Authenticated indexing for outsourced spatial databases

Transcription

1 The VLDB Journal (2009) 8: DOI 0.007/s REGULAR PAPER Authenticate inexing for outsource spatial atabases Yin Yang Stavros Papaopoulos Dimitris Papaias George Kollios Receive: February 2008 / Revise: 2 May 2008 / Accepte: 23 July 2008 / Publishe online: 23 September 2008 Springer-Verlag 2008 Abstract In spatial atabase outsourcing, a ata owner elegates its ata management tasks to a location-base service (LBS), which inexes the ata with an authenticate ata structure (ADS). The LBS receives queries (ranges, nearest neighbors) originating from several clients/subscribers. Each query initiates the computation of a verification object (VO) base on the ADS. The VO is returne to the client that can verify the result correctness using the public key of the owner. Our first contribution is the MR-tree, a space-efficient ADS that supports fast query processing an verification. Our secon contribution is the MR*-tree, a moifie version of the MR-tree, which significantly reuces the VO size through a novel embeing technique. Finally, whereas most ADSs must be constructe an maintaine by the owner, we outsource the MR- an MR*-tree construction an maintenance to the LBS, thus relieving the owner from this computationally intensive task. Keywors Authenticate inex Database outsourcing Spatial atabase Mobile computing Y. Yang S. Papaopoulos D. Papaias (B) Hong Kong University of Science an Technology, Kowloon, Hong Kong imitris@cse.ust.hk Y. Yang yini@cse.ust.hk S. Papaopoulos stavros@cse.ust.hk G. Kollios Boston University, Boston, MA, USA gkollios@cs.bu.eu Introuction Spatial atabase outsourcing is motivate by the large availability of spatial ata from various sources (e.g., satellite imagery, lan surveys, environmental monitoring, an traffic control). Often, agencies collecting such ata (e.g., government epartments, non-profit organizations) are not able to support avance query services; outsourcing to a locationbase service (LBS) is the only option for utilizing the ata. Furthermore, even if an agency possesses the necessary functionality, it may be beneficial in terms of cost, visibility, ease of access etc., to replicate the ata in a specialize LBS. Finally, the value of an outsource ataset may increase if it is combine with the functionality (e.g., riving irections, aerial photos, etc.) of general-purpose online maps. Figure illustrates a common framework for atabase outsourcing aopte from the relational literature. The ata owner (DO) obtains, through a key istribution center, a private an a public key. In aition to the initial ata, the owner transmits to the LBS a set of signatures require for authentication. Whenever upates occur, the relevant ata an signatures are also forware to the LBS. The LBS receives an processes spatial queries, (e.g., ranges, k-nearest-neighbors) from clients. The three parties have ifferent computational power: a typical DO possesses a few workstations; the LBS runs a server farm; a client is usually a mobile evice (e.g., PDA) on battery power. Therefore, the LBS shoul perform most of the computation in orer to minimize the workloa of the DO an, especially, the clients. Since the LBS is not the real owner of the ata, the client must be able to establish the sounness an completeness of the results. Sounness means that every recor in the result set is present in the owner s atabase an is not moifie. Completeness means that no vali result is missing. In orer to process authenticate queries efficiently, the LBS inexes

2 632 Y. Yang et al. DO initial ata & signatures ata upates & signature upates LBS Fig. Database outsourcing framework query query results & VO Client the ata with an authenticate ata structure (ADS). Each incoming query initiates the computation of a verification object (VO) using the ADS. The VO (which inclues the query result) is returne to the client that can verify sounness an completeness using the public key of the DO. Ieally, an ADS must consume little space, support efficient query processing, an lea to small VOs that can be easily transferre an verifie. In aition, it must be able to hanle upates. Most isk-base ADSs focus on D ranges. The only work ealing with multi-imensional ranges is [7], which applies the signature chain concept [28] to KDtrees an R-trees. The R-tree base ADS, calle VR-tree, is the best between the two options, an is use as the benchmark for the propose techniques. Our first contribution is the MR-tree, an inex base on the R*-tree, capable of authenticating arbitrary spatial queries. We show, analytically an experimentally, that the MR-tree is consierably faster to buil an consumes less space than the VR-tree. At the same time, it is much more efficient for query processing an verification. Furthermore, it supports upates (whereas upate algorithms have not been propose for the VR-tree). The most important metric in most applications is the VO size because it etermines the amount of network transmission from the LBS to the client, which is usually the bottleneck of the entire system. This is especially true for mobile clients (e.g., PDAs an smart phones) where battery consumption is a major concern, since wireless transmissions consume significantly more power than offline computations []. Our secon contribution, the MR*-tree, employs a novel embeing technique to consierably reuce the VO size compare to the MR-tree, while imposing marginally more CPU overhea for the LBS an the client. In the majority of outsourcing systems, the initial construction as well as the upates of the ADSs are not outsource, but performe locally by the owner an transmitte to the service provier. Consequently, the DO must acquire the software for maintaining the structures, an eicate the harware to perform the computations. In the case of spatial outsourcing, the problem is magnifie because ata inexing an upating require specialize (i.e., non-relational) schemes an incur high cost. Our thir contribution solves this problem through a set of secure an efficient protocols for fully outsourcing inex maintenance to the LBS. Specifically, the expensive initial construction an upate operations are performe entirely by the LBS. The DO only nees to authenticate the inex through cheap verification processes. Furthermore, it oes not nee to store the tree locally. The rest of the paper is organize as follows. Section 2 surveys relate work. Section 3 escribes the basic MR-tree structure, iscusses query processing, an offers cost moels for its performance. Section 4 proposes the MR*-tree an relate algorithms. Section 5 focuses on protocols for outsourcing the construction an maintenance of the MR- an MR*-tree. Section 6 contains a comprehensive experimental evaluation, an Sect. 7 conclues the paper. 2 Backgroun Section 2. overviews existing solutions for authenticating one-imensional range queries. Section 2.2 iscusses multiimensional query authentication, focusing on the VR-tree. Section 2.3 surveys alternative moels for atabase outsourcing. 2. D range query authentication The Merkle Hash Tree (MH-tree) [22] isamain-memory ADS that has influence several authenticate processing techniques. It is a binary tree that hierarchically organizes hash values (or igests). Figure 2 illustrates a MH-tree covering eight ata recors 8, each assigne to a leaf. A noe N contains a igest H N compute as follows: if N is a leaf noe, H N = hash( N ), an N is the assigne recor of N, e.g., H = hash( ); otherwise (N is an internal noe), H N = hash(h N.lc H N.rc ), where N.lc (N.rc) is the left (right) chil of N, respectively, an concatenates two binary strings, e.g., H 4 = hash(h 2 H 3 4 ).After builing the tree, the DO signs the igest H root store in the root of the MH-tree, using a public key igital signature scheme (e.g., RSA [25]). Devanbu et al. [0] authenticate one-imensional range queries using a MH-tree on the query attribute. Figure 2 shows an example, where the LBS receives query Q covering recors 4 an 5. The LBS first etermines the bounary recors of Q, i.e., 3, an 6 which boun Q s result. Then, it follows the root-to-leaf path (root, N 4, N 3 4, N 3 ) to the left bounary recor 3. For each noe visite, the igest (H 2 ) of its left sibling is inserte into the VO. Recors 3, 4, 5, 6 are ae to the VO. Similarly, the igests (H 7 8 ) of all right-siblings on the path from the root to the right bounary 6 are also appene. The LBS sens the VO an the signature of H root to the client. To verify the sequence, the client re-constructs the igest at the root of the MH-tree using 3, 4, 5, 6, an the igests in the VO Throughout the paper, the term hash function implies a one-way, collision-resistant hash function. In this work we employ SHA [25].

