Structure-Aware Private Set Intersection, With Applications to Fuzzy Matching
Structure-Aware Private Set Intersection, With Applications to Fuzzy Matching
复制标题
DOI:
10.1007/978-3-031-15802-5_12
复制
发表时间:
2022
期刊:
影响因子:
--
通讯作者:
Gayathri Garimella;Mike Rosulek;Jaspal Singh
中科院分区:
文献类型:
--
作者:
Gayathri Garimella;Mike Rosulek;Jaspal Singh
In two-party private set intersection (PSI), Alice holds a setX, Bob holds a setY, and they learn (only) the contents of. We introducestructure-aware PSIprotocols, which take advantage of situations where Alice’s setXis publicly known to have a certain structure. The goal of structure-aware PSI is to have communication that scales with thedescription sizeof Alice’s set, rather itscardinality.We introduce a new generic paradigm for structure-aware PSI based on function secret-sharing (FSS). In short, if there exists compact FSS for a class of structured sets, then there exists a semi-honest PSI protocol that supports this class of input sets, with communication cost proportional only to the FSS share size. Several prior protocols for efficient (plain) PSI can be viewed as special cases of our new paradigm, with an implicit FSS for unstructured sets.Our PSI protocol can be instantiated from a significantly weaker flavor of FSS, which has not been previously studied. We develop several improved FSS techniques that take advantage of these relaxed requirements, and which are in some cases exponentially better than existing FSS.Finally, we explore in depth a natural application of structure-aware PSI. If Alice’s setXis the union of many radius-balls in some metric space, then an intersection betweenXandYcorresponds tofuzzy PSI, in which the parties learn which of their points are within distance. In structure-aware PSI, the communication cost scales with the number of balls in Alice’s set, rather than their total volume. Our techniques lead to efficient fuzzy PSI forandmetrics (and approximations ofmetric) in high dimensions. We implemented this fuzzy PSI protocol for 2-dimensionalmetrics. For reasonable input sizes, our protocol requires 45–60% less time and 85% less communication than competing approaches that simply reduce the problem to plain PSI.