Deterministic, Stash-Free Write-Only ORAM

TL;DR

DetWoORAM introduces a deterministic, stash-free write-only ORAM that improves efficiency and simplicity by eliminating the need for local stashing, achieving optimal write overhead and significant performance gains over prior solutions.

Contribution

This paper presents DetWoORAM, a novel deterministic write-only ORAM that simplifies design and improves performance by removing stashing and using sequential writes.

Findings

DetWoORAM writes only 2 blocks per data block, which is optimal.

Experimental results show 3x-14x slowdown compared to encryption-only baseline.

DetWoORAM outperforms prior randomized solutions with 6x-19x speedup.

Abstract

Write-Only Oblivious RAM (WoORAM) protocols provide privacy by encrypting the contents of data and also hiding the pattern of write operations over that data. WoORAMs provide better privacy than plain encryption and better performance than more general ORAM schemes (which hide both writing and reading access patterns), and the write-oblivious setting has been applied to important applications of cloud storage synchronization and encrypted hidden volumes. In this paper, we introduce an entirely new technique for Write-Only ORAM, called DetWoORAM. Unlike previous solutions, DetWoORAM uses a deterministic, sequential writing pattern without the need for any "stashing" of blocks in local state when writes fail. Our protocol, while conceptually simple, provides substantial improvement over prior solutions, both asymptotically and experimentally. In particular, under typical settings the DetWoORAM writes only 2 blocks (sequentially) to backend memory for each block written to the device, which is optimal. We have implemented our solution using the BUSE (block device in user-space) module and tested DetWoORAM against both an encryption only baseline of dm-crypt and prior, randomized WoORAM solutions, measuring only a 3x-14x slowdown compared to an encryption-only baseline and around 6x-19x speedup compared to prior work.

Tables

Table 1. Table 1. Communication complexity and client memory size for various ORAMs in the uniform block setting

	Logical Read		Logical Write		Unsynchronized	Security
	Physical Read	Physical Write	Physical Read	Physical Write	Client Memory
Path-ORAM (Stefanov et al., 2013)	$O\left(B{\log }^{2}N\right)$	$O\left(B{\log }^{2}N\right)$	$O\left(B{\log }^{2}N\right)$	$O\left(B{\log }^{2}N\right)$	$\omega \left(B\log N\right)$	RW
HiVE-WoORAM (Blass et al., 2014)	$O\left(B\log N\right)$	0	$O\left(B{\log }^{2}N\right)$	$O\left(B\log N\right)$	$\omega \left(B\log N\right)$	W-only
DetWoORAM	$O\left(B\log N\right)$	0	$O\left(B\log N\right)$	$2B$	$O\left(B\right)$	W-only

Table 2. Table 2. bonnie++ benchmarking of sequential accesses

	Sequential write		Sequential read
	MB/sec	overhead	MB/sec	overhead
dm-crypt baseline
SSD	505.4	—	615.8	—
HDD	111.6	—	126.1	—
HiVE-WoORAM
SSD	2.6	192x	40.5	15.2x
DetWoORAM
SSD, $M=3N$, $b=64$	49.7	10.2x	260.0	2.37x
SSD, $M=N$, $b=64$	34.0	14.8x	244.1	2.52x
HDD, $M=3N$, $b=64$	29.0	3.84x	26.1	4.83x
HDD, $M=N$, $b=64$	25.0	4.46x	24.1	5.24x

Table 3. Table 3. fio benchmarking of random reads and writes

	Solid state SSD		Spinning platters HDD
	MB/sec	overhead	MB/sec	overhead
dm-crypt baseline	154	—	16.4	—
HiVE-WoORAM	8.49	18x	0.051	325x
DetWoORAM	34.4	4.5x	10.2	1.6x

Equations

$${\mathsf{PhysicalAcc}}^{\Pi }(\vec{x}){\approx }_c{\mathsf{PhysicalAcc}}^{\Pi }(\vec{y}),$$

$$\mathsf{WOnly}({\mathsf{PhysicalAcc}}^{\Pi }(\vec{x})){\approx }_c\mathsf{WOnly}({\mathsf{PhysicalAcc}}^{\Pi }(\vec{y})),$$

$$i\le i^{\prime }<i+M.$$

$$\lfloor \frac{i^{\prime }N}{M}\rfloor \mathrm{mod}M\le a<\lfloor \frac{(i^{\prime }+1)N}{M}\rfloor \mathrm{mod}M.$$

$$i^{\prime }\mathrm{mod}M\ge \lfloor \frac{Ma}{N}\rfloor \mathrm{mod}M.$$

$$N_p=\lfloor \frac{N-2}{b-1}\rfloor \in O(\frac{N}{b-1}).$$

$$h_0,\frac{m_0^0}{\square },h_1,\frac{m_0^1}{\square },h_2,\frac{m_1^0}{\square },h_3,\frac{m_1^1}{\square },\dots ,h_{M-2},\frac{m_{N-1}^0}{\square },h_{M-1},\frac{m_{N-1}^1}{\square }$$

$$M_p=N_p\cdot h.$$

$$\left(h+1\right)\cdot \left(\lceil \lg M\rceil +\lceil \lg B\rceil +1\right)\le \frac{B}{2}$$

$$\left(\lceil \lg \left(N-2\right)\rceil +1\right)\cdot \left(\lceil \lg N\rceil +17\right)\le 2^{14}.$$

$$\mathsf{WOnly}({\mathsf{PhysicalAcc}}^{\Pi }(\vec{x})){\approx }_c\mathsf{WOnly}({\mathsf{PhysicalAcc}}^{\Pi }(\vec{y})),$$

$${\mathsf{seq}}^0=(init,w_0,w_0,w_2),{\mathsf{seq}}^1=(init,w_0,w_1,w_2)$$

$$init=(w_{0},\ldots,w_{N-1},\underbrace{w_{0},\ldots,w_{0}}_{\mbox{$\lambda$ times}}),$$

$$q_y$$

$$q_n$$

$$p^0-p^1$$

$$\mathrm{Pr}[D_2(u_{1,1})=d_0,S_2(d_0)=0]\ge \frac{1}{2}\cdot \frac{1}{k}.$$

$$\mathrm{Pr}[c3|X]\ge \frac{1}{4k}.$$

$$\Pr[c6|X]\leq\Pr[\mbox{ $u_{1,1}$ has $d^{*}_{1}$ before the 1st ORAMWrite}]=\frac{1}{2N}.$$

$$p^{0}-p^{1}\geq\frac{k}{4N}\cdot\Big{(}\frac{1}{4k}-\frac{1}{2N}\Big{)}=\frac{N-2k}{4N^{2}}.$$

Full text

††copyright: rightsretained††journalyear: 2017††copyright: usgov††conference: CCS’17; ; Oct. 30–Nov. 3, 2017, Dallas, TX, USA.††price: 15.00††doi: 10.1145/3133956.3134051††isbn: 978-1-4503-4946-8/17/10

1. Introduction

ORAM

Even when data is fully encrypted, the sequence of which operations have been performed may be easily observed. This access pattern leakage is prevented by using Oblivious RAMs (or ORAMs), which are protocols that allow a client to access files in storage without revealing the sequence of operations over that data. ORAM solutions that have been proposed provide strong privacy by guaranteeing that anyone who observes the entire communication channel between client and backend storage cannot distinguish any series of accesses from random. Due to this strong privacy guarantee, ORAM has been used as a powerful tool in various application settings such as secure cloud storage (e.g., (Stefanov and Shi, 2013b, a; Mayberry et al., 2014)), secure multi-party computation (e.g., (Gordon et al., 2012; Liu et al., 2014, 2015; Wang et al., 2015; Zahur et al., 2016)), and secure processors (e.g., (Fletcher et al., 2015; Liu et al., 2015; Nayak et al., 2017)).

Unfortunately, in order to achieve this obliviousness, ORAM schemes often require a substantial amount of shuffling during every access, requiring more encrypted data to be transferred than just the data being written/read. Even Path ORAM (Stefanov et al., 2013), one of the most efficient ORAM constructions, has an $\Omega(\log N)$ multiplicative overhead in terms of communication complexity compared to non-private storage.

WoORAM

Write-only ORAM (WoORAM) (Li and Datta, 2013; Blass et al., 2014) introduces a relaxed security notion as compared to ORAMs, where only the write pattern needs to be oblivious. That is, we assume a setting in which the adversary is able to see the entire history of which blocks have been written to the backend, or to view arbitrary snapshots of the storage, but the adversary cannot see which blocks are being read.

Every ORAM trivially satisfies the properties of WoORAM, but entirely different (and possibly more efficient) WoORAM solutions are available because a WoORAM is by definition secure even if $read$s are not oblivious. WoORAM schemes can be used in application settings where adversaries are unable to gather information about physical $read$s. In such settings, the weaker security guarantee of WoORAM still suffice to hide the access patterns from the adversary of limited power.

