Secure Computation Over Encrypted Data Liangliang Xiao.
-
Upload
stanley-waters -
Category
Documents
-
view
226 -
download
3
Transcript of Secure Computation Over Encrypted Data Liangliang Xiao.
Secure Computation Over Encrypted Data
Liangliang Xiao
Cloud Customers outsource their data & computing needs to cloud
Hardware technology hits its limit Systems become harder to maintain
Security issues in cloud Adversaries attacks Human error
Mistakenly sending disks with bank files to eBay [Ham03]
Reorganization or buyout [Nan04]
Introduction
Salary
…
x1
xn
SELECT SUM(salary)
x1+…+ xn
Introduction
Protect data in the cloud Encryption
How to process the encrypted data? Decrypt data for computation (not secure!) Key should be stored with the data at the server (not secure!)
Computing directly on encrypted data
Existing Works
Homomorphic Encryption (HE) Order-preserving Encryption (OPE) Prefix-preserving Encryption (PPE)
HE
Encryption function has homomorphic properties
E(x + y) = E(x) + E(y)E(x * y) = E(x) * E(y)
HE
Encryption function has homomorphic properties
HE supports computations on ciphertexts
Salary
…
E(x1)
E(xn)
E(x + y) = E(x) + E(y)E(x * y) = E(x) * E(y)
HE
Encryption function has homomorphic properties
HE supports computations on ciphertexts
Salary
…
E(x1)
E(xn)
SELECT SUM(salary)
E(x + y) = E(x) + E(y)E(x * y) = E(x) * E(y)
HE
Encryption function has homomorphic properties
HE supports computations on ciphertexts
Salary
…
E(x1)
E(xn)
SELECT SUM(salary)
E(x1+…+ xn)
DB computes E(x1+…+ xn) = E(x1) +…+ E(xn)
E(x + y) = E(x) + E(y)E(x * y) = E(x) * E(y)
HE
Encryption function has homomorphic properties
HE supports computations on ciphertexts
Salary
…
E(x1)
E(xn)
SELECT SUM(salary)
E(x1+…+ xn)
Alice decrypts to get x1+…+ xn
DB computes E(x1+…+ xn) = E(x1) +…+ E(xn)
E(x + y) = E(x) + E(y)E(x * y) = E(x) * E(y)
Example of “Partial” HE
RSA E(x) = xe mod n
e is the public key n = p ∙ q
Homomorphic with respect to multiplication E(x) * E(y) = xe * ye = (x * y)e = E(x * y)
Not homomorphic with respect to addition E(x) + E(y) = xe + ye ≠ (x + y)e = E(x + y)
Existing HEs
Boolean circuit based HE Plaintexts {0,1} Gentry’s construction [Gen09]
High security level but expensive computation
Ring based HE Plaintexts ZN
Efficient than Boolean circuit based HE
Polly Cracker encryption scheme [Fel94] Lack conclusive security evidence
OPE
Encryption preserves order
x < y E(x) < E(y)
Encryption preserves order
OPE supports range searches on ciphertexts
OPE
Salary
…
OPE(x1)
OPE(xn)
Name
E(N1)
…
E(Nn)
x < y E(x) < E(y)
Encryption preserves order
OPE supports range searches on ciphertexts
OPE
Salary
…
OPE(x1)
OPE(xn)
SELECT NameWhere Salary > OPE(a)
Name
E(N1)
…
E(Nn)
x < y E(x) < E(y)
OPE
Encryption preserves order
OPE supports range searches on ciphertexts
Salary
…
OPE(x1)
OPE(xn)
SELECT NameWhere Salary > OPE(a)
E(Ni)
Name
E(N1)
…
E(Nn)DB returns E(Ni) if OPE(xi) > OPE(a)
x < y E(x) < E(y)
OPE
Encryption preserves order
OPE supports range searches on ciphertexts
Salary
…
OPE(x1)
OPE(xn)
SELECT NameWhere Salary > OPE(a)
E(Ni)
Alice decrypts E(Ni) to get Ni
Name
E(N1)
…
E(Nn)DB returns E(Ni) if OPE(xi) > OPE(a)
x < y E(x) < E(y)
Existing OPEs
RN Randomly generate r1, …, rx, …, ry, …
Poly Randomly generate a strict increasing polynomial f
x E(x) = r1 + … + rx
f
y
E(x)
y E(y) = r1 + … + rx + … + ry
x
E(y)
PPE
Encryption preserves prefix
101000 → 001010
101110 → 001111
Plaintexts Ciphertexts
PPE
Encryption preserves prefix
Range searches can be transformed to prefix-matching search [32, 111] [00100000, 01101111] {001*, 010*, 0110*}
101000 → 001010
101110 → 001111
Plaintexts Ciphertexts
PPE
PPE supports range searches on ciphertexts
Salary
…
PPE(x1)
PPE(xn)
Name
E(N1)
…
E(Nn)
PPE
PPE supports range searches on ciphertexts
Salary
…
PPE(x1)
PPE(xn)
Name
E(N1)
…
E(Nn)
SELECT NameWhere Salary = PPE(aj), 1 ≤ j ≤ m
