Information-theoretic Private Information Retrieval Research Articles

Parallel private information retrieval protocol with index anonymity for untrusted databases

Private information retrieval (PIR) enables a client to search data from a single (or multiple) untrusted server, without revealing which entry was queried. PIR can be divided into two categories: information-theoretic PIR (IT-PIR) and computational PIR (CPIR). However, there is a deployment challenge with IT-PIR because the non-collusion assumption is difficult to implement in practice. Meanwhile, due to the fact that CPIR involves performing cryptographic operations on each element, its performance significantly decreases as the size and number of database entries increase. To overcome these problems, based on homomorphic encryption, this paper presents a parallel PIR (ParPIR) with index anonymity for untrusted databases, which uses the batch encoding to compress request size. Furthermore, our ParPIR eliminates computationally expensive ciphertext multiplication operations, which improves the response time. Moreover, our ParPIR packs multiple responses through rotation column operations on ciphertext, thereby reducing the response size. Compared to previous PIR protocols, the offline time in our ParPIR has almost 1∼63× improvement; the online time in our ParPIR decreases by at least 49.9∼98.9%. Meanwhile, although the request size of our ParPIR has a 0∼31× increase, the response size of our ParPIR has a 0∼4095× improvement.

The Capacity of Single-Server Weakly-Private Information Retrieval

A private information retrieval (PIR) protocol guarantees that a user can privately retrieve files stored in a database without revealing any information about the identity of the requested file. Existing information-theoretic PIR protocols ensure perfect privacy, i.e., zero information leakage to the servers storing the database, but at the cost of high download. In this work, we present weakly-private information retrieval (WPIR) schemes that trade off perfect privacy to improve the download cost when the database is stored on a single server. We study the tradeoff between the download cost and information leakage in terms of mutual information (MI) and maximal leakage (MaxL) privacy metrics. By relating the WPIR problem to rate-distortion theory, the download-leakage function, which is defined as the minimum required download cost of all single-server WPIR schemes for a given level of information leakage and a fixed file size, is introduced. By characterizing the download-leakage function for the MI and MaxL metrics, the capacity of single-server WPIR is fully described.

Private Streaming With Convolutional Codes

Recently, information-theoretic private information retrieval (PIR) from coded storage systems has gained a lot of attention, and a general star product PIR scheme was proposed. In this paper, the star product scheme is adopted, with appropriate modifications, to the case of private ( e.g. , video) streaming. It is assumed that the files to be streamed are stored on $n$ servers in a coded form, and the streaming is carried out via a convolutional code. The star product scheme is defined for this special case, and various properties are analyzed for two channel models related to straggling and Byzantine servers, both in the baseline case as well as with colluding servers. The achieved PIR rates for the given models are derived and, for the cases where the capacity is known, the first model is shown to be asymptotically optimal, when the number of stripes in a file is large. The second scheme introduced in this work is shown to be the equivalent of block convolutional codes in the PIR setting. For the Byzantine server model, it is shown to outperform the trivial scheme of downloading stripes of the desired file separately without memory.

Towards Efficient Information-Theoretic Function Secret Sharing

A $(t,r)$ -function secret sharing ( $(t,r)$ -FSS) scheme allows a dealer to secret-share a function $f$ among $r$ parties as $r$ secret keys $k_{1},\ldots,k_{r}$ such that for any input $x$ the parties can compute $r$ output shares that allow the reconstruction of $f(x)$ but any $\leq t$ of the parties cannot learn any information about $f$ . FSS schemes for point functions have been constructed under the name of distributed point functions (DPFs). The existing DPFs are computationally secure and based on the existence of PRGs or OWFs. As a result, the protocols where DPFs work as building blocks are computationally secure as well. In this paper, we study information-theoretically secure $(t,r)$ -FSS (called $(t,r)$ -itFSS) and propose a generic transformation from information-theoretic private information retrieval (PIR) schemes to itFSS schemes for point functions. We measure the efficiency of itFSS with its communication complexity, which can be defined as the total length of the secret keys and the output shares, maximized over the choices of $f$ and $x$ . By instantiating the generic transformation, we obtain $(t,r)$ -itFSS schemes for a variety of choices of $(t,r)$ , which have sublinear (in the functions’ domain size) communication complexity. How to make sure that the parties’ shares of $f(x)$ do not reveal more information than what needed to compute $f(x)$ is an interesting problem. An itFSS with this property is called function-private. In this paper, we also define a parameter called the mutual rate of itFSS in order to measure the amount of information that will be leaked by the parties’ output shares. We calculate the mutual rates for several specific itFSS schemes. We also define computational function privacy and propose a 2-party itFSS scheme with computational function privacy.

