Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 of [ 1, L ] . Then U sends: – ( X 1 , X 2 ) to S 00 , – ( X 1 ∆ { i 1 } , X 2 ) to S 10 , – ( X 1 , X 2 ∆ { i 2 } ) to S 01 , – ( X 1 ∆ { i 1 } , X 2 ∆ { i 2 } ) to S 11 . XOR this data 2. At reception of ( Z 1 , Z 2 ) , each server i 2 computes a = � z ∈ Z 1 × Z 2 F z and sends a to the user. i 1 6/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Seminal work [CGKS’95-98] Private Information Retrieval . Chor, Goldreich, Kushilevitz, Sudan. FOCS. 1995 . Settings: ◮ | F | = M bits, with M = L 2 , and [ 1, M ] ≃ [ 1, L ] 2 . ◮ n = 4 servers S 00 , S 01 , S 10 , S 11 , each storing a replica of F . ◮ Goal: retrieve F i = F ( i 1 , i 2 ) , for 1 ≤ i 1 , i 2 ≤ L . 1. U generates at random two subsets X 1 , X 2 XORed 2 × XORed 4 × of [ 1, L ] . Then U sends: – ( X 1 , X 2 ) to S 00 , – ( X 1 ∆ { i 1 } , X 2 ) to S 10 , – ( X 1 , X 2 ∆ { i 2 } ) to S 01 , – ( X 1 ∆ { i 1 } , X 2 ∆ { i 2 } ) to S 11 . 2. At reception of ( Z 1 , Z 2 ) , each server i 2 computes a = � z ∈ Z 1 × Z 2 F z and sends a to the user. XORed 1 × 3. User XORs the 4 bits and retrieves F i . i 1 6/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Features of the PIR scheme in [CGKS’95-98] Correct , and secure if no collusion. 7/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Features of the PIR scheme in [CGKS’95-98] Correct , and secure if no collusion. With n = 4 servers: ◮ Communication: 8 √ n uploaded bits, 4 downloaded bits, ◮ Storage: replication of F over 4 servers, ◮ Complexity: ◮ for each server: in average, XOR of ( L /2 ) 2 = M /4 bits ◮ for the user: XOR of n = 4 bits. 7/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Features of the PIR scheme in [CGKS’95-98] Correct , and secure if no collusion. With n = 4 servers: ◮ Communication: 8 √ n uploaded bits, 4 downloaded bits, ◮ Storage: replication of F over 4 servers, ◮ Complexity: ◮ for each server: in average, XOR of ( L /2 ) 2 = M /4 bits ◮ for the user: XOR of n = 4 bits. Generalisable to n = 2 b servers: ◮ Communication: b 2 b M 1/ b = n log ( n ) M 1/log ( n ) uploaded bits, n downloaded bits, ◮ Storage: replication of F over n servers, ◮ Complexity: ◮ for each server: in average, XOR of M / n bits ◮ for the user: XOR of n bits. 7/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
(Short) state of the art • 1995: first definition [CGKS95] • 2000: reduction from smooth locally decodable codes [KT00] • 2000-10’s: many improvements ◮ PIR with 3 servers and subpolynomial communication [Yek08, Efr09] ◮ PIR with 2 servers and subpolynomial communication [DG16] ◮ lower storage overhead with PIR codes [FVY15] • 2016-now: capacity-achieving schemes, schemes dedicated to storage systems ◮ capacity of PIR [SJ17, BU18] ◮ (nearly) capacity-achieving schemes [SRR14, CHY15, TR16, ...] 8/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 8/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 8/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Context Storage systems use codes to cope with node failures. ◮ Before 2010: mostly replication or parity-check. ◮ 2010’s: MDS storage ( e.g. [ 14, 10 ] Reed-Solomon code for Facebook). ◮ Recently: codes with locality ( e.g. Hadoop Xorbas). 