Proofs of Retrievability Using Locally Decodable Codes Julien - PowerPoint PPT Presentation

Proofs of Retrievability Using Locally Decodable Codes Julien Lavauzelle, Françoise Levy-dit-Vehel GRACE team, LIX & INRIA, Palaiseau, France 2016 IEEE International Symposium on Information Theory July 13, 2016

Issue Server Client Huge fi le (e.g. 10 GB) 1/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Issue Server Client Huge fi le (e.g. 10 GB) 1/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Issue Server Client ? Is the file retrievable? 1/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Definition (Proof of Retrievability) Proof of Retrievability (PoR) = 3 procedures: ◮ Initialization [ Client ] : F �→ Init ( F ) = ( ˜ F , data F ) Then, the client uploads ˜ F on the server. 2/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Definition (Proof of Retrievability) Proof of Retrievability (PoR) = 3 procedures: ◮ Initialization [ Client ] : F �→ Init ( F ) = ( ˜ F , data F ) Then, the client uploads ˜ F on the server. ◮ Verification [ Client ← → Server ] : ( ˜ Client ( data F ) Server F ) c Pick a challenge c Compute an answer r r Verif data F ( c , r ) ∈ { true , false } 2/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Definition (Proof of Retrievability) Proof of Retrievability (PoR) = 3 procedures: ◮ Initialization [ Client ] : F �→ Init ( F ) = ( ˜ F , data F ) Then, the client uploads ˜ F on the server. ◮ Verification [ Client ← → Server ] : ( ˜ Client ( data F ) Server F ) c Pick a challenge c Compute an answer r r Verif data F ( c , r ) ∈ { true , false } ◮ Extraction [ Client ← → Server ]. We want that Extract ( data F ) = F holds w.h.p. 2/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

A security model Definition ( τ -faulty server). Let τ ∈ [ 0 , 1 ] , P be a PoR and X the distribution of challenges. A τ -faulty server A for P is an algorithm such that, for all encoded files ˜ F : Verif data F ( x , A ( ˜ � � F , x )) = false < τ . P x ∼ X Rem: this also includes malicious servers. 3/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

A security model Definition ( τ -faulty server). Let τ ∈ [ 0 , 1 ] , P be a PoR and X the distribution of challenges. A τ -faulty server A for P is an algorithm such that, for all encoded files ˜ F : Verif data F ( x , A ( ˜ � � F , x )) = false < τ . P x ∼ X Rem: this also includes malicious servers. Definition (PoR soundness). Let τ, ε ∈ [ 0 , 1 ] . A PoR is said ( τ, ε ) -sound if, for all τ -faulty servers A and all files F : � � P Extract ( data F ) = F ≥ 1 − ε , where the probability is taken over extraction procedure randomness. 3/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

The seminal example A. Juels, B. Kaliski Jr., PORs: Proofs of Retrievability for large files. in Proceedings of the 2007 ACM Conference on Computer and Communications Security, Alexandria, USA, 2007. x 2 x 2 x 1 x 1 x 3 x 3 x 0 x 0 x 4 x 4 x 9 x 9 x 8 x 8 x 5 x 5 x 6 x 6 x 7 x 7 4/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

The seminal example A. Juels, B. Kaliski Jr., PORs: Proofs of Retrievability for large files. in Proceedings of the 2007 ACM Conference on Computer and Communications Security, Alexandria, USA, 2007. x 2 x 1 x 3 x 0 x 4 x 9 x 8 x 5 x 6 x 7 4/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

The seminal example A. Juels, B. Kaliski Jr., PORs: Proofs of Retrievability for large files. in Proceedings of the 2007 ACM Conference on Computer and Communications Security, Alexandria, USA, 2007. x 2 x 1 x 4 ,x 7 ? x 3 x 0 x 4 x 9 x 8 x 5 x 6 x 7 4/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

The seminal example A. Juels, B. Kaliski Jr., PORs: Proofs of Retrievability for large files. in Proceedings of the 2007 ACM Conference on Computer and Communications Security, Alexandria, USA, 2007. x 2 x 1 x 4 ,x 7 ? x 3 x 0 x 4 x 9 x 8 x 5 x 6 x 7 4/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

The seminal example A. Juels, B. Kaliski Jr., PORs: Proofs of Retrievability for large files. in Proceedings of the 2007 ACM Conference on Computer and Communications Security, Alexandria, USA, 2007. x 2 x 1 x 4 ,x 7 ? x 3 x 0 x 4 x 9 x 8 x 5 x 6 x 7 4/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Other features ◮ Low communication; ◮ low server overhead and low client storage; ◮ low algorithmic complexity; ◮ unbounded use. 5/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Towards structure verification JK’07 main drawbacks: ◮ bounded use; ◮ quite big client storage. 6/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Towards structure verification JK’07 main drawbacks: ◮ bounded use; ◮ quite big client storage. Our idea: ◮ check the structure of the file instead of file values; ◮ use locally decodable codes which provide a local structure. 6/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Error-correcting codes F q = { t 1 , . . . , t q } a finite field. F q ev 1 : F q [ T ] → q f �→ ( f ( t 1 ) , . . . , f ( t q )) F q m ev m : F q [ X 1 , . . . , X m ] → q f �→ ( f ( x )) x ∈ F m q Example: full length Reed-Solomon code ( n = q ). C = RS q ( k ) = { ev 1 ( f ) , f ∈ F q [ X ] , deg f < k } f ( x i ) c = ∈ C F q 7/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

Affine lifting of codes Let C ⊆ { ev ( f ) , f ∈ F q [ T ] } be a (univariate) base code . The (multivariate) lifted code Lift m ( C ) is the code: L = Lift m ( C ) = { ev m ( g ) , g ∈ F q [ X 1 , . . . , X m ] , ∀ affine line ℓ, ev 1 ( g | ℓ ) ∈ C} F q ∈ C F q Alan Guo, Swastik Kopparty, Madhu Sudan, New Affine-Invariant Codes from Lifting in Proceedings of ITCS’13, Berkeley, USA, 2013. 8/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Initialization and verification Consider L = Lift m ( C ) . ◮ Initialization: � data F = ∅ Init ( F ) = ˜ F = Enc L ( F ) 9/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Initialization and verification Consider L = Lift m ( C ) . ◮ Initialization: � data F = ∅ Init ( F ) = ˜ F = Enc L ( F ) ◮ Verification: Client Server ˜ ∅ F ℓ Randomly pick a line ℓ ⊂ F m q c = { ˜ Read values ˜ F [ x ] } x ∈ ℓ ˜ c If ˜ c ∈ C , then return true . Else return false . 9/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. ◮ Decode the remaining erasures with the decoding algorithm of C . 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. ◮ Decode the remaining erasures with the decoding algorithm of C . ∈ C 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. ◮ Decode the remaining erasures with the decoding algorithm of C . 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16

LiftPoR: Extraction Tab : F m q → F q ◮ Initialize file Tab with q m erasures. ◮ While there remains ≥ q m − 1 erasures : – run a verification test; – if success: update the file, – otherwise, do nothing. ◮ Decode the remaining erasures with the decoding algorithm of C . 10/17 Julien Lavauzelle, Françoise Levy-dit-Vehel ISIT’16