EPISODE: Efficient Privacy-PreservIng Similar Sequence Queries on Outsourced Genomic DatabasEs

Abstract

Nowadays, genomic sequencing has become much more affordable for many people and, thus, many people own their genomic data in a digital format. Having paid for genomic sequencing, they want to make use of their data for different tasks that are possible only using genomics, and they share their data with third parties to achieve these tasks, e.g., to find their relatives in a genomic database. As a consequence, more genomic data get collected worldwide. The upside of the data collection is that unique analyses on these data become possible. However, this raises privacy concerns because the genomic data uniquely identify their owner, contain sensitive data about his/her risk for getting particular diseases, and even sensitive information about his/her family members. In this paper, we introduce EPISODE-a highly efficient privacypreserving protocol for Similar Sequence Queries (SSQs), which can be used for finding genetically similar individuals in an outsourced genomic database, i.e., securely aggregated from data of multiple institutions. Our SSQ protocol is based on the edit distance approximation by Asharov et al. (PETS'18), which we further optimize and extend to the outsourcing scenario. We improve their protocol by using more efficient building blocks and achieve a 5-6× runtime improvement compared to their work in the same two-party scenario. Recently, Cheng et al. (ASIACCS'18) introduced protocols for outsourced SSQs that rely on homomorphic encryption. Our new protocol outperforms theirs by more than factor 24 000× in terms of run-time in the same setting and guarantees the same level of security. In addition, we show that our algorithm scales for practical database sizes by querying a database that contains up to a million short sequences within a few minutes, and a database with hundreds of whole-genome sequences containing 75 million alleles each within a few hours. CCS CONCEPTS • Security and privacy → Privacy-preserving protocols; Management and querying of encrypted data; Privacy protections; * A summary of preliminary results of this paper has been published as short paper at WPES'18 [38]. This is the full version.

Privacy-Preserving Identification of Target Patients from Outsourced Patient Data

“…Our threat model is consistent with previous work [19,24]. Client, hospital(s), and the CSP are assumed to be semi-honest, that is, they honestly follow the protocol while trying to learn extra information during the protocol.…”

“…Moreover, the encryption algorithm supports identification of case and control groups efficiently, without information leakage. Furthermore, the identification process requires less communication compared with secure multi-party computation-based approaches [24] and less computation compared to homomorphic encryption-based approaches [4]. In general, the execution of privacy-preserving identification of target group of patients can be divided into seven phases: data preprocessing, initialization, key generation, data encryption, client authorization, query generation, identification of case and control groups.…”

Recent Advances in Practical Secure Multi-Party Computation

“…In this setting, each two-party has a string (e.g., genome string) and computes the edit distance between these two strings. There are many research results on approximate edit distance computation (e.g., [30], [69]) since we need costly dynamic programming for exact edit distance computation. We also have results on the extended edit distance computation like weighted edit distance and Needleman-Wunsch distance [70].…”

PILOT: Practical Privacy-Preserving Indoor Localization Using OuTsourcing

“…It is important to note that by using the outsourcing setting we achieve practical PPIL with security against malicious PPIL clients and malicious PPIL servers, whereas in the client/server setting even solutions with substantially weaker security against a semihonest client currently have impractical runtimes and communication. Furthermore, the outsourcing model with multiple STTPs is widely adopted not only in recent academic papers, e.g., for private machine learning [70,71], and genomic privacy [72,73,74,75,76,77], to name just a few, but also deployed in industrial products, see [78] for a few examples.…”