|
DBMask: Fine-Grained Access Control on Encrypted Relational Databases
Muhammad I Sarfraz(a),(*), Mohamed Nabeel(b), Jianneng Cao(c), Elisa Bertino(a)
Transactions on Data Privacy 9:3 (2016) 187 - 214
Abstract, PDF
(a) Purdue University, West Lafayette, IN, 47907, USA.
(b) Oracle, Redwood City, CA, 94065, USA.
(c) Institute for Infocomm Research, Singapore 13862.
e-mail:msarfraz @purdue.edu; nabeel.mohamed.nabeel @oracle.com; caojn @i2r.a-star.edu.sg; bertino @purdue.edu
|
|
Abstract
DBMask is a system that implements encrypted query processing with support for complex queries and fine grained access control with create, update, delete and cryptographically enforced read (CRUD) operations for data stored on an untrusted database server hosted in a public cloud. Past research efforts have not adequately addressed flexible access control on encrypted data at different granularity levels which is critical for data sharing among different users and applications. DBMask proposes a novel technique that separates fine grained access control from encrypted query processing when evaluating SQL queries on encrypted data and enforces fine grained access control at the granularity level of a column, row and cell based on an expressive attribute-based group key encryption scheme. DBMask does not require modifications to the database engine, and thus maximizes the reuse of the existing DBMS infrastructures. Our experiments evaluate the performance of an encrypted database, managed by DBMask, using queries from TPC-H benchmark in comparison to plaintext Postgres. We further evaluate the functionality of our prototype using a policy simulator and a multi-user web application. The results show that DBMask is efficient and scalable to large datasets.
|