3 Authenticate inexing for outsource spatial atabases 633 sent to the client N -2 N -4 N3-4 signe by the owner Hroot H -4 H 5-8 P 2 P 4 P 6 P 8 P 0 P 2 P 4 N N 4 N 6 N 5 N 9 H -2 H 3-4 H 5-6 H 7-8 N 3 H H 2 H 3 H 4 H 5 H 6 H 7 H Q Fig. 2 Example of a MH-tree N 4 P P P 9 5 P P 5 P 3 P 7 Q P 3 N 3 N 8 N 2 N 7 (a) Leaf Noe Internal Noe Fig. 4 Signature chains in the VR-tree (b) s 02 s s 234 Fig. 3 Example of signature chaining s 345 insie MB-tree noes in orer to reuce the VO size. Aaptations of MH-trees have also been use to hanle continuous authenticate processing in streaming environments [2,32]. Finally, Tamassia an Trianopoulos [36] propose a istribute MH-tree for ata authentication over peer-to-peer networks. 2.2 Multi-imensional query authentication (H 2, H 7 8 ) : H root = hash(hash{h 2 hash[hash( 3 ) (hash( 4 ))]} hash{hash[hash( 5 ) (hash( 6 ))] H 7 8 }). If the re-constructe H root matches the owner s signature, the result is soun. The bounary recors also guarantee that no recors are omitte from the query enpoints (completeness). The VB-tree [3] is a isk-base ADS that establishes the sounness, but not the completeness, of D range results. Signature chaining [27,28] authenticates both sounness an completeness. Figure 3 illustrates an example, assuming that the atabase contains four tuples 4,sorteonthe query attribute. The ata owner inserts two special recors 0, 5 with values an +, an creates four signatures s 02, s, s 234, s 345, one for each triplet of ajacent tuples; s 02 correspons to, s to 2, an so on. The ata an signatures are then transferre to the LBS. Let the result of a range query contain, 2, an 3. The LBS inserts into the VO:theresult(, 2, 3 ), the signature for each tuple in the result (s 02, s, s 234 ), an the bounary recors 0 an 4.GiventheVO, the client checks that (i) the two bounary recors fall outsie the query range an (ii) all signatures are vali. The first conition ensures that no results are missing at the range bounaries, i.e., an 3 are inee the first an last recors of the result. The secon guarantees that all results are correct. The Merkle B-tree (MB-tree) [20] is a isk-base aaptation of the MH-tree. Each internal noe stores entries e of the form (e.p, e.k, e.h), where e.p points to a chil noe N c, e.k is the search key an e.h is a hash value compute on the concatenation of the igests of the entries in N c. Leaf noes store recors an their respective igests. The DO signs the hash value of the concatenation of the igests containe in the root of the tree. Compare to signature chaining, the MB-tree incurs less space overhea since igests are smaller than signatures an less verification effort because only the root is signe. Li et al. [20] propose embee structures A combination of the MH-tree an the Range Search tree [3] is exploite in [0] to authenticate multi-imensional range queries. Martel et al. [23] exten the MH-tree concept to arbitrary search Directe Acyclic Graphs (DAGs), incluing ictionaries, tries, an optimize range search trees. Goorich et al. [4] present ADSs for graph an geometric searching. These techniques, however, focus on main memory an are highly theoretical in nature. For example, the range search tree is rarely use in practice ue to its high space requirements: O( D log D ), where D an are the size an imensionality of the ata, respectively. The only multi-imensional ADSs in the atabase literature are the VKD-tree an VR-tree [7]. These structures apply the signature chain concept to KD-trees [3] an R-trees [3], respectively. We focus on the VR-tree since, as shown in [7], it outperforms the VKD-tree. All points in a leaf noe are sorte accoring to their x-coorinates. Two fictitious points are ae before the first an after the last point of the noe. Following [28], the VR-tree creates one signature for each sequence of three points an stores it along with each entry, e.g., in Fig. 4a, the entry for P 8 contains s 789. For internal noes, the minimum bouning rectangles (MBRs) of chil noes are sorte on their left sie an a signature chain is forme in a similar way. For instance, in Fig. 4b, the signature of noe N 4 is s 345. The processing of range queries is similar to the R-tree, except for the aitional VO construction. Consier query Q in Fig. 4a, which retrieves P 9 an P. For each inex noe visite, all MBRs in this noe are inserte into the VO. The corresponing signatures participate in the incremental construction of an aggregate 2 signature s. When a leaf noe of the VR-tree is reache, all points whose x-coorinates 2 Signature aggregation [24] conenses multiple signatures into a single one, thus significantly reucing the total size.

