Secure and Private Cloud Storage Systems with Random Linear Fountain Codes

TL;DR

This paper introduces SAPIR, an information-theoretic framework for secure and private data retrieval in distributed cloud storage using Random Linear Fountain codes, ensuring secrecy and privacy even with server collusion.

Contribution

It presents a novel coding scheme combining RLF codes with a PIR protocol that guarantees asymptotic perfect secrecy and privacy against colluding servers.

Findings

Achieves asymptotic perfect secrecy with at least one uncorrupted server.

Provides a PIR scheme that protects user privacy against multiple colluding servers.

Demonstrates the effectiveness of the approach in distributed storage systems.

Abstract

An information theoretic approach to security and privacy called Secure And Private Information Retrieval (SAPIR) is introduced. SAPIR is applied to distributed data storage systems. In this approach, random combinations of all contents are stored across the network. Our coding approach is based on Random Linear Fountain (RLF) codes. To retrieve a content, a group of servers collaborate with each other to form a Reconstruction Group (RG). SAPIR achieves asymptotic perfect secrecy if at least one of the servers within an RG is not compromised. Further, a Private Information Retrieval (PIR) scheme based on random queries is proposed. The PIR approach ensures the users privately download their desired contents without the servers knowing about the requested contents indices. The proposed scheme is adaptive and can provide privacy against a significant number of colluding servers.

Equations

$$c_j^i=\sum _{k=0}^m{v}_k^{i,j}{f}_k=\mathbf{f}{\mathbf{v}}_j^i,$$

$${\mathbf{y}}_r={\mathbf{V}}^T{\left(\mathbf{V}{\mathbf{V}}^T\right)}^{-1}{\mathbf{e}}_r.$$

$$f_r=\mathbf{f}{\mathbf{e}}_r=\mathbf{fV}{\mathbf{y}}_r=\sum _{i=1}^{J_k}\mathbf{f}{\mathbf{V}}_i{\mathbf{y}}_r^i.$$

$$f_r=\mathbf{f}{\mathbf{e}}_r=\mathbf{fV}{\mathbf{y}}_r=\sum _{i=1}^{J_k-1}\mathbf{f}{\mathbf{V}}_i{\mathbf{y}}_r^i+\mathbf{f}{\mathbf{V}}_{J_k}{\mathbf{y}}_r^{J_k}.$$

$$S_r=f_r+T_r.$$

$$I(R;{\mathcal{Q}}_l)=0$$

$$\mathbb{P}[{\rho }_m(l)$$

$$2^{-s(s+c)}\prod _{i=s+1}^{\infty }\left(1-\frac{1}{2^i}\right)\prod _{j=1}^{s+c}{\left(1-\frac{1}{2^j}\right)}^{-1}$$

$$\mathbb{P}[\rho (l)=m]\to \prod _{i=c+1}^{\infty }\left(1-\frac{1}{2^i}\right)$$

$$\mathbb{P}[A\le m+c]\to \prod _{i=c+1}^{\infty }\left(1-\frac{1}{2^i}\right)$$

$$F(c)\to \frac{F(c-1)}{1-\frac{1}{2^c}}.$$

$$F(c-1)\le 1-2^{-c}.$$

$$\mathbb{P}[A=m+c]=F(c)-F(c-1)\to F(c-1)\left(\frac{1}{1-\frac{1}{2^c}}-1\right)$$

$$=F(c-1)\left(\frac{1}{1-\frac{1}{2^c}}-1\right)=\frac{F(c-1)}{2^c-1}\le \frac{1-2^{-c}}{2^c-1}=2^{-c}$$

$$1-2^{-c}\le F(c)\le 1-2^{-(c+1)}$$

$$F(c)$$

$$=1-\sum _{i=c+1}^{\infty }\mathbb{P}[m+i]\ge 1-\sum _{i=c+1}^{\infty }{2}^{-i}=1-2^{-c}$$

$$\mathbb{P}[A\le A^{ϵ}=m+\lceil {\log }_2(\frac{1}{ϵ})\rceil ]\ge 1-2^{-\lceil {\log }_2(\frac{1}{ϵ})\rceil }\ge 1-ϵ$$

$$\mathbb{P}[B_{\mathbf{x}}^r]=\mathbb{P}[{\mathbf{Q}}^{ϵ}\mathbf{x}={\mathbf{e}}_r]=2^{-m}.$$

$$\mathbb{P}[B_{\mathbf{x}}^r]=\mathbb{P}[{\mathbf{Q}}^{ϵ}\mathbf{x}={\mathbf{e}}_r]$$

$$\mathbb{P}[\sum _{j=1}^k{q}_r^{e_j}=1]$$

$$+\mathbb{P}[q_r^{e_k}=0]\mathbb{P}[\sum _{j=1}^{k-1}{q}_r^{e_j}=1]=\frac{1}{2}$$

$$\frac{1}{i+1}{2}^{iH(\frac{j}{i})}\le \left(\genfrac{}{}{0ex}{}{i}{j}\right)\le 2^{iH(\frac{j}{i})}$$

$$\underset{m\to \infty }{\lim }\mathbb{P}[\exists {\mathcal{Q}}_l\subseteq {\mathcal{Q}}^{ϵ}|\text{card}\{{\mathcal{Q}}_l\}\le l=\lfloor \delta m\rfloor ,{\mathbf{e}}_r\in \text{span}\{{\mathcal{Q}}_l\}],$$

$$=$$

$$\stackrel{(b)}{=}$$

$$\stackrel{(d)}{\le }$$

$$\stackrel{(e)}{\le }$$

$${\mathbf{e}}_r=\sum _{k=1}^m{d}_k{\mathbf{q}}_{t_k}$$

$${\mathbb{E}}_q=m+\sum _{i=1}^m\frac{1}{2^i-1}=m+\gamma ,$$

$$f_r=\mathbf{f}{\mathbf{e}}_r=\mathbf{f}\left(\sum _{k=1}^m{d}_k{\mathbf{q}}_{t_k}\right)$$

