Round Efficient Unconditionally Secure MPC and Multiparty Set Intersection with Optimal Resilience
05 Dec 2009-pp 398-417
TL;DR: This paper presents a protocol for unconditionally secure multiparty set intersection (UMPSI) with optimal resilience, the first ever UMPSI protocol with n = 2t + 1, and proposes a new and robust multiplication protocol to generate t-sharing of the product of two t-shared secrets.
Abstract: In information theoretic model, unconditionally secure multiparty computation (UMPC) allows a set of n parties to securely compute an agreed function f, even upto t < n/2 parties are under the control of an active adversary having unbounded computing power. The bound on the resilience/fault tolerance (i.e t < n/2 ) is optimal, as long as each party is connected with every other party by a secure channel and a common physical broadcast channel is available to the parties and a negligible error probability of $2^{-{\it \Omega}(\kappa)}$ (for some security parameter ?) is allowed in the computation. Any UMPC protocol designed under the above settings is called as optimally resilient UMPC protocol. In this paper, we propose an optimally resilient UMPC protocol with n = 2t + 1, which requires only ${\cal O}({\cal D})$ rounds, where ${\cal D}$ is the multiplicative depth of the arithmetic circuit representing f. To the best of our knowledge, our protocol is the first UMPC protocol with optimal resilience, to attain a round complexity that is independent of n. When ${\cal D}$ is constant, then our protocol requires only constant number of rounds. Our protocol is to be compared with the most round efficient, optimally resilient, UMPC protocol of [16] that requires ${\cal O}(\log{n} + {\cal D})$ rounds in the same settings as ours. Thus our UMPC significantly reduces the round complexity of [16]. Moreover, our UMPC protocol requires the same communication complexity as that of [16]. As a tool for designing our UMPC protocol, we propose a new and robust multiplication protocol to generate t-sharing of the product of two t-shared secrets.
As an interesting, practically-on-demand MPC problem, we present a protocol for unconditionally secure multiparty set intersection (UMPSI) with optimal resilience; i.e., with n = 2t + 1, having a negligible error probability in correctness. This protocol adapts the techniques used in our proposed general UMPC protocol. The protocol takes constant number rounds, incurs a private communication of ${\cal O}(m^2n^4 \kappa)$ bits and broadcasts ${\cal O}((m^2n^4 + n^5)\kappa)$ bits, where each party has a set of size m. To the best of our knowledge, this is the first ever UMPSI protocol with n = 2t + 1. This solves an open problem posed in [15] and [17], urging to design an UMPSI protocol with n = 2t + 1. Our UMPSI protocol is to be compared with the best known UMPSI protocol of [17] with n = 3t + 1 (i.e., non-optimal resilience), which takes constant number rounds, incurs a private communication of ${\cal O}((m^2n^3 + n^4 \kappa)\kappa)$ bits and broadcasts ${\cal O}((m^2n^3 + n^4 \kappa)\kappa)$ bits. So even though the communication complexity of our UMPSI protocol is slightly larger than that of [17], our UMPSI protocol significantly improves the resilience of UMPSI protocol of [17]; i.e., from t < n / 3 to t < n / 2.
Citations
More filters
03 Mar 2013
TL;DR: A general approach for transforming perfectly secure protocols for sender-receiver functionalities in the correlated randomness model into secure protocols in the plain model which offer perfect correctness against a malicious sender is presented.
Abstract: We investigate the extent to which correlated secret randomness can help in secure computation with no honest majority. It is known that correlated randomness can be used to evaluate any circuit of size s with perfect security against semi-honest parties or statistical security against malicious parties, where the communication complexity grows linearly with s. This leaves open two natural questions: (1) Can the communication complexity be made independent of the circuit size? (2) Is it possible to obtain perfect security against malicious parties?
We settle the above questions, obtaining both positive and negative results on unconditionally secure computation with correlated randomness. Concretely, we obtain the following results.
Minimizing communication. Any multiparty functionality can be realized, with perfect security against semi-honest parties or statistical security against malicious parties, by a protocol in which the number of bits communicated by each party is linear in its input length. Our protocol uses an exponential number of correlated random bits. We give evidence that super-polynomial randomness complexity may be inherent.
