Verifying computations with streaming interactive proofs

Cormode, Graham; Thaler, Justin; Yi, Ke

doi:10.14778/2047485.2047488

Cited by 48 publications

(118 citation statements)

References 31 publications

Supporting

Mentioning

117

Contrasting

Order By: Relevance

“…Similarly, they turn an online AMA protocol for F into an online AA protocol, which is also just a one-way randomized protocol for F . has an online MAMA protocol that is polynomially more efficient than any online AMA protocol (see e.g., [3,42]). …”

Section: Implications Of the Lower Boundmentioning

confidence: 99%

Practical verified computation with streaming interactive proofs

Cormode

Mitzenmacher

Thaler

2012

Proceedings of the 3rd Innovations in Theoretical Computer Science Conference

Self Cite

144

269

View full text Add to dashboard Cite

When delegating computation to a service provider, as in the cloud computing paradigm, we seek some reassurance that the output is correct and complete. Yet recomputing the output as a check is inefficient and expensive, and it may not even be feasible to store all the data locally. We are therefore interested in what can be validated by a streaming (sublinear space) user, who cannot store the full input, or perform the full computation herself. Our aim in this work is to advance a recent line of work on "proof systems" in which the service provider proves the correctness of its output to a user. The goal is to minimize the time and space costs of both parties in generating and checking the proof. Only very recently have there been attempts to implement such proof systems, and thus far these have been quite limited in functionality.Here, our approach is two-fold. First, we describe a carefully chosen instantiation of one of the most efficient general-purpose constructions for arbitrary computations (streaming or otherwise), due to Goldwasser, Kalai, and Rothblum [19]. This requires several new insights and enhancements to move the methodology from a theoretical result to a practical possibility. Our main contribution is in achieving a prover that runs in time O(S(n) log S(n)), where S(n) is the size of an arithmetic circuit computing the function of interest; this compares favorably to the poly(S(n)) runtime for the prover promised in [19]. Our experimental results demonstrate that a practical general-purpose protocol for verifiable computation may be significantly closer to reality than previously realized.Second, we describe a set of techniques that achieve genuine scalability for protocols fine-tuned for specific important problems in streaming and database processing. Focusing in particular on noninteractive protocols for problems ranging from matrix-vector multiplication to bipartite perfect matching, we build on prior work [8,15] to achieve a prover that runs in nearly linear-time, while obtaining optimal tradeoffs between communication cost and the user's working memory. Existing techniques required (substantially) superlinear time for the prover. Finally, we develop improved interactive protocols for specific problems based on a linearization technique originally due to Shen [34]. We argue that even if general-purpose methods improve, fine-tuned protocols will remain valuable in real-world settings for key problems, and hence special attention to specific problems is warranted.

show abstract

Section: Implications Of the Lower Boundmentioning

confidence: 99%

Practical verified computation with streaming interactive proofs

Cormode

Mitzenmacher

Thaler

2012

Proceedings of the 3rd Innovations in Theoretical Computer Science Conference

Self Cite

144

269

View full text Add to dashboard Cite

show abstract

“…The research community has introduced streaming verifiable computation, both in the statistical [11,12] and the cryptographic setting [10,42], where a verifier and a prover observe a stream of n elements x 1 , x 2 , . . .…”

Section: Related Workmentioning

confidence: 99%

“…, x n and the verifier can delegate some computation over the stream to the prover. The protocols in [11,12] are probabilistic and use multiple interactions for verification, which reveal the secret randomness. Thus they support one-shot computation tasks, whereas we allow any number of queries.…”

Section: Related Workmentioning

confidence: 99%

“…The only eligible interaction occurs in the querying phase (which is inherent anyways). Such interaction consists only of one round as opposed to existing schemes in the statistical setting that can have up to a logarithmic number of interactions (e.g., [11,12]). 2.…”

