Multi-Server Private Information Retrieval with Coded Side Information

TL;DR

This paper investigates multi-server private information retrieval with coded side information, deriving capacity formulas for various scenarios and proposing schemes based on information-theoretic principles and existing PIR strategies.

Contribution

It provides the first capacity results for server-symmetric PIR-CSI with coded side information, extending single-server PIR-CSI schemes to multi-server settings.

Findings

Capacity when side information is independent of requested message

Capacity when side information is a function of requested message

New information-theoretic converse proofs and achievable schemes

Abstract

In this paper, we study the multi-server setting of the \emph{Private Information Retrieval with Coded Side Information (PIR-CSI)} problem. In this problem, there are $K$ messages replicated across $N$ servers, and there is a user who wishes to download one message from the servers without revealing any information to any server about the identity of the requested message. The user has a side information which is a linear combination of a subset of $M$ messages in the database. The parameter $M$ is known to all servers in advance, whereas the indices and the coefficients of the messages in the user's side information are unknown to any server \emph{a priori}. We focus on a class of PIR-CSI schemes, referred to as \emph{server-symmetric schemes}, in which the queries/answers to/from different servers are symmetric in structure. We define the \emph{rate} of a PIR-CSI scheme as its minimum download rate among all problem instances, and define the \emph{server-symmetric capacity} of the PIR-CSI problem as the supremum of rates over all server-symmetric PIR-CSI schemes. Our main results are as follows: (i) when the side information is not a function of the user's requested message, the capacity is given by ${(1+{1}/{N}+\dots+{1}/{N^{\left\lceil \frac{K}{M+1}\right\rceil -1}})^{-1}}$ for any ${1\leq M\leq K-1}$; and (ii) when the side information is a function of the user's requested message, the capacity is equal to $1$ for $M=2$ and $M=K$, and it is equal to ${N}/{(N+1)}$ for any ${3 \leq M \leq K-1}$. The converse proofs rely on new information-theoretic arguments, and the achievability schemes are inspired by our recently proposed scheme for single-server PIR-CSI as well as the Sun-Jafar scheme for multi-server PIR.

Tables

Table 1. TABLE I: The queries/answers of Sun-Jafar protocol for 2 2 2 servers and 3 3 3 messages X ^ 1 , X ^ 2 , X 3 ^ subscript ^ 𝑋 1 subscript ^ 𝑋 2 ^ subscript 𝑋 3 \hat{X}_{1},\hat{X}_{2},\hat{X_{3}} , when the user demands X ^ 1 subscript ^ 𝑋 1 \hat{X}_{1} [ 1 ] .

Server 1	Server 2
${\hat{X}}_{1,1},{\hat{X}}_{2,1},{\hat{X}}_{3,1}$	${\hat{X}}_{1,2},{\hat{X}}_{2,2},{\hat{X}}_{3,2}$
${\hat{X}}_{1,3}+{\hat{X}}_{2,2}$	${\hat{X}}_{1,5}+{\hat{X}}_{2,1}$
${\hat{X}}_{1,4}+{\hat{X}}_{3,2}$	${\hat{X}}_{1,6}+{\hat{X}}_{3,1}$
${\hat{X}}_{2,3}+{\hat{X}}_{3,3}$	${\hat{X}}_{2,4}+{\hat{X}}_{3,4}$
${\hat{X}}_{1,7}+{\hat{X}}_{2,4}+{\hat{X}}_{3,4}$	${\hat{X}}_{1,8}+{\hat{X}}_{2,3}+{\hat{X}}_{3,3}$

Table 2. TABLE II: The queries/answers of Sun-Jafar protocol for 2 2 2 servers and 2 2 2 messages X ^ 1 , X ^ 2 subscript ^ 𝑋 1 subscript ^ 𝑋 2 \hat{X}_{1},\hat{X}_{2} , when the user demands X ^ 2 subscript ^ 𝑋 2 \hat{X}_{2} [ 1 ] .

Server 1	Server 2
${\hat{X}}_{1,1}$	${\hat{X}}_{1,2}$
${\hat{X}}_{2,1}$	${\hat{X}}_{2,2}$
${\hat{X}}_{2,3}+{\hat{X}}_{1,2}$	${\hat{X}}_{2,4}+{\hat{X}}_{1,1}$

Equations

$$H({\mathbf{X}}_{\mathbf{W}}|{\mathbf{A}}^{[\mathbf{W},\mathbf{S},\mathbf{C}]},{\mathbf{Q}}^{[\mathbf{W},\mathbf{S},\mathbf{C}]},{\mathbf{Y}}^{[\mathbf{S},\mathbf{C}]},\mathbf{W},\mathbf{S},\mathbf{C})=0.$$

$$I(\mathbf{W};{\mathbf{Q}}_n^{[\mathbf{W},\mathbf{S},\mathbf{C}]},{\mathbf{A}}_n^{[\mathbf{W},\mathbf{S},\mathbf{C}]},{\mathbf{X}}_{[K]})=0.$$

$$({\mathbf{Q}}_n^{[W,S,C]},{\mathbf{A}}_n^{[W,S,C]},{\mathbf{X}}_{[K]})\sim ({\mathbf{Q}}_{n^{\prime }}^{[W,S,C]},{\mathbf{A}}_{n^{\prime }}^{[W,S,C]},{\mathbf{X}}_{[K]})$$

$${\mathrm{C}}_{W-\text{I}}={\left(1+\frac{1}{N}+\cdots +\frac{1}{N^{\lceil \frac{K}{M+1}\rceil -1}}\right)}^{-1}.$$

$${\mathrm{C}}_{W-\text{II}}=\{\begin{array}{ll}1,& M=2,K,\\ \frac{N}{N+1},& 3\le M\le K-1.\end{array}.$$

$$({\mathbf{Q}}_n^{[W,S,C]},{\mathbf{A}}_n^{[W,S,C]},{\mathbf{X}}_{[K]})\sim ({\mathbf{Q}}_n^{[W^{\prime },S^{\prime },C^{\prime }]},{\mathbf{A}}_n^{[W^{\prime },S^{\prime },C^{\prime }]},{\mathbf{X}}_{[K]})$$

$$D$$

$$=H({\mathbf{A}}^{[W,S,C]},{\mathbf{X}}_W|{\mathbf{Q}}^{[W,S,C]},\mathbf{Y})$$

$$=L+H({\mathbf{A}}^{[W,S,C]}|{\mathbf{Q}}^{[W,S,C]},{\mathbf{X}}_W,\mathbf{Y})$$

$$\ge L+H({\mathbf{A}}_1^{[W,S,C]}|{\mathbf{Q}}^{[W,S,C]},{\mathbf{X}}_W,\mathbf{Y})$$

$$=L+H({\mathbf{A}}_1^{[W,S,C]}|{\mathbf{Q}}_1^{[W,S,C]},{\mathbf{X}}_W,\mathbf{Y})$$

$$H({\mathbf{A}}_1^{[W,S,C]}|{\mathbf{Q}}_1^{[W,S,C]},{\mathbf{X}}_W,\mathbf{Y})=H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}_1^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y}).$$

