SLIDE 1
TOC
- 1. Background
- 2. Protocol
- 3. Theoretical Evaluation
- 4. Practical Evaluation
Privacy-preserving Location Proximity Per Hallgren, Chalmers Univ. - - PowerPoint PPT Presentation
Privacy-preserving Location Proximity Per Hallgren, Chalmers Univ. - - PowerPoint PPT Presentation
Privacy-preserving Location Proximity Per Hallgren, Chalmers Univ. Gothenburg Martn Ochoa, Siemens AG (Recently TUM) Andrei Sabelfeld, Chalmers University of Technology TOC 1. Background 2. Protocol 3. Theoretical Evaluation 4. Practical
SLIDE 2
SLIDE 3
Proximity Testing
Answers the question: "Am I close?"
SLIDE 4
Homomorphic Encryption
A homorphic encryption scheme allows you to perform decipherable operations on ciphertext. RSA: E(x) = xe mod m RSA is multiplicatively homomorphic
E(x)×E(y)= xe×ye mod m =(x×y)e mod m = E(x×y)
SLIDE 5
Homomorphic Encryption
Paillier: E(x) = gx mod m Paillier is additively homomorphic
E(x)×E(y) = gx×gy mod m = gx+y mod m = E(x+y)
Paillier also has this exiting property
E(x)y = (gx)y mod m = gx×y mod m = E(x×y)
SLIDE 6
Protocol
Mission Statement
Answers the question: "Am I close?" Without disclosing:
- Any information about
Alice to Bob or Claire
- The position or distance
- f Bob and Claire to Alice
SLIDE 7
Protocol
Mission Statement
Answers the question: "Am I close?" Without disclosing:
- Any information about
Alice to Bob or Claire
- The position or distance
- f Bob and Claire to Alice
We ONLY say either YES or NO ??? YES NO ???
SLIDE 8
Protocol
Outline We ONLY say either YES or NO Alice
- Sends encrypted info to Bob
Bob
- Computes distance
- Sends boleanized distance
Done!
f = F(position) G ( f )
SLIDE 9
Protocol
Outline We ONLY say either YES or NO Alice:
- Sends encrypted info to Bob
Bob
- Computes distance
- Sends boleanized distance
Done! 2 1 3
f = F(position) G ( f )
SLIDE 10
Protocol
Distance Calculation
Trivial Geometry
Distance from A to B:
Expand & rewrite as:
(xa,ya) (xb,yb)
A B
SLIDE 11
Using Homomorphic Encryption:
Protocol
Distance Calculation
SLIDE 12
Using Homomorphic Encryption:
Protocol
Distance Calculation
Recall! Paillier is additively homomorphic E(x)×E(y) = gx×gy mod m = E(x+y)
And thus:
E(x)/E(y) = gx/gy mod m = E(x-y)
SLIDE 13
Using Homomorphic Encryption:
Protocol
Distance Calculation
SLIDE 14
Using Homomorphic Encryption:
Protocol
Distance Calculation
Recall!
Raising a cipher text to a plaintext is multiplication
E(x)y = (gx)y mod m = gx×y mod m
SLIDE 15
Using Homomorphic Encryption:
Protocol
Distance Calculation
SLIDE 16
Using Homomorphic Encryption:
Protocol
Distance Calculation
SLIDE 17
F(position)
Protocol
Distance Calculation f = F(position)
G ( f )
SLIDE 18
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
Protocol
Distance Obfuscation
SLIDE 19
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
Protocol
Distance Obfuscation
SLIDE 20
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
Protocol
Distance Obfuscation
SLIDE 21
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
- For every x < r^2!
Protocol
Distance Obfuscation
SLIDE 22
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
- For every x < r^2!
Protocol
Distance Obfuscation
SLIDE 23
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
- For every x < r^2!
- Is this enough?
Protocol
Distance Obfuscation
SLIDE 24
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
- For every x < r^2!
- Is this enough? NO!
Protocol
Distance Obfuscation
SLIDE 25
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
- Oblivious comparison:
(D-x) * rand()
- For every x < r^2!
- Is this enough?
- Also shuffle!
Protocol
Distance Obfuscation
SLIDE 26
How to obscure the distance? Now we know how Bob can compute the distance, but he doesn't want to tell Alice what the distance is!
Protocol
Distance Obfuscation
SLIDE 27
Protocol
Final Result
SLIDE 28
Theoretical Evaluation
Runtime Analysis Paillier Encryption: O(log(n) * M(n)) Decryption: O(log(n) * M(n)) Alice1: O(3log(n) * M(n)) Bob: O(r^2 * log(n) * M(n)) Alice2: O(r^2 * log(n) * M(n))
SLIDE 29
Theoretical Evaluation
Size Analysis Paillier ciphertext: O(log(n)) Size of response from Bob: O(r^2 * log(n))
SLIDE 30
Practical Evaluation
Proof of concept Small server-client application Server relays messages to appropriate clients All clients are interested in each other
SLIDE 31
Practical Evaluation
Benchmarks 80 bit key
SLIDE 32
Practical Evaluation
Benchmarks 1024 bit key
SLIDE 33
Practical Evaluation
Benchmarks
Keysize comparison
SLIDE 34
Practical Evaluation
Benchmarks
Keysize comparison Log scale
SLIDE 35
Thank You!
Questions?
SLIDE 36