Hierarchical Role-Based Access Control with Homomorphic Encryption for Database as a Service

摘要

Database as a service provides services for accessing and managing customersdata which provides ease of access, and the cost is less for these services.There is a possibility that the DBaaS service provider may not be trusted, anddata may be stored on untrusted server. The access control mechanism canrestrict users from unauthorized access, but in cloud environment accesscontrol policies are more flexible. However, an attacker can gather sensitiveinformation for a malicious purpose by abusing the privileges as another userand so database security is compromised. The other problems associated with theDBaaS are to manage role hierarchy and secure session management for querytransaction in the database. In this paper, a role-based access control for themultitenant database with role hierarchy is proposed. The query is granted withleast access privileges, and a session key is used for session management. Theproposed work protects data from privilege escalation and SQL injection. Ituses the partial homomorphic encryption (Paillier Encryption) for theencrypting the sensitive data. If a query is to perform any operation onsensitive data, then extra permissions are required for accessing sensitivedata. Data confidentiality and integrity are achieved using the role-basedaccess control with partial homomorphic encryption.