Private Polynomial Computation from Lagrange Encoding

TL;DR

This paper introduces a private polynomial computation scheme using Lagrange encoding that ensures data and function privacy, robustness against server failures, and extends private computation to high-degree polynomials.

Contribution

It demonstrates that Lagrange encoding enables private computation of high-degree polynomials with robustness and data privacy, connecting private and coded computation.

Findings

Supports private computation of any degree polynomial

Robust to Byzantine and straggling servers

Ensures data privacy using Shamir secret sharing

Abstract

Private computation is a generalization of private information retrieval, in which a user is able to compute a function on a distributed dataset without revealing the identity of that function to the servers. In this paper it is shown that Lagrange encoding, a powerful technique for encoding Reed-Solomon codes, enables private computation in many cases of interest. In particular, we present a scheme that enables private computation of polynomials of any degree on Lagrange encoded data, while being robust to Byzantine and straggling servers, and to servers colluding to attempt to deduce the identities of the functions to be evaluated. Moreover, incorporating ideas from the well-known Shamir secret sharing scheme allows the data itself to be concealed from the servers as well. Our results extend private computation to high degree polynomials and to data-privacy, and reveal a tight connection between private computation and coded computation.

Tables

Table 1. TABLE I: Important parameters used in Private Computation schemes.

$q$	field size
$K$	number of uncoded data vectors ${\text{x}}_k$
$M$	length of vectors ${\text{x}}_k$
$G$	degree of polynomial functions to be evaluated on the ${\text{x}}_k$
$N$	number of servers
$𝒞$	$[N,K]$ storage code
$T$	number of colluding function-curious servers
$E$	number of colluding data-curious servers
$A$	number of adversaries / Byzantine servers
$P$	number of stragglers / unresponsive servers
$S$	number of rounds
$B$	number of functions to be evaluated
$R$	download rate of PC scheme

Equations

$$R=$$

$$\frac{K}{G(K+E-1)+1},$$

$$R=\frac{\min \{N-(G(K-1)+T),K\}}{N}.$$

$$R=\frac{N-(K+T+P+2A-1)}{N}.$$

$$R=\frac{N-(K+T-1)}{N}$$

$$\lim_{M\rightarrow\infty}\mathsf{C}=\left\{\begin{array}[]{cc}\frac{N-(E+T)}{N}&\text{if }N>E+T\\ 0&\text{if }N\leq E+T\end{array}\right.$$

$$R=\frac{N-(E+T)}{N}\cdot \frac{1}{E+1}$$

$${\mathcal{P}}_{M,G}=\{\varphi \in {\mathbb{F}}_q[X_1,\dots ,X_M]:\mathrm{deg}(\varphi )\le G\}.$$

$${\mathbb{F}}_q[z{]}^{<K}=\{\varphi \in {\mathbb{F}}_q[z]:\mathrm{deg}(\varphi )\le K-1\}$$

$$ev:{\mathbb{F}}_q[z{]}^{<K}\to {\mathbb{F}}_q^N,ev(\varphi )=(\varphi ({\alpha }_1),\dots ,\varphi ({\alpha }_N))$$

$$\text{G}=\left(\begin{array}{cccc}{\varphi }_1({\alpha }_1)& {\varphi }_1({\alpha }_2)& \cdots & {\varphi }_1({\alpha }_N)\\ {\varphi }_2({\alpha }_1)& {\varphi }_2({\alpha }_2)& \cdots & {\varphi }_2({\alpha }_N)\\ ⋮& ⋮& \ddots & ⋮\\ {\varphi }_K({\alpha }_1)& {\varphi }_K({\alpha }_2)& \cdots & {\varphi }_K({\alpha }_N)\end{array}\right).$$

$$\text{G}=\left(\begin{array}{cccc}1& 1& \cdots & 1\\ {\alpha }_1& {\alpha }_2& \cdots & {\alpha }_N\\ ⋮& ⋮& \ddots & ⋮\\ {\alpha }_1^{K-1}& {\alpha }_2^{K-1}& \cdots & {\alpha }_N^{K-1}\end{array}\right)$$

$$\text{G}=\text{G}(\mathbf{\alpha },\mathbf{\beta })\triangleq$$

$$\left(\begin{array}{cccc}\prod _{j\in [K]\setminus \{1\}}\frac{{\beta }_j-{\alpha }_1}{{\beta }_j-{\beta }_1}& \cdots & \prod _{j\in [K]\setminus \{1\}}\frac{{\beta }_j-{\alpha }_N}{{\beta }_j-{\beta }_1}& \\ \prod _{j\in [K]\setminus \{2\}}\frac{{\beta }_j-{\alpha }_1}{{\beta }_j-{\beta }_2}& \cdots & \prod _{j\in [K]\setminus \{2\}}\frac{{\beta }_j-{\alpha }_N}{{\beta }_j-{\beta }_2}& \\ ⋮& ⋮& \ddots & ⋮\\ \prod _{j\in [K]\setminus \{K\}}\frac{{\beta }_j-{\alpha }_1}{{\beta }_j-{\beta }_K}& \cdots & \prod _{j\in [K]\setminus \{K\}}\frac{{\beta }_j-{\alpha }_N}{{\beta }_j-{\beta }_K}& \end{array}\right),$$

$$\text{x}\star \text{y}=(x_1{y}_1,\dots ,x_N{y}_N)\in {\mathbb{F}}_q^N$$

$$\mathcal{C}\star \mathcal{D}={\mathrm{span}}_{{\mathbb{F}}_q}\{\text{c}\star \text{d}:\text{c}\in \mathcal{C},\text{d}\in \mathcal{D}\}.$$

$${\mathcal{C}}^{\star G}=\underset{G\text{ times}}{\underbrace{\mathcal{C}\star \cdots \star \mathcal{C}}}={\mathrm{span}}_{{\mathbb{F}}_q}\{{\text{c}}_1\star \cdots \star {\text{c}}_G:{\text{c}}_g\in \mathcal{C}\}.$$

$$[{\text{s}}_1,\dots ,{\text{s}}_L,{\text{t}}_1,\dots ,{\text{t}}_X]\cdot \left(\begin{array}{c}\text{A}\\ \text{B}\end{array}\right)=({\text{y}}_1,\dots ,{\text{y}}_N),$$

$$I({\text{s}}_1,\dots ,{\text{s}}_L;{\text{y}}_{n_1},\dots ,{\text{y}}_{n_X})=0$$

$$\left[{\text{y}}_1\cdots {\text{y}}_N\right]$$

$$\triangleq \left[{\text{x}}_1\cdots {\text{x}}_K\right].$$

$$H(\{{\varphi }_b({\text{x}}_k)\}|\{{\rho }_n^{(s)}({\text{y}}_n)\})=0.$$

$$I({\varphi }_1,\dots ,{\varphi }_B;{\rho }_{\mathcal{T}})=0$$

$$T$$

$$I({\text{x}}_1,\dots ,{\text{x}}_K;{\text{y}}_{n_1},\dots ,{\text{y}}_{n_E})=0$$

$$E$$

$$({\rho }_1^{(s)}({\text{y}}_1),\dots ,{\rho }_N^{(s)}({\text{y}}_N))+{\mathbf{ϵ}}^{(s)}$$

$$R=\frac{KB}{NS}.$$

$$R=\frac{H\left(\{{\varphi }_b({\text{x}}_k)\}\right)}{{\sum }_{n=1}^N{\sum }_{s=1}^{S}H\left({\rho }_n^{(s)}({\text{y}}_n)\right)},$$

$$I({\varphi }_1,\dots ,{\varphi }_B|\forall i\in [B],{\varphi }_i\in \mathcal{P};{\rho }_{\mathcal{T}}|\forall n_i\in \mathcal{T},{\rho }_{n_i}\in \mathcal{T})=0$$

$$R=$$

$$\frac{K}{G(K+E-1)+1}.$$

$$u_{\text{X}}({\beta }_k)$$

Full text

I Introduction

I-A Private Information Retrieval

Private Information Retrieval (PIR) refers to the process of downloading a file from a database, without revealing to the database which file is being downloaded. PIR was originally introduced in the seminal work [4] from the perspective of Computer Science, where the goal is to construct PIR scheme with minimal communication cost. Much work has been done on PIR from this point of view, both under information-theoretic constraints [30] and computational ones [19], of which we also briefly mention [10, 29].

