Partially Encrypted Database

CREATE TABLE IF NOT EXISTS "tableName" (
    ... other fields

    -- Before: Unprotected sensitive fields
    sensitive_data VARCHAR(64)

    -- After: Protected Confidential fields
    -- 36 B header, 64 B ciphertext (padded, fixed size) and
    sensitive_data BINARY(100) ,
    -- OR if you use base64 encoding:
    sensitive_data CHAR(136) ,
);

// Used for supplying additional AAD values to the
// reencryption method.
struct MetaData {
    std::string tableName;
    /* more ... */
};

// Define a metadata field such that it can later be used in `TableSchema`. The
// name must also be the name of a member of the metadata type which you use in
// the `reencrypt` function.
METADATA_FIELD(tableName);
// ...

// Define the names of all the columns for later use in the `TableSchema`.
COLUMN(pk);
COLUMN(fk_users);
COLUMN(sensitive_data1);
// ...

// Entrypoint into the enclave. Invoked asynchronously by the `taskRun`
// action from the client libraries.
void run(TaskInputs const & inputs, TaskOutputs &) {
    // Note: In the code, argument parsing and permission signature verification
    // is moved into the respective Context object. This way the `run` function
    // stays leaner and contains only the interesting bits.

    // Parse the `TaskArgument` key-value pairs.
    auto const arguments = Arguments(inputs);

    // An object which wraps all the relevant information for the
    // reencryption operation. Actual class is e.g. ReportContext.
    auto ctx = SomeContext{arguments, ...};

    // Verify that the permissions match the recipient identity, and
    // extract the permissions such that you can verify them.
    // NB This is not necessary when the task was invoked by a
    // cron job.
    auto const permissions = verifyAndParsePermissions(
            ctx.outputKeyData.producer.upid /* or from input key */,
            arguments.permission_data,
            arguments.admin_signature_1,
            inputs.dataflowConfiguration().stakeholder("admin1").publicKey(),
            arguments.admin_signature_2,
            inputs.dataflowConfiguration().stakeholder("admin2").publicKey());

    if (arguments.route == "route1") {
        MetaData metaData{{"table1"}};
        // TODO you need to implement this.
        YourPermissionsCheckFunction("table1", permissions);

        // Define the table schema and used AADs of the incoming data.
        // Outgoing data uses the same structure and AADs.
        // Or you might need to define two table schemas.
        using TS = TableSchema<Public<36, pk>,
                               Public<36, fk_user>
                               /*
                               If the field 'pk' contains
                               "7638e763-861f-462f-bd62-9d18cd666f8c"
                               and the field 'fk_users' contains
                               "96ba3380-f3b9-4074-a21c-2c191dd4a4ff",
                               then the AAD of the field 'sensitive_data1' is:

                               "sensitive_data1;table1;7638e763-861f-462f-bd62-9d18cd666f8c;96ba3380-f3b9-4074-a21c-2c191dd4a4ff"
                               */
                               Private<40, sensitive_data1, AAD<tableName, AllPublicColumns>>,
                               >;

        // This call does all the heavy lifting: reading, fetching
        // decryption keys, decrypting, encrypting, writing.
        ctx.reencrypt<TS>(metaData);

    } else ... /* all your different routes */
}

# Only necessary when using the TypeScript Client Library on the server.
Server.RequireClientCertificate: "DO_NOT_REQUEST_OR_REQUIRE_OR_VERIFY"

// Whenever the `client` object wants to send a message to the Sharemind HI
// Server, it invokes the callback.
auto tunneledChannel = sharemind_hi::client::TunneledChannel{
        [&your_api](std::string const & method, std::string const & serializedRequestBLOB)
        -> std::string {
            // #7 KMI Forward the request through your API, and let your web
            // server do the communication with the Sharemind HI Server.
            return your_api.put("/HI/" + method, serializedRequestBLOB);
        };
};
auto attestationOptions = ...;
auto callbackHandler = ...;
auto sessionData = ...; // key, cert and more - creation explained in a later section.

// The `client` object which can live for the entire session of the user.
auto client = sharemind_hi::client::Client(attestationOptions,
                                           callbackHandler,
                                           sessionData,
                                           tunneledChannel);

# Two ways to create the client key:
# (1) Without passphrase.
openssl ecparam -name prime256v1 -genkey -noout -out client.key
# (2) With passphrase (PKCS#8).
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -aes-128-cbc -out client.key

openssl req -new -key client.key -out client.csr

// #5 #19 Use your favorite source of randomness, e.g. arc4random or SecRandomCopyBytes
std::array<uint8_t, 16> const writeKey = ...;
std::array<uint8_t, 16> const readKey = ...;

// #6
auto const writeKeyId = client.dataUpload(
    "write_keys",
    config.trustedEnforcers,
    {writeKey.data(), writeKey.size()}
);
// #20
auto const readKeyId = client.dataUpload(
    "read_keys",
    config.trustedEnforcers,
    {readKey.data(), readKey.size()}
);

// #16 Use your favorite source of randomness, e.g. arc4random or SecRandomCopyBytes
std::array<uint8_t, 12> const writeKeyIv = ...;

// #5 #15 Of the section 'End-User Short-Term Key Management'.
auto const & writeKey   = /* created during login. */;
auto const & writeKeyId = /* created during login. */;

auto const table1_row = Table1 {
    .pk = "...",                // 36 bytes, unencrypted
    .fk_users = "...",          // 36 bytes, unencrypted
    .sensitive_data1 = 0,       //  4 bytes, to be encrypted
};

// #5
// With JSON the binary data needs to be stringified, e.g. by using base64.
auto encrypted_field =
    encryptFieldB64(
        writeKey,
        writeKeyId,
        table1_row.sensitive_data1,
        // #4, same as will be used in the task enclave, #26.
        AADtoBytes({"sensitive_data1", "table1", pk, fk_users}));

