Secure Grouping and Aggregation with MapReduce

Transcription

1 1/27 Secure Grouping and Aggregation with MapReduce Radu Ciucanu Matthieu Giraud Pascal Lafourcade Lihua Ye 28 July 2018 SECRYPT, Porto

2 2/27 Example of Grouping and Aggregation Name Department Salary Alice Computer Science 1900 Bob Mathematics 1750 Mallory Computer Science 1800 Oscar Physics 2000 Carol Mathematics 1600

3 2/27 Example of Grouping and Aggregation Name Department Salary Alice Computer Science 1900 Bob Mathematics 1750 Mallory Computer Science 1800 Oscar Physics 2000 Carol Mathematics 1600 Department COUNT SUM AVG MAX MIN Computer Science Mathematics Physics

4 MapReduce I Partitioning input data I Scheduling program execution on machines I Performing the shuffle I Handling machine failures Input 1 Input 2 Input 3 Map 1 Map 2 Map 3 Shuffle Programmer gives: Reduce 1 Reduce 2 Output 1 Output 2 I Input files I Map and Reduce 3/27

5 Grouping and Sum with MapReduce User Data owner D M R P γdept,sum(salary) (D) Map: M R: (πdept (t), πsalary (t)) Reduce: Input: (key P, values) sum = πdept (t) values πsalary (t) R P : (πdept (t), sum). t D Name Alice Bob Mallory Oscar Carol Department Computer Science Mathematics Computer Science Physics Mathematics Salary Department Salary Computer Science Mathematics Computer Science Physics Mathematics Department SUM Computer Science Mathematics Physics /27

6 Security Model Cloud is honest-but-curious f( Cloud Data Owner f ) User Security properties I Secrecy of and f( ) I User queries f( ) but cannot learn 5/27

7 Contributions Secure MapReduce Algorithms: I COUNT I SUM I AVG I MAX I MIN Secure Private Approach I Cloud nodes do not learn I Cloud nodes do not learn f( ) I User does not learn 6/27

8 7/27 Outline Cryptography Pseudo-Random Permutation Partial Homomorphic Encryption Oder Preserving Encryption Secure-Private MapReduce for COUNT, SUM and AVG Secure-Private MapReduce for MIN and MAX Security and Performances Conclusion

9 Pseudo-Random Permutation Idea: f : {0, 1} n {0, 1} n 0 {0, 1} n 1 Deterministic Result indistinguishable from a random Not inversible Notation: Data owner picks a key k and uses f k (m) 8/27

10 9/27 Fully Homomorphic Encryption (Gentry 2009) Idea: Perform ANY computations on encrypted data f, x i, f (E k (x 1 ),..., E k (x n )) = E k (f (x 1,..., x n )) Not yet efficient enough

11 Partial Homomorphic Encryption Paillier s Cryptosystem (1999) Public Key encryption Probabilistic encryption E pk (x + y) = E pk (x) E pk (y) E pk (x y) = (E pk (x)) y 10/27

12 11/27 Oder Preserving Encryption Agrawal et al. Cryptosystem (2004) Let c 1 = E k (m 1 ) and c 2 = E k (m 2 ) Symmetric encryption if m 1 < m 2 then c 1 < c 2

13 12/27 Outline Cryptography Pseudo-Random Permutation Partial Homomorphic Encryption Oder Preserving Encryption Secure-Private MapReduce for COUNT, SUM and AVG Secure-Private MapReduce for MIN and MAX Security and Performances Conclusion

14 13/27 COUNT, SUM and AVG Preprocessing on data All data are encrypted with Paillier with pk U All data d have f k (d) Name Dept Salary A CS 1900 B Math 1750 M CS 1800 O Phy 2000 C Math 1600 Name Dept Salary f k (A),E pku (A) f k (CS), E pku (CS) f k (1900), E pku (1900) f k (B),E pku (B) f k (Math), E pku (Math) f k (1750), E pku (1750) f k (M),E pku (M) f k (CS), E pku (CS) f k (1800), E pku (1800) f k (O),E pku (O) f k (Phy), E pku (Phy) f k (2000), E pku (2000) f k (C),E pku (C) f k (Math), E pku (Math) f k (1600), E pku (1600)

15 Secure Private COUNT Name Dept Salary fk(a),epk U (A) fk(cs), Epk U (CS) fk(1900), Epk U (1900) fk(b),epk U (B) fk(math), Epk U (Math) fk(1750), Epk U (1750) fk(m),epk U (M) fk(cs), Epk U (CS) fk(1800), Epk U (1800) fk(o),epk U (O) fk(phy), Epk U (Phy) fk(2000), Epk U (2000) fk(c),epk U (C) fk(math), Epk U (Math) fk(1600), Epk U (1600) (f k (CS), (E pku (CS), E pku (1))) (f k (CS), (E pku (CS) E pku (1))) (f k (Math), (E pku (Math), E pku (1))) (f k (Math), (E pku (Math), E pku (1))) (f k (Phy), (E pku (Phy), E pku (1))) (Epk U (CS), Epk U (2)) (Epk U (Math), Epk U (2)) (Epk U (Phy), Epk U (1)) γ A,COUNT( ) (D) Map: M R: { (π A f k (t), (π A E pku (t), E pku (1))) } t D Reduce: count = E pku ( π A f k (t) values 1) = π A f k (t) values E pk U (1) R P : (π A E pku (t), count). 14/27

