Prio: Private, Robust, and Efficient Computation of Aggregate - - PowerPoint PPT Presentation

▶
prio private robust and efficient computation of
SMART_READER_LITE
LIVE PREVIEW

Prio: Private, Robust, and Efficient Computation of Aggregate - - PowerPoint PPT Presentation

Dec 28, 2022 134 likes •1.93k views

Prio: Private, Robust, and Efficient Computation of Aggregate Statistics Henry Corrigan-Gibbs and Dan Boneh Stanford University NSDI 2017 Today: Non-private aggregation StressTracker Blood pressure Twitter usage Today: Non-private

slide-1
SLIDE 1

Prio: Private, Robust, and Efficient Computation of Aggregate Statistics

Henry Corrigan-Gibbs and Dan Boneh
 Stanford University

NSDI 2017

slide-2
SLIDE 2

Twitter usage Blood pressure

Today: Non-private
 aggregation

StressTracker

slide-3
SLIDE 3

Twitter usage Blood pressure

Today: Non-private
 aggregation

Each user has a
 private data point StressTracker

slide-4
SLIDE 4

StressTracker

Blood pressure

Today: Non-private
 aggregation

Twitter usage

slide-5
SLIDE 5

StressTracker

Blood pressure

Today: Non-private
 aggregation

Twitter usage

slide-6
SLIDE 6

StressTracker

Blood pressure

B(T) = c

1

· T + c

Today: Non-private
 aggregation

Twitter usage

slide-7
SLIDE 7

StressTracker

Blood pressure

B(T) = c

1

· T + c

Today: Non-private
 aggregation

The app provider learned more than it needed

Twitter usage

slide-8
SLIDE 8

StressTracker

Blood pressure

Today: Non-private
 aggregation

Twitter usage

slide-9
SLIDE 9

StressTracker

App store

Blood pressure

This paper:
 Private aggregation

Twitter usage

slide-10
SLIDE 10

StressTracker

App store

Blood pressure

This paper:
 Private aggregation

Clients send an
 encrypted share of their data to each aggregator

Twitter usage

slide-11
SLIDE 11

StressTracker

App store

Blood pressure

This paper:
 Private aggregation

Clients send an
 encrypted share of their data to each aggregator

Twitter usage

slide-12
SLIDE 12

StressTracker

App store

Blood pressure

This paper:
 Private aggregation

Clients send an
 encrypted share of their data to each aggregator

Twitter usage

slide-13
SLIDE 13

Blood pressure

The aggregators
 learn no private client data

This paper:
 Private aggregation

B(T) = c

1

· T + c

StressTracker

App store

Twitter usage

slide-14
SLIDE 14

Private aggregation

f(x1, …, xN)

x1 x3 xN x2

…

  • 1. Exact correctness

If all servers are honest, servers learn f(·)

  • 2. Privacy

If one server is honest, servers learn only* f(·)

  • 3. Robustness

Malicious clients have bounded influence

  • 4. Efficiency

No public-key crypto (apart from TLS)
 1000s of submissions per second

slide-15
SLIDE 15

Blood pressure

200 100,000,000

StressTracker

App store

Twitter usage

slide-16
SLIDE 16

Blood pressure

200 100,000,000

StressTracker

App store

Twitter usage

slide-17
SLIDE 17

Private aggregation

f(x1, …, xN)

x1 xN x2

…

  • 1. Exact correctness

If all servers are honest, servers learn f(·)

  • 2. Privacy

If one server is honest, servers learn only* f(·)

  • 3. Robustness

Malicious clients have bounded influence

  • 4. Efficiency

No public-key crypto (apart from TLS)
 1000s of submissions per second

Prio is the first system to achieve all four.

x3

slide-18
SLIDE 18

Private aggregation

f(x1, …, xN)

x1 xN x2

…

  • 1. Exact correctness

If all servers are honest, servers learn f(·)

  • 2. Privacy

If one server is honest, servers learn only* f(·)

  • 3. Robustness

Malicious clients have bounded influence

  • 4. Efficiency

No public-key crypto (apart from TLS)
 1000s of submissions per second

Prio is the first system to achieve all four.

