Optimal Oblivious Algorithms for Multi-Way Joins

A (natural) join query can be represented as a hypergraph $𝒬=(𝒱,ℰ)$ [2], where $𝒱$ models the set of attributes, and $ℰ\subseteq 2^{𝒱}$ models the set of relations. Let $\mathrm{dom}(x)$ be the domain of attribute $x\in 𝒱$. An instance of $𝒬$ is a function $ℛ$ that maps each $e\in ℰ$ to a set of tuples $R_e$, where each tuple $t\in R_e$ specifies a value in $\mathrm{dom}(x)$ for each attribute $x\in e$. The result of a join query $𝒬$ over an instance $ℛ$, denoted by $𝒬(ℛ)$, is the set of all combinations of tuples, one from each relation $R_e$, that share the same values in their common attributes, i.e., $𝒬(ℛ)=\{t\in {\displaystyle \prod _{x\in 𝒱}}\mathrm{dom}(x)\mid \forall e\in ℰ,\exists t_e\in R_e,{\pi }_{e}t=t_e\}$.

Let $N={\sum }_{e\in ℰ}|R_e|$ be the input size of instance $ℛ$, i.e., the total number of tuples over all relations. Let $\text{OUT}=|𝒬(R)|$ be the output size of the join query $𝒬$ over instance $ℛ$. We study the data complexity [2] of join algorithms by measuring their running time in terms of input and output size of the instance. We consider the size of $𝒬$, i.e., $|𝒱|$ and $|ℰ|$, as constant.

We consider a two-level hierarchical memory model [40, 18]. The computation is performed within trusted memory, which consists of $M$ registers of the same width. For simplicity, we assume that the trusted memory size is $c\cdot M$, where $c$ is a constant. This assumption will not change our results by more than a constant factor. Since we assume the query size as a constant, the arity of each relation is irrelevant. Each tuple is assumed to fit into a single register, with one register allocated per tuple, including those from input relations as well as intermediate results. We further assume that $c\cdot M$ tuples from any set of relations can fit into the trusted memory. Input data and all intermediate results generated during the execution are encrypted and stored in an untrusted memory of unlimited size. Both trusted and untrusted memory are divided into blocks of size $B$. One memory access moves a block of $B$ consecutive tuples from trusted to untrusted memory or vice versa. The complexity of an algorithm is measured by the number of such memory accesses.

An algorithm typically operates by repeating the following three steps: (1) read encrypted data from the untrusted memory into the trusted memory, (2) perform computation inside the trusted memory, and (3) Encrypt necessary data and write them back to the untrusted memory. Adversaries can only observe the address of the blocks read from or written to the untrusted memory in (1) and (3), but not data contents. They also cannot interfere with the execution of the algorithm. The sequence of memory accesses to the untrusted memory in the execution is referred to as the “access pattern” of the algorithm. In this context, we focus on two specific scenarios of interest:

• $\mathrm{■}$

  Random Access Model (RAM). This model can simulate the classic RAM model with $M=O(1)$ and $B=1$, where the trusted memory corresponds to $O(1)$ registers and the untrusted memory corresponds to the main memory. The time complexity in this model is defined as the number of accesses to the main memory by a RAM algorithm.

• $\mathrm{■}$

  External Memory Model (EM). This model can naturally simulate the classic EM model [4, 51], where the trusted memory corresponds to the main memory and the untrusted memory corresponds to the disk. Following prior work [28, 21, 18], we focus on the cache-agnostic EM algorithms, which are unaware of the values of $M$ (memory size) and $B$ (block size), a property commonly referred to as cache-oblivious in the literature. To avoid ambiguity, we use the terms “cache-agnostic” to refer to “cache-oblivious” and “oblivious” to refer to “access-pattern-oblivious” throughout this paper. The advantages of cache-agnostic algorithms have been extensively studied, particularly in multi-level memory hierarchies. A cache-agnostic algorithm can seamlessly adapt to operate efficiently between any two adjacent levels of the hierarchy. We adopt the tall cache assumption, $M=\mathrm{\Omega }(B^2)$ and further $M=\mathrm{\Omega }({\log }^{1+ϵ}N)$¹¹1In this work, $\log (\cdot )$ always means ${\log }_2(\cdot )$ and should be distinguished from ${\log }_{\frac{M}{B}}(\cdot )$. for an arbitrarily small constant $ϵ\in (0,1)$, and the wide block assumption, $B=\mathrm{\Omega }({\log }^{0.55}N)$. These are standard assumptions widely adopted in the literature of EM algorithms [4, 51, 7, 28, 21, 18]. The cache complexity in this model is defined as the number of accesses to the disk by an EM algorithm.