16 Secure Private SUM Name Dept Salary fk(a),epk U (A) fk(cs), Epk U (CS) fk(1900), Epk U (1900) fk(b),epk U (B) fk(math), Epk U (Math) fk(1750), Epk U (1750) fk(m),epk U (M) fk(cs), Epk U (CS) fk(1800), Epk U (1800) fk(o),epk U (O) fk(phy), Epk U (Phy) fk(2000), Epk U (2000) fk(c),epk U (C) fk(math), Epk U (Math) fk(1600), Epk U (1600) (f k(cs), (E pku (CS), E pku (1900))) (f k(cs), (E pku (CS) E pku (1800))) (f k(math), (E pku (Math), E pku (1750))) (f k(math), (E pku (Math), E pku (1600))) (f k(phy), (E pku (Phy), E pku (2000))) (Epk U (CS), Epk U (3700)) (Epk U (Math), Epk U (3350)) (Epk U (Phy), Epk U (2000)) γ A,SUM(B) (D) Map: M R: { (π A f k (t), (π A E pku (t), π B E pku (t))) } t D Reduce: sum = E pku ( π A f k (t) values π B(t)) = π A f k (t) values π BE pku (t) R P : (π A E pku (t), sum). 15/27

17 16/27 Secure Private AVG γ A,AVG(B) (D) Map: M R: { (π A f k (t), (π A E pku (t), π B E pku (t), E pku (1))) } t D Reduce: count = E pku ( π A f k (t) values 1) = π A f k (t) values E pk U (1) sum = E pku ( π A f k (t) values π B(t)) = π A f k (t) values π BE pku (t) R P : (π A E pku (t), (sum, count)).

18 17/27 Outline Cryptography Pseudo-Random Permutation Partial Homomorphic Encryption Oder Preserving Encryption Secure-Private MapReduce for COUNT, SUM and AVG Secure-Private MapReduce for MIN and MAX Security and Performances Conclusion

19 18/27 MIN & MAX Preprocessing on data All data are encrypted with OPE with a shared key K DU And encrypted with the public key of the node pk C All data d have f k (d)

20 Secure Private MIN Name Dept Salary fk(a),ek DU (A) fk(cs), Ek DU (CS) fk(1900), Ek DU (1900) fk(b),ek DU (B) fk(math), Ek DU (Math) fk(1750), Ek DU (1750) fk(m),ek DU (M) fk(cs), Ek DU (CS) fk(1800), Ek DU (1800) fk(o),ek DU (O) fk(phy), Ek DU (Phy) fk(2000), Ek DU (2000) fk(c),ek DU (C) fk(math), Ek DU (Math) fk(1600), Ek DU (1600) (f k(cs), (E kdu (CS), E kdu (1900))) (f k(cs), (E kdu (CS) E kdu (1800))) (f k(math), (E kdu (Math), E kdu (1750))) (f k(math), (E kdu (Math), E kdu (1600))) (f k(phy), (E kdu (Phy), E kdu (2000))) (Ek DU (CS), Ek DU (1800)) (Ek DU (Math), EK DU (1600)) (Ek DU (Phy), Ek DU (2000)) γ A,MIN(B) (D) Map: M R: { (π A f k (t), (π A E pku (t), π B (t))) } t D Reduce: M = min πa f k (t) valuesd skd π B (t) R P : (π A E pku (t), M). 19/27

21 20/27 Outline Cryptography Pseudo-Random Permutation Partial Homomorphic Encryption Oder Preserving Encryption Secure-Private MapReduce for COUNT, SUM and AVG Secure-Private MapReduce for MIN and MAX Security and Performances Conclusion

22 21/27 Security Theorem The SP-SUM, SP-COUNT, SP-AVG, SP-MIN, and SP-MAX protocols securely compute the grouping and aggregation in the ROM in the presence of honest-but-curious adversary even if cloud nodes collude.

23 22/27 Combiners and Improvements COUNT SUM AVG Map can perform some aggregations MAX & MIN We can split it into 2 rounds to counter possible frequency attacks against OPE

24 23/27 Performances of COUNT, SUM & AVG Seconds Avg without combiner Avg with combiner Sum without combiner Sum with combiner Count without combiner Count with combiner 50 1,000 1,840 2,680 3,520 4,360 5,200 Number of tuples/k

25 24/27 Performances of MIN Seconds Nosecure 1Round Nosecure 2Round Secure 1Round Secure 2Round ,888 3,265 4,642 Number of tuples/k

26 25/27 Outline Cryptography Pseudo-Random Permutation Partial Homomorphic Encryption Oder Preserving Encryption Secure-Private MapReduce for COUNT, SUM and AVG Secure-Private MapReduce for MIN and MAX Security and Performances Conclusion

27 Conclusion Secure-Private MapReduce: COUNT, SUM, AVG, & MAX MIN Using Paillier and OPE Honest-but-curious adversay Next step Combinaisons of COUNT, SUM, AVG, MAX & MIN 26/27

28 Questions? 27/27