$$f_r=\sum _{\begin{array}{c}{\mathbf{q}}_{t_k}\in {\mathcal{Q}}^{\text{full}}\\ d_k\ne 0\end{array}}\mathbf{f}{\mathbf{q}}_{t_k}=\sum _{i=1}^a\sum _{{\mathbf{q}}_{t_k}\in {\mathcal{Q}}_i}\mathbf{f}{\mathbf{q}}_{t_k}$$

$$\mathbf{V}{\mathbf{p}}_i=\sum _{{\mathbf{q}}_{t_k}\in {\mathcal{Q}}_i}{\mathbf{q}}_{t_k}$$

$${\mathbf{p}}_i={\mathbf{V}}^T{\left(\mathbf{V}{\mathbf{V}}^T\right)}^{-1}\left(\sum _{{\mathbf{q}}_{t_k}\in {\mathcal{Q}}_i}{\mathbf{q}}_{t_k}\right).$$

Full text

I Introduction

Cloud networks have become a popular platform for data storage during the past decade. Cloud systems have been used in different applications such as healthcare [1]. Security of the stored data has always been a major concern for many cloud service providers. Many cloud service providers use encryption algorithms to encrypt the data on their servers. Dropbox, for instance, is using Advanced Encryption Standard (AES) to store the contents on its servers111https://www.dropbox.com/en/help/27. Since the encryption algorithms are computationally secure, an adversary may be able to break them with time. For instance, Data Encryption Standard (DES) which was once the official Federal Information Processing Standard (FIPS) in US is not considered secure anymore. An interesting problem in highly sensitive cloud services would then be to design information theoretic secure solutions which are immune to attackers in time.

To achieve perfect information theoretic secrecy using Shannon cipher system [2], the number of keys should be equal to the number of messages. Therefore, to retrieve the contents from the cloud using an information theoretically secure approach in which the contents are directly encoded with a different key, each user needs to store a huge number of keys which is not practical. In this paper, we propose to use the storage capability of the trusted servers to generate the keys by using the contents themselves and achieve asymptotic perfect secrecy. Our proposed technique is based on Random Linear Fountain (RLF) codes [3]. RLF codes have been shown [4, 5, 6] to be very useful in distributed storage systems.

On the other hand, in many distributed storage applications like Peer-to-Peer (P2P) distributed storage systems or distributed storage systems in which some of the servers are under the control of an oppressive government, a user wants to download a content in a way that the servers cannot determine which content is requested by the user. This is widely known as Private Information Retrieval (PIR) problem.

Our next contribution in this paper is a novel technique to address the PIR problem in distributed storage systems. Users use random queries to request data from the servers. These random queries are designed in a way that they can be used to retrieve any desired content while preventing any malicious agent with the knowledge of up to half of the random queries to gain information about the requested content. This is an important feature of the proposed technique that provides privacy in the presence of many colluding servers. Such a feature has not been presented in prior information theoretic PIR approaches [7] for coded storage systems. The proposed Secure And Private Information Retrieval (SAPIR) scheme provides both security and privacy for information retrieval.

The rest of the paper is organized as follows. Section II is dedicated to the related work on PIR and security in distributed storage systems. The assumptions and problem formulation are described in section III. We study the security and PIR aspects of SAPIR in sections IV and V, respectively. The simulation results are provided in section VI and the paper is concluded in section VII.

II Related Works

In this paper, we use Random Linear Fountain (RLF) codes [3] to encode the contents within the servers in the network. Significant capacity improvement can be achieved in wireless ad hoc and cellular networks [4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16] using RLF codes. The application of fountain codes in distributed storage systems was previously studied in [17]. Similar coding techniques has been previously used in references like [18, 19, 20, 21, 22, 23, 24, 25] to provide quality of service in wireless systems.

The capacity of wireless ad hoc cached networks was studied in [5] and it was shown that RLF codes can achieve perfect secrecy asymptotically without considering the PIR problem. In the current paper, RLF codes are used to simultaneously achieve security and privacy in distributed cloud storage systems.

While MDS codes [26, 27] show good repair capability, these codes are not particularly designed to provide security. Authors in [28] have studied the security of distributed storage systems with MDS codes and [29] has proposed a construction for repairable and secure fountain codes. Reference [29] achieves security by concatenating Gabidulin codes with Repairable Fountain Codes (RFC). Their specific design allows to use Locally Repairable Fountain Codes for secure repair of the lost data. Unlike [29] which has focused on the security of the repair links using concatenated codes, the current paper presents simultaneous security and privacy of the data storage nodes by only using RLF codes. References [30] and [31] have studied the problem of security in the presence of overhearing interference in cooperative communications. Further [32, 33] studied the same problem on multi-tier networks.

The authors in [34] have numerically studied the wiretap network with a simple topology in which there is a relaying node between the transmitter and the receiver. In the current paper, we considered the general network with a cloud infrastructure in which the servers are cooperating to reconstruct the contents.

The idea of PIR was originally introduced in [35] for uncoded databases. Recently, there has been a renewed interest in studying PIR for storage systems utilizing different coding techniques. Reference [36] was among the first references to study the problem of PIR for coded storage systems. They proved that with only one extra bit, PIR can be achieved. However, the solution in [36] requires that the number of servers grows with the data record size. Reference [37] assumed that the number of servers is fixed and established the trade-off between storage and retrieval costs and demonstrated the fundamental limits on the cost of PIR for coded storage systems. The authors in [7] studied the problem of PIR for MDS coded storage systems and introduced a scheme to achieve PIR in MDS coded databases but the security aspect was not addressed in that paper. They have also assumed that the databases are able to store all the contents which may not be a realistic assumption. Unlike prior work [36, 37, 7] which have only studied PIR for coded databases, we are interested in achieving simultaneous security and PIR. Further, as far as we know, this is the first work to study the problem of PIR for a fountain coded-based distributed storage system. The proposed PIR scheme is easily scalable to the cases when up to half of the servers are colluding to obtain information about the content or content index which makes this technique very robust against large number of colluding servers.