Ramp secret sharing with cheater identification in presence of rushing cheaters

Abstract Secret sharing allows one to share a piece of information among n participants in a way that only qualified subsets of participants can recover the secret whereas others cannot. Some of these participants involved may, however, want to forge their shares of the secret(s) in order to cheat other participants. Various cheater identifiable techniques have been devised in order to identify such cheaters in secret sharing schemes. On the other hand, Ramp secret sharing schemes are a practically efficient variant of usual secret sharing schemes with reduced share size and some loss in security. Ramp secret sharing schemes have many applications in secure information storage, information-theoretic private information retrieval and secret image sharing due to producing relatively smaller shares. However, to the best of our knowledge, there does not exist any cheater identifiable ramp secret sharing scheme. In this paper we define the security model for cheater identifiable ramp secret sharing schemes and provide two constructions for cheater identifiable ramp secret sharing schemes. In addition, the second construction is secure against rushing cheaters who are allowed to submit their shares during secret reconstruction after observing other participants’ responses in one round. Also, we do not make any computational assumptions for the cheaters, i.e., cheaters may be equipped with unlimited time and resources, yet, the cheating probability would be bounded above by a very small positive number.

RPIR: ramp secret sharing-based communication-efficient private information retrieval

Even as data and analytics-driven applications are becoming increasingly popular, retrieving data from shared databases poses a threat to the privacy of their users. For example, investors/patients retrieve records about stocks/diseases they are interested in from a stock/medical database. Knowledge of such interest is sensitive information that the database server would have access to, unless some mitigating measures are deployed. Private information retrieval (PIR) is a promising security primitive to protect the privacy of users' interests. PIR allows the retrieval of a data record from a database without letting the database server know which record is being retrieved. The privacy guarantees could either be information theoretic or computational. Alternatively, anonymizers, which hide the identities of data users, may be used to protect the privacy of users' interests for some situations. In this paper, we study rPIR, a new family of information-theoretic PIR schemes using ramp secret sharing. We have designed four rPIR schemes, using three ramp secret sharing approaches, achieving answer communication costs close to the cost of non-private information retrieval. Evaluation shows that, for many practical settings, rPIR schemes can achieve lower communication costs and the same level of privacy compared with traditional information-theoretic PIR schemes and anonymizers. Efficacy of the proposed schemes is demonstrated for two very different scenarios (outsourced data sharing and P2P content delivery) with realistic analysis and experiments. In many situations of these two scenarios, rPIR's advantage of low communication cost outweighs its disadvantages, which results in less expenditure and/or better quality of service compared with what may be achieved if traditional information-theoretic PIR and anonymizers are used.

