Secure Evaluation of Private Linear Branching Programs with Medical Applications

Abstract

Diagnostic and classification algorithms play an important role in data analysis, with applications in areas such as health care, fault diagnostics, or benchmarking. Branching programs (BP) is a popular representation model for describing the underlying classification/diagnostics algorithms. Typical application scenarios involve a client who provides data and a service provider (server) whose diagnostic program is run on client's data. Both parties need to keep their inputs private. We present new, more efficient privacy-protecting protocols for remote evaluation of such classification/diagnostic programs. In addition to efficiency improvements, we generalize previous solutions - we securely evaluate private linear branching programs (LBP), a useful generalization of BP that we introduce. We show practicality of our solutions: we apply our protocols to the privacy-preserving classification of medical ElectroCardioGram (ECG) signals and present implementation results. Finally, we discover and fix a subtle security weakness of the most recent remote diagnostic proposal, which allowed malicious clients to learn partial information about the program

Constant-Round Private Function Evaluation with Linear Complexity

“…1 We begin by showing a protocol in the semi-honest setting; this illustrates our core techniques and represents what we consider to be our main contribution. (Semi-honest security was the focus of all prior work on PFE [33,6,8,9,11,12,13,19,5,32,30,3].) Zero-knowledge proofs can be used in the standard way [15] to obtain security against malicious parties, still in constant rounds and with linear complexity; however, the resulting protocol is unlikely in practice to out-perform secure computation of universal circuits using efficient protocols for the malicious setting (e.g., [23]).…”

“…Here we treat the more difficult case where everything about the circuit (except an upper bound on its size and the number of inputs/outputs) is hidden. Another direction has been to consider PFE for limited classes of functions: e.g., functions defined by low-depth circuits [33,4], branching programs [19,3], or polynomials [9,27]. Here we handle functions defined by arbitrary (polynomial-size) circuits.…”

“…See Section 2.1 for further discussion.) PFE is useful when the function being computed must remain private, say because the function is classified, because revealing the function would lead to security vulnerabilities, or because the implementation of the function (e.g., the circuit C f itself) is proprietary even if the function f is known [33,6,8,9,11,12,13,19,5,32,30,3].…”

Secure computations on non-integer values

“…For example, several solutions have been proposed that use SMC to enhance privacy in auctions [12], data clustering [13], [14] or filtering [15]. Recently, there is also an increased interest in combining SMC with methods of signal processing in order to be able to privately analyze signals; examples are the analysis of medical signals [16] or the evaluation of biometrics on encrypted data [2]. All these systems currently rely on a fixed-point representation of the signals.…”

Actively Secure Private Function Evaluation

“…A number of previous work [1,2,4,12,14,15,16,17,22,24] have considered the design and implementation of more efficient general-and special-purpose private function evaluation. A major motivation behind these solutions (and PFE in general) is to hide the function being computed since it is proprietary, private or contains sensitive information.…”