Verifiable Set Operations over Outsourced Databases Ran Dimitris - - PowerPoint PPT Presentation

▶
verifiable set operations over outsourced databases
SMART_READER_LITE
LIVE PREVIEW

Verifiable Set Operations over Outsourced Databases Ran Dimitris - - PowerPoint PPT Presentation

Mar 01, 2024 322 likes •976 views

Verifiable Set Operations over Outsourced Databases Ran Dimitris Nikos Omer Canetti Papadopoulos Triandopoulos Paneth Boston University Boston RSA Laboratories Boston & Tel Aviv University University & Boston University

slide-1
SLIDE 1

Verifiable Set Operations over Outsourced Databases

Ran Canetti

Boston University & Tel Aviv University

Omer Paneth

Boston University

Nikos Triandopoulos

RSA Laboratories & Boston University

Dimitris Papadopoulos

Boston University

slide-2
SLIDE 2

Outsourced Computation

  • Powerful Servers
  • Multiple types of

“weak” devices

  • Modern Computing

→ asymmetric computational environment

Big Data

slide-3
SLIDE 3

Outsourced Computation

  • Powerful Servers
  • Cloud Computing
  • Multiple types of

“weak” devices

  • Modern Computing

→ asymmetric computational environment

computation result Big Data

slide-4
SLIDE 4

Outsourced Computation

  • Powerful Servers
  • Cloud Computing
  • Multiple types of

“weak” devices

  • Modern Computing

→ asymmetric computational environment

computation result

  • Integrity-of-computation

Big Data

slide-5
SLIDE 5

Outsourced Computation

  • Powerful Servers
  • Cloud Computing
  • Multiple types of

“weak” devices

  • Modern Computing

→ asymmetric computational environment

Did you do it correctly?

computation result

  • Integrity-of-computation

Big Data

slide-6
SLIDE 6

Verifiable Computation (VC) Protocol

slide-7
SLIDE 7

Verifiable Computation (VC) Protocol

x, f

slide-8
SLIDE 8

Verifiable Computation (VC) Protocol

x, f y = f(x), Π Verify(x,f,y,Π) = accept/reject

slide-9
SLIDE 9
  • Untrusted prover – server can arbitrarily cheat

Verify(x,f,y,Π) = accept/reject x, f y = f(x), Π

Verifiable Computation (VC) Protocol

Soundness: Verify accepts with negligible probability if y ≠ f(x)

slide-10
SLIDE 10

Soundness: Verify accepts with negligible probability if y ≠ f(x) Efficiency: Verification should be faster than computation

  • Untrusted prover – server can arbitrarily cheat

Verify(x,f,y,Π) = accept/reject x, f y = f(x), Π

Verifiable Computation (VC) Protocol

slide-11
SLIDE 11
  • Client runs expensive pre-processing for f once

VC with Pre-processing

f

Setup(sk,f) = f

slide-12
SLIDE 12
  • Client runs expensive pre-processing for f once

VC with Pre-processing

f

Setup(sk,f) =

f f

slide-13
SLIDE 13
  • Client runs expensive pre-processing for f once
  • Amortizes cost over multiple executions

VC with Pre-processing

f

Setup(sk,f) =

f f

. . .

x1 y = f(x1 ), Π xi y = f(xi ), Π

slide-14
SLIDE 14
  • Client runs expensive pre-processing for f once
  • Amortizes cost over multiple executions
  • Pre-processing not inherently necessary

–

[Bitansky,Canetti,Chiesa,Tromer'13]

VC with Pre-processing

f

Setup(sk,f) =

f f

. . .

x1 y = f(x1 ), Π xi y = f(xi ), Π

slide-15
SLIDE 15

VC with Outsourced Storage

dataset D

slide-16
SLIDE 16

VC with Outsourced Storage

dataset D Setup(sk,D) = auth(D)

slide-17
SLIDE 17

VC with Outsourced Storage

D, auth(D)

digest d

VC with Outsourced Storage

dataset D Setup(sk,D) = auth(D)

slide-18
SLIDE 18

VC with Outsourced Storage

D, auth(D)

digest d

VC with Outsourced Storage

dataset D query Q y = Q(D), Π Setup(sk,D) = auth(D)

slide-19
SLIDE 19

VC with Outsourced Storage

D, auth(D)

digest d

  • Studied in existing work

– memory delegation [Chung,Kalai,Liu,Raz'11] – outsourced datasets [Backes,Fiore,Reischuk'13] – authenticated data structures [Nissim,Naor'98][Tamassia'03]