$$D$$

$$=L+H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}_1^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y})$$

$$\ge L+H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y}).$$

$$D$$

$$\ge L+\frac{1}{N}H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y}).$$

$$H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y})$$

$$\ge H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{Y}}_1)$$

$$=H({\mathbf{A}}^{[W_1,S_1,C_1]},{\mathbf{X}}_{W_1}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{Y}}_1)$$

$$=L+H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)$$

$$\ge L+H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)$$

$$=L+H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}_1^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)$$

$$H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}_1^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)=H({\mathbf{A}}_1^{[W_2,S_2,C_2]}|{\mathbf{Q}}_1^{[W_2,S_2,C_2]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1).$$

$$H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y})$$

$$\ge L+H({\mathbf{A}}_1^{[W_1,S_1,C_1]}|{\mathbf{Q}}_1^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)$$

$$=L+H({\mathbf{A}}_1^{[W_2,S_2,C_2]}|{\mathbf{Q}}_1^{[W_2,S_2,C_2]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)$$

$$\ge L+H({\mathbf{A}}_1^{[W_2,S_2,C_2]}|{\mathbf{Q}}^{[W_2,S_2,C_2]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1).$$

$$H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y})$$

$$\ge L+H({\mathbf{A}}_n^{[W_2,S_2,C_2]}|{\mathbf{Q}}^{[W_2,S_2,C_2]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1)$$

$$H({\mathbf{A}}^{[W_1,S_1,C_1]}|{\mathbf{Q}}^{[W_1,S_1,C_1]},{\mathbf{X}}_W,\mathbf{Y})$$

$$\ge L+\frac{1}{N}H({\mathbf{A}}^{[W_2,S_2,C_2]}|{\mathbf{Q}}^{[W_2,S_2,C_2]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1).$$

$$D\ge L+\frac{L}{N}+\frac{1}{N^2}H({\mathbf{A}}^{[W_2,S_2,C_2]}|{\mathbf{Q}}^{[W_2,S_2,C_2]},{\mathbf{X}}_W,\mathbf{Y},{\mathbf{X}}_{W_1},{\mathbf{Y}}_1).$$

$$D$$

$$p(w,s,t)\triangleq \{\begin{array}{ll}\frac{14}{171},& w=0,s=3,t=0\\ \frac{60}{171},& w=0,s=2,t=1\\ \frac{36}{171},& w=0,s=1,t=2\\ \frac{4}{171},& w=0,s=0,t=3\\ \frac{21}{171},& w=1,s=2,t=0\\ \frac{30}{171},& w=1,s=1,t=1\\ \frac{6}{171},& w=1,s=0,t=2\end{array}$$

$${\tilde{I}}_1=\{2,4,1,3\},$$

$${\tilde{I}}_2=\{7,5,1,8\},$$

$${\tilde{I}}_3=\{2,9,6,5\},$$

$${\hat{X}}_1$$

Full text

We focus on a class of PIR-CSI schemes, referred to as server-symmetric schemes, in which the queries/answers to/from different servers are symmetric in structure. We define the rate of a PIR-CSI scheme as its minimum download rate among all problem instances, and define the server-symmetric capacity of the PIR-CSI problem as the supremum of rates over all server-symmetric PIR-CSI schemes. Our main results are as follows: (i) when the side information is not a function of the user’s requested message, the capacity is given by ${(1+{1}/{N}+\dots+{1}/{N^{\left\lceil\frac{K}{M+1}\right\rceil-1}})^{-1}}$ for any ${1\leq M\leq K-1}$; and (ii) when the side information is a function of the user’s requested message, the capacity is equal to $1$ for $M=2$ and $M=K$, and it is equal to ${N}/{(N+1)}$ for any ${3\leq M\leq K-1}$. The converse proofs rely on new information-theoretic arguments, and the achievability schemes are inspired by our recently proposed scheme for single-server PIR-CSI as well as the Sun-Jafar scheme for multi-server PIR.

I introduction

In the Private Information Retrieval (PIR) problem, there is a user who wishes to download a single or multiple messages belonging to a database with copies stored on a single or multiple servers, while protecting the identity of the demanded message(s) from the server(s) [1, 2]. This setup was recently extended to the settings wherein the user has some side information (unknown to the server(s)) about the messages in the database [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13].

For the PIR problem in the presence of side information, the savings in the download cost (i.e., the amount of information downloaded from the server(s)) depend on whether the user wants to achieve $W$-privacy (i.e., only the privacy of the requested message(s) needs to be protected), or $(W,S)$-privacy (i.e., the privacy of both the requested message(s) and the messages in the side information need to be protected).

The settings in which the side information is a subset of messages, referred to as PIR with Side Information (PIR-SI) when $W$-privacy is required, and PIR with Private Side Information (PIR-PSI) when $(W,S)$-privacy is required, were studied in [3, 4, 5, 10, 11, 12]. Recently, in [6] and [7], we studied the single-server case of a related problem wherein the side information is a linear combination of a subset of messages. This problem is referred to as PIR with Coded Side Information (PIR-CSI) when $W$-privacy is required, and PIR with Private Coded Side Information (PIR-PCSI) when $(W,S)$-privacy is required.

In this work, we consider the multi-server case of the PIR-CSI problem. In this problem, there is a database of $K$ messages replicated across $N$ servers, and there is a user who wants to download a single message from the servers, while revealing no information about the requested message to any server. We assume that the user has a linear combination of a subset of $M$ messages in the database as side information. Also, we assume that the side information size $M$ is known to all servers in advance, but no server knows the indices and the coefficients of the messages in the user’s side information in advance. These assumptions are motivated by several practical scenarios. For instance, the user could have obtained their side information from a trusted entity with limited knowledge about the database, or from the information locally stored in their cache.

I-A Main Contributions

We focus on a class of PIR-CSI schemes, which we refer to as server-symmetric, where the queries/answers to/from different servers are symmetric in structure. Such schemes are of particular interest in practice for their simple implementation. We define the rate of a PIR-CSI scheme as its minimum download rate (i.e., the inverse of the normalized download cost) amongst all problem instances, and define the server-symmetric capacity of the PIR-CSI problem as the supremum of rates over all server-symmetric PIR-CSI schemes.

For the settings in which the side information is not a function of the requested message, we show that the capacity is given by ${(1+{1}/{N}+\dots+{1}/{N^{\left\lceil\frac{K}{M+1}\right\rceil-1}})^{-1}}$ for any ${1\leq M\leq K-1}$. Interestingly, the capacity in this case is the same as that of multi-server PIR-SI under the server-symmetry assumption [10], where the user’s side information is comprised of $M$ uncoded messages. Moreover, comparing this result with the capacity of multi-server PIR without side information [1], one can see that having a coded side information (which is not a function of the demanded message) of size $M$ reduces the effective number of messages from $K$ to $\lceil K/(M+1)\rceil$.

