Privacy Preserving Subgraph Matching on Large Graphs in Cloud

Transcription

1 Privacy Preserving Subgraph Matching on Large Graphs in Coud Zhao Chang,#, Lei Zou, Feifei Li # Peing University, China; # University of Utah, USA; {changzhao,zouei}@pu.edu.cn; {zchang,ifeifei}@cs.utah.edu ABSTRACT The wide presence of arge graph data and the increasing popuarity of storing data in the coud drive the needs for graph query processing on a remote coud. But a fundamenta chaenge is to process user queries without compromising sensitive information. This wor focuses on privacy preserving subgraph matching in a coud server. The goa is to minimize the overhead on both coud and cient sides for subgraph matching, without compromising users sensitive information. To that end, we transform an origina graph G into a privacy preserving graph G, which meets the requirement of an existing privacy mode nown as -automorphism. By maing use of the symmetry in a -automorphic graph, a subgraph matching query can be efficienty answered using a graph G o,asma subset of G. This approach saves both space and query cost in the coud server. We aso anonymize the query graphs to protect their abe information using abe generaization technique. To reduce the search space for a subgraph matching query, we propose a cost mode to seect the more effective abe combinations. The effectiveness and efficiency of our method are demonstrated through extensive experimenta resuts on rea datasets.. INTRODUCTION Owing to the rich semantic and structure information represented by a graph, structured graph data is used in numerous appications, such as socia networs, web graphs, bioogica networs, transportation networs, nowedge base, and RDF graphs. Many emerging appications rey on arge graphs to satisfy their query needs, such as Googe s nowedge graph and Faceboo s graph search. Thus, graph data management has attracted significant attention, and efficient graph query processing on arge graph is an important subject of study. In this paper, we focus on subgraph matching query [5, 8, ], which is a ey component of numerous appications. For exampe, answering SPARQL query Q is e- qua to finding subgraph matches of Q on an RDF graph G [5]. Some graph databases aso provide query anguage that is based on subgraph matching semantics, such as Cypher in Neo4j. Meanwhie, increasingy, companies choose the coud as their IT infrastructure patform. Using the coud aows users to avoid Permission to mae digita or hard copies of a or part of this wor for persona or cassroom use is granted without fee provided that copies are not made or distributed for profit or commercia advantage and that copies bear this notice and the fu citation on the first page. Copyrights for components of this wor owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or repubish, to post on servers or to redistribute to ists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. SIGMOD 6, June 6-Juy 0, 06, San Francisco, CA, USA c 06 ACM. ISBN /6/06... $5.00 DOI: expensive upfront infrastructure costs, and focus on projects that differentiate their businesses instead of on infrastructure []. Many pubic coud services are avaiabe, such as Amazon coud and Microsoft Azure. Some graph systems (such as GraphLab [4] and Neo4j []) offer SaaS (software-as-a-service)-stye coud services. In other words, they aow users to upoad their graph data to their coud patforms and provide coud-based computing services over the outsourced graph data. However, whie utiizing coud services for buiding graph appications is a cost-effective soution, the potentia ris of compromising sensitive information is a serious probem. One serious privacy eaage is the identity discosure probem [0, 3]. Assume that an adversary can ocate the target entity t as a vertex v of a socia networ graph G with a high probabiity. We say that the identity of t is discosed. A naïve anonymization soution is to remove a identifiabe persona information before pubishing the networ, such as names and socia security numbers. However, even when a networ is pubished without any identity information, it is sti possibe to ocate the target with a high probabiity based on some structura information around the target [0]. For exampe, if an adversary nows the oca graph structure (such as degree, -neighbor graph) around the target t, he/she may issue a subgraph query representing the oca graph structure to find the matching position. If there are ony few matches in graph G, the target wi be identified with a high probabiity. Once it is determined that a vertex v corresponds to the target t, a sensitive attributes associated with v wi be compromised. These are caed structura attacs; see detais in [3, 4, 0]. To address these threats, many privacy preserving graph data pubishing techniques have been proposed [6, 6, ]. A typica soution to protect graph privacy is based on the symmetry of the reeased graph data [6, 6, ]. Specificay, given a graph G, we transform G into a -automorphic graph G by introducing some noise edges, where each vertex has at east ( ) other symmetric vertices. It means there are no structura differences between v and each of its ( ) symmetric vertices. Thus it is impossibe to distinguish v from the other ( ) symmetric vertices. In other words, the -automorphism strategy [6] can defend against any structure-based attac. These privacy preserving graph data pubishing techniques seem ie perfect soutions to our probem, but they compromise the u- tiity of query resuts. In particuar, they may return fase positives regarding subgraph matching queries, due to the noise edges and vertices that were added. However, in a coud setting, it is possibe to offoad most query processing costs to the coud server and as the cients to execute a simpe and efficient fitering step to remove fase positives and find the exact answers. EXAMPLE. Consider a professiona socia networ in Figure that is modeed as a graph G. Each vertex in G represents an