III Problem Formulation

The network is composed of $n$ servers each capable of storing $h$ contents. These servers are denoted by $\mathcal{N}_{1},\mathcal{N}_{2},\dots,\mathcal{N}_{n}$. A total number of $m$ contents exist within the network and each content has $M$ bits, i.e., $f_{1},f_{2},\dots,f_{m}$.

III-A RLF Coding-Based Storage

The contents are randomly encoded and stored on the servers during the data preloading phase. The encoded file in the $j^{th}$ storage location of the $i^{th}$ server for any $i=1,2,\dots,n$ and $j=1,2,\dots,h$ will have the form

[TABLE]

where222Throughout the paper, the vectors are denoted in bold characters. $\mathbf{f}=[f_{1}~{}f_{2}~{}\dots f_{m}]$ denotes the $1\times m$ vector of all contents and $\mathbf{v}_{j}^{i}$ denotes an $m\times 1$ random encoding vector of [math]’s and $1$’s. Each content $f_{i}$ belongs to the Galois Field $\mathbb{F}_{2^{M}}$, i.e. $\mathbf{f}\in\mathbb{F}_{2^{M}}^{m}$. Throughout the paper, unless otherwise stated we assume that all the vector and matrix operations are in $\mathbb{F}_{2}$. The encoded files stored in server $\mathcal{N}_{i}$ are $\mathbf{c}_{i}=[c_{1}^{i}~{}c_{2}^{i}~{}\dots c_{h}^{i}]$ where $\mathbf{c}_{i}\in\mathbb{F}_{2^{M}}^{h}$. Note that $\mathbf{c}_{i}=\mathbf{f}\mathbf{V}_{i}$ where $\mathbf{V}_{i}$ is the $m\times h$ random encoding matrix for server $\mathcal{N}_{i}$.

In RLF all random vectors $\mathbf{v}_{j}^{i}$ are chosen independently and uniformly from $\mathbb{F}_{2}^{m}$ which results in a random uniform choice of the encoding matrix $\mathbf{V}_{i}$ where each element can be either [math] or $1$ with equal probability. Such an encoding matrix may not necessarily be full rank and may contain linearly dependent rows. This will result in redundant use of storage and may jeopardize the security by revealing more information. Hence, we propose a full rank encoding scheme based on RLF codes in which randomly created encoding vectors $\mathbf{v}_{j}^{i}$ are discarded if they already exist in the span of the previously selected random encoding vectors. In other words, for each server we select $h$ linearly independent vectors to construct a full rank matrix $\mathbf{V}_{i}$ of size $m\times h$ for $i=1,2,\dots,n$.

The encoding can be performed in a decentralized way. This means that each server can fill up its storage space independently of all the other servers during the data preloading phase. It can be shown [6] that the average minimum number of encoded files required to decode any desired content is very close to the optimal value of $m$.

III-B Reconstruction Groups (RG)

After the data preloading phase, users can reconstruct their desired contents during content delivery phase. A desired file $f_{r}$ can be written as $f_{r}=\mathbf{f}\mathbf{e}_{r}$, where $\mathbf{e}_{r}$ is an all zero vector of size $m\times 1$ except in the $r^{th}$ location is equal to 1. To retrieve $f_{r}$, the user needs to access enough encoded files on the network servers in order to construct $\mathbf{e}_{r}$ via ${\mathbf{v}}_{j}^{i}$’s.

Since codes are constructed in $\mathbb{F}_{2}^{m}$, users need $m$ linearly independent encoding vectors to retrieve any of the $m$ contents. We assume that servers are divided into many different *RGs *. Servers within each RG collaborate with each other to retrieve any requested content. Therefore, the number of encoded files within a single RG should be at least equal to $m$. The RGs are represented by $\mathcal{J}_{1},\mathcal{J}_{2},\dots,\mathcal{J}_{u}$ and the number of servers within their corresponding RGs by $J_{1},J_{2},\dots,J_{u}$ where, $\sum_{i=1}^{u}J_{i}=n$. It is shown in [6] that the average minimum number of encoded files within each RG to retrieve all the contents is only slightly larger than $m$. Therefore, for each RG $\mathcal{J}_{i}$ where $1\leq i\leq u$, the minimum value of $J_{i}$ is only slightly larger than $\frac{m}{h}$. Notice that if $J_{i}$ is smaller than $\frac{m}{h}$, then the servers will not be able to form a full rank matrix to retrieve all desired contents. In the case that storage systems store uncoded contents, we need exactly $m$ cache locations for storing files which is very close to our RLF technique and demonstrates that our RLF-coding based approach efficiently utilizes storage space. For large values of $h$, i.e. $h\geq m$, each server can become an RG by itself.

III-C Content Retrieval

Each RG $\mathcal{J}_{k}$ stores $J_{k}h\geq m$ randomly encoded files. The matrices $\mathbf{V}_{i}$ of the $J_{k}$ servers in the RG form a full rank matrix $\mathbf{V}=[\mathbf{V}_{1}~{}\mathbf{V}_{2}~{}\dots~{}\mathbf{V}_{J_{k}}]_{m\times J_{k}h}$. Therefore, any content with index $r$ can be retrieved from the servers by solving the linear equation $\mathbf{V}\mathbf{y}_{r}=\mathbf{e}_{r}$ in $\mathbb{F}_{2}$. Since this matrix is full rank, one possible solution can be given as

[TABLE]

