Presentation is loading. Please wait.

Presentation is loading. Please wait.

Lower and Upper Bounds on Obtaining History Independence Niv Buchbinder and Erez Petrank Technion, Israel.

Similar presentations


Presentation on theme: "Lower and Upper Bounds on Obtaining History Independence Niv Buchbinder and Erez Petrank Technion, Israel."— Presentation transcript:

1 Lower and Upper Bounds on Obtaining History Independence Niv Buchbinder and Erez Petrank Technion, Israel

2 What is History Independent Data- Structure ? Sometimes data structures keep unnecessary information. –not accessible via the legitimate interface of the data structure, –can be restored from the data-structure layout. A privacy issue if an adversary gains control over the data-structure layout. The core problem: history of operations applied on the data-structure may be revealed.

3 Example Data structure with three operations: Insert(D, x) Remove(D, x) Print(D) Used for a wedding invitee list. Naive Implementation – an array. Insert – adds last entry. Remove entry i – move entries i+1 to n backwards (wiser implementation - linked list on an array) Layout implies the order. For example, who was invited last !

4 Weak History Independence [Naor, Teague]: A Data structure implementation is (weakly) History Independent if: Any two sequences of operations S 1 and S 2 that yield the same content induce the same distribution on memory layout. Security: Nothing gained from layout beyond the content.

5 Example – cont. Making the previous data structure weakly history independent: Insert(x): (say, n elements in data-structure) –Choose uniformly at random r {1,2,…,n+1} –Set A[n+1] A[r]; A[r] x Remove entry i: A[i] A[n] The array is a uniformly chosen permutation on the elements

6 Weak History Independence Problems No Information leaks if adversary gets layout once (e.g., the laptop was stolen). But what if adversary may get layout several times ? Information on content modifications leaks. We want: no more information leakage.

7 Strong History Independence ¼ Pair of sequences S 1, S 2 ¼ two lists of stop points in S 1, S 2 If content is the same in each pair of corresponding stop points Then: Joint distribution of memory layouts at stop points is identical in the two sequences. [Naor-Teague]: A Data structure implementation is (Strongly) History Independent if: Security: We cannot distinguish between any such two sequences.

8 Strong History Independence S 1 = ins(1), ins(2), ins(3), ins(4) S 2 = ins(2), ins(1), ins(5), ins(4), ins(3), del(5) First stopSecond stop First stopSecond stop We should not be able to tell from the layouts which of the two sequences happened

9 Example – cont. Recall example: Insert(x) : (say, n elements in database) –Choose uniformly at random r {1,2,…,n+1} –Set A[n+1] A[r]; A[r] x Remove entry i: A[i] A[n] Is this implementation strongly history independent ? No !

10 Example – cont Assume you get the layout of the array twice: First time you see: Second time you see: What could not happen: The empty sequenceRemove(4), Insert(4) Lots of other constraints…

11 Example – last Making the data structure strongly history independent We can keep the array aligned left and sorted. Each content has only one possible layout. Problem: The time complexity of Insert and Remove is Ω(n), (Usually shift Ω (n) elements during insert or delete)

12 A Short History of History Independence [Micciancio97] Weak history independent 2-3 tree (motivated by the problem of private incremental cryptography [BGG95]). [Naor-Teague01] History-independent hash- table, union-find. Weak history-independent memory allocation. All above results are efficient. [HHMPR02] –Strong history independence means canonical layout. –Relaxation of strong history independence. –History independent memory resize.

13 Our Results 1.Strong history independence implies canonical memory layout. 2.Separations between strong & weak (lower bounds): Strong requires a much higher efficiency penalty in the comparison based model. 3.Proving (almost) the same lower bounds to a relaxed version of strong history independence. 4.Implementations (upper bounds): The heap has a weakly history independent implementation with no time complexity penalty.

14 Bounds Summary OperationWeak History Independence Strong History Independence heap: insertO(log n)Ω(n) heap: increase-keyO(log n)Ω(n) heap: extract-maxO(log n)No lower bound heap: build-heapO(n)Ω(n log n) queue: max{ insert- first, remove-last} O(1)Ω(n)

15 Why is Comparison Based implementation important? It is natural: –Standard implementations for most data structure operations are like that. –Therefore, we should know not to design this way when seeking strong history independence Library functions are easy to use: –Only implement the comparison operation on data structure elements.

16 Whats Next 1.Strong History Independence means Canonical Representation. 2.Lower Bounds on strong history independence. 3.Lower Bounds on relaxed strong history independence. 4.Obtaining a weak history independent heap.

17 Strong History Independence = Canonical Representation Definition [content graph]: The content graph of data-structure: Vertices: The possible contents. Edges: C 1 C 2 if operation OP and parameters σ such that OP(C 1, σ)= C 2. Definition [well behaved]: An abstract data- structure is well behaved if its content graph is strongly connected.

18 Strong History Independence = Canonical Representation Lemma: For any strongly history independent implementation of a well behaved data- structure: layout L, operation Op, Op(L) yields only one possible layout. Corollary: Any strongly history independent implementation of well-behaved data- structure is canonical.