Communication-efficient distributed oblivious transfer

Distributed oblivious transfer (DOT) was introduced by Naor and Pinkas (2000) [31], and then generalized to (k,ℓ)-DOT-(n1) by Blundo et al. (2007) [8] and Nikov et al. (2002) [34]. In the generalized setting, a (k,ℓ)-DOT-(n1) allows a sender to communicate one of n secrets to a receiver with the help of ℓ servers. Specifically, the transfer task of the sender is distributed among ℓ servers and the receiver interacts with k out of the ℓ servers in order to retrieve the secret he is interested in. The DOT protocols we consider in this work are information-theoretically secure. The known (k,ℓ)-DOT-(n1) protocols require linear (in n) communication complexity between the receiver and servers. In this paper, we construct (k,ℓ)-DOT-(n1) protocols which only require sublinear (in n) communication complexity between the receiver and servers. Our constructions are based on information-theoretic private information retrieval. In particular, we obtain both a specific reduction from (k,ℓ)-DOT-(n1) to polynomial interpolation-based information-theoretic private information retrieval and a general reduction from (k,ℓ)-DOT-(n1) to any information-theoretic private information retrieval. The specific reduction yields (t,τ)-private (k,ℓ)-DOT-(n1) protocols of communication complexity O(n1/⌊(k−τ−1)/t⌋) between a semi-honest receiver and servers for any integers t and τ such that 1⩽t⩽k−1 and 0⩽τ⩽k−1−t. The general reduction yields (t,τ)-private (k,ℓ)-DOT-(n1) protocols which are as communication-efficient as the underlying private information retrieval protocols for any integers t and τ such that 1⩽t⩽k−2 and 0⩽τ⩽k−1−t.

Robust Information-Theoretic Private Information Retrieval

An information-theoretic private information retrieval (PIR) protocol allows a user to retrieve a data item of its choice from a database replicated amongst several servers, such that each server gains absolutely no information on the identity of the item being retrieved. One problem with this approach is that current systems do not guarantee availability of servers at all times for many reasons, e.g., crash of server or communication problems. In this work we design robust PIR protocols, i.e., protocols which still work correctly even if only some servers are available during the protocol's operation. We present various robust PIR protocols giving different tradeoffs between the different parameters. We first present a generic transformation from regular PIR protocols to robust PIR protocols. We then present two constructions of specific robust PIR protocols. Finally, we construct robust PIR protocols which can tolerate Byzantine servers, i.e., robust PIR protocols which still work in the presence of malicious servers or servers with a corrupted or obsolete database.

Lower bounds for linear locally decodable codes and private information retrieval

We prove that if a linear error-correcting code C:{0, 1}n?{0, 1}m is such that a bit of the message can be probabilistically reconstructed by looking at two entries of a corrupted codeword, then m = 2? (n). We also present several extensions of this result. We show a reduction from the complexity of one-round, information-theoretic Private Information Retrieval Systems (with two servers) to Locally Decodable Codes, and conclude that if all the servers' answers are linear combinations of the database content, then t = ? (n/2a), where t is the length of the user's query and a is the length of the servers' answers. Actually, 2a can be replaced by O(ak), where k is the number of bit locations in the answer that are actually inspected in the reconstruction.

General constructions for information-theoretic private information retrieval

A Private Information Retrieval (PIR) protocol enables a user to retrieve a data item from a database while hiding the identity of the item being retrieved; specifically, in a t-private k-server PIR protocol the database is replicated among k servers, and the user's privacy is protected from any collusion of up to t servers. The main cost-measure of such protocols is the communication complexity of retrieving a single bit of data. This work addresses the information-theoretic setting for PIR, where the user's privacy should be unconditionally protected against computationally unbounded servers. We present a general construction, whose abstract components can be instantiated to yield both old and new families of PIR protocols. A main ingredient in the new protocols is a generalization of a solution by Babai, Gál, Kimmel, and Lokam for a communication complexity problem in the multiparty simultaneous messages model. Our protocols simplify and improve upon previous ones, and resolve some previous anomalies. In particular, we get (1) 1-private k-server PIR protocols with O ( k 3 n 1 / ( 2 k - 1 ) ) communication bits, where n is the database size; (2) t-private k-server protocols with O ( n 1 / ⌊ ( 2 k - 1 ) / t ⌋ ) communication bits, for any constant integers k > t ⩾ 1 ; and (3) t-private k-server protocols in which the user sends O ( log n ) bits to each server and receives O ( n t / k + ε ) bits in return, for any constant integers k > t ⩾ 1 and constant ε > 0 . The latter protocols have applications to the construction of efficient families of locally decodable codes over large alphabets and to PIR protocols with reduced work by the servers.