On secure network coding with uniform. wiretap sets

Transcription

1 O secure etwork codig with uiform 1 wiretap sets Wetao Huag, Tracey Ho, Seior Member, IEEE, Michael Lagberg, Member, IEEE, ad Joerg Kliewer, Seior Member, IEEE, arxiv: v1 [cs.it] 21 Aug 2012 Abstract This paper shows determiig the secrecy capacity of a uicast etwork with uiform wiretap sets is at least as difficult as the k-uicast problem. I particular, we show that a geeral k-uicast problem ca be reduced to the problem of fidig the secrecy capacity of a correspodig sigle uicast etwork with uiform lik capacities ad oe arbitrary wiretap lik. I. INTRODUCTION The secure etwork codig problem, itroduced by Cai ad Yeug [1], cocers iformatio theoretically secure commuicatio over a etwork where a ukow subset of etwork liks may be wiretapped. A secure code esures that the wiretapper obtais o iformatio about the secure message beig commuicated. The secrecy capacity of a etwork, with respect to a give collectio of possible wiretap sets, is the maximum rate of commuicatio such that for ay oe of the wiretap sets the secrecy costraits are satisfied. Types of secrecy costraits studied i the literature iclude perfect secrecy, strog secrecy ad weak secrecy. This paper cosiders the problem of fidig the secrecy capacity of a etwork whe we allow etwork odes i additio to the source to geerate idepedet radomess. We show that a geeral k-uicast problem ca be reduced to a correspodig sigle uicast secrecy capacity problem with uiform lik capacities where ay sigle lik ca be wiretapped. This implies that determiig the secrecy capacity, eve i the simple case of a sigle uicast, uiform lik capacities ad urestricted wiretap sets where ay sigle lik ca be wiretapped, is at least as difficult as the log stadig ope problem of determiig the capacity regio of multiple-uicast etwork codig, which is ot presetly kow to be i P, NP or udecidable [2]. I cotrast, uder the assumptio that oly the source ca geerate radomess, lik capacities are uiform ad up to z arbitrary liks ca be wiretapped, Cai Wetao Huag ad Tracey Ho are with the Departmet of Electrical Egieerig, Califoria Istitute of Techology, Pasadea, CA 91125, USA. {whuag,tho}@caltech.edu Michael Lagberg is with the Departmet of Mathematics ad Computer Sciece at The Ope Uiversity of Israel, 108 Ravutski St., Raaaa 43107, Israel. mikel@opeu.ac.il Joerg Kliewer is with the Klipsch School of Electrical ad Computer Egieerig, New Mexico State Uiversity, Las Cruces, NM 88003, USA. jkliewer@msu.edu

2 2 ad Yeug [1] showed that the secrecy capacity is give by the cut-set boud ad liear codes suffice to achieve capacity. The secure etwork codig problem with restricted wiretap sets ad/or o-uiform lik capacities has bee cosidered by Cui et al. [3], who studied achievable codig schemes, ad by Cha ad Grat [4], who showed that determiig multicast secrecy capacity with restricted (o-uiform) wiretap sets is at least as difficult as determiig capacity for multiple-uicast etwork codig. Our reductio follows the same core ideas appearig i [4] with two differeces. First, by itroducig the idea of key cacellatio ad replacemet at itermediate odes, our costructio does ot eed to impose restrictios o which liks ca be wiretapped. Secodly, ulike the reductio i [4] which ivolves multiple termials, ours oly eeds a sigle destiatio. Therefore, our costructio shows that eve a sigle secure uicast i the uiform settig (equal capacity liks where ay oe of which ca be wiretapped) is as difficult as a k-uicast problem. II. MODEL A etwork is represeted by a directed graph G = (V, E), where V is the set of vertices which represet odes, ad E is the set of edges that represet liks. We assume liks have equal capacity ad there may be multiple liks betwee a pair of odes. There is a source ode S V ad a destiatio ode D V. The source wats to commuicate a message M, uiformly draw from a fiite alphabet set S, to the destiatio usig a code with legth or duratio. The the rate of the code is 1 log S. For the etwork codig problem, we say that a commuicatio rate R is feasible if there exists a sequece of legth- codes such that S = 2 R ad the probability of decodig error teds to 0 as. For the secure etwork codig problem, we specify additioally a collectio A of wiretap lik sets, i.e., A is a collectio of subsets of E such that a eavesdropper ca wiretap ay oe set i A. We cosider three kids of secrecy costraits: the requiremet, for all A A, that correspods to perfect secrecy, that correspods to strog secrecy, ad that I(M; X (A)) = 0 (1) I(M; X (A)) 0 as (2) I(M; X (A)) 0 as (3) correspods to weak secrecy, where X(A) = {X(a, b) : (a, b) A}, ad X(a, b) is the sigal trasmitted o the lik (a, b). We say a secrecy rate R is feasible if the commuicatio rate R is feasible ad the prescribed secrecy coditio is satisfied. The secrecy capacity of the etwork is defied as the supremum of all feasible secrecy rates. III. MAIN RESULT Theorem 1. Give ay K-uicast problem with source-destiatio pairs {(S i, T i ), i = 1,..., K} of uit rate, the correspodig secure commuicatio problem i Figure 1 with uit capacity liks, ay oe of which ca be

