Privacy-Preserving Set Operations

Abstract

In many important applications, a collection of mutually distrustful parties must perform private computation over multisets. Each party's input to the function is his private input multiset. In order to protect these private sets, the players perform privacy-preserving computation; that is, no party learns more information about other parties' private input sets than what can be deduced from the result. In this paper, we propose efficient techniques for privacy-preserving operations on multisets. By employing the mathematical properties of polynomials, we build a framework of efficient, secure, and composable multiset operations: the union, intersection, and element reduction operations. We apply these techniques to a wide range of practical problems, achieving more efficient results than those of previous work.

On the Feasibility of a Technological Response to the Surveillance Morass

“…For example, the NSA's "co-traveler" program [7] finds unknown associates of known (presumably legitimate) surveillance targets by first intersecting cell-tower dumps from times and locations at which a particular known target appeared and then interpreting the intersection as the set of cell-phone numbers of people who may be "traveling with" the known target. By using privacy-preserving set intersection, a well studied cryptographic problem for which there are efficient solutions [8][9][10], the agency could arrive at the same (small) set of co-travelers' phone numbers without learning the phone numbers of the (large) set of innocent people who happen to have used one of the same cell towers at a relevant time. No doubt there are other well understood protocols in the vast cryptographic literature that could be used to find truly useful intelligence without revealing massive amounts of private information about ordinary citizens.…”

Privacy Preserving Group Linkage

“…Among the more popular approaches, solutions based on homomorphic encryption (e.g. [4,16]) or commutative encryption (e.g. [1]) require higher computational overhead.…”

Cryptology and Network Security

“…Private set intersection protocols [3,8,11] enable two or more parties that each hold a set of inputs drawn from a large domain to jointly calculate the intersection of their inputs, without leaking additional information. The private set intersection proposed by Freedman et al [8] 1 is a two-party protocol between a client C and a server S. C's input is a set of size k C , drawn from some domain of size N; S's input is a set of size k S drawn from the same domain.…”