Secure Multi-Source Multicast

TL;DR

This paper addresses secure multi-source multicast by characterizing the rate region under individual security, demonstrating that full capacity can be achieved without increasing field size, thus advancing secure network coding.

Contribution

It provides a complete characterization of the rate region for secure MSM under individual security and proves capacity achievement at the cut-set bound.

Findings

Capacity is achievable at the cut-set bound.

Field size remains similar to non-secure MSM.

Complete rate region characterization for individual security.

Abstract

The principal mission of Multi-Source Multicast (MSM) is to disseminate all messages from all sources in a network to all destinations. MSM is utilized in numerous applications. In many of them, securing the messages disseminated is critical. A common secure model is to consider a network where there is an eavesdropper which is able to observe a subset of the network links, and seek a code which keeps the eavesdropper ignorant regarding all the messages. While this is solved when all messages are located at a single source, Secure MSM (SMSM) is an open problem, and the rates required are hard to characterize in general. In this paper, we consider Individual Security, which promises that the eavesdropper has zero mutual information with each message individually. We completely characterize the rate region for SMSM under individual security, and show that such a security level is achievable at the full capacity of the network, that is, the cut-set bound is the matching converse, similar to non-secure MSM. Moreover, we show that the field size is similar to non-secure MSM and does not have to be larger due to the security constraint.

Equations

$${\text{M}}_s=[{\vec{M}}_{s,1};{\vec{M}}_{s,2};\dots ;{\vec{M}}_{s,k}]\in \{0,1{\}}^{k\times c},$$

$${\text{Z}}_w=[Z_1^c;Z_2^c;\dots ;Z_w^c]\in \{0,1{\}}^{w\times c}.$$

$$P({\hat{\text{M}}}_s({\text{Y}}_d)\ne {\text{M}}_s)\le ϵ,$$

$$H(M_{s,j}|{\text{Z}}_w)=H(M_{s,j}),$$

$$H({\text{M}}_s|{\text{Z}}_w)=H({\text{M}}_s).$$

$$I(M_{s,k};{\text{Z}}_w$$

$$=H(M_{s,k}|M_{s,1},\dots ,M_{s,k-1})$$

$$-H(M_{s,k}|{\text{Z}}_w,M_{s,1},\dots ,M_{s,k-1})$$

$$=H(M_{s,k})-H(M_{s,k}|{\text{Z}}_w,M_{s,1},\dots ,M_{s,k-1})$$

$$\ge H(M_{s,k})-H(M_{s,k}|{\text{Z}}_w)$$

$$=I(M_{s,k};{\text{Z}}_w).$$

$$\begin{gathered} I({\text{M}}_s;{\text{Z}}_w)=\sum _{k}I(M_{s,k};{\text{Z}}_w|M_{s,1},\dots ,M_{s,k-1}) \\ \ge \sum _{k}I(M_{s,k};{\text{Z}}_w). \end{gathered}$$

$$H(M_{s,j}|{\text{Z}}_w)/H(M_{s,j})\to 1$$

$$f:{\mathcal{M}}_s\to {\mathcal{X}}_s\in \{0,1{\}}^{n\times c},$$

$$\vec{Y}=\sum _{r=1}^n{\mu }_r{\vec{X}}_r.$$

$$P[S_F\ge T+k]<q^{-\alpha k}.$$

$$H({\text{M}}_s)\le \rho (s,d_i)-\rho (s,z)+w.$$

$$T^{\prime }=T+\frac{1}{\alpha }(k|S|+\log {ϵ}^{-1})$$

$$\begin{gathered} Pr({\text{X}}_s^k(i)\in {\mathcal{C}}_k\cap {\text{X}}_s^k(i)\in \mathcal{S}h({\text{Z}}_w(i),l)) \\ =\frac{\mathcal{V}ol(\mathcal{S}h({\text{Z}}_w(i),l))}{2^k}=\frac{2^{\left(k-w\right)}}{2^k}. \end{gathered}$$

$$\text{E}\left[|\{m(i):X^k(i)\in \mathcal{S}h(Z(i),l)\}|\right]=\frac{2^{w+kϵ}\ast 2^{k-w}}{2^k}=2^{kϵ}.$$

$$\begin{gathered} {\mathcal{E}}_{C_1}(Z(i),l):=\{(1-{\epsilon }^{\prime })2^{kϵ}\le \\ |m(i):X_s^k(i)\in \mathcal{S}h({\text{Z}}_w(i),l)|\le (1+{\epsilon }^{\prime })2^{kϵ}\}. \end{gathered}$$

$$Pr({\mathcal{E}}_{C_1}(Z(i),l))\ge 1-2^{-{\epsilon }^{\prime }{2}^{kϵ}}.$$

$$I({\text{M}}_s^{k_s}(i);{\text{Z}}_w(i))$$

$$=H({\text{M}}_s^{k_s}(i))-H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i))$$

$$\le k_s-H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i))$$

$$\le k_s-H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i),{\text{1}}_{{\mathcal{E}}_{C_1}})$$

$$=k_s-[P({\mathcal{E}}_{C_1}^c)H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i),{\text{1}}_{{\mathcal{E}}_{C_1}}=0)$$

$$+P({\mathcal{E}}_{C_1})H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i),{\text{1}}_{{\mathcal{E}}_{C_1}}=1)]$$

$$\le k_s-(1-2^{-{\epsilon }^{\prime }{2}^{kϵ}})H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i),{\text{1}}_{{\mathcal{E}}_{C_1}}=1)$$

$$\le k_s-H({\text{M}}_s^{k_s}(i)|{\text{Z}}_w(i),{\text{1}}_{{\mathcal{E}}_{C_1}}=1)+2^{-{\epsilon }^{\prime }{2}^{kϵ}}{k}_s.$$

$$I({\text{M}}_s^{k_s}(i);{\text{Z}}_w(i))\le k_s({\epsilon }^{\prime }+2^{-{\epsilon }^{\prime }{2}^{kϵ}}).$$

$$H({\text{M}}_s)$$

$$=H({\text{M}}_s^{k-w}|{\text{M}}_s^w)+H({\text{M}}_s^w)$$

$$\stackrel{(a)}{\le }I({\text{M}}_s^{k-w};{\text{Y}}_d|{\text{M}}_s^w)+H({\text{M}}_s^{k-w}|{\text{Y}}_d)+w$$

$$\stackrel{(b)}{=}I({\text{M}}_s^{k-w};\text{Z},\bar{\text{Z}}|{\text{M}}_s^w)+w$$

$$=I({\text{M}}_s^{k-w};\text{Z}|{\text{M}}_s^w)+I({\text{M}}_s^{k-w};\bar{\text{Z}}|\text{Z},{\text{M}}_s^w)+w$$

$$=I({\text{M}}_s^{k-w};\text{Z})+I({\text{M}}_s^w;\text{Z}|{\text{M}}_s^{k-w})-I(\text{Z};{\text{M}}_s^w)$$

$$+I({\text{M}}_s^{k-w};\bar{\text{Z}}|\text{Z},{\text{M}}_s^w)+w$$

$$\stackrel{(c)}{=}I({\text{M}}_s^w;\text{Z}|{\text{M}}_s^{k-w})-I(\text{Z};{\text{M}}_s^w)+I({\text{M}}_s^{k-w};\bar{\text{Z}}|\text{Z},{\text{M}}_s^w)+w$$

$$=I({\text{M}}_s^w;\text{Z}|{\text{M}}_s^{k-w})-I(\text{Z};{\text{M}}_s^w)$$

Full text

A common secure model is to consider a network where there is an eavesdropper which is able to observe a subset of the network links, and seek a code which keeps the eavesdropper ignorant regarding all the messages. While this is solved when all messages are located at a single source, Secure MSM (SMSM) is an open problem, and the rates required are hard to characterize in general.

In this paper, we consider Individual Security, which promises that the eavesdropper has zero mutual information with each message individually, or, more generally, with sub sets of messages. We completely characterize the rate region for SMSM under individual security, and show that such a security level is achievable at the full capacity of the network, that is, the cut-set bound is the matching converse, similar to non-secure MSM. Moreover, we show that the field size is similar to non-secure MSM and does not have to be larger due to the security constraint.

I Introduction

Linear Network Coding (LNC) [1] and Random Linear Network Coding (RLNC) [2] are essential for efficient utilization of network resources. With network coding, multiple sources can multicast information to all destinations simultaneously, at rates up to the min-cut between the sources and the destinations. Figure 1 depicts a simple example: the min-cut from any source to any destination is 2, and from both sources to any destination is 4, hence one can disseminate 2 messages from each source to all destinations. However, in many practical multicast applications, it is important to ensure privacy is not compromised if an eavesdropper (Eve) is present in the network. Indeed, the theory of secure network coding is vast. We include here only the most relevant works.

When the sources are co-located at a single node, several secure network coding solutions were suggested [3, 4, 5, 6, 7, 8]. Such solutions guarantee the mutual information between Eve’s data, Z, and all the messages is 0. For example, returning to Figure 1, if only source $s_{1}$ had messages to send, and Eve would be able to wiretap one link in the network, then secure network coding would guarantee secure dissemination of one message from the source to all destinations. This is a reduction in rate compared to the full capacity, as the min-cut from $s_{1}$ to any destination is 2. However, when requiring zero mutual information with all messages from the source, this rate reduction is essential, and matches the converse result.

