Efficient Secure Multiparty Computation Protocol for Sequencing Problem over Insecure Channel

Abstract

As a powerful tool in solving privacy preserving cooperative problems, secure multiparty computation is more and more popular in electronic bidding, anonymous voting, and online auction. Privacy preserving sequencing problem which is an essential link is regarded as the core issue in these applications. However, due to the difficulties of solving multiparty privacy preserving sequencing problem, related secure protocol is extremely rare. In order to break this deadlock, this paper first presents an efficient secure multiparty computation protocol for the general privacy-preserving sequencing problem based on symmetric homomorphic encryption. The result is of value not only in theory, but also in practice.

1. Introduction

Sequencing problem is very common in our daily life, such as ranking according to the scores, queuing by the height. Informally speaking, it is about comparing and sequencing of some numbers. It is easy and convenient to get the result because it cares nothing about privacy in the scenes above. On the contrary, privacy-preserving sequencing problem (PPSP) is always a hard challenge since it requires to conduct secret numbers comparison without knowing the numbers. In this scenario, all participants distrust each other and would not like to leak their own secret information to anyone else. It is an urgent task to be solved for some important applications such as electronic bidding, anonymous voting, and online auction. Naturally, as a powerful tool in solving privacy-preserving cooperative problems, secure multiparty computation (SMC) [1] is the best choice for privacy-preserving sequencing. In fact, the classical Millionaire’s problem [1–3] is the earliest example of introducing secure multiparty computation into the sequencing problem. More specifically, the millionaire’s problem, with the aim to find out which one of the two Millionaires is richer without revealing their net worth, can be described as comparing two secret numbers in the perspective of sequencing, that is, the 2-party case of PPSP. In this aspect, the case of 2-party sequencing problem has already been resolved along with the advent of the solutions to Millionaire’s problem and the presence of other secure two-party computation protocols [4–12]. Due to the limitation of the 2-party case in practice, the general multiparty PPSP becomes the focus in secure multiparty computation recently.

In 1962, Held and Karp [13] put forward a dynamic programming approach to multiparty sequencing problem before the advent of SMC. They concern more about some certain scenarios and aim to design schemes for the special applications such as the traveling-salesman problem. Subsequently, the research on PPSP is rare and mainly about the 2-party case. Currently, Tang et al. [14] have constructed an efficient and secure multiparty computation protocol for PPSP by making use of a secret sharing scheme based on polynomial. It is an important fruit of PPSP since it has indeed realized secure sequencing among distrusted participants. However, the cost is too high in choosing random numbers and transmitting messages. In the case of 𝑛 parties with 𝑡 adversaries, it needs to choose 2𝑛⋅(2𝑡+1)+𝑛 polynomials and 2𝑛⋅(𝑡+1) random numbers. What is more, the transmitted messages are up to (2𝑡+1)⋅(𝑛−1)⋅𝑛+(𝑛−1)⋅𝑛+𝑛²(2𝑡+1) every round.

This paper applies the fast symmetric homomorphic encryption to replace the cumbersome secret sharing based on polynomial. It no longer needs to choose so many polynomials and random numbers. Relevant complexities in computation and communication also have a great improvement. Our result is not only much simpler but also more efficient. In brief, our contributions can be summarized as follows.(1)We first introduce symmetric homomorphic encryption to solve the privacy-preserving sequencing problem in secure multiparty computation, which brings less communications and random numbers than the method of secret sharing based on polynomial.(2)Our protocol is appropriate for the insecure channel which allows external attackers to eavesdrop and can resist at most 𝑡<𝑛/2 adversaries’ corruption supposing that any two neighbor parties do not conspire.(3)We propose a protocol for the general privacy-preserving sequencing problem, which is suitable for multiple parties to securely determine the order of a given set rather than just two parties such as the simplest sequencing problem-Millionaire’s problem, or a special application such as the traveling-salesman problem.

