Reporter:Chien-Wen Huang Protecting the Privacy of Users in Retrieving Valuable Information by a PIR Scheme with Mutual Authentication by RSA Signature Algorithm Date：2010.10.1 Reporter:Chien-Wen Huang 出處:Innovative Computing, Information and Control, 2007. ICICIC '07. Second International Conference

The proposed PIR scheme Outline Introduction 1 Related work 2 3 The proposed PIR scheme Security Analysis of the proposed scheme and comparisons with others 4 Conclusions and Future Work 5

Private Information Retrieval (PIR) Introduction Motivation As the user query a patent but the server will not know which patent the user queried. Private Information Retrieval (PIR) Initial research of PIR was done by Chor et al.(1995) Beimel proposed several robust PIR schemes.(2004) Results A new one-server PIR scheme, with mutual authentication between the user and the server.

Computational Private Information Retrieval Related work Computational Private Information Retrieval Chor et al. introduced a c-PIR scheme(from information-theory security to computational security) Kushilevitz et al. proposed a CPIR scheme based on the quadratic residuosity assumption. Cachin et al. proposed a CPIR scheme which is based on the -Hiding assumption.

Private Information Retrieval Using a Secure Coprocessor (SC) An SC is a temper-proof device with small memory in it; it is designed to prevent anybody from accessing its memory. Conquers the problem of CPIR which can only deal with one bit per query. the communication complexity to O(1). the server’s computation complexity is still O(n).

For the reason of confusing the server, in the kth query, the SC must read previously accessed records,and one unread record.

The proposed PIR scheme

Registering phase: Preprocessing phase: User U calculates User U computes C1 = and send to SC. On receiving C1 , the SC decrypts C1with its private key SKSC and then stores to the ID file in server S. Preprocessing phase: The preprocessing phase is to produce a shuffled copy of DB in server S and a shuffled index in the SC.

Online-query phase: U selects a ru(a part of the session key)and sends C2= to the SC. The SC decrypts C2 with its private key SK SC to get IDU and ru. SC selects a rs random number(another part of the session key)and calculates the session key ,then send C3= to user. User U calculates the session key and decrypts (with K’).if the result= ru, user U send to the SC,otherwise not.

User calculates C4= and send to SC. SC checks whether if the answer is correct then go to next one,else stop the online-query. SC reads the Ri from the shuffled database according to the shuffled index and sends User U decrypts with K’.

Security Analysis of the proposed scheme and comparisons with others The proposed scheme is a mutual authentication scheme Lemma1. The proposed scheme correctly authenticates a legal user U. Proof:E can generate in step(5),s.t. ,E can be authenticated successfully in step(6).Thus,

Lemma2. The proposed scheme correctly authenticates Server S (with the SC in it). Proof: If the SC knows the secret key SKSC,it can decrypt C2 to obtain ru and calculate the session key user U calculates the session key Thus,the session keys Ksu and Kus are the same value. Theorem 3. The proposed scheme is a mutual authentication scheme.(Lemma1,2)

The proposed scheme is a secure scheme The key exchange scheme is secure if the following requirements are satisfied: If both participants honestly execute the scheme then the session key is K=Ksu = Kus. No one can calculate the session key except participants(U and SC in the Server S) The session key is indistinguishable from a truly random number.

Lemma 4. The proposed scheme satisfies the first requirement. Proof: Lemma 5. The proposed scheme satisfies the second requirement. Proof: (The random number ru is selected by user and encrypted by ) Lemma 6. The proposed scheme satisfies the third requirement Proof: ru,rs are two random numbers selected by user U and the SC The session key K is also a random number.

Comparisons with other schemes the proposed scheme, which uses only one server, is more practical in feasibility. It has mutual authentication and key agreement process, which makes it more robust in security than past schemes.

Conclusions and Future Work The proposed scheme is more practical than previous PIR k-server schemes and it has mutual authentication and key agreement process. It can not only apply in the environment mentioned above, but also other applications which need the privacy of users on the internet(e.g:e-voting).

Thank You !