When the network includes multiple sources which are not co-located, the problem is more involved. Clearly, applying a single-source, secure network coding solution at each source would give an achievable scheme. In the example, if Eve wiretaps one link, one can clearly multicast one message from each source, to all destinations. This solution, however, may be wasteful, as it is half of the full capacity of the network, “wasting” one message per source, although Eve may capture only a single link regardless of the number of sources. Indeed, there is no matching converse result for the above solution.

In [9, 10], the authors gave a necessary and sufficient condition for Secure Multi-Source Multicast (SMSM). However, it is a condition on ranks of matrices having the global encoding vectors as columns, and, unlike non-secure MSM or secure single-source multicast, it does not translate directly to rate or min-cut constraints. Thus, the problem of determining the rate region in SMSM is an open problem in general [11], and as mentioned in [12, Section VI], seeking models for which it is solvable is important. In [13], the authors characterized the network coding capacity of several models, including SMSM, via the entropic region $\Gamma^{*}$. Yet, to date, this region is not fully characterized.

Main Contribution

In this paper, we consider SMSM under an Individual Security constraint. In this model, the eavesdropper is kept ignorant, in the sense of having zero mutual information, regarding each message separately (or, more generally, regarding sub sets of messages), yet may potentially obtain insignificant information about mixtures of packets transmitted. Such a security model was recently used in various canonical problems, e.g., wiretap channels [14], more general broadcast channels [15, 16, 17, 18] and multiple-access channels [19, 20], and, although not specifically mentioned as such, is also related to weakly secure network coding [21] and the notion of algebraic security [22, 23], which consider the information in linear combinations of messages. Moreover, a related single-source problem is that of distributed storage [24, 25, 26], which we also address.

We completely characterize the rate region for individually secure MSM. Specifically, we show that secure communication is achievable up to the min-cut, that is, without any decrease in the rate or any message “blow-up” by extra randomness. In fact, due to the individual security constraint, messages protect one another, and in the context of Figure 1, one is able to send two messages from each source securely, although Eve may observe any single link. In that sense, we non-trivially extend the single-source multicast results of [21] and [27] to multi-source multicast, giving both linear codes as well as non-linear codes over a small field size.

We then turn to a few applications where the suggested coding scheme can be useful. Specifically, we consider data centers, wireless networks and live broadcasting of video using multi-path streaming, and show how the individual security coding schemes suggested in this paper are applicable, achieving the full capacity of those systems. Finally, we show that the coding scheme is applicable to algebraic gossip as well [28], resulting in secure gossip without extra rounds. For example, consider the ”Random Phone Call” model. This model was introduced in [29] as special case of uniform gossip. In each round of communication, every participant may ”call” a random participant, and send one unit of information. The goal is, naturally, to disseminate messages from the source to all participants. Rigorously, the underlying graph is complete and unweighted. A detailed analysis of this model is given in [30, 31]. It was shown that in a random phone call model with $v$ nodes, the flooding time is $\Theta(\log v)$, with constant throughput. Of course, this is without any secrecy constraint. Any phone call which Eve listens to contains relevant information, and results in leakage. Using the code suggested in this paper, we will show that one can design a secure gossip scheme, which makes sure that as long as Eve does not listen to too many calls, she remains complectly ignorant regarding any specific message, and all this without any loss in throughput or number of rounds.

The structure of this paper is as follows. In Section II, a SMSM model is formally described. Section III includes our main results, with the individually-SMSM achievability proved in Section IV and converse proved in Section V. Section VI includes a linear code construction for the individually-SMSM model. Section VII describes a Strongly-SMSM algorithm and proves a direct result for it. In Section VIII, we show a few important examples, for which the individual security coding is applicable. Section IX concludes the paper.

II Model and Problem Formulation

SMSM is specified by a graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}$ and $\mathcal{E}$ are the node set and the edge set, respectively. We assume noise-free links of unit capacity. This capacity can be thought of as one ”packet” of $c$ bits, plus some negligible overhead.111As in most LNC solutions, a header is required for each message. Thus, we assume messages of length $c$, large enough to make the overhead in the header negligible.

The node set $\mathcal{V}$ contains a subset of source nodes $\mathcal{S}=\{S_{1},\ldots S_{|S|}\}$ and a subset of legitimate destination nodes $\mathcal{D}=\{D_{1},\ldots D_{|D|}\}$. Each of the sources has its own set of $k$ independent and uniformly distributed messages of length $c$ each, over the binary field. We denote them by a messages matrix

[TABLE]

where each row corresponds to a separate message $\vec{M}_{s,j}$, $j\in\{1,\ldots,k\}$. Note that both the independence of the messages, as well as their uniform distribution are critical to achieve secrecy. These assumption are, indeed, common in the related literature as well [20, 27, 12].

We assume an eavesdropper which can obtain a subset of $w$ packets traversing the network. Specifically, we define the eavesdropper matrix as

[TABLE]

We denote the values of min-cuts in the network by $\rho(.;.)$. For example, for $s_{1}\in\mathcal{S}$ and $d_{1}\in\mathcal{D}$, $\rho(s_{1};d_{1})$ represents the value of the min-cut from source node $s_{1}$ to legitimate node $d_{1}$. $\rho(s_{1};z)$ represents the value of the min-cut from source node $s_{1}$ to the eavesdropper (assuming $z$ is a virtual node with infinite capacity from the $w$ edges observed by Eve) and $\rho(\mathcal{S};d_{1})$ represents the value of the min-cut from all the source nodes to legitimate node $d_{1}$.

The goal is to design secure multi-source multicast coding scheme where legitimate nodes send their available messages in order to disseminate all the messages to all the legitimate destination nodes, yet, observing $w$ packets from the communication between legitimate nodes, the eavesdropper is ignorant regarding the messages.

Definition 1**.**

An MSM algorithm with parameters $k$ and $w$ is Reliable and Individually or Strongly secure if:

(1) Reliable: At the legitimate destination node $d\in\mathcal{D}$, letting $\textbf{Y}_{d}$ denote the message matrix obtained, for any set of messages $\textbf{M}_{s},s\in\mathcal{S}$, we have

[TABLE]

where $\hat{\textbf{M}}_{s}(\textbf{Y}_{d})$ is the estimation of messages $\textbf{M}_{s}$ at $d$.

(2) Individually secure: At the eavesdropper, observing $w$ packets, we have

[TABLE]

for all $j\in\{1,\ldots,k\}$ and for all $s\in\mathcal{S}$.

(3) Strongly secure: At the eavesdropper, observing $w$ packets, for all $s\in\mathcal{S}$ we have

[TABLE]

Remark 1*.*

The individual-secrecy constraint given in Definition 1.2 does not promise perfect, strong-secrecy [5, 9, 8], which is, having the mutual information with all messages negligible. Individual-secrecy ensures secrecy only on each message $M_{s,j}$ separately. The eavesdropper, observing $\textbf{Z}_{w}$, may obtain some information on the combination of $k$ messages since the messages are not independent given $\textbf{Z}_{w}$. However, since the $k$ original messages are mutually independent, the leaked information has no meaning [14, 15, 16, 17, 18, 19, 20, 32]. In other words, if the messages are independent, we have

[TABLE]

Hence,

[TABLE]

We require that the r.h.s will be small, however, this does not guarantee that the l.h.s is small. If the eavesdropper receives message $M_{s,j}$ by any other manner than the Individual-SMSM transmissions, Eve may obtain some information on other messages $M_{s,i},i\neq j$, from $M_{s,j}$ and $\textbf{Z}_{w}$. If it is required to prevent the possibility of such an attack, one can get perfect secrecy using Definition 1.3, yet at the price of a lower rate, as given in Section VII.

Remark 2*.*

For multicast problems and LNC, the condition in $(1)$ can be used with $\epsilon=0$ [1, 2]. Yet, we allow a small error to cope with protocols such as randomized gossip [28, 33], which we discuss later in this paper.

Remark 3*.*

The first code construction we consider, given in Section IV, is based on random coding. Therefore, in that case, the individual secrecy constraint will hold only asymptotically, that is,

[TABLE]

as $k$ grows. Then, in Section VI, we suggest a structured linear code, which results in zero mutual information, such that there is no requirement for $k$ to grow.

II-A Source and Network Coding

We assume a source $s\in\mathcal{S}$ may use an encoder,

[TABLE]

which maps each message matrix $\textbf{M}_{s}$ to a matrix $\textbf{X}_{s}$ of codewords. When using a strong security constraints, e.g., [5, 8], $n>k$ and this represents a message “blow-up” using a random key, used to confuse Eve. However, the main contribution herein, is that under individual-secrecy, $n=k$ suffices, and there will be no rate loss due to the secrecy constraint.

Then, the source packets $\vec{Y}$ transmitted are linear combinations of $\{\vec{X}_{r}\}_{r=1}^{n}$ with coefficients in the usual LNC sense, i.e.,

[TABLE]

Each node maintains a subspace $Y_{v}$ that is the span of all packets known to it. In RLNC, when node $v$ sends a packet, $Out(\vec{Y})$, it chooses uniformly a packet from $Y_{v}$ by taking a random linear combination. If a deterministic algorithm is used, e.g., [34], the coefficients are calculated based on the network topology. The code we suggest herein is only at the sources, and then utilizes any capacity-achieving, non-secure network code.