Json rowJson;
rowJson["pk"] = table1_row.id;
rowJson["fk_users"] = table1_row.fk_users;
rowJson["sensitive_data1"] = encrypted_field;

// #6 #35
your_api.put("/table1/" + user_id + "/" + writeKeyId, rowJson);

// #19 #29 Of the section 'End-User Short-Term Key Management'.
auto const & readKey   = /* created during login. */;
auto const & readKeyId = /* created during login. */;

// #4 #33
// The re-encryption enclave needs to know which key to use for encryption.
// The ID of this key needs to be transmitted as part of your `get` API endpoint,
auto table1Json = your_api.get("/table1/" + user_id + "/" + readKeyId);

std::vector<Table1> result;
for (auto const & rowJson : table1Json) {
    auto & table1_row = result.emplace_back(Table1{
            .pk = rowJson["pk"],
            .fk_users = rowJson["fk_users"],
            .sensitive_data1 = {} /* decrypted below */,
    });

    // #35
    table1_row.sensitive_data1 = decryptFieldB64<decltype(table1_row.sensitive_data1)>(
            readKey,
            rowJson["sensitive_data1"].as_string(),
             // #34 Construct the same AAD as in the task enclave
             // during re-encryption #26.
            AADtoBytes({"sensitive_data1", "table1", table1_row.pk, table1_row.fk_users}));
}

// #19 #29 Of the section 'End-User Short-Term Key Management'.
auto const & readKey   = /* created during login. */;
auto const & readKeyId = /* created during login. */;

// Some argument for the report generation, provided by the user.
const std::string customInputParameter = "...";

// You can combine the processing call with the read query to have only a single
// roundtrip from the client side.
const auto & outputJson =
    // #3 Make the request
    your_api.put("/batch_processing/" + user_id + "/" + readKeyId + "/" + customInputParameter );

// #38 Verify the hash
if (outputJson["hash"] != hash(customInputParameter)) {
    throw std::runtime_error("Hash mismatch, the batch processing enclave did not use my inputs");
}

// #39 #40 Decrypt similarly to read query use case, omitted here.

printf '.. permissions string ..' > permissions_string
openssl dgst -sign admin_key.pem permissions_string > /tmp/signature.asn1
python3 ./convert_signature.py # script is shown below.

#!/usr/bin/env python3

input_filename = 'signature.asn1'
output_filename = 'signature.hi'

def read_binary_file(path):
    with open(path,'rb') as file:
        return file.read()

def write_binary_file(path, data):
    with open(path, 'wb') as file:
        file.write(data)

integer_size = 32
def integer_data_offset(integer_meta_offset, asn1):
    return integer_meta_offset + 2 + (asn1[integer_meta_offset + 1] & 1)

def signature_asn1_to_hi(asn1):
    integer1_offset = integer_data_offset(2, asn1)
    integer2_offset = integer_data_offset(integer1_offset + integer_size, asn1)
    integer1 = asn1[integer1_offset:][:integer_size]
    integer2 = asn1[integer2_offset:][:integer_size]
    # ASN.1 stores integers in big endian, but HI (the SGX SDK) wants the
    # numbers in little endian.
    return integer1[::-1] + integer2[::-1]

signature_asn1 = read_binary_file(input_filename)
signature_hi = signature_asn1_to_hi(signature_asn1)
write_binary_file(output_filename, signature_hi)

const session = new Session(config, {loggingCallback: console.log});

// For short-term key management.
const tunneled_client = new TunneledClient(grpcWebProxyAddress);

// This function invokes the keygen_enclave once every 24.8 days.
(async function addNewStorageKey() {
    await runKeygenEnclave(session);
    const maxDelay = 2147483647; // ca. 24.8 days
    setTimeout(addNewStorageKey, maxDelay);
})();

// Some example database row.
type Table1 = {
    pk: string;                         // size: 36 bytes, unencrypted.
    fk_users: string;                   // size: 36 bytes, unencrypted.
    sensitive_data1: Uint8Array;        // size: 40 bytes, encrypted.
}

function getTable1(session: HI.Session, request_info: ...) {
    // #5 #6 Your query against the DB to get the permission data.
    const permission_info = query_db_permissions(request_info);

    // #7 #8 Your query against the DB to get the requested rows
    const inTable1: Table1[] = query_db_table1(request_info);

    // Serialize the data into a binary, rectangular format.
    const bufs: Buffer[] = [];
    for (const row of inTable1) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.fk_users));
        bufs.push(Buffer.from(row.sensitive_data1));
    }

    // #9 Write the data to the disk.
    writeFileSync(input_file, Buffer.concat(bufs));

    // #11 Run and await the task.
    await session.taskRunSync(new mt.TaskRunRequest(
            new mt.ArbitraryName("read_enclave"),
            new mt.RequiredTrustedEnforcers([]),
            [
                new mt.TaskArgument("input_file", input_file),
                new mt.TaskArgument("output_file", output_file),
                new mt.TaskArgument("read_key_id", request_info.read_key_id),
                new mt.TaskArgument("route", "route1"),
                new mt.TaskArgument("permission_data", permission_info[0]),
                new mt.TaskArgument("admin_signature_1", permission_info[1]),
                new mt.TaskArgument("admin_signature_2", permission_info[2])
            ]));

    // #31 #32 Read back the re-encrypted rows
    const bytes = readFileSync(output_file);

    // Transform bytes back into js objects/json
    const outTable1: Table1[] = [];
    for (let i = 0; i < bytes.length; i += TABLE1_TOTAL_BYTELENGTH) {
        outTable1.push({
            pk:                 bytes.toString('utf8', i +  0, i +  36),
            fk_users:           bytes.toString('utf8', i + 36, i +  72),
            sensitive_data1:    bytes.subarray(        i + 72, i + 112)
        });
    }

