Weighted Oblivious RAM, with Applications to Searchable Symmetric Encryption

International audienceExisting Oblivious RAM protocols do not support the storage of data items of variable size in a non-trivial way. While the study of ORAM for items of variable size is of interest in and of itself, it is also motivated by the need for more performant and more secure Searchable Symmetric Encryption (SSE) schemes. In this article, we introduce the notion of weighted ORAM, which supports the storage of blocks of different sizes. In a standard ORAM scheme, each data block has a fixed size B. In weighted ORAM, the size (or weight) of a data block is an arbitrary integer wi ∈ [1, B]. The parameters of the weighted ORAM are entirely determined by an upper bound B on the block size, and an upper bound N on the total weight wi of all blocks-regardless of the distribution of individual weights wi. During write queries, the client is allowed to arbitrarily change the size of the queried data block, as long as the previous upper bounds continue to hold. We introduce a framework to build efficient weighted ORAM schemes, based on an underlying standard ORAM satisfying a certain suitability criterion. This criterion is fulfilled by various Tree ORAM schemes, including Simple ORAM and Path ORAM. We deduce several instantiations of weighted ORAM, with very little overhead compared to standard ORAM. As a direct application, we obtain efficient SSE constructions with attractive security properties