A Structure Preserving Database Encryption Scheme

Transcription

1 A Structure Preservng Database Encryton Scheme Yuval Elovc, Ronen Wasenberg, Erez Shmuel, Ehud Gudes Ben-Guron Unversty of the Negev, Faculty of Engneerng, Deartment of Informaton Systems Engneerng, Postfach 653, 8405 Beer-Sheva, Israel {elovc, ronenwa, Ben-Guron Unversty of the Negev, Deartment of Comuter Scence, Postfach 653, 8405 Beer-Sheva, Israel Abstract. A new smle and effcent database encryton scheme s resented. The new scheme enables encrytng the entre content of the database wthout changng ts structure. In addton, the scheme suggests how to convert the conventonal database ndex to a secure ndex on the encryted database so that the tme comlexty of all queres s mantaned. No one wth access to the encryted database can learn anythng about ts content wthout havng the encryton ey. Introducton Database s an ntegral art of almost every nformaton system. Accordng to [] the ey features that databases roose are shared access, mnmal redundancy, data consstency, data ntegrty and controlled access. The case where databases hold crtcal and senstve nformaton s not rare, therefore an adequate level of rotecton to database content has to be rovded. Database securty methods can be dvded nto four layers []: hyscal securty [3], oeratng system securty [4, 5, 6], DBMS securty [7, 8, 9] and data encryton [0,, ]. The frst three layers alone are not suffcent to guarantee the securty of the database snce the database data s et n a readable form [3]. Anyone havng access to the database ncludng the DBA (Database Admnstrator), s caable of readng the data. In addton, the data s baced u frequently so access to the baced u data also needs to be controlled [4]. Moreover, a dstrbuted database system maes t harder to control the dsclosure of the data. Database encryton ntroduces an addtonal securty layer to the frst three layers mentoned above. It conceals the readable form of senstve nformaton even f the database s comromsed. Thus, anyone who manages to byass the conventonal database securty layers (e.g., an ntruder) or a DBA, s unable to read the senstve nformaton wthout the encryton ey. Furthermore, encryton can be used to mantan data ntegrty so that any unauthorzed changes of the data can easly be detected.

2 Database encryton can be mlemented at dfferent levels [4]: tables, columns, rows and cells. Encrytng the whole table, column or row entals the decryton of the whole table, column or row resectvely when a query s executed. Therefore, an mlementaton whch decryts only the data of nterest s referred. The database encryton scheme resented n [3] s based on the Chnese- Remnder theorem where each row s encryted usng dfferent sub-eys for dfferent cells. Ths scheme enables encryton at the level of rows and decryton at the level of cells. The database encryton scheme resented n [4] extends the encryton scheme resented n [3] by suortng multlayer access control. It classfes subjects and objects nto dstnct securty classes. The securty classes are ordered n a herarchy such that an object wth a artcular securty class can be accessed only by subjects n the same or a hgher securty class. In ths scheme, each row s encryted wth sub-eys accordng to the securty class of ts cells. One dsadvantage of both schemes s that the basc element n the database s a row and not a cell, thus the structure of the database needs to be changed. In addton, both schemes requre re-encrytng the whole row when a cell value s modfed. The conventonal way to rovde an effcent executon of database queres s by usng ndexes, but ndexes n an encryted database rase the queston of how to construct the ndex so that no nformaton about the database content s revealed [5, 6]. The ndexng scheme rovded n [7] s based on encrytng the whole row and assgnng a set dentfer to each value n ths row. When searchng a secfc value ts set dentfer s calculated and then assed to the server whch n turn returns to the clent a collecton of all rows wth values assgned to the same set. Fnally, the clent searches the secfc value n the returned collecton and retreves the desred rows. However, n ths scheme, equal values are always assgned to the same set, thus some nformaton s revealed when alyng statstcal attacs. The ndexng scheme rovded n [8] s based on constructng the ndex on the lantext values and encrytng each age of the ndex searately. Whenever a secfc age of the ndex s needed for rocessng a query, t s loaded nto memory and decryted. Snce the unform encryton of all ages s lely to rovde many cher breang clues, the ndexng scheme rovded n [9] suggests encrytng each ndex age usng a dfferent ey deendng on the age number. However, these schemes beng mlemented at the level of the oeratng system are not satsfactory. Assumng the ndex s mlemented as a B+-Tree, encrytng each of ts felds searately would reveal the orderng relatonsh between the chertext values. The ndexng scheme rovded n [5] suggests encrytng each node of the B+-Tree as a whole. However, snce references between the B+-Tree nodes are encryted together wth the ndex values, the ndex structure s concealed. In order to overcome the shortcomngs of exstng database encryton schemes, a new smle and effcent scheme for database encryton s roosed whch suggests how to encryt the entre content of the database wthout changng ts structure. Ths roerty allows the DBA to contnue managng the database wthout beng able to vew or manulate the database content. Moreover, anyone ganng access to the database can learn nothng about ts content wthout the encryton ey. The new scheme suggests how to construct a secure ndex on the encryted database so that the

