On the Tradeoff Region of Secure Exact-Repair Regenerating Codes

TL;DR

This paper investigates the tradeoff region of secure exact-repair regenerating codes, revealing that the number of corner points varies with the secrecy level, and provides a detailed characterization for a specific case.

Contribution

It characterizes the tradeoff region for secure regenerating codes, showing multiple corner points for small secrecy parameters and a single corner point for large ones.

Findings

For large secrecy parameter, the SRK point is the only corner point.

For small secrecy parameter, the tradeoff region can have multiple corner points.

Precisely characterized the tradeoff region for the (7,6,6,1) problem with two corner points.

Abstract

We consider the $(n,k,d,\ell)$ secure exact-repair regenerating code problem, which generalizes the $(n,k,d)$ exact-repair regenerating code problem with the additional constraint that the stored file needs to be kept information-theoretically secure against an eavesdropper, who can access the data transmitted to regenerate a total of $\ell$ different failed nodes. For all known results on this problem, the achievable tradeoff regions between the normalized storage capacity and repair bandwidth have a single corner point, achieved by a scheme proposed by Shah, Rashmi and Kumar (the SRK point). Since the achievable tradeoff regions of the exact-repair regenerating code problem without any secrecy constraints are known to have multiple corner points in general, these existing results suggest a phase-change-like behavior, i.e., enforcing a secrecy constraint ($\ell\geq 1$) immediately reduces the tradeoff region to one with a single corner point. In this work, we first show that when the secrecy parameter $\ell$ is sufficiently large, the SRK point is indeed the only corner point of the tradeoff region. However, when $\ell$ is small, we show that the tradeoff region can in fact have multiple corner points. In particular, we establish a precise characterization of the tradeoff region for the $(7,6,6,1)$ problem, which has exactly two corner points. Thus, a smooth transition, instead of a phase-change-type of transition, should be expected as the secrecy constraint is gradually strengthened.

Equations

$$B$$

$$\alpha /B=\bar{\alpha }\text{mbox}and\beta /B=\bar{\beta };$$

$$\mathsf{M}=g_{\mathcal{A}}({\mathsf{W}}_i:i\in \mathcal{A})$$

$${\mathsf{W}}_j=g_j^{\mathcal{B}}({\mathsf{S}}_{i\to j}^{\mathcal{B}}:i\in \mathcal{B})$$

$$I(\mathsf{M};({\mathsf{S}}_{\to j}:j\in \mathcal{E}))=0$$

$$\left(d{T}_{k,d,\ell ,}^{-1},T_{k,d,\ell }^{-1}\right)\in {\mathcal{R}}_{n,k,d,\ell }$$

$$T_{k,d,\ell }:=\sum _{i=\ell +1}^k(d+1-i).$$

$${\ell }^{\ast }(k,d):=\min \left\{\ell \ge 1:T_{k,d,\ell }\le d+\sqrt{d\ell }\right\}.$$

$$T_{k,d,\ell }\le d+\sqrt{d\ell },\forall \ell \ge {\ell }^{\ast }(k,d).$$

$$\bar{\beta }$$

$$\bar{\alpha }$$

$$({\bar{\alpha }}_t,{\bar{\beta }}_t)\in {\mathcal{R}}_{n,n-1,n-1,\ell }$$

$$\displaystyle(t-1)\bar{\alpha}_{t}=(n-1)\bar{\beta}_{t}:=\left.\left(\begin{array}[]{c}n-1\\ t-1\end{array}\right)\right/{\left(\begin{array}[]{c}n-\ell\\ t\end{array}\right)}.$$

$$({\bar{\alpha }}_t,{\bar{\beta }}_t)=\left(\frac{t}{(t-1)(n-t)},\frac{t}{(n-1)(n-t)}\right).$$

$$n\bar{\alpha }+\frac{(n-1)(n-6)}{2}\bar{\beta }\ge 3.$$

$$({\bar{\alpha }}_2,{\bar{\beta }}_2)$$

$$\text{mbox}and({\bar{\alpha }}_3,{\bar{\beta }}_3)$$

$$\bar{\alpha }\ge \frac{3}{8}.$$

$${\mathcal{R}}_{7,6,6,1}=\left\{(\bar{\alpha },\bar{\beta }):\bar{\beta }\ge \frac{1}{15},7\bar{\alpha }+3\bar{\beta }\ge 3,\bar{\alpha }\ge \frac{3}{8}\right\}.$$

$${\alpha }_t=\left(\genfrac{}{}{0ex}{}{n-1}{t-1}\right).$$

$$(n-1){\beta }_t=(t-1){\alpha }_t.$$

$$I(\mathsf{M};\mathsf{E})=0.$$

$$I(\mathsf{M};\mathsf{E})$$

$$=H(\mathsf{E})-H(\mathsf{E}|\mathsf{M})+H(\mathsf{E}|\mathsf{M},\mathsf{K})$$

$$=H(\mathsf{E})-I(\mathsf{E};\mathsf{K}|\mathsf{M})$$

$$=H(\mathsf{E})-H(\mathsf{K}|\mathsf{M})+H(\mathsf{K}|\mathsf{M},\mathsf{E})$$

$$=H(\mathsf{E})-R+H(\mathsf{K}|\mathsf{M},\mathsf{E}).$$

$$H(\mathsf{E})\le R.$$

$$H(\mathsf{K}|\mathsf{M},\mathsf{E})=0.$$

$$\left(\mathsf{M},\mathsf{K},({\mathsf{W}}_i:i\in [1:n]),({\mathsf{S}}_{i\to j}:i,j\in [1:n],i\ne j)\right)$$

$${\mathsf{W}}_{\mathcal{A}}:=\left({\mathsf{W}}_i:i\in \mathcal{A}\right),\mathcal{A}\subseteq [1:n]$$

$${\mathsf{S}}_{i\to \mathcal{B}}:=\left({\mathsf{S}}_{i\to j}:j\in \mathcal{B}\right),$$

$$i\in [1:n],\mathcal{B}\subseteq [1:n]\setminus \{i\}$$

$${\mathsf{S}}_{\mathcal{B}\to j}:=\left({\mathsf{S}}_{i\to j}:i\in \mathcal{B}\right),$$

Full text

I Introduction

Fault tolerance and node repair are two fundamental ingredients of reliable distributed storage systems. While the study of fault tolerance via diversity coding has been in the literature for decades [1, 2, 3, 4, 5, 6, 7], systematic studies of node repair mechanisms were started only recently by Dimakis et al. in their pioneering work [8]. A particular model, which has received a significant amount of attention in the literature, is the so-called exact-repair regenerating code problem.

