[Paper Review] BIOS ORAM: Improved Privacy-Preserving Data Access for Parameterized Outsourced Storage

Michael T. Goodrich|arXiv (Cornell University)|Sep 19, 2017

Cryptography and Data Security22 references3 citations

TL;DR

This paper introduces BIOS ORAM, a novel oblivious RAM scheme that achieves improved I/O overhead for privacy-preserving outsourced storage by combining B-trees with isogrammic access sequences. It provides statistical security and reduces I/O overhead to $O(1)$ to $O(\log^2 n / (\log \log n)^2)$ with high probability, depending on client memory $M$ and block size $B$, enabling efficient private data access across a wide range of system parameters.

ABSTRACT

Algorithms for oblivious random access machine (ORAM) simulation allow a client, Alice, to obfuscate a pattern of data accesses with a server, Bob, who is maintaining Alice's outsourced data while trying to learn information about her data. We present a novel ORAM scheme that improves the asymptotic I/O overhead of previous schemes for a wide range of size parameters for client-side private memory and message blocks, from logarithmic to polynomial. Our method achieves statistical security for hiding Alice's access pattern and, with high probability, achieves an I/O overhead that ranges from $O(1)$ to $O(\log^2 n/(\log\log n)^2)$, depending on these size parameters, where $n$ is the size of Alice's outsourced memory. Our scheme, which we call BIOS ORAM, combines multiple uses of B-trees with a reduction of ORAM simulation to isogrammic access sequences.

Motivation & Objective

• To address the challenge of minimizing I/O overhead in oblivious RAM (ORAM) schemes while maintaining statistical security for private outsourced data access.
• To support a broad range of practical system parameters, including logarithmic to polynomial client-side memory $M$ and block size $B$, beyond prior schemes limited to specific parameter regimes.
• To enable efficient oblivious simulation of data structures like B-trees, stacks, queues, and compressed-scanning algorithms through the isogrammic access sequence abstraction.
• To demonstrate that ORAM simulation overhead can be reduced to $O(\log n)$ with high probability when $M$ and $B$ are at least $\Omega(2^{\sqrt{=\log n}})$, a sub-polynomial threshold.

Proposed method

• The scheme uses multiple instances of B-trees to organize data, enabling efficient updates and access patterns that can be made oblivious through nonce-based keying.
• It introduces the concept of isogrammic access sequences—sequences where each data item is accessed exactly once per round—enabling efficient oblivious simulation.
• Each node in the data structure is assigned a random nonce, and updates are performed in reverse order along access paths to maintain consistency and privacy.
• The method reduces ORAM simulation to isogrammic sequences, allowing any algorithm with bounded-degree tree structures to be simulated with $O(1)$-amortized I/O per operation.
• It leverages the compressed-scanning paradigm, where each round processes all $n$ items exactly once, and transforms it into an isogrammic sequence using random nonces.
• Security is achieved via statistical indistinguishability: the access pattern remains hidden regardless of the adversary’s computational power, assuming semantically secure encryption is used.

Experimental results

Research questions

• RQ1 Can ORAM simulation be made more efficient across a wide range of client memory $M$ and block size $B$, including sub-polynomial values?
• RQ2 Is it possible to achieve $O(\log n)$ I/O overhead with high probability when $M$ and $B$ are smaller than $n^\epsilon$ for any $\epsilon > 0$?
• RQ3 Can the isogrammic access sequence abstraction be used to unify and optimize oblivious simulation for diverse data structures like B-trees, queues, and graph algorithms?
• RQ4 What is the theoretical limit of I/O overhead for statistically secure ORAM when $M$ and $B$ are small, and can super-logarithmic lower bounds be established?

Key findings

• BIOS ORAM achieves an I/O overhead ranging from $O(1)$ to $O(\log^2 n / (\log \log n)^2)$ with high probability, depending on the values of $M$ and $B$.
• For $M$ and $B$ at least $\Omega(2^{\sqrt{\log n}})$, the scheme achieves $O(\log n)$ I/O overhead with high probability, which is sub-polynomial and efficient for practical settings.
• The isogrammic access sequence abstraction enables efficient oblivious simulation of data structures such as stacks, queues, deques, and binary search trees with $O(1)$-amortized I/O per operation.
• The method supports efficient oblivious simulation of compressed-scanning algorithms, allowing all such algorithms to be securely executed with constant-factor I/O overhead.
• The scheme provides statistical security, ensuring that an adversary cannot distinguish between two access sequences beyond their length and data set size.
• The reduction of ORAM simulation to isogrammic sequences enables a unified framework for private data access across diverse data structures and access patterns.