4 634 Y. Yang et al. fall in the query range (P 8 P 2 ) an the two bounary points (P 7, P 3 ) are inserte into the VO. The corresponing signatures are aggregate in s, which is inclue in the VO. To verify results, the client starts from the root an compares all MBRs against the query. Then, it reas the content of each noe whose MBR overlaps the query from the VO an recursively checks all its chilren. Finally, at the leaf level, it can extract the query results. During this proceure, the client incrementally constructs an aggregate igest from the MBRs an points inclue in the VO, which is eventually verifie against the aggregate signature. Cheng an Tan [5,6] present an improve version of the VR-tree to authenticate various multi-imensional query types, incluing k nearest neighbor an 2D reverse nearest neighbor queries. Furthermore, they apply a collaborative igest computation technique introuce in [28] to avoi isclosing objects that o not belong to the query result (e.g., bounary recors). 2.3 Other relate work In certain scenarios, efficient authentication oes not require an ADS. Sion [34] assumes a semi-truste server (e.g., LBS in our setting), whose motivation for cheating is to save computation resources. The only client for this server is the DO, which issues a batch of queries together with a challenge token that captures authenticate information about the result of a secret query Q from the batch. The SP respons with the result sets of all queries an the i of Q. This metho probabilistically establishes that the LBS has inee performe the necessary computations to correctly answer all queries in the batch. However, a malicious LBS can return incorrect results after performing the proper compuations. Another metho [38] incorporates fake tuples in the ataset. The DO encrypts all recors an transmits them to the server. It also provies the clients with the function use to generate the fake tuples. The server cannot istinguish the fake from the real recors. The encryption scheme implicitly ensures sounness. The clients can probabilistically verify completeness by checking whether all fake tuples satisfying the query are present in the result set. Note that all clients are consiere truste, because otherwise the server coul collue with a client an obtain the fake tuple generator. This scheme cannot be applie to our moel, since we o not assume any egree of trust for the LBS an the clients. Several papers stuy privacy preservation of outsource ata, uner a moel similar to [34], i.e., the only client is the DO. Hacıgümüşetal.[7,8] assume that the DO transmits encrypte ata to the server, along with a set of crypto-inices, one for each query attribute. Specifically, for every such attribute, the DO partitions all its values into buckets, an stores in the corresponing crypto-inex the bucket is for each recor. To process a range query Q, the DO translates Q into Q by replacing attribute values with bucket is; the server answers Q using the crypto-inices an returns the encrypte tuples. Note that the results of Q are a superset of that of Q. Decryption an filtering of false hits are performe at the client s site. In the same context, Damiani et al. [2] propose a metho where the client executes a sequence of queries that retrieve encrypte inex noes at progressively eeper levels. Agrawal et al. [] introuce OPES, a scheme where the encrypte ata preserve the original orer, eliminating the use of aitional cryptoinices. Ge an Zonik [5] stuy aggregate query processing over encrypte ata. De Capitani i Vimercati et al. [8] investigate access control enforcement in outsource atabases. Finally, Wong et al. [37] enable mining of association rules on ata encrypte with -to-n item mapping transformations. Query authentication methos can be use in combination with the above-mentione techniques. 3MR-tree Section 3. presents the structure of the MR-tree, an escribes query processing an authentication. Section 3.2 contains cost moels for various performance metrics, an compares the MR-tree an the VR-tree analytically. 3. Structure an query processing The MR-tree combines concepts from MB- [20] an R*-trees [4]. Figure 5 illustrates the noe structure. Leaf noes are ientical to those of the R*-tree: each entry P i correspons to a ata object. Note that although our examples use points, the MR-tree is applicable to objects with arbitrary shapes. We hereafter use terms object an point interchangeably. A igest is compute on the concatenation of the binary representation of all objects in the noe. Internal noes contain entries of the form (p i, MBR i, H i ), signifying the pointer, minimum bouning rectangle, an igest of the ith chil, respectively. The igest summarizes chil noes MBRs (MBR -MBR f ), in aition to their igests (H H f ). As we iscuss shortly, this esign is vital to prove completeness of spatial query results. The igest of the root noe H root is signe by the DO an is store with the tree. To process a range query Q, the LBS invokes RangeQuery (Q, root), shown in Fig. 6, where symbols e.p (e.p, e.mbr, e.h) enote the ata object (chil pointer, MBR, igest) storeinanentrye of a leaf noe (internal noe), respectively. The algorithm computes the verification object by following a epth-first traversal of the MR-tree. The VO contains three types of ata: (i) all objects in each leaf noe visite (line 4), (ii) the MBR an igests of prune noes (line 8), an (iii) special tokens [ an ] that mark the scope of a noe (lines an 9). New entries are always appene to the en of the VO.