9/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Context Storage systems use codes to cope with node failures. ◮ Before 2010: mostly replication or parity-check. ◮ 2010’s: MDS storage ( e.g. [ 14, 10 ] Reed-Solomon code for Facebook). ◮ Recently: codes with locality ( e.g. Hadoop Xorbas). Given a code C of length n : S 1 S 2 S n c 1 ∈ C c 2 ∈ C c M ∈ C 9/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Example: Reed-Solomon storage systems Definition (Reed-Solomon code). Let x = ( x 1 , . . . , x n ) ∈ F n q , pairwise distinct. RS q ( k , n ) : = { ( f ( x 1 ) , . . . , f ( x n )) , f ∈ F q [ X ] , deg f < k } 10/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Example: Reed-Solomon storage systems Definition (Reed-Solomon code). Let x = ( x 1 , . . . , x n ) ∈ F n q , pairwise distinct. RS q ( k , n ) : = { ( f ( x 1 ) , . . . , f ( x n )) , f ∈ F q [ X ] , deg f < k } C = RS q ( k , n ) is MDS : ◮ every codeword c ∈ C can be reconstructed from any k -subset of coordinates of c , ◮ any subset of d ⊥ ( C ) − 1 = k coordinates of c are independent. 10/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Example: Reed-Solomon storage systems Definition (Reed-Solomon code). Let x = ( x 1 , . . . , x n ) ∈ F n q , pairwise distinct. RS q ( k , n ) : = { ( f ( x 1 ) , . . . , f ( x n )) , f ∈ F q [ X ] , deg f < k } C = RS q ( k , n ) is MDS : ◮ every codeword c ∈ C can be reconstructed from any k -subset of coordinates of c , ◮ any subset of d ⊥ ( C ) − 1 = k coordinates of c are independent. File storage: a file F i ∈ Σ ≃ F k is encoded into c i ∈ RS q ( k , n ) ⊗ F q s q s 10/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Example: Reed-Solomon storage systems Definition (Reed-Solomon code). Let x = ( x 1 , . . . , x n ) ∈ F n q , pairwise distinct. RS q ( k , n ) : = { ( f ( x 1 ) , . . . , f ( x n )) , f ∈ F q [ X ] , deg f < k } C = RS q ( k , n ) is MDS : ◮ every codeword c ∈ C can be reconstructed from any k -subset of coordinates of c , ◮ any subset of d ⊥ ( C ) − 1 = k coordinates of c are independent. File storage: a file F i ∈ Σ ≃ F k is encoded into c i ∈ RS q ( k , n ) ⊗ F q s q s Main assumption (can be discussed): s ≫ M 10/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 10/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Presentation Usual goal (assuming s ≫ M ): a large PIR rate ρ : = | F i | | r | . 11/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Presentation Usual goal (assuming s ≫ M ): a large PIR rate ρ : = | F i | | r | . Next, we present a PIR scheme for RS-coded databases. ◮ Originally [TR16], then extended and reformulated [TGKFH18, TGR18]. ◮ Scalable. ◮ Optimal PIR rate for t = 1 and M → ∞ . ◮ PIR rate conjectured optimal for M → ∞ . [TR16] PIR from MDS Coded Data in Distributed Storage Systems . Tajeddine, El Rouayheb. ISIT. 2016 . [TGKFH18] Robust PIR from Coded Systems with Byzantine and Colluding Servers . Tajeddine, Gnilke, Karpuk, Freij-Hollanti, Hollanti. ISIT. 2018 . [TGR18] PIR from MDS Coded Data in Distributed Storage Systems . Tajeddine, Gnilke, El Rouayheb. IEEE-TIT. 2018 . 11/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: query generation a ⋆ b : = ( a 1 b 1 , . . . , a n b n ) Notation: C ⋆ C ′ : = �{ c ⋆ c ′ | c ∈ C , c ′ ∈ C ′ }� 12/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: query generation a ⋆ b : = ( a 1 b 1 , . . . , a n b n ) Notation: C ⋆ C ′ : = �{ c ⋆ c ′ | c ∈ C , c ′ ∈ C ′ }� S 1 S 2 S n c 1 System parameters: q the storage code , C ∈ C M the coded database C ⊆ F n c i “goal” q a query code of dual distance d ⊥ ( D ) = t + 1 D ⊆ F n J J ⊆ [ 1, n ] an information set for C ⋆ D , and J : = [ 1, n ] \ J c M 12/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: query generation a ⋆ b : = ( a 1 b 1 , . . . , a n b n ) Notation: C ⋆ C ′ : = �{ c ⋆ c ′ | c ∈ C , c ′ ∈ C ′ }� S 1 S 2 S n c 1 System parameters: q the storage code , C ∈ C