Efficiently Protecting Data and Functions Thomas Schneider CROSSING Summer School September 13, 2019 1
Based on joint works with… Daniel Ágnes Daniel Günther Kiss Demmler … and many more. 2
Outline 1. Secure Function Evaluation with Mixed Protocols 2. Private Function Evaluation of Boolean Circuits 3
Outline 1. Secure Function Evaluation with Mixed Protocols 2. Private Function Evaluation of Boolean Circuits 4
Secure Function Evaluation (SFE) SFE % # ! !(#, %) 5
Secure Function Evaluation (SFE) Public function !(⋅,⋅) Is S • compute arbitrary function ! richer? x < y • on private data ', ( Client , Server - • without trusted third party • reveal nothing but result ) = !(', () Private data ' Private data ( x = $1 Mio y = $2 Mio SFE Example: Yao’s Millionaires’ Problem true ) = !(', () 6
Applications of Secure Function Evaluation (Small Selection) Auctions [NPS99], ... Remote Diagnostics [BPSW07], ... DNA Searching [TKC07], ... Biometric Identification [EFGKLT09], ... Medical Diagnostics [BFKLS S 09], ... 7
Implementing Secure Function Evaluation Function Idea Boolean Arithmetic Representation Circuits Circuits Protocol DGK Paillier OT Yao GMW Point-and- Fixed-Key Optimizations Free-XOR Half-Gates permute Garbling 8
Example for Mixed-Protocol SFE: Minimum Euclidean Distance Minimum Euclidean Distance: min(∑ d i= 1 ( S i ,1 – C i ) 2 , …, ∑ d i=1 ( S i,n – C i ) 2 ) l Server holds database S , client holds query C l Used in biometric matching (face-recognition, fingerprint, …) Function Arithmetic Boolean Circuits Circuits DGK Paillier OT Yao GMW 9
Example for Mixed-Protocol SFE: Minimum Euclidean Distance Minimum Euclidean Distance: min(∑ d i= 1 ( S i ,1 – C i ) 2 , …, ∑ d i=1 ( S i,n – C i ) 2 ) l Server holds database S , client holds query C l Used in biometric matching (face-recognition, fingerprint, …) Function Arithmetic Boolean Circuits Circuits DGK Paillier OT Yao GMW 10
Example for Mixed-Protocol SFE: Minimum Euclidean Distance Minimum Euclidean Distance: min(∑ d i= 1 ( S i ,1 – C i ) 2 , …, ∑ d i=1 ( S i,n – C i ) 2 ) l Server holds database S , client holds query C l Used in biometric matching (face-recognition, fingerprint, …) Function Arithmetic Boolean Circuits Circuits DGK Paillier OT Yao GMW 11
The ABY Framework [DSZ15] c=a*b A A rithmetic sharing: v = a + b mod 2 ℓ c a ● Free addition / cheap multiplication , b ● Good for multiplication B Y B oolean sharing: v = a ⊕ b [GMW87] Free XOR / one message per AND c=a*b ● Good for multiplexing ● Multiplication (32-bit) Y ao's garbled circuits: S: k 0 ,k 1 ; C: k v [Yao86] Protocol Yao Mixed Free XOR / no interaction per AND ● LAN [μs] 1.1 0.1 Good for comparison ● Comm. 100 5 [KB] [D S Z15] D. Demmler, T. Schneider, M. Zohner: ABY – A Framework for Efficient Mixed-Protocol Secure Two-party Computation. In NDSS’15. 12
The ABY Framework [DSZ15] C++-Framework for efficient hybrid SFE • Efficient secure two-party computation protocols & conversions using symmetric crypto • Code: https://encrypto.de/code/ABY Function Circuit Protocols Program automated manual manual A >_ Idea B Y [D S Z15] D. Demmler, T. Schneider, M. Zohner: ABY – A Framework for Efficient Mixed-Protocol Secure Two-party Computation. In NDSS’15. 13
HDL Circuits [DDKSSZ15] Compilation from HDL into SFE and efficient building blocks • Function description in Verilog/VHDL (or via high-level synthesis in C) • Extends TinyGarble by hardware synthesis for depth-optimized circuits: [SHS S K15] E. Songhori, S. Hussain, A.-R. Sadeghi, T. Schneider, F. Koushanfar: TinyGarble: Highly Compressed and Scalable Sequential Garbled Circuits. In S&P’15. Function HDL Circuit Protocols Program automated automated manual manual A 1 >_ 2 Idea *.vhdl 3 4 B Y 5 [DDKS S Z15] D. Demmler, G. Dessouky, F. Koushanfar, A.-R. Sadeghi, T. Schneider, S. Zeitouni. Automated Synthesis of Optimized Circuits for Secure Computation. In CCS’15. 14
HyCC [BDKKS18] Fully automated compilation from C into hybrid SFE • Extension of CBMC-GC and combination with ABY: [HFKV12] A. Holzer, M. Franz, S. Katzenbeisser, H. Veith: Secure Two-party Computations in ANSI C. In CCS‘12 . • Automated partitioning and protocol selection Function C Circuit Protocols Program automated automated automated manual A 1 >_ 2 Idea *.c 3 4 B Y 5 [BDKK S 18] N. Büscher, D. Demmler, S. Katzenbeisser, D. Kretzmer, T. Schneider. HyCC: Compilation of Hybrid Protocols for Practical Secure Computation. In CCS’18. 15
