  The problem of private information retrieval with graph-based replicated
storage was recently introduced by Raviv, Tamo and Yaakobi. Its capacity
remains open in almost all cases. In this work the asymptotic (large number of
messages) capacity of this problem is studied along with its generalizations to
include arbitrary $T$-privacy and $X$-security constraints, where the privacy
of the user must be protected against any set of up to $T$ colluding servers
and the security of the stored data must be protected against any set of up to
$X$ colluding servers. A general achievable scheme for arbitrary storage
patterns is presented that achieves the rate $(\rho_{\min}-X-T)/N$, where $N$
is the total number of servers, and each message is replicated at least
$\rho_{\min}$ times. Notably, the scheme makes use of a special structure
inspired by dual Generalized Reed Solomon (GRS) codes. A general converse is
also presented. The two bounds are shown to match for many settings, including
symmetric storage patterns. Finally, the asymptotic capacity is fully
characterized for the case without security constraints $(X=0)$ for arbitrary
storage patterns provided that each message is replicated no more than $T+2$
times. As an example of this result, consider PIR with arbitrary graph based
storage ($T=1, X=0$) where every message is replicated at exactly $3$ servers.
For this $3$-replicated storage setting, the asymptotic capacity is equal to
$2/\nu_2(G)$ where $\nu_2(G)$ is the maximum size of a $2$-matching in a
storage graph $G[V,E]$. In this undirected graph, the vertices $V$ correspond
to the set of servers, and there is an edge $uv\in E$ between vertices $u,v$
only if a subset of messages is replicated at both servers $u$ and $v$.
