Encrypted Data Stream Processing at Scale with Cryptographic Access
Total Page:16
File Type:pdf, Size:1020Kb
TimeCrypt: Encrypted Data Stream Processing at Scale with Cryptographic Access Control Lukas Burkhalter, ETH Zurich; Anwar Hithnawi, UC Berkeley, ETH Zurich; Alexander Viand and Hossein Shafagh, ETH Zurich; Sylvia Ratnasamy, UC Berkeley https://www.usenix.org/conference/nsdi20/presentation/burkhalter This paper is included in the Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’20) February 25–27, 2020 • Santa Clara, CA, USA 978-1-939133-13-7 Open access to the Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’20) is sponsored by TimeCrypt: Encrypted Data Stream Processing at Scale with Cryptographic Access Control Lukas Burkhalter1, Anwar Hithnawi1,2, Alexander Viand1, Hossein Shafagh1, Sylvia Ratnasamy2 1ETH Zürich 2UC Berkeley Abstract Time series workloads come with unique performance and security requirements that existing encrypted data processing A growing number of devices and services collect detailed systems fail to meet: time series data that is stored in the cloud. Protecting the confidentiality of this vast and continuously generated data is (i) Scalability and Interactivity. Query processing over an acute need for many applications in this space. At the same time series data must simultaneously scale to large volumes time, we must preserve the utility of this data by enabling of data, support low-latency interactive queries, and sustain authorized services to securely and selectively access and run high write throughput. To meet these challenges several ded- analytics. This paper presents TimeCrypt, a system that pro- icated databases have been designed for time series work- vides scalable and real-time analytics over large volumes of loads [12, 33, 42, 45, 50, 62, 78]. A key aspect of these sys- encrypted time series data. TimeCrypt allows users to define tems is their use of in-memory indices that store aggregate expressive data access and privacy policies and enforces it statistics, enabling faster query response times and data sum- cryptographically via encryption. In TimeCrypt, data is en- marization. As we discuss in §6/§7, prior work on encrypted crypted end-to-end, and authorized parties can only decrypt data processing does not easily lend itself to maintaining these and verify queries within their authorized access scope. Our in-memory indices. The overhead of the crypto primitives in evaluation of TimeCrypt shows that its memory overhead and encrypted data processing needs to be negligible to meet the performance are competitive and close to operating on data scaling, latency, and performance requirements associated in the clear. with time series workloads. (ii) Secure Sharing. A key challenge in modern systems is 1 Introduction that privacy must co-exist with the desire to extract value from the data, which typically implies sharing data to be analyzed Recent years have seen explosive growth in systems and de- by third-party services [54]. Hence, a truly comprehensive vices that collect time series data and relay it to cloud-based approach to data protection must also comprise mechanisms services for analysis. This growth is only expected to ac- for secure sharing of encrypted data. Sharing should also be celerate with the proliferation of IoT devices, telemetry ser- fine-grained since it is undesirable and often unnecessary to vices, and improvements in data analytics. However, with this give parties unfettered access to the data. Instead, users may growth has come mounting concerns over data protection and want to (1) share only aggregated statistics about the data (e.g., data privacy [66]. Today, the public concern over data privacy avg/min/max), (2) limit the resolution at which such statistics and confidentiality is reaching new heights in light of the are reported (e.g., hourly vs. per-minute), (3) limit the time growing scale and scope of data breaches [17, 29, 56]. To interval over which queries are issued (e.g., only June 2019), grasp the extent of this issue, one can look at the number of (4) or a combination of the above. Moreover, the desired gran- data breaches reported under the new GDPR obligation to no- ularity and scope of sharing can vary greatly across users and tify, which has already exceeded 65,000 in the first year [73]. applications. Hence, support for encrypted query processing Over the last decade, encrypted databases [60, 61, 63, 75, must go hand-in-hand with access control that limits the scope 81] have emerged as a promising solution to tackle the prob- of data that users might query. The sharing paradigm in data- lem of data breaches. The approach of keeping data encrypted stream systems is distinctly different than in conventional while in-use allows users to query