For the settings wherein the side information is a function of the requested message, we show that the capacity is equal to $1$ for $M=2$ and $M=K$, and it is equal to $N/(N+1)$ for any $3\leq M\leq K-1$. Again, a comparison of these results with the capacity of multi-server PIR without side information reveals that having a coded side information (which is a function of the demanded message) of size $M\in\{2,K\}$ and $M\in\{3,\dots,K-1\}$ reduces the effective number of messages from $K$ to $1$ and $2$, respectively.

The converse proofs rely on new information-theoretic arguments, and the achievability schemes are inspired by our proposed scheme in [6] for single-server PIR-CSI as well as the Sun-Jafar scheme of [1] for multi-server PIR.

II Problem Formulation

Throughout, we denote random variables by bold-face letters and their realizations by regular letters.

Let $\mathbb{F}_{q}$ be a finite field of size $q$ for some prime $q$, and let $\mathbb{F}_{q}^{\times}\triangleq\mathbb{F}_{q}\setminus\{0\}$ be the multiplicative group of $\mathbb{F}_{q}$. Let $\mathbb{F}_{q^{m}}$ be an extension field of $\mathbb{F}_{q}$ for some integer $m\geq 1$, and let $L\triangleq m\log_{2}q$. For an integer $i\geq 1$, let $[i]\triangleq\{1,\dots,i\}$.

There are $N$ non-colluding servers, each storing an identical copy of $K$ messages $X_{1},\dots,X_{K}$ where $\mathbf{X}_{i}$ for $i\in[K]$ is independently and uniformly distributed over $\mathbb{F}_{q^{m}}$, i.e., ${H(\mathbf{X}_{i})=L}$ for all $i\in[K]$ and ${H(\mathbf{X}_{1},\dots,\mathbf{X}_{K})=KL}$. We denote ${X_{[K]}\triangleq\{X_{1},\dots,X_{K}\}}$ and ${\mathbf{X}_{[K]}\triangleq\{\mathbf{X}_{1},\dots,\mathbf{X}_{K}\}}$. There is a user who wishes to download a message $X_{W}$ for some ${W\in[K]}$ from the servers. We refer to $W$ as the demand index and $X_{W}$ as the demand. The user has a linear combination ${Y^{[S,C]}\triangleq\sum_{i\in S}c_{i}X_{i}}$ for some $S\triangleq\{i_{1},\dots,i_{M}\}\subseteq[K]$ and ${C\triangleq\{c_{i_{1}},\dots,c_{i_{M}}\}}$ with $c_{i}\in\mathbb{F}^{\times}_{q}$. We refer to $Y^{[S,C]}$ as the side information, $S$ as the side information index set, and $M$ as the side information size.

Let $\mathcal{S}$ be the set of all $M$-subsets of $[K]$, and let $\mathcal{C}$ be the set of all length-$M$ sequences (i.e., ordered sets of size $M$) with elements from $\mathbb{F}^{\times}_{q}$. We assume that $\mathbf{S}$ and $\mathbf{C}$ are uniformly distributed over $\mathcal{S}$ and $\mathcal{C}$, respectively. We consider two different models for the conditional distribution of $\mathbf{W}$ given $\mathbf{S}$, depending on whether $\mathbf{W}\not\in\mathbf{S}$ (Model I) or $\mathbf{W}\in\mathbf{S}$ (Model II). For Model I, we assume that $\mathbf{W}$ is distributed uniformly over $[K]\setminus S$ given that $\mathbf{S}=S$; and for Model II, we assume that $\mathbf{W}$ is distributed uniformly over $S$ given that $\mathbf{S}=S$. Note that Models I and II are well-defined for $1\leq M\leq K-1$ and $2\leq M\leq K$, respectively.

We assume that the servers initially know the side information size $M$, the considered model (i.e., whether $\mathbf{W}\not\in\mathbf{S}$ or $\mathbf{W}\in\mathbf{S}$), and the distributions of $\mathbf{S}$ and $\mathbf{C}$, and the conditional distribution of $\mathbf{W}$ given $\mathbf{S}$; whereas the servers have no information about the realizations $W,S,C$ a priori.

In order to retrieve $X_{W}$ for any given $W,S,C$, the user generates $N$ queries $Q_{n}^{[W,S,C]}$ for $n\in[N]$, and sends to the $n$th server the query $Q_{n}^{[W,S,C]}$, which is a (potentially stochastic) function of $W,S,C,Y^{[S,C]}$.

Upon receiving $Q_{n}^{[W,S,C]}$, the $n$th server responds to the user with an answer $A_{n}^{[W,S,C]}$, which is a (deterministic) function of the query $Q_{n}^{[W,S,C]}$ and the messages in $X_{[K]}$. In particular, ${(\mathbf{W},\mathbf{S},\mathbf{C})\rightarrow(\mathbf{Q}_{n}^{[\mathbf{W},\mathbf{S},\mathbf{C}]},\mathbf{X}_{[K]})\rightarrow\mathbf{A}_{n}^{[\mathbf{W},\mathbf{S},\mathbf{C}]}}$ is a Markov chain, and ${H(\mathbf{A}_{n}^{[\mathbf{W},\mathbf{S},\mathbf{C}]}|\mathbf{Q}_{n}^{[\mathbf{W},\mathbf{S},\mathbf{C}]},\mathbf{X}_{[K]})=0}$.

For the simplicity, we denote ${Q}^{[W,S,C]}\triangleq\{Q_{n}^{[W,S,C]}\}_{n\in[N]}$ and $A^{[W,S,C]}\triangleq\{A_{n}^{[W,S,C]}\}_{n\in[N]}$.

Recoverability condition: The user must be able to retrieve the demand $X_{W}$ from the answers $A^{[W,S,C]}$ along with the side information $Y^{[S,C]}$, i.e.,

[TABLE]

$\bm{W}$-privacy condition: For each $n\in[N]$, the query $Q^{[W,S,C]}_{n}$ must protect the privacy of the user’s demand index $W$ from the $n$th server, i.e., for all $n\in[N]$,

[TABLE]

The problem is to design a protocol for generating queries $Q^{[W,S,C]}_{n}$ and their corresponding answers $A^{[W,S,C]}_{n}$ (for any given $W,S,C$) that satisfy the $W$-privacy and recoverability conditions. We refer to this problem as the Private Information Retrieval with Coded Side Information (PIR-CSI). In particular, we refer to this problem under Model I (or Model II) as the PIR-CSI–I (or PIR-CSI–II) problem.

We focus on server-symmetric PIR-CSI protocols in which the queries/answers to/from different servers are symmetric in structure. In particular, we say that a PIR-CSI–I (or respectively, PIR-CSI–II) protocol is server-symmetric if

[TABLE]

holds for all $n,n^{\prime}\in[N]$ and for any $W\in[K],S\in\mathcal{S},C\in\mathcal{C}$ such that ${W\not\in S}$ (or respectively, ${W\in S}$), where the relation $\mathbf{U}\sim\mathbf{V}$ means that $\mathbf{U}$ and $\mathbf{V}$ have identical distributions. It should be noted that most of the existing multi-server PIR schemes (with information-theoretic guarantees) are server-symmetric. Server-symmetric schemes are particularly of interest because the symmetry of queries/answers across the servers makes the implementation quite simple in practice.

