MPC Validation and Aggregation of Unit Vectors

TL;DR

This paper presents a secure MPC method for validating and aggregating unit vectors, enabling privacy-preserving verification and aggregation of categorical data in distributed systems.

Contribution

It introduces a novel MPC technique for verifying blinded unit vectors and a BGW circuit for secure aggregation with threshold release, enhancing privacy in categorical data processing.

Findings

Successfully verifies blinded unit vectors in MPC setting

Securely aggregates inputs with threshold-based output release

Applicable to systems using one-hot encoding or categorical choices

Abstract

When dealing with privatized data, it is important to be able to protect against malformed user inputs. This becomes difficult in MPC systems as each server should not contain enough information to know what values any user has submitted. In this paper, we implement an MPC technique to verify blinded user inputs are unit vectors. In addition, we introduce a BGW circuit which can securely aggregate the blinded inputs while only releasing the result when it is above a public threshold. These distributed techniques take as input a unit vector. While this initially seems limiting compared to real number input, it is quite powerful for cases such as selecting from a list of options, indicating a location from a set of possibilities, or any system which uses one-hot encoding.

Equations

$$shar{e}_i=\left[\begin{array}{c}shar{e}_{i,1}\\ ⋮\\ shar{e}_{i,P}\end{array}\right]=\left[\begin{array}{c}blin{d}_{1,i}\\ ⋮\\ blin{d}_{P,i}\end{array}\right]$$

$$Sums=\left[\begin{array}{c}su{m}_1\\ ⋮\\ su{m}_P\end{array}\right]$$

$$su{m}_j=\sum _{i}shar{e}_{i,j}$$

$$\begin{array}{rl}\mathcal{L}& \in {\text{F}}^{PxN}\\ {\mathcal{L}}_{1,j}& ={\text{r}}_{1,j}\forall j\text{ s.t. }0<j\le N\\ {\mathcal{L}}_{i,j}& ={\text{r}}_{1,j}^i\forall i,j\text{ s.t. }1<i\le P\text{, }0<j\le N\end{array}$$

$${\mathcal{L}}_{sq}=\left[\begin{array}{cccc}{r}_{1,1}& r_{1,2}& \dots & r_{1,N}\\ r_{1,1}^2& r_{1,2}^2& \dots & r_{1,N}^2\\ ⋮& & & ⋮\\ r_{1,1}^P& r_{1,2}^P& \dots & r_{1,N}^P\end{array}\right]$$

$$\begin{array}{rl}\mathcal{L}& \in {\text{F}}^{PxN}\\ {\mathcal{L}}_{i,j}& ={\text{r}}_{i,j}\forall i,j\text{ s.t. }0<i<P\text{, }0<j\le N\\ {\mathcal{L}}_{P,j}& =\prod _{i=1}^{P-1}{r}_{i,j}\forall j\text{ s.t. }\text{, }0<j\le N\end{array}$$

$${\mathcal{L}}_{prod}=\left[\begin{array}{cccc}{r}_{1,1}& r_{1,2}& \dots & r_{1,N}\\ r_{2,1}& r_{2,2}& \dots & r_{2,N}\\ ⋮& & & ⋮\\ {\prod }_i{r}_{i,1}& {\prod }_i{r}_{i,2}& \dots & {\prod }_i{r}_{i,N}\end{array}\right]$$

$$\begin{split}\mathcal{L}&\in\textbf{F}^{PxN}\\ \mathcal{L}_{i,j}&=\textit{r}_{i,j}\text{ }\forall i,j\text{ s.t. }0<i<P\text{, }0<j\leq N\\ \mathcal{L}_{P,j}&=\Bigg{[}\prod_{i=1}^{P-1}r_{i,j}\Bigg{]}^{-1}\text{ }\forall j\text{ s.t. }\text{, }0<j\leq N\\ \end{split}$$

$$\mathcal{L}_{inv}=\begin{bmatrix}r_{1,1}&r_{1,2}&\dots&r_{1,N}\\ r_{2,1}&r_{2,2}&\dots&r_{2,N}\\ \vdots&&&\vdots\\ \big{[}\prod_{i}r_{i,1}\big{]}^{-1}&\big{[}\prod_{i}r_{i,2}\big{]}^{-1}&\dots&\big{[}\prod_{i}r_{i,N}\big{]}^{-1}\\ \end{bmatrix}$$

$$shar{e}_i=\left[\begin{array}{c}shar{e}_{i,1}\\ ⋮\\ shar{e}_{i,P}\end{array}\right]=\left[\begin{array}{c}blin{d}_{1,i}\\ ⋮\\ blin{d}_{P,i}\end{array}\right]$$

