更强的在线ORAM下限
Stronger Lower Bounds for Online ORAM
摘要：
由Goldreich和Ostrovsky [JACM'96]在软件保护的上下文中引入的不经意RAM（ORAM）旨在混淆由RAM计算引起的存储器访问模式。理想情况下，ORAM的存储器访问模式应该与正在处理的数据无关。由于Goldreich和Ostrovsky的工作，人们认为在任何使用大小为$ n $的内存的ORAM中存在固有的$ Ω(\log n) $带宽开销。Larsen和Nielsen [2018]是第一个给出任何在线ORAM的一般$ Ω(\log n) $下限的人，即，ORAM必须以在线方式处理其输入。在这项工作中，我们重新审视了Larsen和Nielsen的下界，这是在对抗服务器确切地知道哪个服务器访问对应于哪个输入操作的假设下证明的。我们给出了一个$Ω(\log n) $下界的带宽开销的任何在线ORAM，即使对手没有访问这些信息。对于ORAM的许多已知构造，该信息被隐式地提供，因为每个输入操作引起大致相同长度的访问序列。因此，它们服从Larsen和Nielsen的下界。我们的研究结果排除了更广泛的一类构造，具体来说，它们意味着混淆输入操作之间的边界无助于构建更有效的ORAM。作为我们的主要技术贡献，并处理缺乏结构，我们研究自然引起的存储器访问模式的ORAM计算的访问图的属性。我们确定了一个特定的图形属性，可以有效地测试，所有的访问图的ORAM计算必须满足高概率。这个性质让人想起Larsen-Nielsen性质，但它的结构性要少得多;也就是说，它更通用。
英文摘要：
Oblivious RAM (ORAM), introduced in the context of software protection by Goldreich and Ostrovsky [JACM'96], aims at obfuscating the memory access pattern induced by a RAM computation. Ideally, the memory access pattern of an ORAM should be independent of the data being processed. Since the work of Goldreich and Ostrovsky, it was believed that there is an inherent $ Ω(\log n) $ bandwidth overhead in any ORAM working with memory of size $ n $. Larsen and Nielsen [CRYPTO'18] were the first to give a general $ Ω(\log n) $ lower bound for any online ORAM, i.e., an ORAM that must process its inputs in an online manner. In this work, we revisit the lower bound of Larsen and Nielsen, which was proved under the assumption that the adversarial server knows exactly which server accesses correspond to which input operation. We give an $Ω(\log n) $ lower bound for the bandwidth overhead of any online ORAM even when the adversary has no access to this information. For many known constructions of ORAM this information is provided implicitly as each input operation induces an access sequence of roughly the same length. Thus, they are subject to the lower bound of Larsen and Nielsen. Our results rule out a broader class of constructions and specifically, they imply that obfuscating the boundaries between the input operations does not help in building a more efficient ORAM. As our main technical contribution and to handle the lack of structure, we study the properties of access graphs induced naturally by the memory access pattern of an ORAM computation. We identify a particular graph property that can be efficiently tested and that all access graphs of ORAM computation must satisfy with high probability. This property is reminiscent of the Larsen-Nielsen property but it is substantially less structured; that is, it is more generic.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
