Data access system, client device, data access method and program

Abstract

The present invention includes: a node acquisition unit that acquires, from a server device, all nodes from a root node to any one leaf node of a complete binary tree in which data can be stored in nodes and all data is stored randomly in one of the leaf nodes in the initial state; a selection unit that probabilistically selects data to be accessed from each of all the nodes and removes the data from the node; a transfer unit that probabilistically transfers the data selected by the selection unit to one of the nodes from the root node to the leaf node among all the nodes, and probabilistically transfers data not selected by the selection unit to one of the nodes from the node storing the data to the leaf node; and a node reply unit that replies to the server device so that all the nodes among which data has been transferred are reflected in the complete binary tree. By including the above, the present invention improves space efficiency to enable a server to keep content related to access to data confidential.

Description

[Technical Field]

[0001] The present invention relates to a data access system, a client device, a data access method, and a program. [Background technology]

[0002] ORAM (Oblivious RAM (Random Access Machine)) is a technology that allows clients to securely store data on an external server and access it as needed. ORAM not only allows data to be searched and referenced while remaining encrypted, but also achieves high security by keeping search history and search biases (access patterns) secret from the server. There are several derivatives of ORAM, and one such derivative, succinct ORAM, is a type of ORAM that is highly space-efficient. Specifically, if the original data set consists of N pieces of data, each with B bits each (NB bits in total), regular ORAM requires NB(1 + Θ(1)) bits of memory space on the server side, while succinct ORAM requires only NB(1 + o(1)) bits.

[0003] Another derivative is a technology called RORAM (Random-Index ORAM) (Non-Patent Document 1). Regular ORAM and simple ORAM are defined as functions that obtain desired data by the client explicitly specifying the data to be accessed when accessing the data (for example, a search key uniquely linked to the data is used as protocol input). On the other hand, RORAM is defined in such a way that the client does not specify the data when accessing the data, but instead obtains random data (one or more) from the data held by the server. Due to this property, RORAM is difficult to use as an encrypted database, but instead is a technology that is expected to be used for secure random sampling of large-scale data and large-scale multi-party computing. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Halevi, S. and Kushilevitz, E.: Random-Index Oblivious RAM, Cryptology ePrint Archive (2022). Summary of the Invention [Problem to be solved by the invention]

[0005] RORAM does not require the requirement of "searching for the correct data from a search key" as in conventional ORAM, so it can omit many of the processes required in ORAM. Therefore, it is expected that RORAM can significantly reduce time and space efficiency compared to ORAM, but in reality, the reduction in both is only very small.

[0006] The present invention has been made in view of the above points, and has as its object to improve space efficiency in order to enable the contents relating to access to data to be kept secret from the server. [Means for solving the problem]

[0007] Therefore, in order to solve the above problem, in a data access system including a server device having a complete binary tree in which data can be stored in each node and in which all data is randomly stored in one of the leaf nodes in an initial state, and a client device that accesses the data, the client device has: a node acquisition unit configured to acquire all nodes from the server device from the root node of the complete binary tree to any one of the leaf nodes; a selection unit configured to probabilistically select data to be accessed from each of the nodes and delete the data from that node; a movement unit configured to probabilistically move the data selected by the selection unit to any node from the root node to the leaf node among all the nodes, and to probabilistically move data not selected by the selection unit from the node that stores the data to any node from the node to the leaf node; and a node return unit configured to return all the nodes to which data has been moved to the server device in order to reflect them in the complete binary tree. [Effects of the Invention]

[0008] It is possible to improve space efficiency by making it possible to conceal from the server the details of access to data. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of a configuration of a data access system according to an embodiment of the present invention. [Figure 2] 1 is a diagram illustrating an example of a hardware configuration of a server device 10 according to an embodiment of the present invention. [Figure 3] 2 is a diagram illustrating an example of a functional configuration of a server device 10 and a client device 20 according to the present embodiment. FIG. [Figure 4] FIG. 2 is a diagram for explaining a height u and a position t. [Figure 5] 10 is a sequence diagram illustrating an example of a procedure for accessing data executed by the server device 10 and the client device 20. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a diagram showing an example of the configuration of a data access system according to an embodiment of the present invention. In Fig. 1, the data access system includes a server device 10 and a client device 20. The server device 10 and the client device 20 are connected via a network such as a LAN (Local Area Network) or the Internet.