3 tme comlexty of all queres s mantaned. Snce the database structure remans the same no changes are mosed on the queres. The remander of the aer s structured as follows: n secton the desred roertes of a database encryton scheme are outlned; n secton 3 the new database encryton scheme s llustrated; n secton 4 the desred roertes of a secure ndexng scheme are descrbed; n secton 5 a new ndexng scheme for the encryted database s roosed; n secton 6 erformance and mlementaton ssues are dscussed, and secton 7 resents our conclusons. The Desred Proertes of a Database Encryton Scheme Accordng to [3], a database encryton scheme should meet the followng requrements: ) The encryton scheme should ether be theoretcally or comutatonally secure (requre a hgh wor factor to brea t). ) Encryton and decryton should be fast enough so as not to degrade system erformance. 3) The encryted data should not have a sgnfcantly greater volume than the unencryted data. 4) Decryton of a record should not deend on other records. 5) Encrytng dfferent columns under dfferent eys should be ossble. 6) The encryton scheme should rotect aganst atterns matchng and substtuton of encryted values attacs. 7) Modfyng data by an unauthorzed user should be notced at decryton tme. 8) Recoverng nformaton from artal records (records where some cells have null values) should be the same as from full records. 9) The securty mechansm should be flexble and not ental any change n the structure of the database. A naïve aroach for database encryton s to encryt each cell searately but ths aroach has several drawbacs. Frst, two equal lantext values are encryted to equal chertext values. V ( V V V E E ) ( ) () Therefore, t s ossble, for examle, to collect statstcal nformaton as to how many dfferent values a secfed column currently has, and what are ther frequences. The same holds for the ablty to execute a jon oeraton between two tables and collect nformaton from the results. Second, t s ossble to swtch unnotced between two chertext values. Dfferent chertext values for equal lantext values can be acheved usng a olyalhabetc cher (e.g. Vernam). However, n ths soluton decryton of a record deends on other records and thus requrement 4 s volated. In the next secton a new database encryton scheme comlyng wth all the above requrements s resented.

4 3 A New Database Encryton Scheme The oston of a cell n the database s unque and can be dentfed usng the trlet that ncludes ts Table ID, Row ID, and Column ID. We wll refer to ths trlet as the cell coordnates. We suggest a new database encryton scheme where each database value s encryted wth ts unque cell coordnates. These coordnates are used n order to brea the correlaton between chertext and lantext values n an encryted database. The new scheme has two mmedate advantages. Frst, t elmnates substtuton attacs attemtng to swtch encryted values. Second, atterns matchng attacs attemtng to gather statstcs based on the database encryted values would fal. a) Table T before Encryton Row C b) Encryton of Table T Usng the Nave Aroach Row C 0 #$ ]{ &* 3 #$ 4 #$ 5 ^% 6 &* = c) Encryton of Table T Usng the New Scheme Row C 0!# :] &* 3 "/ 4 ~? 5 ^ 6 >\ 8 ){ 9 -+ Fg.. Database encryton usng two aroaches. Fgure llustrates database encryton usng two aroaches. Fgure a descrbes a database table (T) wth one data column (C). Fgure b descrbes encryton of table T usng the naïve aroach. Fgure c descrbes encryton of table T usng the new aroach where each cell s encryted wth ts cell coordnates. It s easy to see that equal lantext values n fgure a are encryted to dfferent chertext values n fgure c as oosed to the chertext values n fgure b.

