ProDB: A memory-secure database using hardware enclave and practical oblivious RAM

Ziyang Han, Haibo Hu

Research output: Journal article publicationJournal articleAcademic researchpeer-review

Abstract

One key challenge for data owners to host their databases in the cloud is data privacy. In this paper, we first demonstrate that even with the most recent hardware-based security technology such as Intel SGX, a hypervisor can still sniff key database operations running in its guest virtual machine (VM) such as the frequency and type of SQL queries, by monitoring the access pattern of this VM's main and secondary memory. To ensure security against such access pattern monitoring attacks, we then propose ProDB, a minimal adaptation of a conventional DBMS with both hardware enclave and Oblivious RAM protocol. To enhance its performance for practical use, we also design a SQL-aware Path ORAM protocol called SaP ORAM, which optimizes the classic Path ORAM protocol under practical database workload. Through security analysis and extensive experimental results, we prove and show ProDB achieves high security and throughput on commodity cloud hosting servers.

Original languageEnglish
Article number101681
JournalInformation Systems
Volume96
DOIs
Publication statusPublished - Feb 2021

Keywords

  • Access pattern
  • Hardware-based security
  • Oblivious RAM
  • Path ORAM
  • SaP ORAM
  • Secure database

ASJC Scopus subject areas

  • Software
  • Information Systems
  • Hardware and Architecture

Cite this