Low Congestion Cycle Covers and their Applications

TL;DR

This paper introduces low-congestion cycle covers that are short and nearly edge-disjoint, proving their existence in bridgeless graphs and demonstrating their applications in resilient distributed computation.

Contribution

The paper proves the existence of short, low-overlap cycle covers in bridgeless graphs and extends these results to universally optimal covers, with applications in fault-tolerant distributed algorithms.

Findings

Existence of $(d,c)$-cycle covers with $d = ilde{O}(D)$ and $c= ilde{O}(1)$ in bridgeless graphs.

Extension to covers with $d = ilde{O}(OPT(G))$ and $c= ilde{O}(1)$.

Application of cycle covers to improve fault tolerance in distributed algorithms.

Abstract

A cycle cover of a bridgeless graph $G$ is a collection of simple cycles in $G$ such that each edge $e$ appears on at least one cycle. The common objective in cycle cover computation is to minimize the total lengths of all cycles. Motivated by applications to distributed computation, we introduce the notion of \emph{low-congestion} cycle covers, in which all cycles in the cycle collection are both \emph{short} and nearly \emph{edge-disjoint}. Formally, a $(d,c)$-cycle cover of a graph $G$ is a collection of cycles in $G$ in which each cycle is of length at most $d$ and each edge participates in at least one cycle and at most $c$ cycles. A-priori, it is not clear that cycle covers that enjoy both a small overlap and a short cycle length even exist, nor if it is possible to efficiently find them. Perhaps quite surprisingly, we prove the following: Every bridgeless graph of diameter $D$ admits a $(d,c)$-cycle cover where $d = \tilde{O}(D)$ and $c=\tilde{O}(1)$. These parameters are existentially tight up to polylogarithmic terms. Furthermore, we show how to extend our result to achieve universally optimal cycle covers. Let $C_e$ is the length of the shortest cycle that covers $e$, and let $OPT(G)= \max_{e \in G} C_e$. We show that every bridgeless graph admits a $(d,c)$-cycle cover where $d = \tilde{O}(OPT(G))$ and $c=\tilde{O}(1)$. We demonstrate the usefulness of low congestion cycle covers in different settings of resilient computation. For instance, we consider a Byzantine fault model where in each round, the adversary chooses a single message and corrupt in an arbitrarily manner. We provide a compiler that turns any $r$-round distributed algorithm for a graph $G$ with diameter $D$, into an equivalent fault tolerant algorithm with $r\cdot poly(D)$ rounds.

Figures

Equations

$$\frac{2\ell -a_1-a_2}{3\ell -a_1-a_2}>\frac{6\text{mbox}{\mathtt{d}}_2}{12\text{mbox}{\mathtt{d}}_2-3}>1/2.$$

$$N:V(T)\to \left[|V(T)|\right]$$

$$\sum _{i=1}^{\ell }\mathrm{deg}(B_i,E^{\prime })\ge t\text{mbox}\mathtt{b}+(\ell -t/2)\text{mbox}\mathtt{b}/2\ge \ell \text{mbox}\mathtt{b}/2.$$

$$({\tilde{v}}_j,{\tilde{v}}_{j^{\prime }})\in E(\tilde{G})⟺E_i^{\prime }\cap (B_j\times B_{j^{\prime }})\ne \varnothing .$$

$$E_{i+1}^{\prime }\le 2n_i=8|E_i^{\prime }|/\text{mbox}\mathtt{b}=|E_i^{\prime }|/2.$$

$$P_e=\pi (v,u^{\prime })\circ \mathsf{Swap}(e).$$

$$E_{x,y}^{\prime }=\{(u,v)\in E(T_x^{\prime })\cap I(T^{\prime })\mid v\in V(T_x^{\prime })\text{mbox}ands(v)\in V(T_y^{\prime })\setminus V(T_x^{\prime })\}.$$

$${\hat{E}}_{i,j}=\{(s(v_1),s(v_2))\mid ⟨v_1,v_2⟩\in {\Sigma }_j\}.$$

$$\frac{2\ell -a_1-a_2}{3\ell -a_1-a_2}>\frac{6\text{mbox}{\mathtt{d}}_2}{12\text{mbox}{\mathtt{d}}_2-3}>1/2.$$

$$\text{mbox}\mathtt{b}=16\cdot \varphi (\mathcal{F}).$$

$$C(e,e^{\prime })=\pi (u,u^{\prime },T(B))\circ e^{\prime }\circ \pi (v^{\prime },v)\circ e.$$

$$|E_{i+1}^{\prime }|=|E({\tilde{G}}_i)|\le 2\cdot |E({\tilde{G}}_i^{\prime })|\le 2\varphi (\mathcal{F})\cdot |{\mathcal{B}}_i|$$

$$\le 8\varphi (\mathcal{F})\cdot |E_i^{\prime }|/\text{mbox}\mathtt{b}\le |E_i^{\prime }|/2,$$

$$\mathrm{Pr}[Q_w\ge z]\le (1-e^{-\beta }{)}^{z-1}.$$

$$\mathrm{Pr}[Q_w\ge z]\le (1-e^{-\beta }{)}^{z-1}\le (1-e^{-\beta }{)}^{c^{\prime }\log n\cdot e^{\beta }}\le 1/n^{c^{\prime }}.$$

$$m(y)>m_{u^{\ast }}(y)-1=r_{u^{\ast }}-\text{mbox}\mathrm{dist}(u^{\ast },y,G)-1\ge r_{u^{\ast }}-\text{mbox}\mathrm{dist}(u^{\ast },w,G)-t-1=m(w)-t-1,$$

Full text

A-priori, it is not clear that cycle covers that enjoy both a small overlap and a short cycle length even exist, nor if it is possible to efficiently find them. Perhaps quite surprisingly, we prove the following: Every bridgeless graph of diameter $D$ admits a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover where $\mbox{\tt d}=\tilde{O}(D)$ and $\mbox{\tt c}=\tilde{O}(1)$. That is, the edges of $G$ can be covered by cycles such that each cycle is of length at most $\widetilde{O}(D)$ and each edge participates in at most $\widetilde{O}(1)$ cycles. These parameters are existentially tight up to polylogarithmic terms.

Furthermore, we show how to extend our result to achieve universally optimal cycle covers. Let $C_{e}$ is the length of the shortest cycle that covers $e$, and let ${\mathsf{OPT}}(G)=\max_{e\in G}C_{e}$. We show that every bridgeless graph admits a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover where $\mbox{\tt d}=\tilde{O}({\mathsf{OPT}}(G))$ and $\mbox{\tt c}=\tilde{O}(1)$.

We demonstrate the usefulness of low congestion cycle covers in different settings of resilient computation. For instance, we consider a Byzantine fault model where in each round, the adversary chooses a single message and corrupt in an arbitrarily manner. We provide a compiler that turns any $r$-round distributed algorithm for a graph $G$ with diameter $D$, into an equivalent fault tolerant algorithm with $r\cdot\mathsf{poly}(D)$ rounds.

1. 1 Introduction

2. 1.1 Low Congestion Cycle Covers

3. 1.2 Distributed Compiler for Resilient Computation

4. 1.3 Preliminaries

5. 2 Technical Overview

6. 2.1 Low Congestion Cycle Covers

7. 2.2 Universally Optimal Cycle Covers

8. 2.3 Application to Resilient Distributed Computation

9. 2.4 Distributed Algorithm for Minor-Closed Graphs

10. 3 Low Congestion Cycle Cover

11. 3.1 Covering Non-Tree Edges

12. 3.2 Covering Tree Edges

13. 3.3 Universally Optimal Cycle Covers

14. 3.4 Two-Edge Disjoint Cycle Covers

15. 4 Resilient Distributed Computation

16. 4.1 Byzantine Faults

17. 4.2 Eavesdropping

18. 5 Distributed Construction for Minor-Closed Graphs

19. 5.1 Covering Non-Tree Edges

20. 5.2 Covering Tree Edges

21. A Balanced Partitioning of a Tree

22. B Distributed Constructions for General Graphs

23. B.1 Low Congestion Covers

24. B.2 Neighborhood Covers

1 Introduction

A cycle cover of a graph $G$ is a collection of cycles such that each edge of $G$ appears in at least one of the cycles. Cycle covers were introduced by Itai and Rodeh [IR78] in 1978 with the objective to cover all edges of a bridgeless111A graph $G$ is bridgeless, if any single edge removal keeps the graph connected. graph with cycles of total minimum length. This objective finds applications in centralized routing, robot navigation and fault-tolerant optical networks [HO01]. For instance, in the related Chinese Postman Problem, introduced in 1962 by Guan [Gua62, EJ73], the objective is to compute the shortest tour that covers each edge by a cycle. Szekeresand [Sze73] and Seymour [Sey79] independently have conjectured that every bridgeless graph has a cycle cover in which each edge is covered by exactly two cycles, this is known as the double cycle cover conjecture. Many variants of cycle covers have been studied throughout the years from the combinatorial and the optimization point of views [Fan92, Tho97, HO01, IMM05, BM05, KNY05, Man09, KN16].

1.1 Low Congestion Cycle Covers

Motivated by various applications for resilient distributed computing, we introduce a new notion of low-congestion cycle covers: a collection of cycles that cover all graph edges by cycles that are both short and almost edge-disjoint. The efficiency of our low-congestion cover is measured by the key parameters of packet routing [LMR94]: dilation (length of largest cycle) and congestion (maximum edge overlap of cycles). Formally, a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover of a graph $G$ is a collection of cycles in $G$ in which each cycle is of length at most d, and each edge participates in at least one cycle and at most c cycles. Using the beautiful result of Leighton, Maggs and Rao [LMR94] and the follow-up of [Gha15b], a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover allows one to route information on all cycles simultaneously in time $\widetilde{O}(\mbox{\tt d}+\mbox{\tt c})$.

Since $n$-vertex graphs with at least $2n$ edges have girth $O(\log n)$, one can cover all but $2n$ edges in $G$, by edge-disjoint cycles of length $O(\log n)$ (e.g., by repeatedly omitting short cycles from $G$). For a bridgeless graph with diameter $D$, it is easy to cover the remaining graph edges with cycles of length $O(D)$, which is optimal (e.g., the cycle graph). This can be done by covering each edge $e=(u,v)$ using the alternative $u$-$v$ shortest path in $G\setminus\{e\}$. Although providing short cycles, such an approach might create cycles with a large overlap, e.g., where a single edge appears on many (e.g., $\Omega(n)$) of the cycles. Indeed, a-priori, it is not clear that cycle covers that enjoy both low congestion and short lengths, say $O(D)$, even exist, nor if it is possible to efficiently find them. Perhaps surprisingly, our main result shows that such covers exist and in particular, one can enjoy a dilation of $O(D\log n)$ while incurring only a poly-logarithmic congestion.

Theorem 1** (Low Congestion Cycle Cover).**

Every bridgeless graph with diameter $D$ has a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover where $\mbox{\tt d}=\widetilde{O}(D)$ and $\mbox{\tt c}=\widetilde{O}(1)$. That is, the edges of $G$ can be covered by cycles such that each cycle is of length at most $\widetilde{O}(D)$ and each edge participates in at most $\widetilde{O}(1)$ cycles.

Theorem 1 is existentially optimal up to poly-logarithmic factors, e.g., the cycle graph. We also study cycle covers that are universally-optimal with respect to the input graph $G$ (up to log-factors). By using neighborhood covers [ABCP98], we show how to convert the existentially optimal construction into a universally optimal one:

Theorem 2** (Optimal Cycle Cover, Informal).**

There exists a construction of (nearly) universally optimal $(\mbox{\tt d},\mbox{\tt c})$-cycle covers with $\mbox{\tt d}=\widetilde{O}({\mathsf{OPT}}(G))$ and $\mbox{\tt c}=\widetilde{O}(1)$, where ${\mathsf{OPT}}(G)$ is the best possible cycle length (i.e., even without the congestion constraint).

In fact, our algorithm can be made nearly optimal with respect to each individual edge. That is, we can construct a cycle cover that covers each edge $e$ by a cycle whose length is $\widetilde{O}(|C_{e}|)$ where $C_{e}$ is the shortest cycle in $G$ that goes through $e$. The congestion for any edge remains $\widetilde{O}(1)$.

Turning to the distributed setting, we also provide a construction of cycle covers for the family of minor-closed graphs. Our construction is (nearly) optimal in terms of both its run-time and in the parameters of the cycle cover. Minor-closed graphs have recently attracted a lot of attention in the setting of distributed network optimization [GH16, HIZ16a, GP17, HLZ18, LMR18].

Theorem 3** **(Optimal Cycle Cover Construction for Minor Close Graphs,

Informal).

For the family of minor closed graphs, there exists an $\widetilde{O}(OPT(G))$-round algorithm that constructs $(\mbox{\tt d},\mbox{\tt c})$-cycle cover with $\mbox{\tt d}=\widetilde{O}(OPT(G)),\mbox{\tt c}=\widetilde{O}(1)$, where ${\mathsf{OPT}}(G)$ is equal to the best possible cycle length (i.e., even without the constraint on the congestion).

Natural Generalizations of Low-Congestion Cycle Covers.

Interestingly, our cycle cover constructions are quite flexible and naturally generalize to other related graph structures. For example, a $(\mbox{\tt d},\mbox{\tt c})$-two-edge-disjoint cycle cover of a $3$-edge connected graphs is a collection of cycles such that each edge is covered by at least two edge disjoint cycles in $G$, each edge appears on at most c cycles, and each cycle is of length at most d. In other words, such cycle cover provides $3$ edge disjoint paths between every neighboring nodes, these paths are short and nearly edge disjoint.

As we will describe next, we use this notation of two-edge-disjoint cycle covers in the context of fault tolerant algorithms. Towards this end, we show:

Theorem 4**.**

[Two-edge-Disjoint Cycle Covers, Informal] Every $3$-edge connected $n$-vertex graph with diameter $D$ has a $(\mbox{\tt d},\mbox{\tt c})$-two-edge-disjoint cycle cover with $\mbox{\tt d}=\widetilde{O}(D^{3})$ and $\mbox{\tt c}=\widetilde{O}(D^{2})$.

It is also quite straightforward to adapt the construction of Theorem 4 to yield $k$-edge disjoint covers which cover every edge by $k$ edge disjoint cycles. These variants are also related to the notions of length-bounded cuts and flows [BEH*+*10], and find applications in fault tolerant computation.

Cycle covers can be extended even further, one interesting example is “$P_{k}$ covers”, where it is required to cover all paths of length at most $k$ in $G$ by simple cycles. The cost of such an extension has an overhead of $O((\Delta\cdot D)^{k})$ in the dilation and congestion, where $\Delta$ is the maximum degree in $G$. These variant might find applications in secure computation.

Finally, in a companion work [PY17] cycle cover are used to construct a new graph structure called private neighborhood trees which serve the basis of a compiler for secure distributed algorithms.

Low-Congestion Covers as a Backbone in Distributed Algorithms.

Many of the underlying graph algorithms in the ${\mathsf{CONGEST}}$ model are based (either directly or indirectly) on low-congestion communication backbones. Ghaffari and Haeupler introduced the notion of low-congestion shortcuts for planar graphs [GH16]. These shortcuts have been shown to be useful for a wide range of problems, including MST, Min-Cut [HHW18], shortest path computation [HL18] and other problems [GP17, Li18]. Low congestion shortcuts have been studied also for bounded genus graphs [HIZ16a], bounded treewidth graphs [HIZ16b] and recently also for general graphs [HHW18]. Ghaffari considered shallow-tree packing, collection of small depth and nearly edge disjoint trees for the purpose of distributed broadcast [Gha15a].

Our low-congestion cycle covers join this wide family of low-congestion covers – the graph theoretical infrastructures that underlay efficient algorithms in the ${\mathsf{CONGEST}}$ model. It is noteworthy that our cycle cover constructions are based on novel and independent ideas and are technically not related to any of the existing low congestion graph structures.

1.2 Distributed Compiler for Resilient Computation

Our motivation for defining low-congestion cycle covers is rooted in the setting of distributed computation in a faulty or non-trusted environment. In this work, we consider two types of malicious adversaries, a byzantine adversary that can corrupt messages, and an eavesdropper adversary that listens on graph edges and show how to compile an algorithm to be resilient to such adversaries.

We present a new general framework for resilient computation in the ${\mathsf{CONGEST}}$ model [Pel00] of distributed computing. In this model, execution proceeds in synchronous rounds and in each round, each node can send a message of size $O(\log n)$ to each of its neighbors.

The low-congestion cycle covers give raise to a simulation methodology (in the spirit of synchronizes [Awe85]) that can take any $r$-round distributed algorithm ${\cal A}$ and compile it into a resilient one, while incurring a blowup in the round complexity as a function of network’s diameter. In the high-level, omitting many technicalities, our applications use the fact that the cycle cover provides each edge $e$ two-edge-disjoint paths: a direct one using the edge $e$ and an indirect one using the cycle $C_{e}$ that covers $e$. Our low-congestion covers allows one to send information on all cycles in essentially the same round complexity as sending a message on a single cycle.

Compiler for Byzantine Adversary.

Fault tolerant computation [BOGW88, Gär99] concerns with the efficient information exchange in communication networks whose nodes or edges are subject to Byzantine faults. The three cornerstone problems in the area of fault tolerant computation are: consensus [DPPU88, Fis83, FLP85, KR01, LZKS13], broadcasting (i.e., one to all) [PS89, Pel96, BDP97, KKP01, PP05] and gossiping (i.e., all to all) [BP93, BH94, CHT17]. A plentiful list of fault tolerant algorithms have been devised for these problems and various fault and communication models have been considered, see [Pel96] for a survey on this topic.

In the area of interactive coding, the common model considers an adversary that can corrupt at most a fraction, known as error rate, of the messages sent throughout the entire protocol. Hoza and Schulman [HS16] showed a general compiler for synchronous distributed algorithms that handles an adversarial error rate of $O(1/|E|)$ while incurring a constant communication overhead. [CHGH18] extended this result for the asynchronous setting, see [Gel17] for additional error models in interactive coding.

In our applications, we consider a Byzantine adversary that can corrupt a single message in each round, regardless of the number of messages sent over all. This is different, and in some sense incomparable, to the adversarial model in interactive coding, where the adversary is limited to corrupt only a bounded fraction of all message. On the one hand, the latter adversary is stronger than ours as it allows to corrupt potentially many messages in a given round. On the other hand, in the case where the original protocol sends a linear number (in the number of vertices) of messages in a given round, our adversary is stronger as the interactive coding adversary which handles only error rate of $O(1/n)$ cannot corrupt a single edge in each and every round. As will be elaborated more in the technical sections, this adversarial setting calls for the stronger variant of cycle covers in which each edge is covered by two edge-disjoint cycles (as discussed in Theorem 4).

Theorem 5**.**

(Compiler for Byzantine Adversary, Informal) Assume that a $(\mbox{\tt d}_{1},\mbox{\tt c}_{1})$ cycle cover and a $(\mbox{\tt d}_{2},\mbox{\tt c}_{2})$ two-edge-disjoint cycle cover are computed in a (fault-free) preprocessing phase. Then any distributed algorithm ${\cal A}$ can be compiled into an equivalent algorithm ${\cal A}^{\prime}$ that is resilient to a Byzantine adversary while incurring an overhead of $\widetilde{O}((\mbox{\tt c}_{1}+\mbox{\tt d}_{1})^{2}\cdot\mbox{\tt d}_{2})$ in the number of rounds.

Compiler Against Eavesdropping.

Our second application considers an eavesdropper adversary that in each round can listen on one of the graph edges of his choice. The goal is to take an algorithm ${\cal A}$ and compile it to an equivalent algorithm ${\cal A}^{\prime}$ with the guarantee that the adversary learns nothing (in the information theoretic sense) regarding the messages of ${\cal A}$. This application perfectly fits the cycle cover infrastructure. We show:

Theorem 6** (Compiler for Eavesdropping, Informal).**

Assume that $(\mbox{\tt d},\mbox{\tt c})$-cycle cover is computed in a preprocessing phase. Then any distributed algorithm ${\cal A}$ can be compiled into an ${\cal A}^{\prime}$ algorithm that is resilient to an eavesdropping adversary while incurring an overhead of $\widetilde{O}(\mbox{\tt d}+\mbox{\tt c})$ in the number of rounds.

In a companion work [PY17], low-congestion cycle covers are used to build up a more massive infrastructure that provides much stronger security guarantees. In the setting of [PY17], the adversary takes over a single node in the network and the goal is for all nodes to learn nothing on inputs and outputs of other nodes. This calls for combining the graph theory with cryptographic tools to get a compiler that is both efficient and secure.

Our Focus.

We note that the main focus in this paper is to study low-congestion cycle covers from an algorithmic and combinatorial perspective, as well as to demonstrate their applications for resilient computation. In these distributed applications, it is assumed that the cycle covers are constructed in a preprocessing phase and are given in a distributed manner (e.g., each edge $e$ knows the cycles that go through it). Such preprocessing should be done only once per graph.

Though our focus is not in the distributed implementation of constructing these cycle covers, we do address this setting to some extent by: (1) providing a preprocessing algorithm with $\widetilde{O}(n)$ rounds that constructs the covers for general graphs; (2) providing a (nearly) optimal construction for the family of minor closed graphs. A sublinear distributed construction of cycle covers for general graphs requires considerably extra work and appears in a follow-up work [PY17].

1.3 Preliminaries

Graph Notations.

