Asymmetric Leaky Private Information Retrieval

We consider private information retrieval (PIR) of a single file out of K files from N non-colluding databases with heterogeneous storage constraints m = (m <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> , ⋯, m <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</sub> ). The aim of this work is to jointly design the content placement phase and the information retrieval phase in order to minimize the download cost in the PIR phase. We characterize the optimal PIR download cost as a linear program. By analyzing the structure of the optimal solution of this linear program, we show that, surprisingly, the optimal download cost in our heterogeneous case matches its homogeneous counterpart where all databases have the same average storage constraint μ = 1/N Σ <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n=1</sub> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</sup> mn. N Thus, we show that there is no loss in the PIR capacity due to heterogeneity of storage spaces of the databases. We provide the optimum content placement explicitly for N = 3.

The problem of private information retrieval (PIR) gets renewed attentions in recent years due to its information-theoretic reformulation and applications in distributed storage systems. Let M files be stored in a distributed storage system consisting of N servers, where each file is stored via an (N, K)-MDS code. A PIR scheme will allow a user to retrieve a specific file from the distributed storage system without revealing the identity of the file to any T colluding servers. PIR rate is defined as the number of symbols privately retrieved per one downloaded symbol and the supremum of all achievable rates is called the PIR capacity. The capacity has been solved for some degenerate cases, i.e. $$K=1$$ or $$T=1$$ . For the general case $$K\ge 2$$ and $$T\ge 2$$ , the exact PIR capacity remains unknown. In this paper we propose a general private information retrieval scheme for MDS coded databases with colluding servers achieving PIR rate $$(1+R+R^2+\cdots +R^{M-1})$$ , where $$R=1-\frac{{{N-T}\atopwithdelims ()K}}{{N\atopwithdelims ()K}}$$ . Our scheme captures the essence of the optimal schemes for degenerate cases. We also compare our scheme with some other known PIR schemes for non-degenerate cases. The advantages of our scheme include its independence of the property of the storage code and a better performance when the number of files M is small.

We present lower bounds for the static cryptographic data structure problem of single-server private information retrieval (PIR). PIR considers the setting where a server holds a database of n entries and a client wishes to privately retrieve the i-th entry without revealing the index i to the server. In our work, we focus on PIR with preprocessing where an r-bit hint may be computed in a preprocessing stage and stored by the server to be used to perform private queries in expected time t. As our main result, we prove that for any single-server, computationally secure PIR with preprocessing, it must be that tr = Ω(n log n) when r = Ω(log n). If r = O(log n), then we show that t = Ω(n). Our lower bound holds even when the scheme errs with probability 1/n2 and the adversary's distinguishing advantage is 1/n. Our work improves upon the tr = Ω(n) lower bound of Beimel, Ishai and Malkin [JoC'04]. For information-theoretic security, we present a stronger lower bound of t + r = Ω(n) and show a matching construction. Both our lower bounds apply for public-key doubly-efficient PIRs of Boyle, Ishai, Pass and Wootters [TCC'17]. Additionally, our lower bound for information-theoretic security also applies for offline-online PIRs as defined by Corrigan-Gibbs and Kogan [Eurocrypt'20], where the hint is private and only viewed by the client. We prove our lower bounds in a variant of the cell probe model where only accesses to the database are charged cost and computation and accesses to the hint are free. Our main technical contribution is a novel use of the cell sampling technique (also known as the incompressibility technique) used to obtain lower bounds on data structures. In previous works, this technique only leveraged the correctness guarantees to prove lower bounds even when used for cryptographic primitives. Our work combines the cell sampling technique with the privacy guarantees of PIR to construct a powerful, polynomial-time adversary that is critical to proving our higher lower bounds.

We consider the problem of private information retrieval (PIR) over a distributed storage system. The storage system consists of N non-colluding databases, each storing an MDS-coded version of M messages. In the PIR problem, the user wishes to retrieve one of the available messages without revealing the message identity to any individual database. We derive the information-theoretic capacity of this problem, which is defined as the maximum number of bits of the desired message that can be privately retrieved per one bit of downloaded information. We show that the PIR capacity in this case is C = (1 + K/N + K2/N2 + ··· + KM−1/NN−1)−1 = (1 + R c + R2 c + ··· + RM c −1)−1 = 1−R c /R c M, where R c is the rate of the (N, K) code used. The capacity is a function of the code rate and the number of messages only regardless of the explicit structure of the storage code. The result implies a fundamental tradeoff between the optimal retrieval cost and the storage cost. The result generalizes the achievability and converse results for the classical PIR with replicating databases to the case of coded databases.

