[Paper Review] Secure Private Information Retrieval from Colluding Databases with Eavesdroppers

Qiwen Wang, Mikael Skoglund|arXiv (Cornell University)|Oct 3, 2017

Cryptography and Data Security3 citations

TL;DR

This paper studies private information retrieval (PIR) from N replicated databases under joint threats of colluding servers (up to T) and eavesdroppers (tapping E databases), introducing the T-EPIR model. It proposes a scheme achieving a download rate of $ R = \frac{1 - \frac{T}{N}}{1 - \left(\frac{T}{N}\right)^K} - \frac{E}{KN} $, with a converse bound showing the rate gap vanishes as K→∞, and derives optimal shared randomness usage for secrecy.

ABSTRACT

The problem of private information retrieval (PIR) is to retrieve one message out of $K$ messages replicated at $N$ databases, without revealing the identity of the desired message to the databases. We consider the problem of PIR with colluding servers and eavesdroppers, named T-EPIR. Specifically, any $T$ out of $N$ databases may collude, i.e. they may communicate their interactions with the user to guess the identity of the requested message. An eavesdropper is curious to know the database and can tap in on the incoming and outgoing transmissions of any $E$ databases. The databases share some common randomness unknown to the eavesdropper and the user, and use the common randomness to generate the answers, such that the eavesdropper can learn no information about the $K$ messages. Define $R^*$ as the optimal ratio of the number of the desired message information bits to the number of total downloaded bits, and $ρ^*$ to be the optimal ratio of the information bits of the shared common randomness to the information bits of the desired file. In our previous work, we found that when $E \geq T$, the optimal ratio that can be achieved equals $1-\frac{E}{N}$. In this work, we focus on the case when $E \leq T$. We derive an outer bound $R^* \leq (1-\frac{T}{N}) \frac{1-\frac{E}{N} \cdot (\frac{T}{N})^{K-1}}{1-(\frac{T}{N})^K}$. We also obtain a lower bound of $ρ^* \geq \frac{\frac{E}{N}(1-(\frac{T}{N})^K)}{(1-\frac{T}{N})(1-\frac{E}{N} \cdot (\frac{T}{N})^{K-1})}$. For the achievability, we propose a scheme which achieves the rate (inner bound) $R=\frac{1-\frac{T}{N}}{1-(\frac{T}{N})^K}-\frac{E}{KN}$. The amount of shared common randomness used in the achievable scheme is $\frac{\frac{E}{N}(1-(\frac{T}{N})^K)}{1-\frac{T}{N}-\frac{E}{KN}(1-(\frac{T}{N})^K)}$ times the file size. The gap between the derived inner and outer bounds vanishes as the number of messages $K$ tends to infinity.

Motivation & Objective

• To model and analyze private information retrieval (PIR) in the presence of both colluding databases (up to T) and eavesdroppers (tapping E databases).
• To establish information-theoretic limits for secure PIR under joint T-collusion and E-eavesdropping, particularly when $ E \leq T $.
• To derive an outer bound on the optimal retrieval rate $ R^* $, and a lower bound on the required shared randomness ratio $ \rho^* $.
• To propose a novel achievable scheme that matches the asymptotic performance of the converse bound as $ K \to \infty $.

Proposed method

• The scheme uses shared common randomness across databases, unknown to the user and eavesdropper, to generate answers that hide the database content from eavesdroppers.
• It employs MDS codes and random linear precoding over finite fields to construct queries and answers, ensuring user and system privacy.
• For each round, the user retrieves symbols from the desired file using interference cancellation based on structured query design across subsets of files.
• The queries are distributed across N databases such that any T colluding databases observe only uniformly random linear combinations of all files, preserving user-privacy.
• The eavesdropper observes EJ independent symbols from shared randomness, ensuring no information about the database is leaked.
• The achievable rate is derived by analyzing the total download size relative to the desired file size, accounting for both colluding and eavesdropping constraints.

Experimental results

Research questions

• RQ1 What is the information-theoretic capacity of PIR when databases can collude (up to T) and an eavesdropper can tap E databases, under the constraint $ E \leq T $?
• RQ2 How much shared common randomness is required to ensure that the eavesdropper learns nothing about the database content?
• RQ3 Can a scheme be constructed that achieves a rate close to the derived converse bound, especially as the number of messages K grows large?
• RQ4 How does the presence of both colluding databases and eavesdroppers jointly affect the PIR rate and secrecy requirements?
• RQ5 What is the trade-off between download cost and the amount of shared randomness needed for security in this threat model?

Key findings

• The outer bound on the optimal retrieval rate is $ R^* \leq \left(1 - \frac{T}{N}\right) \frac{1 - \frac{E}{N} \left( \frac{T}{N} \right)^{K-1} }{1 - \left( \frac{T}{N} \right)^K } $, which tightens as $ K \to \infty $.
• The proposed scheme achieves a rate of $ R = \frac{1 - \frac{T}{N}}{1 - \left( \frac{T}{N} \right)^K } - \frac{E}{KN} $, matching the outer bound asymptotically.
• The required shared randomness ratio is $ \rho^* \geq \frac{ \frac{E}{N} \left(1 - \left( \frac{T}{N} \right)^K \right) }{ \left(1 - \frac{T}{N} \right) \left(1 - \frac{E}{N} \left( \frac{T}{N} \right)^{K-1} \right) } $, which is matched by the achievable scheme.
• User-privacy is preserved because colluding databases observe only uniformly random linear combinations of all files, due to i.i.d. random precoding matrices.
• System-privacy is ensured because the eavesdropper sees only independent linear combinations of shared randomness, not the actual database content.
• The gap between the inner and outer bounds on the retrieval rate vanishes as $ K \to \infty $, indicating asymptotic optimality of the scheme.