Piano: Extremely Simple, Single-server PIR with Sublinear Server Computation

experimental/pir/piano/BUILD.bazel

@@ -0,0 +1,100 @@
+# Copyright 2023 Ant Group Co., Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_cc//cc:defs.bzl", "cc_proto_library")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("//bazel:psi.bzl", "psi_cc_binary", "psi_cc_library", "psi_cc_test")
+
+package(default_visibility = ["//visibility:public"])
+
+proto_library(
+    name = "piano_proto",
+    srcs = ["piano.proto"],
+)
+
+cc_proto_library(
+    name = "piano_cc_proto",
+    deps = [":piano_proto"],
+)
+
+psi_cc_library(
+    name = "util",
+    srcs = ["util.cc"],
+    hdrs = ["util.h"],
+    deps = [
+        "@yacl//yacl/crypto/aes:aes_intrinsics",
+    ],
+)
+
+psi_cc_library(
+    name = "serialize",
+    srcs = ["serialize.h"],
+    deps = [
+        ":piano_cc_proto",
+        ":util",
+        "@yacl//yacl/base:buffer",
+    ],
+)
+
+psi_cc_library(
+    name = "server",
+    srcs = ["server.cc"],
+    hdrs = ["server.h"],
+    deps = [
+        ":piano_cc_proto",
+        ":serialize",
+        ":util",
+        "@yacl//yacl/link:context",
+    ],
+)
+
+psi_cc_library(
+    name = "client",
+    srcs = ["client.cc"],
+    hdrs = ["client.h"],
+    deps = [
+        ":piano_cc_proto",
+        ":serialize",
+        ":util",
+        "@yacl//yacl/crypto/rand",
+        "@yacl//yacl/link:context",
+    ],
+)
+
+psi_cc_test(
+    name = "piano_test",
+    timeout = "eternal",
+    srcs = ["piano_test.cc"],
+    deps = [
+        ":client",
+        ":server",
+        ":util",
+        "@yacl//yacl/crypto/rand",
+        "@yacl//yacl/link:context",
+        "@yacl//yacl/link:test_util",
+    ],
+)
+
+psi_cc_binary(
+    name = "piano_benchmark",
+    srcs = ["piano_benchmark.cc"],
+    deps = [
+        ":client",
+        ":server",
+        ":util",
+        "@com_github_google_benchmark//:benchmark_main",
+        "@yacl//yacl/link:context",
+        "@yacl//yacl/link:test_util",
+    ],
+)

experimental/pir/piano/README.md

@@ -0,0 +1,28 @@
+Piano: Extremely Simple, Single-server PIR with Sublinear Server Computation
+
+论文地址：https://eprint.iacr.org/2023/452
+
+论文开源实现：https://github.com/wuwuz/Piano-PIR-new
+
+**方案概括**
+
+1. 采用特定于客户端的预处理模型（也称为订阅模型），让每个客户端在预处理期间下载并存储来自服务器的“提示”
+
+2. 实现了O(√n)的客户端存储，和O(√n)的在线通信与计算开销（平均到每个查询上）
+3. 服务器是诚实且好奇的，恶意服务器也无法侵害隐私，但会导致查询结果出错
+4. 方案包括两个阶段：预处理阶段和在线查询阶段
+
+**预处理阶段**
+
+1. 服务器将数据库划分为O(√n)个块，客户端**流式**的从服务器获取每块数据，并每次只处理当前块中的元素，包括记录部分数据和计算奇偶校验位
+2. 客户端要存储的“提示”包括三类：主表，替换条目和备份表，主表共有O(√n)个，替换条目和备份表在每个块上要存储
+   O(1)个
+
+**在线查询阶段**
+1. 客户端查询包含x的主表，将主表中的x替换为替换条目中该块的下一个可用元素，发送序列给服务器。服务器计算序列的奇偶校验位并返回，客户端在本地通过异或操作恢复出DB[x]
+2. 主表使用一次后就要丢弃，使用备份表进行替换，同时为了负载均衡，要保留(x，DB[x])
+
+**具体实现**
+1. 客户端不存储完整的序列，而是只存储tag，通过msk和PRF扩展出完整的序列
+2. 每个块都有O(1)个备份表，备份表中该块对应的DB[x]没有参与计算奇偶校验位，以实现快速替换
+3. 本地保存查询记录，当有重复查询时在本地查询，并发送随机序列给服务器