论文标题
ENCDBDB：可搜索的加密，快速，压缩，内存数据库，使用飞地
EncDBDB: Searchable Encrypted, Fast, Compressed, In-Memory Database using Enclaves
论文作者
论文摘要
数据机密性是客户将数据库外包到云时的重要要求。信任的执行环境（例如Intel SGX）为此加密问题提供了有效的，基于硬件的解决方案。现有的解决方案未针对面向列的内存数据库进行优化，并在飞地上构成了不切实际的内存要求。我们提出了EncDBDB，这是一种用于客户控制的新方法，用于对列导向的内存数据库进行加密，允许使用Enclave进行范围搜索。 ENCDBDB提供了9个加密字典，可为数据提供不同的安全性，性能和存储效率折衷。它特别适合复杂的，读取的，分析性的查询，例如数据仓库中的存在。与明文处理相比，即使对于具有数百万个条目和泄漏的数据库，计算开销也位于毫秒内。压缩加密数据所需的空间比相应的明文列更少。此外，飞地中的最终代码和数据非常小，从而降低了与安全相关的实现错误和侧向通道泄漏的潜力。
Data confidentiality is an important requirement for clients when outsourcing databases to the cloud. Trusted execution environments, such as Intel SGX, offer an efficient, hardware-based solution to this cryptographic problem. Existing solutions are not optimized for column-oriented, in-memory databases and pose impractical memory requirements on the enclave. We present EncDBDB, a novel approach for client-controlled encryption of a column-oriented, in-memory databases allowing range searches using an enclave. EncDBDB offers nine encrypted dictionaries, which provide different security, performance and storage efficiency tradeoffs for the data. It is especially suited for complex, read-oriented, analytic queries, e.g., as present in data warehouses. The computational overhead compared to plaintext processing is within a millisecond even for databases with millions of entries and the leakage is limited. Compressed encrypted data requires less space than a corresponding plaintext column. Furthermore, the resulting code - and data - in the enclave is very small reducing the potential for security-relevant implementation errors and side-channel leakages.