2 <NAME: Tom> <GENDER: Mae> <OCCUPATION: Engineer> <NAME: Googe> <COMPANY TYPE: Internet> <STATE: Caifornia> c p p p 3 s <NAME: UIUC> <LOCATEDIN: Iinois> <NAME: Lucy> <GENDER: Femae> <OCCUPATION: HR> Graph G <NAME: Microsoft> <COMPANY TYPE: Software> <STATE: Washington> <NAME: Aice> <GENDER: Femae> <OCCUPATION: Accountant> c s p 4 <NAME: MIT> <LOCATEDIN: Massachusetts> <NAME: David> <GENDER: Mae> <OCCUPATION: Manager> p s c Individua Entity Schoo Entity Company Entity <COMPANY TYPE: Internet> p p Spouse Reation p c Wor At Reation p s Graduate From Reation c p <COMPANY TYPE: Software> q q 5 q q 4 s q 3 p c <LOCATEDIN: Iinois> Query Q Figure : An origina data graph and a query graph on a professiona socia networ graph. entity, such as an individua (p i ), a company (c j ), or a schoo (s ). Each edge in G represents a reation between two entities, such as spouse reation, wor at reation and graduate from reation. Each entity has some attributes. For exampe, the attributes associated with individuas are gender, occupation and so on. A user wants to find two individuas satisfying () both of them graduated from the same university ocated in Iinois, and () one of them is woring at a software company and the other one is woring at an Internet company. The user issues a subgraph pattern matching query Q over G, as shown in Figure. Sending the origina graph G to the coud wi ea user privacy in G. Thus, we resort to the privacy preserving graph pubishing techniques. For exampe, we can use the -automorphism mode [6]; the -automorphic graph G for G and = is shown in Figure, where noise edges are shown by red dashed ines. Ceary, G protects the structure privacy of the graph G. To protect abe privacy, we aso use abe anonymization where each vertex abe in G is repaced by a abe group (i.e., a generaized abe). We use Labe Correspondence Tabe (LCT) (in Figure ) to represent the mapping between abe groups and vertex abes. For exampe, vertex p in G has abe groups C and E in Figure. A straightforward method is to upoad G to the coud and perform graph queries over G. Athough the approach does not ea any sensitive information, the answers to query Q over graph G (R(Q, G )) are different from those over G (R(Q, G)). For exampe, there are ony two subgraph matches of Q over the origina graph G. However, due to the noise edges introduced into the - automorphic graph G and the abe anonymization, there are eight matches over G. Nevertheess, when the coud returns R(Q, G ) with eight matches, the cient can efficienty fiter out fase positives based on G to derive R(Q, G). Note that the fitering step at the cient side is much cheaper than asing the cient to run the subgraph matching query Q over G (which is nown to be expensive especiay over arge graphs). In other words, the coud server did most of the wor in this process, maing the coud service worthwhie and attractive for the cient. We do assume that the cient is the data owner who has access to G for the fitering step. For the genera case, a query cient (who is trusted and authenticated by the data owner) can as for the data owner to execute the (very ightweight) fitering step. However, the exampe above shows some major imitations of directy appying the existing graph data pubishing techniques [6, 6, ]. Firsty, most of these techniques that focus on structura attacs do not protect abe privacy at the same time. But more importanty, to achieve higher privacy, they need to add a ot of noise edges and/or vertices (e.g., a arge vaue in the case of the -automorphism mode) to the origina graph G. This resuts in a much arger graph (than the origina graph) on the coud side, which eads to much more expensive storage cost, much arger communication overhead, and much higher query costs for both the coud server and the query cient. This wor focuses on reducing these overheads without compromising either data and query graphs privacy or the correctness of the fina query resuts at the cient side. Soution overview. In order to achieve that, we first propose a basic soution. We transform the data graph G into an outsourced graph G using existing privacy-preserving graph pubication techniques, such as the -automorphism mode [6]; and then upoad G to the coud. At query time, we propose a two-phase query e- vauation strategy. First, given a query graph Q, we transform Q into an outsourced query graph Q o. In the coud, we evauate subgraph query Q o over G to obtain query resuts R(Q o, G ). Then, in the cient side, we fiter out fase positives in R(Q o, G ) based on G to find the fina, correct resuts R(Q, G), i.e., subgraph matches of Q over the origina graph G. To improve the query performance, we propose a soution that ony upoads a sma part of G to the coud by everaging the symmetry of the -automorphic graph G. This method saves both space cost and query processing time in the coud significanty. Athough ony a (sma) part of G is upoaded to the coud, our method sti guarantees the correctness of the query resuts. Furthermore, we aso propose a cost mode based abe combination/generaization strategy to reduce the search space for subgraph matching queries in the coud. Contributions. To the best of our nowedge, this is the first wor that supports privacy preserving subgraph matching queries over a arge graph in the coud whie protecting privacy without undermining query resuts. In this paper, we consider the coud server honest-but-curious, which is consistent with most reated wors in the iterature. In other words, the coud server aways offers correct computations without cheating. However, the coud server is curious to earn the graph data, its index structure, and user queries so as to gain sensitive information if he can. Our main contributions are summarized as foows. We propose an effective strategy to provide exact subgraph matching query services in pubic coud whie preserving private information in the data graph and query graphs. To save both space cost and query processing cost, we ony upoad a sma subset of the anonymized data graph to the coud. We answer subgraph matching queries efficienty in the coud by maing use of the symmetry of the - automorphic graph. These techniques contribute to saving cost whie minimizing the overhead in the cient side. In order to reduce the search space in answering subgraph matching queries, we design a nove cost mode to seect effective vertex abe combinations for anonymizing abes in the data graph and query graphs. We study the effectiveness and efficiency of our method through extensive experiments over severa arge rea graphs.

