private information retrieval in distributed storage systems using … · 2018-05-07 · private...

Private Information Retrieval in Distributed Storage

Systems Using an Arbitrary Linear Code

Siddhartha Kumar1 Eirik Rosnes1 Alexandre Graell i Amat2

1Simula@UiB, Norway

2Chalmers University of Technology, Sweden

Institut Mittag-Leffler16th May, 2017

Introduction System Model Construction Optimizing cPoP Numerical Results Summary

Introduction

· · · · · ·

PIR in Distributed Storage Systems Using an Arbitrary Linear Code | S. Kumar, E. Rosnes and A. Graell i Amat 1 / 13

Introduction

· · · · · ·

Introduction

· · · · · ·

Introduction

· · · · · ·

Introduction

· · · · · ·

Q(1) Q(k) Q(k+1) Q(n)

Introduction

· · · · · ·

r1 rk rk+1 rn

Timeline of PIR

n−se

Chor et al. (1995)

Timeline of PIR

n−se

Ishai et al. (2004)

Timeline of PIR

n−se

PIRforDSS

Shah et al. (2014)

Timeline of PIR

n−se

PIRforDSS

Tajeddine and El Rouayheb (2016)

Timeline of PIR

n−se

PIRforDSS

Banawan and Ulukus (2016)

In this talk (to be presented at ISIT 2017)

Contribution

• Extend Tajeddine and El Rouayheb’s PIR protocol to an arbitrary linear codeddata of rate R > 1/2.

• Show that the protocol can be optimized using the structure of the linear code.

Outcome

• Non-MDS codes can also achieve the lower bound on the communication cost(cPoP).

Parallel Work

• [Freij-Hollanti et al., 2016] designed a protocol• Works over arbitrary linear coded data.• Multiple nodes can collude.

• Our protocol yields better cPoP.

Contribution

Outcome

Parallel Work

Contribution

Outcome

Parallel Work

Contribution

Outcome

Parallel Work

Contribution

Outcome

Parallel Work

Contribution

Outcome

Parallel Work

Contribution

Outcome

Parallel Work

Distributed Storage System (DSS)

• A file X(m): a β × k matrix over a GF(qℓ).

• Each row is encoded using an (n, k) linear systematic code C over GF(q).

· · ·

· · · · · ·

· · ·

· · · · · ·

......

· · · · · ·

......

k systematic nodes n − k parity nodes

Privacy Model

• Query matrix Q(j) of size d × βf is sent to j-th node.

• Node j sends back response rj of length d.

• Let s ∈ {1, . . . , n} be a spy node in the DSS.

Perfect information-theoretic PIR

This scheme achieves perfect information-theoretic PIR if and only if

Privacy : H(m|Q(s)) = H(m)

Recovery : H(X(m)|r1, r2, . . . , rn) = 0,

where H(·) denotes the entropy function.

Privacy Model

Q(j) Q(j) =

Privacy Model

Q(j)rj =

= Q(j)

Content in the node

Privacy Model

Q(j)rj =

= Q(j)

Content in the node

Efficiency of PIR protocols

Communication Price of Privacy (cPoP)

Total amount of downloaded data per unit of retrieved data,

θ =nd

• For the considered protocol, θ ≥ 1/(1 − R) , θLB [Chan et al., 2015].

• For a general protocol (single spy node),

θ ≥ θcap , 1 +k

n2+ · · · +

kf−1

nf−1[Banawan and Ulukus, 2016].

• When number of files (f) is very large, θcap = θLB.

• When more than one nodes collude, an explicit lower bound is currently unknown.

θ =nd

θ ≥ θcap , 1 +k

n2+ · · · +

kf−1

θ =nd

θ ≥ θcap , 1 +k

n2+ · · · +

kf−1

θ =nd

θ ≥ θcap , 1 +k

n2+ · · · +

kf−1

θ =nd

θ ≥ θcap , 1 +k

n2+ · · · +

kf−1

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

• Data encoded using an (3, 2) SPC code.

