An Oblivious Image Retrieval Protocol

We consider the novel problem of oblivious retrieval of images from an outsourced database server. Due to the complexity of managing images, in modern enterprise networks, individual users and organizations are using the services of external servers to store the images. The problem is to query and retrieve images while simultaneously satisfying the criteria of both the user and the database privacy. Oblivious transfer protocols are capable of ensuring the privacy of both the user and the server privacy at the same time. But in their native form, oblivious transfer protocols may not be suitable for querying and retrieving images due to the large size of the images. In this paper, we describe the first such attempt to develop an oblivious retrieval protocol that can achieve the goals of user and database privacy. which allows the user to query for the images of interest. In this phase, the database server does not know the exact user query and the user does not learn of any other images in the database. In the next phase, the user deploys an oblivious transfer protocol to retrieve the necessary decryption for the selected images without revealing the actual set of decryption keys selected. We have evaluated our protocol using an experimental setting and show that the results are a reasonable trade-off when compared to the security requirements being satisfied. We have implemented a working prototype and tested the protocol on a database of 9000 large real-life images.