On the Capacity and Straggler-Robustness of Distributed Secure Matrix Multiplication

Abstract

Computationally efficient matrix multiplication is a fundamental requirement in various fields, including and particularly in data analytics. To do so, the computation task of large-scale matrix multiplication is typically outsourced to multiple servers. However, due to data misusage at the servers, security is typical of concern. In this paper, we first study the two-sided secure matrix multiplication problem, where a user is interested in the matrix product AB of two finite field private matrices A and B from an information-theoretic perspective. In this problem, the user exploits the computational resources of N servers to compute the matrix product but simultaneously tries to conceal the private matrices from the servers. Our goal is twofold: (i) to maximize the downlink communication rate, and (ii) to minimize the effective number of server observations needed to determine AB, while preserving security, where we allow for up to ≤ N servers to collude. To this end, we propose two schemes -an aligned secret sharing scheme (A3S) and a secure cross subspace alignment (SCSA) scheme. For A3S, we optimize the partitioning of matrices A and B in order to either optimize objective (i) or (ii) as a function of the system parameters (e.g., N and ). A proposed inductive approach gives us analytical, close-to-optimal solutions for both (i) and (ii). The SCSA, on the other hand, is shown to be (rate) capacity-optimal for the general J -sided distributed secure matrix multiplication problem J j=1 M j . We show this by developing a recursive information-theoretic upper bound (converse) on the downlink rate for the J -sided secure matrix multiplication problem. With respect to (i), both A3S and SCSA, significantly outperform the state-of-the-art in terms of (a) communication rate, (b) maximum tolerable number of colluding servers, and (c) computational complexity. Overall SCSA (A3S) is the preferred choice when the focus is on the downlink (uplink).

Double Blind T-Private Information Retrieval

“…To see this in a bit more detail, recall that the idea of cross-subspace alignment originated in the context of XS-TPIR [29], [30] as a way to align interference from undesired product terms that result when a secret-shared (private) query vector is multiplied with a secretshared (secure) data vector. It was then observed in [29], [44], [61], [64], [65] that the idea of aligning undesired product terms is similarly useful in distributed computing applications, which led to a crossover of CSA codes to coded distributed computing [66]. Generalized CSA codes were constructed in [61] to unify and improve upon several state-of-art CDC approaches like Lagrange Coded Computing [67] and Entangled Polynomial codes [68].…”

Improved Private and Secure Distributed Matrix Multiplication

“…• When p = 1 and m = n, the recovery threshold of the new code C SDMM is less than that of the Chang-Tandon code in [12]. • The new code C SDMM subsumes the Yang-Lee code [14] as a special case by setting p = X = 1 and subsumes the Kakar et al code 1 [13] as a special case by setting p = 1. • From Table III, it is seen that to compare the performances of the new code C SDMM and the SGPD code in [16], it is equivalent to compare their recovery thresholds.…”

“…Yang and Lee [14] proposed SDMM codes in the case of no collusion (X = 1). Kakar et al [13] and D'Oliveira et al [10], [11] further provided more efficient constructions over that of Chang and Tandon. Based on the entangled polynomial code [9], Aliasgari et al [16] presented more flexible SDMM codes.…”

Private and Secure Distributed Matrix Multiplication With Flexible Communication Load

“…In [18], [25], coded schemes have been used to develop multi-party computation techniques to calculate arbitrary polynomials of massive matrices, preserving security of the data matrices. In [20], [21], [23] a reduction of the communication load is obtained by extending polynomial codes. While these works focus on either minimizing recovery threshold or communication load, the trade-off between these two fundamental quantities has not been addressed in the open literature to the best of our knowledge.…”

“…As we will discuss, the projection of this set onto the plane defined by the condition P C = 0 includes the set of pairs (P R , C L ) in (15) and (16) obtained by the GPD code [14]. The proposed secure GPD (SGPD) code augments matrices A and B by adding P C random block matrices to the input matrices A and B, in a manner similar to prior works [18]- [21], [23], yielding augmented matrices A * and B * . As we will see, a direct application of the GPD codes to these matrices is suboptimal.…”