[0011] The server device 10 is one or more computers that manage data.

[0012] The client device 20 is a computer that accesses the data.

[0013] It should be noted that a plurality of server devices 10 may exist, and a plurality of client devices 20 may exist.

[0014] Fig. 2 is a diagram showing an example of the hardware configuration of a server device 10 according to an embodiment of the present invention. The server device 10 in Fig. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, and an interface device 105, all of which are interconnected via a bus B.

[0015] A program that realizes processing in the server device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101, but may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc.

[0016] When an instruction to start a program is received, the memory device 103 reads the program from the auxiliary storage device 102 and stores it. The CPU 104 executes functions related to the server device 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0017] The client device 20 also has a hardware configuration as shown in FIG.

[0018] FIG. 3 is a diagram showing an example of the functional configuration of the server device 10 and the client device 20 according to the present embodiment.

[0019] 3, the server device 10 has a node transmitting unit 11 and an updating unit 12. These units are realized by processing in which one or more programs installed in the server device 10 are executed by a CPU 104. The server device 10 also uses a data storage unit 13. The data storage unit 13 can be realized using, for example, an auxiliary storage device 102, or a storage device connectable to the server device 10 via a network.

[0020] On the other hand, the client device 20 has a node acquisition unit 21, a selection unit 22, a movement unit 23, and a node reply unit 24. Each of these units is realized by a process executed by a CPU of the client device 20 by one or more programs installed in the client device 20. The client device 20 may also use a stash 25 as needed. The stash 25 can be realized, for example, by using an auxiliary storage device or memory device of the client device 20, or a storage device connectable to the client device 20 via a network.

[0021] Here, f and g are

[0022]

number

[0023] Let N be the total number of data and Z be a constant.

[0024]

number

[0025] The data storage unit 13 has a data structure expressed as a complete binary tree (hereinafter simply referred to as a "binary tree") of height L, and stores N pieces of data using the binary tree. However, among the nodes of the binary tree, 2 L -One internal node can store up to Z data items, and 2 L Each leaf node can store up to M pieces of data. In principle, each piece of data is stored in one of these nodes, and at this time, one bit of auxiliary information is given to each piece of data d.

[0026] In the initial state, all data d is stored randomly in one of the leaf nodes as a pair (d, 0) with auxiliary information c=0.

[0027] The client device 20 and the server device 10 each have a query counter ctr. The initial value of ctr is 0, and it is incremented (1 is added) each time an access is made.

[0028] The stash 25 is a storage unit (array) for temporarily storing data that probabilistically overflows from the binary tree. Each piece of data d stored in the stash 25 is provided with a height u and a position t as auxiliary information by the client device 20 in addition to auxiliary information c. Here, the height u and position t assigned to a certain piece of data d are identification information (height and position) of a node in the binary tree that was intended to store the data d but could not store the data d due to overflowing capacity.

[0029] 4 is a diagram for explaining the height u and the position t, illustrating a complete binary tree with a height L=3.

[0030] The height u of a node is counted from the root as 0. Therefore, the height of a leaf node is L (L=3 in Figure 4).

[0031] The position t of a node is, for example, a value (serial number) indicating the position from the left in the height to which the node belongs. In this case, the position t assigned to each node in the height u is 0,...,2 u In FIG. 4, the value of the position t is expressed in binary and written in each node for convenience.

[0032] It should be noted that two or more pieces of data d may be assigned to the same node, and therefore the height u and position t may stochastically overlap between pieces of data d in the stash 25 .

