ITR: Privacy in Database-As-A-Service (DAS) Model

网络和互联网技术的快速发展推动了企业计算的“软件即服务”模式的出现，该模式使组织能够外包许多信息技术(IT)服务。这种模式使组织能够专注于其核心业务，而不是维持在IT方面的大量投资。IT外包利用了硬件、软件、人员以及维护和升级成本，从而节省了规模经济。外包在企业资源规划(ERP)和客户关系管理(CRM)领域是一种常见的做法，它在电子邮件、存储和灾难保护等基本服务中越来越受欢迎。数据管理系统是几乎所有类型的组织使用的最常见、最昂贵和最复杂的软件系统之一。在设想的“数据库即服务”(DAS)模型中，客户端的数据驻留在服务提供者的前提下，并使用SQL查询进行访问。由于客户的数据作为一种非常有价值的资产，服务提供商必须实施足够的安全措施来保障数据隐私。这项研究将探讨由此带来的挑战：(1)针对恶意外来者的隐私保护：保护服务提供商免受客户数据被盗(例如，黑客侵入提供商的网站并扫描所有磁盘)。(2)数据库服务提供商的隐私保护：确保客户的加密数据不能在服务提供商处解密。因此，需要开发在服务提供商处评估对加密数据的查询的技术。(3)确保结果的完整性：开发可扩展的技术，以确保服务提供商针对客户的查询准确返回正确的答案集。

Rapid advances in networking and Internet technologies has fueled the emergence of the "software as a service" model for enterprise computing that enables organizations to outsource many Information Technology (IT) services. This model allows organizations to concentrate on their core business instead of sustaining large investments in IT. IT outsourcing results in savings from the economies of scale due to leveraging of hardware, software, personnel, as well as maintenance and upgrade costs. Outsourcing is a common practice in Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) domains and it is gaining popularity in basic services such as email, storage and disaster protection.This research will explore the data privacy challenges that arise in outsourcing data management services. Data management systems are among the most common, expensive, and complex software systems used by almost all types of organizations. In the envisioned "database as a service" (DAS) model, the client's data resides on the premises of the service provider and is accessed using SQL queries. Since clients' data as a very valuable asset, the service provider must implement sufficient security measures to guarantee data privacy. The research will explore the resulting challenges: (1) Privacy protection from malicious outsiders: protecting service providers from theft of customer data (e.g., hackers breaking into a provider's site and scanning all disks). (2) Privacy protection from database service providers: assuring that clients' encrypted data cannot be decrypted at the service provider. Thus, techniques to evaluate queries over encrypted data at the service provider need to be developed. (3) Ensuring Integrity of the Results: developing scalable techniques to ensure that the service provider returns exactly the right answer set to the client's query.