Deniable storage (Blass et al., 2014) is one such application. In this setting, a user has a single encrypted volume and may optionally have a second, hidden volume, the existence of which the user wishes to be able to plausibly deny. For example, a laptop or mobile device owner may be forced to divulge their device decryption password at a border crossing or elsewhere. The adversary may also be able to view multiple snapshots of the disk, either at different times or through physical forensic information remaining on the storage medium. Even given every past state of storage, an adversary should not be able to guess whether the user has a second hidden volume or not. In this context, it is reasonable to assume that the adversary won’t get any information about block reads that have taken place in the disk, since read operations do not usually leave traces on the disk. Based on this observation, a hidden volume encryption (HiVE) for deniable storage was constructed based on WoORAM (Blass et al., 2014).

We proposed another example application in (Aviv et al., 2017) for synchronization based cloud storage and backup services. Here, the user holds the entire contents of data locally, and uses a service such as DropBox to synchronize with other devices or store backups. The service provider or an eavesdropper on the network only observes what the user writes to the synchronization folder, but does not see any read operations as these are done locally without the need for network communication. We showed in (Aviv et al., 2017) showed that WoORAMs can provide efficient protection in this scenario, as well as protection against timing and file size distribution attacks.

In both cases, what makes WoORAMs attractive is that they can achieve security much, much more efficiently than the full read/write oblivious ORAMs such as Path-ORAM. For example, consider storing $N$ size-$B$ data blocks in a non-recursive setting in which the client has enough memory to contain the entire position map of size $O(N\log N)$, Blass et al. (Blass et al., 2014) provided a WoORAM construction (hereafter, HiVE-WoORAM) with optimal asymptotic communication overhead of $O(B)$ and negligible stash overflow probability. As a comparison, fully-functional read/write ORAM schemes — again, even without the position map — have an overhead of $\Omega(B\log N)$.

Towards better efficiency with realistic client memory

Although HiVE-WoORAM has a better asymptotic communication complexity than Path-ORAM in the non-recursive setting (i.e., with client memory of size $O(N\log N)$), the situation is different when the size of the unsynchronized client memory is smaller (i.e., polylogarithmic in $N$). This could be because the client really has less memory, or because the state needs to be synchronized frequently (as in a multi-user setting). In this case, the client cannot maintain the entire position map in memory, and so the position map storage needs to be outsourced to the server as another WoORAM. This encoding typically occurs via a recursive process, storing the position map in recursively smaller WoORAMS, until the final WoORAM is small enough to fit within client memory. Therefore, in the uniform block setting where every storage block has the same size, both HiVE-WoORAM and Path-ORAM have the same overhead $O(B\log^{2}N)$ with poly-logarithmic client memory size.111The multiplicative overhead $O(\log^{2}N)$ can be reduced to additive overhead of $O(\log^{3}N)$ if the size of the block can be non-uniform (Stefanov et al., 2013; Blass et al., 2014). However, throughout the paper we will consider the uniform block setting, since the two use cases we consider above assume uniform block sizes. We note that our construction still has better additive overhead of $O(\log^{2}N)$ even in the non-uniform block setting.

Hence, we ask the following question:

• Can we achieve WoORAM with better asymptotic communication complexity in the setting of polylogarithmic client memory and uniform blocks?

1.1. A Deterministic Approach to WoORAMs

In answering the question above, observe that the security requirement of WoORAMs are much weaker than that of ORAMs. Namely, only the write operations need to be oblivious, and the read operations can occur using different protocols than that of writing. This opens the door to a radically different approach toward constructing a WoORAM scheme.

Traditional approaches.

Traditionally, in ORAM schemes as well as WoORAM, to write data $d$, the oblivious algorithm selects $k$ blocks in some random process storage in order to write. In Path-ORAM, those $k$ blocks form a path in a tree, while in HiVE-WoORAM, they are uniformly sampled from a flat storage array of blocks. All $k$ blocks are re-encrypted, and the new block $d$ is inserted if any existing blocks are empty.

One of the challenges with this approach is that there is the possibility for a write to fail if none of the random $k$ blocks are empty and thus $d$ cannot be inserted. Instead $d$ is placed into a stash in reserved client memory until it may be successfully written to the ORAM (or WoORAM) when two or more of the $k$ blocks are empty. Fortunately, the probability of this event is bounded, and thus the size of the stash can also be bounded with negligible stash overflow probability. The schemes will, with overwhelming probability, work for small client memory.

Main observations.

After careful inspection of the security proofs, we discovered that random slots are mainly used to hide read accesses, not write accesses! That is, the challenge for ORAMs is that successive reads of the same data must occur in a randomly indistinguishable manner. For example, without the technique of choosing random slots, two logical reads on the same address may result in reading the same physical address twice, in which case the read accesses are not oblivious. In the WoORAM setting, however, the scheme may still be secure even if reads are not oblivious, since the security requirement doesn’t care about physical reads! Based on this observation, we ask:

• Can we construct a deterministic WoORAM scheme using a radically different framework?

1.2. Our Work: DetWoORAM

We answer both of the above questions affirmatively. In what follows, we describe the main features and contributions of DetWoORAM.

Deterministic, sequential physical accesses

DetWoORAM departs from the traditional approach in constructing a WoORAM scheme in that the write pattern is deterministic and sequential. Roughly speaking, if some logical $write$ results in writing the two physical blocks $i$ and $j$, the next logical $write$ will result in writing in physical blocks $(i+1)\bmod N$ and $(j+1)\bmod M$, where $M$ is a parameter in the system.

No stash

The deterministic nature of the physical writes also implies that a stash is no longer needed. A write will always succeed and always occurs in a free block. Therefore, we were able to remove the notion of stash completely in our scheme. To elaborate this point, we give a very simple toy construction that captures these aspects in Section 3.1. Due to the deterministic access pattern and the absence of stash, security analysis of our scheme is extremely simple.

Optimal communication complexity of physical writes

Each logical read or write operation from the client’s end results in some physical reads and/or writes to backend memory. In the uniform block setting, we assume there is a block size $B$, presumably dictated by the underlying medium, and that all reads and writes must occur in multiples of $B$. The communication complexity is then the total number of bytes transferred for a given operation, which necessarily is a multiple of $B$.

DetWoORAM has better asymptotic communication complexity than previous constructions (see Table 1). In particular, DetWoORAM improves the complexity of write operations compared to HiVE-WoORAM by a factor of $\log N$. Note that, even though read operations are assumed to be hidden from an observer, the asymptotic cost of reads is still very significant for practical performance.

We stress that to the best of our knowledge, DetWoORAM is the first WoORAM construction whose physical write cost is $2B$ for a single logical write. In other words, the physical-write overhead is a single block (additive!), which is exactly optimal in the uniform block setting with small client storage.

Optimization techniques: ODS and packing

We applied two optimization techniques to further reduce the communication complexity and improve practical performance.

First, we created a new write-only oblivious data structure (ODS), in the form of a Trie, to function as the position map. As with previous tree-based ODS schemes (Wang et al., 2014; Roche et al., 2016), our ODS scheme avoids recursive position map lookups by employing a pointer-based technique. That is, the pointer to a child node in a Trie node directly points to a physical location instead of a logical location, and therefore it is no longer necessary to translate a logical address to a physical address within the Trie itself. We note that the ODS idea has previously been applied to WoORAM by (Chakraborti et al., 2017a), although their overall scheme turns out the be insecure (see Section 6).

With the simpler position map stored as a Trie and the deterministic write-access pattern in DetWoORAM, we can manipulate the parameters to optimize the procedure with DetWoORAM. In particular, we will show how to pack write-updates of the position map Trie into block size chunks. With additional interleaving techniques, we will show that we can achieve a minimal communication complexity of $2B$, one block for the data and one block for position map and other updates. The details of these techniques are described in Section 3.3 and 3.4.

Stateless WoORAM

WoORAM is usually considered in a single-client model, but it is sometimes useful to have multiple clients accessing the same WoORAM. In a multi-client setting, even if the client has a large amount of local memory available, our improvements in local storage of eliminating stash and optimizing the position map are significant.

Because our scheme has no stash, we can convert our scheme to a stateless WoORAM with no overhead except for storing the encryption key and a few counter variables. On the other hand, previous schemes such as Path-ORAM and HiVE-WoORAM must maintain the stash of size $\omega(B\log N)$, which in the stateless setting must be transferred in its entirety on each write operation in order to maintain obliviousness.

