Private Information Retrieval Research Articles

A probabilistic separation logic

Probabilistic independence is a useful concept for describing the result of random sampling—a basic operation in all probabilistic languages—and for reasoning about groups of random variables. Nevertheless, existing verification methods handle independence poorly, if at all. We propose a probabili stic separation logic PSL, where separation models probabilistic independence. We first give a new, probabilistic model of the logic of bunched implications (BI). We then build a program logic based on these assertions, and prove soundness of the proof system. We demonstrate our logic by verifying information-theoretic security of cryptographic constructions for several well-known tasks, including private information retrieval, oblivious transfer, secure multi-party addition, and simple oblivious RAM. Our proofs reason purely in terms of high-level properties, like independence and uniformity.

One-Shot PIR: Refinement and Lifting

We study a class of private information retrieval (PIR) methods that we call one-shot schemes. The intuition behind one-shot schemes is the following. The user’s query is regarded as a dot product of a query vector and the message vector (database) stored at multiple servers. Privacy, in an information theoretic sense, is then achieved by encrypting the query vector using a secure linear code, such as secret sharing. Several PIR schemes in the literature, in addition to novel ones constructed here, fall into this class. One-shot schemes provide an insightful link between PIR and data security against eavesdropping. However, their download rate is not optimal, i.e., they do not achieve the PIR capacity. Our main contribution is two transformations of one-shot schemes, which we call refining and lifting. We show that refining and lifting one-shot schemes gives capacity-achieving schemes for the cases when the PIR capacity is known. In the other cases, when the PIR capacity is still unknown, refining and lifting one-shot schemes gives, for most parameters, the best download rate so far.

The Capacity of Private Information Retrieval With Private Side Information Under Storage Constraints

We consider the problem of private information retrieval (PIR) of a single message out of $K$ messages from $N$ replicated and non-colluding databases where a cache-enabled user (retriever) of cache-size $S$ possesses side information in the form of uncoded portions of the messages where the message identities are unknown to the databases. The identities of these side information messages need to be kept private from the databases, i.e., we consider PIR with private side information (PSI). We characterize the optimal normalized download cost for this PIR-PSI problem under the storage constraint $S$ as $D^{*}=1+\frac {1}{N}+\frac {1}{N^{2}}+ {\dots }+\frac {1}{N^{K-1-M}}+ \frac {1-r_{M}}{N^{K-M}}+\frac {1-r_{M-1}}{N^{K-M+1}}+ {\dots }+\frac {1-r_{1}}{N^{K-1}}$ , where $M$ is the number of side information messages and $r_{i}$ is the portion of the $i$ th side information message that is cached with $\sum _{i=1}^{M} r_{i}=S$ . Based on this capacity result, we prove two facts: First, for a fixed memory size $S$ and a fixed number of accessible messages $M$ , uniform caching achieves the lowest normalized download cost, i.e., $r_{i}=\frac {S}{M}$ , for $i=1, {\dots }, M$ , is optimum. Second, for a fixed memory size $S$ , among all possible $K-\left \lceil{ {S} }\right \rceil +1$ uniform caching schemes, the uniform caching scheme which caches $M=K$ messages achieves the lowest normalized download cost.

Private Information Retrieval in Graph-Based Replication Systems

In a Private Information Retrieval (PIR) protocol, a user can download a file from a database without revealing the identity of the file to each individual server. A PIR protocol is called $t$ -private if the identity of the file remains concealed even if $t$ of the servers collude. Graph based replication is a simple technique, which is prevalent in both theory and practice, for achieving robustness in storage systems. In this technique each file is replicated on two or more storage servers, giving rise to a (hyper-)graph structure. In this paper we study private information retrieval protocols in graph based replication systems. The main interest of this work is understanding the collusion structures which emerge in the underlying graph. Our main contribution is a 2-replication scheme which guarantees perfect privacy from acyclic sets in the graph, and guarantees partial-privacy in the presence of cycles. Furthermore, by providing an upper bound, it is shown that the PIR rate of this scheme is at most a factor of two from its optimal value for regular graphs. Lastly, we extend our results to larger replication factors and to graph-based coding, a generalization of graph based replication that induces smaller storage overhead and larger PIR rate in many cases.

