Upload
jat02013
View
84
Download
0
Embed Size (px)
DESCRIPTION
sdfdsfdsfdsfdsfdsfsdf
Citation preview
IIIT
Hyd
erab
ad
Efficient Privacy PreservingEfficient Privacy PreservingProtocols forProtocols for
Visual ComputationVisual Computation
Maneesh Upmanyu
Advisors: C. V. Jawahar , Anoop M. Namboodiri, Kannan Srinathan,
Center for Visual Information Technology
Center for Security, Theory & Algorithmic Research
IIIT- Hyderabad
IIIT
Hyd
erab
ad
Security and Privacy of Visual Data
• Development of secure computational algorithms in computer vision
and related areas.– To develop “highly-secure” solutions
– To develop “computationally efficient” solutions
– To develop solutions to problems with immediate impact
Broad Objective
Project Web-Page: http://cvit.iiit.ac.in/projects/SecureVision
IIIT
Hyd
erab
ad
Research Directions
Private Content Based Image Retrieval (PCBIR)
A2
Q2
Q1
A1
Feature vector (fquery)
……..
Root Info
fquery, f(A1)
fquery, f(A2)
Publication: Shashank J, Kowshik P, Kannan Srinathan and C.V. Jawahar; Private Content Based Image Retrieval; In Proceedings of Computer Vision and Pattern Recognition (CVPR 2008)
Publication: Maneesh Upmanyu, Anoop M. Namboodiri, K. Srinathan and C.V. Jawahar; Blind Authentication - A Secure Crypto-Biometric Verification Protocol: Appears in IEEE-Transactions on Information Forensics and Security (IEEE-TIFS), June 2010
Publication: Maneesh Upmanyu, Anoop M. Namboodiri, K. Srinathan and C.V. Jawahar; Efficient Privacy Preserving Video Surveillance: Proceedings of the 12th International Conference on Computer Vision (ICCV 2009)
Blind Authentication: A Secure Crypto-Biometric Verification
Protocol
Efficient Privacy Preserving Video Surveillance
IIIT
Hyd
erab
ad
Our Security Goal
• What is meant by ‘Privacy’?– Design protocols to limit the information leakage through what is
learned in addition to the designated output.
• What is the ‘Adversary Model’?– Semi-honest vs. Malicious adversary
• Analysis outline: – Correctness
– Security
– Complexity
IIIT
Hyd
erab
ad
Assumptions
• Reliable and secure communication channel
• Players are passively corrupt, that is, honest but curious.
• Players are computationally bounded.
• Players do not collude.
IIIT
Hyd
erab
ad
Thesis Objective
• Traditional Approaches uses highly interactive protocols.– Limitation: massive datasets
– Example: Blind Vision
• Paradigm Shift– Compute directly in encrypted domain.
• Encrypt -> Communicate -> Compute -> Decrypt
– Domain specific encryption schemes.• PKC is data independent and generic.
– Can the paradigm be generic yet efficient?
IIIT
Hyd
erab
ad
Contribution of Thesis
A method that provides provable security, while allowing efficient computations for generic vision algorithms have remained elusive.
We show that, one can exploit certain properties inherent to visual data to break this seemingly impenetrable barrier.
IIIT
Hyd
erab
ad
Dilemma of Privacy vs. Accuracy
IIIT
Hyd
erab
ad
What is Blind Authentication?
A biometric authentication protocol that does not reveal any:
– information about the biometric samples to the authenticating server.
– information regarding the classifier, employed by the server, to the user or client
IIIT
Hyd
erab
ad
Biometric Authentication System
IIIT
Hyd
erab
ad
Primary Concerns in a Biometric System
• Template Protection
• Non-Repudiable
• Network and Client-side Security
• Revocability
IIIT
Hyd
erab
ad
Previous Work
“A template protection scheme with provable security and acceptable recognition performance has thus far remained elusive.”
– A.K. Jain, Eurasip 2008
IIIT
Hyd
erab
ad
Homomorphic Encryption• An encryption scheme using which some algebric
operation , like addition or multiplication, can be directly done on the cipher text.
Let x1 = 20 and x2 = 22, to compute x1+x2 = 42
Use an encryption scheme, for example E(x) = ex
Server stores E(x1) = e20 and E(x2) = e22
Compute using encrypted data
y = E(x1) E(x2) = e20.e22 = e42
Decrypt z = D(y) = ln(y) z = D(y) ln (e42) = 42
IIIT
Hyd
erab
ad
User Enrollment
Enrollment based on a trusted third party.
IIIT
Hyd
erab
ad
Authentication using a Linear Kernel
IIIT
Hyd
erab
ad
Extensions to Kernels & Neural Networks
• Kernel based classifier uses a discriminating function like
• Similarly, in Neural Network the basic units are for example perceptron or sigmoid
• Model above functions as arithmetic circuits consisting of add and multiplication gates over a finite domain.