To solve $\mathbf{V}\mathbf{y}_{r}=\mathbf{e}_{r}$, servers within the RG should send their corresponding encoding matrices $\mathbf{V}_{i}$ to one of the RG servers called $\mathcal{N}_{s}$ that generates $\mathbf{V}$ and computes $\mathbf{y}_{r}$ from the above equation333Notice that the servers of an RG only need to send this information to $\mathcal{N}_{s}$ once. This could be done even right after the data preloading phase.. If $\mathbf{y}_{r}=[\mathbf{y}_{r}^{1}~{}\mathbf{y}_{r}^{2}~{}\dots~{}\mathbf{y}_{r}^{J_{k}}]^{T}$ is such a solution, where $\mathbf{y}_{r}^{i}$ is a $h\times 1$ local decoding vector for server $\mathcal{N}_{i}$, then server $\mathcal{N}_{s}$ sends $\mathbf{y}_{r}^{i}$ to server $\mathcal{N}_{i}$ and $\mathcal{N}_{i}$ then transmits $\mathbf{f}\mathbf{V}_{i}\mathbf{y}_{r}^{i}$ to the requesting user. All of the server responses are then aggregated by the user to retrieve $f_{r}$ as

[TABLE]

However, this solution reveals the identity of the downloaded content to all the servers of the RG. This simple solution cannot be used for PIR but we will show in section IV that perfect secrecy can be achieved with this solution. A solution to preserve the privacy of the users is presented in section V.

IV Security

This section is dedicated to the study of security of our approach. If an adversary is able to wiretap all of the communication links between the RG servers and the user, it can perfectly retrieve $f_{r}$ using equation (3). We prove that perfect communication secrecy can be achieved when the adversary can wiretap all communication links between servers and user except one. We will prove this for the case when the user directly sends the request $\mathbf{e}_{r}$ to the servers and the servers respond accordingly. Under this scenario, the adversary knows the requested content index but still unable to reduce its equivocation about the requested content.

Consider RG $\mathcal{J}_{k}$ and without loss of generality, assume that an adversary can wiretap all of the links between servers $\mathcal{N}_{1},\mathcal{N}_{2},\dots,\mathcal{N}_{J_{k}-1}$ and the user. Further assume that the user wants to directly download the content $f_{r}$ from these servers by sending the query $\mathbf{e}_{r}$ to all these servers. Such a scenario is much more vulnerable to adversarial attacks compared to a scenario in which the requested base vectors are expanded in terms of random queries in order to guarantee privacy. When the query $\mathbf{e}_{r}$ is received by all the servers,they will collectively solve the linear equation $\mathbf{V}\mathbf{y}_{r}=\mathbf{e}_{r}$ to find the decoding vector $\mathbf{y}_{r}$. Equation (3) can be rewritten as

[TABLE]

Since we assume that all of the responses from the servers $\mathcal{N}_{1},\mathcal{N}_{2},\dots,\mathcal{N}_{J_{k}-1}$ can be wiretapped, we can assume that the first part of the above equation is known while the second part is secret to the adversary. Lets define $S_{r}\triangleq\sum_{i=1}^{J_{k}-1}\mathbf{f}\mathbf{V}_{i}\mathbf{y}_{r}^{i}$ and $T_{r}\triangleq\mathbf{f}\mathbf{V}_{J_{k}}\mathbf{y}_{r}^{J_{k}}.$ The requested content can be written as $f_{r}=S_{r}+T_{r}$ and since all operations are in $\mathbb{F}_{2}$, we have

[TABLE]

This is similar to the Shannon cipher system [2] in which an encoding function $\mathfrak{e}:\mathbb{M}\times\mathbb{K}\to\mathbb{C}$ is mapping a message $\mathfrak{M}\in\mathbb{M}$ and a key $\mathfrak{K}\in\mathbb{K}$ to a codeword $\mathfrak{C}\in\mathbb{C}$. In our problem $f_{r}$, $T_{r}$, and $S_{r}$ can be regarded as the message, key, and codeword respectively. The eavesdropper knows the encoded file $S_{r}$ but it cannot obtain any information about the message $f_{r}$ if a unique key $T_{r}$ with uniform distribution is used for each message.

The following theorem provides the necessary and sufficient condition [38] to obtain perfect secrecy.

Theorem 1**.**

If $|\mathbb{M}|=|\mathbb{K}|=|\mathbb{C}|$, a coding scheme achieves perfect secrecy if and only if

• •

For each pair $(\mathfrak{M},\mathfrak{C})\in(\mathbb{M}\times\mathbb{C})$, there exists a unique key $\mathfrak{K}\in\mathbb{K}$ such that $\mathfrak{C}=\mathfrak{e}(\mathfrak{M},\mathfrak{K})$.

• •

The key $\mathfrak{K}$ is uniformly distributed in $\mathbb{K}$.

Proof.

The proof can be found in section 3.1 of [38]. ∎

We will use Theorem 1 to prove that our approach can achieve asymptotic perfect secrecy. To use this theorem, first we prove that for large enough values of $m$, the key $T_{r}$ is uniformly distributed.

Lemma 1**.**

The asymptotic distribution of bits of coded files on the servers tend to uniform. **

Proof.

The proof is skipped due to page limitations. A similar proof appears in [13]. ∎

This lemma paves the way to prove the following theorem.

Theorem 2**.**

For the proposed full rank encoding scheme if $m$ is large but $m<2^{h}$, then the proposed encoded strategy provides asymptotic perfect secrecy against any eavesdropper which is capable of wiretapping all but one of the links from the servers to a user in a RG. **

Proof.

We formulated this problem as a Shannon cipher system assuming that $\mathfrak{M}=f_{r}$, $\mathfrak{K}=T_{r}$, and $\mathfrak{C}=S_{r}$. The condition $m<2^{h}$ ensures that a unique vector $\mathbf{y}_{r}^{J_{k}}$ exists for each requested message. Therefore, since full rank encoding scheme is used, then $\mathbf{V}_{J_{k}}$ will be full rank and $T_{r}$ guarantees that a unique key exists for each requested message $f_{r}$. Notice that if the size of the RG is large enough, then the unique choice of the key does not affect the solvability of the linear equation $\mathbf{V}\mathbf{y}_{r}=\mathbf{e}_{r}$. Therefore, for any pair $(\mathfrak{m},\mathfrak{C})\in(\mathbb{M},\mathbb{C})$, a unique key $\mathfrak{K}\in\mathbb{K}$ exists such that $\mathfrak{C}=\mathfrak{m}+\mathfrak{K}$. Further, we are guaranteed to have $|\mathbb{M}|=|\mathbb{K}|=|\mathbb{C}|$.

