Date post: | 25-Jul-2015 |
Category: |
Software |
Upload: | dibyendu-dev-nath |
View: | 118 times |
Download: | 4 times |
+
Oblivious RAM ORAM
A Brief OverviewDibyendu Nath, UC Santa Barbara
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+What is ORAM ? Oblivious Random Access Machine [ORAM]
A machine is oblivious if the sequence in which it accesses memory locations is equivalent for any two inputs with the same running time.
E.g. For a client-server model with outsourced data storage in server, the server cannot gain info about actual memory access pattern from client requests
Main Idea:
Memory Access Pattern is hidden from adversary.
Caveat: Assume data content is not leaked as it is protected by traditional cryptographic methods (encryption)
ServerClient
read(i)
write(i, d)...
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+Motivation
Rise of Cloud Computing
Success of Pay-as-you-Go model for Public Clouds Affordability, Elasticity,
SLA Guarantees
Lots of “Big” Data
Solution: Outsourced Data Storage
Accessible from many devices (desktop, laptop, phone, car, ...).
Greater reliability.
May be cheaper (economy of scale).
Security Concerns behind outsourcing data to Public Clouds
+Motivation
Possible Solutions
Duh! Use encryption
Use “trusted” public cloud services Com’on, Google is “not evil”
Use private cloud infrastructure Eg. Walmart uses OpenStack
Is there a way to hide how we access our data but still use public cloud infrastructure ? Answer: ORAM
+Motivation: Example Attack
CloudApp
read(i)
write(i, d)
.
.
.
Genuine Client Request
Simulated Client Request from “trusted”
Cloud provider
Cloud Storage with Encrypted Content
+Motivation: Goal
“Untrusted” means: It may not implement Write/Read properly It will try to learn about data
Goal: Securely Outsourcing Data - Store, access, and update data on an untrusted server.
M[0]=d1
M[1]=d2
M[2]=d3
…
…
M[n]=dn
read(i)
write(i, d)
.
.
.
Client
Remote Server
[Islam et al, ‘12]
+Motivation: Solution
An ORAM emulator is an intermediate layer that protects any client (i.e. program). ORAM will issue operations that deviate
from actual client requests. Correctness:
If server is honest then input/ output behavior is same for client.
Security: Server cannot distinguish between two clients with same
running time.
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+History of ORAM
Pippenger and Fischer showed “oblivious Turing machines” could simulate general Turing machines
Goldreich introduced analogous notion of ORAMs in ’87 and gave first interesting construction
Ostrovsky gave a more efficient construction in ’90
... 20 years pass, time sharing systems become “clouds” ...
Then a flurry of papers improving efficiency: ~10 since 2010
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+ORAM Assumptions
Assumption #1: Server does not see data. Store an encryption key on emulator and re-encrypt on
every read/write.
Assumption #2: Server does not see op (read vs write). Every op is replaced with both a read and a write.
Assumption #3: Server is honest-but-curious. Store a MAC key on emulator and sign (address, time,
data) on each operation. Not malicious
+ORAM Security after Simplification
What’s left to protect is the “access pattern” of the program.
Definition: The access pattern generated by a sequence (i1, ..., in) with the ORAM emulator is the random variable (j1, ... , jT) sampled while running with an honest server.
Definition: An ORAM emulator is secure if for every pair of sequences of the same length, their access patterns are indistinguishable.
+Trivial ORAMs
Example #1: Store everything in ORAM simulator cache and simulate with no calls to server. Client storage = N.
Example #2: Store memory on server, but scan entire memory on every operation. Amortized and worst-case communication overhead = N.
Example #3: Assume client accesses each memory slot at most once, and then permute addresses using a PRP. Essentially optimal, but assumption does not hold in
practice.
+ORAM Lower Bounds
Theorem (GO’90):
Any ORAM emulator must perform Ω(t log t) operations to simulate t operations.
Proved via a combinatorial argument.
Theorem (BM’10):
Any ORAM emulator must either perform Ω(t log t log log t) operations to simulate t operations or use storage Ω(N2-o(1)) (on the server).
+ORAM Efficiency Goals
In order to be interesting, an ORAM must simultaneously provide o(N) client storage o(N) amortized overhead Handling of repeated access to addresses.
Desirable features for an “optimal ORAM”: O(log N) worst-case overhead O(1) client storage between operations O(1) client memory usage during operations “Stateless client”: Allows several clients who share a
short key to obliviously access data w/o communicating amongst themselves between queries. Requires op counters.
+Basic Tools: Shuffling
This means we move data at address i to address π(i).
Proof idea:
Use an oblivious sorting algorithm.
For each comparison in the sort, read both positions and rewrite them, either swapping the data or not (depending on if π(i) > π(j)).
Key Idea: Use sorting networks like Batcher or AKS, where memory accesses are independent of input
Claim: Given any permutation π on {1 , ... , N}, we can permute the data according to π with a sequence of ops that does not depend on the data or π.
+Oblivious Sort: Sorting Network Sorts Fixed number of values using a Fixed Sequence of
Comparisons.
Perfect for Oblivious Shuffling
Can be represented as networks of wires and comparator modules Values (of any ordered type) flow across the wires. E Each comparator connect two wires
Batcher Sorting Network for n = 4
Time Complexity = O(N log2 N)
+Batcher Sorting Network
AlgorithmN = 8
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+Goldreich’s “Square Root” ORAM
Scan Cache from the Server
If data is not in server cache, read it from main memory
If data is in server cache, read next dummy slot
Write data into server cache
Reshuffle with new K and flush cache after every C reads.
Initialization: Pick PRP key K. Use it to obliviously shuffle N data slots together with C “dummy” slots. Empty cache.
