45 research outputs found
SoK: Cryptographically Protected Database Search
Protected database search systems cryptographically isolate the roles of
reading from, writing to, and administering the database. This separation
limits unnecessary administrator access and protects data in the case of system
breaches. Since protected search was introduced in 2000, the area has grown
rapidly; systems are offered by academia, start-ups, and established companies.
However, there is no best protected search system or set of techniques.
Design of such systems is a balancing act between security, functionality,
performance, and usability. This challenge is made more difficult by ongoing
database specialization, as some users will want the functionality of SQL,
NoSQL, or NewSQL databases. This database evolution will continue, and the
protected search community should be able to quickly provide functionality
consistent with newly invented databases.
At the same time, the community must accurately and clearly characterize the
tradeoffs between different approaches. To address these challenges, we provide
the following contributions:
1) An identification of the important primitive operations across database
paradigms. We find there are a small number of base operations that can be used
and combined to support a large number of database paradigms.
2) An evaluation of the current state of protected search systems in
implementing these base operations. This evaluation describes the main
approaches and tradeoffs for each base operation. Furthermore, it puts
protected search in the context of unprotected search, identifying key gaps in
functionality.
3) An analysis of attacks against protected search for different base
queries.
4) A roadmap and tools for transforming a protected search system into a
protected database, including an open-source performance evaluation platform
and initial user opinions of protected search.Comment: 20 pages, to appear to IEEE Security and Privac
Privacy-Enhanced Dependable and Searchable Storage in a Cloud-of-Clouds
In this dissertation we will propose a solution for a trustable and privacy-enhanced storage architecture based on a multi-cloud approach. The solution provides the necessary support for multi modal on-line searching operation on data that is always maintained encrypted on used cloud-services. We implemented a system prototype, conducting an experimental evaluation. Our results show that the proposal offers security and privacy guarantees, and provides efficient information retrieval capabilities without sacrificing precision and recall properties on the supported search operations.
There is a constant increase in the demand of cloud services, particularly cloud-based
storage services. These services are currently used by different applications as outsourced storage services, with some interesting advantages. Most personal and mobile applications also offer the user the choice to use the cloud to store their data, transparently and sometimes without entire user awareness and privacy-conditions, to overcome local storage limitations. Companies might also find that it is cheaper to outsource databases and keyvalue stores, instead of relying on storage solutions in private data-centers. This raises the concern about data privacy guarantees and data leakage danger. A cloud system administrator can easily access unprotected data and she/he could also forge, modify or delete data, violating privacy, integrity, availability and authenticity conditions.
A possible solution to solve those problems would be to encrypt and add authenticity
and integrity proofs in all data, before being sent to the cloud, and decrypting and verifying authenticity or integrity on data downloads. However this solution can be used only for backup purposes or when big data is not involved, and might not be very practical for online searching requirements over large amounts of cloud stored data that must be searched, accessed and retrieved in a dynamic way. Those solutions also impose high-latency and high amount of cloud inbound/outbound traffic, increasing the operational costs. Moreover, in the case of mobile or embedded devices, the power, computation and communication constraints cannot be ignored, since indexing, encrypting/decrypting and signing/verifying all data will be computationally expensive.
To overcome the previous drawbacks, in this dissertation we propose a solution for a
trustable and privacy-enhanced storage architecture based on a multi-cloud approach, providing privacy-enhanced, dependable and searchable support. Our solution provides the necessary support for dependable cloud storage and multi modal on-line searching operations over always-encrypted data in a cloud-of-clouds. We implemented a system prototype, conducting an experimental evaluation of the proposed solution, involving the use of conventional storage clouds, as well as, a high-speed in-memory cloud-storage backend. Our results show that the proposal offers the required dependability properties and privacy guarantees, providing efficient information retrieval capabilities without sacrificing precision and recall properties in the supported indexing and search operations
Security and Privacy Issues of Big Data
This chapter revises the most important aspects in how computing
infrastructures should be configured and intelligently managed to fulfill the
most notably security aspects required by Big Data applications. One of them is
privacy. It is a pertinent aspect to be addressed because users share more and
more personal data and content through their devices and computers to social
networks and public clouds. So, a secure framework to social networks is a very
hot topic research. This last topic is addressed in one of the two sections of
the current chapter with case studies. In addition, the traditional mechanisms
to support security such as firewalls and demilitarized zones are not suitable
to be applied in computing systems to support Big Data. SDN is an emergent
management solution that could become a convenient mechanism to implement
security in Big Data systems, as we show through a second case study at the end
of the chapter. This also discusses current relevant work and identifies open
issues.Comment: In book Handbook of Research on Trends and Future Directions in Big
Data and Web Intelligence, IGI Global, 201
Privacy-Enhanced Query Processing in a Cloud-Based Encrypted DBaaS (Database as a Service)
In this dissertation, we researched techniques to support trustable and privacy enhanced solutions for on-line applications accessing to “always encrypted” data in
remote DBaaS (data-base-as-a-service) or Cloud SQL-enabled backend solutions.