M the coded database C ⊆ F n c i “goal” q a query code of dual distance d ⊥ ( D ) = t + 1 D ⊆ F n J J ⊆ [ 1, n ] an information set for C ⋆ D , and J : = [ 1, n ] \ J c M Queries: S 1 S 2 S n 1. the user generates at random M words d 1 , . . . , d M ∈ D and defines Q as follows: d 1 2. the j -th column of Q is sent to server S j + 1 J d i J d M 12/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: query generation a ⋆ b : = ( a 1 b 1 , . . . , a n b n ) Notation: C ⋆ C ′ : = �{ c ⋆ c ′ | c ∈ C , c ′ ∈ C ′ }� S 1 S 2 S n c 1 System parameters: q the storage code , C ∈ C M the coded database C ⊆ F n c i “goal” q a query code of dual distance d ⊥ ( D ) = t + 1 D ⊆ F n J J ⊆ [ 1, n ] an information set for C ⋆ D , and J : = [ 1, n ] \ J c M Queries: S 1 S 2 S n 1. the user generates at random M words d 1 , . . . , d M ∈ D and defines Q as follows: d 1 2. the j -th column of Q is sent to server S j + 1 J d i Remark: queries remain private against collusions of J servers of size ≤ t . d M 12/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: server answers and reconstruction server S j holds receives Server answers: server S j receives as a query a c 1 [ j ] q 1 [ j ] column Q ( j ) ∈ F M q of Q , c M [ j ] q M [ j ] 13/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: server answers and reconstruction server S j holds receives Server answers: server S j receives as a query a c 1 [ j ] c 1 [ j ] q 1 [ j ] q 1 [ j ] column Q ( j ) ∈ F M q of Q , and has to compute + . . . r j = � Q ( j ) , C ( j ) � ∈ F q . + c M [ j ] c M [ j ] q M [ j ] q M [ j ] = r j 13/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: server answers and reconstruction server S j holds receives Server answers: server S j receives as a query a c 1 [ j ] c 1 [ j ] q 1 [ j ] q 1 [ j ] column Q ( j ) ∈ F M q of Q , and has to compute + . . . r j = � Q ( j ) , C ( j ) � ∈ F q . + c M [ j ] c M [ j ] q M [ j ] q M [ j ] = r j Reconstruction: 13/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: server answers and reconstruction server S j holds receives Server answers: server S j receives as a query a c 1 [ j ] c 1 [ j ] q 1 [ j ] q 1 [ j ] column Q ( j ) ∈ F M q of Q , and has to compute + . . . r j = � Q ( j ) , C ( j ) � ∈ F q . + c M [ j ] c M [ j ] q M [ j ] q M [ j ] = r j Reconstruction: The user collects M ∑ r = ( r 1 , . . . , r n ) = d m ⋆ c m + 1 J ⋆ c i m = 1 � �� � � �� � = c i on J ∈C ⋆ D r = 13/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The protocol: server answers and reconstruction server S j holds receives Server answers: server S j receives as a query a c 1 [ j ] c 1 [ j ] q 1 [ j ] q 1 [ j ] column Q ( j ) ∈ F M q of Q , and has to compute + . . . r j = � Q ( j ) , C ( j ) � ∈ F q . + c M [ j ] c M [ j ] q M [ j ] q M [ j ] = r j Reconstruction: The user collects M ∑ r = ( r 1 , . . . , r n ) = d m ⋆ c m + 1 J ⋆ c i m = 1 � �� � � �� � = c i on J ∈C ⋆ D and interpolates on J to recover – ∑ M ∑ M m = 1 c m ⋆ d m m = 1 d m ⋆ c m , r = + – then c i [ | J ] . 0 c i [ J ] 13/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Analysis Features for 1 run of the protocol. ◮ download cost: n symbols over F q s ◮ upload cost: an ( M × n ) -matrix over F q (negligible if s ≫ M ) ◮ retrieval of | J | = n − dim ( C ⋆ D ) symbols of the desired file ◮ the protocol is private against collusions of size ≤ d ⊥ ( D ) − 1 14/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Analysis Features for 1 run of the protocol. ◮ download cost: n symbols over F q s ◮ upload cost: an ( M × n ) -matrix over F q (negligible