3 Labe Group Labes <COMPANY <COMPANY <COMPANY TYPE: A> <COMPANY TYPE: A> A {Internet, Software} TYPE: A> TYPE: A> <STATE: B> <STATE: B> {Caifornia, B Washington} c q c q 5 <GENDER: C> <GENDER: C> C {Femae, Mae} <OCCUPATION: E> <OCCUPATION: D> D {HR, Accountant} p q p q 4 E {Engineer, Manager} <GENDER: C> <GENDER: C> <OCCUPATION: D> <OCCUPATION: E> {Iinois, F Massachusetts} s q 3 Labe Correspondence <LOCATEDIN: F> Graph G <LOCATEDIN: F> <LOCATEDIN: F> Tabe (LCT) Query Q O Figure : A -automorphic graph and an anonymized query graph on the same professiona socia networ graph for =. Boc B Boc B Tabe : Notations c G The origina data graph c c c c c G The data graph reeased by -automorphism agorithm p p G o p3 p4 p p p3 p4 p p p3 p4 The outsourced data graph Q The origina query graph Q o The outsourced query graph s s S i The i-th star of Q o s s s s generated by query decomposition R in The set of candidate matching resuts of Q o generated in (a) Origina (b) Boc (c) Edge Copy coud Graph G Aignment R(Q, G) The set of subgraph matches of Q on G. BACKGROUND. Preiminary Traditiona subgraph matching methods aways adopt the vertex abeed graph mode [3], where each vertex has a singe abe. But this mode is not desirabe to mode compex graph data, such as socia networs and RDF graphs. In this wor, we adopt the attributed graph mode, where each vertex has a rich data structure incuding vertex type, vertex attributes and vertex abes (i.e., attribute vaues). For simpicity, we ony consider rich data structures on vertices and ignore those on edges, athough handing the more genera case is not more compicated. For exampe, we can introduce an imaginary vertex to represent an edge of interest and assign the rich data structure on the edge to the new vertex. Formay, our graph mode is defined as foows. Tabe ists some frequenty-used notations in this paper. Definition. Attributed Graph Mode. An attributed graph is defined as G = {V(G), E(G), T,Γ, L}, where () V(G) is a set of vertices; () E(G) V(G) V(G) is a set of undirected edges; (3) T is a set of vertex types, where each vertex has and ony has one vertex type; (4) Γ is a set of vertex attributes, where each vertex type has one or more vertex attributes and different vertex types have different vertex attributes; and (5) L is a set of vertex abes, where each vertex attribute has one or more vertex abes. The vertex type, vertex attributes and vertex abes of vertex v are denoted as T(v), Γ(v), L(v), respectivey. For any two different vertices v and v, if and ony if T(v ) = T(v ), then Γ(v ) =Γ(v ). For one vertex attribute A Γ(v), A, {a,, a n } represents the vertex attribute vaues on attribute A which are the vertex abes of A. Note that one vertex attribute may have mutipe vertex abes (i.e., attribute vaues). For exampe, the Company Type of one company can be Internet, Software, and so on. The data graph G and the query graphs Q in the running exampe foow the attributed graph mode. Definition. Subgraph Match. Given a data graph G = {V(G), E(G), T, Γ, L} and a query graph Q = {V(Q), E(Q), T, Γ, L}, Qis subgraph isomorphic to G, if and ony if there exists at east one injective function g : V(Q) V(G) such that ) q i V(Q), g(q i ) V(G) L(q i ) L(g(q i )); and ) q i, q j V(Q), edge q i q j E(Q) edge g(q i )g(q j ) E(G). Figure 3: An exampe of the -automorphism agorithm [6]. If Q is subgraph isomorphic to G, a subgraph match M of Q is a subgraph of G, represented as g(q ),,g(q n ). The set of subgraph matches of Q on G is denoted as R(Q, G). Our probem can now be formaized as foows: [Probem Definition] Given a data graph G and a query graph Q, our probem is to find a subgraph matches of Q over G, denoted as R(Q, G), through a coud server, whie preserving private information in data graph G and query graph Q. Note that the goa of our probem is to protect the privacy of data graph and query graph against the coud, where cients who as a subgraph query have the abiity to de-anonymize, fiter and verify the resuts returned from the coud based on the origina graph.. K-Automorphism As expained in Section (Exampe and its discussion), it is possibe to appy existing privacy preserving graph pubication techniques in constructing a baseine soution. However, they suffer from major efficiency imitations. Furthermore, most of these techniques that focus on structura attacs do not protect abe privacy at the same time. Nevertheess, we can use these techniques as a preprocessing step (e.g., -automorphism [6]) towards constructing more effective and efficient soutions. That said, we wi briefy review -automorphism [6] next. The basic idea of -automorphism is as foows. Given a graph G to be pubished, we transform it into G by introducing more vertices and edges, where G satisfies the -automorphic graph mode (Definition 3). It means that any vertex v in graph G cannot distinguish itsef from each of its symmetric ( ) vertices in G. Therefore, G is safe to pubish. Here, it is assumed that the graph is unabeed. Figure 3 shows an exampe of the agorithm in [6]. Definition 3. K-Automorphic Graph [6]. A -automorphic graph G is defined as G = {V(G ),E(G ) }, where V(G ) can be divided into bocs and each boc has vertices. Any V(G ) vertex v has symmetric vertices v in the other bocs. The -automorphic graph is generated with the hep of the - automorphic function defined as foows. Definition 4. K-Automorphic Function [6]. Given a vertex v in a -automorphic graph G, v and its corresponding symmetric vertices form an aignment vertex instance (AVI). symmetric means swapping v and v gives an isomorphic graph.