[0033] In the initialization, all N pieces of data d are randomly stored in one of the leaf nodes, but the server device 10 does not have information about the arrangement of the data d at the time of initialization. One method for achieving this is to distribute the data d to the leaves using a secret shuffle protocol (reference document [4]) between the client device 20 and the server device 10, for example, but any other method with equivalent properties may be adopted. Note that the literature information of the reference documents will be described later.

[0034] The number of bits of server memory required for this data d structure is

[0035]

number

[0036] Below, we will explain the processing procedure (protocol) executed by the server device 10 and the client device 20 when accessing data d. Note that, although omitted below for simplicity, we will assume that all data d on the server device 10 is encrypted with the private key of the client device 20, and that the ciphertext associated with re-encryption is re-randomized each time the client device 20 acquires and returns data d. Furthermore, instead of a two-party protocol between the client device 20 and the server device 10, equivalent processing may be performed as multi-party computation involving three or more server devices 10.

[0037] FIG. 5 is a sequence diagram illustrating an example of a procedure for the process of accessing the data d executed by the server device 10 and the client device 20. In FIG.

[0038] When accessing data, the node acquisition unit 21 of the client device 20 sets ctr to 2 L Remainder when dividing by (ctr mod 2 L The bit-inverted value of the L-bit value, ctr mod 2, is assigned to l (S101). The number of bits in l is also L. Therefore, ctr mod 2 L The possible range is 0 to 2 L -1. Similarly, the range of l is 0 to 2. L -1. This range corresponds to the range of leaf node positions t in a binary tree.

[0039] Next, the node acquisition unit 21 transmits a request to access data to the server device 10 (S102). Here, the data d to be accessed is not specified because the data d to be accessed is random in RORAM, which is the premise of this embodiment.

[0040] In response to a request to access data, the node transmitting unit 11 of the server device 10 sets ctr to 2 L The inverted value of the remainder when divided by is assigned to l (S103). The value of ctr is common between the client device 20 and the server device 10. Therefore, the number of bits and the value of l are also common between the client device 20 and the server device 10.

[0041] Next, the node transmitting unit 11 transmits to the client device 20 all L nodes on the shortest path (hereinafter simply referred to as "path") from the root of the binary tree in the data storage unit 13 to the l-th leaf node (i.e., the position described in FIG. 4 is l) (S104). The range of the leaf node position of the binary tree is 0,...,2 L -1. In the following, we will refer to these leaves as Leaf_0,...,Leaf_{2 L -1}, in which case the l-th leaf node is Leaf_l.

[0042] When the node acquisition unit 21 of the client device 20 receives the nodes from the root node to Leaf_l, it sequentially assigns these nodes to N0, . . . , N L Let's say.

[0043] Next, the selection unit 22 selects data d to be output (accessed) by determining probabilistically whether or not the data d stored in each node is to be output (accessed) taking into consideration the number of leaf nodes linked to the node (i.e., the number of paths to which the node belongs among the paths from the root node to each leaf node in the binary tree (hereinafter referred to as "the number of paths")), and deletes the selected data d from the node (S105). Specifically, the selection unit 22 selects data d to be output by determining whether or not the data d is to be output (accessed) taking into consideration the number of leaf nodes linked to the node (i.e., the number of paths to which the node belongs among the paths from the root node to each leaf node in the binary tree (hereinafter referred to as "the number of paths")). i For all data d(d,c) stored in L-i-c The output target is set to d, and the output target data is set to N i Remove from.

[0044] Here, probability 1 / 2 L-i-c The reason for selecting it as an output target will be explained below.

[0045] In the existing technology, each data d is divided into "Leaf_0" and "Leaf_{2 LThe condition is set as "a node is randomly linked to one of the leaves (or the path to which the leaf belongs) up to {{-1}}" and "when data d is linked to Leaf_l, d exists at one of the nodes on the path between the root and leaf Leaf_l."

[0046] In this embodiment, the direct link between the data d and Leaf_l is eliminated (each data d is not stored in association with Leaf_l), thereby improving space efficiency.