19 Canonical Representation: Proof cont. Corollary: Any strongly history independent implementation of well-behaved data- structure is canonical. Proof sketch (assuming the lemma): Let S be a sequence of operations yielding content C. Each operation in S generates one layout. By induction S yields one possible layout. By strong history independence any other sequence yielding C creates the same layout.

20 Canonical Representation Proof of Lemma Lemma: For any strongly history independent implementation of a well behaved data- structure: layout L, operation Op, Op(L) yields only one possible layout. Assuming well-behaved, any operation Op has a sequence OP -1 that reverses Op. Assuming strong history independence we may set any two sequences with stop points.

21 Canonical Representation Proof of Lemma Proof sketch: Fix any layout L, fix any operation Op. We need to show that Op(L) yields a single specific layout L. Let S be any sequence of operation yielding L with probability > 0. Consider the following sequences with the following stop points: S 1 = S S 2 = S Op OP The two stop points are the same in S 1. The same layout must also appear in S 2.

22 Canonical Representation Proof of Lemma S 1 = S S 2 = S Op OP Suppose L appears after S. L must appear again at the end of S 2. Otherwise, we could distinguish between the two sequences. For any L i =Op(L), Op -1 must transform L i to L with probability 1. L L2L2 L1L1 LkLk Op L Op -1 Op Op -1

23 Canonical Representation: Proof Now lets extend the sequence and modify stop points: S 3 = S Op 1212 S 4 = S Op Op -1 Op Suppose some L i =Op(L) appears after S Op. L i must appear also at the end of S 4. Otherwise, we could distinguish between the two sequences. After Op -1 the layout is again L. The operation of Op depends only on L. Op cannot know which L i to create. There is only one L i = Op(L) L L2L2 L1L1 LkLk Op L Op -1 Op Op -1

24 Whats Next 1.Strong History Independence means Canonical Representation. 2.Lower Bounds on strong history independence. 3.Lower Bounds on relaxed strong history independence. 4.Obtaining a weak history independent heap.

25 Lower Bounds: an example Lemma: D: Data-structure whose content is the set of keys stored inside it. I: Implementation of D that is : comparison-based and canonical. The operation Insert(D, x) requires time Ω (n). This lemma applies for example to: Heaps, Dictionaries, Search trees.

26 Lower Bounds – cont. Proof sketch: comparison-based: keys are treated as black boxes according to the comparison order. The algorithm treats any n keys only according to their total order. The canonical layout of any n different keys is the same no matter what their real values are. d 1, d 2, … d n - memory addresses of n keys in the layout according to their total order. d 1, d 2, … d n+1 - memory addresses of n+1 keys in the layout according to their total order.

27 Lower Bounds – cont. Δ: The number of indices for which d i d i Consider the content C = { k 2, k 3, …, k n+1 } k 2 < k 3 < … < k n+1 : Case 1 - Δ > n/2 - consider insert(C, k n+2 ): Puts k n+2 in address d n+1. Moves each k i (2 i n+1) from d i-1 to d i-1. The operation moves at least n/2 keys. Case 2 - Δ n/2 - consider insert(C, k 1 ): Puts k 1 in d 1 Moves each k i (2 i n+1) from d i-1 to d i. The operation moves at least n/2 keys.

28 More Lower Bounds By similar methods we can show: Remove-key requires time Ω(n). For a Heap: –Increase-key requires time Ω(n). –Build-Heap Operation requires time Ω(n log n). For a queue: either Insert-first or Remove- Last requires time Ω(n).

29 Whats Next 1.Strong History Independence means Canonical Representation. 2.Lower Bounds on strong history independence. 3.Lower Bounds on relaxed strong history independence. 4.Obtaining a weak history independent heap.

30 Relaxed strong history independence Strong history independence implies very strong lower bounds. How can we relax the definition allowing more efficient data structures ? One possible way [HHMPR02 ]: Allowing the adversary to distinguish between the empty sequence and other sequences. Does this definition implies canonical memory layout ?

31 Relaxed strong history independence (cont.) The relaxed definition does not implies canonical memory layout. Possible implementation of previous data structure: In each operation - choose a new independent uniformly chosen permutation of the elements. 1.Not canonical … 2.Relaxed strong history independent. 3.Each operation - O(n)

32 Relaxed strong history independence Is this relaxation enough ? (for efficient implementations) No We may prove almost the same lower bounds using different property of these data structures.

33 Whats Next 1.Strong History Independence means Canonical Representation. 2.Lower Bounds on strong history independence. 3.Lower Bounds on relaxed strong history independence. 4.Obtaining a weak history independent heap.

