Cloud database sharding encryption system for cross-border transactions

Abstract

The application relates to the field of cloud database storage encryption, and discloses a cloud database sharding encryption system for cross-border transactions, which comprises a receiving module that acquires transaction data and jurisdiction constraint tags; a logical mapping module that analyzes the tags to determine logical storage coordinates and extracts storage offset parameters from physical storage nodes; a key derivation module that fuses the coordinates, parameters and root key seeds to generate an encryption key through hash operation; and a storage routing module that routes the ciphertext sharding to the physical storage nodes and writes in. The application limits the key derivation factor by using the storage offset parameters, so that the confidentiality state and the physical addressing characteristics form a causal closed loop; on the premise of not introducing external clock synchronization overhead, the encryption parameters and the storage physical state are deeply coupled, the risk of key collision caused by network clock drift is effectively avoided, and the cross-border distributed storage security is improved.

Description

Technical Field

[0001] This invention belongs to the field of cloud database storage encryption technology, and in particular relates to a cloud database sharding encryption system for cross-border transactions. Background Technology

[0002] In current engineering practices, storage systems typically need to perform encrypted disk write-to-disk operations on nodes in different physical regions based on the compliance attributes of the data to be stored, in order to ensure the storage security of sensitive information in a distributed environment. Current common technical solutions generally adopt a centralized key management architecture, in which each physical storage node initiates a network request to a remote key management server to obtain the encryption key before performing the disk write-to-disk operation.

[0003] However, this model relying on external key distribution faces significant technical constraints in cross-border application scenarios. The inherent physical latency of cross-regional links causes key addressing overhead to far exceed the local computation time of storage nodes, affecting the high-concurrency write performance of distributed databases. To alleviate communication latency, one industry improvement is to introduce a key derivation mechanism based on the system clock on the local storage node, using the timestamp of the write time as an auxiliary entropy source to generate dynamic encryption parameters. However, under extreme conditions of distributed systems, this path based on application-layer timing parameters reveals deep architectural flaws. Limited by the unavoidable physical clock drift between distributed nodes, the forced reliance on external protocols to maintain global clock synchronization cannot guarantee the absolute discreteness of the encryption entropy source within the microsecond-level high-concurrency window. When massive transaction requests flood in within a short period of time, the encryption parameters of different data shards will vary. The design logic of relying on external soft parameters for storage confidentiality is prone to collisions, leading to key reuse and data security vulnerabilities. This creates a dimensional gap between the encryption process and the underlying allocation state of the storage medium, constituting the inherent vulnerability of the existing cross-border storage protection system. Existing security solutions focus on algorithm stacking or decentralized architecture. For example, Chinese invention patent application CN120710759A discloses a cloud computing-based method for encrypted transmission and storage of financial data. It adopts a dual-channel encryption engine combined with a distributed key management matrix and uses fully homomorphic encryption and fragmented storage to ensure security. The reconstruction process of this solution relies on blockchain consensus and node feedback, and does not solve the pain point of high latency in long cross-border links. The encryption operator is decoupled from the underlying addressing of the storage, and it cannot perceive the physical characteristics of kernel space allocation. During high-concurrency writes, there are still derivation conflicts caused by missing bindings.

[0004] Therefore, the technical problem to be solved by this invention is how to extract the storage offset parameter at the underlying physical storage node and integrate it with the logical jurisdiction attribute of the data to calculate the encryption key with physical location sensitivity, so as to reduce cross-node addressing latency and avoid distributed concurrent collisions. Summary of the Invention

[0005] This invention aims to solve the problems of high latency in obtaining encryption parameters and the risk of key collisions caused by timing drift under high concurrency in cross-border distributed storage.

[0006] In this technical solution, a cloud database sharding encryption system for cross-border transactions is provided, the system comprising: The receiving module is used to acquire transaction data and the jurisdiction constraint tags associated with the transaction data; The logical mapping module is used to parse the jurisdiction constraint label to determine the logical storage coordinates, and obtain the starting address of the contiguous storage space in the metadata registry of the target physical storage node based on the logical storage coordinates, and determine the starting address of the contiguous storage space as the storage offset parameter. The key derivation module is used to generate fragmented encryption keys through one-way hashing based on logical storage coordinates, storage offset parameters, and a preset root key seed. The encryption module is used to perform symmetric encryption on transaction data using the fragmented encryption key to generate ciphertext data fragments. The storage routing module is used to route encrypted data fragments to target physical storage nodes according to logical storage coordinates, and write encrypted data fragments based on the physical location coordinates of the target physical storage node; The storage offset parameter is used to limit the derivation factor of the fragment encryption key. When the physical addressing characteristics of the target physical storage node do not match the storage offset parameter, the decryption path determined by the encryption module is configured to be logically blocked.

