Secret Key Generation and Secure Computing

Size: px

Start display at page:

Download "Secret Key Generation and Secure Computing"

Annabelle Blair
5 years ago
Views:

1 Secret Key Generation and Secure Computing Himanshu Tyagi Department of Electrical and Computer Engineering and Institute of System Research University of Maryland, College Park, USA. Joint work with Prakash Narayan and Piyush Gupta 1/21

2 Secure Computing of a Function of Data Correlated data is collected and stored at separated locations. Examples include: Data grids and data centers, Distributed video coding, Sensor networks, etc. Each location wants to know the value of a function of the data. - using a communication that keeps the value of the function secure. Does there exist a communication protocol to do that? 2/21

3 Multiterminal Source Model X 1 X 2 X m Observed data: Correlated rvs X M = (X 1,...,X m). - Probability distribution of the data is known. 3/21

4 Interactive Communication Protocol COMMUNICATION NETWORK F 1 F 2 F m X 1 X 2 X m Terminals communicate over an available network. Multiple rounds of interactive communication are allowed. Interactive communication: F = F 1,...,F m. 4/21

5 Assumptions Assumption on the data 1. Abundance of data: Accumulated data grows with time n. - X i = X n i = (X i1,..., X in) - Data observed at time instance t: X Mt = (X 1t,..., X mt). 2. Observations are i.i.d. across time: - X M1,..., X Mn are i.i.d. rvs. 3. Observations are discrete valued. 5/21

6 Assumptions Assumption on the data 1. Abundance of data: Accumulated data grows with time n. - X i = X n i = (X i1,..., X in) - Data observed at time instance t: X Mt = (X 1t,..., X mt). 2. Observations are i.i.d. across time: - X M1,..., X Mn are i.i.d. rvs. 3. Observations are discrete valued. Assumptions on the protocol 1. Each terminal has access to all the communication. 2. Transmission depends on local data and previous communication. - interactive communication over multiple rounds. 5/21

7 Secure Computing of Functions COMMUNICATION NETWORK F1 F2 Fa Fm F: Public Communication A X n 1 X n 2 X n a X n m U1 U2 Ua Um G (n) 1 G (n) 2 G (n) a Estimates of g (X n M ) Secure computability of g by A: Pr G (n) i = g (XM), n i A 1 : I (g (X n M) F) 0 : Recoverability Secrecy Single-letter function: g (XM) n = (g (X M1),..., g (X Mn)). Notation: G = g (X M), G n = g (XM). n When is a given function g securely computable? 6/21

8 Secret Key Generation [Maurer 1993, Ahlswede-Csiszár 93, Csiszár-Narayan 04] Agreeing on secret bits using public communication. COMMUNICATION NETWORK F 1 F 2 F a F m F: Public Communication X n 1 X n 2 A X n a X n m I(K F) = 0 K1 K2 Ka K: Secret Key Terminals in A form estimates of the key. - Recoverability: Pr(K 1 = K 2 =... = K a = K) 1. - Security: I(K F) 0. 7/21

9 Secret Key Capacity Rate of the secret key = 1 n H(K). Secret key capacity C(A) = maximum achievable rate of a secret key. For two terminals X n F Y n K 1 K 2 K: Secret Key [Maurer 93, Ahlswede-Csiszár 93] C = I(X Y ). 8/21

10 Optimum Rate SK for Two Terminals Maurer-Ahlswede-Csiszár - Common randomness (CR) generated: X n or Y n. - Rate of communication required = min{h(x Y ); H(Y X)}. - Decomposition: H(X) = H(X Y ) + I(X Y ), H(Y ) = H(Y X) + I(X Y ). Csiszár-Narayan - Common randomness generated: X n, Y n. - Rate of communication required = H(X Y ) + H(Y X). - Decomposition: H(X,Y ) = H(X Y ) + H(Y X) + I(X Y ). A generalized decomposition: [Tyagi ISIT 11] 9/21

11 Secret Key Capacity [Csiszár-Narayan 04] Omniscience: Having an access to all the randomness. R(A) Communication for omniscience at A. Total Randomness: H(X M) Randomness Recovered as SK Communication Required to Share the Randomness: R(A) SK capacity: C = H(X M) R(A). R CO(A) can be characterized in a single-letter-form. 10/21

12 Secure Computing of Functions COMMUNICATION NETWORK F1 F2 Fa Fm F: Public Communication A X n 1 X n 2 X n a X n m U1 U2 Ua Um G (n) 1 G (n) 2 G (n) a Estimates of g (X n M ) Secure computability of g by A: Pr G (n) i = G n, i A 1 : I (g (X n M) F) 0 : Recoverability Secrecy When is a given function g securely computable? 11/21

13 A Necessary Condition Secret Key Generation COMMUNICATION NETWORK F1 F2 Fa Fm F: Public Communication X n 1 X n 2 A X n a X n m I(K F) = 0 K1 K2 Ka K: Secret Key [Csiszár-Narayan 04] C(A) = H (X M) R(A), 12/21

