Styx

Abstract

With the advent of the Internet of Things (IoT), billions of devices are expected to continuously collect and process sensitive data (e.g., location, personal health). Due to limited computational capacity available on IoT devices, the current de facto model for building IoT applications is to send the gathered data to the cloud for computation. While private cloud infrastructures for handling large amounts of data streams are expensive to build, using low cost public (untrusted) cloud infrastructures for processing continuous queries including on sensitive data leads to concerns over data confidentiality. This paper presents STYX, a novel programming abstraction and managed runtime system, that ensures confidentiality of IoT applications whilst leveraging the public cloud for continuous query processing. The key idea is to intelligently utilize partially homomorphic encryption to perform as many computationally intensive operations as possible in the untrusted cloud. STYX provides a simple abstraction to the IoT developer to hide the complexities of (1) applying complex cryptographic primitives, (2) reasoning about performance of such primitives, (3) deciding which computations can be executed in an untrusted tier, and (4) optimizing * cloud resource usage. An empirical evaluation with benchmarks and case studies shows the feasibility of our approach.

SecureStreams

“…We plan in our future work to further extend and thoroughly evaluate S S against other known approaches on secure stream processing, like S [45], MrCrypt [47] or DEFC [38]. In particular, we plan to extend S S with full automation of container deployments, as well as enriching the framework with a library of standard stream processing operators and e cient yet secure native plugins, to ease the development of complex stream processing pipelines.…”

“…S S avoids of complex encryption schemes, decrypts data entering enclaves and processes in plaintext. e S [45] system uses partial homorphic encryption to allow for e cient stream processing in trusted cloud environments. Interestingly, the authors of that system mention Intel® SGX as possible alternative to deploy stream processing systems on trusted hardware o ered by untrusted/malicious cloud environments.…”

Distributed systems and trusted execution environments : trade-offs and challenges

“…Some proposals rely on a hybrid model with trusted and untrusted infrastructures, where critical processing is done in private clouds. Under this model, Styx [118] uses partial homomorphic encryption and show overheads of 25 % in comparison to Apache Storm. However, they cannot guarantee data integrity.…”