Secure Index Construction

Given theε-differentially private data ˆDwithkc categorical attributes andkn numerical attributes,

the data provider constructs an encrypted index on all attributes in ˆDin order to support efficient and secure processing of multi-dimensional range count queries over thek-dimensional data, where k=kc+kn. That is, it constructs a balancedkd-tree [Ben75] index, where every internal (non-leaf)

node is ak-dimensional node that splits the space into two half-spaces, and each leaf node stores a noisy count corresponding to a record in ˆD.

The kd-tree index is constructed with the procedure Secure Index Construction (buildIndex) presented in Algorithm 2. BuildIndexis a recursive procedure that has four input parameters: ˆD, depth i, P K, and y. The first input parameter ˆD is the set of records for which thekd-tree will

ALGORITHM 2:buildIndex: Secure Index Construction Input: Shuffledε-differentially private data ˆD

Input: split dimensioni

Input: ACP-ABE public keyP K

Input: Exponential ElGamal public keyy

Output: kd-tree indexT

1: if |Dˆ|= 1then

2: Leaf N ode←constLeaf N ode( ˆD, y); 3: return Leaf N ode;

4: end if

5: cut←median( ˆAi,D);ˆ 6: split( ˆD,Aˆi, cut,Dˆ1,Dˆ2);

7: vlef t←buildIndex( ˆD1,(i+ 1)mod k, P K, y); 8: vright←buildIndex( ˆD2,(i+ 1)mod k, P K, y); 9: create empty nodev;

10: v.split dim←Aˆi;v.split value←cut; 11: v.lc←vlef t;v.rc←vright;

12: v.genCT(P K);

13: return kd-tree indexT;

be constructed, where each record represents a point in the k-dimensional space. The columns in ˆ

D are shuffled a priori to randomize the order of the attributes. The second input parameter i represents the depth of the recursion that determines the split dimension. It ranges between 1 and k, where 1 is the initial value. The third input parameterP K is the public key of the anonymous ciphertext-policy attribute based encryption schemeA, which will be used to secure each internal node in the index tree. To generate this key a security parameterλis passed to the setup algorithm: A.Setup(1λ_{)⇒(P K, M SK). The last parametery is the public key of the Exponential ElGamal}

scheme used to encrypt the noisy counts in the leaf nodes. The functionmedian(Line 5) determines the median value of the domain Ω( ˆAi), where ˆAi is an attribute from ˆD. The functionsplit(Line

6) then uses a hyperplane that passes through the median value in order to split ˆD into two subsets of records, ˆD1 and ˆD2. Note that the median value is chosen for splitting to ensure a balanced

tree where each leaf node is about the same distance from the root of the tree. BuildIndex calls itself (Lines 7-8) using ˆD1and ˆD2as inputs in order to determine the left and right children nodes

respectively. When the procedure terminates (Line 13), it returns the kd-tree index T. Next, we will discuss how internal nodes (Lines 9-12) and leaf nodes (Line 2) are constructed.

Internal Nodes Construction

Each internal (non-leaf) node v in the kd-tree index corresponds to one dimension (attribute) ˆ

Ai∈Dˆ : 1≤i≤k of the k-dimensional space, where the splitting hyperplane is perpendicular to

the axis of dimension ˆAi, and the splitting value cut is determined by the median function (Line

4). Node v has two child nodes, namely, lcand rc, where all records containing values smaller or equal to the cut value with regard to ˆAi will appear in the left subtree, whose root is v.lc, and

all records containing values greater than thecut value with regard to ˆAi will appear in the right

subtree, whose root isv.rc. Furthermore, nodevconsists of two ciphertexts,v.CTlef tandv.CTright,

where the encrypted message inv.CTlef tis a pointer (P tr) to the child nodev.lc, and the encrypted

message in v.CTright is a pointer to the child node v.rc. The intuition is as follows: The service

provider must use the keySKu provided by the user to be allowed to securely traverse the kd-tree

index and compute the answer to the user query u. The structure of SKu and how it is built is

discussed in Section4.4.3. At any nodevin thekd-tree, ifSKu satisfies the access structure of the

ciphertextv.CTlef t, the ciphertext is decrypted and a pointer to the child nodev.CTlef tis obtained.

Similarly, ifSKusatisfies the access structure ofv.CTright, the ciphertext is decrypted and a pointer

to v.CTright is obtained. If SKu satisfies both access structures, then two pointers are obtained,

indicating that both left and right subtrees must be traversed.

Access Structure. The ciphertexts in each node are generated using the anonymous ciphertext- policy attribute based encryption schemeA, where each ciphertext has an access structureW. Each numerical attribute ˆAi∈Dˆ is represented in the access structure of a ciphertext by two attributes,

ˆ Amin

i and ˆAmaxi , where Ω( ˆAimin) = Ω( ˆAmaxi ) = Ω( ˆAi). On the other hand, each categorical attribute

is mapped to one attribute in the access structure of a ciphertext. Below is the formal definition of an access structure of a ACP-ABE ciphertext.

Definition 8 (Ciphertext Access Structure W.) Given ε-differentially private data ˆD and a node v from thekd-tree index over ˆD, the access structure of a ciphertext of v is the conjunction

W = [WAˆ₁∧...∧WAˆ_i∧...∧WAˆ_k]. If ˆAi is a categorical attribute, thenWAˆ_i corresponds either to

the wildcard character “∗” or to a disjunction of values from Ω( ˆAi), where “WAˆ_i=∗” means that

attribute ˆAi should be ignored. If ˆAi is a numerical attribute, thenWAˆ_i =WAˆmin_i ∧WAˆmax_i , where

W_Aˆmin

i andWAˆmaxi each corresponds to either the wildcard character “∗” or a disjunction of values

from Ω( ˆAi).

