Privacy-Preserving Integration of Medical Data

Medical data are often maintained by different organizations. However, detailed analyses sometimes require these datasets to be integrated without violating patient or commercial privacy. Multiparty Private Set Intersection (MPSI), which is an important privacy-preserving protocol, computes an intersection of multiple private datasets. This approach ensures that only designated parties can identify the intersection. In this paper, we propose a practical MPSI that satisfies the following requirements: The size of the datasets maintained by the different parties is independent of the others, and the computational complexity of the dataset held by each party is independent of the number of parties. Our MPSI is based on the use of an outsourcing provider, who has no knowledge of the data inputs or outputs. This reduces the computational complexity. The performance of the proposed MPSI is evaluated by implementing a prototype on a virtual private network to enable parallel computation in multiple threads. Our protocol is confirmed to be more efficient than comparable existing approaches.


Introduction
Medical organizations often store the data accumulated through medical analyses. However, detailed data analysis sometimes requires separate datasets to be integrated without violating patient or commercial privacy. Consider the scenario in which the occurrence of similar accidents can be attributed to a particular defective product. Such defective products should be identified as quickly as possible. However, the databases related to accidents are maintained separately by different organizations. Thus, investigating the causes of accidents is often time-consuming. For example, suppose child A has broken her/his leg at school, but it is not clear whether the accident was caused by defective equipment. In this case, information relating to A's injury, such as the patient's name and type of injury, are stored in hospital database S 1 . Information pertaining to A's accident, such as their name and the location of the swing at the school, are stored in database S 2 , which is held by the fire department. Finally, information relating to the insurance claim following A's accident, such as the name and medical costs, is maintained in the insurance company's database, S 3 . Computing the intersection of these databases, S 1 ∩ S 2 ∩ S 3 , without compromising privacy would enable us to combine the separate sets of information, which may allow the cause of the accident to be identified. Let us consider another situation. Several clinics, denoted as P i , maintain separate databases, represented as S i . The clinics wish to know the patients they have in common to enable them to share treatment details; however, P i should not be able to access any information about patients not stored in their own dataset. In this case, the intersection of the set must not reveal private information.
These examples illustrate the need for the Multiparty Private Set Intersection (MPSI) protocol [11,17,18,21]. MPSI is executed by multiple parties who jointly compute the intersection of their private datasets. Ultimately, only designated parties can access the intersection. Previous protocols are impractical, because the bulk of the computation is a function of the number of players. One previous study required the size of the datasets maintained by the different players to be equal [17,21]. Another study [11] computed only the approximate number of intersections, whereas other researchers [18] required more than two trusted third-parties.
In this paper, we propose a practical MPSI with the following features: 1. The size of the datasets maintained by each party is independent of those maintained by the other parties. 2. The computational complexity for each party is independent of the number of parties. This is accomplished by introducing an outsourcing provider, O. In fact, all computations related to the number of parties are carried out by O. Thus, the number of parties is irrelevant.
The remainder of this paper is organized as follows. Previous results that are used to develop the proposed protocol are summarized in "Preliminaries". "Previous work" then introduces some related studies. We propose the new MPSI in "Practical MPSI", and present the results of its implementation in "Implementation results".

Preliminaries
In this section, we summarize the DDH assumption, Bloom filter, and ElGamal encryption. We consider security according to the honest-but-curious model [13]: all players act according to their prescribed actions in the protocol. A protocol that is secure in an honest-but-curious model does not allow any player to gain information about other players' private input sets, besides that which can be deduced from the result of the protocol. Note that the term adversary here refers to insiders, i.e., protocol participants. Outsider adversaries are not considered. In fact, behavior by outsider adversaries can be mitigated via standard network security techniques.
Our protocol is based on the following security assumption.
Definition 1 (DDH Assumption) Let t be a security parameter. A decisional Diffie-Hellman (DDH) parameter generator IG is a probabilistic polynomial time (PPT) algorithm that takes input 1 k and outputs a description of a finite field F p and a basepoint g ∈ F p with prime order q. We say that IG satisfies the DDH assumption if A Bloom filter [3], denoted by BF, consists of m arrays and has a space-efficient probabilistic data structure. The BF can check whether an element x is included in a set S by encoding S with at most w elements. The encoded Bloom filter of S is denoted by BF(S).
The BF uses a set of k independent uniform hash func- The BF consists of two functions: Const embeds a given set S into BF(S), and ElementCheck checks whether an element x is included in S. SetCheck, an extension of ElementCheck, checks whether an element x in S is in S ∩ S (see Algorithm 3). In Const (see Algorithm 1), BF(S) is constructed for a given set S by first setting all bits in the array to 0. To embed an element x ∈ S into the filter, the element is hashed using k hash functions to obtain k index numbers, and the bits at these indexes are set to 1, i.e., set BF[H i (x)] = 1 for 0 ≤ i ≤ k − 1. In ElementCheck (see Algorithm 2), we check all locations where x is hashed; x is considered to be not in S if any bit at these locations is 0; otherwise, x is probably in S.
Some false positive matches may occur, i.e., it is possible that all BF[H i (y)] are set to 1, but y is not in S. The false positive rate FPR is given by [4]. However, false negatives are not possible, and so Bloom filters have a 100 % recall rate.
Homomorphic encryption under addition is useful for processing encrypted data. A typical homomorphic encryption under addition was proposed by Paillier [19]. However, because Paillier encryption cannot reduce the order of a composite group, it is computationally expensive compared with the following ElGamal encryption. Our protocol requires matching without revealing the original messages, for which exponential ElGamal encryption (exElGamal) is sufficient [5]. In fact, the decrypted results of exEl-Gamal encryption can distinguish whether two messages m 1 and m 2 are equal, although the exElGamal scheme cannot decrypt messages itself. Furthermore, exElGamal can be used in (n, n)-threshold distributed decryption [9], where decryption must be performed by all players acting together. An exElGamal encryption with (n, n)-threshold distributed decryption consists of three functions:

