Privacy-Preserving Personal Information Management Mohamed Layouni - PowerPoint PPT Presentation

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Privacy-Preserving Personal Information Management Mohamed Layouni PhD Oral Defense School of Computer Science, McGill University 1 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Main Focus of this Work Designing protocols that are : Secure Privacy-preserving User-centric 2 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Main Contributions of this Thesis (1/2) Studied/Surveyed Privacy-Preserving Credentials Compared the most complete/elaborate ones Proposed an extension to the Camenisch-Lysyanskaya credential system ∗ Proposed two privacy-preserving protocols for controlling access to remotely-stored DB records , where access is performed according to policies defined by the owners of those records . 3 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Main Contributions of this Thesis (2/2) Proposed protocols to solve real-world problems using privacy-preserving credentials: Prescription-handling for the Belgian Healthcare System ∗ (e.g., protecting patients’ privacy from administrative entities involved in the processing of insurance claims) Tele-monitoring of patients’ health outside Hospital (Protocol for collecting patients’ health measurements in a user-centric and privacy-preserving way) 4 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Presentation Outline Introduction 1 Accredited Symmetrically Private 2 Information Retrieval (ASPIR) Multi-Authorizer ASPIR 3 Conclusion 4 5 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Settings and Parties Involved Data Subject 1 Database Server Receiver Data Subject 2 ... ... ID3 DB[ID3] ... ... Data Subject 3 ... ID2 DB[ID2] Data Subject 4 ID4 DB[ID4] ... ... ID1 DB[ID1] ... ... Data Subject N Figure: Setting of the ASPIR Protocol 6 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Requirements Privacy for Receiver: DB Server should not be able to compute the index of the retrieved record (and hence the ID of data-subject) Privacy for DB Server: For each query, the Receiver can compute information only on one record (defined in the query), and nothing about the other records in DB. Privacy for Data Subject: DB records cannot be retrieved without authorization It should be intractable for a quorum of players to forge an authorization for a record that none of them owns. DB Server should be able to verify the validity of an authorization presented by the Receiver, without learning the identity of the Data-Subject who issued it. 7 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Solution combines two main building blocks : Privacy-Preserving Credential System (Brands’00) Symmetrically Private Information Retrieval System (Lipmaa’05) 8 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Solution combines two main building blocks : Privacy-Preserving Credential System (Brands’00) Symmetrically Private Information Retrieval System (Lipmaa’05) 9 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Symmetrically Private Information Retrieval (SPIR) Receiver DB Server DB[1] Interested i in record i DB[i] ... DB[n] Figure: A Simple Database Query 10 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Symmetrically Private Information Retrieval (SPIR) Receiver DB Server DB[1] Q=Query(Secret−Key,i) Interested in record i Response R ... DB[i]:=Recover(Secret−Key,i,R) DB[n] Figure: Symmetrically Private Information Retrieval 11 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Solution combines two main building blocks : Privacy-Preserving Credential System (Brands’00) Symmetrically Private Information Retrieval System (Lipmaa’05) Similar to an Oblivious Transfer ∗ scheme, Higher efficiency, but Weaker security. 12 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Solution combines two main building blocks : Privacy-Preserving Credential System (Brands’00) Symmetrically Private Information Retrieval System (Lipmaa’05) Similar to an Oblivious Transfer ∗ scheme, Higher efficiency, but Weaker security. 