VC with Outsourced Storage

dataset D query Q y = Q(D), Π Setup(sk,D) = auth(D)

slide-20
SLIDE 20

VC with Outsourced Storage

D, auth(D)

digest d dataset D query Q y = Q(D), Π Setup(sk,D) = auth(D)

slide-21
SLIDE 21

VC with Outsourced Storage

D, auth(D)

digest d

  • Dual of the classic model

– fix function / fix data

VC with Outsourced Storage

dataset D query Q y = Q(D), Π Setup(sk,D) = auth(D)

slide-22
SLIDE 22

VC with Outsourced Storage

D, auth(D)

digest d

  • Dual of the classic model

– fix function / fix data

  • Additional query type: updates in D

VC with Outsourced Storage

dataset D query Q y = Q(D), Π Setup(sk,D) = auth(D)

slide-23
SLIDE 23

VC with Outsourced Storage

D, auth(D)

digest d

  • Dual of the classic model

– fix function / fix data

  • Additional query type: updates in D

– handle updates efficiently

VC with Outsourced Storage

dataset D query Q y = Q(D), Π Setup(sk,D) = auth(D)

slide-24
SLIDE 24

Security Game

Gen($) → sk,pk

slide-25
SLIDE 25

Security Game

pk

Gen($) → sk,pk

slide-26
SLIDE 26

Security Game

pk D0 auth(D0 )

Prove and Verify using pk Provides oracle access to Setup and Update Gen($) → sk,pk

slide-27
SLIDE 27

Security Game

pk D0 auth(D0 ) update u1 auth(D0 , u1 ) update ut auth(Dt-1 , ut )

. . .

Prove and Verify using pk Provides oracle access to Setup and Update Gen($) → sk,pk

slide-28
SLIDE 28

Security Game

{Di ,auth(Di ),d, Q, A*, Π} Adv wins if A* is not the correct answer but Verify accepts

Finally:

for 0 ≤ i ≤ t

slide-29
SLIDE 29

Known Solutions

(in this model and others)

  • Theoretical Results

[Micali'00],[Ishai,Kushilevitz,Ostrovsky'08], [Goldwasser,Kalai,Rothblum'08], [Applebaum,Ishai,Kusilevitz'10], [Gennaro,Gentry,Parno'10] [Chung,Kalai,Vadhan'10], [Canetti,Riva,Rothblum'11], [Gennaro,Gentry,Parno,Raykova'13], [Bitansky,Canetti,Chiesa,Tromer'13],...

  • Implementation Works

[Cormode,Mitzenmacher,Thaler'12] [Setty,Braun,Vu,Blumberg,Parno,Walfish'13], [Parno,Gentry,Howell,Raykova'13] [Ben-Sasson,Chiesa,Genkin,Tromer,Virza'13]...

slide-30
SLIDE 30

State of the art

✔ Excellent asymptotic behavior

– non-interactive – general (i.e. for any language in NP) – verification cost O(|input| + |output|) – O(1) proof size – poly-log overhead for proof computation

slide-31
SLIDE 31

State of the art

✔ Excellent asymptotic behavior

– non-interactive – general (i.e. for any language in NP) – verification cost O(|input| + |output|) – O(1) proof size – poly-log overhead for proof computation

✗ High concrete overhead

– server's cost prohibitive for general functions

slide-32
SLIDE 32
  • Delegation in the circuit-based model of computation

– reduce concrete functions to circuit problems

  • Prover's overhead should be query-specific

– not determined by “largest” query

Examples of Practical Issues

slide-33
SLIDE 33
  • Delegation in the circuit-based model of computation

– reduce concrete functions to circuit problems

  • Prover's overhead should be query-specific

– not determined by “largest” query

Recent works explore alternative models

–

[Goldwasser,Kalai,Popa,Vaikuntanathan,Zeldovich'13]

–

[Gentry,Halevi,Raykova,Wichs'14]

Examples of Practical Issues

slide-34
SLIDE 34

In this Work

  • Focus on specific class of functions

– exploit algebraic structure for practical solutions – existing works

  • [Benabbas,Gennaro,Vahlis'11],[Backes,Fiore,Reischuk'13],

[Papamanthou,Tamassia,Triandopoulos'11] ...

slide-35
SLIDE 35

In this Work

  • Focus on specific class of functions

– exploit algebraic structure for practical solutions – existing works

  • [Benabbas,Gennaro,Vahlis'11],[Backes,Fiore,Reischuk'13],

[Papamanthou,Tamassia,Triandopoulos'11] ...