encrypted data while pre- databases. Data-stream settings feature a multitude of data serving both confidentiality and functionality. Research in sources continuously pushing data to the cloud, where various this domain has led to various encrypted database designs, in- services that are often not known in advance can subscribe to cluding designs for key-value stores [25], batch analytics [60], consume and analyze data streams. Therefore, such systems graph databases [53], and relational databases [63, 81]. This require flexible access policies. Frequently, there is a need motivates the following natural question: can we enable en- to fuse and analyze data from different sources collectively; crypted data processing for time series workloads? this implies that we need to devise an end-to-end encryption USENIX Association 17th USENIX Symposium on Networked Systems Design and Implementation 835 scheme that is compatible with this sharing paradigm. Contributions. In summary, our contributions are: TimeCrypt. In this paper, we present TimeCrypt, a system • We introduce HEAC, an encryption-based access control that augments time series databases with efficient encrypted construction for stream data that is additively homomor- data processing. TimeCrypt provides cryptographic means phic. HEAC additionally provides verifiable computations to restrict the query scope based on data owners’ defined over ciphertexts to ensure the integrity of the outsourced policies. With TimeCrypt, data owners can cryptographically encrypted computation. restrict user A to query encrypted data at a defined temporal • We design, implement, and evaluate TimeCrypt, the first range and granularity, while simultaneously allowing user B scalable privacy-preserving time series database that meets to execute queries on the same data at a different granularity the scalability and low-latency requirements associated without (i) introducing ciphertext expansion or data redun- with time series workloads. We introduce a design that dancy, (ii) introducing any noticeable delays, or (iii) requiring protects the data confidentiality, yet maintains its utility by a trusted entity to facilitate this. efficiently supporting a rich set of functionalities and ana- In this work, we introduce a partially homomorphic- lytics that are key to time series data. TimeCrypt supports encryption-based access control construction (HEAC) that data lifecycle operations such as ongoing data summariza- supports both fine-grained access control and computations tion and deletion that are common in time series databases. over encrypted data within a unified scheme. These two as- TimeCrypt supports expressive data access and privacy pects have traditionally been addressed independently: the policies, enforceable by encryption. former through cryptographically enforced access control • We make TimeCrypt’s code publicly available1, both as a schemes [35, 39, 49, 59, 83] and the latter through encrypted standalone system and as a library to be integrated with data processing [60, 63, 75, 81]. HEAC simultaneously sup- other time series databases. ports both while meeting the performance and access control requirements of time series workloads. A key insight behind 2 Overview the design of HEAC is based on the observation that time series data streams are continuous and time is the natural TimeCrypt achieves its competitive performance through a attribute for accessing and processing this data. Hence, we careful design of cryptographic primitives tailored for time discretize data streams into fixed-length time segments, and series data workloads. To understand the rationale behind encrypt each segment with a different key using symmetric- our techniques, we start this section by presenting relevant key homomorphic encryption. This allows us to express fine- background on time series data, then we give an overview of grained access policies at the stream segment granularity. TimeCrypt, and describe our security model. This, however, raises two challenges; we need to manage a large number of keys in an efficient and scalable manner and 2.1 Background on Time Series Data translate stream access policies to the corresponding keys suc- Time series Applications. Time series data is increasingly cinctly. To overcome these challenges in HEAC, we associate prevalent across a wide range of systems (e.g., monitoring, keys with temporal segments. With this, we avoid the need to telemetry, IoT) in diverse domains such as health, agricul- maintain a mapping between keys and ciphertexts. We derive ture [82], transportation [69], operational insight [2], and these keys from a hierarchical key-derivation tree construc- smart cities. The growth of time series data is largely at- tion that allows us to express fine-grained