Building Capacity-Achieving PIR Schemes with Optimal Sub-Packetization over Small Fields

Suppose a distributed storage system containing <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</i> files is replicated across <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> servers, and a user wants to privately retrieve one file by accessing the servers such that the identity of the retrieved file is kept secret from any subset of up to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> servers, where each file can be viewed as a vector over the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i>-ary finite field Fq. A scheme designed for this purpose is called a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-private information retrieval (T-PIR) scheme. We consider the problem of explicitly constructing capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes over small finite fields. In this paper, we first provide a general framework for constructing explicit capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes for all parameters, which only relies on an MDS array matrix with a special information set. To construct such an MDS array matrix, we propose a new family of matrices over finite fields, called the generalized minor matrices of the Moore matrix, and establish a series of key identities. By combining favourable properties of generalized minor matrices with our framework, we construct an explicit capacityachieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR scheme with optimal sub-packetization over the field Fq, as small as possible, for three classes of parameters <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N, T,M</i> ≥ 3. Specifically, the first class of construction works for all <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>(2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> − 1), <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">dt</i>, and the field size <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> is the least prime power satisfying <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q^t−1</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>. Moreover, this construction generalizes the scheme proposed by Xu and Wang in 2022, which only considers the case of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>(2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i>−1), <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = dt with 2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">^t−1</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>. For all <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>(2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> + 1), <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = dt, our second <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR scheme is the first explicit construction, and the field size <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> is the least prime power satisfying <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q^t</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>, which is the smallest field size among all known explicit capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes. Particularly, when 2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">^t</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>, the field size of such constructions can be reduced to 2. In the case of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = 4<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = 2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</i> + 1, our scheme is the first one to reduce the field size to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> = 2. Compared with all known explicitly capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes, the required field of our schemes has the smallest size.

This paper is eligible for the Jack Keil Wolf ISIT Student Paper Award. In this work, a flexible and robust private information retrieval (PIR) scheme based on binary non-maximum distance separable (non-MDS) codes is considered. This combines previous works on PIR schemes based on transitive non-MDS codes on one hand, and PIR from MDS-coded Byzantine and nonresponsive servers on the other hand. More specifically, a PIR scheme employing binary Reed–Muller (RM) codes tolerant to colluding, Byzantine, and non-responsive servers is constructed, and bounds for the achievable rates are derived under certain conditions. The construction of such schemes turns out to be much more involved than for MDS codes. Namely, the binary query vectors have to be selected with great care to hit the desired information sets, which is technically challenging as will be shown.

Outsourcing database as service instead of using in-house database management is a new trend emerging in a computing industry; there has been growing interest in outsourcing database services in both the commercial world and the research community. In this paper, we present analysis of non-concurrent model of fast single-database Private Information Retrieval (PIR) scheme for maintaining data privacy with data confidentiality using encryption algorithm like AES for Outsourced Database Service (ODBS) Model. In this model encryption method maintains data confidentiality and a utility that help to create PIR reply which maintains data privacy. In PIR Scheme data privacy is achieved by adding noise data into the result of a typical query which is called as PIR reply. Single-database PIR schemes are generally not practical because of its expensiveness from computational point of view. Here we propose a model that suggests the use of General-Purpose computation using Graphic Processing Units (GPGPU) commodity to process such type of computationally intensive operations. This model will help to achieve practical implementation of single-database PIR scheme which uses encryption algorithm to maintain data confidentiality as secondary goal and it serves to create database reply to maintain data privacy as primary goal. This paper shows some real time results that proves need of concurrency in PIR algorithms. It also describes the use of lattice based single-database PIR protocol with GPGPU as a processing unit to achieve high speed-up and hence, the performance of the system.

We consider information-theoretical private information retrieval (PIR) from a coded database with colluding servers. We target, for the first time, locally repairable storage codes (LRCs). We consider any number of local groups g, locality r, local distance δ and dimension k. Our main contribution is a PIR scheme for maximally recoverable (MR) LRCs based on linearized Reed–Solomon codes, which achieve the smallest field sizes among MR-LRCs for many parameter regimes. In our scheme, nodes are identified with codeword symbols and servers are identified with local groups of nodes. Only locally non-redundant information is downloaded from each server, that is, only r nodes (out of r+δ−1) are downloaded per server. The PIR scheme achieves the (download) rate R=(N−k−rt+1)/N, where N=gr is the length of the MDS code obtained after removing the local parities, and for any t colluding servers such that k+rt≤N. For an unbounded number of stored files, the obtained rate is strictly larger than those of known PIR schemes that work for any MDS code. Finally, the obtained PIR scheme can also be adapted when communication between the user and each server is performed via linear network coding, achieving the same rate as previous PIR schemes for this scenario but with polynomial finite field sizes, instead of exponential. Our rates are equal to those of PIR schemes for Reed–Solomon codes, but Reed–Solomon codes are incompatible with the MR-LRC property or linear network coding, thus our PIR scheme is less restrictive in its applications.