5 Authenticate inexing for outsource spatial atabases 635 H=hash(P P 2... P f ) P P 2... (a) Leaf noe H=hash (MBR H MBR 2 H 2 MBR f H f p MBR H p 2 MBR 2 Fig. 5 MR-tree noe structure H 2... (b) Internal noe P f p f MBR f H f RangeQuery(Query Q, MR_Noe N) // LBS. Appen [ to VO 2. For each entry e in N 3. If N is leaf 4. Appen e.p to VO 5. Else // N is internal noe 6. If e.mbr overlaps Q, RangeQuery(Q, e.p) 7. Else // a prune chil noe 8. Appen (e.mbr, e.h) to VO 9. Appen ] to VO Fig. 6 Query processing with the MR-tree P N P 0 P P 2 N 6 P 9 N 2 P 8 N 5 P 6 N 4 P 4 N P 3 P Q 5 2 P 3 P P 2 P 3 (a) Points an noe MBRs P 4 P 5 P 6 Fig. 7 Example range query N N 2 N 3 N 4 N 5 N 6 (b) MR-tree P 7 P 8 P 9 P 7 P 0 P P 2 Consier, for instance, query Q in the example tree of Fig. 7. Similar to conventional R-trees, RangeQuery starts from the root an recursively visits all entries that overlap the shae rectangle: N, N 2, N 4, N 5. After termination, the verification object is: [[(N 3.MBR, N 3.H), [P 4, P 5, P 6 ]]], [[P 7, P 8, P 9 ],(N 6. MBR, N 6.H)]]. The tokens signify the contents of a noe; for example, component [[(N 3.MBR, N 3.H), [P 4, P 5, P 6 ]]] correspons to the first root entry (N ), an the rest of the VO to the secon one (N 2 ). The LBS transmits the VO an the root signature s root to the client. Note that the actual result (e.g., P 4, P 7 ) is part of the VO. (MBRValue, HashValue)=RootHash(VerObj VO) // Client. Set str= an MBR=NULL 2. While VO still has entries 3. Get next entry e V from VO 4. If e V is a ata object P 5. If P overlaps the query, A P to the result set 6. Enlarge MBR to inclue P 7. str = str P 8. If e V is a pair of MBR/igest (MBR_c, H_c) 9. Enlarge MBR to inclue MBR_c 0. str = str MBR_c H_c. If e V is [ 2. (MBR_c, H_c) = RootHash(VO) 3. Enlarge MBR to inclue MBR_c 4. str = str MBR_c H_c 5. If e V is ], Return (MBR, hash(str)) Fig. 8 Algorithm for re-computing H root To verify the query results, the client first scans the VO to check that: (i) no MBR (of a prune noe) in the VO overlaps Q, an (ii) the compute H root from the VO agrees with s root. Figure 8 shows the recursive proceure RootHash that computes H root. The main iea is to simulate the MR-tree traversal performe by the LBS, an calculate the MBR, an igests bottom-up. Note that the actual query results are containe in the VO an are extracte uring RootHash (line 5). In the example of Fig. 7, RootHash computes the MBR an igest of noes N 4 (from P 4 P 6 ), N (from N 3, N 4 ),N 5 (from P 7 P 9 ), N 2 (from N 5, N 6 ), root (from N, N 2 ), in this orer. Note that all entries in the VO, from the [ of the root to its ], must be use. Furthermore, the algorithm is online, meaning that it performs a single sequential scan of the VO. The actual results (P 4, P 7 ) are extracte in line 5. Note that the client also receives some (bounary) objects (P 5, P 6, P 8, P 9 )inthevo, which are not part of the result, but are necessary for its verification. Proof of sounness: Assume that an object P in the result set is bogus or moifie. Because the hash function is collision-resistant anp must be use by RootHash, the re-compute H root cannot be verifie against s root, which is etecte by the client. Proof of completeness. Let P be an object satisfying Q. Consier the leaf noe N l containing P. For the re-compute H root to match s root, either N l s true contents or MBR/hash must be in the VO. In the former case, P is in the VO an is extracte in line 5 of RootHash. In the latter case, N l s MBR overlaps Q, which alarms the client about potential violation of completeness. In aition to range search, the MR-tree can authenticate other common spatial queries, incluing k nearest neighbors (knn) an skylines. Given a point Q,a knn query retrieves the k points from the ata set that are closest to Q [9]. In the example of Fig. 9a, the three NNs of Q are P, P 2, an P 3, in increasing orer of istance from Q. A key observation is that the knn of Q lie in a circular area C centere at Q that

6 636 Y. Yang et al. P 6 P 5 P Q P 2 P 3 P 4 (a) knn Fig. 9 Alternative queries x P P 2 P 3 P 4 P 5 P 6 P P 7 7 (b) Skyline contains exactly k ata points. Therefore, the LBS can prove the knn results by sening to the client the VO corresponing to C. Specifically, it first fins the k neighbors, then it computes C, an finally executes RangeQuery treating C as the range. The verification process of the client is ientical to the one performe for range queries. A skyline query retrieves all points that are not ominate by others in the ataset [30]. A point P i ominates another P j, if an only if, the coorinate of P i on each imension is no larger than the corresponing co-orinate of P j. The skyline in Fig. 9b contains P, P 2 an P 7.To prove it, the LBS processes a range query that contains the area of the ata space not ominate by any skyline point. This area (shae in Fig. 9b) can be ivie into multiple rectangles. The result contains only the skyline points, an can again be verifie accoring to the methoology of range search. Finally, our iscussion assumes no access control restrictions so that the VO inclues (bounary) recors that o not belong to the query result (e.g., P 5, P 6, P 8, P 9 in the example of Fig. 7). If necessary, the LBS can hie the aitional objects, by applying the following moifications base on [5,6,28]. First, the hash value H N of a leaf noe N (containing f points N.P, N.P 2,,N.P f ) is reefine as H N = hash(hash (N.P ) hash (N.P 2 )... hash (N.P f )), where hash follows the efinition of [28]. Secon, each point P outsie the result that must be present in the VO is replace by a pair P ref, H P [5,6], where (i) P ref is a reference point not necessarily in the ataset, an (ii) H P encoes the relationship between P ref an P, such that the client is able to compute hash (P) with P ref an H P, an at the same time verify that P is inee outsie the query Q. An alternative approach to hie the bounary points is base on zero knowlege proofs [6]. 