A Secure Multi-User Database-as-a-Service Approach for Cloud Computing Privacy

Database-as-a-Service (DBaaS) is a new trend that allows industries and organizations outsource their databases and computations to external parties. However, despite the many advantages provided by this service in terms of cost reduction and efficiency, DBaaS raises many security issues regarding data privacy. The protection of privacy has been addressed by several research contributions proposing efficient solutions such as encrypted databases and blind queries over encrypted records. However, access control techniques still suffer from a lack of efficiency especially when dealing with encrypted databases. In this latter context, almost all proposed schemes consider an architecture of a single user (the data owner) that queries his encrypted database that he is the only one capable of decrypting. From a practical perspective, a database system is set up to support not only a single user but multiple users initiating multiple queries. However, managing multiple accesses to an encrypted database introduces several challenges like key sharing, key revocation, and data re-encryption. In this paper, we propose a simple and efficient proved protocol that allows multiple users to query the same database and decrypt the retrieved results without getting access to the secret key. In this protocol, the data owner is not risking the data privacy since he does not need to share the secret key to enable a multi-party collaboration.