SQL on Structurally-Encrypted Databases Seny Kamara Tarik Moataz Q - PowerPoint PPT Presentation

SQL on Structurally-Encrypted Databases Seny Kamara Tarik Moataz

Q : What is a relational database? 2

Relational DB Table or relation Column or attribute Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 Att 7 DB = Row or record T 2 T 1 3

Structured Query Language • SQL is a language for querying relational DBs • Example: ct (name, gender, height) Se Select From (T 2 , T 8 ) Fr Where (age = 36 AND zip = 10040 AND gender = F) Wh • SQL is the standard way to query a relational DB • Standard ANSI/ISO since 1986/1987 4

Q : What is Structured Encryption (STE)? 5

Structured Encryption (STE) [CK10] EDS DS tk ct Query( EDS, tk ) ⟾ ct Setup ( 1 k , DS ) ⟾ (K, EDS) Token ( K , q ) ⟾ tk 6

Structured Encryption (STE) [CK10] Setup Leakage EDS L s ( DS ) DS tk Query Leakage L q ( DS, q ) ans Query( EDS, tk ) ⟾ ans Setup ( 1 k , DS ) ⟾ (K, EDS) Token ( K , q ) ⟾ tk 7

Structured Encryption (STE) [CK10] We say that an STE is ( L S ,L Q )-secure if • It reveals no information about the structure beyond L S • It reveals no information about the structure and queries beyond L Q 8

Encrypted Multi-Maps [CK10] Single Keyword SSE Encrypted Inverted [SWP00], [Goh03], [CGKO06], Encrypted Multi-Map Index [CK10], [KPR12], [KP13], [CJJKRS13], [CJJJKRS14], [Bost16], [BMO17], [AKM19] … 9

Q : How can we encrypt a relational DB? 10

Efficiency Functionality Leakage 11

Tradeoffs: Efficiency vs. Security Efficiency STE/SSE-based PPE-based skFE-based pkFE-based ORAM-based FHE-based Leakage 12

Tradeoffs: Functionality vs. Efficiency Functionality SQL PPE-based FHE-based ORAM-based STE/SSE-based SK-FE-based NoSQL PK-FE-based Efficiency 13

Q : Can we design an STE-based Relational EDB? 14

Challenges • No PPE so no plug-and-play solutions • SQL is a declarative language • Where do we even start? • SQL is complex • Combination of many basic query types • Most STE schemes handle a single type queries • SQL is “constructive” • STE has been optimized for “lookup-type” queries 15

#1: Declarative => Procedural Ch Ch. . #1 • Relational algebra [Codd70] • Set of operations on relations/tables • Union • Difference • Selection • Projection RA • Cross product • Join (many kinds) • … SQL 16

#2: Complex => Simple Ch Ch. . #2: • SPC algebra [Chandra-Merlin77] • S election, P rojection, C ross product • Equivalent to Conjunctive SQL queries SPC • Any SPC query can be written in a Normal Form: RA SQL 17

Select, Project, Cross Product Att 1 Att 2 Att 3 𝜌 $,& Att 1 Att 2 Att 3 𝜏 " Att 1 Att 2 Att 3 Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 Att 2 Att 3 Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 18

Our Goal Att 1 Att 2 Att 1 Att 3 STE K tk SQL => SPC => NF Att 2 Att 3 Enc K 19

Our Results SPX : Encrypted Relational Database • SP • First STE scheme for relational DBs • Handles non-trivial subset of SQL • Sub-linear search and storage complexity (optimal under certain conditions) • from any single-keyword SSE SPX + : dynamic SPX • SP • Only row addition and deletion • from any dynamic single-keyword SSE • Sub-linear search and storage complexity (optimal under certain conditions) SPX + : forward-private dynamic SPX • FP FP-SP • poly-logarithmic overhead for updates 20

A : Naïve STE-based Relational EDB 21

Naïve SPC Algorithm Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 Att 2 Att 6 22

Sub-Linear SPC Algorithm • Ideally linear in output size: Att 2 Att 6 Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 • Less than cross product size: 23

Q : Can we achieve sub-linear STE-based EDB? 24

SPX Overview • Step 1. Heuristic normal form (HNF) instead of the standard normal form • Avoid naïve Cartesian product by a “push select through product” method • Step 2. New (plaintext) data structure that supports HNF • Different representations of the database to handle different SPC operators • Step 3. Encrypted structure that supports HNF queries • Chaining technique with a better control of leakage • From any single-keyword SSE schemes 25

Step 1: Heuristic Normal Form (1) Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 𝜏 " More complicated • Correlated/non-correlated • Different types of select Ψ = Ψ 1 ∧ Ψ 2 Push Select through Product Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 𝜏 " ' 𝜏 " ( 26

Step 1: Heuristic Normal Form (2) Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 𝜏 " ' 𝜏 " ( Size Overhead ≪ Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 Att 1 Att 2 Att 3 Att 4 Att 5 Att 6 27

Step 2: Database representations Att 3 Att 4 Att 5 Att 1 Att 2 DB = T 1 T 2 Row Column Value Cross-value representation representation representation representation 28

Step 2: Row / Column representation Row Multi-map MM R (T 1 , 1) (T 1 , 2) (T 2 , 1) (T 2 , 2) Att 3 Att 4 Att 5 Att 1 Att 2 (T 2 , 3) Column Multi-map MM C (T 1 , Att 1 ) (T 1 , Att 2 ) (T 2 , Att 3 ) (T 2 , Att 4 ) (T 2 , Att 5 ) 29