Less randomness and storage for IVs

The deterministic and sequential access pattern fits nicely with encryption of each block using counter mode. Suppose the previous writes so far have cycled the physical storage $i$ times, and physical block $j$ is about to be encrypted. Then, the block can be encrypted with the counter $i\|j\|0^{\ell}$, where $\ell$ depends on how many times one needs to apply a block cipher to encrypt the entire block. That is, we can get indistinguishable symmetric encryption by storing just a single IV.

We stress that the above optimization cannot be applied to previous schemes due to the randomized procedure. For example, HiVE-WoORAM chooses instead random IVs to encrypt each block. These IVs must be stored separately on the server adding to the communication cost overhead.

Additionally, we remark that the implementation (Blass et al., 2014) of HiVE-WoORAM used RC4 as a PRG to choose random IVs for performance reasons, but the insecurity of RC4 lead to an attack on the implementation (Paterson and Strefler, 2015).

Implementation and experiments

We have implemented DetWoORAM using C++ and BUSE (block device in user space). We tested our implementation using Bonnie++ and fio on both a spinning-platter hard drive and a solid state drive, comparing the implementation to a baseline that performs encryption only (no obliviousness) as well as to an implementation of HiVE-WoORAM. We found that DetWoORAM incurs only a 3x-14x slowdown compared to an encryption-only baseline and around 6x-19x speedup compared to HiVE-WoORAM.

Insecurity of other proposed WoORAM improvement

DataLair (Chakraborti et al., 2017a) is another WoORAM scheme that has been proposed recently with the goal of improving the practical performance compared to HiVE-WoORAM. As our secondary contribution, we analyzed this WoORAM protocol, which achieves faster writes by tracking empty blocks within the WoORAM. We show in Section 6 that, unfortunately, the construction does not satisfy write-only obliviousness.

2. Background

2.1. Write-only ORAM

ORAM

An Oblivious RAM (ORAM) allows a client to store and manipulate an array of $N$ blocks on an untrusted, honest-but-curious server without revealing the data or access patterns to the server. Specifically, the (logical) array of $N$ blocks is indirectly stored into a specialized backend data structure on the server, and an ORAM scheme provides an access protocol that implements each logical access with a sequence of physical accesses to the backend structure. An ORAM scheme is secure if for any two sequences of logical accesses of the same length, the physical accesses produced by the access protocol are computationally indistinguishable.

More formally, let $\vec{y}=(y_{1},y_{2},\ldots)$ denote a sequence of operations, where each $y_{i}$ is a $read(a_{i})$ or a $write(a_{i},d_{i})$; here, $a_{i}\in[0,N)$ denotes the logical address of the block being read or written, and $d_{i}$ denotes a block of data being written. For an ORAM scheme $\Pi$, let $\mathsf{PhysicalAcc}^{\Pi}(\vec{y})$ denote the physical access pattern that its access protocol produces for the logical access sequence $\vec{y}$. We say the scheme $\Pi$ is secure if for any two sequences of operations $\vec{x}$ and $\vec{y}$ of the same length, it holds

[TABLE]

where $\approx_{c}$ denotes computational indistinguishability (with respect to the security parameter $\lambda$).

Since the seminal work by Goldreich and Ostrovsky (Goldreich and Ostrovsky, 1996), many ORAM schemes have been proposed and studied in the literature; see Section 7 for more related work.

WoORAM

Blass et al. (Blass et al., 2014) considered a relaxed security notion of write-only ORAM (WoORAM), where only the $write$ physical accesses are required to be indistinguishable. In particular, we say an ORAM scheme $\Pi$ is write-only oblivious if for any two sequences of logical accesses $\vec{x}$ and $\vec{y}$ containing the same number of $write$ operations, it holds

[TABLE]

where $\mathsf{WOnly}$ denotes a function that filters out the read physical accesses but passes the write physical accesses.

They also gave an WoORAM construction which is much more efficient than full ORAM constructions. We will briefly describe their construction below.

2.2. HiVE-WoORAM

Setting

In (Blass et al., 2014), to store $N$ logical blocks, the server needs a physical array $D$ of $M\geq 2N$ elements, where each element is a pair $(a,d)$, where $a$ is the logical address and $d$ is the actual data. Obviously, all the data in the backend storage $D$ is encrypted with an IND-CPA encryption scheme; throughout the paper, we will implicitly assume that the backend data is encrypted with an IND-CPA encryption scheme, even if we don’t use any encryption notations.

The client maintains a buffer, called ${\sf stash}$, that temporarily holds the blocks yet to be written to $D$. We assume for now that the client also maintains the position map $pos$ in its memory; the map $pos$ translates a logical address into the corresponding physical address.

This protocol depends crucially on parameter $k$, the number of physical writes per logical write. This is selected to ensure a very low probability of filling up the stash; according to (Blass et al., 2014), for $k=3$, the probability of having more than $50$ items in the stash at any given time is bounded by $2^{-64}$.

Write algorithm

The access protocol for $write(a,d)$ works as follows.

1. (1)

Insert $(a,d)$ into ${\sf stash}$ 2. (2)

Choose $k$ physical addresses $r_{1},\ldots,r_{k}$ uniformly at random from $[0,M)$. 3. (3)

For $i\in\{1,\ldots,k\}$ do:

1. (a)

Determine whether $D[r_{i}]$ is free by checking whether $pos[D[r_{i}].a]\neq r_{i}$. 2. (b)

If $D[r_{i}]$ is free and ${\sf stash}$ is nonempty, remove an element $(\alpha,\delta)$ from stash, set $D[r_{i}]\leftarrow\delta$, $D[r_{i}].a\leftarrow\alpha$, and update the position map $pos[\alpha]\leftarrow r_{i}$. 3. (c)

Otherwise, rewrite $D[r_{i}]$ under a new random IV.

Communication complexity

Let $M=O(N)$. Without considering the position map, their access protocol for write has fantastic communication complexity of $O(k(\log N+B))$, where $B$ is the size of a data block. In particular, with $k=3$ and assuming $B=\Omega(\log N)$, the communication complexity is $O(B)$. However, the size of the position map is $\Omega(N\cdot\log N)$, which is usually too large for the client to store in memory. This issue can be addressed by recursively storing the map in smaller and smaller ORAMs. Taking these recursion steps into account, the eventual communication complexity becomes $O(B\log^{2}N)$.

3. Deterministic WoORAM Design

In this section, we describe the algorithm for DetWoORAM construction. We begin by first describing a “toy construction” that has some of the key properties as the final algorithm, such as not employing a stash while using a deterministic write pattern. From this toy construction, we make a series of improvements that lead to our actual DetWoORAM construction with sequential write pattern and $2B$ communication cost per write.

3.1. A Toy Deterministic WoORAM Construction

The toy deterministic WoORAM construction is inspired by the square-root ORAM solution of Goldreich and Ostrovsky (Goldreich and Ostrovsky, 1996), adapted to the write-only oblivious setting. For now, we set aside the issue of the position map, which one could consider being stored by the user locally and separately from the primary procedure. Later, we will describe a method for storing the position map within an adjacent, smaller WoORAM.

Toy Construction.

Physical storage consists of an array $D$ of $2N$ data blocks of $B$ bits each. $D$ is divided into two areas, a main area and a holding area (see Figure 1), where each area contains $N$ blocks.

The key invariants of this construction, which will continue even with our complete non-toy construction later, are:

• •

Every block in the main area is stored at its actual address; therefore the main area does not need any position map.

• •

Every block in the holding area is overwritten only after it has been copied to the main area.

Each block of the storage area has an address $a$, and a user interacts with the system by writing data to an address within the main area, that is $a\in[0,N)$, and reading data back by referring to the address. In the main area, a block is always stored at its address, but in the holding area, blocks are appended as they are written, irrespective of their address.

In order to track where to write the next block in the holding area, we keep a counter $i$ of the number of write operations performed so far. Additionally, as the holding area is not ordered, there needs to be a position map that associates addresses $a\in[0,N)$ to the location in $[0,2N)$ of the freshest data associated with that address, either at the address within the main area or a more recent write to the holding area. The position map construction will be described later as a write-only oblivious data structure stored with in an adjacent, smaller WoORAM. For now, we abstract position map as a straightforward key-value store with operations $\textsc{getpos}(a)\rightarrow a^{\prime}$ and $\textsc{setpos}(a,a^{\prime})$

With parameter $N$, counter $i$, and the WoORAM storage array $D$, where $|D|=2N$, we can now define the primary operations of the toy WoORAM as in Algorithm 1. Note that the read operation, which for now is trivial and which may seem irrelevant for a write-only ORAM, is crucial to the practical performance. As we progress to more sophisticated WoORAM schemes, both the read and write operations will necessarily become more intricate.

Properties of toy construction.

Already, our toy construction has some of the important of the properties of our final construction. As explained below, it provides write obliviousness, it is deterministic, and it does not require a stash.