Recently, due to rising interest in large scale distributed storage systems and emerging quantum attacks on computationally secure protocols, PIR has experienced a flurry of research from the Information Theory community. In the Information-Theoretic formulation of the PIR problem, the primary performance metric of a PIR scheme is the download rate, which refers to the amount of downloaded bits per one information bit. The capacity of PIR, given a specific system setup, is the maximum possible download rate. Commonly, one assumes that files of length $K$ are distributed over $N$ different servers using an $[N,K]$ Maximum Distance Separable (MDS) storage code, and every $T$ out of these $N$ servers can collude to try to deduce the identity of the file being downloaded. The capacity of several variations on the PIR problem is now known, for example for $K=T=1$ by [23], for $K=1$ and $T\geq 1$ by [24], and for $K\geq 1$ and $T=1$ by [2]. Additional interesting and practically relevant variants on PIR appear when one accounts for unreliability of the servers, whether they be unresponsive, malicious, or curious as to the contents of the data they are storing. Variants along these lines have been studied and capacity expressions have been derived in [24, 3, 11].

Many open questions about PIR remain, for example the PIR capacity is unknown when $K,T>1$, that is, when a non-trivial storage code is used and we have non-trivial server collusion; less is known when $K,T>1$ and we try to account for unreliable servers. Given the difficulty of proving optimality in such generality, one is often content with achieving the more modest goal of constructing PIR schemes with large download rate and ignoring questions of capacity. Algebraic constructions of PIR schemes for coded data with colluding servers appeared in [26, 8], which were then generalized in [27] to account for unresponsive and Byzantine servers. Additional work along these lines has been done in [9, 13] for non-MDS storage codes. These schemes generally fall under the umbrella of “one-shot schemes”, a term recently christened in [6], where it was also shown how to lift such schemes to obtain schemes which achieve capacity in certain cases. Reed-Solomon and Reed-Muller codes have been especially useful in such constructions, because of their compatibility with the star product between two linear codes (see Section II-C).

I-B Private Computation

Private Computation (PC) is a generalization of PIR wherein the user wants to not just privately download a file from the database, but privately compute an arbitrary function of it. In PC, privacy refers to hiding the identity of the function to be computed. One recovers the PIR problem by specifying to functions given by coordinate projections. The principal performance metric for PC protocols is the PC-rate (or simply, rate), which is the ratio between the number of desired function evaluations and the total number of function evaluations downloaded.

For functions which are linear combinations of the files, PC was studied in [16, 25] for uncoded databases, and in [17, 18] for coded databases. The case of non-linear functions, and especially polynomial functions of degree larger than one, was studied by the second author of the current work in [12], where a PC scheme was constructed for polynomial functions on systematically coded databases.

I-C Coded Computation

The term Coded Computation (CC) broadly refers to a family of techniques in which redundancy is added to datasets, in order to alleviate various issues that arise in distributed computations. Motivated by recent applications in machine learning, studies in Coded Computation have focused, e.g., on accelerating distributed tasks, combating malicious interventions, providing various forms of privacy, alleviating the communication load in iterative algorithms, and more.

The study of this topic has been highly prolific in recent years, and works on the topic have mostly been task-specific. Typical tasks of interest include matrix multiplication [31, 7], accelerating gradient descent algorithms [20, 28, 15], communication reduction [14], and data shuffling [1, 5]. Yet, coded computing of general polynomials has been addressed only recently in [32], which is tightly connected to our results. In [32] it was shown that coding the data by using the well-known Lagrange polynomials can amend issues of resiliency, security, and privacy in many tasks of interest.

I-D Current Contributions

We present a Private Computation scheme for the evaluation of degree $G$ polynomials on $K$ data vectors $\textbf{x}_{k}\in\mathbb{F}_{q}^{M}$, encoded using an $[N,K+E]$ Reed-Solomon code, which hides the identity of the polynomials to be computed from any $T$ colluding servers, and hides the contents of the data vectors $\textbf{x}_{k}$ from any $E$ colluding servers. The scheme is robust against any $P$ stragglers and any $A$ adversaries, and has PC rate

[TABLE]

which clearly requires that $N>(G(K+E-1)+T+P+2A)$. We provide a non-trivial example which illustrates the scheme construction. Lastly, we propose an alternative scheme in the case that $P=A=E=0$, which employs systematic data encoding and achieves a rate of

[TABLE]

This second scheme construction first appeared in [12]. We provide some basic analysis as to the relative performance of the two schemes.

The scheme construction borrows ideas from Coded Computation, especially those of [32]. Data storage is realized by evaluating interpolating polynomials, which allows the evaluation of polynomials on encoded data to be viewed as the evaluation of a single variable polynomial. This single-variable polynomial is the composition of two polynomial functions of known degree, and its degree can therefore be calculated explicitly and serves as crucial knowledge for the scheme construction and rate calculation.

Our techniques are applicable in many real-world scenarios. Beyond direct applications in distributed computations over finite fields, such as large scale matrix multiplication, one can also apply our techniques in real-number scenarios with minor additional effort, by quantization and embedding of real values into a large enough finite field. Such quantization techniques were employed in machine learning scenarios, e.g., in distributed linear regression in [32], and in distributed logistic regression in [22].

I-E Comparison with Previous Work

The scheme construction presented here also generalizes some ideas from [27] to deal with non-linear functions and data privacy. In the case of $E=0$ and $G=1$ the current scheme achieves a rate of

[TABLE]

If the functions to be computed are all distinct coordinate projections, then we reduce to the case of the PIR problem, and the rate of (2) matches that of [27]. If one further assumes that $P=A=0$, one achieves a rate of

[TABLE]

which is that of [8]. The rate (3) is also the asymptotic rate (as the number of files $M\rightarrow\infty$) of [18] when $T=1$, which studies linear computations of coded databases. In all cases where $E=0$ and the PIR or PC capacity $\mathsf{C}$ is known, the current scheme achieves the asymptotic capacity as the number of files grows, that is, $R=\lim_{M\rightarrow\infty}\mathsf{C}$.

The capacity for the case $E>0$ is subtler. The case of $K=1$, $G=1$, $P=A=0$ is that of the recent work [11], which studies the PIR problem under the constraints of $T$-function privacy and $E$-data privacy, for storage systems in which every server stores an amount of data which is comparable to the entire dataset. In [11], the authors show that

[TABLE]

where $\mathsf{C}$ is the PIR capacity of this setting, and use a technique they deem Cross Subspace Alignment to construct an explicit scheme which achieves the above rate. The rate $R$ we achieve in this scenario is

[TABLE]

whenever $N>E+T$, which is strictly worse than that of [11] when $E>0$. This essentially stems from the fact that it is not clear how to align the noise terms arising from the function-privacy randomness and data-privacy randomness as in [11] for non-linear functions. Thus our PC scheme leaves room for improvement in the case of non-trivial data privacy.