Location Privacy in Cognitive Radios With Multi-Server Private Information Retrieval

Spectrum database-based cognitive radio networks (CRNs) have become the de facto approach for enabling unlicensed secondary users (SUs) to identify spectrum vacancies in channels owned by licensed primary users (PUs). Despite its merits, the use of spectrum databases incurs privacy concerns for both SUs and PUs. Single-server private information retrieval (PIR) has been used as the main tool to address this problem. However, such techniques incur extremely large communication and computation overheads while offering only computational privacy. Besides, some of these PIR protocols have been broken. In this paper, we show that it is possible to achieve high efficiency and (information-theoretic) privacy for both PUs and SUs in database-driven CRN with multi-server PIR. Our key observation is that, by design, database-driven CRNs comprise multiple databases that are required, by the Federal Communications Commission, to synchronize their records. To the best of our knowledge, we are the first to exploit this observation to harness multi-server PIR technology to guarantee an optimal privacy for both SUs and PUs, thanks to the unique properties of database-driven CRN . We showed, analytically and empirically with deployments on actual cloud systems, that multi-server PIR is an ideal tool to provide efficient location privacy in database-driven CRN.

Noisy Private Information Retrieval: On Separability of Channel Coding and Information Retrieval

We consider the problem of noisy private information retrieval (NPIR) from $N$ non-communicating databases, each storing the same set of $M$ messages. In this model, the answer strings are not returned through noiseless bit pipes, but rather through noisy memoryless channels. We aim at characterizing the PIR capacity for this model as a function of the statistical information measures of the noisy channels such as entropy and mutual information. We derive a general upper bound for the retrieval rate in the form of a max-min optimization. We use the achievable schemes for the PIR problem under asymmetric traffic constraints and random coding arguments to derive a general lower bound for the retrieval rate. The upper and lower bounds match for $M=2$ and $M=3$ , for any $N$ , and any noisy channel. The lower and upper bounds show a separation between channel coding and retrieval scheme except for adapting the traffic ratio from the databases. We refer to this as almost separation . Next, we consider the private information retrieval problem from multiple access channels (MAC-PIR). In MAC-PIR, the database responses reach the user through a multiple access channel (MAC) that mixes the responses together in a stochastic way. We show that for the additive MAC and the conjunction/disjunction MAC, channel coding and retrieval scheme are inseparable unlike in NPIR. We show that the retrieval scheme depends on the properties of the MAC, in particular on the linearity aspect. For both cases, we provide schemes that achieve the full capacity without any loss due to the privacy constraint, which implies that the user can exploit the nature of the channel to improve privacy. Finally, we show that the full unconstrained capacity is not always attainable by determining the capacity of the selection channel.

The Capacity of Private Information Retrieval With Partially Known Private Side Information

We consider the problem of private information retrieval (PIR) of a single message out of $K$ messages from $N$ replicated and non-colluding databases where a cache-enabled user (retriever) of cache-size $M$ possesses side information in the form of full messages that are partially known to the databases. In this model, the user and the databases engage in a two-phase scheme, namely, the prefetching phase where the user acquires side information and the retrieval phase where the user downloads desired information. In the prefetching phase, the user receives $m_{n}$ full messages from the $n$ th database, under the cache memory size constraint $\sum _{n=1}^{N} m_{n} \leq M$ . In the retrieval phase, the user wishes to retrieve a message (which is not present in its memory) such that no individual database learns anything about the identity of the desired message. In addition, the identities of the side information messages that the user did not prefetch from a database must remain private against that database. Since the side information provided by each database in the prefetching phase is known by the providing database and the side information must be kept private against the remaining databases, we coin this model as partially known private side information . We characterize the capacity of the PIR with partially known private side information to be $C=\left ({1+\frac {1}{N}+\cdots +\frac {1}{N^{K-M-1}}}\right)^{-1}=\frac {1-\frac {1}{N}}{1-\left({\frac {1}{N}}\right)^{K-M}}$ . Interestingly, this result is the same if none of the databases knows any of the prefetched side information, i.e., when the side information is obtained externally, a problem posed by Kadhe et al. and settled by Chen-Wang-Jafar recently. Thus, our result implies that there is no loss in using the same databases for both prefetching and retrieval phases.