5 3. Encryton/Decryton n the New Scheme Let us defne: V - A lantext value located n table t, row r and column c. : ( N N N) N - a functon that generates a number based on the database coordnates. Enc - A functon whch encryts a lantext value wth ts coordnates. Enc ( V ) E ( V ( t, r, c)) () Where s the encryton ey and E s a symmetrc encryton functon (e.g. DES, AES). X - A chertext value located n table t, row r and column c. X Dec - A functon whch decryts a chertext value ( X ) and dscards ts coordnates. K Enc ( V ) (3) Dec ( X ) D ( X ) ( T, R, C) V (4) Where s the decryton ey and D s a symmetrc decryton functon. 3. Data Integrty Encryton ensures that a user not ossessng the encryton ey cannot modfy a chertext value and redct the change n the lantext value. Usually the range of vald lantext values s sgnfcantly smaller than the whole range of ossble lantext values. Thus, the robablty that an unauthorzed change to a chertext value would result n a vald lantext value s neglgble. Therefore, unauthorzed changes to chertext values are lely to be notced at decryton tme. Substtuton attacs as oosed to atterns matchng attacs can not be revented smly by usng encryton. In the new scheme, each value s encryted wth ts unque cell coordnates. Therefore, tryng to decryt a value wth dfferent cell coordnates (e.g. as a result of a substtuton attac) would robably result n an nvald lantext value. If the range of vald lantext values s not sgnfcantly smaller than the whole ossble range, or nvald lantext values cannot be dstngushed from vald lantext values, encryton has to be carred out as follows: Enc K ( V ) E ( V ( t, r, c)) (5)

6 Snce ( t, r, c) s concatenated to the lantext value before encryton, attemtng to change the chertext value or tryng to swtch two chertext values would result n a corruted ( t, r, c) after decryton. Obvously, concatenatng ( t, r, c) results n data exanson. 3.3 Scheme Analyss The new database encryton scheme satsfes the requrements mentoned n secton : ) The scheme securty reles on the securty of the encryton algorthm used. In order to reveal some database value t has to be decryted usng the correct ey. ) Encryton and decryton are fast oeratons and are mandatory n any database encryton scheme. The roosed mlementaton adds the overhead of a Xor oeraton and comutaton whch are neglgble comared to encryton. 3) Usng encryton algorthms such as DES or AES whch are based on encrytng blocs of data results n value exanson (n many cases ths exanson s neglgble). 4) The basc element of reference s a database cell. Oeratons on a cell do not deend on or have any effect on other cells. 5) The roosed scheme facltates subschema mlementaton. Snce each cell s encryted searately, each column can be encryted under a dfferent ey. 6) The new scheme revents atterns matchng attacs snce there s no correlaton between a lantext value and a chertext value (acheved by usng encryton) and there s no correlaton between chertext values (acheved by usng before encryton). Substtuton attacs are also revented as dscussed n secton 3.. 7) Unauthorzed manulaton on the encryted data wthout the encryton ey would be notced at decryton tme. (see secton 3.) 8) As the basc element of reference s a database cell, t s ossble to recover nformaton from artally comleted records (records wth null values) n the same way as t s recovered from full records. 9) The new scheme comles wth the structure reservng requrements as the basc element of reference s a database cell. 4 The Desred Proertes of a Secure Indexng Scheme An ndex s a data structure suortng effcent access to data and ndexes are frequently used n databases. Most commercal databases even create a default ndex on the rmary-ey columns. Most databases mlement ndexes usng a B+-Tree whch mlementaton s dscussed n secton 6.. Key management s dscussed n secton 6.3.