4 p p 4 p p3 s s c c F( p) p4; F( p4) p F( p) p3; F( p3) p F( s) s; F( s) s F( c ) c ; F( c ) p (a) Aignment Vertex Tabe (b) Automorphic Function F Figure 4: AVT and automorphic functions. A AVIs are stored in an Aignment Vertex Tabe (AVT). Each AVI I in AVT is represented as a circuary-ined ist. Specificay, I.at(i) (i = 0,, ) denotes the i-th vertex in instance I. Suppose v = I.at(i). Ifi, v.next = I.at(i + ); ese v.next = I.at(0). For each vertex v in an AVI, we can define automorphic functions F i (i = 0,, ) in G based on the AVI, where F 0 (v) = v; F i (v) = F i (v).next, for i. If M is a subgraph of G, each F i (M)(i = 0,, ) is defined as a mapping graph under function F i, where: V(F i (M)) = {u v V(M), u = F i (v)}; E(F i (M)) = {u u v v E(M), u = F i (v ) u = F i (v )}. A -automorphic graph G (for = ) generated from G (in Figure ) is given in Figure. The corresponding Aignment Vertex Tabe (AVT) is given in Figure 4(a). Each row of AVT shows symmetric vertices. For exampe, the first row of AVT contains p and p 4, meaning p and p 4 are symmetric vertices. In other words, swapping vertices p and p 4 wi generate another isomorphic graph. Each coumn of AVT shows a vertices in one boc of the -automorphic graph. For exampe, there are two bocs {c, p, p, s } and {c, p 4, p 3, s } in the -automorphic graph in Figure 3. Based on AVT, we aso show the automorphic function F of the running exampe in Figure 4(b). Given a graph G, we generate a -automorphic graph G from G as foows. First, we adopt the METIS agorithm [] to partition G into bocs. For exampe, to generate the -automorphic graph for the graph G in Figure, we obtain two bocs B {c, p, p, s } and B {c, p 4, p 3, s } by partitioning G. If V(G) cannot be divided by, we wi introduce some noise vertices to guarantee that every boc has exacty V(G ) vertices. There is an efficient method to buid the Aignment Vertex Tabe (AVT) (e.g., Figure 4) [6]. Based on the AVT, it is easy to define the -automorphic functions. Finay, based on the -automorphic functions, we buid G by performing graph aignment and edge copy. For exampe, we perform graph aignment on B and B to obtain two aignment bocs B and B (adding edge (p 3, p 4 ) and edge (p 3, s ) in Figure 3(b)), where B and B are isomorphic to each other. Lasty, the edge copy technique is used to dea with the crossing edges between different bocs (adding edge (p, s ) that corresponds to edge (p 3, s )in Figure 3(c)). Readers can refer to [6] for further detais. Furthermore, it is easy to show that any vertex in the -automorphic graph G cannot distinguish itsef from each of its ( ) symmetric vertices. It means that any adversary cannot identify any target vertex with a probabiity higher than..3 Our Framewor and Anaysis Overview In order to provide the correct coud-based subgraph query services whie preserving privacy in data graph and query graphs, our soution wors as foows. We transform G into an outsourced graph G o and upoad G o to the coud. We guarantee that G o does The proof was given in Theorem 4.4 of [6]. not ea any private information in the origina graph G. Specificay, we require that any adversary, who sees G o, cannot identify any target vertex in graph G with a probabiity higher than.we adopt the -automorphism mode [6] to achieve this objective, by generating G o based on G. At query time, given a query graph Q, we transform Q into an outsourced query graph Q o. Leveraging the symmetry of the -automorphic graph, the coud server answers subgraph matching query Q o based on G o and returns R in (a sma subset of R(Q o, G ), see Section 4..) to the cient. Based on R in, the cient can efficienty recover R(Q o, G ) and finay find the fina resuts R(Q, G). We highight severa ey requirements. Firsty, we need to define what sensitive information is in data graph and query graphs. We do not consider the vertex types T and vertex attributes Γ as sensitive information, since they do not compromise users privacy. For any vertex v in G or Q, we consider vertex abes L(v) (i.e., attribute vaues) as private information. Thus, the abe privacy considered in this paper refers to the privacy of the attribute vaues of each vertex in the graph. For exampe, given an individua vertex in graph G in Figure, the vaues of gender and occupation are users privacy. Subgraph matching queries wi revea vertex abes in origina data graph G, if we do not anonymize the vertex abes (i.e., attribute vaues) in query graphs. Thus, the vertex abes in query graph Q are aso considered as sensitive information. Secondy, we must reduce expenses for the coud server; that is to say, we need to save query time and storage space in the coud and reduce communication overhead between the cient and the coud. To protect data privacy, we have to introduce noise edges into the data graph and anonymize attribute vaues of vertices. Doing so wi ead to arger search space in subgraph matching. Therefore, in Section 5, we propose a cost mode to guide how to seect a good graph anonymization strategy. We aso study how to reduce the storage space and communication overhead by everaging the symmetry of the anonymized graph in Section 4, which aso heps reduce the coud s query processing cost. Thirdy, we shoud minimize the overhead in the cient side. Subgraph matching is an expensive tas in terms of both time and s- pace compexity. In our framewor, the cient ony needs to fiter out fase positives using a hash index in inear time compexity (in terms of the number of candidate resuts generated by the coud). 3. A ELINE SOLUTION We first describe a simpe scheme to hep iustrate the basic principe of our approach. For a graph G, we first generate the -automorphic graph G. A baseine soution is to upoad G to the coud directy. Note that -automorphism [6] assumes that the graph is unabeed. To protect the vertex abes in data graph and query graphs, we resort to the generaization technique, which is aso used in -anonymity [7, 9]. Specificay, each vertex abe in data graph and query graphs is represented by a generaized abe. We refer to a generaized vertex abe as a abe group in the foowing discussion. Here, we assume that each abe group contains not ess than θ distinct abes, where θ is a user-specified parameter. For exampe, a abe group A in Figure incudes θ = abes {Internet, Software}. The Labe Correspondence Tabe (LCT) (in Figure ) shows a abe groups in the running exampe. Obviousy, the abe generaization strategy wi affect the query performance. We assume that the abe groups are given unti Section 5, where we wi propose a cost mode to find a good abe generaization strategy. Using abe generaization on a data graph G, we obtain a graph G whose vertices hide vertex abes by abe groups. Next, using the -automorphism agorithm in [6], we obtain a -automorphic data graph G and the corresponding AVT. Each vertex v in G has