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Non PIR scheme for retrieving X(1):

Queries:

, q2 =(

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Non PIR scheme for retrieving X(1):

Queries:

, q2 =(

Nodes’ responses:

= x1, r2 =(

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

PIR scheme for reterieving x1:

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Queries:

, q2 =(

, q3 =(

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Queries:

u1 + 1 u2

, q2 =(

, q3 =(

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Queries:

u1 + 1 u2

, q2 =(

, q3 =(

Nodes’ responses:

u1 + 1 u2

= u1x1 + u2y1 + x1 = I1 + x1

Basic Idea

x1 x2 x1 + x2

y1 y2 y1 + y2

(1) (2) (3)

• Files X(1) = (x1, x2) and X(2) = (y1, y2).

Queries:

u1 + 1 u2

, q2 =(

, q3 =(

Nodes’ responses:

u1 + 1 u2

= u1x1 + u2y1 + x1 = I1 + x1

= I2, r3 =(

x1 + x2

y1 + y2

= I1 + I2

A Brief Overview

• Queries to systematic nodes: Q(l) = U + V (l).

• Queries to parity nodes: U .

• V (l) depends upon the columns of a binary matrix E (β regular).

• Each row of E represents an erasure pattern that is correctable by a shortenedcode C̃ of C. 1 represents erasure.

• β = d̃min − 1. d̃min is the minimum distance of C̃.

A Brief Overview

Query Construction: (5, 3) Linear code C

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1.

• Code C̃ has parity-check matrix H̃ = P . β = d̃min − 1 = 2.

u1,1 u1,2

u2,1 u2,2

u3,1 u3,2

1 0 11 1 00 1 1

Q(1) =

u1,1 + 1 u1,2

u2,1 u2,2 + 1u3,1 u3,2

, Q(2) =

u1,1 u1,2

u2,1 + 1 u2,2

u3,1 u3,2 + 1

, Q(3) =

u1,1 u1,2 + 1u2,1 u2,2

u3,1 + 1 u3,2

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1.

u1,1 u1,2

u2,1 u2,2

u3,1 u3,2

1 0 11 1 00 1 1

Q(1) =

u1,1 + 1 u1,2

u2,1 u2,2 + 1u3,1 u3,2

, Q(2) =

u1,1 u1,2

u2,1 + 1 u2,2

u3,1 u3,2 + 1

, Q(3) =

u1,1 u1,2 + 1u2,1 u2,2

u3,1 + 1 u3,2

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1.

u1,1 u1,2

u2,1 u2,2

u3,1 u3,2

1 0 11 1 00 1 1

Q(1) =

u1,1 + 1 u1,2

u2,1 u2,2 + 1u3,1 u3,2

, Q(2) =

u1,1 u1,2

u2,1 + 1 u2,2

u3,1 u3,2 + 1

, Q(3) =

u1,1 u1,2 + 1u2,1 u2,2

u3,1 + 1 u3,2

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1.

u1,1 u1,2

u2,1 u2,2

u3,1 u3,2

1 0 11 1 00 1 1

Q(1) =

u1,1 + 1 u1,2

u2,1 u2,2 + 1u3,1 u3,2

, Q(2) =

u1,1 u1,2

u2,1 + 1 u2,2

u3,1 u3,2 + 1

, Q(3) =

u1,1 u1,2 + 1u2,1 u2,2

u3,1 + 1 u3,2

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1.

u1,1 u1,2

u2,1 u2,2

u3,1 u3,2

1 0 11 1 00 1 1

Q(1) =

u1,1 + 1 u1,2

u2,1 u2,2 + 1u3,1 u3,2

, Q(2) =

u1,1 u1,2

u2,1 + 1 u2,2

u3,1 u3,2 + 1

, Q(3) =

u1,1 u1,2 + 1u2,1 u2,2

u3,1 + 1 u3,2

File Retrieval: (5, 3) Linear code C

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1, β = d̃min − 1 = 2.