7 s a data structure mantanng an ordered set of values and suortng effcent oeratons on ths set such as search, nsert, udate and delete. A trval aroach whch constructs an ndex over the lantext values would reduce securty snce the lantext values are exosed. Another aroach would cona) An Index Constructed on Column C n Table T b) Table Reresentaton of the Index ID Struct. Data 0, , , , , , , c) Table T Row C Fg.. An examle of a database ndex. Fgure llustrates a database ndex whch s constructed on column C n table T and s mlemented as a B+-Tree. A grahcal reresentaton of the B+-Tree s gven n fgure a; a table reresentaton of the B+-Tree s gven n fgure b and table T s gven n fgure c. Fgure b sharens the searaton between the ndex structure and ts data. A secure ndex n an encryted database has to comly wth the followng requrements: ) No nformaton about the database lantext values can be learned from the ndex. ) The secure ndex should not reduce the effcency of data access. 3) The secure ndex should not reduce the effcency of nsert, udate and delete oeratons. 4) The secure ndex should not have a sgnfcantly greater volume than an ordnary ndex. 5) The secure ndex structure should not dffer from a standard ndex. In ths way, a DBA can manage the ndex wthout the encryton ey.

8 struct the ndex over the database chertext values. In ths aroach, executng equalty queres s ossble but executng range queres s a roblem. Ths aroach would exose the ndex to atterns matchng attacs snce equal lantext values are encryted to equal chertext values. Moreover, snce executng range queres s a roblem, Oracle does not suort encrytng ndexed data [0]. In the next secton, a new ndexng scheme whch overcomes the shortcomngs of exstng ndexng schemes s resented. 5 A New Database Indexng Scheme Several ndexng schemes for encryted databases were roosed [5, 8, 7, ] that fulfll most of the requrements descrbed n secton 4 but none reserve the ndex structure. We clam that there should be a searaton between data and structure. For examle, A DBA should be able to manage database ndexes wthout the need of decrytng ts values. We suggest a new database ndexng scheme whch reserves the ndex structure where each ndex value s the result of encrytng a lantext value n the database concatenated wth ts row-d. Ths ensures that there s no correlaton between the ndex values and the database chertext values 3. Furthermore, the ndex does not reveal the statstcs or order of the database values. 5. Index Constructon n the New Scheme In order to construct an ndex, a set of values and a functon determnng the order 4 of these values are needed. Let us defne: C - An encryted database column that was encryted as defned n secton 3.. C - The column obtaned from decrytng columnc : Dec ( x )C x C (6) Where Dec s the decryton functon defned n secton 3.. C - The column obtaned from encrytng values n C concatenated wth ther row-ds: E ( V r) C V C (7) 3 If the database s encryted as descrbed n secton 3., then should not be mlemented as( t, r, c) r snce there wll be a strong correlaton between the ndex values and the database encryted values. 4 Some ndexes requre only an equalty functon and not an order functon to be constructed. In ths case, the term "order" n ths secton can be relaced by the term "equalty".

