OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

k-Nearest Neighbor Classification overSemantically Secure Encrypted Relational Data

Reporter:Ximeng LiuSupervisor: Rongxing Lu

School of EEE, NTUhttp://www.ntu.edu.sg/home/rxlu/seminars.htm

May 9, 2014

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

1 Main References

2 Introduction

3 Background

4 Basic Protocols

5 The proposed scheme

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Main References

1. Samanthula B K, Elmehdwi Y, Jiang W. k-Nearest NeighborClassification over Semantically Secure Encrypted RelationalData[J]. arXiv preprint arXiv:1403.5001, 2014.2. Elmehdwi Y, Samanthula B K, Jiang W. Secure k-NearestNeighbor Query over Encrypted Data in OutsourcedEnvironments[C]. ICDE 2014, accepted.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

k-Nearest Neighbor algorithm

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Problem Definition

Suppose Alice owns a database D of n records t1, · · · , tn andm + 1 attributes. Let ti ,j denote the j-th attribute value of recordti . Initially, Alice encrypts her database attribute-wise, that is, shecomputes Epk(ti ,j), for 1 ≤ i ≤ n and 1 ≤ j ≤ m + 1, wherecolumn (m + 1) contains the class labels. Let the encrypteddatabase be denoted by D ′.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Problem Definition

Let Bob be an authorized user who wants to classify his inputrecord q =< q1, · · · , qm > by applying the k-NN classificationmethod based on D ′. We refer to such a process asprivacy-preserving k-NN (PPkNN) classification over encrypteddata in the cloud. Formally, we define the PPkNN protocol as:

PPkNN(D ′, q)→ cq

where cq denotes the class label for q after applying k-NNclassification method on D and q.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Paillier Cryptosystem

a. Homomorphic Addition

Epk(a + b) = Epk(a) ∗ Epk(b) mod N2

b. Homomorphic Multiplication

Epk(a ∗ b) = Epk(a)b mod N2

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic Privacy-Preserving Protocols

All of the below protocols are considered under two-partysemi-honest setting. In particular, we assume the exist of twosemi-honest parties P1 and P2 such that the Paillier’s secret key skis known only to P2 whereas pk is treated as public.

1. Multiplication (SM) Protocol: This protocol considers P1 withinput (Epk(a),Epk(b)) and outputs Epk(a ∗ b) to P1, where a andb are not known to P1 and P2. During this process, no informationregarding a and b is revealed to P1 and P2.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic Privacy-Preserving Protocols

Secure Squared Euclidean Distance (SSED) Protocol: In thisprotocol, P1 with input (Epk(X ),Epk(Y )) and P2 with sk securelycompute the encryption of squared Euclidean distance betweenvectors X and Y . Here X and Y are m dimensional vectors whereEpk(X ) =< Epk(x1), · · · ,Epk(xm) > andEpk(Y ) =< Epk(y1), · · · ,Epk(ym) >. The output of the SSEDprotocol is Epk(|X − Y |2) which is known only to P1

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic Privacy-Preserving Protocols

Secure Bit-Decomposition (SBD) Protocol: P1 with input Epk(z)and P2 securely compute the encryptions of the individual bits ofz , where 0 ≤ z < 2l . The output [z ] =< Epk(z1), · · · ,Epk(zl) > isknown only to P1. Here z1 and zl are the most and leastsignificant bits of integer z , respectively

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic Privacy-Preserving Protocols

Secure Minimum (SMIN) Protocol: In this protocol, P1 holdsprivate input (u′, v ′) and P2 holds sk, where u′ = ([u],Epk(su))and v = ([v ],Epk(sv )). Here su (resp., sv ) denotes the secretassociated with u (resp., v). The goal of SMIN is for P1 and P2 tojointly compute the encryptions of the individual bits of minimumnumber between uand v . In addition, they computeEpk(smin(u, v)). That is, the output is ([min(u, v)],Epk(smin(u,v)))which will be known only to P1. During this protocol, noinformation regarding the contents of u, v , su, and sv is revealedto P1 and P2.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic Privacy-Preserving Protocols