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1, β = d̃min − 1 = 2.

r1 = Q(1) ( x11

x21) =

u11+1 u12

u21 u22+1u31 u32

x21) =

u11x11+u12x21+x11

u21x11+u22x21+x21

u31x11+u32x21

I1+x11

I4+x21

r2 = Q(2) ( x12

x22) =

u11 u12

u21+1 u22

u31 u32+1

x22) =

u11x12+u12x22

u21x12+u22x22+x12

u31x12+u32x22+x22

I5+x12

I8+x22

r3 = Q(3) ( x13

x23) =

u11 u12+1u21 u22

u31+1 u32

x23) =

u11x13+u12x23+x23

u21x13+u22x23

u31x13+u32x23+x13

I3+x23

I9+x13

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1, β = d̃min − 1 = 2.

r4 = Q(4)(

x11+x12

x21+x22

u11 u12

u21 u22

u31 u32

x11+x12

x21+x22

r5 = Q(5)(

x12+x13

x22+x23

u11 u12

u21 u22

u31 u32

x12+x13

x22+x23

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1, β = d̃min − 1 = 2.

r4 = Q(4)(

x11+x12

x21+x22

u11 u12

u21 u22

u31 u32

x11+x12

x21+x22

r5 = Q(5)(

x12+x13

x22+x23

u11 u12

u21 u22

u31 u32

x12+x13

x22+x23

• Yields cPoP θ = 3·52·3

= 2.5.

x11 x12 x13 x11 + x12 x12 + x13

x21 x22 x23 x21 + x22 x22 + x23

H = (P |I) =

1 1 0 1 00 1 1 0 1

Example

• We have: n = 5, k = 3, f = 1, β = d̃min − 1 = 2.

r4 = Q(4)(

x11+x12

x21+x22

u11 u12

u21 u22

u31 u32

x11+x12

x21+x22

r5 = Q(5)(

x12+x13

x22+x23

u11 u12

u21 u22

u31 u32

x12+x13

x22+x23

• Yields cPoP θ = 3·52·3

= 2.5.

Recovery : H(X(m)|r1, r2, . . . , rn) = 0

Optimizing cPoP

β = β + 1find erasure patterns

correctable by C̃find β regular matrix, E E exists?

noβ − 1

• cPoP for our protocol: θ = n/β.

• When C is an MDS code, dmin = d̃min = n − k + 1, and the PIR scheme reducesto the one in given [Tajeddine El Rouayheb].

Optimizing cPoP

noβ − 1

Optimizing cPoP

noβ − 1

Optimizing cPoP

noβ − 1

Optimizing cPoP

noβ − 1

Optimizing cPoP

noβ − 1

Optimizing cPoP

noβ − 1

Numerical results

Code dmin d̃min θnon−opt θFH θopt θLB

C1 : (5, 3) (example) 2 3 2.5 5 2.5 2.5C2 : (11, 6) 4 4 3.6667 3.6667 2.75 2.2C3 : (12, 8) Pyramid 4 4 4 4.5 3 3C4 : (16, 10) LRC 5 5 4 4.8 3.2 2.6667C5 : (18, 12) Pyramid 5 5 4.5 4.5 3 3C6 : (154, 121) LRC 4 6 30.8 52.18 4.9677 4.6667C7 : (187, 121) LRC 7 16 12.4667 32.45 3.0656 2.8333

• θFH is the cPoP of linear coded PIR protocol of Freij-Hollanti et al.

• For all codes, θopt is close to the lower bound θLB.

• The non-MDS codes C1, C3, and C5 achieve the lower bound θLB.

• The codes C2, C4, C6, and C7 achieve the best cPoP.

Numerical results

Take-home messages

• Generalized the PIR protocol proposed by Tajeddine and El Rouayheb for a DSSwith a single spy node and where data is linearly coded with R > 1/2.

• Presented an algorithm to optimize the cPoP of the protocol. The optimizationleads to a cPoP close to its theoretical lower bound.

• Interestingly, for certain (non-MDS) codes, the lower bound on the cPoP can beachieved.

Take-home messages

private information retrieval in distributed storage systems using … · 2018-05-07 · private...

Documents