The Capacity of Private Information Retrieval from Decentralized Uncoded Caching Databases

We consider the private information retrieval (PIR) problem from decentralized uncoded caching databases. There are two phases in our problem setting, a caching phase, and a retrieval phase. In the caching phase, a data center containing all the K files, where each file is of size L bits, and several databases with storage size constraint μ K L bits exist in the system. Each database independently chooses μ K L bits out of the total K L bits from the data center to cache through the same probability distribution in a decentralized manner. In the retrieval phase, a user (retriever) accesses N databases in addition to the data center, and wishes to retrieve a desired file privately. We characterize the optimal normalized download cost to be D * = ∑ n = 1 N + 1 N n - 1 μ n - 1 ( 1 - μ ) N + 1 - n 1 + 1 n + ⋯ + 1 n K - 1 . We show that uniform and random caching scheme which is originally proposed for decentralized coded caching by Maddah-Ali and Niesen, along with Sun and Jafar retrieval scheme which is originally proposed for PIR from replicated databases surprisingly results in the lowest normalized download cost. This is the decentralized counterpart of the recent result of Attia, Kumar, and Tandon for the centralized case. The converse proof contains several ingredients such as interference lower bound, induction lemma, replacing queries and answering string random variables with the content of distributed databases, the nature of decentralized uncoded caching databases, and bit marginalization of joint caching distributions.

Private Information Retrieval With Side Information

We study the problem of Private Information Retrieval (PIR) in the presence of prior side information. The problem setup includes a database of $K$ independent messages possibly replicated on several servers, and a user that needs to retrieve one of these messages. In addition, the user has some prior side information in the form of a subset of $M$ messages, not containing the desired message and unknown to the servers. This problem is motivated by practical settings in which the user can obtain side information opportunistically from other users or has previously downloaded some messages using classical PIR schemes. The objective of the user is to retrieve the required message with downloading minimum amount of data from the servers while achieving information-theoretic privacy in one of the following two scenarios: (i) the user wants to protect jointly the identities of the demand and the side information; (ii) the user wants to protect only the identity of the demand, but not necessarily the side information. To highlight the role of side information, we focus first on the case of a single server (single database). In the first scenario, we prove that the minimum download cost is $K-M$ messages, and in the second scenario it is $\lceil K/(M+1)\rceil $ messages, which should be compared to $K$ messages—the minimum download cost in the case of no side information. Then, we extend some of our results to the case of the database replicated on multiple servers. Our proof techniques relate PIR with side information to the index coding problem. We leverage this connection to prove converse results, as well as to design achievability schemes.

Asymmetry Hurts: Private Information Retrieval Under Asymmetric Traffic Constraints

We consider the classical setting of private information retrieval (PIR) of a single message (file) out of $M$ messages from $N$ distributed databases under the new constraint of asymmetric traffic from databases. In this problem, the ratios between the traffic from the databases are constrained, i.e., the ratio of the length of the answer string that the user (retriever) receives from the $n$ th database to the total length of all answer strings from all databases is constrained to be $\tau _{n}$ . This may happen if the user’s access to the databases is restricted due to database availability, channel quality to the databases, and other factors. For this problem, for fixed $M$ , $N$ , we develop a general upper bound $\bar {C}({\boldsymbol {\tau }})$ , which generalizes the converse proof of Sun-Jafar, where database symmetry was inherently used. Our converse bound is a piece-wise affine function in the traffic ratio vector ${\boldsymbol {\tau }}=(\tau _{1}, \cdots , \tau _{N})$ . For the lower bound, we explicitly show the achievability of $\binom {M+N-1}{M}$ corner points. For the remaining traffic ratio vectors, we perform time-sharing between these corner points. The recursive structure of our achievability scheme is captured via a system of difference equations. The upper and lower bounds exactly match for $M=2$ and $M=3$ for any $N$ and any ${\boldsymbol {\tau }}$ . The results show strict loss of PIR capacity due to the asymmetric traffic constraints compared with the symmetric case of Sun-Jafar which implicitly uses $\tau _{n}=\frac {1}{N}$ for all $n$ .

