Two fuzzy private matching protocols are introduced to allow a client to securely compare a list of words to a server list, and discover only those words on the server list that are similar to his, while the server learns nothing. The first protocol achieves perfect client security, while the second achieves almostprivacy and perfect server security. Both protocols are efficient in both communication and computation complexity: for lists of length $n$, only $O(n)$ communication and $O(n^2)$ computation is needed

Doumen, J.M.

English

NARCIS 

Non-interactive fuzzy private matching

University of Twente Research Information

Non-interactive fuzzy private matchingAbstract. Two fuzzy private matching protocols are introduced to allow a clientto securely compare a list of words to a server list, and discover only those wordson the server list that are similar to his, while the server learns nothing. Thefirst protocol achieves perfect client security, while the second achieves almost-privacy and perfect server security. Both protocols are efficient in both commu-nication and computation complexity: for lists of length n, only O(n) communi-cation and O(n2) computation is needed.1 IntroductionIn our current information society, large amounts of data are being accumulated.Naturally, there is interaction between parties having different data. A commonproblem is that two parties want to find out whether they share certain data. How-ever, neither is really willing to reveal all his data to the other. For example, onecan think of cooperative data mining, where two competitors want to cooperatein discovering market trends from their sales data - without revealing that datato the competitor. Other examples include online dating, peer to peer services,recommendation services, electronic health records, and so on. In practice, thisproblem is often solved by using a trusted third party, or by one party sending(part of) his data first regardless of any objections.Both parties, called the client and the server, will be assumed to have a list ofwords. The problem now is to design a secure protocol, by which the clientlearns which of his words are also on the servers list, but which does not pro-vide the server with any information about the clients list. Private matching wasintroduced to solve this problem securely without the use of a third party [1]. Forpractical cases, one often wishes to find out not only which words match exactly,but also the near matches - think of situations like misspellings and tastes whichare never exactly equal. This problem is called fuzzy private matching, and itwas left open by Freedman et al. [1] to design an efficient protocol that achievesthis. This work will present two efficient protocols that achieve this goal in thesemi-honest model.2 BackgroundThe root of the considered problem lies in private equality testing [2,3,4], or PET,where the client and the server each hold a single word and want to securelydecide whether their words are equal. Assuming a word consisting of T symbols,the solution runs in complexity O(T ).Freedman et al. [1] consider lists instead of single words. They develop protocolsfor private matching. Another natural direction to extend the problem is to lookat similarity instead of equality - what if only t out of T symbols (“letters”) ofa word have to be equal? Private approximation of functions was formalized byFeigenbaum et al. [5]. In particular, they left open the question whether there areefficient protocols achieving private similarity testing. Indyk and Woodruff [6]answer this question positively.Combining both these extensions, one arrives at fuzzy private matching. Freed-man et al. gave a first protocol with communication complexity O(n`Tt´), andposed the question whether the same could be achieved without the`Tt´factor.Indyk and Woodruff [6] give a construction with Õ(nT + n2) communication.Chmielewski and Hoepman [7] achieve O(nT ) communication by moving thebinomial factor to the computation complexity, which is O(n2`Tt´) in their bestprotocol.Here two solutions will be presented which eliminate the binomial factor, andhave communication complexity O(nT ), and computation complexity O(n2).3 Preliminaries3.1 Notation and problem definitionAssume that the words xi to be matched have length T and symbols from a fieldF: xi ∈ FT . The server will have a list LS = {y1, . . . , ynS} of nS words, whilethe clients list LC = {x1, . . . , xnC} consists of nC words. The goal is to designa protocol that allows the client to discover words on the server list that are similarto his. To be more precise, the client should learn the setR = {yi | ∃j, d(yi, xj) ≤ T − t},where d denotes Hamming distance (i.e. t out of T symbols of the word shouldmatch).Definition 1. A t-out-of-T (hC , hS) fuzzy private matching scheme is a protocolbetween the client and the server which outputs the set R of those server wordsto the client, which match on at least t symbols with one of the clients words.For each (non-matched) server word, the entropy loss is at most hS , and for