[0007] Preferably, the logical mapping module includes a shard coordinate parsing unit, an attribute overlay unit, and a matrix construction unit; the shard coordinate parsing unit is used to convert jurisdiction constraint labels into shard logical offsets; the attribute overlay unit is used to overlay the jurisdiction attributes of the transaction data with the shard logical offsets bit by bit to generate a composite mapping factor; the matrix construction unit is used to construct a mapping matrix based on the composite mapping factor, which is used to limit the storage space topology of the target physical storage node.

[0008] Preferably, the key derivation module includes a feature extraction unit, a seed fusion unit, and a key calculation unit; the feature extraction unit is used to obtain the hardware feature identifier and storage offset parameter of the target physical storage node; the seed fusion unit is used to perform dimensionality reduction processing on the hardware feature identifier, storage offset parameter, and root key seed to generate a derived root vector; the key calculation unit is used to calculate and generate a fragmented encryption key based on the weight value of the derived root vector and logical storage coordinates.

[0009] Preferably, the storage routing module includes a routing selection unit, a storage verification unit, and a disk write control unit; the routing selection unit is used to retrieve a set of physical nodes that satisfy the jurisdiction constraint label according to the logical storage coordinates; the storage verification unit is used to select a target physical storage node in the set of physical nodes and verify the remaining storage space of the target physical storage node and the size of the encrypted data fragment; the disk write control unit is used to transmit the physical location coordinates of the target physical storage node to the key derivation module.

[0010] Preferably, it also includes an environment sensing module, which is communicatively connected to the storage routing module and is used to monitor the write-ahead sequence and addressing characteristics of the target physical storage node; when the addressing characteristics exceed the preset discrete threshold range, the environment sensing module sends an access interruption command to the storage routing module.

[0011] Preferably, it also includes a random factor generation module, which generates a random perturbation factor based on the storage characteristic noise generated when the transaction data is written to the target physical storage node, and sends the random perturbation factor to the key derivation module so that the generation logic of the fragment encryption key is independent of the external network clock protocol.

[0012] Preferably, it also includes an isolation audit module, which is used to perform storage sovereignty matching verification on the jurisdiction constraint label, logical storage coordinates and physical location coordinates of the target physical storage node.

[0013] Preferably, it also includes a conflict handling module, which is used to allocate independent physical storage addresses to each piece of encrypted data according to the uniqueness of logical storage coordinates when multiple transaction data requests are written concurrently.

[0014] Preferably, it also includes an access blocking module, which blocks the physical addressing path associated with the logical storage coordinates in the target physical storage node when a cross-domain access request is received.

[0015] Compared to existing technologies, the cloud database sharding encryption system for cross-border transactions of this invention has the following advantages: 1. In cloud database sharding encryption for cross-border transactions, the jurisdiction constraint tags in the transaction data are directly converted into logical storage coordinates of physical storage nodes, and used as key factors for generating encryption parameters. This ensures that the storage protection process is completely converged within each physical storage node. Since the derivation logic of encryption parameters no longer depends on the real-time distribution from the remote key management center, the parameter addressing delay caused by transoceanic network transmission in the cross-border data processing flow is eliminated, ensuring high real-time response performance of storage write operations in distributed environments.

[0016] 2. By using the continuous space allocation address at the bottom layer of the storage engine as the auxiliary entropy source of the derivation factor, a deterministic binding between the encryption parameters and the physical write state of the storage medium is established. Since the storage offset is protected by the space mutex lock mechanism in the database kernel and has serial uniqueness, this mechanism can break away from the dependence on the external clock synchronization protocol of the distributed system when dealing with large-scale concurrent transaction requests, eliminate the risk of parameter collision caused by network jitter, and ensure the confidentiality and independence of each encrypted fragment at the physical storage level.

