VaultDB: Encrypted Database with Split Storage

Executive Summary

VaultDB transforms traditional database storage into a threshold-protected distributed system. Each record is serialized, padded, HMAC-signed, and split via XorIDA threshold sharing across independent storage backends. Reconstruction requires a configurable K-of-N threshold and passes cryptographic integrity verification before returning data.

Three simple operations cover all use cases: put() splits a record and distributes shares across all configured backends. get() fetches shares, reconstructs, verifies HMAC, and returns the original record. delete() removes all shares from every backend. The threshold parameter determines fault tolerance — a 2-of-3 configuration survives any single backend failure or compromise.

No single backend ever holds reconstructible data. Each backend stores exactly one share; threshold cooperation is required to read any record. An attacker who compromises fewer than K backends learns zero information about the original data — not computationally hard to break, but mathematically impossible.

Zero configuration out of the box. Zero npm runtime dependencies. Works with any storage backend implementing the simple StorageBackend interface: S3, Google Cloud Storage, Azure Blob, local filesystem, MinIO, or in-memory for testing.

The Problem

Database breaches are catastrophic single-point failures. One compromised server, one stolen backup, one insider with admin access — and entire tables of sensitive records are exposed. Encryption at rest provides no protection during query execution when the database server must decrypt data to process it.

Traditional encryption at rest fails during operation. AES-256 encryption protects data on disk, but the database server holds the decryption key and processes plaintext in memory. An attacker who gains server access via SQL injection, compromised credentials, or insider threat sees everything.

Database servers are high-value targets. A single PostgreSQL instance, MongoDB cluster, or MySQL server holds complete datasets. The 2017 Equifax breach exposed 147 million complete credit records from a single vulnerability. The 2021 Ubiquiti breach leaked customer data from compromised AWS instances.

Backup theft is a silent attack vector. Database backups often lack the same security controls as production systems. An attacker who steals a backup file gains offline access to decrypt data at leisure without detection.

Multi-region replication multiplies exposure. Read replicas, disaster recovery instances, and analytics databases each create additional copies of sensitive data. Every replica is another potential breach point.

Real-World Use Cases

Six scenarios where VaultDB transforms single-point database storage into threshold-protected distributed systems.

How It Works

VaultDB implements a six-step pipeline for write operations and a five-step reconstruction pipeline for reads. Each step provides cryptographic guarantees.

Write Pipeline (put)

Read Pipeline (get)

Integration

VaultDB provides a minimal API surface: three core operations and a pluggable backend interface. Integration takes less than 50 lines of code.

import { VaultDB, MemoryBackend } from '@private.me/vaultdb';

// Create 3 independent storage backends
const backends = [
  new MemoryBackend('aws', 'AWS S3'),
  new MemoryBackend('gcp', 'Google Cloud'),
  new MemoryBackend('azure', 'Azure Blob'),
];

// 2-of-3: any 2 backends can reconstruct
const db = new VaultDB({ backends, threshold: 2 });

// Store a record -- splits across all 3
await db.put({
  id: 'user-42',
  data: { name: 'Alice', ssn: '***-**-****' }
});

// Retrieve -- reconstructs from threshold shares
const result = await db.get('user-42');
if (result.ok) {
  console.log(result.value.data); // { name: 'Alice', ... }
}

Storage Backend Interface

Implement this 5-method interface to connect any cloud provider or custom storage system:

interface StorageBackend {
  readonly id: string;      // Backend identifier
  readonly name: string;    // Human-readable name

  put(key: string, data: Uint8Array): Promise<void>;
  get(key: string): Promise<Uint8Array | null>;
  delete(key: string): Promise<void>;
  list(): Promise<string[]>;
}

Example: AWS S3 Backend

import { S3Client, PutObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3';
import type { StorageBackend } from '@private.me/vaultdb';

class S3Backend implements StorageBackend {
  readonly id = 'aws-s3';
  readonly name = 'AWS S3 us-west-2';
  private client: S3Client;

  constructor(private bucket: string) {
    this.client = new S3Client({ region: 'us-west-2' });
  }

  async put(key: string, data: Uint8Array): Promise<void> {
    await this.client.send(new PutObjectCommand({
      Bucket: this.bucket,
      Key: key,
      Body: data,
    }));
  }

  async get(key: string): Promise<Uint8Array | null> {
    try {
      const response = await this.client.send(new GetObjectCommand({
        Bucket: this.bucket,
        Key: key,
      }));
      return new Uint8Array(await response.Body.transformToByteArray());
    } catch {
      return null;
    }
  }

  // ... delete, list implementations
}

Security

VaultDB provides information-theoretic security guarantees. An attacker with fewer than K backends learns zero information about any record — not computationally hard, but mathematically impossible.

