Data access system, server device, data access method and program

Abstract

This server device comprises: a transmission unit that transmits, to a client device, a first data item in a first array having stored therein N number of data items in the initial state, and transmits, to the client device, all second data items stored in a second array which can store m number of data items, said m number being less than the N number; a migration unit that deletes the first data item transmitted by the transmission unit to the client device from the first array and stores the same in the second array; and a re-storage unit that re-stores data items stored in the second array in the first array when the number of the second data items stored in the second array has reached or exceeded m. The client device comprises a selection unit for probablistically selecting a data item from among the first data item and the second data items received from the server device. Accordingly, the space efficiency for enabling a server to conceal contents relating to data access is improved.

Description

[Technical Field]

[0001] The present invention relates to a data access system, a server device, a data access method, and a program. [Background technology]

[0002] ORAM (Oblivious RAM (Random Access Machine)) is a technology that allows clients to securely store data on an external server and access it as needed. ORAM not only allows data to be searched and referenced while remaining encrypted, but also achieves high security by keeping search history and search biases (access patterns) secret from the server. There are several derivatives of ORAM, and one such derivative, succinct ORAM, is a type of ORAM that is highly space-efficient. Specifically, if the original data set consists of N pieces of data, each with B bits each (NB bits in total), regular ORAM requires NB(1 + Θ(1)) bits of memory space on the server side, while succinct ORAM requires only NB(1 + o(1)) bits.

[0003] Another derivative is a technology called RORAM (Random-Index ORAM) (Non-Patent Document 1). Regular ORAM and simple ORAM are defined as functions that obtain desired data by the client explicitly specifying the data to be accessed when accessing the data (for example, a search key uniquely linked to the data is used as protocol input). On the other hand, RORAM is defined in such a way that the client does not specify the data when accessing the data, but instead obtains random data (one or more) from the data held by the server. Due to this property, RORAM is difficult to use as an encrypted database, but instead is a technology that is expected to be used for secure random sampling of large-scale data and large-scale multi-party computing. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Halevi, S. and Kushilevitz, E.: Random-Index Oblivious RAM, Cryptology ePrint Archive (2022). Summary of the Invention [Problem to be solved by the invention]

[0005] RORAM does not require the requirement of "searching for the correct data from a search key" as in conventional ORAM, so it can omit many of the processes required in ORAM. Therefore, it is expected that RORAM can significantly reduce time and space efficiency compared to ORAM, but in reality, the reduction in both is only very small.

[0006] The present invention has been made in view of the above points, and has as its object to improve space efficiency in order to enable the contents relating to access to data to be kept secret from the server. [Means for solving the problem]

[0007] Therefore, in order to solve the above problem, the present invention provides a server device comprising: a transmitting unit configured to transmit any first data from a first array that stores N pieces of data in an initial state to a client device, and to transmit all second data stored in a second array that can store m pieces of data less than N to the client device; a moving unit configured to delete the first data transmitted to the client device by the transmitting unit from the first array and store it in the second array; and a restoring unit configured to restore the data stored in the second array to the first array when the number of second data stored in the second array becomes m or more; and the client device comprises a selecting unit configured to probabilistically select any data from the first data and each of the second data received from the server device. [Effects of the Invention]

[0008] It is possible to improve space efficiency by making it possible to conceal from the server the details of access to data. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of a configuration of a data access system according to an embodiment of the present invention. [Figure 2] 1 is a diagram illustrating an example of a hardware configuration of a server device 10 according to an embodiment of the present invention. [Figure 3] 2 is a diagram illustrating an example of a functional configuration of a server device 10 and a client device 20 according to the present embodiment. FIG. [Figure 4] 10 is a sequence diagram illustrating an example of a procedure for accessing data executed by the server device 10 and the client device 20. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a diagram showing an example of the configuration of a data access system according to an embodiment of the present invention. In Fig. 1, the data access system includes a server device 10 and a client device 20. The server device 10 and the client device 20 are connected via a network such as a LAN (Local Area Network) or the Internet.

[0011] The server device 10 is one or more computers that manage data.

[0012] The client device 20 is a computer that accesses the data.

[0013] It should be noted that a plurality of server devices 10 may exist, and a plurality of client devices 20 may exist.

[0014] Fig. 2 is a diagram showing an example of the hardware configuration of a server device 10 according to an embodiment of the present invention. The server device 10 in Fig. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, and an interface device 105, all of which are interconnected via a bus B.

[0015] A program that realizes processing in the server device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101, but may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc.

[0016] When an instruction to start a program is received, the memory device 103 reads the program from the auxiliary storage device 102 and stores it. The CPU 104 executes functions related to the server device 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0017] The client device 20 also has a hardware configuration as shown in FIG.

[0018] 3 is a diagram showing an example of the functional configuration of the server device 10 and the client device 20 in this embodiment. In FIG. 3, the server device 10 has a data response unit 11, a receiving unit 12, and a restoring unit 13. Each of these units is realized by a process in which one or more programs installed in the server device 10 are executed by the CPU 104. The server device 10 also uses storage units for arrays T and S, etc. Each of these storage units can be realized using, for example, an auxiliary storage device 102, or a storage device connectable to the server device 10 via a network.

