Robust low-delay Streaming PIR using convolutional codes

Video traffic has had an explosive growth and it is expected to keep its exponential growth in the coming years [1]. Service providers for real-time video streaming are typically hosted in a public cloud, with multiple servers in different data centers, e.g. Google Cloud, Amazon CloudFront and Microsoft Azure. These cloud services aim for private and low-latency communications.

The problem of Private Information Retrieval (PIR) has attracted a lot of attention in the recent years and studies how to retrieve a file from a storage system without revealing the desired file to the servers. It was initially addressed for replicated files [7] and recently for coded files [6, 8, 13, 16, 17]. In this last setting, the general model of the information theoretic PIR problem is as follows. Let a coded database be contained in $n$ servers storing $m$ files and assume that the user knows the content of the servers. Each file is coded and stored independently using the same code and the user wants to retrieve a particular file from the database with zero information gain from the servers, i.e., the user wants information theoretic privacy [19]. Recently, the literature on PIR models has grown considerably with extensions for more general PIR models with several additional constraints. Most of the efforts in private retrieval have focused on efficient schemes that optimize different metrics, such as communication cost or rate. However, in many cases some of the servers may be busy and do not respond within a desirable time frame or network failures may occur. For this reason, new robust schemes were proposed in order to deal with such scenarios [19, 18] adding redundancy to tolerate certain missing files from the servers. PIR schemes on coded data for Byzantine or unresponsive servers were presented in [21, 18]. These schemes are suited for retrieving one single file and therefore use block codes. In [10] a scheme for sequential retrieving was proposed but again for a given set of files of fixed size and assuming that all the responses of the servers are lost at the same time instant. The case of a non-bursty channel is also considered in this paper but only using unit memory convolutional codes. However, to the best of the author’s knowledge, the problem of low-delay private retrieval of a stream of files (of undetermined length) with some low or unresponsive servers remains unexplored.

In this work we investigate this more general problem and propose a novel robust scheme to deal with low-delay streaming retrieval of files from $n$ servers in the presence of possible unresponsive servers by using Maximum Distance Profile (MDP) convolutional codes. This class of codes is suitable for low-delay streaming applications as they possess optimal error-correcting capabilities within a decoding window, see [5, 20]. One of the advantages of using convolutional codes over block codes is the sliding window flexibility that allows to select different decoding windows according to the erasure pattern. We show how to take advantage of this property to provide robust PIR in this context. We present a scheme that is able to stream files consisting of many stripes in the presence of erasures without assuming any particular structure in the sequence of erasures. The model in [10] treated burst erasure channels using general convolutional codes and the non-bursty channel case was treated using unit memory convolutional codes. Unit memory codes are restricted to store only what occurred in the previous instant and therefore are far from optimal for low-delay applications when the given delay constraint is larger than one. Note also that when only burst erasure channels are assumed, there exist concrete constructions of convolutional codes that are optimal in such a context [5, 4, 14]. In this work we extend this thread of research and consider a non necessarily bursty channel using convolutional codes with no restriction in the memory, namely, MDP convolutional codes. In contrast to [10], where the response of the servers is built in a convolutional fashion but the storage code is still a block code, we also use a convolutional code to store the files on the servers.

In this section we recall basic material and introduce the definitions needed for this work, including the notion of convolutional code and superregular matrix. Let $\mathbb{F}=\mathbb{F}_{q}$ be a finite field of size $q$ and $\mathbb{F}[z]$ be the ring of polynomials with coefficients in $\mathbb{F}$.

Convolutional codes process a continuous sequence of data instead of blocks of fixed vectors as done by block codes. If we introduce a variable $z$, called the delay operator, to indicate the time instant in which each information arrived or each codeword was transmitted, then we can represent the sequence message $(\boldsymbol{v}_{0},\boldsymbol{v}_{1},\cdots,\boldsymbol{v}_{l})$ as a polynomial vector $\boldsymbol{v}(z)=\boldsymbol{v}_{0}+\boldsymbol{v}_{1}z+\cdots+\boldsymbol{v}_{l}z^{l}$. Formally, we can define convolutional codes as follows.

A rate $k/n$ convolutional code $\mathcal{C}$ [20] is an $\mathbb{F}[z]$-submodule of $\mathbb{F}[z]^{n}$ with rank $k$ given by

where $G(z)\in\mathbb{F}[z]^{k\times n}$ is a matrix, called generator matrix, that is basic, i.e., $G(z)$ has a polynomial right inverse.