Threat Model

Cryptographic Guarantees

Security Best Practices

Performance Benchmarks

VaultDB operations complete in milliseconds for typical record sizes. Performance scales linearly with record size and number of backends.

Put Operation (2-of-3 threshold)

Get Operation (2-of-3 threshold)

Honest Limitations

VaultDB is not a full-featured database. It provides secure storage and retrieval, not query engines, indexing, or relational operations.

What VaultDB Does Not Provide

When NOT to Use VaultDB

Storage Backends

VaultDB supports any storage system implementing the simple StorageBackend interface. Production deployments typically use cloud object stores with geographic distribution.

Supported Backend Types

Multi-Cloud Distribution Pattern

import { VaultDB } from '@private.me/vaultdb';
import { S3Backend } from './backends/s3';
import { GCSBackend } from './backends/gcs';
import { AzureBackend } from './backends/azure';

const db = new VaultDB({
  backends: [
    new S3Backend('my-bucket-us-west-2'),
    new GCSBackend('my-bucket-europe-west1'),
    new AzureBackend('my-container-asia-east1'),
  ],
  threshold: 2,
});

// Now any single cloud provider breach exposes zero records

Deployment Patterns

VaultDB works in any JavaScript runtime with Web Crypto API support: Node.js, Deno, Bun, Cloudflare Workers, or browser contexts.

Node.js Server (Recommended)

import express from 'express';
import { VaultDB } from '@private.me/vaultdb';
import { S3Backend, GCSBackend, AzureBackend } from './backends';

const db = new VaultDB({
  backends: [
    new S3Backend(process.env.AWS_BUCKET),
    new GCSBackend(process.env.GCP_BUCKET),
    new AzureBackend(process.env.AZURE_CONTAINER),
  ],
  threshold: 2,
});

const app = express();
app.use(express.json());

app.post('/records', async (req, res) => {
  const result = await db.put(req.body);
  if (result.ok) {
    res.status(201).send({ success: true });
  } else {
    res.status(500).send({ error: result.error });
  }
});

app.get('/records/:id', async (req, res) => {
  const result = await db.get(req.params.id);
  if (result.ok) {
    res.json(result.value);
  } else {
    res.status(404).send({ error: result.error });
  }
});

app.listen(3000);

Cloudflare Workers (Serverless)

import { VaultDB } from '@private.me/vaultdb';
import { R2Backend } from './backends/r2';

export default {
  async fetch(request, env) {
    const db = new VaultDB({
      backends: [
        new R2Backend(env.R2_BUCKET_US),
        new R2Backend(env.R2_BUCKET_EU),
        new R2Backend(env.R2_BUCKET_ASIA),
      ],
      threshold: 2,
    });

    const url = new URL(request.url);
    if (url.pathname.startsWith('/records/')) {
      const id = url.pathname.split('/')[2];
      const result = await db.get(id);
      return Response.json(result);
    }
  }
};

Enterprise Deployment

Enterprise deployments add administrative backends, audit logging, and compliance reporting while maintaining the same security guarantees.

Enterprise Features

Compliance Alignment

Developer Experience

VaultDB uses Result-based error handling and provides detailed error codes for debugging and operational monitoring.

Error Handling

const result = await db.get('user-42');

if (result.ok) {
  console.log('Record:', result.value.data);
} else {
  switch (result.error.code) {
    case 'RECORD_NOT_FOUND':
      console.log('Record does not exist');
      break;
    case 'INSUFFICIENT_SHARES':
      console.error('Not enough backends available');
      break;
    case 'HMAC_FAILED':
      console.error('Data integrity check failed');
      break;
    default:
      console.error('Unexpected error:', result.error);
  }
}

Error Codes