Skip List Based Authenticated Data Structure in DAS Paradigm

Transcription

1 009 Eighth International Conference on Grid and Cooerative Comuting Ski List Based Authenticated Data Structure in DAS Paradigm Jieing Wang,, Xiaoyong Du,. Key Laboratory of Data Engineering and Knowledge Engineering, Beijing 007, China, MOE. School of Information, Renmin University of China Abstract In Database-as-a-Service (DAS) comuting aradigm, data owners delegate database management tasks to service rovider. Since the service rovider is untrusted, query authentication becomes an essential issue before database outsourcing. In revious research, various Authentication Data Structures (ADS) have been roosed. However, most of them are either disk-based or static. Considering service rovider usually owns large memory and owerful rocessors, in this aer we roose a dynamic main memory ADS based on ski list, which could rovide efficient authentication for range query both in static and in dynamic scenarios. Exerimental results confirm our claim through a systematic analysis of verification metrics. Keywords-DAS; query authentication; ski list; authenticated data structure I. INTRODUCTION DAS (a.k.a. Outsourced database, ODB) [] is a romising database management aradigm, where data owners delegate their data to the third-arty: service rovider. Due to economy of scale, DAS could rovide high quality of service at reduced cost. Since the service rovider is untrusted or comromised, new security issues have been introduced, among which authentication of query results is a major concern before outsourcing database. Basically, query authentication focuses the following three dimensions of data: soundness, comleteness and freshness []. Soundness means the result set does originate from data owner and has not been tamered with in any way. Comleteness means no qualified tules missing from result set. Freshness means the result set incororates the latest version. To achieve query authentication, we introduce a three-tier architecture in Figure. Insert Owner Security Manager Delete Owner m Querier Query Authenticator Querier n Query User Client Data & ADS SQL Resultset & VO Figure. System overview DBMS DB Service Provider In Figure, there are three entities involved: trusted user, trusted client and untrusted service rovider. User can be divided into two roles: owner, who is resonsible for data generation and maintenance; querier, who accesses data. Client is resonsible for security related tasks, such as data encrytion and query authentication. The rest of database management task is carried out by service rovider. Basically, we artition database management tasks into three hases: initial hase, query hase and maintenance hase. In initial hase, owners generate data and uload them to client. Client creates ADS uon data and delegates them to service rovider. In query hase, service rovider executes query locally and returns result set and associated VO (Verification Object) to client, which does the final verification. In maintenance hase, client recalculates ADS and transfers it to service rovider. Consequently, authentication cost includes three arts:.construction cost of ADS, query authentication cost and ADS maintenance cost. In real alications, above three entities own different comuter owers: user is usually ower limited, e.g. mobile device; client tyically ossesses a work station, or even a PC comuter, while service rovider runs a server cluster. The goal of DAS is to ush workload to service rovider as much as ossible and kee client overhead and communication overhead between client and service rovider minimized. In revious research, various ADSs have been roosed. However, most of them focus on disk-based structures such as VB-tree [3], MB-tree and EMB [], where I/O cost and crytograhic oeration cost are two dominating factors. Obviously, none of them considers the fact that service rovider has large memory and owerful rocessors. The only main memory ADS roosed is based on MHT, a binary balanced tree. Since udate oerations will cause comlete rebuilding, MHT is alicable only for static scenario. In this aer, we roose a dynamic main memory ADS based on Ski List: ADSSL, which has one dominating factor: crytograhic oeration. As a robabilistic alternative to balanced tree, Ski list is easy to imlement and efficient in data udates. Secifically, ADSSL has the following advantages: ADSSL is sace efficient and suitable for main memory structure. This work is suorted by two MOE rojects under Grant No 7000 and /09 $ IEEE DOI 0.09/GCC

