Efficient Private Information Retrieval protocols based on transversal designs Julien Lavauzelle Team GRACE LIX & INRIA Saclay, Université Paris-Saclay Workshop Code-Based Cryptography 2017, Tenerife, Spain 02/06/2017
1. Definitions 2. Transversal designs for efficient PIR protocols 3. Constructions 1/21 J. Lavauzelle Workshop CBC 2017
1. Definitions 2. Transversal designs for efficient PIR protocols 3. Constructions First construction: affine transversal designs Second construction: with orthogonal arrays 1/21 J. Lavauzelle Workshop CBC 2017
Issue Given a file F , can we retrieve F i without leaking any information on i ? Examples: ◮ confidential medical data, ◮ stock exchange prices... 2/21 J. Lavauzelle Workshop CBC 2017
Private Information Retrieval protocols Let F be a file stored on a DSS with ℓ servers S 1 , . . . , S ℓ . Private Information Retrieval (PIR) protocol: a user U wants to recover F i privately. 1. U generates a query Q ( i ) = ( q 1 , . . . , q ℓ ) vector q = Q ( i ) and sends q j to S j . . . 2. Each server S j computes U a j = A ( q j , F ) and sends it back to U { a j = A ( q j , F ) } 3. U recovers S 1 S 2 S ℓ F i = R ( q , a , i ) IT-security: we want P ( q j | i ) = P ( q j ) , ∀ j = 1 , . . . , ℓ . 3/21 J. Lavauzelle Workshop CBC 2017
Parameters and previous works Design goals: ◮ Low communication complexity (exchanged bits). ◮ Low computation complexity for A (server) and R (user). ◮ Low storage overhead (for the servers). 4/21 J. Lavauzelle Workshop CBC 2017
Parameters and previous works Design goals: ◮ Low communication complexity (exchanged bits). ◮ Low computation complexity for A (server) and R (user). ◮ Low storage overhead (for the servers). Existing solutions: ◮ Download the whole file F ... 4/21 J. Lavauzelle Workshop CBC 2017
Parameters and previous works Design goals: ◮ Low communication complexity (exchanged bits). ◮ Low computation complexity for A (server) and R (user). ◮ Low storage overhead (for the servers). Existing solutions: ◮ Download the whole file F ... inefficient, but it’s the best solution with only one server [Chor Goldreich Kushilevitz Sudan ’95]. 4/21 J. Lavauzelle Workshop CBC 2017
Parameters and previous works Design goals: ◮ Low communication complexity (exchanged bits). ◮ Low computation complexity for A (server) and R (user). ◮ Low storage overhead (for the servers). Existing solutions: ◮ Download the whole file F ... inefficient, but it’s the best solution with only one server [Chor Goldreich Kushilevitz Sudan ’95]. ◮ Use smooth locally decodable codes with locality ℓ : ◮ ℓ servers, each storing a copy of F ◮ use the ℓ -query local decoding algorithm to recover F i ◮ smoothness ensures security 4/21 J. Lavauzelle Workshop CBC 2017
Parameters and previous works Design goals: ◮ Low communication complexity (exchanged bits). ◮ Low computation complexity for A (server) and R (user). ◮ Low storage overhead (for the servers). Existing solutions: ◮ Download the whole file F ... inefficient, but it’s the best solution with only one server [Chor Goldreich Kushilevitz Sudan ’95]. ◮ Use smooth locally decodable codes with locality ℓ : ◮ ℓ servers, each storing a copy of F (heavy storage overhead) ◮ use the ℓ -query local decoding algorithm to recover F i (complexity?) ◮ smoothness ensures security 4/21 J. Lavauzelle Workshop CBC 2017
1. Definitions 2. Transversal designs for efficient PIR protocols 3. Constructions First construction: affine transversal designs Second construction: with orthogonal arrays 4/21 J. Lavauzelle Workshop CBC 2017
Motivations Storage: split an encoded version of the file over the servers (instead of replicating) Security: the code must have a “smooth” set of parity-check equations for recovering any symbol F i 5/21 J. Lavauzelle Workshop CBC 2017
An example Let F m q = { P 1 , . . . , P q m } . A q -ary Reed-Muller code is: �� � � RM q ( m , r ) = f ( P 1 ) , . . . , f ( P q m ) , f ∈ F q [ X 1 , . . . , X m ] , deg f ≤ r . For r ≤ q − 2, every c ∈ RM q ( m , r ) satisfies: � ∀ line L ⊂ F m c P = 0 , q P ∈ L 6/21 J. Lavauzelle Workshop CBC 2017
