1

Point-Based Trust: Point-Based Trust: Define How Much Define How Much Privacy is WorthPrivacy is Worth

Danfeng YaoDanfeng Yao Keith B. FrikkenKeith B. FrikkenBrown UniversityBrown University Miami UniversityMiami University

Mikhail J. AtallahMikhail J. Atallah Roberto Tamassia Roberto TamassiaPurdue UniversityPurdue University Brown UniversityBrown University

ICICS December, 2006, Raleigh NCICICS December, 2006, Raleigh NC

Funded by NSF IIS-0325345, IIS-0219560, IIS-0312357, and IIS-0242421, ONR Funded by NSF IIS-0325345, IIS-0219560, IIS-0312357, and IIS-0242421, ONR N00014-02-1-0364, CERIAS, and Purdue Discovery ParkN00014-02-1-0364, CERIAS, and Purdue Discovery Park

2

Outline of the talkOutline of the talk

1. Introduction to privacy 1. Introduction to privacy protection in authorizationprotection in authorization

2. Point-based authorization and 2. Point-based authorization and optimal credential selectionoptimal credential selection

2.1 New York State Division of Motor 2.1 New York State Division of Motor Vehicle 6-Point Authentication SystemVehicle 6-Point Authentication System

3. Secure 2-party 3. Secure 2-party protocol for knapsack protocol for knapsack problemproblem

4. Applications 4. Applications

2.2 Knapsack problem2.2 Knapsack problem

3

Protecting private informationProtecting private information

Request for discountRequest for discount

Request Request UIDUID

RequestRequest BBBBBB

BBBBBB

UIDUID

Grant the discount Grant the discount

PolicPolicyy

Releasing Releasing UIDUID requires requires BBBBBB

CredCred..

UIDUID (student (student ID)ID)

AliceAlice

PolicyPolicyDiscount Discount

requires requires UIDUID

Cred.Cred.BBBBBB (better (better

business business bureau)bureau)

Trust negotiation protocols [Trust negotiation protocols [Winsborough Seamons Jones 00, Yu Winsborough Seamons Jones 00, Yu Ma Winslett 00, Winsborough Li 02, Li Du Boneh 03Ma Winslett 00, Winsborough Li 02, Li Du Boneh 03]]

4

Our goalsOur goals

Prevent pre-mature information leaking by both partiesPrevent pre-mature information leaking by both parties Credentials should be exchanged only if services can be Credentials should be exchanged only if services can be

establishedestablished Support some kind of cumulative privacy Support some kind of cumulative privacy quantitativelyquantitatively

Disclosing more credentials should incur higher privacy loss Disclosing more credentials should incur higher privacy loss Support flexible service modelSupport flexible service model

Allow customized (or personalized) access policiesAllow customized (or personalized) access policies Adjustable services based on qualifications Adjustable services based on qualifications

Our ultimate goal is to encourage users to participate in e-commerceOur ultimate goal is to encourage users to participate in e-commerce

5

What can we learn from New York What can we learn from New York State DMV?State DMV?

6-point proof-of-identity for getting NY driver’s 6-point proof-of-identity for getting NY driver’s license license

CredentialCredential PointsPoints

PassportPassport 55

Utility billUtility bill 11

Birth certificateBirth certificate 44

Social security cardSocial security card 33

6

Another motivation – adjustable Another motivation – adjustable servicesservices

Membership, Membership, CredentialCredential Discount Discount

MastercardMastercard 2%2%

Airline frequent flier Airline frequent flier 1%1%

AAAAAA 0.5%0.5%

VeteranVeteran 0.5%0.5%

Adjustable services based on the private informationAdjustable services based on the private information revealedrevealed

7

Point-based authorization modelPoint-based authorization model

Credential type Credential type CC11,, CC22, …,, …, CCn n

The The service providerservice provider defines defines Point valuesPoint values pp11,, pp22, …,, …, ppnn of credentials ----- privateof credentials ----- private ThresholdThreshold TT for accessing a resource ----- private for accessing a resource ----- private

The The useruser defines defines sensitivitysensitivity scoresscores aa11,, aa22, …,, …, aann of credentials of credentials ----- private----- private

Credential selection problem Credential selection problem The user (or client) wants to satisfy threshold The user (or client) wants to satisfy threshold TT with the with the

minimum minimum disclosure of privacydisclosure of privacy

Minimize Minimize aaii x xii

Subject toSubject to ppi i xxi i ≥≥ TT

i=1i=1

nn

i=1i=1

nn

xxii = 0= 0 not to disclose not to disclose CCii

xxii= 1= 1 disclose disclose CCii

This can be converted to a knapsack problemThis can be converted to a knapsack problem