We define the rate of a PIR-CSI–I (or PIR-CSI–II) protocol as the ratio of the entropy of a message, i.e., $L$, to the maximum total entropy of the answers from all servers, i.e., ${D\triangleq\max_{\{W,S,C\}}H(\mathbf{A}^{[W,S,C]})}$, where the maximization is over all $W,S,C$ such that $W\not\in S$ (or $W\in S$). We also define the server-symmetric capacity of the PIR-CSI–I (or PIR-CSI–II) problem as the supremum of rates over all server-symmetric PIR-CSI–I (or PIR-CSI–II) protocols.

Our goal is to characterize the server-symmetric capacity of the PIR-CSI–I and PIR-CSI–II problems, and to design server-symmetric protocols that are capacity-achieving.

III Main Results

In this section, we present our main results. Theorems 1 and 2 characterize the server-symmetric capacity of the PIR-CSI–I and PIR-CSI–II problems, respectively.

Theorem 1**.**

The server-symmetric capacity of PIR-CSI–I problem with $N$ servers, $K$ messages, and side information size $0\leq M\leq K-1$ is given by

[TABLE]

This result is interesting because it shows that the capacity in this case is the same as the capacity of multi-server PIR-SI [10, 3] where $M$ uncoded messages are available at the user as side information. That is, knowing only one linear combination of $M$ messages as side information would be as effective as knowing $M$ (uncoded) messages separately.

Theorem 2**.**

The server-symmetric capacity of PIR-CSI–II problem with $N$ servers, $K$ messages, and side information size $2\leq M\leq K$ is given by

[TABLE]

This result shows that for the two corner cases of $M=2$ and $M=K$, the cost of retrieving one message privately is no more than that of downloading the message directly. For the cases of $3\leq M\leq K-1$, full privacy can be achieved for only an additional download cost of $L/N$.

IV The  PIR-CSI–I  Problem

In this section, we give the proof of converse and the achievability proof of Theorem 1.

The following lemma renders a necessary condition for any server-symmetric PIR-CSI–I (or PIR-CSI–II) protocol to satisfy the $W$-privacy condition.

Lemma 1**.**

Any server-symmetric PIR-CSI–I (or PIR-CSI–II) protocol satisfies the following condition: for any ${W,W^{\prime}\in[K]},{S\in\mathcal{S}},{C\in\mathcal{C}}$ with ${W\not\in S}$ (or ${W\in S}$), there exist ${S^{\prime}\in\mathcal{S}},{C^{\prime}\in\mathcal{C}}$ with ${W^{\prime}\not\in S^{\prime}}$ (or ${W^{\prime}\in S^{\prime}}$), such that

[TABLE]

holds for all $n\in[N]$.

• Proof:

The proof is by the way of contradiction, and based on the definitions of $W$-privacy and server-symmetry. To protect the user’s privacy, for different demands, the strategies (queries and answers) must be indistinguishable (identically distributed) from the perspective of each server. In particular, for each $n\in[N]$, it must hold that for any ${W\in[K]},{S\in\mathcal{S}},{C\in\mathcal{C}}$ with ${W\not\in S}$ (or ${W\in S}$), and any candidate demand ${W^{\prime}\in[K]}$, there exist ${S_{n}\in\mathcal{S},C_{n}\in\mathcal{C}}$ with ${W^{\prime}\not\in S_{n}}$ (or ${W^{\prime}\in S_{n}}$) that satisfy the condition of the lemma for the server $n$. Otherwise, if there do not exist such ${S_{n}\in\mathcal{S},C_{n}\in\mathcal{C}}$ that satisfy the condition of the lemma for some server $n$, then the privacy condition is violated. Moreover, by the server-symmetry assumption, for any candidate demand ${W^{\prime}\in[K]}$, there must exist ${S^{\prime}\in\mathcal{S},C^{\prime}\in\mathcal{C}}$ (independent of $n$) with ${W^{\prime}\not\in S^{\prime}}$ (or $W^{\prime}\in S^{\prime}$) that make the strategies indistinguishable from the perspective of each server $n\in[N]$. That is, there must exist $S^{\prime}\in\mathcal{S},C^{\prime}\in\mathcal{C}$ with $W^{\prime}\not\in S^{\prime}$ (or $W^{\prime}\in S^{\prime}$) that satisfy the condition of the lemma for all servers. Otherwise, the server-symmetry assumption is violated. ∎

IV-A Converse Proof for Theorem 1

Suppose that the user wishes to retrieve $X_{W}$ for a given $W\in[K]$, and has a side information ${Y\triangleq Y^{[S,C]}}$ for given $S\in\mathcal{S},C\in\mathcal{C}$ such that $W\not\in S$. The user sends to the $n$th server a query $Q_{n}^{[W,S,C]}$, and the $n$th server responds to the user with an answer $A_{n}^{[W,S,C]}$. We need to show that the maximum total entropy of the answers from all servers (over all $W,S,C$), denoted by $D$, is lower bounded by ${(1+{1}/{N}+\dots+{1}/{N^{\lceil\frac{K}{M+1}\rceil-1}})L}$.

The proof proceeds as follows:

[TABLE]

where (1) follows from ${H(\mathbf{X}_{W}|{\mathbf{A}^{[W,S,C]}},{\mathbf{Q}^{[W,S,C]}},\mathbf{Y})=0}$ (by the recoverability condition); (2) holds since $\mathbf{X}_{W}$ is independent of $({\mathbf{Q}^{[W,S,C]}},\mathbf{Y})$, and $H(\mathbf{X}_{W}|{\mathbf{Q}^{[W,S,C]}},\mathbf{Y})=H(\mathbf{X}_{W})=L$; and (3) holds because $\mathbf{A}_{1}^{[W,S,C]}$ only depends on ${({\mathbf{Q}_{1}^{[W,S,C]}},\mathbf{X}_{[K]})}$, and is conditionally independent of ${\mathbf{Q}_{n}^{[W,S,C]}}$ for all $n\neq 1$, given $({\mathbf{Q}_{1}^{[W,S,C]}},\mathbf{X}_{W},\mathbf{Y})$.

We will consider the following two cases separately: (i) ${\lceil K/(M+1)\rceil=1}$ (i.e., $K=M+1$), and (ii) ${\lceil K/(M+1)\rceil>1}$ (i.e., $K>M+1$). In the case (i), we need to show that $D$ is lower bounded by $L$. Since $H({\mathbf{A}_{1}^{[W,S,C]}}|{\mathbf{Q}_{1}^{[W,S,C]}},\mathbf{X}_{W},\mathbf{Y})\geq 0$, then $D\geq L$ (by (3)).