II Preliminaries

II-A Notation

Throughout the current paper, we adopt the following notation. For a given integer $N$, define $[N]$ to be the set $\{1,2,\ldots,N\}$ of the first $N$ natural numbers. We use lowercase letters $a,b,c,\ldots$ for scalars or indexing variables, and uppercase letters $A,B,C,\ldots$ for system parameters, such as the number of servers, dimension of the storage code, etc. Boldface lowercase letters $\textbf{a},\textbf{b},\textbf{c},\ldots$ are reserved for vectors, and boldface uppercase letters $\textbf{A},\textbf{B},\textbf{C},\ldots$ for matrices. Calligraphic letters $\mathcal{A},\mathcal{B},\mathcal{C},\ldots$ are used to denote sets, including linear codes. The symbol $\mathbb{F}_{q}$ is used to denote the finite field of cardinality $q$. Lowercase Greek letters such as $\phi,\psi,\rho,\ldots$ will generally be used to denote functions, and $\phi\circ\psi$ denotes the composition of $\phi$ and $\psi$, that is, $(\phi\circ\psi)(x)=\phi(\psi(x))$.

An $[N,K,D]_{q}$ code $\mathcal{C}$ is a linear code over $\mathbb{F}_{q}$ with length $N$, dimension $K$, and minimum distance $D$. We will often omit the $D$ or $q$ if they are unimportant or clear from context. Recall that $\mathcal{C}$ is MDS (Maximum Distance Separable) if $D=N-K+1$.

We let $\mathcal{P}_{M,G}$ denote the set of all polynomials with coefficients in $\mathbb{F}_{q}$ in $M$ variables with total degree at most $G$, that is,

[TABLE]

Note that $\mathcal{P}_{M,G}$ is a finite-dimensional vector space over $\mathbb{F}_{q}$ and therefore supports a uniform distribution. The parameter $M$ will be of less interest to us in general and hence we will often write $\mathcal{P}_{G}$ for $\mathcal{P}_{M,G}$.

II-B Reed-Solomon Codes

Given parameters $N$, $K$, and $q\geq N$, we construct the $[N,K]$ Reed-Solomon code over $\mathbb{F}_{q}$ as follows. Let $\boldsymbol{\alpha}=(\alpha_{1},\ldots,\alpha_{N})$ be $N$ distinct elements of $\mathbb{F}_{q}$, and let

[TABLE]

We define the Reed-Solomon code $\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$ associated with this data to be the image of the evaluation map

[TABLE]

It is a classical result that $\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$ is an MDS code.

We will be particularly interested in the encoding of Reed-Solomon codes. If one chooses a basis $\phi_{1},\ldots,\phi_{K}$ of the vector space $\mathbb{F}_{q}[z]^{<K}$, then a generator matrix (and therefore an encoding map) is given by

[TABLE]

The following two choices of generator matrices will be the most important for our purposes.

II-B1 Canonical Encoding

The basis $1,z,\ldots,z^{K-1}$ of $\mathbb{F}_{q}[X]^{<K}$ gives rise to the Vandermonde generator matrix

[TABLE]

Another way to view this encoding map is to map a message $\textbf{a}=(a_{1},\ldots,a_{K})\in\mathbb{F}_{q}^{K-1}$ to the polynomial $\phi_{\textbf{a}}=\sum_{i=0}^{K-1}a_{i+1}z^{i}$. The codeword is then $(\phi_{\textbf{a}}(\alpha_{1}),\ldots,\phi_{\textbf{a}}(\alpha_{N}))=\textbf{a}\textbf{G}$.

II-B2 Lagrange Encoding

[32] In this case we choose a basis of $\mathbb{F}_{q}[z]^{<K}$ to consist of interpolating polynomials. More specifically, choose some $\boldsymbol{\beta}=(\beta_{1},\ldots,\beta_{K})$ consisting of distinct $\beta_{k}\in\mathbb{F}_{q}$. If $\textbf{a}=(a_{1},\ldots,a_{K})\in\mathbb{F}_{q}^{K}$ is a message vector, define $u_{\textbf{a},\boldsymbol{\beta}}\in\mathbb{F}_{q}[z]^{<K}$ by the property $u_{\textbf{a},\boldsymbol{\beta}}(\beta_{k})=a_{k}$ for all $k=1,\ldots,K$. The Lagrange Interpolation formula guarantees the existence of $u_{\textbf{a},\boldsymbol{\beta}}$, and the uniqueness is a consequence of the degree restriction.

A generator matrix corresponding to this encoding map is given by

[TABLE]

where we omit the notation $\boldsymbol{\alpha},\boldsymbol{\beta}$ when clear from context. If one defines $\beta_{k}=\alpha_{k}$ for $k=1,\ldots,K$, then the above matrix G is in systematic form. The fact that $\operatorname{Im}\textbf{G}(\boldsymbol{\alpha},\boldsymbol{\beta})\triangleq\{\textbf{a}\textbf{G}(\boldsymbol{\alpha},\boldsymbol{\beta})|\textbf{a}\in\mathbb{F}_{q}^{K}\}$ equals $\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$ for every $\boldsymbol{\beta}$ might not be readily seen, but is easily proved in the following lemma.

Lemma 1**.**

For every set $\boldsymbol{\alpha}\subseteq\mathbb{F}_{q}$ of size $N$, and every set $\boldsymbol{\beta}\subseteq\mathbb{F}_{q}$ of size $K$, we have that $\operatorname{Im}\textbf{G}(\boldsymbol{\alpha},\boldsymbol{\beta})=\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$.

Proof.

Let $\textbf{G}=\textbf{G}(\boldsymbol{\alpha},\boldsymbol{\beta})$. First, observe that $\textbf{a}\textbf{G}=ev(u_{\textbf{a},\boldsymbol{\beta}})$ for every $\textbf{a}\in\mathbb{F}_{q}^{K}$. This readily implies the inclusion $\operatorname{Im}\textbf{G}\subseteq\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$, since $\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$ includes all evaluations at $\boldsymbol{\alpha}$ of all univariate polynomials of degree at most $K-1$, one of which is $u_{\textbf{a},\boldsymbol{\beta}}$. To prove the converse inclusion, let $ev(f)\in\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$, and define $\textbf{y}=(f(\beta_{1}),\ldots,f(\beta_{K}))$. Since the polynomial $u_{\textbf{y},\boldsymbol{\beta}}$ agrees with the polynomial $f$ on $\{\beta_{i}\}_{i=1}^{K}$, and since the degrees of both $f$ and $u_{\textbf{y}.\boldsymbol{\beta}}$ are at most $K-1$, if follows that $f=u_{\textbf{y},\boldsymbol{\beta}}$, which implies that $ev(u_{\textbf{y},\boldsymbol{\beta}})=ev(f)$, and hence $ev(f)\in\operatorname{Im}\textbf{G}$. ∎

II-C Star Products

Let $\textbf{x}=(x_{1},\ldots,x_{N}),\textbf{y}=(y_{1},\ldots,y_{N})\in\mathbb{F}_{q}^{N}$. Their star product is defined to be

[TABLE]

Now let $\mathcal{C}$ and $\mathcal{D}$ be length $N$ linear codes over $\mathbb{F}_{q}$. Their star product $\mathcal{C}\star\mathcal{D}$ is another linear code of length $N$, defined to be

[TABLE]

Similarly, if $G\geq 1$ is any positive integer, we define

[TABLE]

Reed-Solomon codes are especially well-behaved with respect to star products, since the star product of two evaluation vectors is the evaluation vector of the product of the two functions. The following proposition essentially appears in [8] and [12], but we include a proof here for the sake of completeness.

Proposition 2**.**

Let $\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$ and $\mathcal{R}\mathcal{S}_{T}(\boldsymbol{\alpha})$ be Reed-Solomon codes of length $N$ with the same evaluation vector $\boldsymbol{\alpha}$. Then:

• (i)

$\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})\star\mathcal{R}\mathcal{S}_{T}(\boldsymbol{\alpha})=\mathcal{R}\mathcal{S}_{\min\{K+T-1,N\}}(\boldsymbol{\alpha})$, and

• (ii)

$\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})^{\star G}=\mathcal{R}\mathcal{S}_{\min\{G(K-1)+1,N\}}(\boldsymbol{\alpha})$.

Proof.