Organization. The rest of this paper is organized as follows. In Section 2, we briefly give some related preliminaries. In Section 3, we present the new efficient secure multiparty computation protocol for privacy-preserving sequencing problem over insecure channel. In Section 4, we analyze the proposed protocol in detail including its correctness and privacy. Furthermore, we show the advantages of our protocol in the two aspects of transmitted messages and random numbers. Finally, we summarize our work of this paper in the last section.

2. Preliminaries

2.1. Secure Multiparty Computation

Secure multiparty computation is dedicated to dealing with the problem of privacy-preserving cooperative computation among distrusted participants. It was first introduced by Yao in 1982 [1] by putting forward the famous Millionaire’s problem. Afterwards, SMC has become a research focus in the international cryptographic community, and a mass of research results have been published one after the other [2–12].

Generally speaking, SMC is a method to implement cooperative computation with all participants’ private data, ensuring the correctness of the computation as well as not disclosing additional information except the necessary results. Assume that there are 𝑛 participants 𝑃₁,𝑃₂,…,𝑃_𝑛. Each has a secret, respectively, 𝑆₁,𝑆₂,…,𝑆_𝑛. They want to compute the value of a public function 𝐹(⋅) on 𝑛 variables at the point (𝑆₁,𝑆₂,…,𝑆_𝑛), that is, 𝐹(𝑆₁,𝑆₂,…,𝑆_𝑛). An SMC protocol is dubbed secure if no participant can learn more from the description of the public function and the result of the global calculation than what he can learn from his own information.

2.2. Homomorphic Encryption

In this subsection, we introduce a basic tool to design our protocol, the symmetric homomorphic encryption scheme. Allowing for security, the participants usually would not like to directly transmit their original data over insecure channel while interacting with others. They expect that other parties can perform necessary computations on the encrypted version of the data. In this way, they can encrypt their own private information and then transmit it to others without exposing the real data and finally decrypt the information sent back by others to get the target result when completing cooperative computation. To meet this demand, Rivest et al. proposed homomorphic encryption in 1978 [15]. His work sparked the research in this field. A lot of articles have been proposed and widely used in many applications since then. However, the most common homomorphic encryption schemes are mainly asymmetric, for example, ELGamal homomorphic encryption scheme and Paillier’ homomorphic encryption scheme.

Although symmetric homomorphic encryption has not been used in PPSP, it is really a promising method for secure multiparty computation while dealing with the problem of privacy-preserving sequencing. The symmetry will bring high efficiency to our solution since symmetric encryption possesses the advantage of being really fast and can be used as often as possible. As illustrated in [16], a block cipher like AES is typically 100 times faster than RSA encryption and 2000 times than RSA decryption, with about 60?MB per second on a modest platform. Stream ciphers are even faster, some of them being able to encrypt/decrypt 100?MB per second or more. Therefore, asymmetric homomorphic encryptions are bound to much slower than the symmetric ones. In this paper, we will employ the superior symmetric homomorphic encryption schemes to construct our protocol.

Generally, an encryption scheme is said to be homomorphic if for any given encryption key 𝑘, the encryption function 𝐸(⋅) satisfies the following condition: ∀𝑚₁,𝑚₂∈𝑃,𝐸𝑚₁⊙_𝑃𝑚₂=𝐸𝑚₁⊙_𝐶𝐸𝑚₂, (1) where 𝑃(𝐶) denotes the set of the plaintexts (ciphertexts), and ⊙_𝑃 and ⊙_𝐶 are the operators in 𝑃 and 𝐶.

We say that a scheme is additively homomorphic if we consider addition operators, and it is multiplicatively homomorphic if we consider multiplication operators. Usually, multiplicative homomorphic encryption functions are more efficient than additive homomorphic encryption functions.

Herein, we will use the random symmetric homomorphic encryption function 𝐸(⋅) in this paper, which satisfies the following property: ∀𝑚₁,𝑚₂∈𝑄⁺,𝐸𝑚₁+𝑚₂=𝐸𝑚₁∗𝐸𝑚₂, (2) where 𝐸(⋅) is a random function and 𝑄 is the set of rational numbers.