Notice that the key $\mathfrak{K}=T_{r}$ belongs to the set of all possible bit strings with $M$ bits. Lemma 1 proves that each encoded file is uniformly distributed among all $M$-bit strings. Hence each key which is a unique summation of such encoded files is uniformly distributed among the set of all $M$-bit strings. In other words, regardless of the distribution of the bits in files, $T_{r}$ can be any bit string with equal probability for large values of $m$. Therefore, the conditions in Theorem 1 are met and perfect secrecy is achieved. ∎

Remark 1**.**

In this paper, we have assumed that the decoding vector $\mathbf{y}_{r}$ and the encoding matrix $\mathbf{V}_{i}$ are computed during the data preloading phase securely. Therefore, the eavesdropper cannot decode this information on any of the servers or have any knowledge about the key $T_{r}$. **

Remark 2**.**

A naive approach to achieve perfect secrecy using the Shannon cipher system is to choose $m$ different keys from the set of uniform $M$-bit strings and store them and use them to encode the files. However, since the file size $M$ is very large, this requires a significant amount of storage space to store the keys on the trusted servers which doubles the required storage capacity. The important contribution of our approach is that users do not need to store the keys and yet perfect secrecy can still be achieved with the help of trusted servers. **

V Private Information Retrieval

In PIR, the goal is to provide conditions that when a user downloads the content $f_{r}$ with index $r\in\{1,2,\dots,m\}$, the content index remains a secret to all of the servers. This is desirable in applications like Peer-to-Peer networks and in situations where some servers may have been compromised by the adversary. To achieve PIR, users send queries to the servers and servers respond to users based on those queries. These queries should be designed in a way that reveal no information to the servers about the requested content index. To formally define the information theoretic PIR, let $R$ be a random variable denoting the requested content index and let $\mathcal{Q}_{l}$ be a subset of at most $l$ queries. We have the following definition.

Definition 1**.**

A PIR scheme is capable of achieving perfect information theoretic PIR against $i$ colluding servers if for the set $\mathcal{Q}_{l}$ of all queries available to all of these servers and any number of contents we have

[TABLE]

where $I(.)$ is the mutual information function. **

V-A Random Query Generation

To achieve PIR, the user chooses a fixed $\epsilon>0$ and sets $A^{\epsilon}\triangleq m+\lceil\log_{2}(\frac{1}{\epsilon})\rceil$. Then it picks $A^{\epsilon}$ query vectors from $\mathbb{F}_{2}^{m}$ uniformly at random and statistically independent of each other. These will be the set of random queries. Therefore, we will have a set $\mathcal{Q}^{\epsilon}=\{\mathbf{q}_{1},\mathbf{q}_{2},\dots,\mathbf{q}_{A^{\epsilon}}\}$ of i.i.d. random query vectors. In the following, we will prove that with a probability of at least $1-\epsilon$, these random vectors span the whole $m$-dimensional space of $\mathbb{F}_{2}^{m}$. The properties of random vectors that we have used for our coding technique, had been previously studied in [39].

Theorem 3**.**

Let $\mathbf{Q}$ be a matrix of size $m\times l$ whose elements are independent random variables taking the values 0 and 1 with equal probability and let $\rho_{m}(l)$ be the rank of the matrix $\mathbf{Q}$ in $\mathbb{F}_{2}$. Let $s\geq 0$ and $c$ be fixed integers, $c+s\geq 0$. If $m\to\infty$ and $l=m+c$, then

[TABLE]

where the last product equals 1 for $c+s=0$. **

Proof.

This is Theorem 3.2.1 in page 126 of [39]. ∎

Corollary 1**.**

For $l=m+c$ where $c\geq 0$, if $m\to\infty$ we have

[TABLE]

Proof.

The proof follows for $s=0$ in Theorem 3. ∎

In the following, we will use these results for our proofs.

Definition 2**.**

We define the random variable $A$ as the minimum number of random query vectors $\mathbf{q}_{1},\mathbf{q}_{2},\dots,\mathbf{q}_{i}$ to span the whole space of $\mathbb{F}_{2}^{m}$. **

Lemma 2**.**

The probability of the event that $A<m$ is zero and for any $c\geq 0$ we have

[TABLE]

Proof.

This is a direct result of Corollary 1. ∎

Lemma 3**.**

The probability of the event that $A=m+c$ is less than $2^{-c}$ for any $c\geq 0$. **

Proof.

Let $F(c)\triangleq\mathbb{P}[A\leq m+c]$. It is easy to verify from equation (9) that for $m\to\infty$ we have

[TABLE]

Since $F(c)\leq 1$, from equation (10) we arrive at

[TABLE]

Hence,

[TABLE]

∎

Lemma 4**.**

The probability of the event that $A\leq m+c$ is at least $1-2^{-c}$ and at most $1-2^{-(c+1)}$ for any $c\geq 0$. i.e.

[TABLE]

Proof.

The upper bound is already proved in equation (11). From Lemma 3 we have,

[TABLE]

∎

Theorem 4**.**

With a probability of at least $1-\epsilon$, the set of random queries $\mathcal{Q}^{\epsilon}=\{\mathbf{q}_{1},\mathbf{q}_{2},\dots,\mathbf{q}_{A^{\epsilon}}\}$ where $A^{\epsilon}=m+\lceil\log_{2}(\frac{1}{\epsilon})\rceil$ spans the whole $m$-dimensional space of $\mathbb{F}_{2}^{m}$. **

Proof.