To see why the toy construction is write-oblivious, first consider that each write occurs sequentially in the holding area and has no correspondence to the actual address of the data. Writing to the holding area does not reveal the address of the data. Second, once the holding area has been filled completely with the freshest data, after $N$ operations, all the main area blocks are refreshed with data from the holding area, or re-encrypted if no fresher data is found in the holding area. Since all the main area blocks are written during a refresh, it is impossible to determine which of the addresses occurred in the holding area. In both cases, for a write to the holding area and during a refresh, the block writes are oblivious.

The toy construction also has a deterministic write pattern: the $i$-th write always touches the holding area block at index $N+(i\bmod N)$. As compared to previous ORAM and WoORAM schemes, in which writing (or access) requires randomly selecting a set (or path) of blocks to overwrite with the expectation that at least one of the blocks has the requisite space to store the written data, our construction does not require any random selection and operates in a completely deterministic manner.

Further, as each write is guaranteed to succeed—we always write sequentially to the holding area—there is no need for a stash. To the best of our knowledge, all other WoORAM schemes require a stash to handle failed write attempts. In some sense, one can think of the stash in these systems as providing state information about the current incomplete writes, and to have a stateless system the full size of stash would need to be transferred on every step (even if there is nothing in it). By contrast, our construction has constant state cost (ignoring the position map for now), which consists simply of the counter $i$ and the encryption key. Our construction continues to have constant unsynchronized client state even when we consider the de-amortized case with position map below.

3.2. De-amortizing the toy construction

We can advance upon the toy construction above by further generalizing the storage procedure via de-amortization of the refresh procedure as well as allowing the main and holding area to be of different sizes. The key idea of de-amortization is that instead of refreshing the main area once the holding area has been fully written, we can perform a few writes to the main area for each write to the holding area, so that it is fully refreshed at the same rate.

In this generalized setting, physical storage consists of a main area of size $N$ as before, and a holding area of size $M$, where $M$ is arbitrary, so that $|D|=N+M$.

The key to the de-amortized write procedure is that there needs to be a commensurate number of refreshes to the main area for each write to the holding area. After any consecutive $M$ writes to the holding area, the entire main area (of size $N$) needs to be refreshed, just like what would happen in the amortized toy construction.

When $N=M$, this is simply accomplished by performing one refresh for each write. When the sizes are unequal, we need to perform on average $N/M$ refreshes per write to achieve the same goal. For example, consider the case where $N=2M$, where the main area is twice as large as the holding area, then $N/M=2$, and thus we perform two refreshes for every write. After $M$ writes to the holding area, the entire main area will have been refreshed.

It is also possible to have ratios where $M>N$, such as $M=2N$ where the main area is half the size of the holding area, and in fact, this setting and $M=N\cdot{\left\lceil{\log(N)}\right\rceil}$ are both critical settings for performance. When $M>N$ this implies that we need to do less than one refresh per write, on average. Specifically for $N/M=1/2$, we perform a refresh on every other write to the holding area.

Algorithm 2 has the properties of performing on average $N/M$ refreshes per write, while the read operation is the same as before.

It is straightforward to see that the unequal size, de-amortized solution has the same key properties as the toy construction: it is write-oblivious, deterministic, and does not require a stash. It is clearly deterministic because just as before, writes and refreshes occur sequentially in the holding area and main area, respectively, and this also assures write-obliviousness for the same reasons discussed before. It still does not require a stash because every write will succeed, as the refresh pattern guarantees that the next write to the holding area will always overwrite a block that has already had the chance to be refreshed to the main area.

The only non-obvious fact may be the correctness of the scheme. In particular, is it possible for some write to the holding area to overwrite some other block which has not yet been refreshed to the main area? The following lemma justifies that such a situation cannot happen.

Lemma 3.1.

Consider Algorithm 2. For any time $i$ and address $a$, there exists a time $i^{\prime}$ when address $a$ is refreshed to the main area satisfying

[TABLE]

Proof.

Address $a$ is refreshed to main area whenever the current time $i^{\prime}$ is in the range $[s,e)$ in the for loop; namely, when

[TABLE]

This happens as soon as

[TABLE]

Because this is an inequality modulo $M$ on both sides, there exists some $i^{\prime}\in\{i,i+1,\ldots,i+M-1\}$ which satisfies it. $\blacksquare$

The consequence of this lemma is that, for any time $i$, the data which is placed in the holding area at address $N+(i\bmod M)$ will be refreshed to the main area before time $i+M$, which is the next time holding address $N+(i\bmod M)$ will be overwritten. Therefore no data is overwritten before it is refreshed to the main area, and no stash is needed.

3.3. Incorporating the Position Map

In this section, we consider methods for implementing a position map for DetWoORAM, and crucially, modifying the procedure so that only a single position map update per write is needed.

We first describe how to modify our algorithm so that we can store the position map recursively within successively smaller DetWoORAMs, and then show how to further improve by using a Trie-based write-only oblivious data structure (WoODS) stored within an adjacent DetWoORAM to the main, data-storing one.

Recursively stored position map.

One possibility for storing the position map is to pack as many positions as possible into a single block, and then store an adjacent, smaller WoORAM containing these position map blocks only. Then that WoORAM’s position map is stored in a smaller one, and so on, until the size is a constant and can be stored in memory or refreshed on each write. If at least two positions can be packed into each block, the number of levels in such a recursive position map is $O(\log_{B}N)$.

If we consider each of the recursive WoORAMs using the same write procedure as described in Algorithm 2, a problem quickly emerges. A write requires multiple updates to the position map due to the de-amortized procedure: one update to store the location within the holding area of the newly written data, and some number of updates to store the refreshed main areas. In a recursive setting, as these position map updates must occur for every recursive level of the position map, we can get exponential blow up. One write to the main WoORAM requires $O((1+M/N)^{R})$ writes at the smallest WoORAM, where $R\in O(\log_{B}N)$ is the number of recursive levels.

In HiVE-WoORAM, this issue is solved using additional state information of “metadata blocks”, each containing the actual index of the block as well as the IV used to encrypt that block. These metadata blocks are stored alongside the primary physical blocks for the WoORAM. Crucially, by storing the actual index associated with each block in memory, it is no longer necessary to update the position map multiple times for each write. While something similar would work for our system, we solve this problem more efficiently, avoiding the need for separate storage of metadata blocks entirely.

The difference here is not asymptotic, but helps in practice by essentially eliminating an extra metadata block read/write on every step. It also allows us to take better advantage of the uniform block setting, where even reading or writing a few bytes in a block requires transferring $O(B)$ bytes of data. This technique is crucial to our obtaining optimal $2B$ physical writes per logical write, as we show in the next section.

Position map pointers and one-bit diff technique.

To improve the position map and remove exponential blow-up in updating the position map, we recognize that we have a distinct advantage in DetWoORAM construction as compared to prior schemes in that for main area blocks, data is always located at its address. The holding area is the only portion of the WoORAM that needs a position map. The position map does not need to be updated for a refresh if we could determine the freshest block during a read.

To see this, consider a position map that simply stores a holding-area address. When we perform a read of address $a$, we need to look in two locations, both in the holding area at where the position map says $a$ is and in the main area at $a$. Given these two blocks, which is freshest data associated with $a$?

We can perform a freshness check between two blocks using the one-bit diff technique. Specifically, the position map gives a mapping of logical address $a\in[0,N)$ to a tuple $(a_{h},o,q)$, where $a_{h}\in[0,M)$ is an address to the holding area, $o\in[0,B)$ is a bit offset within a block, and $q\in{\{0,1\}}$ is the bit value of the freshest block at the offset $o$. We define the tuple $(a_{h},o,q)$ as a position map pointer.

Whenever a write occurs for logical address $a$ to holding area $a_{h}$, the offset $o$ is chosen so as to invalidate the old data at address $a$ in the main area. Specifically, we ensure that the $o$th bit of the new, fresh data $\textsc{dec}(D[a_{h}])$ is different from the $o$th bit of the old, stale data $\textsc{dec}(D[a])$. (If there is no difference between these, then the old data is not really stale and the offset $o$ can take any valid index, say 0.)

Given the pointer $(a_{h},o,q)$, a freshness check between two blocks $\textsc{dec}(D[a])$ and $\textsc{dec}(D[a_{h}])$ is performed as follows:

• Check if the $o$th bit of $\textsc{dec}(D[a])$ is $q$. If so, $\textsc{dec}(D[a])$ is fresh; otherwise $\textsc{dec}(D[a_{h}])$ is fresh.

The key observation is that when a block is refreshed to the main area, there is no need to update the position map with a new pointer, since the read operation always starts by checking if the block in the main area is fresh. If the main area block is fresh, then there is no need to even look up the holding area position (which may have been rewritten with some newer block for a different logical address). See Algorithm 3 for details of how this is accomplished.

