Private Information Retrieval

PCC retrieves records from servers outside its trust boundary without revealing which records a request selects.

Overview

PCC uses Private Information Retrieval (PIR) to perform searches of databases hosted outside the PCC High-security inference. This helps ensure that the content of queries is not revealed to those servers.

PIR fundamentals

We implemented a PIR scheme using the swift-homomorphic-encryption library, following the blueprint of the SimplePIR protocol. Security relies on the computational hardness of the Ring Learning With Errors (RLWE) problem. In this hint-based scheme, the server provides a hint derived from the database to enable efficient query processing with lower latency. The parameters we selected provide at least 128 bits of classical and quantum security.

PIR databases are represented as an indexed collection of records, and PIR enables retrieval of records at specific indices while maintaining query privacy. The structure and content of these databases are application-specific. For example, the Visual Lookup workflow uses PIR to search databases of visual-entity embeddings.

PIR queries are cryptographically constructed so the server processes queries without learning the target indices. This construction requires the server to process the entire database to retrieve a record, trading computational overhead for query privacy.

PIR in PCC architecture

PCC Agent uses PIR as one of the ways it Extending workflows with tools: when a workflow needs a record from a database outside the trust boundary, PCCAgentKit offloads the PIR lookup to a Delegated tool calls, which performs the operation and returns the result to the calling workflow.

Hint preprocessing

The hint-based PIR scheme requires preprocessed data derived from the database for efficient query processing. Cloud asset distribution on the worker node maintains an up-to-date version of this hint data, making it available to cb_jobhelper instances.

CloudBoard subscribes to update notifications when new PIR assets become available. Upon such a notification, it relaunches the cb_jobhelper and application instances from the process pool, prewarming them with the updated hints and parameters.

cb_jobhelper records the hint asset metadata in the Request execution log at the start of every request it handles, so a PIR query’s hints are identifiable even though the query itself adds no entry. The cryptographic privacy guarantee of PIR remains intact even with malicious hint data: a malicious hint can produce incorrect query results, but doesn’t reveal which database index the query accessed.

Request flow

Once PCCAgentWorker receives the database index to retrieve, the PIR query preparation and execution begin:

  1. cloudboardd manages a pool of cb_jobhelper instances that sample fresh PIR secret keys at startup.

  2. cloudboardd selects a cb_jobhelper instance from the process pool to handle the PIR request. An instance serves one request, so the key it sampled at startup is the key for that request alone.

  3. cb_jobhelper uses the CipherMLSE framework to prepare the PIR request. CipherMLSE calls swift-homomorphic-encryption to generate the encrypted PIR query using the secret key.

  4. cb_bridged, a Outbound requests to external services, transmits the encrypted PIR query to the external PIR server.

  5. The PIR server processes the query homomorphically and returns an encrypted response without learning which database index the query accessed.

  6. cb_jobhelper receives and decrypts the encrypted response using CipherMLSE and swift-homomorphic-encryption with the secret key and hint.

  7. cb_jobhelper passes the result back to the PCCAgentWorkerApp through XPC.

  8. The cb_jobhelper process terminates, discarding the secret key and all other intermediate values.

Security properties

PIR provides several security and privacy properties:

Security parameter verification

The system distributes PIR security parameters to PCC nodes as Cloud asset distribution. Before processing queries, cb_jobhelper uses swift-homomorphic-encryption to verify that the provided parameters meet the required 128-bit quantum security threshold. This verification provides defense-in-depth against misconfigured or downgraded security parameters.

Per-request key isolation

A dedicated cb_jobhelper process handles each PIR request and samples a fresh PIR secret key for that specific request. When the cb_jobhelper process terminates after completing the PIR operation, it automatically discards the secret key. This architectural isolation provides forward and backward secrecy.

Query privacy

The PIR protocol helps ensure that the database server cannot determine which index was accessed. This privacy guarantee is based on the computational hardness of the RLWE problem. Even if the PIR server is compromised or malicious, it should not learn the requested indices.

Query verification

cb_jobhelper helps ensure PIR queries are properly generated using CipherMLSE before transmission, preventing improperly implemented workflows from generating incorrect PIR queries that might reveal the database index.