More specifically, in an $(n,k,d)$ exact-repair regenerating code problem, a file $\mathsf{M}$ of size $B$ is to be encoded and then stored in a total of $n$ distributed storage nodes, each of capacity $\alpha$. The encoding needs to ensure that: 1) the file $\mathsf{M}$ can be perfectly recovered by having full access to any $k$ out of the total $n$ storage nodes; 2) when a node failure occurs, the failed node can be regenerated by extracting data of size $\beta$ from each of an arbitrary set of $d$ remaining nodes. An important technical contribution of [8] was to show that there is an inherent tradeoff between the node capacity $\alpha$ and the repair bandwidth $\beta$ in satisfying both the file-recovery and node-regeneration requirements. In particular, it has been shown [9] that the achievable normalized storage-capacity repair-bandwidth tradeoff region for any $(n,k,d)$ exact-repair regenerating code problem with $k>1$ features multiple corner points including the the all-important minimum storage rate (MSR) and minimum bandwidth rate (MBR) points. Fig. 1 illustrates the achievable normalized storage-capacity repair-bandwidth tradeoff region for the $(4,3,3)$ exact-repair regenerating code problem, which features three corner points including the MSR point $(1/3,1/3)$ and the MBR point $(1/2,1/6)$. Despite intensive research efforts that have yielded many highly non-trivial partial results [8, 9, 10, 11], the optimal tradeoffs between the node capacity $\alpha$ and repair bandwidth $\beta$ have not been fully understood for the general $(n,k,d)$ exact-repair regenerating code problem.

In this paper, we consider an extension of the aforementioned exact-repair regenerating code problem, which further requires certain security guarantee during the node-regeneration processes. More specifically, the $(n,k,d,\ell)$ secure exact-repair regenerating code problem that we consider is the standard $(n,k,d)$ exact-repair regenerating code problem [8, 9, 10, 11], with the additional constraint that the file $\mathsf{M}$ needs to be kept information-theoretically secure against an eavesdropper that can access the data extracted to regenerate a total of $\ell$ different failed nodes (possibly under different repair groups). Apparently, this is only possible when $\ell<k$. Furthermore, when $\ell=0$, the secrecy constraint degenerates, and the $(n,k,d,\ell)$ secure exact-repair regenerating code problem reduces to the $(n,k,d)$ exact-repair regenerating code problem without any security constraints.

Under the additional secrecy constraint ($\ell\geq 1$), the optimal tradeoffs between the node capacity $\alpha$ and repair bandwidth $\beta$ have been studied in [12, 13, 14, 15]. In particular, Shah, Rashmi and Kumar [13] showed that a particular tradeoff point (referred to as the SRK point) can be obtained by extending an MBR code based on the product-matrix construction proposed in [9]. Later, it was shown that the SRK point is the only corner point of the tradeoff region for the cases where we have either $d=2,3$ [14], or $d=4$ [15], or $k=2$ [14], or $\ell=k-1=d-1$ [14]. This is in sharp contrast to the original exact-repair regenerating code problem [8, 9, 10, 11] without any secrecy constraints, for which, as mentioned previously, the tradeoff region features multiple corner points when $k>1$. Fig. 1 also illustrates the tradeoff region for the $(4,3,3,1)$ secure exact-repair regenerating code problem, which features a single corner point at $(1,1/3)$. Thus, the existing results from [14, 15] seem to suggest a phase-change-like behavior that enforcing a secrecy constraint immediately reduces the tradeoff region from one with multiple corner points ($\ell=0$) to one with a single corner point ($\ell\geq 1$).

The main results of this paper are two-folded.

• •

We first show, via new converse results, that for any given $(k,d)$ pair, there is a lower bound on $\ell$, denoted by $\ell^{*}(k,d)$, such that when $\ell\geq\ell^{*}(k,d)$, the SRK point is indeed the only conner point of the tradeoff region for the $(n,k,d,\ell)$ secure exact-repair regenerating code problem. As we shall see, the lower bound $\ell^{*}(k,d)\leq k-1$ for any $(k,d)$ pair, and thus the tradeoff region for any $(n,k,d,\ell)$ problem with $\ell=k-1$ or $k=2$ must have a single corner point. In addition, the lower bound $\ell^{*}(k,d)=1$ for any $d\in[2:4]$. Therefore, our result includes all previous results from [14] and [15] as special cases.

• •

Next, we show that when $1\leq\ell<\ell^{*}(k,d)$, it is entirely possible that the tradeoff region features multiple corner points. In particular, we establish a precise characterization of the tradeoff region for the $(7,6,6,1)$ problem, which has exactly two corner points (see Fig. 2 for an illustration). This result requires new achievability results as well as new converse results, the former of which are obtained by extending the layered coding scheme proposed in [16]. From the viewpoint of the rate region, our result suggests that a smooth transition, instead of a phase-change-type of transition, should be expected as the secrecy constraint is gradually strengthened by increasing the parameter $\ell$.

II Problem Formulation and Known Results

Let $(n,k,d,N,K,T,S)$ be a tuple of positive integers such that $n\geq d+1\geq k+1\geq 2$. Formally, an $(n,k,d,N,K,T,S)$ code consists of:

• •

for each $i\in[1:n]$, a message-encoding function $f_{i}:[1:N]\times[1:K]\rightarrow[1:T]$;

• •

for each $\mathcal{A}\subseteq[1:n]$ such that $|\mathcal{A}|=k$, a message-decoding function $g_{\mathcal{A}}:[1:T]^{k}\rightarrow[1:N]$;

• •

for each $\mathcal{B}\subseteq[1:n]$ such that $|\mathcal{B}|=d$, $i\in\mathcal{B}$, and $j\in[1:n]\setminus\mathcal{B}$, a repair-encoding function $f^{\mathcal{B}}_{i\rightarrow j}:[1:T]\rightarrow[1:S]$;

• •

for each $\mathcal{B}\subseteq[1:n]$ such that $|\mathcal{B}|=d$ and $j\in[1:n]\setminus\mathcal{B}$, a repair-decoding function $g^{\mathcal{B}}_{j}:[1:S]^{d}\rightarrow[1:T]$.