  • Functionality:

Nested Intersections, Unions and Set Differences

slide-36
SLIDE 36

In this Work

  • Focus on specific class of functions

– exploit algebraic structure for practical solutions – existing works

  • [Benabbas,Gennaro,Vahlis'11],[Backes,Fiore,Reischuk'13],

[Papamanthou,Tamassia,Triandopoulos'11] ...

  • Functionality:

Nested Intersections, Unions and Set Differences

  • Applications

– A rich class of SQL queries – Keyword search – Similarity Measurements (e.g. Jaccard distance) – Set Membership

slide-37
SLIDE 37

Outsourced Sets

  • Database D consisting of m sets

X1 ,...,Xm with elements from Zp

slide-38
SLIDE 38

Outsourced Sets

  • Database D consisting of m sets

X1 ,...,Xm with elements from Zp

  • Supports queries expressed as polynomial

length formulas of nested intersections, unions, and set differences

  • e.g. ((X2 ∩ X4 )

∪ (X8 ∩ X5 )) ∩ (X1 \ X9 ))

X1 X3 X2 X4 X5 X6 ∩ ∩ U \ ∩

slide-39
SLIDE 39

Outsourced Sets

  • Database D consisting of m sets

X1 ,...,Xm with elements from Zp

  • Supports queries expressed as polynomial

length formulas of nested intersections, unions, and set differences

  • e.g. ((X2 ∩ X4 )

∪ (X8 ∩ X5 )) ∩ (X1 \ X9 ))

  • D changes dynamically under element

insertion and deletion

X1 X3 X2 X4 X5 X6 ∩ ∩ U \ ∩

slide-40
SLIDE 40

Our Result

  • VC with outsourced storage for sets:

– query-specific proof-construction cost – efficient non-interactive updates – circuit-independent – public verifiability – concrete complexity analysis

  • low involved constants
slide-41
SLIDE 41

Our Result

  • Setup cost:

– client's pre-processing cost → O(|D|)

  • Given query Q computable in O(N) with answer A:

– verification time O(|Q| + |A|) – proof size O(|Q|) – proof construction O(N)

  • Update cost:

– O(1) operations for client and server

slide-42
SLIDE 42

Our Result

  • Setup cost:

– client's pre-processing cost → O(|D|)

  • Given query Q computable in O(N) with answer A:

– verification time O(|Q| + |A|) – proof size O(|Q|) – proof construction O(N)

  • Update cost:

– O(1) operations for client and server

independent of cardinalities of

  • ther sets
slide-43
SLIDE 43

Large Intermediate Results

X1

∩ U U

X2 X3 X4 X5 X6 X6

Verification cost and proof size should be oblivious to the set cardinalities (except for answer set) Note Circle size denotes set cardinality

slide-44
SLIDE 44

Main Idea (attempt 1)

X1 X2

I1 ,Π1

∩

  • i[Papamanthou,Tamassia,Triandopoulos'11]

– construction for a single set operation based

  • n bilinear accumulators
slide-45
SLIDE 45

Main Idea (attempt 1)

X1 X3 X2 X4 X5 X6

I1 ,Π1

∩ ∩ U U ∩

  • i[Papamanthou,Tamassia,Triandopoulos'11]

– construction for a single set operation based

  • n bilinear accumulators
slide-46
SLIDE 46

Main Idea (attempt 1)

  • i[Papamanthou,Tamassia,Triandopoulos'11]

– construction for a single set operation based

  • n bilinear accumulators
  • Apply repeatedly per operation?

X1 X3 X2 X4 X5 X6

I1 ,Π1 I2 ,Π2 U1 ,Π3 U2 ,Π4 Answer A, Π5

∩ ∩ U U ∩

slide-47
SLIDE 47

Main Idea (attempt 1)

X1 X3 X2 X4 X5 X6

I1 ,Π1 I2 ,Π2 U1 ,Π3 U2 ,Π4 Answer A, Π5

Π = { (I1 ,Π1 ), (I2 ,Π2 ), (U1 ,Π3 ),(U2 ,Π4 ),(A,Π5 ) }

∩ ∩ U U ∩

slide-48
SLIDE 48

Main Idea (attempt 1)

X1 X3 X2 X4 X5 X6

I1 ,Π1 I2 ,Π2 U1 ,Π3 U2 ,Π4 Answer A, Π5

Π = { (I1 ,Π1 ), (I2 ,Π2 ), (U1 ,Π3 ),(U2 ,Π4 ),(A,Π5 ) }

  • Not efficient!
  • Intermediate sets possibly much larger than answer

∩ ∩ U U ∩

slide-49
SLIDE 49

Main Idea (attempt 2)