Secure Minimum out of n Numbers (SMINn) Protocol: In thisprotocol, we consider P1 with n encrypted vectors ([d1], · · · , [dn])along with their respective encrypted secrets and P2 with sk. Here[di ] = Epk(di ,1), · · · ,Epk(di ,l) where di ,1 and di ,l are the most andleast significant bits of integer di respectively, for 1 ≤ i ≤ n. Thesecret of di is given by sdi . P1 and P2 jointly compute[min(d1, · · · , dn)]. In addition, they compute Epk(smin(d1,··· ,dn)). Atthe end of this protocol, the output([min(d1, · · · , dn)],Epk(smin(d1,··· ,dn))) is known only to P1. Duringthe SMINn protocol, no information regarding any of di ’s and theirsecrets is revealed to P1 and P2.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic Privacy-Preserving Protocols

Secure Bit-OR (SBOR) Protocol: P1 with input (Epk(o1),Epk(o2))and P2 securely compute Epk(o1 ∨ o2), where o1 and o2 are twobits. The output Epk(o1 ∨ o2) is known only to P1.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Multiplication (SM)

a ∗ b = (a + ra) ∗ (b + rb)− a ∗ ra − b ∗ rb − ra ∗ rbNote that, for any given x ∈ ZN , N − x is equivalent to −x underZN

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Multiplication (SM)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Squared Euclidean Distance (SSED)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Bit-Decomposition (SBD)

We assume that P1 has Epk(z) and P2 has sk , where z is notknown to both parties and 0 ≤ z < 2l . Given Epk(z), the goal ofthe secure bit-decomposition (SBD) protocol is to compute theencryptions of the individual bits of binary representation of z.That is, the output is [z ] =< Epk(z1), · · · ,Epk(zl) >, where z1 andzl denote the most and least significant bits of z respectively. Atthe end, the output [z ] is known only to P1. During this process,neither the value of z nor any zi ’s is revealed to P1 and P2.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum (SMIN)

the basic idea of the proposed SMIN protocol is for P1 to randomlychoose the functionality F (by flipping a coin), where F is eitheru > v or v > u, and to obliviously execute F with P2. Since F israndomly chosen and known only to P1, the result of thefunctionality F is oblivious to P2. Based on the comparison resultand chosen F , P1 computes [min(u, v)] and Epk(smin(u,v)) locallyusing homomorphic properties.

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum (SMIN)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum (SMIN)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum (SMIN)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum (SMIN)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum (SMIN)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Minimum out of n Numbers (SMINn)

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Secure Bit-OR (SBOR)

Suppose P1 holds (Epk(o1),Epk(o2)) and P2 holds sk , where o1

and o2 are two bits not known to both parties. The goal of theSBOR protocol is to securely compute Epk(o1 ∨ o2). At the end ofthis protocol, only P1 knows Epk(o1 ∨ o2). During this process, noinformation related to o1 and o2 is revealed to P1 and P2. Giventhe secure multiplication (SM) protocol, P1 can computeEpk(o1 ∨ o2) as follows:

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

P1 with input (Epk(o1),Epk(o2)) and P2 involve in the SMprotocol. At the end of this step, the output Epk(o1 ∗ o2) is knownonly to P1. Note that, since o1 and o2 are bits,Epk(o1 ∗ o2) = Epk(o1 ∧ o2).Epk(o1 ∨ o2) = Epk(o1 + o2) ∗ Epk(o1 ∧ o2)N−1

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic scheme

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Basic scheme

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Fully Secure kNN Protocol

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Fully Secure kNN Protocol

Figure: Security model

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data

OutlineMain References

IntroductionBackground

Basic ProtocolsThe proposed scheme

Thank youRongxing’s Homepage:

http://www.ntu.edu.sg/home/rxlu/index.htmPPT available @: http://www.ntu.edu.sg/home/rxlu/seminars.htm

Ximeng’s Homepage:http://www.liuximeng.cn/

http://www.ntu.edu.sg/home/rxlu/seminars.htm k-Nearest Neighbor Classification over Semantically Secure Encrypted Relational Data