With high and growing supply of Database-as-a-Service solutions from cloud platform vendors, many enterprises still show moderate to low demand for them. Even though migration to a DaaS solution might result in a significantly reduced bill for IT maintenance, data security and privacy issues are among the reasons of low popularity of these services. Such a migration is also often only justified if it could be done seamlessly, with as few changes to the system as possible. Transparent Data Encryption could help, but solutions for TDE shipped with major database systems are limited to securing only data-at-rest, and appear to be useless if the machine could be physically accessed by the adversary, which is a probable risk when hosting in the cloud. This paper proposes a different approach to TDE, which takes into account cloud-specific risks, extends encryption to cover data-in-use and partly data-in-motion, and is capable of executing large subsets of SQL including heavy relational operations, complex operations over attributes, and transactions.

/pdf/transparent-data-encryption-for-data-in-use-and-data-at-rest-4anpzdaglq.pdf

Transparent Data Encryption for Data-in-Use and Data-at-Rest in a Cloud-Based Database-as-a-Service Solution

Database-as-a-Service is offered by many cloud service providers and could significantly reduce the IT infrastructure maintenance bills for enterprises. However, many hesitate migrating their data storage and processing to the cloud, and one of the reasons are data security issues. Encryption could provide sound security guarantees, but existing approaches often gravitate to one of the extremes: either high security and very limited functionality, or vice versa. This paper proposes a flexible database encryption scheme allowing multiple users to perform complex search-based queries, including cross-table joins, capable of utilizing database's indexing capabilities. Several proxy servers in between the user and the database server help to achieve this and make it all transparent for the user. The proposed solution demonstrates a practical performance level in most of our experiments.

A Confidentiality-Preserving Search Technique for Encrypted Relational Cloud Databases

Even though the concept of a Database-as-a-Service (DaaS) is becoming more popular and offers significant expenditure cuts, enterprises are still reluctant to migrate their data storing and processing to the cloud. One of the reasons to that is a lack of solid security guarantees. Encrypted database is one of the major approaches to address the security of cloud data processing. However, in order to provide processing capabilities over encrypted data, multiple techniques need to be combined and adjusted to work together. This paper introduces a modular and extensible framework model of an encrypted database, which makes it possible to execute a wide range of queries, including those with complex arithmetic expressions, retaining data privacy even with an adversary gaining full access to the database server. Proposed model could be used as a basis for encrypted database systems with various functional requirements.

/pdf/model-of-an-encrypted-cloud-relational-database-supporting-38xpw5ccz2.pdf

Model of an Encrypted Cloud Relational Database Supporting Complex Predicates in WHERE Clause

/pdf/privacy-preserving-oltp-database-systems-with-olap-support-3n3clqjrsm.pdf

Privacy-preserving OLTP database systems with OLAP support

Model of an Encrypted Relational Cloud Database Supporting Complex Predicates in WHERE Clause

While DaaS is becoming more and more popular enterprises start considering it as an option to reduce IT maintenance costs. But data privacy and security issues keep most of them from moving to the cloud. Existing schemes of encrypting the database usually either provide a very basic search only (e.g., SELECT * FROM t WHERE t.a = 5) and nothing more or give users more flexibility at a cost of data security. In this paper we try to introduce a highly secure and flexible database encryption scheme allowing multiple users to perform more complex queries, including cross-table joins and still achieve acceptable performance by utilizing database's built-in indexing capabilities. Several dedicated proxy servers in between the user and the database server help to achieve this and make it all transparent for the user. Developed solution shows acceptable performance level in most of the testing cases.

/pdf/complex-queries-in-a-shared-multi-user-relational-cloud-2akquke11s.pdf

Vasily Sidorpv

Papers

Complex Queries in a Shared Multi User Relational Cloud Database