2 ADSSL is robability balanced and can suly flexible trade-off between storage and verification cost. ADSSL suorts efficient authentication of range query. Maintenance cost of ADSSL is similar to that of query authentication cost. Besides query authentication, there s another imortant class of security issue: data security, which mainly focuses on how to revent sensitive data from unauthorized access. It s orthogonal to our issue and not covered in this aer. The rest of the aer is organized as follows. We resented related work in Section II. In section III, we roosed our new ADS based on ski list and gave systematic evaluations on various authentication costs. Besides, a VO size otimized version of ADSSL is roosed. Exeriments were made in section IV. Section V concludes the aer and oints out future work. II. RELATED WORK Existing research on query authentication can be divided into three categories: signature based, ADS based and robability based. In the following, we comare them from three asects: authentication ability (the tye of query suorted), authentication cost and authentication ratio. Although assigning one signature to each tule could rovide soundness authentication at tule level, it has serious efficiency roblem both in sace and time cost. Furthermore, it could not rovide comleteness authentication. To decrease verification time and network workload, aggregate signature [, 7, 9] was roosed, which transforms multile signature verifications into multile modular multilications and one verification. Signature chain [7, ] was roosed to suort comleteness authentication, where one signature is based on three consecutive tules instead of one tule. In a word, signature based aroach is a simle aroach with 00% authentication ratio. However, it has high authentication cost and limited authentication ability. Secifically, it can only suort soundness and comleteness authentication of range query. To decrease signature cost at tule level, authentication data structure (ADS) [, 3, 0, ] has been extensively studied which organises data into a tree so that only one signature for root is needed. Similar to the signature aroach, ADS could achieve 00% authentication ratio. Among them Merkle Hash Tree (MHT) is a commonly used one. Basic structure of MHT is illustrated in Figure (a). Through rebuilding of MHT and verification on root node, any tamering will be detected. Due to the fast and sace comact of hash, MHT can decrease authentication cost dramatically comared with signature aroach. To enhance erformance further, several variants of MHT [, 3] are roosed, including VB-tree, MB-tree and EMB. The last two structures are illustrated in Figure (b) and (c) resectively. In a word, ADS can suly soundness and comleteness authentication for one-dimensional range query efficiently. For multi-dimensional range query, multile MHT must be built. Besides, it s only suitable for non-sensitive attribute and its maintenance cost is large. h(h h ) h(r ) k h(r ) k k i i h i =H(r i ) (a) MHT... k k j j h j =H(h h f ) (b) MB-tree k i i h i =H(r i ) (c) EMB Figure. Three ADS based on MHT Different from above two aroaches, robability based aroach can only rovide authentication in art. On the other hand, it has strong authentication ability with less authentication cost. There have been two robability authentication aroaches: fake tule [3] and challenge token []. The basic idea of fake tule is as follows: real tules, couled with certain ercentage of fake tules, are outsourced. Through authentication on fake tules, authentication on real tules is inferred with certain robability. However, fake tule aroach brings additional querying and storage cost at DSP. Furthermore, it can not suort authentication of aggregate query. The basic idea of challenge token is that for a batch of queries, through authentication on samled queries, authentication on all queries can be inferred. In [], fake tokens are roosed to increase authentication ratio without increasing authentication cost. Challenge token can authenticate any tye of query efficiently. However, it has two limitations. First, it s a server authentication aroach, which means after roviding correct execution roofs, DSP can still modify result set. Second, it has a strong assumtion