  As tremendous amount of data being generated everyday from human activity and
from devices equipped with sensing capabilities, cloud computing emerges as a
scalable and cost-effective platform to store and manage the data. While
benefits of cloud computing are numerous, security concerns arising when data
and computation are outsourced to a third party still hinder the complete
movement to the cloud. In this paper, we focus on the problem of data privacy
on the cloud, particularly on access controls over stream data. The nature of
stream data and the complexity of sharing data make access control a more
challenging issue than in traditional archival databases. We present
Streamforce - a system allowing data owners to securely outsource their data to
the cloud. The owner specifies fine-grained policies which are enforced by the
cloud. The latter performs most of the heavy computations, while learning
nothing about the data. To this end, we employ a number of encryption schemes,
including deterministic encryption, proxy-based attribute based encryption and
sliding-window encryption. In Streamforce, access control policies are modeled
as secure continuous queries, which entails minimal changes to existing stream
processing engines, and allows for easy expression of a wide-range of policies.
In particular, Streamforce comes with a number of secure query operators
including Map, Filter, Join and Aggregate. Finally, we implement Streamforce
over an open source stream processing engine (Esper) and evaluate its
performance on a cloud platform. The results demonstrate practical performance
for many real-world applications, and although the security overhead is
visible, Streamforce is highly scalable.