…and Prio supports a wide range of aggregation
 functions f(·)

x3

slide-19
SLIDE 19

Private aggregation

f(x1, …, xN)

x1 xN x2

…

  • 1. Exact correctness

If all servers are honest, servers learn f(·)

  • 2. Privacy

If one server is honest, servers learn only* f(·)

  • 3. Robustness

Malicious clients have bounded influence

  • 4. Efficiency

No public-key crypto (apart from TLS)
 1000s of submissions per second

Prio is the first system to achieve all four.

x3

slide-20
SLIDE 20

Contributions

  • 1. Secret-shared non-interactive proofs (SNIPs)


– Client proves that its encoded submission is well-formed
 – We do not need the power of traditional “heavy” crypto tools
 


  • 2. Aggregatable encodings


Can compute sums privately ⟹ Can compute f(·) privately


…for many f’s of interest


slide-21
SLIDE 21

Related systems

  • Additively homomorphic encryption


P4P (2010), Private stream aggregation (2011), Grid aggregation (2011),
 PDDP (2012), SplitX (2013), PrivEx (2014), PrivCount (2016),
 Succinct sketches (2016), …

  • Multi-party computation [GMW87], [BGW88]


FairPlay (2004), Brickell-Shmatikov (2006), FairplayMP (2008), SEPIA (2010),
 Private matrix factorization (2013), JustGarble (2013), …

  • Anonymous credentials/tokens


VPriv (2009), PrivStats (2011), ANONIZE (2014), …

  • Randomized response [W65], [DMNS06], [D06]


RAPPOR (2014, 2016)

Prio is the first system to achieve
 exact correctness, privacy, robustness, efficiency.

slide-22
SLIDE 22

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-23
SLIDE 23

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-24
SLIDE 24

Warm-up: Computing private sums

slide-25
SLIDE 25

Warm-up: Computing private sums

  • Every device i holds a value xi
  • We want to compute


f(x1, …, xN) = x1 + … + xN 
 without learning any users’ private value xi.

slide-26
SLIDE 26

Warm-up: Computing private sums

  • Every device i holds a value xi
  • We want to compute


f(x1, …, xN) = x1 + … + xN 
 without learning any users’ private value xi. 
 Example: Privately measuring traffic congestion. xi = 1 if user i is on the Bay Bridge
 = 0

  • therwise

The sum x1 + … + xN yields the number of app users


  • n the Bay Bridge.
slide-27
SLIDE 27

Private sums:
 A “straw-man” scheme

Server A Server B Server C

[Chaum88], [BGW88], …
 [KDK11] [DFKZ13] [PrivEx14] …

slide-28
SLIDE 28

Private sums:
 A “straw-man” scheme

Server A Server B Server C

Assume that the servers are non-colluding. Equivalently: that at least one server is honest.

[Chaum88], [BGW88], …
 [KDK11] [DFKZ13] [PrivEx14] …

slide-29
SLIDE 29

Private sums:
 A “straw-man” scheme

Server A Server B Server C

Assume that the servers are non-colluding. Equivalently: that at least one server is honest.

[Chaum88], [BGW88], …
 [KDK11] [DFKZ13] [PrivEx14] …

Imagine: app store and app

StressTracker App store App

slide-30
SLIDE 30

Private sums:
 A “straw-man” scheme

Server A Server B Server C

Assume that the servers are non-colluding. Equivalently: that at least one server is honest.

[Chaum88], [BGW88], …
 [KDK11] [DFKZ13] [PrivEx14] …

Imagine: app store and app

StressTracker App store App

Imagine: app store and app

slide-31
SLIDE 31

Private sums:
 A “straw-man” scheme

Server A Server B Server C

Assume that the servers are non-colluding. Equivalently: that at least one server is honest.

[Chaum88], [BGW88], …
 [KDK11] [DFKZ13] [PrivEx14] …

Imagine: app store and app

StressTracker App store App

Imagine: app store and app

Spain Germany Iceland

slide-32
SLIDE 32

Private sums:
 A “straw-man” scheme

Server A Server B Server C

[Chaum88], [BGW88], …
 [KDK11] [DFKZ13] [PrivEx14] …

slide-33
SLIDE 33

Server A Server B Server C

1

Secret sharing Pick three random “shares” that sum to 1. 1 = 15 + (-12) + (- 2) (mod 31)

Private sums:
 A “straw-man” scheme

Need all three shares to recover the shared value.

slide-34
SLIDE 34

Server A Server B Server C

1

Secret sharing Pick three random “shares” that sum to 1. 1 = 15 + (-12) + (- 2) (mod 31)

Private sums:
 A “straw-man” scheme

In real system, we
 use a “big” prime

Need all three shares to recover the shared value.

slide-35
SLIDE 35

Server A Server B Server C

1

Secret sharing Pick three random “shares” that sum to 1. 1 = 15 + (-12) + (- 2) (mod 31)

Private sums:
 A “straw-man” scheme

Need all three shares to recover the shared value.

