Secure Computation in Heterogeneous Environments: How to Bring Multiparty Computation Closer to Practice?
Total Page：16
File Type：pdf, Size：1020Kb
Secure Computation in Heterogeneous Environments: How to Bring Multiparty Computation Closer to Practice? Mariana Raykova Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in the Graduate School of Arts and Sciences COLUMBIA UNIVERSITY 2012 c 2012 Mariana Raykova All Rights Reserved ABSTRACT Secure Computation in Heterogeneous Environments: How to Bring Multiparty Computation Closer to Practice? Mariana Raykova Many services that people use daily require computation that depends on the private data of multiple parties. While the utility of the final result of such interactions outweighs the privacy concerns related to output release, the inputs for such computations are much more sensitive and need to be protected. Secure multiparty computation (MPC) considers the question of constructing computation protocols that reveal nothing more about their inputs than what is inherently leaked by the output. There have been strong theoretical results that demonstrate that every functionality can be computed securely. However, these protocols remain unused in practical solutions since they introduce efficiency overhead prohibitive for most applications. Generic multiparty computation techniques address homogeneous setups with respect to the resources available to the participants and the adversarial model. On the other hand, realistic scenarios present a wide diversity of heterogeneous environments where different participants have different available resources and different incentives to misbehave and collude. In this thesis we introduce techniques for multiparty computation that focus on heterogeneous settings. We present solutions tailored to address different types of asymmetric constraints and improve the efficiency of existing approaches in these scenarios. We tackle the question from three main directions: • New Computational Models for MPC { We explore different computational models that enable us to overcome inherent inefficiencies of generic MPC solutions using circuit representation for the evaluated functionality. First, we show how we can use random access machines to construct MPC protocols that add only polylogarithmic overhead to the running time of the insecure version of the underlying functionality. This allows to achieve MPC constructions with computational complexity sublinear in the size for their inputs, which is very important for computations that use large databases. We also consider multivariate polynomials which yield more succinct representations for the functionalities they implement than circuits, and at the same time a large collection of prob- lems are naturally and efficiently expressed as multivariate polynomials. We construct an MPC protocol for multivariate polynomials, which improves the communication complex- ity of corresponding circuit solutions, and provides currently the most efficient solution for multiparty set intersection in the fully malicious case. • Outsourcing Computation { The goal in this setting is to utilize the resources of a single powerful service provider for the work that computationally weak clients need to perform on their data. We present a new paradigm for constructing verifiable computation (VC) schemes, which enables a computationally limited client to verify efficiently the result of a large computation. Our construction is based on attribute-based encryption and avoids expensive primitives such as fully homomorphic encryption and probabilistically checkable proofs underlying existing VC schemes. Additionally our solution enjoys two new useful properties: public delegation and verification. We further introduce the model of server-aided computation where we utilize the computa- tional power of an outsourcing party to assist the execution and improve the efficiency of MPC protocols. For this purpose we define a new adversarial model of non-collusion, which provides room for more efficient constructions that rely almost completely only on symmetric key operations, and at the same time captures realistic settings for adversarial behavior. In this model we propose protocols for generic secure computation that offload the work of most of the parties to the computation server. We also construct a specialized server-aided two party set intersection protocol that achieves better efficiencies for the two participants than existing solutions. Outsourcing in many cases concerns only data storage and while outsourcing the data of a single party is useful, providing a way for data sharing among different clients