eachclient word the entropy loss is at most hC .Here, entropy loss is measured as H∞(W )−H̃∞(W |FPM), where W is the dis-tributions of words, and H̃∞ is the average min-entropy [8] left after the protocolFPM has run.Note that the privacy requirements are somewhat relaxed - in the literature [1,6,7]only (0, 0) fuzzy private matching schemes are considered.3.2 Secure sketchesSecure sketches were introduced as a kind of secure error-correcting code [8]. Inparticular, a secure sketch produces public information about its input w that doesnot reveal w, and yet it allows exact recovery of w given a value that is close tow. To be more precise we quote Dodis et al.:Definition 2 ([8]). An (M, m, m̃, t)-secure sketch is a pair of randomized pro-cedures, “Sketch” (SS) and “Recover” (Rec), with the following properties:1. The sketching procedure on input w ∈ M returns a bit string s ∈ {0, 1}?.2. The recovery procedure takes an element w′ ∈ M and a bit string s ∈{0, 1}?. The correctness property of the secure sketch guarantees that ifd(w, w′) ≤ t, then Rec(w′, SS(w)) = w.3. The security property guarantees that H̃∞(W |SS(W )) ≥ m̃ for any dis-tribution W over M with min-entropy m. In other words, an adversary whoobserves s can recover the input w with a probability at most 2−m̃.Note that this definition is adapted for Hamming distance d, and Dodis et al. alsoconsidered secure sketches for other similarity metrics. Here we will focus on theHamming distance constructions, since this most closely matches our problem.Constructing a secure sketch from MDS codes. As shown in theliterature [9,8], error-correcting codes can be used to construct secure sketches.Similar to those constructions, an [n, k, d] MDS code C (so k = n− d + 1) canbe used to construct a (Fk, m, m − (n − k)f, d−12) secure sketch as follows.Given w ∈ Fk, calculate the unique tail e such that (w||e) ∈ C (here || standsfor concatenation). Since any k symbols in an MDS code can be used as theinformation symbols [10], such an e always exists and is unique. Recovery isdone by decoding (w′||e), and will succeed if d(w||e, w′||e) = d(w, w′) ≤ d−12.In particular, if we use a (generalised) Reed-Solomon code, for which efficientdecoding algorithms are known (e.g. using the Berlekamp-Massey algorithm),we arrive at an efficient and deterministic sketch with small output size.3.3 Adversary modelIn this work, we assume a semi-honest adversary [11]. Informally, this meansthat both parties are expected to follow the protocol. As a measure for the secu-rity (both of the client and the server), we will take the entropy loss [8] definedas h = H∞(W ) − H̃∞(W |FPM), which measures how much information aneavesdropping adversary gains after the protocol FPM is run. Note that this infor-mation need not be deterministic. For instance, in the secure sketch constructionabove, the entropy loss is (n − k) log2 q. This means that out of qk, there arestill q2k−n possibilities left for w, since there are exactly that many codewordsending in the given tail e.4 Non-interactive Fuzzy Private MatchingIn this section, a low-complexity - both in terms of communication and compu-tation - protocol for private fuzzy matching will be introduced, based on securesketches. There will be both a basic version, achieving perfect client security, aswell as an interactive version, which achieves perfect server security.4.1 Basic ProtocolThe basic non-interactive protocol consists of three phases. Firstly, the serverperforms the setup. Then the server publishes information about his list. lastly,the client can use this information to discover which of his words are similar.Setup Phase. In the setup phase, the server fixes an [n, k, d] q-ary MDS code Cwith n = 3T − 2t, k = T and d = 2T − 2t + 1. The server also publishes adecoding algorithm D for C which can efficiently correct d−12= T − t errors.Note that such an efficiently decodable code exists [10], as long as q is chosensuch that n ≤ q (take for example a generalized Reed-Solomon code).Also, the server fixes an appropiate, publicly known, semantically secure encryp-tion scheme (Enc,Dec).Server operations. For each word yi in the server list LS , the server finds ei suchthat ci = yi||ei ∈ C (here || stands for concatenation). Since yi consists of k = Tcoordinates and C is an MDS code, there is a unique codeword that starts withthese coordinates. Let ki = D(ci). The server publishes the pair (ei, Encki(yi)).All in all, the server publishes a list of pairs {(ei, Encki(yi))|1 ≤ i ≤ nS}.Client operations. In order to find out whether a word xi on the client list LCmatches a published pair (e, c), the client performs the following operations.Firstly, the client applies the decoding algorithm D to obtain k = D(xi||e). Ifthe decoding algorithm fails, xi doesn’t match that server word. Otherwise, theclient continues by trying to decrypt c with the obtained k to find y = Deck(c).If the decryption is succesful, the word xi matches y on the server list, and theclient has retireved y.The client will try to match each pair of the published server list to