For a rooted tree $T\subseteq G$, and $z\in V$, let $T(z)$ be the subtree of $T$ rooted at $z$, and let $\pi(u,v,T)$ be the tree path between $u$ and $v$, when $T$ is clear from the context, we may omit it and simply write $\pi(u,v)$. For a vertex $u$, let $p(u)$ be the parent of $u$ in $T$. Let $P_{1}$ be a $u$-$v$ path (possibly $u=v$) and $P_{2}$ be a $v$-$z$ path, we denote by $P_{1}\circ P_{2}$ to be the concatenation of the two paths.

The fundamental cycle $C$ of an edge $e=(u,v)\notin T$ is the cycle formed by taking $e$ and the tree path between $u$ and $v$ in $T_{0}$, i.e., $C=e\circ\pi(u,v,T)$. For $u,v\in G$, let $\mbox{\rm dist}(u,v,G)$ be the length (in edges) of the shortest $u-v$ path in $G$.

For every integer $i\geq 1$, let $\Gamma_{i}(u,G)=\{v~{}\mid~{}\mbox{\rm dist}_{G}(u,v)\leq i\}$. When $i=1$, we simply write $\Gamma(u,G)$. Let $\deg(u,G)=|\Gamma(u,G)|$ be the degree of $u$ in $G$. For a subset of edges $E^{\prime}\subseteq E(G)$, let $\deg(u,E^{\prime})=|\{v:(u,v)\in E^{\prime}\}|$ be the number of edges incident to $u$ in $E^{\prime}$. For a subset of nodes $U$, let $\deg(U,E^{\prime})=\sum_{u\in U}\deg(u,E^{\prime})$. For a subset of vertices $S_{i}\subseteq V(G)$, let $G[S_{i}]$ be the induced subgraph on $S_{i}$.

Fact 1**.**

[Moore Bound, [Bol04]] Every $n$-vertex graph $G=(V,E)$ with at least $2n^{1+1/k}$ edges has a cycle of length at most $2k$.

The Communication Model.

We use a standard message passing model, the ${\mathsf{CONGEST}}$ model [Pel00], where the execution proceeds in synchronous rounds and in each round, each node can send a message of size $O(\log n)$ to each of its neighbors. In this model, local computation at each node is for free and the primary complexity measure is the number of communication rounds. Each node holds a processor with a unique and arbitrary ID of $O(\log n)$ bits.

Definition 1** (Secret Sharing).**

Let $x\in\{0,1\}^{n}$ be a message. The message $x$ is secret shared to $k$ shares by choosing $k$ random strings $x^{1},\ldots,x^{k}\in\{0,1\}^{n}$ conditioned on $x=\bigoplus_{j=1}^{k}x^{j}$. Each $x^{j}$ is called a share, and notice that the joint distribution of any $k-1$ shares is uniform over $(\{0,1\}^{n})^{k-1}$.

2 Technical Overview

2.1 Low Congestion Cycle Covers

We next give an overview of the construction of low congestion cycle covers of Theorem 1. The proof proof appears in Section 3.

Let $G=(V,E)$ be a bridgeless $n$-vertex graph with diameter $D$. Our approach is based on constructing a BFS tree $T$ rooted at an arbitrary vertex in the graph $G$ and covering the edges by two procedures: the first constructs a low congestion cycle cover for the non-tree edges and the second covers the tree edges.

Covering the Non-Tree Edges.

Let $E^{\prime}=E\setminus E(T)$ be the set of non-tree edges. Since the diameter222The graph $G\setminus T$ might be disconnected, when referring to its diameter, we refer to the maximum diameter in each connected component of $G\setminus T$. of $G\setminus T$ might be large (e.g., $\Omega(n)$), to cover the edges of $E^{\prime}$ by short cycles (i.e., of length $O(D)$), one must use the edges of $T$. A naïve approach is to cover every edge $e=(u,v)$ in $E^{\prime}$ by taking its fundamental cycle in $T$ (i.e., using the $u$-$v$ path in $T$). Although this yields short cycles, the congestion on the tree edges might become $\Omega(n)$. The key challenge is to use the edges of $T$ (as we indeed have to) in a way that the output cycles would be short without overloading any tree edge more than $\widetilde{O}(1)$ times.

Our approach is based on using the edges of the tree $T$ only for the purpose of connecting nodes that are somewhat close to each other (under some definition of closeness to be described later), in a way that would balance the overload on each tree edge. To realize this approach, we define a specific way of partitioning the nodes of the tree $T$ into blocks according to $E^{\prime}$. In a very rough manner, a block consists of a set of nodes that have few incident edges in $E^{\prime}$. To define these blocks, we number the nodes based on post-order traversal in $T$ and partition them into blocks containing nodes with consecutive numbering. The density of a block $B$ is the number of edges in $E^{\prime}$ with an endpoint in $B$. Letting b be some threshold of constant value on the density, the blocks are partitioned such that every block is either (1) a singleton block consisting of one node with at least b edges in $E^{\prime}$ or (2) consists of at least two nodes but has a density bounded by $2\mbox{\tt b}$. As a result, the number of blocks is not too large (say, at most $|E^{\prime}|/8$).

To cover the edges of $E^{\prime}$ by cycles, the algorithm considers the contracted graph obtained by contracting all nodes in a given block into one supernode and connecting two supernodes $B_{1}$ and $B_{2}$, if there is an edge in $E^{\prime}$ whose one endpoint is in $B_{1}$, and the other endpoint is in $B_{2}$. This graph is in fact a multigraph as it might contain self-loops or multi-edges. We now use the fact that any $x$-vertex graph with at least $2x$ edges has girth $O(\log x)$. Since the contracted graph contains at most $x=|E^{\prime}|/8$ nodes and has $|E^{\prime}|$ edges, its girth is $O(\log n)$. The algorithm then repeatedly finds (edge-disjoint) short cycles (of length $O(\log n)$) in this contracted graph333That is, it computes a short cycle $C$, omit the edges of $C$ from the contracted graph and repeat., until we are left with at most $|E^{\prime}|/4$ edges. The cycles computed in the contracted graph are then translated to cycles in the original graph $G$ by using the tree paths $\pi(u,v,T)$ between nodes $u,v$ belonging to the same supernode (block). We note that this translation might result in cycles that are non-simple, and this is handled later on.

Our key insight is that even though the tree paths connecting two nodes in a given block might be long, i.e., of length $\Omega(D)$, we show that every tree edge is “used” by at most two blocks. That is, for each edge $e$ of the tree, there are at most 2 blocks such that the tree path $\pi(u,v,T)$ of nodes $u,v$ in the block passes through $e$. (If a block has only a single node, then it will use no tree edges.) Since the (non-singleton) blocks have constant density, we are able to bound the congestion on each tree edge $e$. The translation of cycles in the contracted graph to cycles in the original graph yields $O(D\log n)$-length cycles in the original graph where every edge belongs to $O(1)$ cycles.

The above step already covers $1/4$ of the edges in $E^{\prime}$. We continue this process for $\log n$ times until all edges of $E^{\prime}$ are covered, and thus get a $\log n$ factor in the congestion.

Finally, to make the output cycle simple, we have an additional “cleanup” step (procedure $\mathsf{SimplifyCycles}$) which takes the output collection of non-simple cycles and produces a collection of simple ones. In this process, some of the edges in the non-simple cycles might be omitted, however, we prove that only tree edges might get omitted and all non-tree edges remain covered by the simple cycles. This concludes the high level idea of covering the non-tree edges. We note the our blocking definition is quite useful also for distributed implementations. The reason is that although the blocks are not independent, in the sense that the tree path connecting two nodes in a given block pass through other blocks, this independence is very limited. The fact that each tree edge is used in the tree paths for only two blocks allows us also to work distributively on all blocks simultaneously (see Section B.1).

Covering the Tree Edges.

Covering the tree edges turns out to be the harder case where new ideas are required. Specifically, whereas for the non-tree edges our goal is to find cycles that use the tree edge as rarely as possible, here we aim to find cycles that cover all tree edges, but still avoid using a particular tree edge in too many cycles.

The construction is based on the notion of swap edges. For every tree edge $e\in T$, define the swap edge of $e$ by $e^{\prime}=\mathsf{Swap}(e)$ to be an arbitrary edge in $G$ that restores the connectivity of $T\setminus\{e\}$. Since the graph $G$ is $2$-edge connected such an edge $\mathsf{Swap}(e)$ is guaranteed to exist for every $e\in T$. Let $e=(u,v)$ (i.e., $u=p(v)$) and $(u^{\prime},v^{\prime})=\mathsf{Swap}(e)$. Let $s(v)$ be the endpoint of $\mathsf{Swap}(e)$ that do not belong to $T(u)$ (i.e., the subtree $T$ rooted at $u$), thus $v^{\prime}=s(v)$.

The algorithm for covering the tree edges is recursive, where in each step we split the tree into two edge disjoint subtrees $T_{1},T_{2}$ that are balanced in terms of number of edges. To perform a recursive step, we would like to break the problem into two independent subproblems, one that covers the edges of $T_{1}$ and the other that covers the edges of $T_{2}$. However, observe that there might be edges $(u,v)\in T_{1}$ where the only cycle that covers them444Recall that the graph $G$ is two edge connected. passes through $T_{2}$ (and vice versa).

Specifically, we will consider all tree edges $(u,v)\in T_{1}$, whose second endpoint $s(v)$ of their swap edge is in $T_{2}$. To cover these tree edges, we employ two procedures, one on $T_{1}$ and the other on $T_{2}$ that together form the desired cycles (for an illustration, see Figures 7 and 9). First, we mark all nodes $v\in T_{1}$ such that their $s(v)$ is in $T_{2}$. Then, we use an Algorithm called $\mathsf{TreeEdgeDisjointPath}$ ([KR95] and Lemma 4.3.2 [Pel00]) which solves the following problem: given a rooted tree $T$ and a set of $2k$ marked nodes $M\subseteq V(T)$ for $k\leq n/2$, find a matching of these vertices $\langle u_{i},u_{j}\rangle$ into pairs such that the tree paths $\pi(u_{i},u_{j},T)$ connecting the matched pairs are edge-disjoint.

We employ Algorithm $\mathsf{TreeEdgeDisjointPath}$ on $T_{1}$ with the marked nodes as described above. Then for every pair $u_{i},u_{j}\in T_{1}$ that got matched by Algorithm $\mathsf{TreeEdgeDisjointPath}$, we add a virtual edge between $s(u_{i})$ and $s(u_{j})$ in $T_{2}$. Since this virtual edge is a non-tree edge with both endpoints in $T_{2}$, we have translated the dependency between $T_{1}$ and $T_{2}$ to covering a non-tree edge in $T_{2}$. At this point, we can simply use Algorithm $\mathsf{NonTreeCover}$ on the tree $T_{2}$ and the non-virtual edges. This computes a cycle collection which covers all virtual edges $(s(u_{i}),s(u_{j}))$. In the final step, we replace each virtual edge $(s(u_{i}),s(u_{j}))$ with an $s(u_{i})$-$s(u_{j})$ path that consists of the tree path $\pi(u_{i},u_{j},T_{1})$, and the paths between $u_{i}$ and $s(u_{i})$ (as well as the path connecting $u_{j}$ and $s(u_{j})$).

This above description is simplified and avoids many details and complications that we had to address in the full algorithm. For instance, in our algorithm, a given tree edge might be responsible for the covering of up to $\Theta(D)$ many tree edges. This prevents us from using the edge disjoint paths of Algorithm $\mathsf{TreeEdgeDisjointPath}$ in a naïve manner. In particular, our algorithm has to avoid the multiple appearance of a given tree edge on the same cycle as in such a case, when making the cycle simple that tree edge might get omitted and will no longer be covered. See Section 3 for the precise details of the proof, and see Figure 1 for a summary of our algorithm.

2.2 Universally Optimal Cycle Covers

In this section we describe how to transform the construction of Section 2.1 into an universally optimal construction: covering each edge $e$ in $G$ by almost the shortest possible cycle while having almost no overlap between cycles. Let $C_{e}$ be the shortest cycle covering $e$ in $G$ and $\mathsf{OPT}_{\mathsf{C}}=\max_{e}{|C_{e}|}$. Clearly, there are graphs with diameter $D=\Omega(n)$ and $\mathsf{OPT}_{\mathsf{C}}=O(1)$. We show:

Theorem 2 (Rephrased).

For any bridgeless graph $G$, one can construct an $(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}),\widetilde{O}(1))$ cycle cover $\mathcal{C}$. Also, each edge $e\in G$ has a cycle $C^{\prime}_{e}$ in $\mathcal{C}$ containing $e$ such that $|C^{\prime}_{e}|=\widetilde{O}(|C_{e}|)$.

We will use the fact that our cycle cover algorithm of Section 2.1 does not require $G$ to be bridgeless, but rather covers every edge $e$ that appears on some cycle in $G$. We call such cycle cover algorithm nice.

Our approach is based on the notion of neighborhood covers (also known as ball carving). The $t$-neighborhood cover [ABCP96] of the graph $G$ is a collection of clusters $\mathcal{N}=\{S_{1},\ldots,S_{r}\}$ in the graph such that (i) every vertex $v$ has a cluster that contains its entire $t$-neighborhood, (ii) the diameter of $G[S_{i}]$ is $O(t\cdot\log n)$ and (iii) every vertex belongs to $O(\log n)$ clusters in $\mathcal{N}$. The key observation is that if each edge appears on a cycle of length at most $\mathsf{OPT}_{\mathsf{C}}$, then there must be a (small diameter) subgraph $G[S_{i}]$ that fully contains this cycle.

The algorithm starts by computing an $\mathsf{OPT}_{\mathsf{C}}$-neighborhood cover which decomposes $G$ into almost-disjoint subgraph $G[S_{1}],\ldots,G[S_{r}]$, each with diameter $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$. Next, a $(\mbox{\tt d}_{i},\mbox{\tt c}_{i})$ cycle cover $\mathcal{C}_{i}$ is constructed in each subgraph $G_{i}$ by applying algorithm $\mathsf{CycleCover}$ of Section 2.1 where $\mbox{\tt d}_{i}=\widetilde{O}(\mathsf{Diam}(G[S_{i}])$ and $\mbox{\tt c}_{i}=\widetilde{O}(1)$. The final cycle cover $\mathcal{C}$ is the union of all these covers $\mathcal{C}=\bigcup_{i}\mathcal{C}_{i}$. Since $\mathsf{Diam}(G[S_{i}])=\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$, the length of all cycles is $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$. Turning to congestion, since each vertex appears on $O(\log n)$ many subgraphs, taking the union of all cycles increases the total congestion by only $O(\log n)$ factor. Finally it remains to show that all edges are covered. Since each edge $e$ appears on a cycle $C_{e}$ in $G$ of length at most $\mathsf{OPT}_{\mathsf{C}}$, there exists a cluster, say $S_{i}$ that contains all the vertices of $C_{e}$. We have that $e$ appears on a cycle in $G[S_{i}]$ and hence it is covered by the cycles of $\mathcal{C}_{i}$. To provide a cycle cover that is almost-optimal with respect each edge, we repeat the above procedures for $O(\log\mathsf{OPT}_{\mathsf{C}})$ many times, in the $i^{th}$ application, the algorithm constructs $2^{i}$-neighborhood cover, applies Alg. ${\cal A}$ in each of the resulting clusters and by that covers all edges $e$ with $|C_{e}|\leq 2^{i}$. The detailed analysis and pseudocodes is in Section 3.3.

2.3 Application to Resilient Distributed Computation

Our study of low congestion cycle cover is motivated by applications in distributed computing. We given an overview of our two applications to resilient distributed computation that uses the framework of our cycle cover. Both applications are compilers for distributed algorithms in the standard ${\mathsf{CONGEST}}$ model. In this model, each node can send a message of size $O(\log n)$ to each of its neighbors in each rounds (the full definition of the model appears in Section 1.3). The full details of the compilers appear in Section 4.

Byzantine Faults.

In this setting, there is an adversary that can maliciously modify messages sent over the edges of the graph. The adversary is allowed to do the following. In each round, he picks a single message $M_{e}$ passed on the edge $e\in G$ and corrupts it in an arbitrary manner (i.e., modifying the sent message, or even completely dropping the message). The recipient of the corrupted message is not notified of the corruption. The adversary is assumed to know the inputs to all the nodes, and the entire history of communications up to the present. It then picks which edge to corrupt adaptively using this information.

Our goal is to compile any distributed algorithm ${\cal A}$ into an resilient one ${\cal A}^{\prime}$ while incurring a small blowup in the number of rounds. The compiled algorithm ${\cal A}^{\prime}$ has the exact same output as ${\cal A}$ for all nodes even in the presence of such an adversary. Our compiler assumes a preprocessing phase of the graph, which is fault-free, in which the cycle covers are computed. The preprocessing phase computes a $(\mbox{\tt d}_{1},\mbox{\tt c}_{1})$-cycle covers and a $(\mbox{\tt d}_{2},\mbox{\tt c}_{2})$-two-edge disjoint variant using Theorem 4 (see Section 3.4 for details regarding two-edge disjoints cycle cover).

For the simplicity of this overview, we give a description of our compiler assuming that the bandwidth on each edge is $\widetilde{O}(\mbox{\tt c}_{2})$. This is the basis for the final compiler that uses the standard bandwidth of $O(\log n)$. We note that this last modification is straightforward in a model without an adversary, e.g., by blowing up the round complexity by a factor of $\widetilde{O}(\mbox{\tt c}_{2})$, or by using more efficient scheduling techniques such as [LMR94, Gha15b]. However, such transformations fail in the presence of the adversary since two messages that are sent in the same round might be sent in different rounds after this transformation. This allows the adversary to modify both of the messages – which could not be obtained before the transformations, i.e., in the large bandwidth protocol.

The key idea is to use the three edge-disjoint, low-congestion paths between any neighboring pairs $u$ and $v$ provided by the $(\mbox{\tt d}_{2},\mbox{\tt c}_{2})$ two-edge disjoint cycle covers. Let $\ell=4\mbox{\tt d}_{2}$, where $\mbox{\tt d}_{2}$ is an upper bound on the length these paths. Consider round $i$ of algorithm ${\cal A}$. For every edge $e=(u,v)$, let $M_{e}$ be the message that $u$ sends to $v$ in round $i$ of algorithm ${\cal A}$. Each of these messages $M_{e}$ is going to be sent using $\ell$ rounds, on the three edge-disjoint routes. The messages will be sent repeatedly on the edge disjoint paths, in a pipeline manner, throughout the $\ell$ rounds. That is, in each of the $\ell$ rounds, node $u$ repeatedly sends the message $M_{e}$ along the three edge disjoint paths to $v$. Each intermediate node forwards any message received on a path to its successor on that path. The endpoint $v$ recovers the message $M_{e}$ by taking the majority of the received messages in these $\ell$ rounds. Let $a_{1}\leq a_{2}$ be the lengths of the two edge-disjoint paths connecting $u$ and $v$ (in addition to the edge $(u,v)$). We prove that the fraction of uncorrupted messages received by $v$ is at least

[TABLE]

Thus, regardless of the adversary’s strategy, the majority of the messages received by $v$ are correct, allowing $v$ to recover the message.

Our final compiler that works in the ${\mathsf{CONGEST}}$ model with bandwidth $O(\log n)$ is more complex. As explained above, using scheduling to reduce congestion might be risky. Our approach compiles each round of algorithm ${\cal A}$ in two phases. The first phase uses the standard $(\mbox{\tt d}_{1},\mbox{\tt c}_{1})$ cycle cover to reduce the number of “risky receivers” from $n$ down to $O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$. The second phase restricts attention to these remaining messages which will be re-send along the three edge-disjoint paths in a similar manner to the description above. The fact that we do not know in advance which messages will be handled in the second phase, poses some obstacles and calls for a very careful scheduling scheme. See Section 4 for the detailed compiler and its analysis.

Eavesdropping.

In this setting, an adversary eavesdrops on an single (adversarially chosen) edge in each round. The goal is to prevent the adversary from learning anything, in the information-theoretic sense, on any of the messages sent throughout the protocol. Here we use the two edge disjoint paths, between neighbors, that the cycle cover provides us in a different way. Instead of repeating the message, we “secret share” it.

Consider an edge $(u,v)$ and let $M$ be the message sent on $e$. The sender $u$ secret shares555We say $M\in\{0,1\}^{m}$ is secret shared to $k$ shares by choosing $k$ random strings $M^{1},\ldots,M^{k}\in\{0,1\}^{m}$ conditioned on $M=\bigoplus_{j=1}^{k}M^{j}$. Each $M^{j}$ is called a share, and notice that the joint distribution of any $k-1$ shares is uniform over $(\{0,1\}^{m})^{k-1}$ and thus provides no information on the message $M$. the message $M$ to $d+1$ random shares $M_{1},\ldots,M_{d+1}$ such that $M_{1}\oplus\dots\oplus M_{d+1}=M$. The first $\ell$ shares of the message, namely $M_{1},\ldots,M_{\ell}$, will be sent on the direct $(u,v)$ edge, in each of the rounds of phase $i$, and the $(d+1)^{th}$ share is sent via the $u$-$v$ path $C_{e}\setminus\{e\}$. At the end of these $d$ rounds, $v$ receives $d+1$ messages. Since the adversary can learn at most $d$ shares out of the $d+1$ shares, we know that he did not learn anything (in the information-theoretic sense) about the message $M$. See the full details in Section 4.