From Lemma 4, we have

[TABLE]

This proves the theorem. ∎

Theorem 4 states that the probability of spanning the $m$-dimensional space can arbitrarily go to 1 provided that the number of random vectors increases logarithmically with $\frac{1}{\epsilon}$. For example, to span the $m$-dimensional space with a probability of at least $0.99$, it is enough to only have $m+7$ random vectors. Using these random query vectors, we can now show that even with a large number of colluding servers no information about the requested content index can be obtained. To prove this result, we need to prove some lemmas.

Let $\mathbf{Q}^{\epsilon}\triangleq[\mathbf{q}_{1}~{}\mathbf{q}_{2}~{}\dots~{}\mathbf{q}_{A^{\epsilon}}]$ be the matrix of size $m\times A^{\epsilon}$ whose columns are random query vectors. Matrix $\mathbf{Q}^{\epsilon}$ contains $A^{\epsilon}$ statistically independent random vectors. Let $B_{\mathbf{x}}^{r}$ be the event that for a specific vector $\mathbf{x}\in\mathbb{F}_{2}^{A^{\epsilon}}$ and a specific base vector $\mathbf{e}_{r}$, we have $\mathbf{Q}^{{\epsilon}}\mathbf{x}=\mathbf{e}_{r}$.

Lemma 5**.**

For any specific non-zero vector $\mathbf{x}\in\mathbb{F}_{2}^{A^{\epsilon}}$ we have

[TABLE]

Proof.

Lets assume vector $\mathbf{x}$ has $k$ ones. If $\mathbf{Q}^{\epsilon}\mathbf{x}=\mathbf{e}_{r}$, then $k$ vectors from the set of all vectors $\mathbf{q}_{1},\mathbf{q}_{2},\dots,\mathbf{q}_{A^{\epsilon}}$ are added together to create $\mathbf{e}_{r}$. Lets denote these vectors by $\mathbf{q}_{e_{1}},\mathbf{q}_{e_{2}},\dots,\mathbf{q}_{e_{k}}$. Let $q^{e_{j}}_{r}$ denote the $r^{th}$ element of vector $\mathbf{q}_{e_{j}}$. Since the vectors $\mathbf{q}_{e_{1}},\mathbf{q}_{e_{2}},\dots,\mathbf{q}_{e_{k}}$ are independent and their elements are also mutually independent, using binary summations in $\mathbb{F}_{2}$, we have

[TABLE]

We can easily prove that $\mathbb{P}[\sum_{j=1}^{k}q^{e_{j}}_{r}=1]=\frac{1}{2}$. To prove this, we can use induction on $k$. This equation is valid for the base case $k=1$. Assume that it is valid for $k-1$. We have

[TABLE]

Similarly, it is easy to prove that $\mathbb{P}[\sum_{j=1}^{k}q^{e_{j}}_{l^{\prime}}=0]=\frac{1}{2}$. Hence, equation (14) can be simplified to $\mathbb{P}[B_{\mathbf{x}}^{r}]=\mathbb{P}[\mathbf{Q}^{\epsilon}\mathbf{x}=\mathbf{e}_{r}]=2^{-m}$. ∎

Lemma 6**.**

The following inequalities hold for $1\leq j\leq i$,

[TABLE]

where $H(\alpha)$ denotes the binary entropy function, i.e. $H(\alpha)=-\alpha\log_{2}(\alpha)-(1-\alpha)\log_{2}(1-\alpha)$. **

Proof.

The proof can be found in the appendix of [40]. ∎

We are now ready to prove the following theorem which shows that accessing a significant number of random queries in $\mathcal{Q}^{\epsilon}$ cannot help in reconstructing any of the base vectors for large $m$.

Theorem 5**.**

Consider the set $\mathcal{Q}^{\epsilon}=\{\mathbf{q}_{1},\mathbf{q}_{2},\dots,\mathbf{q}_{A^{\epsilon}}\}$ of $A^{\epsilon}=m+\lceil\log_{2}(\frac{1}{\epsilon})\rceil$ statistically independent random uniform query vectors. For large enough values of $m$ with probability arbitrarily close to 1, none of the base vectors exist in the span of any subset $\mathcal{Q}_{l}\subset\mathcal{Q}^{\epsilon}$ with cardinality of at most $l=\lfloor\delta m\rfloor$ where $\delta<0.5$. **

Proof.

Consider any base vector $\mathbf{e}_{r}$ and a non-zero vector $\mathbf{x}\in\mathbb{F}_{2}^{A^{\epsilon}}$. For this vector, computing $\mathbf{Q}^{\epsilon}\mathbf{x}$ in $\mathbb{F}_{2}$ is equivalent to adding a subset of columns of $\mathbf{Q}^{\epsilon}$ whose set of indices is equal to the set of indices of non-zero elements in $\mathbf{x}$. If $\mathbf{Q}^{\epsilon}\mathbf{x}=\mathbf{e}_{r}$ for some $\mathbf{x}\in\mathbb{F}_{2}^{A^{\epsilon}}$, then any subset $\mathcal{Q}_{l}\subset\mathcal{Q}^{\epsilon}$ which contains the column vectors of $\mathbf{Q}^{\epsilon}$ whose set of indices is equal to the set of indices of non-zero elements in $\mathbf{x}$ also spans $\mathbf{e}_{r}$. In fact, the number of non-zero elements of $\mathbf{x}$ or Hamming weight of $\mathbf{x}$ (i.e., Ham($\mathbf{x}$)) is equal to the number of vectors that should be added to reconstruct $\mathbf{e}_{r}$.