[0047] In this case, in order to emulate the same effect as the existing technology, data d existing at height i is "potentially stored in node N i 2 on the path to which L-i The probability that it is linked to one of the leaves (Leaf_l being read) is 1 / 2. L-i In other words, the more leaf nodes a node has associated with it (i.e., the closer the node is to the root node in the binary tree), the lower the probability that the data stored in that node will be output.

[0048] However, data d with c=1 has been determined to be moved to a child node at height i+1 (by the action of (a) in step S109 described later), and the number of leaf candidates that are descendants of the child node is 2. L-i-1 As a result, in this embodiment, the output probability is 1 / 2 L-i-c It is stipulated that:

[0049] Next, the selection unit 22 selects N0, . . . , N1 acquired from the server device 10 in this access from among all data d(d, c, u, t) stored in the stash 25. L For each data d that was planned to be stored in one of the nodes, the number of leaf nodes linked to the node where the data d was planned to be stored (i.e., the number of routes to which the node belongs) is taken into consideration to determine probabilistically whether or not the data d should be a target for output (a target for access), and the data d to be output is selected, and the selected data d is deleted from the stash 25 (S106).

[0050] Specifically, the selection unit 22 selects data in which the upper u bits of l match t from among all data (d, c, u, t) stored in the stash 25 with a probability of 1 / 2 L-u-c The output data is removed from the stash 25. The output probability is calculated based on the above output probability of 1 / 2. L-i-c That is, the probability is determined by taking into account the number of leaf nodes linked to the node that was scheduled to store data d (the number of paths that belong to that node). Specifically, the more leaf nodes linked to the node that was scheduled to store data d (the more paths that belong to that node), the lower the output probability becomes.

[0051] Furthermore, the upper u bits of l correspond to the position t of the ancestor node at height u among the ancestor nodes of Leaf_l (the lth leaf node). For example, referring to FIG. 4, if l is "011", {0,0,01,011} are nodes on the path from the root to Leaf_l. In this case, the serial number of the node at height 2 is "01", which are the upper two bits of l. Similarly, the serial number of the node at height 1 is "0", which is the upper one bit of l. In this way, the upper u bits of l indicate the t of the node at height u among the ancestor nodes of the lth leaf node.

[0052] Therefore, among all the data d(d, c, u, t) stored in the stash 25, the data in which the upper u bits of l match t are the data N0,...,N L This means data that was intended to be stored on one of the nodes.

[0053] Next, the moving unit 23 sets c=0 for all data d selected as the output target in step S105 or S106, and temporarily places all the data d(d,0) at the root N0 (S107). At this time, the selecting unit 22 deletes (u, t) of the selected data d from the stash 25.

[0054] Subsequently, if there is data (i.e., data scheduled to be stored in any of N0, ..., N) in the remaining data (d, c, u, t) of the stash 25 where the upper u + 1 bits of l match t, the movement unit 23 temporarily places (d, c) excluding (u, t) from the data (d, c, u, t) in Nu (i.e., the node where the data is scheduled to be stored), and deletes the data from the stash 25 (S108). L If there is such data, the movement unit 23 temporarily places (d, c) excluding (u, t) from the data (d, c, u, t) in Nu (i.e., the node where the data is scheduled to be stored), and deletes the data from the stash 25 (S108).

[0055] Subsequently, the movement unit 23 executes a re-storage process (data movement process) composed of the following steps (a) to (c) (S109).

[0056] (a) First, for each Ni among N0, ..., N L ; i < L (i.e., nodes Ni other than Leaf_l i ), all data d with c = 1 is moved to Ni i ), and c is set to 0 for the data d. This step (a) is a process of moving data that was determined to be moved to a different path from the path obtained from the server device 10 at the time of past access to the different path. This will become clear in the steps described later. i+1 This step (a) is a process of moving data that was determined to be moved to a different path from the path obtained from the server device 10 at the time of past access to the different path. This will become clear in the steps described later.