Let $f,g\in\mathbb{F}_{q}[z]$, where $\deg(f)<K$ and $\deg(g)<T$. Then $\deg(fg)<K+T-1$, and hence $\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})\star\mathcal{R}\mathcal{S}_{T}(\boldsymbol{\alpha})\subseteq\mathcal{R}\mathcal{S}_{\min\{K+T-1,N\}}(\boldsymbol{\alpha})$. Conversely, every polynomial of degree less than $K+T-1$ is a linear combination of polynomials of the form $fg$, where $\deg(f)<K$ and $\deg(g)<T$. This suffices to prove part (i). Part (ii) is proved using part (i) and an easy induction argument on $G$. ∎

II-D The Shamir Secret Sharing Scheme

The perfect privacy guarantees in the sequel can be seen as a special case of the Shamir secret sharing scheme [21]. By now a classic result, the Shamir secret sharing scheme allows $N$ parties to share $L$ secrets, such that sets of at most $X$ parties cannot infer anything about the secrets, and sets of at least $X+L$ parties can reconstruct all $L$ secrets. The Shamir scheme relies on linear encoding of the following form. Let $\textbf{s}_{1},\ldots,\textbf{s}_{L}$ be the secrets, seen as column vectors over a finite field. An external trusted party generates $X$ random column vectors $\textbf{t}_{1},\ldots,\textbf{t}_{X}$ of the same length as the secrets, performs linear encoding

[TABLE]

where $\textbf{A}\in\mathbb{F}_{q}^{L\times N}$ and $\textbf{B}\in\mathbb{F}_{q}^{X\times N}$, and distributes the shares $\textbf{y}_{1},\ldots,\textbf{y}_{N}$ to the parties. The following lemma is well-known, and will be most useful in the sequel.

Lemma 3**.**

If B is an MDS matrix (i.e., if every $X\times X$ submatrix of it is invertible), then

[TABLE]

for every subset $\{n_{1},\ldots,n_{X}\}\subseteq[N]$.

II-E Private Computation of Coded Data

We consider the problem of Private Computation on distributed storage systems of the following type; this follows a standard setup in the PIR literature, see [26, 2, 8]. Let $\textbf{x}_{1},\ldots,\textbf{x}_{K}\in\mathbb{F}_{q}^{M\times 1}$, and let $\mathcal{C}$ be an $[N,K]$ code over $\mathbb{F}_{q}$ with generator matrix $\textbf{G}\in\mathbb{F}_{q}^{K\times N}$. Define vectors $\textbf{y}_{n}\in\mathbb{F}_{q}^{M\times 1}$ for $n=1,\ldots,N$ by

[TABLE]

The vector $\textbf{y}_{n}$ is stored on server $n$. We refer to $\mathcal{C}$ as the storage code.

Given the above setup, a user wishes to compute $\phi_{b}(\textbf{x}_{k})$ for some functions $\phi_{1},\ldots,\phi_{B}$, for all $k=1,\ldots,K$. We assume that the functions $\phi_{b}$ all belong to some (necessarily finite-dimensional) vector space $\mathcal{S}$ of functions $\mathbb{F}_{q}^{M\times 1}\rightarrow\mathbb{F}_{q}$. To accomplish this goal, the user sends $S$ queries $\rho_{n}^{(1)},\ldots,\rho_{n}^{(S)}\in\mathcal{S}$ to the $n$’th server, who responds with the answers $\rho_{n}^{(1)}(\textbf{y}_{n}),\ldots,\rho_{n}^{(S)}(\textbf{y}_{n})$. From all $NS$ answers, the user must be able to decode the desired function evaluations:

[TABLE]

It is useful to think of the above as happening over $S$ rounds or iterations, so that during the $s$’th round the user queries the servers with the functions $\rho_{n}^{(s)}$ and obtains the answers $\rho_{n}^{(s)}(\textbf{y}_{n})$. Similarly, it is useful to think of the parameter $B$ as analogous to the block length of a file in traditional PIR. We view the parameters $B$ and $S$ as free for the user to adjust to maximize their download rate. Here the terms $\phi_{b}(\textbf{x}_{k})$ are random variables in the sense that the contents of the database are, to the user, unknown and therefore best treated as random. The terms $\rho_{n}^{(s)}(\textbf{y}_{n})$ are random variables in the sense that the queries $\rho_{n}^{(s)}$ are sampled according to some distribution employed by the user to preserve privacy. We forego making this precise for the sake of readability.

Our primary function space of interest is $\mathcal{S}=\mathcal{P}_{G}=\mathcal{P}_{M,G}$, the space of polynomial functions of total degree at most $G$ from $\mathbb{F}_{q}^{M\times 1}$ to $\mathbb{F}_{q}$. Thus we in general have $\phi_{b},\rho_{n}^{(s)}\in\mathcal{P}_{G}$, for every $b\in[B]$, $n\in[N]$, and $s\in[S]$.

For any $T$-subset $\mathcal{T}=\{n_{1},\ldots,n_{T}\}$ of $[N]$, we let $\rho_{\mathcal{T}}$ be the joint distribution of all $\rho_{n}^{(s)}$ for all $n\in\mathcal{T}$ and all $s=1,\ldots,S.$ PC scheme has $T$-function-privacy if

[TABLE]

That is, a PC scheme has $T$-function-privacy if the identities of the functions $\phi_{1},\ldots,\phi_{B}$ to be computed remain private even after any $T$ of the servers collude to attempt to deduce the identities of the $\phi_{b}$.

A PC scheme has $E$-data-privacy if

[TABLE]

That is, the servers in the distributed storage system remain oblivious to the contents of the uncoded data, even if $E$ of them collude to attempt to deduce the identities of the $\textbf{x}_{k}$.

A PC scheme is robust against $P$ stragglers or unresponsive servers if the user is still able to decode the values $\phi_{b}(\textbf{x}_{k})$ even if, during any round of the scheme, up to $P$ servers respond with an erasure symbol $?$ instead of the true answer $\rho_{n}^{(s)}(\textbf{y}_{n})$. Similarly, a PC scheme is robust against $A$ adversaries or Byzantine servers if the user is still able to decode the values $\phi_{b}(\textbf{x}_{k})$ even if, during any round of the scheme, up to $A$ servers respond with an arbitrary element of $\mathbb{F}_{q}$ instead of the true answer $\rho_{n}^{(s)}(\textbf{y}_{n})$. From a coding-theoretic perspective, having $P$ stragglers and $A$ adversaries simply means that during the $s$’th round, the user receives the total response vector

[TABLE]

where $\boldsymbol{\epsilon}^{(s)}$ is a vector containing at most $P$ erasure symbols $?$ and at most $A$ non-zero elements of $\mathbb{F}_{q}$. Here the erasure symbol is understood to be absorbing with respect to addition: $x+?=?$ for all $x\in\mathbb{F}_{q}$. See [24, 3, 27] for more on PIR from systems with stragglers and adversaries.

Given a PC scheme, our principal metric of efficiency will be the download rate, also referred to as the PC rate or simply rate, which is defined to be

[TABLE]

That is, the rate $R$ is the number of desired function evaluations $\phi_{b}(\textbf{x}_{k})$ the user obtains, divided by the total number of function evaluations $\rho_{n}^{(s)}(\textbf{y}_{n})$ downloaded. From a strict Information-Theoretic point of view, it would be more correct to define the rate to be

[TABLE]

which better accounts for potential dependencies between the variables $\phi_{b}(\textbf{x}_{k})$. If all $\phi_{b}(\textbf{x}_{k})$ are independent for all $b,k$, and furthermore $H(\phi_{b}(\textbf{x}_{k}))=H(\rho_{n}^{(s)}(\textbf{y}_{n}))$ for all $b,k,n,s$, then the two expressions in (6) and (7) for the rate coincide. This is indeed the case given reasonable independence conditions on the data vectors and the functions to be evaluated, but for the sake of compactness and readability we will ignore these subtleties and use (6) as our definition of rate.

