Secure Multiparty Computation Multi-round protocols

Transcription

1 Secure Multiparty Computation Multi-round protocols Li Xiong CS573 Data Privacy and Security

2 Secure multiparty computation General circuit based secure multiparty computation methods Specialized secure multiparty computation protocols Decision tree mining across horizontally partitioned data Secure sum, secure union Association rule mining across horizontally partitioned data Most of them rely on cryptographic primitives and are still expensive Multi-round protocols as an alternative

3 Multi-round protocols Max/min, top k k-th element protocol using secure comparison (Aggarwal 4) Multi-round probabilistic protocols (Xiong 7) OR (Union) Commutative encryption based Multi-round probabilistic protocols (Bawa 3) Secure computation of the k-ranked element, Aggarwal, 24 Preserving Privacy for outsourcing aggregation services, Xiong, 27 Privacy Preserving Indexing of Documents on the Network, Bawa, 23

4 K-th element (Aggarwal 4) Input Di, i = 1, 2,, s k Range of data values: [alpha, beta]. Size of the union of database: n Output The k-th ranked elements in the union of Di Secure computation of the k-ranked element, Aggarwal, 24

5 kth element protocol Initialize Each party ranks its elements in ascending order. Initialize current range [a,b] to [alpha, beta], set n= sum Di Repeat until done Set m = (a+b)/2 Each party computes li, number of elements less than m, and gi, number of elements greater than m If sum(li) <= k-1 and sum(gi) <= n-k, done If sum(li) >=k, set b = m-1, output If sum(gi) >= n-k+1, set a = m+1, output 1

6 Cost Number of rounds: logm where M is the range size Each round requires two secure sums and two secure comparisons

7 Multi-round protocols Can we get away from cryptographic primitives? Multi-round protocols idea Use randomizations (random response) Utilize inherent network anonymity of multiple nodes Multi-round protocols May not be completely secure May not be completely accurate

8 Multi-round protocols Multi-round probabilistic protocols for max/min and top k (Xiong 7) Multi-round OR (union) protocol (Aggarwal 4)

9 Protocol Structure Random response (Warner 1965) Multi-round randomized protocol Randomized local computation Multi-node anonymity Assumption: semihonest model D1 Dn Output Local Computation Input Output Local Computation Input Private Data Private Data Social Survey Preserving Privacy for outsourcing aggregation services, Xiong, 27 Input Local Computation Local Computation Output D2 Private Data Output Input D3 Private Data 9

10 A Naïve Max/Min Protocol g i-1 i g i start 3 v i g i-1 >=v i g i-1 <v i 2 4 g i g i-1 v i 4 3 Add in randomization how, when, and how much? 4 1

11 Max Protocol Random response Random response at node i: g i-1 >=vi g i-1 (r)<vi g i-1 i v i g i g i (r) g i-1 (r) w/ prob Pr: random number w/ prob 1-Pr: v i 11

12 Max Protocol multi-round random response Multiple rounds Randomization Probability at round r : Pr(r) = r P d * 1 Local algorithm at round r and node i: g i-1 (r) i v i g i (r) g i-1 (r)>=vi g i-1 (r)<vi g i (r) g i-1 (r) w/ prob Pr: rand [g i-1 (r), v i ) w/ prob 1-Pr: v i 12

13 Max Protocol - Illustration Start D D D4 D

14 PrivateTopK Protocol 145 G i (r)=topk(g i-1 (r) U V i ); 125 V i = G i (r) G i-1 (r); G i-1 (r) m = V i ; if m= then G i (r)= G i-1 (r); else with probability 1-Pr(r): G i (r)= Gi-1(r) 4 with probability Pr: D1 D2 V i Gi(r)[1:k-m] = G i-1 (r)[1:k-m] G i (r)[k-m+1:k] = a sorted list of m G i (r) random values generated from [min(g i (r)[k]-delta,g i-1 (r-1)[k-m+1]), G i (r)[k]) Dn end 3/5/29 14

15 Min/Max Protocol - Correctness Precision bound: Converges with r 1 r( r 1) 2 Smaller p and d provides faster convergence r j 1 Pr( j) 1 P r * d 15

16 Min/Max Protocol - Cost Communication cost single round: O(n) Minimum # of rounds given precision guarantee (1-e): 16

17 Min/Max Protocol - Security Probability/confidence based metric: P(C IR,R) Absolute Privacy Different types of exposures based on claim Data value: v i =a Data ownership: Vi contains a Loss of Privacy (LoP) = P(C IR,R) P(C R) Information entropy based metric: Provable Exposure.5 1 Loss of privacy as a measure of randomness of information: H(D R) - H(D IR,R) 17

18 Min/Max Protocol Security (Analysis) Upper bound for average expected LoP: max r 1/2 r-1 * (1-P *d r-1 ) Larger p and d provides better privacy 18

19 Min/Max Protocol Security (Experiments) Loss of privacy decreases with increasing number of nodes Probabilistic protocol achieves better privacy (close to ) When n is large, anonymous protocol is actually okay! 19

20 Union Commutative encryption based approach Number of rounds: 2 rounds Each round: encryption and decryption Multi-round random-response approach?

21 Vector p 1 p 2 p c V G b 1 b OR OR OR = b L Each database has a boolean vector of the data items Union vector is a logical OR of all vectors Privacy Preserving Indexing of Documents on the Network, Bawa, 23

22 1 1 Group Vector Protocol 1 1 Processing of V G at p s of round r v 1 v 2 v c p 1 p 2 p c P ex =1/2 r, P in =1-P ex for(i=1; i<l; i++) if (V s [i]=1 and V G [i]=) Set V G [i]=1 with prob. P in if (V s [i]= and V G [i]=1) Set V G [i]= with prob. P ex r=1, P ex =1/2, P in =1/2 r=2, P ex =1/4, P in =3/4 v G v G v G v G

23 Open issues Tradeoff between accuracy, efficiency, and security How to quantify security How to design adjustable protocols Can we generalize the algorithms for a set of operators based on their properties Operators: sum, union, max, min Properties: commutative, associative, invertible, randomizable