2.4 Distributed Algorithm for Minor-Closed Graphs

We next turn to consider the distributed construction of low-congestion covers for the family of minor-closed graphs. We will highlight here the main ideas for constructing $(\mbox{\tt d},\mbox{\tt c})$ cycle covers with $\mbox{\tt d}=\widetilde{O}(D)$ and $\mbox{\tt c}=\widetilde{O}(1)$ within $r=\widetilde{O}(D)$ rounds. Similarly to Section 2.2, applying the below construction in each component of the neighborhood cover, yields a nearly optimal cycle cover with $\mbox{\tt d}=\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$ and $\mbox{\tt c}=\widetilde{O}(1)$, where $\mathsf{OPT}_{\mathsf{C}}$ is the best dilation of any cycle cover in $G$, regardless of the congestion constraint.

The distributed output of the cycle cover construction is as follows: each edge $e$ knows the edge IDs of all the edges that are covered by cycles that pass through $e$. Let $|E(G)|\leq c\cdot n$ for the universal constant $c$ of the minor closed family of $G$ (see 2).

The algorithm begins by constructing a BFS tree $T\subseteq G$ in $O(D)$ rounds. Here we focus on the covering procedure of the non-tree edges. Covering the tree edges is done by a reduction to the non-tree just like in the centralized construction.

The algorithm consists of $O(\log n)$ phases, each takes $O(D)$ rounds. In each phase $i$, we are given a subset $E^{\prime}\subseteq E\setminus E(T)$ that remains to be covered and the algorithm constructs a cycle cover $\mathcal{C}_{i}$, that is shown to cover most of the $E^{\prime}$ edges, as follows:

Step (S1): Tree Decomposition into Subtree Blocks.

The tree is decomposed into vertex disjoint subtrees, which we call blocks. These blocks have different properties compared to those of the algorithm in Section 2.1. The density of a block is the number of edges in $E^{\prime}$ that are incident to nodes of the block. Ideally, we would want the densities of the blocks to be bounded by $\mbox{\tt b}=16\cdot c$. Unfortunately, this cannot be achieved while requiring the blocks to be vertex disjoint subtrees. Our blocks might have an arbitrarily large density, and this would be handled in the analysis.

The tree decomposition works layer by layer from the bottom of the tree up the root. The weight of a node $v$, $W(v)$, is the number of uncovered non-tree edges incident to $v$. Each node $v$ of the layer sends to its parent in $T$, the residual weight of its subtree, namely, the total weight of all the vertices in its subtree $T(v)$ that are not yet assigned to blocks. A parent $u$ that receives the residual weight from its children does the following. Let $W^{\prime}(u)$ be the sum of the total residual weight of its children plus $W(u)$. If $W^{\prime}(u)\geq\mbox{\tt b}$, then $u$ declares a block and down-casts its ID to all relevant descendants in its subtree (this ID serves as the block-ID). Otherwise, it passes $W^{\prime}(u)$ to its parent.

Step (S2): Covering Half of the Edges.

The algorithm constructs a cycle collection that covers two types of $E^{\prime}$-edges: (i) edges with both endpoints in the same block and (ii) pairs of edges $e_{1},e_{2}\in E^{\prime}$ whose endpoints connect the same pair of blocks $B_{1},B_{2}$. That is, the edges in $E^{\prime}$ that are not covered are those that connect vertices in blocks $B,B^{\prime}$ and no other edge in $E^{\prime}$ connects these pair of blocks.

The root of each block is responsible for computing these edges in its block, and to compute their cycles, as follows. All nodes exchange the block-ID with their neighbors. Then, each node sends to the root of its block the block IDs of its neighbors in $E^{\prime}$. This allows each root to identity the relevant $E^{\prime}$ edges incident to its block. The analysis shows that despite the fact that the density of the block might be large, this step can be done in $O(D)$ rounds. Edges with both endpoints in the same block are covered by taking their fundamental cycle666The fundamental cycle of an edge $e=(u,v)\notin T$ is the cycle formed by taking $e$ and the $u$-$v$ path in $T$. into $\mathcal{C}_{i}$. For the second type, the root arbitrarily matches pairs of $E^{\prime}$ edges that connect vertices in the same pair of blocks. For each matched pair of edges $e=(u,v),e^{\prime}=(u^{\prime},v^{\prime})$ with endpoints in block $B_{1}$ and $B_{2}$, the cycle for covering these edges $C(e,e^{\prime})$ defined by $C(e,e^{\prime})=\pi(u,u^{\prime},T)\circ e^{\prime}\circ\pi(v^{\prime},v,T)\circ e$ (i.e., taking the tree paths in each block). Thus, the cycles have length $O(D)$. (see Figure 13 for an illustration). This completes the description of phase $i$.

Covering Argument via Super-Graph.

We show that most of the $E^{\prime}$-edges belongs to the two types of edges covered by the algorithm. This statement does not hold for general graphs, and exploits the properties minor closed families. Let $E^{\prime\prime}$ be the subset of $E^{\prime}$ edges that are not covered in phase $i$. We consider the super-graph of $T\cup E^{\prime\prime}$ obtained by contracting the tree edges inside each block. Since the blocks are vertex disjoint, the resulting super-graph has one super-node per block and the $E^{\prime\prime}$ edges connecting these super-nodes. By the properties of phase $i$, the super-graph does not contain multiple edges or self-loops. The reason is that every self-loop corresponds to an edge in $E^{\prime}$ that connects two nodes inside one block. Multiple edges between two blocks correspond to two $E^{\prime}$-edges that connect endpoints in the same pair of blocks. Both of these $E^{\prime}$ edges are covered in phase $i$. Since the density of each block with respect to $E^{\prime}$ is at least b, the super-graph contains at most $n^{\prime}=|E^{\prime}|/(c\cdot 8)$ super-nodes and $|E^{\prime\prime}|$ edges. As the super-graph belongs to the family of minor-closed as well, we have that $|E^{\prime\prime}|\leq c\cdot n^{\prime}$ edges, and thus $|E^{\prime\prime}|\leq|E^{\prime}|/8$, as required. The key observation for bounding the congestion on the edges is:

Observation 1**.**

Let $e=(x,y)$ be a tree edge (where $x$ is closer to the root) and let $B$ be the block of $x$ and $y$. Letting $B_{y}=B\cap T(y)$, it holds that $\deg(B_{y},E^{\prime})\leq\mbox{\tt b}$.

This observation essentially implies that blocks can be treated as if they have bounded densities, hence taking the tree-paths of blocks into the cycles keeps the congestion bounded. The distributed algorithm for covering the tree edges essentially mimics the centralized construction of Section 3. For the computation of the swap edges distributively we will use the algorithm of Section 4.1 in [GP16]. The full analysis of the algorithm as well as the prcoedure that covers the tree edges, appear in Section 5.

3 Low Congestion Cycle Cover

We give the formal definition of a cycle cover and prove our main theorem regarding low-congestion cycle covers.

Definition 2** (Low-Congestion Cycle Cover).**

For a given graph $G=(V,E)$, a $(\mbox{\tt d},\mbox{\tt c})$ low-congestion cycle cover ${\cal C}$ of $G$ is a collection of cycles that cover all edges of $G$ such that each cycle $C\in{\cal C}$ is of length at most $O(\mbox{\tt d})$ and each edge appears in at most $O(\mbox{\tt c})$ cycles in ${\cal C}$. That is, for every $e\in E$ it holds that $1\leq|\{C\in\mathcal{C}:e\in C\}|\leq O(\mbox{\tt c})$.

We also consider partial covers, that cover only a subset of edges $E^{\prime}$. We say that a cycle cover $\mathcal{C}$ is a $(\mbox{\tt d},\mbox{\tt c})$ cycle cover for $E^{\prime}\subseteq E$, if all cycles are of length at most d, each edge of $E^{\prime}$ appears in at least one of the cycles of $\mathcal{C}$, and no edge in $E(G)$ appears in more than $c$ cycles in $\mathcal{C}$. That is, in this restricted definition, the covering is with respect to the subset of edges $E^{\prime}$, however, the congestion limitation is with respect to all graph edges.

The main contribution of this section is an existential result regarding cycle covers with low congestion. Namely, we show that any graph that is 2-edge connected has a cycle cover where each cycle is at most the diameter of the graph (up to $\log n$ factors) and each edge is covered by $O(\log n)$ cycles. Moreover, the proof is actually constructive, and yields a polynomial time algorithm that computes such a cycle cover.

Theorem 1 (Rephrased).

For every bridgeless $n$-vertex graph $G$ with diameter $D$, there exists a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover with $\mbox{\tt d}=O(D\log n)$ and $\mbox{\tt c}=O(\log^{3}n)$.

The construction of a $(\mbox{\tt d},\mbox{\tt c})$-cycle cover ${\cal C}$ starts by constructing a BFS tree $T$. The algorithm has two sub-procedures: the first computes a cycle collection ${\cal C}_{1}$ for covering the non-tree edges $E_{1}=E(G)\setminus E(T)$, the second computes a cycle collection ${\cal C}_{2}$ for covering the tree edges $E_{2}=E(T)$. We describe each cover separately. The pseudo-code for the algorithm is given in Figure 2. The algorithm uses two procedures, $\mathsf{NonTreeCover}$ and $\mathsf{TreeCover}$ which are given in Section 3.1 and Section 3.2 respectively.

3.1 Covering Non-Tree Edges

Covering the non-tree edge mainly uses the fact that while the graph has many edges, then the girth is small. Specifically, using Fact 1, with $k=2\log{n}$ we get that the girth of a graph with at least $2n$ edges is at most $4\log{n}$. Hence, as long as that the graph has at least $2n$ edges, a cycle of length $4\log n$ can be found. We get that all but $2n$ edges in $G$ are covered by edge-disjoint cycles of length $O(\log n)$.

In this subsection, we show that the set of edges $E_{1}$, i.e., the set of non-tree edges can be covered by a $(O(D\log n),\widetilde{O}(1))$-cycle cover denoted ${\cal C}_{1}$. Actually, what we show is slightly more general: if the tree is of depth $D(T)$ the length of the cycles is at most $O(D(T)\log n)$. Lemma 1 will be useful for covering the tree-edges as well in Section 3.2.

Lemma 1**.**

Let $G=(V,E)$ be a $n$-vertex graph, let $T\subseteq G$ be a spanning tree of depth $D(T)$. Then, there exists an $(O(D(T)\log n),O(\log n))$-cycle cover ${\cal C}_{1}$ for the edges of $E(G)\setminus E(T)$.

An additional useful property of the cover ${\cal C}_{1}$ is that despite the fact that the length of the cycles in ${\cal C}_{1}$ is $O(D\log n)$, each cycle is used to cover $O(\log n)$ edges.

Lemma 2**.**

Each cycle in ${\cal C}_{1}$ is used to cover $O(\log n)$ edges in $E(G)\setminus E(T)$.

The rest of this subsection is devoted to the proof of Lemma 1. A key component in the proof is a partitioning of the nodes of the tree $T$ into blocks. The partitioning is based on a numbering of the nodes from $1$ to $n$ and grouping nodes with consecutive numbers into blocks under certain restrictions. We define a numbering of the nodes

[TABLE]

by traversing the nodes of the tree in post-order traversal. That is, we let $N(u)=i$ if $u$ is the ${i}\textsuperscript{th}$ node traversed. Using this mapping, we proceed to defining a partitioning of the nodes into blocks and show some of their useful properties.

For a block $B$ of nodes and a subset of non-tree edges $E^{\prime}\subseteq E_{1}$, the notation $\deg(B,E^{\prime})$ is the number of edges in $E^{\prime}$ that have an endpoint in the set $B$ (counting multiplicities). We call this the density of block $B$ with respect to $E^{\prime}$. For a subset of edges $E^{\prime}$, and a density bound b (which will be set to a constant), an $(E^{\prime},\mbox{\tt b})$-partitioning $\mathcal{B}$ is a partitioning of the nodes of the graph into blocks that satisfies the following properties:

Every block consists of a consecutive subset of nodes (w.r.t. their $N(\cdot)$ numbering). 2. 2.

If $\deg(B,E^{\prime})>\mbox{\tt b}$ then $B$ consists of a single node. 3. 3.

The total number of blocks is at most $4|E^{\prime}|/\mbox{\tt b}$.

Claim 1**.**

For any b and $E^{\prime}$, there exists an $(E^{\prime},\mbox{\tt b})$-partitioning partitioning of the nodes of $T$ satisfying the above properties.

Proof.

This partitioning can be constructed by a greedy algorithm that traverses nodes of $T$ in increasing order of their numbering $N(\cdot)$ and groups them into blocks while the density of the block does not exceed b (see Figure 3 for the precise procedure).

Indeed, properties 1 and 2 are satisfied directly by the construction. For property 3, let $t$ be the number of blocks $B$ with $\deg(B,E^{\prime})\leq\mbox{\tt b}/2$. For such a block $B$ let $B^{\prime}$ be the block that comes after $B$. By the construction, we know that $B^{\prime}$ satisfies $\deg(B,E^{\prime})+\deg(B^{\prime},E^{\prime})>\mbox{\tt b}$. Let $B_{1},\ldots,B_{\ell}$ be the final partitioning. Then, we have $t$ pairs of blocks that have density at least b and the rest of the $(\ell-t/2)$ blocks that have density at least $\mbox{\tt b}/2$. Formally, we have

[TABLE]

On the other hand, since it is a partitioning of $E^{\prime}$ we have that $\sum_{i=1}^{\ell}\deg(B_{i},E^{\prime})=2|E^{\prime}|$. Thus, we get that $\ell\mbox{\tt b}/2\leq 2|E^{\prime}|$ and therefore $\ell\leq 4|E^{\prime}|/\mbox{\tt b}$ as required. ∎

Our algorithm for covering the edges of $E_{1}=E(G)\setminus E(T)$ makes use of this block partitioning with $\mbox{\tt b}=16$. For any two nodes $u,v\in V(T)$, The algorithm begins with an empty collection ${\cal C}$ and then performs $\log n$ iterations where each iteration works as follows: Let $E^{\prime}\subseteq E_{1}$ be the set of uncovered edges (initially $E^{\prime}=E_{1}$). Then, we partition the nodes of $T$ with respect to $E^{\prime}$ and density parameter b. Finally, we search for cycles of length $O(\log n)$ between the blocks. If such a cycle exists, we map it to a cycle in $G$ by connecting nodes $u,v$ within a block by the path $\pi(u,v)$ in the tree $T$. This way a cycle of length $O(\log n)$ between the blocks translates to a cycle of length $O(D(T)\log n)$ in the original graph $G$. Denote the resulting collection by ${\cal C}$.

We note that the cycles ${\cal C}$ might not be simple. This might happen if and only if the tree paths $\pi(v_{i},u_{i+1})$ and $\pi(v_{j},u_{j+1})$ intersect for some $j\in[t]$. Notice that the if an edge appears more than once in a cycle, then it must be a tree edge. Thus, we can transform any non-simple cycle $C$ into a collection of simple cycles that cover all edges that appeared only once in $C$ (the formal procedure is given at Figure 5). Since these cycle are constructed to cover only non-tree edges, this transformation does not damage the covering of the $E_{1}$ edges. The formal description of the algorithm is given in Figure 4.

We proceed with the analysis of the algorithm, and show that it yields the desired cycle cover. That is, we show three things: that every cycle has length at most $O(D(T)\log n)$, that each edge is covered by at most $O(\log n)$ cycles, and that each edge has at least one cycle covering it.

Cycle Length.

The bound of the cycle length follows directly from the construction. The cycles added to the collection are of the form $(u_{1},v_{1})\circ\pi(v_{1},u_{2})\circ(u_{2},v_{2})\circ\pi(v_{2},u_{3})\circ(u_{3},v_{3})\circ\dots\circ(v_{t},u_{1})$, where each $\pi(v_{i},u_{i+1})$ are paths in the tree $T$ and thus are of length at most $2D(T)$. Notice that the simplification process of the cycles can only make the cycles shorter. Since $t\leq\log n$ we get that the cycle lengths are bounded by $O(D(T)\log n)$.

Congestion.

To bound the congestion of the cycle cover we exploit the structure of the partitioning, and the fact that each block in the partition has a low density. We begin by showing that by the post-order numbering, all nodes in a given subtree have a continuous range of numbers. For every $z\in V$, let $\min_{N}(z)$ be the minimal number of a node in the subtree of $T$ rooted by $z$. That is, $\min_{N}(z)=\min_{u\in T(z)}N(u)$ and similarly let $\max_{N}(z)=\max_{u\in T(z)}N(u)$.

Claim 2**.**

For every $z\in V$ and for every $u\in G$ it holds that (1) $\max_{N}(z)=N(z)$ and (2) $N(u)\in[\min_{N}(z),\max_{N}(z)]$ iff $u\in T(z)$.

Proof.

The proof is by induction on the depth of $T(z)$. For the base case, we consider the leaf nodes $z$, and hence $T(z)$ with [math]-depth, the claim holds vacuously. Assume that the claim holds for nodes in level $i+1$ and consider now a node $z$ in level $i$. Let $v_{i,1},\ldots,v_{i,\ell}$ be the children of $z$ ordered from left to right. By the post-order traversal, the root $v_{i,j}$ is the last vertex visited in $T(v_{i,j})$ and hence $N(v_{i,j})=\max_{N}(v_{i,j})$. Since the traversal of $T(v_{i,j})$ starts right after finishing the traversal of $T(v_{i,j-1})$ for every $j\geq 2$, it holds that $\min_{N}(v_{i,j})=N(v_{i,j-1})+1$. Using the induction assumption for $v_{i,j}$, we get that all the nodes in $T(z)\setminus\{z\}$ have numbering in the range $[\min_{N}(v_{i,1}),\max_{N}(v_{i,\ell})]$ and any other node not in $T(z)$ is not in this range. Finally, $N(z)=N(v_{i,\ell})+1$ and so the claim holds. ∎

The cycles that we computed contains tree paths $\pi(u,v)$ that connect two nodes $u$ and $v$ in the same block. Thus, to bound the congestion on a tree edge $e\in T$ we need to bound the number of blocks that contain a pair $u,v$ such that $\pi(u,v)$ passes through $e$. The next claim shows that every edge in the tree is effected by at most 2 blocks.

Claim 3**.**

Let $e\in T$ be a tree edge and define $\mathcal{B}(e)=\{B\in\mathcal{B}~{}\mid~{}\exists u,v\in B\mbox{~{}s.t.~{}}e\in\pi(u,v)\}$. Then, $|\mathcal{B}(e)|\leq 2$ for every $e\in T$.

Proof.

Let $e=(w,z)$ where $w$ is closer to the root in $T$, and let $u,v$ be two nodes in the same block $B$ such that $e\in\pi(u,v)$. Let $\ell$ be the least common ancestor of $u$ and $v$ in $T$ (it might be that $\ell\in\{u,v\}$), then the tree path between $u$ and $v$ can be written as $\pi(u,v)=\pi(u,\ell)\circ\pi(\ell,v)$. Without loss of generality, assume that $e\in\pi(\ell,v)$. This implies that $v\in T(z)$ but $u\notin T(z)$. Hence, the block of $u$ and $v$ intersects the nodes of $T(z)$. Each block consists of a consecutive set of nodes, and by Claim 2 also $T(z)$ consists of a consecutive set of nodes with numbering in the range $[\min_{N}(z),\max_{N}(z)]$, thus there are at most two such blocks that intersect $e=(w,z)$, i.e., blocks $B$ that contains both a vertex $y$ with $N(y)\in[\min_{N}(z),\max_{N}(z)]$ and a vertex $y^{\prime}$ with $N(y^{\prime})\notin[\min_{N}(z),\max_{N}(z)]$, and the claim follows. ∎

Finally, we use the above claims to bound the congestion. Consider any tree edge $e=(w,z)$ where $w$ is closer to the root than $z$. Recall that $T(z)$ be the subtree of $T$ rooted at $z$. Fix an iteration $i$ of the algorithm. We characterize all cycles in $\mathcal{C}$ that go through this edge.

For any cycle that passes through $e$ there must be a block $B$ and two nodes $u,v\in B$ such that $e\in\pi(u,v)$. By Claim 3, we know that there are that at each iteration of the algorithm, there are at most two such blocks $B$ that can affect the congestion of $e$. Moreover, we claim that each such block has density at most b. Otherwise it would be a block containing a single node, say $u$, and thus the path $\pi(u,u)=u$ is empty and cannot contain the edge $e$. For each edge in $E^{\prime}$ we construct a single cycle in ${\cal C}$, and thus for each one of the two blocks that affect $e$ the number of pairs $u,v$ such that $e\in\pi(u,v)$ is bounded by $\mbox{\tt b}/2$ (each pair $u,v$ has two edges in the block $B$ and we know that the total number of edges is bounded by b).

To summarize the above, we get that for each iteration, that are at most 2 blocks that can contribute to the congestion of an edge $e$: one block that intersects $T(z)$ but has also nodes smaller than $\min_{N}(z)$ and one block that intersects $T(z)$ but has also nodes larger than $\max_{N}(z)$. Each of these two blocks can increase the congestion of $e$ by at most $\mbox{\tt b}/2$. Since there are at most $\log n$ iterations, we can bound the total congestion by $b\log n$. Notice that if an edge appears $k$ times in a cycle, then this congestion bound counts all $k$ appearances. Thus, after the simplification of the cycles, the congestion remains unchanged.

Cover.

We show that each edge in $E_{1}$ is covered by some cycle and that each cycle is used to cover $O(\log n)$ edges in $E_{1}$. We begin by showing the covering property of the preliminary cycle collection, before the simplification procedure. We later show that the covering is preserved even after simplifying the cycles. The idea is that at each iteration of the algorithm, the number of uncovered edges is reduced by half. Therefore, the $\log|E_{1}|=O(\log n)$ iterations should suffice for covering all edges of $E_{1}$. In each iteration we partition the nodes into blocks, and we search for cycles between the blocks. The point is that if the number of edges is large, then when considering the blocks as nodes in a new virtual graph, this graph has a large number of edges and thus must have a short cycle.

