Towards Practical Verifiable Graph Processing Yupeng Zhang Charalampos Papamanthou and Jonathan Katz University of Maryland Agenda Background of verifiable computation and motivation ID: 514351
Download Presentation The PPT/PDF document "ALITHEIA:" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
ALITHEIA: Towards Practical Verifiable Graph Processing
Yupeng Zhang, Charalampos Papamanthou and Jonathan KatzUniversity of MarylandSlide2
AgendaBackground of verifiable computation and motivation
Our contributionsAlitheia: A system for Verifiable Computation on graphsShortest paths, longest paths and maximum flowDifferent kinds of graphs: general/planarUse of non-generic approaches to achieve practicality/scalability
Experimental resultsConclusionsSlide3
What is verifiable c
omputation?
digest
a
nswer & proof
v
erify(answer, proof, query)
data & function
query
Correctness
Soundness
p
reprocessing time
prover
time
s
erver storage
p
roof size
verification time
[1] R
.
Tamassia
. Authenticated Data Structures. In ESA
, 2003
. Slide4
Generic VC systems: circuit-based
[2] R. Gennaro, C. Gentry, B. Parno, and M. Raykova. Quadratic span programs and succinct NIZKs without PCPs.
in EUROCRYPT, 2013.[3] B. Parno, J. Howell, C. Gentry, and M. Raykova. Pinocchio: Nearly Practical Verifiable Computation. In SSP, 2013.
data & function
query
answer
VC
Limitation: inefficient dynamic
m
emory accesses
Overhead is linear in the size of the memorySlide5
Generic VC systems: RAM-based
Use witness to access dynamic memory based on Merkle tree.Logarithmic overhead in the size of the memory, with large constants
[4] B. Braun, A. J. Feldman, Z. Ren, S. T. V. Setty, A. J. Blumberg, and M. Walfish
. Verifying Computations with State. In SOSP,
2013.
[5]
E. Ben-
Sasson
, A. Chiesa, D.
Genkin
, E.
Tromer
, and M.
Virza.
SNARKs for C: Verifying Program Executions Succinctly
and in Zero Knowledge. In CRYPTO, 2013. Slide6
Why graph algorithms?
Numerous applications in practice
Shortest PathMaximal Flow
Longest PathSlide7
Verifiable shortest path
Many dynamic memory accesses operations
n vertices and m edges, breadth first search on a unit weight graphProver timeCircuit-based naïve implementation:
O(
nm
log
2
m
)
RAM-based naïve implementation:
O(
m
log
3
m
) with large constantsSlide8
AgendaBackground of verifiable computation and motivation
Our contributionsAlitheia: A system for Verifiable Computation on graphsShortest paths, longest paths and maximum flowDifferent kinds of graphs: general/planarUse of non-generic approaches to achieve practicality/scalability
Experimental resultsConclusionsSlide9
What is a certifying algorithm?
Verifying correctness of a computation (possibly given some auxiliary input) faster than performing the computation.E.g., sorting takes O(n log n
) time, but a correct sorted sequence can be verified in O(n) time
[6] R
. M. McConnell, K.
Mehlhorn
, S.
Näher
, and P.
Schweitzer. Certifying
Algorithms. Computer Science
Review, 2011
.Slide10
More efficient VC using certifying algorithms
digest
a
nswer & proof
g
raph G, function F
c
ertifying
algorithm
C
F
q
uery x
Evaluate F(
G,x
)
x
Generic VC
for C
F
F(
G,x
)
a
uxiliary input for C
F
F(
G,x
)o
r rejectverify
(answer, proof, query)
[7] R
.
Tamassia
and N.
Triandopoulos
. Certification and Authentication of Data Structures. In
AMW
, 2010.
proofSlide11
Certifying algorithm: shortest
p
ath
s,t
Linear algorithm with NO dynamic memory accesses!
s
,t
For unit weight undirected graph
O(
n
) speed up compared to circuit-based generic VC
O(
log
m
)
speed up compared to
RAM-
based generic
VC
proof
proofSlide12
AgendaBackground of verifiable computation and motivation
Our contributionsAlitheia: A system for Verifiable Computation on graphsShortest paths, longest paths and maximum flowDifferent kinds of graphs: general/planarUse of non-generic approaches to achieve practicality/scalability
Experimental resultsConclusionsSlide13
From general to planar graphs
3
2
1
c
b
7
d
6
a
e
4
5
f
g
1
2
3
6
7
4
5
f
g
e
a
b
c
d
Planar Separator Theorem:Slide14
Planar separator tree
1
2
3
6
7
d
a
b
c
Query:
d
a
d
d
a
a
+
+
min
……
min
2
min
1Slide15
Shortest path in planar graphs
Precomputation & Storage : O( )Query: O( )What does the server need to prove now?Verifiable selection of the minimum element from the sum of two vectorsSlide16
Additively-homomorphic digest
General Hash is slow in Generic VC!