Section: Introductionmentioning

confidence: 99%

“…The running times of the verifier and the prover (for both updates and queries) as well as the proof size are all logarithmic in n and M , where n is the size of the stream and M is the size of the elements universe. In comparison, existing schemes in this setting (e.g., [10,11,12]) incur a linear proof generation overhead on the server, even for sublinear computations (see Section 1.1). We thus achieve an exponential improvement for many common queries in the prover's running time.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Streaming Authenticated Data Structures

Papamanthou

Shi

Tamassia

et al. 2013

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. We consider the problem of streaming verifiable computation, where both a verifier and a prover observe a stream of n elements x1, x2, . . . , xn and the verifier can later delegate some computation over the stream to the prover. The prover must return the output of the computation, along with a cryptographic proof to be used for verifying the correctness of the output. Due to the nature of the streaming setting, the verifier can only keep small local state (e.g., logarithmic) which must be updatable in a streaming manner and with no interaction with the prover. Such constraints make the problem particularly challenging and rule out applying existing verifiable computation schemes.We propose streaming authenticated data structures, a model that enables efficient verification of data structure queries on a stream. Compared to previous work, we achieve an exponential improvement in the prover's running time: While previous solutions have linear prover complexity (in the size of the stream), even for queries executing in sublinear time (e.g., set membership), we propose a scheme with O(log M log n) prover complexity, where n is the size of the stream and M is the size of the universe of elements. Our schemes support a series of expressive queries, such as (non-)membership, successor, range search and frequency queries, over an ordered universe and even in higher dimensions. The central idea of our construction is a new authentication tree, called generalized hash tree. We instantiate our generalized hash tree with a hash function based on lattices assumptions, showing that it enjoys suitable algebraic properties that traditional Merkle trees lack. We exploit such properties to achieve our results.

show abstract

Data Stream Verification

Thaler¹

2016

Encyclopedia of Algorithms

Self Cite

View full text Add to dashboard Cite

We survey models and algorithms for stream verification. Problem DefinitionStream verification is concerned with the following setting. A computationally limited client wants to compute some property of a massive input, but lacks the resources to store even a small fraction of the input, and hence cannot perform the desired computation locally. The client therefore accesses a powerful but untrusted service provider (e.g., a commercial cloud computing service), who not only performs the requested computation, but also proves that the answer is correct. An array of closely related models have been introduced to capture this scenario. The following section provides a unified presentation of these models, emphasizing their common features before delineating their differences.Stream Verification Model. Let σ = a 1 , a 2 , . . . , a m be a data stream, where each a i comes from a data universe U of size n, and let F be a function mapping data streams to a finite range R. A stream verification protocol for F involves two parties: a prover P, and a (randomized) verifier V. The protocol consists of two stages: a stream observation stage and a proof verification stage.In the stream observation stage, V processes the stream σ, subject to the standard constraints of the data-stream model, i.e., sequential access to σ and limited memory. In the proof verification stage, V and P exchange a sequence of one or more messages, and afterward V outputs a value b. V is allowed to output a special symbol ⊥ indicating a rejection of P's claims. Formally, V constitutes a stream verification protocol if the following two properties are satisfied.• Completeness: There is some prover strategy P such that, for all streams σ, the probability that V outputs F (σ) after interacting with P is at least 2/3.• Soundness: For all streams σ and all prover strategies P, the probability that V outputs a value not in {F (x), ⊥} after interacting with P is at most ǫ ≤ 1/3.Here, the probabilities are taken over V's internal randomness. The constants 2/3 and 1/3 are not essential and are chosen by convention. The parameter ǫ is referred to as the soundness error of the protocol.Costs. There are five primary costs in any stream verification protocol: (1) V's space usage, (2) the total communication cost, (3) V's runtime, (4) P's runtime, and (5) the number of messages exchanged. * Yahoo Labs

show abstract

Verifying computations with streaming interactive proofs

Cited by 48 publications

References 31 publications

Practical verified computation with streaming interactive proofs

Practical verified computation with streaming interactive proofs

Streaming Authenticated Data Structures

Data Stream Verification

Contact Info

Product

Resources

About