Perfect security against malicious parties. Any finite 'sender-receiver' functionality, which takes inputs from a sender and a receiver and delivers an output only to the receiver, can be perfectly realized given correlated randomness. In contrast, perfect security is generally impossible for functionalities which deliver outputs to both parties. We also show useful functionalities (such as string equality) for which there are efficient perfectly secure protocols in the correlated randomness model.
Perfect correctness in the plain model. We present a general approach for transforming perfectly secure protocols for sender-receiver functionalities in the correlated randomness model into secure protocols in the plain model which offer perfect correctness against a malicious sender. This should be contrasted with the impossibility of perfectly sound zero-knowledge proofs.
114 citations
02 May 2012
TL;DR: A comprehensive suite of secure multi-party protocols for set and multiset operations that are composable, do not assume any knowledge of the sets by the parties carrying out the secure computation, and can be used for secure outsourcing are designed.
Abstract: Privacy-preserving set operations and set intersection in particular are a popular research topic. Despite a large body of literature, the great majority of the available solutions are two-party protocols and are not composable. In this work we design a comprehensive suite of secure multi-party protocols for set and multiset operations that are composable, do not assume any knowledge of the sets by the parties carrying out the secure computation, and can be used for secure outsourcing. All of our protocols have communication and computation complexity of O(m log m) for sets or multisets of size m, which compares favorably with prior work. Furthermore, we are not aware of any results that realize composable operations. Our protocols are secure in the information theoretic sense and are designed to minimize the round complexity.
45 citations
Cites background or methods from "Round Efficient Unconditionally Sec..."
...There are also publications that develop private set intersection protocols in the information-theoretic setting [56, 59, 58, 60]....
[...]
...This solution is used in [60] to build a protocol that works when the adversary controls t < n/2 parties, in which case communication complexity becomesO(nm+n)....
[...]
07 Jun 2011
TL;DR: A new efficient solution to the multi-party set intersection problem, and a solution to a multiparty variant of the polynomial reconstruction problem are presented.
Abstract: We present a robust secure methodology for computing functions that are represented as multivariate polynomials where parties hold different variables as private inputs. Our generic efficient protocols are fully black-box and employ threshold additive homomorphic encryption; they do not assume honest majority, yet are robust in detecting any misbehavior. We achieve solutions that take advantage of the algebraic structure of the polynomials, and are polynomial-time in all parameters (security parameter, polynomial size, polynomial degree, number of parties). We further exploit a "round table" communication paradigm to reduce the complexity in the number of parties.
A large collection of problems are naturally and efficiently represented as multivariate polynomials over a field or a ring: problems from linear algebra, statistics, logic, as well as operations on sets represented as polynomials. In particular, we present a new efficient solution to the multi-party set intersection problem, and a solution to a multiparty variant of the polynomial reconstruction problem.
28 citations
Cites background from "Round Efficient Unconditionally Sec..."
...In addition, relatively inefficient information theoretic solutions are presented in [33, 34])....
[...]
TL;DR: In this article, the authors proposed a secure multi-party set and multiset operations in which the inputs can be arbitrarily partitioned among the participants, knowledge of an input (multi)set is not required for any party, and the secure set operations can be composed and can also be securely outsourced to third-party computation providers.
Abstract: Privacy-preserving set operations are a popular research topic. Despite a large body of literature, the great majority of the available solutions are two-party protocols and expect that each participant knows her input set in the clear. In this work, we put forward a new framework for secure multi-party set and multiset operations in which the inputs can be arbitrarily partitioned among the participants, knowledge of an input (multi)set is not required for any party, and the secure set operations can be composed and can also be securely outsourced to third-party computation providers. In this framework, we construct a comprehensive suite of secure protocols for set operations and their various extensions. Our protocols are secure in the information-theoretic sense and are designed to minimize the round complexity. We then also build support for multiset operations by providing (i) a generic conversion from a multiset to a set, which makes the protocols for set operations applicable to multisets and (ii) direct instantiations of multiset operations of improved performance. All of our protocols have communication and computation complexity of $$O(m \log m)$$O(mlogm) and logarithmic round complexity for sets or multisets of size m, which compares favorably with prior work. Practicality of our solutions is shown through experimental results, and novel optimizations based on set compaction allow us to improve performance of our protocols in practice. Our protocols are secure in both semi-honest and malicious security models.
25 citations
DOI•
01 Jan 2012TL;DR: A new adversarial model of non-collusion is defined, which provides room for more efficient constructions that rely almost completely only on symmetric key operations, and at the same time captures realistic settings for adversarial behavior.
