Symmetrically-Private Database Search in Cloud Computing

Database outsourcing has gained importance in the past few years due to the emergence of the cloud computing. In Database-as-a-Service (DaaS), which is a category of cloud computing services, the database owner outsources both databases and querying services to a cloud server and clients issue queries over the database to the cloud server. In this context, privacy is a primary challenge and it is necessary to fulfill main privacy requirements of database owners and clients. This paper presents protocols for executing keyword search and aggregate SQL queries that preserve the privacy of both the client and the database owner. Client privacy is preserved such that the database owner and the cloud server cannot infer the constants contained in the query predicates. Database owner privacy is preserved such that the client cannot obtain any additional information beyond the query result. The primitives that are utilized in designing these protocols include symmetric private information retrieval and private integer comparison. We experimentally evaluate the performance of the proposed protocols and report on the experimental results.

I. Introduction

The opportunity to offer a DBMS as an outsourced service is gaining momentum. Database-as-a-Service (DaaS) is a category of cloud computing services that enables IT providers to deliver database functionality as a service. The main entities in DaaS are database owners, cloud servers and clients. To alleviate the workload of the data owner in answering queries, the data owner delegates the tasks of database storage and query processing to the cloud server. The cloud server stores databases and answers queries issued by clients. Databases are private assets of the data owner and should be protected from the cloud server and the querying client. Thus, the data owner encrypts databases before outsourcing them to the cloud server. On the other hand, the client's objective is to execute queries on the encrypted databases outsourced to the cloud server. The query might disclose sensitive information of the client and should be protected from the cloud server and the data owner. Therefore, a vital concern in DaaS is to protect the privacy of both the data owner and the client.