[Paper Review] Secure Symmetric Private Information Retrieval from Colluding Databases with Adversaries

Qiwen Wang, Mikael Skoglund|arXiv (Cornell University)|Jul 7, 2017

Cryptography and Data Security16 references15 citations

TL;DR

This paper studies symmetric private information retrieval (SPIR) from replicated databases with colluding servers and three types of adversaries: Byzantine (corrupting transmissions), passive eavesdroppers (tapping communications), and combined adversaries. It derives the information-theoretic capacity of T-BSPIR, T-ESPIR, and T-BESPIR as $1 - \frac{2B+T}{N}$, $1 - \frac{\max(T,E)}{N}$, and $1 - \frac{2B+\max(T,E)}{N}$, respectively, under conditions requiring shared common randomness with specific minimum sizes relative to file size.

ABSTRACT

The problem of symmetric private information retrieval (SPIR) from replicated databases with colluding servers and adversaries is studied. Specifically, the database comprises $K$ files, which are replicatively stored among $N$ servers. A user wants to retrieve one file from the database by communicating with the $N$ servers, without revealing the identity of the desired file to any server. Furthermore, the user shall learn nothing about the other $K-1$ files. Any $T$ out of $N$ servers may collude, that is, they may communicate their interactions with the user to guess the identity of the requested file. An adversary in the system can tap in on or even try to corrupt the communication. Three types of adversaries are considered: a Byzantine adversary who can overwrite the transmission of any $B$ servers to the user; a passive eavesdropper who can tap in on the incoming and outgoing transmissions of any $E$ servers; and a combination of both -- an adversary who can tap in on a set of any $E$ nodes, and overwrite the transmission of a set of any $B$ nodes. The problems of SPIR with colluding servers and the three types of adversaries are named T-BSPIR, T-ESPIR and T-BESPIR respectively. The capacity of the problem is defined as the maximum number of information bits of the desired file retrieved per downloaded bit. We show that the information-theoretical capacity of T-BSPIR equals $1-\frac{2B+T}{N}$, if the servers share common randomness (unavailable at the user) with amount at least $\frac{2B+T}{N-2B-T}$ times the file size. Otherwise, the capacity equals zero. The capacity of T-ESPIR is proved to equal $1-\frac{\max(T,E)}{N}$, with common randomness at least $\frac{\max(T,E)}{N-\max(T,E)}$ times the file size. Finally, the capacity of T-BESPIR is proved to be $1-\frac{2B+\max(T,E)}{N}$, with common randomness at least $\frac{2B+\max(T,E)}{N-2B-\max(T,E)}$ times the file size.

Motivation & Objective

• To address the challenge of achieving information-theoretic privacy in symmetric private information retrieval (SPIR) when servers may collude and communication channels are compromised by adversaries.
• To model and analyze three adversarial scenarios: Byzantine (message corruption), passive eavesdropping (eavesdropping), and combined (eavesdropping and corruption).
• To determine the information-theoretic capacity of SPIR under these adversarial models, considering colluding servers and the need for shared common randomness.
• To establish the minimum required amount of common randomness shared among servers to achieve non-zero capacity under each adversarial model.

Proposed method

• Proposes three variants of SPIR: T-BSPIR (Byzantine servers), T-ESPIR (eavesdroppers), and T-BESPIR (combined threats), with $N$ replicated servers storing $K$ files.
• Introduces a scheme using shared common randomness $S$ across servers, independent of the database and unknown to the user, to ensure both user and database privacy.
• Employs query and answer design such that answers are linear combinations of file symbols and common randomness, ensuring privacy against colluding servers and adversaries.
• Uses information-theoretic arguments, including mutual information and entropy inequalities, to derive converse bounds on achievable rates.
• Applies symmetry and averaging over node subsets to derive lower bounds on required common randomness, ensuring privacy against eavesdroppers and Byzantine nodes.
• Replaces the colluding threshold $T$ in prior schemes with $\max(T,E)$ in the combined adversary case to account for the stronger threat model.

Experimental results

Research questions

• RQ1 What is the information-theoretic capacity of symmetric private information retrieval when $T$ out of $N$ servers can collude and an adversary can corrupt $B$ servers?
• RQ2 How does the presence of a passive eavesdropper who can monitor $E$ servers affect the capacity of SPIR with colluding servers?
• RQ3 What is the capacity of SPIR when an adversary can both eavesdrop on $E$ servers and corrupt the answers of $B$ servers?
• RQ4 What minimum amount of common randomness is required among servers to achieve non-zero capacity in each of the three adversarial models?
• RQ5 How does the capacity change when the adversary's capabilities (eavesdropping or corruption) exceed the colluding threshold $T$?

Key findings

• The capacity of T-BSPIR is $1 - \frac{2B+T}{N}$, provided that the shared common randomness is at least $\frac{2B+T}{N-2B-T}$ times the file size.
• The capacity of T-ESPIR is $1 - \frac{\max(T,E)}{N}$, under the condition that common randomness is at least $\frac{\max(T,E)}{N-\max(T,E)}$ times the file size.
• For T-BESPIR, the capacity is $1 - \frac{2B+\max(T,E)}{N}$, with a required common randomness of at least $\frac{2B+\max(T,E)}{N-2B-\max(T,E)}$ times the file size.
• The results show that the presence of both eavesdroppers and Byzantine adversaries increases the required common randomness and reduces the achievable rate, with the combined threat modeled via $\max(T,E)$.
• The derived capacities are analogous to those in secure network coding, indicating a structural similarity between SPIR with adversaries and network coding under similar constraints.
• The converse proofs rely on entropy and mutual information inequalities, with averaging over subsets of size $\max(T,E)$ to establish lower bounds on required randomness.