Presentations of the 1st PaaSword CS-IFG Workshop that took place on 10th of November 2016 in Athens, Greece

1. www.paasword.eu
Distributed Searchable Encryption Engine
Innovathens 11/10/2016

2. Outline
Objectives
Architecture and DB Transform
Example of an SQL Query in PaaSword
Improvements so far
PaaSword – WP4 (Database Encryption)18/11/2016 2

3. Objectives
Improve Privacy in a transparent way
Automatic encryption and decryption
Automatic distribution synthesis
Sufficient (but restricted) support for SQL
Most important queries should be supported
Efficiency
Acceptable performance impact
PaaSword – WP4 (Database Encryption)18/11/2016 3

4. Basic Idea
PaaSword18/11/2016 4
Client Cloud DB
DB Proxy Cloud DBClient
Common (insecure) scenario Desired (secure) scenario

5. DB Proxy Architecture
PaaSword18/11/2016 5
Data Index2Index1
SQL
SQLDatabase
Proxy
(trusted)
SQL
Cloud
(untrusted)
User / Application
Data
(not encrypted)
Data (encrypted)

6. Database Transformation
PaaSword18/11/2016 6
ID Name Surname City Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Howard Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1985
ID Encrypted Data
1 Enc(Paul,Anderson,Athens,01.01.1979)
2 Enc(Howard,Miller,Karlsruhe,02.02.1974)
3 Enc(Henry,Cooper,Berlin,03.03.1980)
4 Enc(Henry,Jones,Brussels,04.04.1985)
Data
Keyword IDs
Name:Paul Enc(1)
Name:Howard Enc(2)
Name:Henry Enc(3,4)
Index1
Keyword IDs
Surname:Anderson Enc(1)
Surname:Miller Enc(2)
Surname:Cooper Enc(3)
Surname:Jones Enc(4)
Index2
Original
Association is hidden

7. Example (1/4)
PaaSword18/11/2016 7
•SQL-Query:
•SELECT * FROM Customers WHERE Name=‚Henry‘ AND Surname=‚Jones‘
Data Index2Index1
SELECT ID FROM Index1
WHERE Keyword=‘Name:Henry‘
SELECT ID FROM Index2
WHERE Keyword=‘Surname:Jones‘
transform query
ID Name Surname Stadt Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Hans Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1983
Database Proxy
SELECT * FROM Customers
WHERE Name=‚Henry‘ AND
Surname=‚Jones‘

8. Example (2/4)
PaaSword18/11/2016 8
•SQL-Query:
•SELECT * FROM Customers WHERE Name=‚Henry‘ AND Surname=‚Jones‘
Data Index2Index1
IDs Enc(3,4)
IDs Enc(4)
decrypt and
compute result
Database Proxy
ID 4
ID Name Surname Stadt Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Hans Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1983

9. Example (3/4)
PaaSword18/11/2016 9
•SQL-Query:
•SELECT * FROM Customers WHERE Name=‚Henry‘ AND Surname=‚Jones‘
Data Index2Index1
SELECT * FROM Data
WHERE ‘ID’ in {4}
retrieve relevant
data
ID Name Surname City Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Hans Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1983
Database Proxy
ID Name Surname Stadt Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Hans Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1983

10. Example (4/4)
PaaSword18/11/2016 10
•SQL-Query:
•SELECT * FROM Customers WHERE Name=‚Henry‘ AND Surname=‚Jones‘
Data Index2Index1
Henry,Jones,Brussels,04.04.1983
decrypt and
return result
Database Proxy
Enc(Henry,Jones,Brussels,04.04.1983)
ID Name Surname Stadt Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Hans Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1983

11. Improvements (1/2)
PaaSword18/11/2016 11
ID Name Surname City Day of Birth
1 Paul Anderson Athens 01.01.1979
2 Howard Miller Karlsruhe 02.02.1974
3 Henry Cooper Berlin 03.03.1980
4 Henry Jones Brussels 04.04.1985
ID Encrypted Data
1 Enc(Paul,Anderson,Athens,01.01.1979)
2 Enc(Howard,Miller,Karlsruhe,02.02.1974)
3 Enc(Henry,Cooper,Berlin,03.03.1980)
4 Enc(Henry,Jones,Brussels,04.04.1985)
Data
Keyword-Name IDs
Enc(Paul) Enc(1)
Enc(Howard) Enc(2)
Enc(Henry) Enc(3,4)
Index1
Keyword-Surname IDs
Enc(Anderson) Enc(1)
Enc(Miller) Enc(2)
Enc(Cooper) Enc(3)
Enc(Jones) Enc(4)
Index2
Original
Keyword Encryption
• AES (deterministic)
• Support for most query types
(excl. LIKE)
Index Distribution
• Index for same data type can be stored at different server
Data Distribution
Minimize exposure of sensitive information by careful distribution

12. PaaSword18/11/2016 12
Improvements (2/2)
Feature Support Before PaaSword Current State
Index Encryption
Multiple Tables
Joins
Subselect
LIKE Partial *
Privacy Constraints
Data Distribution
* Only if index keyword is not encrypted

13. Supported Statements
SELECT, UPDATE, INSERT, DELETE, DROP TABLE, ALTER TABLE
Joins
Left/right, full/outer/inner, …
=, NOT, AND, OR, IN
LIKE (%)
SELECT (SELECT …) )
<, <=, >, >=
GROUP BY, LIMIT, AVG, SUM
PaaSword – WP4 (Database Encryption)18/11/2016 13

14. Way forward
Extend SQL query support for encrypted index
Improve performance
Measure performance in different scenarios
Integrate into PaaSword framework
Include key management
PaaSword18/11/2016 14

15. PaaSword18/11/2016 15
Questions?
Visit us:
www.paasword.euAcknowledgements:
This project has received funding from the
European Union’s Horizon 2020 research and
innovation programme under grant
agreement No 644814.