Private Information Retrieval Benny Chor Oded Goldreich Eyal

Private Information Retrieval Benny Chor, Oded Goldreich, Eyal Kushilevitz and Madhu Sudan Journal of ACM Vol. 45 No 6. 1998 Reporter : Chen, Chun-Hua Date : 2003/10/14

Outline n n n n Motivation Introduction Formal Model & Definition Notation A Basic Two-Server Scheme A Multi-Server Scheme Conclusion

Motivation n n In e-commerce the protection of user privacy was not considered feasible until PIR problem was stated(Private Information Retrieve 36 th IEEE FOCS , pp. 41~50, 1995) Rough Def of Private Information Retrieve(PIR) n A PIR protocol allows a user to retrieve a record from a database while hiding the identity of the record from a database server

Motivation n Where did the need for PIR come from n Patent(專利) Databases n n If the patent server knows which patent the user is interested in , this could cause a lot of problem Pharmaceutical(製藥) Databases n To hide the plans of the company drug designers buy the entire Pharmaceutical Database

Introduction n Consider a user makes a query to a database n n n A lot of research was devoted to methods to protect the database against a curious user But there are no methods to protect the privacy of the user(before 1995) However, it is not difficult to prove that if the user wants to keep its privacy, the only thing he can do is to ask for a copy of the whole database --- it is unacceptable

Introduction n Because the rapid development of distributed databases and fast communication network, it may be possible to make queries to several servers such that from the answers the desired information can be obtained while each server get no information on the identity of the item the user is interested n Assumption n The database is a binary string x = x 1 x 2…xn of length n Identical copies of this string are stored by k >= 2 servers The user is interested in the value of bit xi

Introduction n Private Information Retrieval Scheme : The user queries each of the k servers and gets replies from which the desired bit xi can be computed. The query to each server is distributed independently of i and therefore each server gains no information about i. A scheme with these properties is called a Private Information Retrieval scheme

Introduction n Two server scheme with communication complexity O(n 1/3) Scheme of k servers with communication complexity O(n 1/k) O(n 1/(2 k-1)) A scheme for 1/3*log 2 n+1 servers with total communication complexity 1/3*(1+O(1))*(log 2 n)2*log 2(2 n) (Ref : Private Information Retrieve 36 th IEEE FOCS , pp. 41~50, 1995)

Formal Model & Definition Index i [n] => {1, 2, 3, …, n} n Random input r of length Lrnd n Produces k queries of length Lq to k servers : Q 1(i, r), …, Qk(i, r) n The servers respond A 1, …, Ak of length La according to the content of X and the corresponding query n The user reconstructs the desired bit xi from these k replies n

Formal Model & Definition n Definition 1 A k-servers Private Information Retrieval(PIR) scheme for database length n consists of n n k query functions Q 1, …, Qk : [n] x {0, 1}Lrnd {0, 1}Lq k answer functions, A 1, …, Ak : {0, 1}n x {0, 1}Lq a reconstruction function , R : [n] x {0, 1}n x {0, 1}Lrnd x ({0, 1}La)k {0, 1} These functions should satisfy Correctness & Privacy

Formal Model & Definition n Correctness : For every x {0, 1}n , i and r {0, 1}Lrnd n n R(i, r, A 1(x, Q 1(i, r)), …, Ak(x, Qk(i, r))) = xi Privacy : For every i, j and q {0, 1}Lq n [n], s [k], Pr(Qs(i, r) = q) = Pr(Qs(j, r) = q) where the probabilities are taken over uniformly chosen r {0, 1}Lrnd Extensions : PIR of Blocks Single Bit PIR Schemes

Notation n Notation : the following notations throughout the paper n n n U : a user SRV 1, …, SRVk : the servers x = x 1…xn a string in {0, 1}n , known to each server representing the database i : the index in which U is interested [m] => {1, 2, …, m} For a set S and an element a let S a => S Ù {a} if a S = > S {a} if a S

A Basic Two-Server Scheme n The steps of the scheme are as below : n n The user uniformly selects a random set S [n] The user sends S to SRV 1 and S i to SRV 2 Each server replies with a single bit which is the Exclusive OR of the bits with indices from SRV 1, 2 (SRV 1 replies with j S xj SRV 2 replies with j S i xj ) The user Exclusive OR all the answers it has received thus retrieving the desired bit xi

A Basic Two-Server Scheme (Example) n User randomly choice S = {5, 15, 47} (n=100 , index i = 15, S i = {5, 47}) (3) x 5 x 15 x 47 (1) S ={5, 15, 47} (2) S (4) x 5 x 47 SRV 1 i ={5, 47} SRV 2

A Basic Two-Server Scheme (Example) n User compute the desired bit xi n (SRV 1 ) (SRV 2 )

A Multi-Server Scheme n A scheme for any number k≧ 2 servers n n n The scheme allows the user to obtain the desired bit by asking queries to k =2 d servers. For any d≧ 1, it requires total communication complexity of 2 d * (d * n 1/d + 1) The key idea is to associate [n] with the d dimensional cube [L]d and generalize the two-server scheme which may be viewed as the 1 -dimensional case (i. e. d = 1) Assume n = [L]d and embed x in a d-dimensional cube. Associate each position j n with a d-tuple (j 1, …, jd) [L]d. In particular the index i of the desired bit is associated with a d-tuple (j 1, …, jd) [L]d

A Multi-Server Scheme (Steps)

Conclusion n Some feelings of research n n Remember the study of algorithm Research the topic slowly Treasure the beauty of the papers Research groups n n Cryptography and Information Security Group: Private Information Retrieval (Research topic at MIT) Private Information Retrieval Research at BGU PIR Research (Dartmouth (old research)) Amos Beimel

Conclusion n Research Directions n Extension of PIR n n n Relax some requirement n n Robust PIR T-privacy encryption is permitted for one server O(Nε), ε>0 Make PIR pratical n n n H/w Combination with Datebase Application on EC