Private Information Retrieval from Non-Replicated Databases

TL;DR

This paper investigates private information retrieval from non-replicated databases with specific graph-structured storage, deriving capacity bounds and proposing optimal schemes for cyclic and fully-connected configurations.

Contribution

It introduces capacity bounds and capacity-achieving schemes for PIR in non-replicated, graph-structured databases, extending beyond traditional replicated models.

Findings

PIR capacity for cyclic graphs is 2/(K+1).

PIR capacity for fully-connected graphs is min{2/K, 1/2}.

Non-replication causes significant capacity degradation.

Abstract

We consider the problem of private information retrieval (PIR) of a single message out of $K$ messages from $N$ non-colluding and non-replicated databases. Different from the majority of the existing literature, which considers the case of replicated databases where all databases store the same content in the form of all $K$ messages, here, we consider the case of non-replicated databases under a special non-replication structure where each database stores $M$ out of $K$ messages and each message is stored across $R$ different databases. This generates an $R$-regular graph structure for the storage system where the vertices of the graph are the messages and the edges are the databases. We derive a general upper bound for $M=2$ that depends on the graph structure. We then specialize the problem to storage systems described by two special types of graph structures: cyclic graphs and \emph{fully-connected graphs}. We prove that the PIR capacity for the case of cyclic graphs is $\frac{2}{K+1}$, and the PIR capacity for the case of fully-connected graphs is $\min\{\frac{2}{K},\frac{1}{2}\}$. To that end, we propose novel achievable schemes for both graph structures that are capacity-achieving. The central insight in both schemes is to introduce dependency in the queries submitted to databases that do not contain the desired message, such that the requests can be compressed. In both cases, the results show severe degradation in PIR capacity due to non-replication.

Tables

Table 1. Table 1 : Contents of databases for the example ( 6 , 3 , 2 , 9 ) 6 3 2 9 (6,3,2,9) system specified by graph in Fig.  1 .

$D_1$	$D_2$	$D_3$	$D_4$	$D_5$	$D_6$	$D_7$	$D_8$	$D_9$
$W_1$	$W_1$	$W_1$	$W_2$	$W_2$	$W_3$	$W_3$	$W_4$	$W_5$
$W_2$	$W_4$	$W_6$	$W_3$	$W_5$	$W_4$	$W_6$	$W_5$	$W_6$

Table 2. Table 2 : Contents of databases for the ( 3 , 2 , 2 , 3 ) 3 2 2 3 (3,2,2,3) system specified by graph in Fig.  3 .

Database 1 ($D_1$)	Database 2 ($D_2$)	Database 3 ($D_3$)
$W_1$	$W_1$	$W_2$
$W_2$	$W_3$	$W_3$

Table 3. Table 3 : Sun and Jafar scheme for the K = 3 𝐾 3 K=3 , R = 2 𝑅 2 R=2 , M = 2 𝑀 2 M=2 , N = 3 𝑁 3 N=3 example.

Database 1	Database 2	Database 3
$a_1$	$a_2$	$b_2$
$b_1$	$c_1$	$c_2$
$a_3+b_2$	$a_4+c_2$	$b_3+c_3$

Table 4. Table 4 : Compressing the scheme of Sun and Jafar for K = 3 𝐾 3 K=3 , R = 2 𝑅 2 R=2 , M = 2 𝑀 2 M=2 , N = 3 𝑁 3 N=3 .

Database 1	Database 2	Database 3
$a_1$	$a_2$
$b_1$	$c_1$
$a_3+b_2$	$a_4+c_2$	$b_1+c_2$
		$b_2+c_1$

Table 5. Table 5 : Complete query structure for the capacity-achieving scheme for K = 3 𝐾 3 K=3 , R = 2 𝑅 2 R=2 , M = 2 𝑀 2 M=2 , N = 3 𝑁 3 N=3 .

	Database 1	Database 2	Database 3
rep. 1	$a_1$	$a_2$
	$b_1$	$c_1$
	$a_3+b_2$	$a_4+c_2$	$b_1+c_2$
			$b_2+c_1$
rep. 2	$a_5$		$b_4$
	$b_3$		$c_3$
	$a_6+b_4$	$a_7+c_3$	$b_3+c_4$
		$a_8+c_4$
rep. 3		$a_9$	$b_5$
		$c_5$	$c_6$
	$a_{10}+b_5$	$a_{12}+c_6$	$b_6+c_5$
	$a_{11}+b_6$

Table 6. Table 6 : Contents of databases for the ( 4 , 3 , 2 , 6 ) 4 3 2 6 (4,3,2,6) system specified by graph in Fig.  4

$D_1$	$D_2$	$D_3$	$D_4$	$D_5$	$D_6$
$W_1$	$W_1$	$W_1$	$W_2$	$W_2$	$W_3$
$W_2$	$W_3$	$W_4$	$W_3$	$W_4$	$W_4$

Table 7. Table 7 : Contents of databases for the ( 6 , 2 , 3 , 4 ) 6 2 3 4 (6,2,3,4) system. Note that, here M = 3 𝑀 3 M=3 .

Database 1 ($D_1$)	Database 2 ($D_2$)	Database 3 ($D_3$)	Database 4 ($D_4$)
$W_1$	$W_1$	$W_2$	$W_3$
$W_2$	$W_4$	$W_3$	$W_4$
$W_5$	$W_6$	$W_6$	$W_5$

Table 8. Table 8 : An achievable scheme for the ( 6 , 2 , 3 , 4 ) 6 2 3 4 (6,2,3,4) storage system.

Database 1	Database 2	Database 3	Database 4
$a_1,a_2$	$a_3,a_4$	$b_3,b_4$	$c_3,c_4$
$b_1,b_2$	$d_1,d_2$	$c_1,c_2$	$d_3,d_4$
$e_1,e_2$	$f_1,f_2$	$f_3,f_4$	$e_3,e_4$
$a_5+b_3$	$a_9+d_3$	$b_7+c_7$	$c_9+d_7$
$a_6+b_4$	$a_{10}+d_4$	$b_8+c_8$	$c_5+d_8$
$a_7+e_3$	$a_{11}+f_3$	$b_9+f_5$	$c_7+e_7$
$a_8+e_4$	$a_{12}+f_4$	$b_5+f_9$	$c_8+e_8$
$b_5+e_5$	$d_5+f_5$	$c_9+f_7$	$d_5+e_9$
$b_6+e_6$	$d_6+f_6$	$c_5+f_8$	$d_9+e_5$
$a_{13}+b_7+e_7$	$a_{16}+d_7+f_7$	$b_1+c_3+f_1$	$c_1+d_1+e_1$
$a_{14}+b_8+e_8$	$a_{17}+d_8+f_8$	$b_2+c_4+f_2$	$c_2+d_2+e_2$
$a_{15}+b_9+e_9$	$a_{18}+d_9+f_9$	$b_6+c_6+f_6$	$c_6+d_6+e_6$

