Summation-based Private Segmented Membership Test from Threshold-Fully Homomorphic Encryption

TL;DR

This paper introduces a new privacy-preserving method to check if data is in a segmented set across many holders, improving scalability and security.

Contribution

A novel summation-based PSMT protocol using threshold homomorphic encryption, enabling support for up to 4096 data holders with low overhead.

Findings

The PSMT protocol supports up to 4096 data holders, significantly more than prior work.

Aggregation for 1024 data holders and set size 225 takes 92.5 seconds with minimal overhead increase.

The protocol achieves IND-CPAD security and avoids false positives and privacy leaks.

Abstract

In many real-world scenarios, there are cases where a client wishes to check if a data element they hold is included in a set segmented across a large number of data holders. To protect user privacy, the client’s query and the data holders’ sets should remain encrypted throughout the whole process. Prior work on Private Set Intersection (PSI), Multi-Party PSI (MPSI), Private Membership Test (PMT), and Oblivious RAM (ORAM) falls short in this scenario in many ways. They either require data holders to possess the sets in plaintext, incur prohibitively high latency for aggregating results from a large number of data holders, leak the information about the party holding the intersection element, or induce a high false positive.

This paper introduces the primitive of a Private Segmented Membership Test (PSMT). We give a basic construction of a protocol to solve PSMT using a threshold variant of approximate-arithmetic homomorphic encryption and show how to overcome existing challenges to construct a PSMT protocol without leaking information about the party holding the intersection element or false positives for a large number of data holders ensuring IND-CPAD security. Our novel approach is superior to existing state-of-the-art approaches in scalability with regard to the number of supported data holders. This is enabled by a novel summation-based homomorphic membership check rather than a product-based one, as well as various novel ideas addressing technical challenges. Our PSMT protocol supports many more parties (up to 4096 in experiments) compared to prior related work that supports only around 100 parties efficiently. Our experimental evaluation shows that our method’s aggregation of results from data holders can run in 92.5s for 1024 data holders and a set size of 225, and our method’s overhead increases very slowly with the increasing number of senders. We also compare our PSMT protocol to other state-of-the-art PSI and MPSI protocols and discuss our improvements in usability with a better privacy model and a larger number of parties.

Figures