Let $\mathsf{M}$ be a message that is uniformly distributed over $[1:N]$, and $\mathsf{K}$ be a secret key that is uniformly distributed over $[1:K]$. The message $\mathsf{M}$ and the secret key $\mathsf{K}$ are assumed to be independent of each other. For each $i\in[1:n]$, let $\mathsf{W}_{i}=f_{i}(\mathsf{M},\mathsf{K})$ be the data stored at the $i$th storage node, and for each $\mathcal{B}\subseteq[1:n]$ such that $|\mathcal{B}|=d$, $i\in\mathcal{B}$, and $j\in[1:n]\setminus\mathcal{B}$, let $\mathsf{S}^{\mathcal{B}}_{i\rightarrow j}=f^{\mathcal{B}}_{i\rightarrow j}(\mathsf{W}_{i})$ be the data extracted from the $i$th storage node in order to regenerate the data stored at the $j$th storage node under the context of repair group $\mathcal{B}$. Obviously,

[TABLE]

represent the message rate, storage capacity, and repair bandwidth, respectively.

A normalized storage-capacity repair-bandwidth pair $(\bar{\alpha},\bar{\beta})$ is said to be achievable for the $(n,k,d,\ell)$ secure exact-repair regenerating code problem if an $(n,k,d,N,K,T,S)$ code can be found such that:

• •

(rate normalization)

[TABLE]

• •

(message recovery)

[TABLE]

for any $\mathcal{A}\subseteq[1:n]$ such that $|\mathcal{A}|=k$;

• •

(node regeneration)

[TABLE]

for any $\mathcal{B}\subseteq[1:n]$ such that $|\mathcal{B}|=d$ and $j\in[1:n]\setminus\mathcal{B}$;

• •

(repair secrecy)

[TABLE]

for any $\mathcal{E}\subseteq[1:n]$ such that $|\mathcal{E}|=\ell$, where $\mathsf{S}_{\rightarrow j}:=(\mathsf{S}^{\mathcal{B}}_{i\rightarrow j}:\mathcal{B}\subseteq[1:n],\;|\mathcal{B}|=d,\;\mathcal{B}\not\ni j,\;i\in\mathcal{B})$ is the collection of data that can be extracted from the other nodes to regenerate node $j$.

The closure of all achievable $(\bar{\alpha},\bar{\beta})$ pairs is the achievable normalized storage-capacity repair-bandwidth tradeoff region $\mathcal{R}_{n,k,d,\ell}$ for the $(n,k,d,\ell)$ secure exact-repair regenerating code problem.

In [13], Shah, Rashmi and Kumar proved the following important achievability result for the general $(n,k,d,\ell)$ secure regenerating code problem:

[TABLE]

where

[TABLE]

Note that when $\ell=0$ (no repair-secrecy constraint), $\left(dT_{k,d,0}^{-1},T_{k,d,0}^{-1}\right)$ recovers the MBR point of the $(n,k,d)$ exact-repair regenerating code problem [9]. It has been shown that the SRK point (5) is the only corner point of the tradeoff region $\mathcal{R}_{n,k,d,\ell}$ for the cases where we have either $d=2,3$ [14], or $d=4$ [15], or $k=2$ [14], or $\ell=k-1=d-1$ [14].

III New Results

Consider the $(n,k,d,\ell)$ secure exact-repair regenerating code problem (with $\ell\geq 1$), and let

[TABLE]

Note that $T_{k,d,\ell}$ is monotone non-increasing with respect to $\ell$ for any given $(k,d)$ pair, so we have

[TABLE]

We have the following two outer bounds for the tradeoff region $\mathcal{R}_{n,k,d,\ell}$.

Theorem 1**.**

For the general $(n,k,d,\ell)$ secure exact-repair regenerating code problem, any achievable normalized storage-capacity repair-bandwidth pair $(\bar{\alpha},\bar{\beta})\in\mathcal{R}_{n,k,d,\ell}$ must satisfy:

[TABLE]

In addition, when $\ell\geq\ell^{*}(k,d)$, any achievable normalized storage-capacity repair-bandwidth pair $(\bar{\alpha},\bar{\beta})\in\mathcal{R}_{n,k,d,\ell}$ must also satisfy:

[TABLE]

(Conversely, any $(\bar{\alpha},\bar{\beta})$ satisfying (9) and (10) is achievable.)

While the proof of (9) is straightforward, the proof of (10) is long and technical. We shall defer the proof to Section V. Combining (9) and (10) proves that the SRK point (5) is the only corner point of the tradeoff region $\mathcal{R}_{n,k,d,\ell}$ when $\ell\geq\ell^{*}(k,d)$. It is straightforward to verify that the lower bound $\ell^{*}(k,d)\leq k-1$ for any $(k,d)$ pair and $\ell^{*}(k,d)=1$ for $d\in[2:4]$. Therefore, Theorem 1 includes all previous results from [14] and [15] as special cases.

Next, we shift our attention to the cases where $1\leq\ell<\ell^{*}(k,d)$. To see how the tradeoff region $\mathcal{R}_{n,k,d,\ell}$ may look like in this case, let us begin with the following achievability results for the $(n,k,d,\ell)$ secure exact-repair regenerating code problem with $k=d=n-1$.