Equations

$$H(W_k)$$

$$H(\mathcal{W})$$

$$Z_1$$

$$Z_2$$

$$⋮$$

$$Z_{N-1}$$

$$Z_N$$

$$I(\mathcal{W};Q_{1:N}^{[k]})=0,k\in [K]$$

$$H(A_n^{[k]}|Q_n^{[k]},Z_n)=0,n\in [N]$$

$$(Q_n^{[i]},A_n^{[i]},\mathcal{W})\sim (Q_n^{[j]},A_n^{[j]},\mathcal{W}),n\in [N],i,j\in [K]$$

$$H(W_k|Q_{1:N}^{[k]},A_{1:N}^{[k]})=0$$

$$R_{\text{PIR}}=\frac{L}{{\sum }_{n=1}^{N}H(A_n^{[k]})}$$

$$R_{\text{PIR}}\le \min \left\{\frac{R}{N},\frac{1}{1+\frac{\delta }{R}}\right\}$$

$$C_{\text{PIR}}=\frac{2}{K+1}$$

$$\displaystyle C_{\text{PIR}}=\left\{\begin{array}[]{ll}\frac{1}{2},&K=2,3\\ \frac{2}{K},&K\geq 4\\ \end{array}\right.$$

$$\mathcal{Q}\triangleq \left\{Q_n^{[k]}:k\in [K],n\in [N]\right\}$$

$$H(A_1^{[m]}|\mathcal{Q})$$

$$H(A_1^{[m]}|\mathcal{W}\setminus \{W_m\},\mathcal{Q})$$

$$H(A_n^{[m]}|\mathcal{W}\setminus \{W_m\},\mathcal{Q})\ge \frac{L}{R},n\in {\mathcal{R}}_m$$

$$L$$

$$=H(W_m|\mathcal{W}\setminus \{W_m\},\mathcal{Q})$$

$$=H(W_m|\mathcal{W}\setminus \{W_m\},\mathcal{Q})-H(W_m|\mathcal{W}\setminus \{W_m\},\mathcal{Q},A_{1:N}^{[m]})$$

$$=H(W_m|\mathcal{W}\setminus \{W_m\},\mathcal{Q})-H(W_m|\mathcal{W}\setminus \{W_m\},\mathcal{Q},A_{{\mathcal{R}}_m}^{[m]})$$

$$=I(W_m;A_{{\mathcal{R}}_m}^{[m]}|\mathcal{W}\setminus \{W_m\},\mathcal{Q})$$

$$=H(A_{{\mathcal{R}}_m}^{[m]}|\mathcal{W}\setminus \{W_m\},\mathcal{Q})$$

$$\le RH(A_n^{[m]}|\mathcal{W}\setminus \{W_m\},\mathcal{Q}),n\in {\mathcal{R}}_m$$

$$L$$

$$=\frac{R}{N}NH(A_n^{[m]}|\mathcal{W}\setminus \{W_m\},\mathcal{Q})$$

$$\le \frac{R}{N}NH(A_n^{[m]}|\mathcal{Q})$$

$$=\frac{R}{N}\sum _{n=1}^{N}H(A_n^{[m]}|\mathcal{Q})$$

$$R_{\text{PIR}}=\frac{L}{{\sum }_{n=1}^{N}H(A_n^{[m]})}\le \frac{L}{{\sum }_{n=1}^{N}H(A_n^{[m]}|\mathcal{Q})}\le \frac{R}{N}$$

$$L$$

$$=H(W_1|\mathcal{Q})-H(W_1|A_{1:N}^{[1]},\mathcal{Q})$$

$$=I(W_1;A_{1:N}^{[1]}|\mathcal{Q})$$

$$=H(A_{1:N}^{[1]}|\mathcal{Q})-H(A_{1:N}^{[1]}|W_1,\mathcal{Q})$$

$$\le NH(A_1^{[1]}|\mathcal{Q})-H(A_{1:N}^{[1]}|W_1,\mathcal{Q})$$

$$\le NH(A_1^{[1]}|\mathcal{Q})-H(A_{\Delta }^{[1]}|W_1,\mathcal{Q})$$

$$=NH(A_1^{[1]}|\mathcal{Q})-\sum _{i=1}^{\delta }H(A_i^{[1]}|W_1,\mathcal{Q},A_{1:i-1}^{[1]})$$

$$\le NH(A_1^{[1]}|\mathcal{Q})-\sum _{i=1}^{\delta }H(A_i^{[1]}|W_1,\mathcal{W}\setminus \{W_{n_i}\},\mathcal{Q},A_{1:i-1}^{[1]})$$

$$=NH(A_1^{[1]}|\mathcal{Q})-\sum _{i=1}^{\delta }H(A_i^{[1]}|W_1,\mathcal{W}\setminus \{W_{n_i}\},\mathcal{Q})$$

$$\displaystyle A_{i}^{[1]}=\left\{\begin{array}[]{ll}f_{i}({\mathcal{Q}},W_{1},W_{n_{i}}),&1\leq i\leq R\\ f_{i}({\mathcal{Q}},\tilde{W}_{2},W_{n_{i}}),&R+1\leq i\leq R+\delta_{2}\\ f_{i}({\mathcal{Q}},\tilde{W}_{3},W_{n_{i}}),&R+\delta_{2}+1\leq i\leq R+\delta_{2}+\delta_{3}\\ \vdots\\ f_{i}({\mathcal{Q}},\tilde{W}_{\kappa},W_{n_{i}}),&R+\sum_{j=2}^{\kappa-1}\delta_{j}+1\leq i\leq R+\sum_{j=2}^{\kappa}\delta_{j}\end{array}\right.$$

$$L$$

Full text

1 Introduction

Private information retrieval (PIR), introduced in [1], is a canonical problem to study the privacy of users as they download content from public databases. In the classical setting, a user is interested in retrieving a single message (file) out of $K$ messages from $N$ replicated and non-colluding databases, in such a way that no database can know the identity of the user’s desired file. The PIR problem has become a vibrant research topic within information theory starting with trailblazing papers [2, 3, 4, 5, 6, 7, 8]. In [9], Sun and Jafar introduce the PIR capacity, which is the supremum of the ratio of the number of bits of desired information ($L$) that can be retrieved privately to the total downloaded information. They characterize the PIR capacity of the classical PIR problem to be $C_{\text{PIR}}=(1+\frac{1}{N}+\cdots+\frac{1}{N^{K-1}})^{-1}$. The fundamental limits of many interesting variants of the problem have been investigated in [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56].