This paper presents an overview of the current single-database private information retrieval (PIR) schemes and proposes to explore the usage of these protocols with statistical databases. The vicinity of this research field with the one of Oblivious Transfer, and the different performance measures used for the last few years have resulted in re-discoveries and contradictory comparisons of performance in different publications. The contribution of this paper is twofold. First, we present the different schemes through the innovations they have brought to this field of research, which gives a global view of the evolution since the first of these schemes was presented by Kushilevitz and Ostrovsky in 1997. We know of no other survey of the current PIR protocols. We also compare the most representative of these schemes with a single set of communication performance measures. When compared to the usage of global communication cost as a single measure, we assert that this set simplifies the evaluation of the cost of using PIR and reveals the best adapted scheme to each situation. We conclude this overview and performance study by introducing some important issues resulting from PIR usage with statistical databases and highlighting some directions for further research.

We consider the storage–retrieval rate trade-off in private information retrieval (PIR) systems using a Shannon-theoretic approach. Our focus is mostly on the canonical two-message two-database case, for which a coding scheme based on random codebook generation and the binning technique is proposed. This coding scheme reveals a hidden connection between PIR and the classic multiple description source coding problem. We first show that when the retrieval rate is kept optimal, the proposed non-linear scheme can achieve better performance over any linear scheme. Moreover, a non-trivial storage-retrieval rate trade-off can be achieved beyond space-sharing between this extreme point and the other optimal extreme point, achieved by the retrieve-everything strategy. We further show that with a method akin to the expurgation technique, one can extract a zero-error PIR code from the random code. Outer bounds are also studied and compared to establish the superiority of the non-linear codes over linear codes.

We present lower bounds for the static cryptographic data structure problem of single-server private information retrieval (PIR). PIR considers the setting where a server holds a database of n entries and a client wishes to privately retrieve the i-th entry without revealing the index i to the server. In our work, we focus on PIR with preprocessing where an r-bit hint may be computed in a preprocessing stage and stored by the server to be used to perform private queries in expected time t. As our main result, we prove that for any single-server, computationally secure PIR with preprocessing, it must be that tr = Ω(n log n) when r = Ω(log n). If r = O(log n), then we show that t = Ω(n). Our lower bound holds even when the scheme errs with probability 1/n2 and the adversary's distinguishing advantage is 1/n. Our work improves upon the tr = Ω(n) lower bound of Beimel, Ishai and Malkin [JoC'04]. For information-theoretic security, we present a stronger lower bound of t + r = Ω(n) and show a matching construction. Both our lower bounds apply for public-key doubly-efficient PIRs of Boyle, Ishai, Pass and Wootters [TCC'17]. Additionally, our lower bound for information-theoretic security also applies for offline-online PIRs as defined by Corrigan-Gibbs and Kogan [Eurocrypt'20], where the hint is private and only viewed by the client. We prove our lower bounds in a variant of the cell probe model where only accesses to the database are charged cost and computation and accesses to the hint are free. Our main technical contribution is a novel use of the cell sampling technique (also known as the incompressibility technique) used to obtain lower bounds on data structures. In previous works, this technique only leveraged the correctness guarantees to prove lower bounds even when used for cryptographic primitives. Our work combines the cell sampling technique with the privacy guarantees of PIR to construct a powerful, polynomial-time adversary that is critical to proving our higher lower bounds.

