Abstract

Abstract. With scalability, fault tolerance, ease of programming, and flexibil-ity, MapReduce has gained many attractions for large-scale data processing. However, despite its merits, MapReduce does not focus on the problem of data privacy, especially when processing sensitive data, such as personal data, on untrusted infrastructure. In this paper, we investigate a scenario based on the Trusted Cells paradigm: a user stores his personal data in a local secure data store and wants to process this data using MapReduce on a third party infra-structure, on which secure devices are also connected. The main contribution of the paper is to present TrustedMR, a trusted MapReduce system with high secu-rity assurance provided by tamper-resistant hardware, to enforce the security aspect of the MapReduce. Thanks to TrustedMR, encrypted data can then be processed by untrusted computing nodes without any modification to the exist-ing MapReduce framework and code. Our evaluation shows that the perfor-mance overhead of TrustedMR is limited to few percents, compared to an origi-nal MapReduce framework that handles cleartexts.