It is easy to deduce that for all 𝑚∈𝑄⁺, 𝑟∈𝑍⁺, 𝐸(𝑟∗𝑚)=𝐸(𝑚)^𝑟. (3)

2.3. Privacy-Preserving Sequencing Problem

2.3.1. The Original Problem

Privacy-preserving sequencing problem is in fact the more universal description of the generalized secret number comparison. To be more specific, there are 𝑛 distrusted participants 𝑃₁,𝑃₂,…,𝑃_𝑛. Each of them has a private number, respectively, 𝑆₁,𝑆₂,…,𝑆_𝑛. The problem is that they hope to rank the 𝑛-array (𝑆₁,𝑆₂,…,𝑆_𝑛) without leaking any information about 𝑆₁,𝑆₂,…,𝑆_𝑛. It requires that after executing cooperative computation, 𝑃₁,𝑃₂,…,𝑃_𝑛 know the size relations of 𝑆₁,𝑆₂,…,𝑆_𝑛 but no more other information. Formally, we can represent the whole problem as shown in Algorithm 1.

Input: (𝑆1,𝑆2,…,𝑆𝑛), 𝑆𝑖 is the private number of 𝑃𝑖; Output: (𝑙1,𝑙2,…,𝑙𝑛), 𝑙𝑖 is the order of 𝑆𝑖 in the n-array.

Algorithm 1 

2.3.2. Equivalent Transformation of the Original Problem

In this paper, we make use of a useful theorem in the progressing procedure following reference [14] so that we can reduce the initial sequencing problem about the 𝑛-array (𝑆₁,𝑆₂,…,𝑆_𝑛) to the new 𝑛-array (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛), which has the same sequence as (𝑆₁,𝑆₂,…,𝑆_𝑛) and is called as the pseudoarray of (𝑆₁,𝑆₂,…,𝑆_𝑛). Then 𝑃₁,𝑃₂,…,𝑃_𝑛 can obtain the sequence of 𝑆₁,𝑆₂,…,𝑆_𝑛 by directly comparing the pseudoarrays (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛) in public. Along with the equivalent transformation of the problem, the aim of secure multiparty computation needs a corresponding change. It no longer has to consider how to deal with the real data 𝑆₁,𝑆₂,…,𝑆_𝑛 but only needs to securely get the pseudodata 𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛. And then the subsequent work is just a piece of cake.

Theorem 1. Arrays (𝑆₁,𝑆₂,…,𝑆_𝑛) and (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛) have the same sequence, where 𝑆^′_𝑖=𝑟₁∗𝑆_𝑖+𝑟₂∗𝑆²_𝑖+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖, 𝑟_𝑖≥0, 𝑆_𝑖≥0, 𝑖=1,2,…,𝑛.