Note that if $\boldsymbol{v}(z)=\boldsymbol{u}(z)G(z)$, with

then,

The maximum degree of all polynomials in the $j$-th row of $G(z)$ is denoted by $\delta_{j}$. The degree $\delta$ of $\mathcal{C}$ is defined as the maximum degree of the full size minors of $G(z)$. We say that $\mathcal{C}$ is an $(n,k,\delta)$ convolutional code [15]. Important for the performance of a code in terms of error-free decoding is the (Hamming) distance between two codewords. In the case of convolutional codes, the most relevant notion of distance for low-delay decoding is the column distance that can be defined as follows.

The $\mathbf{j}$-th column distance [11] is defined as

where $\boldsymbol{v}_{[0,j]}(z)=\boldsymbol{v}_{0}+\boldsymbol{v}_{1}z+\cdots+\boldsymbol{v}_{j}z^{j}$ represents the $j$-th truncation of the codeword $\boldsymbol{v}(z)\in\mathcal{C}$ and

where $\text{wt}(\boldsymbol{v}_{i})$ is the Hamming weight of $\boldsymbol{v}_{i}$, which determines the number of nonzero components of $\boldsymbol{v}_{i}$, for $i=1,\ldots,j$. For simplicity, we use $d_{j}^{c}$ instead of $d_{j}^{c}(\mathcal{C})$.

The $j$-th column distance is upper bounded [9] by

and the maximality of any of the column distances implies the maximality of all the previous ones, that is, if $d_{j}^{c}=(n-k)(j+1)+1$ for some $j$, then $d_{i}^{c}=(n-k)(i+1)+1$ for all $i\leq j$. The value

is the largest value for which the bound can be achieved and an $(n,k,\delta)$ convolutional code $\mathcal{C}$ with $d_{L}^{c}=(n-k)(L+1)+1$ is called a maximum distance profile (MDP) code [9]. Hence, MDP codes have optimal error correcting capabilities within time intervals and therefore are ideal for low delay correction. In this work we shall assume that the retrieval must be performed within a given delay constraint $\Delta\leq L$, see [2, 5].

Assume that

and consider the associated sliding matrix

with $G_{j}=0$ when $j>\mu$, for $j\in\mathbb{N}$.

Considering the proof of this theorem, one sees that the recovery is even possible within a delay of $j$ windows of size $n$ and that the given condition for complete recovery is only sufficient but not necessary.

We will develop a PIR scheme in which the star product of certain block codes plays an important role.

Star product PIR was first introduced in [8]. The main idea of this scheme is to design the queries to the different servers in such a way that if the responses are formed as inner products of the query and the stored information, then the total response is a codeword of a certain star product code with some error, where the error contains the information one is interested in. In [10] this scheme was adopted forming the responses in a convolutional way. In the following section, we present a star product scheme where the responses as well as the storage code are convolutional.

We have $m$ sequences of files $(X_{s}^{i})_{s\in\mathbb{N}}$ with $X_{s}^{i}\in\mathbb{F}^{k}$ for $i=1,\ldots,m$ and $s\in\mathbb{N}$. These are encoded with an $(n,k,\delta)$ MDP convolutional code $\mathcal{C}$ with generator matrix $G(z)=\sum_{r=0}^{\mu}G_{r}z^{r}$ to obtain the sequences of files $(Y_{t}^{i})_{t\in\mathbb{N}}$ with $Y_{t}^{i}=\sum_{r+s=t}X_{s}^{i}G_{r}\in\mathbb{F}^{n}$ for $i=1,\ldots,m$ and $t\in\mathbb{N}$ where we set $G_{r}=0$ for $r>\mu$. Moreover, we have $n$ servers and for $j=1,\ldots,n$, we store the $j$-th component $Y_{t,j}^{i}$ of each vector $Y_{t}^{i}$ (for $i=1,\ldots,m$, $t\in\mathbb{N}$) on server number $j$. Furthermore, we assume that $(\mu+2)k\leq n$ and that for $f=1,\ldots,\mu$, $\begin{pmatrix}G_{0}\\ \vdots\\ G_{f}\end{pmatrix}$ is the generator matrix of an $[n,(f+1)k]$ MDS block code denoted by $\mathcal{C}_{f}$ . We will present a construction for an $(n,k,\delta)$ MDP convolutional code with these properties later in this paper. It holds $Y_{t}^{i}\in\mathcal{C}_{f}$ for all $f\in\{t,\ldots,\mu\}$ and $Y_{t}^{i}\in\mathcal{C}_{\mu}$ for $t\geq\mu$. Thus, we set $\mathcal{C}_{f}=\mathcal{C}_{\mu}$ for $f\geq\mu$.