II-B Gossip in Oblivious Networks

While the results in this paper are tailored to LNC in the sense of [1, 2], they easily apply to algebraic gossip [28] as well. Such algebraic gossip protocol have been considered in the literature for many tasks, such as ensuring database consistency, computing aggregate information and other functions of the data [29, 35, 36, 37]. We briefly describe this model. The network operates in rounds. In each round $t$, the sources, as well as any legitimate node which has messages it previously received, pick a random node to exchange information with. The information exchange is done by either sending (PUSH) or receiving (PULL) a message. In algebraic gossip, the message sent by a node $v$ is simply a random linear combination of the vectors which form a basis for $Y_{v}$. The process stops when all the legitimate nodes have all the messages, i.e., have a full rank matrix. We briefly review the definitions and results from [33] for non-secure gossip networks, which we will use to formulate our result in this context.

Definition 2**.**

A network is oblivious if the topology of the network, $G_{t}$ at time $t$, only depends on $t$, $G_{t^{\prime}}$ for any $t^{\prime}<t$ and some randomness. We call an oblivious network model furthermore i.i.d., if the topology $G_{t}$ is independent of $t$ and prior topologies.

The importance of Definition 2 lies in the fact that the topology of an oblivious network may change in time, but only based on the past topology and some external randomness. Topology does not change based on the data traversing the network. Consider a single (uncoded) message, and the set of nodes $S_{l}$ which received that message after $l$ rounds. $S_{l}$ advances like a flooding process $F$. That is, $S_{l}\subseteq S_{l^{\prime}}\subseteq\mathcal{V}$ for $l\leq l^{\prime}$, with an absorbing state $\mathcal{V}$. We say that $F$ stops at time $t$ if the message is received at all nodes after $t$ rounds. Let $S_{F}$ be the random variable denoting the stopping time of $F$.

Definition 3**.**

We say an oblivious network with a vertex set $V$ floods in time $T$ with throughput $\alpha$ if there exists a prime power $q$ such that for every vertex $v\in V$ and every $k>0$ we have

[TABLE]

III Main Results

The three main results in this paper completely characterize the rate region for individually secure multi-source multicast. We give tight achievability and converse, and a tight characterization of the number of rounds required under a gossip model. Specifically, we first note that the individually secrecy constrain in Definition 1 is $I(M_{s,j};\textbf{Z}_{w})=0$ for any single message $j$. However, ensuring the mapping from $\textbf{M}_{s}$ to $\textbf{X}_{s}$ mixes the messages appropriately, i.e., satisfies rank constraints similar to [12, Lemma 3.1], can, in fact, ensure Eve is kept ignorant on any set of $k-(w+k\epsilon)$ messages, where $k\epsilon\geq 1$ is an integer and $\epsilon=o(k)$. That is, guarantee $k_{s}$-individual perfect secrecy with respect to any set of $k_{s}\leq k-(w+k\epsilon)$ messages. Let $\textbf{M}_{s}^{k_{s}}$ denote a set of $k_{s}$ messages from $s$. Thus, the first main result is the following achievability theorem, which states that $k_{s}$-individually-secure multi-source multicast is achievable at rates up to the network min-cuts, using LNC.

III-A Individually Secure MSM

Theorem 1**.**

Assume an SMSM network $(\mathcal{V},\mathcal{E},\mathcal{S},\mathcal{D},w)$. There exists a coding scheme which disseminates $k$ messages from each source in $\mathcal{S}$, to all destinations in $\mathcal{D}$, while keeping an eavesdropper which observes $w<k$ links ignorant with respect to any set of $k_{s}\leq k-(w+k\epsilon)$ messages individually, where $\epsilon=o(k)$, such that $I(\textbf{M}^{k_{s}}_{s};\textbf{Z}_{w})=0$, if:

For all $s\in\mathcal{S}$ and all $d\in\mathcal{D}$, $\rho(s,d)\geq k$. 2. 2.

For all $d\in\mathcal{D}$, $\rho(\mathcal{S},d)\geq k|S|$.

In Section IV-B, we prove the $k_{s}$-individual perfect secrecy constraint is indeed met. In particular, for any single message $j$ as given in Definition 1, we have

Corollary 1**.**

Assume an SMSM network $(\mathcal{V},\mathcal{E},\mathcal{S},\mathcal{D},w)$. There exists a coding scheme which disseminates $k$ messages from each source in $\mathcal{S}$, to all destinations in $\mathcal{D}$, while keeping an eavesdropper which observes $w<k$ links ignorant with respect to each message individually if:

For all $s\in\mathcal{S}$ and all $d\in\mathcal{D}$, $\rho(s,d)\geq k$. 2. 2.

For all $d\in\mathcal{D}$, $\rho(\mathcal{S},d)\geq k|S|$.

Note that under strong-secrecy, i.e., requiring Eve’s mutual information with all messages simultaneously to be zero, the problem of MSM is still open [11],[12, Section VI]. Clearly, if Eve observes $w$ links, a naive implementation, which increases the message rates from each source by $w$, can send $k$ messages from each source where $n\geq k+w+k\epsilon$ and achieve strong secrecy if:

For all $s\in\mathcal{S}$ and all $d\in\mathcal{D}$, $\rho(s,d)\geq n$. 2. 2.

For all $d\in\mathcal{D}$, $\rho(S,d)\geq n|S|$.

However, such an implementation is clearly wasteful, and, to date, the optimal strategy is unknown. Obviously, the required rates under strong secrecy are higher than the min-cut bound, as even for single-source multicast one needs $\rho(s_{1},d_{i})\geq k+w$ [5]. Thus, the importance of Theorem 1 is that under individual secrecy, not only the rate region can be characterized, and is achievable using linear network coding, individually secure MSM is possible up to the min-cuts in the network.

In Section VII, we do provide a code for Strong-SMSM. It is important to note that in the code suggested, the alphabet size does not increase with the network parameters due to the strong-security constraint.

Under an individual secrecy constraint, the converse below gives a stronger result than the min-cut bound.

Theorem 2**.**

Assume an SMSM network $(\mathcal{V},\mathcal{E},\mathcal{S},\mathcal{D},w)$. Under individual security for $k-w$ messages, that is, requiring $I(\textbf{M}^{k-w}_{s};\textbf{Z}_{w})=0$ for any set of $k-w$ messages, one must have

[TABLE]

This result should be interpreted as follows. If Eve observes $w$ independent links, and $\rho(s;z)=w$, then one must have $H(\textbf{M}_{s})\leq\rho(s,d_{i})$, which is the cut set bound. Of course, as mentioned before, the surprising part is that this bound is tight, hence such a level of security is available without any loss in rate. Yet, Theorem 2 is slightly stronger, in the sense that if somehow Eve observes more then $w$ links, yet one still wishes to be secure with respect to any set of $k-w$ messages, then $H(\textbf{M}_{s})$ should be strictly smaller than $\rho(s,d_{i})$ and by the same amount. E.g., if Eve observes $w+e$ links, we have $H(\textbf{M}_{s})\leq\rho(s,d_{i})-e$. This means a linear increase in Eve’s power results in a linear decrease in rate.

The achievability (direct) and the leakage proof are given in Section IV using a random, non-linear code, and in Section VI using a structured linear code. We note that using the non-linear code, the field size is determined only by the network coding scheme and its multicast structure (we elaborate about it in Section III-C), and there is no increase in the field size due to the security constraint. Of coarse, it requires $k$ to be large, but the code is over a binary field. On the down side, in the non-linear code, both the sources and the destinations must store a big codebook, which includes all the possible bins and codewords. We also note that the non-linear code is more straightforward, easy to understand and uses a simple binning scheme, which is common in information theory, yet is used here with a security twist. On the other hand, using the linear code suggested, there is no requirement for $k$ to grow, and the encoding/decoding is done by a linear function, such that it is not required to store a big codebook. Yet, to obtain the secrecy constraint, the code requires a field size greater than or equal to $q^{u}$ at the sources and destinations, where $u=c/\log_{2}(q)\geq k$. This leads to calculations over a large finite field, which are complex. In both cases, the sophisticated coding is only at the sources and destinations. The network code field size and the coding at intermediate nodes can remain small.

Finally, it is important to note that the constraint on how many messages Eve catches is set on the entire network, thus, Eve may catch $w$ messages of a single source, or $w$ messages from several sources all together. Secrecy is maintained in any case, as under individual secrecy, messages from other sources can only increase secrecy, and any network code cannot create linear combinations with other messages which reduce the secrecy level. This is another benefit of the model, and hence the network code can be any LNC, without an increase in alphabet size. In that context, the codes given in [20, 27] for single source multi-cast, if considered under this individual secrecy setting, can also only increase secrecy when applied to multi-source multi-cast. Thus, such codes constitute an achievable scheme as well.

III-B Algebraic Gossip

As mentioned earlier, the suggested code easily applies to algebraic gossip as well, since this can be viewed as linear network coding over a time-extended graph. The following result captures the number of rounds required to (individually) securely disseminate $k$ messages from each of the $|S|$ sources to all nodes in the network.

