Privacy-Preserving Query Execution using a Decentralized Architecture and Tamper Resistant Hardware
Résumé
Current applications, from complex sensor systems (e.g.
quantified self) to online e-markets acquire vast quantities of
personal information which usually ends-up on central servers.
Decentralized architectures, devised to help individuals keep full
control of their data, hinder global treatments and queries,
impeding the development of services of great interest. This paper
promotes the idea of pushing the security to the edges of
applications, through the use of secure hardware devices
controlling the data at the place of their acquisition. To solve this
problem, we propose secure distributed querying protocols based
on the use of a tangible physical element of trust, reestablishing
the capacity to perform global computations without revealing any
sensitive information to central servers. There are two main
problems when trying to support SQL in this context: perform
joins and perform aggregations. In this paper, we study the subset
of SQL queries without joins and show how to secure their
execution in the presence of honest-but-curious attackers. Cost
models and experiments demonstrate that this approach can scale
to nationwide infrastructures.