Database System Using Secret-Sharing Fragmentation for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security methods using encryption keys are vulnerable to encryption key leakage, posing a risk to data security.
Innovation Solution
A database system that uses secret-sharing to fragment information into N parts, eliminating the need for encryption keys by distributing these fragments across N different database devices for secure computation and processing, ensuring that only K fragments are required to reconstruct the original data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are used to conceal data in the database, then data security is improved, but the risk of encryption key leakage increases
Solution Approach 1:
The patent applies segmentation by dividing the secret (data or encryption key) into multiple fragments through secret-sharing schemes. Instead of storing a single encryption key, the system splits it into N fragments distributed across different database devices. This eliminates the risk of key leakage because no single fragment reveals the complete key, and the key is never stored in one location.
Solution Approach 2:
The patent introduces secret-sharing as an intermediary mechanism between the data and the storage system. Rather than directly encrypting data with a key stored in the database, the system uses secret-sharing to create fragments that act as intermediaries. These fragments can be combined to reconstruct the original data or key without ever exposing the complete key in the database.
2Reliability
If data is encrypted before storage, then confidentiality is improved, but computational overhead increases
Solution Approach 1:
The patent applies preliminary action by performing secret-sharing on data before it is stored in the database. The data is divided into fragments and distributed across multiple database devices in advance. When queries need to be executed, the system can perform computations on these fragments without needing to decrypt the entire data set, reducing computational overhead during operations.
Solution Approach 2:
By segmenting data into secret-shared fragments before storage, the system enables efficient query processing. Instead of decrypting large amounts of encrypted data for every query, the system can operate on specific fragments or combine only the necessary fragments, significantly reducing computational overhead during data retrieval and processing operations.
3Reliability
If encryption is used to protect data, then data security is improved, but the complexity of data processing operations increases
Solution Approach 1:
The patent simplifies data processing complexity by segmenting data into secret-shared fragments that can be independently processed. Database devices can perform operations on individual fragments or combinations of fragments without needing to handle complete encrypted data sets. This modular approach to data processing reduces the complexity of secure query execution and data manipulation operations.
Solution Approach 2:
The secret-sharing scheme enables database devices to perform self-service operations on encrypted fragments without requiring centralized decryption and re-encryption processes. Each database device can independently process its stored fragments according to query requirements, reducing the overall system complexity and eliminating the need for complex key management infrastructure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A database system comprises a determining part 13 determining whether or not to conceal information to be registered in a database, a terminal device 1 that, if the determining part 13 determines that the information is to be concealed, generates N information fragments by secret-sharing the information and sends the N information fragments to a system management device 2, where N is a predetermined positive integer, the system management device 2 sending the N information fragments received from the terminal device 1 to N different database devices 3, and N database devices 3 each storing one of N information fragments received from the system management device 2.