[Paper Review] Secure k-Nearest Neighbor Query over Encrypted Data in Outsourced Environments

Yousef Elmehdwi, Bharath K. Samanthula+1 more|arXiv (Cornell University)|Jul 18, 2013

Cryptography and Data Security20 references4 citations

TL;DR

This paper proposes two secure k-Nearest Neighbor (k-NN) query protocols for encrypted data in cloud environments: a basic scheme (S$k$NN$_\text{b}$) and a fully secure protocol (S$k$NN$_\text{m}$). The secure protocol protects data confidentiality, query privacy, and hides access patterns using homomorphic encryption and secure multi-party computation, achieving low user-side computation (4–17 ms for 6 attributes) while enabling efficient, parallelizable execution on large datasets.

ABSTRACT

For the past decade, query processing on relational data has been studied extensively, and many theoretical and practical solutions to query processing have been proposed under various scenarios. With the recent popularity of cloud computing, users now have the opportunity to outsource their data as well as the data management tasks to the cloud. However, due to the rise of various privacy issues, sensitive data (e.g., medical records) need to be encrypted before outsourcing to the cloud. In addition, query processing tasks should be handled by the cloud; otherwise, there would be no point to outsource the data at the first place. To process queries over encrypted data without the cloud ever decrypting the data is a very challenging task. In this paper, we focus on solving the k-nearest neighbor (kNN) query problem over encrypted database outsourced to a cloud: a user issues an encrypted query record to the cloud, and the cloud returns the k closest records to the user. We first present a basic scheme and demonstrate that such a naive solution is not secure. To provide better security, we propose a secure kNN protocol that protects the confidentiality of the data, user's input query, and data access patterns. Also, we empirically analyze the efficiency of our protocols through various experiments. These results indicate that our secure protocol is very efficient on the user end, and this lightweight scheme allows a user to use any mobile device to perform the kNN query.

Motivation & Objective

• Address the lack of secure, efficient k-Nearest Neighbor (k-NN) query processing over encrypted data in outsourced cloud databases.
• Overcome security flaws in prior schemes, including vulnerability to chosen/known plaintext attacks and inaccurate results.
• Ensure confidentiality of both data and user queries, while hiding data access patterns from the cloud.
• Minimize end-user computational overhead to support lightweight devices such as mobile phones.
• Provide a scalable solution through parallelization and map-reduce integration for large-scale datasets.

Proposed method

• Use attribute-wise public-key encryption (e.g., Paillier) to encrypt database records before outsourcing to the cloud.
• Apply homomorphic encryption to compute squared Euclidean distances between the encrypted query and encrypted data records without decryption.
• Implement a secure multi-party computation (MPC)-based protocol (S$k$NN$_\text{m}$) to compare distances and identify the k smallest ones without revealing access patterns.
• Design a two-phase protocol: first, the user encrypts the query and sends it to the cloud; second, the cloud performs secure distance computation and returns the k nearest results.
• Introduce a secure minimum selection protocol (SMIN$_n$) to identify the k smallest distances in a privacy-preserving manner.
• Enable parallelization of distance computations across data records using OpenMP, achieving up to 6× speedup on 6-core systems.

Experimental results

Research questions

• RQ1 How can k-NN queries be securely processed over encrypted data in a cloud environment without exposing data, queries, or access patterns?
• RQ2 What are the trade-offs between security and efficiency in existing S$k$NN protocols, and how can they be improved?
• RQ3 Can a secure k-NN protocol be designed with minimal user-side computation to support mobile and resource-constrained devices?
• RQ4 To what extent can parallelization and distributed computing techniques improve the scalability of secure k-NN protocols?
• RQ5 How do the proposed protocols compare in performance and security to prior works such as those in [28], [13], and [31]?

Key findings

• The proposed S$k$NN$_\text{m}$ protocol achieves full security by protecting data confidentiality, query privacy, and hiding data access patterns, unlike prior schemes that are vulnerable to known/chosen plaintext attacks.
• The S$k$NN$_\text{b}$ protocol has constant user-side computation (0.73 minutes regardless of k), while S$k$NN$_\text{m}$'s user-side cost remains low (4–17 ms for 6 attributes and 512–1024-bit keys).
• For k=5, 69.7% of S$k$NN$_\text{m}$'s total cost is due to the SMIN$_n$ protocol, which increases to at least 75% when k increases to 25.
• The parallelized version of S$k$NN$_\text{b}$ achieves a 6× speedup on a 6-core system, reducing execution time from 215.59 seconds (serial) to 40 seconds for n=10,000 records.
• The S$k$NN$_\text{m}$ protocol is significantly more expensive than S$k$NN$_\text{b}$, with execution times rising from 11.93 to 55.65 minutes as k increases from 5 to 25, but offers stronger security guarantees.
• The results confirm that the proposed protocols are highly efficient on the user side and scalable via parallelization, making them suitable for deployment on mobile devices and large-scale cloud environments.