Theorem 3**.**

Assume an oblivious network that floods in time $T$ with throughput $\alpha$. Then, for $|S|$ nodes in the network with $k$ messages each, algebraic gossip spreads the $k|S|$ messages to all nodes with probability $1-\epsilon$ after

[TABLE]

rounds, while keeping any eavesdropper which observes at most $w$ packets, ignorant with respect to any set of $k_{s}$ messages individually.

The proof is based on applying Theorem 1 above, together with known results from the Gossip literature. The complete details are deferred to Section IV-C. Note that the result above is constant-optimal, as $T$ is the number of rounds required for a single message, hence one cannot expect less that $T^{\prime}$ above for $k|S|$ messages. This is a perfect pipelining property [33], thus, surprisingly, one can gossip securely messages to all parties in the network, without any loss in rate and without any centralized mechanism for routing, key exchange or any other encryption mechanism, as long as the eavesdropper is interested in single messages.

III-C Alphabet Size

Without secrecy constraints, Jaggi et al. proved that a field with size greater than or equal to the number of destinations is sufficient for multicast under LNC [34]. However, this may not hold if it is required to keep an eavesdropper ignorant. Cai et al. [5] devised a code which requires a field of exponential size to obtain secrecy. There, the field size must be larger than $\binom{|E|}{w}$. Feldman et al. [38] showed that there exist networks that require a field of size at least $\Theta(|E|^{\frac{w}{2}})$. In [8], the authors demonstrate that secure network coding can be considered as a network generalization of the wiretap channel of type II. When $d$ is the number of destinations in the multicast connection, a field of size $\binom{2k^{3}d^{2}}{w-1+d}$ is sufficient, which is independent of $|V|$ and $|E|$ but is still exponential in other network parameters.

In the solution we suggest herein, the field size is determined only by the network coding scheme, that is, only by the requirement for reliability, and is not increased by the individual-security constraints. In the gossip case, for example, since $q^{-\alpha k}=2^{-(\alpha\log q)k}$, any field size greater than or equal to $2$ will suffice, and an increase in the field size has only a logarithmic effect on the throughput, meaning only a logarithmic multiplier on the number of rounds $T^{\prime}$ required.

IV Code Construction and a Proof

for Individual-SMSM (Theorem 1 and Theorem 3)

At each source node $s\in\{1,\ldots,|S|\}$, we map each column of the message matrix $\textbf{M}_{s}$ to a column of the same length. Specifically, as depicted in Figure 2, in the code construction phase, for each possible value for the partial column $M_{s,1}(i);\ldots;M_{s,k^{\prime}}(i),1\leq i\leq c$, of length $k^{\prime}=k-(w+k\epsilon)$ in the message matrix, we generate a bin, containing several columns of length $k$. At this point, we only mention that $\epsilon$ is such that $k\epsilon$ is an integer, as it represents a number of bits. At the end of the leakage proof, we discuss how small $\epsilon$ has to be exactly and how it affects the mutual information. The number of columns in a bin corresponds to $w$, the number of packets that the eavesdropper can wiretap, in a relation that will be made formal in the sequel. Then, to map the $i$-th column of the $s$-th message matrix, we select a column from the bin corresponding to $M_{s,1}(i);\ldots;M_{s,k^{\prime}}(i)$. The specific column within that bin is chosen according to $M_{s,k^{\prime}+1}(i);\ldots;M_{s,k}(i)$. That is, the lower part of the original column points to the bin, and the upper part of the original column serves as an index in order to choose the right column from the bin. This way, a new, $k\times c$ message matrix $\textbf{X}_{s}$ is created. This message matrix contains $k$ new messages of the same size $c$.

We may now turn to the detailed construction and analysis.

IV-1 Codebook Generation

Set $\Delta=2^{w+k\epsilon}$. Let $P(x)\sim Bernoulli(1/2)$. Using a distribution $P(X^{k})=\prod^{k}_{j=1}P(x_{j})$, for each possible column $M_{1}(i);\ldots;M_{k^{\prime}}(i)$ in the message matrix, that is, $2^{k-(w+k\epsilon)}$ possibilities, generate $\Delta$ independent and identically distributed codewords $x^{k}(e)$, $1\leq e\leq\Delta$. Thus, we have $2^{k-(w+k\epsilon)}$ bins, each of size $2^{w+k\epsilon}$. Note that the length of the columns in the bins is $k$, thus the codebook matrix is of the same size as $\textbf{M}_{s}$. The codebook is depicted in Figure 2.

IV-2 Source and legitimate Node encodings

At the $s$-th source node, the encoder selects, for each column $i$ of bits $M_{s,1}(i);\ldots;M_{s,k^{\prime}}(i)$, one codeword, $x^{k}(e(i))$, from the bin indexed by $M_{s,1}(i);\ldots;M_{s,k^{\prime}}(i)$, where $e(i)=M_{s,k^{\prime+1}}(i);\ldots;M_{s,k}(i)$. That is, $k^{\prime}=k-(w+k\epsilon)$ bits of the column choose the bin, and the remaining $w+k\epsilon$ bits choose the codeword within the bin.

Then, similar to many RLNC protocols, the sources transmit linear combinations of the rows, with random coefficients. Nodes transmit random linear combinations of the vectors in $\mathcal{S}_{v}$, which is maintained by each node according to the messages received at the node.

IV-A Reliability

The reliability proof using RLNC is almost a direct consequence of [2]. Clearly, the min-cut is given by Theorem 1. Hence, the legitimate nodes can easily reconstruct $\textbf{X}_{s}$ for each $s$ (simple, non-secure, multi-source multicast). Then, each destination maps $\textbf{X}_{s}$ back to $\textbf{M}_{s}$, as per column $1\leq i\leq c$, the index of the bin in which the codeword $\textbf{X}_{s}$(i) resides is $M_{s,1}(i);\ldots;M_{s,k^{\prime}}(i)$ and the index of the codeword location in that bin is $M_{s,k^{\prime}+1}(i);\ldots;M_{s,k}(i)$. It is important to note that since the codebook is generated randomly, the mapping is not exactly 1:1 and there is a possibility for a repetition of codewords. However, averaged over all messages, the error probability from such a repetition is negligible, and this scheme guarantees successful decoding with high probability. Considering the number of bins and the number of codewords in each bin as given in the codebook generation phase, the analysis on the probability of successfully decoding $\textbf{M}_{s}(i)$ from $\textbf{X}_{s}(i)$ is a direct consequence using standard analysis of random coding [39, Section 3.4]. Note also that such a repetition can also be circumvented using a random permutation of the columns rather than random binning, though analysis is more complicated due to the memory in the process.

An example, obtaining both reliability and individual secrecy for two sources, with two messages each and four legitimate destination nodes, where the eavesdropper min-cut is at most $1$, is given in Figure 1. Note that secure communication with respect to one message is possible while sending two messages from each source to all destinations.

Remark 4*.*

The proposed binning scheme has many similarities with the random binning scheme introduced by Wyner’s seminal work on degraded wiretap channel, which relies on information theoretic principles to obtain Physical Layer security [40]. Since its publication in 1975, Wyner’s binning scheme was utilized by numerous studies, models and solutions, e.g., comprehensive surveys can be found in [39, 41]. In the conventional binning scheme, each message is associated with a bin (i.e., the number of bins equals the number of messages) which contains multiple codewords. The number of codewords per bin depends on the capacity of the eavesdropper. Accordingly, the sent codeword incorporates both the bin index and a (private) random key which is used to select the codeword from the corresponding bin (e.g., [39, Chapter 3]).

However, there are a few differences between the typical binning scheme and the scheme proposed herein, as well as the code construction phase. Most importantly, in the suggested scheme we utilize the binning scheme differently such that we exploit some of the messages to protect the other messages and vice versa. In particular, in the suggested scheme each column in the message matrix is partitioned into two; the first partition points to a specific bin (similar to the message itself in the conventional binning scheme), while the second partition points to a specific codeword (in contrast to the conventional binning scheme in which the codeword is chosen at random). Note that as a result, each message-matrix-column points to one possible codeword while in the usual scheme each message points to multiple codewords. Specifically, in order to achieve the full capacity of the network, the number of bins (the first partition) is equal to the total number of messages minus the number of packets that the eavesdropper can wiretap, and the number of codewords per bin (the second partition) equals the number of packets that the eavesdropper can wiretap. This, of course, means there is no private key, and part of the information is used as a key to protect the other part. The final transformation from messages to codewords is 1:1 rather than one to many.

Second, in the suggested scheme, prior to the message coding, we mix the message matrix such that each bit in the transmitted packet is associated with a mixture of bits in the original messages (note that this message mixing is done prior to and independently from the network combinations performed by the network coding mechanism). Specifically, instead of coding the message matrix rows (the messages themselves), we code the columns of the message matrix (auxiliary messages each of which is composed from one bit from each original message). Note that we still send rows of the resulting coded matrix which mean that each bit in each captured packet conveys a coded version of many bits each coming from a different message. Since messages protect one another in our scheme, this trick allows us to require only that the messages are independent, but bits within a message are not required to be independent.