In this work, two practical concepts related to private information retrieval (PIR) are introduced and coined <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">full support-rank</i> PIR and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">strongly linear</i> PIR. Being of full support-rank is a technical, yet natural condition required to prove a converse result for a capacity expression and satisfied by almost all currently known capacity-achieving schemes, while strong linearity is a practical requirement enabling implementation over small finite fields with low subpacketization degree. Then, the capacity of MDS-coded, linear, full support-rank PIR in the presence of colluding servers is derived, as well as the capacity of symmetric, linear PIR with colluding, adversarial, and nonresponsive servers for the recently introduced concept of matched randomness. This positively settles the capacity conjectures stated by Freij-Hollanti <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> and Tajeddine <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> in the presented cases. It is also shown that, further restricting to strongly-linear PIR schemes with deterministic linear interference cancellation, the so-called star product scheme proposed by Freij-Hollanti <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> is essentially optimal and induces no capacity loss.

The problem of private information retrieval (PIR) gets renewed attentions in recent years due to its information-theoretic reformulation and applications in distributed storage systems. Let M files be stored in a distributed storage system consisting of N servers, where each file is stored via an (N, K)-MDS code. A PIR scheme will allow a user to retrieve a specific file from the distributed storage system without revealing the identity of the file to any T colluding servers. PIR rate is defined as the number of symbols privately retrieved per one downloaded symbol and the supremum of all achievable rates is called the PIR capacity. The capacity has been solved for some degenerate cases, i.e. $$K=1$$ or $$T=1$$ . For the general case $$K\ge 2$$ and $$T\ge 2$$ , the exact PIR capacity remains unknown. In this paper we propose a general private information retrieval scheme for MDS coded databases with colluding servers achieving PIR rate $$(1+R+R^2+\cdots +R^{M-1})$$ , where $$R=1-\frac{{{N-T}\atopwithdelims ()K}}{{N\atopwithdelims ()K}}$$ . Our scheme captures the essence of the optimal schemes for degenerate cases. We also compare our scheme with some other known PIR schemes for non-degenerate cases. The advantages of our scheme include its independence of the property of the storage code and a better performance when the number of files M is small.

An information theoretic approach to security and privacy called Secure And Private Information Retrieval (SAPIR) is introduced. SAPIR is applied to distributed data storage systems. In this approach, random combinations of all contents are stored across the network. Our coding approach is based on Random Linear Fountain (RLF) codes. To retrieve a content, a group of servers collaborate with each other to form a Reconstruction Group (RG). SAPIR achieves asymptotic perfect secrecy if at least one of the servers within an RG is not compromised. Further, a Private Information Retrieval (PIR) scheme based on random queries is proposed. The PIR approach ensures the users privately download their desired contents without the servers knowing about the requested contents indices. The proposed scheme is adaptive and can provide privacy against a significant number of colluding servers.

SummaryIn big cities, the drivers face a major problem in identifying an optimal vacant parking space for their vehicles as the number of vehicles has rapidly grown over the recent years. This objective of determining the available parking space results in wastage of time, air pollution, and traffic congestion. Smart parking systems facilitate the driver to book parking slots and attain real‐time parking information. However, the existing smart parking solutions necessitate the disclosure of sensitive information like desired destination from the vehicle drivers. Moreover, the current smart parking solutions are highly centralized, making them vulnerable for launching privacy breaches by service providers and resulting in the issues of single‐point failure. In this paper, ring signature and improved multi‐transaction mode consortium blockchain‐based private information retrieval (RS‐IMTMCB‐PIR) scheme is proposed for privacy preserving in smart parking system. This RS‐IMTMCB‐PIR scheme initially utilizes an improved multi‐transaction mode consortium blockchain constructed by different number of parking lot owners in order to achieve maximized parking offers based on the factor of availability, transparency, and security. It incorporates an improved private information retrieval approach for protecting the location privacy of drivers and secretly retrieving the offers of parking from the improved multi‐transaction mode consortium blockchain. It further utilizes the benefits of ring signature for permitting the drivers in a potential anonymous authentication process that aids in available parking slot reservation. The simulation results of this proposed RS‐IMTMCB‐PIR scheme portrayed a predominant performance in ensuring maximized degree of drivers' privacy with reduced computation and communication overheads.

A private information retrieval (PIR) scheme on coded storage systems with colluding, byzantine, and non-responsive servers is presented. Furthermore, the scheme can also be used for symmetric PIR in the same setting. An explicit scheme using an [n, k] generalized Reed-Solomon storage code is designed, protecting against t-collusion and handling up to b byzantine and r non-responsive servers, when n ≥ n <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1'</sup> =(ν+1)k+t+2b+r-1, for some integer ν ≥ 1. This scheme achieves a PIR rate of 1-[(k+2b+t+r-1)/(n <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">'</sup> -r)]. In the case where the capacity is known, namely when k=1, it is asymptotically capacity achieving as the number of files grows.