An example (cont’d) Let G = { G 1 , . . . , G q } be a partition of F m q into q hyperplanes. 1) Encode F into c with RM q ( m , r ) . Give c | G j to server S j . 2) To recover F i = c i for some i ∈ F m q : ◮ Pick a line L through i ◮ Ask server S j for c P j where { P j } = L ∩ G j , except if P j = i . ◮ Reconstruct � c i = − c P j i � = P j ∈ L Security: there is a line between i and any other point of F m q . 7/21 J. Lavauzelle Workshop CBC 2017
An example (cont’d 2 ) 1 But RM q ( m , r ) with r < q has rate ≤ m ! Generalization: build a similar code through its parity-check equations according to an appropriate incidence structure. 8/21 J. Lavauzelle Workshop CBC 2017
Transversal designs A transversal design T = TD ( ℓ, s ) is a 3-tuple ( X , B , G ) of sets: ◮ X is the set of points , | X | = n = s ℓ , • • • • • • • • • • • • . . . • • • • • • • • • • • • • • • • 9/21 J. Lavauzelle Workshop CBC 2017
Transversal designs A transversal design T = TD ( ℓ, s ) is a 3-tuple ( X , B , G ) of sets: ◮ X is the set of points , | X | = n = s ℓ , G ℓ − 1 G ℓ G 1 G 2 ◮ the groups G = { G j } 1 ≤ j ≤ ℓ satisfy • • • • ℓ • • • • � X = G j and | G j | = s , • • • • . . . i = 1 • • • • • • • • • • • • • • • • 9/21 J. Lavauzelle Workshop CBC 2017
Transversal designs A transversal design T = TD ( ℓ, s ) is a 3-tuple ( X , B , G ) of sets: ◮ X is the set of points , | X | = n = s ℓ , G ℓ − 1 G ℓ G 1 G 2 ◮ the groups G = { G j } 1 ≤ j ≤ ℓ satisfy • • • • ℓ • • • • � X = G j and | G j | = s , • • • • • i i = 1 • • • • ◮ the blocks B ∈ B satisfy: • • • • • – B ⊂ X and | B | = ℓ ; • • • • • j – { i , j } ⊂ X lie in the same group, or • • • • • ∃ ! B ∈ B such that { i , j } ⊂ B 9/21 J. Lavauzelle Workshop CBC 2017
Transversal designs A transversal design T = TD ( ℓ, s ) is a 3-tuple ( X , B , G ) of sets: ◮ X is the set of points , | X | = n = s ℓ , G ℓ − 1 G ℓ G 1 G 2 ◮ the groups G = { G j } 1 ≤ j ≤ ℓ satisfy • • • • • ℓ • • • • • j � X = G j and | G j | = s , • • • • • i i = 1 • • • • • ◮ the blocks B ∈ B satisfy: • • • • – B ⊂ X and | B | = ℓ ; • • • • – { i , j } ⊂ X lie in the same group, or • • • • ∃ ! B ∈ B such that { i , j } ⊂ B 9/21 J. Lavauzelle Workshop CBC 2017
Transversal designs A transversal design T = TD ( ℓ, s ) is a 3-tuple ( X , B , G ) of sets: ◮ X is the set of points , | X | = n = s ℓ , G ℓ − 1 G ℓ G 1 G 2 ◮ the groups G = { G j } 1 ≤ j ≤ ℓ satisfy • • • • • ℓ • • • • • j � X = G j and | G j | = s , • • • • • i i = 1 • • • • • ◮ the blocks B ∈ B satisfy: • • • • – B ⊂ X and | B | = ℓ ; • • • • – { i , j } ⊂ X lie in the same group, or • • • • ∃ ! B ∈ B such that { i , j } ⊂ B Its incidence matrix M has size |B| × | X | and is defined by: � 1 if x j ∈ B i M i , j = 0 otherwise 9/21 J. Lavauzelle Workshop CBC 2017
Transversal designs A transversal design T = TD ( ℓ, s ) is a 3-tuple ( X , B , G ) of sets: ◮ X is the set of points , | X | = n = s ℓ , G ℓ − 1 G ℓ G 1 G 2 ◮ the groups G = { G j } 1 ≤ j ≤ ℓ satisfy • • • • • ℓ • • • • • j � X = G j and | G j | = s , • • • • • i i = 1 • • • • • ◮ the blocks B ∈ B satisfy: • • • • – B ⊂ X and | B | = ℓ ; • • • • – { i , j } ⊂ X lie in the same group, or • • • • ∃ ! B ∈ B such that { i , j } ⊂ B Its incidence matrix M has size |B| × | X | and is defined by: � 1 if x j ∈ B i M i , j = 0 otherwise The code C based on T over F q is the F q -linear code having M as parity-check matrix. 9/21 J. Lavauzelle Workshop CBC 2017
Our PIR protocol construction Let C ⊆ F n q be a code based on a TD ( ℓ, s ) . Initialisation. User U encodes c = C ( F ) , and gives c | G j to server S j for j = 1 , . . . , ℓ . 10/21 J. Lavauzelle Workshop CBC 2017
Our PIR protocol construction Let C ⊆ F n q be a code based on a TD ( ℓ, s ) . Initialisation. User U encodes c = C ( F ) , and gives c | G j to server S j for j = 1 , . . . , ℓ . To recover F i = c i : 1. User U randomly picks a block B ∈ B containing i . Then it defines: � B ∩ G j if i / ∈ G j q j = Q ( i ) j = a random point in G j otherwise 2. each server S j sends back a j = A ( q j , c | G j ) = c q j 3. U recovers � c i = − c q j i / ∈ G j 10/21 J. Lavauzelle Workshop CBC 2017
Properties Theorem.– If the servers do not collude, then our PIR protocol is information-theoretically secure. 11/21 J. Lavauzelle Workshop CBC 2017
Recommend
More recommend
