Wolfgang Boehmer

How to estimate a technical VaR using conditional probability, attack trees and a crime function

Keywords: Conditional probability, Bayes theorem, attack trees, threat actor, crime function, risk scenario technology

According to the Basel II Accord for banks and Solvency II for the insurance industry, not only should the market and financial risks for the institutions be determined, so should the operational risks (opRisk). In recent decades, Value at Risk (VaR) has prevailed for market and financial risks as a basis for assessing the present risks. Occasionally, there are suggestions as to how the VaR is to be determined in the field of operational risk. However, existing proposals can only be applied to an IT infrastructure to a certain extent, or to parts of them e.g. such as VoIP telephony. In this article, a proposal is discussed to calculate a technical Value at Risk (t-VaR). This proposal is based on risk scenario technology and uses the conditional probability of the Bayes theorem. To determine the threats, attack trees and threat actors are used. The vulnerabilities have been determined empirically for an insurance company in 2012. The attack trees are weighted by a function that is called the criminal energy. To verify this approach the t-VaR was calculated for VoIP telephony for an insurance company. It turns out that this method achieves good and sufficient results for the IT infrastructure as an effective method to meet the Solvency II's requirements.

Introduction

In the early days of protecting IT, i.e. in the early 90s, the focus was purely on technical security, because it was recognized that the IT is vulnerable. These often expensive safeguarding measures were not always bound by economic considerations and only a rudimentary relationship to the business processes was established. Therefore the Basel II Accord in 2004 represents a cornerstone, because it placed the operational risk (opRisk) equal to the market and financial risks. In the implementation of Basel II / Solvency II requirements for operational risks, it was recognized immediately that they should be treated differently than the market and financial risks. For while the market and financial risks can reference historical data, this is not possible for operational risk due to lack of data. Thus many projects have failed that tried to create a loss database in order to provide a database for operational risk. Additionally, for the operational risks, attempts have been made in several theoretical models to determine appropriate parameters for the VaR, which have never prevailed in practice. Consequently, the qualitative and the quantitative risk procedures developed that still stand side by side today. The German Baseline Protection Manual, with his hazard analysis, can be considered a representative of the qualitative method and, to name a few examples for the quantitative method, there is the standard ISO 27005 or the standard ISO 31000. What the methods above have in common is that these do not calculate a VaR or similar parameter that is compatible with the parameters of the market and financial risks.

An important feature in the calculation of risk between the market and financial risks on the one hand and the operational risks on the other hand is the fact that the area of operational risk, the IT infrastructures are dominated by threats and existing vulnerabilities. Thus in the market and financial risks, the widespread approach of a Monte Carlo simulation to determine the probability distribution leads to unsatisfactory results when used for operational risks.

In general, the risk analysis is the consideration of two distributions. The first distribution describes the occurrence probability of risk events, and the second distribution represents the impact or outcome (consequence) of the risk event, if the risk is faced. Then the two distributions are convolved. This convolved distribution is a new distribution, the distribution of risk. If, for example, a 5% quantile (α -quantile as a confidence level) of this risk distribution is defined as the expected loss, the VaR is determined. But the question remains, how realistic input distributions are found. Furthermore, the type of the input distribution determines a specific part of the operational risk. The Basel II framework includes the operational risk (opRisk) and defines opRisk as the risk of losses resulting from inadequate or failed internal processes, people and systems, or external events. In this definition, legal risk is included. Strategic and reputational risks are excluded. Without entering into details, the main difference with market and credit risk is that, for opRisk, we only have losses, as P. Embrecht et al. argued in his paper [START_REF] Embrechts | Quantifying regulatory capital for operational risk[END_REF].

The contribution of this paper is the development of a VaR for the system, or in detail, for the technical infrastructure, the t-VaR, that considers the characteristics of an IT infrastructure and is part of the opRisk, but is placed on a par with the VaR for the market and financial risks.

The rest of the article is organized as follows. In the next section, the underlying model is discussed. In section III, the data collection for the identification of vulnerabilities, threats, and the application of the model to calculate the t-VaR is discussed using the VoIP telephony of an insurance company. In section IV, the relevant literature is discussed. The article concludes with a brief summary, continuing considerations and proposals for further studies.

The Model

Basic equations

Starting from the general linear relationship between the risk (R), the probability (Pr) and the monetary outcome (impact) (I), as expressed in the equation 2.1,

R = Pr × I [R], (2.1)
which is not used in this paper. We use instead 2.1 the loss distribution approach and the Lower Partial Moment, cf. Fig. 2, as expressed for a system Ψ in equation 2.2. Because only the negative result for a system is considered, the Loss [R -], as is typical in the area of operational risk (see [START_REF] Embrechts | Quantifying regulatory capital for operational risk[END_REF]).

R = Pr E × L [R -] → Ψ (2.2)
In equation 2.2 for the probability (Pr) of an event (E) the most frequent probability is not used, the conditional probability (Pr E ) in accordance with Bayes' Theorem is.

According to the Bayesian statistics, a hypothesis is created that says here, that a vulnerability only can be exploited on the condition (|) if a threat exist with a matching threat agent. Or vice versa, that a threat with a threat agent can develop only if a corresponding vulnerability exists. The threat is indicated by (Thr) and the vulnerability by (Vul). Thus the equation 2.2 can be transformed into the equation 2.3.

R = Pr E (Vul | T hr) × L [R -] → Ψ (2.3)
Thus, the conditional probability that an existing vulnerability is exploited by a threat with a matching threat agent is described in equation 2.

4

Pr E (Vul | T hr) = Pr E (T hr ∩ Vul) Pr E (T hr) . (2.4)
Hence the numerator describes in the equation 2.4 the intersection between the set of threats and set of vulnerabilities in the plane of the probability Pr E (cf. Fig. 1). In this context, the vulnerability, the following definition is used.

Definition 2.1.01 (Vulnerabilities) are real (existing) and represent a weakness of an asset or represent a point at which the asset (component, system, process, employee) is technically or organizationally vulnerable. Vulnerability is a property of an asset and the security services of assets can be changed, circumvented or deceived (cf. ISO 27000:2012, p. 11).

Definition 2.1.02 (Threats) are not real (hypothetically) and aim at an asset (system or component) to exploit one or more weaknesses or vulnerabilities to a loss of data integrity, liability, confidentiality or availability. Threats can interact with an asset actively or passively (cf. ISO 27000:2012, p. 10).

The Figure 1 shows the conditional probability on a two dimensional level and the set of threats and vulnerabilities as well as their intersection. If now the equation (2.4) is used in the Def 2.2, the following equation (2.5) results for the system Ψ . Equation (2.5) states that the risk (R) to face a loss (L [R -]) depends of the event (E), and a conditional probability (Pr) for the occurrence of the intersection of vulnerability (Vul) and threat (T hr) for the system Ψ . following equations (2.6) to (2.9).

