What Storage Access Privacy is Achievable with Small Overhead?

Abstract

Oblivious RAM (ORAM) and private information retrieval (PIR) are classic cryptographic primitives used to hide the access pattern to data whose storage has been outsourced to an untrusted server. Unfortunately, both primitives require considerable overhead compared to plaintext access. For large-scale storage infrastructure with highly frequent access requests, the degradation in response time and the exorbitant increase in resource costs incurred by either ORAM or PIR prevent their usage. In an ideal scenario, a privacypreserving storage protocols with small overhead would be implemented for these heavily trafficked storage systems to avoid negatively impacting either performance and/or costs. In this work, we study the problem of the best storage access privacy that is achievable with only small overhead over plaintext access.To answer this question, we consider differential privacy access which is a generalization of the oblivious access security notion that are considered by ORAM and PIR. Quite surprisingly, we present strong evidence that constant overhead storage schemes may only be achieved with privacy budgets of ϵ = Ω(log n). We present asymptotically optimal constructions for differentially private variants of both ORAM and PIR with privacy budgets ϵ = Θ(log n) with only O(1) overhead. In addition, we consider a more complex storage primitive called key-value storage in which data is indexed by keys from a large universe (as opposed to consecutive integers in ORAM and PIR). We present a differentially private key-value storage scheme with ϵ = Θ(log n) and O(log log n) overhead. This construction uses a new oblivious, two-choice hashing scheme that may be of independent interest.

Dynamic Volume-Hiding Encrypted Multi-Maps with Applications to Searchable Encryption

“…To avoid this extra storage, we can utilize a modified version of two-choice hashing introduced by Patel et al [33] that we denote by H 2ch . This hashing scheme reduces the amount of unused space by arranging bins to share physical memory.…”

“…Whenever a value is inserted into two bins that are completely filled (all nodes appearing on the unique leaf-to-root paths are occupied), the item is instead placed into the stash. We formally present bounds on the stash size and point readers to the proof in [33]. Theorem 3 ([33]).…”

SHORTSTACK: Distributed, Fault-tolerant, Oblivious Data Access

“…There are two approaches to oblivious data access todaythe classical ORAM [10][11][12][13][14][15][16][17], and more recent approach of frequency smoothing as in Pancake [6,18,19]. ORAMs are designed to prevent a broad range of attacks (e.g., active adversaries); accordingly, they also suffer from high overheads, e.g., recent results [20][21][22][23][24][25] have established strong lower bounds on ORAM overheads-for a data store with n KV pairs, any ORAM design must incur bandwidth overheads of Ω(log n) (for proxy storage sublinear in KV store size). For KV stores that store millions or billions of KV pairs, these overheads may amount to orders-of-magnitude of throughput loss [6,37], making ORAMs impractical.…”

“…• Bandwidth and/or compute scalability bottlenecks: Since the proxy receives multiple responses for each client query, it has bandwidth overheads (Ω(log n) in ORAM [20][21][22][23][24][25] and 3× in Pancake [6]); and, since the proxy is responsible for both data encryption/decryption and processing for each individual query and response, it has non-trivial compute overheads. Thus, the centralized proxy can become bandwidth or compute bottlenecked, limiting system throughput.…”

SoK: Differential privacies

“…Many adaptations of DP simply change the neighborhood definition to protect different types of input data than datasets. DP was adopted to graph-structured data in [38,85,136,140,144,151,153], to streaming data in [51,55,56,64,102], to symbolic control systems in [93], to text vectors in [175], to set operations in [172], to images in [174], to genomic data in [147], to recommendation systems in [80], to machine learning in [119], to location data in [28], to outsourced database systems in [101], to bandit algorithms in [12,156], to RAMs in [3,21,158] and to Private Information Retrieval in [135,155]. We detail the corresponding definitions in the full version of this work.…”