Private information retrieval (PIR) is a cryptographic primitive that facilitates the seemingly impossible task of letting users fetch records from untrusted and remote database servers without revealing to those servers which records are being fetched. The research literature on PIR is vast; the over two decades since its 1995 introduction by Chor, Goldreich, Kushilevitz, and Sudan, the cryptography, privacy, and theoretical computer science research communities have studied PIR intensively and from a variety of perspectives. Alas, despite a series of significant advances, most privacy practitioners and theoreticians alike fall into one of two camps: (i) those who believe that PIR is so inefficient and abstruse as to make it all-but-useless practice, and (ii) those who remain blissfully unaware that PIR even exists. Indeed, to date not even one of the numerous PIR-based applications proposed the research literature has been deployed at scale to protect the privacy of users in the wild. This tutorial targets both of the above camps, presenting a bird's-eye overview of the current state of PIR research. Topics covered will span the spectrum from purely theoretical through imminently applicable and all the high points between, thereby providing participants with an awareness of what modern PIR techniques have (and do not have) to offer, dispelling the myth of PIR's inherent impracticality, and hopefully inspiring participants to identify practical use cases for PIR within their own niche areas of expertise. This introductory tutorial will be accessible to anyone comfortable with college-level mathematics (basic linear algebra and some elementary probability and number theory).

Private information retrieval (PIR) protocols allow a user to retrieve a data item from a database without revealing any information about the identity of the item being retrieved. Specifically, in information-theoretic k-server PIR, the database is replicated among k non-communicating servers, and each server learns nothing about the item retrieved by the user. The cost of PIR protocols is usually measured in terms of their communication complexity, which is the total number of bits exchanged between the user and the servers. However, another important cost parameter is the storage overhead, which is the ratio between the total number of bits stored on all the servers and the number of bits in the database. Since single-server information-theoretic PIR is impossible, the storage overhead of all existing PIR protocols is at least 2 (or k, in the case of k-server PIR). In this work, we show that information-theoretic PIR can be achieved with storage overhead arbitrarily close to the optimal value of 1, without sacrificing the communication complexity. Specifically, we prove that all known k-server PIR protocols can be efficiently emulated, while preserving both privacy and communication complexity but significantly reducing the storage overhead. To this end, we distribute the n bits of the database among s + r servers, each storing n/s coded bits (rather than replicas). Notably, our coding scheme remains the same, regardless of the specific k-server PIR protocol being emulated. For every fixed k, the resulting storage overhead (s +r)/s approaches 1 as s grows; explicitly we have equation. Moreover, in the special case k = 2, the storage overhead is only 1 + 1/s. In order to achieve these results, we introduce and study a new kind of binary linear codes, called here k-server PIR codes. Finally, we show how such codes can be constructed from multidimensional cubic, from Steiner systems, and from one-step majority-logic decodable codes.

There has been much recent interest in private information retrieval (PIR) in models where a database is stored across several servers using coding techniques from distributed storage, rather than being a simply replicated. In particular, a recent breakthrough result of Fazelli, Vardy, and Yaakobi introduces the notion of a PIR code and a PIR array code, and uses this notion to produce efficient PIR protocols. In this paper, we are interested in designing PIR array codes. We consider the case when we have m servers, with each server storing a fraction (1/s) of the bits of the database; here s is a fixed rational number with s > 1. A PIR array code with the k-FIR property enables a k-server PIR protocol (with k ≤ m) to be emulated on m servers, with the overall storage requirements of the protocol being reduced. The communication complexity of a PIR protocol reduces as k grows, so the virtual server rate, defined to be k/m, is an important parameter. We study the maximum virtual server rate of a PIR array code with the k-PIR property. We present upper bounds on the achievable virtual server rate, some constructions, and ideas how to obtain the PIR array codes with the highest possible virtual server rate. In particular, we present constructions that asymptotically meet our upper bounds and the exact largest virtual server rate is obtained when 1 <; s ≤ 2. A k-PIR code (and similarly a k-PIR array code) is also a locally repairable code with symbol availability k-1. Such a code ensures k parallel reads for each information symbol. So the virtual server rate is very closely related to the symbol availability of the code when used as a locally repairable code. The results of this paper are discussed also in this context where subspace codes also have an important role.