PPE
PPE supports range searches on ciphertexts
E(Ni)
DB returns PPE(xi) if PPE(aj) is its prefix
Salary
…
PPE(x1)
PPE(xn)
Name
E(N1)
…
E(Nn)
SELECT NameWhere Salary = PPE(aj), 1 ≤ j ≤ m
PPE supports range searches on ciphertexts
PPE
E(Ni)
Alice decrypts E(Ni) to get Ni
DB returns PPE(xi) if PPE(aj) is its prefix
Salary
…
PPE(x1)
PPE(xn)
Name
E(N1)
…
E(Nn)
SELECT NameWhere Salary = PPE(aj), 1 ≤ j ≤ m
Main problem of the Existing Works
HE/OPE/PPE only consider one encryption key One encryption key
DB colludes with any user compromise all data
Different users use different keys Computation cannot be performed
…
collude
Other Problems
HE Circuit-based HE has very high computation cost
Gentry’s algorithm
32-bit integer addition 900 s
32-bit integer multiplication 67,000 s 18 hours
Gentry’s algorithm:• Computation of each binary operation is 6 seconds [Gen]• Multiplication requires ~ 11,000 gates; Addition requires 160 gates [Mor]
Other Problems
Attacks against OPE Suppose A knows (m/2, OPE(m/2))
Plaintexts {1, …, m}
A can retrieve the most significant bit of other cipherterxts Need to qualify the security of OPE
OPE(m/2)
m/2
Other Problems
Attacks against OPE Suppose A knows (m/2, OPE(m/2))
Plaintexts {1, …, m}
A can retrieve the most significant bit of other cipherterxts Need to qualify the security of OPE
OPE(m/2)
m/2
ciphertext ciphertext
Other Problems
Existing security analysis Reduce the security of the real OPE scheme to the ideal OPE
object
Other Problems
Existing security analysis Reduce the security of the real OPE scheme to the ideal OPE
object Ideal OPE
The encryption function is uniformly randomly selected from all order-preserving functions
All OPE functionsRandomly selected
Encryption function
Other Problems
Existing security analysis Reduce the security of the real OPE scheme to the ideal OPE
object Ideal OPE
The encryption function is uniformly randomly selected from all order-preserving functions
No security analysis of the ideal OPE object
All OPE functionsRandomly selected
Encryption function
Objective of My Research
Bridge the gaps HE
Design a more efficient HE algorithm Enhance it for multi-user systems
OPE Prove the security of the ideal OPE object Develop a multi-user OPE protocol
PPE Prove the security of the ideal PPE object Design a multi-user PPE protocol based on an existing PPE
Objective of My Research
Bridge the gaps HE
Design a more efficient HE algorithm Enhance it for multi-user systems
OPE Prove the security of the ideal OPE object Develop a multi-user OPE protocol
PPE Prove the security of the ideal PPE object Design a multi-user PPE protocol based on an existing PPE
Basic construction (ring based) E(x, k) = M
M is a matrix with the eigenvalue x w.r.t. the eigenvector k Over ring ZN where N = p ∙ q
Homomorphic in addition and multiplication x ∙ k = M ∙ k and y ∙ k = M’ ∙ k (x + y) ∙ k = (M + M’) ∙ k
(x ∙ y) ∙ k = (M ∙ M’) ∙ k
Our HE Construction
x ∙ k = M ∙ k
ZN
[ [] ][ ]
Security Definition
Attack model Adversary knows some plaintext/ciphertext pairs Adversary tries to reverse another ciphertext
Called challenge
Attack based on plaintext/ciphertext pair (x, M) Solve k from x ∙ k = M ∙ k
x has the only eigenvector k
Use k to reverse other ciphertexts
Security Analysis
Solve k
x ∙ k = M ∙ k
ZN
[ [] ][ ]
Our HE Construction
Need to improve the basic construction One common eigenvector homomorphic computation Second distinct eigenvector resist the attack
Improved Construction Consider 44 matrix k, u, v, w are randomly chosen eigenvectors
Our HE Construction
Improved Construction Associate x with k and z
z = u, v, or w subject to a distribution D
Randomly select r Associate r with two remaining eigenvectors
M
x r
k u v w
M
x r
k v u w
M
x r
k w u v
Our HE Construction
Consider m rings
ZN
k1
k2
km
k
p
p
ppm
Zf1
Zf2
Zfm
. . .