Theorem 2**.**

For any $t\in[2:n-\ell]$, we have

[TABLE]

where

[TABLE]

The proof is based on a new coding scheme, which we shall describe in the next section. Note that when $\ell=1$, $(\bar{\alpha}_{t},\bar{\beta}_{t})$ can be simplified as:

[TABLE]

In this case, when $t=2$, $(\bar{\alpha}_{t},\bar{\beta}_{t})$ coincides with the SRK point (5) with $k=d=n-1$ and $\ell=1$. Furthermore, note that $\bar{\beta}_{t}$ is monotone increasing with $t$, and $\bar{\alpha}_{t}$ is monotone decreasing with $t$ for any $t\in[2:n-1]$ such that $t^{2}+t<n$. Thus, no pairs of points from the set $\{(\bar{\alpha}_{2},\bar{\beta}_{2}),\ldots,(\bar{\alpha}_{t+1},\bar{\beta}_{t+1})\}$ dominate each other for any $t\in[2:n-1]$ such that $t^{2}+t<n$. For example, when $n=7$, a second achievability point $(\bar{\alpha}_{3},\bar{\beta}_{3})=\left(\frac{3}{8},\frac{1}{8}\right)$ emerges in addition to the SKR point $(\bar{\alpha}_{2},\bar{\beta}_{2})=\left(\frac{2}{5},\frac{1}{15}\right)$. When $n=13$, a third achievability point $(\bar{\alpha}_{4},\bar{\beta}_{4})=\left(\frac{4}{27},\frac{1}{27}\right)$ emerges in addition to the points $(\bar{\alpha}_{3},\bar{\beta}_{3})=\left(\frac{3}{20},\frac{1}{40}\right)$ and $(\bar{\alpha}_{2},\bar{\beta}_{2})=\left(\frac{2}{11},\frac{1}{66}\right)$. Therefore, for the $(n,n-1,n-1,1)$ secure exact-repair regenerating code problem, the SRK point cannot be the only corner point when $n\geq 7$.

Next, we show that both $(\bar{\alpha}_{2},\bar{\beta}_{2})$ and $(\bar{\alpha}_{3},\bar{\beta}_{3})$ are optimal tradeoff points for the $(n,n-1,n-1,1)$ secure exact-repair regenerating code problem when $n\geq 7$, so in this case the tradeoff region must have multiple corner points.

Theorem 3**.**

For the $(n,n-1,n-1,1)$ secure exact-repair regenerating code problem with $n\geq 7$, any achievable normalized storage-capacity repair-bandwidth pair $(\bar{\alpha},\bar{\beta})\in\mathcal{R}_{n,n-1,n-1,1}$ must satisfy:

[TABLE]

Note that both

[TABLE]

satisfy the inequality (18) with equalities and hence cannot be dominated by a single achievable tradeoff point.

Finally, we focus on the $(n,n-1,n-1,1)$ problem with $n=7$ and show that the tradeoff region has exactly two corner points at $(\bar{\alpha}_{2},\bar{\beta}_{2})$ and $(\bar{\alpha}_{3},\bar{\beta}_{3})$.

Theorem 4**.**

For the $(7,6,6,1)$ secure exact-repair regenerating code problem, any achievable normalized storage-capacity repair-bandwidth pair $(\bar{\alpha},\bar{\beta})\in\mathcal{R}_{7,6,6,1}$ must satisfy:

[TABLE]

Therefore, the tradeoff region $\mathcal{R}_{7,6,6,1}$ is given by:

[TABLE]

The proof of (18) and (19) can be found in Section V.

IV A New $(n,n-1,n-1,\ell)$ Code Construction

In this section, we provide a code construction based on the layered exact-repair regenerating codes proposed in [16], which leads to the achievability of the tradeoff points given in Theorem 2.

Fix a parameter $t$, and consider the following scheme. There are a total of $B={n-\ell\choose t}(t-1)$ information symbols, denoted as $\mathsf{M}$, and there are a total of $R={n\choose t}(t-1)-B$ random symbols, denoted as $\mathsf{K}$. Assume that an eavesdropper has access to the repair messages to an arbitrary set of $\ell$ nodes, the collection of which is denoted as $\mathsf{E}$.

We first encode the $(R+B)={n\choose t}(t-1)$ symbols (in a finite field $\mathbb{F}_{q}$ such that $q\geq 2(R+B)$, and $q$ will be used as the basis of the entropy function), into the parity check symbols of an $(2(R+B),R+B)$ systematic MDS code. These $R+B$ symbols are broken into a total of ${n\choose t}$ parity groups, each with $(t-1)$ symbols, and each parity group is associated with a subset $\mathcal{A}$ of $[1:n]$ of cardinality $t$.

Next, we expand each parity group by introducing one additional parity symbol which can be the simple linear sum of them, in the same finite field as earlier (or even in the binary field, assuming the original one is an extension of the binary field). These $t$ symbols are then distributed into the subset of nodes associated with this parity group, one symbol to each node.

We need to show that the following three conditions are satisfied:

Reconstruction with any $n-1$ nodes. This is trivial since in each parity group, at most one of them is in the failed node, and thus the contents of the parity group can be recovered. This also implies that

[TABLE]

• 2)

Repair with the remaining $n-1$ nodes. Assume without loss of generality that node 1 fails. Then, to repair the symbol in the parity group associated with each $\mathcal{A}$ such that $1\in\mathcal{A}$ and $|\mathcal{A}|=t$, we can send from the remaining nodes all the other symbols in this parity group. The total transmission is thus given by:

[TABLE]

• 3)

Security against any eavesdropper on $\ell$ nodes. We need to show that

[TABLE]

This follows from

[TABLE]

All the parity groups that have symbols in the compromised nodes are completely revealed by accessing $\mathsf{E}$, and conversely all the symbols in $\mathsf{E}$ can be generated by these parity groups alone. A total of ${n\choose t}-{{n-\ell}\choose t}$ parity groups are exposed, implying that

[TABLE]

It only remains to show that

[TABLE]

which follows from the fact that given the eavesdropper’s information and the message $\mathsf{M}$, the random symbols $\mathsf{K}$ can be completely recovered. This can be seen as follows: there are a total of $R$ symbols (after removing the simple sums in each parity group) from $\mathsf{E}$ that were original parity symbols of the $(2(R+B),R+B)$ MDS code, but any $R+B$ codeword symbols can be used to recover the original information $(\mathsf{M},\mathsf{R})$, which we indeed have together with the $B$ information symbols.