Capacity-Achieving Private Information Retrieval Codes With Optimal Message Size and Upload Cost

We propose a new capacity-achieving code for the private information retrieval (PIR) problem, and show that it has the minimum message size (being one less than the number of servers) and the minimum upload cost (being roughly linear in the number of messages) among a general class of capacity-achieving codes, and in particular, among all capacity-achieving linear codes. Different from existing code constructions, the proposed code is asymmetric, and this asymmetry appears to be the key factor leading to the optimal message size and the optimal upload cost. The converse results on the message size and the upload cost are obtained by an analysis of the information theoretic proof of the PIR capacity, from which a set of critical properties of any capacity-achieving code in the code class of interest is extracted. The symmetry structure of the PIR problem is then analyzed, which allows us to construct symmetric codes from asymmetric ones, yielding a meaningful bridge between the proposed code and existing ones in the literature.

Private Secure Coded Computation

We present private secure coded computation that ensures both the master’s privacy and data security against the workers, where the master aims to compute a function of its private data and a specific data in a library exclusively owned by the external workers. For privacy, the master should conceal the index of the specific data in the library against the workers. For security, the master should encrypt its private data. As an achievable scheme, we propose private secure polynomial codes and compare the proposed scheme with private polynomial codes in private coded computation and the optimal scheme of robust private information retrieval (RPIR).

Ramp secret sharing with cheater identification in presence of rushing cheaters

Abstract Secret sharing allows one to share a piece of information among n participants in a way that only qualified subsets of participants can recover the secret whereas others cannot. Some of these participants involved may, however, want to forge their shares of the secret(s) in order to cheat other participants. Various cheater identifiable techniques have been devised in order to identify such cheaters in secret sharing schemes. On the other hand, Ramp secret sharing schemes are a practically efficient variant of usual secret sharing schemes with reduced share size and some loss in security. Ramp secret sharing schemes have many applications in secure information storage, information-theoretic private information retrieval and secret image sharing due to producing relatively smaller shares. However, to the best of our knowledge, there does not exist any cheater identifiable ramp secret sharing scheme. In this paper we define the security model for cheater identifiable ramp secret sharing schemes and provide two constructions for cheater identifiable ramp secret sharing schemes. In addition, the second construction is secure against rushing cheaters who are allowed to submit their shares during secret reconstruction after observing other participants’ responses in one round. Also, we do not make any computational assumptions for the cheaters, i.e., cheaters may be equipped with unlimited time and resources, yet, the cheating probability would be bounded above by a very small positive number.

PIR Array Codes With Optimal Virtual Server Rate

There has been much recent interest in private information retrieval (PIR) in models where a database is stored across several servers using coding techniques from distributed storage, rather than being a simply replicated. In particular, a recent breakthrough result of Fazelli, Vardy, and Yaakobi introduces the notion of a PIR code and a PIR array code, and uses this notion to produce efficient PIR protocols. In this paper, we are interested in designing PIR array codes. We consider the case when we have $m$ servers, with each server storing a fraction $(1/s)$ of the bits of the database; here $s$ is a fixed rational number with $s > 1$ . A PIR array code with the $k$ -PIR property enables a $k$ -server PIR protocol (with $k\leq m$ ) to be emulated on $m$ servers, with the overall storage requirements of the protocol being reduced. The communication complexity of a PIR protocol reduces as $k$ grows, so the virtual server rate , defined to be $k/m$ , is an important parameter. We study the maximum virtual server rate of a PIR array code with the $k$ -PIR property. We present upper bounds on the achievable virtual server rate, some constructions, and ideas how to obtain the PIR array codes with the highest possible virtual server rate. In particular, we present constructions that asymptotically meet our upper bounds and the exact largest virtual server rate is obtained when $1 . A $k$ -PIR code (and similarly a $k$ -PIR array code) is also a locally repairable code with symbol availability $k-1$ . Such a code ensures $k$ parallel reads for each information symbol. So the virtual server rate is very closely related to the symbol availability of the code when used as a locally repairable code. The results of this paper are discussed also in this context where subspace codes also have an important role.

