Enclave Database Statistics Visibility for Privacy-Aware Query Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional hardware-enabled encrypted database (H-EDB) systems face limitations in achieving fully hardware encrypted (F-HE) architectures due to trusted execution environment (TEE) memory constraints, leading to performance issues with input/output costs and data security vulnerabilities.
Innovation Solution
Implementing a fully hardware encrypted (F-HE) database system by residing the entire Database Management System (DBMS) within a Trusted Execution Environment (TEE), providing security and privacy through encryption and masking of database statistics, and controlling visibility based on user-defined security levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a partially hardware encrypted (P-HE) architecture is used with enclave memory constraints, then the database system can operate with limited TEE resources, but I/O performance deteriorates significantly due to frequent encryption/decryption operations between enclave and DBMS
Solution Approach 1:
The database system is segmented into two parts: the DBMS layer outside the enclave that handles I/O operations and query processing, and the enclave layer that provides cryptographic functions. This segmentation allows the DBMS to operate with full I/O performance while the enclave only performs encrypted operations on data already in plaintext form, eliminating the I/O performance penalty of frequent encryption/decryption.
Solution Approach 2:
The patent introduces an intermediary mechanism where the DBMS maintains plaintext copies of data in its buffer pools and only sends encrypted data to the enclave when necessary. The enclave acts as an intermediary that verifies integrity and provides cryptographic operations without forcing the entire DBMS into the enclave, thus maintaining I/O performance while providing security.
2Reliability
If client-side cryptography is used to protect database statistics, then data security is improved, but system complexity increases due to additional cryptographic operations and key management
Solution Approach 1:
The patent extracts the cryptographic complexity from the client-side and relocates it to the enclave. The DBMS and client applications can access statistics in plaintext without managing cryptographic keys, while the enclave independently manages encryption/decryption of statistics data. This extraction reduces system complexity at the client level while maintaining security through enclave-based cryptography.
3Reliability
If the entire DBMS is migrated into the TEE to achieve fully hardware encrypted (F-HE) architecture, then data security is enhanced by preventing data leaks in memory and processor, but TEE memory constraints prevent practical implementation
Solution Approach 1:
The architecture segments the DBMS into components that remain outside the enclave (I/O handlers, query optimizers, buffer pools) and components that interact with the enclave (statistics management, sensitive data processing). This segmentation allows the system to achieve F-HE security for critical data while keeping the bulk of the DBMS outside the enclave to avoid TEE memory constraints.
4Productivity
If database statistics are made visible for query optimization, then query performance is improved, but data privacy is compromised as statistics may leak sensitive information about database contents
Solution Approach 1:
The patent applies local quality by implementing different visibility levels for different statistics. Frequently accessed statistics that are less sensitive to privacy leaks are made fully visible for query optimization, while statistics containing sensitive information are restricted to authorized users only. The enclave enforces these local quality differences through fine-grained access control, allowing query optimization where safe while protecting privacy where needed.
Data Source
AI summary
A database management system provided in a trusted execution environment controls the visibility of a requested statistic for a database table column based on the source of the request. The visibility control is based on a visibility level of the database table column to the source of the request. The visibility of the provided statistic can further be based on a security level of the database table column even if the source of the request is not a permitted viewer. The statistic can include frequency or histogram data for the database table column.