On the construction of PIR schemes Julien Lavauzelle IRMAR, - PowerPoint PPT Presentation

On the construction of PIR schemes Julien Lavauzelle IRMAR, Université de Rennes 1 Séminaire GREYC 27/02/2019

Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 1/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 1/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Problem statement Private information retrieval (PIR): Given a remote database F ∈ Σ M and i ∈ [ 1, M ] , can we retrieve the entry/file F i , without leaking information on the index i ? 2/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Problem statement Private information retrieval (PIR): Given a remote database F ∈ Σ M and i ∈ [ 1, M ] , can we retrieve the entry/file F i , without leaking information on the index i ? Trivial solution: full download. 2/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Definition of PIR Introduced in: Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Database F stored (in some way) on n servers S 1 , . . . , S n , user U wants to recover F i privately. A Private Information Retrieval protocol is a set of algorithms ( Q , A , R ) : 3/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Definition of PIR Introduced in: Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Database F stored (in some way) on n servers S 1 , . . . , S n , user U wants to recover F i privately. A Private Information Retrieval protocol is a set of algorithms ( Q , A , R ) : ( q 1 , . . . , q n ) 1. U generates a query vector q = ( q 1 , . . . , q n ) ← Q ( i ) and sends q j to server S j . . . U S 1 S 2 S n 3/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Definition of PIR Introduced in: Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Database F stored (in some way) on n servers S 1 , . . . , S n , user U wants to recover F i privately. A Private Information Retrieval protocol is a set of algorithms ( Q , A , R ) : ( q 1 , . . . , q n ) 1. U generates a query vector q = ( q 1 , . . . , q n ) ← Q ( i ) and sends q j to server S j . . . U 2. Each server S j computes r j = A ( q j , F | S j ) and sends it back to U ( r 1 , . . . , r n ) S 1 S 2 S n 3/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Definition of PIR Introduced in: Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Database F stored (in some way) on n servers S 1 , . . . , S n , user U wants to recover F i privately. A Private Information Retrieval protocol is a set of algorithms ( Q , A , R ) : ( q 1 , . . . , q n ) 1. U generates a query vector q = ( q 1 , . . . , q n ) ← Q ( i ) and sends q j to server S j . . . U 2. Each server S j computes r j = A ( q j , F | S j ) and sends it back to U ( r 1 , . . . , r n ) S 1 S 2 S n 3. U recovers F i = R ( q , r , i ) 3/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Privacy A collusion of servers : set of servers { S j : j ∈ T } , where T ⊂ [ 1, n ] , which exchange information about queries, data, etc. t : = max {| T | , T ⊆ [ 1, n ] is a collusion } ≥ 1 4/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Privacy A collusion of servers : set of servers { S j : j ∈ T } , where T ⊂ [ 1, n ] , which exchange information about queries, data, etc. t : = max {| T | , T ⊆ [ 1, n ] is a collusion } ≥ 1 • Information-theoretic privacy: I ( i ; q | T ) = 0, ∀ T ⊆ [ 1, n ] , | T | ≤ t . • Computational privacy: by varying the index i , distributions of queries q | T = Q ( i ) | T are computationally indistinguishable. 4/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Privacy A collusion of servers : set of servers { S j : j ∈ T } , where T ⊂ [ 1, n ] , which exchange information about queries, data, etc. t : = max {| T | , T ⊆ [ 1, n ] is a collusion } ≥ 1 • Information-theoretic privacy: I ( i ; q | T ) = 0, ∀ T ⊆ [ 1, n ] , | T | ≤ t . • Computational privacy: by varying the index i , distributions of queries q | T = Q ( i ) | T are computationally indistinguishable. Theorem [CGKS95, CG97]. If t = n (in particular if n = 1), then: ◮ for IT-privacy, no better solution than full download , ◮ computational privacy is possible (but remains expensive as of now). 4/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Main parameters of PIR schemes We focus on IT-privacy (hence we need n ≥ 2 servers) 5/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Main parameters of PIR schemes We focus on IT-privacy (hence we need n ≥ 2 servers) Parameters to be taken into account: – communication complexity (upload and download) – computation complexity (client and servers) – global server storage overhead – maximum size of collusions ( t ) 5/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Main parameters of PIR schemes We focus on IT-privacy (hence we need n ≥ 2 servers) Parameters to be taken into account: – communication complexity (upload and download) – computation complexity (client and servers) – global server storage overhead – maximum size of collusions ( t ) Several possible settings : – bounded vs. unbounded number of entries in the database – replicated database vs. coded database – small entries vs. large entries – dynamic database vs. static database – unresponsive or byzantine servers 5/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . i 2 i 1 6/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 of [ 1, L ] . Then U sends: X 2 i 2 i 1 X 1 6/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 of [ 1, L ] . Then U sends: – ( X 1 , X 2 ) to S 00 , i 2 i 1 6/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 of [ 1, L ] . Then U sends: – ( X 1 , X 2 ) to S 00 , – ( X 1 ∆ { i 1 } , X 2 ) to S 10 , i 2 i 1 6/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 of [ 1, L ] . Then U sends: – ( X 1 , X 2 ) to S 00 , – ( X 1 ∆ { i 1 } , X 2 ) to S 10 , – ( X 1 , X 2 ∆ { i 2 } ) to S 01 , i 2 i 1 6/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC

Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 of [ 1, L ] . Then U sends: – ( X 1 , X 2 ) to S 00 , – ( X 1 ∆ { i 1 } , X 2 ) to S 10 , – ( X 1 , X 2 ∆ { i 2 } ) to S 01 , – ( X 1 ∆ { i 1 } , X 2 ∆ { i 2 } ) to S 11 . i 2 i 1 6/22 J. Lavauzelle – On the construction of PIR schemes – Séminaire GREYC