Optimal Communication Unbalanced Private Set Union

2024-02-26

International Conference on Applied Cryptography and Network Security

AI Summary

This work addresses the Unbalanced Private Set Union (UPSU) problem, proposing the first two-party protocol whose sender’s computational and communication costs scale strictly linearly with its own set size—and are entirely independent of the receiver’s set size. Methodologically, we design a dual construction synergizing Fully Homomorphic Encryption (FHE) and Linearly Homomorphic Encryption (LHE): one minimizes sender overhead, while the other reduces receiver cost to quasi-linear. Key techniques include LHE, FHE, multi-point polynomial evaluation (MEv), and polynomial Euclidean remainder computation within FHE. Experiments show that for sender sets of ~1,000 elements, processing time remains under 2 seconds and communication under 10 MB—regardless of receiver set size. This is the first protocol achieving strict linear scalability in sender cost, significantly enhancing UPSU’s practicality in real-world imbalanced data scenarios.

Technology Category

• Search and Optimization: Learning to Search
• Machine Learning: Privacy
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems

Abstract

We present new two-party protocols for the Unbalanced Private Set Union (UPSU) problem.Here, the Sender holds a set of data points, and the Receiver holds another (possibly much larger) set, and they would like for the Receiver to learn the union of the two sets and nothing else. Furthermore, the Sender's computational cost, along with the communication complexity, should be smaller when the Sender has a smaller set.While the UPSU problem has numerous applications and has seen considerable recent attention in the literature, our protocols are the first where the Sender's computational cost and communication volume are linear in the size of the Sender's set only, and do not depend on the size of the Receiver's set.Our constructions combine linearly homomorphic encryption (LHE) withfully homomorphic encryption (FHE). The first construction uses multi-point polynomial evaluation (MEv) on FHE, and achieves optimal linear cost for the Sender, but has higher quadratic computational cost for the Receiver. In the second construction we explore another trade-off: the Receiver computes fast polynomial Euclidean remainder in FHE while the Sender computes a fast MEv, in LHE only. This reduces the Receiver's cost to quasi-linear, with a modest increase in the computational cost for the Sender.Preliminary experimental results using HElib indicate that, for example, a Sender holding 1000 elements can complete our first protocol using less than 2s of computation time and less than 10MB of communication volume, independently of the Receiver's set size.

Problem

• Optimizing computational cost for unbalanced private set union
• Achieving linear sender cost independent of receiver's set size
• Balancing efficiency trade-offs between sender and receiver

Innovation

• Sender cost linear only in own set size
• Combines linearly and fully homomorphic encryption
• Uses polynomial evaluation in homomorphic encryption