[0017] 3. The logical mapping unit, key derivation unit, and storage routing unit construct a protection system deeply coupled with the jurisdictional topology by superimposing the compliance attributes, physical location coordinates, and underlying pre-written sequences of the data in multiple dimensions. This system forms a closed loop between the confidentiality status of the data and the logical matrix of a specific jurisdiction. When an unexpected physical drift or unauthorized cross-domain access occurs in the storage node, the mismatch between the physical environment characteristics and the derivation factors will cause the resolution mechanism to automatically lock at the physical layer. This enhances the system's ability to enforce data sovereignty isolation across multiple jurisdictions without adding additional defense components. Attached Figure Description

[0018] Figure 1 This is a functional module architecture and parameter interaction diagram of the cloud database sharding encryption system of the present invention; Figure 2 This is the overall structure and encrypted data flow diagram of the cloud database sharding encryption system of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] It should be noted that all directional and positional terms used in this invention, such as: up, down, left, right, front, back, vertical, horizontal, inner, outer, top, bottom, transverse, longitudinal, center, etc., are only used to explain the relative positional relationship and connection between components in a specific state (as shown in the accompanying drawings). They are only for the convenience of describing this invention and do not require that this invention be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention. In addition, the descriptions of "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated.

[0021] In the description of this invention, unless otherwise explicitly specified and limited, the terms installation, connection, and linking should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to the internal connection of two components. For those skilled in the art, the specific meaning of the above terms in this invention can be understood in conjunction with the specific circumstances.

[0022] In the description of this specification, references to the terms "an embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example, and the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0023] A cloud database sharding encryption system for cross-border transactions, the system comprising: The receiving module is used to acquire transaction data and the jurisdiction constraint tags associated with the transaction data; The logical mapping module is used to parse the jurisdiction constraint label to determine the logical storage coordinates, and obtain the starting address of the contiguous storage space in the metadata registry of the target physical storage node based on the logical storage coordinates, and determine the starting address of the contiguous storage space as the storage offset parameter. The key derivation module is used to generate fragmented encryption keys through one-way hashing based on logical storage coordinates, storage offset parameters, and a preset root key seed. The encryption module is used to perform symmetric encryption on transaction data using the fragmented encryption key to generate ciphertext data fragments. The storage routing module is used to route encrypted data fragments to target physical storage nodes according to logical storage coordinates, and write encrypted data fragments based on the physical location coordinates of the target physical storage node; The storage offset parameter is used to limit the derivation factor of the fragment encryption key. When the physical addressing characteristics of the target physical storage node do not match the storage offset parameter, the decryption path determined by the encryption module is configured to be logically blocked.

[0024] Preferably, the logical mapping module includes a shard coordinate parsing unit, an attribute overlay unit, and a matrix construction unit; the shard coordinate parsing unit is used to convert jurisdiction constraint labels into shard logical offsets; the attribute overlay unit is used to overlay the jurisdiction attributes of the transaction data with the shard logical offsets bit by bit to generate a composite mapping factor; the matrix construction unit is used to construct a mapping matrix based on the composite mapping factor, which is used to limit the storage space topology of the target physical storage node.

[0025] Preferably, the key derivation module includes a feature extraction unit, a seed fusion unit, and a key calculation unit; the feature extraction unit is used to obtain the hardware feature identifier and storage offset parameter of the target physical storage node; the seed fusion unit is used to perform dimensionality reduction processing on the hardware feature identifier, storage offset parameter, and root key seed to generate a derived root vector; the key calculation unit is used to calculate and generate a fragmented encryption key based on the weight value of the derived root vector and logical storage coordinates.

[0026] Preferably, the storage routing module includes a routing selection unit, a storage verification unit, and a disk write control unit; the routing selection unit is used to retrieve a set of physical nodes that satisfy the jurisdiction constraint label according to the logical storage coordinates; the storage verification unit is used to select a target physical storage node in the set of physical nodes and verify the remaining storage space of the target physical storage node and the size of the encrypted data fragment; the disk write control unit is used to transmit the physical location coordinates of the target physical storage node to the key derivation module.

[0027] Preferably, it also includes an environment sensing module, which is communicatively connected to the storage routing module and is used to monitor the write-ahead sequence and addressing characteristics of the target physical storage node; when the addressing characteristics exceed the preset discrete threshold range, the environment sensing module sends an access interruption command to the storage routing module.