N data slots
C dummy
slots
C cache slots
Server Storage: N + 2C slots [General Case]Client Storage: O(1)
+Goldreich’s ORAM : Efficiency
Taking C=N1/2
Batcher sort ⇒ extra log N factor in costs
Security: Relatively easy to prove.Server sees an oblivious sort and then C unique, random looking read/writes before reinitializing.
+
Can we do Better ?
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+Ostrovsky’s “Hierarchical”
ORAM [Ostrovsky ’96]
Aim: Minimize Amortized cost of Random Shuffling in “Square Root” Approach
Store data (including dummies) in Random-Hash Table, rather than Randomly Sorted Array and recurse carefully
Main Idea:
Use Hierarchy of Buffers (hash tables) of different sizes
Shuffle buffers with frequency inversely proportional to their sizes
Much more complicated technique for hiding repeated access to same slots.
+ Ostrovsky’s “Hierarchical” ORAM DesignServer Storage
• log N “levels” for N items
• Level i contains 2i buckets
• Each buckets contains log N slots
• Each slot contains a ciphertext encrypting data or dummy.
level
2
3
4
1
K2
K3
K4
K1
• Data starts on lowest level into buckets, overflow happens
Client StoragePRP key Ki for each level
• When accessed, data gets moved to level 1 with negligible prob.
• Eventually, data gets shuffled to lower levels
• Invariant: ≤ 2i data slots used in level i • (i.e. ≤ 1 per bucket on average)
= data
PRP Keys
+Ostrovsky’s ORAM: Read/Write
Read/Write(addr) *
Scan both top buckets for data
At each lower level, scan exactly one bucket Until found, scan bucket at F(Ki, addr) on that
level After found, scan a random bucket on that level
Write data into bucket F(K1, addr) on level 1
Perform a “shuffling procedure” to maintain invariant
* Server is blind to ops i.e. every op is replaced with both a read and a write (which might or might not modify the data).
+Ostrovsky’s ORAM in Action
level
2
3
4
1
K2
K3
K4
K1
= data
PRF Keys
Read/Write(blue address):
1. Scan both buckets at level 1
2. Scan bucket F(K2, addr) = 4 in level 2
3. Scan F(K3, addr) = 3 in level 3 (finding data)
4. Scan a random bucket in level
5. Move found data to level 1
+Shuffling Procedure
We “merge levels” so that each level has ≤ 1 slot per bucket on average
After T operations: Let D={ max x : 2x divides T } For i = 1 to D
Pick new PRP key for level i+1
Shuffle data in levels i and i+1 together into level i+1 using new key
Level i is shuffled after every 2i ops.
+Shuffling: Oblivious Hashing 12-step Shuffling process with multiple calls to 2
primitives for merging level i and i+1 into i
Primitives Used: Scanning: Reading all words in memory array and possibly
modifying them Oblivious in the sense, order of access is predetermined
and same content may be written back 7 Calls
Oblivious Sorting:
Sorting memory array by sorting keys using Sorting Network such that sequence of memory accesses are fixed and independent of input.
4 Calls
Example of Sorting Networks: Batchers, AKS
+Ostrovsky’s ORAM in Action
level
2
3
4
1
K2
K3
K4
K1
= data
PRF Keys
1. Read a Slot
+Ostrovsky’s ORAM in Action
level
2
3
4
1
K2
K3
K4
K1
= data
PRF Keys
1. Read a Slot
2. Read another Slot Level 1 shuffled after 2^1 = 2 operations [stops here]
+Ostrovsky’s ORAM in Action
level
2
3
4
1
K2
K3
K4
K1
= data
PRF Keys
1. Read a Slot
2. Read another Slot Level 1 shuffled after 2^2 = 2 operations
3. 2 more Reads Level 1 shuffled after 2^2 = 4 operations Level 2 shuffled after 2^2 = 4 operations [stops here]
+Ostrovsky’s ORAM: Security
Security proof is more delicate than the first one.
Key observation: This scheme never uses the value F(Ki, addr) on the same (key, address) twice.
Why? Suppose client touches for the same address twice. After the first read, data is promoted to level 1. During the next read:
If it is still on level 1, then we don’t evaluate F at all. If it is has been moved, a new key must have been
chosen for that level since last read due to shuffling.
Using key observation, all reads look like random bucket scans.
+Ostrovsky’s ORAM: Efficiency
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+Recent Developments
Cuckoo Hashing ORAMs Replace bucket-lists with more efficient hash table
Path ORAM Protocol Binary Tree based ORAM Framework with client
stash Each block is mapped to a uniformly random leaf
bucket in the tree, Unstashed blocks are always placed in some
bucket along the path to the mapped leaf.
+Outline
What’s ORAM ?
Motivation
History
More on ORAM
Goldreich’s ORAM
Ostrovsky’s ORAM
Recent Developments
Conclusion
+Conclusion
Main Takeaway
Use sorting networks with PRP keys to simulate oblivious shuffling after a certain number of memory accesses Rinse and repeat
Improvement
Use Hierarchy of Hash table Buffers of different sizes Shuffle buffers with frequency inversely proportional to their
sizes
+References
Goldreich, Oded, and Rafail Ostrovsky. "Software protection and simulation on oblivious RAMs." Journal of the ACM (JACM) 43.3 (1996): 431-473.
Islam, Mohammad Saiful, Mehmet Kuzu, and Murat Kantarcioglu. "Access Pattern disclosure on Searchable Encryption: Ramification, Attack and Mitigation." NDSS. Vol. 20. 2012.
http://cseweb.ucsd.edu/~cdcash/oram-slides.pdf
+
Thanks :)Any Q?