Hierarchical ORAM Revisited, and Applications to Asymptotically Efficient ORAM and OPRAM. Hubert Chan, Yue Guo, Wei-Kai Lin, Elaine Shi 2017/12/5

Transcription

1 Hierarchical ORAM Revisited, and Applications to Asymptotically Efficient ORAM and OPRAM Hubert Chan, Yue Guo, Wei-Kai Lin, Elaine Shi 2017/12/5

2 Random Access Machine, RAM Maybe the standard model of algorithms Memory / Server: N words, indexed by address Interface: Read / Write address CPU / Client: Constant num. of registers Hierarchical ORAM Revisited 2

3 Oblivious RAM (ORAM) Provable security [Goldreich and Ostrovsky] ORAM Read / Write address Addr 1 Addr 2 Addr 3. Hierarchical ORAM Revisited Simulator Addr 1 Addr 2 Addr 3. 3

4 Hierarchical ORAM Schemes (1) Bandwidth overhead: ORAM O N [Goldreich and Ostrovsky] Hierarchical ORAM Revisited 4

5 Hierarchical ORAM Schemes (2) Bandwidth overhead: ORAM O log 3 N [Goldreich and Ostrovsky] Hierarchical ORAM Revisited 5

6 Hierarchical ORAM Schemes (3) Bandwidth overhead: ORAM O log 2 N [Goodrich and Mitzenmacher] Hierarchical ORAM Revisited 6

7 Hierarchical ORAM Schemes (4) Bandwidth overhead: ORAM [Kushilevitz, Lu, and Ostrovsky] O log2 N log log N Hierarchical ORAM Revisited 7

8 Hierarchical ORAM Schemes (5) Bandwidth overhead: ORAM [Today] O log2 N Simple log log N Hierarchical ORAM Revisited 8

9 Warmup: Permute and Buffer [Goldreich and Ostrovsky] Hidden permutation π Memory π 1 π 3 π 2 Hierarchical ORAM Revisited 9

10 Warmup: Permute and Buffer [Goldreich and Ostrovsky] Hidden permutation π Memory π 1 π 3 π 2 π 3? Hierarchical ORAM Revisited 10

11 Warmup: Permute and Buffer [Goldreich and Ostrovsky] Buffer Scan Buffer Random addr. 3?3? 3? Memory random π 1 π 3 π 2 Hierarchical ORAM Revisited 11

12 Warmup: Permute and Buffer [Goldreich and Ostrovsky] Buffer New Permutation Memory Hierarchical ORAM Revisited 12

13 Warmup: Hash and Buffer [Goldreich and Ostrovsky] Buffer Bandwidth overhead: O N Build Lookup Hash Table Hierarchical ORAM Revisited 13

14 Hierarchical ORAM [Goldreich and Ostrovsky] Recursive buffer of next level Level 0 Level 1 Bandwidth overhead: O log 3 N Level 2 Level 3 Level 4 Hierarchical ORAM Revisited 14

15 Use Cuckoo Hash Faster hash table Level 0 Level 1 Level 2 Bandwidth overhead: O log 2 N [Goodrich and Mitzenmacher] Build: O log N per element Lookup: O(1) Level 3 Level 4 Hierarchical ORAM Revisited 15

16 Cuckoo Hash is Involved Especially make it oblivious [Goodrich and Mitzenmacher] Random bipartite graph Doob martingale Azuma s inequality Hierarchical ORAM Revisited 16

17 Cuckoo Hash is Involved Especially make it oblivious Topological info Hierarchical ORAM Revisited 17

18 Cuckoo Hash is Involved Especially make it oblivious Refine algorithm Var. martingale Var. Azume s ineq. [Goodrich and Mitzenmacher] Hierarchical ORAM Revisited 18

19 Use Cuckoo Hash Faster hash table [Goodrich and Mitzenmacher] Level 0 Level 1 Level 2 Build: O log N per element Lookup: O(1) Level 3 Level 4 Hierarchical ORAM Revisited 19

20 Re-parameterize Hierarchy Reduce num. levels Level 0 Each level μ = log N hash tables Level i, capacity μ i log μ N levels Bandwidth overhead: O [Kushilevitz, Lu, and Ostrovsky] log2 N log log N Level 1 Level 2 Hierarchical ORAM Revisited 20

21 Hash Table We Need Each Each level level μ μ = = log log 1 ε NNhash hash tables tables Cuckoo hash is an overkill! Level 0 Level 1 Build: O log N per element Lookup: O(log ε N) Level 2 Hierarchical ORAM Revisited 21

22 Recall: Balls-and-Bins (1-tier) Hash Table Standard hash table Oblivious: sort and scan Bucket size: Z words Not efficient enough Num. of buckets B Secure implementation [GO96] 1. Add hash values 2. Add dummy words 3. Sort by hash values using AKS 4. Mark duplicates 5. Sort by duplicates 6. Truncate 22

23 Two-Tier Hash Table Repeats standard hash twice Diff. B and Z Hierarchical ORAM Revisited 23

24 Parameters To store n elements, choose Z = 5 log ε λ B = n log ε λ ε 0.5, 1 is a constant Bucket size: Z words Num. of buckets B 24

25 Overflow Probability Theorem (1 st tier): If n 3 exp log ε N, then total overflow is at most k = 288B exp Z 6 Except with negl. prob. Theorem (2 nd tier): If n 3 exp log ε N, then no overflow Except with negl. prob. o n 1 α Chernoff bound Moment gen. func. Negative dep. 25

26 Simple Hierarchical ORAM Level 0 Each level μ = log 1 ε N hash tables Two-tier hash Build: O log N per element Lookup: O(log ε N) Bandwidth overhead: O log2 N log log N Level 1 Level 2 Hierarchical ORAM Revisited 26

27 Parallel: Oblivious PRAM Provable security [Boyle, Chung, and Pass] Read / Write address Addr 1 Addr 2 Addr 3. OPRAM OPRAM OPRAM Hierarchical ORAM Revisited Simulator Addr 1 Addr 2 Addr 3. 27

28 Improved OPRAM Level 0 Two-tier hash table is easy to parallelize Just sort and scan Previous result Work && parallel time: O log 3 N O log2 N log log N Level 1 Level 2 Hierarchical ORAM Revisited 28

29 Conclusions ORAM OPRAM Hierarchical ORAM Revisited 29

30 Followup: Cache-Efficiency Contiguous memory Hierarchical ORAM Revisited 30

31 Thank you! Questions? Hierarchical ORAM Revisited 31