9 Where s the encryton ey, E s an encryton functon and r s the row d. : C C - A functon whch decryts a value n C (usng ey ) and dscards ts row-d: ( x) Dscard( D ( x), r ) (8) Where s the decryton ey, D s a decryton functon, r s the row-d, r s the length of r n bts, and Dscard ( v, n) stands for dscardng the n rghtmost bts of v. R - The values n C are ordered by the relaton R : R - The values n ( x, y) R x, yc And( x y) (9) C are ordered by the relaton R : ( x, y) R x, yc And( ( x), ( y)) R (0) The new ndex wll be constructed based on the values n an order functon. a) Encryton of Table T n the New Scheme C, usng the relaton b) Encryton of the Index n the New Scheme R as Row C 0 ( 5000 ( T,0, E ( 500 ( T,, E ( 000 ( T,, E 3 ( 7500 ( T,3, E ID Struct. Data 0, E (5000 0) 3,4 E (500 ) 5,6 E (7500 3) 3 4 E (000 ) 4 5 E (500 ) 5 6 E (5000 0) 6 - E (7500 3) Fg. 3. Encryton n the new scheme. Fgure 3 llustrates encryton of the table and the ndex whch were llustrated n fgure usng the new schemes. Fgure 3a descrbes the encryton of the table n the new scheme where each cell s encryted wth ts coordnates. Fgure 3b descrbes the encryton of the ndex where each ndex value s the result of encrytng a database lantext value concatenated wth ts row-d. It s easy to see that the table and ndex structure are not changed by the encryton rocess.

10 5. Executng a Query n the New Scheme The followng SQL query llustrates the retreval of all rows n table T, whch ther values n column C are greater or equal to V: SELECT * FROM T WHERE T.C>=V () The followng seudo code llustrates the retreval of row-ds of rows whch answer the above query. The seudo code assumes that the ndex s mlemented as a bnary B+-Tree. INPUT: A table T, a column C and a value V. OUTPUT: A collecton of row-ds. X := getindex(t, C).getRootNode(); Whle X s not a leaf Do If X.getData().getValue()<V Then X := X.getRghtSonNode(); Else X := X.getLeftSonNode(); End If; End Whle; RESULT := ; Whle X.getData().getValue()<V Do X := X.getRghtSblngNode(); End Whle; Whle X s not null Do RESULT := RESULT{X.getData().getRowId()}; X := X.getRghtSblngNode(); End Whle; Return RESULT; Each node n the ndex whch s not a leaf has a left son node, a rght son node and a data whch stores a value. Each leaf n the ndex has a rght sblng node and a data whch stores a value and a row-d. In the new scheme the data n each ndex node s an encryton of a database value concatenated wth ts row-d. Thus, the functons getvalue() and getrowid() need to be gven a new mlementaton n order to suort the new ndexng scheme. However, the above seudo code stands wthout any change. 5.3 Index Integrty In the new scheme, a substtuton attac whch attemts to substtute ndex values can be carred out wthout beng notced at decryton tme. If t s ossble to mantan a unque oston for each value n the ndex, ths nd of attac can be elmnated usng

11 a technque smlar to the one roosed n secton 3 where each value s encryted wth ts unque oston. a) Mantanng Data Integrty of Table T Row C 0 E ( 5000 ( T,0, E ( 500 ( T,, E ( 000 ( T,, 3 E ( 7500 ( T,3, b) Mantanng Data Integrty of the Index ID Struct. Data 0, E (5000 0) 3,4 E (500 ) 5,6 E (7500 ) 3 4 E ((000, ) 3) 4 5 E ((500,) 4) 5 6 E ((5000, 0) 5) 6 - E ((7500, 3) 6) Fg. 4. Mantanng data ntegrty. Fgure 4 llustrates data ntegrty mantenance of the table and the ndex whch were llustrated n fgure. Fgure 4a descrbes data ntegrty mantenance of the table as suggested n secton 3.. Fgure 4b descrbes data ntegrty mantenance of the ndex where each ndex value s concatenated to ts unque oston n the ndex (ID) and then encryted. We argue that wthout changng the ndex structure and affectng ts effcency, mantanng a unque oston for each value n the ndex s not a trval matter. 5.4 Scheme Analyss The new ndex mlementaton on an ordered set of values s dentcal to the ordnary ndex mlementaton. The only dfferences between the ordnary ndex and the new one are the set of values and the order functon defned on them. The new ndex comles wth the requrements mentoned n secton 4: ) Snce the values n the ndex are encryted and unque (acheved by concatenatng row-d) there s no correlaton between them as to the column chertext values, or the column lantext values. Therefore, no nformaton s revealed on the database data by the new ndex. ) The order functon s mlemented n a tme comlexty of O () snce decryton and dscardng bts are mlemented n a tme comlexty of O (). Therefore, data access usng the roosed ndex s as effcent as wth an ordnary ndex. 3) Determnng the order of two values s mlemented n a tme comlexty of O (). Therefore, the delete oeraton s as effcent as n an ordnary ndex. En-