slide-36
SLIDE 36

Server A Server B Server C

1

Secret sharing Pick three random “shares” that sum to 1. 1 = 15 + (-12) + (- 2) (mod 31)

Private sums:
 A “straw-man” scheme

Need all three shares to recover the shared value.

slide-37
SLIDE 37

Server A Server B Server C

1

Secret sharing Pick three random “shares” that sum to 1. 1 = 15 + (-12) + (- 2) (mod 31)

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

Need all three shares to recover the shared value.

slide-38
SLIDE 38

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

1

slide-39
SLIDE 39

Server A Server B Server C

15

  • 12
  • 2

Private sums:
 A “straw-man” scheme

1

slide-40
SLIDE 40

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2
slide-41
SLIDE 41

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

= (-10) + 7 + 3

slide-42
SLIDE 42

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

= (-10) + 7 + 3

slide-43
SLIDE 43

Server A Server B Server C

  • 10

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

7 3 = (-10) + 7 + 3

slide-44
SLIDE 44

Server A Server B Server C

  • 10

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

7 3

slide-45
SLIDE 45

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15

  • 12
  • 2

7 3

  • 10
slide-46
SLIDE 46

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15-10

  • 12+7
  • 2+3
slide-47
SLIDE 47

Server A Server B Server C

…

Private sums:
 A “straw-man” scheme

15-10+…

  • 12+7+…
  • 2+3+…
slide-48
SLIDE 48

Server A Server B Server C

SB SC SA

Private sums:
 A “straw-man” scheme

slide-49
SLIDE 49

Server A Server B Server C

SB SC SA

Private sums:
 A “straw-man” scheme

SA + SB + SC = 15 + -10 + …

slide-50
SLIDE 50

Server A Server B Server C

SB SC SA

Private sums:
 A “straw-man” scheme

SA + SB + SC = 15 + -10 + …

slide-51
SLIDE 51

Server A Server B Server C

SB SC SA SA + SB + SC = 1 + 0 + … + 1

Private sums:
 A “straw-man” scheme

SA + SB + SC = 15 + -10 + …

slide-52
SLIDE 52

Server A Server B Server C

SB SC SA SA + SB + SC = 1 + 0 + … + 1 Servers learn the
 sum of client values and learn nothing else.

Private sums:
 A “straw-man” scheme

SA + SB + SC = 15 + -10 + …

slide-53
SLIDE 53

Server A Server B Server C

SB SC SA SA + SB + SC = 1 + 0 + … + 1 Servers learn the
 sum of client values and learn nothing else.

Private sums:
 A “straw-man” scheme

SA + SB + SC = 15 + -10 + …

slide-54
SLIDE 54

Server A Server B Server C

SB SC SA SA + SB + SC = 1 + 0 + … + 1 Servers learn the
 sum of client values and learn nothing else.

Private sums:
 A “straw-man” scheme

SA + SB + SC = 15 + -10 + …

Learn that three phones are on the Bay Bridge— don’t know which three

slide-55
SLIDE 55

Computing private sums

slide-56
SLIDE 56

Computing private sums

Exact correctness: If everyone follows the protocol, servers compute the sum of all xis. Privacy: Any proper subset of the servers learns nothing but the sum of the xis. Efficiency: Follows by inspection.

slide-57
SLIDE 57

Computing private sums

Exact correctness: If everyone follows the protocol, servers compute the sum of all xis. Privacy: Any proper subset of the servers learns nothing but the sum of the xis. Efficiency: Follows by inspection. Robustness: ???

slide-58
SLIDE 58

Server A Server B Server C

F

Private sums:
 A “straw-man” scheme

x

15-10

  • 12+7
  • 2+3
slide-59
SLIDE 59

Server A Server B Server C

F

Private sums:
 A “straw-man” scheme

x

x is supposed to be a 0/1 value

15-10

  • 12+7
  • 2+3
slide-60
SLIDE 60

Server A Server B Server C

F

Private sums:
 A “straw-man” scheme

x

15-10

  • 12+7
  • 2+3
slide-61
SLIDE 61

Server A Server B Server C

Private sums:
 A “straw-man” scheme

15-10

  • 12+7
  • 2+3
slide-62
SLIDE 62

Server A Server B Server C

Private sums:
 A “straw-man” scheme

An evil client needn’t follow the rules!

15-10

  • 12+7
  • 2+3
slide-63
SLIDE 63

+ + = 21

Server A Server B Server C

Private sums:
 A “straw-man” scheme

An evil client needn’t follow the rules!

