Private information retrieval from Byzantine and colluding databases

The problem of private information retrieval (PIR) gets renewed attentions in recent years due to its information-theoretic reformulation and applications in distributed storage systems. Let M files be stored in a distributed storage system consisting of N servers, where each file is stored via an (N, K)-MDS code. A PIR scheme will allow a user to retrieve a specific file from the distributed storage system without revealing the identity of the file to any T colluding servers. PIR rate is defined as the number of symbols privately retrieved per one downloaded symbol and the supremum of all achievable rates is called the PIR capacity. The capacity has been solved for some degenerate cases, i.e. $$K=1$$ or $$T=1$$ . For the general case $$K\ge 2$$ and $$T\ge 2$$ , the exact PIR capacity remains unknown. In this paper we propose a general private information retrieval scheme for MDS coded databases with colluding servers achieving PIR rate $$(1+R+R^2+\cdots +R^{M-1})$$ , where $$R=1-\frac{{{N-T}\atopwithdelims ()K}}{{N\atopwithdelims ()K}}$$ . Our scheme captures the essence of the optimal schemes for degenerate cases. We also compare our scheme with some other known PIR schemes for non-degenerate cases. The advantages of our scheme include its independence of the property of the storage code and a better performance when the number of files M is small.

We consider the problem of private information retrieval (PIR) over a distributed storage system. The storage system consists of N non-colluding databases, each storing an MDS-coded version of M messages. In the PIR problem, the user wishes to retrieve one of the available messages without revealing the message identity to any individual database. We derive the information-theoretic capacity of this problem, which is defined as the maximum number of bits of the desired message that can be privately retrieved per one bit of downloaded information. We show that the PIR capacity in this case is C = (1 + K/N + K2/N2 + ··· + KM−1/NN−1)−1 = (1 + R c + R2 c + ··· + RM c −1)−1 = 1−R c /R c M, where R c is the rate of the (N, K) code used. The capacity is a function of the code rate and the number of messages only regardless of the explicit structure of the storage code. The result implies a fundamental tradeoff between the optimal retrieval cost and the storage cost. The result generalizes the achievability and converse results for the classical PIR with replicating databases to the case of coded databases.

We consider the problem of private information retrieval (PIR) of a single message (file) out of $M$ messages from $N$ distributed databases under asymmetric traffic from databases. In this problem, the ratios between the traffic from the databases are constrained, i.e., the ratio of the length of the answer string that the user receives from the nth database to the total length of all answer strings from all databases is constrained to be $\tau_{n}$ . For this problem, for fixed $M, N$ , we develop a general upper bound $\bar{C}(\tau)$ . Our converse bound is a piece-wise affine function in the traffic ratio vector $\tau=(\tau_{1}, \cdots, \tau_{N})$ . For the lower bound, we explicitly show the achievability of $\begin{pmatrix} M+N-1 M \end{pmatrix}$ corner points. For the remaining traffic ratio vectors, we perform time-sharing between these corner points. The recursive structure of our achievability scheme is captured via a system of difference equations. The upper and lower bounds exactly match for $M=2$ and $M=3$ for any $N$ and any $\tau$ .

This paper is eligible for the Jack Keil Wolf ISIT Student Paper Award. In this work, a flexible and robust private information retrieval (PIR) scheme based on binary non-maximum distance separable (non-MDS) codes is considered. This combines previous works on PIR schemes based on transitive non-MDS codes on one hand, and PIR from MDS-coded Byzantine and nonresponsive servers on the other hand. More specifically, a PIR scheme employing binary Reed–Muller (RM) codes tolerant to colluding, Byzantine, and non-responsive servers is constructed, and bounds for the achievable rates are derived under certain conditions. The construction of such schemes turns out to be much more involved than for MDS codes. Namely, the binary query vectors have to be selected with great care to hit the desired information sets, which is technically challenging as will be shown.

