[Paper Review] Secure Computation of the kth-Ranked Element in a Star Network

Anselme Tueno, Florian Kerschbaum+3 more|arXiv (Cornell University)|Sep 18, 2019

Cryptography and Data Security34 references4 citations

TL;DR

This paper proposes secure, efficient protocols for computing the kth-ranked element (e.g., median or min/max) in a star network where n clients hold private integers and a single untrusted server performs computation. Using garbled circuits or threshold homomorphic encryption, the schemes achieve constant-round computation and low communication, with one variant (Kre-Ygc) completing in 197 seconds for 100 clients over a WAN, enabling scalable and practical secure benchmarking in real-world settings.

ABSTRACT

We consider the problem of securely computing the kth-ranked element in a sequence of n private integers distributed among n parties. The kth-ranked element (e.g., minimum, maximum, median) is of particular interest in benchmarking, which allows a company to compare its own key performance indicator to the statistics of its peer group. The individual integers are sensitive data, yet the kth-ranked element is of mutual interest to the parties. Previous secure computation protocols for the kth-ranked element require a communication channel between each pair of parties. They do not scale to a large number of parties as they are highly interactive resulting in longer delays. Moreover, they are difficult to deploy as special arrangements are required between each pair of parties to establish a secure connection. A server model naturally fits with the client-server architecture of Internet applications in which clients are connected to the server and not to other clients. It can simplify secure computation by reducing the number of rounds, and as a result, improve its performance and scalability. In this model, there are communication channels only between each client and the server, while only clients provide inputs to the computation. Hence, it is a centralized communication pattern, i.e., a star network. We propose different approaches for privately computing the kth-ranked element in the server model, using either garbled circuits or threshold homomorphic encryption. Our schemes have a constant number of rounds and can compute the kth-ranked element within seconds for up to 50 clients in a WAN.

Motivation & Objective

• To address the scalability and deployment challenges of existing secure multiparty computation protocols for kth-ranked element (KRE) computation, which require pairwise communication and become infeasible with large n.
• To design a secure computation model that leverages a single server as a coordinator, reducing communication complexity and enabling deployment in standard client-server architectures.
• To ensure privacy by guaranteeing that the server learns nothing about clients' inputs, while still enabling accurate KRE output computation.
• To evaluate and compare multiple protocol instantiations—based on garbled circuits and threshold homomorphic encryption—under realistic network conditions and security constraints.
• To provide practical, efficient solutions suitable for real-world applications such as secure benchmarking of key performance indicators (KPIs) in industries like finance and manufacturing.

Proposed method

• The protocol uses a star network topology where only clients communicate with the server, eliminating direct client-to-client communication and reducing protocol complexity.
• The core approach involves sorting the inputs via secure comparison protocols, computing the rank of each input, and identifying the kth-ranked element using the rank information.
• Three main schemes are proposed: Kre-Ygc (based on garbled circuits), Kre-Ahe1 and Kre-Ahe2 (based on threshold homomorphic encryption), each with different trade-offs in security and efficiency.
• For threshold homomorphic encryption, the schemes use secret sharing with threshold t, requiring t clients to jointly decrypt the final result, ensuring collusion resistance and fault tolerance.
• The protocols are implemented and evaluated using standard cryptographic libraries, with performance measured in computation time, communication cost, and scalability across 100 clients in a WAN setting.
• Optimizations include batching comparisons and using efficient encryption schemes like Elliptic Curve ElGamal (secp256r1) to reduce communication and computation overhead.

Experimental results

Research questions

• RQ1 Can secure computation of the kth-ranked element be achieved with a constant number of communication rounds in a star network, improving scalability over traditional pairwise-communication models?
• RQ2 How do different cryptographic techniques—garbled circuits versus threshold homomorphic encryption—affect the performance and security properties of KRE protocols in a client-server model?
• RQ3 What is the trade-off between efficiency, collusion resistance, and fault tolerance in secure KRE computation, and how can it be optimized for real-world deployment?
• RQ4 Can the proposed protocols achieve sub-minute execution times for up to 100 clients in a wide area network (WAN), making them practical for industrial benchmarking applications?
• RQ5 What is the asymptotic and practical performance of the most efficient scheme (Kre-Ygc) under non-colluding server and non-failing client assumptions?

Key findings

• Kre-Ygc, based on garbled circuits, is the most efficient scheme, completing the secure computation of the kth-ranked element for 100 clients in 197 seconds over a WAN with only 0.31 MB of communication per client and 5.42 MB on the server.
• Kre-Ahe2, based on threshold homomorphic encryption, achieves a balance between efficiency and security, requiring 336 seconds for 100 clients with t=2 and 56.12 MB of server-side communication, while supporting collusion resistance and fault tolerance.
• Kre-Ahe1, though less efficient, supports full fault tolerance and collusion resistance but requires 1749 seconds for 100 clients with t=2 and 222.67 MB of server-side communication, making it impractical for large-scale use.
• Kre-She, based on somewhat homomorphic encryption, has the best asymptotic complexity but is currently impractical due to high computational cost, though it shows promise with future improvements in homomorphic encryption.
• Threshold decryption in Kre-Ahe2 scales efficiently, taking less than 0.15 seconds for n-out-of-n decryption with up to 40 clients, demonstrating strong performance for fault-tolerant scenarios.
• The evaluation confirms that the star network model significantly reduces protocol complexity and communication overhead compared to standard multiparty models, enabling practical deployment in real-world benchmarking systems.