Private Set Intersection for Unequal Set Sizes with Mobile - PowerPoint PPT Presentation

Private Set Intersection for Unequal Set Sizes with Mobile Applications Ágnes Kiss (TU Darmstadt) Jian Liu (Aalto University) Thomas Schneider (TU Darmstadt) N. Asokan (Aalto University) Benny Pinkas (Bar-Ilan University) 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 1

Private Set Intersection (PSI) 𝑂 ≈ 𝑂 𝐶 𝐵 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 2

Private Set Intersection (PSI) ? ? ? ? ? ? ? 𝑂 ≈ 𝑂 𝐶 𝐵 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 2

PSI with Unequal Set Sizes 𝑂 ≫ 𝑂 𝐶 𝐵 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 3

PSI with Unequal Set Sizes – Mobile Messaging Service ... 𝑂 ≫ 𝑂 𝐶 𝐵 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 4

PSI with Unequal Set Sizes – Mobile Messaging Service ? ? ? ? ? ? ... 𝑂 ≫ 𝑂 𝐶 𝐵 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 4

PSI with Unequal Set Sizes – Malware Detection Service ... 𝑂 ≫ 𝑂 𝐶 𝐵 3 Mio 95 [TLP+17] 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 5

PSI with Unequal Set Sizes – Malware Detection Service ? ? ? ? ? ? ? ... ? ? 𝑂 ≫ 𝑂 𝐶 𝐵 3 Mio 95 [TLP+17] 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 5

What do we have? • OT-based protocols efficient for 𝑶 𝑩 ≈ 𝑶 𝑪 • Garbled BF based protocols [DCW13,RR17] Hashing-based protocols [PSZ14,PSSZ15,KKRT16] • 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 6

What do we have? • OT-based protocols efficient for 𝑶 𝑩 ≈ 𝑶 𝑪 • Garbled BF based protocols [DCW13,RR17] Hashing-based protocols [PSZ14,PSSZ15,KKRT16] • Require sending data linear in 𝑂 𝐵 for each element of the client (𝑃(𝑂 𝐵 𝑂 𝐶 )) 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 6

What do we have? • OT-based protocols efficient for 𝑶 𝑩 ≈ 𝑶 𝑪 • Garbled BF based protocols [DCW13,RR17] Hashing-based protocols [PSZ14,PSSZ15,KKRT16] • Require sending data linear in 𝑂 𝐵 for each element of the client (𝑃(𝑂 𝐵 𝑂 𝐶 )) • Protocols linear in the set sizes (𝑷 𝑶 𝑩 + 𝑶 𝑪 ) • Based on public-key crypto: OPE [FNP04], DH [HFH99] Based on Oblivious PRF evaluation: NR [FIPR05,HL08], • AES [PSSW09], RSA [CT10] 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 6

What do we have? • OT-based protocols efficient for 𝑶 𝑩 ≈ 𝑶 𝑪 • Garbled BF based protocols [DCW13,RR17] Hashing-based protocols [PSZ14,PSSZ15,KKRT16] • Require sending data linear in 𝑂 𝐵 for each element of the client (𝑃(𝑂 𝐵 𝑂 𝐶 )) • Protocols linear in the set sizes (𝑷 𝑶 𝑩 + 𝑶 𝑪 ) • Based on public-key crypto: OPE [FNP04], DH [HFH99] Based on Oblivious PRF evaluation: NR [FIPR05,HL08], • AES [PSSW09], RSA [CT10] Can these be adapted to unequal set sizes? 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 6

What do we have? • OT-based protocols efficient for 𝑶 𝑩 ≈ 𝑶 𝑪 • Garbled BF based protocols [DCW13,RR17] Hashing-based protocols [PSZ14,PSSZ15,KKRT16] • Require sending data linear in 𝑂 𝐵 for each element of the client (𝑃(𝑂 𝐵 𝑂 𝐶 )) • Protocols linear in the set sizes (𝑷 𝑶 𝑩 + 𝑶 𝑪 ) • Based on public-key crypto: OPE [FNP04], DH [HFH99] Based on Oblivious PRF evaluation: NR [FIPR05,HL08], • AES [PSSW09], RSA [CT10] Can these be adapted to unequal set sizes? 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 6

