Last When We Met
Data Privacy in Biomedicine Lecture 24: Strengthening Privacy Preserving Data Mining via Probability
Bradley Malin, PhD ([e-mail]) Assistant Professor of Biomedical Informatics, School of Medicine Assistant Research Professor of Computer Science, School of Engineering Vanderbilt University April 10, 2008
We were considering collusion problems in the horizontal partitioned privacy preserving data mining problem Actually, there are still problems. Let's look at the situation graphically.
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
2
Example: Set Union
Prior model
Encrypt and pass
h(h(h(h(D2,y2),y3),y4),y1) L1 D2 L4 L2
Example: Set Union
Prior model
Encrypt and pass "odd"/ "even" locations pass to location L1 / L2
L4 L1
L2
h(D2,y2) L3 L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
4
Example: Set Union
Prior model
Encrypt and pass "odd"/ "even" locations pass to location L1 / L2 L1 and L2 union data U
L1
Example: Set Union
Prior model
Encrypt and pass "odd"/ "even" locations pass to location L1 / L2 L1 and L2 union data Decryption down the line
L1 h(h(h(U,y2),y3),y4) L4 h(U,y4) L2
L4
L2
h(h(U,y3),y4) L3
L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
5
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
6
1
Example: Set Union
Prior model
Encrypt and pass "odd"/ "even" locations pass to location L1 / L2 L1 and L2 union data Decryption down the line Last location broadcasts
L1
Application: Set Union
Problems
susceptible to collusion "Power parties" require more trust Broadcast of result required
L1
L4
ANSWER U!
L2
L4
L2
L3
L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
7
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
8
Outline
From Global to Local Responses Crypto to Prevent Collusion Key Switching Grab-and-Go's
Personalization
Inject a semi-trusted third party mediator Removes power players Enables personalized responses to each of the locations Local control over security parameters Let's consider a variant of the protocol
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
9
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
10
Basic Protocol
Location L controls encryption and submission of own dataset DL
L4 D1 L1
Basic Protocol
Location L controls encryption and submission of own dataset DL
L2 L4 L1 h(D1, y1)
L2
L3
L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
11
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
12
2
Basic Protocol
Location L controls encryption and submission of own dataset DL
L4 L1 h(h(D1, y1), y2) L2
Basic Protocol
Location L controls encryption and submission of own dataset DL
L4 L1 h(h(D1, y1), y2) L2
L3
L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
13
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
14
Basic Protocol
Location L controls encryption and submission of own dataset DL
L4 L1
Basic Protocol
Location L controls encryption and submission of own dataset DL
L2 L1 h(h(h(D1, y1), y2), y3) L4 L2
h(h(h(D1, y1), y2), y3) L3 L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
15
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
16
Basic Protocol
Location L controls encryption and submission of own dataset DL
L1 h(h(h(D1, y1), y2), y3), y4) L4 L2
Basic Protocol
Location L controls encryption and submission of own dataset DL Submit to Central
D4 L4 Central D3 L3 L3 L2 D2 L1 D1
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
17
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
18
3
Basic Protocol
Location L controls encryption and submission of own dataset DL Submit to Central Central analyzes, responds with RL Decryption proceeds similarly to encryption
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 19
Basic Protocol
L1 R1
Location L controls encryption and submission of own dataset DL
L2 R2
L1 h(h(h(R1, y1), y2), y3), y4) L4 L2
R4 L4 Central R3 L3
Submit to Central Central analyzed and responds with RL Decryption proceeds similarly to encryption
Data Privacy in Biomedicine: Lecture 23 PPDM
L3
2008 Bradley Malin
20
Basic Protocol
Location L controls encryption and submission of own dataset DL Submit to Central Central analyzed and responds with RL Decryption proceeds similarly to encryption
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 21
Basic Protocol
L1
h(h(R1, y1), y2), y3) L4 L2
Location L controls encryption and submission of own dataset DL Submit to Central Central analyzed and responds with RL Decryption proceeds similarly to encryption
Data Privacy in Biomedicine: Lecture 23 PPDM
R1 L1
L4
L2
Applies z4 L3 L3
2008 Bradley Malin
22
Complexity
Number of encryptions / decryptions per location 2(1 + 1 + |L|) O(|L|)