$$Sums=\left[\begin{array}{c}su{m}_1\\ ⋮\\ su{m}_P\end{array}\right]$$

$$su{m}_j=\sum _{i}shar{e}_{i,j}$$

$$Sum{s}_1^i=Sum{s}_i\forall i,0<i\le P$$

$$Sum{s}_P=\prod _{i=1}^{P-1}Sum{s}_i$$

$$\prod _{i=1}^{P}Sum{s}_i=1$$

Full text

I Introduction

In our system, a user would like to input an N long unit vector; however, no strict subset of the servers should be able to recreate user inputs. The servers should then be able to verify that the user’s input was a unit vector. In addition, the servers should then be able to aggregate all user inputs and release the value only if it is above a public threshold. The verification circuit is an implementation of the MPC protocol described in [1]. This scheme takes input vectors, blinds (randomizes) the values, and then splits each value across all verification servers. The result is that no strict subset of the servers which collaborate can distinguish the inputs from random. However, all servers working together can verify that an input is a unit vector without revealing any other information about the input. Finally, the servers can combine all user inputs to perform an aggregate on each element of the inputs by using the BGW circuit shown in Figure 1. In other words, let N be the input length and $\ell$ be the number of user inputs. This data can be represented as an $\ell$xN matrix where each row is a user input, and the aggregation is a sum on each column, thus giving N aggregation results. We will now discuss the implementation of the verification and aggregation circuits as well as their performance.

II Verification

Assume a user wants to submit an N long vector $\textit{V}=[v_{1},~{}\dots,~{}v_{N}]$, and we want to verify that it is a unit vector using P parties without any party learning the user’s vector input. The verification scheme is as follows:

The user splits V into a PxN matrix ($Split$), such that $\sum_{i}\textit{Split}_{ij}=v_{j}$. 2. 2.

The user blinds Split into a PxP matrix Blind using one of the three algorithms discussed in Section II-B. 3. 3.

The user sends one Px1 column vector

[TABLE]

from Blind to each verifier. 4. 4.

Verifiers perform an MPC sum on each row of the shares to get the Px1 vector

[TABLE]

where

[TABLE] 5. 5.

Validation functions are performed on Sums to check V was was a unit vector.

It is important to note that all operations are done in a finite field with a prime size which is randomly chosen. The recommended size is at least 256 bits, and the performance impacts of differnet field sizes are discussed in Section IV-A.

II-A Splitting

The user starts with a unit vector $\textit{V}=[v_{1},~{}\dots,~{}v_{N}]$. For each $v_{j}$, $j\in\{1,~{}\dots,~{}N\}$ the user generates random values $split_{i,j}$, $i\in\{1,~{}\dots,~{}P-1\}$. Then they set $split_{p,j}=v_{j}-\sum_{i}split_{i,j}$. After this is done for all N rows, the result is Split, a PxN matrix where $\sum_{i}\textit{Split}_{i,j}=v_{j}$.

II-B Blinding

There are 3 functions defined in [1] for blinding which we implemented: $Square$, $Product$, and $Inverse$. Let $\mathcal{L}$ be a PxN matrix used to blind Split, and r is a PxN matrix of random values. After the $\mathcal{L}$ matrix is generated, we perform Blind = $\mathcal{L}$*Split to calculate our blinded PxP matrix. It is important to note that all calculations are done in a finite field of prime size. The constructions of the $\mathcal{L}$ matrix for the various blinding techniques are below:

$Square$:

[TABLE]

The result is a matrix

[TABLE]

$Product$:

[TABLE]

The result is a matrix

[TABLE]

$Inverse$:

[TABLE]

The result is a matrix

[TABLE]

II-C Sharing

After the user calculates Blind, they split it into P, Px1 column vectors

[TABLE]

The client sends one $share_{i}$ to each verifier. Before the verifiers can check if the input vector is valid, they must first sum their shares into a Px1 vector

[TABLE]

where

[TABLE]

This is acheived through any MPC summation scheme which does not reveal any information but the final value. Every verifier will calculate the same $Sums$ vector.

II-D Validation

Based on the method chosen for blinding, there are 3 ways to verify that the original input vector was a unit vector [1]. $Sums$ is the Px1 vector which is the result of the MPC sum done by the verifiers. To verify, simply check the relation below holds for the chosen blinding method.

$Square$:

[TABLE]

$Product$:

[TABLE]

$Inverse$:

[TABLE]

II-E Security

At no point does any individual have enough information to reconstruct a user’s input. In addition, after the user splits their value into P shares, any subset of those P shares appears random (as each share is a randomly generated bit-array). This ensures that as long as there is at least one honest party, security holds. However, for correctness to hold, all parties must act in an honestly-but-curious way.

III BGW Aggregation

Once all users’ inputs are validated, it is convenient to be able to aggregate the initial unit vectors. However, we wish for the servers to never be able to reconstruct any individual’s input. We will now describe a BGW circuit which returns a sum per entry in the Nx1 input vectors across all users’ inputs, and each entry’s result is only released if it is above a publicly known threshold. In other words, all $\ell$ inputs can be thought of as an $\ell$xN matrix where each row is a user’s input, and we will perform a sum on each column. Our BGW circuit can be seen in Figure 1.