8

ExampleExample

CredentialCredential CollegCollege IDe ID

Driver’Driver’s s

licenselicense

CrediCredit t

cardcard

SSNSSN

Sensitivity score

10 30 50 100

CredentiCredentialal

CollegCollege IDe ID

Driver’Driver’s s

licenselicense

Credit Credit cardcard

SSNSSN

Point value

3 6 8 10

Threshold of accessing a resource: 10

Alice’s Alice’s optionoption

Point Point valuevalue

ss

SensitiviSensitivity scorety score

SSN 10 100

College ID, Credit

card

11 60

License, Credit card

14 80

9

Where do points come from? Where do points come from? Reputation systems [Reputation systems [Beth Borcherding Klein 94Beth Borcherding Klein 94,, Tran Hitchens Tran Hitchens

Varadharajan Watters 05Varadharajan Watters 05, Zouridaki Mark Hejmo ThomasZouridaki Mark Hejmo Thomas 20052005]] This is future work, but here is an ideaThis is future work, but here is an idea

Evaluate

Evaluate

Evaluate

Member of

10

Converting CSP into a knapsack Converting CSP into a knapsack problemproblem

Defines binary vector Defines binary vector yy11,, yy22, …,, …, yynn, where , where yyi i = 1 –= 1 – xxii

{{aaii}: Private to user}: Private to user

{{ppii }: Private to provider }: Private to provider

Maximize Maximize aaii y yii

Subject toSubject to ppi i yyi i << T’ T’

i=1i=1

nn

i=1i=1

nn Let Let T’T’ = = ppii - - TT

i=1i=1

nn

Bag of size T’,Bag of size T’,n = 6n = 6

What to pick and steal?What to pick and steal?

11

Dynamic programming of Dynamic programming of knapsack problemknapsack problem

Dynamic programming for 0/1 knapsack problemDynamic programming for 0/1 knapsack problem Construct a Construct a nn-by--by-T’T’ table table MM, where, where

M M i, ji, j == M M i-1i-1, , jj ifif j j << p pi i

maxmax {{M M i-1i-1,, j j,, M M i-1i-1,, j-pi j-pi ++ a ai i }} ifif j j ≥≥ p pii

T’T’ = = ppii - - TT i=1i=1

nn

.... .... .... ....

Mi-1, j-pi .... .... Mi-1, j

.... .... .... ??

{ai }: Private to user{pi }: Private to provider

12

Overview of privacy-preserving Overview of privacy-preserving knapsack computation knapsack computation

Uses 2-partyUses 2-party maximization protocol maximization protocol [ [Frikken Frikken Atallah 04Atallah 04]]

Uses Uses homomorphic encryptionhomomorphic encryption scheme scheme E(x)E(y) = E(x + y)E(x)E(y) = E(x + y) E(x)E(x)cc = E(xc) = E(xc)

Preserves privacy for bothPreserves privacy for both Two phases: table-filling and traceback Two phases: table-filling and traceback

maxmax {{ ,, - - ∞ ∞ ++ a aii }}M M i, ji, j == M M i-1i-1, , jj ifif j j << p pi i

maxmax {{M M i-1i-1,, j j ,, M M i-1i-1,, j-pi j-pi ++ a ai i }} ifif j j ≥≥ p pii

Add maximization and addition of Add maximization and addition of aaii to make the two to make the two computation procedures indistinguishable computation procedures indistinguishable

13

Preliminary: 2-party maximization Preliminary: 2-party maximization protocol in a split formatprotocol in a split format

Alice1Amazon1

Alice2Amazon2

Alice’s share

Amazon’sshare

Max

PlayerPlayer InputInput OutputOutput PrivacyPrivacy

AliceAlice Alice1, Alice2Alice1, Alice2 Alice’s share of Alice’s share of max*max*

Do not know Do not know which is the which is the

maxmaxAmazoAmazonn

Amazon1, Amazon1, Amazon2Amazon2

Amazon’s share of Amazon’s share of max*max*

* Alice’s share + Amazon’s share = * Alice’s share + Amazon’s share =

max (Alice1 + Amazon1, Alice2 + Amazon2)max (Alice1 + Amazon1, Alice2 + Amazon2)

Comparison can be done similarly [Comparison can be done similarly [Frikken Atallah 04Frikken Atallah 04]]