Security of Our HE
Security Theorem: the probability for the adversary to reverse any
other ciphertext is pm
p = 1 (1 q) qn
pm becomes negligibly small if n < m ln poly() is the security parameter
Achieves one-wayness security Further computes q to minimize (1 (1 q) qn)m
q is the probability that x is associated with u q = 1 1/n
Performance Comparison
Compare our algorithm with Gentry’s
Gentry’s algorithm Our algorithm
32-bit integer addition 900 s 0.0992 ms
32-bit integer multiplication
67,000 s 18 hours
108 ms
Space cost 1 bit → 200,000 bits 1024 bits → 262,144 bits
Our algorithm• Choose m = 16 to sustain 1109 chosen plaintext attacks
Gentry’s algorithm:• Computation of each binary operation is 6 seconds [Gen]• Multiplication requires ~ 11,000 gates; Addition requires 160 gates [Mor]
Objective of My Research
Bridge the gaps HE
Design a more efficient HE algorithm Enhance it for multi-user systems
OPE Prove the security of the ideal OPE object Develop a multi-user OPE protocol
PPE Prove the security of the ideal PPE object Design a multi-user PPE protocol based on an existing PPE
HE for Multi-User System
Key transformation similarity transform k’ ∙ E(x, k) ∙ k’ −1 = E(x, k’ ∙ k)
HE for Multi-User System
Key transformation similarity transform k’ ∙ E(x, k) ∙ k’ −1 = E(x, k’ ∙ k)
Request protocol kj – user key
Different user holds different user key
kj’ and kj’’ – matching key
mk – master key
Response protocol – reverse the request protocol
User Uj Key agent DB
Hold key kj’Hold key kj Hold key kj’’
E(x, kj) E(x, kj’ ∙ kj)
kj’’ kj’ kj = mk
E(x, mk)x
HE for Multi-User System
Security Theorem: Our Protocols are as secure as HE unless both DB
and KA are compromised
Further security improvement Use a chain of KAs
Performance Study
Request/Response Protocols User ; DB Key agent
Performance Study
Results λ – data length NE = “No Encryption” HE – Q = DB received the data encrypted by user HE – P = User decrypts the data sent from DB
λ (bit) NE (ms) HE - Q (ms)
HE - P (ms)
Request Protocol
(ms)
Response Protocol
(ms) 32 86.03 301.03 120.03 807 80664 86.23 301.23 120.23 807 806
1024 91.62 306.99 125.62 807 806
Objective of My Research
Bridge the gaps HE
Design a more efficient HE algorithm Enhance it for multi-user systems
OPE Prove the security of the ideal OPE object Develop a multi-user OPE protocol
PPE Prove the security of the ideal PPE object Design a multi-user PPE protocol based on an existing PPE
Security Analysis of the Ideal OPE
Security metric zh = Average # of secure bits of plaintext under h known
plaintext attacks
= H~∞(X | Y, KPh) H~∞ is the average min-entropy
X is the plaintext, Y is a challenge (randomly generated ciphertext) KPh is h plaintext ciphertext pairs known by the adversary
Challenge of computing zh
It is difficult to find close-form expression for zh
Security Analysis of the Ideal OPE
Instead, estimate the upper and lower bounds on zh
Upper bound on zh Choose KPh = { (xi, E*(xi)) | xi = i∙(m+1)/(h+1), 1≤i≤h }
xi is uniformly distributed
zh ≤ log2(m−h)/(h+1)
Lower bound on zh
Don’t know the strongest plaintext attack, how?