HyCC – Hybrid MPC Applications Protocol online runtime: Protocol online runtime: Biometric Matching (n=1000) Textbook Gauss Solver (n=10) Runtime Runtime Runtime Runtime Total LAN WAN LAN WAN Communication Yao GC (Y) 1,177 ms 1,789 ms Y 429 ms 631 ms 31 MB GMW (B) 2,932 ms 7,974 ms A + Y 256 ms 4,235 ms 10 MB LSS and GMW 131 ms 4,249 ms (A+B) Protocol online runtime: LSS and Yao GC 70 ms 584 ms MiniONN CNN (Relu, MNIST dataset) (A+Y) Runtime Runtime LAN WAN All circuits compiled with HyCC and evaluated [LJLA17] 5,740 ms - in the ABY framework. LAN: 1Gbit / WAN: 100Mbit and 100ms RTT. A + Y 1,621 ms 5,882 ms 16
Outline 1. Secure Function Evaluation with Mixed Protocols 2. Private Function Evaluation of Boolean Circuits 17
Secure Function Evaluation of Boolean Circuits Boolean circuit % # !(#, %) , 18
Private Function Evaluation (PFE) PFE ! # !(#) 19
Private Function Evaluation of Boolean Circuits PFE C # !(#) 20
Applications of PFE of Boolean Circuits Solvency verification Smart metering Insurance rate & credit Private databases risk assessment 21
Challenges – Hiding the Circuit • Public: 1 = 4 Number of inputs 1 • Number of outputs 2 • ? ? Number of gates 3 • 3 = 4 ? ? • Private: • Functionality of gates ? • Topology of circuit 2 = 1 22
Universal Circuit (UC) There exists a Boolean circuit 6, of size Θ 8 log 8 s.t. for any Boolean function ! of size 8 6, can be programmed to compute !. Leslie G. Valiant 1976 ! 6, 23
Universal Circuit (UC) There exists a Boolean circuit 6, of size Θ 8 log 8 s.t. for any Boolean function ! of size 8 there exists a programming = such that for any input #: 6, =, # = ! # . # # = Leslie G. Valiant 1976 !(#) 6, =, # = !(#) 24
PFE of Boolean Circuits PFE , ?, @, A # !(#) 25
PFE of Boolean Circuits via SFE of a UC p # 6, ?,@,A ! # = 6, =, # 26
Further Applications of UCs beyond PFE Obfuscation Attribute-based Encryption Adaptively Secure MPC Batch Execution MPC 27
UC Generation gates inputs C (size: 8 = 1 + 2 + 3 ) outputs UC Generation Programming bits p Universal circuit UC 28
Existing UC Constructions [Val76] 1976 [Val76] [Val76] 2-way 4-way 58 log 8 4.758 log 8 Size 3.758 Depth 38 Code [Val76] L. G. Valiant: Universal Circuits (Preliminary Report). In STOC’76. 29
Valiant’s UC Construction C size ≤ 8 8 Graph G C C G C 30
Valiant’s UC Construction C size ≤ 8 8 P ROGRAMMING G ENERATION Graph G C Universal graph UG Embedding E Universal circuit UC G C UG 31
Valiant’s UC Construction C size ≤ 8 8 P ROGRAMMING G ENERATION Graph G C Universal graph UG Embedding E Universal circuit UC G C UG 32
Valiant’s UC Construction C size ≤ 8 8 P ROGRAMMING G ENERATION Graph G C Universal graph UG Embedding E Universal circuit UC G C UG 33
Valiant’s UC Construction C size ≤ 8 8 P ROGRAMMING G ENERATION Graph G C Universal graph UG Embedding E Programming bits p Universal circuit UC 34
2-way Recursive UG Construction 6H I K L 6H ⁄ 6H ⁄ I K I K LL 6H ⁄ LK KL KK 6H ⁄ 6H ⁄ 6H ⁄ I M I M I M I M ... ... ... ... ... 35
2-way Recursive UG Construction 6H I K L 6H ⁄ 6H ⁄ I K I K LL 6H ⁄ LK KL KK 6H ⁄ 6H ⁄ 6H ⁄ I M I M I M I M KKL 6H ⁄ LLL 6H ⁄ KLL 6H ⁄ LKL 6H ⁄ LLK KKK KLK LKK 6H ⁄ 6H ⁄ 6H ⁄ 6H ⁄ I N I N I N I N I N I N I N I N 36
A „Small„ Example 1 = 25 Q RS 835 nodes / 3 = 56 869 AND gates 2 = 1 37
Existing UC Constructions [Val76] [K S 08] 1976 2008 [Val76] [Val76] [KS08] 2-way 4-way 1.58 log 2 8 58 log 8 4.758 log 8 Size + 28 log 8 Depth 38 3.758 8 log 8 Code [K S 08] V. Kolesnikov, T. Schneider: A Practical Universal Circuit Construction and Secure Evaluation of Private Functions. In FC’08 . 38
Existing UC Constructions [K S 16] [Val76] [K S 08] [LMS16] 1976 2008 2016 [Val76] [Val76] [KS08] 2-way 4-way 1.58 log 2 8 58 log 8 4.758 log 8 Size + 28 log 8 Depth 38 3.758 8 log 8 Code [K S 16] Á. Kiss, T. Schneider: Valiant's Universal Circuit is Practical. In EUROCRYPT’16. [LMS16] H. Lipmaa, P. Mohassel, S. Sadeghian: Valiant's Universal Circuit: Improvements, Implementation, and Applications. In ePrint 2016/017. 39
Comparison [K S 08] UC Size of the UC [Val76] 2-way UC n=1070 Input circuit size 8 40
Recommend
More recommend