5 <GENDER: C> <OCCUPATION: E> <COMPANY TYPE: A> <STATE: B> <GENDER: C> <OCCUPATION: D> <LOCATEDIN: F> G o Figure 5: The outsourced data graph G o for G in Exampe. <GENDER: C> <OCCUPATION: D> <LOCATEDIN: F> ( ) symmetric vertices F i (v) under automorphic functions F i for i =,,. The vertices, i.e., v together with F i (v) for i =,,, form a symmetric vertex group, which corresponds to a row in AVT (an AVI). For each symmetric vertex group, we ensure that a vertices in it have the same abe groups, i.e., a vertex v s abe gropus are L(v) L(F (v)) L(F (v)). EXAMPLE. Given the origina data graph G in Figure, the -automorphic graph G together with its abe correspondence tabe (LCT) is given in Figure. A naïve soution is to upoad G to the coud directy. Given a query graph Q, we anonymize Q by representing each vertex abe using its corresponding abe group. The anonymized query graph is denoted as Q o, which is submitted to the coud. The coud server answers subgraph query Q o over the -automorphic graph G. We now that R(Q, G) R(Q o, G ). Intuitivey, we introduce more edges and vertices into G to form G, and Q o and G s vertex abes are anonymized using the same LCT. Formay, Theorem. For graph G and query graph Q, R(Q, G) R(Q o, G ). Finay, R(Q o, G ) are sent to the cient and the cient fiters out fase positives in R(Q o, G ) based on G to obtain R(Q, G). The baseine soution suffers from the foowing imitations. First, we need to upoad the -automorphic graph G to the coud. S- ince the size of G can be significanty arger than G, this introduces communication overhead and higher storage cost. Secondy, a arger graph G naturay eads to a arger search space for subgraph matching, which eads to higher query cost, especiay as increases. Nevertheess, the baseine soution aready saves the cient from executing the very expensive subgraph matching query hersef. 4. THE OPTIMIZED METHOD 4. Outsourced Graph According to Definition 3, G is a -automorphic graph consisting of bocs. Each vertex v in G has ( ) symmetric vertices in the other ( ) bocs. Intuitivey, we ony need to upoad a boc of G together with automorphic functions F i (i = 0,, ) to the coud, since the coud can recover the whoe G based on G o and the functions F i. This is the motivation of defining the outsourced graph G o (Definition 5), which is exacty the first boc of G together with the -hop neighbors in G. Definition 5. Outsourced Graph. For a graph G(V(G), E(G), T, Γ, L) and its -automorphic graph G (V(G ),E(G ),T,Γ, L), an outsourced graph of G is defined as G o = {V(G o ),E(G o ),T, Γ, L}, where () G o foows the attributed graph mode; () V(G o ) is the union of vertices in the first boc of G, denoted as V(B ), together with their one-hop neighbors in G denoted as V(N ); and (3) E(G o ) is the subset of undirected edges from E(G ) that connect vertices within V(B ) and vertics between V(B ) and V(N ). Given a -automorphic graph G, according to Definition 5, we generate an outsourced graph G o and upoad it to the coud. For exampe, given G and G in Figure and Figure from Exampe respectivey, an outsourced graph G o is represented in Figure 5. G o contains the vertices in the first boc of G (i.e., the vertices in the first coumn of AVT) together with their -hop neighbors in G, and their corresponding edges in G. Note that the size of G o is much smaer than the size of G (roughy an / fraction of it). Athough G o is a part of G, according to the automorphic functions F i (see Definition 4), each vertex/edge in G must have a counterpart in G o. It means that we can easiy recover G based on G o and the automorphic functions F i (i = 0,, ). This is the intuition that we ony upoad G o to the coud without compromising the accuracy of query resuts. More sophisticated technica detais are discussed in the foowing subsection. 4. Privacy Preserving Subgraph Query Given a query Q at the cient side, we generaize its vertex abes to form Q o. Specificay, for each vertex abe in Q, we repace it with the corresponding abe group according to the LCT (an exampe is shown in Figure ). Q o has the same size as Q, athough each vertex of Q o has a generaized abe group. Q o ensures the privacy of the vertex abe information in Q. It is a trade-off between the query privacy and the query performance. Thus, abe generaization is an interesting chaenge in its own and we assume for now that this is done and present the detais in Section 5. The cient then sends Q o to the coud. The coud first finds subgraph matches of a basic units of Q o over G o, which wi be defined shorty. Using the symmetry of the -automorphic graph, the coud can then obtain R(Q o, G ), but without G since it ony has G o, by joining these intermediate resuts. Lasty, R(Q o, G ) is sent bac to the cient, who can obtain R(Q, G) by pruning the fase positives in R(Q o, G ). Theorem guarantees the correctness of this framewor. 4.. Processing in the Coud A -automorphic graph G consists of symmetric bocs (B,, B ), whie the outsourced graph G o contains ony one boc together with the first-hop neighbors of its boundary vertices. The chaenge is how to find subgraph matches crossing mutipe bocs of G without accessing G, since ony G o resides in the coud. We adopt the query decomposition method. Given a query Q o, the coud server decompose Q o into a set of stars {S i }, i =,..., n, where a star is a root vertex together with its adjacent edges and neighbors in Q o. Then, it finds R(S i, G o ) for each star graph S i for i =,, n. Leveraging the symmetry of G, we can then obtain R(S i, G ) based on R(S i, G o ). Finay, we obtain R(Q o, G ) by joining the matching resuts for these stars. Query Decomposition. We first discuss how to decompose Q o into a set of stars and how to find the optima query decomposition. Consider a query Q o in Figure. The stars rooted at vertices with Type P are shown in Figure 6, where a shaded circe denotes the center (aa root) of a star. Intuitivey, a query decomposition is a set of stars that coectivey cover the outsourced query graph Q o. Figure 6 shows the query decomposition {S, S } over query Q o. The set of subgraph matches of a star graph S i with respect to the outsourced graph G o is R(S i, G o ), or simpy R(S i ) when the context is cear. To reduce the number of intermediate resuts, we design a cost mode to estimate the number of matches, R(S i ), for each star S i. We wi discuss the technica detais of the cost mode in Section 5. Here, we assume