[0028] Preferably, it also includes a random factor generation module, which generates a random perturbation factor based on the storage characteristic noise generated when the transaction data is written to the target physical storage node, and sends the random perturbation factor to the key derivation module so that the generation logic of the fragment encryption key is independent of the external network clock protocol.

[0029] Preferably, it also includes an isolation audit module, which is used to perform storage sovereignty matching verification on the jurisdiction constraint label, logical storage coordinates and physical location coordinates of the target physical storage node.

[0030] Preferably, it also includes a conflict handling module, which is used to allocate independent physical storage addresses to each piece of encrypted data according to the uniqueness of logical storage coordinates when multiple transaction data requests are written concurrently.

[0031] Preferably, it also includes an access blocking module, which blocks the physical addressing path associated with the logical storage coordinates in the target physical storage node when a cross-domain access request is received.

[0032] Example 1: In a cross-border financial clearing system deployed across multiple jurisdictions globally, when the system processes high-concurrency transaction data with a write rate exceeding 100,000 transactions per second, the receiving module located in jurisdiction A acquires transaction data containing transaction details and the corresponding jurisdiction constraint tag. If the timestamp synchronized by the network time protocol is directly used as the encryption random source, the microsecond-level clock drift caused by the jitter of the transoceanic optical cable physical link will result in overlapping encryption parameters within the concurrent write window, leading to key reuse. To address this technical issue, the logical mapping module determines the logical storage coordinates in a pre-set global node logical matrix based on the jurisdiction constraint tag. and access the logical storage coordinates. Extract the starting address of the currently allocated contiguous storage space from the metadata registry of the corresponding target physical storage node, and determine this starting address as the storage offset parameter. The key derivation module obtains the preset root key seed. And store the logical coordinates Storage offset parameter and root key seed As a derived input parameter, a one-way hash operation is performed to generate a fragmented encryption key. .

[0033] The formula for one-way hashing is as follows: ,in, Logically store coordinate weight values. For the fragment encryption key, Logical storage coordinates, To store the offset parameter, As the root key seed, It is a one-way hash function. The XOR operator is used by the encryption module to implement the fragmented encryption key. The transaction data is symmetrically encrypted and fragmented into ciphertext data. The storage routing module then stores the coordinates according to the logical storage. The encrypted data fragments are routed to the target physical storage node deployed in jurisdiction B, and the physical location coordinates of the target physical storage node are written into the encrypted data fragments along with the associated storage offset parameters. .

[0034] During the data routing operation performed by the storage routing module, the system calls the physical addressing operator to store the logical coordinates. This is converted to the bus address and logical unit number (LUN) of the corresponding physical storage node. The driver for that physical storage node then determines the physical slot, head number, and track offset according to the storage control protocol to construct the physical placement coordinates. The storage control driver instructs the storage controller to modulate the data write current to the media sector indicated by the physical placement coordinates, in conjunction with the storage offset parameter. The encrypted data fragments are written to disk using a defined physical address. During this process, the storage offset parameter is protected by the storage engine kernel space mutex mechanism. It possesses serial uniqueness, ensuring a deterministic correlation between each encryption key generation action and the physical allocation state of the storage medium, due to the storage offset parameter. The system monotonically evolves with the sequence of writes to the storage space. It can generate discrete encryption parameters in the local computing environment without initiating cross-regional network requests to a remote key center. This eliminates parameter collisions caused by clock drift in extremely short concurrent time, ensuring the confidentiality and independence of cross-border transaction data in the distributed storage architecture. For cases where the physical addressing characteristics and derivation factors do not match, the logical blocking mechanism of the decryption path is specifically manifested as follows: When the system receives a read command, the kernel driver engine will synchronously compare the actual location coordinate characteristics currently fed back by the underlying media controller with the original storage offset parameters associated with the requested data block. Once a difference is found between the two due to illegal mirror transfer or cross-domain tampering, the hardware register will throw a non-maskable interrupt, forcibly stopping the transmission of the root key seed to the bus decryption module, and resetting the initialization state machine of the hardware cryptographic acceleration engine, thereby blocking the plaintext inversion process at the lowest level of the physical link.