The user wants to stream the sequence $(X_{s}^{i})_{s\in\mathbb{N}}$ for some $i$ without the servers knowing $i$, i.e. without that the servers know which sequence he or she is streaming. For our PIR scheme we assume that there is no collusion between the servers (i.e. the number of colluding servers, usually denoted by $t$ in the literature is equal to $1$).
Set $d=[1\ \ldots\ 1]\in\mathbb{F}^{n}$, let $\mathcal{D}$ be the $[n,1]$ block code generated by $d$ and $D\in\mathbb{F}^{(\mu+1)m\times n}$ be a matrix whose rows are constituted by $(\mu+1)m$ random codewords of $\mathcal{D}$ (i.e. multiples of $d$). For a subset $J\subset\{1,\ldots,n\}$, we denote by $E\in\mathbb{F}^{n}$ the vector with entries $E_{j}:=\begin{cases}1&\text{if}\ j\in J\\ 0&\text{otherwise}\end{cases}$ and we denote by $e_{j}$ the $j$-th standard basis vector of $\mathbb{F}^{(\mu+1)m}$.
For $j=1,\ldots,n$, we send the following query $q_{j}^{i}$ to server $j$:

where $D_{\cdot,j}$ denotes the $j$-th column of $D$. We write $q_{j}^{i}=\begin{pmatrix}q_{j,1}^{i}\\ \vdots\\ q_{j,\mu+1}^{i}\end{pmatrix}$ with $q_{j,k}^{i}\in\mathbb{F}^{m\times 1}$ for $k=1,\ldots,\mu+1$ and $Y_{t,j}:=(Y^{1}_{t,j},Y^{2}_{t,j},\ldots,Y^{m}_{t,j})\in\mathbb{F}^{m}$.
The response of server $j$ at time $t\in\mathbb{N}$ is

where $Y_{r,j}=0$ for $r\not\in\mathbb{N}$.
Hence the total response at time $t\in\mathbb{N}$ is given by

where diag(E) denotes the diagonal matrix with diagonal entries equal to the entries of the vector $E$.

By Definition 4 and the definition of the code $\mathcal{D}$ the star product code $\mathcal{D}\ast\mathcal{C}_{t}$ is equal to the MDS code $\mathcal{C}_{t}$. As $\mathcal{D}\ast\mathcal{C}_{t}$ is a linear code, any sum of codewords is again a codeword. Hence, the response has the form

for some $c_{t}\in\mathcal{C}_{t}$.

We assume that it is possible that some parts of the response at time $t$ get lost during transmission and could not be received. Hence the vector $r_{t}^{i}$ could have some erased components. We denote by $T_{t}\subset\{1,\ldots,n\}$ the set that consists of the positions of the erased components of the vector $r_{t}^{i}$.

For each $t\in\mathbb{N}$ for which the condition of the preceding lemma is not fulfilled we are not able to obtain $diag(E)\sum_{l=0}^{\mu}Y^{i}_{t-l}$. Therefore, we define

where $0_{n}$ denotes the $n\times n$ zero matrix.

It remains to show how to obtain the desired sequence of files $(X_{s}^{i})_{s\in\mathbb{N}}$ from the sequence $(diag_{t}(\hat{E})\sum_{l=0}^{\mu}Y^{i}_{t-l})_{t\in\mathbb{N}}$. With the definitions $\hat{r}^{i}_{t}:=\sum_{l=0}^{\mu}Y^{i}_{t-l}$ and

one obtains

Denote by $I_{k}\in\mathbb{F}^{k\times k}$ the identity matrix and set $U\!:=\!\!\left[\begin{array}[]{cccc}I_{k}&\cdots&I_{k}&\\ &I_{k}&\cdots&I_{k}\\ &\qquad\ \ddots&&\qquad\ \ddots\end{array}\right]$ where each block of $k$ rows of $U$ contains $\mu+1$ identity matrices. Then, one has

Therefore, one obtains the following lemma.

