Michael T. Goodrich

Oblivious RAM simulation is a method for achieving confidentiality and privacy in cloud computing environments. It involves obscuring the access patterns to a remote storage so that the manager of that storage cannot infer information about its contents. Existing solutions typically involve small amortized overheads for achieving this goal, but nevertheless involve potentially huge variations in access times, depending on when they occur. In this paper, we show how to de-amortize oblivious RAM simulations, so that each access takes a worst-case bounded amount of time.

In this paper, we study sparsity-exploiting Mastermind algorithms for attacking the privacy of an entire database of character strings or vectors, such as DNA strings, movie ratings, or social network friendship data. Based on reductions to nonadaptive group testing, our methods are able to take advantage of minimal amounts of privacy leakage, such as contained in a single bit that indicates if two people in a medical database have any common genetic mutations, or if two people have any common friends in an online social network. We analyze our Mastermind attack algorithms using theoretical characterizations that provide sublinear bounds on the number of queries needed to clone the database, as well as experimental tests on genomic information, collaborative filtering data, and online social networks. By taking advantage of the generally sparse nature of these real-world databases and modulating a parameter that controls query sparsity, we demonstrate that relatively few nonadaptive queries are needed to recover a large majority of each database.

The round-trip distance function on a geographic network (such as a road network, flight network, or utility distribution grid) defines the "distance" from a single vertex to a pair of vertices as the minimum length tour visiting all three vertices and ending at the starting vertex. Given a geographic network and a subset of its vertices called "sites" (for example a road network with a list of grocery stores), a two-site round-trip Voronoi diagram labels each vertex in the network with the pair of sites that minimizes the round-trip distance from that vertex. Alternatively, given a geographic network and two sets of sites of different types (for example grocery stores and coffee shops), a two-color round-trip Voronoi diagram labels each vertex with the pair of sites of different types minimizing the round-trip distance. In this paper, we prove several new properties of two-site and two-color round-trip Voronoi diagrams in a geographic network, including a relationship between the "doubling density" of sites and an upper bound on the number of non-empty Voronoi regions. We show how those lemmas can be used in new algorithms asymptotically more efficient than previous known algorithms when the networks have reasonable distribution properties related to doubling density, and we provide experimental data suggesting that road networks with standard point-of-interest sites have these properties.

Authenticated data structures provide cryptographic proofs that their answers are as accurate as the author intended, even if the data structure is being controlled by a remote untrusted host. We present efficient techniques for authenticating data structures that represent graphs and collections of geometric objects. We introduce the path hash accumulator, a new primitive based on cryptographic hashing for efficiently authenticating various properties of structured data represented as paths, including any decomposable query over sequences of elements. We show how to employ our primitive to authenticate queries about properties of paths in graphs and search queries on multi-catalogs. This allows the design of new, efficient authenticated data structures for fundamental problems on networks, such as path and connectivity queries over graphs, and complex queries on two-dimensional geometric objects, such as intersection and containment queries.