SPIKE: Secure and Private Investigation of the Kidney Exchange problem

Abstract

Background:The kidney exchange problem (KEP) addresses the matching of patients in need for a replacement organ with compatible living donors. Ideally many medical institutions should participate in a matching program to increase the chance for successful matches. However, to fulfill legal requirements current systems use complicated policy-based data protection mechanisms that effectively exclude smaller medical facilities to participate. Employing secure multi-party computation (MPC) techniques provides a technical way to satisfy data protection requirements for highly sensitive personal health information while simultaneously reducing the regulatory burdens. Results:We have designed, implemented, and benchmarked SPIKE, a secure MPC-based privacy-preserving KEP which computes a solution by finding matching donor-recipient pairs in a graph structure. SPIKE matches 40 pairs in cycles of length 2 in less than 4 minutes and outperforms the previous state-of-the-art protocol by a factor of 400× in runtime while providing medically more robust solutions. Conclusions:We show how to solve the KEP in a robust and privacy-preserving manner achieving practical performance. The usage of MPC techniques fulfills many data protection requirements on a technical level, allowing smaller health care providers to directly participate in a kidney exchange with reduced legal processes.

Solving the Kidney Exchange Problem Using Privacy-Preserving Integer Programming

“…We eliminate this redundancy by proposing the more efficient subset formulation. 3 Definition 2 (Subset Formulation): Let S contain all vertex sets of size k with 2 ≤ k ≤ l and let µ : S → C ∪ {∅} be a mapping that assigns an arbitrary cycle µ(S) ∈ C with V (µ(S)) = S to each S ∈ S. If there is no such cycle, let µ(S) = ∅. Then, the subset formulation is defined as…”

“…Recently, Birka et al [3] present another SMPC protocol in the greater context of kidney exchange. In contrast to the protocols by Breuer et al [5], [6] as well as the newlydeveloped protocol in this paper, the protocol introduced in [3] does not solve the KEP.…”

“…Recently, Birka et al [3] present another SMPC protocol in the greater context of kidney exchange. In contrast to the protocols by Breuer et al [5], [6] as well as the newlydeveloped protocol in this paper, the protocol introduced in [3] does not solve the KEP. Instead, their protocol implements an ideal functionality that outputs some set of possible exchanges for a single fixed cycle size l as well as the number of cycles that exist in the otherwise private compatibility graph.…”

“…Instead, their protocol implements an ideal functionality that outputs some set of possible exchanges for a single fixed cycle size l as well as the number of cycles that exist in the otherwise private compatibility graph. This set is only an approximation to a solution of the KEP since it neither maximizes the number of exchange cycles for the fixed l nor does it consider all possible cycle sizes up to l. While [3] exhibits a superior runtime performance compared to the protocols in [5] and [6], it fails to analyze the quality of the approximation. This is highly problematic for the use case of kidney exchange where any possible exchange that is not found may have severe ramifications for the respective patient-donor pairs.…”