Normalizing $\alpha_{t}$ and $\beta_{t}$ by $B$ proves the achievability of the tradeoff points given in Theorem 2.

V Proof of the Converse Results

V-A Proof of (9) and (10)

Let us first outline the main ingredients for proving the inequalities (9) and (10).

Total number of nodes. To prove the inequalities (9) and (10), let us first note that these two inequalities are independent of the total number of storage nodes $n$ in the system. In our proof, we only need to consider the cases where $n=d+1$. For the cases where $n>d+1$, since any subsystem consisting of $d+1$ out of the total $n$ storage nodes must give rise to a $(d+1,k,d,\ell)$ secure exact-repair regenerating code problem. Therefore, these two inequalities as outer bounds must apply as well. When $n=d+1$, any repair group $\mathcal{B}$ of size $d$ is uniquely determined by the node $j$ to be repaired, i.e., $\mathcal{B}=[1:n]\setminus\{j\}$, and hence can be dropped from the notation $\mathsf{S}^{\mathcal{B}}_{i\rightarrow j}$ without causing any confusion.

• 2)

Code symmetry. Due to the built-in symmetry of the problem, to prove the inequalities (9) and (10), we only need to consider the so-called symmetrical codes [10] for which the joint entropy of any subset of random variables from

[TABLE]

remains unchanged under any permutation over the storage-node indices.

• 3)

Key collections of random variables. Focusing on the symmetrical $(n=d+1,d,N,K,T,S)$ codes, the following collections of random variables play a key role in our proof:

[TABLE]

In particular, the collection $\mathsf{L}_{t,s}$ defined in (34) was first identified in [17] for proving that separate encoding can achieve the MBR point for multilevel diversity coding with regeneration. As we shall see, here it also plays a key role in our proof of (9) and (10). Fig. 3 illustrates the structure of $\mathsf{L}_{0,4}$, $\mathsf{L}_{1,4}$ and $\mathsf{L}_{2,4}$ in the repair diagram introduced by Duursma [11] for $n=5$.

An important part of the proof is to understand the relations between the collections of random variables defined above, and to use them to derive the desired converse results. We have the following key lemmas, whose proof can be found in the Appendix.

Lemma 1**.**

For any $(n=d+1,k,d,N,K,T,S)$ code that satisfies the node-regeneration requirement (3), $(\underline{\mathsf{S}}_{\rightarrow[t+1:s]},\mathsf{W}_{[t+1:s]})$ is a function of $\mathsf{L}_{t,s}$ for any $s\in[1:n]$ and $t\in[0:s-1]$.

Lemma 2**.**

For any symmetrical $(n=d+1,k,d,N,K,T,S)$ code, we have

[TABLE]

for any $t\in[1:2]$, $r\in[2:k-1]$, $p\in[1:r-t+1]$, and $q\in[0:d-r-1]$. It follows that

[TABLE]

for any $t\in[1:2]$, $j\in[2:k]$, and $m\in[1:j-t+1]$.

Lemma 3**.**

For any symmetrical $(n=d+1,k,d,N,K,T,S)$ code that satisfies the node-regeneration requirement (3), we have

[TABLE]

for any $j\in[2:k-1]$ and $t\in[j:k-1]$. It follows that

[TABLE]

for any $j\in[2:k-1]$ and $m\in[j:k-1]$.

The inequality (9) can now be proved as follows:

[TABLE]

where $(a)$ follows from the repair-secrecy constraint (4); $(b)$ follows from the fact that $\mathsf{W}_{[1:\ell]}$ is a function of $\mathsf{S}_{\rightarrow[1:\ell]}$ due to the node-regeneration constraint (3); $(c)$ follows from the fact that $\mathsf{W}_{[\ell+1:k]})$ is a function of $\mathsf{L}_{\ell,k}$ by Lemma 1; $(d)$ follows from the fact that $H(\mathsf{M}|\mathsf{S}_{\rightarrow[1:\ell]},\overline{\mathsf{S}}_{\rightarrow[\ell+1:k]},\mathsf{W}_{[1:k]})=0$ due to the message-recovery constraint (2); and $(e)$ follows from the bandwidth constraint on the repair messages. Normalizing both sides by $B$ completes the proof of (9).

To prove the inequality (10), we shall consider the cases where $T_{k,d,\ell}\leq d$ and $d\leq T_{k,d,\ell}\leq d+\sqrt{d\ell}$ separately.

Case 1: $T_{k,d,\ell}\leq d$. In this case, we have

[TABLE]

where $(a)$ follows from the fact that

[TABLE]

due to the symmetrical code that we consider; $(b)$ is due to the storage-capacity constraint $H(\mathsf{W}_{1})\leq\alpha$; $(c)$ is due to the fact that $\mathsf{S}_{1\rightarrow[2:\ell+1]}$ is a function of $\mathsf{W}_{1}$; $(d)$ follows from the fact that

[TABLE]

due to the submodularity of the entropy function; $(e)$ follows from the fact that

[TABLE]

and $(f)$ follows from the facts that

[TABLE]

Applying (36) with $(t,j,m)=(1,\ell+1,\ell)$ and $(t,j,m)=(1,\ell,\ell)$, respectively gives:

[TABLE]

Substituting (44) and (45) into (39) gives:

[TABLE]

where $(a)$ follows from the fact that $(\mathsf{W}_{[2:k]},\underline{\mathsf{S}}_{\rightarrow[2:k]})$ is a function of $\mathsf{L}_{1,k}$ by Lemma 1; $(b)$ follows from the fact that $\mathsf{M}$ is a function of $\mathsf{W}_{[1:k]}$ due to the message-recover constraint (2); $(c)$ follows from the repair-secrecy constraint (4); and $(d)$ follows again from (40) due to the symmetrical code that we consider. Canceling $dH(\mathsf{S}_{\rightarrow[1:\ell]})$ from both sides of the inequality completes the proof of (10) for the cases where $T_{k,d,\ell}\leq d$.

