Secure Strassen-Winograd Matrix Multiplication with MapReduce Radu - PowerPoint PPT Presentation

Secure Strassen-Winograd Matrix Multiplication with MapReduce Radu Ciucanu 1 Matthieu Giraud 2 Pascal Lafourcade 2 Lihua Ye 3 1 LIFO, INSA Centre Val de Loire Universit´ e d’Orl´ eans 2 LIMOS University Clermont Auvergne, France 3 School of Computer Science and Technology Harbin Institute of Technology, China 26 July 2019 @ SECRYPT, Prague

Matrix Multiplication Applications Shortest path problem PageRank algorithm Genetic

Matrix Multiplication Strassen-Winograd (SW) Algorithm 1 Shmuel Winograd (1936 − ) Volker Strassen (1936 − ) • Recursive algorithm • Faster than the standard algorithm: O ( n 2 . 81 ) vs O ( n 3 ) 1 V. Strassen. Gaussian Elimination is not Optimal . In Numerische Mathematik, Vol. 13, 1969.

Contributions 1 SW matrix multiplication with MapReduce 2 Secure SW matrix multiplication with MapReduce 3 Comparison with CRSP MapReduce protocols 2 2 X. Bultel, R. Ciucanu, M. Giraud, and P. Lafourcade. Secure Matrix Multiplication with MapReduce . In the proceedings of ARES 2017.

Outline 1 MapReduce Paradigm 2 Standard and SW Matrix Multiplication Algorithms 3 SW Matrix Multiplication with MapReduce 4 Security Model and Cryptographic Tools 5 Secure SW Matrix Multiplication Protocol 6 Experimental Results 7 Conclusion

MapReduce 3 MapReduce Environment Take care of : • Partitioning input data • Scheduling program execution on a set of machines • Handling machine failures Programmer Specify : • Map and Reduce functions • Input files 3 J. Dean and S. Ghemawat. MapReduce: Simplified Data Processing on Large Clusters . In the proceedings of OSDI 2004.

MapReduce Example Application : Make pure fruit juice Input 1 Input 2 Input 3 Map 1 Map 2 Map 3 Master Controller Reduce 1 Reduce 2 Output 1 Output 2

MapReduce in 3 Steps 1. Map tasks Input : ID of chunk Output : key-value pairs 2. Master Controller • Key-value pairs aggregated and sorted by key • Pairs with same key sent to the same Reduce task 3. Reduce tasks Input : One key Output : Combine values associated to the key

Standard Algorithm � A 11 � � B 11 � A 12 B 12 Multiply square matrices: and A 21 A 22 B 21 B 22 1 8 multiplications S 1 = A 11 × B 11 S 2 = A 12 × B 21 S 3 = A 21 × B 11 S 4 = A 22 × B 21 T 1 = A 11 × B 12 T 2 = A 12 × B 22 T 3 = A 21 × B 12 T 4 = A 22 × B 22 2 4 additions U 1 = S 1 + S 2 U 2 = T 1 + T 2 U 3 = S 3 + S 4 U 4 = T 3 + T 4 � U 1 � U 2 3 Result is U 3 U 4

Strassen-Winograd Algorithm � A 11 � � B 11 � A 12 B 12 Multiply square 2-power matrices: and A 21 A 22 B 21 B 22 1 8 additions S 1 = A 21 + A 22 S 2 = S 1 − A 11 S 3 = A 11 − A 21 S 4 = A 12 − S 2 T 1 = B 12 − B 11 T 2 = B 22 − T 1 T 3 = B 22 − B 12 T 4 = T 2 − B 21 2 7 recursive multiplications R 1 = A 11 × B 11 R 2 = A 12 × B 21 R 3 = S 4 × B 22 R 4 = A 22 × T 4 R 5 = S 1 × T 1 R 6 = S 2 × T 2 R 7 = S 3 × T 3 3 7 final additions U 1 = R 1 + R 2 U 2 = R 1 + R 6 U 3 = U 2 + R 7 U 4 = U 2 + R 5 U 5 = U 4 + R 3 U 6 = U 3 − R 4 U 7 = U 3 + R 5 � U 1 � U 5 4 Result is U 6 U 7

Standard vs Strassen-Winograd For matrices of order n = 2 k # additions # multiplications n 3 − n 2 8 k Standard k n 3 − n 2 � 7 i 4 k − i 7 k SW 2 + i =1

Static Padding Add rows and columns to obtain matrices of 2-power order 2 k − n 2 k − n 2 k − 1 < n < 2 k 2 k − 1 < n < 2 k     0 0 0 0 a 1 , 1 · · · a 1 , n · · · b 1 , 1 · · · b 1 , n · · · . . . . . . . . ... ... ... ... . . . . . . . .  . . . .   . . . .          · · · 0 · · · 0 · · · 0 · · · 0 a n , 1 a n , n b n , 1 b n , n         0 0 0 0 0 0 0 0 · · · · · · · · · · · ·      . . . .   . . . .  ... ... ... ... . . . . . . . .     . . . . . . . .     0 0 0 0 0 0 0 0 · · · · · · · · · · · ·