Abstract: Many services that people use daily require computation that depends on the private data of multiple parties. While the utility of the final result of such interactions outweighs the privacy concerns related to output release, the inputs for such computations are much more sensitive and need to be protected. Secure multiparty computation (MPC) considers the question of constructing computation protocols that reveal nothing more about their inputs than what is inherently leaked by the output. There have been strong theoretical results that demonstrate that every functionality can be computed securely. However, these protocols remain unused in practical solutions since they introduce efficiency overhead prohibitive for most applications.
Generic multiparty computation techniques address homogeneous setups with respect to the resources available to the participants and the adversarial model. On the other hand, realistic scenarios present a wide diversity of heterogeneous environments where different participants have different available resources and different incentives to misbehave and collude. In this thesis we introduce techniques for multiparty computation that focus on heterogeneous settings. We present solutions tailored to address different types of asymmetric constraints and improve the efficiency of existing approaches in these scenarios. We tackle the question from three main directions:
• New Computational Models for MPC – We explore different computational models that enable us to overcome inherent inefficiencies of generic MPC solutions using circuit representation for the evaluated functionality. First, we show how we can use random access machines to construct MPC protocols that add only polylogarithmic overhead to the running time of the insecure version of the underlying functionality. This allows to achieve MPC constructions with computational complexity sublinear in the size for their inputs, which is very important for computations that use large databases.
We also consider multivariate polynomials which yield more succinct representations for the functionalities they implement than circuits, and at the same time a large collection of problems are naturally and efficiently expressed as multivariate polynomials. We construct an MPC protocol for multivariate polynomials, which improves the communication complexity of corresponding circuit solutions, and provides currently the most efficient solution for multiparty set intersection in the fully malicious case.
• Outsourcing Computation – The goal in this setting is to utilize the resources of a single powerful service provider for the work that computationally weak clients need to perform on their data. We present a new paradigm for constructing verifiable computation (VC) schemes, which enables a computationally limited client to verify efficiently the result of a large computation. Our construction is based on attribute-based encryption and avoids expensive primitives such as fully homomorphic encryption and probabilistically checkable proofs underlying existing VC schemes. Additionally our solution enjoys two new useful properties: public delegation and verification.
We further introduce the model of server-aided computation where we utilize the computational power of an outsourcing party to assist the execution and improve the efficiency of MPC protocols. For this purpose we define a new adversarial model of non-collusion, which provides room for more efficient constructions that rely almost completely only on symmetric key operations, and at the same time captures realistic settings for adversarial behavior. In this model we propose protocols for generic secure computation that offload the work of most of the parties to the computation server. We also construct a specialized server-aided two party set intersection protocol that achieves better efficiencies for the two participants than existing solutions.
Outsourcing in many cases concerns only data storage and while outsourcing the data of a single party is useful, providing a way for data sharing among different clients of the service is the more interesting and useful setup. However, this scenario brings new challenges for access control since the access control rules and data accesses become private data for the clients with respect to the service provide. We propose an approach that offers trade-offs between the privacy provided for the clients and the communication overhead incurred for each data access.
• Efficient Private Search in Practice – We consider the question of private search from a different perspective compared to traditional settings for MPC. We start with strict efficiency requirements motivated by speeds of available hardware and what is considered acceptable overhead from practical point of view. Then we adopt relaxed definitions of privacy, which still provide meaningful security guarantees while allowing us to meet the efficiency requirements. In this setting we design a security architecture and implement a system for data sharing based on encrypted search, which achieves only 30% overhead compared to non-secure solutions on realistic workloads.
22 citations
References
More filters
01 Jan 1987
TL;DR: This work presents a polynomial-time algorithm that, given as a input the description of a game with incomplete information and any number of players, produces a protocol for playing the game that leaks no partial information, provided the majority of the players is honest.
Abstract: We present a polynomial-time algorithm that, given as a input the description of a game with incomplete information and any number of players, produces a protocol for playing the game that leaks no partial information, provided the majority of the players is honest. Our algorithm automatically solves all the multi-party protocol problems addressed in complexity-based cryptography during the last 10 years. It actually is a completeness theorem for the class of distributed protocols with honest majority. Such completeness theorem is optimal in the sense that, if the majority of the players is not honest, some protocol problems have no efficient solution [C].