In what follows, we formalize the intuition given above. Let $E^{\prime}_{i}$ be the set $E^{\prime}$ at the ${i}\textsuperscript{th}$ iteration of the algorithm. Consider the iteration $i$ with the set of uncovered edge set $E^{\prime}_{i}$. Our goal is to show that $E^{\prime}_{i+1}\leq 1/2E^{\prime}_{i}$. By having $\log|E_{1}|$ iterations, last set will be empty.

Let $\mathcal{B}_{i}$ be the partitioning performed at iteration $i$ with respect to the edge set $E^{\prime}_{i}$. Define a super-graph $\widetilde{G}$ in which each block $B_{j}\in\mathcal{B}_{i}$ is represented by a node $\widetilde{v}_{j}$, and there is an edge $(\widetilde{v}_{j},\widetilde{v}_{j^{\prime}})$ in $\widetilde{G}$ if there is an edge in $E^{\prime}_{i}$ between some node $u$ in $B_{j}$ and a node $u^{\prime}$ in $B_{j^{\prime}}$, i.e.,

[TABLE]

See Figure 6 for an illustration.

The number of nodes in $\widetilde{G}$, which we denote by $n_{i}$, is the number of blocks in the partition and is bounded by $n_{i}\leq 4|E^{\prime}_{i}|/\mbox{\tt b}$. Let $B(u)$ be the block of the node $u$. The algorithm finds cycles of the form $(u_{1},v_{1})\circ\pi(v_{1},u_{2})\circ(u_{2},v_{2})\circ\pi(v_{2},u_{3})\circ\dots\circ(u_{t},v_{t})\circ(v_{t},u_{1})$, which is equivalent to finding the cycle $B(u_{1}),\ldots,B(u_{t})$ in the graph $\widetilde{G}$. In general, any cycle of length $t$ in $\widetilde{G}$ is mapped to a cycle in $G$ of length at most $t\cdot D(T)$. Then, the algorithm adds the cycle to ${\cal C}$ and removes the edges of the cycle (thus removing them also from $\widetilde{G}$). At the end of iteration $i$ the graph $\widetilde{G}$ has no cycles of length at most $\log n$. At this point, the next set of edges $E^{\prime}_{i+1}$ is exactly the edges left in $\widetilde{G}$. By Fact 1 (and recalling that $\mbox{\tt b}=16$) we get that if $\widetilde{G}$ does not have any cycles of length at most $\log n$ then we get the following bound on the number of edges:

[TABLE]

Thus, all will be covered by a cycle $C$ before the simplification process. We show that the simplification procedure of the cycle maintains the cover requirement. This stems from the fact that the only edges that might appear more than once in a cycle are tree edges. Thus even if we drop these edges, the non-tree edges remain covered. It is left to show that this process only drops edges that appear more than once:

Claim 4**.**

Let $C$ be a cycle and let ${\cal C}^{\prime}=\mathsf{SimplifyCycles}(C)$. Then, for every edge $e\in C$ that appears at most once in $C$ there is a cycle $C^{\prime}\in{\cal C}^{\prime}$ such that $e\in C^{\prime}$.

Proof.

The procedure $\mathsf{SimplifyCycles}$ works in iterations where in each iteration it chooses a vertex $w$ that appears more than once in $C$ and partitions the cycle $C$ to consecutive parts, $C_{1},\ldots,C_{\ell}$. All edges in $C$ appear in some $C_{j}$. However, $C_{j}$ might not be a proper cycle since it might be the case that $|C_{j}|\leq 2$. Thus, we show that in an edge $e\in C$ appeared at most once in a cycle $C$ then it will appear in $C_{j}$ for some $j$ where $|C_{j}|\geq 3$. We show that this holds for any iteration and thus will hold at the end of the process.

We assume without loss of generality that no vertex has two consecutive appearances. Denote $e=(v_{2},v_{3})$ and let $C=(v_{1},v_{2})\circ(v_{2},v_{3})\circ\dots\circ(v_{k-1},v_{k})$ for $k\geq 3$. Since $e$ does not appear again in $C$ we know that $v_{1},v_{2},v_{3}$ are distinct. Thus, if $k=3$ then $C$ will not be split again and the claim follows.

Therefore, assume that $k\geq 4$. Since $e$ does not appear again in $C$ we know that $v_{2},v_{3},v_{4}$ are distinct (it might be the case that $v_{1}=v_{4}$). Thus, we know that $|\{v_{1},v_{2},v_{3},v_{4}\}|\geq 3$. Any subsequence begins and ends at the same vertex and thus the subsequence $C_{j}$ that contains $e$ must contains all of $v_{1},v_{2},v_{3},v_{3}$ and thus $|C_{j}|\geq 3$, and the claim follows. ∎

Finally, we turn to prove Lemma 2. The lemma follows by noting that each cycle in ${\cal C}_{1}$ contains at most $O(\log n)$ non-tree edges. To see this, observe that each cycle computed in the contracted block graph has length $O(\log n)$. Translating these cycles into cycles in $G$ introduces only tree edges. We therefore have that each cycle is used to cover $O(\log n)$ non-tree edges.

3.2 Covering Tree Edges

Finally, we present Algorithm $\mathsf{TreeCover}$ that computes a cycle cover for the tree edges. The algorithm is recursive and uses Algorithm $\mathsf{NonTreeCover}$ as a black-box. Formally, we show:

Lemma 3**.**

For every $n$-vertex bridgeless graph $G$ and a tree $T\subseteq G$ of depth $D$, there exists a $(D\log n,\log^{3}n)$ cycle cover for the edges of $T$.

We begin with some notation. Throughout, when referring to a tree edge $(u,v)\in T$, the node $u$ is closer to the root of $T$ than $v$. Let $E(T)=\{e_{1},\ldots,e_{n-1}\}$ be an ordering of the edges of $T$ in non-decreasing distance from the root. For every tree edge $e\in T$, recall that the swap edge of $e$, denoted by $e^{\prime}=\mathsf{Swap}(e)$, is an arbitrary edge in $G$ that restores the connectivity of $T\setminus\{e\}$. Let $e=(u,v)$ (i.e., $u=p(v)$) and $(u^{\prime},v^{\prime})=\mathsf{Swap}(e)$. Let $s(v)$ be the endpoint of $\mathsf{Swap}(e)$ that does not belong to $T(u)$ (i.e., the subtree $T$ rooted at $u$), thus $v^{\prime}=s(v)$. Define the $v$-$s(v)$ path

[TABLE]

For an illustration see Figure 7.

For the tree $T$, we construct a subset of tree edges denoted by $I(T)$ that we are able to cover. These edges are independent in the sense that their $P_{e}$ paths are “almost” edge disjoint (as will be shown next). The subset $I(T)$ is constructed by going through the edges of $T$ in non-decreasing distance from the root. At any point, we add $e$ to $I(T)$ only if it is not covered by the $P_{e^{\prime}}$ paths of the $e^{\prime}$ edges already added.

Claim 5**.**

The subset $I(T)$ satisfies:

• •

For every $e\in E(T)$, there exists $e^{\prime}\in I(T)$ such that $e\in e^{\prime}\circ P_{e^{\prime}}$.

• •

For every $e,e^{\prime}\in I(T)$ such that $e\neq e^{\prime}$ it holds that $P_{e}$ and $P_{e^{\prime}}$ have no tree edge in common (no edge of $T$ is in both paths).

• •

For every swap edge $(z,w)$, there exists at most two paths $P_{e},P_{e^{\prime}}$ for $e,e^{\prime}\in I(T)$ such that one passes through $(z,w)$ and the other through $(w,z)$. That is, each swap edge appears at most twice on the $P_{e}$ paths, once in each direction.

Proof.

The first property follows directly from the construction. Next, we show that they share no tree edge in common. Assume that there is a common edge $(z,w)\in P_{e}\cap P_{e^{\prime}}\cap E(T)$. Then, both $e,e^{\prime}$ must be on the path from the root to $z$ on the tree. Without loss of generality, assume that $e^{\prime}$ is closer to the root than $e$. We then get that $e\in P_{e^{\prime}}$, leading to contradiction. For the third property, assume towards constriction that both $P_{e}$ and $P_{e^{\prime}}$ use the same swap edge in the same direction. Again it implies that both $e,e^{\prime}$ are on the path from the root to $z$ on $T$, and the same argument to the previous case yields that $e\in P_{e^{\prime}}$, thus a contradiction. ∎

Our cycle cover for the $I(T)$ edges will be shown to cover all the edges of the tree $T$. This is because the cycle that we construct to cover an edge $e\in I(T)$ necessarily contains $P_{e}$.

Algorithm $\mathsf{TreeCover}$ uses the following procedure $\mathsf{TreeEdgeDisjointPath}$, usually used in the context of distributed routing.

Key Tool: Route Disjoint Matching.

Algorithm $\mathsf{TreeEdgeDisjointPath}$ solves the following problem ([KR95], and Lemma 4.3.2 [Pel00]): given a rooted tree $T$ and a set of $2k$ marked nodes $M\subseteq V(T)$ for $k\leq n/2$, the goal is to find (by a distributed algorithm) a matching of these vertices $\langle w_{i},w_{j}\rangle$ into pairs such that the tree paths $\pi(w_{i},w_{j},T)$ connecting the matched pairs are edge-disjoint. This matching can be computed distributively in $O(\mathsf{Diam}(T))$ rounds by working from the leaf nodes towards the root. In each round a node $u$ that received information on more $\ell\geq 2$ unmarked nodes in its subtree, match all but at most one into pairs and upcast to its parent the ID of at most one unmarked node in its subtree. It is easy to see that all tree paths between matched nodes are indeed edge disjoint.

We are now ready to explain the cycle cover construction of the tree edges $E(T)$.

Description of Algorithm $\mathsf{TreeCover}$.

We restrict attention for covering the edges of $I(T)$. The tree edges $I(T)$ will be covered in a specific manner that covers also the edges of $E(T)\setminus I(T)$. The key idea is to define a collection of (virtual) non-tree edges $\widetilde{E}=\{(v,s(v)):(p(v),v)~{}\in I(T)\}$ and covering these non-tree edges by enforcing the cycle that covers the non-tree edge $(v,s(v))$ to cover the edges $e=(p(v),v)$ as well as the path $P_{e}$. Since every edge $e^{\prime}\in T$ appears in one of the $e\circ P_{e}$ paths, this will guarantee that all tree edges are covered.

Algorithm $\mathsf{TreeCover}$ is recursive and has $O(\log n)$ levels of recursion. In each independent level of the recursion we need to solve the following sub-problem: Given a tree $T^{\prime}$, cover by cycles the edges of $I(T^{\prime})$ along with their $P_{e}$ paths. The key idea is to subdivide this problem into two independent and balanced subproblems. To do this, the tree $T^{\prime}$ gets partitioned777This partitioning procedure is described in Appendix A. We note that this partitioning maintains the layering structure of $T^{\prime}$. into two balanced edge disjoint subtrees $T^{\prime}_{1}$ and $T^{\prime}_{2}$, where $|T^{\prime}_{1}|,|T^{\prime}_{2}|\leq 2/3\cdot|T^{\prime}|$ and $E(T^{\prime}_{1})\cup E(T^{\prime}_{2})=E(T^{\prime})$. Some of the tree edges in $T^{\prime}$ are covered by applying a procedure that computes cycles using the edges of $T^{\prime}$, and the remaining ones will be covered recursively in either $T^{\prime}_{1}$ or $T^{\prime}_{2}$. Specifically, the edges of $I(T^{\prime})$ are partitioned into $4$ types depending on the position of their swap edges. For every $x,y\in\{1,2\}$, let

[TABLE]

The algorithm computes a cycle cover ${\cal C}_{1,2}$ (resp., ${\cal C}_{2,1}$) for covering the edges of $E^{\prime}_{1,2},E^{\prime}_{2,1}$ respectively. The remaining edges $E^{\prime}_{11}$ and $E^{\prime}_{22}$ are covered recursively by applying the algorithm on $T^{\prime}_{1}$ and $T^{\prime}_{2}$ respectively. See Fig. 7 for an illustration.

We now describe how to compute the cycle cover ${\cal C}_{1,2}$ for the edges of $E^{\prime}_{1,2}$. The edges $E^{\prime}_{2,1}$ are covered analogously (i.e., by switching the roles of $T^{\prime}_{1}$ and $T^{\prime}_{2}$). Recall that the tree edges $E^{\prime}_{1,2}$ are those edges $(p(v),v)$ such $v\in T^{\prime}_{1}$ and $s(v)\in T^{\prime}_{2}$. The procedure works in $O(\log n)$ phases, each phase $i$ computes three cycle collections ${\cal C}^{\prime}_{i,1},{\cal C}^{\prime}_{i,2}$ and ${\cal C}^{\prime}_{i,3}$ which together covers at least half of the yet uncovered edges of $E^{\prime}_{1,2}$ (as will be shown in analysis).

Consider the $i^{th}$ phase where we are given the set of yet uncovered edges $X_{i}\subseteq E^{\prime}_{1,2}$. We first mark all the vertices $v$ with $(p(v),v)\in X_{i}$. Let $M_{i}$ be this set of marked nodes. For ease of description, assume that $M_{i}$ is even, otherwise, we omit one of the marked vertices $w$ (from $M_{i}$) and take care of its edge $(p(w),w)$ in a later phase. We apply Algorithm $\mathsf{TreeEdgeDisjointPath}(T^{\prime}_{1},M_{i})$ (see Lemma 4.3.2 [Pel00]) which matches the marked vertices $M_{i}$ into pairs $\Sigma=\{\langle v_{1},v_{2}\rangle\mid v_{1},v_{2}\in M_{i}\}$ such that for each pair $\sigma=\langle v_{1},v_{2}\rangle$ there is a tree path $\pi(\sigma)=\pi(v_{1},v_{2},T^{\prime}_{1})$ and all the tree paths $\pi(\sigma),\pi(\sigma^{\prime})$ are edge disjoint for every $\sigma,\sigma^{\prime}\in\Sigma$.

Let $X^{\prime\prime}_{i}=\{e=(p(v),v)\in X_{i}:\exists v^{\prime}\mbox{~{}and~{}}\langle v,v^{\prime}\rangle\in\Sigma,\mbox{~{}s.t.~{}}e\in\pi(v,v^{\prime},T^{\prime}_{1})\}$ be the set of edges in $X_{i}$ that appear in the collection of edge disjoint paths $\{\pi(\sigma),\sigma\in\Sigma\}$. Our goal is to cover all edges in $E^{\prime\prime}_{i}=X^{\prime\prime}_{i}\cup\{P_{e}~{}\mid~{}e\in X^{\prime\prime}_{i}\}$ by cycles ${\cal C}_{i}$. To make sure that all edges $E^{\prime\prime}_{i}$ are covered, we have to be careful that each such edge appears on a given cycle exactly once. Towards this end, we define a directed conflict graph $G_{\Sigma}$ whose vertex set are the pairs of $\Sigma$, and there is an arc $(\sigma^{\prime},\sigma)\in A(G_{\Sigma})$ where $\sigma=\langle v_{1},v_{2}\rangle$, $\sigma=\langle v^{\prime}_{1},v^{\prime}_{2}\rangle$, if at least one of the following cases holds: Case (I) $e=(p(v_{1}),v_{1})$ on $\pi(v_{1},v_{2},T^{\prime}_{1})$ and the path $\pi^{\prime}=\pi(v^{\prime}_{1},v^{\prime}_{2},T^{\prime}_{1})$ intersects the edges of $P_{e}$; Case (II) $e^{\prime}=(p(v_{2}),v_{2})$ on $\pi(v_{1},v_{2},T^{\prime}_{1})$ and the path $\pi^{\prime}$ intersects the edges of $P_{e^{\prime}}$. Intuitively, a cycle that contains both $\pi^{\prime}$ and $P_{e}$ is not simple and in particular might not cover all edges on $P_{e}$. Since the goal of the pair $\sigma=\langle v_{1},v_{2}\rangle$ is to cover all edges on $P_{e}$ (for $e\in\pi(v_{1},v_{2},T^{\prime}_{1})$), the pair $\sigma^{\prime}$ “interferes” with $\sigma$.

In the analysis section (Claim 6), we show that the outdegree in the graph $G_{\Sigma}$ is bounded by $1$ and hence we can color $G_{\Sigma}$ with $3$ colors. This allows us to partition $\Sigma$ into three color classes $\Sigma_{1},\Sigma_{2}$ and $\Sigma_{3}$. Each color class $\Sigma_{j}$ is an independent set in $G_{\Sigma}$ and thus it is “safe” to cover all these pairs by cycles together. We then compute a cycle cover ${\cal C}_{i,j}$, for each $j\in\{1,2,3\}$. The collection of all these cycles will be shown to cover the edges $E^{\prime\prime}_{i}$.

To compute ${\cal C}_{i,j}$ for $j=\{1,2,3\}$, for each matched pair $\langle v_{1},v_{2}\rangle\in\Sigma_{j}$, we add to $T^{\prime}_{2}$ a virtual edge $\widehat{e}$ between $s(v_{1})$ and $s(v_{2})$. Let

[TABLE]

We cover these virtual non-tree edges by cycles using Algorithm $\mathsf{NonTreeCover}$ on the tree $T^{\prime}_{2}$ with the non-tree edges $\widehat{E}_{i,j}$. Let ${\cal C}^{\prime\prime}_{i,j}$ be an $(O(D\log n),\widehat{O}(\log n))$-cycle cover that is the output of Algorithm $\mathsf{NonTreeCover}(T^{\prime}_{2},E^{\prime}_{i,j})$. The output cycles of ${\cal C}^{\prime\prime}_{i,j}$ are not yet cycles in $G$ as they consists of two types of virtual edges: the edges in $\widehat{E}_{i,j}$ and the edges $\widetilde{E}=\{(v,s(v))~{}\mid~{}(p(v),v)\in I(T)\}$. First, we translate each cycle $C^{\prime\prime}\in{\cal C}^{\prime\prime}_{i,j}$ into a cycle $C^{\prime}$ in $G\cup\widetilde{E}$ by replacing each of the virtual edges $\widehat{e}=(s(v_{1}),s(v_{2}))\in\widehat{E}_{i,j}$ in $C^{\prime\prime}$ with the path $P(\widehat{e})=(s(v_{1}),v_{1})\circ\pi(v_{1},v_{2},T^{\prime}_{1})\circ(v_{2},s(v_{2}))$. Then, we replace each virtual edge $(v,s(v))\in\widetilde{E}$ in $C^{\prime}$ by the $v$-$s(v)$ path $P_{e}$ for $e=(p(v),v)$. This results in cycles ${\cal C}_{i,j}$ in $G$.

Finally, let $\mathcal{C}_{i}=\mathcal{C}_{i,1}\cup\mathcal{C}_{i,2}\cup\mathcal{C}_{i,3}$ and define $X_{i+1}=X_{i}\setminus X^{\prime\prime}_{i}$ to be the set of edges $e\in X_{i}$ that are not covered by the paths of $\Sigma$. If in the last phase $\ell=O(\log n)$, the set of marked nodes $M_{\ell}$ is odd, we omit one of the marked nodes $w\in M_{\ell}$, and cover its tree edge $e=(p(w),w)$ by taking the fundamental cycle of the swap edge $\mathsf{Swap}(e)$ into the cycle collection. The final cycle collection for $E^{\prime}_{1,2}$ is given by ${\cal C}_{1,2}=\bigcup_{i=1}^{\ell}{\cal C}_{i}$. The same is done for the edges $E^{\prime}_{2,1}$. This completes the description of the algorithm. The final collection of cycles is denoted by ${\cal C}_{3}$. See Figure 10 for the full description of the algorithm. See Figures 7, 8 and 9 and for illustration.

We analyze the $\mathsf{TreeCover}$ algorithm and show that it finds short cycles, with low congestion and that every edge of $T$ is covered.

Short Cycles.

By construction, each cycle that we compute using Algorithm $\mathsf{NonTreeCover}$ consists of at most $O(\log n)$ non-tree (virtual) edges $\widehat{E}_{i,j}$. The algorithm replaces each non-tree edge $\widehat{e}=(v_{1},v_{2})$ by an $v_{1}$-$v_{2}$ path in $G$ of length $O(D)$. This is done in two steps. First, $\widehat{e}=(v_{1},v_{2})$ is replaced by a path $P_{\widehat{e}}=(v_{1},s(v_{1}))\circ\pi(v_{1},v_{2},T)\circ(v_{2},s(v_{2}))$ in $G\cup\widetilde{E}$. Then, each $(v,s(v))$ edge is replaced by the path $P_{(p(v),v)}$ in $G$, which is also of length $O(D)$. Hence, overall the translated path $v_{1}$-$v_{2}$ path in $G$ has length $O(D)$. Since there are $O(\log n)$ virtual edges that are replaced on a given cycle, the cycles of $G$ has length $O(D\log n)$.

Cover.

We start with some auxiliary property used in our algorithm.

Claim 6**.**

Consider the graph $G_{\Sigma}$ constructed when considering the edges in $E^{\prime}_{1,2}$. The outdegree of each pair $\sigma^{\prime}=\langle v^{\prime}_{1},v^{\prime}_{2}\rangle\in\Sigma$ in $G_{\Sigma}$ is at most $1$. Therefore, $G_{\Sigma}$ can be colored in $3$ colors.