that the batch of queries is carried out on the same segment of data, which is difficult to ensure in real alication. Comared with above two aroaches, robability based aroach can authenticate soundness, comleteness and freshness of data. In a conclusion, signature aroaches and ADSs can rovide 00% authentication ratio, but they have limited authentication ability and relative large authentication cost. The robability based aroach is much more efficient and effective, but its authentication ratio is less than 00%. To decrease authentication cost of current ADS, we roose a main memory ADS, which only crytograhic oeration costs are involved. III. AUTHENTICATION DATA STRUCTURE BASED ON SKIP LIST In this section, we first introduce our main memory ADS based on ski list, and then give a detailed analysis on various authentication costs. Finally, we give a VO size efficient version. 70

3 A. Structure Ski list was first roosed by William [] in 990 as a robabilistic alternative to balanced tree, e.g. B+-tree. Figure 3(a) is an examle, where ointers with same level are linked by sorted order. The nodes at low level jum higher with uniform robability. For brevity, a node that has k forward ointers is called a level k node. According to nodes juming higher randomly or not, there re two kinds of ski lists: randomized ski lists, e.g. Figure 3(a); deterministic ski lists, e.g. each node jums one higher. Among them, randomized ski lists are suitable for dynamic scenario and adoted in this aer. Comared with balanced trees, ski lists have the following characteristics: Ski lists are easy to imlement and ractically efficient in search, esecially udate time (without node slit or merge). Interested readers can refer to [] for concrete comarisons. Ski lists are sace comact, where sace is allocated when needed, while emty sace (decided by filling factor) is reserved in balanced tree. Ski lists are main memory index, while balanced tree are disk-based index. In balanced tree, there s only one search direction: move down from root node to leaf node. The number of I/O is decided by the height of tree. However, in ski lists, search includes two directions: ho forward and dro down. For examle, search ath of value 7 is lotted by dotted arrows in Figure 3(a). It s unsuitable to artition ski lists either horizontally or vertically. In conclusion, ski lists are dynamic and efficient main memory index, esecially suitable for the context of service rovider (a) Search ath of value 7 in ski list by dotted arrows (b) Authentication data structure based on ski list (c) Verification rocess of result set {,7,,9,0} (d) VO size otimized authentication structure based on ski list Figure 3. ADSSL and BADSSL based on ski list Although Goodrich etc. roosed authentication dictionary based on ski list and commutative hashing [5], it could only suort membershi query, such as is element s in set S. For range query, a new authentication structure is required. Insired by MHT, we transform ski lists into our new authentication structure, which is illustrated in Figure 3(b). Unlike linked list in Figure 3(a), Figure 3(b) can be regarded as a tree with root node -, where at most one ath exists between any two nodes. 7

4 The search ath in Figure 3(b) is similar to that in Figure 3(a), excet that the number of comarisons is reduced. The construction algorithm of ADSSL is resented in Figure. Algorithm: Construction of ADS Based on Ski Lists Inut: data set: ds, robability: ; maximal levell max Outut: ADS Based on Ski List. for each data in ds{. level = random(l max ); 3. createnode(data, level);. } 5. createnode(, l max );. createnode(+, ); 7. sort nodes on search key;. for each ointer of each node { 9. if exists(consecutive node with equal or less level) 0. link them;. }. scan nodes by reversed sorted order{ 3. calculate verification value for each node;. } Figure. Construction algorithm of ADS based on ski list k v(k ) ck P c3 c c r Child ointer Record ointer Figure 5. Node structure To suort authentication of range queries, each node is assigned with a verification value and the node structure is illustrated in Figure 5, where a node is comosed of three comonents: key (e.g. k, k ), verification value (e.g. v(k ), v(k )) and ointers (e.g. r, c ). The calculation of verification value ensures that it includes information of itself and all of its children. Here we divide ointers into two classes: child