Blinding during encryption Blinding during decryption
Bandwidth
Submisson and return datasets DL and RL, resp. 2* (|L|-1)*(|DL| + |RL|) + |DL| + |RL|
Submission to Central Reception from Central
All Locations
O(|L|2)
But, these can be executed in parallel
= O(|L|(|DL| + |RL|)) per location Assume each location has the same size DBs, the total bandwidth is = O(|L|2 (|DL| + |RL|))
23 Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 24
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
4
Outline
From Global to Local Responses Crypto to Prevent Collusion Key Switching Grab-and-Go's
Integrating Security via Blinding
Problem: Susceptible to semi-honest collusion Introduce "blinding" yLb, zLb
Akin to one-time use pseudo-location "Signing carbon copy letter in a sealed envelope" (Chaum, 1982) L1
y1b h(D1,y1b) h(h(D1,y1b), y2m) z1b,y1m y2m
L2
Central
BLINDED SUBMISSION
"multiuse" key
h(h(D1,y1m), y2m)
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
25
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
26
Integrating Security via Blinding
Introduce "blinding" yLb, zLb Blind again to decrypt response yLr, zLr Guarantees collusion not possible among locations
L1 BLINDED RESPONSE L2 Central h(h(R1,y1m), y2m) Analysis Complete
Application Revisited: Set Union
Each location uses blinding and key switch detection D1 L1
L4
L2
y1r h(h(h(R ,y r), y m), y m) 1 1 1 2 h(h(R1,y1 z1m,z1r
r),
L3
y1
m)
z 2m
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
27
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
28
Application Revisited: Set Union
Each location uses blinding and key switch detection h(h(h(h(D1,y1),y2),y3),y4) L1
Application Revisited: Set Union
Each location uses blinding and key switch detection Multiuse encrypted data sent to Central L4 L1
L4
L2
Central
L2
L3
L3
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
29
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
30
5
Application Revisited: Set Union
Each location uses blinding and key switch detection Multiuse encrypted data sent to Central Central merges data U Central
Application Revisited: Set Union
Each location uses blinding and key switch detection Multiuse encrypted data sent to Central Central merges data U Central uses own blinding key and sends data around for decryption L1
L4
Central (U,yC) L3
L2
h(h(h(h(D1,y1),y2),y3),y4)
h(h(h(h(D4,y1),y2),y3),y4)
h(h(h(h(U,y1),y2),y3),y4)
h(h(h(h(D2,y1),y2),y3),y4)
h(h(h(h(D3,y1),y2),y3),y4)
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 31 Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 32
Application Revisited: Set Union
Each location uses blinding and key switch detection Multiuse encrypted data sent to Central Central merges data U Central uses own blinding key and sends data around for decryption
In Comparison to Prior Model Trust in all participants minimized to arbitrary level (i.e. no more "power parties") No collusion possible Global response (but could have been differential)
Outline
From Global to Local Responses Crypto to Prevent Collusion Key Switching
Partial Full
L1
ANSWER U!!!! L2
L4
Central
L3
Grab-and-Go's
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
33
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
34
But What about Malicious?
1. Key Switching - encrypt location's data with "bad" key
Prevent data from correct representation at Central 1. full encrypt another location's data with different key
yAm yBm DA DB yASWITCH yBm
Partial Key Switch Detection
Repeat as necessary
Location pads with dummy data Blinds; everyone proves correct encrypt/decrypt exists New key for decrypt (check) L1 y1b h([D1,dummy1], y1b) h(h([D1,dummy1], y1b), y2m) y1check y2m L2 If CHECKED correct Then use POTENTIAL POTENTIAL y1m), h(h([D1,dummy1], y2m) h(h(h([D1,dummy1], y1b), y1check), y2m) h(h([D1,dummy1], y1b ), y1check) z2m CHECKED
2008 Bradley Malin 36
2. partial encrypt part of another locations data
yAm yBm DB yA
SWITCH
yB
m
We can design protocols to address each problem*
*B. Malin et al. Configurable security protocols for multiparty data analysis with malicious participants. Proc IEEE ICDE. 2005: 533-544. Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 35
z1check,z1b
Data Privacy in Biomedicine: Lecture 23 PPDM
6
Partial Key Switch Detection
Probability a location achieves a partial key switch can be set arbitrarily low Malicious location must "find" switched data Imagine two locations: Alice (good) and Mallory (malicious) Alice chooses dummy values to add to dataset DAlice Mallory chooses f values from Alice to encrypt with "bad" key; encrypts n-f with the "good" key But now... Mallory needs to prove to Alice that he can decrypt these records AFTER blinding!