Key generation
Let F p be a finite field, g ∈ F p , with prime order q. Each player P i chooses x i ∈ Z q at random and computes y i = g x i (mod p). Then, y = n i=1 y i (mod p) is a public key and each x i is a share for each player to decrypt a ciphertext.

Encryption thrEnc[m] → (u, v)
Choose r ∈ Z q at random, and compute both u = g r (modp) and v = g m y r (modp) for the input message m ∈ Z q and a public key y. Output (u, v) as a ciphertext of m. 1 Finally, each player can decrypt the ciphertext as g m = v/z(modp).
ExElGamal encryption with (n, n)-threshold decryption has the following features: (1) homomorphic under addition: (2) homomorphic under scalar operations: Enc(m) k = Enc(km) for a message m and k ∈ Z q .

Previous work
This section summarizes prior works on PSI between a server and a client and MPSI among n players. In PSI, let S = {s 1 , ..., s v } and C = {c 1 , ..., c w } be server and client datasets, where |S| = v and |C| = w. In MPSI [17], we assume that each player holds the same number of datasets.

PSI protocol based on polynomial representation
The main idea is to represent the elements in C as the roots of a polynomial. The encrypted polynomial is sent to the server, where it is evaluated on the elements in S, as originally proposed by Freedman [12]. This is secure against honestbut-curious adversaries under secure public key encryption. The computational complexity is O(vw) exponentiations, and the communication overhead is O(v + w). The computational complexity can be reduced to O(v log log w) exponentiations using the balanced allocation technique [1]. Kissner and Song extended this protocol to MPSI [17], which requires O(nw 2 ) exponentiations and O(nw) communication overhead. The MPSI version is secure against honest-but-curious and malicious adversaries (in the random oracle model) using generic zero-knowledge proofs.

PSI protocol based on DH-key agreement
The main objective here is to apply the DH-key agreement protocol [7]: after representing the server and client datasets as hash values {h(s i )} and {h(c i )}, respectively, the client encrypts the dataset as {h(c i ) r i } using a random number r i and sends the encrypted set to the server. The server encrypts the client set {h(c i ) r i } and the server set {h(s i )} using a random number r, which gives {h(c i ) rr i } and {h(s i ) r }, respectively, and returns these sets to the client. Finally, the client evaluates S ∩ C by decrypting to {h(c i ) r }. This is secure against honest-but-curious adversaries under the DDH assumption. The total computational complexity is O(v + w) exponentiations and the total communication The security of this approach can be enhanced against malicious adversaries in the random oracle model [6] by using a blind signature. However, no extensions to MPSI based on the DH-key agreement protocol have been proposed.
PSI protocol based on BF This protocol was originally proposed in [18]. As the Bloom filter itself reveals information about the other player's dataset, the set of players is separated into two groups: input players who have datasets and privacy players who perform private computations under shared secret information. In [16], the privacy of each player's dataset is protected by encrypting each array of the Bloom filter using Goldwasser-Micali encryption [14].

Practical MPSI
This section presents a practical MPSI that is secure under the honest-but-curious model.

Notation and privacy definition
In the remainder of this paper, the following notation is used.
-P i : i-th player, i = 1, · · · , n -O: outsourcing provider with no knowledge of the inputs or outputs -S i = {s i,1 , s i,2 , · · · , s i,w i }: dataset held by P i , where |S i | = ω i -∩S j : intersection of all n players -thrEnc and thrDec: (n, n)-threshold exElGamal encryption and decryption, respectively m and k: number of arrays and hashes used in BF -= [ , · · · , ] (1 ≤ ≤ n): an m-dimensional array, where all strings in the array are set to is the sum of all players' arrays.
We introduce an outsourcing provider O to reduce the computational burden on all players. The dealer has no information about the elements of any player's set. The privacy issues faced by MPSI with an outsourcing provider can be informally written as follows.

