SMCQL: Secure Query Processing for Private Data Networks

People and machines are recording data at an unprecedented rate. At the same time, progress has been slow in making data available for open science and other research initiatives. Many of these efforts are stymied by privacy concerns and regulatory compliance issues. For example, numerous hospitals are interested in combining their patient records with those of other healthcare sites for clinical data research, but they cannot disclose the contents of their databases without violating patient confidentiality. We propose a novel generalization of federated database systems called a private data network (PDN), and it is designed for querying over the collective data of mutually distrustful parties. In a PDN, participants do not reveal their raw data, nor do they encrypt and upload it to the cloud. Rather, they perform secure multiparty computation (SMC) with other federation members to produce query results over the data of both parties. Here, a user submits their SQL query to an honest broker that plans and coordinates its distributed execution using SMC. Within SMC, the participating database providers compute a joint function with an output that is only revealed to the user and the honest broker. The databases computing the query learn nothing about the inputs provided by their peers, nor can they see the output of the group's computation. This capability comes at a high cost-SMC programs typically have runtimes that are orders of magnitude slower than their insecure counterparts. We address this challenge with a query planner that automatically identifies the minimal set of coordination points between parties in a given query plan. The planner translates these distributed steps into SMC as needed and feeds the secure code into our query executor. Our framework, SMCQL, plans and executes PDN queries. We are preparing SMCQL for an open-source release.