6 Labe Group <COMPANY TYPE: A> q A <> q p q 3 c s <LOCATEDIN: F> <COMPANY TYPE: A> c s q 5 p q 3 <LOCATEDIN: F> Star S Star S Figure 6: Star graphs after query decomposition. B <> Vertex Type C <c > P <p, p > S <s > C <, > D <0, > E <, 0> Vertex F <> Neighbor Labe Bit Vector Tabe (LBV) Vertex Bit Vector Tabe (VBV) Figure 7: Index structure. that each R(S i ) (i =,, n) is given. We define the cost of the query decomposition as foows. q 4 Labe Groups of the Corresponding Neighbor Vertices <A, B, C, D, E, F> c <0, 0,,,, 0> p <,,,, 0, > p <,,, 0,, > s <0, 0,,,, 0> Definition 6. The Cost of Query Decomposition. Given a set of stars {S,...,S n } that is a decomposition of an outsourced query graph Q o, the cost of the query decomposition is: n cost(q o ) = R(S i). i= It is straightforward to reduce a minimum weighted vertex cover (a cassica NP-hard probem) to the probem of finding the query decomposition with the minimum cost. Formay, Theorem. Given an outsourced query graph Q o, finding the query decomposition with the minimum cost with respect to Definition 6 is an NP-hard probem. That said, we formuate finding the optima query decomposition as the foowing ILP (integer inear programming) probem and use an avaiabe ILP too, e.g, the Gurobi ILP sover, to sove this probem. Athough ILP is sti an NP-hard probem, Q o is aways a sma-size graph. Thus in practice, it is actuay very efficient to find the optima query decomposition through this formuation. Soving this ILP aso gives us the vaue n, the number of stars, in the query decomposition. minimize R(S (v i )) x vi a v i V(Q o ) sub ject to x vi + x v j for a v i v j E(Q o ) /*Each edge is contained in at east one star.*/ x vi {0, } for a v i V(Q o ) /*A star rooted at each vertex v i is either seected (x vi = ) into the query decomposition or not (x vi = 0).*/ Star Matching. Next, we present our star matching agorithm. The agorithm is designed to find the subgraph matches for each star S i, in the query decomposition of Q o, over G o, i.e., R(S i, G o ). The coud server buids a query index structure offine to improve the query efficiency. The index can be considered as two parts: one is regarding the vertex abe, and the other one is regarding the neighbourhood structure. Thus, there are two components in the index structure, as shown in Figure 7 which are constructed based on LCT (abe correspondence tabe) and G o (see Figure and Figure 5 respectivey). They are the Vertex Bit Vector (VBV) Tabe and the Neighbor Labe Bit Vector (LBV) Tabe, respectivey. For convenience, the first boc of G is denoted as B. Obviousy, B is a subgraph of G o. Each VBV corresponds to a abe group, where the corresponding bit in the VBV for a vertex v B is set to iff v contains that abe group. For exampe, p contains D but not E in B. Thus the two corresponding bits in VBV are and 0, respectivey. In LBV, for each vertex v in B, the corresponding bit for a abe group L is set to if and ony if L is contained in at east one abe set for v s neighbor vertices. For exampe, D is contained in the abe set of p that is one of p s neighbors. However, E is not contained in the abe set of any of p s neighbors. Thus the two corresponding bits for p in LBV are and 0, respectivey. Agorithm Star Matching Agorithm Require: Input: G o (the outsourced data graph) and S (the set of stars that contains star S i with center v i, for i n). Output: RS (R(S i, G o ) for i n). : Initiaize RS := φ. : for i := ton do 3: Initiaize RS i := φ. 4: Set α := VBV(L(v i, )) VBV(L(v i, )) VBV(L(v i, L(v i ) )). 5: for each vertex v a that corresponds to a non-zero bit in α do 6: if LBV(v a ) LBV(v i ) = LBV(v i ) then 7: Generate the set of matches of S i with center v a, denoted as RS temp. 8: RS i := RS i RS temp. 9: RS := RS RS i. 0: Return RS. The Star Matching Agorithm is presented in Agorithm. Without oss of generaity, assume that the center of a star S i is vertex v i. For each star S i for i n, we first find each Vertex Bit Vector that corresponds to every abe group of v i ; e.g. VBV(C) = (, ) in our exampe. Reca L(v) is the set of abe groups for vertex v. We use L(v, j) to denote the j-th abe group of v, for j L(v). Hence, the first step is to find VBV(L(v i, j)) for j L(v i ). We perform a bitwise AND operation on these L(v i ) bit vectors to obtain the resut vector α (Line 4). Each vertex v a that corresponds to a non-zero bit in α is a candidate match of v i. If each abe group of v i s neighbors can be found in the abe sets of v a s neighbors (Line 6), some of v a s neighbors can be candidate matches of v i s neighbors. By enumerating candidate vertex combinations of v a and its neighbor vertices, we generate matches of S i and add them to the resut set (Line 7-Line 8). Resut Join. The next chaenge is how to compute R(Q o, G ) based on the star matching resuts R(S i, G o ), for i =,..., n. A straightforward soution wors as foows. First, using the -automorphic function F j ( j = 0,, ), we compute R(S i, G ) based on R(S i, G o ). Then we compute R(Q o, G ) by joining R(S i, G ) s, i.e., R(Q o, G ) = R(S, G ) R(S, G ) R(S n, G ). Obviousy, the cost of the join is n i= R(S i, G ). Figure 8 demonstrates the above process using the running exampe. In our exampe, Q o is decomposed into two stars S and S (in Figure 6). Given the graph G o (in Figure 5) on the coud, we perform subgraph matching to obtain R(S, G o ) and R(S, G o ) (as shown in Figure 8), i.e., the subgraph matches of S and S over graph G o, respectivey. According to the automorphic function F (defined in Figure 4), we can derive R(S, G ) and R(S, G ). Specificay, for each match M in R(S, G o ), using the automorphic function F, F (M) derives another match M in R(S, G ). For exampe, (p, c, s ) is a match of S over G o ; thus, (F (p ), F (c ), F (s )) gives another match (p 4, c, s ). Thus, we get R(S, G ) = R(S, G o ) F (R(S, G o )) F (R(S, G o )). We can obtain