14 A Necessary Condition Secret Key Generation COMMUNICATION NETWORK F1 F2 Fa Fm F: Public Communication X n 1 X n 2 A X n a X n m I(K F) = 0 K1 K2 Ka K: Secret Key [Csiszár-Narayan 04] C(A) = H (X M) R(A), If g is securely computable by A, H(G) C(A). 12/21

15 Is H(G) < C(A) sufficient? All terminals wish to compute: A = M [TNG 10] If H(G) < C(M) a protocol for SC of g by M exists. 13/21

16 Is H(G) < C(A) sufficient? All terminals wish to compute: A = M [TNG 10] If H(G) < C(M) a protocol for SC of g by M exists. An Example for m = 2 X 1 X δ 0 δ Pr(X 1 = 1) = p Pr(X 1 X 2) = δ δ 1 1 δ 1 g(x 1, x 2) = x 1 + x 2 mod 2 H(G) = h(δ). C({1, 2}) = I(X 1 X 2) = h((1 p)δ + p(1 δ)) h(δ). g is securely computable if 2h(δ) < h((1 p)δ + p(1 δ)). 13/21

17 Example: Secure Computation of Parity Binary Symmetric Sources: p = 1 2 Secure computability condition: h(δ) < 1 h(δ). P : parity check matrix of a linear SW code for X 1 given X 2. I(G n X1 n ) = 0 I(G n F 1) = 0. K: location of X1 n in the coset of the standard array (for P). Rate of K = 1 h(δ). I(K F 1) = 0. Can show: I(K F 1, G n ) = 0. I(G n F 2, F 1) = I(G n F 2 F 1)e I(K F 1, G n ) = 0. X n 1 X n 2 14/21

18 Example: Secure Computation of Parity Binary Symmetric Sources: p = 1 2 Secure computability condition: h(δ) < 1 h(δ). P : parity check matrix of a linear SW code for X 1 given X 2. I(G n X1 n ) = 0 I(G n F 1) = 0. K: location of X1 n in the coset of the standard array (for P). Rate of K = 1 h(δ). I(K F 1) = 0. Can show: I(K F 1, G n ) = 0. I(G n F 2, F 1) = I(G n F 2 F 1)e I(K F 1, G n ) = 0. F 1 = PX n 1 X n 1 X n 2 Ĝ (n) 14/21

19 Example: Secure Computation of Parity Binary Symmetric Sources: p = 1 2 Secure computability condition: h(δ) < 1 h(δ). P : parity check matrix of a linear SW code for X 1 given X 2. I(G n X1 n ) = 0 I(G n F 1) = 0. K: location of X1 n in the coset of the standard array (for P). Rate of K = 1 h(δ). I(K F 1) = 0. Can show: I(K F 1, G n ) = 0. I(G n F 2, F 1) = I(G n F 2 F 1)e I(K F 1, G n ) = 0. F 1 = PX n 1 X n 1 X n 2 Ĝ (n) 14/21

20 Example: Secure Computation of Parity Binary Symmetric Sources: p = 1 2 Secure computability condition: h(δ) < 1 h(δ). P : parity check matrix of a linear SW code for X 1 given X 2. I(G n X1 n ) = 0 I(G n F 1) = 0. K: location of X1 n in the coset of the standard array (for P). Rate of K = 1 h(δ). I(K F 1) = 0. Can show: I(K F 1, G n ) = 0. I(G n F 2, F 1) = I(G n F 2 F 1)e I(K F 1, G n ) = 0. K K F 1 = PX n 1 X n 1 X n 2 Ĝ (n) 14/21

21 Example: Secure Computation of Parity Binary Symmetric Sources: p = 1 2 Secure computability condition: h(δ) < 1 h(δ). P : parity check matrix of a linear SW code for X 1 given X 2. I(G n X1 n ) = 0 I(G n F 1) = 0. K: location of X1 n in the coset of the standard array (for P). Rate of K = 1 h(δ). I(K F 1) = 0. Can show: I(K F 1, G n ) = 0. I(G n F 2, F 1) = I(G n F 2 F 1)e I(K F 1, G n ) = 0. K K F 1 = PX n 1 X n 1 X n 2 Ĝ (n) 14/21

22 Example: Secure Computation of Parity Binary Symmetric Sources: p = 1 2 Secure computability condition: h(δ) < 1 h(δ). P : parity check matrix of a linear SW code for X 1 given X 2. I(G n X1 n ) = 0 I(G n F 1) = 0. K: location of X1 n in the coset of the standard array (for P). Rate of K = 1 h(δ). I(K F 1) = 0. Can show: I(K F 1, G n ) = 0. I(G n F 2, F 1) = I(G n F 2 F 1)e I(K F 1, G n ) = 0. K K F 1 = PX n 1 X n 1 X n 2 F 2 = K + Ĝ(n) Ĝ (n) Ĝ (n) 14/21