Much of the current literature on PIR concerns itself with establishing the capacity $\mathsf{C}$ of a given PIR setup. The capacity of a PIR problem is defined to be the supremum of all possible PIR rates. As the current work is only concerned with explicit scheme constructions and not with establishing the capacity of any PC setup, we will mostly ignore this notion in the sequel.

We aggregate all of the important parameters of our system in Table I.

II-F Private Information Retrieval as Private Computation and a Remark on Upload Cost

The problem of Private Information Retrieval is a special case of the problem of Private Computation described above. Indeed, in PIR one typically supposes that the data matrix X is composed of several row blocks $\textbf{x}^{i}\in\mathbb{F}_{q}^{B\times K}$, which are the files of the system. Setting the functions $\phi_{b}$ to be the $B$ coordinate projections corresponding to the $B$ coordinates of some $\textbf{x}^{i}$, we see that computing $\phi_{b}(\textbf{x}_{k})$ for all $b=1,\ldots,B$ and all $k=1,\ldots,K$ is equivalent to retrieving each row of $\textbf{x}^{i}$, that is, downloading the file $\textbf{x}^{i}$. Since coordinate projections have degree $G=1$, any PC scheme for privately computing polynomials of arbitrary degree $G$ specifies to a PIR scheme when we set $G=1$ and choose the $\phi_{b}$ to all be distinct coordinate projections.

In Private Information Retrieval, one typically justifies ignoring the upload cost of a PIR scheme by assuming that the files $\textbf{x}^{i}$ have entries in some field extension $\mathbb{K}$ of $\mathbb{F}_{q}$, while the storage code $\mathcal{C}$ and queries $\rho_{n}^{(s)}$ all remain defined over $\mathbb{F}_{q}$. Provided that $[\mathbb{K}:\mathbb{F}_{q}]\gg 0$, the upload cost is dominated by the download cost, which justifies using the download rate as the sole performance metric. Generally, one can ignore the extension field $\mathbb{K}$ as all important operations and analysis occur over the base field $\mathbb{F}_{q}$.

Similar considerations allow one to ignore the upload cost in Private Computation. One can suppose that the data matrix is defined over some large extension $\mathbb{K}$ of $\mathbb{F}_{q}$, and that the function space $\mathcal{P}_{G}$ consists of polynomials with coefficients in $\mathbb{F}_{q}$ itself. Communicating an arbitrary polynomial in $\mathcal{P}_{G}$ costs $\sum_{i=0}^{G}\binom{M}{i}$ elements of $\mathbb{F}_{q}$, and therefore the user’s total upload cost will be $NS\sum_{i=0}^{G}\binom{M}{i}$. However, the total download cost is easily seen to be $NS\cdot[\mathbb{K}:\mathbb{F}_{q}]$ many elements of $\mathbb{F}_{q}$, and therefore if $\mathbb{K}$ satisfies $[\mathbb{K}:\mathbb{F}_{q}]\gg\sum_{i=0}^{G}\binom{M}{i}$, one can ignore the upload cost. We note that the upload cost increases very quickly in $G$, and therefore in practice this inequality may be satisfied only for small $G$.

Finally, we note that a simple relaxation of the privacy requirement can drastically reduce the upload cost. Notice that the expression $NS\sum_{i=0}^{G}\binom{M}{i}$ for upload cost stems from the expression $NS\dim_{\mathbb{F}_{q}}(\mathcal{P}_{G})$, where $\dim_{\mathbb{F}_{q}}(\mathcal{P}_{G})$ is the dimension of the set $\mathcal{P}_{G}$ as a subspace over $\mathbb{F}_{q}$. More generally, in order to communicate a function in a subspace $\mathcal{P}\subseteq\mathcal{P}_{G}$, where $\mathcal{P}$ is known to all, one only has to communicate $\dim_{\mathbb{F}_{q}}(\mathcal{P})$ field elements. Hence, one can determine any such subspace $\mathcal{P}$, either a priori or by communicating a sparse basis of it. Then, one can apply an identical scheme in which $\phi_{b}\in\mathcal{P}$ for every $b\in[B]$. The resulting privacy, however, will be restricted to $\mathcal{P}$, that is, the definition of $T$-function privacy will be reduced to

[TABLE]

for all $T$-subsets $\{n_{1},\ldots,n_{T}\}$ of $[N]$.

III A General Construction

In this section we present the main Private Computation scheme of the paper which applies for $N>(G(K+E-1)+T+P+2A)$. With the system parameters as in Table I, the PC scheme has rate

[TABLE]

In what follows, we describe the data encoding procedure, then present the scheme in broad strokes. In the third subsection, we present the scheme in detail, with an emphasis on the presentation of the first two rounds of the scheme for the sake of clarity. We show that the scheme has the stated rate, has $E$-data privacy, has $T$-function privacy, and is robust against any $P$ stragglers and any $A$ adversaries.

III-A Data Encoding

Let us first describe the data encoding procedure, which follows the Lagrange encoding of Reed-Solomon codes as in Section II-B2. Let $\textbf{x}_{k}\in\mathbb{F}_{q}^{M}$ for $k=1,\ldots,K$ be the $K$ data vectors, and let $\textbf{t}_{1},\ldots,\textbf{t}_{E}\in\mathbb{F}_{q}^{M}$ be $E$ i.i.d. uniform random vectors. Define $\textbf{X}=\left[\textbf{x}_{1}\cdots\textbf{x}_{K}\ \textbf{t}_{1}\cdots\textbf{t}_{E}\right]$. Let $\boldsymbol{\beta}=(\beta_{1},\ldots,\beta_{K+E})\in\mathbb{F}_{q}^{K+E}$ consist of $K+E$ distinct elements of $\mathbb{F}_{q}$. Define the interpolation polynomial $u_{\textbf{X}}(z)=u_{\textbf{X},\boldsymbol{\beta}}(z)$ by the property

[TABLE]

By basic facts about polynomial interpolation, we have $\deg(u_{\textbf{X}}(z))\leq K+E-1$. Note that $u_{\textbf{X}}(z)$ is more accurately described as a vector of polynomials of length $M$, that is, $u_{\textbf{X}}(z)\in\mathbb{F}_{q}[z]^{M}$. However, we continue to refer to it as a polynomial for simplicity. We now choose an evaluation vector $\boldsymbol{\alpha}=(\alpha_{1},\ldots,\alpha_{N})\in\mathbb{F}_{q}^{N}$ where the $\alpha_{n}$ are all distinct and non-zero, and set

[TABLE]

which is then stored on server $n=1,\ldots,N$. If we further have $\{\beta_{k}\}_{k\in[K]}\cap\{\alpha_{n}\}_{n\in[N]}=\varnothing$, then it is straightforward to show using Lemma 3 that we have $E$-data privacy. See [32, Section IV.C] for more details.

III-B Basic Scheme Outline

To begin, define $N^{\prime}\triangleq N-(P+2A)$, and let

[TABLE]

Define $B$ and $S$ to be positive integers satisfying the equation

[TABLE]

The exact choice of $B$ and $S$ is not of crucial importance, so one can choose them to be minimal or simply set $S=L$ and $B=H$ for simplicity, which are the minimal solutions whenever $\gcd(L,H)=1$.

The scheme will evaluate $\phi_{b}(\textbf{x}_{k})$ for $B$ functions $\phi_{b}\in\mathcal{P}_{G}$. This will be accomplished by downloading all coefficients of $\gamma_{b}(z)\triangleq\phi_{b}(u_{\textbf{X}}(z))$, and then evaluating the $\gamma_{b}(z)$ on the $\beta_{k}$. We have $\deg(\gamma_{b}(z))\leq G(K+E-1)$, and thus $L$ is the number of coefficients we need to download to completely determine a single $\gamma_{b}(z)$. As the individual coefficients of $\gamma_{b}(z)$ will also play a role in the scheme construction, we define $\gamma_{b\ell}$ by

[TABLE]

The parameter $H$ is defined so that the user will download $H$ unique coefficients $\gamma_{b\ell}$ during each round of the scheme.