7 q q q 3 q 4 q 5 q 3 o o RS ( p c s p c s, G) RS (, G) p c s p c s p c s p c s p 4 c s p 4 c s p 3 c s p 3 c s F RS (, G o ) (, o ( ) F ( RS G ) p 3 c s p 3 c s RS (, G) RS (, G) Figure 8: Star join. q q q 3 q 4 q 5 p c s p 3 c p c s p 3 c p c s p 4 c p c s p 3 c p 4 c s p c p 3 c s p c p 3 c s p c p 3 c s p c o RQ (, G ) R(S, G ) in a simiar fashion. Figure 8 iustrates this process for our running exampe where =. Finay, we need to join R(S, G ) and R(S, G ) based on the topoogy reation between S and S. Since S and S shares ony one common vertex q 3 in this case, the join condition is that R(S, G ).q 3 = R(S, G ).q 3 but the other two coumns of R(S, G ) and R(S, G ) do not match. The join resuts are R(Q o, G ). In this subsection, we propose an efficient technique to speed up the above process by everaging the symmetry of the -automorphic graph G. We conceptuay divide R(Q o, G ) into two parts: R in and R out. We ony compute the subgraph matches in R in through the above join process. The subgraph matches in R out can be easiy computed based on the automorphic functions (such as in Figure 8) without going through the expensive join process. For exampe, in Figure 8, we ony expand R(S, G o )tor(s, G ) using the automorphic function. Then, we join R(S, G o ) with R(S, G )to obtain R in. A other matches can be obtained by appying the automorphic function over matches in R in.fornstars, we can appy this idea recursivey over two star matches at a time, which can be done in parae as we. Consider a vertex q in Q o. For any match M of Q o over G, et v denote the matching vertex of q in this match. There are ony two cases: v is in B (the first boc of G ) or not. If v B, there must exist another match M under automorphic function F (i.e., M = F (M)), where v is the matching vertex of q in match M and v is in B. For exampe, in match (p, c, s, p 3, c )in Figure 8, p corresponds to q, where p is in boc B. In match (p 4, c, s, p, c ), p 4 corresponds to q but p 4 is not in boc B ; but we now that (p 4, c, s, p, c ) = F (p, c, s, p 3, c ), where F is an automorphic function. In the atter match, p matches q and p is in boc B. Formay, we have the foowing theorem. Theorem 3. Given Q o with m vertices q a (a =,, m), M with m vertices v a (a =,, m) is a subgraph match of Q o over graph G, where v a matches q a. Consider a vertex q a in Q o. If vertex v a matching q a is not in B (the first boc of G ), we can find another match M that contains a vertex v a matching q a, where v a B and v a = F j (v a ) under some automorphic function F j. Furthermore, M = F j (M), where F j (M) is a mapping graph of M under an automorphic function F j, which is defined in Definition 4. Let us consider a vertex q a in Q o.givenq a, the set of subgraph matches R(Q o, G ) can be divided into the foowing two parts:. R in ={M M R(Q o, G ) ( v a B, v a M v a q a )}. R out ={M M R(Q o, G ) ( v a B, v a M v a q a )} where v a q a means that vertex v a matches q a. We ony need to find subgraph matches in R in. Then based on the automorphic functions, the cient can obtain R out. Note that the coud server can do this step too if the goa is to minimize the R in R out processing cost at the cient side, but with a higher communication overhead. Finay, R(Q o, G ) = R in R out. Agorithm presents the join agorithm. Let us consider a query decomposition {S,...,S n } over Q o. Suppose that R(S a ) ( a n) is the minimum over a stars, and without oss of generaity star S a roots at vertex q a. Initiay, we set answer set R in = R(S a, G o ). We start with S a and find another star S i ( i a n), where S i overaps with S a and R(S i ) is minimum over a such overapping stars. Then, we compute R(S i, G ) according to the automorphic functions F j ( j = 0,, ) (Line 5-Line 8). We perform the natura join R in = R in R(S i, G ) (Line 9). Then we deete a the matches that contain dupicate vertices (Line 0-Line ), since two query vertices cannot match the same vertex in the data graph, according to the definition of subgraph isomorphism. We iterate the above process unti a stars in the query decomposition have been processed. Agorithm Resut Join Agorithm Require: Input: RS (the set of R(S i, G o ), i n) and Aignment Vertex Tabe (AVT). Output: R in. : Initiaize R in := R(S a, G o ), where R(S a ) is minimum over a stars. : RS := RS R in. 3: whie RS.size() > 0 do 4: Initiaize a set R next := R(S i, G o )( i a n), where S i overaps with the part of query graph that corresponds to current matches in R in, and R(S i ) is minimum over a such overapping stars. 5: Initiaize a set R next := φ. 6: for m := 0to do 7: R next := R next F m(r next ). 8: /* F m (R next ) = {M M R next, M = F m (M )}. */ 9: R in := R in R next 0:. for each match M R in do : if M contains dupicate vertices then : R in := R in {M}. 3: RS := RS R next. 4: Return R in. 4.. Processing in the Cient Side According to Agorithm, the coud obtains the set R in and transmits it to the cient. There are two stages in the cient side processing. The pseudocode is given in Agorithm 3. First, we need to compute R out according to the automorphic functions F j ( j =,, ) (Line -Line 4 in Agorithm 3). For each match M in R in, we compute F j (M) (j =,, ) and put them into R out. Obviousy, R(Q o, G ) = R in R out (Line 5). Note that this step can aso be done by the coud. Secondy, the cient computes the fina resut set R(Q, G) by fitering out the fase positives in R(Q o, G ) (Line 6-Line 3). The fitering process aso has two steps. In the first step, we remove some matches in R(Q o, G ) that contain vertices or edges that do not exist in the origina graph G (Line 8-Line 0). Aso note that we anonymize the vertex abes in the query graph by using vertex abe groups. Thus in the second step, we need to fiter out matches that contain vertices whose abes cannot match those of the corresponding vertices in the origina query graph Q (Line -Line ). It is straightforward to see that the time compexity of the cient processing is inear with the number of matches in R(Q o, G ). Furthermore, it is easy to design some hashing techniques to speed up the fitering processing. 5. COST MODEL In order to reduce the search space of subgraph matching, we need a cost mode for both abe generaization and query decomposition. Different abe combinations ead to different search s-