Hence, we could use equation (12) to obtain $[diag_{1}(\hat{E})\hat{r}^{i}_{1},diag_{2}(\hat{E})\hat{r}^{i}_{2},\ldots]$ via erasure decoding with an MDP convolutional code where the set of positions of the total erasures denoted by $T$ has the form $T=\bigcup_{t\in\mathbb{N}}S_{t}$ with

where for $J=\{j_{1},\ldots,j_{|J|}\}$, the set $\{J+(t-1)n\}$ is defined as
$\{j_{1}+(t-1)n,\ldots,j_{|J|}+(t-1)n\}$ and $\{T_{t}+(t-1)n\}$ should be defined analogous. Hence, using also Theorem 3, we get the following theorem.

From this theorem we could deduce which erasure patterns we can correct for sure with our proposed scheme.

Finally, we have to choose the cardinality of the set $J\subset\{1,\ldots,n\}$. Then, the set $J$ is chosen randomly with this fixed cardinality. If the cardinality of $J$ is larger, this leads to more erasures for $\mathcal{C}_{t}$ to correct. But in turn if the cardinality of $J$ is smaller, this leads to more erasures for $\mathcal{C}$ to correct. To balance this somehow, we want to determine $|J|$ such that the number of erasures one could correct in positions $\{1+(t-1)n,\ldots,n+(t-1)n\}\setminus\{J+(t-1)n\}$ is approximately the same as the number of erasures one could correct in positions $\{1+(t-1)n,\ldots,n+(t-1)n\}\cap\{J+(t-1)n\}$. We denote this number of erasures by $n_{t}$. This approach leads to the following equations:

This implies

and consequently,

Having equality in this last equation, implies $|J|=\frac{1}{2}(n-k\min\{\mu,t\})$. However, we need $|J|$ to be an integer and independent of $t$. As depending on the erasure pattern, the MDP convolutional code $\mathcal{C}$ might be able to correct more erasures than (20) indicates, we propose to rather choose $|J|$ smaller, which finally leads to

Of course, depending on the erasures that occur during transmission, other choices for $|J|$ could lead to a better performance. However, as we do not know the erasure pattern before transmission and we have to choose $J$ before, we cannot adapt $J$ corresponding to the erasure pattern but have to choose it in a way that the numbers of channel erasures our codes $\mathcal{C}_{t}$ and $\mathcal{C}$ are able to tolerate are balanced.

Note that we can correct more erasures in $r_{t}^{i}$ if $t$ is small (as the code $\mathcal{C}_{t}$ has a larger minimum distance if $t$ is small). This means that we could tolerate slightly more erasures at the beginning of the stream than at the end.

In the following, we illustrate the erasure correcting capability of our scheme with the help of two examples.

The aim of this section is to provide constructions for $(n,k,\delta)$ MDP convolutional codes $\mathcal{C}$, which have the additional property that, for $f=1,\ldots,\mu$, $\mathcal{C}_{f}$ is an $[n,(f+1)k]$ MDS block code, as proposed at the beginning of the previous section. To this end, we will use the following lemma and proposition.

The following theorem gives the desired construction.

We have studied the problem of private streaming of a sequence of files having the resilience against unresponsive servers the primary metric for judging the efficiency of a PIR scheme. We proposed for the first time a general scheme for such a problem. This scheme is based on MDP convolutional codes and the star product of codes. It suits for a context where some servers fail to respond in contrast to other solutions considered in the literature where all the servers were assumed to fail at the same time instant. The approach presented can retrieve files in a sequential fashion and therefore is optimal for low-delay streaming applications. Some examples were presented to show how to take advantage of the proposed scheme. We derived a large set of erasure patterns that our codes can recover. Concrete constructions of such codes exist although large field sizes are required. The construction of optimal codes for PIR over small fields that can deal with both burst and isolated erasures/errors is an interesting open problem that requires further research.

The work of the first and third author was supported by the Portuguese Foundation for Science and Technology (FCT-Fundação para a Ciência e a Tecnologia), through CIDMA - Center for Research and Development in Mathematics and Applications, within project UID/MAT/04106/2019. The first author was supported by the German Research Foundation within grant LI 3101/1-1. The second author was partially supported by Spanish grant AICO/2017/128 of the Generalitat Valenciana and the University of Alicante under the project VIGROB-287.