Download presentation

1
**Private Inference Control**

David Woodruff MIT Joint work with Jessica Staddon (PARC)

2
**Contents Background Access Control and Inference Control**

Our contribution: Private Inference Control (PIC) Related Work PIC model & definitions Our Results Conclusions

3
**Sensitive: Access denied**

Access Control User queries a database. Some info in DB sensitive. What’s Bob’s salary? Server DB of n records Sensitive: Access denied Access control prevents user from learning individual sensitive relations/attributes. Does access control prevent user from learning sensitive info?

4
**Inference Control Name Job Salary**

Alyssa P. Hacker Software Engineer $90,000 Paul E. Nomial Mathematician $31,415 … Query 1 How much does Alyssa make? Query 2 What is Alyssa’s job? Query 3 How much do software engineers make? Sensitive. Software Engineer $90,000 Combining non-sensitive info may yield something sensitive Inference Channel: {(name, job), (job, salary)} Inference Control : block all inference channels

5
**Inference Control Database x 2 ({0,1}m)n**

DB of n records, m attributes 1, …, m per record n tending to infinity, m = O(1) Inference engine: generates collection C of subsets of [m] denoting all the inference channels We assume have an engine [QSKLG93] (exhaustive search) F 2 C means for all i, user shouldn’t learn xi, j for all j 2 F Assume C is monotone. Assume C input to both user and server User learns C anyway when his queries are blocked C is data-independent, reveals info only about attributes

6
**Our contribution: Private Inference Control**

Existing inference control schemes require server to learn user queries to check if they form an inference Our goal: user Privacy + Inference Control = PIC Privacy: efficient S learns nothing about honest user’s queries except # made so far # queries made so far enables S to do inference control Private and symmetrically-private information retrieval Not sufficient since stateless – user’s permissions change Generic secure function evaluation Not efficient – our communication exponentially smaller This talk: arbitrary malicious users U*, semi-honest S Can apply [NN] to handle malicious S

7
Application Government analysts inspect repositories for terrorist patterns Inference Control: prevent analysts from learning sensitive info about non-terrorists. User Privacy: prevent server from learning what analysts are tracking – if discovered this info could go to terrorists! DB

8
**Related Work Data perturbation [AS00, B80, TYW84]**

So much noise required data not as useful [DN03] Adaptive Oblivious Transfer [NP99] One record can be queried adaptively at most k times Priced Oblivious Transfer [AIR01] One record, supports more inference channels than threshold version considered in [NP99] We generalize [NP99] and [AIR01] Arbitrary inference channels and multiple records More efficient/private than parallelizing NP99 and AIR01 on each record

9
**The Model Offline Stage: S given x, C, 1k, and can preprocess x**

Online Stage: at time t, honest U generates query (it, jt) (it, jt) can depend on all prior info/transactions with S Let T denote all queries U makes, (i1, j1), …, (i|T|, j|T|) T r.v. - depends on U’s code, x, and randomness T permissable if no i s.t. (i,j) 2 T for all j 2 F for some F 2 C. We require honest U to generate permissable T. U and S interact in a multiround protocol, then U outputs outt ViewU consists of C, n, m, 1k , all messages from S, randomness ViewS consists of C, n, m, 1k, x, all messages from U, randomness

10
Security Definitions Correctness: For all x, C, for all honest users U, for all 2 [|T(U, x)|], if T permissable, out = xi, j User Privacy: For all x, C, for all honest U, for any two sequences T1, T2 with |T1| = |T2|, for all semi-honest servers S* and random coin tosses of S* (ViewS* | T(U, x) = T1) (ViewS* | T(U, x) = T2) Inference Control: Comparison with ideal model – for every U*, every x, any random coins of U*, for every C there exists a simulator U’ interacting with trusted party Ch for which ViewU* View<U’, Ch>, where U’ just asks Ch for tuples (it, jt) that are permissable

11
**Efficiency Efficiency measures are per query**

Minimize communication & round complexity Ideally O(polylog(n)) bits and 1 round Minimize server’s time-complexity Ideally O(n) without preprocessing W/preprocessing, potentially better, but O(n) optimal w.r.t. known single-server PIR schemes

12
**Our Result Using best-known PIR schemes [CMS99], [L04]: PIC scheme**

(O~ hides polylog(n), poly(k) terms) Communication O~(1) Work O~(n) 1 round

13
A Generic Reduction A protocol is a threshold PIC (TPIC) if it satisfies the definitions of a PIC scheme assuming C = {[m]}. Theorem (roughly speaking): If there exists a TPIC with communication C(n), work W(n), and round complexity R(n), then there exists a PIC with communication O(C(n)), work O(W(n)), and round complexity O(R(n)).

14
**PIC ideas: … User/server do SPIR on table of encryptions**

cnvdselvuiaapxnw … User/server do SPIR on table of encryptions Idea: Encryptions of both data and keys that will help user decrypt encryptions on future queries User can only decrypt if has appropriate keys – only possible if not in danger of making an inference

15
**Stateless PIC Efficiency of PIC is a data structures problem**

Which keys most efficienct for user to: Update as user makes new queries? Prove user not in danger of making an inference on current/future queries? Keys must prevent replay attacks: can’t use “old” keys to pretend made less queries to records than actually have

16
**PIC Scheme #1 – Stage 1 E(i3), E(j3), ZKPOK PK, SK PK (i3, j3)**

Let E by a homomorphic semantically secure encryption scheme (e.g., Pallier) Suppose we allow accessing each record at most once E(i3), E(j3), ZKPOK PK, SK PK (i3, j3) E(i1) -> E(r1(i1 – i3)) E(i2) -> E(r2(i2 – i3)) Recovers r1, r2 iff hasn’t previously accessed i3 From r1 and r2 user can reconstruct a secret S

17
**User does “SPIR on records” on**

PIC Scheme #1 – Stage 2 E(i3), E(j3), commit, ZKPOK PK, SK PK (i3, j3) E(r1,1(j-j3) + r’1,1(i – i3) + S + x1,1) E(r1,2(j-j3) + r’1,2(i – i3) + S + x1,2) E(r2,1(j-j3) + r’2,1(i – i3) + S + x2,1) … Recovers S User does “SPIR on records” on table of encryptions

18
PIC Scheme #1 - Wrapup To extend to querying a record < m times, on t-th query, let r1, …, rt-1 be (t-m+1) out of (t-1) secret sharing of S This scheme can be proven to be a TPIC – use generic reduction to get a PIC User Privacy: semantic security of E, ZK of proof, privacy of SPIR Inference Control: user can recover at most t-m ri if already queried record m-1 times – can build a simulator using SPIR w/knowledge extractor [NP99]

19
**O~(1)-communication, O~(n) work PIC**

PIC Scheme #2 - Glimpse t O~(1)-communication, O~(n) work PIC Balanced binary tree B Leaves are attributes Parents of leaves are records Internal node n accessed when record r queried and n on path from r to root Keys encode # times nodes in B have been accessed. Ku, a Kv, b Kw,c Kx,d Ky,e Kz,f 1 2 3 4 a+b =t

20
**Conclusions Extensions not in this talk Multiple users (pseudonyms)**

Collusion resistance: c-resistance => m-channel becomes collection of (m-1)/c channels. Summary New Primitive – PIC Essentially optimal construction w.r.t. known PIR schemes

Similar presentations

Presentation is loading. Please wait....

OK

Secure Computation of Linear Algebraic Functions

Secure Computation of Linear Algebraic Functions

© 2018 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google