[0057] (b) Subsequently, for all data d with c = 0 (including the data d with c = 0 in (a)), it is moved to Ni i+1 with a probability of 1 / 2. That is, for the data d selected as the output target, the movement starts from N0, and for the data d not selected as the output target, the movement starts from the Ni i (if the data d is data stored in the stash 25, the movement starts from the Ni i [[ID=2⑧]]) where the data is scheduled to be stored). This process is executed one branch at a time in the direction of Leaf_l until the movement fails for each data d (when it does not move with a probability of 1 / 2). When the movement of a certain data d fails, c is set to 1 at the timing of the failure, and the node where the data d has reached at the time of the failure (i.e., if the number of successful movements is k times, Nii+k ) and the data d is stored in Leaf_l (node ​​N L ) is stored in Leaf_l with c=0.

[0058] In addition, N i+1 The probability of moving to is 1 / 2 when N i This is to make the probability of moving to each of the two child nodes of equal.

[0059] Here, node N i+1 The failure to move to node N i Of the two child nodes of i+1 means that it was determined that the data should be moved to a different child node (i.e., a child node on a path of a leaf node other than Leaf_l). Therefore, c=1 indicates that it was determined that the data should be moved to another path in the re-storing process, but the move was not possible. However, data with c=1 can be moved to the child node on the other path by (a) when accessed in the future.

[0060] (c) Finally, for each node N i If there is data d that cannot be stored in N (if there is data d that has been moved to a node that exceeds the capacity), u=i and the upper u bits of l are substituted into t, and (d, c, u, t) is stored in the stash 25. Here, N i i is N i Therefore, substituting i for u means substituting N for u. i As mentioned above, the upper u bits of l correspond to the position of the node with height u among the ancestor nodes of Leaf_l. Therefore, substituting the upper u bits of l into t means substituting N i That is, the position of node N i The data d (u, t) that could not be stored in node N i The identification information (height, position) of the object.

[0061] Next, the node reply unit 24 of the client device 20 updates all nodes N0, . . . , N1 in order to reflect the change in the storage location of the data in the server device 10 (the binary tree of the data storage unit 13). L is returned to the server device 10 (S110), and ctr is incremented by 1 (S111).

[0062] The update unit 12 of the server device 10 updates the nodes N0, . . . , N L When the data storage unit 13 receives the binary tree, the nodes N0,...,N L with the received content (S112). As a result, the movement of data in the client device 20 is reflected in the binary tree. Next, the update unit 12 adds 1 to ctr (S113).

[0063] As described above, according to this embodiment, for RORAM that allows random access to large amounts of data, the space efficiency of the data structure can be improved compared to conventional RORAM and ORAM. That is, the space efficiency for keeping the details of data access confidential from the server can be improved.

[0064] Specifically, while existing RORAM (Reference [1]) requires a memory area NB(1+Θ(1)) like regular ORAM, our implementation requires only NB(1+o(1)), similar to concise ORAM (References [2], [3]). In addition, our implementation is more space-efficient than existing concise ORAM (Reference [2]) while achieving the same computational efficiency. Specifically, Reference [2] requires a lower bound B=ω(logN) on the block size to satisfy its conciseness (i.e., the required space is NB(1+o(1))), whereas our implementation is concise for any block size.

[0065] Here, B is the number of bits of data, and N is the number of pieces of data.

[0066] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims.

[0067] The literature information for the above references is as follows: [1]Goldreich, O. and Ostrovsky, R.: Software Protection and Simulation on Oblivious RAMs, J. ACM, Vol. 43, No. 3, pp. 431.473 (1996). [2] Onodera, T. and Shibuya, T.: Succinct Oblivious RAM, STACS (2018). [3] Fukunari, M., Ogata, W.: Proposal of a Truly Concise Oblivious RAM Protocol, SCIS (2021). [4]Patel, S., Persiano, G., and Yeo, K.: CacheShu.e: A family of oblivious shu.es, ICALP (2018) 3 [Explanation of symbols]

[0068] 10 Server device 11 Node Transmitter 12 Update section 13 Data storage unit 20 Client Device 21 Node Acquisition Unit 22 Selection section 23 Mobile Unit 24 Node Reply Section 25 Stash 100 Drive device 101 Recording media 102 Auxiliary storage 103 Memory Device 104 CPU 105 Interface Device B Bus