The notion of obliviousness is defined based on the access pattern of an algorithm. Memory accesses to the trusted memory are invisible to the adversary and, therefore, have no impact on security. Let $𝒜$ be an algorithm, $𝒬$ a join query, and $ℛ$ an arbitrary input instance of $𝒬$. We denote ${\mathrm{𝖠𝖼𝖼𝖾𝗌𝗌}}_{𝒜}(𝒬,ℛ)$ as the sequence of memory accesses made by $𝒜$ to the untrusted memory when given $(𝒬,ℛ)$ as the input, where each memory access is a read or write operation associated with a physical address. The join query $𝒬$ and the size $N$ of the input instance are considered non-sensitive information and can be safely exposed to the adversary. In contrast, all input tuples are considered sensitive information and should be hidden from adversaries. This way, the access pattern of an oblivious algorithm $𝒜$ should only depend on $𝒬$ and $N$, ensuring no leakage of sensitive information.

This notion of obliviousness applies to both deterministic and randomized algorithms. For a randomized algorithm, different execution states may arise from the same input instance due to the algorithm’s inherent randomness. Each execution state corresponds to a specific sequence of memory accesses, allowing the access pattern to be modeled as a random variable with an associated probability distribution over the set of all possible access patterns. The statistical distance between two probability distributions is typically quantified using standard metrics, such as the total variation distance. A randomized algorithm is indeed oblivious if its access pattern exhibits statistically indistinguishable distributions across all input instances of the same size. Relatively simpler, a deterministic algorithm is oblivious if it displays an identical access pattern for all input instances of the same size.

ORAM is a general randomized framework designed to protect access patterns [31]. In ORAM, each logical access is translated into a poly-logarithmic number of random physical accesses, thereby incurring a poly-logarithmic overhead. Goldreich et al. [31] established a lower bound $\mathrm{\Omega }(\log N)$ on the access overhead of ORAMs in the RAM model. Subsequently, Asharov et al. [8] proposed a theoretically optimal ORAM construction with an overhead of $O(\log N)$ in the RAM model under the assumption of the existence of a one-way function, which is rather impractical [47]. It remains unknown whether a better cache complexity than $O(\log N)$ can be shown for such a construction. Path ORAM [48] is currently the most practical ORAM construction, but it introduces an $O({\log }^{2}N)$ overhead and requires $\mathrm{\Omega }(1)$ trusted memory. In the EM model, one can place the tree data structures for ORAM in an Emde Boas layout, resulting in a memory access overhead of $O(\log N\cdot {\log }_{B}N)$.

The WCOJ algorithm [43] have been developed to compute any join query in $O(N^{{\rho }^{\ast }})$ time²²2A hashing-based algorithm achieves $O(N^{{\rho }^{\ast }})$ time in the worst case using the lazy array technique [27]., where ${\rho }^{\ast }$ is the fractional edge cover number of the join query (formally defined in Section 2.1). The optimality is implied by the AGM bound [9]. ³³3The maximum number of join results produced by any instance of input size $N$ is $O(N^{{\rho }^{\ast }})$, which is also tight in the sense that there exists some instance of input size $N$ that can produce $\mathrm{\Theta }(N^{{\rho }^{\ast }})$ join results. However, these WCOJ algorithms are not oblivious. In Section 4, we use triangle join as an example to illustrate the information leakage from the WCOJ algorithm. Another line of research also explored output-sensitive join algorithms. A join query can be computed in $O((N^{\text{subw}}+\text{OUT})\cdot \mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}N))$ time [54, 3], where subw is the submodular-width of the join query. For example, $\text{subw}=1$ if and only if the join query is acyclic [12, 25]. These algorithms are also not oblivious due to various potential information leakages. For instance, the total number of memory accesses is influenced by the output size, which can range from a constant to a polynomially large value relative to the input size. A possible mitigation strategy is worst-case padding, which involves padding dummy accesses to match the worst case. However, this approach does not necessarily result in oblivious algorithms, as their access patterns may still vary significantly across instances with the same input size.