Although solutions for SQL-querying of encrypted databases have been proposed in
recent research, they fail in providing: (i) flexible multimodal query facilities includ ing online image searching and retrieval as extended queries to conventional SQL-based
searches, (ii) searchable cryptographic constructions for image-indexing, searching and
retrieving operations, (iii) reusable client-appliances for transparent integration of multi modal applications, and (iv) lack of performance and effectiveness validations for Cloud based DBaaS integrated deployments.
At the same time, the study of partial homomorphic encryption and multimodal
searchable encryption constructions is yet an ongoing research field. In this research
direction, the need for a study and practical evaluations of such cryptographic is essential,
to evaluate those cryptographic methods and techniques towards the materialization of
effective solutions for practical applications.
The objective of the dissertation is to design, implement and perform experimental
evaluation of a security middleware solution, implementing a client/client-proxy/server appliance software architecture, to support the execution of applications requiring on line multimodal queries on “always encrypted” data maintained in outsourced cloud
DBaaS backends. In this objective we include the support for SQL-based text-queries
enhanced with searchable encrypted image-retrieval capabilities. We implemented a
prototype of the proposed solution and we conducted an experimental benchmarking
evaluation, to observe the effectiveness, latency and performance conditions in support ing those queries. The dissertation addressed the envisaged security middleware solution,
as an experimental and usable solution that can be extended for future experimental
testbench evaluations using different real cloud DBaaS deployments, as offered by well known cloud-providers.Nesta dissertação foram investigadas técnicas para suportar soluções com garantias de
privacidade para aplicações que acedem on-line a dados que são mantidos sempre cifrados em nuvens que disponibilizam serviços de armazenamento de dados, nomeadamente
soluções do tipo bases de dados interrogáveis por SQL. Embora soluções para suportar interrogações SQL em bases de dados cifradas tenham sido propostas anteriormente, estas
falham em providenciar: (i) capacidade de efectuar pesquisas multimodais que possam
incluir pesquisa combinada de texto e imagem com obtenção de imagens online, (ii) suporte de privacidade com base em construções criptograficas que permitam operações
de indexacao, pesquisa e obtenção de imagens como dados cifrados pesquisáveis, (iii)
suporte de integração para aplicações de gestão de dados em contexto multimodal, e (iv)
ausência de validações experimentais com benchmarking dobre desempenho e eficiência
em soluções DBaaS em que os dados sejam armazenados e manipulados na sua forma
cifrada.
A pesquisa de soluções de privacidade baseada em primitivas de cifras homomórficas
parciais, tem sido vista como uma possível solução prática para interrogação de dados e
bases de dados cifradas. No entanto, este é ainda um campo de investigação em desenvolvimento. Nesta direção de investigação, a necessidade de estudar e efectuar avaliações
experimentais destas primitivas em bibliotecas de cifras homomórficas, reutilizáveis em
diferentes contextos de aplicação e como solução efetiva para uso prático mais generalizado, é um aspeto essencial.
O objectivo da dissertação e desenhar, implementar e efectuar avalições experimentais
de uma proposta de solução middleware para suportar pesquisas multimodais em bases
de dados mantidas cifradas em soluções de nuvens de armazenamento. Esta proposta visa
a concepção e implementação de uma arquitectura de software client/client-proxy/server appliance para suportar execução eficiente de interrogações online sobre dados cifrados,
suportando operações multimodais sobre dados mantidos protegidos em serviços de
nuvens de armazenamento. Neste objectivo incluímos o suporte para interrogações estendidas de SQL, com capacidade para pesquisa e obtenção de dados cifrados que podem
incluir texto e pesquisa de imagens por similaridade. Foi implementado um prototipo da
solução proposta e foi efectuada uma avaliação experimental do mesmo, para observar as condições de eficiencia, latencia e desempenho do suporte dessas interrogações. Nesta
avaliação incluímos a análise experimental da eficiência e impacto de diferentes construções criptográficas para pesquisas cifradas (searchable encryption) e cifras parcialmente
homomórficas e que são usadas como componentes da solução proposta.
