Sub-linear Privacy-preserving Search with Unsecured Server and Semi-honest Parties

Privacy-preserving Near-neighbor search (PP-NNS) is a wellstudied problem in the literature. The overwhelming growth in the size of current datasets and the lack of any truly secure server in the online world render the existing solutions impractical either due to their high computational requirements or the non-realistic assumptions which potentially compromise privacy. PP-NNS with multiple (semi-honest) data owners having query time sub-linear in the number of users has been proposed as an open research direction in [30]. In this paper, we provide the first such algorithm which has a sub-linear query time and the ability to handle semi-honest (honest but curious) parties. Our algorithm can further manage the situation where a large chunk of the server information is being compromised. Probabilistic embedding based on Locality Sensitive Hashing (LSH) is the algorithm of choice for sub-linear nearneighbor search in high dimensions [24]. However, in this paper, we show that LSH is not suitable for semi-honest setting, and particularly when the server information is compromisable. LSH allows estimation of any pairwise distances between users, which can be easily compromised to learn user attributes using the idea of “triangulation”. We suggest a novel methodology which overcomes this LSH vulnerability. At the heart of our proposal lies a secure probabilistic embedding scheme generated from a novel probabilistic transformation over appropriate LSH family. Our well-tailored transformation preserves the near-neighbor embedding of the LSH, which is required for sub-linear nearneighbor search, and at the same time destroys the distance information between non-neighbors, making distance estimation impossible. Our secure embeddings combined with advances in multi-party computation result in an efficient PP-NNS algorithm suitable for massive-scale datasets without strong assumptions on the behavior of parties involved. We demonstrate the validity of our claims by experimentally demonstrating the effectiveness of our solution in hiding the sensitive variables in medical records without compromising the precision-recall of the retrieval. ∗ indicates equal contribution of Authors † Work done as a part of COMP 640 course project at Rice instructed by Dr. Shrivastava 1. MOTIVATION AND PROBLEM SETTING Near-Neighbor Search (NNS) is one of the most fundamental and frequent tasks in large-scale data processing systems. The demand for privacy in big-data systems has led to an increasing interest in the problem of privacy-preserving near-neighbor search (PP-NNS). System Goal: The scenario we are interested in is as follows: We are given a giant collection C of users (or Data Owners), each represented by some D dimensional attribute vectors, i.e., C ⊂ R. We are interested in being able to get answers to near-neighbor queries, i.e., for a given vector q, we want to compute arg max x∈C Sim(x, q), where Sim(., .) is a desired similarity measure. However, the process should prevent any given (possibly malicious) user from inferring the attributes of other users, except for the information that can be inferred from the answer of the NNS queries. The above setting is natural and ubiquitous in the online world where matching and recommendations are common [34]. For example, on dating websites, a user is interested in finding a match (near neighbors) without revealing their attributes to anyone who is a mismatch. NNS cannot be entirely secure, regardless of implementation details. For example, if user i and j are very close regarding similarity (near identical), then the near-neighbor query of user i should return j as the correct answer (with high probability). A correct answer automatically reveals information that j’s attributes are likely to be very similar to i’s attributes (with high probability). This kind of information leak cannot be avoided by any algorithm answering the near-neighbor query with reasonable accuracy. Nevertheless, this kind of information leak is acceptable in current and connected real world. For instance, if a Twitter user Alice re-tweeted a friend Bob’s tweet, all Alice’s friends could know what Bob posted even though part of them were not Bob’s friends. Any adversary, possessing data owner role, can query to learn extra information about its neighbors. However, an inference of attribute information from any non-neighbor party or adversary is not acceptable. Moreover, we cannot assume any trusted server in real settings. For instance, privacy breaches where the data servers have been compromised for a significant chunk of their data are common in recent times. A famous one being the recent Yahoo’s massive leak, which compromised 500 million user accounts including private information like phone number, ar X iv :1 61 2. 