PanORAMa: Oblivious RAM with Logarithmic Overhead Sarvar Patel, - PowerPoint PPT Presentation

PanORAMa: Oblivious RAM with Logarithmic Overhead Sarvar Patel, Giuseppe Persiano, Mariana Raykova, Kevin Yeo

Most frequently used file Bob knows what files I am accessing

Bandwidth is expensive Retrieve the whole database

Oblivious RAM [GO’96] Access pattern hiding ORAM polylogarithmic overhead (amortized)

How Efficient Can an ORAM Construction be?

ORAM Lower Bound

ORAM Lower Bound Goldreich-Ostrovsky’96 ● Lower bound O(log C N) blocks for database of N blocks and client memory of C blocks ○

ORAM Lower Bound Goldreich-Ostrovsky’96 ● Lower bound O(log C N) blocks for database of N blocks and client memory of C blocks ○ Caveats: ○ Server only moves and retrieves blocks (does not do any computation) ■ Constructions with statistical security ■ Constructions that work for any block size ■ The client can have oracle access to a private random function ■

ORAM Lower Bound Goldreich-Ostrovsky’96 ● Lower bound Ω (log C N) blocks for database of N blocks and client memory of C blocks ○ Caveats: ○ Server only moves and retrieves blocks (does not do any computation) ■ Constructions with statistical security ■ Constructions that work for any block size ■ The client can have oracle access to a private random function ■ Boyle-Naor’16 ● Formalized the “balls and bins” model ○ Evidence for the hardness of extending the lower bound beyond the ball and bins model ○ Reduction from sorting circuits to ORAM ■

ORAM Lower Bound Goldreich-Ostrovsky’96 ● Lower bound Ω (log C N) blocks for database of N blocks and client memory of C blocks ○ Caveats: ○ Server only moves and retrieves blocks (does not do any computation) ■ Constructions with statistical security ■ Constructions that work for any block size ■ The client can have oracle access to a private random function ■ Boyle-Naor’16 ● Formalized the “balls and bins” model ○ Evidence for the hardness of extending the lower bound beyond the ball and bins model ○ Reduction from sorting circuits to ORAM ■ Larsen-Nielsen’18 ● Lower bound extended to computational online ORAM model (only block uploads/downloads) ○

PanORAMa:

New Oblivious RAM Construction ● Improved asymptotic communication ○ O(log N . log log N) blocks ■ Block size Ω (log N) ○ PanORAMa: Can be instantiated in the balls and bins model ○ Follows the hierarchical paradigm ○

New Oblivious RAM Construction ● Improved asymptotic communication ○ O(log N . log log N) blocks ■ Block size Ω (log N) ○ PanORAMa: Can be instantiated in the balls and bins model ○ Follows the hierarchical paradigm ○ New Oblivious Hash Table Construction ● Obliviousness for non-repeating queries ○ Efficient initialization from random array ○ Amortized query communication complexity ○ O(log N + poly(log log ƛ )) ■

New Oblivious RAM Construction ● Improved asymptotic communication ○ O(log N . log log N) blocks ■ Block size Ω (log N) ○ PanORAMa: Can be instantiated in the balls and bins model ○ Follows the hierarchical paradigm ○ New Oblivious Hash Table Construction ● Obliviousness for non-repeating queries ○ Efficient initialization from random array ○ Amortized query communication complexity ○ O(log N + poly(log log ƛ )) ■ New Multi-Array Shuffle Algorithm ● Efficient shuffle for input with entropy ○ Shuffle multiple sorted arrays ○ O(N log log ƛ + N log N log ƛ ) ■ Not too many very small arrays ■

Construction Paradigms Hierarchical ORAMs Tree ORAMs ● ● Worst case ≠ Average case Worst case = Average case ○ ○ Computation assumption beyond Encryption - the only computational ○ ○ encryption in most cases assumption

Construction Paradigms Hierarchical ORAMs Tree ORAMs ● ● Worst case ≠ Average case Worst case = Average case ○ ○ Computation assumption beyond Encryption - the only computational ○ ○ encryption in most cases assumption Accessed item Shuffle Shuffled items Accessed once

Construction Paradigms Hierarchical ORAMs Tree ORAMs ● ● Worst case ≠ Average case Worst case = Average case ○ ○ Computation assumption beyond Encryption - the only computational ○ ○ encryption in most cases assumption Lookup path Stored recursively PMAP = {item, path} {all items}

Construction Paradigms Hierarchical ORAMs Tree ORAMs ● ● Worst case ≠ Average case Worst case = Average case ○ ○ Computation assumption beyond Encryption - the only computational ○ ○ encryption in most cases assumption