Trie WoODS for Position Map

A more efficient solution for storing the position map, as compared to the recursively stored position map, is to use an oblivious data structure (ODS) in the form of a Trie. Recall that Trie edges are labeled, and looking up a node with a keyword $w_{1}w_{2}\cdots w_{\ell}$ is performed by starting with a root node and following the edge labeled with $w_{1}$, and then with $w_{2}$, and all the way through the edge labeled with $w_{\ell}$ one by one, finally reaching the target node.

As with previous tree-based ODS schemes (Wang et al., 2014; Roche et al., 2016), our ODS scheme avoids recursive position map lookups by employing a pointer-based technique. That is, the pointer to a child node in a Trie node directly points to a physical location instead of a logical location, and therefore it is no longer necessary to translate a logical address to a physical address within the Trie itself.

Applying an ODS in a write-only setting (a WoODS or write-only oblivious data structure) is similar to an idea proposed by Chakraborti et. al (Chakraborti et al., 2017a). A major difference in our construction is that we do not store the data structure within the primary WoORAM. We also allow changing the branching factor of the Trie independently of the block size, so we can tune the secondary WoORAM and flexibly control the number of physical block writes for every logical write, including position map information stored within the Trie.

As the WoODS Trie is stored in an adjacent DetWoORAM construction, we differentiate between the two WoORAMs by referring to the data WoORAM as the WoORAM storing data blocks and the position WoORAM as the WoORAM storing the nodes of the Trie. The Trie itself acts as the position map, and will map addresses in the data WoORAMs main area to position map pointers referencing the data WoORAMs holding area. The main idea is that given an address $a$, one can walk the Trie to find a leaf node storing $a$’s position map pointer. The position WoORAM will be strictly smaller than the data WoORAM, but will be implemented using the same DetWoORAM framework (i.e., using the notions of main area, the holding area, and the counter).

Details of the procedure for the position WoORAM is outlined in Algorithm 4. Observe that the functions for the position WoORAM call the READ and WRITE functions from Algorithm 3, but with modified versions of the subroutines for accessing and updating the position map, as the Trie is its own position map.

As noted, the Trie is stored in an adjacent WoORAM that has a main area and a holding area. The key difference is that the Trie nodes are addressed with the position WoORAM’s main area using heap indexing. For example, with a branching factor of $b=4$, the root node of the Trie has address 0, its children are at address 1, 2, 3, and 4, and their children are at addresses (5, 6, 7, 8), (9, 10, 11, 12), and so on. By using heap indexing, the structure of the Trie reveals the position of its nodes, becoming its own position map. In particular, this indexing avoids the need to store edge labels explicitly; they can instead be stored implicitly according to the heap indexing formulas.

It is still possible for a node of the Trie to have been recently updated and thus the freshest node information to be resident in the holding area of the position WoORAM. As such, each internal node of the Trie stores $b$ position map pointers to the position WoORAM’s holding area, one for each of its child nodes. A leaf node in the Trie then stores $b$ position map pointers to the data WoORAM’s holding area. The root node of the Trie can be stored as part of the local state, since it is constantly rewritten and read on every operation. A visual of the Trie is provided in Figure 3.

Reading from the Trie to retrieve a position map pointer for the data WoORAM is a straightforward process. One only needs to traverse from the root node to a leaf, following a path dictated by the address $a$ called via $\textsc{getpos-trie}(a,\texttt{DATA})$. On each step down the tree, the current Trie node stores the position map pointer of the child node; the corresponding sequence of nodes are retrieved via the path-nodes helper function. The position map pointers for the data WoORAM can be found at the correct index in the leaf node along the fetched path.

Updating a pointer in the Trie (by calling $\textsc{setpos}(a,ptr)$) is a bit more involved. An update of the position map for the data WoORAM requires updating a leaf node in the Trie within the position WoORAM. Writing that leaf node will change its pointer, which requires updating the parent node, whose pointer will then also change, and so on up to the root of the Trie. That is, each write to the main WoORAM requires rewriting an entire path of Trie nodes within the position WoORAM.

Recall that in DetWoORAM, each write operation not only writes one block to the holding area, but also performs some refreshes in the main area. The challenge is, for each refresh, determining where in the holding area fresher data might be. For the data WoORAM, this is achieved simply by performing a lookup in the position map. But for the position WoORAM, there is no position map! Instead, we use the Trie itself to look up the pointer for fresher data in a position WoORAM refresh operation, by calling $\textsc{getpos-trie}(a,\texttt{TRIE})$. This is possible again because of the heap indexing; from the index of the Trie node that is being refreshed, we can determine all the indices of the nodes along the path to that one, and then perform lookups for the nodes in that path to find the position WoORAM holding area location of the node being refreshed.

Trie WoODS parameters and analysis

We start by calculating $N_{p}$, which is the number of Trie nodes as well as the size of the position WoORAM main area. This needs to be large enough so that there is room for $N$ pointers in the leaf nodes, where $N$ is the number of logical addresses in the data WoORAM. With branching factor $b$, the number of Trie nodes is given by

[TABLE]

To derive (3.1) above, consider that each Trie node holds $b$ pointers, either to children in the Trie or to addresses in the data WoORAM. We do not count the root node in $N_{p}$ because it changes on each write in is stored in the $O(1)$ client local memory. The total number of pointers or addresses stored is therefore $N_{p}+N$. This leads to the inequality $(N_{p}+1)b\geq N_{p}+N,$ which implies $N_{p}={\left\lceil{\frac{N-b}{b-1}}\right\rceil}.$ The form of (3.1) is a simple rewriting of this floor into a ceiling based on the fact that, for any two integers $x,y$, ${\left\lceil{x/y}\right\rceil}={\left\lfloor{(x+y-1)/y}\right\rfloor}.$

The height of the Trie is then equal to the height of a $b$-ary tree with $N_{p}+1$ nodes, which is $O(\log_{b}N)$. This is the number of Trie nodes that need to be written to the holding area of the position WoORAM on each update (including a potential dummy node).

Each write to the data WoORAM requires rewriting $h\in O(\log_{b}N)$ nodes in the Trie (for a single path). Each of those writes to the holding area of the position WoORAM needs, on average, $N_{p}/M_{p}$ number of refreshes to the main area, where $N_{p}$ is the size of the position WoORAM’s main area and $M_{p}$ is the size of the position WoORAM’s holding area.

Looking up a position in the Trie requires reading $O(\log_{b}N)$ blocks in the position WoORAM, each of which results in up to two physical reads due to having to check for fresher data. A refresh operation in the position WoORAM also requires a read of the Trie to determine if fresher data for that node exists in the holding area. If the sizes of the main area $N_{p}$ and holding area $M_{p}$ for the position WoORAM are not set appropriately, this could lead to $O(\log^{2}N)$ reads to perform an update. However, consider that we can control the ratio $N_{p}/M_{p}$. If we set $M_{p}\gg N_{p}\log_{b}N$ then we need to perform only $O(1)$ refreshes per position map update, thus requiring $O(\log N_{p})$ reads per update.

If $N$ is a power of $b$, then the number of leaf nodes in the Trie $N/b$ is also a power of $b$, and the Trie is a complete $b$-ary tree of height $\log_{b}(N/b)$. If $N$ is not a power of $b$, then the last level of the Trie is incomplete, and leaf node heights may differ by one. In order to preserve write obliviousness, in cases of rewriting a path with smaller height, we add one additional dummy node write.

Finally, observe that the branching factor $b$ can play a role in the performance. With $b=2$, the size of a Trie path is minimized, but the height and number of nodes $N_{p}$ are maximal. Increasing $b$ will reduce the height of the Trie and the number of Trie nodes, while increasing the total size of a single path. As we will show next, adjusting the packing of position map by setting the branching factor $b$ can be done carefully to achieve write communication cost of exactly $2B$ in a fully sequential write pattern.

3.4. Fully Sequential Physical Write Pattern

In this section, we describe how to achieve fully sequential writing of physical storage and how to minimize the communication cost. This requires interleaving the various storage elements of DetWoORAM such that all the writing, regardless of which part of the construction is being written, occurs sequentially.

To understand the challenge at hand, first consider a simple implementation which aligns the data WoORAM (main and holding areas) adjacent to the position WoORAM (main and holding area) forming a single storage data array broken into size-$B$ blocks. A write to the data WoORAM will result in a write to the holding area plus $M/N$ average writes to the main area. The position map is also updated, requiring $O(\log_{b}N)$ nodes in the Trie to be written to the holding area and $O(1)$ refreshes of the position WoORAM’s main area, provided $M_{p}\in\Omega(N_{p}\log_{b}N)$. While all these writes occur sequentially within their respective data/position WoORAM main/holding areas, do not occur sequentially on the underlying storage device as each of the various WoORAM areas are separated. Furthermore, the writes to the position map are wasteful in that they may update only a few nodes, constituting just a small fraction of the block, but in the uniform access model this in fact requires updating the entire block.