if s ≫ M ) ◮ retrieval of | J | = n − dim ( C ⋆ D ) symbols of the desired file ◮ the protocol is private against collusions of size ≤ d ⊥ ( D ) − 1 For Reed-Solomon codes : C = RS q ( k , n ) and D = RS q ( t , n ) : d ⊥ ( D ) − 1 = t C ⋆ D = RS q ( k + t − 1, n ) ⇒ | J | = n − k − t + 1 and 14/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Analysis Features for 1 run of the protocol. ◮ download cost: n symbols over F q s ◮ upload cost: an ( M × n ) -matrix over F q (negligible if s ≫ M ) ◮ retrieval of | J | = n − dim ( C ⋆ D ) symbols of the desired file ◮ the protocol is private against collusions of size ≤ d ⊥ ( D ) − 1 For Reed-Solomon codes : C = RS q ( k , n ) and D = RS q ( t , n ) : d ⊥ ( D ) − 1 = t C ⋆ D = RS q ( k + t − 1, n ) ⇒ | J | = n − k − t + 1 and If ( n − k − t + 1 ) | k , then repeating several runs gives a (download) PIR rate : ρ = n − k − t + 1 = 1 − k + t − 1 . n n 14/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Analysis Features for 1 run of the protocol. ◮ download cost: n symbols over F q s ◮ upload cost: an ( M × n ) -matrix over F q (negligible if s ≫ M ) ◮ retrieval of | J | = n − dim ( C ⋆ D ) symbols of the desired file ◮ the protocol is private against collusions of size ≤ d ⊥ ( D ) − 1 For Reed-Solomon codes : C = RS q ( k , n ) and D = RS q ( t , n ) : d ⊥ ( D ) − 1 = t C ⋆ D = RS q ( k + t − 1, n ) ⇒ | J | = n − k − t + 1 and If ( n − k − t + 1 ) | k , then repeating several runs gives a (download) PIR rate : ρ = n − k − t + 1 = 1 − k + t − 1 . n n Otherwise, striping methods allow to achieve the same PIR rate. 14/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 14/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Regenerating codes !!! Sorry for the notation !!! 15/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Regenerating codes !!! Sorry for the notation !!! Definition: C is an ( n , k , d , α , β , B ) - regenerating code if: ◮ C is a linear space of dimension B , consisting in ( α × n ) -matrices over F q , ◮ every c ∈ C is fully determined by any k -subset of columns, ◮ every column of c can be “repaired”, by downloading β ≤ α symbols from any d -subset of columns (hence d β ≥ α ). 15/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Regenerating codes !!! Sorry for the notation !!! Definition: C is an ( n , k , d , α , β , B ) - regenerating code if: ◮ C is a linear space of dimension B , consisting in ( α × n ) -matrices over F q , ◮ every c ∈ C is fully determined by any k -subset of columns, ◮ every column of c can be “repaired”, by downloading β ≤ α symbols from any d -subset of columns (hence d β ≥ α ). Main bound (cut-set bound [WDR07]): k − 1 ∑ B ≤ min ( α , ( d − i ) β ) . i = 0 15/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Regenerating codes !!! Sorry for the notation !!! Definition: C is an ( n , k , d , α , β , B ) - regenerating code if: ◮ C is a linear space of dimension B , consisting in ( α × n ) -matrices over F q , ◮ every c ∈ C is fully determined by any k -subset of columns, ◮ every column of c can be “repaired”, by downloading β ≤ α symbols from any d -subset of columns (hence d β ≥ α ). Main bound (cut-set bound [WDR07]): k − 1 ∑ B ≤ min ( α , ( d − i ) β ) . i = 0 d β = α . A particular optimal point (minimum-bandwidth repair, MBR): Then, � � kd − k ( k − 1 ) B = β . 2 15/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Product-matrix MBR codes [RSK11] Optimal Exact-Regenerating Codes for Distributed Storage at the MSR and MBR Points via a Product-Matrix Construction . Rashmi, Shah, Kumar. IEEE-TIT. 2011 . We set β = 1, hence α = d . 