Secure Combinatorial Optimization Simulating DFS Tree-Based Variable Elimination

In general, Constraint Optimization Problems (COP) are NP-hard. Using variable elimination techniques [5, 13] COPs can be solved with computation that is exponential only in the induced-width of the constraint graph (given some order on the nodes), i.e. smaller than n. Orders on nodes allowing for some parallelism are offered by Depth First Search (DFS) trees of the constraint graph [3, 13]. Any arithmetic circuit can be compiled into a general secure multi-party computation where no participant learns anything except for the result [1, 8]. We show in [25] that a secure combinatorial problem solver must necessarily pick the result randomly among optimal solutions, to be really secure. We recently developed SMC [19], the first programming language that translates [1]’s theory into practice. SMC also supports constraint satisfaction problems (CSPs), but additional techniques were revealed needed to offer acceptably efficient support for COPs. In [24] we proposed arithmetic circuits for solving COPs but which are exponential in the number of variables, n, for any constraint graph. Here we show how to construct an arithmetic circuit with the complexity properties of DFS-based variable elimination, and that finds a random optimal solution for any COP. For forest constraint graphs, this leads to a linear cost secure solver. Developing an arithmetic circuit performing the operations of the dynamic programming step in variable elimiSignificant input was received from Benjamin Pflanz. nation proves to be quite straightforward and similar to previous work. We encountered a more interesting scientific challenge in choosing a secure scheme for the equivalent of the decoding step. The decoding step consists of traversing the dynamic programming data structures backward to detect the assignments that generate the winning alternative. What seems to be the straightforward arithmetic circuit translation reveals results before the end of the computation, compromising security. We show how to develop an arithmetic circuit comprising all processing until the end of the computation.