First, each user performs a sum on the blinded values they received from all users. Then, they use Shamir’s Secret Sharing Algorithm [2] to create shares and distribute one to each participating server. These are the inputs to the BGW circuit in Figure 1. Next, each server locally computes the sum of shares ($sum$) and subtracts the publicly known threshold ($thresh$), to get $dif=sum-thresh$. Next, we use the BGW bit conversion algorithm described in [3] to get the encrypted bit representation of $dif$, called $dif_{b}$. We then take the most significant bit of $dif_{b}$ (called $msb$), calculate $(1-msb)*sum$, and reveal the result. If $msb=0$ then $sum\geq thresh$, so we reveal the aggregate. If $msb=1$ then $sum<thresh$ so 0 is returned. This ensures that we only release the aggregate value if it is above $thresh$.

The BGW bit conversion described in [3] works as follows. The algorithm takes as input an encrypted share $[a]_{p}$ and returns an array of encrypted shares $[a]_{b}$. When decrypted, $[a]_{b}$ is the bit representation of decrypted $[a]_{p}$. This is done by generating an array of shares $[b]_{b}$ which represent random bits. Next, we reveal c = $([a]_{p}-[b]_{b})$ and convert it to bit representation in the clear. $[a]_{b}=c+[b]_{b}$ can now be computed. In our implementation, we do not reveal any bits as we only need the encrypted value of the MSB.

This circuit relies on manipulation of Shamir’s Secret Shares, which we know is resilient to $M<P/3$ malicious adversaries where $P$ is the number of participating parties [4]. It also relies on the BGW Bit Conversion described in [3] which they prove is secure against an adversary which controls $M<\lfloor(P-1)/2\rfloor$ honest-but-curious participants.

IV Performance

IV-A Verification

We will now discuss the performance of our implementations for the verification and aggregation schemes described above. Our verification scheme is lightweight and fast. Running on consumer grade hardware, we can run thousands of verifications simultaneously at roughly the same latency as running 100 queries simultaneously. In general, a verifier takes between 350 and 550 ms, and the client takes 20 to 50 ms for normal operating modes per query. There are five parameters which affect execution time which we will analyze in turn: field size, blinding algorithm, number of simultaneous queries, length of input vector, and number of verifiers.

When verifying, a random prime is selected for the finite field size used in all our arithmetic. The length of this field does not drastically affect the verifiers, but the client’s performance is drastically impacted by the number of bits in the chosen prime. The client is decently efficient up to 512 bit primes, but it slows significantly beyond that. The graphs of finite field size vs latency for the client and verifiers can be seen in Figures 2 and 3 respectively.

The $Square$ and $Product$ algorithms for verification have similar latencies for small finite field sizes, but $Product$ is significantly faster than $Square$ for large finite field sizes (over 1024 bits). In addition, $Inverse$ is slower for the client at all finite field sizes. This relationship can be seen in Figures 2 and 4. A mojority of the client processing time is spent blinding and transfering data over the newtork. Because of this, we see large changes in performance due to blinding algorithm choice. The $Product$ algorithm is much more efficient than the alternatives because it only needs to execute $(P-1)$ multiplications per value to blind, whereas $Square$ performs $(P-1)$ exponentiation operations, and $Inverse$ performs $(P-1)$ multiplications and one exponentiation. The majority of server time is not spent doing the final verification step, so we do not see a change in run-time for the servers when we change the algorithm used.

The number of simultaneous queries, unsurprisingly, affects latency. This linear slowdown is observed by both clients and verifiers. However, the slowdown has a gradual slope. Increasing from 1 query to 100 simultaneous queries only causes a slowdown of roughly 4 times. Figures 5 and 6 show the relationship between the number of simultaneous queries and latency for clients and verifiers respectively.

Our verification algorithm is highly parallelizable. Each element in the original input vector can be handled separately, and the only instance where threads must be joined is on the final check performed in the validation step. This leads to vector size not impacting latency for the clients or verifiers. All differences in timings can be attributed to external factors, such as random generation of larger numbers or an increase in network load due to other users on the network. The relationship between vector length and latency for the client and verifiers is shown in Figures 7 and 8.

During our verification process, every verification party communicates with all other servers, meaning our communication complexity is O($P^{2}$) where $P$ is the number of verification parties. This relationship is seen in our experimental results for the verifiers. However, the client’s dependency is linear in P because an increased number of parties linearly relates to the number of blinded shares to create. These relationships can be seen in Figures 9 and 10.

IV-B BGW Aggregation

BGW bit conversion is incredibly expensive. As shown in [3], the BGW bit conversion protocol requires $O(L\log L)$ BGW multiplications where $L$ is the nubmer of bits we wish to convert to. Each of these multiplications involves every server sending and receiving data to and from every other server, leading to large delays. Our findings mirrored these results. Once parallelized, our consumer-level hardware performed bit conversion in the following times:

[TABLE]

This is incredibly inefficient, even though the algorithms are run in parallel. These times will improve with enterprise-level hardware, however they will still be quite slow. Alternative techniques (such as GMW circuits) are recommended.

V Conclusion

This paper has described an implementation for the validation and aggregation of secret unit vector inputs in an MPC system. It has provided a fast, scalable system for validation with minimal overhead and computation requirements while retaining privacy as long as one honest server exists. It also provided a (slow) scheme for aggregation on secret inputs which only releases the sum if above a publicly known threshold.