10 4 7

15-10

  • 12+7
  • 2+3
slide-64
SLIDE 64

Server A Server B Server C

Private sums:
 A “straw-man” scheme

10 4 7

15-10

  • 12+7
  • 2+3
slide-65
SLIDE 65

Server A Server B Server C

F

Private sums:
 A “straw-man” scheme

garbage garbage garbage

slide-66
SLIDE 66

Server A Server B Server C

F

Private sums:
 A “straw-man” scheme

garbage garbage garbage

Users have incentives to cheat Typical defenses
 (NIZKs) are costly A single bad client can undetectably corrupt the sum

slide-67
SLIDE 67

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-68
SLIDE 68

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-69
SLIDE 69

Server A Server B Server C

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-70
SLIDE 70

Server A Server B Server C

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-71
SLIDE 71

+ ( ) + ( ) = 1

Server A Server B Server C

15

  • 12
  • 2

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-72
SLIDE 72

Server A Server B Server C

15

  • 12
  • 2

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-73
SLIDE 73

Server A Server B Server C

15

  • 12
  • 2

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-74
SLIDE 74

Server A Server B Server C

15

  • 12
  • 2

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs)

The servers want to ensure that their shares sum to 0 or 1
 …without learning x.

x = 1

slide-75
SLIDE 75

Server A Server B Server C

  • hold shares of the client’s private value x
  • hold an arbitrary public predicate Valid(·) 


– expressed as an arithmetic circuit

  • want to test if “Valid(x)” holds, without leaking x

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs)

More generally, servers

x = 1 xa xb xc

slide-76
SLIDE 76

Server A Server B Server C

  • hold shares of the client’s private value x
  • hold an arbitrary public predicate Valid(·) 


– expressed as an arithmetic circuit

  • want to test if “Valid(x)” holds, without leaking x

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs)

More generally, servers

x = 1 xa xb xc

For our running example:
 Valid(x) = “x ∈ {0,1}”

slide-77
SLIDE 77

Server A Server B Server C

  • hold shares of the client’s private value x
  • hold an arbitrary public predicate Valid(·) 


– expressed as an arithmetic circuit

  • want to test if “Valid(x)” holds, without leaking x

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs)

More generally, servers

x = 1 xa xb xc

slide-78
SLIDE 78

Server A Server B Server C

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1 xa xb xc

slide-79
SLIDE 79

Server A Server B Server C

πa Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1 xa xb xc

slide-80
SLIDE 80

Server A Server B Server C

πb πa Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1 xa xb xc

slide-81
SLIDE 81

Server A Server B Server C

πb πa πc Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1 xa xb xc

slide-82
SLIDE 82

xa xb xc

Server A Server B Server C

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-83
SLIDE 83

xa xb xc

Server A Server B Server C

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-84
SLIDE 84

xa xb xc

Server A Server B Server C

πa, πb, πc, Servers gossip Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-85
SLIDE 85

xa xb xc

Server A Server B Server C

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-86
SLIDE 86

xa xb xc

Server A Server B Server C

Ok.

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-87
SLIDE 87

xa xb xc

Server A Server B Server C

Ok. Ok.

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-88
SLIDE 88

xa xb xc

Server A Server B Server C

Ok. Ok. Ok.

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-89
SLIDE 89

xa xb xc

Server A Server B Server C

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-90
SLIDE 90

Server A Server B Server C

xa xb xc

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-91
SLIDE 91

xa xb xc

Server A Server B Server C

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-92
SLIDE 92

xa xb xc

Server A Server B Server C

Fail

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-93
SLIDE 93

xa xb xc

Server A Server B Server C

Fail Fail

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-94
SLIDE 94

xa xb xc

Server A Server B Server C

Fail Fail Fail

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-95
SLIDE 95

xa xb xc

Server A Server B Server C

πa, πb, πc, Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-96
SLIDE 96

xa xb xc

Server A Server B Server C

X X X

  • Prio servers detect and reject malformed

client submissions

  • In this example, each client can influence

the aggregate statistic by +/- 1, at most

Contribution 1
 Secret-shared
 non-interactive
 proofs (SNIPs) x = 1

slide-97
SLIDE 97

Server A Server B Server C

The servers want to ensure that
 Valid(x) = Valid(xa+xb+xc) = 1
 …without learning x.

x = 1 xa xb xc How SNIPs work

slide-98
SLIDE 98

xa xb xc

Server A Server B Server C

How SNIPs work

slide-99
SLIDE 99

xa xb xc

Server A Server B Server C

How SNIPs work

Could run secure multiparty computation to check that Valid(x) = 1.


