StealthDB: a Scalable Encrypted Database with Full SQL Query Support
This work addresses the need for scalable and secure encrypted databases for users in untrusted infrastructures, representing an incremental improvement by leveraging existing trusted computing technology.
The authors tackled the problem of building an encrypted database system that balances security and performance by developing StealthDB using Intel SGX, which supports full SQL queries and scales to large workloads with only a 30% throughput decrease compared to unmodified Postgres on a 2GB dataset.
Encrypted database systems provide a great method for protecting sensitive data in untrusted infrastructures. These systems are built using either special-purpose cryptographic algorithms that support operations over encrypted data, or by leveraging trusted computing co-processors. Strong cryptographic algorithms (e.g., public-key encryptions, garbled circuits) usually result in high performance overheads, while weaker algorithms (e.g., order-preserving encryption) result in large leakage profiles. On the other hand, some encrypted database systems (e.g., Cipherbase, TrustedDB) leverage non-standard trusted computing devices, and are designed to work around the architectural limitations of the specific devices used. In this work we build StealthDB - an encrypted database system from Intel SGX. Our system can run on any newer generation Intel CPU. StealthDB has a very small trusted computing base, scales to large transactional workloads, requires minor DBMS changes, and provides a relatively strong security guarantees at steady state and during query execution. Our prototype on top of Postgres supports the full TPC-C benchmark with a 30% decrease in the average throughput over an unmodified version of Postgres operating on a 2GB unencrypted dataset.