x1 x2xhx3
…
Security Analysis of the Ideal OPE
Our approach to estimate the lower bound on zh
Observation KPh divides the domain and range
to h+1 subdomains and subranges KPh = {(xi, yi)}1≤i≤h
No plaintext attack within each
subdomains and subranges
Estimate the lower bound for the case of no plaintext attack Defined as z0
Apply z0 to each subdomain and subrange (xi,yi) are variables
Accordingly, estimate zh ≥ clog2(m−h)/(h+1) Optimize the h (xi,yi) pairs
0 < c < 1
xj
yj
[m]
[n]
xj+1
yj+1
No plaintext attack
Security Analysis of the Ideal OPE
zh = Θ(log2(m−h)/(h+1)) for n ≥ m3
Combine the lower bound and upper bound Θ denotes the big-theta notion
Theorem: constant ratio of bits are secure
Objective of My Research
Bridge the gaps HE
Design a more efficient HE algorithm Enhance it for multi-user systems
OPE Prove the security of the ideal OPE object Develop a multi-user OPE protocol
PPE Prove the security of the ideal PPE object Design a multi-user PPE protocol based on an existing PPE
OPE for Multi-User System
Challenge All data should be encrypted by one key
Simple solution: One key agent holds the key and encrypt the data for users
Has to have some knowledge of the key in order to encrypt
No entity should hold the encryption key
But how to encrypt the data? Possible solution:
Use a group of key agents to “distributedly” encrypt the data How to design it so that the resulting ciphertexts are still
order-preserving? Existing data sharing schemes cannot achieve this
Basic-DOPE (digit-based OPE) User partitions the plaintext into “digits” Each key agent encrypts a single “digit” DB integrates the encrypted “digits”
Request protocol
Basic-DOPE (digit-based OPE) User partitions the plaintext into “digits” Each key agent encrypts a single “digit” DB integrates the encrypted “digits”
Request protocol
User DB
…
KA1 with k1
KAp with kp
…
KAj with kj
Basic-DOPE (digit-based OPE) User partitions the plaintext into “digits” Each key agent encrypts a single “digit” DB integrates the encrypted “digits”
User DB
…
KA1 with k1
KAp with kp
x1
xp
Request protocol
…
KAj with kj
xj
Expresses x in base A number system, i.e., x = 1j≤p xj · Aj−1
Basic-DOPE (digit-based OPE) User partitions the plaintext into “digits” Each key agent encrypts a single “digit” DB integrates the encrypted “digits”
User DB
…
KA1 with k1
KAp with kp yp
y1x1
xp
Request protocol
KAj encrypts xj by an OPE with kj
…
KAj with kj
xjyj
Basic-DOPE (digit-based OPE) User partitions the plaintext into “digits” Each key agent encrypts a single “digit” DB integrates the encrypted “digits”
User DB
…
KA1 with k1
KAp with kp yp
y1x1
xp
Request protocol
DB integrates the ciphertext COPE(x) = 1j≤p yj · Bj−1
In the base B number system
…
KAj with kj
xjyj
Example Base A = 10; base B = 20 p = 3
User DB
KA1 with k1
KA3 with k3y3 = OPE(5, k3)
y1 = OPE(3, k1)3
5
Request protocol
DB integrates the ciphertext COPE(x) = y3*202 + y2*20 + y1
User maps 583 to (5, 8, 3)
x = 583
KA2 with k28
y2 = OPE(8, k2)
KAj encrypts xj by an OPE with kj
If DB and one KA are compromised The adversary can get one “digit” of each data in DB
Security Issues of Basic-DOPE
User DB
KA1 with k1
KA3 with k3
KA2 with k2
Uses k3 to decrypt this digit
OPE( 5 8 3)
3
5
8
OPE(5, k3)
OPE(3, k1)
OPE(8, k2)
OPE( 2 5 6)
OPE( 7 3 1)
…
…
Solution Substitute each KA by a chain of key agents
Security Issues of Basic-DOPE
User DB
KA12 with k12
KA32 with k32z3=OPE(y3, k32)
z1=OPE(y1, k12)3
5
x = 583
KA22 with k228
z2=OPE(y2, k22)
KA11 with k11
KA31 with k31
KA21 with k21
y3=OPE(5, k31)
y1=OPE(3, k11)
y2=OPE(8, k21)
If the first KA in the chain is compromised A views the raw “digit”
Potential solution: Two party computation Too expensive
Security Issues of Basic-DOPE
can views raw digit
User DB
KA12 with k12
KA32 with k32
3
5
x = 583
KA22 with k228
KA11 with k11
KA31 with k31
KA21 with k21
OE-DOPE
OE (Oblivious Encryption)
OE-DOPE
OE (Oblivious Encryption) “digit” x “micro-digits” (x1, x2, …, xu)
Inserting micro-digits into random matrix
User Key agent DBEncrypt elements in the matrix …
r r x1 r r
r r r r x2
r x3 r r r
x4 r r r r
OE-DOPE
OE (Oblivious Encryption) “digit” x “micro-digits” (x1, x2, …, xu)
Inserting micro-digits into random matrix
User Key agent DBEncrypt elements in the matrix …
DB knows which micro-digit to select and encrypt further
r r x1 r r
r r r r x2
r x3 r r r
x4 r r r r
(1,3), (2,5), (3,2), (4,1)
Position information
OE-DOPE
OE (Oblivious Encryption) “digit” x “micro-digits” (x1, x2, …, xu)
Inserting micro-digits into random matrix