12 crytng a new value s mlemented n a tme comlexty of O (), thus the effcency of nsert and udate oeratons s not changed. 4) Each value n the new ndex s a result of encrytng a database lantext value concatenated wth ts row-d, therefore the sace added for each node n the new ndex s fxed. Thus, the ndex sace comlexty remans the same. 5) The new ndex structure remans the same and only ts data s modfed. Thus, any admnstratve wor on the ndex can be carred out wthout the need of decrytng the ndex values. 6 Performance and Imlementaton Issues Imlementng the new schemes requres careful consderaton. Several erformance and mlementaton ssues are dscussed n ths secton. 6. Stable Cell Coordnates The roosed scheme assumes that cell coordnates are stable. That s, nsert, udate and delete oeratons do not change the coordnates of exstng cells. However, f a database reorganzaton rocess changes cell coordnates, all affected cells are to be re-encryted wth ther new coordnates and the ndex udated resectvely. A naïve mlementaton whch uses the row number n the table as the row-d, roves to be lmted n ths resect as row numbers are affected by nsert and delete oeratons. In the Oracle database, for examle, cell coordnates are stable. 6. Imlementng a Secure Functon As defned n secton 3., the values n the database are encryted as follows: Enc K ( V ) E ( V ( t, r, c)) () A secure mlementaton of would generate dfferent numbers for dfferent coordnates: t, r, c ) ( t, r, c ) ( t, r, c ) ( t, r, ) (3) ( c Unfortunately, generatng a unque number for each database coordnates may result n consderable data exanson. An alternatve mlementaton reducng the data exanson may result n collsons. Assume that there are two cells, whch generates two equal values for ther coordnates: t, r, c, t, r, c (4) [( t, r, c ) ( t, r, c )] [ ( t, r, c ) ( t, r, c )]

13 It s ossble to substtute the chertext values of these cells ( x tr c and x trc ) wthout beng corruted at decryton tme. If t s dffcult to fnd two cells such as those mentoned above, ths nd of attac can be revented. Ths can be acheved by usng a collson free hash functon. 6.3 Key Management Databases contan nformaton of dfferent senstvty degrees that have to be selectvely shared between a large numbers of users. The roosed scheme facltates subschema mlementaton snce each column can be encryted wth a dfferent ey. Encrytng each column wth a dfferent ey, results n a large number of eys for each legtmate user. However, usng the aroach roosed n [] can reduce the number of eys. It s suggested n [] how the smallest elements whch can be encryted usng the same ey accordng to the access control olcy can be found. Thus, the eys are generated accordng to the access control olcy n order to ee ther number mnmal. Ths aroach can be ncororated n the roosed scheme n order to encryt sets of columns wth the same ey n accordance wth the database access control olcy. 6.4 Performance In the new scheme, all conventonal algorthms reman the same snce the structure of the database remans the same. Ths ensures that the only overhead of the new scheme s that of encryton and decryton oeratons. 7. Conclusons In ths aer, a new structure reservng scheme for database encryton has been resented. In the new scheme, each database cell s encryted wth ts unque oston and ths guarantees that atterns matchng and substtuton attacs cannot succeed, thus, guaranteeng nformaton confdentalty and data ntegrty. A new database ndexng scheme that does not reveal any nformaton on the database lantext values was roosed. In the new scheme ndex values are encryted wth a unque number (the row-d of the database value) n order to elmnate atterns matchng attacs and any correlaton between ndex and database values. Ensurng ndex ntegrty s ossble f an ndex oston can be attached to each ndex value by smly usng a technque smlar to the one used for table encryton. The new schemes do not mose any changes on the database structure, thus enablng a DBA to manage the encryted database as any other non-encryted database. Furthermore, mlementng the new scheme n exstng alcatons does not ental modfyng the queres.