34 The Binary Heap Binary heap - a simple implementation of a priority queue. The keys are stored in an almost full binary tree. Heap property - For each node i: V(parent(i)) V(i) Assume that all values in the heap are unique

35 The Binary Heap: Heapify Heapify - used to preserve the heap property. Input: a root and two proper sub-heaps of height h-1. Output: a proper heap of height h. The node always chooses to sift down to the direction of the larger value

36 Heapify Operation

37 Reversing Heapify heapify -1 : reversing heapify: Heapify -1 (H: Heap, i: position) Root v i All the path from the root to node i are shifted down The parameter i is a position in the heap H

38 Heapify -1 Operation Heapify(Heapify -1 (H, i)) = H Property: If all the keys in the heap are unique then for any i:

39 The Binary Heap: Build-heap in O(n) Building a heap - applying heapify on any sub-tree in the heap in a bottom up manner. Time Complexity

40 Reversing Build-heap Build-Heap -1 (H: heap) : Tree If size(H) = 1 then return (H); Choose a node i uniformly at random among the nodes in the heap H; H Heapify -1 (H, i); Return TREE(root(H), build-heap -1 (H L ), build-heap -1 (H R )); For any random choice: Build-heap(Build-heap -1 (H)) = H Works in a Top-Bottom manner

41 Uniformly Chosen Heaps Build-heap is a Many-To-One procedure. Build-heap -1 is a One-To-Many procedure depending on the random choices. Support(H) : The set of permutations (trees) such that build-heap(T) = H Facts (without proof): 1.For each heap H the size of Support(H) is the same. 2.Build-heap -1 returns one of these heaps uniformly.

42 How to Obtain a Weak History Independent Heap Main idea: keeping a uniformly random heap at all time. We want: 1.Build-heap: Return one of the possible heaps uniformly. 2.Other operations: preserve this property.

43 An Easy Implementation: Build-Heap Apply random permutation on the input elements and then use the standard build-heap. Analysis: Each heap has the same size of Support group each heap has the same probability. More intuition: Applying random permutation on the elements erases all data about the order of the elements. There is no information on the history.

44 Another Easy Implementation: Increase-key Standard Increase-key - changes the value of element and sift it up until it gets to the correct place

45 Increase-key – cont. The standard increase-key is good for us. 1.The increase-key operation is reversible: decreasing the value of the key back will return the key to its previous location. 2.The number of heaps with n different keys is the same no matter of the actual values of keys. The increase-key function is 1-1. If we had uniformly chosen heap then after increase-key it stays uniformly chosen heap.

46 Not So Easy: Extract-max and Insert Extract-max(H) Replace the value at the root with the value of the last leaf. Let the value sift down to the right position. The standard operation of extract-max: Is this good for us ? No !

47 Standard Extract-max is Not Good Three possible heaps with 4 elements: One heap has probability 1/3 while the other has probability of 2/3 ! /

48 Naive Implementation: Extract-max Extract-max(H) 1. T = build-heap -1 (H) 2. Remove the last node v in the tree (T). 3. H = build-heap(T) 4. If we already removed the maximal value return H Otherwise: 5. Replace the root with v and let v sift down to its correct position. build-heap -1 and build-heap works in O(n) … but this implementation is history independent.

49 Analysis: Extract-max Extract-max(H) 1.T = build-heap -1 (H) 2.Remove the last node v in the tree (T). 3.H = build-heap(T) H is a random uniform heap on the n original keys of the heap excluding a random key v. T is a random uniform permutation on the n+1 keys of the heap. T is a random uniform permutation on n keys of the heap excluding the random key v.

50 Analysis: Extract-max 4.If we already removed the maximal value return H Otherwise: 5.Replace the root with v and let v sift down to its correct position. If we already removed the maximal value we are done. Otherwise: This is just applying increase/decrease-key on the value at the root. (this is a 1-1 function …)

51 Improving Complexity: Extract-max First 3 steps of Extract-max(H) 1.T = build-heap -1 (H) 2.Remove the last node v in the tree. 3.H = build-heap(T) Main problem - steps 1 to 3 that takes O(n). Simple observation reduces the complexity of these steps to O(log 2 (n)) instead of O(n)

52 Reducing the Complexity to O(log 2 (n)) Observation: Most of the operations of build-heap -1 are redundant. they are always canceled by the operation of build- heap. Only the operations applied on nodes lying on the path from the root to the last leaf are really needed

53 Reducing the Complexity to O(log 2 (n)) Complexity analysis: Each heapify -1 and heapify operation takes at most O(log n). There are O(log n) such operations.

54 Reducing the Complexity: O(log(n)) Expected Time This is the most complex part Main ideas: We can show that there are actually O(1) operations of heapify -1 and heapify that make a differnce (in average over the random choices made by the algorithm in each step). We can detect these operations and apply only them.

55 The Insert Operation The standard implementation of insert is not good for us. Good implementation must use randomization in order to be efficient (otherwise it should be canonical …) Making insert history independent is not easy. The general method is similar to Extract-max. The most difficult part is again reducing the complexity from O(log 2 n) to O(log n) expected time.

56 Conclusions 1.Demanding strong history independence usually requires a high efficiency penalty in the comparison based model. 2.Weak history independent heap in the comparison-based model without panelty, Complexity: build-heap - O(n) worst case. increase-key - O(log n) worst case. extract-max, insert- O(log n) expected time, O(log 2 n) worst case.

57 Open Questions 1.Can We show separation between weak and strong History independence in the non- comparison model ? 2.History independent implementation of other, more complex, data structures. Thank you


Download ppt "Lower and Upper Bounds on Obtaining History Independence Niv Buchbinder and Erez Petrank Technion, Israel."

Similar presentations


Ads by Google