ointers and record ointers. Record ointers, denoted as r, refer to the ointer to record. Child ointers, denoted as c, refer to remaining ointers. To calculate verification value uniquely, child ointers are sorted by their levels. As for node n(k, v, r, c, ck ), according to whether c is null or not, the calculation of v is as follows: Case : c =null v(k) = h(r) Case : c null v(k) = h(h(r) v(k-> c ) v(k-> c ) v(k-> ck )) For examle, in Figure 3(b), node (7) and node () corresond to above two cases resectively. Their verification values are calculated as follows: v(7) = h(r 7 ) k v(k ) ck P c3 3 c c r v() = h(h(r ) v(3) v() v()) After initial construction of authentication structure, we calculate verification value for each node from right to left. The calculation of verification value ensures that each node contributes one and only one time to the root node, which is consistent with MHT. B. Query Verification I n this subsection, we discuss how to achieve authentication for range query based on node verification values calculated above. Generally, one range query can be transformed into two (boundary) oint queries. For examle, assume ADSSL in Figure 3(c) is constructed on attribute X. To authenticate range query 7<=x<=9, two oint queries x=7 and x=9 are issued resectively. Query rocess starts from the root node (here is -) and recursively hos forward and dros down until the node with search key is reached. Here the final result set is {7,, 9}. To rovide boundary comleteness, two additional nodes are included: {, 0}. So the result set is {, 7,, 9, 0}. The following roblem is how to construct VOs to rove that the result set is sound and comlete. Generally, VO generation is a reverse rocess of search, which constructs ath from the result set to root. Any node which is required in construction but can not be inferred by the result set (co-ath) is included in VO. For examle, in Figure 3(c), to calculate verification value of node (), two VOs are included: h(r ) and v(5). Two oint queries form a subtree, which is illustrated by dotted line olygon in Figure 3(c). The VO is comosed of those nodes intersecting with subtree, which are illustrated by bold arrows in Figure 3(c). VO is illustrated by bold box. The formal algorithm of verifiable result set generation is illustrated in Figure. Consider, for instance, above query 7<=x<=9, the verifiable result set generated is: [h(-),v(),[h(r),v(3),[h(r),v5],[r, r7]],[r,[r9,[r0,v(+)]]]]]. The time comlexity of VO generation is similar to that of query rocess. After receiving the result set and root signature from service rovider, client would verify if it is sound. Secifically, it scans result set to comute root hash and checks if it agrees with unsigned root signature. Comleteness verification can be achieved by consecutive validation of values in the final result set. There must not be any VO among values in the result set. For examle, if one value, such as r, is omitted from the result set, then the result set is not consecutive. For examle, {r, r 7,VO, r 9, r 0 }. Authentication of ADSSL is ensured by the following theorem. Theorem. ADSSL could rovide soundness and comleteness verification of query results. Proof: Basically, authentication ability of ADSSL is based on the following three factors: first, hash function used to calculate node verification value is one-way and collision-free; second, each node contributes one and only one time to the comutation of root hash; third, the order in which each of value is involved in root hash calculation is fixed and unique. If a attacker modifies, insert or deletes any value in the result set, the ossibility of re-comuting root hash correctly is equal to 7

5 the ossibility of collision in hash, which is negligible in ractice. Algorithm: Verifiable result set generation Inut: ski list root, rang query[low, high] Outut: a verifiable result set. Init stack s; //note: s is a set. search low and ush search ath in stack; 3. search high and ush search ath in stack;. Init rs; 5. while (!emty(s)) {. n = o(s); 7. ush n s ointer values in rs in order;. } 9. return rs; Figure. Verifiable result set generation algorithm C. Maintenance of ADSSL As we ointed out reviously, ski lists are efficient esecially in dynamic scenario. The maintenance of ADSSL is similar to that of ski lists, which is comosed of two stes: query and insert (delete). Here udate is relaced by a air of