Obviously, there are also several limitations to the suggested scheme compared to the vanilla-version of the Wiretap code. First, it is important to note that achieving full capacity of the network requires a compromise on the secrecy level. Specifically, the suggested scheme ensures “Individual Secrecy”, which guarantees that the eavesdropper has zero mutual information with each message individually, rather than “conventional secrecy constraint” which requires zero leakage of information to the eavesdropper, when normalized by the message length, independently from any other message. Second, as mentioned, attaining secrecy while utilizing the message mixing technique requires that the messages be independent and uniformly distributed (a common assumption in the related literature, e.g., [20, 27, 12]). Third, we require the total number of messages to be sufficiently large (large $k$), as the mutual information to the eavesdropper decays as a function of the total number of messages (Section IV-B). From a secrecy perspective, however, we do not need message length to grow.

IV-B Information Leakage at the Eavesdropper

We now prove the $k_{s}$-individual security constraint is met, that is, $I(\textbf{M}^{k_{s}}_{s};\textbf{Z}_{w})\rightarrow 0$ as $k\rightarrow\infty$ for any set of $k_{s}\leq k-(w+k\epsilon)$ messages, where $\textbf{Z}_{w}=\textbf{W}[\textbf{X}_{1},\cdots,\textbf{X}_{|S|}]$ and W is an arbitrary encoding matrix due to the network code. At the end of this subsection, we also quantify the rate at which the mutual information can decay as a function of $k$.

In particular, for the simplest individual secrecy constraint, we wish to show that $I(M_{s,j};\textbf{Z}_{w})$ is small for all $s\in\mathcal{S}$ and all $j$. However, herein we prove a stronger result, by showing that given $\textbf{Z}_{w}$, Eve’s information, all possibilities for any set of $k_{s}\leq k-(w+k\epsilon)$ messages $\textbf{M}^{k_{s}}_{s}$ are almost equally likely. Hence Eve has no intelligent estimation for $\textbf{M}^{k_{s}}_{s}$ and $M_{s,j}$.

Denote by $\mathcal{C}_{k}$ the random codebook and by $\textbf{X}_{s}$ the set of codewords corresponding to $\vec{M}_{s,1}\ldots\vec{M}_{s,k}$. To analyze the information leakage at the eavesdropper, note that Eve has access to at most $w$ linear combinations on the rows of $\textbf{X}_{s}$.

Next, note that the columns of $\textbf{X}_{s}$ are independent (by the construction of the codebook, creating $\textbf{X}_{s}$ is done independently per-column; $c$ columns are used only to reduce the NC overhead). Hence, it suffices to consider the information leakage for each column $i\in\{1,\ldots,c\}$ from $\textbf{X}_{s}$ separately, denoted by $\textbf{X}_{s}$(i).

For each column $i$ of $\textbf{M}_{s}$, the encoder has $2^{k^{\prime}}$ bins, with $\Delta$ independent and identically distributed codewords in each, out of which one is selected. Hence, there is an exponential number of codewords, from the eavesdropper’s perspective, that can generate a column in $\textbf{X}_{s}$, and we require that Eve is still confused even given the $w$ linear combinations on each column. Let $\textbf{Z}_{w}(i)$ be the $w$ linear combinations Eve has on column $i$.

Hence, when the number of codewords is $2^{k}$, given the $w$ linear combinations from each column in $\textbf{Z}_{w}(i)$, the eavesdropper has at most $2^{k}(1/2)^{w}=2^{(k-w)}$ possible codewords. Denote $l=k-w$. Similar to the technique used in [42] to prove that myopic adversaries are blind, we define by the shell $\mathcal{S}h(\textbf{Z}_{w}(i),l)$, the set of all $k$-tuples consistent with $\textbf{Z}_{w}(i)$. Clearly, there are $2^{l}$ tuples in $\mathcal{S}h(\textbf{Z}_{w}(i),l)$. See Figure 3 for a graphical illustration.

We assume Eve has the codebook, yet does not know which column from each bin is selected to be the codeword. Hence, we wish to show that given $\textbf{Z}_{w}(i)$, Eve will have at least one candidate per bin. The probability for a codeword to fall in a given shell is

[TABLE]

In each bin of $\mathcal{C}_{k}$, we have $\Delta=2^{w+k\epsilon}$ codewords. Thus, the expected number of codewords Eve sees on a shell, per bin is

[TABLE]

Hence, we can conclude that on average, and if $k\epsilon$ is not too small, for every column in $\textbf{M}_{s}$ Eve has a few possibilities in each bin, hence cannot locate the right bin. However, it is still important to show that all bins have (asymptotically) equally likely number of candidate codewords, hence Eve cannot locate a preferred bin. In other words, we proved that the average number of candidate codewords per column is $2^{k\epsilon}$. We now wish to show that the actual number Eve has in each bin is concentrated around this average.

To this end, we show that now the probability that the actual number of options deviates from the average by more than $\varepsilon$ is small. Define the event

[TABLE]

By the Chernoff bound, we have

[TABLE]

Finally, we are now able to show that the mutual information is indeed negligible. Denote by $\textbf{1}_{\mathcal{E}_{C_{1}}}$ the indicator for the event where the actual number of options per column does not deviates from the average. We thus have

[TABLE]

However, since we now condition on $\textbf{1}_{\mathcal{E}_{C_{1}}}=1$, that is, there was no deviation from the average by more than $\varepsilon^{\prime}$, Eve’s distribution on the bins is almost uniform, and we have $H(\textbf{M}^{k_{s}}_{s}(i)|\textbf{Z}_{w}(i),\textbf{1}_{\mathcal{E}_{C_{1}}}=1)\geq k_{s}(1-\varepsilon^{\prime})$. Thus,

[TABLE]

Note that we are free to choose small $\varepsilon^{\prime}$ and $\epsilon$ as long as $k\epsilon$ is an integer. E.g., taking $\varepsilon^{\prime}=k^{-m}$ and $\epsilon$ such that $k\epsilon=\left\lceil{(m+1)\log k}\right\rceil$, for some $m\geq 2$, gives $I(\textbf{M}^{k_{s}}_{s}(i);\textbf{Z}_{w}(i))=O(k^{-m+1})$.

IV-C Algebraic Gossip (Theorem 3)

Revisiting the above proof of Theorem 1, it is clear that the algorithm suggested therein is a source code, followed by any good NC scheme which can be used to disseminate the encoded packages over the network. This is actually a universal code [43, 44], in the sense that it can be applied to any network without requiring knowledge of, or any modifications on, the NC. Special coding is required only at the sources. Hence, using the same source code as in Theorem 1 and then disseminating the encoded messages by a gossip protocol as in [31], which uses RLNC, the reliability at the legitimate nodes is a direct consequence of [33, Theorem 1]. Moreover, the mixing that the gossip protocol does over the network is the same as RLNC, hence, the information leakage at the eavesdropper is as proved in Section IV-B. Thus, compared to only a reliability constraint, the number of rounds required for both reliability and individual-secrecy is exactly the same as in the original non-secure gossip protocol.

V Converse (Theorem 2)

In this section, we derive a converse result, which shows that under individual secrecy on a group of $k-w$ messages, not only the rate is bounded by the min-cut, but, more importantly, any independent link that Eve observes above $w$ will require to reduce the rate at the same amount in order to achieve both reliability and secrecy. Thus, the converse result derived herein will be specific for the “individual secrecy” constraint given in Definition 1, and its extension to any set of $k-w$ messages, and hence extend on the well known cut-set bound.

Let $\bar{\textbf{Z}}$ denote the random variable corresponding to the links which are not available to Eve. Hence, $\textbf{Y}_{d}=(\textbf{Z},\bar{\textbf{Z}})$. Let $\textbf{M}_{s}^{k-w}$ denote a set of $k-w$ messages, and $\textbf{M}_{s}^{w}$ denote the remaining $w$. We will show that reliability, that is $H(\textbf{M}_{s}|\textbf{Y}_{d})=0$, and individual secrecy, that is, $I(\textbf{M}_{s}^{k-w};\textbf{Z})=0$, imply that $H(\textbf{M}_{s})$ is upper bounded by the term in Theorem 2.

[TABLE]

[TABLE]

where (a) is since conditioning reduces entropy. Note that this inequality is tight if the messages are independent. (b) is due to the reliability constraint, that is, $H(\textbf{M}_{s}^{k-w}|\textbf{Y}_{d})=0$ since all messages, and $\textbf{M}_{s}^{k-w}$ specifically, are decodable at the destination using $\textbf{Y}_{d}=(\textbf{Z},\bar{\textbf{Z}})$. (c) follows since we assume that Eve is kept ignorant regarding any group of $w-k$ messages, hence $I(\textbf{M}_{s}^{k-w};\textbf{Z})=0$. That is, it uses the security constraint. (d) is since $H(\textbf{M}_{s}^{w}|\textbf{Z},\bar{\textbf{Z}})=0$. However, since the converse turns out to be tight, and it turns out that removing the positive term $H(\textbf{M}_{s}^{w}|\textbf{Z},\textbf{M}_{s}^{k-w})$ does not change much, we conclude that $H(\textbf{M}_{s}^{w}|\textbf{Z},\textbf{M}_{s}^{k-w})$ is negligible, meaning, given the messages Eve is interested in, and her captured links, she is actually able to decode the rest of the messages/randomness as well. This is a returning theme in such wiretap-like coding schemes. (e) follows since $\rho(s_{i};d_{i})-\rho(s_{i};z)$ is the maximum amount that may not be available to Eve, if she has a min-cut $\rho(s_{i};z)$. Again, we assume unit capacity links and normalize the information in a message to $"1"$ accordingly.