We can improve on this storage layout and achieve a minimum in write performance requiring exactly $2$ blocks to be written to physical storage for each block write, where one block is the new data, a half block worth of main area refresh, and a half block worth of position map updates. Further, we can interleave the various WoORAM portions such that those $2$ blocks are written sequentially on the physical device.

Data WoORAM Block Interleaving

Every logical block write to the data WoORAM results in exactly one block write to the holding area of data WoORAM. Recall that there are two parameters for setting up DetWoORAM: $N$, the size of the main area, and $M$, the size of the holding area. These two values need not be the same, and in fact, to achieve sequential writing, we will set $M=2N$. In this case, on average $\frac{M}{N}=\frac{1}{2}$ block is refreshed to the main area for each logical write.

With adjacent main and holding areas, this could be achieved by performing one full block refresh on every other logical write. To make the writing sequential, we will instead refresh half of a block on every logical write, resulting in the following storage layout:

[TABLE]

where $m^{0}_{j}$ is the first half of the block $m_{j}$, $m^{1}_{j}$ is the back half of $m_{j}$, and $\square$ represents empty space. (This empty space will be used to store nodes for the position WoORAM, as we will show next.)

There is a slight complication to reading now, as a single main area block is actually divided between two physical memory locations, resulting in an additional (constant) overhead for reading operations. The benefit is that the writing is fully sequential now: each logical write requires writing sequentially the data being updated (to the holding area), and the next half block of data being refreshed (to the main area), plus another half-block containing position map information as we will detail next. Also observe that, under this configuration with $M=2N$, the total physical memory requirement will be $4N$ blocks.

Position WoORAM Block Interleaving

As suggested above, the remaining half-block of data $\square$ in the above construction will be used to store position map information. A diagram storage achieving 2 sequential physical block writes per logical write is shown in Figure 4.

Specifically, these $\frac{B}{2}$ bits will store the Trie nodes written to position WoORAM holding and main areas during a single logical write operation. This is (potentially) possible because the Trie nodes in the position WoORAM are much smaller than the blocks in the data WoORAM. Fully sequential writing will be achieved if and only if all of the Trie nodes written during a single step can always fit into $B/2$ bits.

There are many settings of parameters $M$, $b$, and $M_{p}$ that may make sequential writing possible, depending on logical and physical memory requirements and the physical block size $B$. We will choose some parameters here and demonstrate that they would work for any conceivable value of $N$.

For this purpose, set the branching factor $b=2$, and then recall from (3.1) that the number of Trie nodes and the Trie height will be $N_{p}=N-2$ and $h={\left\lceil{\lg(N-2)}\right\rceil}$, respectively.

Next, set the number of nodes in the position WoORAM holding area to be

[TABLE]

This ensures that only (at most) one Trie node needs to be refreshed to the position WoORAM main area when writing an entire path of $h$ Trie nodes during a single logical write operation. (The number of Trie nodes written to the holding area for each operation is always $h$.) Based on these formulae, we need to have enough space in the $B/2$ bits of a half block to fit $h+1$ Trie nodes.

What remains is to estimate the size of each Trie node. Each node stores $b=2$ DetWoORAM pointers, each of which contains ${\left\lceil{\lg M}\right\rceil}$ bits for the holding area position, ${\left\lceil{\lg B}\right\rceil}$ bits for the block offset, and 1 bit for the bit diff value. The condition that $h+1$ Trie nodes fit into $B/2$ bits then becomes

[TABLE]

Combining this inequality with all of the previous settings for $b$, $M$, and $M_{p}$, and assuming a block size of 4096 bytes (so $B=4096\cdot 8=2^{15}$) as is the default in modern Linux kernels, we have

[TABLE]

That inequality is satisfied for values of $N$ up to $6.6\times 10^{35}$, which is much more than any conceivable storage size. Further tuning of the $b$ and $M$ parameters could be dome to achieve an even tighter packing and/or better read performance while maintaining 2 physical block writes per logical write.

3.5. Encryption Modes

The deterministic and sequential access pattern fits nicely with encryption of each block using counter mode. In particular, We encrypt each DetWoORAM block using AES encryption based on the number $i\|0^{64}$ as a counter. Recall that the client maintains the global counter $i$ (64-bit long). Assuming the block size $B$ is reasonable (shorter than $2^{64}\cdot 16$ bytes), there will be no collision of IVs, and the security of encryption is guaranteed. We stress that we do not need space for storing IVs due to this optimization which cannot be applied to previous schemes. For example, the randomized procedures in schemes like HiVE-WoORAM, IVs must be stored separately on the server, adding to the communication cost overhead.

However, the physical blocks that store the position map Trie are encrypted with AES in CBC mode. When we pack multiple Trie nodes together, such as during interleaving or packing as described previously, we can encrypt a group of Trie nodes together in one shot using a single IV. Since Trie nodes are much smaller than $B$, we can place that IV for that group of nodes at the beginning of the block itself, thus avoiding an extra memory access on read or write.

We note that after packing the Trie nodes into blocks, the number of blocks in the main DetWoORAM is significantly larger than that in the Position-DetWoORAM, so that most of the data is encrypted using counter mode.

4. Analysis of DetWoORAM

We formally state the security (obliviousness), and communication complexity of DetWoORAM. Fortunately, the simplicity of the construction makes the proofs relatively straightforward in all cases.

Security proof

First we state the security in terms of the definitions in Section 2.1.

Theorem 4.1.

DetWoORAM provides write-only obliviousness.

Proof.

Let $\vec{x}$ and $\vec{y}$ denote two sequences of operations in DetWoORAM that contain the same number of write operations.

The sequence of locations of physical writes is deterministic and does not in any way depend on the actual locations being written, and the contents of physical writes are encrypted using an IND-CPA symmetric cipher. Therefore ii it holds that

[TABLE]

because the locations in these two access patterns are identical, and the contents in the access patterns are indistinguishable from random. $\blacksquare$

Communication complexity

For the complexity analysis, assume that:

• •

the size ratio $M/N$ is a constant,

• •

the branching factor $b$ is a constant,

• •

the block size $B$ is large enough to contain a single path of trie nodes, and

• •

the position map holding area is at least $O(\log N)$ times larger than the position map’s main area.

Asymptotically this means that $B\in\Omega(\log^{2}N)$. From a practical standpoint, even in the extreme case of storing a yottabyte of data ($2^{80}$ bytes), with holding area size $M=N$, branching factor $b=2$, and 4KB blocks (i.e., $B=4096$), an entire path of trie nodes is still well below the block size at 1496 bytes.

Theorem 4.2.

Under the assumptions above, the number of physical block writes per logical block write in DetWoORAM is $O(1)$. Furthermore, the number of physical block reads per logical read or write operation is $O(\log N)$.

Proof.

Let $h\in O(\log_{b}N)$ for the height of the trie that stores the position map. A single read to DetWoORAM requires at most two block reads and one position map lookup, which requires fetching all $h$ nodes in the Trie path to that position. Fetching a Trie node in the position WoORAM requires accessing the parent node as well, requiring at most $2h$ nodes need to be fetched. In the worst case every node might be packed in a different block, so this is $O(1+h)$ physical block reads per logical read, which is $O(\log_{b}N)$.

A single write to DetWoORAM requires at most $1+\lceil M/N\rceil$ block writes to holding and main areas and one update to the position map Trie. Each main area refresh requires an additional block read and position map lookup. Because $M/N$ is a constant, this is $O(1)$ block writes, $O(\log_{b}N)$ reads, and one trie update.

Updating a single node in the Trie involves first fetching the path to that node in $O(\log_{b}N)$ physical reads, then writing each node on that path, updating the pointers in the parent nodes from leaf back up to root. This requires $h$ writes to the position map WoORAM, which from the assumptions will require $h$ writes to the holding area plus $O(1)$ refreshes in position map WoORAM’s main area. These $O(1)$ refreshes each require looking up $O(\log_{b}N)$ nodes in the position map WoORAM, for an additional reading cost of up to $O(\log N)$ physical blocks.

All together we get $O(\log_{b}N)$ physical reads per logical write, and $O(1)$ physical writes per logical write. $\blacksquare$

5. Implementation

We have implemented our DetWoORAM system, using the Trie-based position map, in an open source C++ library available at https://github.com/detworam/detworam. As we will show in this section, comparison benchmarks validate our theoretical results on the efficiency of DetWoORAM, showing it to be many times faster than the previous scheme of HiVE-WoORAM, and only a few times slower than a non-oblivious baseline.