    // Done
    return outTable1;
}

// Some example database row.
type Input = {
    pk: string;                 // size: 36 bytes, unencrypted.
    sensitive_data: Uint8Array; // size: 40 bytes, encrypted.
    // ...
}

type Output = {
    hash: string                // size: 32 bytes, unencrypted
    // ...
}

function batchProcess(session: HI.Session, request_info: ...) {
    // #4 #5 Your query against the DB to get the permission data.
    const permission_info = query_db_permissions(request_info);

    // #6 #7 Your query against the DB to get the requested rows
    const table: Input[] = query_db_table1(request_info);

    // Serialize the data into a binary, rectangular format.
    const bufs: Buffer[] = [];
    for (const row of table) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.sensitive_data));
        // ...
    }

    // #8 #9 Write the data to the disk.
    writeFileSync(input_file, Buffer.concat(bufs));

    // #10 Run and await the task.
    await session.taskRunSync(new mt.TaskRunRequest(
            new mt.ArbitraryName("batch_processing_enclave"),
            new mt.RequiredTrustedEnforcers([]),
            [
                new mt.TaskArgument("input_file", input_file),
                new mt.TaskArgument("output_file", output_file),
                new mt.TaskArgument("permission_data", permission_info[0]),
                new mt.TaskArgument("admin_signature_1", permission_info[1]),
                new mt.TaskArgument("admin_signature_2", permission_info[2]),
                new mt.TaskArgument("customInputParameter", request_info.customInputParameter)
            ]));

    // #35 #36 Read back the re-encrypted rows
    const bytes = readFileSync(output_file);

    // Transform bytes back into js objects/json
    const outputs: Output[] = [];
    for (let i = 0; i < bytes.length; i += OUTPUT_TOTAL_BYTELENGTH) {
        outputs.push({
            // ... as for other use cases.
        });
    }

    // Done
    return outputs;
}

// #1 This line was already shown earlier.
const tunneled_client = new TunneledClient(grpcWebProxyAddress);

// #8
const bytesParser = bodyParser.raw({ type: 'application/octet-stream' });
router.post("/HI/:method", bytesParser, async (req: Request, res: Response) => {
    const methodName: string = req.params.method;
    const serializedRequest = Uint8Array.from(req.body);

    let tunneled_result: Uint8Array;
    try {
        // #9 The request can be directly forwarded to HI without further inspection.
        tunneled_result = await tunneled_client.dispatch(methodName, serializedRequest);
    } catch (e) {
        res.status(500).send("HI Error:" + e);
        return;
    }

    // #13
    res.status(200).send(Buffer.from(tunneled_result.buffer));
});

CREATE TABLE IF NOT EXISTS table3
(
    pk UUID PRIMARY KEY,
    sensitive_data4 CHAR(56) NOT NULL
);

// Table 2
// ...

// Table 3
COLUMN(sensitive_data4);

// ...

    }  else if (ctx.args.route == "route3") {
        MetaData metaData{{"table3"}};
        using TS = TableSchema<
                Public<UUID_SIZE, pk>,
                Private<4 + EH_SIZE, sensitive_data4, AAD<tableName, AllPublicColumns>>
                >;
        ctx.reencrypt<TS>(metaData);
    }

// Some example database row.
type Table3 = {
    pk: string;                         // size: 36 bytes, unencrypted.
    sensitive_data4: Uint8Array;        // size: 40 bytes, encrypted.
}

function getTable3(session: HI.Session, request_info: ...) {
    const permission_info = query_db_permissions(request_info);

    // Query the new table from your DB
    const inTable3: Table3[] = query_db_table3(request_info);

    // Serialize as with other tables
    const bufs: Buffer[] = [];
    for (const row of inTable3) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.sensitive_data4));
    }

    // Only the route changes in the task arguments
    writeFileSync(input_file, Buffer.concat(bufs));
    await session.taskRunSync(new mt.TaskRunRequest(
            new mt.ArbitraryName("read_enclave"),
            new mt.RequiredTrustedEnforcers([]),
            [
                new mt.TaskArgument("input_file", input_file),
                new mt.TaskArgument("output_file", output_file),
                new mt.TaskArgument("read_key_id", request_info.read_key_id),
                new mt.TaskArgument("route", "route3"),
                new mt.TaskArgument("permission_data", permission_info[0]),
                new mt.TaskArgument("admin_signature_1", permission_info[1]),
                new mt.TaskArgument("admin_signature_2", permission_info[2])
            ]));
    const bytes = readFileSync(output_file);

    // Deserialize as for other tables
    const outTable3: Table3[] = [];
    for (let i = 0; i < bytes.length; i += TABLE3_TOTAL_BYTELENGTH) {
        outTable3.push({
            pk:                 bytes.toString('utf8', i +  0, i + 36),
            sensitive_data4:    bytes.subarray(        i + 36, i + 76)
        });
    }

    // Done
    return outTable3;
}

auto const row = Table3 {
    .pk = "...",                // 36 bytes, unencrypted
    .sensitive_data4 = 0,       //  4 bytes, to be encrypted
};

auto const encrypted_field = encryptFieldB64(
    writeKey,
    writeKeyId,
    row.sensitive_data4,
    AADtoBytes({"sensitive_data4", "table3", pk})
);

Json rowJson;
rowJson["pk"] = row.id;
rowJson["sensitive_data4"] = encrypted_field;

your_api.put("/table3/" + user_id + "/" + writeKeyId, rowJson);

auto table3Json = your_api.get("/table3/" + user_id + "/" + readKeyId);

std::vector<Table3> result;
for (auto const & rowJson : table3Json) {
    auto & row = result.emplace_back(Table3{
            .pk = rowJson["pk"],
            .sensitive_data4 = {},
    });

    row.sensitive_data4 = decryptFieldB64<decltype(row.sensitive_data4)>(
            readKey,
            rowJson["sensitive_data4"].as_string(),
            AADtoBytes({"sensitive_data4", "table3", row.pk}));
}