[GMW87], [BGW88]

slide-100
SLIDE 100

xa xb xc

Server A Server B Server C

How SNIPs work

Could run secure multiparty computation to check that Valid(x) = 1.


[GMW87], [BGW88]

slide-101
SLIDE 101

xa xb xc

Server A Server B Server C

How SNIPs work

slide-102
SLIDE 102

Server A Server B Server C

How SNIPs work x xa xb xc

slide-103
SLIDE 103

Server A Server B Server C

How SNIPs work x

Idea: Client generates the transcripts that servers would have observed in a multi-party computation

See also [IKOS07]

xa xb xc

xa xb xc

slide-104
SLIDE 104

Server A Server B Server C

How SNIPs work x

Idea: Client generates the transcripts that servers would have observed in a multi-party computation

See also [IKOS07]

xa xb xc

xa xb xc

slide-105
SLIDE 105

Server A Server B Server C

How SNIPs work x

xa xb xc

xa xb xc

slide-106
SLIDE 106

Server A Server B Server C

How SNIPs work x xa xb xc

slide-107
SLIDE 107

Server A Server B Server C

How SNIPs work x

Servers check that the transcripts are valid and consistent.

xa xb xc

slide-108
SLIDE 108

Server A Server B Server C

How SNIPs work x

Servers check that the transcripts are valid and consistent.

πa πb πc xa xb xc

slide-109
SLIDE 109

Server A Server B Server C

How SNIPs work x

Servers check that the transcripts are valid and consistent. Checking a transcript is
 much easier than generating it!

πa πb πc xa xb xc

slide-110
SLIDE 110

Server A Server B Server C

How SNIPs work πa πb πc xa xb xc

slide-111
SLIDE 111

Server A Server B Server C

How SNIPs work πa πb πc Da Db Dc xa xb xc

slide-112
SLIDE 112

Server A Server B Server C

How SNIPs work πa πb πc Da Db Dc xa xb xc

“Randomized digest”


  • f the transcript
slide-113
SLIDE 113

Server A Server B Server C

How SNIPs work πa πb πc Da Db Dc xa xb xc

slide-114
SLIDE 114

Server A Server B Server C

How SNIPs work Da Db Dc

[BFO12]

slide-115
SLIDE 115

Server A Server B Server C

How SNIPs work Da Db Dc

[BFO12]

slide-116
SLIDE 116
  • If x is valid,

Da + Db + Dc = 0

  • If x is invalid,

Da + Db + Dc ≠ 0 with high probability 
 Servers run lightweight multi-party computation to check that 
 Da + Db + Dc = 0 If so, servers accept x is valid.

Server A Server B Server C

How SNIPs work Da Db Dc

[BFO12]

slide-117
SLIDE 117
  • If x is valid,

Da + Db + Dc = 0

  • If x is invalid,

Da + Db + Dc ≠ 0 with high probability 
 Servers run lightweight multi-party computation to check that 
 Da + Db + Dc = 0 If so, servers accept x is valid.

Server A Server B Server C

How SNIPs work Da Db Dc

O(1) O(1) O(1)

[BFO12]

slide-118
SLIDE 118
slide-119
SLIDE 119

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

slide-120
SLIDE 120

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

Dishonest-maj. MPC

Θ(M) Θ(M) 5,000x


at server

[CLOS02], [DPSZ12], …

slide-121
SLIDE 121

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

Dishonest-maj. MPC

Θ(M) Θ(M) 5,000x


at server

Commits + NIZKs

Θ(M) Θ(M) Θ(M) Θ(M) 50x


at server

[FS86], [CP92], [CS97], … [CLOS02], [DPSZ12], …

slide-122
SLIDE 122

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

Dishonest-maj. MPC

Θ(M) Θ(M) 5,000x


at server

Commits + NIZKs

Θ(M) Θ(M) Θ(M) Θ(M) 50x


at server

Commits + SNARKs

Θ(M) O(1) O(1) O(1) 500x

at client

[FS86], [CP92], [CS97], … [GGPR13], [BCGTV13], … [CLOS02], [DPSZ12], …

slide-123
SLIDE 123

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

Dishonest-maj. MPC

Θ(M) Θ(M) 5,000x


at server

Commits + NIZKs

Θ(M) Θ(M) Θ(M) Θ(M) 50x


at server

Commits + SNARKs

Θ(M) O(1) O(1) O(1) 500x

at client

This work: SNIPs

Θ(M) O(1) 1x

[FS86], [CP92], [CS97], … [GGPR13], [BCGTV13], … [CLOS02], [DPSZ12], …

slide-124
SLIDE 124

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

Dishonest-maj. MPC

Θ(M) Θ(M) 5,000x


at server

Commits + NIZKs

Θ(M) Θ(M) Θ(M) Θ(M) 50x


at server

Commits + SNARKs

Θ(M) O(1) O(1) O(1) 500x

at client

This work: SNIPs

Θ(M) O(1) 1x

[FS86], [CP92], [CS97], … [GGPR13], [BCGTV13], …

For specific Valid() circuits, it is possible to eliminate this cost [BGI16]