3,579 citations
"Round Efficient Unconditionally Sec..." refers background in this paper
...MPC is one of the most important and fundamental problems in secure distributed computing and has been studied extensively in different settings (see [19, 11, 5, 6, 18, 1, 12, 10, 2, 4, 3, 16] and their references)....
[...]
03 Nov 1982
TL;DR: This paper describes three ways of solving the millionaires’ problem by use of one-way functions (i.e., functions which are easy to evaluate but hard to invert) and discusses the complexity question “How many bits need to be exchanged for the computation”.
Abstract: Two millionaires wish to know who is richer; however, they do not want to find out inadvertently any additional information about each other’s wealth. How can they carry out such a conversation? This is a special case of the following general problem. Suppose m people wish to compute the value of a function f(x1, x2, x3, . . . , xm), which is an integer-valued function of m integer variables xi of bounded range. Assume initially person Pi knows the value of xi and no other x’s. Is it possible for them to compute the value of f , by communicating among themselves, without unduly giving away any information about the values of their own variables? The millionaires’ problem corresponds to the case when m = 2 and f(x1, x2) = 1 if x1 < x2, and 0 otherwise. In this paper, we will give precise formulation of this general problem and describe three ways of solving it by use of one-way functions (i.e., functions which are easy to evaluate but hard to invert). These results have applications to secret voting, private querying of database, oblivious negotiation, playing mental poker, etc. We will also discuss the complexity question “How many bits need to be exchanged for the computation”, and describe methods to prevent participants from cheating. Finally, we study the question “What cannot be accomplished with one-way functions”. Before describing these results, we would like to put this work in perspective by first considering a unified view of secure computation in the next section.
3,510 citations
"Round Efficient Unconditionally Sec..." refers background in this paper
...Secure Multiparty Computation (MPC): Secure multiparty computation (MPC) [19] allows a set of n parties P = {P1, ....
[...]
...MPC is one of the most important and fundamental problems in secure distributed computing and has been studied extensively in different settings (see [19, 11, 5, 6, 18, 1, 12, 10, 2, 4, 3, 16] and their references)....
[...]
Proceedings Article•
01 Jan 1988
TL;DR: The above bounds on t , where t is the number of players in actors, are tight!
Abstract: Every function of n inputs can be efficiently computed by a complete network of n processors in such a way that:t are tight!
- If no faults occur, no set of size
t <n /2 of players gets any additional information (other than the function value), - Even if Byzantine faults are allowed, no set of size
t <n /3 can either disrupt the computation or get additional information.
2,298 citations
"Round Efficient Unconditionally Sec..." refers background in this paper
..., O(D)) [5, 13], to the best of our knowledge, our UMPC protocol is the first optimally resilient UMPC protocol with n = 2t+1, to provide the same....
[...]
...It is known that perfectly secure MPC tolerating At is possible iff n ≥ 3t + 1 and every two parties are directly connected by a secure channel [5]....
[...]
...MPC is one of the most important and fundamental problems in secure distributed computing and has been studied extensively in different settings (see [19, 11, 5, 6, 18, 1, 12, 10, 2, 4, 3, 16] and their references)....
[...]
01 Jan 1988
TL;DR: In this article, the authors show that every function of n inputs can be efficiently computed by a complete network of n processors in such a way that if no faults occur, no set of size t can be found.
Abstract: Every function of n inputs can be efficiently computed by a complete network of n processors in such a way that: If no faults occur, no set of size t
2,207 citations
01 Jan 1982
TL;DR: The author gives a precise formulation of this general problem and describes three ways of solving it by use of one-way functions, which have applications to secret voting, private querying of database, oblivious negotiation, playing mental poker, etc.
Abstract: The author investigates the following problem: Suppose m people wish to compute the value of a function f(x1, x2, x3, ..., xm), which is an integer-valued function of m integer variables xi of bounded range. Assume initially person Pi knows the value of xi and no other x's. Is it possible for them to compute the value of f, by communicating among themselves, without unduly giving away any information about the values of their own variables? The author gives a precise formulation of this general problem and describe three ways of solving it by use of one-way functions (i.e., functions which are easy to evaluate but hard to invert). These results have applications to secret voting, private querying of database, oblivious negotiation, playing mental poker, etc.. He also discusses the complexity question "How many bits need to be exchanged for the computation," and describes methods to prevent participants from cheating. Finally, he studies the question "What cannot be accomplished with one-way functions."
1,894 citations