Consider all vectors $\mathbf{x}\in\mathbb{F}_{2}^{A^{\epsilon}}$ with Hamming weight less than or equal to $l=\lfloor\delta m\rfloor$ where $\delta<0.5$. Lemma 5 shows that for any $\mathbf{x}$, we have $\mathbb{P}[B_{\mathbf{x}}^{r}]=2^{-m}$. Therefore, the asymptotic probability of existence of a subset $\mathcal{Q}_{l}\subset\mathcal{Q}^{\epsilon}$ with a cardinality of at most $l=\lfloor\delta m\rfloor$ which spans $\mathbf{e}_{r}$ for large values of $m$ can be found as

[TABLE]

where inequality (a) comes from the union bound and (b) holds by using Lemma 5 and counting all the vectors $\mathbf{x}$ with Hamming weight less than $l=\lfloor\delta m\rfloor$ and inequality (e) comes from Lemma 6. Notice that (c), (d), (e) and (f) are only valid for cases when $\delta<0.5$. This shows that the probability of existence of any desired base in the span of any subset of vectors with cardinality less than $\lfloor\delta m\rfloor$ goes to zero as $m$ grows if $\delta<0.5$. ∎

Remark 3**.**

In practice the user generates enough number of random vectors to span the whole $m$-dimensional space. Hence, it has a set $\mathcal{Q}=\{\mathbf{q}_{1},\mathbf{q}_{2},\dots,\mathbf{q}_{A}\}$ of $A\geq m$ total random vectors. Then it chooses a subset $\mathcal{Q}^{\textrm{full}}=\{\mathbf{q}_{t_{1}},\mathbf{q}_{t_{2}},\dots,\mathbf{q}_{t_{m}}\}\subseteq\mathcal{Q}$ of $m$ linearly independent vectors from them and use them as its query vectors. This way it is guaranteed that the $m$ queries will span the whole space of $\mathbb{F}_{2}^{m}$ and any base vector $\mathbf{e}_{r}$ can be represented in terms of these independent query vectors as

[TABLE]

The following lemma shows that the average required number of random vectors to span $\mathbb{F}_{2}^{m}$ is very close to $m$ so in practice only a few number of random queries more than $m$ is needed to span $\mathbb{F}_{2}^{m}$. **

Lemma 7**.**

If ${\bf q}_{j}$ is a random vector belonging to $\mathbb{F}_{2}^{{m}}$ with elements having uniform distribution, the average minimum number of vectors ${\bf q}_{j}$ to span the whole space of $\mathbb{F}_{2}^{{m}}$ equals

[TABLE]

where $\gamma$ asymptotically approaches the Erdős–Borwein constant ($\approx 1.6067$). **

Proof.

The proof can be found in [6]. ∎

Remark 4**.**

Since $\mathcal{Q}^{\textrm{full}}\subseteq\mathcal{Q}$, if any vector $\mathbf{e}_{r}$ does not exist in the span of any subset $\mathcal{Q}_{l}\subset\mathcal{Q}$, of $l$ random query vectors, it will not exist in the span of any subset $\mathcal{Q}_{l}\subset\mathcal{Q}^{\textrm{full}}$ of $l$ random query vectors in $\mathcal{Q}^{\textrm{full}}$ too. So, Theorem 5 remains valid for this choice of random queries too. This means that in practice, every base vector is guaranteed to exist in the span of the $m$ query vectors but none of the base vectors exist in the span of any subset $\mathcal{Q}_{l}\subset\mathcal{Q}$ with probability close to one if $l<\lfloor\delta m\rfloor$ for $\delta<0.5$. **

V-B Responding to Queries

In this section, we assume that the user has chosen $m$ linearly independent random query vectors in $\mathcal{Q}^{\textrm{full}}$ and wants to download the $r^{th}$ content. Since $\mathcal{Q}^{\textrm{full}}$ is a set of vectors which spans the whole space of $\mathbb{F}_{2}^{m}$, the user can expand the base vector $\mathbf{e}_{r}$ in terms of the query vectors in $\mathcal{Q}^{\textrm{full}}$ as mentioned in (16). Hence, the requested content can be expanded in terms of query vectors as

[TABLE]

where $d_{k}\in\mathbb{F}_{2}$ is either 0 or 1. Based on equation (18) the user requests some parts of the desired content from each RG so that none of the RGs can understand any information about the requested content.

To accomplish PIR, the user partitions the set of random queries $\mathbf{q}_{t_{k}}$ whose corresponding decoding gains $d_{k}$ are non-zero into $a$ disjoint subsets $\mathcal{Q}_{1},\mathcal{Q}_{2},\dots,\mathcal{Q}_{a}$. The choice of number of subsets (i.e. $a$) depends on the number of colluding servers. Each subset of queries is then sent to a different RG as depicted in Figure 1. Therefore, the requested content can be retrieved as

[TABLE]

The ultimate goal in PIR is to prevent any colluding group of servers to gain information about the requested content index. Assume that the number of colluding servers is $b$. If any two colluding servers lie within the same RG, they receive the same subset of queries from the user. Therefore, without loss of generality we consider the worst scenario in which all the colluding servers lie within different RGs and all these $b$ colluding servers are able to collaboratively obtain all the queries $\mathcal{Q}_{1},\mathcal{Q}_{2},\dots,\mathcal{Q}_{b}$. Based on Theorem 5, if the number of all query vectors in $\mathcal{Q}_{l}=\cup_{i=1}^{b}\mathcal{Q}_{i}$ is less than $\lfloor\delta m\rfloor$ for some $\delta<0.5$, then no information can be achieved about the requested content index. This provides significant PIR capability for this technique.

Notice that since RGs have full rank encoding matrices, they can respond to any query that they receive. Assume that RG $\mathcal{J}_{i}$ with the full rank encoding matrix $\mathbf{V}=[\mathbf{V}_{1}~{}\mathbf{V}_{2}~{}\dots~{}\mathbf{V}_{J_{i}}]$ receives the set of queries $\mathcal{Q}_{i}$. This RG needs to send $\sum_{\mathbf{q}_{t_{k}}\in\mathcal{Q}_{i}}\mathbf{f}\mathbf{q}_{t_{k}}$ to the user. It can solve the linear equation

[TABLE]

in Galois Field $\mathbb{F}_{2}$ for $\mathbf{p}_{i}$ as

[TABLE]