8 Agorithm 3 Resut Processing Agorithm Require: Input: R in (the set of candidate matching resuts generated in coud), Aignment Vertex Tabe (AVT). Output: R (the set of fina matching resuts). : Initiaize R out := φ. : for m := to do 3: R out := R out F m (R in ). 4: /* F m (R in ) = {M M R in, M = F m (M )}. */ 5: Set R := R in R out. 6: Initiaize R := φ. 7: for each match M R do 8: find := true; 9: for each vertex v V(M) do 0: if v V(G) then : find := fase; : brea; 3: if find = fase then 4: continue; 5: for each edge e E(M) do 6: if e E(G) then 7: find := fase; 8: brea; 9: if find = fase then 0: continue; : if M contains any vertices whose abes do not match those of the corresponding vertices on query Q then : continue; 3: R := R {M}. 4: Return R. paces in subgraph matching. Since our subgraph matching agorithm is based on joining star matches, we require that the number of star matches ( R(S ) ) shoud be as sma as possibe. Furthermore, the query decomposition method in Section 4.. aso reies on estimating R(S ). Thus, we propose a cost mode for estimating R(S ). 5. Estimating R(S) Given a star query S with center q, it matches a star with the center v in B (i.e., the first boc of G ) if and ony if the foowing two conditions hod. Therefore, we shoud consider the two factors whie estimating R(S ). center q shoud match v; each neighbor of q shoud match one of v s neighbors. First Factor. The first factor measures the number of candidate matching vertices of the center q of the star query S. Given an outsourced graph G o, the vertices matching the center q of S ony ocate in the first boc of G, i.e., boc B. That is to say, we need to find the number of such candidate vertices v in B, where each v and q share the same vertex type and each such candidate V(G v contains q s vertex abe group. ) is the number of vertices in B. Given a center q, we shoud estimate the probabiity that a vertex v B has the same vertex type with q and v contains q s vertex abe group. Due to the symmetry in G, the first boc B has the same vertex abe distribution with G. Thus, we use G to derive the probabiity. Let V(G, j), V (G, ( j, i)), and V g (G, ( j, i)) denote the set of vertices with the j-th vertex type, abe j, i (ith abe of jth vertex type), and abe group L j, i respectivey. Then, we define: F G ( j) = V(G, j) V(G ), F G ( j, i) = V (G, ( j, i)) V(G, F g, j) ( j, i) = V g(g, ( j, i)) G V(G, j) () for the graph G. Intuitivey, F G ( j) estimates the probabiity of a vertex being the jth vertex type; F G ( j, i) estimates the probabiity of a vertex that s the jth vertex type having an ith abe; asty, F g ( j, i) estimates the G probabiity a vertex that s the jth vertex type having an ith abe group after the abe generaization. Simiary, we can aso define F S ( j), FS ( j, i) and Fg S ( j, i) for a star query graph S, repacing G by star S in the equation. Without oss of generaity, assume that for the j-th ( j t) vertex type, there are θh j different abes ( j,, j,,, j,θhj ). These abes can be combined into h j abe groups (L j,, L j,,, L j, h j ). The i-th group L j, i contains θ different abes, which are j, pθ(i )+, j, pθ(i )+,, j, pθi for i h j. Note that p, p,, p θh j forms a permutation of {,,,θh j }. F G ( j)f S ( j) is the probabiity that a vertex v in G has the same vertex type with the star center q. Consider each possibe vertex h j type. For the j-th vertex type, i= F g ( j, i)f g G S ( j, i) denotes the probabiity that vertex v and the query center has the same abe group. Therefore, the first factor estimating the number of vertices that can match the center of the star query is as foows. V(G h ) t j F G ( j)f S ( j) F g ( j, G i)fg S ( j, i) () j= Second Factor. The second factor measures the search space of checing whether each of q s neighbors can find its matching vertex in v s neighbors. The estimation here is simiar with that of the first factor. The difference is that the candidate matching vertex v of the center q of S has been given. Thus, to match the first vertex of q s neighbors, the number of candidate vertices that we shoud search is the degree of vertex v rather than V(G ). Since there are severa candidate vertices v, we use the average degree of vertices in G to estimate the degree of vertex v. Here, we denote it as D(G ). Then, to match the second vertex of v s neighbors, the potentia search space is D(G ). The rest can be done in the same manner. Suppose the center of the star query S has D c (S ) neighbors. Thus, this part of the search space can be estimated as D(G ) (D(G ) ) (D(G ) D c (S )+). For the sae of simpicity, we can estimate it as D(G ) Dc (S ). As with the estimation of the first factor, we shoud aso consider the probabiity of sharing the same vertex type and containing the corresponding vertex abe group. Thus, we can define the second factor that estimates the search space of matching the star center q s neighbors as foows. h D t j D(G ) F G ( j)f S ( j) F g ( j, G i)fg S c (S ) ( j, i) (3) j= i= The Cost Mode. Our cost mode is given by Expression 4, which is simpy the product of factor and factor from () and (3). It does assume independence among the abe distributions for the neighbors of a vertex. This may not aways hod in practice. But our experimenta resuts show that our assumption is acceptabe in three rea arge graphs and our cost mode is very effective. We aso note that V g (G, ( j, i)) [ + δ()] θ m= V (G, ( j, p θ(i )+m )) for some constant 0 δ(), i.e., the number of vertices from the jth vertex type having the ith abe group is at most a constant factor of the tota number of vertices with jth vertex type having a abe that was generaized into this abe group. Immediatey, this impies that F g ( j, i) [ + δ()] θ G m= FG ( j, p θ(i )+m). Intuitivey, each vertex u in G has ( ) symmetric vertices. To ensure that they have the same vertex groups, we require that u shoud have a union of a its symmetric vertices abe groups. In the worst case, F g ( j, i) wi increase by a factor of ( ). In fact, δ() can be much G ess than ( ), and given G and the corresponding -automorphic graph G, we can give a much tighter bound on the parameter δ(). That is to say, if we do not introduce any unnecessary abe groups during abe generaization (just ie the exampe in Figure ), δ() i=