insert and delete. So maintenance cost is the sum of query cost and insert cost. Since ADSSL is a main memory index, query cost is negligible comared with that of insert. Insert cost is dominated by recalculation of node verification value from inserted (deleted) node to root, which is linear to the search ath. Since ADSSL can be maintained efficiently, it can authenticate data freshness efficiently. D. Cost Analysis Since authentication cost is involved in three hases, we will discuss them resectively. In each hase, authentication cost includes three arts: sace cost, time cost and network cost. Costs of MHT are resented for comarison. TABLE I. NOTATIONS AND DESCRIPTION Symbol Descrition Default Value C h Time of hash 0 μs C s Time of signature 9.53 ms C v Time of verification 0. ms s Size of signature bytes h Size of hash bytes k Size of search key bytes ointer Size of ointer bytes nmht Size of MHT node bytes nsl Size of ski list node bytes N Cardinality of table 0 P Probability of ski list Max level of ski list LogN Cx Construction time of x Sx Sace cost of x Vx Verification time of x VOx VO size of x Mx Maintenance cost of x In initial hase, ADS is construc ted and delivered to the service rovider. Since the root node can be signed only by the client, the client must construct the whole authentication tree locally. Fortunately, the client needn t shift authentication tree to the service rovider. Instead, it can be reconstructed at the service rovider. Thus a large amount of network cost is saved and the only additional network cost is one signature. So in initial hase, cost focuses on two asects: construction time and sace time. Secifically, construction time is dominated by hash comutation. Symbols used in this aer are summarized in table I. Formally, initial costs of MHT and ADSSL are calculated as follows: C s C MHT = (N-)* C h + C ADSSL = N* C h + C s S MHT = (N-)* n MHT + sign S ADSSL = N*( n SL +/(-))+ sign Obviously, the number of hash in ADSSL construction is about half of MHT. Although the sace cost of ADSSL varies with robability, it s always much less than that of MHT. The calculation of SADSSL is as follows: i i N*( )*( n SL + ointer *i) - l * *(- ) max =N*( n SL * *( )* ) * N*( n SL ) ( 0) In query hase, authentication cost is dominated by the number of hash to recomute root hash. Secifically, verification cost and VO size are calculated as follows: V MHT = N* C h + C v V N *( ) C ADSSL C h v VO MHT = N* h + sign *( VO ADSSL = N N / ) * ( ) h sign Assume result set has one value. Extension to result set with more values is straightforward. As for MHT, the height of tree is N. So do the number of hash and VO. The analysis of ADSSL is much more comlex. For juming robability, the height of ADSSL is N. On average, for nodes with the same level, only one of them jums higher. Besides, the robability of any node juming higher is the same. So the average search ath at level is i*. The number i of VO with k level node is (k-). So the total number of VO is N i. i0 Comared with MHT, ADSSL has higher verification cost, esecially in VO size. The detailed comarison is lotted in Figure. Since VO will influence network erformance negatively, we roose an imroved version, denoted as BADSSL, which is resented in Figure 3(d). Obviously, each node with k child ointers in ADSSL is divided into k nodes with one child ointer. Consequently, The number of VO with k level node decreases from (k-) to. The initial and verification of BADSSL is as follows: 73

6 N C BADSSL = Ch Cs N nsl S BADSSL = sign V BADSSL = N *( ) C h C VO N *( ) BADSSL h sign In maintenance hase, MHT is static an d maintenance cost is almost equal to rebuilding cost. While maintenance cost of ADSSL and BADSSL is dominated by search ath. Formal analysis is as follows: M MHT = (N-)*h()+sign() N *( ) M A DS SL = ( )Ch C *( ) M BADSSL = ( N )Ch Cv Here we assume before insertion, th e level of current ADSSL is equal with max level. If the level of inserted element is larger than current max level, maintenance cost will increase a little. IV. EXPERIMENTAL E VALUATION v v cost. In Figure (b), VO size of ADSSL is much larger than two others, which confirms BADSSL is VO size efficient. A. Exerimental Setu We carried out exeriments on Microsoft Windows XP with a.7ghz Intel rocessor and 5M RAM. Crytograhic signature and hash were erformed using the standard Java imlementation of RSA and MD5 