While the users retrieve valuable information on the internet, the protection of users' privacy from a database server was not considered feasible until the private information retrieval (PIR) problem was stated and solved. A PIR scheme allows a user to retrieve a data item from an online database while hiding the identity of the item from a database server. In this paper, a new PIR scheme combined with mutual authentication by RSA signature algorithm for protecting the privacy of users is proposed. Using only one server and including the mutual authentication process in the proposed scheme, it is more secure and more practical in the real application compared with previous PIR solutions.

In the e-commerce environment, the protection of users' privacy from a server was not considered feasible until the private information retrieval (PIR) problem was stated and solved. A PIR scheme allows a user to retrieve a data item from an online database while hiding the identity of the item from a database server. In 1995, Chor et al. stated private information retrieval (PIR) problem and proposed k-server solutions which replicate the same database on the k servers. In 1997, Kushilevitz et al. proposed a PIR scheme based on the quadratic-residue assumption using only one server (one database - database replication is not needed). The scheme can simplifies multi-server management and reduce costs. In this paper, we point out that Kushilevitz's PIR scheme will let the user get much more information than he/she should get in one query of the database.

We study the problem of private set intersection (PSI). In PSI, there are two entities, each storing a set Pi, whose elements are picked from a finite set S <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">K</sub> , on N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> replicated and non-colluding databases. It is required to determine the set intersection P <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> ∩P <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> without leaking any information about the remaining elements to the other entity. We first show that the PSI problem can be recast as a multi-message symmetric private information retrieval (MM-SPIR) problem. Next, as a stand-alone result, we show that the exact capacity of MM-SPIR is C <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MM-SPIR</sub> = 1 - 1/N when P ≤ K - 1, if the common randomness S satisfies H(S) ≥ P/N-1 per desired symbol. This result implies that there is no gain for MM-SPIR over successive single-message SPIR. We present a novel capacity-achieving scheme which builds seamlessly over the multi-message PIR (MM-PIR) scheme. Based on this capacity result for the MM-SPIR problem, we show that the optimal download cost for the PSI problem is given by min{[P <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> /N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> -1],[P <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> /N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> -1]}, where P i is the cardinality of the set Pi.

In recent years, the opportunity to use search engines has increased due to the greater variety and number of Internet-capable devices. Search engines have become indispensable for many users, who provide vast amounts of information as input. However, there has been recent recognition of the risk entailed by search engine providers storing and analyzing information related to user privacy. Existing research evaluates protection of user privacy from search engines that try to extract related information from users' query strings (Jones et al. I know what you did last summer--query logs and user privacy. In: Proceedings of the sixteenth ACM conference on conference on information and knowledge management, pp. 909---914, 2007). The searchable encryption technique is effective when searching encrypted queries and is useful when users search their own data stored in external cloud storage. However, search engine providers make a profit based on the query strings of their many users, so they are not expected to adopt this approach. Private information retrieval (PIR) is an established technique which ensures that no information is leaked to the search engine. However, PIR is based on a model with strict limitations on retrieval and is impractical. In this paper, we define a measure to quantify the amount of information that is leaked during a search. The measure is defined based on the entropy of query strings. We propose a practical search scheme that reduces the amount of leaked information. The proposed scheme is simple and can be implemented using a typical personal computer. We evaluate the system by experiment and confirm that the proposed scheme works as intended and is of acceptable usability.

Private information retrieval (PIR) is a cryptographic primitive that facilitates the seemingly impossible task of letting users fetch records from untrusted and remote database servers without revealing to those servers which records are being fetched. The research literature on PIR is vast; the over two decades since its 1995 introduction by Chor, Goldreich, Kushilevitz, and Sudan, the cryptography, privacy, and theoretical computer science research communities have studied PIR intensively and from a variety of perspectives. Alas, despite a series of significant advances, most privacy practitioners and theoreticians alike fall into one of two camps: (i) those who believe that PIR is so inefficient and abstruse as to make it all-but-useless practice, and (ii) those who remain blissfully unaware that PIR even exists. Indeed, to date not even one of the numerous PIR-based applications proposed the research literature has been deployed at scale to protect the privacy of users in the wild. This tutorial targets both of the above camps, presenting a bird's-eye overview of the current state of PIR research. Topics covered will span the spectrum from purely theoretical through imminently applicable and all the high points between, thereby providing participants with an awareness of what modern PIR techniques have (and do not have) to offer, dispelling the myth of PIR's inherent impracticality, and hopefully inspiring participants to identify practical use cases for PIR within their own niche areas of expertise. This introductory tutorial will be accessible to anyone comfortable with college-level mathematics (basic linear algebra and some elementary probability and number theory).

