Access control for encrypted query processing
Methods, systems, and computer-readable storage media for enforcing access control in encrypted query processing. Implementations include actions of obtaining a set of user groups based on the user credential and a user group mapping, obtaining a set of relations based on the query, obtaining a set of virtual relations based on the set of user groups and the set of relations, receiving a first rewritten query based on the set of virtual relations and a query rewriting operation, encrypting the first rewritten query to provide an encrypted query, and transmitting the encrypted query to at least one server computing device over a network for execution of the encrypted query over access controlled, encrypted data.
1. A computer-implemented method for enforcing access control in encrypted query processing, the method being executed using one or more processors and comprising:
receiving, by the one or more processors, a query and a user credential, the user credential uniquely identifying a user requesting execution of the query;
obtaining, by the one or more processors, a set of user groups based on the user credential and a user group mapping, the set of user groups comprising at least one user group;
obtaining, by the one or more processors, a set of relations based on the query;
obtaining, by the one or more processors, a set of virtual relations based on the set of user groups and the set of relations, the set of virtual relations comprising at least one virtual relation;
receiving, by the one or more processors, a first rewritten query based on the set of virtual relations and a query rewriting operation;
encrypting, by the one or more processors, the first rewritten query to provide an encrypted query; and
transmitting, by the one or more processors, the encrypted query to at least one server computing device over a network for execution of the encrypted query over access controlled, encrypted data.
2. The method of claim 1 , further comprising determining that the query comprises at least one operation that is included in a set of predefined operations, and in response, initiating a key adjustment.
3. The method of claim 1 , wherein the user group mapping maps one or more users to one or more user groups, based on an access control matrix that indicates which users are allowed access to which data stored in an encrypted database.
4. The method of claim 1 , wherein the set of virtual relations is obtained further based on a virtual relation mapping that maps at least one relation and user group pair to a virtual relation.
5. The method of claim 1 , further comprising:
receiving an encrypted result from the server computing device; and
decrypting the encrypted results to provide a query result.
6. The method of claim 5 , further comprising:
receiving a second rewritten query based on the set of virtual relations and the query rewriting operation; and
obtaining a final query result based on the second rewritten query and the query result.
7. The method of claim 1 , wherein the set of pre-defined operations comprises one or more of a count operation, a count distinct operation, an equi-join operation, and a set difference operation.
8. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for enforcing access control in encrypted query processing, the operations comprising:
receiving, by the one or more processors, a query and a user credential, the user credential uniquely identifying a user requesting execution of the query;
obtaining a set of user groups based on the user credential and a user group mapping, the set of user groups comprising at least one user group;
obtaining a set of relations based on the query;
obtaining a set of virtual relations based on the set of user groups and the set of relations, the set of virtual relations comprising at least one virtual relation;
receiving a first rewritten query based on the set of virtual relations and a query rewriting operation;
encrypting the first rewritten query to provide an encrypted query; and
transmitting the encrypted query to at least one server computing device over a network for execution of the encrypted query over access controlled, encrypted data.
9. The computer-readable storage medium of claim 8 , wherein operations further comprise determining that the query comprises at least one operation that is included in a set of predefined operations, and in response, initiating a key adjustment.
10. The computer-readable storage medium of claim 8 , wherein the user group mapping maps one or more users to one or more user groups, based on an access control matrix that indicates which users are allowed access to which data stored in an encrypted database.
11. The computer-readable storage medium of claim 8 , wherein the set of virtual relations is obtained further based on a virtual relation mapping that maps at least one relation and user group pair to a virtual relation.
12. The computer-readable storage medium of claim 8 , wherein operations further comprise:
receiving an encrypted result from the server computing device; and
decrypting the encrypted results to provide a query result.
13. The computer-readable storage medium of claim 12 , wherein operations further comprise:
receiving a second rewritten query based on the set of virtual relations and the query rewriting operation; and
obtaining a final query result based on the second rewritten query and the query result.
14. The computer-readable storage medium of claim 8 , wherein the set of pre-defined operations comprises one or more of a count operation, a count distinct operation, an equi-join operation, and a set difference operation.
15. A system, comprising:
a computing device; and
a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for enforcing access control in encrypted query processing, the operations comprising:
obtaining a set of user groups based on the user credential and a user group mapping, the set of user groups comprising at least one user group;
obtaining a set of relations based on the query;
obtaining a set of virtual relations based on the set of user groups and the set of relations, the set of virtual relations comprising at least one virtual relation;
receiving a first rewritten query based on the set of virtual relations and a query rewriting operation;
encrypting the first rewritten query to provide an encrypted query; and
transmitting the encrypted query to at least one server computing device over a network for execution of the encrypted query over access controlled, encrypted data.
16. The system of claim 15 , wherein operations further comprise determining that the query comprises at least one operation that is included in a set of predefined operations, and in response, initiating a key adjustment.
17. The system of claim 15 , wherein the user group mapping maps one or more users to one or more user groups, based on an access control matrix that indicates which users are allowed access to which data stored in an encrypted database.
18. The system of claim 15 , wherein the set of virtual relations is obtained further based on a virtual relation mapping that maps at least one relation and user group pair to a virtual relation.
19. The system of claim 15 , wherein operations further comprise:
receiving an encrypted result from the server computing device; and
decrypting the encrypted results to provide a query result.
20. The system of claim 19 , wherein operations further comprise:
receiving a second rewritten query based on the set of virtual relations and the query rewriting operation; and
obtaining a final query result based on the second rewritten query and the query result.