Proposed MPSI
Our MPSI consists of four phases: i) initialization, ii) Bloom filter construction and the encryption of P i data, iii) the O's randomization of thrEnc(IBF(∪S i ) − n), and iv) the computation of ∩P i . The computation of ∩P i consists of three steps: a) joint decryption of an (n, n)-threshold exEl-Gamal among n players, b) Bloom filter check, and c) output intersection. Figure 1 shows an overview of our protocol after the initialization phase. The system parameters of a finite field F p and a basepoint g ∈ F p with order q for an (n, n)-threshold exElGamal encryption (thrEnc, thrDec) are provided to both P i and O. For the Bloom filter, Const(S) and SetCheck(BF, S ) are only provided to P i , where the array size is m and k independent hash functions are used. for r = [r 0 , · · · , r m−1 ] ∈ Z m q . Our protocol proceeds as follows.

Initialization:
1. P i generates x i ∈ Z q , computes y i = g x i ∈ Z q , and publishes y i to the other players as a public key, where the corresponding secret key is x i . 2. P i computes y = i y i , where y is an n-player public key. Note that no player knows the corresponding secret key x = x i before executing the joint decryption.
Construction and encryption of BF(S i ) − 1: where y is an n-player public key. 3. P i sends thrEnc y (BF(S i ) − 1) to O.
The above protocol satisfies the correctness requirement. This is because each array position of thrEnc y (r(IBF(∪S i ) − n)) is decrypted to 1, where x ∈ ∩S i is embedded by each hash function; however, each array position for which x ∈ ∩S i is embedded by each hash function is decrypted to a random value.

Security Proof
The security of our MPSI protocol is as follows.

Theorem 1 For any coalition of fewer than n players, MPSI is player-private against an honest-but-curious adversary under the DDH assumption.
Proof The views of P i and O, that is, are shown to be indistinguishable from a random vector r = [r 0 , · · · , r m−1 ] ∈ Z m q . Assume that a polynomial-time distinguisher D outputs 0 when the views are presented as a random vector and outputs 1 when they are constructed in MPSI, thrEnc(BF i [0]), · · · , thrEnc(BF i [m − 1]). We show that a simulator SIM that solves the DDH assumption can be constructed as follows.

Send
If (g, g α , g β , g γ ) is a DH-key-agreement-protocol element, i.e., γ = αβ, then thrEnc y (BF m,k (S i )) is distributed in the same way as when constructed by the MPSI scheme. Thus, D must output 1. If (g, g α , g β , g γ ) is not a DH tuple, then thrEnc y (BF m,k (S i )) is randomly distributed, and D has to output 0. As a result, SIM can use the output of D to respond to the DDH challenge correctly. Therefore, D can answer correctly with negligible advantage over random guessing. Furthermore, as all inputs of each player are encrypted until the decryption is performed, and decryption cannot be performed by fewer than n players, nothing can be learned by any player prior to decryption.
As for the views of thrEnc y (r(IBF m,k (∪S i ) \ n)), the same argument holds. Therefore, for any coalition of fewer than n players, MPSI is player-private under the honest-but-curious model.

Efficiency
Although many PSI protocols have been proposed, to the best of our knowledge, relatively few have considered the multiparty scenario [11,17,18,21]. Our target is multiparty private set intersection, and the final result must be obtained by all players acting together, without a trusted third-party (TTP). Among previous MPSI protocols, the approach in [11] computes only the approximate number of intersections, and that in [18] requires more than two TTPs. In contrast, [21] follows almost the same method as [17] and thus has a similar complexity. The only difference exists in the security model. Hence, we only compare our scheme with that of [17].
The computational and communication efficiency of the proposed protocol and [17] are compared in Table 1. These approaches are secure against honest-but-curious adversaries without a TTP under exElGamal encryption (DDH security) and Paillier encryption (Decisional Composite Residue (DCR) security), respectively.
Our MPSI uses the Bloom filter for the computations performed by P i and the integrations performed by the O. The use of a Bloom filter eliminates the restriction on set size. Thus, in our MPSI, the set size of each player is flexible. However, P i 's computations consist of Bloom filter construction, joint decryption, and Bloom filter check. Neither the computations related to the Bloom filter nor the joint decryption depends on the number of players, as shown in "Preliminaries". In summary, the computational complexity of operations performed by P i is O(ω i ). All player-dependent data are sent to O, who integrates n i=1 thrEnc y (IBF(∪S i )) without decryption. As a result, the computational complexity of operations performed by O is O(nω).