3 3 Fig. 1. The source S wats to commuicate with the destiatio D secretly (with either weak secrecy, strog secrecy or perfect secrecy). N is a embedded geeral etwork. Liks are labeled by the sigals trasmitted o them. wiretapped, has secrecy capacity K (uder perfect, strog or weak secrecy requiremets) if ad oly if the K-uicast problem is feasible. Proof:. Suppose a secrecy rate of K is achieved by a code with legth. Let M be the source iput message, the H(M) = K. Because there is o shared radomess betwee differet odes, M is idepedet with {d 1, fk, k = 1,..., K}. Hece By the chai rule, So H(M d 1, f 2,..., f K) = K. (4) H(M c 1, d 1, f 2,..., f K) + H(c 1 d 1, f 2,..., f K) = H(M, c 1 d 1, f 2,..., f K) H(M d 1, f 2,..., f K). H(M c 1, d 1, f 2,..., f K) H(M d 1, f 2,..., f K) H(c 1 d 1, f 2,..., f K) (K 1), (5) where the last iequality holds because of (4) ad H(c 1 d 1, f 2,..., f K ) H(c 1 ). Similarly, H(M c 1, d 1, f 2,..., f K) H(M c 1, d 1, f 2,..., f K, e 2,..., e K) + H(e 2,..., e K c 1, d 1, f 2,..., f K) ɛ + H(e 2,..., e K c 1, d 1, f 2,..., f K) (6) ɛ + (K 1), (7) where ɛ 0 as ad (6) is due to the cut set {c 1, d 1, f2,..., fk } from S to D ad Fao s iequality. Hece it follows H(c 1 ) H(c 1 d 1, f 2,..., f K) H(M d 1, f 2,..., f K) H(M c 1, d 1, f 2,..., f K) (8) ɛ, (9)

4 4 where (8) holds because of (5), ad (9) follows from (4) ad (7). Also otice that H(M c 1, d 1, f2,..., fk) H(M c 1, f2,..., fk) H(d 1 c 1, f2,..., fk), (10) where H(M c 1, f2,..., fk) = H(M c 1 ) K δ, (11) with δ 0 as 0. Here the first equality holds because {M, c 1 } is idepedet with {fi, i = 1,..., K} ad the secod iequality holds due to the weak secrecy costrait. Note that all argumets exted aturally to the cases of strog ad perfect secrecy because they are eve stroger coditios. Therefore by (7), (10) ad (11) we have H(d 1 ) H(d 1 c 1, f2,..., fk) H(M c 1, f2,..., fk) H(M c 1, d 1, f2,..., fk) ɛ δ. (12) Furthermore, by the idepedecy betwee the sets of {M, c 1, d 1 } ad {fi, i = 1,..., K} we also have H(M c 1, d 1, f2,..., fk) = H(M c 1, d 1 ). Accordig to (5) ad (7), it is bouded by (K 1) H(M c 1, d 1 ) ɛ + (K 1). (13) Now cosider the joit etropy of M, d 1, c 1 ad expad it i two ways H(M, d 1, c 1 ) = H(c 1 M, d 1 ) + H(M d 1 ) + H(d 1 ) = H(M c 1, d 1 ) + H(d 1 c 1 ) + H(c 1 ) (K + 1) + ɛ, where the last iequality holds because of (13) ad H(d 1 c 1 ), H(c 1 ). Therefore H(c 1 M, d 1 ) (K + 1) + ɛ H(M d 1 ) H(d 1 ) 2ɛ + δ, (14) where (12) ad H(M d 1 ) = K (because M ad d 1 are idepedet by costructio) are used to establish the iequality. Ad so by observig the Markov chai (M, d 1 ) (M, b 1 ) c 1, it follows H(c 1 M, b 1 ) = H(c 1 M, b 1, d 1 ) H(c 1 M, d 1 ) 2ɛ + δ. (15) The cosider the joit etropy of M, b 1, c 1 ad expad it i two ways H(M, b 1, c 1 ) = H(b 1 M, c 1 ) + H(M c 1 ) + H(c 1 ) = H(c 1 M, b 1 ) + H(M b 1 ) + H(b 1 ) (K + 1) + 2ɛ + δ,