A common assumption in most of these works is that the entire message set is replicated across all databases. This is crucial for constructing capacity-achieving schemes, as in many existing schemes the undesired symbols downloaded from one database are exploited as side information in the remaining databases, and replication is the key that enables downloading any bit from any database and using it as side information at any other database. However, the replication assumption may not be practical in next-generation storage systems and networks. From a storage point of view, message replication is impractical as it incurs high storage cost, especially for storage systems with a large number of messages or files with a large size. From a network structure point of view, in next-generation networks where peer-to-peer (P2P) connections will be prevalent, nodes (i.e., databases) may not necessarily possess the same set of messages. These practical scenarios, which challenge the replication assumption, motivate investigating PIR in non-replicated storage systems. In this work, we aim at devising achievable schemes that do not rely on message replication, and at the same time, that are more efficient than the trivial scheme of downloading the contents of all databases. We aim at evaluating the loss in the PIR rate due to non-replication and investigating the interplay between the storage structure and the resulting PIR rate.

A few works have considered relaxing the replication assumption: Reference [14] investigates the case when the contents of the databases are encoded via an $(N,K_{c})$ MDS code instead of assuming data replication. [14] derives the PIR capacity for this setting, which reveals a fundamental tradeoff between storage cost and retrieval cost. Reference [40] studies the PIR problem from storage constrained databases. In this problem, each database is constrained to store $\mu KL$ uncoded bits with $\mu\leq 1$ (as opposed to $KL$ bits needed in replicated databases). [40] shows that symmetric batch caching, which was originally introduced for centralized coded caching systems in [57], results in the largest possible PIR rate under storage constraints. This problem is extended to the decentralized setting in [54], where each database stores $\mu KL$ bits randomly and independently from any other database. [54] shows that uniform and random bit selection, which was introduced for decentralized coded caching systems in [58], results in the largest possible PIR rate under storage constraints.

The work that is most closely related to our work here is [55]. The databases in [55] store different subsets of the message set. Different from the previous works on non-replication such as [40, 54], in [55] databases store full messages and not portions of every message. In particular, [55] investigates the case when every message is replicated across two databases only. This storage system, in this case, can be represented by a graph, in which every two databases are connected via an edge corresponding to the common message. [55] proposes an achievable PIR scheme that is immune against colluding databases, that do not form a cycle in the graph. The scheme in [55] achieves a retrieval rate of $\frac{1}{N}$. The work in [55] highlights some interesting insights about the relation between some combinatorial properties of the graph and the immunity against database collusion. In the extended version of [55] in [56], which has appeared concurrently and independently of our work here, an upper bound is proposed to show that their PIR rate is at most a factor of 2 from the optimal value for regular graphs, and the techniques are extended to larger replication factors.

In this paper, we consider PIR of a single message out of $K$ messages from $N$ non-replicated and non-colluding databases. In our formulation, each message appears in $R$ different databases, and every database stores $M$ different messages. Thus, the storage system is parameterized by $(K,R,M,N)$ such that $KR=MN$, where $K$ is the total number of messages in the system, $R$ is the replication factor of each message, $M$ is the storage constraint of each database, and $N$ is the number of databases. We focus on the case $M=2$. For this case, the storage system can be uniquely specified by an $R$-regular graph. In our graph formulation, the messages correspond to the vertices and the databases correspond to the edges. This is in contrast to [55], where $R=2$, and the roles of messages and databases are reversed on the graph. Hence, our graph formulation may be considered as the dual graph formulation to [55]. Our goal is to characterize the PIR capacity of this system.

First, we derive a general upper bound on the retrieval rate for storage systems described by $R$-regular graphs. Interestingly, the upper bound depends on the structure of the graph and not only on $(K,R,M,N)$. In particular, the upper bound is related to the longest sequence of databases that cover all of the $K$ messages in the storage system. We specialize the problem further to two classes of graphs, namely, cyclic graphs and fully-connected graphs, where we obtain exact results. In cyclic graphs, all vertices form a circle connected by edges. Therefore, each vertex (a message) emanates two edges (two databases), which means that each message is common among two adjacent databases which are arranged in a cycle. Thus, in this case $R=2$, and since $M=2$ in this paper, using $KR=MN$ mentioned above, we have, $K=N$. For this type of graphs, we show that $C_{\text{PIR}}=\frac{2}{K+1}$. The achievable scheme starts from the greedy algorithm of Sun and Jafar [9] and then compresses the requests to $K-2$ databases by replacing the individual symbols of the scheme in [9] by sum of two messages. This compression necessitates exploiting side information even in databases that do not contain the desired messages. In fully-connected graphs, each vertex is connected to all of the remaining $K-1$ vertices. Therefore, each vertex (a message) emanates $K-1$ edges ($K-1$ databases), which means that each message resides in $K-1$ databases. Thus, in this case $R=K-1$, and since $M=2$, from $KR=MN$, we have $N=K(K-1)/2$, i.e., $N=\binom{K}{2}$. That is, all $\binom{K}{2}$ combinations of two messages appear in a different database. In this case, we show that $C_{\text{PIR}}=\min\{\frac{2}{K},\frac{1}{2}\}$. For $K\geq 4$, for this case, we propose a novel achievable scheme, which is based on retrieving a single weighted sum (with respect to sufficiently large field) of two symbols from every database. For the comparable cases with [55], our scheme outperforms their scheme in terms of the PIR rate. We note that, in both cyclic and fully-connected graph cases, the PIR capacity converges to zero as $N\rightarrow\infty$, which implies a severe degradation in the PIR efficiency due to non-replication.

Finally, we show an example for a storage system with $M=3$. We provide a novel achievable scheme that uses processed side information and outperforms the scheme in [55].

2 Problem Formulation

Consider the problem of PIR from $N$ non-replicated and non-colluding databases. We denote the databases by $\mathcal{D}=\{D_{1},D_{2},\cdots,D_{N}\}$. The storage system stores $K$ messages in total, each message is stored across $R$ different databases, i.e., $R$ is the repetition factor for every message, and each database stores locally $M$ different messages. We denote the message set by ${\mathcal{W}}=\{W_{1},W_{2},\cdots,W_{K}\}$. Each message $W_{k}\in\mathbb{F}_{q}^{L}$ is a vector of length $L$ picked in an i.i.d. fashion from a sufficiently large finite field $\mathbb{F}_{q}^{L}$,

[TABLE]

The storage system is parameterized by $(K,R,M,N)$. We note that for a feasible storage system (that is symmetric across databases and messages), we have $KR=MN$. In this work, we focus on the case $M=2$. To fully characterize the storage system in this case, we represent the storage system as $R$-regular graph111We note that the graph used in our formulation may be considered as the dual graph of the one used in [55]. In our work, $M=2$, the nodes are the messages and the edges are the databases, while in [55], $R=2$, the nodes are the databases and the edges are the messages.; see Fig. 1 and Table 1 for a $(6,3,2,9)$ example. We characterize the storage system by a $(V,E)$ regular graph, where $V={\mathcal{W}}=\{W_{1},W_{2},\cdots,W_{K}\}$ is the set of vertices, and $E=\mathcal{D}=\{D_{1},D_{2},\cdots,D_{N}\}$ is the set of edges, i.e., in this graph, the vertices are the messages and the edges are the databases. An edge $D_{j}$ drawn between messages $W_{m}$ and $W_{k}$ means that the contents of database $D_{j}$ is $Z_{j}=\{W_{m},W_{k}\}$. This graph is an $R$-regular graph, since each message is repeated $R$ times across the storage system. In the following, we define specific parameters of the graph, which are needed while constructing the converse proof.

