  As cloud computing gains traction, data owners are outsourcing their data to
cloud service providers (CSPs) for Database Service (DBaaS), bringing in a
deviation of data ownership and usage, and intensifying privacy concerns,
especially with potential breaches by hackers or CSP insiders. To address that,
encrypted database services propose encrypting every tuple and query statement
before submitting to the CSP, ensuring data confidentiality when the CSP is
honest-but-curious, or even compromised. Existing solutions either employ
property preserving cryptography schemes, which can perform certain operations
over ciphertext without decrypting the data over the CSP, or utilize trusted
execution environment (TEE) to safeguard data and computations from the CSP.
Based on these efforts, we introduce Enc2DB, a novel secure database system,
following a hybrid strategy on PostgreSQL and openGauss. We present a
micro-benchmarking test and self-adaptive mode switch strategy that can
dynamically choose the best execution path (cryptography or TEE) to answer a
given query. Besides, we also design and implement a ciphertext index
compatible with native cost model and query optimizers to accelerate query
processing. Empirical study over TPC-C test justifies that Enc2DB outperforms
pure TEE and cryptography solutions, and our ciphertext index implementation
also outperforms the state-of-the-art cryptographic-based system.