[0035] Example 2: In a cloud database simulation test system consisting of 20 distributed storage nodes, to address the encryption parameter conflict problem caused by clock asynchrony under high-concurrency write conditions for cross-border transaction data, a simulated dataset containing 1,000,000 financial transaction records was selected as the original input. The simulation environment adopted a discrete event-driven modeling approach to simulate a cross-regional network environment. The one-way network latency of the transoceanic link was set within the range of 10ms to 200ms, and parameters with a mean of 0 and a standard deviation of 20 were actively injected. The clock drift noise of s is sampled with a period of 1ms, which is determined based on the pre-calibration of the database kernel mutex holding time. This is intended to ensure that the sampling accuracy covers the internal timing of memory allocation operations, in order to verify the memory offset parameter. With fragmented encryption key The deterministic mapping relationship between them was compared with the sample group which used encryption factors generated based on the system's local clock, and the experimental group which used logically stored coordinates. With storage offset parameter In the coupled approach, when the system write load increases from 10,000 transactions per second to 100,000 transactions per second, the external time synchronization protocol relied upon by the comparison group cannot achieve microsecond-level consistency in a cross-regional environment. This leads to multiple physical storage nodes generating duplicate encryption parameters within the same time window, causing the measured key collision rate to increase from 0.008% to 0.124%, showing an increasing trend with increasing concurrency density. In contrast, the experimental group utilizes the storage offset parameter generated by the storage engine kernel space mutex mechanism. Since the storage offset evolves monotonically with physical write operations, its key collision rate remains constant at 0% under full load testing.

[0036] Under extreme load conditions with 500,000 concurrent requests per second and network jitter increasing to 200ms, the logical mapping module directly accesses the starting address of the contiguous storage space of the metadata registry in the target physical storage node. Based on the principle of lock-free concurrent programming atomic operations and the underlying block device append write mechanism, a local offset buffer pool is pre-built in memory. The logical mapping module calls the processor's built-in compare and exchange atomic instructions to non-blockingly extract continuous values ​​from the local offset buffer pool and allocate them to the current concurrent write thread. As a hardware-level support mechanism, this local offset buffer pool actually resides in the bearer. The logical mapping module, residing in the L1 or L2 processor cache of the local computing node, acts as an addressing state proxy for the remote target node. Therefore, the processing path for comparing and exchanging atomic instructions is limited to the memory controller bus of the current single-machine motherboard, without involving any cross-WAN packet encapsulation or transmission. This ensures that the atomicity of the micro-instruction cycle is not compromised by the distance of the macro-network topology. When the available margin in the local offset buffer pool falls below 10% of the total capacity, the control driver requests new logical physical block address ranges from the underlying physical media in batches to supplement them. Using this buffer prefetching and atomic fetching procedure, the offset parameters are stored. As the storage space allocation sequence monotonically increases from 0x00001000 to 0x0008F000, the key derivation module obtains the root key seed. The above parameters are then used as input to calculate the fragment encryption key. The calculation formula is as follows: ,in, Logically store coordinate weight values. For the fragment encryption key, Logical storage coordinates, To store the offset parameter, As the root key seed, It uses one-way hash logic. The XOR operator, as demonstrated by experimental data, generates globally unique fragment encryption keys under the aforementioned conditions. The generated key entropy value is stable at 256 bits and is not affected by cross-regional clock offset noise. The experimental results show the effectiveness of using the underlying physical allocation state of the storage medium as an encryption factor. This mechanism binds the encryption logic with the serial allocation action of the storage space, eliminates the dependence of the distributed database on the external global clock consensus, and forms a closed-loop mapping between the security protection state of cross-border transaction data and the physical distribution characteristics of the jurisdiction topology. While ensuring the high-concurrency writing performance of massive data, it eliminates the parameter collision problem of traditional sharding encryption methods in cross-border network environments, and achieves deep coupling between storage confidentiality and physical location characteristics.

