Secure Outsourcing of Sequence Comparisons Mikhail Atallah and Jiangtao Li CERIAS and Department of Computer Sciences Purdue University PET2004: Workshop on Privacy Enhancing Technologies May 26th 2004, Toronto, Canada

Outline Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

Motivation Grid computing Computational outsourcing Privacy concerns

Secure Outsourcing A computationally weak client can outsource a computationally intensive task to one or more external agents Agents must learn nothing about the client’s data and the result of the computation Client does work (computation/communication) that is linear in the size of the data External agents do all the super-linear work External agents’ work should be as close as possible to the complexity bounds of the best known algorithm for the outsourced problem

Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

Secure Outsourcing of Sequence Comparisons Problem definition –Client has λ=λ 1 …λ n and μ=μ 1 …μ m –Wants to compute the similarity between λ and μ –Lacks computational power and space to compute it locally What we have achieved –Client outsources the computation of edit distance between λ and μ to two agents –Agents learn nothing about λ, μ, and result, if they do not collude

String Editing Problem String edit distance –Least-cost set of insertions, deletions, and substitutions to transform one string into the other Dynamic programming solution –Θ(mn) time complexity Applications –Molecular sequence comparison, text editing, pattern matching, speech recognition, etc.

Dynamic Programming Algorithm for String Editing M(i,j) is the minimum in cost of transform the prefix of λ of length i into the prefix of μ of length j Insertion Cost Deletion Cost Substitution Cost … m … n

Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

Disguising Sequences Hiding the sequences’ lengths –Client introduces a new symbol ‘$’ such that I($)=D($)=0, S(a,$)=S($,a)=+∞ –Client pads λ and μ with symbols ‘$’ –Note that distance(λ, μ) remains the same Splitting λ and μ –Client splits λ into λ’=λ 1 ’…λ n ’ and λ”=λ 1 ”…λ n ” such that λ i =λ i ’+λ i ” mod σ for 1≤i≤n –Similarly splits μ into μ’ and μ” –Client sends λ’ and μ’ to Agent 1, sends λ” and μ” to Agent 2

Agents Compute M’, M” M’M” M = M’+M” A1A

Secure Table Lookup Protocol Input: A1 has a’ and b’, A2 has a” and b”, where a=a’+a” mod σ, b=b’+b” mod σ. Output: A1 gets c’, A2 gets c”, c’+c”=S(a,b). Idea: One agent rotates the table S by a’ rows, b’ columns into S’, S’(a”,b”) = S(a,b) σxσ size Substitution Cost Table S Rotated Cost Table S’ by 1 row, 1 column a=2, b=1, S(a,b) =2 a’=1,b’=1 a”=1,b”=0 b a a” b”

Secure Table Lookup Protocol (cont.) A1A2 E(S’(i,j)) E(S(a,b)+r) S → S’ Picks (a”,b”) entry: E(S(a,b)) c’=S(a,b)+rc”=-r Performance: –3 rounds –O(σ 2 ) computation and communication Security: –A1 and A2 learn nothing about a, b, and S(a,b) Picks E E(x)·E(y)=E(x+y) Chooses r and computes E(S(a,b))·E(r)

Min-Finding Protocol [AKD] Input: A1 has (a 1,…,a k ), A2 has (b 1,…,b k ). Let c i = a i +b i, for i=1,…,k. Output: A1 gets α, A2 gets β, such that α+β=min(c 1,…,c k ) Observation: Blind-and-permute Using secure comparison protocol

Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

Preliminary Version M’ M” Interaction A1 A2 λ, μ M’(n,m)M”(n,m) λ”, μ”λ’, μ’ M’ M”

Preliminary Version (cont.) SumAgent 1Agent 2 M(i-1,j-1)M’(i-1,j-1)M”(i-1,j-1) M(i-1,j)M’(i-1,j)M”(i-1,j) M(i,j-1)M’(i,j-1)M”(i,j-1) D(λ i )M’(i,0)-M’(i-1,0)M”(i,0)-M”(i-1,0) I(μ j )M’(0,j)-M’(0,j-1)M”(0,j)-M”(0,j-1) S(λ i,μ j )c’c” Two agents run min-finding protocol

Performance: –Client: O(m+n) –Agents: O(σ 2 mn) Bottleneck: Secure table lookup protocol is executed mn times, each time needs O(σ 2 ) computation/communication. Preliminary Version (cont.)

Improved Version Improvement: Batch the computation of S(λ i,μ j ) together for each row. Performance: Computation of S(λ i,μ j ) for row i needs O(σm) communication. Overall performance improves by a factor of σ.

Batched Secure Table Lookup Protocol Input: –A1 has a’,b 1 ’,…,b m ’, A2 has a”,b 1 ”,…,b m ”, such that a= a’+ a” mod σ, b k = b k ’+ b k ” mod σ, for k=1,…,m. Output: –A1 has c’ 1,…,c’ m, A2 has c” 1,…,c” m, such that c’ i +c” i = S(a,b i ) Main Idea : σxσ size Substitution Cost Table S Rotated Cost Table S’ by a’ row row a row a” row a row a rotated by b” entry b entry b’

Batched Secure Table Lookup Protocol (cont.) Performance: –S’ table sent only once, OT executed m times. –O(σ 2 ) +O(σm) E(S(a,b j ”)+r j ) E(S(a,b j ”+1)+r j ) E(S(a,b j ”+2)+r j ) … E(S(a,b j ”-1)+r j ) A1A2 Oblivious Transfer: get b j ’ entry E(S(a,b j ”+b j ’)+r j ) = E(S(a,b j )+r j ) E(S(a,0)) E(S(a,2)) … E(S(a,σ-1)) For each j=1,…,m

Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

Two Special Cases Case S(a,b) = |a-b| –Sequences are additively split without modular, i.e., λ=λ’+λ”, μ k =μ’+μ” –Use max-finding protocol –Avoid table lookup Case I(a)=D(a)=1, S(a,b)=+∞ if a≠b –Longest common subsequence problem –Set alphabet to be {0,2,4,…,2σ-2} –Run the protocol of case S(a,b)=|a-b|

Roadmap Motivation Sequence comparisons Framework and building blocks Outsourcing Protocols for sequence comparisons Two special cases Conclusion and future work

Conclusion and Future Work Conclusion –We developed an efficient protocol for outsourcing of string editing problem in a privacy-preserving way Future Work –Other compute-intensive problems

Thank You!