16/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Product-matrix MBR codes [RSK11] Optimal Exact-Regenerating Codes for Distributed Storage at the MSR and MBR Points via a Product-Matrix Construction . Rashmi, Shah, Kumar. IEEE-TIT. 2011 . We set β = 1, hence α = d . 1. Message symbols are arranged in a ( d × d ) -matrix k � � T ⊤ S A = 0 T 0 d where S is ( k × k ) -symmetric. 16/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Product-matrix MBR codes [RSK11] Optimal Exact-Regenerating Codes for Distributed Storage at the MSR and MBR Points via a Product-Matrix Construction . Rashmi, Shah, Kumar. IEEE-TIT. 2011 . We set β = 1, hence α = d . 1. Message symbols are arranged in a ( d × d ) -matrix k � � T ⊤ S A = 0 T 0 d where S is ( k × k ) -symmetric. 2. Let G be a ( d × n ) generator matrix for ev ( 1 ) ev ( x ) RS q ( d , n ) , echelonized in degree ( i.e. a Vandermonde matrix). Codewords are then: ev ( x d − 1 ) C = AG ∈ F d × n . q C 1 C 2 0 C d n 16/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Product-matrix MBR codes [RSK11] Optimal Exact-Regenerating Codes for Distributed Storage at the MSR and MBR Points via a Product-Matrix Construction . Rashmi, Shah, Kumar. IEEE-TIT. 2011 . We set β = 1, hence α = d . 1. Message symbols are arranged in a ( d × d ) -matrix k � � T ⊤ S A = 0 T 0 d where S is ( k × k ) -symmetric. 2. Let G be a ( d × n ) generator matrix for ev ( 1 ) ev ( x ) RS q ( d , n ) , echelonized in degree ( i.e. a Vandermonde matrix). Codewords are then: ev ( x d − 1 ) C = AG ∈ F d × n . q C 1 C 2 Remark: row C j of C is a word of a RS code 0 C d – of dimension k , if j > k , n – of dimension d > k otherwise. 16/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). ev ( 1 ) ev ( x ) ev ( x d − 1 ) C 1 C 2 0 C d 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x ) – Interpolate random values ∑ d m ⋆ C j , m . ev ( x k − 1 ) – Recover row C j , then row A j . C 1 C 2 0 C d 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x ) – Interpolate random values ∑ d m ⋆ C j , m . ev ( x k − 1 ) – Recover row C j , then row A j . C 1 C 2 0 C d Retrieval rate: 1 − k n 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x ) – Interpolate random values ∑ d m ⋆ C j , m . ev ( x k − 1 ) – Recover row C j , then row A j . C 1 C 2 0 C d 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x ) – Interpolate random values ∑ d m ⋆ C j , m . ev ( x k − 1 ) – Recover row C j , then row A j . C 1 C 2 0 C d Retrieval rate: 1 − k n 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x ) – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . ev ( x d − 1 ) • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x ) – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . ev ( x d − 1 ) • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . – Interpolate random values ∑ d m ⋆ C j , m . ev ( x k − 1 ) – Recover row C j , then row A j . • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . ev ( x d − 1 ) • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). Retrieval rate: 1 − k n – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . ev ( x d − 1 ) • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . ev ( x k − 2 ) – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . ev ( x d − 1 ) • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). Retrieval rate: 1 − k − 1 n – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes with no collusion Private Information Retrieval Schemes with Regenerating Codes . L., Tajeddine, Freij-Hollanti, Hollanti. arxiv:1811.02898 . 