VI Linear Code Construction for Individual-SMSM

The code given in Section IV relies on random coding, for which the individual secrecy constraint holds only asymptotically, that is, $H(M_{s,j}|\textbf{Z}_{w})/H(M_{s,j})\rightarrow 1$ as $k$ grows. In this section, we provide a structured linear code, which results in zero mutual information, not constrained by the number of messages (i.e., no requirement for $k$ to grow), without any decrease in the rate or any message “blow-up” by extra randomness. Yet, the code requires a field size greater than or equal to $q^{u}$ at the sources and destinations, where $u=c/\log_{2}(q)\geq k$. Note that this means we regard packets as symbols over a finite field $F_{q^{u}}$, where $F_{q}^{1\times u}\cong F_{q^{u}}$. Hence, the code is compatible with the network code given in Section IV since $F_{q^{u}}$ is a vector space over $F_{q}$. Furthermore, note that the increased alphabet size is only at the sources and destinations. The network code at intermediate nodes can remain small. The structured linear code provided in this section adopts the linear code given in [21, 27] for single-source multicast to multi-source multicast. Even though most of the results and proofs in this subsection follow the techniques given in [43], for completeness we provide the adapted proofs herein, adopting the scope, terminology and notations to the multi-source multicast problem considered in this study. Note, however, that in the information leakage proof, Eve’s observation $\textbf{Z}_{w}$ may include a linear combination of packets from several sources, rather than only one source as in [27], hance maybe confusing Eve even further. We do not exploit this confusion here, and the proof holds even for the case where Eve may see $w$ packets unmixed with other sources, yet it creates a difference compared to single-source multicast. Moreover, if one could guarantee Eve’s observation include mixtures of packets from several sources, the field size of the code may have been decreased. The current literature includes several examples analyzing the security achieved compared to the level of mixing in the network [22].

Corollary 2**.**

With a $(k,w)$ linear code over a field $F_{q^{u}}$, $k_{s}$-individual security holds in SMSM networks over a field $F_{q}$, keeping an eavesdropper which observes $w\geq\rho(s;z)$ links ignorant with respect to any set of $k_{s}\leq k-w$ messages, if $u\geq k$, form each source $s\in\mathcal{S}$ to each destination $d\in\mathcal{D}$, $\rho(s,d)\geq k$, for all $d\in\mathcal{D}$, $\rho(S,d)\geq(k)|S|$ and $k$ satisfies

[TABLE]

We may now turn to the detailed construction and proof of the Individual-SMSM structured linear code.

VI-1 Codebook Generation

Let $\mathcal{C}$ be a linear code over $F_{q^{u}}$ of length $k$ and dimension $w$, and set $k^{\prime}=k-w$. Then, let

[TABLE]

be a parity check matrix for the code. This linear code defines $q^{u(k-w)}$ cosets, one of them is the code itself. We denote the cosets by $\{A_{m}\}$, $1\leq m\leq q^{u(k-w)}$. Note that each coset is of size $q^{uw}$. Hence, the cosets of this code correspond to the bins we used in Section IV, yet over a field $F_{q^{u}}$, such that there are many more cosets, and each is larger.

Let G be a generator matrix for $\mathcal{C}$. We thus denote

[TABLE]

and we select a matrix

[TABLE]

with $k^{\prime}$ linearly independent rows from $F_{q^{u}}^{k}\setminus\mathcal{C}$. That is, $\textbf{G}^{\star}$ spans the null space of $\mathcal{C}$.

The linear code we consider herein is from the class of linear Maximum Rank Distance (MRD) codes [45, 46]. The norm of a vector $\textbf{X}_{s}\in F_{q^{u}}^{k}$ is defined as the column rank of $\textbf{X}_{s}$ over $F_{q}$, denoted by $rank_{F_{q}}(\textbf{X}_{s})$. The rank distance of two vectors over $F_{q^{u}}^{k}$ is defined as

[TABLE]

The minimum rank distance of a code $\mathcal{C}\subseteq F_{q^{u}}^{k}$ is defined as the minimum distance of all pairs of distinct codewords in $\mathcal{C}$. Rank metric codes adhere to a Singleton bound, that is, the size of a code is bounded by $|\mathcal{C}|\leq q^{\max\{k,u\}(\min\{k,u\}-d+1)}$. For linear codes this becomes $d\leq\min\{1,u/k\}(k-k^{\prime})+1$. We use the requirements in [27, Theorem 7], that is, for $u\geq k$, we use a code over $F_{q^{u}}$, defined by a parity check matrix $\textbf{H}\in F_{q^{u}}^{k^{\prime}\times k}$, which is MRD and the matrix PHT is nonsingular for all full rank $\textbf{P}\in F_{q}^{k^{\prime}\times k^{\prime}}$ and all full rank $\textbf{T}\in F_{q}^{k\times k^{\prime}}$.

VI-2 Source and legitimate nodes encodings

At each source node, $s$, the encoder selects a codeword $x^{k}(e)$ out of the $q^{uw}$ members of the coset $A_{m}$, where $m$ is given by the index $M_{s,1};\ldots;M_{s,k^{\prime}}$ and $e=M_{s,k^{\prime}+1};\ldots;M_{s,k}$ over a field $F_{q^{u}}^{k}$. That is, similar to Section IV, $k^{\prime}=k-w$ symbols choose the coset, and the remaining $w$ symbols choose the codeword within the coset. This is equivalent to letting $\textbf{X}_{s}$ be a choice from the $q^{uw}$ solutions of

[TABLE]

Again, note that $\textbf{X}_{s}$ is of the same size as $\textbf{M}_{s}$. Proposition 1 below shows that, in fact, $\textbf{X}_{s}$ can be easily computed using matrix multiplication.

Proposition 1**.**

At each source node, $s$, the encoding operation for the symbols $M_{s,1};\ldots;M_{s,k}\triangleq\textbf{M}_{s}$, is given by

[TABLE]

Proof.

Define $\textbf{X}_{s}^{T}$ according to (4). We wish to show that this definition is indeed consistent with (1), that is, using the definition in (4) the symbols $M_{s,1};\ldots;M_{s,k^{\prime}}$ define the coset in which $\textbf{X}_{s}$ resides, and, furthermore, the remaining $w$ symbols, $M_{s,k^{\prime}+1};\ldots;M_{s,k}$, uniquely define the word within the coset.

To this end, take the transposed of equation (4), and multiply it by H. We have:

[TABLE]

where the second inequality is since the row vectors $\vec{G}^{\star}$ are our choice of a basis to the null space of the code, hence, we can take $\textbf{G}^{\star}$ such that $\textbf{H}\textbf{G}^{\star T}=\textbf{I}$ [43, Section V.C]; Moreover, since H is a parity check matrix for the code, it is orthogonal to all codewords. Thus, the first $k^{\prime}$ rows define the coset.

Now, since the rows $M_{s,k^{\prime}+1};\ldots;M_{s,k}$ create a linear combination of codewords, the addition of such a linear combination does not change the coset. $\textbf{X}_{s}^{T}$ remains in the same coset regardless of these rows. Yet, as ($\vec{G}_{1};\ldots;\vec{G}_{w})$ is of rank $w$, all $q^{uw}$ possibilities for the linear combination are distinct, creating distinct vectors $\textbf{X}_{s}^{T}$ within the coset. ∎

Then, since each symbol over $F_{q^{u}}$ of the encoded codeword $X_{s,1};\ldots;X_{s,k}\triangleq\textbf{X}_{s}$ at the source is a vector over $F_{q}$ of length $c=u/\log_{2}(q)$, the network code is still compatible with Section IV. That is, the sources transmit linear combinations of the rows, with random coefficients. Nodes transmit random linear combinations of the messages they received.

VI-A Reliability

As for the reconstruction of $\textbf{X}_{s}$ at the destinations, it is almost a direct consequence of [2]. Again, the min-cut is given by Theorem 1, and the legitimate nodes can easily reconstruct $\textbf{X}_{s}$ for each $s$. Now, each destination can map $\textbf{X}_{s}$ back to $\textbf{M}_{s}$. First, compute the bin index according to $(M_{s,1};\ldots;M_{s,k^{\prime}})=\textbf{H}\textbf{X}_{s}$. Then, $M_{s,k^{\prime}+1};\ldots;M_{s,k}$ are simply the index of $\textbf{X}_{s}$ within that bin. They can be computed using $(M_{s,k^{\prime}+1};\ldots;M_{s,k})=\tilde{\textbf{G}}\textbf{X}_{s}$, where $\tilde{\textbf{G}}$ is any basis for the code such that $\tilde{\textbf{G}}\textbf{G}^{\star}=0$ yet $\tilde{\textbf{G}}\textbf{G}=I$.222In the same way, using a gossip protocol, the reliability proof is almost a direct consequence of [33, Theorem 1]. Hence, the number of rounds required is given by Theorem 3.

VI-B Information Leakage at the Eavesdropper

Denoted by $\mathcal{C}$ the code and by $\textbf{X}_{s}$ the codeword corresponding to $\vec{M}_{s,1}\ldots\vec{M}_{s,k}$. We assume that the eavesdropper has full knowledge of the code $\mathcal{C}$. As given in Section IV-B, to analyze the information leakage at the eavesdropper, note that Eve has access to at most $w$ linear combinations on the elements of $\textbf{X}_{s}$.