User Key agent DBEncrypt elements in the matrix …
DB knows which micro-digit to select and encrypt further
r r x1 r r
r r r r x2
r x3 r r r
x4 r r r r
(1,3), (2,5), (3,2), (4,1)
Position information
The probability to derive digit x is negligibly small
OPE for Multi-User Systems
Response Protocol Can simply reverse the request protocol
Response may contain a large number of confidential data Reverse protocol can be very inefficient
DB maintains CCE(x) Encrypted using a conventional encryption (e.g AES) Key is granted to users with access privilege
User DBCCE(x)
Maintains COPE(x) and CCE(x)
Properties of OE-DOPE
Security Theorem: the probability for A to retrieve any “digit” is
negligible if The underlying OPE has one-wayness security A cannot compromise all the key agents in a chain simultaneously
Versatile Our OE-DOPE can be applied to any OPE algorithm
Performance Study
Basic-DOPE: 4 key agents User ; DB Key agent
Performance Study
OE-DOPE: 4 * 2 = 8 key agents User ; DB Key agent
Performance Study
Results for OPE Poly and Hyper λ – data length NE = “No Encryption”
λ (bit)
NE (ms)
Poly (ms)
Basic-DOPE + Poly (ms)
OE-DOPE + Poly (ms)
Hyper (ms)
Basic-DOPE + Hyper (ms)
OE-DOPE + Hyper (ms)
8 85.87 85.87 166.62 194.35 106.24 506.06 7718.9032 86.03 86.03 167.83 214.18 20537 9.19E+0764 86.23 86.23 169.32 239.34 4965977.56
128 86.64 86.64 172.05 285.091024 91.62 91.99 197.23 786.72
Basic - DOPE is at most 2 times slower
OE - DOPE is at most 8 times slower
OE-DOPE is more expensive but more secure
Objective of My Research
Bridge the gaps HE
Design a more efficient HE algorithm Enhance it for multi-user systems
OPE Prove the security of the ideal OPE object Develop a multi-user OPE protocol
PPE Prove the security of the ideal PPE object Design a multi-user PPE protocol based on an existing PPE
PPE
Prove the security of the ideal PPE object Weaken the security notion from IND-CPA to IND-PCPA Show that IND-PCPA can exactly qualify the security of the
ideal PPE object By mapping the prefix-preserving function to tree-based function
Design a multi-user PPE protocol Based on an existing PPE construction, which consists
A pseudo random function (PRF) A least significant bit extractor (LSB)
Distributedly compute PRF by DL Remove LSB
But will cause the ciphertext to be too long Develop a reduction method to reduce the size
Future Research
Theoretical work Further improve the security and performance of HE Construct better OPE and PPE algorithms to achieve better
security and improved performance
OPE PPE
IND-OCPA ? IND-PCPA √
One-wayness security √ One-wayness security ?
Future Research
HE application Current key management systems have a centralized
manager to generate and refresh keys and validate entities In a large scale system, centralized solution won’t work
E.g., the SCADA (supervisory control and data acquisition) system includes a large number of meters and devices
Expected to have billions of entities
Distributed key management Individual key managers will not be as trustworthy Probability of one of the many key managers being malicious or
compromised is very high
Use HE for key manager computation Large data space, uniform distribution suitable to our HE
HE application
Centralized key manager
Distributed key manager
Key manager
HE application
Centralized key manager
Distributed key manager
Key manager
HEHE HE
Future Research
OPE application Privacy preserving data mining
Decision tree (with continuous attributes) For each step, an attribute X and threshold t is selected Compute the information gain about X and t
o Comparisons are needed to determine the number of instances in each class
Use our multi-user OPE Handle training data from different sources Privacy requirement: Each data owner wishes not to disclose its data
to other parties
OPE application
Privacy preserving data mining
Data owner
Data owner
Data owner
…
…
…… … …
… yij …
… … …
… … …
… xij …
… … …
… … …
… zij …
… … …
Data mining
Multi-user OPE
OPE application
Privacy preserving data mining
Data owner
Data owner
Data owner
…
…
…… … …
… yij …
… … …
… … …
… xij …
… … …
… … …
… zij …
… … …
Data mining
Future Research
PPE application Anonymous analysis of internet traffic traces
E.g., study web performance, routing performance analysis, or clustering of end-systems
Traffic log owners hesitate to make the traces public Leak the identities of senders and receivers
Use our PPE protocol Handle traffic data from different sources Privacy requirement: No entity in the system has a global knowledge
to the traffic information
Question?