algorithm. Our ADSSL and BADSSL are imlemented in JAVA/JRE. develoment kit and Runtime Library. B. Results Analysis We comare initial construction cost, query authentication cost and maintenance cost of three ADSs: MHT, ADSSL and BADSSL. Three sets of exeriments were erformed in total. In the first set of exeriments, we study the sace and time cost of initial construction. The results are illustrated in Figure 7. Both sace cost and time cost of our aroaches are less than those of MHT. Besides, MHT is indeendent of robability, while our two aroaches negatively deend on. Although sace and time cost of ADSSL are always less than those of BADSSL, with the increasing of, the difference decreases quickly. Secifically, when reaches 3, the costs of them are similar. In the second set of exeriments, we study query authentication cost and VO size. The results are illustrated in Figure (a) and (b). In Figure (a), verification cost of our aroaches is always larger than that of MHT. However, for an aroriate, such as, the difference between them is very little. So the selection of is critical in deciding verification Figure 7. Initial construction cost of three ADSs 7

7 Figure. Query authentication cost and VO size comarison The third set of exeriments is to comare maintenance cost of three aroaches. The results are illustrated in Figure 9. Since maintenance cost of MHT is almost equal to that of rebuilding, it s much larger than the others and omitted here. For ADSSL and BADSSL, maintenance costs are the same and little larger than that of verification time. In conclusion, BADSSL is comrehensively efficient in construction cost, query authentication cost and maintenance cost. query distribution is non-uniform, or even skewed, how to adat our authentication structure dynamically is one interesting and useful research toic. REFERENCES [] H. Hacigumus, B. Iyer and S. Mehrotra, Providing database as a service, in Proc. of th ICDE, San Jose, CA, USA, February 00. [] F. Li, M. Hadjieleftheriou, G. Kollios, L. Reyzin, Dynamic authenticated index structures for outsourced databases. SIGMOD, 00. [3] H. Pang, KL.Tan Authenticating query results in edge comuting. In Proc. of International C onference on Data Engineering (ICDE), ages 50-57, 00. [] W. Pugh. Ski lists: a robabilistic alternative to balanced trees. Commun. ACM, 33(): 7, 990. [5] MT. Goodrich, R. Tamassia. Efficient authenticated dictionaries with ski lists and commutative hashing. Technical reort, Johns Hokins Information Security Institute, 000. [] E. Mykletun, M. Narasimha, G. Tsudik. Authentication and Integrity in Outsourced Databases. In Network and Distributed Systems Security, 00. [7] M. Narasimha, G. Tsudik. DSAC: Integrity of Outsourced Databases with Signature Aggregation and Chaining. In Proc. of Conference on Information and Knowledge Management (CIKM), ages 35-5, 005. [] H. Pang, A. Jain, K. Ramamritham, KL Tan. Verifying comleteness of relational query results in data ublishing. In SIGMOD Conference, ages 07. ACM, 005. Figure 9. Maintenance time cost [9] E. Mykletun, M. Narasimha, G. Tsudik. Signature bouquets: Immutability for aggregated/condensed signatures. In Euroean V. CONCLUSIONS AND FUTURE WORK Symosium on Research in Comuter Security (ESORICS), ages 0-7, 00. In this aer, we roosed a dynamic main memory [0] C. Martel, G. Nuckolls, P. Devanbu, M. Gertz, A. Kwong, SG. Stubblebine. A general model for authenticated data structures. authentication data structure: ADSSL, which is not only sace Technical reort, CSE-00-9 UC Davis Deartment of Comuter comact, but also efficient in query authentication cost and Science December 00. maintenance cost. To decrease query VO size of ADSSL, we [] R. Sion. Query execution assurance for outsourced databases. In roose an imroved version: BADSSL, which suorts a VLDB, ages 0. ACM, 005. flexible trade-off between query verification cost and [] P. Devanbu, M. Gertz, C. Martel, SG. Stubblebine. Authentic thirdconstruction cost. arty data ublication. In IFIP Worksho on Database Security, ages 0-, 000. For now, ADSSL only suorts authentication of range [3] M. Xie, HJ Wang, J. Yin, XM Meng. Integrity auditing of outsourced queries. How to suort more tyes of queries, such as data. In Proceedings of the 33rd international conference on VLDB aggregate query, join queries is one of our future work. 007, Pages Moreover, here we assume the workload is uniform. When 75