Step 2: Value representation Value Multi-map MM v (1, T 1 , Att 1 ) (T 1 , 1) (2, T 1 , Att 1 ) (T 1 , 2) (CS, T 1 , Att 2 ) (T 1 , 1) (Math, T 1 , Att 2 ) (T 1 , 2) Att 3 Att 4 Att 5 Att 1 Att 2 (1, T 2 , Att 3 ) (T 2 , 1) 1 45 CS 1 CS (T 2 , 3) 2 45 Math (2, T 2 , Att 3 ) (T 2 , 2) 2 Math (45, T 2 , Att 4 ) 2 60 CS (T 2 , 2) (T 2 , 1) (60, T 2 , Att 4 ) (T 2 , 1) (CS, T 2 , Att 5 ) (T 2 , 1) (T 2 , 3) (Math, T 2 , Att 5 ) (T 2 , 2) 30

Step 2: Cross-Value representation Cross-Value Multi-map MM Att1 ((T 1 ,Att 1 ), (T 2 , Att 3 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 2) (T 1 , 2), (T 2 , 3) Att 3 Att 4 Att 5 Att 1 Att 2 1 45 CS 1 CS 2 45 Math Cross-Value Multi-map MM Att2 2 Math 2 60 CS ((T 1 ,Att 2 ), (T 2 , Att 5 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) 31

Step 3: SPX Setup Att 1 Att 2 Setup SPX 1 k , Att 3 Att 4 Att 5 32

Step 3: SPX Setup Encrypted Column Multi-map EMM C Encrypted Row Multi-map EMM R Encrypted Value Multi-map EMM v (T 1 , 1) (T 1 , 1) (1, T 1 , Att 1 ) (T 1 , 1) (T 1 , 2) (T 1 , 2) (2, T 1 , Att 1 ) (T 1 , 2) (T 2 , 1) (T 2 , 1) (CS, T 1 , Att 2 ) (T 1 , 1) (T 2 , 2) (T 2 , 2) (Math, T 1 , Att 2 ) (T 1 , 2) , (T 2 , 3) (T 2 , 3) (1, T 2 , Att 3 ) (T 2 , 1) (2, T 2 , Att 3 ) (T 2 , 2) (T 2 , 3) Encrypted dictionary EDX (45, T 2 , Att 4 ) (T 2 , 1) (T 2 , 2) Encrypted Cross-Values Multi-map EMM Att1 Att 1 (60, T 2 , Att 4 ) (T 2 , 1) ((T 1 ,Att 1 ), (T 2 , Att 3 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 2) (T 1 , 2), (T 2 , 3) (CS, T 2 , Att 5 ) (T 2 , 3) (T 2 , 1) Encrypted Cross-Values Multi-map EMM Att2 (Math, T 2 , Att 5 ) (T 2 , 2) Att 2 ((T 1 ,Att 2 ), (T 2 , Att 5 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) 33

Step 3: SPX Token (1) Select Att 3 , From (T 1 , T 2 ) Token SPX Where T 1 .Att 2 = T 2 .Att 5 34

Step 3: SPX Token (2) 1. Rewrite SQL query to Normal Form ✓ �◆ � T 1 × T 2 π att 3 σ att 2 = att 5 2. Rewrite Normal Form to Heuristic Normal Form 3. Generate the token 3 Att 2 ((T 1 , Att 2 ), (T 2 , Att 5 )) Dictionary Projection Select sub-token Sub-token Sub-token 35

Step 3: SPX Query (1) Encrypted Value Multi-map EMM v Encrypted Row Multi-map EMM R Att 2 3 , Query SPX Encrypted Column Multi-map EMM C ((T 1 , Att 2 ), (T 2 , Att 5 )) Encrypted dictionary EDX 36

Step 3: SPX Query (2) Encrypted dictionary EDX Encrypted Cross-Values Multi-map EMM Att1 , Att 1 Get ((T 1 ,Att 1 ), (T 2 , Att 3 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 2) (T 1 , 2), (T 2 , 3) Att 2 Encrypted Cross-Values Multi-map EMM Att2 Att 2 ((T 1 ,Att 2 ), (T 2 , Att 5 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) Encrypted Cross-Values Multi-map EMM Att2 ((T 1 ,Att 2 ), (T 2 , Att 5 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) 37

Step 3: SPX Query (3) , Encrypted Cross-Values Multi-map EMM Att2 Get ((T 1 , Att 2 ), (T 2 , Att 5 )) ((T 1 ,Att 2 ), (T 2 , Att 5 )) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) 38

Step 3: SPX Query (4) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) Encrypted Row Multi-map EMM R (T 1 , 1) , (T 1 , 2) Get (T 1 , 1) Temporary Result Table (T 2 , 1) (T 2 , 2) (T 2 , 3) , Get Encrypted Row Multi-map EMM R (T 2 , 1) 39

Step 3: SPX Query (5) (T 1 , 1), (T 2 , 1) (T 1 , 2), (T 2 , 3) (T 1 , 2), (T 2 , 2) , Get (T 1 , 2) Encrypted Row Multi-map EMM R Temporary Result Table , Get Encrypted Row Multi-map EMM R (T 2 , 3) , Get (T 1 , 2) Encrypted Row Multi-map EMM R , Get (T 2 , 2) Encrypted Row Multi-map EMM R 40

Step 3: SPX Query (6) Temporary Result Table Final Result 𝜌 3 41

Leakage: SPX-OPT vs. PPE-based • Query leakage of PPE-based schemes ⊆ • Query leakage of SPX • Cross product pattern • Cross product pattern • Projection pattern • Projection pattern • Selection pattern • Selection pattern • Frequency pattern • Persistent • Existing very strong attacks 42

Modularity: SPX-Obliv vs. SPX-OPT ⊆ Query leakage of SPX-Obliv Query leakage of SPX-OPT • When the EMMs are oblivious [ GO96,SvDS+13,GMP16,KMO18 ] • But comes with extra overhead 43