Abstract:Encrypting data before sending it to the cloud protects it against hackers and malicious insiders, but requires the cloud to compute on encrypted data. Trusted (hardware) modules, e.g., secure enclaves like Intel's SGX, can very efficiently run entire programs in encrypted memory. However, it already has been demonstrated that software vulnerabilities give an attacker ample opportunity to insert arbitrary code into the program. This code can then modify the data flow of the program and leak any secret in the program to an observer in the cloud via SGX side-channels. Since any larger program is rife with software vulnerabilities, it is not a good idea to outsource entire programs to an SGX enclave. A secure alternative with a small trusted code base would be fully homomorphic encryption (FHE) -- the holy grail of encrypted computation. However, due to its high computational complexity it is unlikely to be adopted in the near future. As a result researchers have made several proposals for transforming programs to perform encrypted computations on less powerful encryption schemes. Yet, current approaches fail on programs that make control-flow decisions based on encrypted data. In this paper, we introduce the concept of data flow authentication (DFAuth). DFAuth prevents an adversary from arbitrarily deviating from the data flow of a program. Hence, an attacker cannot perform an attack as outlined before on SGX. This enables that all programs, even those including operations on control-flow decision variables, can be computed on encrypted data. We implemented DFAuth using a novel authenticated homomorphic encryption scheme, a Java bytecode-to-bytecode compiler producing fully executable programs, and SGX enclaves. A transformed neural network that performs machine learning on sensitive medical data can be evaluated on encrypted inputs and encrypted weights in 0.86 seconds.

Information Flows in Encrypted Databases

Secure Skyline Queries on Cloud Platform

Privacy-Preserving Queries On Encrypted Data

SQL queries over encrypted databases: a survey

Secure Graph Database Search with Oblivious Filter

Secure Computation over Encrypted Databases

Secure and Efficient Skyline Queries on Encrypted Data

Securing SQLJ Source Codes from Business Logic Disclosure by Data Hiding Obfuscation

Enjoy the Untrusted Cloud: A Secure, Scalable and Efficient SQL-like Query Framework for Outsourcing Data

Security Framework for Cloud Information under Transparency of a Key

Encrypted Databases: Progresses and Challenges

Distributed secure database service based on sensitive data encryption

Sql-Based Fuzzy Query Mechanism Over Encrypted Database

Passive Attacks Against Searchable Encryption.

Secure Storage and Fuzzy Query over Encrypted Databases.

Storage and Query over Encrypted Character and Numerical Data in Database

Secure Boolean Queries over Encrypted Data from Indistinguishability Obfuscation

Computation on Encrypted Data using Data Flow Authentication

Secure Range Queries for Multiple Users

Constraints, Inference Channels and Secure Databases.

Securely Sharing Data in Encrypted Databases