Secure Network Coding in the Setting in Which a Non-Source Node May Generate Random Keys

TL;DR

This paper studies secure network coding where only one non-source node can generate random keys, characterizing the secure communication rate in this intermediate model with an eavesdropper accessing multiple links.

Contribution

It introduces and analyzes a new model of secure network coding where a non-source node generates keys, extending understanding beyond traditional source-only key generation scenarios.

Findings

Secure rate characterized for the intermediate model.

Analysis extends to scenarios with non-source key generation.

Highlights complexity of secure multicast with multiple key-generating nodes.

Abstract

It is common in the study of secure multicast network coding in the presence of an eavesdropper that has access to $z$ network links, to assume that the source node is the only node that generates random keys. In this setting, the secure multicast rate is well understood. Computing the secure multicast rate, or even the secure unicast rate, in the more general setting in which all network nodes may generate (independent) random keys is known to be as difficult as computing the (non-secure) capacity of multiple-unicast network coding instances --- a well known open problem. This work treats an intermediate model of secure unicast in which only one node can generate random keys, however that node need not be the source node. The secure communication rate for this setting is characterized again with an eavesdropper that has access to $z$ network links.

Equations

$$X_e={\bar{f}}_e(X_{\mathrm{In}(u)})=\sum _{e^{\prime }\in \mathrm{In}(u)}{\bar{c}}_{e^{\prime },e}{X}_{e^{\prime }}.$$

$$g_T(X_{\mathrm{In}(T)})$$

$$\mathrm{I}(M;X_{\mathcal{W}})$$

$$C_{K-S}$$

$$C_{K-T}$$

$$C_{S-T}$$

$$C_{KS-T}$$

$$z\le \min (C_{K-S},C_{K-T})$$

$$R\le C_{S-T}$$

$$R+z\le C_{KS-T}$$

$$X_{\mathcal{W}}=\left[\begin{array}{cc}{\mathbf{A}}_{\mathcal{W}}& {\mathbf{B}}_{\mathcal{W}}\end{array}\right]\left[\begin{array}{c}M\\ N\end{array}\right]$$

$$\mathrm{rk}(\left[\begin{array}{cc}{\mathbf{A}}_{\mathcal{W}}& {\mathbf{B}}_{\mathcal{W}}\end{array}\right])=\mathrm{rk}({\mathbf{B}}_{\mathcal{W}})$$

$$\Big{(}1-\dfrac{2(|\mathcal{E}|+R+z)^{2}+\binom{|\mathcal{E}|}{z}2z}{q}\Big{)},$$

$$\mathrm{I}(M;X_{\mathcal{W}})$$

$$X_e$$

$$X_{\mathrm{Out}(S)}$$

$$=\left[\begin{array}{cc}{\mathbf{A}}_{\mathbf{S}}& {\mathbf{B}}_S{\mathbf{V}}_{In(S)}{\mathbf{B}}_K\end{array}\right]\left[\begin{array}{c}M\\ N\end{array}\right].$$

$$|{\mathrm{mincut}}_{{\mathcal{G}}^{\ast }}(K,T)|=C_{K-T}\ge z$$

$$|{\mathrm{mincut}}_{{\mathcal{G}}^{\ast }}(K,T^{\ast })|=\min (R+z,C_{K-S})\ge z$$

$$|{\mathrm{mincut}}_{{\mathcal{G}}^{\ast }}(S,T^{\ast })|=R+z\ge R$$

$$|{\mathrm{mincut}}_{{\mathcal{G}}^{\ast }}(S,T)|=C_{S-T}\ge R$$

$$|{\mathrm{mincut}}_{{\mathcal{G}}^{\ast }}(\{K,S\},T^{\ast })|=R+z$$

$$|{\mathrm{mincut}}_{{\mathcal{G}}^{\ast }}(\{K,S\},T)|=C_{KS-T}\ge R+z$$

$$\displaystyle\Big{(}1-\dfrac{2}{q}\Big{)}^{L}$$

$$1-\frac{2(|\mathcal{E}|+R+z{)}^2}{q}$$

$$X_e$$

$$X_{\mathcal{W}}$$

$${\mathbf{A}}_{\mathcal{W}}$$

$$\mathbf{\Phi }$$

$$\underset{{\mathbf{B}}_K,{\mathbf{B}}_S}{\mathrm{Pr}}\{\mathrm{rk}({\mathbf{B}}_{\mathcal{W}})=z\}=$$

