Abstract
In the Database-As-a-Service (DAS) model, clients store their database contents at servers belonging to potentially untrusted service providers. To maintain data confidentiality, clients need to outsource their data to servers in encrypted form. At the same time, clients must still be able to execute queries over encrypted data. One prominent and fairly effective technique for executing SQL-style range queries over encrypted data involves partitioning (or bucketization) of encrypted attributes.
However, executing aggregation-type queries over encrypted data is a notoriously difficult problem. One well-known cryptographic tool often utilized to support encrypted aggregation is homomorphic encryption; it enables arithmetic operations over encrypted data. One technique based on a specific homomorphic encryption function was recently proposed in the context of the DAS model. Unfortunately, as shown in this paper, this technique is insecure against ciphertext-only attacks. We propose a simple alternative for handling encrypted aggregation queries and describe its implementation. We also consider a different flavor of the DAS model which involves mixed databases, where some attributes are encrypted and some are left in the clear. We show how range queries can be executed in this model.
This work was supported by in part by NSF Awards 0331707 (ITR-DAS) and 0220069 (ITR-RESCUE).
Chapter PDF
References
Hacigumus, H., Iyer, B., Mehrotra, S.: Providing database as a service. In: International Conference on Data Engineering (March 2002)
Hacigumus, H., Iyer, B., Li, C., Mehrotra, S.: Executing sql over encrypted data in the database-service-provider model. In: ACM SIGMOD Conference on Management of Data, June 2002, pp. 216–227. ACM Press, New York (2002)
Hacigumus, H., Iyer, B., Mehrotra, S.: Efficient execution of aggregation queries over encrypted relational databases. In: Lee, Y., Li, J., Whang, K.-Y., Lee, D. (eds.) DASFAA 2004. LNCS, vol. 2973, pp. 125–136. Springer, Heidelberg (2004)
Mykletun, E., Narasimha, M., Tsudik, G.: Authentication and integrity in outsourced databases. In: Symposium on Network and Distributed Systems Security (NDSS 2004) (February 2004)
Mykletun, E., Narasimha, M., Tsudik, G.: Signature bouquets: Immutability for aggregated/Condensed signatures. In: Samarati, P., Ryan, P.Y.A., Gollmann, D., Molva, R. (eds.) ESORICS 2004. LNCS, vol. 3193, pp. 160–176. Springer, Heidelberg (2004)
Devanbu, P., Gertz, M., Martel, C., Stubblebine, S.G.: Authentic third-party data publication. In: 14th IFIP 11.3 Working Conference in Database Security, pp. 101–112 (2000)
Hore, B., Mehrotra, S., Tsudik, G.: A privacy-preserving index for range queries. In: International Conference on Very Large Databases (VLDB) (2004)
Ceselli, A., Damiani, E., Vimercati, S., Jajodia, S., Paraboschi, S., Samarati, P.: Modeling and assessing inference exposure in encrypted databases. ACM Transactions on Information and System Security 8, 119–152 (2005)
Bellare, M., Rogaway, P.: Optimal asymmetric encryption. In: Advances in Cryptology - Eurocrypt, pp. 92–111 (2004)
Paillier, P.: Public-key cryptosystems based on composite degree residuosity classes. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 206–214. Springer, Heidelberg (1999)
Rivest, R., Adleman, L., Dertouzous, M.: On data banks and privacy homomorphisms. In: Foundations of Secure Computation, pp. 169–179. Academic Press, London (1978)
Boneh, D., Gentry, C., Lynn, B., Shacham, H.: Aggregate and Verifiably Encrypted Signatures from Bilinear Maps
Menezes, A.J., van Oorschot, P.C., Vanstone, S.A.: Handbook of applied cryptography. CRC Press series on discrete mathematics and its applications. CRC Press, Boca Raton (1997)
Benaloh, J.: Dense Probabilistic Encryption. In: Proceedings of the Workshop on Selected Areas of Cryptography, pp. 120–128 (1994)
ElGamal, T.: A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory 31, 469–472 (1985)
Okamoto, T., Uchiyama, S.: A New Public-Key Cryptosystem as Secure as Factoring. In: Nyberg, K. (ed.) EUROCRYPT 1998. LNCS, vol. 1403, pp. 308–318. Springer, Heidelberg (1998)
Castelluccia, C., Mykletun, E., Tsudik, G.: Efficient Aggregation of encrypted data in Wireless Sensor Networks. In: Mobile and Ubiquitous Systems: Networking and Services (2005)
N.I. of Standards and Technology, Triple-des algorith. FIPS 46(3) (1998)
N.I. of Standards and Technology, Advanced encryption standard, NIST FIPS PUB 197 (2001)
Mykletun, E., Girao, J., Westhoff, D.: Public Key Based Cryptoschemes for Data Concealment in Wireless Sensor Networks. In: International Conference on Communications (2006)
Gura, N., Patel, A., Wander, A., Eberle, H., Shantz, S.C.: Comparing elliptic curve cryptography and RSA on 8-bit cPUs. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 119–132. Springer, Heidelberg (2004)
IEEE, Standard P1363: Standard Specifications For Public-Key Cryptography, http://grouper.ieee.org/groups/1363/
Mykletun, E., Tsudik, G.: Incorporating a Secure Coprocessor in the Database-as-a-Service Model. In: International Workshop on Innovative Architecture for Future Generation High Performance Processors and Systems (2005)
Dyer, J.G., Lindemann, M., Perez, R.S.R., van Doorn, L., Smith, S.W.: Building the IBM 4758 Secure Coprocessor. IEEE Computer, 57–66 (2001)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 IFIP International Federation for Information Processing
About this paper
Cite this paper
Mykletun, E., Tsudik, G. (2006). Aggregation Queries in the Database-As-a-Service Model. In: Damiani, E., Liu, P. (eds) Data and Applications Security XX. DBSec 2006. Lecture Notes in Computer Science, vol 4127. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11805588_7
Download citation
DOI: https://doi.org/10.1007/11805588_7
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-36796-3
Online ISBN: 978-3-540-36799-4
eBook Packages: Computer ScienceComputer Science (R0)