QUICKeR: Quicker Updates Involving Continuous Key Rotation
Authors: Lawrence Lim (University of California, Santa Barbara), Wei-Yee Goh (University of California, Santa Barbara), Divyakant Agrawal (University of California, Santa Barbara), Amr El Abbadi (University of California, Santa Barbara), Trinabh Gupta (University of California, Santa Barbara)
Volume: 2024
Issue: 1
Pages: 58–73
DOI: https://doi.org/10.56553/popets-2024-0005
Abstract: Since the advent of cloud computing, storing large quantities of sensitive data on remote services have demanded secure encryption practices to maintain data privacy. Merely encrypting data at-rest leaves ciphertexts vulnerable to inevitable key leakage from mismanaged keys, side-channel attacks, and security bugs. To combat this, we propose QUICKeR, a system to facilitate continuous key rotation and ciphertext updates. Unfortunately, continuous ciphertext updates from key rotation interferes with routine access operations by introducing race conditions and performance bottlenecks that preclude prior works from practical use. QUICKeR addresses these concerns through protocols that eliminate race conditions and even achieve the stronger linearizability correctness criterion. In addition, QUICKeR proposes three approaches to implement frequent ciphertext updates. We show how these different update schemes perform under different database bottlenecks. Finally, we demonstrate that QUICKeR is practical through end-to-end experiments showing that routine access operations are not significantly impacted by ciphertext update operations.
Keywords: Key Rotation, Updatable Encryption, Linearizability
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
