Financial crime has seen a surge in complexity over the past decades as a result of digitisation. This required better tools for detecting financial crime, creating a cat-and-mouse game between law enforcement and criminals. Anti-money laundering (AML) is the collective term describing these tools, as well as financial regulations designed to combat money laundering. The detection of fraud is done through data analysis. Typically, the financial data is a large set of transactions between accounts. Transactions have a sender, receiver, and an amount that is transferred from sender to receiver. This can be represented by a directed graph where nodes represent accounts and edges transactions between accounts. Methods for finding fraudulent transactions in transactional graphs are widely studied in both literature and industry. This usually assumes a centralised entity with full access to the data. At an international scale, the centralised approach is not suitable. Besides its massive scale posing a challenge, it is hard to imagine a global agreement on what capabilities such an entity should have. At the same time, organisations sharing financial data for analysis raises privacy concerns. We limit our scope to transactional cycles. These typically occur when criminals send money through a series of international bank accounts back to the original account. This lowers the chance of the money being traced back to its illicit source. We propose a privacy-preserving decentralised protocol which takes as input a parameter $\ell$ from any node and outputs all cycles of at most length $\ell$ containing the node. The protocol relies on the decisional Diffie-Hellman assumption, and we show the protocol is secure against a polynomially bounded adversary within our security model. The communication complexity of an instance is $O(n^{\ell})$, multiple instances can be ran in parallel. We implement the protocol and measure its performance on scale free graphs in terms of communication and computational costs. Lastly, we discuss our results and suggestions for future work.

Cloud computing and storage solutions have been credited with increasing competitiveness through cost savings, greater flexibility, elasticity and optimal resource allocation. However, the data outsourced to the cloud may contain private information that must be protected from misuse. In such cases, the data can only be outsourced after encryption. Graphs are widely used to model and represent data in various applications, including geographic information systems. Yet performing the shortest path algorithm over such encrypted outsourced graphs represents a challenge. Current approaches rely on trusted third parties, employ weaker security measures, or treat the cloud as a storage medium rather than addressing the algorithmic complexities directly. This makes the adoption of such protocols difficult in practice.

In this work, we develop two privacy-preserving navigation protocols to compute the shortest path over encrypted outsourced graphs, under different security and efficiency guarantees. The first protocol enables one to retrieve the shortest path in an oblivious manner, that is, without the cloud learning any information about the outsourced graph or the returned path. The second protocol assumes that the topology of the outsourced graph is public knowledge, and obtains retrieval times orders of magnitude faster. The evaluation results on a proof-of-concept implementation indicate that the condition number of the node-incidence matrix of the graph being outsourced serves as a determining factor for the number of iterations. Dense graphs exhibit a low condition number. In such cases, the high number of iterations required for convergence, quadratic time complexity with respect to the number of edges in the graph, and the inherently slow homomorphic operations results in impractical retrieval times. Conversely, sparse graphs allow for trivial resolution of shortest paths within a single iteration.