cryptdb
play

CryptDB Protecting Confidentiality with Encrypted Query Processing - PowerPoint PPT Presentation

Nov 16, 2023 •474 likes •1.27k views

CryptDB Protecting Confidentiality with Encrypted Query Processing Katarzyna Baranowska University of Warsaw January 21, 2012 Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Why secure data? Medical data Contact data Payment

  1. CryptDB Protecting Confidentiality with Encrypted Query Processing Katarzyna Baranowska University of Warsaw January 21, 2012

  2. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Why secure data? Medical data Contact data Payment Personal evaluation and recommendations Company data

  3. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Posible threats

  4. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Posible threats

  5. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Posible threats

  6. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Posible threats

  7. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Other solutions Encrypt and decrypt data at users side

  8. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Other solutions Encrypt and decrypt data at users side Needs moving application logic to users

  9. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Other solutions Encrypt and decrypt data at users side Needs moving application logic to users Not effective if apllication computes over large amount of data

  10. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Other solutions Encrypt and decrypt data at users side Needs moving application logic to users Not effective if apllication computes over large amount of data Use fully homomorphic encryption, which allows servers to compute functions over encrypted data

  11. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Other solutions Encrypt and decrypt data at users side Needs moving application logic to users Not effective if apllication computes over large amount of data Use fully homomorphic encryption, which allows servers to compute functions over encrypted data Very slow

  12. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Other solutions Encrypt and decrypt data at users side Needs moving application logic to users Not effective if apllication computes over large amount of data Use fully homomorphic encryption, which allows servers to compute functions over encrypted data Very slow Very expensive

  13. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB solution

  14. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB solution Threat 1

  15. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB solution Threat 1 SQL-aware encryption strategy (symmertic keys)

  16. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB solution Threat 1 SQL-aware encryption strategy (symmertic keys) Adjustable query-based encryption (onions of encryption)

  17. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB solution Threat 1 SQL-aware encryption strategy (symmertic keys) Adjustable query-based encryption (onions of encryption) Threat 2

  18. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB solution Threat 1 SQL-aware encryption strategy (symmertic keys) Adjustable query-based encryption (onions of encryption) Threat 2 Chaining encryption keys to user passwords

  19. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Dealing with curious DBA

  20. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Dealing with curious DBA

  21. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Dealing with curious DBA UPDATE Table1 SET C2-Ord = DECRYPT RND(K, C2-ORD, C2-IV)

  22. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms

  23. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV

  24. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV DET (deterministic): AES-CMC, Blowfish without IV

  25. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV DET (deterministic): AES-CMC, Blowfish without IV JOIN : keyed cryptographic hash, with the additional property that hashes can be adjusted to change their keys without access to the plaintext (JOIN-ADJ)

  26. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV DET (deterministic): AES-CMC, Blowfish without IV JOIN : keyed cryptographic hash, with the additional property that hashes can be adjusted to change their keys without access to the plaintext (JOIN-ADJ) OPE (order-preserving encryption): random mapping that preserves order, never before implemented

  27. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV DET (deterministic): AES-CMC, Blowfish without IV JOIN : keyed cryptographic hash, with the additional property that hashes can be adjusted to change their keys without access to the plaintext (JOIN-ADJ) OPE (order-preserving encryption): random mapping that preserves order, never before implemented OPE-JOIN: must be known a priori, but is rare (50 out of 128,840 columns)

  28. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV DET (deterministic): AES-CMC, Blowfish without IV JOIN : keyed cryptographic hash, with the additional property that hashes can be adjusted to change their keys without access to the plaintext (JOIN-ADJ) OPE (order-preserving encryption): random mapping that preserves order, never before implemented OPE-JOIN: must be known a priori, but is rare (50 out of 128,840 columns) HOM (homomorphic encryption): Paillier cryptosystem for summation

  29. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms RND (random): AES-CBC, Blowfish (for integers) with IV DET (deterministic): AES-CMC, Blowfish without IV JOIN : keyed cryptographic hash, with the additional property that hashes can be adjusted to change their keys without access to the plaintext (JOIN-ADJ) OPE (order-preserving encryption): random mapping that preserves order, never before implemented OPE-JOIN: must be known a priori, but is rare (50 out of 128,840 columns) HOM (homomorphic encryption): Paillier cryptosystem for summation SEARCH (word search): protocol of Song et al.

  30. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms

  31. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Used alorithms OPE can be speeded up by caching frequently used constants over diffrent keys HOM encryption can be speeded up by precomputing Paillier r n randomness

  32. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements

  33. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers

  34. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing

  35. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing Training mode

  36. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing Training mode Onion re-encryption

  37. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing Training mode Onion re-encryption Performance Optimizations

  38. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing Training mode Onion re-encryption Performance Optimizations Developer Annotations

  39. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing Training mode Onion re-encryption Performance Optimizations Developer Annotations Known query set

  40. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB features Security improvements Minimum onion layers In-proxy processing Training mode Onion re-encryption Performance Optimizations Developer Annotations Known query set Precomputing and caching for OPE and HOM

  41. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation CryptDB structure

  42. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Environment used for tests

  43. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Environment used for tests

  44. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Throughput 1

  45. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Throughput 2

  46. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Throughput 2 SUM (2x less) and UPDATE (1.6 less) requires HOM additions at server

  47. Threats Threat 1 Speed Evaluation Threat 2 More Evaluation Processing times Proxy* - without precomputing and caching optimization

More recommend