We define some $\zeta_{b}^{(s)}(z)\in\mathbb{F}_{q}[z,z^{-1}]$ for $b=1,\ldots,B$ and $s=1,\ldots,S$, whose precise nature will be made clear in the scheme construction. We also choose111As mentioned in Subsection II-F, one can restrict the attention to some subspace $\mathcal{P}\subseteq\mathcal{P}_{G}$ to reduce upload costs, in which case we must have $\phi_{b}\in\mathcal{P}$ for every $b\in[B]$ and $\psi_{t}^{(s)}\in\mathcal{P}$ for every $s$ and $t$. The resulting query in (8) will be in $\mathcal{P}$ as a linear combination. The guaranteed privacy will be restricted to $\mathcal{P}$, i.e., an attacker will not be able to learn anything about the functions $\phi_{1},\ldots,\phi_{B}$ other than them being in $\mathcal{P}$. $\psi_{t}^{(s)}\in\mathcal{P}_{G}$ to be i.i.d. uniform random elements, which are chosen anew during each round. Now set

[TABLE]

Given our evaluation points $\alpha_{n}\in\mathbb{F}_{q}$, we construct query functions $\rho_{n}^{(s)}$, for $n=1,\ldots,N$, the $n$’th of which is equal to $\rho^{(s)}$ evaluated at $z=\alpha_{n}$. That is,

[TABLE]

Note that the coefficients $\zeta_{b}^{(s)}(\alpha_{n})$ and $\alpha_{n}^{H+t-1}$ in (8) are independent of the functions $\phi_{b}$ and $\psi_{t}^{(s)}$, and hence can be computed a priori. Here $\rho_{n}^{(s)}$ is transmitted to the $n$’th server during the $s$’th round, who responds with $\rho_{n}^{(s)}(\textbf{y}_{n})$. We define the $s$’th response polynomial $r^{(s)}(z)\in\mathbb{F}_{q}[z]$ to be

[TABLE]

where we define $\delta^{(s)}(z)\triangleq\sum_{t=1}^{T}z^{t-1}\psi_{t}^{(s)}(u_{\textbf{X}}(z))$. Note that

[TABLE]

and thus the evaluation vector of $z^{H}\delta^{(s)}(z)$, which contains only randomness, lives in a subspace of $\mathbb{F}_{q}^{N}$ of dimension $G(K+E-1)+T=N^{\prime}-H$.

During the $s$’th round, the user observes the vector

[TABLE]

where $\boldsymbol{\epsilon}^{(s)}$ is a vector which contains at most $P$ erasure symbols, coming from the $P$ stragglers, and at most $A$ arbitrary elements of $\mathbb{F}_{q}$, coming from the $A$ adversaries. During each round, this will allow the user to decode the coefficients of $1,z,\ldots,z^{H-1}$ in $r^{(s)}(z)$, which will come from the terms in $\sum_{b=1}^{B}\zeta_{b}^{(s)}(z)\gamma_{b}(z)$. The general expression for $r^{(s)}(z)$ will be of the form

[TABLE]

for some $C$ which can depend on the round index $s$. The assumption that $\alpha_{n}\neq 0$ for all $n$ guarantees that $ev(r^{(s)}(z))$ is a well-defined element of $\mathbb{F}_{q}^{N}$. Strictly speaking, $r^{(s)}(z)$ is not a polynomial as it will contain negative powers of $z$, but the distinction is not relevant to the scheme construction, and so we refer to it as a polynomial for simplicity.

During the $s$’th round, the decoding process roughly proceeds as follows. The user subtracts off the evaluation vectors of $a^{(s)}_{-C}z^{-C},\ldots,a^{(s)}_{-1}z^{-1}$ from what they receive, and are left with an element of a Reed-Solomon code with parameters $[N,N^{\prime},P+2A+1]$. This allows them to correct the $P$ erasures and $A$ errors in the vector $\boldsymbol{\epsilon}^{(s)}$. After this decoding, they may obtain the elements $a_{0}^{(s)},\ldots,a^{(s)}_{H-1}$ as the coefficients of the evaluation vectors of $1,z,\ldots,z^{H-1}$, which are linearly independent from the evaluation vector of $z^{H}\delta^{(s)}$.

The scheme construction will guarantee that the sets $A^{(s)}=\{a_{i}^{(s)}\ |\ i=0,\ldots,H-1\}$ of coefficients decoded during round $s$ each consist of $H$ unique coefficients of the polynomials $\gamma_{b}(z)$. That is, $A^{(s)}\cap A^{(t)}=\varnothing$ for $s\neq t$, and since each has size $H$, the user will have decoded $HS=BL$ unique coefficients of the $B$ polynomials $\gamma_{b}(z)$ at the end of the scheme. Since this is all of the coefficients of these polynomials, the user can reconstruct all $\gamma_{b}(z)$ entirely, and therefore compute

[TABLE]

for all $b=1,\ldots,B$ and all $k=1,\ldots,K$. The PC rate is therefore

[TABLE]

as claimed.

III-C Construction of $\zeta_{b}^{(s)}(z)$ and Decoding

It remains to define the functions $\zeta_{b}^{(s)}(z)$ and describe the decoding process. To begin, define the matrix

[TABLE]

and let $\zeta^{(s)}(z)$ be the $s$’th row of $\zeta(z)$. We start by defining integers $Q_{1}$ and $U_{1}$ by using Euclidean division to write

[TABLE]

For the sake of presentation, we first define $\zeta^{(1)}(z)$ and $\zeta^{(2)}(z)$ and demonstrate the decoding process during the first two rounds of the scheme. We then give a recursive definition of $\zeta_{b}^{(s)}(z)$ which works for every $s=2,\ldots,S$.

III-C1 Round $s=1$

Define $\zeta^{(1)}(z)$ to be

[TABLE]

or equivalently,

[TABLE]

The response polynomial $r^{(1)}(z)$ is then of the form

[TABLE]

First, note that

[TABLE]

that alongside (9) implies that the evaluation vector of $r^{(1)}(z)$ lives in $\mathcal{R}\mathcal{S}_{N^{\prime}}(\boldsymbol{\alpha})$, which is an MDS code with parameters $[N,N^{\prime},P+2A+1]$ and can thus correct $P$ erasures and $A$ errors contained in the vector $\boldsymbol{\epsilon}^{(s)}$. After the erasure/error correction, the user is left with the evaluation vector of $r^{(1)}(z)$, which determines $r^{(1)}(z)$ completely. Since $\deg(\gamma_{b}(z))\leq L$ for all $b$, the coefficients of $1,z,\ldots,z^{H-1}$ of the above allow the user to decode all of the coefficients of $\gamma_{1}(z),\ldots,\gamma_{Q_{1}}(z)$, and the first $U_{1}$ coefficients of $\gamma_{Q_{1}+1}(z)$. That is, $A^{(1)}=\{\gamma_{10},\ldots,\gamma_{Q_{1}+1,U_{1}-1}\}$.

III-C2 Round $s=2$

Let $Q_{2}$ be the largest integer such that $-U_{1}+(Q_{2}-Q_{1})L\leq H$, and define $\zeta^{(2)}(z)$ by

[TABLE]

The response polynomial $r^{(2)}(z)$ is then of the form

[TABLE]

where $U_{2}$ is chosen so that $-U_{1}+(Q_{2}-Q_{1})L+U_{2}-1=H-1$, that is, so that the first $U_{2}$ coefficients of $\gamma_{Q_{2}+1}(z)$ are downloaded during round $2$. Here $\eta^{(2)}(z)$ is a polynomial which incorporates the noise polynomial $\delta^{(2)}(z)$ and the monomials of $\gamma_{Q_{2}+1}(z)$ whose coefficients are not downloaded during the $s$’th round. One sees easily that

[TABLE]

from which we see that $\deg(z^{H}\eta^{(2)}(z))\leq N^{\prime}-1$ as well.