Next, using techniques given in [27, 43], we calculate the eavesdropper’s uncertainty. Let $\underline{\textbf{M}}_{s}^{k-w}=\textbf{P}\textbf{M}_{s}^{k-w}$ for a full rank $\textbf{P}\in F_{q}^{k^{\prime}\times k^{\prime}}$. Let $\textbf{Z}_{w}=\textbf{W}\textbf{X}_{s}$, where W is an arbitrary encoding matrix due to network links observed by the eavesdropper. Then, we have

[TABLE]

where (a) is since given the network coefficients and $\textbf{X}_{s}$, $H(\textbf{Z}_{w}|\underline{\textbf{M}}_{s}^{k-w},\textbf{X}_{s})\geq 0$, and the last inequality follows directly from the proof of Lemma 6 in [43]. Note that the above inequality, $H(\textbf{Z}_{w}|\underline{\textbf{M}}_{s}^{k-w},\textbf{X}_{s})\geq 0$, is a key difference compared to single source multicast. In single source multicast, $H(\textbf{Z}_{w}|\underline{\textbf{M}}_{s}^{k-w},\textbf{X}_{s})=0$, as the output at Eve’s side is determined by the source input. However, in MSM this entropy might be positive, if Eve’s observation includes a mixture with other sources and not only the source $s$.

Now, if $\langle\cdot\rangle$ denotes the row space of a matrix, we have

[TABLE]

Let $r=dim(\langle\textbf{PH}\rangle\cap\langle\textbf{W}\rangle)$. Then, there exist full rank matrices $\textbf{R}_{1}\in F_{q^{u}}^{r\times w}$ and $\textbf{R}_{2}\in F_{q^{u}}^{r\times k^{\prime}}$, such that $\textbf{R}_{1}\textbf{W}=\textbf{R}_{2}\textbf{PH}$ and $rank(\textbf{R}_{2}\textbf{PH})=r$, and we have $\textbf{R}_{1}\textbf{Z}_{w}=\textbf{R}_{1}\textbf{W}\textbf{X}_{s}=\textbf{R}_{2}\textbf{PH}\textbf{X}_{s}=\textbf{R}_{2}\underline{\textbf{M}}_{s}^{k-w}$. On the other hand, the mutual information is at least the linear common part, that is, $I(\underline{\textbf{M}}_{s}^{k-w};\textbf{Z}_{w})\geq H(\textbf{R}_{2}\underline{\textbf{M}}_{s}^{k-w})$. By the uniformity of the messages and the full ranks of P and $\textbf{R}_{2}$, $H(\textbf{R}_{2}\underline{\textbf{M}}_{s}^{k-w})=r$, hence

[TABLE]

To conclude,

[TABLE]

Now, if $\mathcal{C}$ is an MRD code over a field of $F_{q^{u}}^{k},u\geq k$, for any full rank $\textbf{P}\in F_{q}^{k^{\prime}\times k^{\prime}}$ the matrix \left[\begin{array}[]{c}\textbf{PH}\\ \textbf{W}\end{array}\right] is nonsingular for any full rank $\textbf{W}\in F_{q}^{w\times k}$. Thus, rank\left[\begin{array}[]{c}\textbf{PH}\\ \textbf{W}\end{array}\right]=rank(\textbf{PH})+rank(\textbf{W}), and the mutual information is zero.

VII Code Construction and a Proof for Strong-SMSM

In this section, we design a random code, which results with strong-secrecy, i.e., requiring Eve’s mutual information with all messages simultaneously to be zero, yet, at price of rate as given in [5]. However, using the suggested random code herein, the field size is determined only by the network coding scheme, that is, only by the requirement for reliability, and is not increased by the strong-security constraints.

At each source node $s\in\{1,\ldots,|S|\}$, we randomly map each column of the message matrix $\textbf{M}_{s}$. As depicted in Figure 4, in the code construction phase, for each possible column of the $s$-th message matrix we generate a bin, containing several columns. The number of such columns corresponds to $w$, the number of packets that the eavesdropper can wiretap, in a relation that will be made formal in the sequel. Then, to encode, for each column of the message matrix, we randomly select a column from its corresponding bin. This way, a new, $n\times c$ message matrix $\textbf{X}_{s}$ is created.

Specifically, a Strong-SMSM code at the $s$-th source node consists of a messages matrix $\textbf{M}_{s}$ of $\vec{M}_{s,1}\ldots\vec{M}_{s,k}$ messages of length $c$ bits over the binary field, we denote the set of matrices by $\mathcal{M}_{s}$; A discrete memoryless source of randomness over the alphabet $\mathcal{R}$ and some known statistics $p_{R}$; An encoder,

[TABLE]

which maps each message matrix $\textbf{M}_{s}$ to a matrix $\textbf{X}_{s}$ of codewords. This message matrix contains $n\geq k+w+n\epsilon$ new messages of size $c$, where, here as well, $n\epsilon\geq 1$ is a small integer.

The need for a stochastic encoder is similar to most encoders ensuring information theoretic security, as randomness is required to confuse the eavesdropper about the actual information [39]. Hence, we define by $R_{k}$ the random variable encompassing the randomness required for the $k$ messages at the source node, and by $\Delta$ the number of columns in each bin. We may now turn to the detailed construction and analysis.

VII-1 Codebook Generation

Set $\Delta=2^{w+n\epsilon}$. Where $P(x)\sim Bernoulli(1/2)$, using a distribution $P(X^{n})=\prod^{n}_{j=1}P(x_{j})$, for each possible column in the message matrix generate $\Delta$ independent and identically distributed codewords $x^{n}(e)$, $1\leq e\leq\Delta$.

VII-2 Source and legitimate node encodings

For each column $i$ of the $s$-th message matrix $\textbf{M}_{s}$, the $s$-th source node selects uniformly at random one codeword $x^{n}(e)$ from the $i$-th bin. Therefore, the $s$-th source Strong-SMSM matrix $\textbf{X}_{s}$ contains $c$ randomly selected codewords of length $n$, one for each column of the $s$-th message matrix. Then, the sources transmit linear combinations of the rows, with random coefficients. Nodes transmit random linear combinations of the vectors in $\mathcal{S}_{v}$, which is maintained by each node according to the messages received at the node.

The reliability in the Strong-SMSM algorithm is inherited from the reliability in RLNC. That is, if min-cuts are $\rho(s,d)\geq k+w$ and $\rho(S,d)\geq(k+w)|S|$ for each $s\in\mathcal{S}$ and $d\in\mathcal{D}$ then $k+w=n$ messages can be transmitted reliably from each source to all destinations. Since the transformation $\textbf{M}_{s}$ to $\textbf{X}_{s}$ can be inverted as given in Section IV-A, the destinations can decode the original messages.

VII-A Information Leakage at the Eavesdropper

We now prove the strong-security constraint is met. In particular, for the strong constraint, we wish to show that $I(\textbf{M}_{s};\textbf{Z}_{w})$ is small for all $s\in\mathcal{S}$. We will do that by showing that given $\textbf{Z}_{w}=\textbf{W}[\textbf{X}_{1},\cdots,\textbf{X}_{|S|}]$ where W is arbitrary encoding matrix due to network, Eve’s information, all possibilities for $\textbf{M}_{s}$ are equally likely, hence Eve has no intelligent estimation for $\textbf{M}_{s}$.

Denote by $\mathcal{C}_{n}$ the random codebook and by $\textbf{X}_{s}$ the set of codewords corresponding to $\vec{M}_{s,1}\ldots\vec{M}_{s,k}$. To analyze the information leakage at the eavesdropper, note that Eve has access to at most $w$ linear combinations on the rows of $\textbf{X}_{s}$.

Next, note that the columns of $\textbf{X}_{s}$ are independent (by the construction of the codebook, creating $\textbf{X}_{s}$ is done independently per-column; $c$ columns are used only to reduce the NC overhead). Hence, it suffices to consider the information leakage for each column $i\in\{1,\ldots,c\}$ from $\textbf{X}_{s}$ separately. For each column $i$ of $\textbf{M}_{s}$, the encoder has $\Delta$ independent and identically distributed codewords, out of which one is selected. Hence, there is an exponential number of codewords, from the eavesdropper’s perspective, that can generate a column in $\textbf{X}_{s}$, and we require that Eve is still confused even given the $w$ linear combinations from each column. Hence, when the number of codewords is $2^{n}$, given the $w$ linear combinations from each column in $\textbf{Z}_{w}(i)$, the eavesdropper has $2^{n}(1/2)^{w}=2^{(n-w)}$ possible codewords. We now denote $l=n-w$ and define the shell $\mathcal{S}h(\textbf{Z}_{w}(i),l)$, the set of all $n$-tuples consistent with $\textbf{Z}_{w}(i)$. Clearly, there are $2^{l}$ tuples in $\mathcal{S}h(\textbf{Z}_{w}(i),l)$.