CREATE TABLE IF NOT EXISTS table1
(
    pk UUID PRIMARY KEY,
    fk_users UUID NOT NULL,
    fk_table3 UUID NOT NULL,
    sensitive_data1 CHAR(56) NOT NULL,
    CONSTRAINT table1_fkey_users FOREIGN KEY (fk_users)
        REFERENCES users (pk) MATCH SIMPLE
        ON UPDATE NO ACTION
        ON DELETE NO ACTION,
    CONSTRAINT table1_fkey_table3 FOREIGN KEY (fk_table3)
        REFERENCES table3 (pk) MATCH SIMPLE
        ON UPDATE NO ACTION
        ON DELETE NO ACTION
);

MetaData metaData{{"table1"}};
using TS = TableSchema<
        Public<UUID_SIZE, pk>,
        Public<UUID_SIZE, fk_users>,
        Public<UUID_SIZE, fk_table3>,
        Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>
        >;

ctx.reencrypt<TS>(metaData);

// ...
// Table1
COLUMN(pk);
COLUMN(fk_users);
COLUMN(fk_table3);
COLUMN(sensitive_data1);
// ...

type Table1 = {
    pk: string;                         // size: 36 bytes, unencrypted.
    fk_users: string;                   // size: 36 bytes, unencrypted.
    fk_table3: string;                  // size: 36 bytes, unencrypted.
    sensitive_data1: Uint8Array;        // size: 40 bytes, encrypted.
}

function getTable1(session: HI.Session, request_info: ...) {
    // ...

    // Serialize the data into a binary, rectangular format.
    const bufs: Buffer[] = [];
    for (const row of inTable1) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.fk_users));
        bufs.push(Buffer.from(row.fk_table3));
        bufs.push(Buffer.from(row.sensitive_data1));
    }

    // ...
    // ...

    // Transform bytes back into js objects/json
    const outTable1: Table1[] = [];
    for (let i = 0; i < bytes.length; i += TABLE1_TOTAL_BYTELENGTH) {
        outTable1.push({
            pk:                 bytes.toString('utf8', i +   0, i +  36),
            fk_users:           bytes.toString('utf8', i +  36, i +  72),
            fk_table3:          bytes.toString('utf8', i +  72, i + 108),
            sensitive_data1:    bytes.subarray(        i + 108, i + 148)
        });
    }

    // Done
    return outTable1;
}

auto const table1_row = Table1 {
    .pk = "...",                // 36 bytes, unencrypted
    .fk_users = "...",          // 36 bytes, unencrypted
    .fk_table3 = "...",         // 36 bytes, unencrypted
    .sensitive_data1 = 0,       //  4 bytes, to be encrypted
};

auto encrypted_field =
    encryptFieldB64(
        writeKey,
        writeKeyId,
        table1_row.sensitive_data1,
        AADtoBytes({"sensitive_data1", "table1", pk, fk_users, fk_table3}));

Json rowJson;
rowJson["pk"] = table1_row.id;
rowJson["fk_users"] = table1_row.fk_users;
rowJson["fk_table3"] = table1_row.fk_table3;
rowJson["sensitive_data1"] = encrypted_field;

// ...

// ...

for (auto const & rowJson : table1Json) {
    auto & table1_row = result.emplace_back(Table1{
            .pk = rowJson["pk"],
            .fk_users = rowJson["fk_users"],
            .fk_users = rowJson["fk_table3"],
            .sensitive_data1 = {},
    });

    table1_row.sensitive_data1 = decryptFieldB64<decltype(table1_row.sensitive_data1)>(
            readKey,
            rowJson["sensitive_data1"].as_string(),
            AADtoBytes({"sensitive_data1", "table1", table1_row.pk, table1_row.fk_users, table1_row.fk_table3}));
}

CREATE TABLE IF NOT EXISTS table1
(
    pk UUID PRIMARY KEY,
    fk_users UUID NOT NULL,
    fk_table3 UUID NOT NULL,
    sensitive_data1 CHAR(56) NOT NULL,
    sensitive_data5 CHAR(56) NOT NULL,
    CONSTRAINT table1_fkey_users FOREIGN KEY (fk_users)
        REFERENCES users (pk) MATCH SIMPLE
        ON UPDATE NO ACTION
        ON DELETE NO ACTION,
    CONSTRAINT table1_fkey_table3 FOREIGN KEY (fk_table3)
        REFERENCES table3 (pk) MATCH SIMPLE
        ON UPDATE NO ACTION
        ON DELETE NO ACTION
);

// Table1
COLUMN(pk);
COLUMN(fk_users);
COLUMN(fk_table3);
COLUMN(sensitive_data1);
COLUMN(sensitive_data5);

MetaData metaData{{"table1"}};
using TS = TableSchema<
        Public<UUID_SIZE, pk>,
        Public<UUID_SIZE, fk_users>,
        Public<UUID_SIZE, fk_table3>,
        Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>,
        Private<4 + EH_SIZE, sensitive_data5, AAD<tableName, pk, fk_table3>>
        >;

type Table1 = {
    pk: string;                         // size: 36 bytes, unencrypted.
    fk_users: string;                   // size: 36 bytes, unencrypted.
    fk_table3: string;                  // size: 36 bytes, unencrypted.
    sensitive_data1: Uint8Array;        // size: 40 bytes, encrypted.
    sensitive_data5: Uint8Array;        // size: 40 bytes, encrypted.
}

function getTable1(session: HI.Session, request_info: ...) {
    // ...
    // Serialize the data into a binary, rectangular format.
    const bufs: Buffer[] = [];
    for (const row of inTable1) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.fk_users));
        bufs.push(Buffer.from(row.fk_table3));
        bufs.push(Buffer.from(row.sensitive_data1));
        bufs.push(Buffer.from(row.sensitive_data5));
    }
    // ...
    // ...
    // Transform bytes back into js objects/json
    const outTable1: Table1[] = [];
    for (let i = 0; i < bytes.length; i += TABLE1_TOTAL_BYTELENGTH) {
        outTable1.push({
            pk:                 bytes.toString('utf8', i +   0, i +  36),
            fk_users:           bytes.toString('utf8', i +  36, i +  72),
            fk_table3:          bytes.toString('utf8', i +  72, i + 108),
            sensitive_data1:    bytes.subarray(        i + 108, i + 148),
            sensitive_data5:    bytes.subarray(        i + 148, i + 188)
        });
    }
    return outTable1;
}