Claims

1. A data access system including: a server device having a complete binary tree in which data can be stored in each node and in which all data is randomly stored in any of the leaf nodes in an initial state; and a client device accessing the data, The client device a node acquisition unit configured to acquire all nodes from a root node to any one of leaf nodes of the complete binary tree from the server device; a selection unit configured to probabilistically select data to be accessed from each of all the nodes and delete the data from the selected node; a moving unit configured to probabilistically move data selected by the selecting unit to any of the nodes from a root node to the leaf node among all the nodes, and to probabilistically move data not selected by the selecting unit from the node storing the data to any of the nodes from the node storing the data to the leaf node; a node reply unit configured to reply to the server device to reflect all the nodes to which data has been moved in the complete binary tree; A data access system comprising:

2. the selection unit is configured to reduce the probability that data stored in a node closer to a root node among all the nodes will be selected as the access target; 2. The data access system according to claim 1.

3. the movement unit is configured to store, in the storage unit, data that has been moved to a node that exceeds the capacity as a result of the probabilistic movement of the data, the data being assigned with identification information of the node; the selection unit is further configured to probabilistically select, from the data stored in the storage unit, data to which identification information of any of the nodes acquired by the node acquisition unit is assigned, as an access target, and delete the data from the storage unit.

3. The data access system according to claim 1 or 2.

4. the selection unit is configured to reduce the probability that data stored in the storage unit is selected as the access target as the identification information of a node closer to a root node is assigned to the data.

4. The data access system according to claim 3.

5. the moving unit is configured to, when the node acquisition unit acquires a leaf node other than the leaf node and a child node of the node, probabilistically move data that has failed to be probabilistically moved from the leaf node to any node from the child node to the other leaf node; 3. The data access system according to claim 1 or 2.

6. a node acquisition unit configured to acquire, from a server device having a complete binary tree in which data can be stored in each node and in which all data is randomly stored in any of the leaf nodes in an initial state, all nodes from a root node of the complete binary tree to any one of the leaf nodes; a selection unit configured to probabilistically select data to be accessed from each of all the nodes and delete the data from the selected node; a moving unit configured to probabilistically move data selected by the selecting unit to any of the nodes from a root node to the leaf node among all the nodes, and to probabilistically move data not selected by the selecting unit from the node storing the data to any of the nodes from the node storing the data to the leaf node; a node reply unit configured to reply to the server device to reflect all the nodes to which data has been moved in the complete binary tree; A client device comprising:

7. a node acquisition step of acquiring, from a server device having a complete binary tree in which data can be stored in each node and all data is randomly stored in any of the leaf nodes in an initial state, all nodes from the root node of the complete binary tree to any one of the leaf nodes; a selection step of probabilistically selecting data to be accessed from each of the nodes and deleting the data from the selected node; a moving procedure that probabilistically moves data selected by the selection procedure to any of the nodes from the root node to the leaf node, and that probabilistically moves data not selected by the selection procedure from the node storing the data to any of the nodes from the node storing the data to the leaf node; a node reply procedure for replying to the server device to reflect all the nodes to which data has been moved in the complete binary tree; A data access method characterized by being executed by a computer.

8. a node acquisition step of acquiring, from a server device having a complete binary tree in which data can be stored in each node and all data is randomly stored in any of the leaf nodes in an initial state, all nodes from the root node of the complete binary tree to any one of the leaf nodes; a selection step of probabilistically selecting data to be accessed from each of the nodes and deleting the data from the selected node; a moving procedure that probabilistically moves data selected by the selection procedure to any of the nodes from the root node to the leaf node, and that probabilistically moves data not selected by the selection procedure from the node storing the data to any of the nodes from the node storing the data to the leaf node; a node reply procedure for replying to the server device to reflect all the nodes to which data has been moved in the complete binary tree; A program characterized by causing a computer to execute the above.

Images