Proof.

Let $\sigma=\langle v_{1},v_{2}\rangle$ be such that $\sigma^{\prime}$ interferes with $\sigma$ (i.e., $(\sigma^{\prime},\sigma)\in A(G_{\Sigma})$). Without loss of generality, let $e=(p(v_{1}),v_{1})$ be such that $e\in\pi(v_{1},v_{2},T^{\prime}_{1})$ and $\pi(v^{\prime}_{1},v^{\prime}_{2},T^{\prime}_{1})$ intersects the edges of $P_{e}$.

We first claim that this implies that $e$ appears above the least common ancestor of $v^{\prime}_{1}$ and $v^{\prime}_{2}$ in $T^{\prime}_{1}$, and hence by the properties of our partitioning, also in $T$. Assume towards contradiction otherwise, since $e\circ P_{e}$ is a path on $T$ (where $e$ is closer to the root) and since $P_{e}$ intersects $\pi(v^{\prime}_{1},v^{\prime}_{2},T^{\prime}_{1})$, it implies that $e\in\pi(v^{\prime}_{1},v^{\prime}_{2},T^{\prime}_{1})$. Since the vertex $v_{1}$ is marked, we get a contradiction that $v^{\prime}_{1}$ got matched with $v^{\prime}_{2}$ as the algorithm would have matched $v_{1}$ with one of them. In particular, we would get that the paths $\pi(\sigma)$ and $\pi(\sigma^{\prime})$ are not edge disjoint, as both contain $e$. Hence, we prove that $e$ is above the LCA of $v^{\prime}_{1}$ and $v^{\prime}_{2}$.

Next, assume towards contradiction that there is another pair $\sigma^{\prime\prime}=\langle v^{\prime\prime}_{1},v^{\prime\prime}_{2}\rangle\in\Sigma$ such that $\sigma^{\prime}$ interferes with $\sigma^{\prime\prime}$. Without loss of generality, let $v^{\prime\prime}_{1}$ be such that $e^{\prime\prime}=(p(v^{\prime\prime}_{1}),v^{\prime\prime}_{1})$ in on $\pi(v^{\prime\prime}_{1},v^{\prime\prime}_{2},T^{\prime}_{1})$ and $P_{e^{\prime\prime}}$ intersects with $\pi(v^{\prime}_{1},v^{\prime}_{2},T^{\prime}_{1})$. This implies that $e^{\prime\prime}$ is also above the LCA of $v^{\prime}_{1}$ and $v^{\prime}_{2}$ in $T^{\prime}_{1}$. Since one of the edges of $P_{e^{\prime\prime}}$ is on $\pi(v^{\prime}_{1},v^{\prime}_{2},T^{\prime}_{1})$ it must be that either $e^{\prime\prime}$ on $P_{e}$ or vice verca, in contradiction that $e,e^{\prime\prime}\in I(T)$. ∎

We now claim that each edge $e\in T$ is covered. By the definition of $I(T)\subseteq E(T)$, it is sufficient to show that:

Claim 7**.**

For every edge $e\in I(T)$, there exists a cycle $C\in{\cal C}_{3}$ such that $e\circ P_{e}\subseteq C$.

Consider a specific tree edge $e=(p(v),v)$. First, note that since $(v,s(v))$ is a non-tree edge, there must be some recursive call with the tree $T^{\prime}$ such that $v\in T^{\prime}_{1}$ and $s(v)\in T^{\prime}_{2}$ where $T^{\prime}_{1}$ and $T^{\prime}_{2}$ are the balanced partitioning of $T^{\prime}$. At this point, $(v,s(v))$ is an edge in $E^{\prime}_{1,2}$. We show that in the $\ell=O(\log n)$ phases of the algorithm for covering the $E^{\prime}_{1,2}$, there is a phase in which $e$ is covered.

Claim 8**.**

*(I) For every $e=(p(v),v)\in E^{\prime}_{1,2}$ except at most one edge $e^{*}$, there is a phase $i_{e}$ where Algorithm $\mathsf{TreeEdgeDisjointPath}$ matched $v$ with some $v^{\prime}$ such that $e\in\pi(v,v^{\prime})$.

(II) Each edge $e\neq e^{*}$ is covered by the cycles computed in phase $i_{e}$.*

Proof.

Consider phase $i$ where we cover the edges of $X_{i}$. Recall that the algorithm marks the set of nodes $v$ with $(p(v),v)\in X_{i}$, resulting in the set $M_{i}$. Let $\Sigma$ be the output pairs of Algorithm $\mathsf{TreeEdgeDisjointPath}(T^{\prime}_{1},M_{i})$. We first show that at least half of the edges in $X_{i}$ are covered by the paths of $\Sigma$.

If $M_{i}$ is odd, we omit one of the marked nodes and then apply Algorithm $\mathsf{TreeEdgeDisjointPath}$ to match the pairs in the even-sized set $M_{i}$. The key observation is that for every matched pair $\langle v_{1},v_{2}\rangle$, it holds that either $(p(v_{1}),v_{1})$ or $(p(v_{2}),v_{2})$ is on $\pi(v_{1},v_{2},T^{\prime}_{1})$ (or both). Hence, at least half of the edges of $X_{i}$ are on the edge disjoint paths $\pi(v_{1},v_{2},T^{\prime}_{1})$.

We therefore get that after $\ell=c\log n$ phases, we are left with $|M_{\ell}|=O(1)$ at that point if $|M_{\ell}|$ is odd, we omit one vertex $v^{*}$ such that $e^{*}=(p(v^{*}),v^{*})$. Claim (I) follows.

We now consider (II) , let $e=(p(v),v)$ and consider phase $i=i_{e}$ in which $e\in\pi(v,v^{\prime},T^{\prime}_{1})$ where $v^{\prime}$ is the matched pair of $v$. We show that all the edges of $e\circ P_{e}$ are covered by the cycles ${\cal C}_{i}$ computed in that phase. By definition, $\langle v,v^{\prime}\rangle$ belongs to $\Sigma$. By Claim 6, $G_{\Sigma}$ can be colored by $3$ colors, let $\Sigma_{j}\subseteq\Sigma$ be the color class that contains $\langle v,v^{\prime}\rangle$.

We will show that there exists a cycle $C$ in ${\cal C}_{i,j}$ that covers each edge $e^{\prime\prime}\in e\circ P_{e}$ exactly once. Recall that the algorithm applies Algorithm $\mathsf{NonTreeCover}$ which computes a cycle cover ${\cal C}^{\prime\prime}_{i,j}$ to cover all the virtual edges $\widehat{E}_{i,j}$ in $T^{\prime}_{2}$. Also, $(s(v),s(v^{\prime}))\in\widehat{E}_{i,j}$.

Let $C^{\prime\prime}$ be the (simple) cycle in ${\cal C}^{\prime\prime}_{i,j}$ that covers the virtual edge $(s(v),s(v^{\prime}))$. In this cycle $C^{\prime\prime}$ we have two types of edges: edges in $T^{\prime}_{2}$ and virtual edges $(s(v_{1}),s(v_{2}))$. First, we transform $C^{\prime\prime}$ into a cycle $C^{\prime}$ in which each virtual edge $\widehat{e}=(s(v_{1}),s(v_{2}))$ is replaced by a path $P(\widehat{e})=(s(v_{1}),v_{1})\circ\pi(v_{1},v_{2},T^{\prime}_{1})\circ(v_{2},s(v_{2}))$. Next, we transform $C^{\prime}$ into $C\subseteq G$ by replacing each edge $(v_{1},s(v_{1}))\in\widetilde{E}$ in $C^{\prime\prime}$ by the $v_{1}$-$s(v_{1})$ path $P_{e_{1}}$ for $e_{1}=(p(v_{1}),v_{1})$.

We now claim that the final cycle $C\subseteq G$, contains each of the edges $e\circ P_{e}$ exactly once, hence even if $C$ is not simple, making it simple still guarantees that $e\circ P_{e}$ remain covered. Since $T^{\prime}_{1}$ and $T^{\prime}_{2}$ are edge disjoint, we need to restrict attention only two types of $T^{\prime}_{1}$ paths that got inserted to $C$: (I) the edge disjoint paths $\Pi_{i,j}=\{\pi(v_{1},v_{2},T^{\prime}_{1})\mid\langle v_{1},v_{2}\rangle\in\Sigma_{j}\}$ and (II) the $v^{\prime}$-$s(v^{\prime})$ paths $P_{e^{\prime}}$ for every edge $e^{\prime}=(p(v^{\prime}),v^{\prime})$ (appears on $C^{\prime}$).

We first claim that there is exactly one path $\pi(v_{1},v_{2},T^{\prime}_{1})\in\Pi_{i,j}$ that contains the edge $e=(p(v),v)$. By the selection of phase $i$, $e\in\pi(v,v^{\prime},T^{\prime}_{1})$ where $v^{\prime}$ is the pair of $v$. Since all paths $\Pi_{i,j}$ are edge disjoint, no other path contains $e$. Next, we claim that there is no path $\pi\in\Pi_{i,j}$ that passes through an edge $e^{\prime}\in P_{e}$. Since $e=(p(v),v)\in\pi(v,v^{\prime},T^{\prime}_{1})$ and all edges on $P_{e}$ are below $e$ on $T$888Since our partitioning into $T^{\prime}_{1},T^{\prime}_{2}$ maintains the layering structure of $T$, it also holds that $P_{e}$ is below $e$ on $T^{\prime}_{1}$., the path $\pi(v,v^{\prime},T^{\prime}_{1})$ does not contain any $e^{\prime}\in P_{e}$. In addition, since all pairs in $\Sigma_{j}$ are independent in $G_{\Sigma}$, there is no path in $\pi(\sigma^{\prime})\in\Pi_{i,j}$ that intersects $P_{e}$ (as in such a case, $\sigma$ interferes with $\langle v,v^{\prime}\rangle$). We get that $e$ appears exactly once on $\Pi_{i,j}$ and no edge from $P_{e}$ appears on $\Pi_{i,j}$. Finally, we consider the second type of paths in $T^{\prime}_{1}$, namely, the $P_{e^{\prime}}$ paths. By construction, every $e^{\prime}\in X_{i}$ is in $I(T)$ and hence that $P_{e^{\prime}}$ and $P_{e}$ share no tree edge. We get that when replacing the edge $(v,s(v))$ with $P_{e}$ all edges $e^{\prime}\in P_{e}$ appears and non of the tree edges on $P_{e}$ co-appear on some other $P_{e^{\prime\prime}}$. All together, each edge on $e\circ P_{e}$ appears on the cycle $C$ exactly once. This completes the cover property. ∎

Since the edge $e^{*}$ is covered by taking the fundamental cycle of its swap edge, we get that all edges of $E^{\prime}_{1,2}$ are covered. Since each edge $(v,s(v))$ belongs to one of these $E^{\prime}_{1,2}$ sets, the cover property is satisfied.

Congestion.

A very convenient property of our partitioning of $T^{\prime}$ into two trees $T^{\prime}_{1}$ and $T^{\prime}_{2}$ is that this partitioning is closed for LCAs. In particular, for $j\in\{1,2\}$ then if $u,v\in T^{\prime}_{j}$, the LCA of $u,v$ in $T^{\prime}$ is also in $T^{\prime}_{j}$. Note that this is in contrast to blocks of Section 3.1 that are not closed to LCAs. We begin by proving by induction on $i=\{1,\ldots,O(\log n)\}$ that all the trees $T^{\prime},T^{\prime\prime}...$ considered in the same recursion level $i$ are edge disjoint. In the first level, the claim holds vacuously as there is only the initial tree $T$. Assume it holds up to level $i$ and consider level $i+1$. As each tree $T_{j}$ in level $i-1$ is partitioned into two edge disjoint trees in level $i+1$, the claim holds.

Note that each edge $e=(v,s(v))$ is considered exactly once, i.e., in one recursion call on $T^{\prime}=T^{\prime}_{1}\cup T^{\prime}_{2}$ where without loss of generality, $v\in T^{\prime}_{1}$ and $s(v)\in T^{\prime}_{2}\setminus T^{\prime}_{1}$. By Claim 8, there is at most one edge $e^{*}\in E^{\prime}_{1,2}$, which we cover by taking the fundamental cycle of $\mathsf{Swap}(e^{*})$ in $T$.

We first show that the congestion in the collection of all the cycles added in this way is bounded by $O(\log n)$. To see this, we consider one level $i$ of the recursion and show that each edge appears on at most $2$ of the fundamental cycles $\mathcal{F}_{i}$ added in that level. Consider an edge $e^{*}$ that is covered in this way in level $i$ of the recursion. That is the fundamental cycle of $\mathsf{Swap}(e^{*})$ given by $\pi(v^{*},s(v^{*}))\cup P_{e^{*}}$ was added to $\mathcal{F}_{i}$. Let $T^{\prime}$ be such that $T^{\prime}=T^{\prime}_{1}\cup T^{\prime}_{2}$ and $e^{*}=(p(v^{*}),v^{*})$ is such that $v^{*}\in T^{\prime}_{1}$ and $s(v^{*})\in T^{\prime}_{2}$. Since both $v$ and $s(v)$ are in $T^{\prime}$, the tree path $\pi(v^{*},s(v^{*}))\subseteq T^{\prime}$. As all other trees $T^{\prime\prime}\neq T^{\prime}$ in level $i$ of the recursion are edge disjoint, they do not have any edge in common with $\pi(v^{*},s(v^{*}))$. For the tree $T^{\prime}$, there are at most two fundamental cycles that we add. One for covering an edge in $E^{\prime}_{1,2}$ and one for covering an edge in $E^{\prime}_{2,1}$. Since $e^{*}\in I(T)$, and each edge appears on at most two paths $P_{e},P_{e^{\prime}}$ for $e,e^{\prime}\in I(T)$, overall each edge appears at most twice on each of the cycles in $\mathcal{F}_{i}$ (once in each direction of the edge) and over all the $O(\log n)$ of the recursion, the congestion due to these cycles is $O(\log n)$.

It remains to bound the congestion of all cycles obtained by translating the cycles computed using Algorithm $\mathsf{TreeCover}$. We do that by showing that the cycle collection ${\cal C}_{i}$ computed in phase $i$ to cover the edges of $E^{\prime}_{1,2}$ is an $O(D\log n,\log n)$ cover. Since there are $O(\log n)$ phases and $O(\log n)$ levels of recursion, overall it gives an $O(D\log n,\log^{3}n)$ cover.

Since all trees considered in a given recursion level are edge disjoint, we consider one of them: $T^{\prime}$. We now focus on phase $i$ of Algorithm $\mathsf{TreeCover}(T^{\prime})$. In particular, we consider the output cycles ${\cal C}^{\prime\prime}_{i,j}$ for $j\in\{1,2,3\}$ computed by Algorithm $\mathsf{NonTreeCover}$ for the edges $\widehat{E}_{1,2}$ and $T^{\prime}_{2}$. Each edge $e\in T^{\prime}_{2}$ appears on $O(\log n)$ cycles of ${\cal C}^{\prime\prime}_{i,j}$. Each virtual edge $\widehat{e}=(s(v_{1}),s(v_{2}))$ is replaced by an $s(v_{1})$-$s(v_{2})$ path $P(\widehat{e})=(s(v_{1}),v_{1})\circ\pi(v_{1},v_{2},T^{\prime}_{1})\circ(s(v_{1}),v_{1})$ in $G\cup\widetilde{E}$. Let ${\cal C}^{\prime}_{i,j}$ be the cycles in $G\cup\widetilde{E}$ obtained from ${\cal C}^{\prime\prime}_{i,j}$ by replacing the edges of $\widehat{e}\in\widehat{E}_{1,2}$ with the paths $P(\widehat{e})$ in $G\cup\widetilde{E}$. Note that every two paths $P(\widehat{e})$ and $P(\widehat{e}^{\prime})$ are edge disjoint for every $\widehat{e},\widehat{e}^{\prime}\in\widehat{E}_{1,2}$. The edges $(s(v_{1}),v_{1})$ of $\widetilde{E}$ gets used only in tree $T^{\prime}$ in that recursion level. Hence, each edge $(v_{1},s(v_{1}))$ appears on $O(\log n)$ cycles $C^{\prime}$ in $G\cup\widetilde{E}$.

Since the paths $\pi(v_{1},v_{2},T^{\prime}_{1})$ are edge disjoint, each edge $e^{\prime}\in\pi(v_{1},v_{2},T^{\prime}_{1})$ appears on at most $O(\log n)$ cycles $C^{\prime}$ in $G\cup\widetilde{E}$ (i.e., on the cycles translated from $C^{\prime\prime}\in{\cal C}^{\prime\prime}_{i,j}$ that contains the edge $\widehat{e}=(s(v_{1}),s(v_{2}))$). Up to this point we get that each virtual edge $(v,s(v))\in\widetilde{E}$ appears on $O(\log n)$ cycles of ${\cal C}^{\prime}_{i,j}$. Finally, when replacing $(v,s(v))$ with the paths $P_{(p(v),v)}$, the congestion in $G$ is increased by factor of at most $2$ as every two path $P_{e}$ and $P_{e^{\prime}}$ for $e,e^{\prime}\in I(T)$, are nearly edge disjoint (each edge $(z,w)$ appears on at most twice of these paths, one time in each direction). We get that the cycle collection ${\cal C}_{i}$ is an $O(D\log n,\log n)$ cover, as desired.

Finally, we conclude by observing that our cycle cover algorithm $\mathsf{CycleCover}$ does not require $G$ to bridgeless by rather covers by a cycle, every edge that appears on some cycle in $G$.

Observation 2**.**

Algorithm $\mathsf{CycleCover}$ covers every edge $e$ that appears on some cycle in $G$, hence it is nice.

Proof.

Every non-tree edge is clearly an edge the appears on a cycle, an Alg. $\mathsf{NonTreeCover}$ indeed covers all non-tree edges. In addition, every tree edge that appears on a cycle, has a swap edge. Since Alg. $\mathsf{TreeCover}$ covers all swap edges while guaranteeing that their corresponding tree edges get covered as well, the observation follows. ∎

3.3 Universally Optimal Cycle Covers

For each edge $e=(u,v)\in E(G)$, let $C_{e}$ be the shortest cycle in $G$ that contains $e$ and let $\mathsf{OPT}_{\mathsf{C}}=\max_{e\in G}|C_{e}|$. Clearly, for every $(\mbox{\tt d},\mbox{\tt c})$-cycle cover $\mathcal{C}$ of $G$, it must hold that each cycle length is at least $\mathsf{OPT}_{\mathsf{C}}$, even when there is no constraint on the congestion c.

An algorithm ${\cal A}$ for constructing cycle covers is nice if it does not require $G$ to be bridgeless, but rather covers by cycles all $G$-edges that lie on a cycle in $G$. In particular, Algorithm $\mathsf{CycleCover}$ of Section 3 is nice (see Observation 2).

Consider a nice algorithm ${\cal A}$ that constructs an $(f_{{\cal A}}(D),\mbox{\tt c})$-cycle cover. We describe Alg. ${\cal A}_{\mathsf{OPT}}$ for constructing an $(\mbox{\tt d}^{\prime},\mbox{\tt c}^{\prime})$-cycle cover with $\mbox{\tt d}^{\prime}=f_{{\cal A}}(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}))$ and $\mbox{\tt c}^{\prime}=\widetilde{O}(\mbox{\tt c})$. Taking ${\cal A}$ to be the $\mathsf{CycleCover}$ algorithm of Section 3 yields the theorem. Alg. ${\cal A}_{\mathsf{OPT}}$ is based on the notion of neighborhood-covers [ABCP96] (also noted by ball carving).

Definition 3** (Neighborhood Cover, [ABCP96]).**

A $(k,t,q)$ $t$-neighborhood cover of an $n$-vertex graph $G=(V,E)$ is a collection of subsets of $V$ (denoted as clusters), $\mathcal{S}=\{S_{1},\ldots,S_{r}\}$ with the following properties:

• •

For every vertex $v$, there exists a cluster $S_{i}$ such that $\Gamma_{t}(V)\subseteq S_{i}$.

• •

The diameter of each induced sugraph $G[S_{i}]$ is at most $\widetilde{O}(t)$.

• •

Each vertex belongs to at most $\widetilde{O}(1)$ clusters.

Alg. ${\cal A}_{\mathsf{OPT}}$ first constructs an $\mathsf{OPT}_{\mathsf{C}}$-neighborhood cover $\mathcal{N}=\{S_{1},\ldots,S_{r}\}$. Thus the diameter $D_{i}$ of each subgraph $G[S_{i}]$ is $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$. Next, Algorithm ${\cal A}$ is applied in each subgraph $G[S_{i}]$ simultaneously, computing a $(f_{{\cal A}}(D_{i}),\mbox{\tt c})$-cycle cover $\mathcal{C}_{i}$ for every $i\in\{1,\ldots,r\}$. The output cover is $\mathcal{C}^{*}=\bigcup_{i=1}^{r}\mathcal{C}_{i}$.

The key observation is that since each edge $e$ lies on a cycle $C_{e}$ of length $O(\mathsf{OPT}_{\mathsf{C}})$ in $G$, there exists a subgraph $G[S_{i}]$ that contains the entire cycle $C_{e}$. Since Alg. ${\cal A}$ is nice, $e$ gets covered in the cycle collection $\mathcal{C}_{i}$ computed by Alg. ${\cal A}$ in $G[S_{i}]$. As the diameter of $G[S_{i}]$ is $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$, the length of all cycles is bounded by $f_{{\cal A}}(\mathsf{OPT}_{\mathsf{C}})$. Finally, since each edge appears on $\widetilde{O}(1)$ clusters, we have that each edge appears on $\widetilde{O}(\mbox{\tt c})$ cycles in the output cycle cover $\mathcal{C}^{*}$.