$$\underset{{\mathbf{B}}_S}{\mathrm{Pr}}\{\mathrm{rk}(\mathbf{\Phi })=z\}\underset{{\mathbf{B}}_K}{\mathrm{Pr}}\{\mathrm{rk}(\mathbf{\Phi }{\mathbf{B}}_K)=z|\mathrm{rk}(\mathbf{\Phi })=z\}.$$

$$\underset{{\mathbf{B}}_K,{\mathbf{B}}_S}{\mathrm{Pr}}\{{\mathbb{E}}_{\mathcal{W}}\}$$

$$\mathrm{Pr}\{\bigcup _{\mathcal{W}\subset \mathcal{E}}{\bar{\mathbb{E}}}_{\mathcal{W}}\}$$

$$X_e^{(i)}$$

$${\mathcal{S}}_{\mathcal{A}}:=\{S,K\}\cap {\mathcal{V}}_{\mathcal{A}}.$$

Full text

Secure Network Coding in the Setting in Which a Non-Source Node May Generate Random Keys

Debaditya Chaudhuri

Michael Langberg

Michelle Effros

I Introduction

In this work, we study secure network communication over a directed acyclic network $\mathcal{G}=(\mathcal{V},\mathcal{E})$ having a single source node $S$, a single terminal node $T$, and a single node $K$, which is capable of generating random “keys” independent of the messages generated by $S$. We employ a notion of secure “wiretap” communication networks introduced by Cai and Yeung in [1] and studied further in, for example [2, 3, 4, 5, 6]. Under this notion of security, given a communication scheme over $\mathcal{G}$, we consider an edge $e\in\mathcal{E}$ of the network to be secure in the presence of a wiretap adversary if and only if $I(M;X_{e})=0$, where $M$ denotes the source message and $X_{e}$ denotes the information communicated on edge $e$.111Detailed definitions of all concepts discussed here and below appear in Section II. To be secure in the presence of an adversary that wiretaps any size-$z$ subset $\mathcal{W}=\{e_{1},\cdots,e_{z}\}\subset\mathcal{E}$ of edges, we require that $I(M;X_{\mathcal{W}})=0$, where $X_{\mathcal{W}}=(X_{e_{1}},\cdots,X_{e_{z}})$.

Given integers $R$ and $z$, we define a secure network code over the network $\mathcal{G}$ to be $(R,z)$-feasible if it allows information to be communicated from the source $S$ to the terminal $T$ at rate $R$ and, in addition, it secures the network against a wiretap adversary that eavesdrops on up to $z$ edges of the network. Our work entails determining, for each $z$, the closure of the set of rates that are $(R,z)$-feasible, thereby deriving the capacity-security region.

When $K=S$, the capacity-security region for secure multicast network codes is well understood [1, 2] with several follow up works [3, 4, 5, 6] that address various methods to alter any given non-secure linear network code into a new code that is secure. In contrast, determining the capacity-security region for secure network codes over a single-source single-terminal network, where every node can generate random keys, is as hard as the problem of characterizing the (non-secure) capacity region of the $k$-unicast problem as shown by [7]. Results of a similar nature are also presented in [8]. The $k$-unicast problem is a well known open problem in the study of network codes [8, 9, 10, 11, 12].