3.2 Cost moels The important performance metrics for authenticate structures are (i) inex construction time, (ii) inex size, (iii) query processing cost, (iv) size of the VO, an (v) verification time. The first metric affects the party that buils the inex, i.e., epening on the system, the DO or the LBS. The secon one burens the LBS an, in some cases, the DO (if it also y Table Symbols an values in the analysis Symbol Description Value C s Cost of sign operation 3.4 ms C v Cost of verify operation 60 µs C H Cost of hash operation 28 µs C m Cost of multiply operation 43 µs C NA Cost of a ranom noe access 5 ms S s Size of a signature 28 bytes S H Size of a igest 20 bytes S M Size of an MBR 32 bytes S P Size of a ata point 6 bytes D Data carinality 2,000,000 Data imensionality 2 Q l Query extent on one imension 0% of space b Block size 4096 bytes f l Fanout of leaf noe VR 9 MR 79 f n Fanout of internal noe VR 7 MR 5 g Height of the tree VR 5 MR 4 has to maintain the inex). Furthermore, it affects the communication cost between the two. Metric (iii) is important only for the LBS. The size of the VO influences the network overhea between the LBS an the client. Finally, the verification time burens exclusively the client. In the sequel, we analytically compare the MR-tree an the VR-tree on the above metrics. Table summarizes the symbols use in the analysis, as well as their typical values ( ms = 0 3 s, µs = 0 6 s). These values were obtaine base on the harware an software settings of our experiments, using the Crypto++ library. Our measurements are similar to those of the library benchmarks [9] an the values suggeste in [20]. We first establish a simple cost moel for the R-tree, base on the fact that in -imensional unit space [0,], the probability that two ranom rectangles r, r 2 overlap is P overlap (r, r 2 ) = (r.l j + r 2.l j ) (3.) j= where r.l j enotes rectangle r s extent along the jth imension [29]. For simplicity, we assume that the ata set contains points (rectangular ata are iscusse in [35]) uniformly istribute in the unit space an query Q has equal length Q l on all imensions. Let f l ( f n ) be the average fanout of a leaf (internal) noe, an D be the ata carinality. The number of leaf noes is D /f l, an the height of the R-tree is g = + log fn ( D /f l ). The number of internal noes at epth i of the tree (assuming a complete tree where the root has epth 0) is fn i, each containing D /f n i ata points in its sub-tree. Because of the uniform istribution, the number of points in a noe is proportional to the space covere by this noe. Following [35], we assume that all noes at the

7 Authenticate inexing for outsource spatial atabases 637 same level are squares with similar sizes. Therefore, a noe at epth i covers /fn i space, an has length /fn i on each imension. Applying Eq. 3., the total cost of processing Q using the VR- or the MR-tree is g 2 ( ) ( C Q =C NA fn i /fn i ) + Q l + f l fl / D + Q l i=0 (3.2) where C NA is the cost of a noe access. Similarly, the storage overhea of both the VR- an the MR-tree can be estimate by g 2 S inex = b fn i + D / f l (3.3) i= where b is the block size. The ifference between the two structures regars the authentication information, leaing to ifferent fanouts ( f l, f n ). The VR-tree maintains one signature (28 bytes) per entry in every noe (leaf or internal). In contrast, the MR-tree as igests (20 bytes each) only to internal noes. Assuming a page of 4 KBytes, 70% average storage utilization an ouble precision, the VR-tree has a fanout of f l = 9 (leaf) an f n = 7 (internal), while for the MR-tree f l = 79 an f n = 5. The lower fanout of the VR-tree increases its height. Besies R-tree generation, the VR-tree requires a signature for each object an noe. The MR-tree only involves cheap computations of igests for noes (but not objects). If the cost of a sign/verify/hash operation is C s, C v, C H,respectively, the initial construction overhea of the VR-tree (MR-tree) is given by Eq. 3.4 (3.5): C VR init = C s g fn i + n (3.4) i= Cinit MR = C g s + C H fn i (3.5) i=0 Let the size of a signature, an MBR, a igest an a ata point be S s, S M, S H, an S P, respectively. Then, the VO of the VR-tree with signature aggregation consumes space: VO = S g 2 s + S VR i=0 f i+ n ( /fn l) i + Q S M ( ) + D fl / D + Q l SP (3.6) where the last two terms estimate MBRs an points for visite internal an leaf noes, respectively. Note that with signature aggregation, there is a single signature, thus the VO size is relatively small. To prepare this VO, however, the LBS must perform moular multiplications, whose cost is C VR VO = C m g 2 i=0 f i+ n ( /fn i + Q l ) ( ) + D fl / D + Q l (3.7) Thus, the total query processing overhea for the VR-tree is the sum of the two costs expresse in Eqs. 3.2 an 3.7.TheVO size of the MR-tree is given by Eq The complicate part is to analyze the total number of prune noes uring query processing. PN(i) estimates the number of prune noes at epth i, by computing the number of noes outsie Q, subtracte by escenents of higher prune noes. g SVO MR = i=0 ( PN(i) = fn i ( ) PN(i) (S H +S M )+ D fl / D + Q l SP ( ) ) /fn i + Q l i j=0 PN( j) f i j n (3.8) Finally, we estimate the verification time for the client, which is ominate by moular multiplications (VR-tree) or igest computations (MR-tree). The costs of the VR-tree (with signature aggregation) an the MR-tree are given by Eqs. 3.9 an 3.0. The MR-tree has a clear avantage because (i) for each noe, the MR-tree invokes the hash function once, whereas the VR-tree performs moular multiplication for each entry, an (ii) C H < C m. C VR Client = C v + C m g CClient MR = g 2 i=0 f i+ n ( /fn i + Q l ( ) ) + D fl / D + Q l i=0 f i n ) (3.9) ( /fn l) i + Q C H + C v (3.0) Table 2 shows the costs calculate by the above-mentione equations using the typical values of Table. The VR-tree incurs about 30 times the overhea of the MR-tree for computing the authentication information (in the entire tree), an is 8 times larger. The MR-tree is also significantly better in terms of query processing an verification cost. The latter is particularly important because the clients are mobile evices with limite computing power. The only aspect where the two structures are similar is VO size. In the following section we present an optimize version of the MR-tree, namely the MR*-tree, for reucing the VO.