14

Our protocol for dynamic programming of Our protocol for dynamic programming of 0/1 knapsack problem0/1 knapsack problem

Computed entries are Computed entries are encrypted and stored by the encrypted and stored by the provider provider

The provider splits the two The provider splits the two candidates of candidates of MMi, ji, j

The client and provider The client and provider engage in a engage in a 2-party private 2-party private maximization protocolmaximization protocol to to compute the maximum compute the maximum

The client encrypts her share The client encrypts her share of the maximum and sends it of the maximum and sends it to the provider to the provider

The provider computes and The provider computes and stores the encrypted stores the encrypted MMi, ji, j

M M i, ji, j == M M i-1i-1, , jj ifif j j << p pi i

maxmax {{MMi-1i-1,, j j ,, M Mi-1i-1,, j-pi j-pi ++ a ai i }} ifif j j ≥≥ ppii

maxmax {{ ,, - - ∞ ∞ ++ a aii }}

.... .... .... ....

E(Mi-1, j-pi) .... .... E(Mi-1, j)

.... .... .... ??

Alice Amazon

Alice Amazon

E(Mi-1, j)

E(Mi-1, j-pi)Alice’s share

Amazon’sshare

aaii

Max

15

Our protocol for knapsack (Cont’d)Our protocol for knapsack (Cont’d)

At the end of the 2-party dynamic programming, the At the end of the 2-party dynamic programming, the provider has a n-by-T’ table of encrypted entriesprovider has a n-by-T’ table of encrypted entries

Number of credentials n=4Number of credentials n=4

How does the client find out the optimal selection of credentials?How does the client find out the optimal selection of credentials?

E(E(MM1, 11, 1)) E(E(MM1, 21, 2)) E(E(MM1, 31, 3)) E(E(MM1, 41, 4)) E(E(MM1, 51, 5))

E(E(MM2, 12, 1)) E(E(MM2, 22, 2)) E(E(MM2, 32, 3)) E(E(MM2, 42, 4)) E(E(MM2, 52, 5))

E(E(MM3, 13, 1)) E(E(MM3, 23, 2)) E(E(MM3, 33, 3)) E(E(MM3, 43, 4)) E(E(MM3, 53, 5))

E(E(MM4, 14, 1)) E(E(MM4, 24, 2)) E(E(MM4, 34, 3)) E(E(MM4, 44, 4)) E(E(MM4, 54, 5))

T’T’ = = ppii - - TT i=1i=1

nn

16

Traceback protocol: get the Traceback protocol: get the optimal credential selectionoptimal credential selection

Security in a semi-honest (honest-but-curious) modelSecurity in a semi-honest (honest-but-curious) model

E(E(MM1, 11, 1), ), E(E(FF1, 11, 1))

E(E(MM1, 21, 2), ), E(E(FF1, 21, 2))

E(E(MM1, 31, 3), ), E(E(FF1, 31, 3))

E(E(MM1, 41, 4), ), E(E(FF1, 41, 4))

E(E(MM1, 51, 5), ), E(E(FF1, 51, 5))

E(E(MM2, 12, 1), ), E(E(FF2, 12, 1))

E(E(MM2, 22, 2), ), E(E(FF2, 22, 2))

E(E(MM2, 32, 3), ), E(E(FF2, 32, 3))

E(E(MM2, 42, 4), ), E(E(FF2, 42, 4))

E(E(MM2, 52, 5), ), E(E(FF2, 52, 5))

E(E(MM3, 13, 1), ), E(E(FF3, 13, 1))

E(E(MM3, 23, 2), ), E(E(FF3, 23, 2))

E(E(MM3, 33, 3), ), E(E(FF3, 33, 3))

E(E(MM3, 43, 4), ), E(E(FF3, 43, 4))

E(E(MM3, 53, 5), ), E(E(FF3, 53, 5))

E(E(MM4, 14, 1), ), E(E(FF4, 14, 1))

E(E(MM4, 24, 2), ), E(E(FF4, 24, 2))

E(E(MM4, 34, 3), ), E(E(FF4, 34, 3))

E(E(MM4, 44, 4), ), E(E(FF4, 44, 4))

E(E(MM4, 54, 5), ), E(E(FF4, 54, 5))

Item 0Item 0

Item 1Item 1

Item 2Item 2

Item 3Item 3

Item 4Item 4

00

FFi, ji, j == 0 or 10 or 1

E(E(FFii, , jj))

17

Security and efficiency of our Security and efficiency of our privacy-preserving knapsack privacy-preserving knapsack

computationcomputation Informally, security means that private information is not Informally, security means that private information is not

leakedleaked Security definitions Security definitions

Semi-honest adversarial modelSemi-honest adversarial model A protocol securely implements function A protocol securely implements function ff ifif the view of the view of

participants are simulatable with an ideal implementation of participants are simulatable with an ideal implementation of the protocol the protocol

Theorem Theorem The basic protocol of the private two-party dynamic The basic protocol of the private two-party dynamic programming computation in the point-based trust programming computation in the point-based trust management model is secure in the semi-honest adversarial management model is secure in the semi-honest adversarial model.model.

