Proposal Achieving Symmetric Private Information Retrieval via Oblivious Transfer

There exist many situations where a user may wish to access a database without any record of what was viewed, or found, being recorded. This is solved by Private Information Retrieval. An example being Google’s newly released e-mail program GMail, the server scans each e-mail for matching textual advertisements, the scanning process can be viewed as a user query. Some users may refrain from using this new e-mail client because someone with access to the server, or the website of a resulting ad, could easily infer the content of private e-mails based on the matching textual ads. There also exist situations in which the database should also have a level of privacy, and this is solved with Symmetric Private Information Retrieval. Two or more medical institutions may wish to mine for trends amongst the union of each institution’s data. Since all medical records are confidential it is important to be able to query the databases without the results from a specific institution per query being known and to also not allow the data mining process to retrieve more information than that received from the queries posed and from information that could be inferred from the results of the queries. Oblivious Transfer is a cryptographic primitive that can retrieve data from a sender without the sender revealing anymore data other than the data requested and without the sender knowing which piece of data was revealed to the receiver. This primitive can achieve Symmetric Private Information Retrieval. The forthcoming thesis should review past works in the area and then should expand upon these works through implementation and experimentation. Overview and Definitions There exist many databases, both public and private, and there exist several users that may be hesitant to obtain information from these databases for various reasons involving the perseverance of the user’s privacy. Knowledge of the data retrieved by a party could cause such hazards as unwanted profiling. Given a scenario with a public database, a Private Information Retrieval (PIR) protocol will provide the user a means to retrieve data without revealing his query. Private Information Retrieval (PIR) [GIKM98] Allows a user to retrieve information from a database while maintaining the privacy of his query. An example, Google’s GMail, where a user’s e-mail is scanned, and textual ads are retrieved from Google’s database based on the text of the e-mail. The e-mail text can easily be viewed by a database administrator, and if the user pursues the resulting ads, the owners of these sites could potentially infer the text of a user’s e-mails. Considering the e-mail text as the private query, the textual ads as the result of the private query, and Google’s database of textual ads as public, this scenario becomes a PIR problem. When the privacy of the database must also be maintained, a Symmetric Private Information Retrieval (SPIR) protocol can achieve this functionality. Symmetric Private Information Retrieval (SPIR) Allows a user to retrieve information from a database in a manner that preserves the privacy of the users query and the privacy of the database. The privacy of the data is dependent upon the functionality of the particular database. A private database may restrict the user to a specific number of results based on clearance or subscription level or to a variable number of results dependent upon the query. This functionality is first discussed by Gertner, et. al [GIKM98]. In 1981, Rabin introduced, the cryptographic primitive, Oblivious Transfer [Rab81], which has also been presented by Yao as Oblivious Circuit Evaluation [Yao86]. SPIR, by definition, can be achieved by the use of Oblivious Transfer. Oblivious Transfer (OT) In the traditional two-party scenario, a sender A has n records of data and a receiver B would like to receive k of those records provided the following hold: • A can be guaranteed that B does not receive any information about the n records A has beyond the k records B is allowed to receive. • B can be guaranteed that A does not know which of the k records of the n possible records B received. The simplest implementation of an OT protocol would be in the ideal model.