CryptDB: Protecting confidentiality with encrypted query processing
Name
cryptdb-sosp11.pdf
Size
350.68 KB
Format
Adobe PDF
Checksum (MD5)
5d930c426aea77ac63ba3ecaa214e589
Author(s)
Popa, Raluca Ada
Redfield, Catherine M.
Zeldovich, Nickolai
Balakrishnan, Hari
Date Issued
October 2011
Journal
Proceedings of the 23rd ACM Symposium on Operating Systems Principles (SOSP '11)
Publisher
Association for Computing Machinery (ACM)
Citation
Popa, Raluca Ada et al. “CryptDB: Protecting confidentiality with encrypted query processing.” ACM Press, 2011. 85.
Version
Author's final manuscript
Abstract
Online applications are vulnerable to theft of sensitive information because adversaries can exploit software bugs to gain access to private data, and because curious or malicious administrators may capture and leak data. CryptDB is a system that provides practical and provable confidentiality in the face of these attacks for applications backed by SQL databases. It works by executing SQL queries over encrypted data using a collection of efficient SQL-aware encryption schemes. CryptDB can also chain encryption keys to user passwords, so that a data item can be decrypted only by using the password of one of the users with access to that data. As a result, a database administrator never gets access to decrypted data, and even if all servers are compromised, an adversary cannot decrypt the data of any user who is not logged in. An analysis of a trace of 126 million SQL queries from a production MySQL server shows that CryptDB can support operations over encrypted data for 99.5% of the 128,840 columns seen in the trace. Our evaluation shows that CryptDB has low overhead, reducing throughput by 14.5% for phpBB, a web forum application, and by 26% for queries from TPC-C, compared to unmodified MySQL. Chaining encryption keys to user passwords requires 11--13 unique schema annotations to secure more than 20 sensitive fields and 2--7 lines of source code changes for three multi-user web applications.
MIT Department
Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike 3.0
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1145/2043556.2043566
