VD-PSI: Verifiable Delegated Private Set Intersection on Outsourced Private Datasets

Abstract

Abstract. Private set intersection (PSI) protocols have many real world applications. With the emergence of cloud computing the need arises to carry out PSI on outsourced datasets where the computation is delegated to the cloud. However, due to the possibility of cloud misbehaviors, it is essential to verify the integrity of any outsourced datasets, and result of delegated computation. Verifiable Computation on private datasets that does not leak any information about the data is very challenging, especially when the datasets are outsourced independently by different clients. In this paper we present VD-PSI, a protocol that allows multiple clients to outsource their private datasets and delegate computation of set intersection to the cloud, while being able to verify the correctness of the result. Clients can independently prepare and upload their datasets, and with their agreement can verifiably delegate the computation of set intersection an unlimited number of times, without the need to download or maintain a local copy of their data. The protocol ensures that the cloud learns nothing about the datasets and the intersection. VD-PSI is efficient as its verification cost is linear to the intersection cardinality, and its computation and communication costs are linear to the dataset cardinality. Also, we provide a formal security analysis in the standard model.

Outsourced Mutual Private Set Intersection Protocol for Edge-Assisted IoT

“…Kavousi et al proposed a PSI protocol in [19], which takes the OPRF and the garbled BF as its main components, avoiding costly operations of computation and having high scalability. e protocol in [20] allows users to store their private data sets on cloud server and also entrust computing of the intersection to the server and use homomorphic encryption (HE) and oblivious polynomial evaluation (OPE) to process the data. It greatly reduces the workload of users and improves the computational efficiency of the protocol.…”

“…Performance Evaluation 6.1. eoretical Evaluation. In this section, regarding the complexity of calculation and communication, we compare the O-mPSI protocol with the protocols in [11,12,20]. We choose these three protocols because both parties of the protocols in [11,12] can know the intersection, and the protocol in [20] supports outsourcing.…”

New Approach to Set Representation and Practical Private Set-Intersection Protocols

“…Recently, Abadi et al [9], [10] presented two delegated PSI protocols for the outsourced public cloud systems [11] based on additive homomorphic PKC and point-value set representation. In the protocols, clients encrypted their datasets by representing them as blinded polynomials independently, outsourced and stored the blinded datasets on the cloud server, and the blinded datasets could be used directly when running the protocols.…”

“…We evaluate our PSI protocol by comparing with other related PSI protocols that are PKC-based protocols [5], [10], generic protocols based protocol [14] and OT-based protocols [18], [20]. We compare these protocols in terms of four properties: simulated-based security, natural secure data storage, needing secure channel or not and runtime.…”

“…We implement these protocols in C, while ours in Java, and measure the execution times of all the protocols on the same environment: an Intel(R)Core TM i7 − 7700HQ @ 3.6GHz CPU, 8 GBRAM processor with one thread in the LAN setting. The results are summarized in Table 3, which show that our PSI protocol enjoys the following advantages: (a) our protocol provides a formal detailed simulated-based security proof, which [14] and [20] only give an informal security analysis; (b) in our protocol, a natural secure data storage is given, it's possible to outsource and store datasets on the cloud server and use the encrypted datasets directly when executing the protocol, while in [5], [14], [20] and [18], if datasets are outsourced and stored on the cloud server, they must be encrypted first and be decrypted in advance when using them; (c) a normal channel is suitable to our need, while a secure channel is need in [10] because from the message e i , P B could learn τ (A) (x i ) and then the set of P A ; (d) based on the runtime analysis, our protocol is more efficient than others especially when the set size less than 2 12 .…”