[0019] On the one hand, the client device 20 includes an access unit 21 and a reply unit 22. Each of these units is realized by a process in which one or more programs installed in the client device 20 cause the CPU of the client device 20 to execute. The client device 20 also uses an output target storage unit 23. The output target storage unit 23 can be realized, for example, using a memory device or an auxiliary storage device of the client device 20, or a storage device that can be connected to the client device 20 via a network.

[0020] The array T is an array having a capacity capable of storing each of all the data held by the server device 10 as an element. In the present embodiment, it is assumed that the total number of all the data is N. The capacity of the array T is N. In the initial state, all the data (N pieces of data) are stored in the array T.

[0021] The array S is an array having a capacity of an arbitrary integer m (<N). That is, the array S can store m pieces of data less than N. The array S is empty in the initial state.

[0022] Among the data stored in the array T, the data transmitted to the client device 20 is moved to the array S. When the array S is full, all the data (m pieces of data) in the array S are integrated with the remaining data ((N - m) pieces of data) in the array T and re-stored in the array T.

[0023] [[ID=1�]] In the initialization, all N pieces of data are randomly permuted (shuffled) and stored in the array T. At this time, the server device 10 does not have the data order, i.e., the permutation information used for shuffling. One method for achieving this is, for example, a secret shuffle protocol (reference document [4]) between the client device 20 and the server device 10, but any other method with equivalent properties may be adopted. For example, a simple method may be used in which the client device 20 retrieves all N pieces of data, shuffles and re-encrypts them, and then returns the results to the server device 10. Note that the literature information for each reference document will be described later.

[0024] The following describes the processing procedure (protocol) executed by the server device 10 and the client device 20 when accessing data. Although omitted below for simplicity, it is assumed that all data on the server device 10 is encrypted with the private key of the client device 20, and that the ciphertext is re-randomized each time the client device 20 acquires and returns data. Furthermore, instead of a two-party protocol between the client device 20 and the server device 10, equivalent processing may be performed as multi-party computation involving three or more server devices 10.

[0025] 4 is a sequence diagram illustrating an example of a processing procedure for accessing data executed by the server device 10 and the client device 20. At the start of the processing procedure in FIG. 4, the number of data items moved to the array S is set to t (≦m).

[0026] When accessing data, the access unit 21 of the client device 20 generates a random bit b∈{0,1} with probability Pr[b=1]=any probability p (0≦p≦1) (S101). In this case, the probability that b will be 1 is p. If a uniform output probability is given to all data, the client device 20 may generate a random bit b with probability Pr[b=1]=t / N. In this case, the probability that b will be 1 is t / N. Step S101 is executed every time data is accessed.

[0027] Next, the access unit 21 transmits a request to access the data to the server device 10 (S102). Here, the data to be accessed is not specified, because the data to be accessed is random in RORAM, which is the premise of this embodiment.

[0028] In response to a data access request, the data response unit 11 of the server device 10 retrieves an arbitrary element t from the array T. i Take out t i is deleted from the array T (S103). i is transmitted to the client device 20 (S104).

[0029] The access unit 21 of the client device 20 i When receiving , if and only if b = 0, t is output for the access request. i The output target storage unit 23 stores the data to be output (access target) (S105). The output target storage unit 23 is a storage unit for storing data to be output (access target), and has a capacity for one piece of data.

[0030] Next, the data response unit 11 of the server device 10 performs the following operations on the t elements s1, . . . , s of the array S. t to the client device 20, and deletes these t elements from the array S (S106).

[0031] The access unit 21 of the client device 20 accesses the elements s1,...,s tWhen b is received, elements s1,...,s are t Randomly select one s from j Select the selected s j is stored in the output target storage unit 23 as an output in response to the access request (S107). t By setting the probability that each of these will be selected to a uniform distribution of 1 / t, uniform random access to all data is achieved.

[0032] In this way, based on the probabilistically determined value of b, t1 and s1,...,s t The output target (access target) is selected probabilistically from among these.

[0033] Next, the reply unit 22 of the client device 20 sends all the data (t i and s1,...,s t ) to the server device 10 (S108). The client device 20 may rewrite or change any of the returned data. The data may be returned all at once in step S108, or sequentially each time data is received in steps S104 and S106.

[0034] When the receiving unit 12 of the server device 10 receives the returned data, it stores all the received data in the array S (S109). The data may be stored in any order. i and the receiving unit 12 adds t to the array S in step S109. i By storing t from array T to array S i The movement of elements s1,...,s t will be restored to array S.

[0035] When the number of elements in array S becomes m or more (i.e., when the capacity of array S is filled), the restoring unit 13 combines all elements (m pieces of data) in array S with all elements ((Nm) pieces of data) in array T to make a total of N elements, permutes (shuffles) the order of the N elements (i.e., randomly determines the order of the N elements), and then restores the N elements to array T (S110). The shuffling may be performed using a method similar to that used for initialization, or may be performed using the Oblivious Intersperse algorithm disclosed in Reference [5].