[CLOS02], [DPSZ12], …

slide-125
SLIDE 125

M = # of multiplication gates in Valid(·) circuit

Public-key ops. Communication Slow- down Client Server C-to-S S-to-S

Dishonest-maj. MPC

Θ(M) Θ(M) 5,000x


at server

Commits + NIZKs

Θ(M) Θ(M) Θ(M) Θ(M) 50x


at server

Commits + SNARKs

Θ(M) O(1) O(1) O(1) 500x

at client

This work: SNIPs

Θ(M) O(1) 1x

[FS86], [CP92], [CS97], … [GGPR13], [BCGTV13], … [CLOS02], [DPSZ12], …

slide-126
SLIDE 126

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-127
SLIDE 127

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-128
SLIDE 128

Evaluation

  • Implemented Prio in Go


(see optimizations described in paper)

  • Five-server cluster in EC2
  • System collects the sum

  • f “N” 0/1 values


Four variants

  • 1. No privacy
  • 2. No robustness (“straw man”)
  • 3. Prio

(privacy + robustness)

  • 4. NIZK

(privacy + robustness)

slide-129
SLIDE 129

Evaluation

  • Implemented Prio in Go


(see optimizations described in paper)

  • Five-server cluster in EC2
  • System collects the sum

  • f “N” 0/1 values


Four variants

  • 1. No privacy
  • 2. No robustness (“straw man”)
  • 3. Prio

(privacy + robustness)

  • 4. NIZK

(privacy + robustness)

E.g., for privately measuring telemetry data.

slide-130
SLIDE 130

Evaluation

  • Implemented Prio in Go


(see optimizations described in paper)

  • Five-server cluster in EC2
  • System collects the sum

  • f “N” 0/1 values


Four variants

  • 1. No privacy
  • 2. No robustness (“straw man”)
  • 3. Prio

(privacy + robustness)

  • 4. NIZK

(privacy + robustness)

slide-131
SLIDE 131

Evaluation

  • Implemented Prio in Go


(see optimizations described in paper)

  • Five-server cluster in EC2
  • System collects the sum

  • f “N” 0/1 values


Four variants

  • 1. No privacy
  • 2. No robustness (“straw man”)
  • 3. Prio

(privacy + robustness)

  • 4. NIZK

(privacy + robustness)

  • ne server
slide-132
SLIDE 132

Evaluation

  • Implemented Prio in Go


(see optimizations described in paper)

  • Five-server cluster in EC2
  • System collects the sum

  • f “N” 0/1 values


Four variants

  • 1. No privacy
  • 2. No robustness (“straw man”)
  • 3. Prio

(privacy + robustness)

  • 4. NIZK

(privacy + robustness)

  • ne server

five servers

slide-133
SLIDE 133

Five-server cluster in five Amazon data centers

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s NIZK

slide-134
SLIDE 134

Five-server cluster in five Amazon data centers

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s Prio NIZK

slide-135
SLIDE 135

Five-server cluster in five Amazon data centers

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s Prio NIZK

slide-136
SLIDE 136

Five-server cluster in five Amazon data centers

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s Prio NIZK

50x performance improvement

slide-137
SLIDE 137

Five-server cluster in five Amazon data centers

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s No robustness Prio NIZK

slide-138
SLIDE 138

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s No robustness Prio NIZK No privacy

Five-server cluster in five Amazon data centers

slide-139
SLIDE 139

24 26 28 210 212 214 216 Submission length (0/1 integers) 1 10 100 1000 10000 Submissions processed/s No robustness Prio NIZK No privacy

Five-server cluster in five Amazon data centers

Within 10x of
 no privacy

slide-140
SLIDE 140

22 26 210 214 Submission length (0/1 integers) 256 B 4 KiB 64 KiB 1 MiB Per-server data transfer N I Z K Prio

slide-141
SLIDE 141

22 26 210 214 Submission length (0/1 integers) 256 B 4 KiB 64 KiB 1 MiB Per-server data transfer N I Z K Prio

slide-142
SLIDE 142

22 26 210 214 Submission length (0/1 integers) 256 B 4 KiB 64 KiB 1 MiB Per-server data transfer N I Z K Prio