We assume Eve has the codebook, yet does not know which column from each bin is selected to be the codeword. Hence, we wish to show that given $\textbf{Z}_{w}(i)$, Eve will have at least one candidate per bin. Now,

[TABLE]

In each bin of $\mathcal{C}_{n}$, we have $\Delta=2^{w+n\epsilon}$ codewords. Thus, the expected number of codewords Eve sees in her shell, per bin is

[TABLE]

Again, we can conclude that on average, and if $n\epsilon$ is not too small, for every column in $\textbf{M}_{s}$ Eve has a few possibilities in each bin, hence cannot locate the right bin. We need to show that all bins have (asymptotically) equally likely number of candidate codewords. Similarly to the individual security proof, we wish to show that the probability that the actual number of options deviates from the average by more than $\varepsilon$ is small. We define $\mathcal{E}_{C_{1}}(Z(i),l)$ similarly to Section IV-B and by the Chernoff bound, we have

[TABLE]

The reminder of the leakage proof follows the exact same steps as the one in Section IV-B, yet with $\textbf{M}_{s}(i)$ replacing $\textbf{M}^{k_{s}}_{s}(i)$ and $k$ replacing $k_{s}$.

VIII Applications

In previous sections we suggested an SMSM code and proved that under the suggested code an eavesdropper which can capture a subset of the packet’s traversing the network (up to $w$ packets) is kept ignorant regarding each packet’s content, under the Individual Security constraint, without compromising the rate (i.e., achieving full network capacity). In this section, we show several common applications which exemplify the applicability of the suggested code to a diverse range of protocols and applications. The first two examples include only a single source, merely to show the applicability of the individual secrecy setup. The third example is multi-source in nature, and includes all aspects of our solution.

VIII-A Data Centers

One of the most prominent facilities characterizing our new “information explosion” era are distributed Data Centers. Such facilities, which aim to cope with the rapidly increasing volumes of data generated, archived and expected to be accessible, are vital to many services such as video sharing, social networks, peer-to-peer cloud storage and many more. Google’s GFS [47], Amazon’s Dynamo [48], Google’s BigTable [49], Facebook’s Apache Hadoop [50], Microsoft’s WAS [51] and LinkedIn’s Voldemort [52] are just a few examples of such ubiquitous applications. Obviously, the security and reliability of such Data Centers are critical for such applications to be adopted by users and organizations.

In the basic non-secure model [53, 54], a source $s$ needs to store a file M, which is decomposed into $k$ messages, in $v$ servers (nodes), such that any legitimate user $d$ (destination) can reconstruct the file by collecting the stored information from any $l$ servers $(l=\rho(s,d_{i})\geq k)$. With one source, as considered in [24, 25, 26], the secured version constraints the stored chunks such that an eavesdropper, which can observe the information stored at any $w$ servers, will be kept ignorant regarding the actual file stored (see Figure 5). In these works, which consider only one source, a source code to obtain weak secrecy is considered as an outer code, with a loss of a small factor of storage secrecy capacity. Then, Regenerating Codes [53, 54, 55] are used. These are usually suggested to store data in distributed storage.

For the secured multi-source version, we can leverage the individual-SMSM coding scheme suggested herein to enhance the non-secure solution suggested in [56, 57, 28, 58, 59], which consider each node in the network as a server which maintains pieces of data using RLNC. We will be able to guarantee that any eavesdropper that can access any $w$ servers will have no information regarding any stored message individually (zero mutual information regarding each message separately). Specifically, each source $s$ encodes the original data file M using the individual security coding scheme suggested herein (Sections IV and VI) and then uploads the encoded packets to the $v$ servers. The number and the size of packets uploaded to the servers in the secure solution suggested are as in the non-secure model; thus, we obtain the full capacity of the system.

It is important to note that utilizing the individual security coding scheme suggested in this paper, one not only ensures individual secrecy from potential eavesdroppers, but also can guarantee privacy from the hosting servers themselves, such that, each server not only will not be able to decode the original data but will have zero information regarding any of the stored message individually. For example, assume that in the example depicted in Figure 6, the source $s$ (private user) wants to store a file M in the cloud. To do that, the source can utilize $3$ different cloud storage providers, such as Google Drive, Microsoft OneDrive, Dropbox, etc. However, the source wants to keep the original information private. Hence, by encoding the original data using the individual security coding scheme suggested at the source, and then uploading at most $3$ encoded packets $\vec{Y}_{i_{1}},\ldots,\vec{Y}_{i_{3}}$ to any provider, the provider will store the packets in their servers $v$, but these will be kept ignorant of the original file.

VIII-B Wireless Networks

The inherent broadcast nature of the wireless medium makes network coding techniques pertinent for wireless networks. Specifically, relying on network coding, instead of sending packets (unicast, multicast or broadcast packets) to each intended addressee individually, a source (or an intermediate node which needs to relay packets toward the destination) can transmit a manipulation (usually a linear combination) of the packets destined to the various receivers. A receiver collecting sufficient number of such combinations (coded packets) can reconstruct (decode) the original packets.

Relying on NC when the channel is lossy, i.e., there is a probability that a sent packet will not be received (decoded) by its intended receiver (receivers), has great advantages as instead of resending each un-coded packet until received correctly by its intended receiver, a sender keeps sending combinations of the original packets until each receiver collects a sufficient number of combinations (e.g., [60, 61, 62, 63, 64, 65, 66]). Accordingly, a sender can a priori estimate the number of coded packets needed according to the most lossy channel and send coded packets accordingly, without relying on any feedbacks mechanism.

The secured version of this data dissemination problem requires that an eavesdropper with a degraded channel which can obtain only a subset of the transmitted packet will not be able to attain any information regarding any of the original packets. Utilizing the individual security coding scheme suggested in this paper, in which the source estimates the number of packets needed to be sent according to the estimated packet loss to each receiver, encodes the messages before the wireless transmission according to the procedure presented in Section IV and the anticipated packet loss to the eavesdropper and broadcast the coded packets ensures that the legitimate users will be available to obtain the original transmitted data while any eavesdropper with higher packet loss rate will be kept ignorant. A simple illustration is given in Figure 7: a transmitter utilizing MU-MIMO techniques to direct the beams toward its intended receivers such that eavesdroppers which are sparsely scattered are expected to experience a lower quality channel hence higher packet loss than the intended receivers; the transmitter is utilizing the individual-SMSM coding scheme suggested in Section IV, ensuring individual security as proved in this paper. In some sense, a similar application was suggested in [67, 68] for secure data exchange, where legitimate clients want to directly exchange information over a wireless channel in the presence of an eavesdropper. These works considered the matrix completion problem [69], and provided an MRD code, such that, given constraints on the number of messages that each legitimate client has and transmits, established bounds on the number of transmissions over broadcasting channel required for both reliability at the legitimate clients (of all the data exchanged), and weakly secrecy at the eavesdropper who obtains all transmitted data.

VIII-C Live Broadcast of Video with Multi-Path Streaming

Multi-Path routing techniques which enable the use of multiple alternative paths between a source and a destination through the network, has been widely exploited over the years to provide a variety of benefits such as load balancing, fault tolerance, bandwidth enhancement, etc. One such ubiquitous example is LiveU innovative solution for distributing live video streams via wireless networks [70, 71]. In these systems, the real-time recorded video is encoded in packets by the source. These encoded packets include pieces of the data to be transmitted through different distributed media. For example, the pieces of the data transmitted over various technologies such as cellular networks, WiFi, satellite, fiber internet, etc. or various providers, e.g., Sprint, T-Mobile, AT&T Verizon, etc. A local server at the legitimate client decodes the data received from the different distributed media. This distributed streaming system maintains a high-quality viewer experience and cost-efficiency since the source can adapt the number of pieces dynamically to be transmitted by the different media. For example, if the connection using cellular or WiFi is lost during the real-time transmission, the source can route the pieces of the data dynamically by other connections or medias, taking into account the cost of each transmission by the optional connections.

In context to individual security suggested herein, we consider the case where there is an eavesdropper which has access to only a subset of the connections during the real-time distributed streaming (we assume that the eavesdropper can access any set of the streams unknown to the source, yet only a subset thereof). Utilizing the individual security coding scheme suggested in this paper, i.e., encoding the packets prior to the transmission, according to the coding scheme suggested in Section IV, guarantees Individual Secure Live Broadcast of Video with Multi-Path Streaming, such that an eavesdropper which can capture at most $w$ streams transmitted over the different distributed medias is kept ignorant in the sense of having zero mutual information, regarding any set of $k_{s}$ messages individually, yet may potentially obtain insignificant information about mixtures of packets transmitted. Figure 8 depicts a graphical representation of this system.

IX Conclusions

In this paper, we proposed SMSM codes under an Individual Security constraint. In this model, the eavesdropper is kept ignorant, in the sense of having zero mutual information regarding each message separately, yet may potentially obtain insignificant information about mixtures of packets transmitted. In fact, it ensures Eve is kept ignorant of any set of $k-w$ messages. That is, guarantee zero mutual information, with respect to any set of $k-w$ messages.

We completely characterized the rate region for individually secure MSM. Specifically, we showed that secure communication is achievable up to the min-cut, that is, without any decrease in the rate or any message “blow-up” by extra randomness. Moreover, we provided a code for Strong-SMSM by extra randomness, i.e., requiring Eve’s mutual information with all messages simultaneously to be zero. While this included a rate loss, it is important to note that in the code suggested the alphabet size did not increase with the network parameters due to the strong-security constraint.

Finally, we showed a few examples out of many important applications, like data centers, wireless networks, gossip and live broadcasting of video, for which the individual security coding schemes suggested is applicable, and achieves the full capacity of these systems.