Proof. Given for all 𝑆^′_𝑖,𝑆^′_𝑗∈(𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛)𝑆^′_𝑖=𝑟₁∗𝑆_𝑖+𝑟₂∗𝑆²_𝑖+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖,𝑆^′_𝑗=𝑟₁∗𝑆_𝑗+𝑟₂∗𝑆²_𝑗+⋯+𝑟_𝑛∗𝑆^𝑛_𝑗. (4) Then, 𝑆^′_𝑖−𝑆^′_𝑗=𝑟₁∗𝑆_𝑖+𝑟₂∗𝑆²_𝑖+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖=𝑟₁∗𝑆_𝑖+𝑟₂∗𝑆²_𝑖+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖−𝑟₁∗𝑆_𝑗+𝑟₂∗𝑆²_𝑗+⋯+𝑟_𝑛∗𝑆^𝑛_𝑗=𝑟₁∗𝑆_𝑖−𝑆_𝑗+𝑟₂∗𝑆²_𝑖−𝑆²_𝑗+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖−𝑆^𝑛_𝑗=𝑆_𝑖−𝑆_𝑗𝑟₁+𝑟₂∗𝑆_𝑖+𝑆_𝑗+𝑟₃∗𝑆²_𝑖+𝑆_𝑖⋅𝑆_𝑗+𝑆²_𝑗+⋯+𝑟_𝑛∗𝑆_𝑖^𝑛−1+𝑆_𝑖^𝑛−2⋅𝑆_𝑗+⋯+𝑆_𝑖⋅𝑆_𝑗^𝑛−2+𝑆_𝑗^𝑛−1. (5) Let 𝑄=𝑟₁+𝑟₂∗𝑆_𝑖+𝑆_𝑗+𝑟₃∗𝑆²_𝑖+𝑆_𝑖⋅𝑆_𝑗+𝑆²_𝑗+⋯+𝑟_𝑛∗𝑆_𝑖^𝑛−1+𝑆_𝑖^𝑛−2⋅𝑆_𝑗+⋯+𝑆_𝑖⋅𝑆_𝑗^𝑛−2+𝑆_𝑗^𝑛−1. (6) Then, 𝑆^′_𝑖−𝑆^′_𝑗=(𝑆_𝑖−𝑆_𝑗)⋅𝑄. As we know that 𝑟_𝑖≥0, 𝑆_𝑖≥0, 𝑖=1,2,…,𝑛. Therefore, 𝑄≥0. That means, for all 𝑆^′_𝑖,𝑆^′_𝑗∈(𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛), 𝑆^′_𝑖, 𝑆^′_𝑗 and 𝑆_𝑖, 𝑆_𝑗 have the same sequence. Obviously, (𝑆₁,𝑆₂,…,𝑆_𝑛) and (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛) have the same sequence.

3. Proposed Protocol

In this section, we present our protocol. The simplified version of the protocol is briefly illustrated in Figure 1, and the details can be described as follows.

Figure 1 

Simplified version of the proposed protocol.

Initialization. Assume that there are 𝑛 participants 𝑃₁,𝑃₂,…,𝑃_𝑛, each 𝑃_𝑖 owning a secret number 𝑆_𝑖 and a random symmetric homomorphic encryption function 𝐸_𝑖(⋅).

Computation(1)𝑃_𝑖 chooses a random number 𝑟_𝑖>0, 𝑖=1,2,…,𝑛, and computes 𝐸_𝑖(𝑆_𝑖),𝐸_𝑖(𝑆²_𝑖),…,𝐸_𝑖(𝑆_𝑖^𝑖−1),𝐸_𝑖(𝑆_𝑖^𝑖+1),…,𝐸_𝑖(𝑆^𝑛_𝑖) and 𝐸_𝑖(𝑟_𝑖∗𝑆^𝑖_𝑖) locally. For 𝑖=1,2,…,𝑛, 𝑗=1,2,…,𝑛, 𝑖≠𝑗, 𝑃_𝑖 sends 𝐸_𝑖(𝑆^𝑗_𝑖) to 𝑃_𝑗.(2)After receiving 𝐸_𝑖(𝑆^𝑗_𝑖), 𝑃_𝑗 computes 𝐸_𝑖(𝑆^𝑗_𝑖)^𝑟𝑗, 𝑖=1,2,…,𝑛, 𝑗=1,2,…,𝑛, 𝑖≠𝑗. And then, 𝑃_𝑗 transmits 𝐸_𝑖(𝑆^𝑗_𝑖)^𝑟𝑗 to 𝑃_𝑖+1, 𝑖=1,2,…,𝑛−1, 𝑗=1,2,…,𝑛, 𝑗≠𝑖+1. For 𝑖=𝑛, 𝑃_𝑗 transfers 𝐸_𝑛(𝑆^𝑗_𝑛)^𝑟𝑗 to 𝑃₁, 𝑗=2,…,𝑛.(3)𝑃₁ computes 𝑆_𝑛^′′=𝐸_𝑛(𝑟₁∗𝑆_𝑛+𝑟₂∗𝑆²_𝑛+⋯+𝑟_𝑛∗𝑆^𝑛_𝑛) and sends 𝑆_𝑛^′′ to 𝑃_𝑛; For 𝑖=1,2,…,𝑛−1, 𝑃_𝑖+1 computes 𝑆_𝑖^′′=𝐸_𝑖(𝑟₁∗𝑆_𝑖+𝑟₂∗𝑆_𝑖²+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖) and sends 𝑆_𝑖^′′ to 𝑃_𝑖.(4)𝑃_𝑖 computes 𝑆^′_𝑖=𝐷_𝑖(𝑆_𝑖^′′), 𝑖=1,2,…,𝑛 and broadcasts 𝑆^′_𝑖 to obtain the sequence of the 𝑛-array (𝑆₁,𝑆₂,…,𝑆_𝑛) by comparing the size of the pseudoarray (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛).