Similar to before the server $\mathcal{N}_{s}$ in the RG $\mathcal{J}_{i}$ which has already acquired all the information in matrix $\mathbf{V}$, computes the overal query decoding solution $\mathbf{p}_{i}$ which is a vector of size $J_{i}h\times 1$. If this vector is divided into $J_{i}$ equal size pieces as $\mathbf{p}_{i}=[\mathbf{p}_{i}^{1}~{}\mathbf{p}_{i}^{2}~{}\dots~{}\mathbf{p}_{i}^{J_{i}}]^{T}$, then the server $\mathcal{N}_{s}$ sends the $j^{th}$ portion of $\mathbf{p}_{i}$ to server $\mathcal{N}_{j}$ in the RG $\mathcal{J}_{i}$. More precisely, server $\mathcal{N}_{j}$ receives a query response vector $\mathbf{p}_{i}^{j}$ of size $h\times 1$ from $\mathcal{N}_{s}$ for each $j=1,2,\dots,J_{i}$. Then the server $\mathcal{N}_{j}$ sends $\mathbf{f}\mathbf{V}_{j}\mathbf{p}_{i}^{j}$ back to the coordinating server $\mathcal{N}_{s}$. The coordinating server $\mathcal{N}_{s}$ then aggregates all the data received from multiple servers in the RG to construct $\sum_{\mathbf{q}_{t_{k}}\in\mathcal{Q}_{i}}\mathbf{f}\mathbf{q}_{t_{k}}$ as

[TABLE]

The coordinating server $\mathcal{N}_{s}$ in the RG $\mathcal{J}_{i}$ then transmits $\sum_{\mathbf{q}_{t_{k}}\in\mathcal{Q}_{i}}\mathbf{f}\mathbf{q}_{t_{k}}$ to the user.

Each RG only transmits one encoded file to the user. However all the servers within an RG need to collaborate with each other prior to responding to the queries sent from the user. Notice that communication between the servers are carried using high bandwidth fiber optic links while transmissions from the servers to the user are performed over low bandwidth links. In our computation of communication cost for achieving PIR, we only consider communication between the servers and the user in the low bandwidth links.

Remark 5**.**

It is worth mentioning that in this approach the coordinations between servers in an RG is necessary because the servers do not have full storage capacity to store all the contents. In fact if we also assume each server has high storage capacity similar to [7], then each server can act as an RG and there will be no communications between servers. **

V-C Trade-off Between Communication Cost and Privacy Level

In order to achieve PIR, each user needs to download more information. This additional bandwidth utilization is referred to as communication Price of Privacy (cPoP) [7] which is defined as follows. Note that the cost of sending queries are ignored because it is assumed that the size of contents are significantly higher than the size of the queries.

Definition 3**.**

The communication Price of Privacy (cPoP) is the ratio of the total number of bits downloaded by the user from the servers to the size of the requested file. **

To explain the trade-off between communication cost and level of privacy, assume that the user divides the queries into $a$ equal size groups of queries and sends each group of queries to a different RG. Each RG should respond to at most $\lceil\frac{m}{a}\rceil$ queries. If $b$ RGs collude to gain some information about the requested content index, then they will have access to a total of at most $b\lceil\frac{m}{a}\rceil$ queries. We proved that knowing $\lfloor\delta m\rfloor$ queries asymptotically gives no information about the requested content index if $\delta<0.5$. Hence, if $b<\frac{a}{2}$, then the colluding RGs will get no information about the requested content index. Therefore, if less than half of the RGs collude to gain some information about the requested content index, they cannot gain any information. We can increase $a$ to get the maximum possible level of privacy. However, the downside of increasing $a$ is that the communication Price of Privacy (cPoP) will also increase.

As discussed earlier, if the queries are sent to $a$ RGs then $a$ responses from these RGs are required to retrieve a content. Since each RG transmits an encoded file of size $M$ bits to the user the total number of bits downloaded by the user will be equal to $aM$ and therefore the cPoP will be equal to $aM/M=a$.

V-D Full Size Servers

Assume that the servers have large storage capability such that each RG is only composed of 1 server. Our assumption of full rank encoding scheme guarantees that servers with storage ability of $h\geq m$ encoded files can be used to retrieve any desired content. In [7], the authors studied the use of MDS codes for PIR. They considered full size storage systems with MDS codes and they considered the case when only one of the databases is compromised. They proposed a PIR technique in which a cPoP of $\frac{1}{1-R}$ can be achieved in full size databases where $R$ is the MDS code rate. To compare our results with [7], notice that if we assume that there is only one malicious server in the cloud, then we can choose any two servers and send half of the queries to each one of them. This way we have a cPoP of 2 which is better than the results in [7] for $R>1/2$.

VI Simulation

To numerically verify the results proved in section V, we created $m$ linearly independent random query vectors which are used to expand the bases. Figure 2 demonstrates the probability of the event that at least one of the base vectors exists in the span of $l=\lfloor\delta m\rfloor$ vectors for $\delta=0.1,0.2,0.3$ and $0.4$. Consistent with our results in section V, the probability of the event that a base exists in the span of any set of $l=\lfloor\delta m\rfloor$ vectors goes quickly to zero.

It is proved [41] that the problem of finding the minimum spanning set of vectors is NP-Complete. It is even proved [42] that this problem is NP-Hard to approximate. Therefore, in general it is NP-Hard to find out if a given base exists in the span of at most $l=\lfloor\delta m\rfloor$ vectors out of the $m$ vectors. For our simulations we have used a brute force approach to check if a given base exists in the span of at most $l=\lfloor\delta m\rfloor$ vectors out of the $m$ existing random query vectors where $m\leq 20$.

VII Conclusions

In this paper, we have studied the problems of security and private information retrieval in distributed storage systems which are using a full rank encoding scheme based on Random Linear Fountain (RLF) codes. We have proposed an approach based on uniform random queries to achieve information theoretic PIR property. We have proved that our proposed technique can asymptotically achieve perfect secrecy for a distributed storage system. Our proposed solution is robust against a significant number of colluding servers in the network. We have also shown that our technique can outperform MDS codes for storage systems in terms of PIR cost for certain regimes.