auto const table1_row = Table1 {
    .pk = "...",                // 36 bytes, unencrypted
    .fk_users = "...",          // 36 bytes, unencrypted
    .fk_table3 = "...",         // 36 bytes, unencrypted
    .sensitive_data1 = 0,       //  4 bytes, to be encrypted
    .sensitive_data5 = 0,       //  4 bytes, to be encrypted
};

auto encrypted_field1 =
    encryptFieldB64(
        writeKey,
        writeKeyId,
        table1_row.sensitive_data1,
        AADtoBytes({"sensitive_data1", "table1", pk, fk_users, fk_table3}));
auto encrypted_field5 =
    encryptFieldB64(
        writeKey,
        writeKeyId,
        table1_row.sensitive_data5,
        AADtoBytes({"sensitive_data5", "table1", pk, fk_table3}));

Json rowJson;
rowJson["pk"] = table1_row.id;
rowJson["fk_users"] = table1_row.fk_users;
rowJson["fk_table3"] = table1_row.fk_table3;
rowJson["sensitive_data1"] = encrypted_field1;
rowJson["sensitive_data5"] = encrypted_field5;

// ...

// ...

for (auto const & rowJson : table1Json) {
    auto & table1_row = result.emplace_back(Table1{
            .pk = rowJson["pk"],
            .fk_users = rowJson["fk_users"],
            .fk_users = rowJson["fk_table3"],
            .sensitive_data1 = {},
            .sensitive_data5 = {},
    });
    // ...
    table1_row.sensitive_data1 = decryptFieldB64<decltype(table1_row.sensitive_data1)>(
            readKey,
            rowJson["sensitive_data1"].as_string(),
            AADtoBytes({"sensitive_data1", "table1", table1_row.pk, table1_row.fk_users, table1_row.fk_table3}));
    table1_row.sensitive_data5 = decryptFieldB64<decltype(table1_row.sensitive_data5)>(
            readKey,
            rowJson["sensitive_data5"].as_string(),
            AADtoBytes({"sensitive_data5", "table1", table1_row.pk, table1_row.fk_table3}));
}

CREATE TABLE IF NOT EXISTS table2
(
    pk UUID PRIMARY KEY,
    fk_table1 UUID NOT NULL,
    regular_data CHAR(100) NOT NULL,
-   sensitive_data2 CHAR(136) NOT NULL,
    sensitive_data3 CHAR(56) NOT NULL,
    CONSTRAINT table2_fkey_table1 FOREIGN KEY (fk_table1)
        REFERENCES table1 (pk) MATCH SIMPLE
        ON UPDATE NO ACTION
        ON DELETE NO ACTION
);

    // Table2
    //COLUMN(pk);
    COLUMN(fk_table1);
    COLUMN(regular_data1);
-   COLUMN(sensitive_data2);
    COLUMN(sensitive_data3);

MetaData metaData{{"table2"}};
using TS = TableSchema<
        Public<UUID_SIZE, pk>,
        Public<UUID_SIZE, fk_table1>,
        Public<100, regular_data1>,
-       Private<64 + EH_SIZE, sensitive_data2, AAD<tableName, AllPublicColumns>>,
        Private<4 + EH_SIZE, sensitive_data3, AAD<tableName, pk, regular_data1>>
        >;

type Table2 = {
    pk: string;                         // size: 36 bytes, unencrypted.
    fk_table1: string;                  // size: 36 bytes, unencrypted.
    regular_data1: string;              // size: 100 bytes, unencrypted.
-   sensitive_data2: Uint8Array;        // size: 64 bytes, encrypted.
    sensitive_data3: Uint8Array;        // size: 44 bytes, encrypted.
}

function getTable2(session: HI.Session, request_info: ...) {
    // ...
    // Serialize the data into a binary, rectangular format.
    const bufs: Buffer[] = [];
    for (const row of inTable2) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.fk_table1));
        bufs.push(Buffer.from(row.regular_data1));
-       bufs.push(Buffer.from(row.sensitive_data2));
        bufs.push(Buffer.from(row.sensitive_data3));
    }
    // ...
    // ...
    // Transform bytes back into js objects/json
    const outTable2: Table2[] = [];
    for (let i = 0; i < bytes.length; i += TABLE2_TOTAL_BYTELENGTH) {
        outTable2.push({
            pk:                 bytes.toString('utf8', i +   0, i +  36),
            fk_table1:          bytes.toString('utf8', i +  36, i +  72),
            regular_data1:      bytes.toString('utf8', i +  72, i + 172),
-           sensitive_data2:    bytes.subarray(        i + 172, i + 263),
-           sensitive_data3:    bytes.subarray(        i + 263, i + 280)
+           sensitive_data3:    bytes.subarray(        i + 172, i + 216)
        });
    }
    return outTable2;
}

auto const table2_row = Table2 {
    .pk = "...",                //  36 bytes, unencrypted
    .fk_table1 = "...",         //  36 bytes, unencrypted
    .regular_data1 = "...";     // 100 bytes, unencrypted.
-   .sensitive_data2 = "",      //  64 bytes, to be encrypted
    .sensitive_data3 = 0,       //   4 bytes, to be encrypted
};

-auto encrypted_field2 = encryptFieldB64(
-       writeKey,
-       writeKeyId,
-       table2_row.sensitive_data2,
-       table2_row.sensitive_data2_size,
-       AADtoBytes({"sensitive_data2", "table2", table2_row.pk, table2_row.fk_table1, table2_row.regular_data1}));
auto encrypted_field3 = encryptFieldB64(
        writeKey,
        writeKeyId,
        table2_row.sensitive_data3,
        AADtoBytes({"sensitive_data3", "table2", table2_row.pk, table2_row.regular_data1}));

