A Fault-Tolerant Approach to Secure Information Retrieval

For any critical information services, there are two fundamental challenges: the protection of users’ privacy and the provision of highly available services. Several schemes for private information retrieval (PIR) were proposed to protect users’ privacy when sensitive information stored in (remote) database servers is accessed. However, all the existing PIR schemes are based on a simple honest-but-curious model, and assume that any attack to the database servers does not change the information and computational results. We present in this paper a novel fault-tolerant scheme (called FT-PIR) both for protecting users’ privacy and ensuring service availability even in the presence of malicious server faults. This scheme does not rely on any unproven cryptographic assumptions and on the availability of tamper-proof hardware. A probabilistic result verification algorithm is introduced into this scheme to detect any corrupted information and incorrect results. We have implemented both the FT-PIR scheme and a typical PIR scheme on a distributed multidatabase system. By conducting a number of experiments in the fault-free case and various fault scenarios, we show that the FT-PIR scheme can preserve users’ privacy effectively and at the same time tolerate server faults including malicious attacks. For example, when three replicated servers were used, only a 6% performance overhead was introduced by FT-PIR in comparison with PIR in the fault-free case. In several fault scenarios, the FT-PIR scheme performs generally better than the PIR − 35.82% less processing time was needed for FT-PIR to tolerate a server fault and to retrieve correct results.