Hierarchical ORAM Revisited, and Applications to Asymptotically Efficient ORAM and OPRAM Hubert Chan, Yue Guo, Wei-Kai Lin, Elaine Shi 2017/12/5
Random Access Machine, RAM Maybe the standard model of algorithms Memory / Server: N words, indexed by address Interface: Read / Write address CPU / Client: Constant num. of registers Hierarchical ORAM Revisited 2
Oblivious RAM (ORAM) Provable security [Goldreich and Ostrovsky] ORAM Read / Write address Addr 1 Addr 2 Addr 3. Hierarchical ORAM Revisited Simulator Addr 1 Addr 2 Addr 3. 3
Hierarchical ORAM Schemes (1) Bandwidth overhead: ORAM O N [Goldreich and Ostrovsky] Hierarchical ORAM Revisited 4
Hierarchical ORAM Schemes (2) Bandwidth overhead: ORAM O log 3 N [Goldreich and Ostrovsky] Hierarchical ORAM Revisited 5
Hierarchical ORAM Schemes (3) Bandwidth overhead: ORAM O log 2 N [Goodrich and Mitzenmacher] Hierarchical ORAM Revisited 6
Hierarchical ORAM Schemes (4) Bandwidth overhead: ORAM [Kushilevitz, Lu, and Ostrovsky] O log2 N log log N Hierarchical ORAM Revisited 7
Hierarchical ORAM Schemes (5) Bandwidth overhead: ORAM [Today] O log2 N Simple log log N Hierarchical ORAM Revisited 8
Warmup: Permute and Buffer [Goldreich and Ostrovsky] Hidden permutation π Memory π 1 π 3 π 2 Hierarchical ORAM Revisited 9
Warmup: Permute and Buffer [Goldreich and Ostrovsky] Hidden permutation π Memory π 1 π 3 π 2 π 3? Hierarchical ORAM Revisited 10
Warmup: Permute and Buffer [Goldreich and Ostrovsky] Buffer Scan Buffer Random addr. 3?3? 3? Memory random π 1 π 3 π 2 Hierarchical ORAM Revisited 11
Warmup: Permute and Buffer [Goldreich and Ostrovsky] Buffer New Permutation Memory Hierarchical ORAM Revisited 12
Warmup: Hash and Buffer [Goldreich and Ostrovsky] Buffer Bandwidth overhead: O N Build Lookup Hash Table Hierarchical ORAM Revisited 13
Hierarchical ORAM [Goldreich and Ostrovsky] Recursive buffer of next level Level 0 Level 1 Bandwidth overhead: O log 3 N Level 2 Level 3 Level 4 Hierarchical ORAM Revisited 14
Use Cuckoo Hash Faster hash table Level 0 Level 1 Level 2 Bandwidth overhead: O log 2 N [Goodrich and Mitzenmacher] Build: O log N per element Lookup: O(1) Level 3 Level 4 Hierarchical ORAM Revisited 15
Cuckoo Hash is Involved Especially make it oblivious [Goodrich and Mitzenmacher] Random bipartite graph Doob martingale Azuma s inequality Hierarchical ORAM Revisited 16
Cuckoo Hash is Involved Especially make it oblivious Topological info Hierarchical ORAM Revisited 17
Cuckoo Hash is Involved Especially make it oblivious Refine algorithm Var. martingale Var. Azume s ineq. [Goodrich and Mitzenmacher] Hierarchical ORAM Revisited 18
Use Cuckoo Hash Faster hash table [Goodrich and Mitzenmacher] Level 0 Level 1 Level 2 Build: O log N per element Lookup: O(1) Level 3 Level 4 Hierarchical ORAM Revisited 19
Re-parameterize Hierarchy Reduce num. levels Level 0 Each level μ = log N hash tables Level i, capacity μ i log μ N levels Bandwidth overhead: O [Kushilevitz, Lu, and Ostrovsky] log2 N log log N Level 1 Level 2 Hierarchical ORAM Revisited 20
Hash Table We Need Each Each level level μ μ = = log log 1 ε NNhash hash tables tables Cuckoo hash is an overkill! Level 0 Level 1 Build: O log N per element Lookup: O(log ε N) Level 2 Hierarchical ORAM Revisited 21
Recall: Balls-and-Bins (1-tier) Hash Table Standard hash table Oblivious: sort and scan Bucket size: Z words Not efficient enough Num. of buckets B Secure implementation [GO96] 1. Add hash values 2. Add dummy words 3. Sort by hash values using AKS 4. Mark duplicates 5. Sort by duplicates 6. Truncate 22
Two-Tier Hash Table Repeats standard hash twice Diff. B and Z Hierarchical ORAM Revisited 23
Parameters To store n elements, choose Z = 5 log ε λ B = n log ε λ ε 0.5, 1 is a constant Bucket size: Z words Num. of buckets B 24
Overflow Probability Theorem (1 st tier): If n 3 exp log ε N, then total overflow is at most k = 288B exp Z 6 Except with negl. prob. Theorem (2 nd tier): If n 3 exp log ε N, then no overflow Except with negl. prob. o n 1 α Chernoff bound Moment gen. func. Negative dep. 25
Simple Hierarchical ORAM Level 0 Each level μ = log 1 ε N hash tables Two-tier hash Build: O log N per element Lookup: O(log ε N) Bandwidth overhead: O log2 N log log N Level 1 Level 2 Hierarchical ORAM Revisited 26
Parallel: Oblivious PRAM Provable security [Boyle, Chung, and Pass] Read / Write address Addr 1 Addr 2 Addr 3. OPRAM OPRAM OPRAM Hierarchical ORAM Revisited Simulator Addr 1 Addr 2 Addr 3. 27
Improved OPRAM Level 0 Two-tier hash table is easy to parallelize Just sort and scan Previous result Work && parallel time: O log 3 N O log2 N log log N Level 1 Level 2 Hierarchical ORAM Revisited 28
Conclusions ORAM OPRAM Hierarchical ORAM Revisited 29
Followup: Cache-Efficiency Contiguous memory Hierarchical ORAM Revisited 30
Thank you! Questions? wklin@cs.cornell.edu Hierarchical ORAM Revisited 31