In the case (ii), in order to continue lower bounding (3), we arbitrarily choose a message, say $X_{W_{1}}$, such that $W_{1}\not\in W\cup S$. (Note that such $W_{1}$ exists because $|W\cup S|=M+1<K$.) Based on Lemma 1, there exist $S_{1}\in\mathcal{S}$, $C_{1}\in\mathcal{C}$ with $W_{1}\not\in S_{1}$, and accordingly ${Y_{1}\triangleq Y^{[S_{1},C_{1}]}}$, such that

[TABLE]

Then, we can write

[TABLE]

Similarly, by the server-symmetry assumption we have

[TABLE]

for all $n\in[N]$. Combining all of these inequalities, we get

[TABLE]

To further lower bound (4), we can write

[TABLE]

where (5) holds since $X_{W_{1}}$ is recoverable from ${A^{[W_{1},S_{1},C_{1}]},Q^{[W_{1},S_{1},C_{1}]},Y_{1},W_{1},S_{1},C_{1}}$; and (6) holds because $\mathbf{X}_{W_{1}}$ is independent of $({\mathbf{Q}^{[W_{1},S_{1},C_{1}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{1})$.

We consider two cases separately: (ii.1) $\lceil K/(M+1)\rceil=2$, and (ii.2) $\lceil K/(M+1)\rceil>2$. In the case (ii.1), from (4) and (7) it follows that $D\geq L+L/N$.

In the case (ii.2), to continue lower bounding (7), we pick a message, say ${X_{W_{2}}}$, such that $W_{2}\not\in W\cup S\cup W_{1}\cup S_{1}$. (Note that such $W_{2}$ exists since $|W\cup S\cup W_{1}\cup S_{1}|\leq 2(M+1)<K$.) According to Lemma 1, there exist $S_{2}\in\mathcal{S}$, $C_{2}\in\mathcal{C}$ with ${W_{2}\not\in S_{2}}$, and accordingly, ${Y_{2}=Y^{[S_{2},C_{2}]}}$, such that

[TABLE]

Thus,

[TABLE]

Similarly, by the server-symmetry assumption, we have

[TABLE]

for all $n\in[N]$. Combining all of these inequalities, we get

[TABLE]

Putting (4) and (8) together, we get

[TABLE]

By recursively choosing the messages $X_{W_{i}}$ (similarly as $X_{W_{1}}$ and $X_{W_{2}}$) for $i\in\{3,\dots,{\lceil K/(M+1)\rceil}\}$ and using the same lower bounding technique, it can be shown that

[TABLE]

IV-B Achievability Proof for Theorem 1

In this section, we propose a server-symmetric PIR-CSI–I protocol that achieves a rate equal to ${\mathrm{C}_{W-\text{\it I}}}$. The proposed protocol employs the Randomized Partitioning (RP) scheme which we proposed in [6] for single-server PIR-CSI (under Model I) as well as the Sun-Jafar scheme of [1] for multi-server PIR.

We assume that each message consists of ${N^{\lceil K/(M+1)\rceil}}$ symbols over $\mathbb{F}_{q}$.

Multi-Server PIR-CSI–I Protocol:

Step 1: The user utilizes the RP scheme of [6] to construct $r\triangleq\lceil\frac{K}{M+1}\rceil$ sequences $I_{1},\dots,I_{r}$ from indices in $[K]$, each of length $M+1$, and $r$ sequences $I^{\prime}_{1},\dots,I^{\prime}_{r}$ with elements in $\mathbb{F}^{\times}_{q}$, each of length $M+1$. In particular, $I_{1}=\{W,S\}$ and $I^{\prime}_{1}=\{c,C\}$ where $C$ is the sequence of coefficients in the user’s side information $Y^{[S,C]}$, and $c$ is randomly chosen from $\mathbb{F}^{\times}_{q}$. (For more details, see [6, Section IV-B].)

Step 2: The user then creates $\tilde{I}_{i}$ and $\tilde{I}^{\prime}_{i}$ for each $i\in[r]$ by reordering the elements of both $I_{i}$ and $I^{\prime}_{i}$ with the same randomly picked permutation $\pi_{i}:[M+1]\rightarrow[M+1]$, and constructs $I^{*}_{i}=(\tilde{I}_{i},\tilde{I}^{\prime}_{i})$. Then, the user sends $\{I^{*}_{\sigma(i)}\}_{i\in[r]}$ to all servers, for a randomly chosen permutation ${\sigma:[r]\rightarrow[r]}$. Note that in the RP scheme, $\{I_{i}\}_{i\in[r]}$ and $\{I^{\prime}_{i}\}_{i\in[r]}$ are designed in such a way that given $\{I^{*}_{\sigma(1)},\dots,I^{*}_{\sigma(r)}\}$, any index in $[K]$ is equally likely to be the user’s demand index.

Step 3: Using $I^{*}_{\sigma(i)}=(\tilde{I}_{\sigma(i)},\tilde{I}^{\prime}_{\sigma(i)})$ for all $i\in[r]$, the user and all the servers form $r$ super-messages ${\hat{X}_{1},\dots,\hat{X}_{r}}$ such that $\hat{X}_{i}=\sum_{j=1}^{M+1}c_{i_{j}}X_{i_{j}}$ for all $i\in[r]$, where ${\tilde{I}_{\sigma(i)}=\{i_{1},\dots,i_{M+1}\}}$ and ${\tilde{I}^{\prime}_{\sigma(i)}=\{c_{i_{1}},\dots,c_{i_{M+1}}\}}$.

Step 4: The user and the servers then utilize the Sun-Jafar protocol with $r$ super-messages $\hat{X}_{1},\dots,\hat{X}_{r}$ in such a way that the user can privately download the super-message $\hat{X}_{\sigma^{-1}(1)}=cX_{W}+Y^{[S,C]}$; and subsequently, subtracting off $Y^{[S,C]}$ from $\hat{X}_{\sigma^{-1}(1)}$, the user recovers $X_{W}$.

Example 1. Assume that there are ${N=2}$ servers, ${K=9}$ messages from $\mathbb{F}_{3^{8}}$ (i.e., each message has $8$ symbols over $\mathbb{F}_{3}$), and $M=3$. Suppose that the user demands the message $X_{1}$ and has a side information $X_{2}+2X_{3}+X_{4}$. Note that for this example, $W=1$, $S=\{2,3,4\}$, and $C=\{1,2,1\}$.

First, the user labels $r=\lceil\frac{K}{M+1}\rceil=3$ sequences as $I_{1},I_{2},I_{3}$, each of length $M+1=4$. For creating these sequences, the user needs to have $12$ indices, but at the beginning the user has $9$ indices. For selecting the remaining $3$ required indices, following the RP scheme of [6], the user selects $w\in\{0,1\}$, $s\in\{0,1,2,3\}$, and $t\in\{0,1,\dots,5\}$ randomly chosen indices from $W=\{1\}$, $S=\{2,3,4\}$, and $T=\{5,6,7,8,9\}$, respectively, according to a carefully designed probability distribution (ensuring $W$-privacy of the RP scheme) on all $(w,s,t)$ such that $w+s+t=3$. For this example, the probability distribution is given by

[TABLE]

Suppose that the user chooses ${w=1},{s=1},{t=1}$, and selects the $3$ indices $\{1,2,5\}$. Following the RP protocol, the user forms the sequence $I_{1}=\{W,S\}=\{1,2,3,4\}$. In the remaining $8$ indices, there is one repetitive index, $5$. For forming the other two sequences, $I_{2}$ and $I_{3}$, the user places the repetitive index $5$ into both $I_{2}$ and $I_{3}$. Next, the user randomly partitions the remaining $6$ indices, $\{1,2,6,7,8,9\}$, into $I_{2}$ and $I_{3}$. For this example, suppose that ${I_{2}=\{5,1,7,8\}}$ and ${I_{3}=\{5,2,6,9\}}$.