Note that for a given node v, the access structure of the left and right ciphertexts is mainly concerned with the splitting dimensionv.split dim, and the split valuev.split valueover ˆD1or ˆD2,

where ˆD1,Dˆ2 ⊆D. Ifˆ v.split dim is a categorical attribute ˆAi, then WAˆ_i in the access structure

ofv.CTlef t should correspond to the disjunction of all valuesval∈ {Ω( ˆAi)∪ {1}}such that val≤

v.split valueand forval= 1, where 1 represents “Any” value. Similarly,WAˆ_iin the access structure

of v.CTright should correspond to the disjunction of all values val ∈ {Ω( ˆAi)∪ {1}} such that

val > v.split value or forval = 1. On the other hand, if v.split dim is a numerical attribute ˆAi,

then W_Aˆmin

i in the access structure of v.CTlef t should correspond to the disjunction of all values

val ∈ Ω( ˆAi) for all val ≤ v.split value, and W_Aˆmax

i in the access structure of v.CTright should

correspond to the disjunction of all valuesval∈Ω( ˆAi) such thatval > v.split value. Regardless of

whether ˆAiis categorical or numerical, all values in{W \WAˆ_i} should correspond to “∗”.

Example 3 Given ˆD from Table4, and given nodev fromkd-tree index:

a) Ifv.split dim=J ob (categorical) andv.split value= 2, then the access structure of the left and right ciphertexts can be represented as follows:

WL = (Country = ∗)∧(J ob = 1∨J ob = 2)∧(Agemin = ∗)∧(Agemax = ∗)∧(Salarymin =

∗)∧(Salarymax=∗).

WR = (Country = ∗)∧(J ob = 1∨J ob = 3)∧(Agemin = ∗)∧(Agemax = ∗)∧(Salarymin =

∗)∧(Salarymax=∗).

b) If v.split dim=Age(numerical) andv.split value= 1, then the access structure of the left and right ciphertexts are:

∗).

WR= (Country=∗)∧(J ob=∗)∧(Agemin=∗)∧(Agemax= 2)∧(Salarymin=∗)∧(Salarymax=

∗).

In procedure buildIndex presented in Algorithm 2, each internal node v is created after deter- mining its children nodes Vlef t and vright (Lines 9-12), where function genCT is responsible for

creating the left ciphertextCTlef t and the right ciphertextCTrightof the node by calling twice the

ACP-ABE algorithmA.Enc() and passing as parameters the public keyPK ofA, a pointer to the child node to be encrypted, and the values in the access structure (without the attribute names): v.CTlef t←A.Enc(P K, P tr(v.lc), WL);

v.CTright←A.Enc(P K, P tr(v.rc), WR);

For each attribute ˆAi inW that is assigned a wildcard, e.g. (Country=∗),A.Enc() generates

a random (mal-formed) group elements [Ci,j,1, Ci,j,2] for each value in Ω( ˆAi). On the other hand,

for each attribute in W assigned specific values, e.g. (J ob = 1∨J ob = 2), A.Enc() generates a

well-formed group elements for each value specified, i.e. for value 1 and for value 2, and random group elements for each remaining value in Ω(J ob). As a result, all ciphertexts CT generated by A.Enc() in the kd-tree index contain the same number of group elements regardless of the access structure.

Leaf Nodes Construction

In procedurebuildIndex, as the multi-dimensional space is being recursively partitioned a leaf node is created whenever the number of the records being partitioned reaches 1 (Lines 1-2 ). Procedure

Leaf Node Construction(constLeafNode), presented in Algorithm3, is responsible for generating the leaf nodes. It takes as input a ε-differentially private record R and Exponential ElGamal’s public keyy and outputs a leaf nodel. After creating an empty node l(Line 1), the noisy count of record Ris encrypted using Exponential ElGamal encryption schemeGand stored in nodel (Line 2). We choose the Exponential ElGamal cryptosystem due to its additive homomorphism property, which

ALGORITHM 3:constLeafNode: Leaf Node Construction Input: ε-differentially private recordR

Input: Exponential ElGamal’s public keyy

Output: leaf nodel

1: create empty nodel;

2: l.N Count←G.Enc(R.N Count, y, r); 3: for eachnumerical attribute ˆAi∈Dˆ do 4: l←genT AG(R.Aˆi);

5: end for 6: return l;

ALGORITHM 4:indexUpload: kd-Tree Index Upload

1: The Data Provider submits thekd-tree indexT to the Service Provider; 2: The Service Provider receivesT;

allows for homomorphically adding encrypted noisy counts together in an efficient way.

For each numerical range value R.Aˆi in R, a deterministic and hiding commitment function

genT AG() is utilized to commit R.Aˆi and randomly generate a unique tag (Line 3-4). Applying

genT AG() to the same value will always generate the same tag (deterministic). Moreover, the cor- respondence between each tag and its value is kept secret (hiding). As we will see in Section4.4.3, using a deterministic function to generate tags for the numerical range values enables the service provider during query execution to compute the exact percentage of the noisy count of each reported leaf node with respect to the query being processed.

Once the kd-tree indexT has been created, it is submitted to the service provider according to Algorithm4. While Algorithm4 is trivial, it is required in Section4.5.3to prove by simulation the security of the framework.