Json rowJson;
rowJson["pk"] = table2_row.id;
rowJson["fk_table1"] = table2_row.fk_table1;
rowJson["regular_data1"] = table2_row.regular_data1;
-rowJson["sensitive_data2"] = encrypted_field2;
rowJson["sensitive_data3"] = encrypted_field3;

// ...
for (auto const & rowJson : table2Json) {
    auto & table2_row = result.emplace_back(Table2{
         .pk = rowJson["pk"],
         .fk_users = rowJson["fk_table1"],
         .fk_users = rowJson["regular_data1"],
-        .sensitive_data2 = {},
         .sensitive_data3 = {},
    });
    // ...
-    table2_row.sensitive_data2 = decryptFieldB64<decltype(table2_row.sensitive_data2)>(
-        readKey,
-        table2JSON["sensitive_data2"].as_string(),
-        AADtoBytes({"sensitive_data2", "table2", table2_row.pk, table2_row.fk_table1, table2_row.regular_data1}));

    table2_row.sensitive_data3 = decryptFieldB64<decltype(table2_row.sensitive_data3)>(
        readKey,
        table2JSON["sensitive_data3"].as_string(),
        AADtoBytes({"sensitive_data3", "table2", table2_row.pk, table2_row.regular_data1}));
}

CREATE TABLE IF NOT EXISTS table2
(
    pk UUID PRIMARY KEY,
    fk_table1 UUID NOT NULL,
-   regular_data CHAR(100) NOT NULL,
    sensitive_data3 CHAR(56) NOT NULL,
    CONSTRAINT table2_fkey_table1 FOREIGN KEY (fk_table1)
        REFERENCES table1 (pk) MATCH SIMPLE
        ON UPDATE NO ACTION
        ON DELETE NO ACTION
);

    // Table2
    //COLUMN(pk);
    COLUMN(fk_table1);
-   COLUMN(regular_data1);
    COLUMN(sensitive_data3);

MetaData metaData{{"table2"}};
using TS = TableSchema<
        Public<UUID_SIZE, pk>,
        Public<UUID_SIZE, fk_table1>,
-       Public<100, regular_data1>,
-       Private<4 + EH_SIZE, sensitive_data3, AAD<tableName, pk, regular_data1>>
+       Private<4 + EH_SIZE, sensitive_data3, AAD<tableName, pk>>
        >;

type Table2 = {
    pk: string;                         // size: 36 bytes, unencrypted.
    fk_table1: string;                  // size: 36 bytes, unencrypted.
-   regular_data1: string;              // size: 100 bytes, unencrypted.
    sensitive_data3: Uint8Array;        // size: 44 bytes, encrypted.
}

function getTable2(session: HI.Session, request_info: ...) {
    // ...
    // Serialize the data into a binary, rectangular format.
    const bufs: Buffer[] = [];
    for (const row of inTable2) {
        bufs.push(Buffer.from(row.pk));
        bufs.push(Buffer.from(row.fk_table1));
-       bufs.push(Buffer.from(row.regular_data1));
        bufs.push(Buffer.from(row.sensitive_data3));
    }
    // ...
    // ...
    // Transform bytes back into js objects/json
    const outTable2: Table2[] = [];
    for (let i = 0; i < bytes.length; i += TABLE2_TOTAL_BYTELENGTH) {
        outTable2.push({
            pk:                 bytes.toString('utf8', i +   0, i +  36),
            fk_table1:          bytes.toString('utf8', i +  36, i +  72),
-           regular_data1:      bytes.toString('utf8', i +  72, i + 172),
-           sensitive_data3:    bytes.subarray(        i + 172, i + 216)
+           sensitive_data3:    bytes.subarray(        i + 72, i + 116)
        });
    }
    return outTable2;
}

auto const table2_row = Table2 {
    .pk = "...",                //  36 bytes, unencrypted
    .fk_table1 = "...",         //  36 bytes, unencrypted
-    .regular_data1 = "...";     // 100 bytes, unencrypted.
    .sensitive_data3 = 0,       //   4 bytes, to be encrypted
};

auto encrypted_field3 = encryptFieldB64(
        writeKey,
        writeKeyId,
        table2_row.sensitive_data3,
-       AADtoBytes({"sensitive_data3", "table2", table2_row.pk, table2_row.regular_data1}));
+       AADtoBytes({"sensitive_data3", "table2", table2_row.pk}));


Json rowJson;
rowJson["pk"] = table2_row.id;
rowJson["fk_table1"] = table2_row.fk_table1;
-rowJson["regular_data1"] = table2_row.regular_data1;
rowJson["sensitive_data3"] = encrypted_field3;

for (auto const & rowJson : table2Json) {
    auto & table2_row = result.emplace_back(Table2{
         .pk = rowJson["pk"],
         .fk_users = rowJson["fk_table1"],
         .sensitive_data3 = {},
    });
    // ...
    table2_row.sensitive_data3 = decryptFieldB64<decltype(table2_row.sensitive_data3)>(
        readKey,
        table2JSON["sensitive_data3"].as_string(),
-       AADtoBytes({"sensitive_data3", "table2", table2_row.pk, table2_row.regular_data1}));
+       AADtoBytes({"sensitive_data3", "table2", table2_row.pk}));
}

        HI_ARG(std::string, input_file);
        HI_ARG(std::string, output_file);
        HI_ARG(std::uint64_t, output_key_id);
+       HI_ARG(std::string, route);
        HI_ARG(std::string, permission_data);
        HI_ARG(std::string, admin_signature_1);
        HI_ARG(std::string, admin_signature_2);

        // Example additional user defined argument to modify the output of the report.
        HI_ARG(std::int64_t, customInputParameter);

void run(TaskInputs const & inputs, TaskOutputs &) {

    // ...