5 5 where the last iequality holds due to (15) ad H(M b 1 ) = K, H(b 1 ). Therefore by (9) ad the weak secrecy costrait H(M c 1 ) K δ, we have H(b 1 M, c 1 ) (K + 1) + 2ɛ + δ H(M c 1 ) H(c 1 ) 3ɛ + 2δ. (16) So H(b 1 M, d 1 ) H(b 1, c 1 M, d 1 ) = H(b 1 M, c 1, d 1 ) + H(c 1 M, d 1 ) H(b 1 M, c 1 ) + H(c 1 M, d 1 ) 3ɛ + 2δ + 2ɛ + δ = 5ɛ + 3δ, where the last iequality ivokes (16) ad (14). Notice that M is idepedet with {b 1, d 1 }, so H(b 1 d 1 ) = H(b 1 M, d 1 ) 5ɛ + 3δ. (17) Now we boud the etropy of b 1. Agai cosider the joit etropy, H(M, b 1, c 1 ) = H(c 1 M, b 1 ) + H(M b 1 ) + H(b 1 ) = H(b 1 M, c 1 ) + H(M c 1 ) + H(c 1 ) (K + 1) ɛ δ, where the last iequality holds because of (9), the secrecy coditio H(M c 1 ) K δ, ad H(b 1 M, c 1 ) 0. So by (15) ad because H(M b 1 ) = K, we have H(b 1 ) (K + 1) ɛ δ H(c 1 M, b 1 ) H(M b 1 ) 3ɛ 2δ. (18) Fially, by (17) ad (18), I(b 1 ; d 1 ) H(b 1 ) H(b 1 d 1 ) 8ɛ 5δ, The above argumet exteds to all other paths aturally (by reumberig the otatios accordigly), so I(b i ; d i ) 8ɛ 5δ, i = 1,..., K. Therefore i = 1,..., K, by the chael codig theorem, if we employ a outer code of legth by ecodig b i as a supersymbol, the there exists a ier code that achieves a rate of 8ɛ 8δ from B i to T i, ad so the overall rate is R i 8ɛ 5δ 1 as. Because B i ca be viewed as a virtual source of S i, so i = 1,..., K, the uicast from ode S i to T i of rate 1 is feasible.. The secrecy capacity is upper bouded by K due to the mi cut from S to D. Ad secrecy rate K is achieved by the scheme described i Figure 2, i.e., let ɛ (i) be the probability of error for the uicast from S i to T i, the the probability of error from S to D is upper bouded by Kɛ 0 as, where ɛ = max i ɛ (i).

