SHELDB: Client Storage Aware Homomorphic Encrypted Database Processing Framework With Low Communication Overhead

Abstract

Database as a service (DBaaS) in cloud raises severe concern in terms of data security. Storing data in encrypted form may confirm data confidentiality. But, database processing cannot be supported in this encrypted form. Theoretically, homomorphic encryption is a solution to support direct encrypted data processing. In this work, we highlight one of the major challenges of FHE- encrypted query processing that demands huge data transfer requirements from cloud to client for final decryption at the end of SQL query execution. We show in light of Chosen Plaintext Attack (CPA) that in spite of performing conditional filtering through SQL queries over encrypted databases, the size of the resultant dataset cannot be less than the original size of the database. In this work, we make an effort to propose a new encrypted query processing framework termed as SHELDB which supports client storage compatibility and low communication overhead using block-wise final result transmission from cloud to client by extending the concept of TOP operator implementation in standard SQL. However, it is to be noted that realization of such optimization is not straightforward because of circuit-based implementation requirements with FHE gates. Our experimental demonstration shows that the proposed framework is capable of executing all TPC-C standard SQL queries with the aid of 8-core parallel processing within $\sim 12.65$ minutes for an encrypted database of $768 \times 9$ size with 16-bits elements each. Though the computation time is linear with the number of rows, we have explored map-reduce type parallel processing techniques to reduce the timing requirements for databases with larger rows. Consequently, our new query processing framework reduces the communication overhead from m to $\delta k$ rows ($1 \leq \delta \leq block$) where the encrypted database contains m rows, $\delta$ is the number of blocks to be transmitted each time with $k$ = ($m/block$) rows. In spite of $k$ being a controllable parameter according to client storage and $\delta$ is dependent on the query parameters, final security analysis explains why the proposed technique is general database attack-resistant.