The user then labels ${r=3}$ sequences as $I^{\prime}_{1},I^{\prime}_{2},I^{\prime}_{3}$, each of length $4$. For this example, suppose that the user creates ${I^{\prime}_{1}=I^{\prime}_{2}=I^{\prime}_{3}=\{1,1,2,1\}}$. Then, the user randomly reorders the elements of $I_{i}$ and $I^{\prime}_{i}$, and constructs

[TABLE]

Next, the user sends a uniform random permutation of ${\{I^{*}_{1},I^{*}_{2},I^{*}_{3}\}}$, say ${\{I^{*}_{1},I^{*}_{3},I^{*}_{2}\}}$, to both servers, where ${I^{*}_{i}=(\tilde{I}_{i},\tilde{I}^{\prime}_{i})}$.

The user and the servers then form three super-messages as follows:

[TABLE]

Finally, the user and the servers run the Sun-Jafar protocol as follows for the three super-messages $\hat{X}_{1},\hat{X}_{2},\hat{X}_{3}$ in such a way that the user can privately download $\hat{X}_{1}$. For each $\hat{X}_{i}$, let $[\hat{X}_{i,1},\dots,\hat{X}_{i,8}]$ be an independent and uniform random permutation of the $8$ symbols (over $\mathbb{F}_{3}$) of $\hat{X}_{i}$. The user requests $7$ symbols from the first server and $7$ symbols from the second server as listed in Table I [1], where the requested symbols are carefully designed linear combinations of symbols $\{\hat{X}_{i,j}\}_{i\in[3],j\in[8]}$. From the servers’ answers, the user first obtains the super-message $\hat{X}_{1}=X_{2}+X_{4}+X_{1}+2X_{3}$, and then recovers the desired message $X_{1}$ by subtracting off the side information $X_{2}+2X_{3}+X_{4}$. For this example, the proposed protocol requires to download a total of $14$ symbols (over $\mathbb{F}_{3}$), achieving the rate of $8/14=4/7$.

Lemma 2**.**

The Multi-Server PIR-CSI–I protocol is a server-symmetric protocol that satisfies the recoverability and the $W$-privacy conditions, and achieves the rate ${(1+{1}/{N}+\dots+{1}/{N^{\lceil\frac{K}{M+1}\rceil-1}})^{-1}}$.

• Proof:

The Multi-Server PIR-CSI–I protocol is a server-symmetric protocol since as explained in Step $4$ of this protocol, it builds upon the Sun-Jafar protocol that enforces symmetry across servers [1].

Since $\mathbf{X}_{1},\dots,\mathbf{X}_{K}$ are uniformly and independently distributed over $\mathbb{F}_{q^{m}}$, and $\hat{X}_{1},\dots,\hat{X}_{r}$ are linearly independent combinations of $X_{1},\dots,X_{K}$ over $\mathbb{F}_{q}$, then $\hat{\mathbf{X}}_{1},\dots,\hat{\mathbf{X}}_{r}$ are uniformly and independently distributed over $\mathbb{F}_{q^{m}}$. That is, ${H(\hat{\mathbf{X}}_{i})=m\log_{2}q=L}$ for all $i\in[r]$. Hence, the proposed protocol achieves the same rate as the Sun-Jafar protocol for $N$ servers and $\lceil{K}/{(M+1)}\rceil$ identically and independently distributed messages, i.e., the rate ${(1+{1}/{N}+\dots+{1}/{N^{\lceil\frac{K}{M+1}\rceil-1}})^{-1}}$ (see [1, Theorem 1]).

From the step $4$ of the proposed protocol, it can be easily confirmed that the recoverability condition is satisfied. The proof of $W$-privacy is as follows. By the design of the protocol, all servers are fully aware of how the super-messages $\hat{X}_{1},\dots,\hat{X}_{r}$ have been formed. From the perspective of each server, according to the RP protocol, each super-message $\hat{X}_{i}$ has a certain probability to be the super-message needed by the user, i.e., the super-message from which the user can recover the demanded message. On the other hand, the Sun-Jafar protocol guarantees that given their query, no server can obtain any information about which super-message is being requested by the user. That is, given their query, from each server’s perspective the probability of any super-message $\hat{X}_{i}$ to be the super-message needed by the user remains the same as that in the RP protocol. Moreover, the $W$-privacy of the RP protocol ensures that given their query, each server finds every message in $X_{[K]}$ equally likely to be the user’s demand. This proves the $W$-privacy of the proposed protocol. ∎

V The  PIR-CSI–II  Problem

In this section, we give the proof of converse and the achievability proof of Theorem 2.

V-A Converse Proof for Theorem 2

Suppose that the user wishes to retrieve $X_{W}$ for a given $W\in[K]$, and has a side information ${Y\triangleq Y^{[S,C]}}$ for given $S\in\mathcal{S},C\in\mathcal{C}$ such that $W\in S$. We need to show that the maximum total entropy of the answers from all servers (over all $W,S,C$), denoted by $D$, is lower bounded by $L$ when $M=2$ or $M=K$, and is lower bounded by $(1+1/N)L$ when $3\leq M\leq K-1$.

The proof proceeds as follows:

[TABLE]

where (9) holds because of the recoverability condition, and (10) holds because $\mathbf{X}_{W}$ is independent of $({\mathbf{Q}^{[W,S,C]}},\mathbf{Y})$. By the non-negativity of the entropy, (10) yields $D\geq L$, which completes the proof for the cases of $M=2$ and $M=K$. For the cases of ${3\leq M\leq K-1}$, we continue lower bounding (10) as follows:

[TABLE]

where (11) holds because given $({\mathbf{Q}_{1}^{[W,S,C]}},\mathbf{X}_{W},\mathbf{Y})$, ${\mathbf{A}_{1}^{[W,S,C]}}$ is conditionally independent of $\mathbf{Q}_{n}^{[W,S,C]}$ for all ${n\neq 1}$. In order to continue lower bounding (11), we choose an arbitrary message, say $X_{W_{1}}$, such that $W_{1}\in S\setminus W$. According to Lemma 1, there exist $S_{1}\in\mathcal{S}$, $C_{1}\in\mathcal{C}$ with $W_{1}\in S_{1}$, and accordingly $Y_{1}\triangleq Y^{[S_{1},C_{1}]}$, such that

[TABLE]

Rewriting (11),

[TABLE]

Similarly, by the server-symmetry assumption, we can write

[TABLE]

for all $n\in[N]$. Combining all of these inequalities, we get

[TABLE]

To further lower bound $H({\mathbf{A}^{[W_{1},S_{1},C_{1}]}}|{\mathbf{Q}^{[W_{1},S_{1},C_{1}]}},\mathbf{X}_{W},\mathbf{Y})$, we can write

[TABLE]

where (13) follows from the fact that $X_{W_{1}}$ is recoverable from $A^{[W_{1},S_{1},C_{1}]},Q^{[W_{1},S_{1},C_{1}]},Y_{1},W_{1},S_{1},C_{1}$.