We consider the problem of Private Information Retrieval with Private Side Information (PIR-PSI), wherein the privacy of the demand and the side information are jointly preserved. Although the capacity of the PIR-PSI setting is known, we observe that the underlying capacity-achieving code construction uses Maximum Distance Separable (MDS) codes therefore contributing to high computational complexity when retrieving the demand. Pointing at this drawback of MDS-based PIR-PSI codes, we propose XOR-based PIR-PSI codes for a simple yet non-trivial setting of two non-colluding databases and two side information files at the user. Although our codes offer substantial reduction in complexity when compared to MDS-based codes, the code-rate marginally falls short of the capacity of the PIR-PSI setting. Nevertheless, we show that our code-rate is strictly higher than that of XOR-based codes for PIR with no side information. As a result, our codes can be useful when privately downloading a file especially after having downloaded a few other messages privately from the same database at an earlier time-instant.

We present lower bounds for the static cryptographic data structure problem of single-server private information retrieval (PIR). PIR considers the setting where a server holds a database of n entries and a client wishes to privately retrieve the i-th entry without revealing the index i to the server. In our work, we focus on PIR with preprocessing where an r-bit hint may be computed in a preprocessing stage and stored by the server to be used to perform private queries in expected time t. As our main result, we prove that for any single-server, computationally secure PIR with preprocessing, it must be that tr = Ω(n log n) when r = Ω(log n). If r = O(log n), then we show that t = Ω(n). Our lower bound holds even when the scheme errs with probability 1/n2 and the adversary's distinguishing advantage is 1/n. Our work improves upon the tr = Ω(n) lower bound of Beimel, Ishai and Malkin [JoC'04]. For information-theoretic security, we present a stronger lower bound of t + r = Ω(n) and show a matching construction. Both our lower bounds apply for public-key doubly-efficient PIRs of Boyle, Ishai, Pass and Wootters [TCC'17]. Additionally, our lower bound for information-theoretic security also applies for offline-online PIRs as defined by Corrigan-Gibbs and Kogan [Eurocrypt'20], where the hint is private and only viewed by the client. We prove our lower bounds in a variant of the cell probe model where only accesses to the database are charged cost and computation and accesses to the hint are free. Our main technical contribution is a novel use of the cell sampling technique (also known as the incompressibility technique) used to obtain lower bounds on data structures. In previous works, this technique only leveraged the correctness guarantees to prove lower bounds even when used for cryptographic primitives. Our work combines the cell sampling technique with the privacy guarantees of PIR to construct a powerful, polynomial-time adversary that is critical to proving our higher lower bounds.

While the users retrieve valuable information on the internet, the protection of users' privacy from a database server was not considered feasible until the private information retrieval (PIR) problem was stated and solved. A PIR scheme allows a user to retrieve a data item from an online database while hiding the identity of the item from a database server. In this paper, a new PIR scheme combined with mutual authentication by RSA signature algorithm for protecting the privacy of users is proposed. Using only one server and including the mutual authentication process in the proposed scheme, it is more secure and more practical in the real application compared with previous PIR solutions.

In the e-commerce environment, the protection of users' privacy from a server was not considered feasible until the private information retrieval (PIR) problem was stated and solved. A PIR scheme allows a user to retrieve a data item from an online database while hiding the identity of the item from a database server. In 1995, Chor et al. stated private information retrieval (PIR) problem and proposed k-server solutions which replicate the same database on the k servers. In 1997, Kushilevitz et al. proposed a PIR scheme based on the quadratic-residue assumption using only one server (one database - database replication is not needed). The scheme can simplifies multi-server management and reduce costs. In this paper, we point out that Kushilevitz's PIR scheme will let the user get much more information than he/she should get in one query of the database.

A private information retrieval (PIR) scheme on coded storage systems with colluding, byzantine, and non-responsive servers is presented. Furthermore, the scheme can also be used for symmetric PIR in the same setting. An explicit scheme using an [n, k] generalized Reed-Solomon storage code is designed, protecting against t-collusion and handling up to b byzantine and r non-responsive servers, when n ≥ n <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1'</sup> =(ν+1)k+t+2b+r-1, for some integer ν ≥ 1. This scheme achieves a PIR rate of 1-[(k+2b+t+r-1)/(n <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">'</sup> -r)]. In the case where the capacity is known, namely when k=1, it is asymptotically capacity achieving as the number of files grows.