X1 X3 X2 X4 X5 X6

I1 ,Π1 I2 ,Π2 U1 ,Π3 U2 ,Π4 Answer A, Π5

Π = { (I1 ,Π1 ), (I2 ,Π2 ), (U1 ,Π3 ),(U2 ,Π4 ),(A,Π5 ) }

∩ ∩ U U ∩

slide-50
SLIDE 50

Main Idea (attempt 2)

Π = { (I1 ,Π1 ), (I2 ,Π2 ), (U1 ,Π3 ),(U2 ,Π4 ),(A,Π5 ) }

  • Remove intermediate sets

X1 X3 X2 X4 X5 X6

I1 ,Π1 I2 ,Π2 U1 ,Π3 U2 ,Π4 Answer A, Π5

∩ ∩ U U ∩

slide-51
SLIDE 51

Security Proof

  • Soundness?

– construct adversary for a single operation

slide-52
SLIDE 52

Security Proof

X1 X3 X2 X4 X5 X6 ∩ U ∩ ∩ .

.

Y X6

. .

Π = { Π1 , Π2 , ..., Πn }

  • Soundness?

– construct adversary for a single operation

slide-53
SLIDE 53

Security Proof

X1 X3 X2 X4 X5 X6 ∩ U ∩ ∩ .

.

Y X6

A B ∩ C

. .

Π = { Π1 , Π2 , ..., Πn } Πi

  • Soundness?

– construct adversary for a single operation

slide-54
SLIDE 54

X1 X3 X2 X4 X5 X6

∩ U ∩ ∩

. . .

Y X6

Security Proof

slide-55
SLIDE 55

X1 X3 X2 X4 X5 X6

∩ U ∩ ∩

. . .

A B

∩

Y X6 C

  • Exists operation with

honest input A,B, cheating output C and proof Πi

Security Proof

slide-56
SLIDE 56

X1 X3 X2 X4 X5 X6

∩ U ∩ ∩

. . .

A B

∩

Y X6 C

  • What is the value of set C?

– even the adversary may not know!

Problem

slide-57
SLIDE 57

Solution

  • Replace proofs Πi with proofs-of-knowledge
slide-58
SLIDE 58

Solution

  • Replace proofs Πi with proofs-of-knowledge
  • Proof of Knowledge (PoK)

– For any convincing (cheating) prover

Ǝ extractor that outputs witness

slide-59
SLIDE 59

Solution

  • Replace proofs Πi with proofs-of-knowledge
  • Proof of Knowledge (PoK)

– For any convincing (cheating) prover

Ǝ extractor that outputs witness

  • Witness → cheating sets
slide-60
SLIDE 60

PoK for Sets

  • Construction based on q-Knowledge of

Exponent assumption [Groth'10]

slide-61
SLIDE 61

PoK for Sets

  • Construction based on q-Knowledge of

Exponent assumption [Groth'10]

  • Constant size

– only two additional group elements on Πi

slide-62
SLIDE 62

PoK for Sets

  • Construction based on q-Knowledge of

Exponent assumption [Groth'10]

  • Constant size

– only two additional group elements on Πi

  • Matches nicely with bilinear accumulators

– “accumulators with knowledge”

slide-63
SLIDE 63

Conclusion

  • Verifiable Computation

– numerous general solutions in literature – asymptotically excellent but not practical for general

deployment yet (continuous improvements though... [SBV+'12],[PGHR'13],[BCGTV'13], etc.)

  • Our work: a protocol for specific functions

– sacrifice generality for practicality

  • Follow-up [Kosba, Papadopoulos, Papamanthou, Sayed, Shi, Triandopoulos]

– constant-size proofs – extends the Quadratic Span Program framework – server cost ~30x smaller than [PGHR'13]

slide-64
SLIDE 64

Thank you!

Conclusion

  • Verifiable Computation

– numerous general solutions in literature – asymptotically excellent but not practical for general

deployment yet (continuous improvements though... [SBV+'12],[PGHR'13],[BCGTV'13], etc.)

  • Our work: a protocol for specific functions

– sacrifice generality for practicality

  • Follow-up [Kosba, Papadopoulos, Papamanthou, Sayed, Shi, Triandopoulos]

– constant-size proofs – extends the Quadratic Span Program framework – server cost ~30x smaller than [PGHR'13]