Servers exchange
 a constant number


  • f bytes
slide-143
SLIDE 143

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-144
SLIDE 144

Outline

  • Background: The private aggregation problem
  • A straw-man solution for private sums
  • Providing robustness with SNIPs
  • Evaluation
  • Encodings for complex aggregates
slide-145
SLIDE 145

Known techniques: Complex statistics

If you can compute private sums, you can compute many

  • ther interesting aggregates using known techniques
  • Average
  • Variance
  • Standard deviation
  • Most popular (approx)
  • “Heavy hitters” (approx)
  • Min and max (approx)
  • Quality of arbitrary regression model (R2)
  • Least-squares regression
  • Stochastic gradient descent [Bonawitz et al. 2016]

[PrivStats11], [KDK11], [DFKZ13], [PrivEx14], [MDD16], …

slide-146
SLIDE 146

Known techniques: Complex statistics

If you can compute private sums, you can compute many

  • ther interesting aggregates using known techniques
  • Average
  • Variance
  • Standard deviation
  • Most popular (approx)
  • “Heavy hitters” (approx)
  • Min and max (approx)
  • Quality of arbitrary regression model (R2)
  • Least-squares regression
  • Stochastic gradient descent [Bonawitz et al. 2016]

[PrivStats11], [KDK11], [DFKZ13], [PrivEx14], [MDD16], …

Contribution 2:
 SNIP-friendly encodings
 for these statistics

slide-147
SLIDE 147

Known techniques: Complex statistics

If you can compute private sums, you can compute many

  • ther interesting aggregates using known techniques
  • Average
  • Variance
  • Standard deviation
  • Most popular (approx)
  • “Heavy hitters” (approx)
  • Min and max (approx)
  • Quality of arbitrary regression model (R2)
  • Least-squares regression
  • Stochastic gradient descent [Bonawitz et al. 2016]

[PrivStats11], [KDK11], [DFKZ13], [PrivEx14], [MDD16], …

Contribution 2:
 SNIP-friendly encodings
 for these statistics Prio can’t compute all statistics efficiently

slide-148
SLIDE 148

Known techniques: Complex statistics

If you can compute private sums, you can compute many

  • ther interesting aggregates using known techniques
  • Average
  • Variance
  • Standard deviation
  • Most popular (approx)
  • “Heavy hitters” (approx)
  • Min and max (approx)
  • Quality of arbitrary regression model (R2)
  • Least-squares regression
  • Stochastic gradient descent [Bonawitz et al. 2016]

[PrivStats11], [KDK11], [DFKZ13], [PrivEx14], [MDD16], …

Contribution 2:
 SNIP-friendly encodings
 for these statistics See the paper for the details Prio can’t compute all statistics efficiently

slide-149
SLIDE 149

StressTracker

Blood pressure

Today

Twitter usage

slide-150
SLIDE 150

StressTracker

Blood pressure

Today

Twitter usage

slide-151
SLIDE 151

StressTracker

App store

Blood pressure

With Prio…

Twitter usage

slide-152
SLIDE 152

StressTracker

App store

Blood pressure

With Prio…

Twitter usage

slide-153
SLIDE 153

StressTracker

App store

Blood pressure

With Prio…

Twitter usage

slide-154
SLIDE 154

Blood pressure

With Prio…

B(T) = c

1

· T + c

StressTracker

App store

Twitter usage

slide-155
SLIDE 155

Conclusions

  • Wholesale collection of sensitive user data puts our

security at risk.

  • Prio is the first system for aggregation that provides:

– exact correctness, – privacy, – robustness, and – efficiency.

  • To do so, Prio uses SNIPs and aggregatable encodings.
  • These techniques together bring private aggregation

closer to practical.

Thank you!

Henry Corrigan-Gibbs henrycg@cs.stanford.edu 
 https://crypto.stanford.edu/prio/

slide-156
SLIDE 156
slide-157
SLIDE 157

Example Encoding: Average and Variance

[PrivStats11]

slide-158
SLIDE 158

Example Encoding: Average and Variance

– Each of N clients holds a value xi – Servers want the AVG and VAR of the xis.

Each client i encodes her value x as the pair
 (x, y) = (x, x2) Simple to check that the encoding is valid:
 Valid(x, y) = (x2 - y) [outputs zero if valid]

[PrivStats11]

slide-159
SLIDE 159

Example Encoding: Average and Variance

– Each of N clients holds a value xi – Servers want the AVG and VAR of the xis.