Definition 1** **(Graph reduction)

The graph $(V,E)=({\mathcal{W}},\mathcal{D})$ is reduced iteratively starting with the vertex $W_{1}$ by enumerating all the edges connecting to $W_{1}$, and removing all neighboring vertices connected to enumerated edges except one, which we denote by $\tilde{W}_{2}$. The process of enumerating edges and removing corresponding neighbors iteratively continues until one vertex is left $\tilde{W}_{\kappa+1}$ after $\kappa$ reductions.

Definition 2** **(Spread of the graph)

The spread of a graph $\delta$ is the largest sequence of edges (databases) that results from the graph reduction procedure given in Definition 1.

An example graph reduction for the $(6,3,2,9)$ storage system given in Fig. 1 and Table 1 is shown in Fig. 2. In this work, we further focus on two special classes of $R$-regular graphs, namely: cyclic graphs and fully-connected graphs.

Definition 3** **(Cyclic graphs)

The graph $(V,E)=({\mathcal{W}},\mathcal{D})$ is called a cyclic graph if each two adjacent vertices are connected by an edge and no non-adjacent vertices are connected by an edge, i.e., the contents of the databases can be written as (without loss of generality):

[TABLE]

Consequently, the cyclic graph is parameterized by $(K,R,M,N)=(K,2,2,K)$, and the spread of the graph is $\delta=K-1$.

Definition 4** **(Fully-connected graphs)

The graph $(V,E)=({\mathcal{W}},\mathcal{D})$ is called fully-connected if every two vertices are connected by a unique edge. Hence, the contents of the databases can be written as the $\binom{K}{2}$ subsets of $\{1,\cdots,K\}$ with 2 elements. The fully-connected graph is parameterized by $(K,R,M,N)=(K,K-1,2,\binom{K}{2})$, and the spread of the graph is $\delta=K-1$.

In PIR, the user wants to retrieve a message $W_{k}$ without leaking any information about the identity of the message to any individual database. To that end, the user sends $N$ queries, one for each database. These queries are independent of the messages as the user has no information about the messages prior to retrieval, hence,

[TABLE]

The databases respond to the user queries by answer strings $A_{1:N}^{[k]}$. The answer string $A_{n}^{[k]}$ is a deterministic function of the query $Q_{n}^{[k]}$ and the contents of the database $D_{n}$, which is denoted by $Z_{n}$, therefore,

[TABLE]

In PIR, we have two formal requirements. First, we have the privacy requirement. To ensure privacy, the retrieval strategy intended to retrieve $W_{i}$ must be indistinguishable from the retrieval strategy intended to retrieve $W_{j}$ for any $i$ and $j$, i.e.,

[TABLE]

where $\sim$ denotes statistical equivalence.

The second requirement is the reliability requirement. The user needs to be able to reconstruct $W_{k}$ perfectly222The results of this work do not change if we relaxed the reliability constraint to allow arbitrarily small probability of error, i.e., if we changed the reliability constraint as $H(W_{k}|Q_{1:N}^{[k]},A_{1:N}^{[k]})=o(L)$. from the collected answers, i.e.,

[TABLE]

We measure the efficiency of the retrieval scheme by the retrieval rate $R_{\text{PIR}}$. An achievable retrieval scheme is a scheme that satisfies (6), (7) for some message length $L$. The retrieval rate is the ratio between the length of the desired message $L$ and the total download,

[TABLE]

The PIR capacity is the largest PIR rate over all achievable schemes, i.e., $C_{\text{PIR}}=\sup R_{\text{PIR}}$.

3 Main Results

In this section, we present the main results of this paper. Our first result is a general upper bound for storage systems defined by $R$-regular graphs with $M=2$ and arbitrary $(K,R,N)$ which is given in the following theorem. The proof of Theorem 1 is given in Section 4.

Theorem 1** **(Upper-bound for $R$-regular graphs)

For an $R$-regular graph storage system with $(K,R,M,N)=(K,R,2,N)$, the retrieval rate is upper bounded by

[TABLE]

Remark 1

The upper bound reveals a dependency on the structure of the storage system, captured in the spread of the graph $\delta$. I.e., the upper bound cannot be parameterized by $(K,R,M,N)$ only. This opens the door for joint optimization of the storage system together with the retrieval scheme.

Remark 2

The upper bound $R_{\text{PIR}}\leq\frac{1}{1+\frac{\delta}{R}}$ is a general upper bound which is valid for any storage system with $M=2$ and is represented via an $R$-regular graph (including the example shown in Figs. 1 and 2). In this paper, we focus on two special cases, namely:

• •

Cyclic graphs: In this case, the spread of the graph is $\delta=K-1$ as we can cover all the messages in the storage system by visiting exactly $K-1$ databases. Furthermore, $R=2$, as every node in the graph is connected to $2$ adjacent nodes only. Applying the bound in Theorem 1, $R_{\text{PIR}}\leq\frac{1}{1+\frac{\delta}{R}}=\frac{1}{1+\frac{K-1}{2}}=\frac{2}{K+1}$.

• •

Fully-connected graphs: In this case, the spread of the graph is $\delta=R$ as $W_{1}$ is connected to all other messages. Applying the bound in Theorem 1, $R_{\text{PIR}}\leq\frac{1}{1+\frac{\delta}{R}}=\frac{1}{1+\frac{R}{R}}=\frac{1}{2}$. Also, in this case, $R=K-1$ and $N=K(K-1)/2$, hence, $R_{\text{PIR}}\leq\frac{R}{N}=\frac{(K-1)}{K(K-1)/2}=\frac{2}{K}$.

In the following two results, we characterize the PIR capacity of cyclic graphs and fully-connected graphs. The converse proofs for Theorems 2 and 3 are corollaries of Theorem 1 as shown in Remark 2. The achievability proofs of Theorems 2 and 3 are given in Section 5.

Theorem 2** **(Capacity of cyclic graphs)

For a cyclic graph storage system, the PIR capacity is given by

[TABLE]

Theorem 3** **(Capacity of fully-connected graphs)

For a fully-connected graph storage system with $M=2$, the PIR capacity is given by

[TABLE]

Remark 3

The capacity results in this work reveal a severe loss in the retrieval rate due to non-replication. For the cyclic and fully-connected graphs, $C_{\text{PIR}}\rightarrow 0$ as $N\rightarrow\infty$. This is in contrast to the classical PIR problem [9], where $C_{\text{PIR}}\rightarrow 1$ as $N\rightarrow\infty$. This is intuitively due to the fact that as $N\rightarrow\infty$, we have $K\rightarrow\infty$. Meanwhile, the number of side information equations generated is limited due to non-replication. In particular, the side information equations are related to $R-1$ (in contrast to $N-1$ in the classical model), while total downloads grow with $N$ as the user needs to download from all databases to satisfy the privacy constraint. The ratio $\frac{R}{N}\rightarrow 0$ as $N\rightarrow\infty$ for both cases.

