Solving the Kidney Exchange Problem Using Privacy-Preserving Integer Programming (Updated and Extended Version)

TL;DR

This paper introduces a novel privacy-preserving integer programming protocol that computes exact solutions to the kidney exchange problem, outperforming existing methods while safeguarding sensitive medical data.

Contribution

It presents an innovative privacy-preserving protocol based on Integer Programming that achieves exact solutions with improved performance and extended output for better decision transparency.

Findings

Outperforms existing privacy-preserving approaches in efficiency

Provides exact solutions to the KEP under privacy constraints

Evaluates information leakage from extended output

Abstract

The kidney exchange problem (KEP) is to find a constellation of exchanges that maximizes the number of transplants that can be carried out for a set of pairs of patients with kidney disease and their incompatible donors. Recently, this problem has been tackled from a privacy perspective in order to protect the sensitive medical data of patients and donors and to decrease the potential for manipulation of the computing of the exchanges. However, the proposed approaches to date either only compute an approximative solution to the KEP or they suffer from a huge decrease in performance. In this paper, we suggest a novel privacy-preserving protocol that computes an exact solution to the KEP and significantly outperforms the other existing exact approaches. Our novel protocol is based on Integer Programming which is the most efficient method for solving the KEP in the non privacy-preserving case. We achieve an improved performance compared to the privacy-preserving approaches known to date by extending the output of the ideal functionality to include the termination decisions of the underlying algorithm. We implement our protocol in the SMPC benchmarking framework MP-SPDZ and compare its performance to the existing protocols for solving the KEP. In this extended version of our paper, we also evaluate whether and if so how much information can be inferred from the extended output of the ideal functionality.