01 83 5v 1 [ cs .C R ] 6 D ec 2 01 6 date of birth and even answers to security questions. It is, therefore, desirable that the protocol does not rely on the complete security of participating servers and even if data from the server is compromised, the user’s information should be secure. Threat Model: There are two parties involved in our model: servers and data owners. The models in previous works, for example [30], usually have trusted servers. In many practical scenarios, like for medical records, users do not trust server, and they do not want to share any personal information due to potential threats common in the online environment. Similar level of privacy is also desirable in the setting of personal recommendations (of friends, events, movies, etc.) especially based on neighborhood models [46], online classification based on k-NN search, face recognition [37], secure biometric authentication [2, 4], privacypreserving speech recognition [33], etc. Keeping in mind the big-data and modern security challenges, we are interested in three main requirements: 1) We do not assume any trusted server 2) Semi-honest Data Owners (Users) and 3) The query time should be sub-linear (near constant) in the number of users (or database size), which can handle web-scale datasets. Finding sub-linear privacy preserving solution without any trusted party is currently considered to be a critical, yet open, research direction as stated in a recent article [30]. We briefly explain the three requirements: 1. Untrusted (compromisable) server: One of the common shortcomings of many existing solutions is the need of a trusted party. There have been many incidents where such trusted servers are compromised raising concerns over the validity of trusted server assumption. Thus, current users are not comfortable in sharing their sensitive information. A practical solution must therefore not involve any trusted party, i.e., all the data of the user remains with the user and should never be revealed to any cloud storage or cloud server. The users should only communicate with the server via secure mechanisms. Similar to the untrusted servers assumption in [14], servers in our system are trusted for availability [30]. 2. Semi-honest Data Owners (Users): We assume semi-honest data owners who follow the protocols but attempt to learn query or data values of other users. Furthermore, colluding data owners in (relatively small) groups and issuing multiple queries should not affect the privacy of the protocol. 3. Query Time Should be Sub-linear: With the data explosion in modern applications, scanning all the data (O(N)) for answering one query is prohibitively expensive, especially in latency-critical applications like recommendations. PPNNS can only be deemed practical if it admits algorithms sub-linear (near constant) in the size of the database (or the number of users N). It should be further noted that privacy guarantees in the near-neighbor setting always rely on the inherent assumption on bounded computations. Given unbounded computations, the adversary can enumerate the whole space of every possible vector and use near-neighbor query until the generated vector returns the target user as the neighbor. In high dimensions, this process will require exponential computations due to the curse of dimensionality, which turns out to be a boon for the privacy of NNS. PP-NNS is a heavily studied problem. However, existing PP-NNS algorithms fail in one of the above three requirements. We briefly discuss some prior related works: Secure Distance Computation Based Methods: A common philosophy in most of the modern techniques for PP-NNS is to use the very well studied topic of secure computations. Cryptographic primitives to securely compute the distances by performing the computation on encrypted version of the data [17] are commonly adopted. The security of this approach, like cryptographic tools, is based on the hardness of some problems in number theory (e.g. factorization of large numbers). Since every single bit in the computation is encrypted, distance calculations are computationally demanding and slow. Another popular approach is to use information-theoretic secure computations, which guarantees that even with unlimited computational power no adversary could compromise the data. This method is based on sharing secret information to perform the secure computations. Securely computing pairwise distances requires comparison which cannot be carried out using secretsharing alone and needs some cryptographic blocks [28, 15] which limits the overall scalability. All of these algorithms work by first computing all possible distances securely followed by finding the near-neighbors based on distance values. Irrespective of the techniques used, calculating all possible distances O(N) is required. This line of work, thus, fails to address the sub-linear time requirement making it unscalable and impractical to modern massive datasets. Differential Privacy(DP) and Adding Noise: There has been a successful progress of differential privacy [16, 22]. However, DP assumes a trusted server that holds all sensitive data, and the goal is to provid