14 References. Date, C.J.: An Introducton to Database Systems. Vol., Ffth Edton. Addson Wesley, Massachusetts (990). Fernandez, E.B., Summers, R.C. and Wood C.: Database Securty and Integrty. Addson- Wesley, Massachusetts, (980) 3. Coer, J.A.: Comuter & Communcaton Securty: Strateges for the 990s. McGraw- Hll, New Yor (989) 4. Conway, R.W., Maxwell, W.L. and Morgan, H.L.: On the mlementaton of securty measures n nformaton systems. Communcatons of the ACM 5(4) (97) Graham, G.S. and Dennng, P.J.: Protecton - Prncles and ractce. Proc. Srng Jt. Comuter Conf., Vol. 40, AFIPS 47-49, Montrale, N.J. (97) 6. Hwang, M.S. and Yang, W.P.: A new dynamc access control scheme based on subjectobject-lst. Data and Knowledge Engneerng 4() (994) Garvey, C. and Wu, A.: ASD-Vews. Proc. IEEE Symosum on Securty and Prvacy, Oaland, Calforna (988) Lunt, T.F., Dennng, D.E., Schell, R.R., Hecman, M. and Shocley, W.R.: The SeaVew securty model. IEEE Trans. on Software Engneerng, SE-6(6) (990) Stachour, P.D. and Thurasngham, B.: Desgn of LDV: A multlevel secure relatonal database management system, IEEE Trans. on Knowledge and Data Engneerng () (990) Natonal Bureau of Standards. Data Encryton Standard. FIPS, NBS (977). Rvest, R.L., Shamr, A. and Adleman, L.: A method for obtanng dgtal sgnatures and ublc ey crytosystems. Communcatons of the ACM () (978) 0-6. Smd, M.E. and Branstad, D.K.: The data encryton standard: ast and future. Proc. IEEE 76(5) (988) Davda, G.I., Wells, D.L., and Kam, J.B.: A Database Encryton System wth Subeys. ACM Trans. Database Syst. 6 (98) Mn-Shang, H. and We-Pang, Y.: Multlevel secure database encryton wth subeys. Data and Knowledge Engneerng (997) Daman, E., De Catan dvmercat, S., Jajoda, S., Parabosch, S. and Samarat, P.: Balancng Confdentalty and Effcency n Untrusted Relatonal DBMSs. CCS 03, Washngton (003) Dennng, D.E.: Crytograhy and Data Securty. Addson-Wesley, Massachusetts (98) 7. Hacgümüs, H., Iyer, B., L, C., and Mehrotra, S.: Executng SQL over encryted data n the database-servce-rovder model. In Proc. of the ACM SIGMOD 00, Madson, Wsconsn, USA (00) 8. Iyer, B., Mehrotra, S., Myletun, E., Tsud, G. and Wu, Y.: A Framewor for Effcent Storage Securty n RDBMS. E. Bertno et al. (Eds.): EDBT 004, LNCS 99 (004) Bouganm, L. and Pucheral, P.: Ch-secured data access: Confdental data on untrusted servers. In Proc. of the 8th Internatonal Conference on Very Large Data Bases, Hong Kong, Chna (00) Database Encryton n Oracle9. An Oracle Techncal Whte Paer (00). Bayer, R. and Metzger, J.K.: On the Encherment of Search Trees and Random Access Fles. ACM Trans Database Systems, Vol. (976) Bertno, E. and Ferrar, E.: Secure and Selectve Dssemnaton of XML Documents. ACM Transactons on Informaton and System Securty Vol. 5 No. 3 (00) Hwang, M.S. and Yang, W.P.: A two-hase encryton scheme for enhancng database securty. J. Systems and Software 3() (995) 57-65