We will consider two cases as follows separately: (i) $\mathbf{X}_{W_{1}}$ is independent of $({\mathbf{Q}^{[W_{1},S_{1},C_{1}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{1})$, and (ii) $\mathbf{X}_{W_{1}}$ and $({\mathbf{Q}^{[W_{1},S_{1},C_{1}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{1})$ are not independent.

In the case (i), $\mathbf{X}_{W_{1}}$ and $({\mathbf{Q}^{[W_{1},S_{1},C_{1}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{1})$ are independent. That is, $H(\mathbf{X}_{W_{1}}|\mathbf{Q}^{[W_{1},S_{1},C_{1}]},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{1})=H(\mathbf{X}_{W_{1}})=L$. Then, we can continue lower bounding (13) as follows:

[TABLE]

By (12) and (14), $D\geq L+L/N$, as was to be shown.

In the case (ii), due to the dependence of $\mathbf{X}_{W_{1}}$ and $({\mathbf{Q}^{[W_{1},S_{1},C_{1}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{1})$ and the linearity of $X_{W},Y,X_{W_{1}},Y_{1}$, it must hold that ${Y=c_{W}X_{W}+c_{W_{1}}X_{W_{1}}+Z}$ and ${Y_{1}=c^{\prime}_{W}X_{W}+c^{\prime}_{W_{1}}X_{W_{1}}+c^{\prime}Z}$ for some ${c^{\prime}_{W},c^{\prime}_{W_{1}},c^{\prime}}\in\mathbb{F}^{\times}_{q}$, where $Z=\sum_{i\in S\setminus\{W,W_{1}\}}c_{i}X_{i}$, and ${c_{i}}$’s are the elements in the sequence $C$ (i.e., the coefficients of the messages in the side information $Y$). We proceed by lower bounding (11), when ${W,S,C,Y}$ are replaced by ${W_{1},S_{1},C_{1},Y_{1}}$. To this end, we choose an arbitrary message, say $X_{W_{2}}$, such that ${{W_{2}}\not\in S}$. Based on Lemma 1, there exist ${S_{2}\in\mathcal{S}}$, ${C_{2}\in\mathcal{C}}$ with $W_{2}\in S_{2}$, and accordingly ${Y_{2}\triangleq Y^{[S_{2},C_{2}]}}$, such that

[TABLE]

We consider two cases as follows separately: (ii.1) $\mathbf{X}_{W_{2}}$ is independent of $({\mathbf{Q}^{[W_{2},S_{2},C_{2}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{2})$, and (ii.2) $\mathbf{X}_{W_{2}}$ depends on $({\mathbf{Q}^{[W_{2},S_{2},C_{2}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{2})$. In the case (ii.1), the proof follows the exact same line as in the proof of case (i), and hence not repeated.

In the case (ii.2), one can readily verify that $X_{W_{2}}$ must be recoverable from ${Q^{[W_{2},S_{2},C_{2}]},X_{W},Y,Y_{2}}$ since $\mathbf{X}_{W_{2}}$ depends on $({\mathbf{Q}^{[W_{2},S_{2},C_{2}]}},\mathbf{X}_{W},\mathbf{Y},\mathbf{Y}_{2})$. As a result, ${Y_{2}=c^{\prime\prime}_{W_{2}}X_{W_{2}}+c^{\prime\prime}(c_{W_{1}}X_{W_{1}}+Z)}$ for some $c^{\prime\prime}_{W_{2}},c^{\prime\prime}\in\mathbb{F}^{\times}_{q}$. It is also easy to verify that $X_{W_{2}}$ is not recoverable from $X_{W_{1}},Y_{1},Y_{2}$, and $\mathbf{X}_{W_{2}}$ is independent of $(\mathbf{X}_{W_{1}},\mathbf{Y}_{1},\mathbf{Y}_{2})$. On the other hand, we have

[TABLE]

where (15) follows from (11) that holds for $W_{1},S_{1},C_{1}$ (and $Y_{1}$), because $D$ is defined as the maximum total entropy of answers from all servers over all ${W^{\prime}\in[K]},{S^{\prime}\in\mathcal{S}},{C^{\prime}\in\mathcal{C}}$ such that ${W^{\prime}\in S^{\prime}}$. Similarly as before, by the server-symmetry assumption it can also be shown that

[TABLE]

Since $\mathbf{X}_{W_{2}}$ is independent of $(\mathbf{Q}^{[W_{2},S_{2},C_{2}]},\mathbf{X}_{W_{1}},\mathbf{Y}_{1},\mathbf{Y}_{2})$, and $X_{W_{2}}$ is recoverable from $A^{[W_{2},S_{2},C_{2}]}$, $Q^{[W_{2},S_{2},C_{2}]}$, and $Y_{2}$, a simple application of the chain rule of entropy yields

[TABLE]

By (16) and (17), $D\geq L+L/N$, as was to be shown.

V-B Achievability Proof for Theorem 2

In this section, we propose a server-symmetric PIR-CSI–II protocol for each $2\leq M\leq K-1$ that achieves a rate equal to ${\mathrm{C}_{W-\text{\it II}}}$ for the corresponding $M$.

For $3\leq M\leq K-1$, we assume that each message consists of ${N^{2}}$ symbols over $\mathbb{F}_{q}$. For $M=2$ and $M=K$, each message can be as short as one $\mathbb{F}_{q}$-symbol.

Multi-Server PIR-CSI–II Protocols:

Case of $M=2$: The user randomly selects one of the two indices, say $i$, in $S$ as follows: $i=W$ with probability $1/K$, and $i=S\setminus W$ with probability $(K-1)/K$. Then, the user requests the message $X_{i}$ from a randomly chosen server.

Case of $3\leq M\leq K-1$: The proposed scheme for this case consists of four steps. In the first step, given $W,S,C$ (and $Y^{[S,C]}$), the user utilizes the scheme of [6] for single-server PIR-CSI (under Model II), which we refer to as Modified Randomized Partitioning (MRP), to construct two sequences $I_{1},I_{2}$ of indices in $[K]$, each of length $M-1$, and two sequences $I^{\prime}_{1},I^{\prime}_{2}$ of elements in $\mathbb{F}^{\times}_{q}$, each of length $M-1$. (For details, see [6, Section V-B].) Next, the user and the servers follow the steps 2-4 of the Multi-Server PIR-CSI–I protocol.