To provide a cycle cover that is almost-optimal with respect each individual edge, we repeat the above procedures for $O(\log\mathsf{OPT}_{\mathsf{C}})$ many times. In the $i^{th}$ application, the algorithm constructs $2^{i}$-neighborhood cover and applies Alg. ${\cal A}$ in each of the resulting clusters. The output cycle cover is the union of all cycle covers computed in these applications.

An edge $e$ that lies on a cycle of length $\ell=|C_{e}|$ in $G$, will be a covered by the cycles computed in the $\lceil\log\ell\rceil$ iteration. Since the cycles computed in that iteration are computed in clusters of $2^{\lceil\log\ell\rceil}$-neighborhood cover, $e$ will be covered by a cycle of length $\widetilde{O}(|C_{e}|)$. Finally, the $O(\log\mathsf{OPT}_{\mathsf{C}})$ repetitions increases the congestion by factor of at most $O(\log n)$, the claim follows. We now provide a detailed analysis of Algorithm ${\cal A}_{\mathsf{OPT}}$ for proving Theorem 2.

Edge cover.

We show that $\mathcal{C}^{*}$ is a cover. Consider an edge $e=(u,v)$. By the definition of the neighborhood cover there exist an $i\in[r]$ such that $\Gamma_{\mathsf{OPT}_{\mathsf{C}}}(u)\subseteq S_{i}$. Since ${\cal A}$ is nice, each edge in $G[S_{i}]$ that belongs to some cycle in $G[S_{i}]$ is covered by the output cycle cover of Algorithm ${\cal A}$. As $e$ belongs to a cycle $C_{e}$ in $G$ of length at most $\mathsf{OPT}_{\mathsf{C}}$, it holds that $C_{e}\subseteq G[S_{i}]$, thus $e$ is covered by a cycle in $\mathcal{C}_{i}$.

Cycle length.

By the construction of the neighborhood cover, the strong diameter $D_{i}$ of each $G[S_{i}]$ is $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$. Thus, when we run ${\cal A}$ on $G[S_{i}]$, it returns a cycle cover where each cycle is of length at most $f_{{\cal A}}(D_{i})=f_{{\cal A}}(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}))$.

Congestion.

Since $\mathcal{C}_{i}$ is an $(f(D_{i}),\mbox{\tt c})$ cover, each edge $e\in G[S_{i}]$, appears on at most c cycles in $\mathcal{C}_{i}$ for every $i\in\{1,\ldots,r\}$. Since each vertex $v$ appears in at most $q=O(\log n)$ different clusters $S_{j}\in\mathcal{S}$, overall, we get that each edge appears on $O(\mbox{\tt c}\cdot\log n)$ cycles in $\mathcal{C}^{*}$. In Figures 11 and 12, we describe the pseudocodes when taking ${\cal A}$ to be algorithm $\mathsf{CycleCover}$ of Section 3 which constructs $(\widetilde{O}(D),\widetilde{O}(1))$ cycle covers.

See Section B.1 for the distributed construction of universally optimal cycle covers in the ${\mathsf{CONGEST}}$ model.

3.4 Two-Edge Disjoint Cycle Covers

A $(\mbox{\tt d},\mbox{\tt c})$-two-edge disjoint cycle cover $\mathcal{C}$ is a collection of cycles such that each edge appears on at least two edge disjoint cycles, each cycle is of length at most d and each appears on at most c cycles. Using our cycle cover theorem, in this section we show the following generalization;

Theorem 4 (Rephrased).

Let $G$ be a $3$-edge connected graph, then there exists a construction of $(d,c)$ two-edge disjoint cycle cover $\mathcal{C}$ with $d=\widetilde{O}(D^{3})$ and $c=\widetilde{O}(D^{2})$.

Proof.

The construction is based on the sampling approach [DK11]. The algorithm consists of $O(D^{2}\log n)$ iterations or independent experiments. In each experiment $i$, we sample each edge $e\in E(G)$ into $G_{i}$ with probability $p=(1-1/3D)$. We then apply Algorithm $\mathsf{OptimalEdgeCycleCover}$ (see Figure 12) in the graph $G_{i}$. The output of this algorithm is a cycle collection $\mathcal{C}_{i}$ that covers each edge $e\in G_{i}$ by a cycle of length at most $O(\log n\cdot|C_{e}|)$ where $C_{e}$ is the shortest cycle in $G_{i}$ that covers $e$ (if such exists). The final cycle collection is $\mathcal{C}=\bigcup_{i}\mathcal{C}_{i}$.

Next, for each edge $e=(u,v)$, we define the subgraph $G_{e}=\{C\in\mathcal{C}~{}\mid~{}e\in C\}$ containing all cycles in $\mathcal{C}$ that cover $e$ in all these experiments999It is in fact sufficient to pick from each $\mathcal{C}_{i}$, the shortest cycle that covers $e$, for every $i$.. The $3$-edge disjoint cycles between $u$ and $v$ are obtained by computing max-flow between $u$ and $v$ in $G_{e}$.

We next prove the correctness of this procedure and begin by showing the w.h.p. the $u$-$v$ cut in $G_{e}$ is at least $3$ for every $e=(u,v)$. This would imply by Menger theorem that the max-flow computation indeed finds $3$ edge disjoint paths between $u$ and $v$. To prove this claim we show that for every pair of two edge $e_{1},e_{2}\in E$, $G_{e}\setminus\{e_{1},e_{2}\}$ contains a $u$-$v$ path of length at most $O(D\log n)$ (hence, the min-cut between $u$ and $v$ is at least $3$).

Fix such a triplet $\langle e,e_{1},e_{2}\rangle$ and an experiment $i$. We will bound the probability of the following event $\mathcal{E}_{i}$: $G_{i}$ does not contain $e_{1},e_{2}$ but contains all the edges on $P\cup\{e\}$, where $P$ is the $u$-$v$ shortest path in $G\setminus\{e,e_{1},e_{2}\}$. Since all edges are sampled independently into $G_{i}$ with probability $p$, the probability that $\mathcal{E}_{i}$ happens is $p^{|P|+1}\cdot(1-p)^{2}\leq p^{3D+1}\cdot 1/9D^{2}$. Hence, w.h.p., there exists an experiment $j$ in which the event $\mathcal{E}_{j}$ holds. Since $e=(u,v)$ is covered by a path of length $O(D)$ in $G_{j}$ and $G_{j}$ does not contain $e_{1},e_{2}$, we get that the cycle $C^{\prime}_{e}$ that covers $e=(u,v)$ in $\mathcal{C}_{j}$ is of length $O(D\log n)$. Overall, the path $C^{\prime}_{e}\setminus\{e\}$ is free from $\{e_{1},e_{2}\}$. Since the $u$-$v$ cut in $G_{e}$ is at least $3$, by Menger theorem we get that $G_{e}$ contains $3$ edge disjoint $u$-$v$ paths of length at most $|V(G_{e})|=\widetilde{O}(D^{3})$.

We next turn to consider the congestion. Since the final cover is a union of $O(D^{2}\log n)$ cycle covers, and each individual cover $\mathcal{C}_{i}$ has congestion of $\widetilde{O}(1)$, the total congestion is bounded by $\widetilde{O}(D^{2})$. ∎

By the proof of Theorem 4, the construction of two-edge disjoint cycle covers is reduced to $\widetilde{O}(D^{2})$ applications of cycle cover constructions. Using the distributed construction of cycle cover of Section B.1, we get an $\widetilde{O}(n\cdot D^{2})$ algorithm for constructing the two-edge disjoint covers.

4 Resilient Distributed Computation

Our study of low congestion cycle cover is motivated by applications to distributed computing. In this section, we describe two applications to resilient distributed computation that use the framework of our cycle covers. Both applications provide compilers (or simulation) for distributed algorithms in the standard ${\mathsf{CONGEST}}$ model. In this model, each node can send a message of size $O(\log n)$ to each of its neighbors in each rounds (see Section 1.3 for the full definition). The first compiler transforms any algorithm to be resilient to Byzantine faults. The second one compiles any algorithm to be secure against an eavesdropper.

4.1 Byzantine Faults

The Model.

We consider an adversary that can maliciously modify messages sent over the edges of the graph. The adversary is allowed to do the following. In each round, he picks a single message $M_{e}$ passed on the edge $e\in G$ and corrupts it in an arbitrary manner (i.e., modifying the sent message, or even completely dropping the message). The recipient of the corrupted message is not notified of the corruption. The adversary is assumed to know the inputs to all the nodes, and the entire history of the communications up to the present. It then picks which edge to corrupt adaptively using this information.

The goal is to compile any distributed algorithm ${\cal A}$ into an resilient algorithm ${\cal A}^{\prime}$. The compiled algorithm ${\cal A}^{\prime}$ has the exact same output as ${\cal A}$ for all nodes even in the presence of such an adversary. The compiler works round-by-round, and after compiling round $i$ of algorithm ${\cal A}$, all nodes will be able to recover the original messages sent in algorithm ${\cal A}$ in round $i$.

Our compiler assumes a preprocessing phase of the graph, which is fault-free, in which the cycle covers are computed and are given in a distributed manner. Alternatively, if the topology of the network $G$ is known to all nodes as assumed in many previous works, then there is no need for the preprocessing phase. For instance, in [HS16] it assumed that nodes know the entire graph, which allows the nodes to route messages over a sparser spanning subgraph.

Preprocessing.

The preprocessing phase computes a $(\mbox{\tt d}_{1},\mbox{\tt c}_{1})$-cycle covers $\mathcal{C}_{1}$ and a $(\mbox{\tt d}_{2},\mbox{\tt c}_{2})$-two-edge disjoint variant $\mathcal{C}_{2}$, see Section 3.4. These covers are known in a distributed manner, where each edge $e=(u,v)$ knows the cycles that cover it, and the other cycles that go through it.

The Compiler.

To simplify the presentation, we first describe the compiler under the assumption that the bandwidth on each edge is $\widetilde{O}(\mbox{\tt c}_{2})$. We then reduce the bandwidth to $O(\mbox{\tt c}_{1}+\mbox{\tt d}_{1})$, and finally present the final compiler with bandwidth of $O(\log n)$ (i.e., the standard ${\mathsf{CONGEST}}$ model). Such transformations are usually straightforward in the fault-free setting (e.g., by simply blowing-up every round by a factor of $\widetilde{O}(\mbox{\tt c}_{2})$ rounds). In our setting, it becomes quite tricky. To see this, assume that there are two messages $M_{1},M_{2}$ that are sent in the same round in the large bandwidth protocol. In such a case, the adversary can corrupt only one of these messages. When applying a scheduler to reduce the bandwidth, the messages $M_{1}$ and $M_{2}$ might get sent in different rounds, allowing the adversary to corrupt them both!

Throughout, we fix a round $i$ in algorithm ${\cal A}$, and for each edge $e=(u,v)$, let $M_{e}$ be the message sent on $e$ in round $i$ of algorithm ${\cal A}$.

Warming up, Compiler (A) with Bandwidth $\widetilde{O}(\mbox{\tt c}_{2})$:

The compiler works by exploiting the three edge-disjoints paths between every neighboring pair $u$ and $v$, as provided by the $(\mbox{\tt d}_{2},\mbox{\tt c}_{2})$ two-edge disjoint cycle cover.

Specifically, each of the $M_{e}$ messages, for every $e\in G$, is sent along the three edge-disjoint $u$-$v$ paths, repeatedly for $\ell$ rounds in a pipeline manner, where $\ell=4\mbox{\tt d}_{2}$. That is, for $\ell$ rounds, the node $u$ repeatedly sends the message $M_{e}$ to $v$ via the three edge disjoint paths. Each intermediate node on these paths simply forwards the message it has received to its successor on that path. The endpoint $v$ computes the message $M_{e}$ by taking the majority of the messages obtained in these $\ell$ rounds.

We claim that the majority message $M^{\prime}_{e}$ recovered by each $v$ is the correct message $M_{e}$. Let $a_{1}\leq a_{2}$ be the lengths of the two edge-disjoint paths connecting $u$ and $v$ (in addition to the edge $(u,v)$). By definition, $a_{1},a_{2}\leq\mbox{\tt d}_{2}$. The endpoint $v$ received in total $3\ell-a_{1}-a_{2}$ messages from $u$ during this phase: $\ell$ messages are received from the direct edge $(u,v)$, $\ell-a_{1}$ messages received on the second $u$-$v$ path, and $\ell-a_{2}$ messages on the third $u$-$v$ path.

Since the adversary can corrupt at most one message per round, and since the paths are edge-disjoint, in a given round the adversary could corrupt at most one message sent on the three edge-disjoint paths. Hence, in $\ell$ rounds, the adversary could corrupt at most $\ell$ of the received messages in total. Thus, the fraction of uncorrupted messages is at least

[TABLE]

Therefore, the strict majority of messages received by $v$ which establishes the correctness of the compiler. Notice that each edge can get at most $\mbox{\tt c}_{2}$ messages in a given round, since it appears on $\mbox{\tt c}_{2}$ many paths. Since the edge bandwidth is $\widetilde{O}(\mbox{\tt c}_{2})$, all these messages can go through in a single round. Round $i$ is then complied within $O(\mbox{\tt d}_{2})$ rounds.

Intermediate Compiler (B), Bandwidth $O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$:

We will have two phases. In the first phase, all but $O(\mbox{\tt d}_{1})$ of the messages will be correctly recovered. The second phase will take care of these remaining messages using the ideas of compiler (A).

The first phase contains two subphases, each of $\mbox{\tt d}_{1}$ rounds. In the first subphase, each node $u$ sends the message $M_{e}$ along the edge $(u,v)$ in each of these rounds. In addition $u$ sends $M_{e}$ along the path $C_{e}\setminus\{e\}$, where $C_{e}$ is the cycle that covers $e$ in the cycle cover $\mathcal{C}_{1}$. At the end of these $\mbox{\tt d}_{1}$ rounds, $v$ should receive $\mbox{\tt d}_{1}+1$ messages. Observe that the adversary cannot modify all the messages received by $v$: if he modifies the single message sent on the path $C_{e}\setminus\{e\}$, then he cannot modify one of the messages sent directly on the edge $(u,v)$. If $v$ received from $u$ a collection of $\mbox{\tt d}_{1}+1$ identical messages $M^{\prime}$, then it is assured that this is the correct message and $M^{\prime}=M_{e}$. In the complementary case, the message $M_{e}$ is considered to be suspicious, and it will be handled in the second phase.

The key point is that while some messages cannot be recovered, almost all messages will be transmitted successfully. Since there are only $\mbox{\tt d}_{1}$ rounds, the adversary can corrupt at most $\mbox{\tt d}_{1}$ messages. Since each edge $e$ appears on at most $\mbox{\tt c}_{1}$ many cycles, in a given round it can receive $\mbox{\tt c}_{1}$ many messages, and since the bandwidth of the edge is $O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$, all these messages can be sent in a single round.

The second subphase of the first round is devoted for feedback: the receiving nodes $v$ notify their neighbors $u$ whether they successfully received their message in the first subphase. This is done in a similar manner to the first subphase. I.e., the feedback message from $v$ to $u$ is sent directly on the $e$ edge, in each of the $\mbox{\tt d}_{1}$ rounds. In addition, it is sent once along the edge-disjoint path $C_{e}\setminus\{e\}$. Only an endpoint $u$ that has received $\mbox{\tt d}_{1}+1$ positive acknowledgment messages from its neighbor $u$ can be assured that the $M_{e}$ message has been received successfully.

Overall, at the end of this phase, we are left with only $2\mbox{\tt d}_{1}$ suspicious messages to be handled. Importantly, the senders endpoints of these suspicious messages are aware of that fact (based on the above feedback procedure), and will become active in the second phase that is described next.

The second phase applies compiler (A) but only for a subset of $O(\mbox{\tt d}_{1})$ many messages. This allows us to use an improved bandwidth of $O(\mbox{\tt d}_{1})$. The number of rounds of the second phase is still bounded by $O(\mbox{\tt d}_{2})$.

Final Compiler (C), Bandwidth $O(\log n)$:

Throughout, we distinguish between two types for sending a message $M_{e}$: the direct type where $M_{e}$ is sent along the edge $e=(u,v)$, and the indirect type where $M_{e}$ is sent along a $u$-$v$ path (which is not $e$).

We will have two phases as in compiler (B). In the first phase, the messages $M_{e}$ are sent directly on the $e$ edges in every round of the phase. To route the indirect messages along the cycles of the $(\mbox{\tt d}_{1},\mbox{\tt c}_{1})$ cycle cover, we apply the random delay approach of [LMR94], which takes $O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$ rounds. Since the direct messages are sent in each of the rounds of the first phase, no matter how the other messages are sent, the adversary still cannot modify all the $M_{e}$ messages for a given pair $u,v$. As a result, at the end of the first phase (including the feedback procedure), we are left with $T=O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$ suspicious messages, that would be handled in the second phase.

Implementing the second phase with the random delay approach is too risky. The reason is that the correctness of the second phase is based on having the correct majority for each edge $M_{e}$. Thus, we have to make sure that each message $M_{e}$ is sent on the three edge disjoint paths in the exact same round. Obtaining this coordination is not so trivial. To see why it is crucial, consider a scenario where the scheduler sends the message $M_{e}$ along the path $P_{1}$ in round $j$, and along the path $P_{2}$ in round $j+1$, where $P_{1}$ and $P_{2}$ are the two edge disjoint paths between $u$ and $v$ (aside from $e$). In such a case, the adversary can in fact corrupt both of this messages, and our majority approach will fail.

To handle this, we use the fact that there are only $T$ suspicious messages to be sent and we handle them in the second phase one by one. To define the order in which these messages are handled, the sender endpoint of each suspicious message picks a random ID in $[1,T^{2}]$. Since $T=\Omega(\log n)$, each suspicious message gets a unique ID, with high probability. We will now have $T^{2}$ many subphases, each consists of $\ell=4\mbox{\tt d}_{2}$ many rounds. The $i^{th}$ subphase will take care of the suspicious message whose random ID is $i$. In each subphase, we implement compiler (A) with the imporved bandwidth of $O(\log n)$, as each subphase takes care of (at most) one message $M_{e}$.

To make sure that intermediate vertices along the edge disjoint paths will know where to route the message, we add the information on the source and destination $u,v$ to each of the sent messages $M_{e}$. We note that since the adversary might create fake messages by its own, it might be the case that vertices receive messages even if they are not the true recipient of the suspicious message that is handled in this particular subphase. Indeed, the endpoint $v$ does not know the random ID of the message $M_{e}$ (as this was chosen by its neighbor $u$) and thus it does not know when to expect the messages from $u$ to arrive. However, by the same majority argument, a vertex should receive a majority of messages in at most one subphase – and every vertex that receives a majority of messages (which are identical) can indeed deduce that this is the correct message.

Overall the round complexity of the first phase is $O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$ and of the second phase is $O((\mbox{\tt d}_{1}+\mbox{\tt c}_{1})^{2}\cdot\mbox{\tt d}_{2})$. This completes the proof of Theorem 5.

4.2 Eavesdropping

Model.

In this setting, we consider an adversary that on each round eavesdrops on one of the graph edges chosen in an arbitrary manner. Our goal is to prevent the adversary from learning anything, in the information-theoretic sense, on any of the messages sent throughout the protocol. We show how to use the low congestion cycle-cover to provide a compiler that can take any $r$-round distributed algorithm ${\cal A}$ in the ${\mathsf{CONGEST}}$ model and turn it into another algorithm ${\cal A}^{\prime}$ that is secure against an eavesdropper, while incurring an overhead of $\widetilde{O}(D)$ in the round complexity. We note that if we settle for computational assumptions then there is a simple solution. One can encrypt the message using a public-key encryption scheme and then send the encrypted message using the public-key of the destination node. Thus, the main goal is to achieve unconditional security.

Preprocessing.

The preprocessing phase computes a $(\mbox{\tt d}_{1},\mbox{\tt c}_{1})$-cycle cover. At the end of the phase, each node knows the cycles in participates in.

Our Compiler.

The compiler works round-by-round. Fix a round $i$ in algorithm ${\cal A}$, such a round is fully specified by the collection of messages sent on the edges at this round. Consider an edge $e=(u,v)$ and let $M=M_{e}$ be the message sent on $e$ in round this round. The secure algorithm simulates round $i$ within $\mbox{\tt d}_{1}$ rounds. At the end of these $\mbox{\tt d}_{1}$ rounds, $v$ will receive the message $M$ while the eavesdropper learns noting on $M$.

The sender $u$ secret shares the message $M$ to $\mbox{\tt d}_{1}+1$ random shares $M_{1},\ldots,M_{d+1}$ such that $M_{1}\oplus\dots\oplus M_{d+1}=M$ (see Definition 1). The first $\mbox{\tt d}_{1}$ shares of the message, namely $M_{1},\ldots,M_{\ell}$, will be sent on the direct $(u,v)$ edge, in each of the rounds of phase $i$, and the $(\mbox{\tt d}_{1}+1)^{th}$ share is sent via the $u$-$v$ path $C_{e}\setminus\{e\}$. At the end of these $\mbox{\tt d}_{1}$ rounds, $v$ receives $d+1$ messages.