Case 2: $d\leq T_{k,d,\ell}\leq d+\sqrt{d\ell}$. Note that if $k=\ell+1$, we have $T_{k,d,\ell}=d-\ell<d$. Therefore, in this case we must have $k\geq\ell+2\geq 3$. In addition, let

[TABLE]

and we have

[TABLE]

It follows that

[TABLE]

where $(a)$ follows from (40) due to the symmetrical code that we consider; $(b)$ is due to the storage-capacity constraint $H(\mathsf{W}_{1})\leq\alpha$; $(c)$ is due to the fact that $\mathsf{S}_{1\rightarrow[2:\ell+1]}$ is a function of $\mathsf{W}_{1}$; $(d)$ follows from (41) due to the submodularity of the entropy function; and $(e)$ follows from (42).

The first term on the right-hand side of (46) can be further bounded from below by the fact that $\mathsf{L}_{2,\ell+1}$ is a function of $\mathsf{L}_{1,\ell+1}$ by Lemma 1, so we have

[TABLE]

To bound from below the second term on the right-hand side of (46), note that

[TABLE]

where $(a)$ follows from the fact that $\mathsf{S}_{\ell+1\rightarrow 1}$ is a function of $\mathsf{W}_{\ell+1}$, which is in turn a function of $\mathsf{L}_{1,\ell+1}$ by Lemma 1; (b) follows from (38) with $(j,m)=(\ell+1,\ell+1)$; $(c)$ is due to the storage-capacity constraint $H(\mathsf{W}_{\ell+1})\leq\alpha$; $(d)$ follows from the fact that $\mathsf{S}_{\ell+1\rightarrow 1}$ is a function of $\mathsf{W}_{\ell+1}$; $(e)$ follows from the fact that

[TABLE]

due to the submodularity of the entropy function; $(f)$ follows yet again from the fact that $\mathsf{S}_{\ell+1\rightarrow 1}$ is a function of $\mathsf{W}_{\ell+1}$; $(g)$ follows from the facts that

[TABLE]

due to the symmetrical code that we consider; and $(h)$ follows from the fact that $\mathsf{L}_{2,k}$ is a function of $\mathsf{L}_{1,k}$ by Lemma 1, so we have

[TABLE]

Substituting (47) and (48) into (46) gives:

[TABLE]

where $(a)$ and $(c)$ follow from the fact that

[TABLE]

$(b)$ follows from (36) with $(t,j,m)=(2,\ell+1,l)$; $(d)$ follows from the fact that $(\mathsf{W}_{[3:k]},\underline{\mathsf{S}}_{\rightarrow[3:k]})$ is a function of $\mathsf{L}_{2,k}$ by Lemma 1; $(e)$ follows from the fact that $\mathsf{M}$ is a function of $\mathsf{W}_{[1:k]}$ due to the message-recover constraint (2); $(f)$ is due to the secrecy constraint (4); and $(g)$ follows from the fact that

[TABLE]

due to the symmetrical code that we consider. Canceling $dH(\mathsf{S}_{\rightarrow[1:\ell]})$ from both sides of the inequality completes the proof of (10) for $d\leq T_{k,d,\ell}\leq d+\sqrt{d\ell}$.

V-B Proof of (18)

Assume that $k=d=n-1$ and $\ell=1$. As before, we shall also assume without loss of generality that the codes that we consider here are symmetrical ones.

Let us first show that for any $i\in[1:n-1]$, we have

[TABLE]

which can be seen as follows:

[TABLE]

where $(a)$ follows from the fact that $H(\mathsf{S}_{\rightarrow 1})=H(\mathsf{S}_{\rightarrow i})$ due to the symmetrical code that we consider; $(b)$ is due to the fact that $\underline{\mathsf{S}}_{\rightarrow i}$ is a function of $\mathsf{W}_{[1:i-1]}$; and $(c)$ is due to the submodularity of the entropy function. Canceling $H(\mathsf{W}_{[1:i-1]})$ from both sides completes the proof of (54).

Setting $i=2,3$ in (54) and by the symmetrical code that we consider, we have

[TABLE]

and

[TABLE]

Adding (55) and (56) gives:

[TABLE]

Furthermore, by the repair-bandwidth constraint, we have

[TABLE]

Adding (57) and (58) gives:

[TABLE]

where the last equality follows from the change of variable $i\rightarrow n-i$.

To proceed, we shall need the following lemma, whose proof can be found in the Appendix.

Lemma 4**.**

For any symmetrical $(n,k=n-1,d=n-1,N,K,T,S)$ code that satisfies the node-regeneration requirement (3) and the repair-secrecy constraint (4) with $\ell=1$, we have

[TABLE]

Adding (59) and (60) gives:

[TABLE]

Canceling $3H(\mathsf{S}_{\rightarrow 1})$ from both sides and normalizing the remaining terms by $B$ complete the proof of (18).

V-C Proof of (19)

Let us first show that

[TABLE]

which can be seen as follows.

First note that

[TABLE]

where $(a)$ follows from (54) with $n=7$ and $i=2$; and $(b)$ follows from the fact that $H(\mathsf{S}_{1\rightarrow 2})=H(\mathsf{S}_{7\rightarrow 6})$ due to the symmetrical code that we consider. Next, we have

[TABLE]

where $(a)$ follows from (54) with $n=7$ and $i=3$; and $(b)$ follows from the fact that $H(\mathsf{S}_{[1:2]\rightarrow 3})=H(\mathsf{S}_{[6:7]\rightarrow 5})$ due to the symmetrical code that we consider. Finally, setting $n=7$ and $i=4$ in (54) gives

[TABLE]

Adding (62)–(64) completes the proof of (61).

To proceed, we shall consider the cases where $\alpha\geq H(\mathsf{S}_{[2:4]\rightarrow 1})$ and $\alpha\leq H(\mathsf{S}_{[2:4]\rightarrow 1})$, separately.

Case 1: $\alpha\geq H(\mathsf{S}_{[2:4]\rightarrow 1})$. In this case, we have

[TABLE]

where $(a)$ follows from (61); $(b)$ follows from the fact that $H(\mathsf{S}_{[1:3]\rightarrow 4})=H(\mathsf{S}_{[5:7]\rightarrow 1})$ due to the symmetrical code that we consider; and $(c)$ follows from Lemma 4 with $n=7$. Canceling $3H(\mathsf{S}_{\rightarrow 1})$ from both sides and normalizing the remaining terms by $B$ complete the proof of (19) for the cases where $\alpha\geq H(\mathsf{S}_{[2:4]\rightarrow 1})$.