In contrast, there has been significantly less research on multi-way join processing in the EM model. First of all, we note that an EM version of the WCOJ  algorithm incurs at least $\mathrm{\Omega }\left(\frac{N^{{\rho }^{\ast }}}{B}\right)$ cache complexity since there are $\mathrm{\Theta }(N^{{\rho }^{\ast }})$ join results in the worst case and all join results should be written back to disk. For the basic two-way join, the nested-loop algorithm has cache complexity $O\left(\frac{N^2}{B}\right)$ and the sort-merge algorithm has cache complexity $O\left(\frac{N}{B}{\log }_{\frac{M}{B}}\frac{N}{B}+\frac{\text{OUT}}{B}\right)$. For multi-way join queries, an EM algorithm with cache complexity $O\left(\frac{N^{{\rho }^{\ast }}}{M^{{\rho }^{\ast }-1}B}\cdot {\log }_{\frac{M}{B}}\frac{N}{B}+\frac{\text{OUT}}{B}\right)$ has been achieved for Berge-acyclic joins [37], $\alpha$-acyclic joins [36, 39], graph joins [38, 22] and Loomis-Whitney joins [39].⁴⁴4Some of these algorithms have been developed for the Massively Parallel Computation (MPC) model [11] and can be adapted to the EM model through the MPC-to-EM reduction [39]. These results were previously stated without including the output-dependent term $\frac{\text{OUT}}{B}$ since they do not consider the cost of writing join results back to disk. Again, even padding the output size to be as large as the worst case, these algorithms remain non-oblivious since their access patterns heavily depend on the input data. Furthermore, even in the insecure setting, no algorithm with a cache complexity $O\left(\frac{N^{{\rho }^{\ast }}}{B}\right)$ is known for general join queries.

Oblivious algorithms have been studied for join queries in both the RAM and EM models. In the RAM model, the naive nested-loop algorithm can be transformed into an oblivious one by incorporating some dummy writes, as it enumerates all possible combinations of tuples from input relations in a fixed order. This algorithm runs in $O(N^{|ℰ|})$ time, where $|ℰ|$ is the number of relations in the join query. Wang et al. [53] designed circuits for conjunctive queries - capturing all join queries as a special case - whose time complexity matches the AGM bound up to poly-logarithmic factors. Running such a circuit will automatically yield an oblivious join algorithm with $O\left(N^{{\rho }^{\ast }}\cdot \mathrm{𝗉𝗈𝗅𝗒𝗅𝗈𝗀}N\right)$ time complexity. By integrating the insecure WCOJ algorithm [44] with the optimal ORAM [8], it is possible to achieve an oblivious algorithm with $O(N^{{\rho }^{\ast }}\cdot \log N)$ time complexity, albeit under restrictive theoretical assumptions. Alternatively, incorporating the insecure WCOJ algorithm into the Path ORAM yields an oblivious join algorithm with $O\left(N^{{\rho }^{\ast }}\cdot {\log }^{2}N\right)$ time complexity.

In the EM model, He et al. [35] proposed a cache-agnostic nested-loop join algorithm for the basic two-way join $R⨝S$ with $O\left(\frac{|R|\cdot |S|}{B}\right)$ cache complexity, which is also oblivious. Applying worst-case padding and the optimal ORAM construction to the existing EM join algorithms, we can derive an oblivious join algorithm with $O\left(\frac{N^{{\rho }^{\ast }}}{B}\cdot {\log }_{\frac{M}{B}}\frac{N}{B}\cdot \log N\right)$ cache complexity for specific cases such as acyclic joins, graph joins and Loomis-Whitney joins. However, these algorithms are not cache-agnostic. For general join queries, no specific oblivious algorithm has been proposed for the EM model, aside from results derived from the oblivious RAM join algorithm. These results yield cache complexities of either $O\left(N^{{\rho }^{\ast }}\cdot \log N\right)$ or $O\left(N^{{\rho }^{\ast }}\cdot \log N\cdot {\log }_{B}N\right)$, as they rely heavily on retrieving tuples from hash tables or range search indices.

Beyond fully oblivious algorithms, researchers have explored relaxed notions of obliviousness by allowing specific types of leakage, such as the join size, the multiplicity of join values, and the size of intermediate results. One relevant line of work examines join processing with released input and output sizes. For example, integrating an insecure output-sensitive join algorithm into an ORAM framework produces a relaxed oblivious algorithm with $O\left((N^{\text{subw}}+\text{OUT})\cdot \mathrm{polylog}N\right)$ time complexity. It is noted that relaxed oblivious algorithm with the same time complexity $O((N+\text{OUT})\cdot \log N)$ have been proposed without requiring ORAM [6, 40] for the basic two-way join as well as acyclic joins. Although not fully oblivious, these algorithms serve as fundamental building blocks for developing our oblivious algorithms for general join queries. Another line of work considered differentially oblivious algorithms [15, 13, 18], which require only that access patterns appear similar across neighboring input instances. However, differentially oblivious algorithms have so far been limited to the basic two-way join [18]. This paper does not pursue this direction further.

