Outsourced Databases Research Articles

Prism: Privacy-Preserving and Verifiable Set Computation Over Multi-Owner Secret Shared Outsourced Databases

Private set computation over multi-owner databases is an important problem with many applications — the most well studied of which is private set intersection (PSI). This paper proposes <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prism</small> , a secret-sharing based approach to compute private set operations ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i.e.</i> , intersection and union, as well as aggregates such as count, sum, average, maximum, minimum, and median) over outsourced databases belonging to multiple owners. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prism</small> enables data owners to pre-load the data onto non-colluding servers and exploits the additive and multiplicative properties of secret-shares to compute the above-listed operations. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prism</small> takes (at most) two rounds of communication between non-colluding servers (storing the secret-shares) and the querier for executing the above-mentioned operations, resulting in a very efficient implementation. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prism</small> also supports result verification techniques for each operation to detect malicious adversaries. Experimental results show that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prism</small> scales both in terms of the number of data owners and database sizes, to which prior approaches do not scale.

BopSkyline: Boosting privacy-preserving skyline query service in the cloud

With the widespread adoption of cloud computing, there has been great popularity of storing and querying databases in the cloud. However, such service outsourcing also entails critical data privacy concerns, as the cloud providers are generally not in the same trust domain as the data owners/users and could even suffer from data breaches. In this paper, different from most existing works that propose security designs for keyword search, we focus on secure realizations of advanced skyline query processing, which plays an important role in multi-criteria decision support applications. We propose BopSkyline, a new system framework for privacy-preserving skyline query service in cloud computing. BopSkyline is designed to not only ensure the confidentiality of outsourced databases, skyline queries, and query results, but also conceal data patterns (like the dominance relationships among database tuples) and search access patterns that may indirectly lead to data leakages. Notably, through a delicate synergy of key ideas on secure database shuffling and differentially private database padding, BopSkyline achieves a significant performance boost over the state-of-the-art. Extensive experiments demonstrate that compared with the state-of-the-art prior work, BopSkyline is up to 4.7× better in query latency and achieves up to 99.38% cost savings in communication.

A Parallel Privacy-Preserving k-Means Clustering Algorithm for Encrypted Databases in Cloud Computing

With the development of cloud computing, interest in database outsourcing has recently increased. However, when the database is outsourced, there is a problem in that the information of the data owner is exposed to internal and external attackers. Therefore, in this paper, we propose decimal-based encryption operation protocols that support privacy preservation. The proposed protocols improve the operational efficiency compared with binary-based encryption operation protocols by eliminating the need for repetitive operations based on bit length. In addition, we propose a privacy-preserving k-means clustering algorithm using decimal-based encryption operation protocols. The proposed k-means clustering algorithm utilizes efficient decimal-based protocols that enhance the efficiency of the encryption operations. To provide high query processing performance, we also propose a parallel k-means clustering algorithm that supports thread-based parallel processing by using a random value pool. Meanwhile, a security analysis of both the proposed k-means clustering algorithm and the proposed parallel algorithm was performed to prove their data protection, query protection, and access pattern protection capabilities. Through our performance analysis, the proposed k-means clustering algorithm shows about 10~13 times better performance compared with the existing algorithms.

VeriTxn: Verifiable Transactions for Cloud-Native Databases with Storage Disaggregation

Cloud-native databases become increasingly popular while exposing to greater data security and correctness risks. Existing verifiable outsourced databases overlook either the correctness risk of transactions, or the disaggregation architecture: a key design consideration of cloud-native databases for performance and elasticity, or both. We present VeriTxn, a novel cloud-native database that efficiently provides verifiability of transaction correctness. VeriTxn relies on the trusted hardware (i.e., Intel SGX) to enable verifiable transaction processing. We build a page-structure cache in the trusted domain, where transactions can be verified with low, constant overhead. VeriTxn further optimizes the read-only transactions by exploiting disaggregation to fit the read-heavy workload in the cloud. We also integrate our proposal into MySQL, a popular open-source database. We conduct extensive experiments to compare VeriTxn against state-of-the-art verifiable databases and evaluate the performance of VeriTxn on MySQL. The results show that VeriTxn introduces tolerable performance degradation for verifiable transactions, while achieving up to 7.03× and 7.93× higher throughput than Litmus and LedgerDB, and its sustainable performance when integrated with MySQL.

Integrity coded databases - protecting data integrity for outsourced databases

In recent years, cloud storage has become a viable option for businesses to store and retrieve information. This storage service allows its clients releasing from financial burden of hiring professionals to maintain local databases. However, it comes at a cost of requiring the clients to relinquish control of their data to cloud service providers. There remains the possibility of malicious attacks to make the data no longer correct, fresh nor complete. This paper presents a novel database model called the Integrity Coded Database (ICDB), where the model allows the client to insert Integrity Codes (ICs), as well as fake tuples, to an outsourced database, run queries against the server, and verify that the queried data from the cloud is both correct, fresh and complete. We have benchmarked and evaluated six ICDB schemes with different combinations of three IC generation algorithms and two integrity verification modes.