R = Pr E (T hr ∩ Vul) Pr E (T hr) × L [R -] → Ψ. ( 2
R sz1 = PrE p1 (Vul 1 | T hr 1 ) • l 1 → ψ 1 (2.6) R sz2 = PrE p2 (Vul 2 | T hr 1 ) • l 2 → ψ 2 (2.7) R sz3 = PrE p3 (Vul 2 | T hr 2 ) • l 3 → ψ 2 (2.8) . . . R szn = PrE pn (Vul j | T hr k ) • l n → ψ n (2.9)
Summing up risk scenarios R sz1 , ..., R szn for an infinitely long period of time gives the maximum possible loss, such as the equation (2.10) expresses. For shorter periods e.g. for a fiscal year (T ) a summation does not make sense; the risks must be aggregated as discussed in section (V).

n i=1 R sz i = PrE pi          n Vul k=1 | n T hr j=1          • l i (2.10)
While vulnerabilities are real, threats are hypothetical. To obtain a quantitative assessment of the risk situation of a company, it is necessary to analyze the threats more accurately, because not every threat has an immediate and direct effect. It also assumes that behind every active threat, an actor must be present. Historically, the concept of the threat tree was first discussed in 1991 by J.D. Weis [START_REF] Weis | A system security engineering process Proceedings of the 14th National[END_REF]. This concept is based on the theory of fault trees (Fault Tree Analysis, Event Tree Analysis FTA and ETA).

With risk (Eq. 2.3) as a measure, it is associated as a universal measure of a probability space and is strongly related to the Loss Distribution Approach (LDA). The Loss Distribution Approach has been widely used in the financial and insurance industry for several decades and is as used for share portfolios. Thus it is natural to use this loss approach in the area of operational risk, but not for an equity portfolio, but for the value chain (production). In the literature, the topic is widely studied; significant work in this area has been performed by P. Embrecht et al. [START_REF] Embrechts | Quantifying regulatory capital for operational risk[END_REF], M. Leipold and P. Vanini [START_REF] Leippold | The quantification of operational risk[END_REF] and K. Böcker and C. Klüppelberg [START_REF] Böcker | Operational var: A closed-form approximation[END_REF].

LDA Approach

The Loss Distribution Approach (LDA) refers to the bottom (marked in gray) part of Figure 2, which is the lower partial moment (LPM). For risk analysis, this means that two distributions are determined for a time period (T). First is the distribution of losses (Loss (T), cf. 2.2) and second is the probability distribution of events (Pr E (T), cf. 2.2) which were mathematically composited in the grey dashed line in Figure 2 and is a joint distribution of risk according to the equations (2.6) to (2.9). The joint distribution is interpreted, which lead more often to minor losses and rarely major losses. This distribution is required to determine the VaR and the confidence level.

In the article by K. Böcker and C. Klüppelberg [START_REF] Böcker | Operational var: A closed-form approximation[END_REF], a general summary of the standard LDA approach is given on page 6/7, which we follow here roughly.

1. The severities process (l k ) k ∈ N are positive independent and identically distributed (iid) random variables describing the magnitude of each loss event. 2. The number N(x) of loss events (l i ) in the time interval [t 1 , t 2 ] for t 2 ≥ t 1 is random (see Fig. 2). The resulting counting process (N(x) t 2 ≥ t 1 ), is generated by a sequence of points (x n ) t n ≥ 1 of non-negativ random variables, and 3. The severity process and the frequency process are assumed to be independent.

The aggregate loss process:

The aggregate loss L(x) up to time T constitutes a process

L(T ) = N(x) i=1 l i , x ≥ 0 (2.11)

Value at Risk

Illustrated in the equation 2.2, the risk represents the Lower Partial Moment (LPM), which as a downside risk measure only refers to a part of the total probability density (see Fig. 2). This covers only the negative deviations from a target size (e.g. a plan value of the reachability of the insurance company for their customers in a time interval) and evaluates all of the information of the probability distribution (up to the theoretically possible maximum outage). The random variable in the example in Figure 2 presents the reachability of the insurance company for their costumers in the unit of time. The reachability varies only in a small range 1 -α for the planned insurance service and is shown as a random variable (X) for the period t 1 , t 2 . Figure 2 shows the normal distribution of the exogenous density function that results from the random variable (X). For this discrete random variable (X), the values x i , i =, 1, 2, 3 and x i x j for i j.

The expected value (E T w ) is defined for the discrete random variable (X) as the sum of their possible values, weighted by the respective probability. In the example of Figure 2, for the time period

t 1 ≤ T ≤ t 2 , this is represented by probability 1 → ∞ with E T w = ∞ i=1 x i • Pr (X -x i ).
(2.12)

For the random variable (X) as a placeholder, we can use the three protection goals of information security. These are defined e.g. in the standard ISO/IEC 27001:2005 as confidentiality (C), integrity (I), availability (A) [START_REF]information technology -security techniques -information security management systems -requirements[END_REF]. Often referred to as the CIA Triad. The statistical spread (σ) is the expectation of (E w ) expressed in the discrete case with the variance (Var), as shown in equation 2.13

Var(X) = σ 2 X = ∞ i=1 x i -E w (X) 2 • Pr (X = x i ).
(2.13)

The variance (Var) represents the average of the squared deviations from the mean of the random variable (X). The standard deviation is defined as the square root of the variance. The Discrete result values in the time interval T have been approximated by a normal distribution, so that in the Figure 2, the continuous course of the random variable is shown with density f (x), so the expected value is obtained in this case E T w , as shown in equation 2.14

E T w = +∞ -∞ x • f (x) dx. (2.14)
In Fig. 2, the opVaR T α (X) and the opES T α (X) have been illustrated. This is where a VaR is a α-quantile. The α-quantile q α of a distribution function F(x) is the value of the α% below the mass of the probability mass that separates the upper 1 -α% from the probability mass. The random variable (X) with probability α then takes on a value less than or equal to q α . The formal definition of the α-quantile is shown as in infimum function in equation 2. [START_REF] Taleb | The Black Swan. The Impact of the Highly Improbable[END_REF] with

q α = F -1 (α). (2.15)
F -1 it is the inverse function of the distribution function.

The Value at Risk, VaR is thus the α-quantile of a loss distribution. If a random variable (X)is given, the OpVaR for a time interval T is shown in the following equation 2.16

opVaR T α (X) = in f {x ∈ R | P [X > x] ≤ 1 -α}.
(2.16) opVaR T α (X) expresses that the smallest loss (for the example it would be the availability of the VoIP telephony of the insurance company) that corresponds to a lower limit and exceeds the loss with a probability of (1 -α). Hence the crucial probability for the calculation of (opVaR T α (X)) is determined by the α confidence level. To hold the energy production in the range of opVaR T α (X) for the open system of the value chain, a control circuit based ISMS is used to react accordingly to the disturbances with respect to the protection goals.

Expected shortfall

The Expected Shortfall (ES ), often referred to as the Conditional VaR, (CVaR), as a coherent risk measure, was already addressed in 1997 by Artzner et al. [START_REF] Artzner | Coherent measures of risk[END_REF]. The ES is defined as the expected loss in the event that the VaR is actually exceded. Thus, this is the probability-weighted average of all losses that are higher than the VaR. For Figure 2, the OpES for the random variable (X) with probability α for a time interval T is given in the equation 2.17.

opES T α (X) = E T w [X | X ≥ opVaR T α (X)] (2.17)
The expected value E T w for the time period T shown in Equation 2.17 corresponds to a conditional expectation of the random variable (X), for the case that X ≥ opVaR T α (X) occurs. A risk scenario is understood under the conditional expectation of the random variable (X). For the very rare deviations of the extreme values of E T w a control circuit based Business Continuity Management System (BCMS) is used.