Our library

The library relies on BUSE (Block device in USErspace, https://github.com/acozzette/BUSE) to allow mounting a normal filesystem as with any other device. We also use the mbed TLS library (https://tls.mbed.org/) for encryption utilities. We also made extensive use of C++ templates in our implementation, which allows for considerable flexibility in choosing the parameters for the DetWoORAM and automatically tuning the performance at compile-time. For example, based on the size and number of backend storage blocks, the exact byte sizes needed to store pointers, relative proportion of data WoORAM to position map WoORAM, trie height, and relative main/holding area sizes will all be seamlessly chosen at compile time.

The implementation is exactly as described in the previous section, with a default Trie branching factor of $b=64$ unless otherwise noted. The only exception is that we did not implement the full interleaving, but rather the packing solution within the position map WoORAM to pack trie nodes into single blocks. Two blocks at a time (from the position map holding and position map main areas) are held in memory while they are being filled sequentially, and then are written back to disk once filled. In total, the result is that rather than having a fully sequential access pattern as we would with full interleaving, we see 4 sequential write patterns in sub-regions of memory.

Comparisons

We carefully re-implemented the HiVE-WoORAM (only the WoORAM part, not the hidden volume part), using the same BUSE/mbedTLS library setup. As in their original paper and implementation, our HiVE-WoORAM implementation uses $k=3$ random physical writes per logical write, and makes use of a recursive position map. The original implementation was as a kernel module for a device mapper, but unfortunately due to Linux kernel changes this module is incompatible with recent Linux kernels. In fact, this incompatibility was part of our motivation to use only standards-compliant userspace C++ code for our DetWoORAM implementation.

For a baseline comparison, we wanted to use the best existing solution with the same general setup as ours. Our baseline uses the linux kernel module dm-crypt, which provides an encrypted block device with no obliviousness, connected to simple “passthrough” device that comes with the BUSE distribution. There is no obliviousness in this option; it simply encrypts/decrypts and stores the resulting ciphertext in the same location on disk. This provides a fair baseline to our work, and should help to eliminate any bottlenecks or artifacts of the BUSE layer in order to have a clear comparison with our new DetWoORAM protocol.

Measurement using bonnie++

Table 2 shows the results of running the popular bonnie++ disk benchmarking tool our the plain encryption as well as different WoORAM settings. All tests were performed with a 40GB logical filesystem within a 200GB partition, using the btrfs filesystem.

We tested using 200GB partitions on a 1TB HDD (HGST Travelstar 7200RPM) and on a 256GB SSD (Samsung 850 Pro). We note that both drives are standard commodity disks available for around $100 USD. As expected, the SSD drive is considerably faster for both reading and writing.

Recall that one novel feature of DetWoORAM is that it can flexibly adapt to different storage ratios between logical and physical storage. We tested both with $M=N$, similar to the HiVE-WoORAM, and with more physical space of $M=3N$, and observed a slight (but statistically meaningful) performance improvement from having more physical disk space (and therefore larger holding area in the DetWoORAM). We also tested with different branching factors ranging from $b=2$ to $b=512$, but did not notice any significant timing differences overall, indicating that the position map plays a smaller role in the overall performance.

Overall we can see that the DetWoORAM suffers only a 3x-10x slowdown compared to the baseline, whereas the HiVE-WoORAM is almost 200x slower in the case of writing and 15x slower for reading compared to the same baseline. The results for HiVE-WoORAM are consistent with the results reported in their original paper (Blass et al., 2014).

In fact, our DetWoORAM running on an SSD is in most cases faster than the baseline running on a spinning disk HDD, providing good evidence that our system is fast enough for practical use. We believe this is largely explained by the sequential write pattern of DetWoORAM, which also makes read operations partially sequential. For large sequential workloads, the data locality appears to have a very significant effect on performance.

Measurement using fio

As has been noted in previous WoORAM works (Blass et al., 2014), performing sequential logical operations can put WoORAMs in an especially bad light, as the baseline non-oblivious storage will translate the sequential read/write operations to physically sequential addresses, thereby gaining significantly over WoORAMs that need to obscure the logical address of each operation.

Interestingly, our DetWoORAM is a somewhat “in-between” case here, as the write pattern is completely sequential, and the read pattern is partially sequential: the main area of storage corresponds exactly to physical addresses, but the holding area and position map do not. We used a second disk performance measurement tool fio (https://github.com/axboe/fio) in order to perform random reads and writes, as opposed to the sequential read/write pattern of the bonnie++ benchmarks. The results are shown in Table 3, which shows the throughput for random reads and writes of 4KB-4MB sized blocks in direct access to the device without any filesystem mounted.

As expected, the performance degradation for HDD compared to SSD in all cases was significant for the random reads and writes. As with the bonnie++ benchmarks, but more dramatically here, our DetWoORAM running on an SSD outperformed the baseline running on the HDD. Even more surprisingly, on the HDD our DetWoORAM was only 1.6x slower than the baseline. This can be explained in part by the fact that our scheme actually turns random writes into sequential writes, so although it performs more writes than the baseline, they will be more compact in this experiment.

6. Insecurity of DataLair

A recent paper (Chakraborti et al., 2017a) has also proposed to improve the performance of HiVE-WoORAM. While this paper contains some new and promising ideas, and in particular proposed the use of a B-tree ODS similar to our Trie ODS for the position map, unfortunately it violates the notion of write-only obliviousness.

Intuitively, the DataLair scheme identifies that a bottleneck in HiVE-WoORAM is in identifying free blocks from the random blocks chosen, and propose to modify the random block choosing scheme in order to find free blocks more efficiently with fewer dummy writes. Unfortunately, this improvement leaks a small amount of information about which blocks are free or not, and thereby allows an adversary to distinguish between whether recent writes have been to the same address, or to different addresses. We formalize this notion and prove the insecurity of these schemes below.

We note that, since the submission of this work, the authors of (Chakraborti et al., 2017a) have acknowledged the vulnerability here and proposed a fix as a preprint (Chakraborti et al., 2017b).

Overview of scheme

Let $N$ be the number of logical blocks. DataLair sets $2N$ to the number of physical blocks so that the number of free physical blocks is always $N$. In DataLair (Chakraborti et al., 2017a, Section IV), every ORAMWrite considers two disjoint sets of $k$ items:

• •

Free set $S_{0}$: A set of $k$ blocks chosen randomly among the $N$ free physical blocks.

• •

Random set $S_{1}$: A set of $k$ blocks chosen randomly among the entire $2N$ physical blocks.

To make sure that $S_{0}$ and $S_{1}$ are disjoint, some elements may be removed and addional steps of sampling may be done. Based on the two sets, the ORAM writes a data block as follows:

ORAMWrite($d$): // $d$ is a data block

1. (1)

Insert $d$ in ${\sf stash}$ 2. (2)

Create two sets $S_{0}$ and $S_{1}$ as described above. 3. (3)

Choose $k$ blocks $U=\{u_{1},\ldots,u_{k}\}$ as follows:

For $i=1$ to $k$:

… $b_{i}{\,\leftarrow\,}{\{0,1\}}$, and fetch (and remove) $u_{i}$ from $S_{b_{i}}$.

… If $b_{i}=0$ and ${\sf stash}$ is not empty:

…… Take out a data item from ${\sf stash}$ and write it in $u_{i}$.

… Otherwise, reencrypt $u_{i}$.

We assume $N>2k$ and $k\geq 3$. The actual scheme chooses a large $N$ and $k=3$.

Insecurity of the scheme

We note that the access pattern of a single ORAMWrite is hidden. However, that alone is not sufficient to show write obliviousness. In particular, security breaks down when one considers multiple ORAMWrite operations.

Observe that the above algorithm is more likely to choose a free block than a non-free block; with probability 1/2, a chosen block will be from $S_{0}$ and thereby always free, and with probability 1/2, a chosen block will be from $S_{1}$ and thereby sometimes free. This tendency towards choosing free blocks leaks information. To clarify our point, consider the following two sequences of logical writes:

[TABLE]

Here, $w_{i}$ denotes writing data to a logical address $i$, and $init$ is a sequence of operations that makes the ORAM have exactly $N$ free blocks.222 Their ORAM seems to be initialized with exactly $N$ free blocks, in which case $init$ contains no operation. If that’s not the case, we can set the $init$ sequence as follows:

init=(w_{0},\ldots,w_{N-1},\underbrace{w_{0},\ldots,w_{0}}_{\mbox{\lambda times}}),

where $\lambda$ is the security parameter. Note that after the $init$ sequence, the ORAM will have exactly $N$ non-free physical blocks and $N$ free physical blocks with probability least $1-{\sf negl}(\lambda)$. So, we can safely ignore this negligible probability, and proceed our argument assuming that the ORAM has exactly $N$ free blocks after the $init$ sequence.