The coefficients $\gamma_{Q_{1}+1,0},\ldots,\gamma_{Q_{1}+1,U_{1}-1}$ are exactly the first $U_{1}$ coefficients of $\gamma_{Q_{1}}(z)$, and are known to the user from round $s=1$. The user can therefore subtract the vectors $\gamma_{Q_{1}+1,0}ev(z^{-U_{1}}),\ldots,\gamma_{Q_{1}+1,U_{1}-1}ev(z^{-1})$ from the response vector in round $2$. After this subtraction, the user is left with the vector

[TABLE]

where $\epsilon^{(2)}$ contains $P$ erasure symbols and $A$ non-zero elements of $\mathbb{F}_{q}$. Because $\mathcal{R}\mathcal{S}_{N^{\prime}}(\boldsymbol{\alpha})$ is an MDS code with parameters $[N,N^{\prime},P+2A+1]$, the user can correct these erasures and errors. After this erasure/error correction, the user further decodes the coefficients $A^{(2)}=\{\gamma_{Q_{1}+1,U_{1}},\ldots,\gamma_{Q_{2}+1,U_{2}-1}\}$ as the coefficients of the evaluation vectors of $1,z,\ldots,z^{H-1}$.

III-C3 Round $s=2,\ldots,S$

We generalize the construction of the $\zeta_{b}^{(2)}(z)$ to the following recursive construction of $\zeta_{b}^{(s)}$ for all $s=2,\ldots,S$. Having already defined $U_{s-1}$ and $Q_{s-1}$, we define $Q_{s}$ to be the maximal integer such that $-U_{s-1}+(Q_{s}-Q_{s-1})L\leq H$, and then set

[TABLE]

Lastly, define $U_{s}$ by the equation $-U_{s-1}+(Q_{s}-Q_{s-1})L+U_{s}-1=H-1$. In round $s-1$, the user decoded the first $U_{s-1}$ coefficients of $\gamma_{Q_{s-1}}(z)$. The response polynomial $r^{(s)}(z)$ can therefore be written as

[TABLE]

As in rounds $s=1,2$, the user first subtracts the vectors corresponding to negative powers of $z$, the coefficients of which have been decoded in round $s-1$. As in rounds $s=1,2$, one shows easily that $\deg(z^{H}\eta^{(s)}(z))\leq N^{\prime}-1$, hence what is left after this subtraction is an element of $\mathcal{R}\mathcal{S}_{N^{\prime}}(\boldsymbol{\alpha})$ plus a vector $\boldsymbol{\epsilon}^{(s)}$ with $P$ erasure symbols and $A$ non-zero elements of $\mathbb{F}_{q}$. After performing erasure/error correction in this Reed-Solomon code, the user may now decode the set $A^{(s)}=\{\gamma_{Q_{s-1},U_{s-1}},\ldots,\gamma_{Q_{s},U_{s}-1}\}$ as the coefficients of the evaluation vectors of $1,z,\ldots,z^{H-1}$. We see that during the $s$’th round, the user obtains all coefficients of $Q_{s}-Q_{s-1}$ distinct polynomials $\gamma_{b}(z)$, and $U_{s}$ coefficients of a single additional polynomial.

After $S$ rounds, the user has decoded all of the sets $A^{(s)}$ for $s=1,\ldots,S$. Since they are all clearly disjoint and of size $H$, the user has obtained $HS=BL$ coefficients of the $\gamma_{b}(z)$, which suffices to reconstruct all of these polynomials. The scheme construction is therefore complete.

III-D Proof of $T$-function Privacy

Since a function in $\mathcal{P}_{G}$ can be seen as a vector over $\mathbb{F}_{q}$, it follows from (8) that the query functions are of the following form.

[TABLE]

It is readily verified by Lemma 3 that $I(\phi_{1},\ldots,\phi_{B};\rho_{n_{1}}^{(s)},\ldots,\rho_{n_{T}}^{(s)})=0$ for any $T$-subset $\mathcal{T}$ of $[N]$, and any single $s=1,\ldots,S$. Since the $\psi_{t}^{(s)}$ are chosen independently between rounds, the result follows.

IV Example

In this section we illustrate some of the subtleties of the scheme construction through a detailed example for the parameters $N=14$, $K=2$, $G=2$, $T=1$, $P=1$, $A=1$, $E=2$, which achieves a PC rate of

[TABLE]

The auxiliary parameters are given by $N^{\prime}=11$, $H=4$, $L=7$, $B=4$, and $S=7$. The data encoding operates by choosing two i.i.d. uniform random vectors $\textbf{t}_{1}$, $\textbf{t}_{2}$ and distinct elements $\beta_{1},\ldots,\beta_{4}\in\mathbb{F}_{q}$, and defining the interpolating polynomial $u_{\textbf{X}}(z)$ by the conditions

[TABLE]

We have $\deg(u_{\textbf{X}}(z))\leq 3$. Choosing some $\alpha_{1},\ldots,\alpha_{14}\in\mathbb{F}_{q}$ to all be non-zero and distinct from $\beta_{1}$ and $\beta_{2}$, we encode by setting $\textbf{y}_{n}=u_{\textbf{X}}(\alpha_{n})$ for all $n=1,\ldots,14$.

The scheme will compute, over $S=7$ rounds, the function values $\phi_{b}(\textbf{x}_{k})$ for $B=4$ quadratic functions $\phi_{b}$. The polynomials $\gamma_{b}(z)=\phi_{b}(u_{\textbf{X}}(z))$ whose coefficients will be downloaded have degree $\deg(\gamma_{b}(z))\leq 6$, and hence are each completely determined by $L=7$ coefficients.

The query functions $\rho^{(s)}_{n}$ take the form

[TABLE]

where $\psi_{1}^{(s)}$ is a uniform random element of $\mathcal{P}_{2}$. The functions $\zeta_{b}^{(s)}(z)$ are given by

[TABLE]

from which we can compute the response polynomials $r^{(s)}(z)$ to be

[TABLE]

In the first round, the polynomial $r^{(1)}(z)$ has degree $\leq N^{\prime}-1=10$, hence its evaluation vector lives in a Reed-Solomon code with parameters $[14,11,4]$, allowing the user to correct the erasure and error from the straggler and adversary. The user then decodes $\gamma_{10},\ldots,\gamma_{13}$. In all successive rounds, it is clear from the above expressions that all coefficients of negative powers of $z$ are decoded in previous rounds, and can thus be subtracted from the response vector. After this subtraction, what is left is in a Reed-Solomon code with parameters $[14,11,4]$, which can correct $P=1$ erasure and $A=1$ error. The user performs this erasure/error correction, and then decodes the coefficients of $1,z,z^{2},z^{3}$ in every round.

Having decoded all $\gamma_{b\ell}$ for $b=1,\ldots,4$ and $\ell=0,\ldots,6$, the user can compute $\phi_{b}(\textbf{x}_{k})=\gamma_{b}(\beta_{k})$ for $b=1,\ldots,4$ and $k=1,2$. The user has computed $KB=8$ function evaluations while downloading $NS=98$ elements of $\mathbb{F}_{q}$ total, hence the rate of the scheme is

[TABLE]

as claimed.

V Improved PC rate for systematic encoding

In this section it is shown that whenever $P=A=E=0$ and $N\leq 2G(K-1)+T+1$, a larger PC rate is achievable by systematic encoding. The choice of the specific systematic code is not important, so one can simply assume that the data is encoded with systematic Lagrange encoding (i.e., where $\beta_{i}=\alpha_{i}$ for all $i\in[K]$ in (II-B2)). The scheme in this section appeared in [12].