We consider the problem of single-round private information retrieval (PIR) from N replicated databases. We consider the case when B databases are outdated (unsynchronized), or even worse, adversarial (Byzantine), and therefore, can return incorrect answers. In the PIR problem with Byzantine databases (BPIR), a user wishes to retrieve a specific message from a set of M messages with zero-error, irrespective of the actions performed by the Byzantine databases. We consider the T-privacy constraint in this paper, where any T databases can collude, and exchange the queries submitted by the user. We determine the information-theoretic capacity of this problem, which is the maximum number of correct symbols that can be retrieved privately for every symbol of the downloaded data to be C = N−2B/N · 1−T/N−2B / 1−(T/N−2B)M, if 2B + T < N. Our achievable scheme extends the optimal achievable scheme for the robust PIR (RPIR) problem to correct the errors introduced by the Byzantine databases. Our converse proof uses the idea of the cut-set bound in the network coding problem against adversarial nodes.

For the symmetric private information retrieval problem with K messages and N servers, we show that the minimum (symmetric) upload cost is log <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> (⌈K <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1/N-1</sup> ⌉) bits per server, i.e., the user must upload a q-ary symbol to each server where q is at least ⌈K <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1/N-1</sup> ⌉.

In order to achieve user's privacy preservation and data security of LBS server in road networks, a query scheme for points of interest(PoI) is proposed in this paper based on oblivious transfer and private information retrieval. The scheme can proceed in two phases: Firstly, we take vertexes in road networks as generating elements to construct a new data structure which is employed to store the distribution information and details of PoIs which are encrypted with different symmetric keys for sake of data security of LBS server. And an oblivious transfer protocol is presented based on the data structure, which facilitates a user to privately obtain the unique key materials corresponding to his interested PoIs without revealing any other PoI information in LBS server since the data is its asset. Then, a private information retrieval protocol is presented to obtain the interested PoI details, the user does not need to provide his location or explicit query content in the query, whereas he can derive an accurate result with the previous key materials, so it guarantees the user's privacy as well. Finally, performance analysis and experiments show that our scheme is more efficient and accurate in a real scenario compared with existing solutions.

Database outsourcing as a service is a new trend emerging in the computing industry instead of managing database in-house. This introduces several security issues related to database. One of the important security requirements is privacy. A Private Information Retrieval protocol (PIR) allows user to retrieve an element from the database in such way that identity of that element is not get revealed by database server. In this project work, we present the optimized lattice based PIR schema. This proposed schema is based on use of different techniques like General Purpose Graphics Processing Unit (GPGPU) and cache like technology to reduce accessibility. The latest proposed PIR scheme deal with user privacy, use of GPGPU but left to focus on data privacy, data confidentiality and accessibility cost. In our approach our system focusing on issues like user privacy, data confidentiality and accessibility cost by using cache and computational overhead by using GPGPU. Thus searching time of proposed PIR protocol is minimized to number of records in the cache. Thus our proposed design improves the overall performance of PIR protocol.

We consider the fundamental tradeoff between the storage cost and the download cost in private information retrieval systems, without any explicit structural restrictions on the storage codes, such as maximum distance separable codes or uncoded storage. Two novel outer bounds are provided, which have the following implications. When the messages are stored without any redundancy across the databases, the optimal PIR strategy is to download all the messages; on the other hand, for PIR capacity-achieving codes, each database can reduce the storage cost, from storing all the messages, by no more than one message on average. We then focus on the two-message two-database case, and show that a stronger outer bound can be derived through a novel pseudo-message technique.

We present efficient protocols for the 1-out-of-n single-server Computationally-Private Information Retrieval (CPIR) problem for l-bit strings. In particular, our results achieve simultaneously polylogarithmic extra storage, communication, and Client and Server local computational complexities, improving the best current bounds. Most designs for CPIR exploit the communication vs. computation trade-off, whereas ours exploit instead trade-offs between accuracy and the metrics mentioned above. The work is of a theoretical nature. In a nutshell, our polylogarithmic claims show that it is possible to substantially reduce the mentioned complexity measures at the expense of accuracy of the results. The main indirect (practical) implication of this work is to show that CPIR is actually viable for very large databases. We also present some open questions and future directions.