words in hisown list LC , until he either finds a succesful match or he has exhausted his ownlist.4.2 Protocol analysisIn this section, the correctness, communication and computational complexity,and the security of the basic protocol will be discussed. The basic protocol willturn out to be a t-out-of-T (0, 2f(T − t)) fuzzy private matching scheme.Correctness. First of all, assume the client has a word x matching the serverpair (ei, Encki(yi)). Since x matches the pair, the following Hamming weightcan be bounded d(x||ei, yi||ei) = d(x, yi) ≤ T − t, and thus D is able toefficiently decode and reconstruct ki. Using this key, the client is able to find theoriginal server word yi.On the other hand, if the server pair doesn’t match the client word, we have thatd(x||ei, yi||ei) > T − t, which means that one will not find ki using D. Thedecoding algorithm will either abort, or return a key which is of no use to decryptyi.Complexity. The communication complexity of this protocol is only nS(3T−2t) symbols. This is the same order of magnitude as the best known resultsfrom the literature [7]. However, the clients time complexity is only O(nSnC),which substantially improves upon the time complexity of O(nSnC`Tt´) [7]. Theservers time complexity is O(nS).Security. Since the basic protocol is a non-interactive scheme, the client listremains perfectly secure - the server never gets any information about it.To analyze the security of the server list, we first remark that for each word, thefirst part published by the server is the secure sketch discussed in Section 3.2.In fact, this is an (FT , T (1 − δ)f, 2tf − T (1 + δ)f, T − t) secure sketch [8,Theorem 5.1] for any 0 ≤ δ < 1, where f = log2(q). To show this claim,assume that the words on the server list are drawn from a distribution with min-entropy H∞(Y ) = T (1 − δ)f . Then the average min-entropy given the sketchE is H̃∞(Y |E) = 2tf − T (1 + δ)f , since C is a q-ary MDS code.This shows that publishing e inevitably leaks information about y. In particular,we need t > (1+δ)T2in order to have any min-entropy left. Hence, this approachis best suited for fuzzy private matching with t ≈ T .4.3 Interactive ProtocolThe basic protocol achieves perfect client security. However, the server securityis only computational. In fact, the server essentially publishes n− k = 2T − 2tsymbols of each of his words. Also, the server has no control over the lengthof the client list - which allows the client to perform a brute-force attack on thepublished server list.In order to remedy these problems, the protocol can be reversed. Pick a suitablecollision-resistant hash function h. For each word in the client list, the followingprotocol is executed:1. Assume the client word is x. The client calculates e such that c = (x||e) ∈C. For the same reasons as in the basic protocol, there is a unique codewordthat starts with these coordinates. Let k = D(c). The client sends the pair(e, h(k)) to the server.2. For each word yi in the server list, the server decodes yi||e using the ef-ficient decoding algorithm D. If decoding succeeds, the server calculatesh(D(yi||e)) and compares it to the hash value sent by the client. If these areequal, the server word matches the client word, and the server sends yi to theclient, encrypted with the users key.This interactive protocol is perfectly secure for the server. However, this comes ata price. First of all, now the clients security is only computational - by the samearguments, the client publishes information about his words (in fact, the entropyloss is equal to the non-interactive case). Moreover, since the server now has todo the decoding, the computational complexity shifts to the server, which maybe undesirable. Lastly, perhaps most importantly, this protocol does not achievethe exact goals we set out at the start - the server will learn which of its wordsmatch the clients list. Unfortunately, this seems to be unavoidable when perfectserver security is desired with small communication complexity (i.e. less thannCnS), since the server can always run his part of the protocol twice (or more)with adjusted server lists - it seems there is not enough communication possiblefor the client to exert control over how often his data is used. Thus the interactiveprotocol is a t-out-of-T (2f(T − t), 0) fuzzy almost-private matching scheme.4.4 Protocol enhancementsIn this section some enhancements to the protocol will be introduced. While theyare written from the perspective of the basic protocol, the enhancements apply tothe interactive version as well.Keylength. The basic protocol assumes an encryption scheme with a keylengthof Tf bits. In particular, this means that T must be large enough to not allow fora brute-force attack on Encki(yi). Moreover, in practice, such a scheme mightbe hard to find, especially if one wants to conform to standards (like AES).Assume that one wants to use an encryption scheme which has a keylength ofl = (T + τ)f bits. For simplicity we will consider the case where f is a divisorof l (in the general case, if we discard a few