Remark 4

The results of this work outperform the trivial scheme of downloading all messages, which achieves $\frac{1}{K}$. Our retrieval rate also outperforms the best achievable scheme in [55], which achieves $\frac{1}{N}$ for cyclic graphs (which is the comparable case to our work). The achievable rate $\frac{1}{N}=\frac{1}{K}<\frac{2}{K+1}$ for the case of cyclic graphs. This implies that the retrieval rates in non-replicated PIR systems in [55] may be improved. Nevertheless, the results in [55] are more general which are valid for all $(K,2,M,N)$ graph-based storage systems. The results in [55] also cover collusion resistance, which is outside the scope of our work here.

4 Converse Proof

In this section, we prove Theorem 1. To that end, we present a general upper bound for the retrieval rate for general $R$-regular graphs for the case of $M=2$.

Let ${\mathcal{Q}}$ denote the collection of all queries to all databases for all desired messages, i.e.,

[TABLE]

We assume that the retrieval scheme is symmetric across databases (as in [8, Lemma 1]). This assumption is without loss of generality, since any asymmetric retrieval scheme can be transformed into a symmetric one by means of time-sharing without changing the retrieval rate. Hence, for $m\in\{1,\cdots,K\}$, we have

[TABLE]

where ${\mathcal{W}}\setminus\{W_{m}\}=\{W_{1},W_{2},\cdots,W_{m-1},W_{m+1},\cdots,W_{K}\}$. We need the following lemma.

Lemma 1

Let ${\mathcal{R}}_{m}$ denote the set of databases containing message $W_{m}$, then

[TABLE]

**Proof: ** We have

[TABLE]

where (19) follows from the fact that $W_{m}$ is independent of the messages and the queries $({\mathcal{W}}\setminus\{W_{m}\},{\mathcal{Q}})$, (20) follows from the reliability constraint. For (21), we note that the answer strings $A_{[N]\setminus{\mathcal{R}}_{m}}^{[m]}=\{A_{n}^{[m]}:n\not\in{\mathcal{R}}_{m}\}$ are deterministic functions of $({\mathcal{W}}\setminus\{W_{m}\},{\mathcal{Q}})$ only, hence $W_{m}\rightarrow({\mathcal{W}}\setminus\{W_{m}\},{\mathcal{Q}})\rightarrow A_{[N]\setminus{\mathcal{R}}_{m}}^{[m]}$ is a Markov chain and $A_{[N]\setminus{\mathcal{R}}_{m}}^{[m]}$ can be dropped from the conditioning. (23) follows from the fact that answer strings are deterministic functions of the messages and queries, and (24) follows from the database symmetry in (16). Rearranging (24) concludes the proof.  $\blacksquare$

We are now ready to prove the converse statement in Theorem 1. We first prove that $R_{\text{PIR}}\leq\frac{R}{N}$. From Lemma 1, we have

[TABLE]

where (27) follows from the fact that conditioning reduces entropy, (28) follows from the symmetry across databases. Therefore,

[TABLE]

Next, we prove that $R_{\text{PIR}}\leq\frac{1}{1+\frac{\delta}{R}}$, where $\delta$ is the spread of the graph; see Definition 2. In order to obtain the spread of the graph, we begin by the node representing $W_{1}$, then we enumerate all the edges (databases) connecting to $W_{1}$. Without loss of generality, label these databases by $1,2,\cdots,R$. These edges are connecting to the nodes corresponding to $\{W_{n_{1}},W_{n_{2}},\cdots,W_{n_{R}}\}$. Then, we reduce the graph by removing all the connecting nodes to $W_{1}$ except one (which belongs to the path of the largest distance), which we denote by $\tilde{W}_{2}\in\{W_{n_{1}},W_{n_{2}},\cdots,W_{n_{R}}\}$. We again enumerate all the edges connecting to $\tilde{W}_{2}$ with the nodes $\{W_{n_{R+1}},W_{n_{R+2}},\cdots,W_{n_{R+\delta_{2}}}\}$, where $\delta_{2}$ is the number of databases that contain $\tilde{W}_{2}$ after the graph reduction, then we reduce the graph again by removing all nodes connecting to $\tilde{W}_{2}$ except one, which we denote by $\tilde{W}_{3}$, and so on. Then, we have

[TABLE]

where (31) follows from the reliability constraint and the independence of queries and messages, (34) follows from the independence bound, (35) follows from the non-negativity of the entropy function where $A_{\Delta}^{[1]}$ denotes the answer strings returned by the sequence of the databases that define the spread of the graph, and (37) follows from the fact that conditioning on ${\mathcal{W}}\setminus\{W_{i}\}$ cannot increase entropy.

To show (38), we note that from the reduction procedure that results in $A_{\Delta}^{[1]}$, we have

[TABLE]

for some deterministic function $f_{i}(\cdot)$, and $\kappa$ is the number of reductions on the graph until all nodes are removed from the graph. Since the leading message at the $j$th graph reduction $\tilde{W}_{j}$ belongs to the set of the connected messages in the $(j-1)$th graph reduction, and at the $j$th graph reduction, the nodes connecting to $\tilde{W}_{j}$ are removed from the graph, we have $\{\tilde{W}_{2},\tilde{W}_{3},\cdots,\tilde{W}_{j(i)}\}\subseteq\{W_{n_{1}},W_{n_{2}},\cdots,W_{n_{i-1}}\}\subseteq{\mathcal{W}}\setminus\{W_{n_{i}}\}$, where $j(i)$ is the index of the leading message in the $i$th database. Consequently, we can drop $A_{1:i-1}^{[1]}$ as they are deterministic functions of $({\mathcal{Q}},W_{1},{\mathcal{W}}\setminus\{W_{n_{i}}\})$.

Now, we have

[TABLE]

where (46) follows from the privacy constraint, and (47) follows from Lemma 1. Reordering terms, we have

[TABLE]

which together with (29) concludes the proof of Theorem 1.

5 Achievability Proof

In this section, we begin first with a motivating example of $(K,R,M,N)=(3,2,2,3)$ to show the basic ingredients of the achievable scheme. In fact, the graph for this motivating example is both cyclic and fully-connected (see Fig. 3), therefore, this motivating example can be considered as a unifying instance of the optimal scheme for both cyclic and fully-connected graphs. Then, we present general capacity-achieving schemes for cyclic graphs and fully-connected graphs. Finally, we show by an example how we can extend the presented schemes to the case of $M\geq 3$ (with no claim of optimality).

5.1 Motivating Example: $K=3$, $R=2$, $M=2$, $N=3$

In this example, we consider a storage system that consists of $N=3$ databases. The system stores $K=3$ messages in total, namely $W_{1},W_{2},W_{3}$. Each message is replicated across $R=2$ databases, such that each database stores $M=2$ messages (see Table 2). This is a cyclic and also a fully-connected graph as shown in Fig. 3.