2018 . PIR scheme with no collusion ( t = 1). • For row j = d down to k + 1: – Run a RS ( k ) -coded PIR scheme with ev ( 1 ) randomness D . – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . ev ( x d − 1 ) • For row j = k down to 1: C 1 C 2 – Run a RS ( j ) -coded PIR scheme with randomness D . – Use symmetry of A and previously recovered 0 C d data for the reconstruction (high-degree terms can be eliminated). Retrieval rate: 1 − j n – Interpolate random values ∑ d m ⋆ C j , m . – Recover row C j , then row A j . 17/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes We get a PIR rate: 1 − k > 1 − k n ρ = 1 − k ( k + 1 )( k − 1 ) n nB 18/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
PIR scheme on PM-MBR codes We get a PIR rate: 1 − k > 1 − k n ρ = 1 − k ( k + 1 )( k − 1 ) n nB 1 Our scheme 0.9 1 − k 0.8 n 1 − B dn 1 − B +( d − 1 ) dn 0.6 PIR rate PIR rate 0.85 0.4 0.2 Our scheme 0.8 Scheme in [DN18] 0 10 15 20 25 30 35 40 10 15 20 25 30 35 40 d d Comparison of PIR rates for n = 40 and k = 7. 18/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 18/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Context Previous schemes: ◮ low communication complexity ◮ computationally inefficient (linear in | F | = ∑ M m = 1 | F m | ) Our goal: ◮ optimal computation ( | r j | for each server S j ) ◮ remove the assumption s ≫ M ◮ moderate communication complexity 19/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 19/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Transversal designs A transversal design TD ( n , s ) = ( X , B , G ) is given by: ◮ X a set of points , | X | = N = ns , • • • • • • • • • • • • . . . • • • • • • • • • • • • • • • • 20/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Transversal designs A transversal design TD ( n , s ) = ( X , B , G ) is given by: G 1 G 2 G n − 1 G n ◮ X a set of points , | X | = N = ns , • • • • ◮ groups G = { G j } 1 ≤ j ≤ n satisfying • • • • n ∐ X = G j and | G j | = s , • • • • . . . j = 1 • • • • • • • • • • • • • • • • 20/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Transversal designs A transversal design TD ( n , s ) = ( X , B , G ) is given by: G 1 G 2 G n − 1 G n ◮ X a set of points , | X | = N = ns , • • • • ◮ groups G = { G j } 1 ≤ j ≤ n satisfying • • • • n ∐ X = G j and | G j | = s , • • • • • i j = 1 • • • • ◮ blocks B ∈ B satisfying • • • • • – B ⊂ X and | B | = n ; • • • • • j – for all { i , j } ⊂ X , { i , j } lie: • • • • • either in a single group G ∈ G , or in a unique block B ∈ B 20/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Codes from designs Let T be a transversal design TD ( n , s ) = ( X , B , G ) . Its incidence matrix M has size |B| × | X | and is defined by: � 1 if x j ∈ B i M i , j = 0 otherwise. 21/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Codes from designs Let T be a transversal design TD ( n , s ) = ( X , B , G ) . Its incidence matrix M has size |B| × | X | and is defined by: � 1 if x j ∈ B i M i , j = 0 otherwise. The code C based on T over F q is the F q -linear code admitting M as a parity-check matrix ( C ⊥ is generated by M ). ◮ length ( C ) = | X | , ◮ dim ( C ) = dim ( ker M ) , ◮ every B ∈ B gives an h ∈ C ⊥ such that wt ( h | G j ) = 1, ∀ j = 1, . . . , n . 