A major difference between the analysis of financial and market risks and operational risks, is that there are, firstly, no goals and no security protection concepts concerning the protection goals exist in the field of finance and mark risks, and secondly, there are no management systems that can respond to exogenous disturbances. Only the approach of H. Markowitz [START_REF] Markowitz | Portfolio Selection: Efficient Diversification of Investment[END_REF] in 1959 suggesting a risk diversification of a portfolio could, therefore, be considered as a measure to protect the invested capital (availability of capital), but for operational risks it would only be helpful in rare situations.

In the previous sections, the VaR and the OpVaR have been discussed along with application scenarios. The argument here, however, is that these considerations of VaR and the OpVaR could be transferred to information technology and information processing, but not easily, if at all.

One of the main differences is that the information technology of a company is exposed to, among other technical damage, passive and active threats, vulnerabilities and attacks. The literature in the field of OpVaR has barely considered these facts at all. Against this background, a technical VaR is proposed (t-VaR), which addresses the concerns of information technology and information processing as well as the demonstrated passive and active threats, vulnerabilities and attacks. This is based on the definition of risk, according to equation (2.2).

Attack trees and threat agent

Equation (2.5) illustrated the Baysian view of a risk situation for a system Ψ . Exogenous knowledge is required for the intersection of vulnerability (Vul) and threat (Thr) for the Bayesian statistics. This required exogenous knowledge is filled with the attack trees, attack actors and a crime function. With this exogenous knowledge makes it possible to estimate the conditional probability of the intersection, as we will show in this section.

The idea of the attack trees goes back to the article by Weis in 1991 [START_REF] Weis | A system security engineering process Proceedings of the 14th National[END_REF]. In this article he describes threat logical trees. Generally, attacks are modelled with graphical, mathematical, decision trees. A few years later, the idea of the threat trees was taken up by B. Schneier, among others, and developed [START_REF] Schneier | Attack trees[END_REF]. This work by B. Schneier led to extensive additions and improvements to this technology, such as that published by A.P. Moore et al. [START_REF] Moore | Attack modeling for information security and survivability[END_REF]. Several tools have been developed and published; representative here of the work is [START_REF] Sheyner | Tools for Generating and Anaylzing Attack Graphs[END_REF][START_REF] Ingoldsby | Fundamentals of Capabilities-based Attack Tree Analysis[END_REF]; the authors provide an overview of the techniques and tools. The contribution of S. Mauw and M. Oostdijk [START_REF] Mauw | Foundations of attack trees[END_REF] in 2005 formalize the concepts informally introduced by Schneier [START_REF] Schneier | Attack trees[END_REF]. This formalization clarifies which manipulations of attack trees are allowed under which conditions. The commonality of attack trees and game theory has been elaborated on in 2010 by Kordy et al. [START_REF] Kordy | Attack-defense trees and two-player binary zero-sum extensive form games are equivalent[END_REF]. Thus, a similar approach for the threat scenarios and threat agent are performed using the game theory.

In this work, we expand the idea of T. R. Ingoldsby [START_REF] Ingoldsby | Fundamentals of Capabilities-based Attack Tree Analysis[END_REF] with conditional probability and the t-VaR. Threat trees generally have a root or target. Different branches (nodes) can lead to this target that are to be regarded as parts of goals and each start of a leaf. Each leaf is initiated by an attacker with different motives. The leaves and branches are weighted and equipped with an actor [START_REF] Mauw | Foundations of attack trees[END_REF]. The weighting corresponds to the criminal energy (Criminal power, Cp), and contain three functions. The assessment of these three functions reflect the exogenous knowledge which is required in the Bayesian statistics (see equation (2.4)).

Already in 1985, A. Mosleh et al. pointed out the two main distributions for a risk analysis on the Bayesian statistic [START_REF] Mosleh | Bayesian probabilistic risk analysis[END_REF]. On the one hand, it is the probability distribution of the event occurring. Since these are rare events, the Poisson distribution is proposed here, which is later used by many other authors. The one-parameter Poisson distribution does a good job of providing the assessment, that small deviations occur more frequently than larger deviations, such as is expressed in Figure 2 with the lower partial moment (LPM). The challenge now is to get a good estimation of the parameters of the distribution. This assessment is made in this paper on the threats and attack trees in combination with the function of the criminal energy.

On the other hand, in the article by A. Mosleh et al. [START_REF] Mosleh | Bayesian probabilistic risk analysis[END_REF], the loss distribution is approximated by the log normal distribution. This distribution also corresponded to the idea that small losses occur more frequently than large losses for a long time. This idea has been revised by the Black Swan Theory [START_REF] Taleb | The Black Swan. The Impact of the Highly Improbable[END_REF] (extreme value theory) and is now often replaced by a Generalized Pareto Distribution (GPD).

Often, the loss distribution is easier to determine than the frequency distribution, if the loss is related to the value chain.

The function of the criminal energy (Cp), which in turn is composed of three additive functions, represents the expert knowledge for the Bayesian risk analysis (see equation (2.6 -2.9)). The criminal energy is represented by the cost function (cost of attack cf. Fig. 3), the technical feasibility function (technical function, cf. 4) and the noticeability function, cf. Fig. 5. The three functions are mentioned by T. R. Ingoldsby [START_REF] Ingoldsby | Fundamentals of Capabilities-based Attack Tree Analysis[END_REF] and have to be adjusted to the relevant inspection. The following Figures 345describe the exogenous knowledge that focuses on the objective of VoIP telephony. This exogenous knowledge is important for the Bayesian approach.

Fig. 3 states that a threat agent (actor) for an attack on the VoIP telephony of the insurance company is willing to spend money on tools. This willingness varies between 0 -1 (axis of ordinates) and decreases with increasing costs (axis of abscissae). This can be explained simply because on the internet there are a number of free tools that are all well-suited to threaten a VoIP telephony. Figure 5 shows the noticeability function expressing how an actor wants to disguise his attack, so that he could not be discovered. From of these three functions, the threat of an attack is determined more precisely. This is called the criminal energy. These functions must be adapted to each situation and reflect the exogenous knowledge again, which is necessary for the conditional probability.

As an example, we can estimate the technical ability rating of 5 (out of 10), and expose the miscreant at a 0.3 noticeability.

f noticeabiity (0.3) = 0.85 (2.20)
and therefore the criminal energy with

CE = f cost • f tech ability • f noticeabiity (2.21)
CE = 0.6885 = 0.9 • 0.9 • 0.85 (2.22) With this function of the criminal energy, we could estimate the threat profile in conjunction with a specific threat agent (actor). The three functions of Figures 345do not explain anything about the motivation and benefit of the threat agent, but the threat agent's motivation is correlated to attack benefits. These must also be taken into account in order to understand how desirable an attack appears to an adversary. The discussion of the motivation and benefits of a threat agent is not really covered in this article, due to lack of space. But, typically the largest benefit of the threat agent is associated with achieving the tree's root node, or with side benefits occurring at the various intermediate nodes. Different threat scenarios run through different paths among leaf nodes and root node (cfg Fig. 7). The threat agent's benefits may differ considerably depending on the threat scenario used. We will discuss different threat scenarios and different paths between leaf nodes and root in the next section.

Data acquisition

According to the model (cfg section 2), data acquisition regarding vulnerabilities is handled in this section and matched to the attack-tree with the associated threat agent (actor) and analyzed to develop risk scenarios according to the equations 2.6 to 2.9.