Timeline and Complexity Path ORAM: evict on a path O(log 2 N) blocks of size Ω ( log N) First Tree ORAM: O(log 3 N) Square Root ORAM Unified framework for O(log N) blocks of size Ω ( log 2 N) Hierarchical ORAM: O(log 3 N) Eviction: two nodes per level all hierarchical ORAM Cuckoo Hash + level partition Fixed Cuckoo Hash approach Best Complexity: Balls & Bins, Any Circuit ORAM, matches O(log 3 N) block size: O(log 2 N / log log N) Path ORAM for circuit Binary tree per level complexity in MPC Only Comp. assump.: Cuckoo Hashing Encryption; O(log 3 N) Homomorphic encryption Security issue Deterministic Eviction Onion-ORAM: Schedule: O(log 3 N/ log log N) Offline ORAM: O(1) blocks of size Ω ( log 6 N) O(log n log log n) GO’96 PR’10 GM’11 DMN’11 SCSL’11 KLO’11 GGHJRW’13 SDSFRYD’13 MZ’14 WCS’15 DDFRSW’15 CGLS’17

The Hierarchical ORAM Paradigm

Hierarchical Construction Level 1 Level i has capacity for all items assigned to 2 levels 1 to i at any moment (2 i items) i log N - 1 log N

Hierarchical Construction: Search Level 1 Linear scan 2 i log N - 1 log N

Hierarchical Construction: Search Level 1 Linear scan 2 Look up searched item Item found ✔ i Look up searched item log N - 1 log N

Hierarchical Construction: Search Level 1 Linear scan 2 Look up searched item Item found ✔ i Look up searched item Look up random item log N - 1 log N

Hierarchical Construction: Search Level 1 Linear scan Move Item 2 Look up searched item Item found ✔ i Look up searched item Look up random item log N - 1 log N

Hierarchical Construction Level 1 Deterministic schedule shuffle: 2 Shuffle all items residing in level 1 to i and place them in level i, obliviously! i log N - 1 log N

Oblivious Hash Table [CGLS’17] Level 1 Efficiency costs: Instantiate each level with 2 ● Query cost oblivious hash table (OHT) ● Oblivious initialization ● Access pattern hiding for ○ During shuffle non-repeating queries i log N - 1 log N

Existing Oblivious Hash Table Constructions

Existing Oblivious Hash Table Constructions GO’96: ● Use pseudo-random function to match items log n to level buckets ● Query: retrieve item bucket O(log n) ● Oblivious initializations: several oblivious PRF(item) sorts O(n log n)

Existing Oblivious Hash Table Constructions GO’96: ● Use pseudo-random function to match items log n to level buckets ● Query: retrieve item bucket O(log n) ● Oblivious initializations: several oblivious PRF(item) sorts O(n log n) GM’11: ● Cuckoo hash table T1 ● Query: O(1) ● Oblivious initialization: oblivious sort O(n log n) T2 Cuckoo Hash: h1(item) or h2(item)

Existing Oblivious Hash Table Constructions KLO’12: ● Level size n: log n Cuckoo hash tables; each shuffle creates a new one ● Query all Cuckoo tables: O(log n) ● Oblivious initialization: log n oblivious sorts on n/log n items per n queries: log N Cuckoo hash tables O(log n)

Oblivious Two Tier Hash Table [CGLS’17]

Oblivious Two Tier Hash Table [CGLS’17] Tier 1 log n : number of bins B = n/log ε ƛ Use PRF1 to assign items into bins

Oblivious Two Tier Hash Table [CGLS’17] Tier 1 Overflow buffer of size 288.Be -Z/6 log n Z=log ε ƛ : number of bins B = n/log ε ƛ Use PRF1 to assign items into bins

Oblivious Two Tier Hash Table [CGLS’17] I n i t i a O l i z b a l Tier 1 i v t i o i o n u : s s Overflow buffer o r t ! of size 288.Be -Z/6 log n Z=log ε ƛ : number of bins B = n/log ε ƛ Use PRF1 to assign items into bins I n Tier 2 i t i a O l i z b a l i t v i o i Insert in Tier 2 table o n u : s s o r t ! Use PRF2 to assign items into bins

Oblivious Two Tier Hash Table [CGLS’17] Tier 1 Retrieve bin PRF1(query) Amortized complexity: O(log Tier 2 2 N / log log N) If not found, Retrieve bin PRF2(query) else, Retrieve random bin.

PanORAMa Overview ● Leverage entropy reuse to shuffle more efficiently

PanORAMa Hierarchical Construction Level 1 2 i log N - 1 log N

PanORAMa Hierarchical Construction OHT Extract: extract unqueried items Level from each level in shuffled order 1 2 i log N - 1 log N

PanORAMa Hierarchical Construction Multi-array shuffle: shuffle together all OHT Extract: extract unqueried items Level randomly permuted input arrays from each level in shuffled order 1 2 i log N - 1 log N