21/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Example The transversal design TD ( 3, 3 ) represented by: G 1 G 2 G 3 B 1 ∪ B 2 ∪ B 3 B = • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • gives an incidence matrix 1 1 1 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 1 1 1 1 0 0 0 0 1 0 1 0 M = 0 1 0 1 0 0 0 0 1 0 0 1 0 1 0 1 0 0 1 0 0 0 1 0 0 0 1 0 1 0 0 0 1 1 0 0 0 0 1 1 0 0 0 1 0 Its rank over F 3 is 6 = ⇒ the associated code C is a [ 9, 3 ] 3 code. 22/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 22/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The PIR scheme Let C ⊆ F N q be a code based on a TD ( n , s ) . 23/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The PIR scheme Let C ⊆ F N q be a code based on a TD ( n , s ) . • Initialisation. User U encodes F �→ c ∈ C , and gives c | G j to server S j . 23/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
The PIR scheme Let C ⊆ F N q be a code based on a TD ( n , s ) . • Initialisation. User U encodes F �→ c ∈ C , and gives c | G j to server S j . • To recover F i = c i , with i ∈ X : 1. User U randomly picks a block B ∈ B containing i . Then U defines: � unique ∈ B ∩ G j ∈ G j if i / q j = Q ( i ) j : = a random point in G j otherwise. 2. Each server S j sends back c q j 3. U recovers c i = − ∑ c q j = − ∑ c b ∈ G j j : i / b ∈ B \{ i } 23/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Privacy and parameters Theorem. This PIR protocol is information-theoretically private. Proof: – the only server which holds F i received a random query; – for each other server S j , query q j gives no information on the block B which has been picked ⇒ no information leaks on i . 24/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Privacy and parameters Theorem. This PIR protocol is information-theoretically private. Proof: – the only server which holds F i received a random query; – for each other server S j , query q j gives no information on the block B which has been picked ⇒ no information leaks on i . Features. ◮ communication complexity: n log s uploaded bits, n log q downloaded bits ◮ computational complexity: ◮ only 1 read for each server (somewhat optimal) ◮ ≤ n additions over F q for the user ◮ storage overhead: ( ns − M ) log q bits, where M = dim ( C ) 24/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Privacy and parameters Theorem. This PIR protocol is information-theoretically private. Proof: – the only server which holds F i received a random query; – for each other server S j , query q j gives no information on the block B which has been picked ⇒ no information leaks on i . Features. ◮ communication complexity: n log s uploaded bits, n log q downloaded bits ◮ computational complexity: ◮ only 1 read for each server (somewhat optimal) ◮ ≤ n additions over F q for the user ◮ storage overhead: ( ns − M ) log q bits, where M = dim ( C ) Question: transversal designs with good dim ( C ) depending on ( n , s ) ? 24/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Outline 1. Private information retrieval 2. PIR schemes for common storage systems Distributed storage systems A PIR scheme on RS-coded databases A PIR scheme with regenerating codes 3. PIR schemes with low computation Transversal designs and codes A PIR scheme with transversal designs Instances 4. Conclusion 24/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