In this work, we seek to make progress in the apparently difficult generalization from the scenario where only the source can generate random keys to the scenario where all nodes can generate keys by studying the case where only a single node can generate keys but allowing that single node to be arbitrary. Our central result is a characterization of the capacity-security region in the unicast (single-source single-terminal) setting when only a single network node $K\neq S\in\mathcal{V}$ can generate random keys.

The remainder of the paper is organized as follows. In Section II, we present our model and preliminary notation. Our main result, the capacity-security characterization of the networks at hand, appears in Section III. The characterization is combinatorial in nature and involves different cut-set bounds between the source node, the key generating node, and the terminal node. Achievability is proven in Section IV via a reduction from secure communication over $\mathcal{G}$ to (non-secure) multi-source multi-cast network coding over a modified network $\mathcal{G}^{*}$ as shown in Figure 1b. The converse proof, which is based on cutset bounds, appears in Section V. An additional converse proof, in the more general context of cyclic networks, is presented in Appendix A. The proofs of some one of our lemmas and claims are presented in Appendix B and Appendix C, respectively.

II Network Model

Our system model consists of the following components:

• (a)

A finite directed acyclic graph $\mathcal{G}=\{\mathcal{V},\mathcal{E}\}$. We assume that each edge $e\in\mathcal{E}$ noiselessly transmits one unit of information (i.e., one field element in a given field $\mathbb{F}_{q}$) per unit time. We use multiple edges to model an edge with the ability to communicate more than one information symbol per unit time.

• (b)

A source node $S$, which generates a source message vector of length $R$, $M=\begin{bmatrix}M_{1}&M_{2}&\cdots&M_{R}\end{bmatrix}^{T}$, with $M_{1},M_{2},\cdots,M_{R}$ independently and uniformly distributed over the field $\mathbb{F}_{q}$ of size $q$.

• (c)

A terminal node $T\in\mathcal{V}$, which is required to decode all the messages generated by the source $S$ with zero error.

• (d)

A node $K\in\mathcal{V}$, which generates a random “key” vector, $N=\begin{bmatrix}N_{1},\cdots,N_{|N|}\end{bmatrix}^{T}$ with $N_{1},\cdots,N_{|N|}$ independently and uniformly distributed over the field $\mathbb{F}_{q}$ with $N$ independent of $M$.

• (e)

An eavesdropper that can access any subset $\mathcal{W}\subset\mathcal{E}$ of edges for which $|\mathcal{W}|\leq z$.

In the following subsections, we introduce our definition of a network code and discuss the notions of topological order and cut sets.

II-A Network Code

We define a scalar linear network code $\mathcal{N}$ for the network $\mathcal{G}$ to be an assignment of a linear encoding function $f_{e}$ to each edge $e\in\mathcal{E}$ and a linear decoding function $g_{T}$ to terminal $T$. For $e\in\mathcal{E}$, we denote the edge message on $e$ by $X_{e}$, and for any set $\mathcal{A}\subseteq\mathcal{E}$, we define $X_{\mathcal{A}}=\{X_{e}:e\in\mathcal{A}\}$. If $e\in\mathcal{E}$ and $e=(u,v)$ then the edge message $X_{e}$ is a linear combination of all the messages carried by the edges in ${\rm In}(u)=\{(w,u):(w,u)\in\mathcal{E}\}$, the incoming edges of $u$. The edge message at $e$ is obtained using local encoding at $u$. We define $X_{e}$ using the local encoding function $\bar{f}_{e}$ on $e=(u,v)$ as

[TABLE]

Here, $X_{e}$ denotes the message on edge $e$, for each edge $e^{\prime}\in{\rm In}(u)$, $X_{e^{\prime}}$ denotes the messages on edges $e^{\prime}$ and $\bar{c}_{e^{\prime},e}$ is the coefficient acting on each message $X_{e^{\prime}}$. If edge $e$ is an outgoing edge of $S$ (or $K$), then $X_{e}$ is a function of the source messages (or keys) as well. Given, such a network code, an adversary that wiretaps any size-$z$ subset of edges $\mathcal{W}\subset\mathcal{E}$ would obtain the information $X_{\mathcal{W}}$ on the wiretapped edges. A network code is said to be $(R,z)$-feasible if

[TABLE]

where $T$ is the terminal node and $M$ is the $R$-dimensional message vector generated by the source $S$.