Without loss of generality, assume that the desired message is $W_{1}$. To construct the capacity-achieving scheme, the user randomly permutes the indices of messages $W_{1},W_{2},W_{3}$ independently, uniformly, and privately from the databases. Denote the permuted version of $W_{1}$ by the vector $(a_{1},\cdots,a_{L})$, the permuted version of $W_{2}$ by $(b_{1},\cdots,b_{L})$, and the permuted version of $W_{3}$ by $(c_{1},\cdots,c_{L})$. Pick $L=12$.

A straightforward solution for this problem is to apply Sun and Jafar scheme in [9]. Since every database contains $M=2$ messages, the user downloads a single bit from each message from each database in round 1, i.e., the user downloads $a_{1},b_{1}$ from database 1, $a_{2},c_{1}$ from database 2, and $b_{2},c_{2}$ from database 3. Now, the user exploits $b_{2},c_{2}$ as side information by downloading $a_{3}+b_{2}$ from database 1, and $a_{4}+c_{2}$ from database 2. Finally, the user downloads the sum $b_{3}+c_{3}$ from database 3. The query table for this scheme is shown in Table 3. Note that although the sum $b_{3}+c_{3}$ is irrelevant to the decodability of $W_{1}$, the user needs to download it to satisfy the privacy constraint. Otherwise, database 3 would figure out that the desired message is $W_{1}$, as the user requests 2 bits from database 3 when the desired message is $W_{1}$, while the user would have requested 3 bits from database 3 if the desired message was $W_{2}$ or $W_{3}$. With this scheme, the user downloads $4$ bits from $W_{1}$ out of the total $9$ downloads, hence $R_{\text{PIR}}=\frac{4}{9}$.

Although this scheme outperforms the scheme in [55] in terms of the retrieval rate (the scheme in [55] achieves $R_{\text{PIR}}=\frac{1}{3}$), there is room for improving it. The main source of inefficiency of the scheme is the downloads from database 3, as the user downloads 3 bits and exploits only 2 of them. Moreover, the user downloads new independent bit $b_{3}+c_{3}$. If the user introduces dependency to the downloads of database 3, the user may compress333Throughout this work, we use the expressions “dependency” and “compression”. In previous PIR works, the user downloads new and independent undesired symbols at each round, which can be used in later rounds as side information. However, in this work, the user downloads undesired symbols which are dependent on the undesired symbols downloaded from other databases. We download these dependent symbols even from the databases that do not contain the desired message. We call these “dependent” downloads to differentiate them from “side information” downloads, which are intended to be used to decode the desired message directly. Furthermore, by “compression”, we mean downloading shorter (fewer) answer strings than the greedy algorithm in [9] by exploiting the knowledge of the dependent symbols. the requests from database 3, and improve the retrieval rate. In order to do this, the user downloads the sums $b_{1}+c_{2}$ and $b_{2}+c_{1}$ from database 3 (see Table 4). For the decodability, the user can decode $c_{2}$ by canceling $b_{1}$ from $b_{1}+c_{2}$ and $b_{2}$ by canceling $c_{1}$ from $b_{2}+c_{1}$. Therefore, $a_{3}$, $a_{4}$ are decodable by canceling $b_{2}$ and $c_{2}$.

Nevertheless, the scheme in Table 4 is not private because the user still downloads 2 bits from database 3 in the form of sum of 2 bits. To remedy this problem, the user should repeat the compression of the downloads over all databases, i.e., the user should download 2 bits in the same manner of downloading from database 3 in the other two databases as well. Hence, in repetition 2, the user compresses the downloads from database 2 and downloads $a_{7}+c_{3}$, $a_{8}+c_{4}$. Similarly, in repetition 3, the user downloads $a_{10}+b_{5}$ and $a_{11}+b_{6}$ from database 1. The complete query structure is given in Table 5.

Next, we discuss privacy, decodability and the rate of this achievable scheme.

Regarding privacy: The query structure is now symmetric across the databases, and the indices of the bits from each message are chosen uniformly, independently and privately. Hence, all queries are equally likely, and the scheme is private.

Regarding decodability: We note that each repetition is decodable separately. As we discussed above, $a_{1},\cdots,a_{4}$ are decodable in repetition 1. For repetition 2, $a_{5}$ is decodable directly, $a_{6}$ is decodable by canceling $b_{4}$ from $a_{6}+b_{4}$, and $a_{7}$ is decodable by canceling $c_{3}$ from $a_{7}+c_{3}$. Finally, $c_{4}$ is decodable by canceling $b_{3}$ from $b_{3}+c_{4}$ and therefore $a_{8}$ is decodable by further canceling $c_{4}$ from $a_{8}+c_{4}$ (or equivalently by adding $a_{8}+c_{4}$ and $b_{3}+c_{4}$ under modulo-2 addition and canceling $b_{3}$ from the sum). The decodability of repetition 3 follows in a similar way to the decodability of repetition 2 by exchanging the roles of $W_{2},W_{3}$.

Regarding the achievable rate: The user downloads $12$ bits from $W_{1}$ out of a total of $24$ downloads. Consequently, $R_{\text{PIR}}=\frac{12}{24}=\frac{1}{2}$ which matches the upper bound in Theorem 1.

Remark 5

It is interesting to compare the PIR capacity here to the PIR capacity in [40] where the contents are stored in the databases using the optimal storage strategy under the memory-size constraint $\mu$. Note that, in this example, $\mu=\frac{2}{3}$ as every database stores 2 full messages out of 3 messages. Using the optimal storage strategy in [40], the PIR capacity is $C_{\text{PIR}}=(1+\frac{1}{2}+\frac{1}{2^{2}})^{-1}=\frac{4}{7}$ which is larger than the PIR capacity here $C_{\text{PIR}}=\frac{1}{2}$. This implies a loss in the PIR capacity due to storing full messages here as opposed to storing uncoded parts of the messages in [40] subject to the same memory-size constraint.

5.2 General Achievability for the Case of Cyclic Graphs

In this section, we generalize the ideas of the motivating example for arbitrary $K$. The new ingredient in this scheme (in contrast to [9]) is the compression of the queries submitted for a subset of the databases. To satisfy the privacy constraint, the user performs the scheme along $\binom{N}{2}=\binom{K}{2}$ repetitions. In each repetition, the user chooses to submit the full query (according to [9]) to $2$ databases. For the remaining databases, the user downloads two symbols in the form of 2-sums. The scheme works with $L=4\binom{K}{2}$ symbols. The general scheme for cyclic graphs can be summarized as:

Index preparation: The indices of the symbols of each message are permuted independently, uniformly, and privately at the user side. 2. 2.