Let $U_{i}=(u_{i,1},\ldots,u_{i,k})$ be the set of chosen blocks from the $i$th ORAMWrite after the $init$ sequence. Let $d_{\ell}$ be the data in logical block $\ell$.

Then, in ${\sf seq}^{0}$, physical block $\gamma\in U_{1}$ containing $d_{0}$ will be probably freed up thanks to the second $w_{0}$, and the last $w_{2}$ may be able to choose $\gamma$ as a free block. However, in ${\sf seq}^{1}$, the block $\gamma$ cannot be freed up by $w_{1}$, since $\gamma$ contains $d_{0}$! So, the last $w_{2}$ can choose $\gamma$ only as a non-free block. Due to the different probablity weights in choosing free blocks vs. non-free blocks, $U_{1}$ and $U_{3}$ are more likely to overlap in ${\sf seq}^{0}$ than in ${\sf seq}^{1}$, and security breaks down.

To clarify our point, we give an attack. Given an access pattern $(U_{1},U_{2},U_{3})$, the adversary tries to tell if it is from ${\sf seq}^{0}$ or ${\sf seq}^{1}$. Consider the following events:

• •

$X$: $u_{1,1}\not\in U_{2}$,       $Y$: $u_{1,1}\in U_{3}$,       $E$: $X\wedge Y$

The adversary works as follows:

… Output 0 if $E$ takes place; otherwise output a random bit.

Let $p^{b}=\Pr[E]$ from ${\sf seq}^{b}$. We show that $p^{0}-p^{1}$ is non-negligible, which proves that the adversary is a good distinguisher.

Let $F_{i}(u)$ denote a predicate indicating whether a physical block $u$ was free when the $i$th ORAMWrite starts. Note that whether $u_{1,1}$ belongs $U_{3}$ ultimately depends on $F_{3}(u_{1,1})$. In particular, for any $u_{1,1}$, we have

[TABLE]

The following table shows how $F_{3}(u_{1,1})$ depends on the previous events. In the table, $D_{2}(u)\in\{f,d_{0}^{*},\ldots,d_{N-1}^{*},d_{0}\}$ denotes a random variable indicating which logical block a physical block $u$ contains when the second ORAMWrite starts. If the value is $f$, it means the block is free, and $d_{\ell}^{*}$ is the initial data for the logical block $\ell$ that the ORAM initialization procedure used. The value $d_{0}$ denotes the data block used in the first $w_{0}$ operation in ${\sf seq}^{0}$ and ${\sf seq}^{1}$. Let $S_{i}(\ell)$ denote a predicate indicating whether a logical block $\ell$ is in the stash when the $i$th ORAMWrite starts. In addition, ${\sf FreeSet}_{i}$ denotes a predicate indicating whether the $i$th ORAMWrite found a physical block in the free set $S_{0}$ (thereby successfully writing the input logical block in the free physical block).

[TABLE]

For example, in case $c3$,

• •

$D_{2}(u_{1,1})=d_{0}$: When the second ORAMWrite begins, the physical block $u_{1,1}$ contains the logical block $d_{0}$.

• •

$S_{2}(d_{0})=0$: When the second ORAMWrite begins, the stash is empty.

• •

$({\sf FreeSet}_{2}|X)=1$: The second ORAMWrite found at least one block in the free set $S_{0}$.

• •

For ${\sf seq}^{0}$, the second write is $w_{0}$. From ${\sf FreeSet}_{2}=1$, a new $d_{0}$ from $w_{0}$ will be written in a free block, and $u_{1,1}$ containing the old $d_{0}$ is freed.

• •

For ${\sf seq}^{1}$, the second write is $w_{1}$. From ${\sf FreeSet}_{2}=1$, a new $d_{1}$ from $w_{1}$ will be written in a free block, but $u_{1,1}$ containing $d_{0}$ is not affected.

Note that the first ORAMWrite in both ${\sf seq}^{0}$ and ${\sf seq}^{1}$ is the same with $w_{0}$, so $D_{2}(u_{1,1})$ and $S_{2}(d_{0})$ is identically distributed for both ${\sf seq}^{0}$ and ${\sf seq}^{1}$. Moreover, observe that the distribution of $X$ depends on only $u_{1,1}$ because the ORAMWrite samples $U_{2}$ at random. Finally, $\Pr[{\sf FreeSet}_{2}]$ is always the same, since the number of free blocks in the second ORAMWrite is always the same with $N$.

Based on the table and the above observation, we have the following:

[TABLE]

Now, let’s first calculate the lower bound on $\Pr[c3|X]$. If the first ORAMWrite chooses at least one block from the free set and writes $d_{0}$ in $u_{1,1}$, it must be $D_{2}(u_{1,1})=d_{0}$ and $S_{2}(d_{0})=0$. Therefore,

[TABLE]

Moreover, at least probability $\frac{1}{2}$, the second ORAMWrite will find a block from the freeset, which implies that

[TABLE]

To calculate the upper bound on $\Pr[c6|X]$, observe that $D_{2}(u_{1,1})=d^{*}_{1}$ implies that $u_{1,1}$ contained $d^{*}_{1}$ even before the first ORAMWrite $w_{0}$. Therefore, we have

[TABLE]

Therefore, we have

[TABLE]

7. Related Work

Oblivious RAM (ORAM) and applications.

ORAM protects the access pattern so that it is infeasible to guess which operation is occurring and on which item. Since the seminal work by Goldreich and Ostrovsky (Goldreich and Ostrovsky, 1996), many works have focused on improving efficiency and security of ORAM (for example (Stefanov et al., 2013; Ren et al., 2015; Moataz et al., 2015; Sahin et al., 2016) just to name a few; see the references therein).

ORAM plays as an important tool to achieve secure cloud storage (Stefanov and Shi, 2013b, a; Mayberry et al., 2014) and secure multi-party computation (Gordon et al., 2012; Liu et al., 2014, 2015; Wang et al., 2015; Zahur et al., 2016) and secure processors (Fletcher et al., 2015; Liu et al., 2015; Nayak et al., 2017). There also have been works to hide the access pattern of protocols accessing individual data structures, e.g., maps, priority queues, stacks, and queues and graph algorithms on the cloud server (Toft, 2011; Blanton et al., 2013; Wang et al., 2014; Roche et al., 2016). The work of (Jia et al., 2016) considers obliviousness in the P2P content sharing system.

Write-only obliviousness

Blass et al. (Blass et al., 2014) considers write-only ORAM (WoORAM), and gave a WoORAM construction much more efficient than the traditional ORAM constructions. They applied WoORAM to deniable storage scenarios and gave a WoORAM-based construction of hidden volume encryption (HiVE). Aviv et al. (Aviv et al., 2017) gave a construction of oblivious synchronization and backup for the cloud environment. They observed that write-only obliviousness is sufficient for the scenario, since the client stores a complete local copy of his data, and therefore $read$ accesses are naturally hidden from the adversary.

Deniable storage

Anderson et al. (Anderson et al., 1998) proposed steganography-based approaches, that is, hiding blocks within cover files or random data. There are works based on his suggestion (McDonald and Kuhn, 1999; Pang et al., 2003), but they don’t allow deniability against a snapshot adversary.

Another approach is hidden volumes. Unfortunately, existing solutions such as TrueCrypt (discontinued now) (TrueCrypt, 2017), Mobiflage (Skillen and Mannan, 2014) and MobiPluto (Chang et al., 2015) are secure only against a single-snapshot adversary. HIVE (Blass et al., 2014) provides security even against a multiple-snapshot adversary. DEFY (Peters et al., 2015) is the deniable log-structured file system specifically designed for flash-based, solidstate drives; although it is secure against a multiple-snapshot adversary, it doesn’t scale well.

8. Conclusion

We presented DetWoORAM, a stash-free, deterministic write-only oblivious ORAM with sequential write patterns. This scheme achieves asymptotic improvement in write communication costs, $O(B\log N)$, requiring exactly $2B$ physical writes per logical write. We further showed that prior schemes to improve on HiVE-WoORAM are insecure. Finally, we implemented and evaluated DetWoORAM, and, for sequential writing, it incurs only a 3-4.5x overhead on HDD and 10-14x on SSD compared to using encryption only. It is 19x faster than HiVE-WoORAM, the previous best, secure scheme. It is also practical; the theoretical write complexity is optimal, and DetWoORAM with an SSD backend has similar (sometimes better) performance compared to using encryption only on a spinning-platter HDD in a similar price range.

Acknowledgements.

The authors thank the CCS program committee for their valuable suggestions. This work is supported by the Sponsor Office of Naval Research https://www.onr.navy.mil/ under awards Grant #N0001416WX01489 and Grant #N0001416WX01645, and by the Sponsor National Science Foundation https://www.nsf.gov/ under awards Grant #1618269 and Grant #1319994.