a590003

1 Introduction
Consider the following scenario: a set of computationally weak devices holding private inputs, wish to jointly
compute a function F over those inputs. Each device does not have the power to compute F on its own, let
alone engaging in a secure multiparty computation protocol such as [Yao82, GMW87, BOGW88, CCD88] for
computing F . They can however access the services of a “computation provider” who can “help” them compute
F . To maintain the privacy of their input, the clients need to engage in a cryptographic protocol where the
provider does the bulk of the computation (i.e., computes F ), while the computation and communication of each
client is “low” (in particular, less than the time it takes to compute F ). Nevertheless the clients must be able to
verify the correctness of the output of this protocol, even under the assumption that some corrupted clients might
cooperate with a malicious provider to fool them into accepting an incorrect ouput or to learn their input.
One can think of this problem, called multi-client verifiable computation or multi-client delegation of computation,
as a secure multi-party computation protocol between the clients and the provider (the cloud service),
where however only the provider’s work is allowed to be proportional to the complexity of the function being
computed (the function that computes the joint statistics). In this paper, we solve the above problem, by relying
on only standard polynomial time cryptographic assumptions. We present a protocol that allows many computationally
weak clients to securely outsource a computation over privately held inputs to a powerful server, in
the presence of the most powerful adversarial model that can be considered, and by minimizing the “on-line”
computation by the clients. The round complexity being of paramount importance in this line of work, we follow
the convention of obtaining a solution in which the clients delegates the computation non-interactively (i.e., the
clients and the server exchange a single message).
While a lot of work has been devoted to secure outsourced computation in the case of a single client interacting
with a single server (see for example [Mic94, GKR08, GGP10, CKV10, AIK10]), the research effort for
the multi-client case is still in the preliminary stages with very few works that consider much weaker models of
security (we shall discuss these works in detail later on).
1.1 Our Model
Before we state our main results, we shall first take a closer look at the model in which we work in. In a nutshell,
we obtain our results a) based on standard cryptographic hardness assumptions; b) in the strongest adversarial
model - i.e., simulation based security in the ideal/real paradigm when malicious clients may collude with the
server; and c) with minimal communication between the clients and that too only when verifying the results of the
computation. In explaining our model, we consider three important design principles that influence our choice -
first, the cryptographic hardness assumption that we make; second, the corruption model (which parties can the
adversary corrupt), and finally, the communication model (how much do clients need to interact with each other
and with the server).
Hardness assumptions: standard cryptographic assumptions. Following the standard convention in cryptography,
we are interested in constructing multi-client verifiable computation protocols based on standard cryptographic
assumptions (i.e., without resorting to random oracles or non-falsifiable hardness assumptions). Furthermore,
we are interested in obtaining solutions where the interaction between the clients and the server is minimal,
i.e., only one message is sent in each direction between the client and the server. We note that obtaining such
solutions is a difficult problem even in the single-client setting, exemplified by the small number of known solutions
[GGP10, CKV10, AIK10]. In particular, all known single-client non-interactive solutions based on standard
assumptions work in an “amortized” computational model (also known as the pre-processing model) [GGP10].
In view of the above, in this work, we will also work in (a natural extension of) the pre-processing model, which
we discuss later on in this section.
Corruption model: simulation based security. As we discussed earlier, it is quite natural to have a situation
where one of the clients might collude with a corrupt server in order to either learn something about the honest
client’s inputs or to force the output of the computation to some value. Naturally, it would be highly desirable to
1
11. How to Delegate Secure Multiparty Computation to the Cloud