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 37
Partial Key Switch Detection
Unless Mallory knows how Alice shuffled the records, he's performing a random selection Think of this as "bins & balls"
Mallory throws f red balls into the bin Mallory throws n-f black balls into the bin
What's the probability Mallory selects f red balls (without replacement) before a black ball?
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 38
Partial Key Switch Detection
With every correct selection of a red ball, the problem becomes harder!
That is - for Mallory. Ratio of red to black is decreasing
Partial Key Switch Detection
The probability is maximized when Mallory sets f to either
log prob. find all switched
1 or |DAlice| + |dummy| -1 Symmetric distribution
(i.e., n-1)
In fact, it's a hypergeometric probability distribution!
Several options for increased security with various tradeoffs
Increase padding (i.e., size of ): computation scales quadratically with size of dataset Increase number of encryption / decryption rounds: communication scales linearly in number of locations
Probability is
f n - f n - n f
f f
1 # of values switched
n-1
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
39
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
40
Outline
From Global to Local Responses Crypto to Prevent Collusion Key Switching
Partial Full
Moving Beyond Partial
Ok, so that solves the partial key switch issue... ...but what about the full key switch? Can we use this method to prevent it? No. Why?
Grab-and-Go's
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
41
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
42
7
Full Key Switch Detection
One time shot
Central sends the same dummy data to each location Each location adds dummy data to their dataset If someone attempts full key switch missing common value L1 Basic Protocol Basic Protocol L2
dummy dummy h(h(dummy, y1m), y2m) h(h(dummy, y1m), y2m)
Full Key Switch Detection Proof (Sketch)
One way malicious location can achieve full key switch Use the "bad" key with every location's data But this would imply that no "good" key was used... ... thus, the "bad" key is actually the "good" key!
Central
Distributed Integrity Check
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 43 Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 44
Be Careful
If Central fails to detect the dummy data - it can not claim that a full key switch has been committed... ... It's possible that a location failed to insert the dummy into their dataset. Remember: this is only a protocol
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 45 Data Privacy in Biomedicine: Lecture 23 PPDM
Outline
From Global to Local Responses Crypto to Prevent Collusion Key Switching Grab-and-Go's
2008 Bradley Malin
46
Beyond Key Switches
Just learned we can detect key switches We didn't prove the keys will be used Hoorah! Shucks! But, all we proved is that the correct keys exist!
Locking Mechanism
Central can make each location prove they can correctly decrypt the response Central can do so without asking the locations to reveal the actual values in their datasets Again, we use dummy data generated by Central, DC Initialization: Central uses the blinding protocol to generate a fully encrypted version of the dummy data
47 Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin 48
Imagine, everyone decrypt's Mallory's dataset, but Mallory refuses to decrypt Alice's dataset. In effect Mallory grabs his data and walks away ... leaving Alice in the cold; a.k.a. the "grab-and-go"
Data Privacy in Biomedicine: Lecture 23 PPDM 2008 Bradley Malin
8
Central Setup
Central generates a fully encrypted dummy dataset Use blinding as before yCb, zCb
L1
h(DC,yCb)
Locking Mechanism
For each location
Central generates a blinding key pair <yCL, zCL> Sends blinded dummy data with AND without full encryption
L1 Central
yCb
L2
h(DC, yC1)
Central
h(h(h([DC, return1] y1m), y2m), yC1)
L2
BLINDED DUMMY BUILD
y1m
h(h(DC,yCb), y1m) h(h(DC,yCb), y1m) y2m h(h(h(DC,yCb), y1m) , y2m) zCb
h(h(h([DC, return2] y1m), y2m), yC2) h(DC, yC2)
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Bradley Malin
49
Data Privacy in Biomedicine: Lecture 23 PPDM
2008 Br...