8 638 Y. Yang et al. Table 2 Comparison of estimate costs Costs MR-tree VR-tree Construction overhea 4 s 2 h Inex size 57 MBytes 5 MBytes Query processing time 2 s 22 s VO size 390 KBytes 398 KBytes Verification time 4 ms 99 ms 4 MR*-tree Recall from Sect. 3. that in the MR-tree, each noe consists of a simple list of entries. During query processing (Fig. 6), the LBS inserts into the VO authentication information (i.e., MBR/igests for internal noes, points for leaf noes) for every prune entry. In practice, a noe may contain a large number of entries (5 in an internal noe an 79 in a leaf noe accoring to Table ), an the query often overlaps with only a fraction of these entries, especially at higher levels. Consequently, many of them are prune an their contents are inserte into the VO. As an extreme case, consier a query which only overlaps with one entry per level of the tree an retrieves only one ata object. Assuming that the MR-tree has a height of 5,(5 ) 4 = 200 MBR/igest pairs an 79 points are present in the VO, while the result set is merely one point. Motivate by this observation, we propose the MR*-tree, an optimize version of the MR-tree that aims at ecreasing the VO size an improving the communication overhea. The basic iea is to organize the entries of each noe using an embee ADS. The embee ADSs are only conceptual, meaning that they o not consume any isk space or ecrease the noe fanout. Hence the MR*-tree achieves exactly the same query processing cost as the original MR-tree in terms of I/O time. Section 4. presents the structure of the MR*- tree, an Sect. 4.2 the query processing algorithms. 4. Structure An embee ADS in a leaf noe is base on the KD-tree [3], whereas that in an internal noe on the box-kd-tree [2]. We first clarify the embeing of leaf noes. Let be the atabase imensionality an N l an arbitrary MR*-tree leaf. A -imensional KD-tree T KD 3 is constructe top-own with the text-book algorithm [3]. Then, in a subsequent step, we inject igests into its noes bottom-up. Let n KD =(P, lc, rc,h) be a noe in T KD, where P is a ata object in N l, an lc, rc are pointers to the left an right chilren of n KD, respectively; N p MBR H... p i MBR i H i =h 4... p f MBR f H f N l P P 2 P 3 P 4 MBR i P 6 Fig. 0 MR*-tree leaf noe structure P 5 Materialize KD-tree T KD h 4 =hash( P 4 h 3 h 6 ) P 4 P 3 h 3 =hash( P 3 h h 2 ) P h =hash(p P 6 h 6 =hash( P 6 h 5 ) ) P 5 h 5 =hash(p 5 ) P 2 h 2 =hash(p 2 ) Conceptual KD-tree P P 3 P 2 P 4 P 5 P 6 h is a hash value efine as follows: when n KD is a leaf noe (both lc, rc are empty), h is compute by hashing the binary representation of P. On the other han, if n KD is an internal noe, h=hash( P lc.h rc.h), i.e., the hash value of the concatenation of P with the igests of n KD s chilren. The root igest of T KD summarizes authentication information about N l, an is store in the corresponing entry of N l s parent. Note that in the MR-tree, the igest of N l is erive from the irect concatenation of all ata objects (Fig. 5a). Figure 0 illustrates an example MR*-tree leaf noe N l that correspons to entry (p i, MBR i, H i ) store in parent N; p i is the pointer to N l s page an MBR i is the MBR of the points resiing in N l, namely P P 6. The two-imensional KD-tree T KD over these points is constructe as follows. We first sort them accoring to their x-coorinate, yieling orere list L:[P, P 2, P 3, P 4, P 5, P 6 ]. The meian 4 P 4 is store at the root of T KD.P 4 splits L into two lists; L :[P, P 2, P 3 ] an L 2 : [P 5, P 6 ]. We then sort L an L 2 base on the y-coorinate, an store their meians (P 3 an P 6 ) into the left an right chilren of P 4, respectively. We continue recursively by switching the split axis in a roun-robin fashion until all the points resie in exactly one noe of T KD. Subsequently, we compute the igests bottom-up. For example, the leaf noe that inclues P stores h = h(p ), an the internal noe accommoating P 3 contains h(p 3 h h 2 ).The root igest h 4 is assigne to H i in N l s entry in parent N. Materializing the KD-tree insie the MR*-tree noe woul ecrease its fanout ue to the aitional igests an pointers. Instea, we only conceptually represent T KD by storing the points accoring to the in-orer traversal of the tree, iscaring the prouce igests an pointers. Note that there is always a one-to-one corresponence between a conceptual an a materialize KD-tree. Revisiting the example of Fig. 0, we erive the list [P, P 3, P 2, P 4, P 5, P 6 ] from T KD, store it in N l, an elete all igests an pointers. In this way, 3 To avoi confusion between the components (i.e., noes, entries, etc.) of the MR*-tree an the embee ADSs, hereafter we appen the subscript KD to all symbols enoting those of the latter category. 4 The meian of a list of even carinality, as well as the switching orer of the split axis, are arbitrarily pre-efine by the owner an known to the LBS.

9 Authenticate inexing for outsource spatial atabases 639 the KD-tree can be built on-the-fly upon fetching the noe page from the isk, without requiring any sorting operations. Next, we iscuss the embee ADS of internal noes in the MR*-tree, base on the box-kd-tree [2] that inexes rectangles. A box-kd-tree can be thought of as a 2-imensional KD-tree, treating each -imensional rectangle (efine by 2 values) as a 2-imensional point. For instance, a 2D rectangle efine by the two corner points (x min, y min ) an (x max, y max ) is perceive as a 4D point (x min, y min, x max, y max ). Similarly, a -imensional range query can be converte to a 2-imensional query expresse as the intersection of 2 half-planes, e.g., the query (00 x 200, 500 y 600) is transforme to (x min 200, x max 00, y min 600, y max 500). Each noe n BKD of a box-kd-tree T BKD contains a tuple of the form (e i, lc, rc, h), where e i = (p, MBR, H) is an entry store in the embeing MR*-tree noe N i, an lc, rc are pointers to the left an right chilren of n BKD, respectively; h is a igest equal to hash(mbr H) when n BKD is a leaf noe, an hash(mbr H lc.h rc.h), otherwise. After builing T BKD, we re-arrange N i s entries following the inorer traversal of T BKD, store its root igest in N i s parent, an iscar T BKD. The owner signs the root igest of the box-kd-tree constructe over the entries of the MR*-tree root. 4.2 Query processing Upon receiving a range query Q, the LBS calls RangeQuery* (Q, root MR ), shown in Fig.. The algorithm fetches an MR*-tree noe N (passe as an argument) from the isk, an invokes proceure KDConstruct (for leaf noes) an BKD- Construct (for internal noes), which re-buils an authenticate KD-tree/box-KD-tree over N s entries, epening on whether N is a leaf (line ) or an internal noe (line 4), respectively. We omit further etails for these two subroutines since they are alreay explaine in the escriptions. Subsequently, RangeQuery* accesses the embee ADSs by invoking