We propose a cheat sensitive quantum protocol to perform a private search on a classical database which is efficient in terms of communication complexity. It allows a user to retrieve an item from the server in possession of the database without revealing which item she retrieved: if the server tries to obtain information on the query, the person querying the database can find it out. Furthermore our protocol ensures perfect data privacy of the database, i.e. the information that the user can retrieve in a single queries is bounded and does not depend on the size of the database. With respect to the known (quantum and classical) strategies for private information retrieval, our protocol displays an exponential reduction both in communication complexity and in running-time computational complexity. Privacy is a major concern in many information transactions. A familiar example is provided by the transactions between web search engines and their users. On one hand, the user (say Alice) would typically prefer not to reveal to the server the item she is interested in (user privacy). On the other hand, the server (say Bob) would like not to disclose more information than that Alice has asked for (data privacy). User and data privacy are apparently in conflict: the most straightforward way to obtain user privacy is for Alice to have Bob send her the entire database, leading to no data privacy whatsoever. Conversely, techniques for guaranteeing the server's data privacy typically leave the user vulnerable [1]. At the information theoretical level, this problem has been formalized by Gertner et al. as the Symmetrically-Private Information Retrieval (SPIR) [1] . This is a generalization of the Private Information Retrieval (PIR) problem [2] which deals with user privacy alone. (SPIR is closely related to oblivious transfer [3] , in which Bob sends to Alice N bits, out of which Alice can access exactly one-which one, Bob doesn't know.) No efficient solutions in terms of communication complexity [4] are known for SPIR. Indeed, even rephrasing them at a quantum level [5, 6] , the best known solution for the SPIR problem (with a single database server) employs O(N ) qubits to be exchanged between the server and the user [7] and ensures data privacy only in the case of honest users (here N is the number of items contained in the database, while an honest user is defined as one who does not want to compromise her chances of getting the information about the selected item in order to get more). PIR admits protocols that are more efficient in terms of communication complexity [2] . As will be seen below, however, both PIR and SPIR necessarily require O(N ) computational complexity on the part of the database. In this paper we present a new quantum cryptographic primitive [8] , the quantum private query (QPQ), which allows an exponential reduction in the communication and computational complexity with respect to the best (quantum or classical) SPIR protocol proposed so far. QPQ ensures perfect data privacy and it exploits a cheat sensitive strategy [9] that allows Alice to determine whether Bob has been trying to cheat to obtain information about her query. In other words, Alice can ask Bob's database a question and obtain the answer, together with a quantum certificate that Bob retains no record of what question she asked. With respect to (classical or quantum) SPIR and oblivious transfer protocols QPQ presents an exponential reduction in communication complexity. This comes from the fact that information theoretic SPIR protocols require the exchange of the whole database [7] , O(N ) qubits, while QPQ requires the exchange of only two database elements, identified by O(log N ) qubits. Quantum Private Queries also provides an exponential reduction in computational complexity over all classical PIR schemes, whether symmetric or not. In both cryptographic and information-theoretic PIR protocols, the owner(s) of the database(s) must perform O(N ) 'internal' database calls in response to Alice's query. That is, as part of the protocol, Bob must perform operations that access every entry in his database, using some cryptographic primitive such as a public key supplied by Alice. If the PIR protocol requires Bob to perform fewer than N internal database calls, then he obtains information about Alice's query simply by monitoring which database entries were and were not called in the course of executing the protocol. That is, a classical PIR protocol necessarily has database computational complexity O(N ) per query. In contrast, Quantum Private Queries require only two internal database calls per use, each using only O(log N ) time steps [10] . Quantum private queries achieve two competing goals: Bob can provide the service of private searching without having to give up his database, and Alice can test his honesty without having to trust him. The basic idea underlying the protocol is simple: Bob, as a sign of his discretion, returns not only the answer to Alice's query, but the original query itself, retaining no copy. Alice, in addition to performing normal queries, can perform also quantum superpositions of different queries. This
In 2008, Giovannetti et al. REF proposed the first quantum private query (QPQ) protocol.
Quantum private queries
Phys. Rev. Lett. 100, 230502 (2008)
Physics Medicine