Private and Scalable Execution of SQL Aggregates on a Secure Decentralized Architecture

Abstract

Current applications, from complex sensor systems (e.g. quantified self) to online e-markets acquire vast quantities of personal information which usually end-up on central servers where they are exposed to prying eyes. Conversely, decentralized architectures helping individuals keep full control of their data, complexify global treatments and queries, impeding the development of innovative services. This paper precisely aims at reconciling individual's privacy on one side and global benefits for the community and business perspectives on the other side. It promotes the idea of pushing the security to secure hardware devices controlling the data at the place of their acquisition. Thanks to these tangible physical elements of trust, secure distributed querying protocols can reestablish the capacity to perform global computations, such as SQL aggregates, without revealing any sensitive information to central servers. This paper studies how to secure the execution of such queries in the presence of honest-but-curious and malicious attackers. It also discusses how the resulting querying protocols can be integrated in a concrete decentralized architecture. Cost models and experiments on SQL/AA, our distributed prototype running on real tamperresistant hardware, demonstrate that this approach can scale to nationwide applications.

Managing Distributed Queries under Personalized Anonymity Constraints

“…However, the decentralized nature of the Trusted Cells architecture must not hinder global computations and queries, impeding the development of services of great interest for the community. SQL/AA (SQL Asymmetric Architecture) is a protocol to execute standard SQL queries on the Trusted Cells architecture To et al, 2016). It has been precisely designed to tackle this issue, that is executing global queries on a set of TDSs without recentralizing microdata and without leaking any information.…”

“…Finally, note that the aggregation phase is recursive and runs until all tuples belonging to a same group have been actually aggregated. We refer the interested reader to To et al, 2016) for a more detailed presentation of the SQL/AA protocol.…”

“…For the sake of simplicity, we do not consider joins between data stored in different TDSs but internal joins which can be executed locally by each TDS are supported. We refer to To et al, 2016) for a deeper discussion on this aspect which is not central to our work in this paper.…”

“…k i SQL/AA is an extension of the SQL/AA protocol To et al, 2016) where the enforcement of the anonymity guarantees have been pushed in the collection, aggregation and filtering phases.…”

“…We have implemented the k i SQL/AA protocol on equivalent open-source hardware used in To et al, 2016). The goal of this experimental section is to show that there is very little overhead when taking into account personalized anonymity constraints compared to the performance measured by the original implementation of To et al.…”