PIR Schemes With Small Download Complexity and Low Storage Requirements

In the classical model for (information theoretically secure) Private Information Retrieval (PIR) due to Chor, Goldreich, Kushilevitz and Sudan, a user wishes to retrieve one bit of a database that is stored on a set of ${n}$ servers, in such a way that no individual server gains information about which bit the user is interested in. The aim is to design schemes that minimise the total communication between the user and the servers. More recently, there have been moves to consider more realistic models where the total storage of the set of servers, or the per server storage, should be minimised (possibly using techniques from distributed storage), and where the database is divided into ${R}$ -bit records with ${R}>1$ , and the user wishes to retrieve one record rather than one bit. When ${R}$ is large, downloads from the servers to the user dominate the communication complexity and so the aim is to minimise the total number of downloaded bits. Work of Shah, Rashmi and Ramchandran shows that at least ${R}+1$ bits must be downloaded from servers in the worst case, and provides PIR schemes meeting this bound. Sun and Jafar have considered the download cost of a scheme, defined as the ratio of the message length ${R}$ and the total number of bits downloaded. They determine the best asymptotic download cost of a PIR scheme (as ${R}\rightarrow \infty $ ) when a database of ${k}$ messages is stored by ${n}$ servers. This paper provides various bounds on the download complexity of a PIR scheme, generalising those of Shah et al. to the case when the number ${n}$ of servers is bounded, and providing links with classical techniques due to Chor et al. The paper also provides a range of constructions for PIR schemes that are either simpler or perform better than previously known schemes. These constructions include explicit schemes that achieve the best asymptotic download complexity of Sun and Jafar with significantly lower upload complexity, and general techniques for constructing a scheme with good worst case download complexity from a scheme with good download complexity on average.

Private Coded Matrix Multiplication

In distributed computing system for the master-worker framework, an erasure code is able to mitigate the effects of slow workers, also called stragglers. The distributed computing system combined with coding is referred to as coded computation . For a matrix multiplication, we consider a variation of coded computation that ensures the master’s privacy from the workers, which is referred to as private coded matrix multiplication . In the private coded matrix multiplication, the master needs to compute a matrix multiplication on its own matrix and one of the matrices in a library exclusively shared by the external workers. After the master recovers the matrix multiplication through coded matrix multiplication, the workers should not know which matrix in the library was desired by the master, which implies that the master’s privacy is ensured. Our problem is a special case of linear private computation , where a linear combination of matrices in the library should be concealed. We propose a private coded matrix multiplication scheme, based on the conventional coded matrix multiplication scheme. In terms of computation time and communication load, we compare our proposed scheme with a conventional robust private information retrieval scheme and private computation schemes.