1 0.9 m=2 0.8 0.7 0.6 0.5 m=3 0.4 0.3 0.2 m=4 0.1 m=5 0 2 10 2 15 2 20 2 25 2 30 2 35 2 40 2 45 Instances with geometric designs T A , the classical affine transversal design : The code has: ◮ X = F m q , m ≥ 2, – length ns = q m , ◮ G a set of q disjoint hyperplanes partitionning X , – “locality” n = q . ◮ B = { affine lines L secant to each group of G} . 25/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with geometric designs T A , the classical affine transversal design : The code has: ◮ X = F m q , m ≥ 2, – length ns = q m , ◮ G a set of q disjoint hyperplanes partitionning X , – “locality” n = q . ◮ B = { affine lines L secant to each group of G} . rate M / N 1 0.9 m=2 0.8 0.7 0.6 0.5 m=3 0.4 0.3 0.2 m=4 0.1 m=5 length N = ns = 2 em 0 2 10 2 15 2 20 2 25 2 30 2 35 2 40 2 45 25/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with geometric designs T A , the classical affine transversal design : The code has: ◮ X = F m q , m ≥ 2, – length ns = q m , ◮ G a set of q disjoint hyperplanes partitionning X , – “locality” n = q . ◮ B = { affine lines L secant to each group of G} . rate M / N 1 0.9 m=2 0.8 0.7 0.6 0.5 m=3 0.4 0.3 0.2 m=4 0.1 m=5 length N = ns = 2 em 0 2 10 2 15 2 20 2 25 2 30 2 35 2 40 2 45 Question: better instances? 25/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with orthogonal arrays An orthogonal array OA ( t , n , s ) of strength t is a list A of words – of length n , – over a finite set S , | S | = s , – such that, for every I ⊂ [ 1, n ] of size t , A | I = S t . Equivalently, an OA ( t , n , s ) is a code A ⊂ S n with dual distance t + 1. S = { a , b } a b b b b a OA ( 2, 3, 2 ) = b a b a a a 26/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with orthogonal arrays An orthogonal array OA ( t , n , s ) of strength t is a list A of words – of length n , – over a finite set S , | S | = s , – such that, for every I ⊂ [ 1, n ] of size t , A | I = S t . Equivalently, an OA ( t , n , s ) is a code A ⊂ S n with dual distance t + 1. S = { a , b } a b b Construction OA → TD : b b a OA ( 2, 3, 2 ) = ◮ X = S × [ 1, n ] b a b a a a ◮ G = { S × { i } , 1 ≤ i ≤ n } ( a , 1 ) ( a , 2 ) ( a , 3 ) ( b , 1 ) ( b , 2 ) ( b , 3 ) 26/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with orthogonal arrays An orthogonal array OA ( t , n , s ) of strength t is a list A of words – of length n , – over a finite set S , | S | = s , – such that, for every I ⊂ [ 1, n ] of size t , A | I = S t . Equivalently, an OA ( t , n , s ) is a code A ⊂ S n with dual distance t + 1. S = { a , b } a b b Construction OA → TD : b b a OA ( 2, 3, 2 ) = ◮ X = S × [ 1, n ] b a b a a a ◮ G = { S × { i } , 1 ≤ i ≤ n } ◮ B = {{ ( c i , i ) , 1 ≤ i ≤ n } , c ∈ OA } ( a , 1 ) ( a , 2 ) ( a , 3 ) ( b , 1 ) ( b , 2 ) ( b , 3 ) 26/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with orthogonal arrays An orthogonal array OA ( t , n , s ) of strength t is a list A of words – of length n , – over a finite set S , | S | = s , – such that, for every I ⊂ [ 1, n ] of size t , A | I = S t . Equivalently, an OA ( t , n , s ) is a code A ⊂ S n with dual distance t + 1. S = { a , b } a b b Construction OA → TD : b b a OA ( 2, 3, 2 ) = ◮ X = S × [ 1, n ] b a b a a a ◮ G = { S × { i } , 1 ≤ i ≤ n } ◮ B = {{ ( c i , i ) , 1 ≤ i ≤ n } , c ∈ OA } ( a , 1 ) ( a , 2 ) ( a , 3 ) ( b , 1 ) ( b , 2 ) ( b , 3 ) 26/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Instances with orthogonal arrays An orthogonal array OA ( t , n , s ) of strength t is a list A of words – of length n , – over a finite set S , | S | = s , – such that, for every I ⊂ [ 1, n ] of size t , A | I = S t . Equivalently, an OA ( t , n , s ) is a code A ⊂ S n with dual distance t + 1. S = { a , b } a b b Construction OA → TD : b b a OA ( 2, 3, 2 ) = ◮ X = S × [ 1, n ] b a b a a a ◮ G = { S × { i } , 1 ≤ i ≤ n } ◮ B = {{ ( c i , i ) , 1 ≤ i ≤ n } , c ∈ OA } ( a , 1 ) ( a , 2 ) ( a , 3 ) ( b , 1 ) ( b , 2 ) ( b , 3 ) 26/28 J. Lavauzelle – On the construction of PIR schemes – Séminaire C2
Recommend
More recommend
