Efficient PrivacyPreserving Protocols for MultiUnit Auctions

1
Efficient Privacy-Preserving Protocols for
Multi-Unit Auctions

• Tuomas Sandholm
• Carnegie Mellon University

Felix Brandt Stanford University
2
Overview

• Auctions (sealed-bid, multi-unit)
• Privacy, correctness related work
• Bidder-resolved auctions
• Order statistic subprotocol
• Secure multi-unit auction protocols
• Analysis
• Conclusion

3
Sealed-Bid Auctions

• Each bidder submits sealed bid to auctioneer
• Auctioneer opens all bids and declares outcome
  (i.e., allocation and prices)
• English auction 2nd-price sealed-bid
  (Vickrey)Independent private values
• Dutch auction 1st-price sealed-bid
• Advantages Efficiency and privacy

4
Multi-Unit Auctions

• M indistinguishable units of one item
• Each bidder submits bid vector
  where denotes the price bidder i is willing to
  pay for jth unit (bidder is willing to pay
  for m units)
• Auctioneer computes allocation that maximizes
  revenue (NP-complete)
• Marginal decreasing valuations? tractable
• Classic applications Treasury bills, electrical
  power, spectrum licenses
• CS applications CPU time, network bandwidth

5
Common Pricing Schemes

• Uniform-priceAll bidders pay same unit price
  given by (M1)st-highest bid
• DiscriminatoryBidders pay what they bid (
  for mi units)
• Generalized VickreyBidder who receives mi units
  pays sum of mi highest losing bids submitted by
  other bidders

6
Privacy and Correctness

• Bidders are reluctant to reveal their bids to
  auctioneer
• Confidentiality of private information
• Significance for current auction and future
  negotiations
• In (generalized) Vickrey auctions bids are
  usually equal to valuations due to dominant
  strategy equilibrium
• Bidders doubt the correctness of the outcome
• Especially in Vickrey auctions

7
Related Work

• Cryptographic single-unit auction protocolsNaor
  et al 99, Abe et al 02, Lipmaa et al 02, Brandt
  03, etc.
• 1st-, 2nd-, and (M1)st-price (unit demand)
• Multiple auctioneers (either two (asymmetric MPC)
  or more (threshold MPC)
• Cryptographic combinatorial auction
  protocolsSuzuki et al 02 and 03
• Exponential worst-case complexity

8
Auctions without Auctioneers

• Bidders jointly emulate virtual auctioneer,
  i.e., they jointly compute outcome function
  without revealing any information in addition to
  outcome

Auctioneer
Bidder 1
Bidder 2
Bidder 3
Bidder 1
Bidder 2
Bidder 3
9
Multiparty Computation (MPC)

• General MPC is (still) inefficient
• Special-purpose MPC auction protocols based on
• Linear combinations
• Random multiplications
• Efficient implementation using homomorphic
  encryption (El Gamal) and standard ZK-proofs
• Low round complexity
• Communication complexity linear in number of
  prices

10
Vector Representation

• Bids are expressed in unary notation
• Linear combinations (multiplication with
  matrices)
• Random multiplication matrix R

11
Order Statistic Subprotocol

• Example
• Extra work required due to possibility of ties
  involving mth-highest bid (total of m(N-m)
  vectors)

12
Compute Allocation

• Additional vectors to enable tie-breaking

13
Compute Prices

• Uniform-price auction
• Discriminatory auction
• Generalized Vickrey auction

14
Protocol Implementation

• Round 1 Distributed generation of El Gamal keys
• Round 2 Publishing El Gamal encryptions of bids
• Round 3 Joint computation of outcome vectors
• Round 4 Distributed decryption of outcome
• One additional round for discriminatory auction
• Two additional rounds for generalized Vickrey
  auction

15
Analysis
n bidders, M units, k prices
16
Conclusion

• Fully private bidder-resolved constant-round
  protocols for all three common types of
  multi-unit auctions
• Feasible for moderately-sized settings (tens of
  bidders, hundreds of prices)
• Linearity in number of prices
• High communication complexity
• Straightforward adaptability to iterative
  auctions