SecSkyline: Fast Privacy-Preserving Skyline Queries Over Encrypted Cloud Databases

The well-known benefits of cloud computing have spurred the popularity of database service outsourcing, where one can resort to the cloud to conveniently store and query databases. Coming with such popular trend is the threat to data privacy, as the cloud gains access to the databases and queries which may contain sensitive information, like medical or financial data. A large body of work has been presented for querying encrypted databases, which has been mostly focused on secure keyword search. In this paper, we instead focus on the support for secure skyline query processing over encrypted outsourced databases, where little work has been done. Skyline query is an advanced kind of database query which is important for multi-criteria decision-making systems and applications. We propose SecSkyline, a new system framework building on lightweight cryptography for fast privacy-preserving skyline queries. SecSkyline ambitiously provides strong protection for not only the content confidentiality of the outsourced database, the query, and the result, but also for data patterns that may incur indirect data leakages, such as dominance relationships among data points and search access patterns. Extensive experiments demonstrate that SecSkyline is substantially superior to the state-of-the-art in query latency, with up to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$813\times$</tex-math></inline-formula> improvement.

Toward Efficient Homomorphic Encryption for Outsourced Databases through Parallel Caching

Many applications deployed to public clouds are concerned about the confidentiality of their outsourced data, such as financial services and electronic patient records. A plausible solution to this problem is homomorphic encryption (HE), which supports certain algebraic operations directly over the ciphertexts. The downside of HE schemes is their significant, if not prohibitive, performance overhead for data-intensive workloads that are very common for outsourced databases, or database-as-a-serve in cloud computing. The objective of this work is to mitigate the performance overhead incurred by the HE module in outsourced databases. To that end, this paper proposes a radix-based parallel caching optimization for accelerating the performance of homomorphic encryption (HE) of outsourced databases in cloud computing. The key insight of the proposed optimization is caching selected radix-ciphertexts in parallel without violating existing security guarantees of the primitive/base HE scheme. We design the radix HE algorithm and apply it to both batch- and incremental-HE schemes; we demonstrate the security of those radix-based HE schemes by showing that the problem of breaking them can be reduced to the problem of breaking their base HE schemes that are known IND-CPA (i.e. Indistinguishability under Chosen-Plaintext Attack). We implement the radix-based schemes as middleware of a 10-node Cassandra cluster on CloudLab; experiments on six workloads show that the proposed caching can boost state-of-the-art HE schemes, such as Paillier and Symmetria, by up to five orders of magnitude.

Research on the Game Mechanism of Rational Outsourcing Database

While outsourcing databases are widely used, their security is also facing great challenges. In order to reduce the validation and communication overheads of outsourcing solutions, this paper designs a game mechanism for rational outsourcing databases based on game theory, setting incentives and defining a payoff matrix to ensure that each rational participant will only maintain an honest strategy so as not to contradict the self-interest nature and achieve a Nash equilibrium. Finally, through simulation experiments, this paper proves that the use of utility functions to secure data can reduce the user's verification overhead and communication overhead, which has important research value.

Privacy-Preserving Top-k Query Processing Algorithms Using Efficient Secure Protocols over Encrypted Database in Cloud Computing Environment

Recently, studies on secure database outsourcing have been highlighted for the cloud computing environment. A few secure Top-k query processing algorithms have been proposed in the encrypted database. However, the previous algorithms can support either security or efficiency. Therefore, we propose a new Top-k query processing algorithm using a homomorphic cryptosystem, which can support both security and efficiency. For security, we propose new secure and efficient protocols based on arithmetic operations. To obtain a high level of efficiency, we also propose a parallel Top-k query processing algorithm using an encrypted random value pool. Through our performance analysis, the proposed Top-k algorithms present about 1.5∼7.1 times better performance with regard to a query processing time, compared with the existing algorithms.

Secure aggregate signature scheme for smart city applications

With the recent advances in technology, smart cities are rapidly earning momentum. To provide better lives, smart cities should host several applications to increase the efficiency and accessibility of services. Since these services involve the conveyance of significant data among the smart cities’ cloud and the dwellers over the Internet, security and privacy are critical. This paper proposes an authentication protocol with a full aggregation signature to secure the smart city applications. A certificate-less aggregate signature (CLAS) is used for smart city real applications such as secure routing and database outsourcing. The proposed CLAS achieves message authentication, user anonymity, constant signature size, unlinkability, and is resistant to replay attacks. Also, we have proved that the proposed scheme is resistant to all malicious adversaries. Finally, the performance evaluation results show that the proposed CLAS performs better than existing relevant schemes.