[0037] Example 3: In a cloud database sharded cluster deployed across three independent jurisdictions, the logical mapping module pre-builds a dimension of... The global node logical matrix, in which, For the number of indexes in the jurisdiction, The number of logical shard groups under each jurisdiction is specified. When the receiving module obtains transaction data containing transaction details and the corresponding jurisdiction constraint tags, the logical mapping module inputs the jurisdiction constraint tags into a preset mapping function. This mapping function determines the row vector of the global node logical matrix by searching the correspondence table between jurisdiction codes and matrix row indices, performs a modulo operation based on the business serial number of the transaction data to obtain the column index, and outputs the logical storage coordinates. In engineering deployments that include multiple geographically partitioned storage groups, the logical mapping module uses a preset tag parsing protocol to extract the administrative region code contained in the jurisdiction constraint tag, compares it with the static mapping rule table stored in local memory, and determines the matrix row index corresponding to the administrative region code. Calculate its logical shard group number based on the transaction data serial number. The column index below The final output is determined by row index. With column index Logical storage coordinates .

[0038] The logical mapping module stores coordinates according to logic. The system accesses the metadata registry of the target physical storage node and sends an address space query command to the storage control driver of that node. The storage control driver responds by triggering a mutex mechanism in the kernel space to lock the allocation sequence number register of the current physical sector, retrieves the starting address of the contiguous storage space to be used for the write operation recorded in that register, and determines this hexadecimal value as the storage offset parameter. Storage offset parameter The bit width is set to 64 bits to match the addressing length of the physical storage medium and to ensure that no numerical overflow occurs when the data size reaches the TB level.

[0039] The logical storage coordinates obtained by the key derivation module Storage offset parameter and root key seed with a bit width of 256 bits. Bit-by-bit concatenation is implemented, incorporating hash folding principles and a topological distance weighted model as convergence parameters. The feature extraction unit collects the 512-bit Media Access Control address of the target physical storage node as a hardware feature identifier. The seed fusion unit divides the binary sequence of the hardware feature identifier into two 256-bit data segments and performs a bitwise XOR operation to reduce dimensionality. The dimensionality reduction output is multiplied by the root key seed to generate a derived root vector. The key calculation unit calculates the number of hops across the core router from the target physical storage node to the master node, extracts the ratio of the hop count to the network hop count extreme value of 255 to determine the logical storage coordinate weight value, and uses the weight value to perform operations on the logical storage coordinates. In this scalar product calculation, the network hop count extreme value of 255, used as the scaling benchmark, is adopted from the maximum eight-bit binary value of the Time-to-Live (TTL) field in the IPv4 packet header. Using this uniform physical routing limit value across the entire network as a constant denominator ensures that the relative routing distances of target nodes across different geographical spans are dimensionlessly mapped to deterministic floating-point coefficients between 0 and 1. This provides a robust and physically consistent reference system for subsequent calculations of heterogeneous jurisdiction network weights. After the above feature reconstruction and parameter fusion, the resulting concatenated data is input into a one-way hash function conforming to the SM3 standard to calculate the fragmentation encryption key. Fragmented encryption key The calculation formula is as follows: ,in, Logical storage of coordinate weight values For the fragment encryption key, Logical storage coordinates, To store the offset parameter, As the root key seed, It uses one-way hash logic. The bit concatenation operator calculates a 256-bit hash value, which is then used as the fragment encryption key. The encryption module calls the 256-bit encryption link of the Advanced Encryption Standard algorithm, utilizing fragmented encryption keys. The transaction data is symmetrically encrypted and fragmented into ciphertext data. When the system is in concurrent write mode, the storage offset parameter is... The evolution of the storage offset parameter is consistent with the database allocation unit Page Size. With the Page Size set to 16KB, the storage offset parameter... With the allocation sequence monotonically increasing from 16384, this storage offset parameter, generated by the underlying allocation sequence of the storage engine, possesses serial uniqueness. This binds each key derivation action to the physical address characteristics where the data is stored. Even under extremely high concurrent loads, the system generates discrete encryption factors through local memory operations, eliminating parameter acquisition latency caused by cross-regional network addressing and avoiding key collision risks caused by clock skew. Cross-border transaction data achieves deep coupling of storage encryption protection with the jurisdictional topology without relying on external clock synchronization. In conjunction with the above isolation requirements, the daemon process running in the system background is responsible for executing the specific storage sovereignty matching verification process. During verification, the processor extracts the plaintext of the jurisdictional constraint label contained in the header of the encrypted data fragment and performs a hash collision comparison with the unique regional identification code burned in the underlying storage motherboard firmware. If the verification hash value generated by the collision is inconsistent with the compliance signature certificate pre-issued by the system to the jurisdiction, the system will directly discard subsequent data communication requests at the seventh layer of the network protocol stack. This achieves deterministic sovereignty matching verification through cryptographic verification of hardware and software attributes.