    // #16
    TODO_doSomethingWithPermissions(ctx.permissions);
+   if (ctx.args.route == "route1") {
        /* #17 #18 Set-up table schema */
        MetaData inputTableName{{"table1"}};

        // ...
        // Existing processing code is here
        // ...

        ctx.buildOutput<TS_OUT>(outputTableName, outputFn, aggregation_map);
+   }
}

// ...
if (ctx.args.route == "route1") {
    // ...
} else if (ctx.args.route == "route2") {
    // Define input and output tables
    MetaData inputTableName{{"table3"}};
    using TS_IN = TableSchema<
            Public<UUID_SIZE, pk>,
            Private<4 + EH_SIZE, sensitive_data4, AAD<tableName, pk>>>;
    using Row_IN = TS_IN::DecryptedRow;

    MetaData outputTableName{{"processing_results"}};
    using TS_OUT =
            TableSchema<Private<4 + EH_SIZE, result, AAD<tableName>>>;
    using Row_OUT = TS_OUT::DecryptedRow;

    // Define intermediate result structures
    using MAP = std::map<uint8_t, int32_t>;
    using MAP_VALUES = const std::pair<std::remove_const_t<MAP::value_type::first_type>,
                                       std::remove_const_t<MAP::value_type::second_type>>;
    MAP result_as_map{};
    result_as_map[0] = 0;

    // This function reads the input table and performs the processing
    auto processingFn = [&](Row_IN const & row) {
        result_as_map[0] += bit_cast<int32_t>(row.sensitive_data4);
    };
    // This function transforms the intermediate structure to match the output schema
    auto outputFn = [&](MAP_VALUES & row) {
        Row_OUT rowOUT = {};
        // We disregard the key as we only need the value in this use case.
        rowOUT.result = bit_cast<decltype(rowOUT.result)>(row.second);
        return rowOUT;
    };

    // Start the processing
    ctx.process<TS_IN>(inputTableName, processingFn);
    ctx.buildOutput<TS_OUT>(outputTableName, outputFn, result_as_map);
}

type ProcessingResult1 = {
    hash: string;                 // size: 32 bytes, unencrypted
    fk_users: string              // size: 36 bytes, unencrypted
    result: string                // size: 40 bytes, encrypted
}
type ProcessingResult2 = {
    result: string                // size: 40 bytes, encrypted
}

function batchProcess(session: HI.Session, request_info: ...) {
    const permission_info = query_db_permissions(request_info);

    const bufs: Buffer[] = [];
    if (request_info.route == "route1") {
        const table: Table1[] = query_db_table1(request_info);
        for (const row of table) {
            bufs.push(Buffer.from(row.pk));
            // ... as for other use cases.
        }
    } else if (request_info.route == "route2") {
        const table: Table3[] = query_db_table3(request_info);
        for (const row of table) {
            bufs.push(Buffer.from(row.pk));
            // ... as for other use cases.
        }
    } else {
        console log("Unknown route!");
        return;
    }

    writeFileSync(input_file, Buffer.concat(bufs));
    await session.taskRunSync(new mt.TaskRunRequest(
            new mt.ArbitraryName("batch_processing_enclave"),
            new mt.RequiredTrustedEnforcers([]),
            [
                new mt.TaskArgument("input_file", input_file),
                new mt.TaskArgument("output_file", output_file),
                new mt.TaskArgument("permission_data", permission_info[0]),
                new mt.TaskArgument("admin_signature_1", permission_info[1]),
                new mt.TaskArgument("admin_signature_2", permission_info[2]),
                new mt.TaskArgument("customInputParameter", request_info.customInputParameter),
                new mt.TaskArgument("route", request_info.route)
            ]));
    const bytes = readFileSync(output_file);

    if (request_info.route == "route1") {
        const outputs: ProcessingResult1[] = [];
        for (let i = 0; i < bytes.length; i += RESULT1_TOTAL_BYTELENGTH) {
            outputs.push({
                // ... as for other use cases.
            });
        }
        return outputs;
    } else if (request_info.route == "route2") {
        const outputs: ProcessingResult2[] = [];
        for (let i = 0; i < bytes.length; i += RESULT2_TOTAL_BYTELENGTH) {
            outputs.push({
                // ... as for other use cases.
            });
        }
        return outputs;
    }
}

const auto & outputJson = your_api.put("/batch_processing2/" + user_id + "/" + readKeyId);

ProcessingResult2 output{ .result = {} };

output.result = decryptFieldB64<decltype(outputJson.result)>(
        readKey,
        outputJson["result"].as_string(),
        AADtoBytes({"result", "processing_results"}));

}  else if (ctx.args.route == "table3_inplace") {
    MetaData metaData{{"table3"}};
    using TS = TableSchema<
            Public<UUID_SIZE, pk>,
            Private<4 + EH_SIZE, sensitive_data4, AAD<tableName, AllPublicColumns>>
            >;
    ctx.reencrypt<TS>(metaData);
}

function reencTable3(session: HI.Session, request_info: ...) {
    // Query the table from your DB
    const inTable3: Table3[] = query_db_table3(request_info);

    // Serialize as with other tables
    const bufs: Buffer[] = [];
    for (const row of inTable3) { ... }

    writeFileSync(input_file, Buffer.concat(bufs));
    await session.taskRunSync(new mt.TaskRunRequest(
            new mt.ArbitraryName("reencryption_enclave"),
            new mt.RequiredTrustedEnforcers([]),
            [
                new mt.TaskArgument("input_file", input_file),
                new mt.TaskArgument("output_file", output_file),
                new mt.TaskArgument("route", "route3")
            ]));
    const bytes = readFileSync(output_file);