of the service is the more interesting and useful setup. However, this scenario brings new challenges for access control since the access control rules and data accesses become private data for the clients with respect to the service provide. We propose an approach that offers trade-offs between the privacy provided for the clients and the communication overhead incurred for each data access. • Efficient Private Search in Practice { We consider the question of private search from a different perspective compared to traditional settings for MPC. We start with strict efficiency requirements motivated by speeds of available hardware and what is considered acceptable overhead from practical point of view. Then we adopt relaxed definitions of privacy, which still provide meaningful security guarantees while allowing us to meet the efficiency requirements. In this setting we design a security architecture and implement a system for data sharing based on encrypted search, which achieves only 30% overhead compared to non-secure solutions on realistic workloads. Table of Contents 1 Introduction 1 1.1 Contributions . .6 1.1.1 New Models for Secure Computation . .6 1.1.2 Outsourcing Computation . .8 1.1.3 Efficient Private Search in Practice . 10 2 Related Work 12 2.0.4 Secure Multiparty Computation . 12 2.0.5 Delegation of Computation . 15 2.0.6 Secure Search . 16 2.0.7 Oblivious Random Access Memory (ORAM) . 18 I New Computational Models 20 3 Secure Computation with Sublinear Amortized Work 21 3.1 Motivation and Contributions . 21 3.2 Solution Overview . 22 3.3 Preliminaries . 24 3.3.1 Random Access Machines . 24 3.3.2 Oblivious RAM . 25 3.3.3 Secure Computation . 27 3.4 Generic Construction . 29 3.4.1 Proof of Security . 32 i 3.5 An Optimized Protocol . 34 3.5.1 Technical Overview . 35 3.5.2 Building Blocks . 37 3.5.3 Our Construction . 46 3.5.4 Discussion: Bucket Size . 50 3.6 Security Proof . 51 3.7 Performance . 60 4 Secure Multiparty Computation for Multivariate Polynomials 61 4.1 Motivation and Contributions . 61 4.1.1 Our Contributions . 62 4.2 Solution Overview . 66 4.3 Definitions and Techniques . 68 4.3.1 Definitions . 68 4.3.2 Techniques . 69 4.4 Building Block Protocols . 71 4.4.1 Multiparty Homomorphic Encryption Proof of Knowledge and Plaintext Ver- ification (HEPKPV) . 72 4.4.2 Multiparty Coin Tossing . 73 4.4.3 Input Preprocessing and Verification . 75 4.5 Main Protocol . 77 4.5.1 Security analysis . 79 4.6 Communication and Computation Complexity . 88 4.7 Multiparty Set Intersection and Other Applications . 89 4.7.1 Optimizations . 89 4.7.2 Multiparty Set Intersection as Polynomial Evaluation . 90 II Outsourced Computation 92 5 How to Delegate and Verify in Public: Verifiable Computation from Attribute- based Encryption 93 ii 5.1 Motivation and Contributions . 93 5.1.1 Our Contributions . 96 5.2 Definitions . 99 5.2.1 Public Verifiable Computation . 99 5.2.2 Key-Policy Attribute-Based Encryption . 103 5.2.3 Multi-Function Verifiable Computation . 105 5.3 Verifiable Computation from Attribute-Based Encryption . 108 5.3.1 Main Construction . 109 5.3.2 Instantiations . 113 5.4 Multi-Function Verifiable Computation from KP-ABE With Outsourcing . 116 6 Outsourcing Multi-Party Computation with Non-Colluding Adversaries 120 6.1 Motivation and Contributions . 120 6.1.1 Our Contributions . 121 6.2 Overview of Protocols . 124 6.3 Preliminaries and Standard Definitions . 127 6.4 Non-Collusion in Multi-Party Computation . 129 6.4.1 Formalizing Non-Collusion With Respect to Semi-Honest Adversaries . 131 6.4.2 Formalizing Non-Collusion With Respect to Deviating Adversaries . 134 6.5 An Efficient Protocol for Non-Colluding Semi-Honest Parties . 139 6.6 Protecting Against Deviating Circuit Garblers . 145 6.6.1 What goes wrong in the server-aided setting? . 147 6.6.2 Extending to Multiple Parties . 157 6.7 Server-Aided Computation From Delegated Computation . 158 6.8 Server-Aided Private Set Intersection . 163 6.9 Efficiency in the Server-Aided Setting . 168 6.9.1 Evaluating the Efficiency Gain . 168 6.9.2 Comparison with Secure Delegated Computation . 170 6.9.3 Why Non-Collusion Helps . 171 iii 7 Privacy Enhanced Access Control for Outsourced Data Sharing 172 7.1 Motivation and Contributions . 172 7.1.1 Contributions . 175 7.2 Two-level Access Control Model { Solution Overview . 176 7.3 Access Control Model . 178 7.4 Read Access Control . 180 7.4.1 Techniques . 181 7.4.2 Read Access Control . 184 7.5 Write Access Control . 187 7.5.1 Techniques . 188 7.5.2 Integrated Read and Write Access Control . 189 7.6 Analysis . 192 7.6.1 Security Guarantees . 192 7.6.2 Performance Analysis . 194 7.6.3 Discussion . ..