6 6 Fig. 2. A scheme to achieve secrecy rate K. V x is the local key ijected by ode x, with H(V x) = 1, x. M i, i = 1,..., K are source iput messages, with H(M i ) = 1, i = 1,..., K. Note that the scheme achieves perfect secrecy, which i tur implies strog ad weak secrecy requiremets are also satisfied. The above result ca be easily exteded to the case of zero error commuicatio ad perfect secrecy. I this case, we say a rate R is feasible if there exists a code with fiite legth such that S = 2 R ad the probability of decodig error is strictly zero. The for the secrecy commuicatio problem i Figure 1, its zero error perfect secrecy capacity is K if ad oly if the K-uicast for source-destiatio pairs {(S i, T i ), i = 1,..., K} of uit rate is feasible with zero error. The proof of this claim follows the same outlie as the proof of Theorem 1, with the differece that all ɛ ad δ become strictly 0. The (17) implies that b 1 is a fuctio of d 1, ad hece that it ca be perfectly decoded from d 1. Coversely, we ote that for ay give weakly secure commuicatio problem where ay oe lik ca be wiretapped, we ca costruct a correspodig commuicatio problem without security costraits (which ca i tur be reduced to a equivalet multiple-uicast problem by [5]) that is feasible if ad oly if the secure commuicatio problem is feasible. The equivalet commuicatio problem is defied o a specialized versio of the A-ehaced etwork i [6], stated here i simplified form for coveiece as follows. Defiitio 1. Cosider a secure commuicatio problem o a etwork N represeted by a directed graph G = (V, E) with the collectio of wiretap sets A = {{e} : e E} comprisig idividual liks. Let c e deote the capacity of lik e E ad let E out (i) deote the set of liks (i, j) origiatig at ode i V. The A-ehaced etwork N (A) o graph Ǧ = (ˇV, Ě) is defied as follows: 1) For each lik e = (i, j) E, create a eavesdropper ode v e ad a ode u e, replace (i, j) by two liks (i, u e ) ad (u e, j) ad create a lik (u e, v e ), all of capacity c e. 2) For each ode i V create a message ode v i ad a radom key ode v i. 3) Create a overall key ode v L.

7 7 4) For each i V, create a set H i of liks from ode v i to all of the odes i { i } { v e : e E }, ad a set H i of liks from ode v i to odes i ad v L, all of which have capacity č i = c e. e E out(i) 5) For each lik e E, create a lik (v L, v e ) of capacity c e c e. { 6) ˇV = V vi : i V } { v i : i V } { u e, v e : e E } {v L }. 7) Ě = i V (H i H i ) { (i, u e ), (u e, j), (u e, v e ) : e = (i, j) E } { (v L, v e ) : e E }. e E The commuicatio requiremets i the A-ehaced etwork are as follows. For each message that origiates at a ode i i the origial secure commuicatio problem, i the A-ehaced etwork, the message origiates istead at the correspodig message ode v i ad is demaded by the same destiatio odes as i the origial problem. I additio, the commuicatio problem o the A-ehaced etwork also requires a radom key message L i L i = {1,..., 2 či } to be delivered from each radom key ode v i to all eavesdropper odes {v e : e E}. Ituitively, if the commuicatio problem o the A-ehaced etwork is solved, the it implies that the iformatio observed by the eavesdropper is idepedet with the iput message i the secure commuicatio problem, ad hece the secrecy coditios are satisfied. Details are give i [6]. REFERENCES [1] N. Cai ad R. W. Yeug, Secure etwork codig, i Proc. IEEE It Iformatio Theory Symp, [2] M. Lagberg ad M. Medard, O the multiple uicast etwork codig, cojecture, i Proc. 47th Aual Allerto Cof. Commuicatio, Cotrol, ad Computig Allerto 2009, 2009, pp [3] T. Cui, T. Ho, ad J. Kliewer, O secure etwork codig with ouiform or restricted wiretap sets, accepted to IEEE Trasactios o Iformatio Theory, [4] T. Cha ad A. Grat, Missio impossible: Computig the etwork codig capacity regio, i Proc. IEEE Iteratioal Symposium o Iformatio Theory, July 2008, pp [5] R. Dougherty ad K. Zeger, Noreversibility ad equivalet costructios of multiple uicast etworks, IEEE Trasactios o Iformatio Theory, vol. 52, o. 11, [6] T. Dikaliotis, H. Yao, T. Ho, M. Effros, ad J. Kliewer, Network equivalece i the presece of a eavesdropper, i Allerto Coferece o Commuicatio, Cotrol ad Computig, accepted, 2012.