4. Analysis

In this section, we have an analysis of the proposed protocol in the aspects of security and efficiency. To guarantee that it is a secure multiparty computation protocol, we have to prove that it satisfies correctness and privacy requirements at first.

4.1. Correctness

Assume that the attacker is passive. Then, all participants (including all attackers and honest participants) correctly follow the protocol. Therefore, we only need to examine whether the protocol will give the correct sequence for the array (𝑆₁,𝑆₂,…,𝑆_𝑛). From the proof of Theorem 1, we know that the array (𝑆₁,𝑆₂,…,𝑆_𝑛) have the same sequence with the pseudoarray (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛). Thus, the proposed protocol can correctly achieve the aim of sequencing the array (𝑆₁,𝑆₂,…,𝑆_𝑛) by comparing the pseudoarrays (𝑆^′₁,𝑆^′₂,…,𝑆^′_𝑛) secretly. Hence, the protocol satisfies correctness.

4.2. Privacy

According to the definition of privacy in multiparty computation protocols in [17], the protocol is private if the protocol satisfies the following conditions.(a)The information string viewed by each participant 𝑃_𝑖 and a random string with the same length have the same probability distribution. That is, the information string and the random string are indistinguishable. (b)Arbitrary 𝑡<𝑛/2 participants cannot jointly obtain any information about the input of any other participant.

In fact, in the proposed protocol, the viewed information strings of 𝑃_𝑖 are 𝐸_𝑖(𝑆_𝑖),𝐸_𝑖(𝑆²_𝑖),…,𝐸_𝑖(𝑆_𝑖^𝑖−1),𝐸_𝑖(𝑆_𝑖^𝑖+1),…,𝐸_𝑖(𝑆^𝑛_𝑖), and 𝐸_𝑖(𝑟_𝑖∗𝑆^𝑖_𝑖) in the first step; 𝐸_𝑖(𝑟_𝑖∗𝑆^𝑖_𝑖), 𝐸_𝑗(𝑆^𝑖_𝑗), 𝐸_𝑗(𝑆^𝑖_𝑗)^𝑟𝑖, 𝑖=1,2,…,𝑛, 𝑗=1,2,…,𝑛, 𝑖≠𝑗 in the second step; 𝑆^′′_𝑖−1, 𝑖=2,…,𝑛, specially, for 𝑖=1, the viewed information string in this step is 𝑆_𝑛^′′ for 𝑃₁; finally, in the last step, the viewed string is 𝑆^′_𝑖 for 𝑃_𝑖. All the strings are generated by the random symmetric homomorphic encryption function 𝐸_𝑖(⋅). Therefore, the strings viewed by 𝑃_𝑖 and a random string with the same length have the same probability distribution, and (a) is satisfied.

Moreover, our protocol also satisfies that arbitrary 𝑡<𝑛/2 participants cannot jointly obtain any information about the input of any other participant under the assumption that any two neighbor parties never conspire. Since we have 𝑃_𝑖+1 to compute 𝑆_𝑖^′′ for 𝑃_𝑖 by collecting 𝐸_𝑖(𝑆^𝑗_𝑖)^𝑟𝑗, 𝑗=1,…,𝑛, it is obvious that it is insecure if 𝑃_𝑖 and 𝑃_𝑖+1 collude. It is reasonable to suppose that no neighbors collude because the two adversaries are not exactly adjacent since they cannot control the order of the parties when executing the protocol. In addition, if an adversary wants to get more information from 𝑆_𝑖^′′=𝐸_𝑖(𝑟₁∗𝑆_𝑖+𝑟₂∗𝑆²_𝑖+⋯+𝑟_𝑛∗𝑆^𝑛_𝑖), he must corrupt with at least 𝑛−1 parties since there are 𝑛−1 unknown coefficients as well as breaking the encryption scheme 𝐸(⋅).

