PolyStream

Abstract

With data becoming available in larger quantities and at higher rates, new data processing paradigms have been proposed to handle high-volume, fast-moving data. Data Stream Processing is one such paradigm wherein transient data streams flow through sets of continuous queries, only returning results when data is of interest to the querier. To avoid the large costs associated with maintaining the infrastructure required for processing these data streams, many companies will outsource their computation to third-party cloud services. This outsourcing, however, can lead to private data being accessed by parties that a data provider may not trust. The literature offers solutions to this confidentiality and access control problem but they have fallen short of providing a complete solution to these problems, due to either immense overheads or trust requirements placed on these third-party services. To address these issues, we have developed PolyStream, an enhancement to existing data stream management systems that enables data providers to specify attribute-based access control policies that are cryptographically enforced while simultaneously allowing many types of in-network data processing. We detail the access control models and mechanisms used by PolyStream, and describe a novel use of security punctuations that enables flexible, online policy management and key distribution. We detail how queries are submitted and executed using an unmodified Data Stream Management System, and show through an extensive evaluation that PolyStream yields a 550x performance gain versus the state-of-the-art system StreamForce in CODASPY 2014, while providing greater functionality to the querier.

QShield: Protecting Outsourced Cloud Data Queries With Multi-User Access Control Based on SGX

“…One representative system is CryptDB [2]. Streamforce [3] and PloyStream [4] target at real-time stream processing and extend CryptDB to support multi-user query control. However, both systems encrypt a piece of data multiple times so as to satisfy the queries requested by different data users.…”

“…Hence, many cloud-based systems employ cryptography to encrypt confidential data when being transmitted, processed and/or stored. However, one of the biggest challenges caused by cloud data encryption is how to efficiently utilize encrypted data while not being bothered by encryption, e.g., queries that are frequently performed in many cloud systems [2]- [4]. Typically, a data query can be represented by a SQL-style expression and interpreted as a query plan, i.e., a directed acyclic graph (DAG) of computational operators for execution, such as projection, selection, aggregation, union and join.…”