Constructing full queries: We apply the scheme of Sun and Jafar [9] to construct the full queries to all databases. We apply this scheme over blocks of $\tilde{L}=4$. To that end, the user downloads 1 individual symbol from each message from each database in round 1. Next, the user downloads a 2-sum from the stored messages in each database. This sum exploits the side information generated from other databases. Note that since $R=2$ in this graph, the user can generate 1 side information equation for each database. Another change from [9] is that even for the $K-2$ databases that do not contain the desired message, the user exploits the side information generated at other databases by introducing dependency to the answers. 3. 3.

Compressing queries: The user choose different $K-2$ databases at each repetition. The user compresses the queries to these databases by adding the individual symbols in round 1 into single equation.444We note that in some cases, we may need to shuffle the indices of the symbols in the sum to prevent ending up with useless equations. For example, if the full queries are in the form of $b_{2},c_{1},b_{1}+c_{2}$, then, after compressing, we have the 2-sums $b_{2}+c_{1}$, and $b_{1}+c_{2}$. Now, imagine that $b_{2}$ and $c_{1}$ are decodable from the remaining databases. In this case, the sum of $b_{2}+c_{1}$ is useless and the sum $b_{1}+c_{2}$ is not decodable. However, if we shuffle the indices such that the user downloads $b_{2}+c_{2}$ and $b_{1}+c_{2}$, then the user can use both equations to decode $b_{1}$ and $c_{2}$. This would not affect the privacy as the indices are permuted uniformly and privately at the user side. 4. 4.

Repeat step 2, 3 over new blocks of 4 symbols for $\binom{K}{2}$ repetitions.

5.2.1 Decodability, Privacy, and Achievable Rate

Regarding decodability: In this scheme, at each repetition, we have $4$ unknowns corresponding to the desired message and $2(K-1)$ unknowns corresponding to the undesired messages. The user downloads 3 equations (full queries) from 2 databases, and 2 equations from the remaining databases. Hence, the user downloads in total $6+2(K-2)=2K+2$ equations in $2(K-1)+4$ unknowns. This linear system is decodable (up to necessary index shuffling).

Regarding privacy: The scheme is private since the symbols are permuted randomly and privately at the user side and the scheme is repeated along all $\binom{K}{2}$ combinations of the databases. Hence, the structure of the queries is the same across all databases. Thus, the distribution of the queries is the same irrespective to the desired message.

Regarding the achievable rate: From every repetition of the scheme, the user can decode 4 symbols from the desired message, thus,

[TABLE]

5.3 General Achievability for the Case of Fully-Connected Graphs

In this section, we present the general achievability for the case of fully-connected graphs. For $K=2$, we have 1 database containing 2 messages; the capacity-achieving scheme is simply to download the contents of the entire database, hence $C_{\text{PIR}}=\frac{1}{2}$. For $K=3$, the capacity-achieving scheme is exactly the motivating example in Section 5.1, hence $R_{\text{PIR}}=\frac{1}{2}$.

For $K\geq 4$, the upper bound $R_{\text{PIR}}\leq\frac{2}{K}$ is the active upper bound. The general achievability for this case is given below. The achievable scheme works with $L=R=K-1$ symbols from $\mathbb{F}_{q}$, where $q$ is sufficiently large and is prime.

Index preparation: The indices of the symbols of each message is permuted independently, uniformly, and privately at the user side. 2. 2.

Retrieval from database 1: Denote the permuted contents of the $n$th database by $Z_{n}=\left\{X_{1}^{(n)},X_{2}^{(n)}\right\}$. Without loss of generality, assume that the desired message is stored in database 1, hence, $X_{1}^{(1)}$ is the permuted version of the desired message. From database 1, the user downloads a weighted sum of two symbols from the two messages, i.e., the user downloads $\alpha_{1}^{(1)}X_{1}^{(1)}(1)+\alpha_{2}^{(1)}X_{2}^{(1)}(1)$ from database 1, where $\alpha_{m}^{(n)}\in\mathbb{F}_{q}$, $m\in\{1,2\},n\in[N]$. The choice of $\alpha_{m}^{(n)}$ will be specified later. 3. 3.

Exploiting side information: The user downloads different weighted sums from every database. If the $n$th database contains the desired message, the user downloads a new desired symbol in the sum. If the message stored in the $n$th database is undesired, the user exploits the same message symbol in all databases. I.e., the user downloads the weighted sum $\alpha_{1}^{(n)}X_{1}^{(n)}(i)+\alpha_{2}^{(1)}X_{2}^{(1)}(j)$, where indices $i,j$ are chosen depending on the message (if desired, we increment the index; if undesired we fix the index to 1) 4. 4.

Database symmetry: The user repeats the last step across all databases.

5.3.1 Decodability, Privacy, and Achievable Rate

Regarding decodability: The user collects $N=\binom{K}{2}$ equations. These equations have $L=K-1$ unknowns corresponding to the desired message and $K-1$ unknowns corresponding to the undesired messages, i.e., we have a linear system of $\binom{K}{2}$ equations in $2K-2$ unknowns. Without loss of generality, assume that the desired message is stored in the first $K-1$ databases, hence $W_{k}=\{X_{1}^{(1)}(1),X_{1}^{(2)}(2),\cdots,X_{1}^{(K-1)}(K-1)\}$. The linear system of equations can be written as:

[TABLE]

The choice of the coefficients $\alpha_{m}^{(n)}\in\mathbb{F}_{q}$, $m\in\{1,2\},n\in[N]$ is such that the decoding matrix $\mathbf{\Psi}$ is invertible. One simple way555In general, one can enumerate all possible $\mathbf{\Psi}$ that are full rank for every desired message $W_{k}$. The user can choose $\mathbf{\Psi}$ uniformly from this set. to choose $\bm{\alpha}=\left(\alpha_{1}^{(1)},\alpha_{2}^{(1)},\alpha_{1}^{(2)},\cdots,\alpha_{2}^{\binom{K}{2}}\right)$ is to choose \bm{}uniformlyfromallpossible$P(q,2 (K2))=q!(q-2 (K2))!$permutationsofthefieldelements.\par Regardingprivacy:Sincethemessagesymbolsandthecoefficientsarepermuteduniformly,andthedistributionofthequeriesforeverydatabaseisthesameirrespectiveofthedesiredmessage,theretrievalschemeisprivate.\par Regardingtheachievablerate:Theuserdownloads$N=(K2)$answerstrings,$L=K-1$ofwhicharedesiredsymbolsandaredecodable,thus,\begin{aligned} R_{\text{PIR}}=\frac{K-1}{\binom{K}{2}}=\frac{2}{K}\end{aligned}\par$

