ProDB: A memory-secure database using hardware enclave and practical oblivious RAM. Issue 96 (February 2021)

• Record Type: Journal Article
• Authors: Han, Ziyang; Hu, Haibo
• Is Part Of: Information systems. Issue 96(2021)
• Publication Date: 2021-02
• Subjects: Access pattern -- Oblivious RAM -- Secure database -- Path ORAM -- SaP ORAM -- Hardware-based security; Database management -- Periodicals; Electronic data processing -- Periodicals; Bases de données -- Gestion -- Périodiques; Informatique -- Périodiques; Database management; Electronic data processing; Periodicals; 005.7
• DOI: 10.1016/j.is.2020.101681
• Languages: English
• ISSNs: 0306-4379

Abstract

Abstract: One key challenge for data owners to host their databases in the cloud is data privacy. In this paper, we first demonstrate that even with the most recent hardware-based security technology such as Intel SGX, a hypervisor can still sniff key database operations running in its guest virtual machine (VM) such as the frequency and type of SQL queries, by monitoring the access pattern of this VM's main and secondary memory. To ensure security against such access pattern monitoring attacks, we then propose ProDB, a minimal adaptation of a conventional DBMS with both hardware enclave and Oblivious RAM protocol. To enhance its performance for practical use, we also design a SQL-aware Path ORAM protocol called SaP ORAM, which optimizes the classic Path ORAM protocol under practical database workload. Through security analysis and extensive experimental results, we prove and show ProDB achieves high security and throughput on commodity cloud hosting servers.