+
+
[
8
]
C.
Papamanthou
, E. Shi, R.
Tamassia
, and K. Yi.
Streaming Authenticated
Data Structures. In EUROCRYPT,
2013Slide17
VC for vector
addition and minimum
Digest(
A
)
=
d
Output
min(
A
)
m
in(
A
)
A
d
proofSlide18
Complexity comparison
Circuit-Based VC
RAM-Based VC Alitheia:
Certifying
Algorithms
Alitheia
:
Planar
Graphs
Preprocessing Time
O(
nm
)
O
(
m
log
m
)
O
(
m)O(
n3/2)
Prover TimeO
(nm log2 (mn
))O(m
log3 m)
O(m log2
m)
O(
n
1/2
log
2
n
)
Proof Size
O(1)
O(1)
O(|
p
|)
O(
log
n
+|
p
|
)
Verification Time
O(|
p
|)
O(|
p
|)
O(|
p
|)
O(
log
n
+|
p
|
)
n
: number of vertices,
m
: number of edges, |
p
|: length of the shortest pathSlide19
ImplementationImplementation details:
Built on top of Pinocchio [2]Planar separator by E.Fox-Epstein et al. [7]Graph processing by LEDA library [8]Amazon EC2 Linux machine with 15GB RAMExperiment details:A random planar graph is generated10 runs of experiments
[2] B. Parno, J. Howell, C. Gentry, and M. Raykova. Pinocchio: Nearly Practical Verifiable Computation. In SSP,
2013.[9] E. Fox-Epstein, S. Mozes, P. M.
Phothilimthana
,
and C
.
Sommer
. Short and Simple Cycle Separators in
Planar Graphs
. In
ALENEX
,
2013.
[10] http://www.algorithmic-solutions.com/leda/index.htm.Slide20
Example: road network of Rome
PINOCCHIO
(Circuit-Based VC)PANTRY
(RAM-Based VC)
SNARKs for C
(RAM-Based VC )
Alitheia
:
Certifying
Algorithms
Alitheia
:
Planar
Graphs
Preprocessing Time
19000 hours*
270 hours*
52 hours*
69 minutes
4.1 minutes
Prover
Time
7600
hours*
550
hours*
30 hours*
3.3 minutes13 seconds
Proof Size288 bytes
288 bytes
288 bytes
704 bytes
3872bytes
Verification Time
0.08
seconds*
0.08
seconds*
0.05 seconds*
0.19
seconds
0.59 seconds
n
= 3353 nodes,
m
= 8870
edges, |
p
| = 13
[6] 9th DIMACS implementation challenge for shortest paths. http://www.dis.uniroma1.it/challenge9/.
*
estimated
.Slide21
Experimental results
O
n a graph with 105 nodes:Certifying algorithm: 106x
faster than Pinocchio BFS, 2x faster than
Strawman
Planar Graph:
10
7
x
faster than Pinocchio BFS,
12x
faster than
Strawman
10
6
x
10
7
x
12 xSlide22
100 x
Experimental results
On a graph with 105 nodes:
Certifying algorithm: 106
x
smaller than Pinocchio BFS,
100x
smaller than
Strawman
Planar Graph:
10
7
x
smaller than Pinocchio BFS, 1000x smaller than Strawman
10
6
x
10
7
x
1000 xSlide23
Experimental results
O
n a graph with 105 nodes:Certifying algorithm: 107x
faster than Pinocchio BFSPlanar Graph:
10
8
x
faster than Pinocchio BFS, only tens of seconds
10
7
x
10
8
xSlide24
Experimental results
O
n a graph with 105 nodes:Certifying algorithm: slower by a constant factorPlanar Graph: grows logarithmically with
n but still only around 1sSlide25
ConclusionsAlitheia is the first system to scale verifiable graph computation
to large graphs (up to 200,000 nodes)We show that by combining non-generic approaches with generic VC systems can lead to better efficiencyFor graph algorithms, we show speedups by using certifying algorithms and noncryptographic data structuresSlide26
Thank you!
zhangyp@umd.eduSlide27
Certifying algorithm: maximal
flow
Maximum-flow-min-cut theorem
s,t
Maximum Flow
Maximum Flow
Flow Assignment
Cut
Linear !!
proof
Complexity:
Ω
(
nm
)