Here, ψ represents the VoIP telephony. Other systems are not investigated and consequently Ψ = ψ. This means that in this real-world case study, all the vulnerabilities, threats and risk scenarios relate to ψ = VoIP telephony of the insurance company. Figure 6 is a rough sketch of the VoIP telephony of the insurance company. There are two locations indicated with A and B. The two locations (A, B) are connected to a non-public network (MPLS cloud) and the switch at the location A and B are both used for data traffic as well as for voice traffic. This means that two locations are not connected to the internet. The MPLS cloud is maintained by a service provider which supplies the insurance company in addition to other customers in its MPLS cloud. The customers (the insured) of the insurance company choose from outside the softphone to get in touch with the employees. In addition to uptime (availability), the confidentiality of the conversations is a security objective for the insurance company.

Vulnerability analysis

The empirical study in 2012 for the insurance company had to analyze the current target vulnerabilities within the scope of VoIP telephony. These weaknesses are discussed as an example in this section to show the procedure of the model. This analysis was carried out in two steps. In the first step, the VoIP module (B 4.7) of the baseline protection manual from the BSI was used [16,[START_REF]Federal Office for Security in Information Technology, IT Baseline Protection Handbook[END_REF]. The technical department was interviewed. In the second step, a white box penetration testing was conducted to verify the statements and to find other vulnerabilities. It is worth mentioning that there is no connection between the VoIP telephony and the Internet. In our investigation in 2012 it was recognized, inter alia, that the voice data (RTP stream) transmitted without encryption and the ports at the Softphones and patch socket in the premises were not secured against unauthorized use (IEEE 802.1x, Port Based Network Control PBNC). Furthermore, we identified that there was no firewall between the MPLS network and the LAN of the insurance company and also the voice data was transmitted unecrypted in the MPLS network.

Based on these findings, the following threat analysis was performed.

Threat analysis

The threat analysis is based on the identified vulnerabilities and contains three elements: the threat scenarios, the matching threat agent and the function of the criminal energy.

In our threat analysis, we show as an example, how the protection target -in this case, the confidentiality of VoIP Telephony -is given in the current threat situation for the insurance company. Confidentiality for VoIP telephony means that the phone calls between the employees of the insurance company and its insured cannot be intercepted. Similarly, the phone calls between sites A and B will be kept confidential, because the interception could have negative implications for the insurance company.

Figure 7 shows the potential threat paths for the insurance company from the leaf to the root. Between the paths are either "or" or "and" connections. The "and" connection means that the two paths connected with the "and" must be met in order to reach the next sub-goal. Between the sub-goals the function of the criminal energy will change. The individual leaves represents the threat agent and the root represents the target of the attack (interception of voice traffic). The numbers represent the function of the criminal energy and therefore the exogenous knowledge. The index (I) = Impossible and (P) = Possible differentiates possible paths that are possible or not possible due to policies or structural circumstances. The equations 2.18 -2.20 were determined for each threat attack and different threat agent with a specific crime function (cf. 2.21). Inserting a set of risk scenarios for the VoIP-Telephony in the given situation into the set of equations 2.6 -2.9 created equations 3.1 -3.4. The actual risks of wiretapping the voice traffic in the real-world case study was estimated with risk scenarios (cfg equations 3.1 -3.4) according to the Bayesian statistics, with the attack trees, the threat agent and the criminal function (CE). As a threat agent, an intruder from the inside the insurance company was postulated, because the unencrypted voice traffic is only in the LAN of the insurance company and is also transmitted unencrypted in the cloud provider's MPLS. However, no Internet connection exists for voice traffic to the insurance company and the MPLS cloud is also not connected to the Internet. Thus, as insiders only someone from the insurance company is eligible out of the environment (priviledged person) of the MPLS cloud providers.

The threat was assumed to be the interception (T hr 1 ) of sensitive voice data of the insurance company that could be performed by an internal perpetrator (threat agent). Likewise, the threat agent could also be represented by service personnel (T hr 2 ) or a trespasser (T hr 3 ). For each threat tree and threat agent a separate criminal function from Fig. 3, Fig. 4 and Fig. 5 is estimated with the equation 2.21. The leaves in Figure 7 represent the different threat agents. The behavior of insiders has already been addressed in a number of published articles, representative here is the article by I. J. Martinez-Moyano et al. [START_REF] Martinez-Moyano | A behavioral theory of insider-threat risks: A system dynamics approach[END_REF]. ψ 1 denotes the VoIP infrastructure and refers to the vulnerability of the non-encrypted voice data with Vul 1 .

The possible damage resulting for insurance company caused by insiders is the associated reputational damage if the intercepted voice data is given to the public. Given to the reputational damage for the voice data scenario, we made an assumption that 25 customers terminate their contract in the current year. The loss by termination is indicated with l 25c . The loss of 25 insurance contracts in a one-year period is also well above the normal turnover rate between 8 -11 (l 8cl 11c ) contracts per year (T) and hence higher than the expected value of E T w (cfg Eq. II.12). We can use the equations 2.6 -2.9 to express the risk scenarios R sz1 -R szn (3.1 -3.4) with the potential loss of 25 contracts (l 25c ) under consideration of Eq. 2.21 for the threat agents and the attack trees for our real-world case study of ψ = VoIP telephony of the insurance company:

R sz1 = PrE p1 (Vul 1 | T hr 1 ) • l 25c → VoIP-Telephony (3.1) R sz2 = PrE p2 (Vul 1 | T hr 2 ) • l 25c → VoIP-Telephony (3.2) R sz3 = PrE p3 (Vul 1 | T hr 3 ) • l 25c → VoIP-Telephony (3.3) . . . R szn = PrE pn (Vul n | T hr n ) • l 25c → VoIP-Telephony (3.4)
The probability PrE p1 -PrE pn is estimated as described above with the conditional probability of Eq. 2.4.

In addition to safeguarding the confidentiality and the risk scenarios as described with R sz1 -R szn (3.1 -3.4), we also worked out the risk scenarios for the other two protection goals: the availability and integrity. Thus, for the protection of target availability and integrity, analogous threat trees were developed with appropriate threat agents and criminal functions in order to then determine the conditional probability and therefore the risk scenarios. Due to space limitations in article, these analogous considerations will not be pursued further.

Results

In this section, we will discuss the results from the VoIP-Telephony investigation for our real-world case study.

The business success of a insurance company can be determined, inter alia, by the amount of insurance policies (|C|). The number of insurance policies (c i ∈ C) fluctuates with 8 to 11 policy terminations. The target is expected to lose no more than 8 insurance policies per year, however, if the loss of 11 insurance policies occurs, this is also acceptable and the α value is achieved. Thus, the expected value of E T w (C) for one year is 8 insurance policies and corresponds to the target value "1" in Figure 8. The period is one year (T ).

The equation4.1 describes the negative variation around the target value of 1 ((l c8 = 8 lost contracts). The possible new customers per year are not considered in our realworld case study. For this reason, only the lower distribution (LPM) is considered. The scattering width is 3 contracts and partly achieves the loss of 11 contracts per year. The equation 4.1 now describes the influence of the technical infrastructure with the control objectives (Confidentiality, Integrity, Availability) to the cardinality of the set of contracts |C|.

t-Var

(C) = σ 2 C = |C| i=1 c i -E T w (C) 2 • Pr (C = c i ). (4.1)
This experience of the turnover is derived from observations from the last 10 years. For the insurance company, availability for your customers is very important. If customers cannot express their concerns over the phone, they are angry and are ready to switch to another insurance company in the current year.