Implementation
To investigate the behavior and performance of our MPSI protocol, we implemented a prototype in C++ using the GNU Multi-Precision (GMP) library (version 5.1.3) and OpenSSL (version 1.0.1f). GMP is used for large-integer arithmetic and random number generation in the exEl-Gamal encryption. To instantiate hash functions for the Bloom filter, we used SHA-1 in OpenSSL: H i (x) := sha1(s i x) mod m, where s i is a unique salt. This truncation of the hash functions is based on the recommendation of the National Institute of Standards and Technology (NIST) [8]. Each executable communicates through TCP. We used Boost.Asio C++ 1.54.0 for the TCP socket.
The C++ prototype has two executables: one for the players and one for the outsourcing provider. The prototype can work in either pipeline or parallel mode. In pipeline mode, the computation and communication threads are separated. Thus, computation and data transmission are processed in parallel when possible. Pipeline mode allows each executable to start immediately without waiting for the completion of all previous computations. Parallel mode extends the pipeline mode by multiplying the number of computation threads in each executable. The most expensive process of our protocol is Bloom filter encryption and decryption. In parallel mode, the encryption and decryption computation is conducted in multiple threads. This significantly improves the performance of our protocol.

Evaluation
All experiments were performed on the Google Compute Engine (GCE). GCE is a cloud computing system that delivers virtual machines running in Google's data centers. In our experiments, each executable was calculated on a single virtual machine. We used the Ubuntu 14.04 LTE operating system with Intel Xeon 2.50 GHz CPUs. Each CPU core was assigned 3.75 GB of memory. Every virtual machine was connected to a virtual private network. The bandwidth between two virtual machines was approximately 2.0 Gbps, although our protocol used less than 10 Mbps. The time required for Bloom filter construction, encryption, decryption, randomization procedures, and MPSI computation was measured. However, the measurements do not include initialization and finalization, e.g., parsing command lines, reading and writing CSV files, TCP socket setup and shutdown, and public key exchange. Each player input a database set of size 2 6 -2 14 . We measured the performance for n = 4, 8, 16 and tested the security parameters for 80-bit, 112-bit, 128-bit, 196-bit, and 256-bit security. Each security parameter is half of the bit size of q. The evaluation of the security parameter is based on the NIST guidelines for key management [2], as summarized in Table 2. We chose a false positive rate FPR = 0.65 %, as was adopted in [18].
First, we report the runtimes in pipeline mode. The performance measurements are presented in Tables 3 and 4 (Figs. 2, 3, 4, and 5). To measure each executable time separately, we excluded the wait time for communication. From Table 3, it is clear that the runtime scales almost linearly     with the set size. It is also apparent that the player's runtime increases in accordance with n. This is because, in our implementation, each player performs the joint decryption process independently. However, the joint decryption process can be distributed by the players so that the computational complexity remains constant with respect to n. The outsourcing provider's runtime obeys scales with the computational complexity, namely, O(nω). The breakdown of runtimes is presented in Tables 5 and 6 The performance measurements in parallel mode are presented in Table 7 (Fig. 6 ). We fixed the security parameter at 80-bit security and measured the total runtime,    including the computation time and the wait time for communication. Although the total runtimes are not exactly proportional to the number of CPU cores, there is a significant improvement in the multi-core environment. As the time consumption of our protocol is dominated by the encryption and decryption of the Bloom filter array, these processes can easily be implemented in parallel. We believe this property is one of the most important advantages of our protocol.

Comparison
We compared our protocol with Kissner and Song's MPSI protocol [17]. We implemented Kissner and Song's MPSI protocol with PARI in C++ for the comparison. All measurements were conducted in pipeline mode. The results are presented in Table 8 (Figs. 7, 8 and 9). The results show that our protocol is faster than Kissner and Song's MSPI protocol when n = 4 and the set size is greater than 2 8 , when n = 8 and the set size is greater than 2 6 , and when n = 16 and the set size is greater than 2 4 . Furthermore, although Kissner and Song's MSPI protocol crashed with a set size of 2 14 , these results reveal that the time consumption of their protocol is approximately proportional to the square of the set size. As in our protocol, Kissner and Song's MSPI protocol uses the (n, n)-threshold scheme, so it does not require a conspiracy assumption. However, their protocol is not scalable with respect to either the set size or number of players.

Conclusion
This paper has described a practical MPSI in which some of the computations are outsourced to a third-party. As none of the information of S i , |S i |(∀i ∈ [1, n]) is revealed to the third-party, this function can be safely outsourced. Our scheme satisfies that the following requirements: any restrictions on the sets are eliminated, meaning that the set size of each player can be flexibly chosen; and the computational burden on each player is independent of the number of players.
Importantly, our scheme can be applied to the efficient integration of medical and related data maintained by different organizations without violating any privacy constraints. We confirmed that the computational complexity is independent of the number of organizations from which data are being integrated.