Our Contributions Improve existing Prototype Further linear complexity implementation extensions for protocols for of improved real-world unequal set sizes protocols applications 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 7

Precomputed PSI – Three Phases |𝑂 𝐵 | ≫ |𝑂 𝐶 | Base Phase max maximum number of client inputs Data-independent, depends on 𝑂 𝐶 Setup Phase Depends on the 𝑂 𝐵 elements in the database Online Phase Depends on the 𝑂 𝐶 elements in the client set 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 8

Precomputed PSI – Three Phases |𝑂 𝐵 | ≫ |𝑂 𝐶 | Base Phase max maximum number of client inputs Data-independent, depends on 𝑂 𝐶 Can be precomputed without any knowledge on the inputs Setup Phase Depends on the 𝑂 𝐵 elements in the database Online Phase Depends on the 𝑂 𝐶 elements in the client set 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 8

Precomputed PSI – Three Phases |𝑂 𝐵 | ≫ |𝑂 𝐶 | Base Phase max maximum number of client inputs Data-independent, depends on 𝑂 𝐶 Can be precomputed without any knowledge on the inputs Setup Phase Depends on the 𝑂 𝐵 elements in the database The server can perform most of the computation in advance Online Phase Depends on the 𝑂 𝐶 elements in the client set 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 8

Precomputed PSI – Three Phases |𝑂 𝐵 | ≫ |𝑂 𝐶 | Base Phase max maximum number of client inputs Data-independent, depends on 𝑂 𝐶 Can be precomputed without any knowledge on the inputs Setup Phase Depends on the 𝑂 𝐵 elements in the database The server can perform most of the computation in advance Same for all clients? Online Phase Depends on the 𝑂 𝐶 elements in the client set 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 8

Precomputed PSI – Three Phases |𝑂 𝐵 | ≫ |𝑂 𝐶 | Base Phase max maximum number of client inputs Data-independent, depends on 𝑂 𝐶 Can be precomputed without any knowledge on the inputs Setup Phase Depends on the 𝑂 𝐵 elements in the database The server can perform most of the computation in advance Same for all clients? Online Phase Depends on the 𝑂 𝐶 elements in the client set Computation on the client’s few elements is fast 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 8

Bloom filter 𝐼 1 𝐼 2 … 𝐼 𝑙 1 2 ... i ... j ... n 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 9

Bloom filter 𝑓 : 004912345678910 𝐼 1 𝐼 2 … 𝐼 𝑙 1 2 ... i ... j ... n 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 9

Bloom filter 𝑓 : 004912345678910 𝐼 1 𝐼 2 … 𝐼 𝑙 1 2 ... i ... j ... n 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 𝐼 1 (𝑓) 𝐼 2 (𝑓) … 𝐼 𝑙 (𝑓) 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 9

Bloom filter 𝑓 : 004912345678910 𝐼 1 𝐼 2 … 𝐼 𝑙 1 2 ... i ... j ... n 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 𝐼 1 (𝑓) 𝐼 2 (𝑓) … 𝐼 𝑙 (𝑓) 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 9

Bloom filter 𝐹(𝑓) : fti45jxcfuu984fghdr56fguew91jm 𝐼 1 𝐼 2 … 𝐼 𝑙 1 2 ... i ... j ... n 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 𝐼 1 (𝐹(𝑓)) 𝐼 2 (𝐹 𝑓 ) … 𝐼 𝑙 (𝐹(𝑓)) 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 9

Efficient and Secure Updates Insertion in Bloom filter 𝐹(𝑓) : fti45jxcfuu984fghdr56fguew91jm 𝐼 1 𝐹(𝑓) , 𝐼 2 𝐹(𝑓) , … , 𝐼 𝑙 (𝐹(𝑓)) Deletion: Counting Bloom filter 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 10

Precomputed PSI – PSI with PRF: RSA-PSI, NR-PSI, GC-PSI |𝑂 𝐵 | ≫ |𝑂 𝐶 | Base Phase Key generation, Precomputation Agree on key, parameters, Precomputation Precomputation Setup Phase Encrypt database and BF insert in Bloom filter Store Bloom filter Online Phase Request encryption of Encrypt element privately elements privately Encryption Check and output intersection locally 20.07.17 | Private Set Intersection for Unequal Set Sizes with Mobile Applications | Ágnes Kiss | Slide 11