Case 2: $\alpha\leq H(\mathsf{S}_{[2:4]\rightarrow 1})$. Note that in this case, by node-capacity constraint and the symmetry of the code that we consider, we have

[TABLE]

It follows that

[TABLE]

where $(a)$ follows from (65); $(b)$ follows from the fact that $\mathsf{W}_{i}$ is a function of $(\overline{\mathsf{S}}_{\rightarrow i},\mathsf{W}_{[1:i-1]})=\mathsf{L}_{i-1,i}$ by Lemma 1; $(c)$ follows from the fact that $\mathsf{S}_{[i+1:j-1]\rightarrow i}$ is a function of $\mathsf{W}_{[1:j-1]}$; and $(d)$ follows from the fact that $\mathsf{S}_{j\rightarrow[2:j-1]}$ is a function of $\mathsf{W}_{j}$. Further note that

[TABLE]

where $(a)$ follows from the fact that $H(\mathsf{S}_{j\rightarrow[2:j-1]})=H(\mathsf{S}_{j+1\rightarrow[3:j]})$ due to the symmetrical code that we consider; and $(b)$ is due to the node-capacity constraint. We thus have

[TABLE]

where $(a)$ follows from (61); $(b)$ follows from (66); $(c)$ follows from (67); $(d)$ follows from the node-capacity constraint; $(e)$ follows from the fact that $H(\mathsf{L}_{2,6})\geq H(\mathsf{W}_{[1:6]})$ due to Lemma 1; $(f)$ follows from the facts that $\mathsf{M}$ is a function of $\mathsf{W}_{[1:6]}$ due to the message-recovery requirement (2) and that $\mathsf{W}_{7}$ is a function of $\mathsf{S}_{\rightarrow 7}$, which is in turn a function of $\mathsf{W}_{[1:6]}$; $(g)$ follows from the fact that $\mathsf{S}_{\rightarrow 1}$ is a function of $\mathsf{W}_{[2:7]}$; and $(h)$ follows from the repair-secrecy constraint (4) with $\ell=1$. Canceling $3H(\mathsf{S}_{\rightarrow 1})$ from both sides and normalizing the remaining terms by $B$ complete the proof of (19) for the cases where $\alpha\geq H(\mathsf{S}_{[2:4]\rightarrow 1})$.

VI Concluding Remarks

In this paper, we considered the $(n,k,d,\ell)$ secure exact-repair regenerating code problem, which has been previously studied in [12, 13, 14, 15]. We proved that when the secrecy parameter $\ell$ is sufficiently large, the SRK point [13] is the only corner point of the achievable normalized storage-capacity repair-bandwidth tradeoff region. This includes all previous results from [14] and [15] as special cases. On the other hand, when $\ell$ is small, we showed that it is entirely possible that the achievable normalized storage-capacity repair-bandwidth tradeoff region features multiple corner points. In particular, we showed that the achievable normalized storage-capacity repair-bandwidth tradeoff region for the $(7,6,6,1)$ problem has exactly two corner points. This suggests a much “smoother” transition, in terms of the rate region, from the original exact-repair regenerating code problem to the secrecy extension than that suggested by the previous results from [14] and [15].

The question whether (8) is also necessary for the SRK point [13] to be the only corner point of the achievable normalized storage-capacity repair-bandwidth tradeoff region remains open. Significant research is also needed to further understand how the tradeoff region $\mathcal{R}_{n,k,d,\ell}$ may look like when $\ell$ is small (the non-secrecy case with $\ell=0$ remains open and appears to be very challenging).

Acknowledgment

The authors would like to thank Dr. Kenneth Shum for sharing with us an early draft of his paper [15], which inspired our interest in the secure exact-repair regenerating code problem.

[Proof of the Technical Lemmas]

Proof of Lemma 1. Fix $s\in[1:n]$ and $t\in[0:s-1]$. Let us first note that $\underline{\mathsf{S}}_{\rightarrow t+1}$ is a function of $\mathsf{W}_{[1:t]}$. As a result, $\mathsf{S}_{\rightarrow t+1}=(\underline{\mathsf{S}}_{\rightarrow t+1},\overline{\mathsf{S}}_{\rightarrow t+1})$ is a function of $\mathsf{L}_{t,s}$. It thus follows immediately from the node-regeneration requirement (3) that $\mathsf{W}_{t+1}$ is a function of $\mathsf{L}_{t,s}$. Similarly and inductively, it can be shown that $(\underline{\mathsf{S}}_{\rightarrow j},\mathsf{W}_{j})$ is a function of $\mathsf{L}_{t,s}$ for all $j\in[t+2:s]$ as well. This completes the proof of Lemma 1.

Proof of Lemma 2. To prove (35), let us fix $t\in[1:2]$, $r\in[2:k-1]$, $p\in[1:r-t+1]$, and $q\in[0:d-r-1]$. We have

[TABLE]

where $(a)$ follows from the fact that $H(\mathsf{S}_{1\rightarrow[2:p+1]})=H(\mathsf{S}_{r+q+2\rightarrow[r-p+2:r+1]})$ due to the symmetrical codes that we consider; $(b)$ follows from the submodularity of the entropy function; and $(c)$ follows from the fact that $H(\mathsf{S}_{r+q+2\rightarrow[r-p+2:r]})=H(\mathsf{S}_{1\rightarrow[2:p]})$ again due to the symmetrical codes that we consider. This completes the proof of (35) for any $r\in[2:k-1]$, $p\in[1:r-t+1]$, and $q\in[0:d-r-1]$.