bits the extra entropy loss will besmall). To arrive at an l-bit key, the server should select an [3T − 2t + τ, T +τ, 2T − 2t+1] MDS code C in the setup phase. Then for each server word yi theserver generates a string ti of τ random symbols, and constructs the codewordci = (yi||ti||ei). Instead of publishing ei, the server will publish (ti||ei). Notethat this construction does not modify the resulting min-entropy of the protocol- it allows one to use a standard encryption scheme, and prevents brute-forceattacks when T is too small.Introducing user dependence. The biggest weakness of the non-interactiveprotocol is that the server has no control over the client. In particular, the client(or anyone who has access to the published server list) can keep trying to finda match until he can successfully decrypt the server word. In order to limit thissomewhat, the server may choose to adapt the protocol slightly and encrypt eachei with the users key (for this we have to assume either a public key, or a sharedsecret key). This protects the server against eavesdropping on the list – the serverinherently has no control over the clients list.Using list decoding. Recent developments in coding theory [12,13] allowone to (list) decode beyond the traditional d−12bound. For (generalised) Reed-Solomon codes, it is possible to decode up to e = n −√kn errors (which isstrictly larger than d−12) in about Õ(n12) time [13, Theorem 6.16]. It is still anopen problem whether this is the best possible result for specific codes, like thegeneralized Reed-Solomon codes used here.These results could be used by a client in the basic protocol to correct more errorsthan anticipated, resulting in the ability to match words that are (slightly) furtherapart. However, we can also use these results positively: if we can efficientlyperform Sudan’s algorithm [12], the protocol only needs a code C’ that can listdecode up to e = T − t errors. This will lead to a smaller length of the used code.5 ConclusionsTwo protocols for t-out-of-T fuzzy private matching were constructed using se-cure sketches based on MDS codes for 2t > T . Both run in small communicationcomplexity, as well as low computation complexity. The first, basic protocol is a(0, 2f(T − t)) fuzzy private matching scheme, or in other words it achieves per-fect client security, and computational (exponential in t) server security in a non-interactive fashion. The second, interactive protocol enjoys perfect server securityand computational client security, i.e. it is a (2f(T − t), 0) fuzzy almost-privatematching scheme. However, in the last scheme the server learns which wordsfrom his list are similar to the clients list.References1. Freedman, M.J., Nissim, K., Pinkas, B.: Efficient private matching and setintersection. In: EUROCRYPT. (2004) 1–192. Fagin, R., Naor, M., Winkler, P.: Comparing information without leaking it.Communications of the ACM 39 (1996) 77–853. Boudot, F., Schoenmakers, B., Traore, J.: A fair and efficient solution to thesocialist millionaires’ problem. Discrete Applied Mathematics 111 (2001)23–364. Lipmaa, H.: Verifiable homomorphic oblivious transfer and private equalitytest. In: ASIACRYPT. (2003) 416–4335. Feigenbaum, J., Ishai, Y., Malkin, T., Nissim, K., Strauss, M.J., Wright, R.N.:Secure multiparty computation of approximations. Lecture Notes in Com-puter Science 2076 (2001) 927+6. Indyk, P., Woodruff, D.P.: Polylogarithmic private approximations and effi-cient matching. In Halevi, S., Rabin, T., eds.: TCC. Volume 3876 of LectureNotes in Computer Science., Springer (2006) 245–2647. Chmielewski, L., Hoepman, J.H.: Fuzzy private matching. Submitted forpublication (2007)8. Dodis, Y., Reyzin, L., Smith, A.: Fuzzy extractors: How to generate strongkeys from biometrics and other noisy data. In: EUROCRYPT. (2004) 523–5409. Juels, A., Wattenberg, M.: A fuzzy commitment scheme. In: ACM Confer-ence on Computer and Communications Security. (1999) 28–3610. MacWilliams, F., Sloane, N.: The theory of error-correcting codes. North-Holland Publishing Co., Amsterdam (1977) North-Holland MathematicalLibrary, Vol. 16.11. Goldreich, O.: Secure multi-party computation. Working Draft (2000)12. Sudan, M.: Decoding of Reed Solomon codes beyond the error-correctionbound. J. Complex. 13 (1997) 180–19313. Guruswami, V.: List Decoding of Error-Correcting Codes (Winning The-sis of the 2002 ACM Doctoral Dissertation Competition). Volume 3282 ofLecture Notes in Computer Science. Springer (2004)

A fair and efﬁcient solution to the socialist millionaires’ problem.

Comparing information without leaking it.

D.P.: Polylogarithmic private approximations and efﬁ-cient matching.

Efﬁcient private matching and set intersection. In: EUROCRYPT.

Secure multiparty computation of approximations.

Veriﬁable homomorphic oblivious transfer and private equality test. In: ASIACRYPT.

https://ris.utwente.nl/ws/files/210516615/Doumen2007non_interactive.pdf

Non-interactive fuzzy private matching

Abstract

Similar works

Full text

Available Versions

NARCIS

University of Twente Research Information