[0036] In the above processing procedure, for convenience, an algorithm for accessing one piece of data in one access is exemplified, but it is also possible to access multiple pieces of data by changing the number of pieces of data sent and received in step S104 to any k pieces less than m, and setting the number of pieces of data selected in step S107 to k pieces.

[0037] As described above, according to this embodiment, for RORAM that allows random access to large amounts of data, the space efficiency of the data structure can be improved compared to conventional RORAM and ORAM. That is, the space efficiency for keeping the details of data access confidential from the server can be improved.

[0038] Specifically, while existing RORAM (reference document [1]) requires a memory area NB(1+Θ(1)) like regular ORAM, this embodiment only requires NB(1+o(1)) like concise ORAM (reference documents [2], [3]). In addition, this embodiment has better space efficiency while achieving the same computational efficiency as existing concise ORAM (reference document [3]). Specifically, reference document [3] requires NB+√N(B+logN) bits, this embodiment requires only NB+√NB bits. Here, B is the number of data bits, and N is the number of data.

[0039] In this embodiment, the array T is an example of a first array, and the array S is an example of a second array. i is an example of the first data. Elements s1,...,s t Each of these is an example of second data. The data response unit 11 is an example of a sending unit. The data response unit 11 and the receiving unit 12 are an example of a moving unit. The access unit 21 is an example of a selecting unit.

[0040] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims.

[0041] The literature information for the above references is as follows: [1]Goldreich, O. and Ostrovsky, R.: Software Protection and Simulation on Oblivious RAMs, J. ACM, Vol. 43, No. 3, pp. 431.473 (1996). [2] Onodera, T. and Shibuya, T.: Succinct Oblivious RAM, STACS (2018). [3] M. Fukunari and W. Ogata: Proposal of a Truly Concise Oblivious RAM Protocol, SCIS (2021). [4]Patel, S., Persiano, G., and Yeo, K.: CacheShu.e: A family of oblivious shu.es, ICALP (2018) [5]Asharov, G., Komargodski, I., Lin, W., Nayak, K., Peserico, E. and Shi, E.: OptORAMA: Optimal Oblivious RAM, EUROCRYPT, pp. 403.432 (2020) [Explanation of symbols]

[0042] 10 Server device 11 Data response part 12 Receiving unit 13 Re-storage section 20 Client Device 21 Access Section 22 Reply section 23 Output target memory section 100 Drive device 101 Recording media 102 Auxiliary storage 103 Memory Device 104 CPU 105 Interface Device B Bus

Claims

1. A data access system including a client device and a server device, The server device a transmitting unit configured to transmit to the client device any first data in a first array that stores N pieces of data in an initial state, and to transmit to the client device all second data stored in a second array that can store m pieces of data, where m is less than N; a moving unit configured to delete the first data transmitted to the client device by the transmitting unit from the first array and store the first data in the second array; a restoring unit configured to restore the data stored in the second array to the first array when the number of the second data stored in the second array becomes m or more; and The client device a selection unit configured to probabilistically select one of the first data and each of the second data received from the server device; having A data access system comprising:

2. the restoring unit is configured, when the number of pieces of data stored in the second array becomes m or more, to randomly determine an order of the data stored in the second array and the data stored in the first array, and store the data stored in the second array and the data stored in the first array in the first array.

2. The data access system according to claim 1.

3. The client device a reply unit configured to reply to the server device the first data and all of the second data; and the moving unit is configured to delete the first data from the first array when the transmitting unit transmits the first data, and to store the first data and all of the second data returned from the client device in the second array.

3. The data access system according to claim 1 or 2.

4. a transmitting unit configured to transmit any first data in a first array that stores N pieces of data in an initial state to a client device, and to transmit all second data stored in a second array that can store m pieces of data, where m is less than N, to the client device; a moving unit configured to delete the first data transmitted to the client device by the transmitting unit from the first array and store the first data in the second array; a restoring unit configured to restore the data stored in the second array to the first array when the number of the second data stored in the second array becomes m or more; A server device comprising:

5. a transmission step of transmitting any first data in a first array that stores N pieces of data in an initial state to a client device, and transmitting all second data stored in a second array that can store m pieces of data, where m is less than N, to the client device; a moving step of deleting the first data transmitted to the client device by the transmitting step from the first array and storing the first data in the second array; a restoring step of restoring the data stored in the second array to the first array when the number of second data stored in the second array becomes m or more; A data access method characterized by being executed by a computer.

6. a transmission step of transmitting any first data in a first array that stores N pieces of data in an initial state to a client device, and transmitting all second data stored in a second array that can store m pieces of data, where m is less than N, to the client device; a moving step of deleting the first data transmitted to the client device by the transmitting step from the first array and storing the first data in the second array; a restoring step of restoring the data stored in the second array to the first array when the number of second data stored in the second array becomes m or more; A program characterized by causing a computer to execute the above.

Images