On the Security of Outsourced and Untrusted Databases

The outsourcing of databases to third parties has become a viable alternative to traditional in-house data management. Database management by third parties including the storage and maintenance allows companies to reduce their expenses and profit from the expertise of data storage specialists. However, the price is the transfer of confidential data to third parties. The data owners need to trust the third party that data is stored (i) confidentially, such that the service providers cannot profit from passing the data to unauthorized parties, and (ii) in a correct and untampered state. This work identifies security issues that data owners have to face when it comes to database outsourcing. We provide an overview of existing techniques for solving the confidentiality and integrity problem and point out the limitations of these approaches. Thereby, this work aims to support decision makers who are confronted with the outsourcing question.

I. Introduction

Database outsourcing has become popular in recent times. Due to improvements in network stability and easy access to broadband connectivity, outsourcing database services has become a viable and cost-effective alternative to in-house data management. In the outsourced database service model (ODBS) (cf. [1]) or database-as-a-service model (DaaS) (cf. [2]), data management and storage is handled entirely by external service providers, keeping internal processes such as backup and recovery transparent to the client companies. The main incentive has been identified to be cost reduction (cf. [3]), but there are other motives to outsource IT services, including access to external expertise, increased reliability or scalability, because external service providers are assumed to have access to better resources and facilities surpassing the client companies' in-house capabilities [4]. Especially for smaller organizations with limited IT budget, outsourcing database services can be more cost-effective than keeping data management in-house, allowing them to concentrate their IT spendings on other areas such as adequate protection of their internal network environment. But also for larger firms, outsourcing can be quite attractive: the liberty not to bother with reliability and scalability problems can be a major boon.