    // Deserialize as for other tables and insert it back to the DB
    // ...
}

} else if (ctx.args.route == "table1_add_regular") {
    MetaData metaData{{"table1"}};
    // If the default value for the new column can be set to a fixed value,
    // it can be hardcoded in the conversion function
    using TS_IN = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>
            >;
    using TS_OUT = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>
            >;
    auto conversionFn = [&](TS_IN::DecryptedRow & rowIN) {
        TS_OUT::DecryptedRow rowOUT = {};
        rowOUT.pk = rowIN.pk;
        rowOUT.fk_users = rowIN.fk_users;
        rowOUT.sensitive_data1 = rowIN.sensitive_data1;
        rowOUT.fk_table3 = "SOME_CONSTANT_FIXED_VALUE           ";
        return rowOUT;
    };
    ctx.reencrypt<TS_IN, TS_OUT>(metaData);
}

} else if (ctx.args.route == "table1_add_regular") {
    MetaData metaData{{"table1"}};
    // If the default value for the new column can be provided externally,
    // then the input table should already contain the new regular column
    // with the correct new value, but it should not be a part of the AAD
    using TS_IN = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, pk, fk_users>>
            >;
    using TS_OUT = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>
            >;
    auto conversionFn = [&](TS_IN::DecryptedRow & rowIN) {
        // As the plaintext of the schemas are identical we can simply copy the fields
        TS_OUT::DecryptedRow rowOUT = {};
        rowOUT.pk = rowIN.pk;
        rowOUT.fk_users = rowIN.fk_users;
        rowOUT.sensitive_data1 = rowIN.sensitive_data1;
        rowOUT.fk_table3 = rowIN.fk_table3;
        return rowOUT;
    };
    ctx.reencrypt<TS_IN, TS_OUT>(metaData);
}

function addRegularToTable1(session: HI.Session, request_info: ...) {
    // Query the table with the old schema from DB
    const table1: Table1[] = query_db_table1(request_info);

    // Optionally insert the new column with some row based public values
    const inTable1 = addColumn(table1);

    // Serialize as with other tables
    const bufs: Buffer[] = [];
    for (const row of inTable1) { ... }

    writeFileSync(input_file, Buffer.concat(bufs));
    await session.taskRunSync(new mt.TaskRunRequest(
            new mt.ArbitraryName("reencryption_enclave"),
            new mt.RequiredTrustedEnforcers([]),
            [
                new mt.TaskArgument("input_file", input_file),
                new mt.TaskArgument("output_file", output_file),
                new mt.TaskArgument("route", "table1_add_regular")
            ]));
    const bytes = readFileSync(output_file);

    // Deserialize as for other tables and insert it back to the DB with the new schema
    // ...
}

else if (ctx.args.route == "table2_remove_regular") {
    MetaData metaData{{"table2"}};
    using TS_IN = TableSchema<
        Public<UUID_SIZE, pk>,
        Public<UUID_SIZE, fk_table1>,
        Public<UUID_SIZE, regular_data1>,
        Private<4 + EH_SIZE, sensitive_data3, AAD<tableName, pk, regular_data1>>>;
    using TS_OUT = TableSchema<
        Public<UUID_SIZE, pk>,
        Public<UUID_SIZE, fk_table1>,
        Private<4 + EH_SIZE, sensitive_data3, AAD<tableName, pk>>>;
    auto conversionFn = [&](TS_IN::DecryptedRow &rowIN) {
        // Exisiting columns can be copied
        TS_OUT::DecryptedRow rowOUT = {};
        rowOUT.pk = rowIN.pk;
        rowOUT.fk_table1 = rowIN.fk_table1;
        rowOUT.sensitive_data3 = rowIN.sensitive_data3;
        // The removed column is ignored
        return rowOUT;
    };
    ctx.reencrypt<TS_IN, TS_OUT>(metaData, conversionFn);
}

} else if (ctx.args.route == "table1_add_sensitive") {
    MetaData metaData{{"table1"}};
    // Sensitive columns can not be provided externally,
    // so they have to be set to some constant default
    using TS_IN = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>
            >;
    using TS_OUT = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>,
            Private<10 + EH_SIZE, sensitive_data5, AAD<tableName, pk, fk_table3>>
            >;

    auto conversionFn = [&](TS_IN::DecryptedRow & rowIN) {
        // Existing columns can be copied
        TS_OUT::DecryptedRow rowOUT = {};
        rowOUT.pk = rowIN.pk;
        rowOUT.fk_users = rowIN.fk_users;
        rowOUT.sensitive_data1 = rowIN.sensitive_data1;
        rowOUT.fk_table3 = rowIN.fk_table3;
        // The added column is set to some default value
        rowOUT.sensitive_data5 = bit_cast<decltype(rowOUT.sensitive_data5)>("NULL      ");
        return rowOUT;
    };
    ctx.reencrypt<TS_IN, TS_OUT>(metaData);
}

} else if (ctx.args.route == "table1_add_sensitive") {
    MetaData metaData{{"table1"}};
    using TS_IN = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Public<10, temporary>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, pk, fk_users, fk_table3>>
            >;
    using TS_OUT = TableSchema<
            Public<UUID_SIZE, pk>,
            Public<UUID_SIZE, fk_users>,
            Public<UUID_SIZE, fk_table3>,
            Private<4 + EH_SIZE, sensitive_data1, AAD<tableName, AllPublicColumns>>,
            Private<10 + EH_SIZE, sensitive_data5, AAD<tableName, pk, fk_table3>>
            >;

    auto conversionFn = [&](TS_IN::DecryptedRow & rowIN) {
        // Existing columns can be copied
        TS_OUT::DecryptedRow rowOUT = {};
        rowOUT.pk = rowIN.pk;
        rowOUT.fk_users = rowIN.fk_users;
        rowOUT.sensitive_data1 = rowIN.sensitive_data1;
        rowOUT.fk_table3 = rowIN.fk_table3;
        // The added column is taken from the temporary column
        rowOUT.sensitive_data5 = bit_cast<decltype(rowOUT.sensitive_data5)>(rowIN.temporary);
        return rowOUT;
    };
    ctx.reencrypt<TS_IN, TS_OUT>(metaData);
}