We next claim that the adversary did not learn anything (in the information-theoretic sense) about the message $M$, for any edge $(u,v)$. To show this, it suffices to show that the adversary learns at most $\mbox{\tt d}_{1}$ shares out of the total $\mbox{\tt d}_{1}+1$ shares of the message $M$. First consider the case that there is a round $j$ (in phase $i$) where the adversary did not eavesdropping on the edge $(u,v)$. In such a case, it doesn’t know the $j^{th}$ share of $M$ and hence cannot know $M$. Otherwise, the adversary was eavesdropping the edge $(u,v)$ during the entire phase. This implies that it did not eavesdrop on none of the edges of $C_{e}\setminus\{e\}$ and hence did not learn the $(\mbox{\tt d}_{1}+1)^{th}$ share $M_{d+1}$.

The total number of rounds is $O(\mbox{\tt d}_{1})$ using a bandwidth of $\mbox{\tt c}_{1}$. Next, we show how to schedule the messages to get a bandwidth of $O(\log n)$.

Scheduling Messages.

The scheduling scheme here is similar to the scheduling of the pre-phase described before. We send a direct message on the each $(u,v)$ in all rounds. Then, the additional message send via the cycle is sent using the scheduling scheme of [LMR94]. The adversary still one always miss at least one share, and thus security holds. The total number of rounds as a result of this scheduling scheme is $O(\mbox{\tt d}_{1}+\mbox{\tt c}_{1})$. This completes the proof of Theorem 6.

5 Distributed Construction for Minor-Closed

Graphs

The following fact about the sparsity of minor-closed graphs is essential in our algorithm:

Fact 2**.**

[Mad67, Tho84]** Every (non-trivial) minor-closed family of graphs has bounded density. In particular, graphs with an $h$-vertex forbidden minor have at most $O(h\sqrt{\log h}\cdot n)$ edges.

Recall that $\mathsf{OPT}_{\mathsf{C}}(G)=\max_{e}|C_{e}|$ where $C_{e}$ is the shortest cycle containing $e$. We show:

Theorem 3 (Rephrased).

For every minor-closed graph $G$, one can construct in $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}(G))$ rounds, an $(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}(G)),\widetilde{O}(1))$ cycle cover ${\cal C}$ that covers every edge $e\in G$ that lies on some cycle in $G$. If the vertices do not know $\mathsf{OPT}_{\mathsf{C}}(G)$, then the round complexity is $\widetilde{O}(D)$ (which is optimal, see Figure 14).

Due to Lemma 6, it is sufficient to present an $\widetilde{O}(D)$-round algorithm that constructs an $(\widetilde{O}(D),\widetilde{O}(1))$ cycle cover ${\cal C}^{\prime}$ where $D$ is the diameter of $G$. Then by applying this algorithm in each cluster of a $\mathsf{OPT}_{\mathsf{C}}(G)$-neighborhood cover, we get the desired nearly optimal covers.

For a minor-closed graph $G$ in family $\mathcal{F}$, let $\phi(\mathcal{F})$ be the upper bound density of every $G^{\prime}\in\mathcal{F}$. That is, every $n$-vertex graph $G^{\prime}\in\mathcal{F}$ has $\phi(\mathcal{F})\cdot n$ edges, where $\phi(\mathcal{F})$ is a constant that depends only on the family $\mathcal{F}$ (and not $n$). In the description of the algorithm, we assume that $\phi(\mathcal{F})$ is known to all nodes.101010We observe that algorithm can be easily modified to work even without $\phi(\mathcal{F})$ being known. The algorithm starts by constructing a BFS tree $T\subseteq G$ in $O(D)$ rounds. Let $E^{\prime}$ be the subset of non-tree edges. The main procedure is $\mathsf{NonTreeMinorClosed}$ that constructs a cover $\mathcal{C}^{\prime}$ for all the non-tree edges $E^{\prime}$. We first describe how this cover can be constructed in $\widetilde{O}(D)$ rounds.

5.1 Covering Non-Tree Edges

The algorithm has $\ell=O(\log n)$ phases, in each phase $i$, it is given a subset $E^{\prime}_{i}$ of non-tree edges to be covered and constructs a cycle collection $\mathcal{C}_{i}$ that covers constant fraction of the edges in $E^{\prime}_{i}$. At the end, the collection $\mathcal{C}^{\prime}=\bigcup_{i}\mathcal{C}_{i}$ covers all non-tree edges.

We now focus on phase $i$ and explain how to construct $\mathcal{C}_{i}$. Similar to Alg. $\mathsf{NonTreeCover}$, our approach is based on partitioning the vertices into blocks – a set of nodes that have few incident edges in $E^{\prime}_{i}$ . Unlike Alg. $\mathsf{NonTreeCover}$, here each block is a subtree of $T$ and every two blocks are vertex-disjoint. This plays an essential role as it allows us to contract each block into a super-node and get a contracted graph $G^{\prime}_{i}$ that is still minor-closed and hence must be sparse. The fact that the contracted graph is sparse would imply that most the of non-tree edges connect many vertices between the same block or between two blocks. This allows us to cover these edges efficiently. We now describe phase $i$ of Alg. $\mathsf{NonTreeMinorClosed}$ in details.

Step (S1): Tree Decomposition into Vertex Disjoint Subtree Blocks.

A block $B$ is a subset of vertices such that $T(B)$ is a connected subtree of $T$. For a subset of edges $E^{\prime}$, the density of the block, $\deg(B,E^{\prime})$, is the number of edges in $E^{\prime}$ that have an endpoint in the set $B$. Define

[TABLE]

The algorithm works from the bottom of the tree up the root, in $O(0pt(T))$ rounds. Let $W\colon V\to V$ be a weight function where $w(v)=\deg(v,E^{\prime}_{i})$. In round $i\geq 1$, each vertex $v$ in layer $0pt(T)-i+1$ sends to its parent the residual weight of its subtree, namely, the total weight of all the vertices in its subtree $T(v)$, that are not yet assigned to blocks. Every vertex $v$ that receives the residual weight from its children does the following: Let $W^{\prime}(v)$ be the sum of the total residual weight plus its own weight. If $W^{\prime}(v)\geq\mbox{\tt b}$, then $v$ declares a block and down-cast the its ID (i.e., that serves as the block-ID), to all relevant descendants in its subtree. Otherwise, it passes $W^{\prime}(v)$ to its parent. Let $\mathcal{B}_{i}$ the output block decomposition.

Step (S2): Covering Half of the Edges.

For ease of description, we orient every non-tree edge $e=(u,v)\in E^{\prime}_{i}$ from its higher-ID endpoint to the lower-ID endpoint. Every vertex will be responsible for its outgoing edges in $E^{\prime}_{i}$. At that point, every vertex $v$ knows its block-ID.

Non-tree edges inside the same block:

All nodes exchange their block-ID with their neighbors. Nodes that are incident to non-tree edges $e$ with both endpoints at the same block, mark the fundamental cycle of these edges. That is, the cycle that covers each such edge $e$ is given by $C(e)=\pi(u,v,T)\circ e$. All these cycles are added to $\mathcal{C}_{i}$.

Non-tree edges between different blocks:

Each vertex $v$ in block $B$, sends to the root of its block, all its outgoing edges along with the block-IDs of each of its outgoing $E^{\prime}_{i}$-neighbors. In the analysis, we will show that despite the fact that the density of the block might be large, this step can be done in $O(0pt(T))$ rounds.

The root of each block $B$ receives all the outgoing edges of its block vertices and the block IDs of the other endpoints. It then partitions the edges into $|\mathcal{B}_{i}|$ subsets $E_{i}(B,B^{\prime})$ for every block $B^{\prime}\in\mathcal{B}_{i}\setminus\{B\}$. Fix a pair $B\neq B^{\prime}$ and assume that $E_{i}(B,B^{\prime})$ has even-size, otherwise, omit at most one edge to make it even. To cover the edges in $E_{i}(B,B^{\prime})$, the leader arbitrarily matches these edges into pairs $\langle e,e^{\prime}\rangle$ and notifies the matching of all the edges to the vertices in its block. For every matched pair $\langle e,e^{\prime}\rangle\in E_{i}(B,B^{\prime})$, we have $e=(u,v)$, $e^{\prime}=(u^{\prime},v^{\prime})$ such that $u,u^{\prime}\in B$ and $v,v^{\prime}\in B^{\prime}$. Letting $u$ be of higher ID than $u$, the vertex $u$ is responsible for that pair. First, $u$ sends a message to its endpoint $v\in B^{\prime}$ and notifies it regarding its pairing with the edge $(u^{\prime},v^{\prime})$. The other endpoint $v^{\prime}$ notifies it to the leader of its block $B^{\prime}$. The cycle $C(e,e^{\prime})$ covering these edges is defined by:

[TABLE]

The final cycle collection $\mathcal{C}_{i}$ contains the set of all $C(e,e^{\prime})$ cycles of each matched pair $\langle e,e^{\prime}\rangle\in E_{i}(B,B^{\prime})$ for every $B,B^{\prime}\in\mathcal{B}_{i}$. All the matched edges are removed from $E^{\prime}_{i}$. Note that to make the $E_{i}(B,B^{\prime})$ sets even, the algorithm omitted at most one edge from each such sets and all these edges are precisely those that remained to be handled in the next phase, namely, the edges $E^{\prime}_{i+1}$. This completes the description of phase $i$. See Figure 13 for an illustration.

We proceed by analyzing Alg. $\mathsf{NonTreeMinorClosed}$.

Round Complexity and Message Complexity.

Note that unlike the cycle cover algorithm of [PY17], the blocks of Alg. $\mathsf{NonTreeMinorClosed}$ might have arbitrary large density. The key claim for bounding the rounding complexity and the congestion of the cycles is the following:

Claim 9**.**

Let $e=(x,y)$ be a tree edge (where $x$ is closer to the root) and let $B$ be the block of $x$ and $y$. Letting $B_{y}=B\cap T(y)$, it holds that $\deg(B_{y},E^{\prime}_{i})\leq\mbox{\tt b}$.

Proof.

By the construction of the blocks, $\deg(B_{y},E^{\prime}_{i})\leq\mbox{\tt b}$ as otherwise $y$ would declare $B_{y}$ as a block, in contradiction that $x$ and $y$ are in the same block. ∎

Claim 10**.**

Algorithm $\mathsf{NonTreeMinorClosed}$ has round complexity of $O(0pt(T))$.

Proof.

The decomposition clearly takes $O(0pt(T))$ rounds so we consider the second phase. The algorithm starts by letting each vertex $v$ send to its root the information all on the edges $\deg(v,E^{\prime}_{i})$. We now show that this can be done in $O(0pt(T))$ rounds by observing that despite the fact that the total density of a block might be large, the total number of messages that passes through a given tree edge is small. Consider an edge $e=(x,y)\in T$ in block $B$, we will prove that the total number of messages that go through that edge is bounded by $O(\mbox{\tt b})$. Since all the messages that go through the edge $e$ towards the root of $B$ originated from vertices in $B_{y}=V(T(y))\cap B$, the above claim follows by Claim 9.

All non-tree edges $e=(u,v)$ that have both endpoints in $B$ mark their fundamental cycle in $T$. By the definition of the block, this fundamental cycle is in the tree of $B$. The marking is done by sending the ID of the non-tree edge to all the edges on the fundamental cycle. This is done by letting one endpoint $u$ send the edge ID of $e=(u,v)$ to the root and back to $v$. By the same argument as above, each edge $e\in T$ receives $O(\mbox{\tt b})$ such messages and hence this can be done is $O(0pt(T))$ rounds.

Next, the root of each block $B$ partitions the $E^{\prime}_{i}$ edges of its block members into $|\mathcal{B}_{i}|$ subsets $E_{i}(B,B^{\prime})$ and each edge $e=(u,v)$ receives the ID of a matched edge $e^{\prime}=(u^{\prime},v^{\prime})$ such that both $e$ and $e^{\prime}$ connect vertices in the same pair of blocks. By applying the same argument only in the reverse direction, we again get that only $O(\mbox{\tt b})$ messages pass on each edge111111That is, an edge $e^{\prime\prime}=(x,y)\in T$ only sends information back to vertices in $B\cap V(T(y))$.. Finally, marking the edges on all cycles $C(e,e^{\prime})$ is done in $O(0pt(T))$ rounds as well, using same arguments. ∎

Since the construction of private trees employs Alg. $\mathsf{NonTreeMinorClosed}$ on many subgraphs of $G$ simultaneously, it is also important to bound the number of messages that go through a single edge $e\in G$ throughout the entire execution of Alg. $\mathsf{NonTreeMinorClosed}$. The next lemma essentially enables us to employ Alg. $\mathsf{NonTreeMinorClosed}$ on many subgraphs at once, at almost the round complexity as that of a single application, e.g., by using the random delay approach of [Gha15b].

Claim 11**.**

Alg. $\mathsf{NonTreeMinorClosed}$ passes $\widetilde{O}(1)$ messages on each edge $e\in G$.

Proof.

Alg. $\mathsf{NonTreeMinorClosed}$ consists of $O(\log n)$ phases. We show that in each phase $i$, a total of $O(\log n)$ messages pass on each edge $e$. The first step of the phase is to decompose the tree $T$ into blocks. By working from leafs towards the root, on each tree edge $(u,p(u))$, $u$ sends to $p(u)$ the residual weight in its subtree and $p(u)$ sends to $u$ a message containing its block ID. Hence, overall, on each tree edge, the algorithm passes $O(1)$ messages. Then, each vertex sends to its neighbors its block ID and non-tree edges within the same block are covered by taking their fundamental cycle (inside the block). Every vertex $v$ sends to its block leader the identities of all its edges in $E^{\prime}_{i}$ including the block-ID of the other endpoint. This information is passed on the subtree of each block. By the proof of Claim 10, one each edge, there are total of $O(\mbox{\tt b})$ messages (this bounds holds overall the $O(0pt(T))$ rounds of the algorithm). ∎

Cover Analysis.

The analysis of Algorithm $\mathsf{NonTreeMinorClosed}$ exploits two properties of minor-closed graphs: (i) being closed under edge contraction and (ii) being sparse (see Fact 2).

Let $E^{\prime}_{i+1}$ be set all the edges that are not covered in phase $i$. We will show that $|E^{\prime}_{i+1}|\leq|E^{\prime}_{i}|/2$. That is, we will show that at least half of the edges in $E^{\prime}_{i}$ are covered by the cycles of $\mathcal{C}_{i}$. Consider the subgraph $G^{\prime}_{i}=T\cup E^{\prime}_{i+1}$, clearly, $G^{\prime}_{i}\subseteq G$ is a minor-closed graph as well. We now compute a new graph $\widetilde{G}_{i}$ by contracting all the tree edges, $E(T)$, in $G^{\prime}_{i}$. Note that this contraction is only of the sake of the analysis, and it is not part of the algorithm. Since the blocks correspond to vertex-disjoint trees, the resulting contracted graph has $|\mathcal{B}_{i}|$ nodes and all its edges correspond to the non-tree edges $E^{\prime}_{i+1}$. We slightly abuse notation by denoting the super-node of block $B$ in $\widetilde{G}_{i}$ by $B$. By the explanation above, each edge in $\widetilde{G}_{i}$ is of multiplicity at most $2$. This is because for every pair $B,B^{\prime}$, at most one edge in $E_{i}(B,B^{\prime})$ is added to $E_{i+1}$ and also at most one edge of $E_{i}(B^{\prime},B)$ is added to $E_{i+1}$. Let $\widetilde{G}^{\prime}_{i}$ be the simple graph analogue of the contracted graph $\widetilde{G}_{i}$, i.e., removing multiplicities of edges. Since $\widetilde{G}_{i}$ is minor-close with $|\mathcal{B}_{i}|$ nodes, it has at most $\phi(\mathcal{F})\cdot|\mathcal{B}_{i}|$ edges. Since the weight of each block is at least b and blocks are vertex disjoint, we have that $|\mathcal{B}_{i}|\leq 2E^{\prime}/\mbox{\tt b}$. We have:

[TABLE]

where the last inequality follows by Equation 1.

Length and Congestion Analysis.

Clearly, all cycles of the form $C(e,e^{\prime})$ or $C(e)$ have length $O(0pt(T))$. It is also easy to see, that by definition, each cycle is used to cover at most two non-tree edges. We now claim that each edge appears on $O(1)$ cycles of $\mathcal{C}_{i}$.

Since each non-tree edge appears on at most two cycles, it is sufficient to bound the congestion on the tree edges. Let $e^{\prime\prime}=(x,y)$ be a tree edge in $T$ (where $x$ is closer to the root) and let $\mathcal{C}(e^{\prime\prime})$ be the collection of all the cycles that go through $e^{\prime\prime}$. Let $B$ be the unique block to which $x,y$ belong. By construction, the edge $e^{\prime\prime}$ appears only on cycles $C(e)$ or $C(e,e^{\prime})$ where the edge $e$ is incident to a vertex in $B_{y}=T(y)\cap B$. By Claim 9, $\deg(B_{y},E^{\prime}_{i})\leq\mbox{\tt b}$, and hence $e^{\prime\prime}$ appears on $O(\mbox{\tt b})$ cycles are required.

5.2 Covering Tree Edges

The distributed covering of tree edges is given by Alg. $\mathsf{DistTreeCover}$. In the high level, this algorithm reduces the problem of covering tree edge to the problem of covering non-tree edges at the cost of $O(0pt(T))$ rounds. Hence, by applying the same reduction to the non-tree setting and using Alg. $\mathsf{NonTreeMinorClosed}$, we will get an $(\widetilde{O}(D),\widetilde{O}(1))$ cycle cover ${\cal C}^{\prime\prime}$ for the tree edges of $T$. Also here, each cycle $C\in{\cal C}^{\prime\prime}$ might be used to cover $O(D)$ tree edges.

Description of Algorithm $\mathsf{DistTreeCover}$

Algorithm $\mathsf{DistTreeCover}$ essentially mimics the centralized construction of Section 3. Let $p(v)$ be the parent of $v$ in the BFS tree $T$. A non-tree edge $e^{\prime}=(u^{\prime},v^{\prime})$ is a swap edge for the tree edge $e=(p(v),v)$ if $e\in\pi(u^{\prime},v^{\prime})$, let $s(v)=v^{\prime}$ by the endpoint of $e^{\prime}$ that is not in $T(v)$. By using the algorithm of Section 4.1 in [GP16], we can make every node $v$ know $s(v)$ in $O(D)$ rounds.

A key part in the algorithm of Section 3.2 is the definition of the path $P_{e}=\pi(v,u^{\prime})\circ(u^{\prime},s(v))$ for every tree edge $e=(p(v),v)$. By computing swap edges using Section 4.1 in [GP16] all the edges of each $P_{e}$ get marked.

Computing the set $I(T)\subseteq E(T)$.

We next describe how to compute a maximal collection of tree edges $I=\{e_{i}\}$ whose paths $P_{e_{i}}$ are edge disjoint and in addition for each edge $e_{j}\in E(T)\setminus I$ there exists an edge $e_{i}\in T^{\prime}$ such that $e_{j}\in P_{e_{i}}$. To achieve this, we start working on the root towards the leaf. In every round $i\in\{1,\ldots,D\}$, we consider only active edges in layer $i$ in $T$. Initially, all edges are active. An edge becomes inactive in a given round if it receives an inactivation message in any previous round. Each active edge in layer $i$, say $e_{j}$, initiates an inactivation message on its path $P_{e_{j}}$. An inactivation message of an edge $e_{j}$ propagates on the path $P_{e_{j}}$ round by round, making all the corresponding edges on it to become inactive.

Note that the paths $P_{e_{j}}$ and $P_{e_{j^{\prime}}}$ for two edges $e_{j}$ and $e_{j^{\prime}}$ in the same layer of the BFS tree, are edge disjoint and hence inactivation messages from different edges on the same layer do not interfere each other. We get that an edge in layer $i$ active in round $i$ only if it did not receive any prior inactivation message from any of its BFS ancestors. In addition, any edge that receives an inactivation message necessarily appears on a path of an active edge. It is easy to see that within $D$ rounds, all active edges $I$ on $T$ satisfy the desired properties (i.e., their $P_{e_{i}}$ paths cover the remaining $T$ edges and these paths are edge disjoint).

Distributed Implementation of Algorithm $\mathsf{TreeCover}$.

First, we mark all the edges on the $P_{e}$ paths for every $e\in I(T)$. As every node $v$ with $e=(p(v),v)$ know its swap edge, it can send information along $P_{e}$ and mark the edges on the path. Since each edge appears on the most two $P_{e}$ paths, this can be done simultaneously for all $e\in I(T)$.

From this point on we follow the steps of Algorithm $\mathsf{TreeCover}$. The partitioning of Appendix A can be done in $O(D)$ rounds as it only required nodes to count the number of nodes in their subtree. We define the ID of each tree $T^{\prime}_{1},T^{\prime}_{2}$ to be the maximum edge ID in the tree (as the trees are edge disjoint, this is indeed an identifier for the tree). By passing information on the $P_{e}$ paths, each node $v$ can learn the tree ID of its swap endpoint $s(v)$. This allows to partition the edges of $T^{\prime}$ into $E^{\prime}_{x,y}$ for $x,y\in\{1,2\}$. Consider now the $i^{th}$ phase in the computation of cycle cover ${\cal C}_{1,2}$ for the edges $E^{\prime}_{1,2}$.