This paper is organized as follows. In Section 2, we introduce the preliminaries for building our algorithms. In Section 3, we show our first algorithm based on the nested-loop algorithm. While effective, this algorithm is not always optimal, as demonstrated with the triangle join. In Section 4, we use triangle join to demonstrate the leakage of insecure WCOJ algorithm and show how to transform it into an oblivious algorithm. We introduce our oblivious WCOJ algorithm for general join queries in Section 5, and conclude in Section 6.

Given an input array of $N$ elements, a linear scan of all elements can be done with $O(N)$ time complexity and $O(\frac{N}{B})$ cache complexity in a cache-agnostic way.

Given an input array of $N$ elements, the goal is to output an array according to some predetermined ordering. The classical bitonic sorting network [10] requires $O(N\cdot {\log }^{2}N)$ time. Later, this time complexity has been improved to $O\left(N\cdot \log N\right)$ [5] in 1983. However, due to the large constant parameter hidden behind $O(N\cdot \log N)$, the classical bitonic sorting is more commonly used in practice, particularly when the size $N$ is not too large. Ramachandran and Shi [45] showed a randomized algorithm for sorting with $O(N\cdot \log N)$ time complexity and $O\left(\frac{N}{B}{\log }_{\frac{M}{B}}\frac{N}{B}\right)$ cache complexity under the tall cache assumption.

Given an input array of $N$ elements, some of which are distinguished as $⟂$, the goal is to output an array with all non-distinguished elements moved to the front before any $⟂$, while preserving the ordering of non-distinguished elements. Lin et al. [42] showed a randomized algorithm for compaction with $O(N\cdot \log \log N)$ time complexity and $O\left(\frac{N}{B}\right)$ cache complexity under the tall cache assumption.

We use the above primitives to construct additional building blocks for our algorithms. To ensure obliviousness, all outputs from these primitives include a fixed size equal to the worst-case scenario, i.e., $N$, comprising both real and dummy elements. All these primitives achieve $O(N\cdot \log N)$ time complexity and $O\left(\frac{N}{B}\cdot {\log }_{\frac{M}{B}}\frac{N}{B}\right)$ cache complexity. Further details are provided in the full version [1].

Given two input relations $R$, $S$ of at most $N$ tuples and their common attribute(s) $x$, the goal is to output the set of tuples in $R$ that can be joined with at least one tuple in $S$.

Given an input relation $R$ of $N$ tuples defined over attributes $e$, and a subset of attributes $x\subseteq e$, the goal is to output $\{t\in R:{\pi }_{x}t\}$, ensuring no duplication.

Given two input arrays $R,S$ of at most $N$ elements, the goal is to output $R\cap S$.

Given a relation $R$ and $k$ additional relations $S_1,S_2,\mathrm{\cdots },S_k$ (each with at most $N$ tuples) sharing common attribute(s) $x$, the goal is to attach each tuple $t$ the number of tuples in $S_i$ (for each $i\in [k]$) that can be joined with $t$ on $x$.

We note that any sequential composition of oblivious primitives yields more complex algorithms that remain oblivious, which is the key principle underlying our approach.

Nested-loop algorithm can compute $R⨝S$ with $O(|R|\cdot |S|)$ time complexity, which iterates all combinations of tuples from $R,S$ and writes a join result (or a dummy result, if necessary, to maintain obliviousness). He et al. [35] proposed a cache-agnostic version in the EM model with $O\left(\frac{|R|\cdot |S|}{B}\right)$ cache complexity, which is also oblivious.

The relaxed two-way join algorithm [6, 40] takes as input two relations $R,S$ and a parameter $\tau \ge |R⨝S|$, and output a table of $\tau$ elements containing join results of $R⨝S$, whose access pattern only depends on $|R|,|S|$ and $\tau$. This algorithm can also be easily transformed into a cache-agnostic version with $O((|R|+|S|+\tau )\cdot \log (|R|+|S|+\tau ))$ time complexity and $O\left(\frac{|R|+|S|+\tau }{B}\cdot \log \tau \right)$ cache complexity. In the full version [1], we show how to improve the cache complexity of this algorithm without sacrificing the time complexity.