1. Reporter:Chien-Wen Huang
Protecting the Privacy of Users in Retrieving Valuable Information by a PIR Scheme with Mutual Authentication by RSA Signature Algorithm
Date：
Reporter:Chien-Wen Huang
出處:Innovative Computing, Information and Control, ICICIC '07. Second International Conference

2. The proposed PIR scheme
Outline
Introduction 1
Related work 2 3
The proposed PIR scheme
Security Analysis of the proposed
scheme and comparisons with others 4
Conclusions and Future Work 5

3. Private Information Retrieval (PIR)
Introduction
Motivation
As the user query a patent but the server will not know which patent the user queried.
Private Information Retrieval (PIR)
Initial research of PIR was done by Chor et al.(1995)
Beimel proposed several robust PIR schemes.(2004)
Results
A new one-server PIR scheme, with mutual authentication between the user and the server.

4. Computational Private Information Retrieval
Related work
Computational Private Information Retrieval
Chor et al. introduced a c-PIR scheme(from information-theory security to computational security)
Kushilevitz et al. proposed a CPIR scheme based on the quadratic residuosity assumption.
Cachin et al. proposed a CPIR scheme which is based on the -Hiding assumption.

5. Private Information Retrieval Using a Secure Coprocessor (SC)
An SC is a temper-proof device with small memory in it; it is designed to prevent anybody from accessing its memory.
Conquers the problem of CPIR which can only deal with one bit per query.
the communication complexity to O(1).
the server’s computation complexity is still O(n).

6. For the reason of confusing
the server, in the kth query,
the SC must read
previously accessed
records,and one unread
record.

7. The proposed PIR scheme

8. Registering phase: Preprocessing phase: User U calculates
User U computes C1 = and send to SC.
On receiving C1 , the SC decrypts C1with its private key SKSC and then stores to the ID file in server S.
Preprocessing phase:
The preprocessing phase is to produce a shuffled copy of DB in server S and a shuffled index in the SC.

9. Online-query phase:
U selects a ru(a part of the session key)and sends C2= to the SC.
The SC decrypts C2 with its private key SK SC to get IDU and ru.
SC selects a rs random number(another part of the session key)and calculates the session key
,then send C3= to user.
User U calculates the session key
and decrypts (with K’).if the result= ru, user U send to the SC,otherwise not.

10. User calculates C4= and send to SC.
SC checks whether
if the answer is correct then go to next one,else stop the online-query.
SC reads the Ri from the shuffled database according to the shuffled index and sends
User U decrypts with K’.

11. Security Analysis of the proposed scheme and comparisons with others
The proposed scheme is a mutual authentication scheme
Lemma1. The proposed scheme correctly authenticates a legal user U.
Proof:E can generate in step(5),s.t.
,E can be authenticated successfully in step(6).Thus,

12. Lemma2. The proposed scheme correctly authenticates Server S (with the SC in it).
Proof:
If the SC knows the secret key SKSC,it can decrypt C2 to obtain ru and calculate the session key
user U calculates the session key
Thus,the session keys Ksu and Kus are the same value.
Theorem 3. The proposed scheme is a mutual authentication scheme.(Lemma1,2)

13. The proposed scheme is a secure scheme
The key exchange scheme is secure if the following requirements are satisfied:
If both participants honestly execute the scheme then the session key is K=Ksu = Kus.
No one can calculate the session key except participants(U and SC in the Server S)
The session key is indistinguishable from a truly random number.

14. Lemma 4. The proposed scheme satisfies the first requirement.
Proof:
Lemma 5. The proposed scheme satisfies the second requirement.
Proof: (The random number ru is selected by user and encrypted by )
Lemma 6. The proposed scheme satisfies the third requirement
Proof: ru,rs are two random numbers selected by user U and the SC The session key K is also a random number.

15. Comparisons with other schemes
the proposed scheme, which uses only one server, is more practical in feasibility.
It has mutual authentication and key agreement process, which makes it more robust in security than past schemes.

16. Conclusions and Future Work
The proposed scheme is more practical than previous PIR k-server schemes and it has mutual authentication and key agreement process.
It can not only apply in the environment mentioned above, but also other applications which need the privacy of users on the internet(e.g:e-voting).

17. Thank You !