algorithm KDRangeQuery (when N is leaf) or BKDRangeQuery (when N is internal noe). Figure 2 presents KDRangeQuery. Parameter a signifies the current split axis of the KD-tree T KD. This recursive algorithm performs a epth-first traversal of T KD. At each visite noe n KD, it first appens the ata object n KD.P to the VO, RangeQuery*(Query Q, MR*_Noe N) // LBS. If N is leaf 2. root KD =KDConstruct (N) 3. KDRangeQuery(Q, root KD, 0) // Figure 2 4. Else // N is internal noe 5. root KD =BKDConstruct (N) 6. BKDRangeQuery(Q, root KD, 0) // Figure 3 Fig. Query processing with the MR*-tree KDRangeQuery (Query Q, KD_Noe n KD, Axis a). Appen [ to VO 2. Appen n KD.P to VO 3. sv=calculatesplitvalue(n KD.P, a) 4. If n KD is internal noe 5. If sv < Q.a min 6. Appen n KD.lc.h to VO 7. Else, call KDRangeQuery(Q, n KD.lc, (a+) mo ) 8. If sv > Q.a max 9. Appen n KD.rc.h to VO 0. Else, call KDRangeQuery(Q, n KD.rc, (a+) mo ). Appen ] to VO Fig. 2 Algorithm KDRangeQuery an then calculates the split value using n KD.P an a. When n KD is an internal noe, the algorithm etermines whether a subtree can be prune (lines 5 an 8). Q.a min an Q.a max enote the lower an upper bounary specifie by Q on axis a. If a subtree is prune, the corresponing igest is appene to the VO (lines 6 an 9). Otherwise, traversal continues in the respective subtree, changing the split axis to the next one (lines 7 an 0). Finally, tokens [ an ] mark the structure of the inex to facilitate the verification process. BKDRangeQuery in Fig. 3 follows a similar iea, but is more involve in two aspects. First, whereas each KD-tree noe stores a ata object an KDRangeQuery simply inserts it to the VO, a box-kd-tree noe n BKD contains a MR*-tree entry e i =(p, MBR, H), which is inclue in a MR*-tree internal noe N i. Recall that p is a pointer to a MR*-tree noe N c (which is a chil of N i ), an MBR an H is the MBR an igest of N c, respectively. The algorithm first appens to the VO the e i.mbr value of every visite n BKD noe (line 3). Observe that this is an important ifference between the MR-tree an the MR*-tree. The former only inserts the MBRs of the prune noes to the VO, since the rest can be re-constructe from information inclue in lower levels of the tree. On the other han, the latter must inclue in the VO all the noe MBRs, because they cannot be re-constructe from lower levels, ue to the use of embee ADSs. Subsequently, BKDRangeQuery checks whether e i.mbr overlaps Q; if so, query execution temporarily pauses in n BKD, an continues in the MR*-tree traversal by calling RangeQuery*, which follows pointer p (line 5). On the other han, if Q oes not overlap MBR, the algorithm inserts the igest H of the corresponing MR*-tree noe into the VO (line 6). Later, we further elaborate on the interaction between the global MR*- tree an the embee box-kd-trees through an example. The secon complication of BKDRangeQuery is that the box-kd-tree has imensionality 2 instea of. In our notation, we assume that the first imensions correspon to the lower bounary of the rectangles, an the last imensions to the upper bounaries. Therefore, when the current axis a signifies an upper bounary, the algorithm checks whether the corresponing lower bounary of Q is greater than the

10 640 Y. Yang et al. BKDRangeQuery (Query Q, BKD_Noe n BKD, Axis a). Appen [ to VO 2. Let e i be the MR*-tree entry store in n BKD 3. Appen e i.mbr to VO 4. If Q overlaps with e i.mbr 5. RangeQuery*(Q, e i.p) // Figure 6. Else, Appen e i.h to VO 7. sv=calculatesplitvalue(n BKD.MBR, a) 8. If n BKD is internal noe 9. If (a ) AND (Q.(a-) min > sv) 0. Appen n BKD.lc.h to VO. Else, BKDRangeQuery(Q, n BKD.lc, (a+) mo 2) 2. If (a < ) AND (Q.a max < sv) 3. Appen n BKD.rc.h to VO 4. Else, BKDRangeQuery(Q, n BKD.rc, (a+) mo 2) 5. Appen ] to VO Fig. 3 Algorithm BKDRangeQuery TBKD n 4 Overlaps with Q n 2 n 6 MR*-tree n n 3 n 5 n 7 e 6 e 7 T KD n n 9 n 3 n 8 n 0 n 2 n N VO: [e 4.MBR, e 4.H, n 2.h,[e 6.MBR, [P, [P 9, n 8.h, n 0.h], [P 3, [P 2], n 4.h]], n 5.h,[e 7.MBR, N 3_VO]]] Fig. 4 Query processing example 3 2 N2 4 N3 P 9 P 2... split value to etermine if a sub-tree can be prune (line 9) an vice versa (line 2). The example of Fig. 4 provies more insight about the query processing algorithms using an MR*-tree with two levels. RangeQuery* first fetches the MR*-tree root N from the isk, constructs box-kd-tree T BKD over its entries, an calls function BKDRangeQuery to access it. Each box-kdtree noe n i correspons to entry N. e i,for i 7, an each KD-tree noe n j correspons to ata object P j for 8 j 4. Entries/noes overlapping with Q are shown in grey color. BKDRangeQuery first reaches n 4 in T BKD, obtains e 4 containe in n 4, an appens e 4.MBR to the VO. Since Q oes not overlap with it, the algorithm inserts e 4.H into the VO. Given that Q is isjoint with the left sub-tree of n 4,the LBS inserts n 2.h into the VO an visits the right chil n 6 of n 4. Subsequently, it as n 6.MBR to the VO an, since Q overlaps with this MBR, it invokes RangeQuery* which retrieves MR*-tree noe N 2, following the pointer in e 6. Assuming N 2 is a leaf noe of the MR*-tree, the LBS buils KDtree T KD over its points. RangeQuery* next calls KDRangeQuery to access T KD, which appens components [P, [P 9, n 8.h, n 0.h], [P 3, [P 2, n 4.h]] to the VO. Note that HashValue=RootHash* (VerObj VO) // Client. Set str= 2. While VO still has entries 3. Get next entry e V from VO 4. If e V is a ata object P 5. If P overlaps the query, A P to the result set 6. str = str P 7. If e V is a igest or an MBR 8. str = str e V 9. If e V is [ 0. hash_c = RootHash*(VO). str = str hash_c 2. If e V is ], Return hash(str) Fig. 5 Verification algorithm P, P 9, P 3 an P 2 are containe in noes n, n 9, n 3 an n 2, respectively. When KDRangeQuery on T KD terminates, so oes RangeQuery* on N 2. The processing of Q backtracks to BKDRangeQuery on N, which was visiting noe n 6. Continuing the traversal in T BKD, the algorithm inserts n 5.h into the VO, then appens e 7.MBR an since Q overlaps e 7.MBR, N 3 is retrieve an processe similarly to N 2, aing a partial VO N 3 _VO. This conclues the execution of Q an completes the VO, shown at the bottom of Fig. 4. The verification process for the MR*-tree is similar to that of the MR-tree. Specifically, the client checks whether (i) no MBR (of a prune noe) in the VO overlaps Q, (ii) for each prune KD- or box-kd- tree noe, Q oes not overlap with its corresponing sie of the split value on the axis of the level it resies in, an (iii) the compute root igest from the VO agrees with the DO s signature. RootHash*, shown in Fig. 5, has one major ifference from that of the MR-tree. When using the MR*-tree, the client oes not compute the noe MBRs bottom up as in the case of the MR-tree (line 6 an9offig.8); instea, the MBRs of all visite noes are explicitly given in the VO (line 3 of Fig. 3). In