The loss of confidentiality creates reputational damage for the insurance company and a number of customers cancel. There is an internal investigation of the insurance company, which proves this fact. This is one of reasons why the risk analysis was performed. It has been shown that, due to the risk scenarios in our real-world case study, there is the possibility losing a lot more contracts than expected. Figure 9 shows the In conclusion, it can be said for our real-world case study that the insurance company has decided to take appropriate countermeasures in the field of encryption in the LAN and in the connection in the MPLS cloud. It was ensured that the cost of action does not exceed the potential unexpected losses. Fig. 9: Loss distribution for the contracts c i due to breaches of confidentiality of the VoIP-Telephony items, the set of scenarios (S ), probability (p) and loss (x), in a linear combination R = { S i , p i , x i }, the concept of hazard (H) contains only two items, the set of scenarios (S ) and the loss (x) in a linear combination H = { S i , x i }. Furthermore, the authors [START_REF] Kaplan | On the quantitative definition of risk[END_REF] pointed out the difference between the probability according to the frequentist view of Laplace and the conditional probability of the Bayesian theory. For both of these views, there are a number of publications. Widespread is also the approach of Bayes. For this view, there are different ideas, to name a few: [START_REF] Mosleh | Bayesian probabilistic risk analysis[END_REF][START_REF] Valle | A bayesian approach to estimate the marginal loss distributions in operational risk management[END_REF][START_REF] Alexander | Bayesian methods for measuring operational risk[END_REF][START_REF] Poolsappasit | Towards an Efficient Vulnerability Analysis Methodology for better Security Risk Management[END_REF].

Representative of many contributions to the provision of operational risk is the work of P. Embrecht et al. [START_REF] Embrechts | Quantifying regulatory capital for operational risk[END_REF] or by K. Boecker and C. Klüppelberg [START_REF] Böcker | Operational var: A closed-form approximation[END_REF]. The discussion about the coherent version of VaR was initiated by P. Atzner et al. [START_REF] Artzner | Coherent measures of risk[END_REF]. In the area of operational risk, additional work should be mentioned that is related to this paper. Thus, the present paper follows broadly the doctoral thesis from 2010 of N. Poolsappasit [START_REF] Poolsappasit | Towards an Efficient Vulnerability Analysis Methodology for better Security Risk Management[END_REF] but expands on his idea, however, to the actor model and a weight function, which represents the criminal energy. Finally, it can be summarized that one unique way does not yet exist to satisfy answers to determine the operational risk.

Conclusion and further investigation

Over the past two decades the VaR and the coherent variant C-VaR have established themselves as a value for determining the risks associated with market and financial risks. According to BASEL II and/or Solvency II the operational risks should be determined in an appropriate manner. Once the standard approach to a loss database proved infeasible and unsuccessful, many institutes and industrial companies tried to follow BASEL II. However, the process of determining the VaR in the market and financial risks cannot be directly transferred to the technical infrastructure. In our view, the operational risk of the individual VaR must be assembled for systems, processes, people and external events. Therefore, in this article we present a method based on the Bayesian statistics, vulnerabilities, attack trees, an actor model and the function of criminal energy, that determines a technical VaR that is an appropriate response to the specific protection targets (confidentiality, integrity, availability) of an IT infrastructure. The real-world case study of VoIP telephony in an insurance company verified t-VaR for the protection target of confidentiality. As a result, it can be shown that the t-VaR is an appropriate method to determine the VaR for the IT infrastructure under operational risks. Other considerations now aim to determine a t-VaR for other areas of the IT infrastructure, and then conduct a risk aggregation to determine the overall risk in the technical area.

. 5 )Fig. 1 :

 51 Fig. 1: Section and intersection of the set of threats and the set of vulnerabilities

Fig. 2 :

 2 Fig. 2: Expected value of random variable (X), opVaR and opES

Fig. 3 :

 3 Fig. 3: Cost function

Fig. 5 :

 5 Fig. 4: Technical function

Fig. 6 :

 6 Fig. 6: VoIP Architecture

Fig. 7 :

 7 Fig. 7: Attack tree with the criminal energy

Fig. 8 :

 8 Fig. 8: Technical Value at Risk for the insured contracts

Related work

The concept of risk and its various considerations is a discussion of the past few decades in the literature as shown in the article 1980 of S. Kaplan and J. Garrick [START_REF] Kaplan | On the quantitative definition of risk[END_REF]. Also, the authors distinguish between risk and hazard. While the risk (R) contains the three


Matthias Huber

Matthias Gabel

Marco Schulze

Alexander Bieber

Cumulus4j: A Provably Secure Database Abstraction Layer

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cloud Computing enables a more efficient use of storage and computing resources by sharing them between multiple applications and clients. Outsourcing and payper-use payment models cause reduced cost for IT infrastructures. Also, the risk of fatal data loss is minimized due to specialization of the individual providers.

Huge impediments for the adoption of Cloud Computing, however, are security concerns. A client using a cloud service, loses control over his data. He cannot control whether its data is copied or misused. A malicious system administrator may copy sensitive data and sell it to e.g. competitors. Providers may even be required by law to disclose the data of their clients to government agencies.

Current security measures of Cloud Computing providers focus on external adversaries. Authentication and authorization mechanisms prohibit access for unauthorized clients. Measures against internal adversaries mostly try to restrict physical access to servers to authorized staff. Examples like Wikileaks, however, show that legal insiders also have to be taken into account.

In this paper, we present a novel approach to secure database outsourcing. Intuitively, our scheme hides associations like Alice ↔ Bob rather than hiding the values Alice and Bob themselves. In order to achieve security as well as efficiency, we use a combination of encryption and index generation. We provide the security notion Ind-ICP that informally hides relations between data values. Furthermore, we prove that our approach fulfills this new security notion.

In order to demonstrate the practicability of our approach, we provide Cu-mulus4j [1], an implementation of our approach for data objects. We implemented Cumulus4j as a plug-in for DataNucleus [START_REF]Data Nucleus Access Plattform[END_REF]. DataNucleus is an opensource database abstraction layer that implements the latest versions of JPA [START_REF]Java Persistence API (JPA[END_REF] and JDO [START_REF]Java Data Objects[END_REF]. Our plug-in transparently encrypts data before it is stored in the database back-end, while providing provable security. The overhead introduced by Cumulus4j depends on the query type and the data structure. We define the overhead as the fraction time with Cumulus4j over time without Cumulus4j. Our benchmarks show that Cumulus4j has no impact on select and update queries but takes 5 times longer for inserts. Cumulus4j is open source under the GNU Affero General Public License, and can be downloaded from [1].

This paper is structured as follows: In Section 2, we will discuss related work. We present the data model used by Cumulus4j in Section 3 and the architecture in Section 4. In Section 5, we prove the security of Cumulus4j. We present and discuss benchmark results in Section 6. Section 7 concludes.

Related Work

The problem of secure database outsourcing emerged early in 2002 [START_REF] Hacigümüs | Providing database as a service[END_REF]. Consequently, there is a rich body of research on this problem. Most of the approaches rely either on indices or on fragmentation.

There are also well-known cryptographic schemes, that could be used to implement secure database outsourcing, namely secure multi party computations and fully homomorphic encryption [START_REF] Goldreich | How to play any mental game or a completeness theorem for protocols with honest majority[END_REF][START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF]. While providing provable security, the huge overhead of these schemes would cancel out the benefits of outsourcing.

