Quantum Inf Process (2015) 14:4201–4210 DOI 10.1007/s11128-015-1091-0 Enhancing user privacy in SARG04-based private database query protocols Fang Yu1 · Daowen Qiu2,3 · Haozhen Situ4 · Xiaoming Wang1 · Shun Long1 Received: 24 June 2015 / Accepted: 4 August 2015 / Published online: 15 August 2015 © Springer Science+Business Media New York 2015 Abstract The well-known SARG04 protocol can be used in a private query applica- tion to generate an oblivious key. By usage of the key, the user can retrieve one out of N items from a database without revealing which one he/she is interested in. How- ever, the existing SARG04-based private query protocols are vulnerable to the attacks of faked data from the database since in its canonical form, the SARG04 protocol lacks means for one party to defend attacks from the other. While such attacks can cause significant loss of user privacy, a variant of the SARG04 protocol is proposed in this paper with new mechanisms designed to help the user protect its privacy in private query applications. In the protocol, it is the user who starts the session with the database, trying to learn from it bits of a raw key in an oblivious way. An honesty test is used to detect a cheating database who had transmitted faked data. The whole private query protocol has O(N) communication complexity for conveying at least N encrypted items. Compared with the existing SARG04-based protocols, it is efficient in communication for per-bit learning. B Daowen Qiu [email protected] Fang Yu [email protected] Haozhen Situ [email protected] 1 Department of Computer Science, Jinan University, Guangzhou 510632, China 2 Department of Computer Science, Sun Yat-sen University, Guangzhou 510006, China 3 The Guangdong Key Laboratory of Information Security Technology, Sun Yat-sen University, Guangzhou 510006, China 4 College of Mathematics and Informatics, South China Agricultural University, Guangzhou 510642, China 123 4202 F. Yu et al. Keywords Quantum private database query · User privacy · SARG04-based 1 Introduction In a private database query (PDQ) application, the user tries to retrieve one item from a database without revealing which item he/she is interested in. This is modeled in the classical scheme symmetrically private information retrieval (SPIR) [1] as the user querying the database A one of its N items, say A j (assumed to be a bit generally, j ∈[N]), while keeping not only the value of j private (user privacy) but also all Aks(k = j) private (data privacy). For such a query task, advantages in communication efficiency can be obtained by the usage of quantum resources [2–4]. There is an exponential reduction in the communication complexity with respect to the best classical SPIR protocol proposed so far [5–7]. However, these protocols compromise security for communication effi- ciency. For example, a cheating database may learn j with a probability a half or more probability, simply by applying a projective measurement on the system [2–4]. Even worse, the cheat may never be detected because there are no means provided for the user to detect the cheat in the canonical forms of some protocols [3,4]. Other quantum SPIR (QSPIR) protocols address more concerns about security than communication efficiency [8–11]. Among them, [9–11] construct QSPIR pro- tocols based on a QKD protocol. The latter is widely thought to offer unconditional security in communication between two parties. By encrypting the items with the key generated by the QKD protocol, better bipartite privacy is obtained. Another advan- tage of this approach is that the research on QKD implementations is progressing very fast, which see that many QKD protocols are realized in practical settings. This will also benefit QSPIR applications in their realization. Out of these concerns, it deserves more attention in future research on finding better QSPIR solutions based on existing QKD schemes. The PDQ protocol [9] is the first QKD-based protocol constructed from the well- known SARG04 QKD scheme [12]. As a bit-learning module, the SARG04 protocol runs first, during which the user tries to learn part of a raw key of the database without revealing which part he/she has learnt. Then, the key is post-processed, with ideally a single bit known to the user. Finally, the oblivious key can be used to encrypt the item values, exactly one of which can be decrypted by the user. In the bit-learning process of the PDQ protocol, the privacy of both parties is guaranteed by the security of the SARG04 protocol. In a QKD application, the two parties, as partners, cooperate to share a key, only with a need to defend against a third party. The SARG04 scheme is secure for both parties to defend against outside attacks in such an application. In a private query application, however, both parties, as adversaries, would like to gain as much information about the other party. So the security of the scheme must be re-evaluated with respect to dishonest parties in such a scenario. The communication of the SARG04 protocol is one way, during which the user can only accept messages from the database compulsively. This makes it convenient for the database to invade user privacy but difficult for the user to defend against attacks from 123 Enhancing user privacy in SARG04-based private database... 4203 the database in a private query application. In fact, the database can gain a big amount of information about user privacy in the bit-learning process of the PDQ protocol via easy methods such as data forging. Moreover, from the forged data the user would make wrong derivations, which might produce wrong answers to his/her queries in the subsequent process. To avoid producing wrong answers and leaking significant information in the query, the scheme must be revised on its bit-learning mechanisms in order to help the user detect such cheats. The Yang’s protocol [11] is recently proposed based on a variation of the SARG04 protocol. It reduces the cost of quantum bits by usage of classical bits and therefore has an advantage over the PDQ protocol in communication. In its bit-learning process, the database always sends one same state to the user, who makes a choice on which messages to transmit to the database next. So, the communication is two way. But as there exists deficiency in the mechanism, the database still can forge the signal and user privacy can be invaded more seriously, even if the user can decide what messages to deliver to its adversary. In this paper, we propose a variant of the SARG04 protocol, which can be used in a SPIR application to enhance user privacy. The bit-learning mechanism is designed to prevent the user from being attacked by faked data in such an application. In this proposed protocol, it is the user who starts the session with the database by sending a state of his/her own choice. A dishonest database may make use of the faked data so as to invade user privacy, but an honesty test is performed subsequently to reveal its dishonest activities. In the meanwhile, as a wrong answer to his/her query might be produced, the user would not take cheats in such a scheme despite that he/she can gain some information from the cheats. Furthermore, the protocol improves its efficiency in communication by reducing the usage of both quantum and classical bits. The rest of the paper begins with a brief introduction to the PDQ protocol and the Yang’s protocol in Sect. 2. Security breaches on user privacy are stated. In Sect. 3, we describe our SPIR scheme in detail with a tabular form presenting the data in its bit-learning process. It is followed by an assessment in its communication perfor- mance in comparison with the existing SARG04-based protocols. The attacks from the adversaries, especially from the database, are addressed, and the security of the protocol against such attacks is analyzed in Sect. 4. Finally, in Sect. 5, we conclude with a summary of our results. 2 Related works In this subsection, we review two main works, including the PDQ protocol [9] and the Yang’s protocol [11]. The former inherits the SARG04 protocol directly as its bit-learning module and the latter uses one of its variation. Below we briefly describe their mechanisms on bit learning and follow tables to present the data. Suppose that the database initially owns a raw key which is a bit string and tries to commit one of the bits bi to the user in an oblivious way in the process. 123 4204 F. Yu et al. 2.1 The bit-learning process of the PDQ protocol In the beginning of the bit-learning process of the PDQ protocol, the database sends the user randomly one of the four basis states |↑, |↓, |→, |←of a single-qubit space. Both |←and |→(or the ↔ basis) represent a bit 1, and both |↑and |↓(or the basis) represent a bit 0(|↔= √1 (|↑±|↓)). Suppose that |↑ 2 was sent, then a pair of states, including the delivered real state |↑and one mask state in the other basis, say, |→, will be announced by the database. See row 5 in Table 1. On receiving the state, the user measures it in randomly one of the two basis. Based on the outcome of his/her measurement along with the announcement of the database, the user tries to derive the value of bi . He/she can only derive bi as 1 “unknown” (represented as “X” in the forms) unless (with a probability of 4 ) he/she has chosen the basis ↔ and measured |←.