In a typical formulation of the private information retrieval (PIR) problem, a single user wishes to retrieve one out of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$ K$ </tex-math></inline-formula> files from N servers without revealing the demanded file index to any server. This paper formulates an extended model of PIR, referred to as multi-message private computation (MM-PC), where instead of retrieving a single file, the user wishes to retrieve <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$P\gt 1$ </tex-math></inline-formula> linear combinations of files while preserving the privacy of the demand information. The MM-PC problem is a generalization of the private computation (PC) problem (where the user requests one linear combination of the files), and the multi-message private information retrieval (MM-PIR) problem (where the user requests <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$P\gt 1$ </tex-math></inline-formula> files). A baseline achievable scheme repeats the optimal PC scheme by Sun and Jafar P times, or treats each possible demanded linear combination as an independent file and then uses the near optimal MM-PIR scheme by Banawan and Ulukus. In this paper, we propose a new MM-PC scheme that significantly improves upon the baseline schemes. In doing so, we design the queries inspired by the structure in the cache-aided scalar linear function retrieval scheme by Wan et al., which leverages the dependency between linear functions to reduce the amount of communications. To ensure the decodability of our scheme, we propose a new method to benefit from the existing dependency, referred to as the sign assignment step. In the end, we use Maximum Distance Separable matrices to code the queries, which allows the reduction of download from the servers, while preserving privacy. By the proposed schemes, we characterize the capacity within a multiplicative factor of 2.

Outsourcing database as service instead of using in-house database management is a new trend emerging in a computing industry; there has been growing interest in outsourcing database services in both the commercial world and the research community. In this paper, we present analysis of non-concurrent model of fast single-database Private Information Retrieval (PIR) scheme for maintaining data privacy with data confidentiality using encryption algorithm like AES for Outsourced Database Service (ODBS) Model. In this model encryption method maintains data confidentiality and a utility that help to create PIR reply which maintains data privacy. In PIR Scheme data privacy is achieved by adding noise data into the result of a typical query which is called as PIR reply. Single-database PIR schemes are generally not practical because of its expensiveness from computational point of view. Here we propose a model that suggests the use of General-Purpose computation using Graphic Processing Units (GPGPU) commodity to process such type of computationally intensive operations. This model will help to achieve practical implementation of single-database PIR scheme which uses encryption algorithm to maintain data confidentiality as secondary goal and it serves to create database reply to maintain data privacy as primary goal. This paper shows some real time results that proves need of concurrency in PIR algorithms. It also describes the use of lattice based single-database PIR protocol with GPGPU as a processing unit to achieve high speed-up and hence, the performance of the system.

Private information retrieval (PIR) is a cryptographic primitive that facilitates the seemingly impossible task of letting users fetch records from untrusted and remote database servers without revealing to those servers which records are being fetched. The research literature on PIR is vast; the over two decades since its 1995 introduction by Chor, Goldreich, Kushilevitz, and Sudan, the cryptography, privacy, and theoretical computer science research communities have studied PIR intensively and from a variety of perspectives. Alas, despite a series of significant advances, most privacy practitioners and theoreticians alike fall into one of two camps: (i) those who believe that PIR is so inefficient and abstruse as to make it all-but-useless practice, and (ii) those who remain blissfully unaware that PIR even exists. Indeed, to date not even one of the numerous PIR-based applications proposed the research literature has been deployed at scale to protect the privacy of users in the wild. This tutorial targets both of the above camps, presenting a bird's-eye overview of the current state of PIR research. Topics covered will span the spectrum from purely theoretical through imminently applicable and all the high points between, thereby providing participants with an awareness of what modern PIR techniques have (and do not have) to offer, dispelling the myth of PIR's inherent impracticality, and hopefully inspiring participants to identify practical use cases for PIR within their own niche areas of expertise. This introductory tutorial will be accessible to anyone comfortable with college-level mathematics (basic linear algebra and some elementary probability and number theory).