Evaluation of Hazards and Operability Study for Optimization Operation of Industrial Processes

With the recent advances in technology, smart cities are rapidly earning momentum thanks to the quality of citizens' life that smart cities help improve. To provide better lives, smart cities should host several applications to increase the efficiency and accessibility of services. Since these services involve the conveyance of significant data among the smart cities' cloud and the dwellers over the Internet, security and privacy are critical. This paper proposes an authentication protocol with a full aggregation signature to secure the smart city applications. A certificateless aggregate signature (CLAS) is used for smart city real applications such as secure routing and database outsourcing. The proposed CLAS achieves message authentication, user anonymity, constant signature size, unlinkability, and is resistant to replay attacks. Also, we have proved that the proposed scheme is resistant to all malicious adversaries. Finally, the performance evaluation results show that the proposed CLAS performs better than existing relevant schemes.

Privacy-preserving parallel kNN classification algorithm using index-based filtering in cloud computing.

With the development of cloud computing, interest in database outsourcing has recently increased. In cloud computing, it is necessary to protect the sensitive information of data owners and authorized users. For this, data mining techniques over encrypted data have been studied to protect the original database, user queries and data access patterns. The typical data mining technique is kNN classification which is widely used for data analysis and artificial intelligence. However, existing works do not provide a sufficient level of efficiency for a large amount of encrypted data. To solve this problem, in this paper, we propose a privacy-preserving parallel kNN classification algorithm. To reduce the computation cost for encryption, we propose an improved secure protocol by using an encrypted random value pool. To reduce the query processing time, we not only design a parallel algorithm, but also adopt a garbled circuit. In addition, the security analysis of the proposed algorithm is performed to prove its data protection, query protection, and access pattern protection. Through our performance evaluation, the proposed algorithm shows about 2∼25 times better performance compared with existing algorithms.

Privacy-preserving kNN query processing algorithms via secure two-party computation over encrypted database in cloud computing

Since studies on privacy-preserving database outsourcing have been spotlighted in a cloud computing, databases need to be encrypted before being outsourced to the cloud. Therefore, a couple of privacy-preserving kNN query processing algorithms have been proposed over the encrypted database. However, the existing algorithms are either insecure or inefficient. Therefore, in this paper we propose a privacy-preserving kNN query processing algorithm via secure two-party computation on the encrypted database. Our algorithm preserves both data privacy and query privacy while hiding data access patterns. For this, we propose efficient and secure protocols based on Yao’s garbled circuit. To achieve a high degree of efficiency in query processing, we also propose a parallel kNN query processing algorithm using encrypted random value pool. Through our performance analysis, we verify that our proposed algorithms outperform the existing ones in terms of a query processing cost.

ConcurDB: Concurrent Query Authentication for Outsourced Databases

Clients of outsourced databases need Query Authentication (QA) guaranteeing the integrity and authenticity of query results returned by potentially compromised providers. Prior work provides QA assurances for a limited class of queries by deploying several software-based cryptographic constructs. The constructs are often designed assuming read-only or infrequently updated databases. For dynamic datasets, the data owner is required to perform all updates on behalf of clients. Hence, for concurrent updates by multiple clients, such as for OLTP workloads, existing QA solutions are inefficient. We present ConcurDB, a concurrent QA scheme that enables simultaneous updates by multiple clients. To realize concurrent QA, we have designed several new mechanisms. First, we identify and use an important relationship between QA and memory checking to decouple query execution and verification. We allow clients to execute transactions concurrently and perform verifications in parallel using an offline memory checking based protocol. Then, to extend QA to a multi-client scenario, we design new protocols that enable clients to securely exchange a small set of authentication data even when using the untrusted provider as a communication hub. Finally, we overcome provider-side replay attacks. Using ConcurDB, we provide and evaluate concurrent QA for the full TPC-C benchmark. For updates, ConcurDB shows a 4x performance increase over existing solutions.

Distributed Memetic Algorithm for Outsourced Database Fragmentation.

Data privacy and utility are two essential requirements in outsourced data storage. Traditional techniques for sensitive data protection, such as data encryption, affect the efficiency of data query and evaluation. By splitting attributes of sensitive associations, database fragmentation techniques can help protect data privacy and improve data utility. In this article, a distributed memetic algorithm (DMA) is proposed for enhancing database privacy and utility. A balanced best random distributed framework is designed to achieve high optimization efficiency. In order to enhance global search, a dynamic grouping recombination operator is proposed to aggregate and utilize evolutionary elements; two mutation operators, namely, merge and split, are designed to help arrange and create evolutionary elements; a two-dimension selection approach is designed based on the priority of privacy and utility. Furthermore, a splicing-driven local search strategy is embedded to introduce rare utility elements without violating constraints. Extensive experiments are carried out to verify the performance of the proposed DMA. Furthermore, the effectiveness of the proposed distributed framework and novel operators is verified.