To prove (36), let us fix $t\in[1:2]$, $j\in[2:k]$, and $m\in[1:j-t+1]$. Notice that (36) holds trivially with equality when $j=k$, so we only need to consider the cases where $j\in[2:k-1]$ for $k\geq 3$. (When $k=2$, $[2:k-1]$ is empty and there is nothing to prove.) Now adding (35) for $q\in[0:d-r-1]$ gives:

[TABLE]

Canceling $\sum_{q=1}^{d-r-1}H(\mathsf{L}_{t,r},\mathsf{S}_{[r+2:r+q+1]\rightarrow r+1})$ from both sides of the above inequality gives:

[TABLE]

for any $r\in[2:k-1]$ and $p\in[1:r-t+1]$. Adding (68) for $r\in[j:k-1]$ and $p\in[1:m]$ gives:

[TABLE]

Canceling $T_{k,d,j}\sum_{p=2}^{m}H(\mathsf{S}_{1\rightarrow[2:p]})+m\sum_{r=j+1}^{k-1}H(\mathsf{L}_{t,r})$ from both sides of the above inequality gives:

[TABLE]

Dividing both sides by $m$ completes the proof of (36) for any $t\in[1:2]$, $j\in[2:k]$, and $m\in[1:j-t+1]$. This completes the proof of Lemma 2.

Proof of Lemma 3. To prove (37), let us fix $j\in[2:k-1]$ and $t\in[j:k-1]$. Let $n-j=u(d-t)+p$ for some positive integers $u$ and $p\in[1:d-t]$. Let

[TABLE]

and

[TABLE]

for $q\in[1:u-1]$. Notice that we have

[TABLE]

By the symmetry of the codes that we consider, we have

[TABLE]

for any $B\subseteq[t+2:n]$ such that $|B|=|\tau_{0}|=p$. It follows that

[TABLE]

where $(a)$ follows from the well-known Han’s inequality [18]; $(b)$ follows from the facts that $(\overline{\mathsf{S}}_{\rightarrow[3:j]},\mathsf{S}_{t+1\rightarrow 2})$ is a sub-collection of random variables from $\mathsf{L}_{1,t}$ and that conditioning reduces entropy; and $(c)$ follows from the fact that $(\mathsf{W}_{2},\underline{\mathsf{S}}_{\rightarrow[3:j]})$ is a function of $\mathsf{L}_{1,t}$ by Lemma 1.

Next, let us show, by induction, that

[TABLE]

for any $r\in[1:u]$.

For the base case where $r=1$, we have

[TABLE]

where $(a)$ and $(e)$ follow from the fact that $(\mathsf{W}_{2},\underline{\mathsf{S}}_{\rightarrow[2:j]},\mathsf{S}_{\cup_{q=0}^{u-r}\tau_{q}\rightarrow t+1})$ is a function of $\mathsf{L}_{1,t}$ by Lemma 1; $(b)$ follows from the fact that $\underline{\mathsf{S}}_{\rightarrow[2:j]}$ is a function of $\mathsf{L}_{1,j}$ by Lemma 1; and $(c)$ follows from the fact that

[TABLE]

due to the symmetrical codes that we consider; and $(d)$ follows from the submodularity of the entropy function. This completes the proof of the base case.

Now assume that (74) holds for some $r\in[1:u-1]$. Similar to the base case, we have

[TABLE]

where $(a)$ and $(d)$ follow from the fact that $(\mathsf{W}_{2},\underline{\mathsf{S}}_{\rightarrow[2:j]},\mathsf{S}_{\cup_{q=0}^{u-(r+1)}\tau_{q}\rightarrow t+1})$ is a function of $\mathsf{L}_{1,t+1}$ by Lemma 1; $(b)$ follows from the fact that

[TABLE]

due to the symmetrical codes that we consider; and $(c)$ follows from the submodularity of the entropy function. Adding (74) and (76) gives

[TABLE]

This completes the proof of the induction step.

Finally, setting $r=u$ in (74) gives:

[TABLE]

Substituting (73) into (78) and using the fact that

[TABLE]

we have

[TABLE]

Finally, due to the symmetrical codes that we consider, we have

[TABLE]

where the last equality follows from the fact that $\underline{\mathsf{S}}_{\rightarrow[2:j-1]}$ is a function of $\mathsf{L}_{1,j-1}$ by Lemma 1. Substituting (81) into (80) completes the proof of (37) for any $j\in[2:k-1]$ and $t\in[j:k-1]$.

Proof of Lemma 4. First note that

[TABLE]

where $(a)$ follows from the fact that $\mathsf{W}_{i}$ is a function of $(\mathsf{W}_{[1:i-1]},\overline{\mathsf{S}}_{\rightarrow i})=\mathsf{L}_{i-1,i}$ by Lemma 1; $(b)$ follows from the fact that $\mathsf{S}_{[i+1;j-1]\rightarrow i}$ is a function of $\mathsf{W}_{[1:j-1]}$; and $(c)$ follows from the fact that $H(\mathsf{S}_{j\rightarrow[1:j-1]})=H(\mathsf{S}_{j+1\rightarrow[2:j]})$ due to the symmetrical code that we consider.

Further note that

[TABLE]

Adding (82)–(83) gives:

[TABLE]

where $(a)$ follows from the fact that $\mathsf{S}_{j\rightarrow[1:j-1]}$ is a function of $\mathsf{W}_{j}$; and $(b)$ follows from the fact that $\mathsf{W}_{[2:n-1]}$ is a function of $\mathsf{L}_{1,n-1}$ by Lemma 1 so we have $H(\mathsf{L}_{1,n-1})\geq H(\mathsf{W}_{[1:n-1]})$.

Finally, by the node-capacity constraint, we have

[TABLE]

Adding (84) and (85) gives:

[TABLE]

where $(a)$ follows from the facts that $\mathsf{M}$ is a function of $\mathsf{W}_{[1:n-1]}$ by the message-recovery requirement (2) and that $\mathsf{W}_{n}$ is a function of $\mathsf{S}_{\rightarrow n}$, which is in turn a function of $\mathsf{W}_{[1:n-1]}$; $(b)$ follows from the fact that $\mathsf{S}_{\rightarrow 1}$ is a function of $\mathsf{W}_{[2:n]}$; and $(c)$ follows from the repair-secrecy requirement (4) with $\ell=1$. This completes the proof of Lemma 4.