大象不会忘记：面向隐私预算的具备状态连续性的差分隐私
Elephants Do Not Forget: Differential Privacy with State Continuity for Privacy Budget
AI总结：
针对现有差分隐私系统无法维护隐私预算状态连续性易遭攻击的问题，提出基于TEE和状态连续性模块的ElephantDP系统，可在不可信环境下提供可信级DP保障，开销为基线的1.1-3.2倍。
摘要：
当前差分隐私（DP）系统的实现要么不支持追踪数据集上消耗的全局隐私预算，要么无法忠实地维持该预算的状态连续性。我们证明，无法维护隐私预算会使对手能够发起重放、回滚和分叉攻击——获取远超安全系统允许数量的查询答案。如此一来，攻击者可以重建DP旨在保护的秘密数据——即便DP代码运行在可信执行环境（TEE）中也无济于事。我们提出ElephantDP系统，其目标是在不可信环境中，提供与全局DP模型中可信管理者相同的安全保障。我们的系统依赖状态连续性模块为隐私预算提供保护，并借助TEE忠实执行DP代码并更新预算。为保障安全性，我们的协议做出了多项设计选择，包括持久化状态的内容、预算更新与查询答复之间的执行顺序。我们证明ElephantDP具备活性（即只要预算未耗尽，协议就能从正确状态重启并响应查询）和DP机密性（即攻击者从数据集中获知的信息量，与同可信管理者交互获知的信息量相当）。我们使用Intel SGX作为TEE运行DP代码，并通过TEE网络维持状态连续性，完成了协议的实现与评估。与不安全的基线系统相比，我们观察到1.1-3.2倍的开销，且复杂DP查询的相对开销更低。
英文摘要：
Current implementations of differentially-private (DP) systems either lack support to track the global privacy budget consumed on a dataset, or fail to faithfully maintain the state continuity of this budget. We show that failure to maintain a privacy budget enables an adversary to mount replay, rollback and fork attacks - obtaining answers to many more queries than what a secure system would allow. As a result the attacker can reconstruct secret data that DP aims to protect - even if DP code runs in a Trusted Execution Environment (TEE). We propose ElephantDP, a system that aims to provide the same guarantees as a trusted curator in the global DP model would, albeit set in an untrusted environment. Our system relies on a state continuity module to provide protection for the privacy budget and a TEE to faithfully execute DP code and update the budget. To provide security, our protocol makes several design choices including the content of the persistent state and the order between budget updates and query answers. We prove that ElephantDP provides liveness (i.e., the protocol can restart from a correct state and respond to queries as long as the budget is not exceeded) and DP confidentiality (i.e., an attacker learns about a dataset as much as it would from interacting with a trusted curator). Our implementation and evaluation of the protocol use Intel SGX as a TEE to run the DP code and a network of TEEs to maintain state continuity. Compared to an insecure baseline, we observe 1.1-3.2$\times$ overheads and lower relative overheads for complex DP queries.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