Authenticated Outlier Mining for Outsourced Databases

The Data-Mining-as-a-Service (DMaS) paradigm is becoming the focus of research, as it allows the data owner (client) who lacks expertise and/or computational resources to outsource their data and mining needs to a third-party service provider (server). Outsourcing, however, raises some issues about result integrity: how could the client verify the mining results returned by the server are both sound and complete? In this paper, we focus on outlier mining, an important mining task. Previous verification techniques use an authenticated data structure (ADS) for correctness authentication, which may incur much space and communication cost. In this paper, we propose a novel solution that returns a probabilistic result integrity guarantee with much cheaper verification cost. The key idea is to insert a set of artificial records (ARs) into the dataset, from which it constructs a set of artificial outliers (AOs) and artificial non-outliers (ANOs). The AOs and ANOs are used by the client to detect any incomplete and/or incorrect mining results with a probabilistic guarantee. The main challenge that we address is how to construct ARs so that they do not change the (non-)outlierness of original records, while guaranteeing that the client can identify ANOs and AOs without executing mining. Furthermore, we build a strategic game and show that a Nash equilibrium exists only when the server returns correct outliers. Our implementation and experiments demonstrate that our verification solution is efficient and lightweight.

Secrecy and performance models for query processing on outsourced graph data

Database outsourcing is a challenge concerning data secrecy. Even if an adversary, including the service provider, accesses the data, she should not be able to learn any information from the accessed data. In this paper, we address this problem for graph-structured data. First, we define a secrecy notion for graph-structured data based on the concepts of indistinguishability and searchable encryption. To address this problem, we propose an approach based on bucketization. Next to bucketization, it makes use of obfuscated indexes and encryption. We show that finding an optimal bucketization tailored to graph-structured data is NP-hard; therefore, we come up with a heuristic. We prove that the proposed bucketization approach fulfills our secrecy notion. In addition, we present a performance model for scale-free networks which consists of (1) a number-of-buckets model that estimates the number of buckets obtained after applying our bucketization approach and (2) a query-cost model. Finally, we demonstrate with a set of experiments the accuracy of our number-of-buckets model and the efficiency of our approach with respect to query processing.

A Multivariate Public Key Encryption Scheme With Equality Test

The public key encryption with equality test (PKEET) allows the cloud server to judge whether two different ciphertexts are generated by the same message without decryption. Through this technique, PKEET provides an effective solution for building secure outsourced databases, and has made some rich achievements. This paper combines multivariate public key encryption and equality test, and proposes the first multivariate public key encryption scheme with equality test (MPKEET), which inherits the advantages of both primitives. Moreover, the equality test algorithm proposed in this paper is based on a straight line. Compared with the schemes based on bilinear pairing, it is simpler and easier to implement. And our MPKEET scheme achieves desirable security, which can resist linearization equation attacks, differential attacks, XL attacks, Grobner basis attacks and the attack of quantum computer, when appropriate parameters are selected.

Cryptographic key management scheme for supporting multi-user SQL queries over encrypted databases

Database outsourcing is getting more popular bringing in a new standard, called database-as-a-service, where an organisation's database is stored in cloud. In such a setting, both access control and data confidentiality plays an important role, particularly when a data owner likes to publish his data for external use. Any cloud provider promises the security of its platform, while the execution of solutions to ensure confidentiality of the data stored in cloud databases is left to the data owner. The state-of-the-art solutions deal few preliminary issues with aid of SQL queries on encrypted data. In this paper, we propose a novel cryptographic key management scheme that combines data encryption and key management and supports multi-user SQL queries over encrypted databases. Our approach shows the proposed solutions for enforcing access control and for ensuring confidentiality of data. The experimental results obtained in this paper show the performance of proposed scheme.

Facilitating Secure and Efficient Spatial Query Processing on the Cloud

Database outsourcing is a common cloud computing paradigm that allows data owners to take advantage of its on-demand storage and computational resources. The main challenge is maintaining data confidentiality with respect to untrusted parties i.e., cloud service provider, as well as providing relevant query results in real-time to authenticated users. Existing approaches either compromise confidentiality of the data or suffer from high communication cost between the server and the user. To overcome this problem, we propose a dual transformation and encryption scheme for spatial data, where encrypted queries are executed entirely at the service provider on the encrypted database and encrypted results are returned to the user. The user issues encrypted spatial range queries to the service provider and then uses the encryption key to decrypt the query response returned. This allows a balance between the security of data and efficient query response as the queries are processed on encrypted data at the cloud server. Moreover, we compare with existing approaches on large datasets and show that this approach reduces the average query communication cost between the authorized user and service provider, as only a single round of communication is required by the proposed approach.