Each client i encodes her value x as the pair
 (x, y) = (x, x2) Simple to check that the encoding is valid:
 Valid(x, y) = (x2 - y) [outputs zero if valid] Use Prio to compute the sum of encodings ∑i (xi, yi)

[PrivStats11]

slide-160
SLIDE 160

Example Encoding: Average and Variance

– Each of N clients holds a value xi – Servers want the AVG and VAR of the xis.

Each client i encodes her value x as the pair
 (x, y) = (x, x2) Simple to check that the encoding is valid:
 Valid(x, y) = (x2 - y) [outputs zero if valid] Use Prio to compute the sum of encodings ∑i (xi, yi) Then recover the statistics:
 AVG(X) = (∑i xi) / N
 AVG(X2) = (∑i yi) / N = (∑i xi2) / N
 VAR(X) = AVG(X2) - AVG(X)2

[PrivStats11]

slide-161
SLIDE 161

BrCa

30x14-bit ints

Heart

13 mixed
 features

10 1 0.1 0.01 0.001

slide-162
SLIDE 162

Using 128-bit
 integers

slide-163
SLIDE 163

Submit
 data Using 128-bit
 integers

slide-164
SLIDE 164

xa, πa

Submit
 data Using 128-bit
 integers

slide-165
SLIDE 165

xa, πa

Submit
 data

xb, πb

Using 128-bit
 integers

slide-166
SLIDE 166

xa, πa

Submit
 data

xb, πb xc, πc

Using 128-bit
 integers

slide-167
SLIDE 167

xa, πa

Submit
 data Proportional to length

  • f data submission and

size of “Valid” circuit

xb, πb xc, πc

Using 128-bit
 integers

slide-168
SLIDE 168

xa, πa

Submit
 data

xb, πb xc, πc

Using 128-bit
 integers

slide-169
SLIDE 169

xa, πa

Submit
 data

xb, πb xc, πc

Using 128-bit
 integers

slide-170
SLIDE 170

AES key

xa, πa

AES key

Submit
 data

xb, πb xc, πc

Using 128-bit
 integers

slide-171
SLIDE 171

AES key

xa, πa

AES key

Submit
 data Check that P(r) =? 0

xb, πb xc, πc

Using 128-bit
 integers

3 2 B 3 2 B 1 6 B 1 6 B 1 6 B 1 6 B

slide-172
SLIDE 172

AES key

xa, πa

AES key

Submit
 data Check that P(r) =? 0 Accept/reject
 client data

xb, πb xc, πc

Using 128-bit
 integers

3 2 B 3 2 B 1 6 B 1 6 B 1 6 B 1 6 B

slide-173
SLIDE 173

AES key

xa, πa

AES key Ok/fail bit Ok/fail bit

Submit
 data Check that P(r) =? 0 Accept/reject
 client data

xb, πb xc, πc

Using 128-bit
 integers

3 2 B 3 2 B 1 6 B 1 6 B 1 6 B 1 6 B

slide-174
SLIDE 174

AES key

xa, πa

AES key Ok/fail bit Ok/fail bit

Submit
 data Check that P(r) =? 0 Accept/reject
 client data Does not grow with size

  • f data or “Valid” circuit

xb, πb xc, πc

Using 128-bit
 integers

3 2 B 3 2 B 1 6 B 1 6 B 1 6 B 1 6 B

slide-175
SLIDE 175

AES key

xa, πa

AES key Ok/fail bit Ok/fail bit

Submit
 data Check that P(r) =? 0 Accept/reject
 client data

xb, πb xc, πc

Using 128-bit
 integers

3 2 B 3 2 B 1 6 B 1 6 B 1 6 B 1 6 B

slide-176
SLIDE 176

Example Encoding: Average and Variance

[PrivStats11]

slide-177
SLIDE 177

Example Encoding: Average and Variance

– Each of N clients holds a 4-bit value xi – Servers want the AVG and VAR of the xis.


 Each client encodes her value x = b3b2b1b0 as the tuple
 (x, y) = (x, x2, b3, b2, b1, b0)

[PrivStats11]

slide-178
SLIDE 178

Example Encoding: Average and Variance

– Each of N clients holds a 4-bit value xi – Servers want the AVG and VAR of the xis.


 Each client encodes her value x = b3b2b1b0 as the tuple
 (x, y) = (x, x2, b3, b2, b1, b0) 
 To test validity of the encoding, check that:
 
 Valid(x, y) = { (x2 - y) = 0 — y is x2
 { x - ∑j2j bj = 0 — b’s are the bits of x
 { bj ·(bj –1) = 0 — b’s are 0/1 values

[PrivStats11]