Abstract

New big-data analysis platforms can enable distributed computation on encrypted data by utilizing trusted com-puting primitives available in commodity server hard-ware. We study techniques for ensuring privacy-preserving computation in the popular MapReduce framework. In this paper, we first show that protect-ing only individual units of distributed computation (e.g. map and reduce units), as proposed in recent works, leaves several important channels of information leak-age exposed to the adversary. Next, we analyze a variety of design choices in achieving a stronger notion of pri-vate execution that is the analogue of using a distributed oblivious-RAM (ORAM) across the platform. We de-velop a simple solution which avoids using the expen-sive ORAM construction, and incurs only an additive logarithmic factor of overhead to the latency. We im-plement our solution in a system called M2R, which en-hances an existing Hadoop implementation, and evaluate it on seven standard MapReduce benchmarks. We show that it is easy to port most existing applications to M2R by changing fewer than 43 lines of code. M2R adds fewer than 500 lines of code to the TCB, which is less than 0.16 % of the Hadoop codebase. M2R offers a factor of 1.3 × to 44.6 × lower overhead than extensions of previ-ous solutions with equivalent privacy. M2R adds a total of 17 % to 130 % overhead over the insecure baseline solu-tion that ignores the leakage channels M2R addresses. 1