More practical approaches try to find a trade-off between security, performance, and efficient support for as many query types as possible. An efficient and practical database outsourcing scheme should provide support for sub-linear query execution time in the size of the database [START_REF] Kantarcioglu | Security issues in querying encrypted data[END_REF].

To our knowledge, the first practical approach to the problem of secure database outsourcing was presented by Hacigümüs et. al. in [START_REF] Hacigümüs | Providing database as a service[END_REF]. Based on this approach, additional solutions have been suggested [START_REF] Hacigümüs | Executing SQL over encrypted data in the database-service-provider model[END_REF][START_REF] Damiani | Balancing confidentiality and efficiency in untrusted relational DBMSs[END_REF][START_REF] Hore | A privacy-preserving index for range queries[END_REF].

The idea of these solutions is to create indices in order to support efficient query processing. These indices are coarse-grained. They contain keywords, ranges, or other identifiers and row ids of the rows in the database where the keywords occur. An adapter handles query transformation and sorts out false positives. Depending on the indices and the queries this can lead to a large overhead. Furthermore, it is unclear what level of security these approaches provide for realistic scenarios.

Another idea found in literature is to achieve privacy by data partitioning. The approaches in [START_REF] Aggarwal | Two can keep a secret: A distributed architecture for secure database services[END_REF][START_REF] Capitani Di Vimercati | Fragments and loose associations: respecting privacy in data publishing[END_REF][START_REF] Soodejani | k-anonymity-based horizontal fragmentation to preserve privacy in data outsourcing[END_REF] introduce privacy constraints that can be fulfilled by fragmenting or encrypting the data [START_REF] Aggarwal | Two can keep a secret: A distributed architecture for secure database services[END_REF][START_REF] Capitani Di Vimercati | Fragments and loose associations: respecting privacy in data publishing[END_REF] or fragmentation and addition of dummy data [START_REF] Soodejani | k-anonymity-based horizontal fragmentation to preserve privacy in data outsourcing[END_REF]. In [START_REF] Nergiz | Query processing in private data outsourcing using anonymization[END_REF], Nergiz et. al. use the Anatomy approach [START_REF] Xiao | Anatomy: simple and effective privacy preservation[END_REF] to achieve privacy in a database outsourcing scenario. The level of privacy achieved by these partition-based approaches depends on the actual data and user defined privacy constraints. They do not provide any security notion beyond that.

Different to the approaches described above is CryptDB [START_REF] Popa | Cryptdb: protecting confidentiality with encrypted query processing[END_REF]. It does not rely on explicit indices or fragmentation. It uses the interesting concept of onions of encryptions. CryptDB proposes to encrypt the database attribute wise. Furthermore, it uses different encryption schemes that for example allow for exact match or for range queries of encrypted values. These encryptions are nested with the clear text in the middle. If a query cannot be executed because of the current encryption level of an attribute, the database removes the outermost layer of all entries of this attribute. Therefore, the security of this approach depends on how the database is used (i.e. what type of queries are issued to the database). The CryptDB approach does not provide any security notion.

Data Model

In order to store data objects securely in a database, we need to transform them. In this section, we describe the data model of Cumulus4j, the transformation and encryption of data objects, as well as retrieval of stored data.

A difference between relational data and objects is that objects can hold references to other objects. In order to serialize objects we serialize these references. We also need to serialize references for the indices we create. We will explain this process in the next subsection.

Serializing References

In contrast to plain fields such as int, char or boolean, references to other objects cannot be encrypted directly. They need to be serialized first. Therefore, we replace the reference with a field containing the id of the referenced object. Consider Figure 1(a). There are two objects, each with an unique id. These ids are provided by DataNucleus as specified in JDO and JPA. The object A has a reference to object B. Cumulus4j replaces this reference with an additional field in object A containing the object id of object B. Encrypting this field prevents an adversary from learning the relation of object A to object B. With the encryption key Cumulus4j can, however, reconstruct the original object A from the object A .

Note that this procedure can also be recursively applied to more complex data structures.

The Cumulus4j transformation

Cumulus4j transforms data objects into the data structure depicted in Figure 2. This transformation is done in three steps:

1. Data object transformation and encryption Cumulus4j serializes data objects, encrypts the serialization, and stores it in wrapper objects of the type DataEntry. References to other objects are serialized by replacing them with their wrapper objects' IDs.

Meta data class creation

For each data object class a ClassMeta object and for each field of each class a FieldMeta object is created. These objects contain metadata such as the name of the class/field. Additionally ClassMeta objects contain references to their FieldMeta objects.

Index generation

For each field in a data object, an IndexEntry object is created. This object contains the value of the field together with serialized (cf. Section 3.1) and encrypted references to those DataEntry wrapper objects containing the indexed field value. There are different types of IndexEntry classes. For example an IndexEntryDouble objects contains a double value, while an Index-EntryString object contains a string value. Each IndexEntry object contains a reference to its FieldMeta object.

FieldMeta ClassMeta DataEntry IndexEntry . . . IndexEntryDouble IndexEntryString Fig. 2. The Cumulus4j data model stored in the back-end. The dashed arrow represents a serialized and encrypted reference. The DataEntry classes contain encrypted serializations of data objects.

After this transformation, due to the encrypted references in the IndexEntry objects and the encrypted data objects, an adversary only learns the field values of the original objects, but not which values occurred in the same object. Cumulus4j, however, can reconstruct the original objects. Note, that this transformation can also be applied to relational data interpreted as data objects (cf. Section 5.1). We use this in our security proof in Section 5.3.

For increased security, the index generation step can be suppressed with annotations in data object classes. In this case no index will be generated. Cumulus4j allows for suppression of index generation on field level. This has implications for security as well as performance. Not generating an index results in faster writes and increased security. This is an option for fields that are confidential by itself, and will not be part of conditions in queries (e.g. credit card numbers).

Data Retrieval

In the last section, we described the transformation that is used in order to store data objects. In this section, we describe the retrieval of data objects. This is done by the Cumulus4j plug-in that intercepts issued queries and rewrites them. The transformation of data retrieval queries is depicted as pseudocode in Figure 3.

Data: retrieval query q with conditions C and boolean operators OP Result: result set S exp = {} ; / * empty expression of algebra of sets * / foreach ci ∈ C do ind ← retrieve and decrypt IndexEntry objects with matching condition ci; if i = 1 then exp = ind; else exp = exp opi-1 ind; end ids = evaluate exp ; / * set of ids * / data ← retrieve and decrypt DataEntry objects with ids in ids; S ← q(data) ; / * remaining evaluation of q with data * / return S; Fig. 3. Pseudocode for data retrieval queries in Cumulus4j

Consider the following example selection query for objects of a class C: σ A=x op B<y (C), where A and B are attributes, x and y are attribute values from the domain of A and B, respectively, and op is a boolean operator. In order to execute this query, Cumulus4j issues queries to the IndexEntries for indices of Class C and field A with value x and for field B with value < y. This procedure can be parallelized. Then Cumulus4j decrypts the indices and applies the boolean operator op to the decrypted sets of indices. The result is the set of indices of DataEntries that satisfies the query. After retrieval and decryption of these DataEntries, Cumulus4j returns them. If the issued query contains an aggregation (e.g. count), we use in memory evaluation before returning the result.