Dynamic Padding Add one row and one column when order is odd n = 2 k − 1 1 n = 2 k − 1 1  0   0  a 1 , 1 · · · a 1 , n b 1 , 1 · · · b 1 , n . . . . . . ... ... . . . . . .     . . . . . .      0   0  a n , 1 · · · a n , n b n , 1 · · · b n , n     0 · · · 0 0 0 · · · 0 0

Dynamic Peeling “Remove” one row and one column when order is odd n − 1 = 2 k 1 n − 1 = 2 k 1     a 1 , 1 · · · a 1 , n − 1 a 1 , n b 1 , 1 · · · b 1 , n − 1 b 1 , n . . . . . . ... ... . . . . . .  . . .   . . .          a n − 1 , 1 · · · a n − 1 , n − 1 a n − 1 , n − 1 b n − 1 , 1 · · · b n − 1 , n − 1 b n − 1 , n − 1     a n , 1 · · · a n , n − 1 a n , n b n , 1 · · · b n , n − 1 b n , n Block matrix multiplication � A 11 � � B 11 � � A 11 × B 11 + A 12 × B 21 A 11 × B 12 + A 12 × B 22 � A 12 B 12 = × A 21 × B 11 + A 22 × B 21 A 21 × B 12 + A 22 × B 22 A 21 A 22 B 21 B 22

Strassen-Winograd with MapReduce Execution • 2 phases: deconstruction and combination • Each phase is run (at most) F = log 2 ( d ) times Deconstruction phase • Split matrices until the desired dimension (8 additions) • Compute matrix multiplications Combination phase • Combine results of multiplications (7 additions)

Strassen-Winograd with MapReduce Preprocessing • Run on both matrices A , B ∈ R d × d • Each a i , j ∈ A gives key-value pair (0 , ( A , i , j , a i , j , d )) • Each b j , k ∈ B gives key-value pair (0 , ( B , j , k , b j , k , d )) Reduce function (Deconstruction) • Update value of key according to the recursive multiplication • Perform additions and multiplications Reduce function (Combination) • Update value of key to build intermediate matrices • Perform additions and combine matrices

SW Matrix Multiplication with MapReduce Deconstruction phase Combination phase � x � � . 01 0 . Value of key . Dimension � x � � 02 0 � � x � � � 03 0 � Initial � x � � x � � � � Result matrices 0 04 0 � � x � � � 05 0 � 04 � x � � . 06 0 . . � x � � 07 0 16 8 4 8 16

Security Model Cloud is honest-but-curious Cloud Data Owner User Matrices Result MapReduce computations Without security, Cloud learns: • Content of both matrices • Result

Cryptographic Tools Additive homomorphic scheme • E ( pk , x 1 ) ⊗ E ( pk , x 2 ) = E ( pk , x 1 + x 2 ) • E ( pk , x 1 ) ⊘ E ( pk , x 2 ) = E ( pk , x 1 − x 2 ) • Example: Paillier, Okamoto-Uchiyama cryptosystems. . . Interactive homomorphic multiplication 4 How to obtain E ( pk , m 1 m 2 ) from c 1 = E ( pk , m 1 ) and c 2 = E ( pk , m 2 )? α 1 = c 1 ⊗ E ( pk , r 1 ), α 2 = c 2 ⊗ E ( pk , r 2 ) α 1 ,α 2 β 1 = D ( sk , α 1 ), β 2 = D ( sk , α 2 ) ← − − − − − c c = E ( pk , β 1 × β 2 ) − → E ( pk , m 1 m 2 ) = c ⊘ ( E ( pk , r 1 r 2 ) c r 2 1 c r 1 2 ) 4 Cramer et al. Multiparty Computation from Threshold Homomorphic Encryption . In the proceedings of EUROCRYPT 2001.

Secure SW Matrix Multiplication with MapReduce 8 additions Use additive homomorphic properties A ⊗ B or A ⊘ B 7 recursive multiplications • Use interactive homomorphic multiplication • Only applied during the last round of deconstruction phase 7 additions Use additive homomorphic properties A ⊗ B or A ⊘ B

Experimental Results Settings Software • 3.2.0 / Standalone mode / Streaming 16.04 LTS • • Map and Reduce functions in Hardware • 4 CPU @ 2.4 GHz • 80 Gb of disk • 8 Gb of RAM

Experimental Results 120 100 CPU time (in seconds) 80 60 40 Dyn. Pad. Dyn. Peel. 20 Stat. Pad. Standard 0 240 270 300 330 360 390 420 450 Order

Experimental Results Dyn. Pad. Dyn. Peel. Stat. Pad. CRSP CPU time (in seconds) 600 400 200 0 90 120 150 180 210 240 270 300 Order

Conclusion Conclusion • Design MapReduce approach of SW algorithm • Design a secure approach of SW algorithm with MapReduce • Comparison with state-of-the-art MapReduce protocols Future works • Apache Spark experiment • Malicious cloud • Collusion resistance

Thank you for your attention Any questions? matthieu.giraud@uca.fr Credit: Pascal Lafourcade