TheoremTheorem The communication complexity between the provider The communication complexity between the provider and the client of our basic secure dynamic programming and the client of our basic secure dynamic programming protocol is O(nT'), where n is the total number of credentials protocol is O(nT'), where n is the total number of credentials and T' is the marginal threshold.and T' is the marginal threshold.

18

Fingerprint protocol: an improved Fingerprint protocol: an improved traceback protocol traceback protocol

We want to exclude the provider in the tracebackWe want to exclude the provider in the traceback To prevent tampering and reduce costsTo prevent tampering and reduce costs

1. Filling knapsack table1. Filling knapsack table

2. (Encrypted) last entry2. (Encrypted) last entry

3. Decrypt and identity 3. Decrypt and identity optimal credential selectionoptimal credential selection

Fingerprint protocol is a general solution for traceback in DPFingerprint protocol is a general solution for traceback in DP

19

Fingerprint protocol (cont’d)Fingerprint protocol (cont’d)

Item No.Item No. Privacy Privacy scorescore

(decimal)(decimal)

Privacy Privacy score score

(binary)(binary)

Transformed scoreTransformed score

11 22 010010 010 010 00010001

22 33 011011 011 011 00100010

33 55 101101 101 101 01000100

44 88 10001000 1000 1000 1000 1000

Knapsack result Knapsack result (decimal)(decimal)

Knapsack result Knapsack result (binary)(binary)

Item numbers in Item numbers in the knapsackthe knapsack

33 … … 00100010 22

2020 … … 11111111 1, 2, 3, 41, 2, 3, 4

20

Application of point-based Application of point-based authorization: fuzzy location query in authorization: fuzzy location query in

Presence systemsPresence systems

Alice’s bossAlice’s boss

Alice’s exAlice’s ex

Alice’s momAlice’s mom

Where is Alice?Where is Alice?

Where is Alice?Where is Alice?

Where is Alice?Where is Alice?BossBoss

MomMom

ExEx

21

Related workRelated work

Hidden credentials [Hidden credentials [Bradshaw Holt Seamons 04Bradshaw Holt Seamons 04, , Frikken Li Frikken Li Atallah 06Atallah 06]]

Private policy negotiation [Private policy negotiation [Kursawe Neven TuylsKursawe Neven Tuyls 0606], ], Optimizing trust negotiation [Optimizing trust negotiation [Chen Clarke Kurose Towsley Chen Clarke Kurose Towsley 0505], Trust negotiation protocol/framework [], Trust negotiation protocol/framework [Winsborough Winsborough Seamons Jones 00Seamons Jones 00, , Yu Ma Winslett 00Yu Ma Winslett 00,, Winsborough Li 02 Winsborough Li 02,, Li Du Boneh 03Li Du Boneh 03,, Li Li Winsborough 05 Li Li Winsborough 05]]

Anonymous credential approaches [Anonymous credential approaches [Chaum 85Chaum 85,, Camenisch Camenisch Lysyanskaya 01Lysyanskaya 01]]

Secure Multiparty Computation [Secure Multiparty Computation [Atallah Li 04Atallah Li 04,, Atallah Du Atallah Du 0101]]

OCBE [OCBE [Li Li 06Li Li 06]] Manet [Manet [Zouridaki Mark Hejmo ThomasZouridaki Mark Hejmo Thomas 0505]] Platform for Privacy PreferencesPlatform for Privacy Preferences (P3P) [(P3P) [W3CW3C]]

22

Conclusions and future workConclusions and future work

Our point-based model allows a client to choose the Our point-based model allows a client to choose the optimal selection of credentialsoptimal selection of credentials

We presented private 2-party protocol for knapsack We presented private 2-party protocol for knapsack problemproblem

Our fingerprint protocol is a general solution for Our fingerprint protocol is a general solution for tracebacktraceback

Future workFuture work Add typing to credentialsAdd typing to credentials Reputation systems and pointsReputation systems and points