5.3.2 Further Example: Fully-Connected Graph with $K=4$

As a concrete example, we present the achievable scheme for $K=4$ for a fully-connected graph. Hence, we have $N=\binom{K}{2}=6$ databases and $R=K-1=3$. Thus, this is a $(4,3,2,6)$ system. We assume that $Z_{1}=\{W_{1},W_{2}\}$, $Z_{2}=\{W_{1},W_{3}\}$, $Z_{3}=\{W_{1},W_{4}\}$, $Z_{4}=\{W_{2},W_{3}\}$, $Z_{5}=\{W_{2},W_{4}\}$, and $Z_{6}=\{W_{3},W_{4}\}$. See Fig. 4 and Table 6 for the graph structure and the database contents. Assume for sake of simplicity that $\bm{\alpha}=(1,2,\cdots,12)\in\mathbb{F}_{13}^{12}$. The scheme works with $L=3$ bits. Denote the permuted message $W_{1}$ by $(a_{1},a_{2},a_{3})$, $W_{2}$ by $(b_{1},b_{2},b_{3})$, and so on. Assume without loss of generality that the user is interested in retrieving $W_{1}$. Therefore, the user downloads the following:

[TABLE]

This system of equations is full-rank, hence $W_{1}$ is decodable along with $b_{1},c_{1},d_{1}$. The rate of retrieval is $R_{\text{PIR}}=\frac{3}{6}=\frac{1}{2}$. To see privacy, let the desired message be $W_{2}$, in which case, the user downloads:

[TABLE]

This system of equations is full rank as well. Since, the queries have the same structure and the symbol indices are chosen randomly and privately, the scheme is private.

5.4 Discussion and Further Extensions: Extension to $M\geq 3$:

In this section, we show how the ideas of $M=2$ can be extended to $M\geq 3$. We discuss our additional ideas via the following example. In this example, we consider a $(K,R,M,N)=(6,2,3,4)$ storage system, whose structure is shown in Table 7. Note that, in this example, our graph formulation fails to represent the storage structure since $M>2$, however, we can use the graph structure in [55] as $R=2$ in this example. In the following, we only show an achievable scheme for this example without any claim of optimality. In addition to introducing dependency as in the previous schemes, we have a new insight in this case, which is to exploit processed side information.

Our scheme works with $L=18$ symbols from $\mathbb{F}_{2}$. We permute the indices of the messages uniformly, independently and privately at the user side. We denote the permuted message symbols of $W_{1},W_{2},\cdots,W_{6}$ by the vectors $(a_{1},\cdots,a_{L}),(b_{1},\cdots,b_{L}),\cdots,(f_{1},\cdots,f_{L})$.

The idea of our scheme is to extend the greedy algorithm of [9] to our setting (see Table 8). To that end, the user starts by downloading $2$ individual symbols from every message from every database in round 1. Hence, the user downloads $a_{1},a_{2}$, $b_{1},b_{2}$, $e_{1},e_{2}$ from database 1, $a_{3},a_{4}$, $d_{1},d_{2}$, $f_{1},f_{2}$ from database 2, and so on.

Returning to the scheme in [9], the user downloads 2-sums in round 2 from all databases. The undesired symbols in round 1 are exploited as side information in round 2. In our case, this is applicable in databases 1 and 2. Therefore, the user downloads the sums $a_{5}+b_{3}$, $a_{6}+b_{4}$, $a_{7}+e_{3}$, $a_{8}+e_{4}$ from database 1, and $a_{9}+d_{3}$, $a_{10}+d_{4}$, $a_{11}+f_{3}$, $a_{12}+f_{4}$. We complete round 2 by downloading $b_{5}+e_{5}$, $b_{6}+e_{6}$ from database 1, and $d_{5}+f_{5}$, $d_{6}+f_{6}$ from database 2 to satisfy the privacy constraint by downloading all combinations of the 2-sums.

In order to proceed with the achievable scheme, we need to generate side information in round 3, which consists of 3-sums. At this point, we note two issues: First, we did not exploit the side information generated from $W_{3}$ in round 1, as the messages $W_{1},W_{3}$ do not appear together at any database. Second, we note that the side information needed in round 3 does not appear directly in any other database unlike [9], i.e., in round 3, we need the side information to be of the form $b+e$ and $d+f$, which are not available in any other database. This motivates the use of processed side information, i.e., combine side information generated at multiple databases into a single side information that is usable at another database. There are two types of processing in this example, which are: combining double 2-sums and combining triple 2-sums.

First, for combining double 2-sums to get a single side information equation, we download $b_{7}+c_{7}$ from database 3 and $c_{7}+e_{7}$ from database 4. By adding the two 2-sums (modulo-2 addition), we get $b_{7}+e_{7}$ which can be used as side information in database 1. Similarly, we obtain the single side information $b_{8}+e_{8}$ by adding $b_{8}+c_{8}$ and $c_{8}+e_{8}$ and again use it in database 1. Next, we generate the side information needed in database 2. We combine $c_{9}+f_{7}$ from database 3 with $c_{9}+d_{7}$ from database 4 to get $d_{7}+f_{7}$, and combine $c_{5}+f_{8}$ from database 3 and $c_{5}+d_{8}$ from database 4 to get $d_{8}+f_{8}$.

Second, we can create extra side information by combining triple 2-sums. To see that, we can add $b_{5}+e_{5}$ from database 1, $b_{5}+f_{9}$ from database 3, and $d_{9}+e_{5}$ from database 4 to create the side information $d_{9}+f_{9}$, which can be exploited in database 2. Similarly, we can add $d_{5}+f_{5}$ from database 2, $b_{9}+f_{5}$ from database 3, and $d_{5}+e_{9}$ from database 4 to get $b_{9}+e_{9}$, which can be exploited in database 1.

To introduce dependency in databases 3 and 4 as in the previous schemes, we can download $b_{1}+c_{3}+f_{1}$, $b_{2}+c_{4}+f_{2}$, $c_{1}+d_{1}+e_{1}$, and $c_{2}+d_{2}+e_{2}$, which result from round 1.

Using this scheme, the user gets $18$ desired symbols out of total $60$ downloads, resulting in $R_{\text{PIR}}=\frac{18}{60}=\frac{3}{10}$. This outperforms the achievable scheme of [55], which achieves $\frac{1}{N}=\frac{1}{4}$.

We note that this is the first instance of using processed side information in PIR. Further, the presented scheme achieves the bound in Lemma 1 with equality, i.e., $H(A_{n}^{[m]}|{\mathcal{W}}\setminus\{W_{m}\},{\mathcal{Q}})=\frac{L}{R}=9$, which may be promising. However, a curious question remains which should be investigated further, which is: Can we compress the downloads in the same manner of the achievable scheme for the cyclic graphs by exploiting dependencies?

6 Conclusion

In this paper, we investigated the PIR problem from non-replicated and non-colluding databases. We studied the $(K,R,2,N)$ storage systems, where every database stores $M=2$ messages. This system is uniquely described by an $R$-regular graph. We proved a general upper bound, which depends on the spread of the graph. We derived the capacity of two classes of graphs, namely: cyclic graphs and fully-connected graphs. For these two classes of graphs, we proposed novel achievable schemes, whose retrieval rate matches the developed upper bound. Our results showed that non-replication significantly hurts the retrieval rate.