Information-theoretic formulations of the private information retrieval (PIR) problem have been investigated under a variety of scenarios. Symmetric private information retrieval (SPIR) is a variant where a user is able to privately retrieve one out of K messages from N non-colluding replicated databases without learning anything about the remaining K-1 messages. However, the goal of perfect privacy can be too taxing for certain applications. In this paper, we investigate if the information-theoretic capacity of SPIR (equivalently, the inverse of the minimum download cost) can be increased by relaxing both user and DB privacy definitions. Such relaxation is relevant in applications where privacy can be traded for communication efficiency. We introduce and investigate the Asymmetric Leaky PIR (AL-PIR) model with different privacy leakage budgets in each direction. For user privacy leakage, we bound the probability ratios between all possible realizations of DB queries by a function of a non-negative constant ϵ. For DB privacy, we bound the mutual information between the undesired messages, the queries, and the answers, by a function of a non-negative constant δ. We propose a general AL-PIR scheme that achieves an upper bound on the optimal download cost for arbitrary ϵ and δ. We show that the optimal download cost of AL-PIR is upper-bounded as D <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">*</sup> (ϵ,δ) ≤ 1+\frac 1N-1-\frac δe <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ϵ</sup> N <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">K-1</sup> -1. Second, we obtain an information-theoretic lower bound on the download cost as D <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">*</sup> (ϵ,δ) ≥ 1+\frac 1Ne <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ϵ</sup> -1-\frac δ(Ne <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ϵ</sup> ) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">K-1</sup> -1. The gap analysis between the two bounds shows that our AL-PIR scheme is optimal when ϵ = 0, i.e., under perfect user privacy and it is optimal within a maximum multiplicative gap of \frac N-e <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-ϵ</sup> N-1 for any ϵ > 0 and δ > 0.

Private information retrieval (PIR) protocols allow a user to retrieve a data item from a database without revealing any information about the identity of the item being retrieved. Specifically, in information-theoretic k-server PIR, the database is replicated among k non-communicating servers, and each server learns nothing about the item retrieved by the user. The cost of PIR protocols is usually measured in terms of their communication complexity, which is the total number of bits exchanged between the user and the servers. However, another important cost parameter is the storage overhead, which is the ratio between the total number of bits stored on all the servers and the number of bits in the database. Since single-server information-theoretic PIR is impossible, the storage overhead of all existing PIR protocols is at least 2 (or k, in the case of k-server PIR). In this work, we show that information-theoretic PIR can be achieved with storage overhead arbitrarily close to the optimal value of 1, without sacrificing the communication complexity. Specifically, we prove that all known k-server PIR protocols can be efficiently emulated, while preserving both privacy and communication complexity but significantly reducing the storage overhead. To this end, we distribute the n bits of the database among s + r servers, each storing n/s coded bits (rather than replicas). Notably, our coding scheme remains the same, regardless of the specific k-server PIR protocol being emulated. For every fixed k, the resulting storage overhead (s +r)/s approaches 1 as s grows; explicitly we have equation. Moreover, in the special case k = 2, the storage overhead is only 1 + 1/s. In order to achieve these results, we introduce and study a new kind of binary linear codes, called here k-server PIR codes. Finally, we show how such codes can be constructed from multidimensional cubic, from Steiner systems, and from one-step majority-logic decodable codes.

We consider information-theoretical private information retrieval (PIR) from a coded database with colluding servers. We target, for the first time, locally repairable storage codes (LRCs). We consider any number of local groups g, locality r, local distance δ and dimension k. Our main contribution is a PIR scheme for maximally recoverable (MR) LRCs based on linearized Reed–Solomon codes, which achieve the smallest field sizes among MR-LRCs for many parameter regimes. In our scheme, nodes are identified with codeword symbols and servers are identified with local groups of nodes. Only locally non-redundant information is downloaded from each server, that is, only r nodes (out of r+δ−1) are downloaded per server. The PIR scheme achieves the (download) rate R=(N−k−rt+1)/N, where N=gr is the length of the MDS code obtained after removing the local parities, and for any t colluding servers such that k+rt≤N. For an unbounded number of stored files, the obtained rate is strictly larger than those of known PIR schemes that work for any MDS code. Finally, the obtained PIR scheme can also be adapted when communication between the user and each server is performed via linear network coding, achieving the same rate as previous PIR schemes for this scenario but with polynomial finite field sizes, instead of exponential. Our rates are equal to those of PIR schemes for Reed–Solomon codes, but Reed–Solomon codes are incompatible with the MR-LRC property or linear network coding, thus our PIR scheme is less restrictive in its applications.