What is more, in our protocol, all information strings are transmitted in the encrypted forms. The private information 𝑆_𝑖 and 𝑟_𝑖 are secret as long as the encryption function 𝐸_𝑖(⋅) is robust. In other words, it is secure even over the insecure channel, which is better than the previous protocol based on polynomial for the sequencing problem.

In short, our protocol is correct and private.

4.3. Efficiency

Our protocol is efficient as well as secure. It operates better than the previous one because it is independent of the secret sharing scheme based on complex polynomial. We can make a concrete comparison between the proposed protocol and the previous one on the numbers of random numbers and transmitted messages as in Table 1.

Table 1 

Efficiency comparison.

From Table 1, we can easily find that in Tang’ protocol [14], it needs to choose 𝑛⋅(2𝑡+1) polynomials for 𝑓(⋅), 𝑛 polynomials for 𝑟(⋅), and 𝑛⋅(2𝑡+1) polynomials for ℎ(⋅), that is, totally 2𝑛⋅(𝑡+1) random numbers as well as 2𝑛⋅(2𝑡+1)+𝑛 polynomials; it also needs to transmit 𝑓_𝑖𝑘(𝑥_𝑗) from 𝑃_𝑖 to 𝑃_𝑗, 𝑖,𝑗=1,2,…,𝑛, 𝑘=1,2,…,2𝑡+1, 𝑟_𝑖(𝑥_𝑗), ℎ_𝑖𝑘(𝑥_𝑗) from 𝑃_𝑖 to 𝑃_𝑗, 𝑖=1,2,…,2𝑡+1, 𝑗,𝑘=1,2,…,𝑛; thus, (2𝑡+1)⋅(𝑛−1)⋅𝑛+(𝑛−1)⋅𝑛+𝑛²(2𝑡+1) messages are needed to be transmitted totally.

In our protocol, it only needs to choose 𝑛 random numbers in the whole procedure. And the messages that need to be transmitted are, respectively, 𝐸_𝑖(𝑆^𝑗_𝑖), 𝑖=1,2,…,𝑛, 𝑗=1,2,…,𝑛, 𝑖≠𝑗, 𝐸_𝑖(𝑆^𝑗_𝑖)^𝑟𝑗, 𝑖=1,2,…,𝑛−1, 𝑗=1,2,…,𝑛, 𝑗≠𝑖+1, and 𝐸_𝑛(𝑆^𝑗_𝑛)^𝑟𝑗, 𝑗=2,…,𝑛, and 𝑆_𝑖^′′, 𝑖=1,2,…,𝑛, totally 𝑛⋅(2𝑛−1) messages. It is much simpler and more appropriate for the clients who expect easier products in practice.

If there are 𝑡=(𝑛−1)/2 adversaries (the upper bound of the adversaries in Tang’ protocol [14]), the advantages of our protocol are more obvious as shown in Table 2.

Table 2 

Efficiency comparison.

5. Conclusion

It is always a difficult problem in the cryptographic field to construct a secure multiparty computation protocol for the privacy-preserving sequencing problem. In the present study, we have successfully designed an efficient secure multiparty computation protocol for sequencing problem over insecure channel based on symmetric homomorphic encryption, which is of great importance to the theory on this topic and of significant value in practice for its high efficiency.

Acknowledgments

This work is supported by NSFC (Grant nos. 61170270, 61100203, 60903152, 61003286, and 61121061) and the Fundamental Research Funds for the Central Universities (Grant nos. BUPT2011YB01, BUPT2011RC0505, 2011PTB-00-29, 2011RCZJ15, and 2012RC0612).