[0040] Example 4: In the initial deployment environment of a cross-border cloud database cluster, the logical mapping module sends heartbeat packets to each physical storage node to obtain the network round-trip latency of each physical storage node. Based on the jurisdiction constraint label, physical storage nodes within the same jurisdiction are divided into independent groups to be allocated, and within each group, allocation is based on network round-trip latency. The values ​​are sorted in ascending order, and a unique logical fragment group number is assigned to each physical storage node in turn. This completes the process, including physical location coordinates and the index of the jurisdiction to which the location belongs. With logical fragment group number Initialization and construction of the global node logical matrix of the correspondence.

[0041] In the storage engine initialization procedure, the system uses a true random number generator within the trusted computing environment to generate a 256-bit root key seed. The root key seed is transmitted through a secure channel with a two-way authentication mechanism. The hardware isolation environment embedded in each physical storage node allows the key derivation module to instruct the storage engine to allocate an initial physical storage page before receiving a transaction write instruction, and to read the physical starting offset of that physical storage page in the current volume group to determine the storage offset parameter. initial state quantity The initial state quantity The determination logic follows the formula ,in, These are the initial state variables. To allocate the starting physical address of the sequence, the system completes the initial state variables. After calibration, the system transitions to a business-ready state, ensuring that the key derivation module has a consistent physical addressing reference in subsequent operations.

[0042] Example 5: In a scenario where distributed cloud database nodes are expanded and the global node logical matrix needs to be dynamically reconstructed, the logical mapping module executes a pre-calibration procedure. It obtains response message timestamps by sending 100 sets of payload packets conforming to the probe protocol to each newly added physical storage node. A sliding window averaging method is used to remove outliers deviating more than 30% from the median, and the processed time average is calculated. This time average is then determined as the network round-trip time. For physical storage nodes with overlapping latency characteristics, the system calls the node load rate parameter. As a secondary sorting factor, it is used to establish the physical placement and logical segmentation group numbering. The non-conflict mapping relationship between them, the dimension of the global node logical matrix is ​​synchronized with the number of currently accessed jurisdictions, and the logical shard group number. Upper limit of values According to the formula Calculate, where, This represents the upper limit of the logical shard group number. This represents the total physical storage capacity within the jurisdiction. As the baseline size for data fragmentation, This is the floor operator.

[0043] In the hardware driver layer alignment process before ciphertext data is fragmented and written to disk, the storage routing module detects the total length of the transaction data. ,when When the block size does not match the 128-bit block size defined by the Advanced Encryption Standard (AES) algorithm, the system pads the data end with a pseudo-random bitstream to the alignment length. The logical mapping module sends a status read instruction to the controller register of the physical storage node, retrieves the logical physical block address (LBA) of the current allocation sequence, and converts this address parameter into a storage offset parameter. This conversion logic follows the formula... ,in, For storing offset parameters, LBA stands for logical physical block address. In this embodiment, the sector size is in bytes. Set to 512, based on the physical drift characteristics of the read / write cycle of semiconductor flash memory cells, the random factor generation module synchronously acquires the analog voltage waveform written along the drive pin of the storage controller, filters out the DC bias signal of the voltage waveform, and extracts high-frequency jitter components with frequencies higher than 100MHz as storage characteristic noise. After the characteristic noise is quantized into a discrete sequence by the built-in analog-to-digital converter circuit, the least significant bits of the data at each sampling point are extracted and concatenated into a bit stream. A von Neumann debiasing algorithm is applied to the bit stream to filter out statistical biases caused by continuous same-polarity levels, outputting a random perturbation factor with uniform dispersion. The key derivation module then uses this real-time acquired data... The system inputs a one-way hash function to calculate the dynamic check value of the current data block, and writes the encrypted ciphertext data fragments and the dynamic check value synchronously to the target physical storage page. This enables the physical address characteristics of the storage space allocation and the encryption operator to achieve hardware-level binding within the instruction execution cycle. In this environmental perception and monitoring process, in order to quantitatively judge abnormal conditions, the limit of the preset discrete threshold range is derived by combining the factory nominal read and write tolerance of the flash memory chips used by the target physical storage node through a normal distribution function. The system establishes a threshold boundary with a 15% fluctuation around the baseline value of the nominal physical addressing response time. When the actual addressing delay exceeds the normal distribution fluctuation boundary multiple times due to excessive wear of the solid medium, circuit aging, or interference from external malicious magnetic fields, the system determines that the addressing characteristics have abnormally diverged.