A dissertaçao aborda a soluçao de seguranca projectada, como uma solução experimental que pode ser estendida e utilizavel para futuras aplcações e respetivas avaliações
experimentais. Estas podem vir a adoptar soluções do tipo DBaaS, oferecidos como serviços na nuvem, por parte de diversos provedores ou fornecedores
Homomorphic-Encrypted Volume Rendering
Computationally demanding tasks are typically calculated in dedicated data
centers, and real-time visualizations also follow this trend. Some rendering
tasks, however, require the highest level of confidentiality so that no other
party, besides the owner, can read or see the sensitive data. Here we present a
direct volume rendering approach that performs volume rendering directly on
encrypted volume data by using the homomorphic Paillier encryption algorithm.
This approach ensures that the volume data and rendered image are
uninterpretable to the rendering server. Our volume rendering pipeline
introduces novel approaches for encrypted-data compositing, interpolation, and
opacity modulation, as well as simple transfer function design, where each of
these routines maintains the highest level of privacy. We present performance
and memory overhead analysis that is associated with our privacy-preserving
scheme. Our approach is open and secure by design, as opposed to secure through
obscurity. Owners of the data only have to keep their secure key confidential
to guarantee the privacy of their volume data and the rendered images. Our work
is, to our knowledge, the first privacy-preserving remote volume-rendering
approach that does not require that any server involved be trustworthy; even in
cases when the server is compromised, no sensitive data will be leaked to a
foreign party.Comment: Accepted for presentation at IEEE VIS 202
A Survey on Property-Preserving Database Encryption Techniques in the Cloud
Outsourcing a relational database to the cloud offers several benefits,
including scalability, availability, and cost-effectiveness. However, there are
concerns about the security and confidentiality of the outsourced data. A
general approach here would be to encrypt the data with a standardized
encryption algorithm and then store the data only encrypted in the cloud. The
problem with this approach, however, is that with encryption, important
properties of the data such as sorting, format or comparability, which are
essential for the functioning of database queries, are lost. One solution to
this problem is the use of encryption algorithms, which also preserve these
properties in the encrypted data, thus enabling queries to encrypted data.
These algorithms range from simple algorithms like Caesar encryption to secure
algorithms like mOPE. The report at hand presents a survey on common encryption
techniques used for storing data in relation Cloud database services. It
presents the applied methods and identifies their characteristics.Comment: 34 pages, 10 figure
Practical Isolated Searchable Encryption in a Trusted Computing Environment
Cloud computing has become a standard computational paradigm due its numerous
advantages, including high availability, elasticity, and ubiquity. Both individual users and
companies are adopting more of its services, but not without loss of privacy and control.
Outsourcing data and computations to a remote server implies trusting its owners, a
problem many end-users are aware. Recent news have proven data stored on Cloud
servers is susceptible to leaks from the provider, third-party attackers, or even from
government surveillance programs, exposing users’ private data.
Different approaches to tackle these problems have surfaced throughout the years.
Naïve solutions involve storing data encrypted on the server, decrypting it only on the
client-side. Yet, this imposes a high overhead on the client, rendering such schemes
impractical. Searchable Symmetric Encryption (SSE) has emerged as a novel research
topic in recent years, allowing efficient querying and updating over encrypted datastores
in Cloud servers, while retaining privacy guarantees. Still, despite relevant recent advances,
existing SSE schemes still make a critical trade-off between efficiency, security,
and query expressiveness, thus limiting their adoption as a viable technology, particularly
in large-scale scenarios.
New technologies providing Isolated Execution Environments (IEEs) may help improve
SSE literature. These technologies allow applications to be run remotely with
privacy guarantees, in isolation from other, possibly privileged, processes inside the CPU,
such as the operating system kernel. Prominent example technologies are Intel SGX and
ARM TrustZone, which are being made available in today’s commodity CPUs.
In this thesis we study these new trusted hardware technologies in depth, while exploring
their application to the problem of searching over encrypted data, primarily focusing
in SGX. In more detail, we study the application of IEEs in SSE schemes, improving their
efficiency, security, and query expressiveness.
We design, implement, and evaluate three new SSE schemes for different query types,
namely Boolean queries over text, similarity queries over image datastores, and multimodal
queries over text and images. These schemes can support queries combining different
media formats simultaneously, envisaging applications such as privacy-enhanced medical diagnosis and management of electronic-healthcare records, or confidential photograph
catalogues, running without the danger of privacy breaks in Cloud-based provisioned
services