• Consider two encryptions E+ and E*
IIIT
Hyd
erab
ad
Implementation and Analysis• Experiments designed to evaluate the efficiency and
accuracy of proposed approach.
• For evaluation, an SVM based verifier based on client-server architecture was implemented.– Accuracy: as no assumptions are made, accuracy remains same.
• Verified this on various public domain (UCI, Statlog) datasets.
IIIT
Hyd
erab
ad
Case study shows that matching using fixed length feature representation is comparable to variable length methods such as dynamic warping.
IIIT
Hyd
erab
ad
Security, Privacy and Trust
• Server Security– Template database security
– Hacker sitting in server
• Client Security– Hacker has user’s key or biometric
– Passive attacks at client end
• Network Security– Network is susceptible to snooping attacks
IIIT
Hyd
erab
ad
Advantages of Blind Authentication
• Fast and Provably Secure authentication without trading off accuracy.
• Supports generic classifiers such as Neural Network and SVMs.
• Useful with wide variety of fixed-length biometric-traits.
• Ideal for applications such as biometric ATMs, login from public terminals.
IIIT
Hyd
erab
ad
Proposed Surveillance System
Plain Video Captured by Camera
Encrypted Video As seen by one of the
Computational Servers
Processed Video As seen by the
Computational Server
Result Video Received by
Observer
How do we carry out surveillance
on ‘Randomized’ images ?
IIIT
Hyd
erab
ad
Motivation
Can we do surveillance without
‘seeing’ the original video ?
IIIT
Hyd
erab
ad
Paradigm Shift
We use the paradigm of secret sharing to achieve private and efficient surveillance.
IIIT
Hyd
erab
ad
Protocol in a nutshellPropose a ‘Cloud-Computing’ based solution using k>2 non-colluding servers
IIIT
Hyd
erab
ad
Secret Sharing• A method of distributing a secret among a group of servers,
such that:– Each server on its own has no meaningful information
– Secret is reconstructed only when all shares combine together
• Existing methods are highly inefficient
• Asmuth-Bloom overcomes this limitation by working in Residue Number System (RNS).
IIIT
Hyd
erab
ad
RNS ( m1 = 37, m2 = 49; M = m1 x m2 = 1813)
Example to do Addition in RNS
CRT (z1, z2)
X = 973%(m1, m2)
(x1, x2) = (11, 42)Y = 678%(m1, m2)
(y1, y2) = (12, 41)
x1 = 11, y1 = 12
z1 = (x1 + y1) % m1
= (11+12) % 37 = 23
x2 = 42, y2 = 41
z2 = (x2 + y2) % m2
= (42+41) % 49 = 34
Z = 1651
Shatter: (x) = (x.S+) mod mi
Merge: (xi, mi) = CRT(xi, mi) /S
IIIT
Hyd
erab
ad
Data Properties
• While general purpose secure computation appears inherently complex and oftentimes impractical.
– We show certain properties of the data can be used to ensure efficiency while ensuring privacy.
• Following properties are of interest to us.– Limited and Fixed Range
– Scale Invariant
– Approximate Nature
– Non-General Operands
IIIT
Hyd
erab
ad
Characteristics of the System
IIIT
Hyd
erab
ad
Implementation Challenges
• Representation of negative numbers: Use an Implicit sign representation.– Use (0, M/2) as positive and rest as negative.
– Sign conversion is carried out using additive inversion of Z.
• Overflow and Underflow: Operations are valid and correct as long as range of data is (-M/2, M/2).
• Integer Division and Thresholding: RNS domain is finite and hence not all divisions are defined.
– Dividing integer A by B is defined as A/B = (ai.bi-1) mod mi
• Defining Equivalent operations: For every f(x), we need to define f`(x) such that merging f`(xi) would give f(x).
IIIT
Hyd
erab
ad
Experimental Results
IIIT
Hyd
erab
ad
IIIT
Hyd
erab
ad
Properties of the Protocol
• Servers are un-trusted and the network may be insecure.
• Near loss-less data encoding (PSNR~51).
• No compromise in accuracy.
• Inexpensive capture device, and a unidirectional data flow.
• Negligible overheads to make private computation practical.
• Secure as long as servers do not collude.Our approach shows that privacy and efficiency co-exists
in the domain of visual data
Con
trib
utio
n
IIIT
Hyd
erab
ad
K-Means Clustering• Data clustering is one of the most important techniques for discovery
of patterns in a dataset.
• K-Means clustering is a simple and extensively used technique that automatically partitions a dataset into k clusters.
• The technique becomes more effective with larger amount of data such as when multiple businesses share their data to carry out the clustering together.
• However, the data may contain sensitive information.