[0044] The embodiments of this application have been described above with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit of this application and the scope of protection of this invention, and all of these forms are within the protection scope of this application.

Claims

1. A cloud database sharding encryption system for cross-border transactions, characterized in that, The system includes: The receiving module is used to acquire transaction data and jurisdiction constraint tags associated with the transaction data; The logical mapping module is used to parse the jurisdiction constraint label to determine the logical storage coordinates, and obtain the starting address of the contiguous storage space in the metadata registry of the target physical storage node based on the logical storage coordinates, and determine the starting address of the contiguous storage space as the storage offset parameter. The key derivation module is used to generate fragmented encryption keys through one-way hashing based on logical storage coordinates, storage offset parameters, and a preset root key seed. The encryption module is used to perform symmetric encryption on transaction data using the fragmented encryption key to generate ciphertext data fragments. The storage routing module is used to route encrypted data fragments to target physical storage nodes according to logical storage coordinates, and write encrypted data fragments based on the physical location coordinates of the target physical storage nodes; The storage offset parameter is used to limit the derivation factor of the fragment encryption key. When the physical addressing characteristics of the target physical storage node do not match the storage offset parameter, the decryption path determined by the encryption module is configured to be logically blocked.

2. The cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, The logical mapping module includes a shard coordinate parsing unit, an attribute overlay unit, and a matrix construction unit. The shard coordinate parsing unit is used to convert jurisdiction constraint labels into shard logical offsets. The attribute overlay unit is used to overlay the jurisdiction attributes of the transaction data with the shard logical offsets bit by bit to generate a composite mapping factor. The matrix construction unit is used to construct a mapping matrix based on the composite mapping factor, which is used to limit the storage space topology of the target physical storage node.

3. The cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, The key derivation module includes a feature extraction unit, a seed fusion unit, and a key calculation unit. The feature extraction unit is used to obtain the hardware feature identifier and storage offset parameter of the target physical storage node. The seed fusion unit is used to perform dimensionality reduction processing on the hardware feature identifier, storage offset parameter, and root key seed to generate a derived root vector. The key calculation unit is used to calculate and generate a fragmented encryption key based on the derived root vector and the weight value of the logical storage coordinates.

4. A cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, The storage routing module includes a routing selection unit, a storage verification unit, and a disk write control unit. The routing selection unit is used to retrieve a set of physical nodes that satisfy the jurisdiction constraint label based on the logical storage coordinates. The storage verification unit is used to select the target physical storage node in the set of physical nodes and verify the remaining storage space of the target physical storage node and the size of the encrypted data fragment. The disk write control unit is used to transmit the physical location coordinates of the target physical storage node to the key derivation module.

5. A cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, It also includes an environment awareness module, which is connected to the storage routing module to monitor the write-ahead sequence and addressing characteristics of the target physical storage node; when the addressing characteristics exceed the preset discrete threshold range, the environment awareness module sends an access interruption command to the storage routing module.

6. A cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, It also includes a random factor generation module, which generates a random perturbation factor based on the storage characteristic noise generated when transaction data is written to the target physical storage node, and sends the random perturbation factor to the key derivation module so that the generation logic of the fragment encryption key is independent of the external network clock protocol.

7. A cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, It also includes an isolation audit module, which is used to verify the storage sovereignty matching of jurisdiction constraint labels, logical storage coordinates, and physical location coordinates of target physical storage nodes.

8. A cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, It also includes a conflict handling module, which allocates independent physical storage addresses to each ciphertext data fragment based on the uniqueness of the logical storage coordinates when multiple transaction data requests are written concurrently.

9. A cloud database sharding encryption system for cross-border transactions according to claim 1, characterized in that, It also includes an access blocking module, which blocks the physical addressing path associated with the logical storage coordinates in the target physical storage node when a cross-domain access request is received.

Images