13 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Privacy-Preserving Credentials Show Cred A1,..,An Prove Pred(A1,...,An) Issuer User Verifier Cred Provide Service Deposit Verifiers Showing Transcript Figure: Privacy-Preserving Credentials Issuing, Showing, and Depositing 14 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Building Blocks Privacy-Preserving Credentials Properties of Privacy-Preserving Credentials Selective disclosure (in the sense of Zero Knowledge) Soundness (no false claims) Untraceability (showings unlinkable to user’s identity) Unlinkability (between showings) . . . Constructions from the Literature Camenisch and Lysyanskaya (IBM’s IDEMIX ) Brands (Microsoft’s U-Prove ) 15 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Solution Overview Database Server Data Subject i Receiver ... ... Q:=Query(i,Rec−Public−Key) ID3 DB[ID3] Auth = SPK{ (i,j) : Cred.ID = j ^ ... Inv(Q) = i ^ i = j } (RecID, Policy...) ... Q + Auth Q + Auth + RecID + Policy ID2 DB[ID2] ID4 DB[ID4] Check Auth, RecID, ... if Policy is satisfied ... SPIR−Process Q ID1 DB[ID1] Response R ... ... DB[i]:=Recover(Rec−Secret−Key,R) Figure: Accredited SPIR Protocol: High-Level Overview 16 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Overview Multi-Authorizer ASPIR is : A new approach to constructing ASPIR schemes (also 1 useful for single-Authorizer ASPIR) An extension of ASPIR to a setting where: 2 A DB record belongs to multiple owners simultaneously Receiver can recover a DB record only if he: Complies with privacy policy defined by record owners. Has authorizations from: — All owners of target record, — Any subset of owners of size larger than a threshold , — Certain subsets of owners (general access structure) 17 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Settings and Parties Involved Data Subject 1 Database Server Receiver Data Subject 2 ... ... {ID2,ID3,ID4} DB[ID ] 2,3,4 ... ... Data Subject 3 ... {ID1,ID2,ID3} DB[ID ] 1,2,3 ... Data Subject 4 ... ... ... {ID1,ID3,ID4} DB[ID ] 1,3,4 ... ... Data Subject N Figure: Setting of the Multi-Authorizer ASPIR Protocol 18 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Requirements Privacy for Receiver: DB Server cannot compute the index of the retrieved record (and hence the IDs of its owners) Privacy for DB Server: For each query, the Receiver learns information only on one record (defined in the query), and nothing about the other records in DB. Privacy for Data Subject: DB records cannot be recovered without the necessary authorizations It should be intractable for a quorum of players to forge an authorization for a record that none of them owns. 19 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Solution Overview Multi-Authorizer ASPIR is a completely new construction : We use different building blocks : Pairing-based signatures instead of Credentials. (Security relies on Bilinear Diffie-Hellman assumption). We use SPIR schemes in a black-box fashion ; Construction works with any SPIR scheme, not only Lipmaa’s SPIR scheme as in ASPIR. The new scheme is more efficient than previous ASPIR. 20 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Solution Overview Auth i = F (s,RecID,Policy) i Auth 1 Database Server Receiver ... ... = U Auth 1,2,3 Auth i {ID2,ID3,ID4} DB[ID ] 2,3,4 i ... ... Data Subject 1 s = index(ID ) {ID1,ID2,ID3} DB[ID ] 1,2,3 1,2,3 ... ... ... Q = Query SPIR (s) ... Auth 2 {ID1,ID3,ID4} DB[ID ] 1,3,4 ... Q,RecID,Policy ... Data Subject 2 If Policy satisfied Response R SPIR−process Q Auth DKey = F(Auth 1,2,3 , R) 3 DB[ID ] = Recover(DKey, R) 1,2,3 Data Subject 3 Figure: Multi-Authorizer ASPIR Protocol (Basic Construction) 21 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Further Extensions The proposed protocols have the following extra functionalities: Receiver can retrieve multiple records belonging to a tuple of data-subjects (2 Constructions) Idea 1: Change the way the SPIR query is processed (Technique similar to the one used in the General and Threshold Access Structure variants) Idea 2: Two Databases : one for Keys, one for Ciphertexts. Retrieve key with MASPIR, and use it to decrypt all records of owners’ tuple being considered. 22 / 25

Introduction ASPIR Multi-Authorizer ASPIR Conclusion Summary: Proposed two privacy-preserving protocols for controlling 1 access to remotely-stored DB records , where access is performed according to policies defined by the owners of those records . Proposed Privacy-Preserving eHealth protocols (e.g., 2 Prescription-handling for the Belgian Healthcare System) Surveyed the State of the Art in Privacy-Preserving 3 Credential Systems , and provided a Comparison of the most elaborate/complete ones. 23 / 25