We implemented Cumulus4j as a plug-in for the database abstraction layer DataNucleus. Cumulus4j integrates into DataNucleus as an OSGi plug-in. Consider the architecture depicted in Figure 4. The application component accesses DataNucleus and DataNucleus accesses the underlying database. Cumulus4j enhances DataNucleus.

The integration of our plug-in, and therefore the encryption of the underlying database, is fully transparent to the application (except for a minimum of Cu-mulus4j API calls controlling the key management). Thus, existing applications using DataNucleus can be easily enhanced with Cumulus4j.

In one database, thousands or more different keys are used to encrypt different records. During a database operation, only those encryption keys are in the memory of the server Cumulus4j is deployed to which are needed for the current operation. Therefore, an attacker taking a memory dump can only compromise a subset of the keys and thus decrypt only a part of the database. Cumulus4j requires a key server that manages encryption keys. Cumulus4j supports deployment of the key server on the client as well as deployment of the key server on a separate server.

Key Server deployed on the Client In order to communicate with the server, the client establishes a communication channel with the server. Without a dedicated key server, the client will initiate a second communication channel. This channel is dedicated for key requests issued by the server and responses from the client (cf. Figure 5(a)). Key requests are issued by the server whenever it has to encrypt or decrypt data and therefore needs access to certain keys.

Dedicated Key Server Alternatively to holding the keys on every client, it is possible to run a dedicated key-server (cf. Figure 5(b)). Then, clients need to establish crypto sessions with the key server. Since the keys are password protected, the key server only sends issued keys to the server if there is a corresponding crypto session with a client. To increase security, the presence of a crypto-session (i.e. an authenticated user) is not sufficient for the key server to respond to key requests. Only, if the client is currently expecting the application server to perform database operations on his behalf, access to the key server is granted. This is done by temporarily unlocking the current crypto-session. It is locked again immediately after the application server finished its database operation. Therefore, a user does not need to log out in order to deny access to the keys on his behalf. His crypto-session is always locked whenever the user is not actively using the application.

Security of Cumulus4j

In this section, we introduce a novel security notion for outsourced databases, called Ind-ICP (Indistinguishability under Independent Column Permutation). Informally, this notion hides relations between attribute values. Furthermore, we argue that the Cumulus4j transformation we presented in Section 3.2 adheres this security notion. In order to do so, we interpret objects as rows in a table with a scheme defined by the class of the object.

Interpretation of Objects as Relational Data

Data objects contain either primitive values (e.g. int, boolean, char) or references to other objects. In order to prove the security of Cumulus4j, we interpret objects as rows in tables of a relational database. The representation we choose is as follows: Tables represent classes, attributes represent fields of classes, and attribute values represent field values of objects. Therefore, an object is represented by a row in the table of its class. Consider for example Figures 6(a Figure 6(a) depicts two objects of the class Person. These objects have the field name, surname and a friends with reference to each other.

These objects can be represented by rows in the table depicted in figure 6(b). Each row has a unique id. The references are replaced with the id s of the objects or rather rows. Note, that the mapping of data objects to relational data is bijective. Therefore, a proof of security properties of objects represented this way, also applies to the objects itself.

A Security Notion for Outsourced Databases: Ind-ICP

In this section, we will present Ind-ICP, a security notion applicable to secure database outsourcing. We already introduced Ind-ICP in [START_REF] Huber | Towards secure cloud computing through a separation of duties[END_REF]. In this paper, we will do this more formally. We do not distinguish between a table and a database, since a (finite) set of tables always can be normalized to a universal relation. For the definition of our security notion, we define a database as a multiset of tuples: Definition 1. A database d = {t 1 , t 2 , . . . , t n } is a multiset of tuples with attributes A 1 , A 2 , . . . , A m . We denote the value of attribute A i in tuple t j as d i,j . We call the set of all i-th elements of each tuple in d the i-th column of d. We call the set of all databases DB.

Throughout this paper, we use the terms tuple and row interchangeably. When interpreting objects as rows of a database, the Cumulus4j transformation presented in Section 3.2 takes databases as input and outputs also databases. We define this process as a database transformation: Definition 2. A database transformation is a transformation f : DB → DB. We call F the set of all database transformations. If f is a function, we call f a database function.

Note that not all database transformations are functions. Consider for example transformations that involve probabilistic processes. In order to define a security notion for database outsourcing, we define a relation for databases that should be indistinguishable after the Cumulus4j transformation. This relation is implied by the following database function: Definition 3. Let Π ⊂ F be the set of database functions p : DB → DB such that each p ∈ Π independently permutes the entries within each column of a database. We call p an independent column permutation (ICP).

Consider for example the databases depicted in Figure 7. The right database (b) is the result of applying the independent column permutation p = (p 1 , p 2 , p 3 ) with p 1 = (13), p 2 = (123), and p 3 = id to the one (a).

Based on Definition 3, we define the following experiment: Definition 4. Let d ∈ DB be a database, f ∈ F a database transformation, p ∈ Π a independent column permutation, A an adversary and i ∈ {0, 1}. We define the experiment Ind-ICP i A as follows:

Ind-ICP i A (d): d 0 ← f (d) d 1 ← f (p(d)) b ← A(d i ) return b
In this experiment, an adversary A guesses whether an ICP p has been applied to a database d before applying f . Now, we can define our security notion: Definition 5. For a database transformation f , Indistinguishability under Independent Column Permutation (Ind-ICP) holds iff for each polynomially restricted adversary A, for each database d ∈ DB, and each ICP p ∈ Π the following holds:

Adv Ind-ICP A (d) := P r[Ind-ICP 1 A (d) = 1] -P r[Ind-ICP 0 A (d) = 1] is negligible.
Informally, a database transformation fulfills Ind-ICP if, given the transformed database, an adversary cannot infer the relations of the attribute values of the original database, since the relations are destroyed by independent column permutations. This security notion is weaker than classical cryptographic security notion (e.g. Ind-CCA). It, however, allows for schemes that support efficient execution of queries on the encrypted data.

Please note, that Ind-ICP does not compose with background knowledge. According to the No-Free-Lunch Theorem [START_REF] Kifer | No free lunch in data privacy[END_REF], this is not possible for an scheme that maintains some utility. Because of this, in our implementation we introduced annotations that allow for suppression of index generation.

Cumulus4j fulfills Ind-ICP

In Section 5.1, we argued that data objects also can be interpreted as relational data. In this section, we apply the Cumulus4j transformation to arbitrary relational data and prove that it adheres Ind-ICP. For this proof, we assume that all tables are sorted lexicographically and that the adversary has no background knowledge about the database.

α a a β b b γ c c (a) γ c a β a b α b c (b)
Consider Figure 8: Figure 8(a) depicts an arbitrary table with attributes a i and attribute values v i,j . Figure 8(b) depicts the table from Figure 8(a) after applying an arbitrary independent column permutation (cf. Section 5.2). We now apply the Cumulus4j transformation to these two tables and show, that the results are indistinguishable for any polynomial time adversary. Thus, proving that the Cumulus4j transformation fulfills Ind-ICP.

a1 a2 . . . v1,1 v2,1 . . . v1,2 v2,2 . . . . . . . . . . . . (a) a1 a2 . . . v 1,π 1 (1) v 2,π 2 (1) . . . v 1,π 1 (2) v 2,π 2 (2) . . . . . . . . . . . . (b)
Fig. 8. A table with attributes ai and values vi,j (a) and the same table after applying an independent column permutation (b). Not depicted: The meta data associated with the tables and its attributes.