23 Is H(G) < C(A) sufficient? All terminals wish to compute: A = M [TNG 10] If H(G) < C(M) a protocol for SC of g by M exists. Counterexample for A M A X n 1 X n 1 X n 2 X 1 X 2 g(x 1, x 1, x 2) = x 2. Let H(X 2) < H(X 1) = C(A). H(G) < C(A) is satisfied. However, g is clearly not securely computable. 15/21

24 A New Necessary Condition If G n is securely computable by A: COMMUNICATION NETWORK F1 F2 Fa Fm F: Public Communication A X n 1 X n 2 X n a X n m G n : Side Information for Decoding G (n) 1 G (n) 2 G a (n) Provide G n as side information to terminals in A c. - Available only for decoding but not for communicating. G n forms a secret key for all terminals, termed an aided secret key. - Let C g,a(m) be that largest achievable rate of such a key. 16/21

25 A New Necessary Condition If G n is securely computable by A: COMMUNICATION NETWORK F1 F2 Fa Fm F: Public Communication A X n 1 X n 2 X n a X n m G n : Side Information for Decoding G (n) 1 G (n) 2 G a (n) Provide G n as side information to terminals in A c. - Available only for decoding but not for communicating. G n forms a secret key for all terminals, termed an aided secret key. - Let C g,a(m) be that largest achievable rate of such a key. For a g securely computable by A, H(G) C g,a(m) 16/21

26 Aided Secret Key Capacity Theorem The aided secret key capacity is C g,a(m) = H(X M) R g,a(m), where R g,a(m) = min. sum rate of communication for omniscience at M when G n is available as side information for decoding to terminals in A c. 17/21

27 Characterization of Securely Computable Functions Theorem If g is securely computable by A : H(G) C g,a(m). Conversely, g is securely computable by A if: H(G) < C g,a(m). For securely computable function g: Omniscience can be obtained at A using F G n. Noninteractive communication suffices. Randomization is not needed. 18/21

28 Sketch of the Proof Consider random binning of appropriate rate at each terminal: To allow omniscience at M, with G n given to the terminals in A c for decoding. To keep bin indices independent of G n. 19/21

29 Sketch of the Proof 1. H(G) < C g,a(m) = H(X M) R g,a(m) H (X M G) > R g,a(m). 19/21

30 Sketch of the Proof 1. H(G) < C g,a(m) = H(X M) R g,a(m) H (X M G) > R g,a(m). 2. Generate random mappings F i = F i(xi n ) of rate R i: P Ri Rg,A(M) with (R1,..., Rm) s.t. i - it enables omniscience at M with side information G n given to the terminals in A c only for decoding. 19/21

31 Sketch of the Proof 1. H(G) < C g,a(m) = H(X M) R g,a(m) H (X M G) > R g,a(m). 2. Generate random mappings F i = F i(xi n ) of rate R i: P Ri Rg,A(M) with (R1,..., Rm) s.t. i - it enables omniscience at M with side information G n given to the terminals in A c only for decoding. mx 3. Observe: I(F M G n ) I `F i G n, F M\{i}. i 19/21

32 Sketch of the Proof 1. H(G) < C g,a(m) = H(X M) R g,a(m) H (X M G) > R g,a(m). 2. Generate random mappings F i = F i(xi n ) of rate R i: P Ri Rg,A(M) with (R1,..., Rm) s.t. i - it enables omniscience at M with side information G n given to the terminals in A c only for decoding. 3. Observe: I(F M G n ) mx I `F i G n, F M\{i}. i 4. To prove: With high probability I `F i G n, F M\{i} = 0, for each i. 19/21

33 Independence Properties of Random Mappings The Balanced Coloring Lemma To prove: With high probability I `F i G n, F M\{i} = 0, for each i. Shall show: For almost all (y,z): F i {G n = y, F M\{i} = z} uniform. Family of distributions on X n i : P X n i {G n =y,f M\{i} =z. Seek conditions for random mappings to be uniformly distributed - w.r.t. a given family of distributions. 20/21

34 Independence Properties of Random Mappings The Balanced Coloring Lemma Balanced Coloring Lemma: [R. Ahlswede-I. Csiszár, 98], [I. Csiszár-P.N., 04] Given a family of distributions with probabilities uniformly bounded above, Pr (random coloring uniform, w.r.t. all pmfs in the family) q, where q depends on the size of the family, the uniform bound and the rate of coloring. For the case at hand: a slightly generalized version is applied. - q = q(n) grows to 1 super-exponentially in n. 20/21

35 Secure Computability of Multiple Functions COMMUNICATION NETWORK F 1 F 2 F m F: Public Communication X n 1 X n 2 X n m g 1 g 2 g m Secrecy Condition: I (F G n 1,..., G n m) 0. Which functions g 1,..., g m are securely computable? Omniscience is not allowed in general For m = 2: X 1 X 2 g i(x 1, x 2) = x i. 21/21

Common Randomness Principles of Secrecy

Common Randomness Principles of Secrecy Himanshu Tyagi Department of Electrical and Computer Engineering and Institute of Systems Research 1 Correlated Data, Distributed in Space and Time Sensor Networks