Applying Algorithm $\mathsf{TreeEdgeDisjointPath}$ can be done in $O(D)$ round. At the end, each node $v_{j}$ knows its matched pair $v^{\prime}_{j}$ and the edges on the tree path $\pi(v_{j},v^{\prime}_{j},T^{\prime}_{1})$ are marked. Let $\Sigma$ be the matched pairs. We now the virtual conflict graph $G_{\Sigma}$. Each pair $\langle v_{j},v^{\prime}_{j}\rangle\in\Sigma$ is simulated by the node of higher ID, say, $v_{j}$. We say that $v_{j}$ is the leader of the pair $\langle v_{j},v^{\prime}_{j}\rangle\in\Sigma$. Next, each node $v$ that got matched with $v^{\prime}$ activates the edges on its path $P_{e}\cap E(T^{\prime}_{1})$ for $e=(p(v),v)$. Since the $\pi$ edges of the matched pairs are marked as well, every edge $e^{\prime}\in\pi(v_{k},v^{\prime}_{k},T^{\prime}_{1})$ that belongs to an active path $P_{e}$ sends the ID of the edge $e$ to the leader of the pair $\langle v_{k},v^{\prime}_{k}\rangle$. By Claim 6, every pair $\sigma^{\prime}$ interferes with at most one other pair and hence there is no congestion and a single message is sent along the edge-disjoint paths $\pi(v_{j},v^{\prime}_{j},T^{\prime}_{1})$ for every $\langle v_{j},v^{\prime}_{j}\rangle\in\Sigma$. Overall, we get the the construction of the virtual graph can be done in $O(D)$ rounds.

We next claim that all leaders of two neighboring pairs $\sigma,\sigma^{\prime}\in G_{\Sigma}$ can exchange $O(\log n)$ bits of information using $O(D)$ rounds. Hence, any $r$-round algorithm for the graph $G_{\Sigma}$ can be simulated in $T^{\prime}_{1}$ in $O(r\cdot D)$ rounds. To see this, consider two neighbors $\sigma=\langle x,y\rangle,\sigma^{\prime}=\langle x^{\prime},y^{\prime}\rangle$ where $\sigma^{\prime}$ interferes $\sigma$. Without loss of generality, assume that the leader $x^{\prime}$ of $\sigma^{\prime}$ wants to send a message to the leader $x$ of $\sigma$. First, $x^{\prime}$ sends the message on the path $\pi(x^{\prime},y^{\prime},T^{\prime}_{1})$. The edge $e^{\prime}\in\pi(x^{\prime},y^{\prime},T^{\prime}_{1})\cap P_{e}$ for $e=(p(x),x)$ that receives this message sends it to the leader $x$ along the path $P_{e}$. Since we only send messages along edge disjoint paths, there is no congestion and can be done in $O(D)$ rounds.

Since the graph $G_{\Sigma}$ has arboricity $O(1)$, it can be colored with $O(1)$ colors and $O(\log n)$ rounds using the algorithm of [BE10]. By the above, simulating this algorithm in $G$ takes $O(D\log n)$ rounds. We then consider each color class at a time where at step $j$ we consider $\Sigma_{i,j}$. For every $\sigma=\langle x,y\rangle$, $x$ sends the ID of $s(y)$ to $s(x)$ along the $P_{e}$ path for $e=(p(x),x)$. In the same manner, $y$ sends the ID of $s(x)$ to $s(y)$. This allows each node in $T^{\prime}_{2}$ know its virtual edge. At that point we run Algorithm $\mathsf{NonTreeMinorClosed}$ to cover the virtual edges. Each virtual edge is later replaced with a true path in $G$ in a straightforward manner.

Analysis of Algorithm $\mathsf{DistTreeCover}$.

Claim 12**.**

Algorithm $\mathsf{DistTreeCover}$ computes a $(\widetilde{O}(D),\widetilde{O}(1))$ cycle cover ${\cal C}_{2}$ for the tree edges $E(T)$ and has round complexity of $\widetilde{O}(D)$.

Proof.

The correctness follows the same line of arguments as in the centralized construction (see the Analysis of Section 3.2), only the here we use Algorithm $\mathsf{NonTreeMinorClosed}$. Each cycle computed by Algorithm $\mathsf{NonTreeMinorClosed}$ has length $\widetilde{O}(D)$ and the cycle covers $\widetilde{O}(1)$ non-tree edges. In our case, each non-tree edge is virtual and replaced by a path of length $O(D)$ hence the final cycle has still length $\widetilde{O}(D)$. With respect to congestion, we have $O(\log n)$ levels of recursion, and in each level when working on the subtree $T^{\prime}$ we have $O(\log n)$ applications of Algorithm $\mathsf{NonTreeMinorClosed}$ which computes cycles with congestion $\widetilde{O}(1)$. The total congestion is then bounded by $\widetilde{O}(1)$.

We proceed with round complexity. The algorithm has $O(\log n)$ levels of recursion. In each level we work on edge disjoint trees simultaneously. Consider a tree $T^{\prime}$. The partitioning into $T^{\prime}_{1},T^{\prime}_{2}$ takes $O(D)$ rounds. We now have $O(\log n)$ phases. We show that each phase takes $\widetilde{O}(D)$ rounds, which is the round complexity of Algorithm $\mathsf{NonTreeMinorClosed}$. In particular, In phase $i$ we have the following procedures. Applying Algorithm $\mathsf{TreeEdgeDisjointPath}$ in $T^{\prime}_{1},T^{\prime}_{2}$ takes $O(D)$ rounds. The computation of the conflict graph $G_{\Sigma}$ takes $O(D)$ rounds as well and coloring it using the coloring algorithm for low-arboricity graphs of [BE10] takes $O(D\log n)$ rounds. Then we apply Algorithm $\mathsf{NonTreeMinorClosed}$ which takes $\widetilde{O}(D)$ rounds. Translating the cycles into cycles in $G$ takes $\widetilde{O}(D)$ rounds. ∎

Summing over all the $O(\log n)$ phases, each (tree) edge appears on $O(\log n\mbox{\tt b})=O(\log n)$ cycles of the final cycle collection $\mathcal{C}^{\prime}=\bigcup_{u}\mathcal{C}_{i}$. We therefore have:

Lemma 4**.**

For every bridgeless minor-closed graph $G$, a tree $T\subseteq G$ of diameter $D$, there exists: (i) a $O(0pt(T))$ round algorithm that constructs an $(O(0pt(T)),O(\log n))$ cycle collection ${\cal C}$ that covers all non-tree edges. Each cycle in ${\cal C}$ is used to cover at most two non-tree edges in $E(G)\setminus E(T)$. In addition, the algorithm passes $\widetilde{O}(1)$ messages on each edge $e$ over the entire execution; (ii) an $\widetilde{O}(D)$ round algorithm that constructs an $(\widetilde{O}(D),\widetilde{O}(1))$ cycle collection ${\cal C}$ that covers all edges in $G$.

Appendix A Balanced Partitioning of a Tree

We show that every rooted tree $T$ can be partitioned into two edge-disjoint rooted trees $T_{1}$ and $T_{2}$ such that (I) $E(T_{1})\cup E(T_{2})=E(T)$ and (II) $V(T_{1}),V(T_{2})\leq 2/3\cdot N$ where $N=|T|$. In addition, this partitioning maintains the layering structure of $T$ as will be described later. To compute this partitioning, define the weight $w(v)$ of each vertex $v$ in $T$ to be the number of vertices in its subtree $T(v)$. First, consider the case, where there is a vertex $v^{*}$ with weight $w(v^{*})\in[1/3N,2/3N]$. In such a case, define $T_{1}=T_{v^{*}}$ and $T_{2}=T\setminus E(T(v^{*}))$. By definition, both $T_{1}$ and $T_{2}$ are trees, all edges of $T$ are covered and $|T_{1}|,|T_{2}|\in[1/3N,2/3N]$.

Else, if no such balanced vertex exists, there must be a vertex $v^{*}$ such that $w(v^{*})\geq 2/3N$ but for each of its children in $T$, $u_{i}$, it holds that $w(u_{i})\leq 1/3N$. In such a case, we consider the children of $v^{*}$ from left to right $u_{1},\ldots,u_{k}$ and sum up their weights until we get to a value in the range $[1/3N,2/3N]$. Formally, let $\ell\in\{1,\ldots,k\}$ be the minimal index satisfying that $\sum_{i=1}^{\ell}w(u_{i})\in[1/3N,2/3N]$. Since each $w(u_{i})\leq 1/3N$, such an index $\ell$ exists. We then set $T_{1}=\bigcup_{i=1}^{\ell}\left(T(u_{i})\cup\{(u_{i},v^{*})\}\right)$ and $T_{2}=T\setminus\bigcup_{i=1}^{\ell}V(T(u_{i}))$. By construction, all edges of $T$ are covered by $T_{1}$ and $T_{2}$. In addition, by definition, $|T_{1}|\in[1/3N,2/3N]$ and hence also $T_{2}\in[1/3N,2/3N]$.

Finally, we pick the roots $r_{1},r_{2}$ of $T_{1},T_{2}$ (respectively) to be the vertices the are close-most to the root $r$ in $T$. We then get for $u,v\in T_{1}$, that if $u$ is closer to the root than $v$ in $T$, then also $u$ is closer to the root $r_{1}$ than $v$ in $T_{1}$.

Appendix B Distributed Constructions for General Graphs

B.1 Low Congestion Covers

In this section, we show how the covers of Theorems 1 and 2 with existentially optimal bounds can be constructed using $\widetilde{O}(n)$ rounds in the distributed setting.

Lemma 5**.**

For every bridgeless $n$-vertex graph a $(D\log n,\log^{3}n)$ cycle cover can be computed distributively in $\widetilde{O}(n)$ rounds of pre-processing.

Proof.

Compute a BFS tree $T$ and consider the set of non-tree edges $E^{\prime}$. Let $E_{0}=E^{\prime}$. As long that number of edges $E_{i}$ to be covered in $E^{\prime}$ is at least $O(\log^{c}n\cdot n)$, we do as follows in phase $i$. Let $\Delta_{i}=|E_{i}|/n$. We partition the edges of $E_{i}$ into $\ell_{i}=\Delta_{i}/(c\cdot\log n)$ edge-disjoint subgraphs by letting each edge in $E_{i}$ pick a number in $[1,\ell_{i}]$ uniformly at random. We have that w.h.p. each subgraph $E_{i,j}$ contains $\Theta(n\log n)$ edges of $E_{i}$.

At the point, we work on each subgraph $E_{i,j}$ independently. We compute a BFS tree $T_{i,j}$ in each $E_{i,j}$ (using only communication on $E_{i,j}$ edges). We then collect all edges of $E_{i,j}$ to the root by pipelining these edges on $T_{i,j}$. At that point, each root of $T_{i,j}$ can partition all but $2n$ edges of $E_{i,j}$ into edge disjoint cycles of length $O(\log n)$. The root also pass these cycle information to the relevant edges using the communication on $T_{i,j}$. Note that since the $E_{i,j}$ subgraphs are disjoint, this can be done simultaneously for all subgraphs $E_{i,j}$. At the end of that phase, we are left with $2n\cdot\ell_{i}=O(|E_{i}|/\log n)$ uncovered edges $E_{i+1}$ to be handled in the next phase. Overall, after $O(\log n/\log\log n)$ phases, we are left with $O(n\log n)$ uncovered edges. At the point, we can pipeline these edges to the root of the BFS tree, along with the $n-1$ edges of the BFS tree and let the root compute it locally as explained in Section 3. The lemma follows. ∎

Preprocessing algorithm for universally optimal covers.

Lemma 6**.**

Every distributed nice algorithm ${\cal A}$ that given a bridgeless graph $G$ with diameter $D$, constructs an $(f_{{\cal A}}(D),\mbox{\tt c})$ cycle cover ${\cal C}$ within $r_{{\mathcal{A}}}(D)$ rounds can be transformed into an algorithm ${\mathcal{A}}^{\prime}$ that constructs an $(f_{{\cal A}}(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}(G))),\widetilde{O}(\mbox{\tt c}))$ cover ${\cal C}^{\prime}$ for $G$, within $r_{{\mathcal{A}}}(\mathsf{OPT}_{\mathsf{C}}(G))$ rounds.

Proof.

Algorithm ${\cal A}^{\prime}$ first employs Lemma 8 to construct an $t$-neighborhood cover ${\cal N}$ with for $t=\mathsf{OPT}_{\mathsf{C}}$ within $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$ rounds. Then, it applies Alg. ${\cal A}$ on each subgraph $G[S_{i}]$ resulting in a cycle collection ${\cal C}_{i}$. Since each vertex belongs to $\widetilde{O}(1)$ clusters, Algorithm ${\cal A}$ can be applied on all graphs $G[S_{i}]$ simultaneously using $\widetilde{O}(r_{{\mathcal{A}}}(\mathsf{OPT}_{\mathsf{C}}))$ rounds, in total. The final cycle cover is ${\cal C}=\bigcup_{i}{\cal C}_{i}$. Since the diameter of each subgraph $G[S_{i}]$ is $\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})$, ${\cal C}_{i}$ is an $(f_{{\cal A}}(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})),\mbox{\tt c})$ cycle cover for the edges of $G[S_{i}]$ (i.e., covering the edges that lie on some cycle on $G[S_{i}]$). We have that ${\cal C}$ is an $(f_{{\cal A}}(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}})),\widetilde{O}(\mbox{\tt c}))$ cycle cover for $G$.

To see that each edge $e$ is indeed covered, note that each edge $e$ lies on some cycle $C_{e}$ in $G$ of length at most $\mathsf{OPT}_{\mathsf{C}}$. By the properties of the neighborhood cover, w.h.p., there is a cluster $S_{i}\in{\cal N}$ that contains all the vertices of $C_{e}$ and hence $e$ is an edge that lies on a cycle in the subgraph $G[S_{i}]$. Since the algorithm ${\cal A}$ is nice, the edge $e$ is covered in the cycles of ${\cal C}_{i}$.

∎

By combining Lemma 7 with Lemma 6, we have:

Lemma 7**.**

For every bridgeless $n$-vertex graph a $(\widetilde{O}(\mathsf{OPT}_{\mathsf{C}}(G)),\widetilde{O}(1))$ cycle cover can be computed distributively in $\widetilde{O}(n)$ rounds of preprocessing.

B.2 Neighborhood Covers

In this section we describe how to construct neighborhood cover in the ${\mathsf{CONGEST}}$ model. As far as we know, previous explicit constructions for neighborhood cover (such as [ABCP96]) are in the ${\mathsf{LOCAL}}$ model and use large messages. For the definition of $(k,t,q)$ neighborhood cover, see Definition 3. For ease of presentation, we construct a slightly weaker notion where the diameter of each cluster is $O(k\cdot t\cdot\log n)$ rather than $O(k\cdot t)$ as in Definition 3 (this weaker notion suffices for our construction). This construction is implicit in the recent spanner construction of [EN17].

Lemma 8**.**

For every integer $t$, and every $n$-vertex graph $G=(V,E)$, one can construct in $O(k\cdot t\cdot\log n)$ rounds, an $(k,t,q)$ neighborhood cover with $k=2\log n$, $q=O(\log n)$ and the strong diameter of each cluster is $O(t\cdot k\cdot\log n)$, w.h.p. In addition, there are $\widetilde{O}(1)$ messages that go through each edge $e\in G$ over the entire execution of the algorithm.

We first describe how using the spanner construction of [EN17], we get a neighborhood cover that succeeds with constant probability. That is, we show that using the algorithm of [EN17] for constructing a $(k\cdot t)$-spanner, one can get in $O(kt\log n)$ rounds, a collection of subsets $\mathcal{S}=\{S_{1},\ldots,S_{n}\}$ such that (I) the diameter of each $G[S_{i}]$ is $O(k\cdot t\cdot\log n)$, (II) w.h.p., each vertex belongs to $O(k\cdot n^{1/k})$ sets and (III) for each vertex $v$, there is a constant probability that there exists $S_{i}$ that contains its entire $t$-neighborhood. Repeating this procedure for $O(\log n)$ many times yields the final cover.

We now describe the phase $i=\{1,\ldots,\Theta(\log n)\}$ where we construct a collection of $n$ sets $S_{i,u_{1}},\ldots,S_{i,u_{n}}$ that satisfy (I-III). Each vertex $u\in V$ samples a radius $r_{u}$ from the exponential distribution121212Recall the exponential distribution with parameter $\beta$ where $f(x)=\beta\cdot e^{-\beta\cdot x}$ for $x\geq 0$ and [math] otherwise. with parameter $\beta=\ln(c\cdot n)/(3k\cdot t)$. Each vertex $u$ starts to broadcast131313Having $u$ start at round $-r_{u}$ is not part of [EN17]. We introduced this modification to guarantee that the total of messages that are sent on each edge is at most $\widetilde{O}(1)$. its messages in round $-\lceil r_{u}\rceil$. For a vertex $w$ that received (at least one) message in round $i$ for the first time, let $m_{u_{j}}(w)=r_{u_{j}}-\mbox{\rm dist}(w,u_{j},G)$ for every message originated from $u_{j}$ and received at $w$ in round $i$. Let $m(w)=\max_{u_{j}}m_{u_{j}}(w)$ and $u^{*}\in\Gamma(w)$ be such that $m(w)=m_{u^{*}}(w)$. Then, $w$ does the following: (i) store $m(w)$ and the neighbor $p_{u^{*}}(w)$ and (ii) sends the message $\langle w,m(w)-1\rangle$ to all its neighbors $z\in\Gamma(w)\setminus\{p_{u_{j}}(w)\}$ in round $i+1$.

For every vertex $u$, let $S_{i,u}=\{w~{}\mid~{}m_{u}(w)\geq m(w)-1\}$. The final neighborhood cover is given by $\mathcal{S}=\bigcup_{i}\bigcup_{u}S_{i,u}$.

We show that the output collection of sets are indeed neighborhood cover. Fix a phase $i$, we claim the following about the output sets $S_{i,u_{1}},\ldots,S_{i,u_{n}}$.

Claim 13**.**

(I) Each $S_{i,u}$ is connected with diameter $O(k\cdot t\log n)$ with high probability.

(II) For every $i$, every vertex $w$ appears in $O(\log n\cdot(cn)^{1/(kt)})$ sets $S_{i,u}$ with high probability.

(III) For every vertex $w$, there exists $S_{i,u}$ such that $\Gamma_{t}(w)\subseteq S_{i,u}$, with constant probability.

Proof.

For ease of notation let $S_{i,u}=S_{u}$. For every $u$ and $w$, let $p_{u}(w)$ be the neighbor of $w$ that lies on the shortest path from $w$ to $u$, from which $w$ received the message about $u$ (breaking ties based on IDs).

To show that each set $S_{u}$ is connected, it is sufficient to show that if $w\in S_{u}$ then also $p_{u}(w)\in S_{u}$. The proof is as Claim 5 in [EN17]. In particular, since $w$ and $w^{\prime}=p_{u}(w)$ are neighbors, it holds that $m(w)\geq m(w^{\prime})-1$ and hence $w^{\prime}\in S_{u}$. In addition, by Claim 3 in [EN17] (and plugging our value of $\beta$) it holds that for every $u$ w.h.p. $r_{u}\leq O(k\cdot t\log n)$.

We proceed with Claim (II). For each $w$ and $u$, let $X_{w,u}\in\{0,1\}$ be the random variable indicating that $w\in S_{u}$. Let $Q_{w}=\sum_{u}X_{w,u}$ be the random variable of the number of sets to which $w$ belongs. In Lemma 2 of [EN17] they show that for any $1\leq z\leq n$ it holds that

[TABLE]

Plugging in $z=c^{\prime}\log n\cdot(cn)^{1/(kt)}+1=c^{\prime}\log n\cdot e^{\beta}+1$ we get

[TABLE]

Taking a union on all nodes $w$ in the graph claim (II) follows.

Finally, consider claim (III), and consider the more strict event in which the entire $t$-neighborhood of $w$ belongs to $S_{u^{*}}$ where $u^{*}$ is the vertex that attains $m(w)=m_{u^{*}}(w)$ (breaking ties based on IDs). Let $Y_{w}$ be an indicator variable for this event. We show that $Y_{w}=0$ with probability of at most constant. Consider $u^{*}$ as above, we bound the probability that there is a vertex $y\in\Gamma_{t}(w)$ that does not belong to $S_{u^{*}}$. We therefore have:

[TABLE]

and in the same manner, $m(w)\geq m(y)-t-1$. Therefore, $m(w)\in[m(y)-t-1,m(y)+t+1]$. That is, given that $m(w)\geq m(y)-t-1$ the probability that also $m(w)\leq m(y)+t+1$ is at most $1-e^{-3\beta\cdot t}=1-\ln(cn)/k\leq c^{\prime}$ for $k=2\log n$. The claim follows. ∎

We are now ready to complete the proof of Lemma 8.

Proof.

It is easy to see that each phase can be implemented in $O(k\cdot t\log n)$ rounds. In the distributed implementation of [EN17] (Sec. 2.1.1), the algorithm might pass $\widetilde{O}(t)$ messages on a given edge. For our purposes (e.g., distributed construction of private tree) it is important that on each edge the algorithm sends a total of $\widetilde{O}(1)$ messages. By letting each node $u$ start at round $-r(u)$, we make sure that the message from the node $w$ that maximizes $r_{w}-\mbox{\rm dist}(w,u,G)$ arrives first to $u$ and hence there is no need to send any other messages from other centers on that edge.

By Claim 13, w.h.p., all subsets have small diameter and bounded overlap. In addition, for every vertex $w$, with constant probability, the entire $t$-neighborhood of $w$ is covered by some of the $S_{i,u}$ sets. Since we repeat this process for $O(\log n)$ times, w.h.p., there exists a set that covers $\Gamma_{t}(w)$. By applying the union bounded overall sets, we get that w.h.p. all vertices are covered, the Lemma follows. ∎