the example of Fig. 4, the MBRs of noes N 2 an N 3 (e 6.MBR an e 7.MBR, respectively) are inclue in the VO. This is because the MR*-tree is essentially a complex ata structure combining heterogeneous components (KD-tree an box-kd-tree as embee ADSs, R*-tree as the global one), an it is impossible to obtain MBR information of an R-tree entry from its offspring, which are KD- (or box-kd-) noes. For example, in Fig. 4, since none of the noes in the KD-tree T KD stores the MBR of its sub-tree, we cannot compute the MBR of N 2 base on this T KD. Finally, similar to the case of the MR-tree, the client extracts from the VO the result set of the query uring RootHash* (line 5). Proof of sounness. Consier a MR*-tree leaf noe N l. Recall that the root igest H l of the KD-tree constructe over the points in N l summarizes authentication information about all the points in N l. H l is store in N l s parent N i an, in a similar manner, it participates in the generation of the root igest of the box-kd-tree built over the entries of N i, an so on. In other wors, authentication information about each

11 Authenticate inexing for outsource spatial atabases 64 vali point is involve in the igest that the owner eventually signs. Therefore, if the LBS moifies a point, or as a bogus one, the change will propagate up to the re-constructe root igest (ue to the collision resistance of the hash function), which will not be matche against the signature. Proof of completeness. Consier an arbitrary noe n of the KD-tree constructe over the points of MR*-tree leaf N l, an suppose point n.p satisfies query Q. If the LBS simply omits incluing n.p in the VO, the client will compute a igest that oes not match the signature ue to the collision resistance of the hash function. On the other han, the LBS may hie n.p by incluing n.h in the VO without changing the root igest; e.g., for n 9 in Fig. 4,theVO may contain n 9.h instea of P 9. However, this violates conition (ii), checke by the client uring the verification process, i.e., that each noe must be correctly prune. If the LBS inee hies P 9 uner n 9.h, assuming the split axis for n is x, the client fins that Q actually overlaps with the left part of P.x, an etects that the presence of n 9.h is wrong. The MR*-tree occupies the same isk space as the MRtree an, therefore, incurs ientical construction cost an query processing overhea in terms of isk accesses. Yet, its conceptual inexing of the entries leas to consierably smaller VO size ue to the effective pruning of entries that o not overlap with the query. The ownsie of the MR*-tree is that inex construction, query processing an verification require more CPU cycles for the hash operations incurre by the embee ADSs. This traeoff, however, is usually esirable. From the perspective of the DO an LBS, since I/O cost is the ominating factor, this increase in CPU time eteriorates performance only marginally. For the client, receiving a large VO from the network is generally more expensive than local computations, especially for mobile evices. Finally, the extra CPU overhea impose by the MR*-tree is also insignificant, since the hashing operation epens on the length of the unerlying ata; for KD- an box-kd-trees, the hash function is applie on the concatenation of merely two noes. Our experimental evaluation supports these claims. 5 Outsourcing inex maintenance Most query authentication techniques assume that the ata owner, rather than the LBS, is responsible for creating an upating the authenticate structures. For the MR-tree an the MR*-tree, however, it is beneficial to elegate maintenance tasks to the LBS, ue to several reasons. First, the unerlying R*-tree is a rather specialize structure. The DO may not have the software or the expertise to buil an maintain it. Secon, the upate algorithms are expensive, an the DO may not be able to perform them, especially if the ata are highly ynamic. The LBS, on the other han, is assume to contain the computational power require. Finally, the LBS has knowlege of the query workloa an can fine-tune the various parameters (e.g., page size, minimum noe utilization), whereas the DO is oblivious to the clients. In this section, we propose algorithms for outsourcing tree maintenance that are (i) secure, i.e., the DO can verify the changes mae by the LBS, (ii) efficient in terms of processing cost an space overhea for both parties, an (iii) effective, meaning that most of the workloa is performe by the LBS. Section 5. focuses on the initial inex construction, an Sect. 5.2 eals with upates. 5. Initial construction Traitionally, in the initial construction phase, the DO buils an inex an transfers it to the LBS. Clearly the DO performs the entire workloa an the LBS passively receives ata. In contrast, our solution consists of three interactive steps between the two parties. First, the DO forwars only the ata to the LBS. The LBS buils the inex, an sens back information about the tree to the DO. Finally, the DO computes an signs the igest of the root noe, an transmits it to the LBS. Specifically, after the LBS has receive all ata an constructe the tree, it processes a range query Q full covering the entire ata space. Then, it transfers VO(Q full ) to the DO. VO(Q full ) inclues all ata points, but it oes not contain any MBR or igest of internal noes, because no noe is prune (all MBRs overlap Q full ). To reuce the size of VO(Q full ), the LBS inserts the ID of each point into the VO instea of its concrete value. Therefore, VO(Q full ) is essentially a list of all point IDs organize by [ an ] to show the structure of the inex. Particularly for the case of the MR*-tree, entries in VO(Q full ) are also automatically sorte by the query processing algorithm, accoring to the pre-orer traversal of the embee KD-trees (for leafs) or the box-kd-trees (for internal noes). Upon receiving VO(Q full ), the DO checks that no point ID is missing or repeate, an that all IDs are vali. Furthermore, for the MR*-tree it verifies the proper orer of the entries. After that, the DO computes the tree root igest H root using its local copy of the points, signs it to create the signature s root, an returns s root to the LBS. Recall that the LBS sens s root along with a VO in response to every client query. We next prove that, using the above construction scheme, it is impossible for the LBS to violate the sounness an completeness of any future query result, without being caught by the clients. Proof of sounness. Suppose that the LBS moifies an existing (or inserts a bogus) point P in the result of an arbitrary client query Q. Accoring to the propose scheme, uring the construction phase, the DO receives only point IDs from the LBS an, thus, prouces the signature s root solely on its genuine ata (store locally). Therefore, s root oes not cover any moifie (or bogus) point, e.g., P. Due