Resizable Tree-Based Oblivious RAM

Abstract

Although newly proposed, tree-based Oblivious RAM schemes are drastically more efficient than older techniques, they come with a significant drawback: an inherent dependence on a fixed-size database. Yet, a flexible storage is vital for real-world use of Oblivious RAM since one of its most promising deployment scenarios is for cloud storage, where scalability and elasticity are crucial. We revisit the original construction by Shi et al. [17] and propose several ways to support both increasing and decreasing the ORAM’s size with sublinear communication. We show that increasing the capacity can be accomplished by adding leaf nodes to the tree, but that it must be done carefully in order to preserve the probabilistic integrity of data structures. We also provide new, tighter bounds for the size of interior and leaf nodes in the scheme, saving bandwidth and storage over previous constructions. Finally, we define an oblivious pruning technique for removing leaf nodes and decreasing the size of the tree. We show that this pruning method is both secure and efficient.

T. Moataz—Work done while at Northeastern University.

T. Moataz and T. Mayberry—Both are first authors.

A Proof: Oblivious Permute-and-Merge

Lemma A1

Given two buckets with maximum size k and load m and n respectively, over the random configurations of those buckets, Algorithm 1 will output a uniformly random permutation which is independent of m and n.

Proof

We can determine the probability of a particular permutation $\pi$ being chosen, given m and n, with a counting argument. It will be equal to

$$\begin{aligned} \dfrac{\#\text { of configurations for which } \pi \text { is a valid permutation}}{\text {total }\# \text {of configurations } \times \#\text { of valid permutations for a given configuration}} \end{aligned}$$

The number of configurations for which $\pi$ is a valid permutation depends on m and n, but not on $\pi$ itself. This can be seen if you consider that applying the permutation to a fixed configuration of the bucket simply creates another, equally likely configuration. The number of configurations for the sibling bucket that will “match” with that bucket are exactly the same no matter what the actual configuration of the first bucket is. Knowing this, combined with the fact that the probabilities must sum to one, tells us immediately that every permutation is equally likely. However, we can continue and express the total quantity for our first expression as

$$\begin{aligned} {k \atopwithdelims ()m}{k - m \atopwithdelims ()n} \end{aligned}$$

This can be thought of as choosing the m full slots for one bucket freely and then choosing the n full slots in the second bucket to line up with the free slots in the already chosen first bucket. The number of valid permutations per configuration can equally be determined via a counting argument as

$$\begin{aligned} {k - m \atopwithdelims ()n} \cdot (k-n)! \cdot n! \end{aligned}$$

That is, choosing free slots for the n elements in the second bucket and then all permutations of those elements times the permutations of the free blocks. That gives us a final expression for the probability of choosing permutation $\pi$ of

$$\begin{aligned} \dfrac{{k \atopwithdelims ()m}{k - m \atopwithdelims ()n}}{{k \atopwithdelims ()m}{k \atopwithdelims ()n}{k - m \atopwithdelims ()n}\cdot (k-n)! \cdot n!} \end{aligned}$$

(7)

With some algebraic computations, we can show that the Eq. 7 can be simplified to $\frac{1}{k!}$. That is, this shows that the number of permutations, for any random distribution of load in a bucket, is independent of the current load. Again, since this does not depend on $\pi$ (but only on the size of the bucket), every permutation must be equally likely over the random configurations of the buckets.    $\square$

Corollary A1

A permutation $\pi$ chosen by Algorithm 1 gives no information about the load of the buckets being merged.

Proof

By our above lemma, independent of the load each permutation is chosen uniformly over the configurations of the two buckets. Therefore the permutation cannot reveal any information about the load.    $\square$