IIIT
Hyd
erab
ad
Secure K-Means Algorithms• Trusted Third Party (TTP) based solutions
– Dwork et al. ( Crypto 2004) Very Efficient No TTP in Real World, Possible security compromise
• Data Perturbation techniques– Stanley et al. (BSD 03), Kargupta et al. (ICDM 03) Negligible communication overhead Partial security, Non-invertible transformations used
• Those employing Multiparty Computations– Vaidya et al. (KDD 03), Jha et al. (ESORICS 05)
Wright et al. (KDD 05), Inan et al (DKE 07) Complete privacy Highly in-efficient
IIIT
Hyd
erab
ad
Our Distributed Solution
• We simulate TTP on a set of un-trusted servers over an in-secure network.
• Secret Sharing is a method of distributing a secret among a group of servers.
IIIT
Hyd
erab
ad
Proposed Protocol
• Protocol consists of two phases– Phase One: Secure Data Distribution
– Phase Two: Secure K-Means
• Phase One: Secure Storage of data at servers– Selection of an optimal RNS.
– Shattering of the user’s private data.
Privacy: Server stores only the shattered shares of data.
• Phase Two: Secure K-Means– Initialization
– Lloyd Step
– Knowledge Revelation
IIIT
Hyd
erab
ad
Phase Two: Secure K-Means• Clusters are initialized using the shattered shares
• Lloyd Step involves iteratively computing the closest centers in a Euclidean space– Secure protocols for division and comparison
• Securely evaluate the termination criteria– Send the shattered cluster centers to users who uses the Merge
function on it
• Privacy: No information is leaked to the servers– Data for operations such as division secured using randomization
– Randomization done so as to secure against possible GCD and factorization based attacks
IIIT
Hyd
erab
ad
Overview of the Protocol
User 1 User 2
IIIT
Hyd
erab
ad
Analysis• Overheads calculated over the naïve TTP based protocol.
• Division and Comparison operations introduce communication overhead.– Limited to one round per operation
• Traditional approaches uses SMC for this.– Based on OT, a communicational intensive protocol.
– O(n2) communication overhead to multiply two vectors (length n)
• Limited data expansion– Eg: 32bit data shattered into 5 shares requires 54bits while
traditional SS requires 160bits.
IIIT
Hyd
erab
ad
Algorithm Properties
• We have proposed a highly secure framework using paradigm of secret sharing.
• Negligible overheads in simulating algebraic operations.
• Achieve efficiency by exploiting the data properties.
• Solution does not demand any trust and the clustering is carried out directly on the encrypted data.
IIIT
Hyd
erab
ad
Conclusion
• The traditional methods of ensuring privacy are communication and computation expensive.
• We show that domain specific knowledge can be incorporated to ensure efficiency while retaining privacy.
• Moreover, our methods do not trade off accuracy.
• Development of secure computational algorithms in computer vision
and related areas.– To develop “highly-secure” solutions
– To develop “computationally efficient” solutions
– To develop solutions to problems with immediate impact
Broad Objective
IIIT
Hyd
erab
ad
Related Publications
Maneesh Upmanyu, Anoop M. Namboodiri, K. Srinathan and C.V. Jawahar;
“Blind Authentication - A Secure Crypto-Biometric Verification Protocol” In IEEE-Transactions on Information Forensics and Security(IEEE-TIFS, June 2010)
“Efficient Biometric Verification in Encrypted Domain” In Proceedings of 3rd International Conference on Biometrics(ICB 2009)
“Efficient Privacy Preserving Video Surveillance” Proceedings of the 12th International Conference on Computer Vision (ICCV 2009)
“Efficient Privacy Preserving K-Means Clustering” Proceedings of the Pacific Asia Workshop on Intelligence and Security Informatics(PAISI 2010)
IIIT
Hyd
erab
ad
Thank you for your attention
IIIT
Hyd
erab
ad
RNS & CRT
• Residue Number System (RNS) is an integer using a set of smaller integers.
– RNS is defined by a set of k integer constants. {m1, m2, m3, …, mk}
– Secret A is represented by k smaller integers. {a1, a2, a3, …, ak} where ai = A modulo mi
– This representation is valid as long as 0 < A < M, where M is LCM of mi’s
• Chinese Remainder Theorem (CRT) is the method of recovering the integer value from a given set of smaller integers.
– Define Mi = M/mi
– Compute ci = Mi x (Mi-1 mod mi)
– The above equation is always valid in our system, therefore unique solution exists
IIIT
Hyd
erab
ad
Shatter & Merge Functions
• Shatter function : Compute and store the secret shares of the private data.
– Where xi is the ith secret share, and η is a uniform randomness
• Merge function : Reconstruct the secret.– Given for different primes Pi’s, secret is
recovered using CRT