Case of $M=K$: Assume, w.l.o.g., that $W={1}$. The user randomly chooses an element $c^{\prime}_{1}$ from $\mathbb{F}^{\times}_{q}\setminus\{c_{1}\}$, where $c_{1}$ is the coefficient of $X_{1}$ in the side information $Y^{[S,C]}$. Then, the user requests the linear combination $c^{\prime}_{1}X_{1}+c_{2}X_{2}+\dots+c_{K}X_{K}$ from a randomly chosen server, where $c_{i}$ is the coefficient of $X_{i}$ in the side information $Y^{[S,C]}$.

Example 2. (Case of ${3\leq M\leq\frac{K}{2}+1}$) Assume that there are ${N=2}$ servers, ${K=10}$ messages from $\mathbb{F}_{3^{4}}$ (i.e., each message has $4$ symbols over $\mathbb{F}_{3}$), and ${M=4}$. Suppose that the user demands the message $X_{1}$ and has a coded side information $X_{1}+X_{2}+2X_{3}+X_{4}$. Note that, for this example, $W=1$, ${S=\{1,2,3,4\}}$, and ${C=\{1,1,2,1\}}$.

First, the user labels $2$ sequences as $I_{1},I_{2}$, each of length $M-1=3$. For creating these sequences, the user selects $w\in\{0,1\}$ and $t\in\{2,3\}$ randomly chosen indices from $W=\{1\}$ and $T=\{5,6,7,8,9,10\}$, respectively, according to a carefully designed probability distribution (ensuring $W$-privacy of the MRP scheme) on all $(w,t)$ such that $w+t=3$. For this example, the probability distribution is given by

[TABLE]

Suppose that the user chooses ${w=1},{t=2}$, and selects the $3$ indices $\{1,6,10\}$. Following the MRP protocol, the user forms the sequence $I_{1}=S\setminus W=\{2,3,4\}$ and ${I_{2}=\{1,6,10\}}$.

The user then labels $2$ sequences as $I^{\prime}_{1},I^{\prime}_{2}$, each of length $3$. For this example, suppose that the user creates ${I^{\prime}_{1}=\{1,2,1\},I^{\prime}_{2}=\{1,1,1\}}$. Then, the user randomly reorders the elements of $I_{i}$ and $I^{\prime}_{i}$, and constructs

[TABLE]

Next, the user sends a uniform random permutation of $\{I^{*}_{1},I^{*}_{2}\}$, say $\{I^{*}_{2},I^{*}_{1}\}$, to both servers, where $I^{*}_{i}=(\tilde{I}_{i},\tilde{I}^{\prime}_{i})$. The user and the servers form two super-messages as follows:

[TABLE]

Finally, the user and the servers run the Sun-Jafar protocol as follows for the two super-messages $\hat{X}_{1},\hat{X}_{2}$ in such a way that the user can privately download $\hat{X}_{2}$. For each $\hat{X}_{i}$, let $[\hat{X}_{i,1},\dots,\hat{X}_{i,4}]$ be an independent and uniform random permutation of the $4$ symbols (over $\mathbb{F}_{3}$) of $\hat{X}_{i}$. The user requests $3$ symbols from the first server and $3$ symbols from the second server as listed in Table II [1], where the requested symbols are carefully designed linear combinations of symbols $\{\hat{X}_{i,j}\}_{i\in[2],j\in[4]}$. From the servers’ answers, the user first obtains the super-message $\hat{X}_{2}=2X_{3}+X_{2}+X_{4}$, and then recovers the desired message $X_{1}$ by subtracting off $\hat{X}_{2}$ from the side information $X_{1}+X_{2}+2X_{3}+X_{4}$. For this example, the proposed protocol requires to download a total of $6$ symbols (over $\mathbb{F}_{3}$), achieving the rate of $4/6=2/3$.

Example 3. (Case of ${\frac{K}{2}\leq M\leq K-1}$) Assume that there are ${N=2}$ servers, ${K=5}$ messages from $\mathbb{F}_{3^{4}}$ (i.e., each message has $4$ symbols over $\mathbb{F}_{3}$), and ${M=4}$. Suppose that the user demands the message $X_{1}$ and has coded a side information $X_{1}+X_{2}+2X_{3}+X_{4}$. Note that, for this example, $W=1$, ${S=\{1,2,3,4\}}$, and ${C=\{1,1,2,1\}}$.

First, the user labels $2$ sequences as $I_{1},I_{2}$, each of length $M=4$. For creating these sequences, the user selects ${w\in\{0,1\}}$ and $t\in\{2,3\}$ randomly chosen indices from $W=\{1\}$ and $T=\{2,3,4\}$, respectively, according to a carefully designed probability distribution (ensuring $W$-privacy of the MRP scheme) on all $(w,t)$ such that $w+t=3$. For this example, the probability distribution is given by

[TABLE]

Suppose that the user chooses ${w=1},{t=2}$, and selects the $3$ indices $\{1,2,4\}$. Following the MRP protocol, the user forms the sequence $I_{1}=S=\{1,2,3,4\}$ and ${I_{2}=\{5,1,2,4\}}$.

The user then labels $2$ sequences as $I^{\prime}_{1},I^{\prime}_{2}$, each of length $4$. For this example, suppose that the user creates ${I^{\prime}_{1}=\{2,1,2,1\},I^{\prime}_{2}=\{1,2,1,1\}}$. Then, the user randomly reorders the elements of $I_{i}$ and $I^{\prime}_{i}$, and constructs

[TABLE]

Next, the user sends a uniform random permutation of $\{I^{*}_{1},I^{*}_{2}\}$, say $\{I^{*}_{2},I^{*}_{1}\}$, to both servers, where $I^{*}_{i}=(\tilde{I}_{i},\tilde{I}^{\prime}_{i})$. The user and the servers form two super-messages as follows:

[TABLE]

Finally, the user and the servers run the Sun-Jafar protocol as explained in the previous example for the two super-messages $\hat{X}_{1},\hat{X}_{2}$ in such a way that the user can privately download $\hat{X}_{2}$. The user requests $3$ symbols from the first server and $3$ symbols from the second server as listed in Table II [1]. From the servers’ answers, the user first obtains the super-message $\hat{X}_{2}=2X_{1}+X_{4}+X_{2}+2X_{3}$, and then recovers the desired message $X_{1}$ by subtracting off the side information $X_{1}+X_{2}+2X_{3}+X_{4}$ from $\hat{X}_{2}$. For this example, the proposed protocol requires to download a total of $6$ symbols (over $\mathbb{F}_{3}$), achieving the rate of $4/6=2/3$.

Lemma 3**.**

The Multi-Server PIR-CSI–II protocols for the cases of ${M=2}$, ${3\leq M\leq K-1}$, and ${M=K}$ are server-symmetric protocols that satisfy the recoverability and the $W$-privacy conditions, and achieve the rates $1$, $N/(N+1)$, and $1$, respectively.

• Proof:

The proof is similar to the proof of Lemma 2, and hence omitted to avoid repetition. ∎