1. Secure Outsourcing of Sequence Comparisons Mikhail Atallah and Jiangtao Li CERIAS and Department of Computer Sciences Purdue University PET2004: Workshop on Privacy Enhancing Technologies May 26th 2004, Toronto, Canada

2. Outline Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

3. Motivation Grid computing Computational outsourcing Privacy concerns

4. Secure Outsourcing A computationally weak client can outsource a computationally intensive task to one or more external agents Agents must learn nothing about the client’s data and the result of the computation Client does work (computation/communication) that is linear in the size of the data External agents do all the super-linear work External agents’ work should be as close as possible to the complexity bounds of the best known algorithm for the outsourced problem

5. Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

6. Secure Outsourcing of Sequence Comparisons Problem definition –Client has λ=λ 1 …λ n and μ=μ 1 …μ m –Wants to compute the similarity between λ and μ –Lacks computational power and space to compute it locally What we have achieved –Client outsources the computation of edit distance between λ and μ to two agents –Agents learn nothing about λ, μ, and result, if they do not collude

7. String Editing Problem String edit distance –Least-cost set of insertions, deletions, and substitutions to transform one string into the other Dynamic programming solution –Θ(mn) time complexity Applications –Molecular sequence comparison, text editing, pattern matching, speech recognition, etc.

8. Dynamic Programming Algorithm for String Editing M(i,j) is the minimum in cost of transform the prefix of λ of length i into the prefix of μ of length j Insertion Cost Deletion Cost Substitution Cost 0 1 2 3 4 … m 0 1 2 3 … n

9. Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

10. Disguising Sequences Hiding the sequences’ lengths –Client introduces a new symbol ‘$’ such that I($)=D($)=0, S(a,$)=S($,a)=+∞ –Client pads λ and μ with symbols ‘$’ –Note that distance(λ, μ) remains the same Splitting λ and μ –Client splits λ into λ’=λ 1 ’…λ n ’ and λ”=λ 1 ”…λ n ” such that λ i =λ i ’+λ i ” mod σ for 1≤i≤n –Similarly splits μ into μ’ and μ” –Client sends λ’ and μ’ to Agent 1, sends λ” and μ” to Agent 2

11. Agents Compute M’, M” M’M” M = M’+M” A1A2 0 1 2 3 4 5 6 0 1 2 3 4 5 6 7

12. Secure Table Lookup Protocol Input: A1 has a’ and b’, A2 has a” and b”, where a=a’+a” mod σ, b=b’+b” mod σ. Output: A1 gets c’, A2 gets c”, c’+c”=S(a,b). Idea: One agent rotates the table S by a’ rows, b’ columns into S’, S’(a”,b”) = S(a,b) σxσ size Substitution Cost Table S Rotated Cost Table S’ by 1 row, 1 column a=2, b=1, S(a,b) =2 a’=1,b’=1 a”=1,b”=0 b a a” b”

13. Secure Table Lookup Protocol (cont.) A1A2 E(S’(i,j)) E(S(a,b)+r) S → S’ Picks (a”,b”) entry: E(S(a,b)) c’=S(a,b)+rc”=-r Performance: –3 rounds –O(σ 2 ) computation and communication Security: –A1 and A2 learn nothing about a, b, and S(a,b) Picks E E(x)·E(y)=E(x+y) Chooses r and computes E(S(a,b))·E(r)

14. Min-Finding Protocol [AKD] Input: A1 has (a 1,…,a k ), A2 has (b 1,…,b k ). Let c i = a i +b i, for i=1,…,k. Output: A1 gets α, A2 gets β, such that α+β=min(c 1,…,c k ) Observation: Blind-and-permute Using secure comparison protocol

15. Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

16. Preliminary Version M’ M” Interaction A1 A2 λ, μ M’(n,m)M”(n,m) λ”, μ”λ’, μ’ M’ M”

17. Preliminary Version (cont.) SumAgent 1Agent 2 M(i-1,j-1)M’(i-1,j-1)M”(i-1,j-1) M(i-1,j)M’(i-1,j)M”(i-1,j) M(i,j-1)M’(i,j-1)M”(i,j-1) D(λ i )M’(i,0)-M’(i-1,0)M”(i,0)-M”(i-1,0) I(μ j )M’(0,j)-M’(0,j-1)M”(0,j)-M”(0,j-1) S(λ i,μ j )c’c” Two agents run min-finding protocol

18. Performance: –Client: O(m+n) –Agents: O(σ 2 mn) Bottleneck: Secure table lookup protocol is executed mn times, each time needs O(σ 2 ) computation/communication. Preliminary Version (cont.)

19. Improved Version Improvement: Batch the computation of S(λ i,μ j ) together for each row. Performance: Computation of S(λ i,μ j ) for row i needs O(σm) communication. Overall performance improves by a factor of σ.

20. Batched Secure Table Lookup Protocol Input: –A1 has a’,b 1 ’,…,b m ’, A2 has a”,b 1 ”,…,b m ”, such that a= a’+ a” mod σ, b k = b k ’+ b k ” mod σ, for k=1,…,m. Output: –A1 has c’ 1,…,c’ m, A2 has c” 1,…,c” m, such that c’ i +c” i = S(a,b i ) Main Idea : σxσ size Substitution Cost Table S Rotated Cost Table S’ by a’ row row a row a” row a row a rotated by b” entry b entry b’

21. Batched Secure Table Lookup Protocol (cont.) Performance: –S’ table sent only once, OT executed m times. –O(σ 2 ) +O(σm) E(S(a,b j ”)+r j ) E(S(a,b j ”+1)+r j ) E(S(a,b j ”+2)+r j ) … E(S(a,b j ”-1)+r j ) A1A2 Oblivious Transfer: get b j ’ entry E(S(a,b j ”+b j ’)+r j ) = E(S(a,b j )+r j ) E(S(a,0)) E(S(a,2)) … E(S(a,σ-1)) For each j=1,…,m

22. Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

23. Two Special Cases Case S(a,b) = |a-b| –Sequences are additively split without modular, i.e., λ=λ’+λ”, μ k =μ’+μ” –Use max-finding protocol –Avoid table lookup Case I(a)=D(a)=1, S(a,b)=+∞ if a≠b –Longest common subsequence problem –Set alphabet to be {0,2,4,…,2σ-2} –Run the protocol of case S(a,b)=|a-b|

24. Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

25. Conclusion and Future Work Conclusion –We developed an efficient protocol for outsourcing of string editing problem in a privacy-preserving way Future Work –Other compute-intensive problems

26. Thank You!