An Efficient Fully Homomorphic Encryption Scheme for Private Information Retrieval in the Cloud

Information retrieval in the cloud is common and convenient. Nevertheless, privacy concerns should not be ignored as the cloud is not fully trustable. Fully Homomorphic Encryption (FHE) allows arbitrary operations to be performed on encrypted data, where the decryption of the result of ciphertext operation equals that of the corresponding plaintext operation. Thus, FHE schemes can be utilized for private information retrieval (PIR) on encrypted data. In the FHE scheme proposed by Ducas and Micciancio (DM), only a single homomorphic NOT AND (NAND) operation is allowed between consecutive ciphertext refreshings. Aiming at this problem, an improved FHE scheme is proposed for efficient PIR where homomorphic additions and multiplications are based on linear operations on ciphertext vectors. Theoretical analysis shows that when compared with the DM scheme, the proposed scheme allows multiple homomorphic additions and a single homomorphic multiplication to be performed. The number of allowed homomorphic additions is determined by the ratio of the ciphertext modulus to the upper bound of initial ciphertext noise. Moreover, simulation results show that the proposed scheme is significantly faster than the DM scheme in the homomorphic evaluation for a series of algorithms.

A New Capacity-Achieving Private Information Retrieval Scheme With (Almost) Optimal File Length for Coded Servers

In a distributed storage system, private information retrieval (PIR) guarantees that a user retrieves one file from the system without revealing any information about the identity of its interested file to any individual server. In this paper, we investigate an $(N,K,M)$ coded server model of PIR, where each of $M$ files is distributed to $N$ servers in the form of $(N,K)$ maximum distance separable (MDS) code for some $N>K$ and $M>1$ . As a result, we propose a new capacity-achieving $(N,K,M)$ coded linear PIR scheme such that it can be implemented with file length $\frac {K(N-K)}{\gcd (N,K)}$ , which is much smaller than the previous best result $K\left({\frac {N}{\gcd (N,K)}}\right)^{M-1}$ . Notably, among all the capacity-achieving coded linear PIR schemes, we show that the file length is optimal if $M>\big \lfloor \frac {K}{\gcd (N,K)}-\frac {K}{N-K}\big \rfloor +1$ or $\min (K,N-K)|N$ , and within a multiplicative gap $\frac {\min (K,N-K)}{\gcd (N,K)}$ of a lower bound on the minimum file length otherwise.

On Private Information Retrieval Array Codes

Given a database, the private information retrieval (PIR) protocol allows a user to make queries to several servers and retrieve a certain item of the database via the feedbacks, without revealing the privacy of the specific item to any single server. Classical models of PIR protocols require that each server stores a whole copy of the database. Recently new PIR models are proposed with coding techniques arising from distributed storage system. In these new models each server only stores a fraction $1/s$ of the whole database, where $s>1$ is a given rational number. PIR array codes are recently proposed by Fazeli, Vardy and Yaakobi to characterize the new models. Consider a PIR array code with $m$ servers and the $k$-PIR property (which indicates that these $m$ servers may emulate any efficient $k$-PIR protocol). The central problem is to design PIR array codes with optimal rate $k/m$. Our contribution to this problem is three-fold. First, for the case $1<s\le 2$, although PIR array codes with optimal rate have been constructed recently by Blackburn and Etzion, the number of servers in their construction is impractically large. We determine the minimum number of servers admitting the existence of a PIR array code with optimal rate for a certain range of parameters. Second, for the case $s>2$, we derive a new upper bound on the rate of a PIR array code. Finally, for the case $s>2$, we analyze a new construction by Blackburn and Etzion and show that its rate is better than all the other existing constructions.

Cross Subspace Alignment and the Asymptotic Capacity of $X$ -Secure $T$ -Private Information Retrieval

X-secure and T-private information retrieval (XSTPIR) is a form of private information retrieval where data security is guaranteed against collusion among up to X servers and the user's privacy is guaranteed against collusion among up to T servers. The capacity of XSTPIR is characterized for an arbitrary number of servers N and arbitrary security and privacy thresholds X and T, in the limit as the number of messages K → ∞. Capacity is also characterized for any number of messages if either N = 3, X = T = 1 or if N ≤ X +T. Insights are drawn from these results, about aligning versus decoding noise, dependence of PIR rate on field size, and robustness to symmetric security constraints. In particular, the idea of cross subspace alignment, i.e., introducing a subspace dependence between Reed-Solomon code parameters, emerges as the optimal way to align undesired terms while keeping desired terms resolvable.