First, let the storage code be $\mathcal{C}=\mathcal{R}\mathcal{S}_{K}(\boldsymbol{\alpha})$. Define $\mathcal{D}=\mathcal{R}\mathcal{S}_{T}(\boldsymbol{\alpha})$, called the retrieval code of the scheme, and let $\mathcal{E}\triangleq\mathcal{C}^{\star G}\star\mathcal{D}$. It follows from Lemma 1 and Proposition 2 that $\mathcal{E}=\mathcal{R}\mathcal{S}_{G(K-1)+T}(\boldsymbol{\alpha})$. Denote the minimum distance of $\mathcal{E}$ by $D_{\mathcal{E}}$, and let $F\triangleq D_{\mathcal{E}}-1=N-G(K-1)-T$. Next, let $B$ and $S$ be the minimal integers that satisfy $\min\{F,K\}S=KB$ (i.e., $S=\frac{\operatorname{lcm}(K,\min\{F,K\})}{\min\{F,K\}}$ and $B=\frac{\operatorname{lcm}(K,\min\{F,K\})}{K}$), and choose subsets of $[K]$ –

[TABLE]

such that in each row the sets in the union are pairwise disjoint, such that $|\mathcal{I}^{(s)}|=\min\{F,K\}$ for every $s\in[S]$, and such that for every $b\in[B]$ we have that $\cup_{s=1}^{S}\mathcal{I}^{(s,b)}=[K]$. The process of choosing the sets $\{\mathcal{I}^{(s,b)}\}_{(s,b)\in[S]\times[B]}$ in (V) is very simple, and similar constructions have appeared in [8, 12]. For our current purposes, the choice of these sets is best illustrated by the following example.

Example 4**.**

Assume that $F=4$ and $K=6$, which implies that $S=3$ and $B=2$. Consider the following matrix

[TABLE]

which naturally corresponds to the sets

[TABLE]

One verifies immediately that the sets $\{\mathcal{I}^{(s,b)}\}_{(s,b)\in[S]\times[B]}$ have the stated properties.

To continue with the scheme construction, let $Q$ be the dimension of $\mathcal{P}_{G}$, and fix a basis $\psi^{1},\ldots,\psi^{Q}$ of $\mathcal{P}_{G}$. In round $s\in[S]$, the user employs fresh randomness in order to choose codewords $\textbf{d}^{1},\ldots,\textbf{d}^{Q}\in\mathcal{D}$, and defines

[TABLE]

for every $n\in[N]$, where $\textbf{d}^{i}(n)$ is the $n$’th entry of $\textbf{d}^{i}$. Then, the user defines the queries

[TABLE]

Intuitively, the set $\mathcal{I}^{(s)}\subseteq[N]$ contains the indices of the $\textbf{y}_{i}$’s for which some $\phi_{b}(\textbf{y}_{i}),b\in[B]$ is retrieved during the $s$’th round. In addition, for every $b\in[B]$, the set $\mathcal{I}^{(s,b)}$ contains the indices of the $\textbf{y}_{i}$’s such that $\phi_{b}(\textbf{y}_{i})$ is retrieved during the $s$’th round; formally, we have that

[TABLE]

The $T$-function-privacy relies on the following lemma, analogues of which were fully proved in [12, Theorem 1] and in [8, Theorem 8], among others.

Lemma 5**.**

If $\mathcal{D}$ is an MDS code then the scheme is $T$-function-private.

In turn, the response vector is of the form

[TABLE]

where

[TABLE]

and notice that $\phi(\textbf{y}_{n})=\phi_{b}(\textbf{x}_{n})$ merely since $\mathcal{I}^{(s)}\subseteq[K]$, and since the encoding is systematic.

Lemma 6**.**

The codeword $\boldsymbol{\psi}(\textbf{Y})\triangleq[\psi_{1}(\textbf{y}_{1}),\ldots,\psi_{N}(\textbf{y}_{N})]$ is in $\mathcal{E}$.

Proof.

According to (11), one can readily verify that

[TABLE]

and hence it remains to prove that $[\psi^{j}(\textbf{y}_{1}),\ldots,\psi^{j}(\textbf{y}_{N})]\in\mathcal{C}^{\star G}$ for every $j\in[Q]$. To this end, assume that the chosen basis $\psi^{1},\ldots,\psi^{Q}$ consists only of monomials, and let $\psi^{j}=X_{1}^{a_{1}}X_{2}^{a_{2}}\cdots X_{M}^{a_{M}}$ for some $j\in[Q]$. Denoting $\textbf{y}_{n}\triangleq[y_{n,1},y_{n,2},\ldots,y_{n,M}]$ for every $n\in[N]$, which implies that $[y_{1,m},y_{2,m},\ldots,y_{N,m}]\in\mathcal{C}$ for every $m\in[M]$, implies that

[TABLE]

Since $\boldsymbol{\psi}(\textbf{Y})$ is a codeword in $\mathcal{E}$, and since the Hamming weight of $\textbf{v}^{(s)}$ is at most $|\mathcal{I}^{(s)}|\leq F=D_{\mathcal{E}}-1$, it follows that the vector $\textbf{v}^{(s)}$ can be extracted from $\boldsymbol{\rho}^{(s)}(\textbf{Y})$ by an error correction algorithm for $\mathcal{E}$. Therefore, according to the definition of the sets $\{\mathcal{I}^{(s,b)}\}_{(s,b)\in[S]\times[B]}$, it follows that the user can retrieve $\{\phi_{b}(\textbf{x}_{k})\}_{(k,b)\in[K]\times[B]}$, which concludes the correctness of the scheme, whose PC rate is

[TABLE]

Recall that for the parameters $P=A=E=0$, the PC rate of the general scheme (I-D) is

[TABLE]

Therefore, in order to compare (13) with (14), notice that if $N>2G(K-1)+T+1$, then since $G\geq 1$, it follows that

[TABLE]

and thus (13) reduces to $K/N$. Moreover, (15) also implies that

[TABLE]

and hence for this parameter regime we have that (14) is superior to (13). Conversely, if $N\leq 2G(K-1)+T+1$, then $F\leq G(K-1)+1$, and therefore

[TABLE]

Also, since $K\leq G(K-1)+1$, we have that

[TABLE]

and hence

[TABLE]

which implies the superiority of the systematic scheme for $N\leq 2G(K-1)+T+1$.

To compare (13) and (14) asymptotically, assume that $N,K,$ and $T$ approach infinity, and yet $\alpha\triangleq K/N$ and $\beta\triangleq T/N$ remain constants. The resulting PC rates are $\frac{1-\beta}{G}-\alpha$ for the general scheme, and $\min\{1-\alpha G-\beta,\alpha\}$ for the systematic one, and the necessary condition $N\geq G(K-1)+T+1$ translates to $\alpha G+\beta\leq 1$. An example for $G=2$ and $\beta=0.05$ is given in Figure 1.

VI Discussion and open problems

In this paper we leveraged a recent notion from coded computing and obtained a robust private computing scheme for computing polynomials of arbitrary degree on encoded data, that can also guarantee privacy of the data. The scheme also accounts for servers which are stragglers or adversaries, and is robust against servers colluding to attempt to deduce the identity of the functions to be evaluated. Many open questions remain, the most prominent of which is the capacity question, i.e., constructing schemes for this scenario with provably optimal rate. However, as mentioned in Section I, the capacity question of PIR is largely open, even without extending its scope to private computation. Thus, proving optimality is likely to be very difficult, even in restricted cases where some of the system parameters are zero. Another possible research direction is coming up with a proper notion of perfect privacy for real-valued computations, which applies directly without embedding into a finite field.

Acknowledgements

The first author would like to thank Prof. Jehoshua Bruck for many helpful discussions. The second author would like to thank Razane Tajeddine and Oliver Gnilke for constructive and helpful conversations regarding the results of the current work.