Interpreting the tables in Figure 8 as objects, applying the Cumulus4j transformation (cf. Section 3.2) and reinterpreting the result as relational data yields tables depicted in Figures 9 and10. For the sake of simplicity and w.l.o.g., we assume each attribute value to be unique.

Performance

In order to predict the performance of an application after migrating to Cumu-lus4j, we measure the performance with a generic benchmark suite. For this, we use the open-source database benchmark suite PolePosition [START_REF]PolePosition[END_REF], which can be easily used with DataNucleus. We compare two engines: DataNucleus without Cumulus4j and DataNucleus with Cumulus4j. The benchmark is run multiple times for each engine and averaged. This way, effects of the OS and the Java garbage collection are minimized. Different scenarios (called circuits) are considered in order to better understand the impact on a complex application later. The full source code -including the benchmarks -can be downloaded at [1]. We measure the time for four different circuits (for details cf. [START_REF]PolePosition Circuits[END_REF]):

-Complex uses a deep object graph of different classes with an inheritance hierarchy of five levels. -Flatobject uses simple flat objects with indexed fields.

-Inheritancehierarchy operates on objects of a class hierarchy with a depth of five levels. -Nestetdlists uses a deep graph of lists for traversing.

We describe the operations performed in the different circuits:

-write stores all objects into an initially empty database.

-read loads all attached objects into memory and traverses them, by calculating a checksum over all objects. -query queries for instances over an indexed field.

-update traverses all objects, updates a field in each object.

-delete traverses all objects and deletes each object individually.

-queryIndexedString simulates querying for a number of flat objects by an indexed string member. -queryIndexedInt simulates querying for a number of flat objects by an indexed int member.

DataNucleus translates all above queries into rapidly processable exact match queries (attr = param).

The setup is as follows: The benchmark is run on an application and benchmark server (Intel Core i7-2700K, 3.5 GHz, 16 GB RAM). A database server (AMD Phenom II X6, 0.8 GHz, 8 GB RAM) hosts the MySQL 5.5 database. They are connected via Gigabit Ethernet. The setup divides the servers into two zones: The trusted zone running the DataNucleus+Cumulus4j middleware and the untrusted storage back-end.

The results are shown in Figure 11 in appendix A. In oder to cope with outliers, the mean time for all operations is shown on a logarithmic scale in order to cope with outliers. The introduction of the Cumulus4j plug-in makes the creation of the initial datasets more complex, thus consuming more time. Data encryption and the creation of indices result in an overhead of factor 5. MySQL does not use any indices per default. But due to the implicit use of indices in Cumulus4j, query operations run faster on the Cumulus4j engine for all circuits. Updates take almost the same amount of time while deletes are marginally slower with Cumulus4j. It is currently unknown why the read operations in the Inheritancehierarchy are much slower than without Cumulus4j.

We can confer that the use of the Cumulus4j plug-in in DataNucleus does not introduce high overhead in any scenario. It is best suited for applications with many read and few write queries, but it can be used in every scenario.

When using Cumulus4j in web application, the user would probably not notice any slowdown at all, because the overall response time is only marginally affected by Cumulus4j.

Conclusion and future work

In this paper, we introduced a new approach for securing outsourced databases. While taking insider-attacks into account, we focused on privacy -a major concern when dealing with Cloud Computing.

We presented Cumulus4j, a plug-in for the database abstraction layer DataNucleus. It serializes and encrypts data objects and generates meta data that enables fast query processing. Cumulus4j handles encryption, decryption and query translation transparently and requires only minimal changes to the original application. We defined a novel security notion, Ind-ICP, which informally is fulfilled if relations between attribute values are hidden. We proved that Cumulus4j achieves this kind of security. Finally, we showed that the solution is practical by comparing it with an unsecured database in several benchmark scenarios.

Planned future improvements are optimizations of the index structure as well as additional annotations in order to allow for even faster queries execution.

A Benchmark Results

Fig. 1 .

 1 Fig. 1. Two objects A and B (a). Each object has a unique id. Object A has a reference relation to object B. In Figure (b), the reference has been replaced. A contains an additional field with the id of object B.

Fig. 4 .

 4 Fig. 4. Coarse architecture of DataNucleus with Cumulus4j. The integration of Cumu-lus4j as a plug-in for DataNucleus is transparent for the application.

Fig. 5 .

 5 Fig. 5. Key management for different deployment Scenarios: Without a dedicated key server (a) clients handle key management. With a dedicated key-server (b) clients establish a crypto session with the key server.

  ) and 6(b).

Fig. 6 .

 6 Fig. 6. An example of two objects of type Person (a) and a tabular representation (b) of these objects.

Fig. 7 .

 7 Fig. 7. An example for a database before (a) and after (b) an independent column permutation.

Fig. 11 .

 11 Fig. 11. Benchmark of circuit (a) Complex, (b) Flatobject, (c) Inheritancehierarchy, and (d) Nestedlists of JDO/DataNucleus without (light gray) and with the Cumulus4j plug-in (dark gray).

  Cumulus4j encrypts each row of the original table (DataEntry), generates indices (IndexEntry) with encrypted keys for every attribute value, and generates the meta data tables. The meta data tables contain keys, meta data about the original table, as well as meta data about attributes.The tables in Figures 9 and 10 are identical except for the encrypted entries. Therefore, breaking the Ind-ICP property of Cumulus4j implies breaking the underlying encryption scheme. The result of the application of the Cumulus4j transformation to the table in Figure8(b) assuming the attribute values vi,j are different.

								key fID IDlist
	fID cID metadata				v1,1 1 E(π1(1))	id cID	data
	1	1		fm1,1	cID metadata	v1,2 2 E(π1(2))	1 1 E(v 1,π1(1) , v 2,π2(1) , . . . )
	2	1		fm1,2	1	cm1		v2,1 1 E(π2(1))	2 1 E(v 1,π1(2) , v 2,π2(2) , . . . )
	. . . . . . (a) FieldMeta . . .	(b) ClassMeta	v2,2 2 E(π2(2)) . . . . . . . . .	. . . . . . (d) DataEntry . . .
							(c) IndexEntry
	Fig. 10.
								key fID IDlist
		fID cID metadata			v1,1 1 E(1)	id cID	data
		1	1	fm1,1		cID metadata	v1,2 2 E(2)	1 1 E(v1,1, v2,1, . . . )
		2	1	fm1,2		1	cm1	v2,1 1 E(1)	2 1 E(v1,2, v2,2, . . . )
		. . . . . . (a) FieldMeta . . .	(b) ClassMeta	v2,2 2 E(2) . . . . . . . . .	. . . . . . (d) DataEntry . . .
								(c) IndexEntry
	Fig. 9. A relational representation of the result of the application of the Cumulus4j
	transformation (cf. Section 3.2) to the table in Figure 8(a) assuming the attribute
	values vi,j are different.

Acknowledgements

We wish to thank Andy Jefferson and Jan Mortensen of NightLabs Consulting GmbH their support with the implementation of Cumulus4j and with the benchmarks. This work has been partially funded by the Federal Ministry of Education and Research, Germany (BMBF, Contract No. 01IS10037) and KAS-TEL (BMBF, Contract No. 16BY1172). The responsibility for the content of this article lies solely with the authors.