II-B Topological Order

To achieve secure communication over the network $\mathcal{G}$, the source $S$ must “mix” the message symbols in $M$ with the (received) random key symbols in $N$. This mixture of messages and keys is communicated to the terminal $T$, which must decode correctly to reconstruct message $M$. Let $\mathcal{V}=\{v_{0},...,v_{n-1}\}$. Since $\mathcal{G}$ is directed and acylic, we assume, without loss of generality, that the nodes $v_{i}\in\mathcal{V}$ are indexed according to their topological order in $\mathcal{G}$. This implies that the node $v_{i}$ receives its incoming information only from nodes $v_{0},\cdots,v_{i-1}$. We also assume that the index of $K$ in this topological order is less than that of $S$ which in turn is less than that of the terminal $T$. More specifically, we assume $K=v_{0}$, $S=v_{m}$, and $T=v_{n-1}$ for $v_{0},v_{m},v_{n-1}\in\mathcal{V}$ and $0<m<n-1$. There is no loss of generality in these assumptions as otherwise, either transmissions on outgoing edges of $S$ cannot be secure or the communication rate $R$ between $S$ and $T$ is zero. This implies that nodes $\{v_{0},\dots,v_{m-1}\}$ only transmit, on their outgoing edges, functions of the information generated by $K$ while nodes $\{v_{m},\dots,v_{n-1}\}$ may potentially transmit functions of the information generated at both $S$ and $K$.

II-C The Cut Sets

For any pair of nodes $u,v\in\mathcal{V}$, a cut is a set of edges in $\mathcal{E}$ which, when removed, disconnects all paths from $u$ to $v$. The cut with the minimum capacity that separates $u$ and $v$ is denoted as ${\rm mincut}_{\mathcal{G}}(u,v)$. Since each edge in $\mathcal{E}$ is assumed to be of unit capacity, $|{\rm mincut}_{\mathcal{G}}(u,v)|$ represents the total capacity of all the edges in ${\rm mincut}_{\mathcal{G}}(u,v)$. The cuts as defined above may also separate sets of nodes in the network $\mathcal{G}$. For a subset of nodes $\mathcal{A}$, the set ${\rm mincut}_{\mathcal{G}}(\mathcal{A},v)$ is the minimum capacity cut that separates the set of nodes in $\mathcal{A}\subset\mathcal{V}$ from the node $v\in\mathcal{V}$. For the network $\mathcal{G}$, we use the following notation

[TABLE]

III Results

In this work we prove the following theorem.

Theorem 1**.**

Given the directed acyclic network $\mathcal{G}$ and integers $R$ and $z$ such that $R>0$, there exists an $(R,z)$-feasible network code $\mathcal{N}$ over $\mathcal{G}$ if and only if,

[TABLE]

The proof of Theorem 1 is divided into two parts, the achievability proof, shown in Section IV, and the converse proof shown in Section V.

IV Proof of Theorem 1: Achievability

Proof.

For the network $\mathcal{G}=(\mathcal{E},\mathcal{V})$ with source node $S$ and key generating node $K$ holding $R$ message symbols $M$ and $z$ key symbols $N$ respectively, we set the values of integers $R$ and $z$ such that they satisfy the bounds (4), (5), and (6). We implement a random linear network code $\mathcal{N}$ over $\mathcal{G}$ and over a sufficiently large field $\mathbb{F}_{q}$ such that, for any edge $e=(u,v)\in\mathcal{E}$, the local encoding coefficients $\{\bar{c}_{e^{\prime},e}\}_{e^{\prime}\in{\rm In}(u)}$ associated with edge $e$, as described in (1), are i.i.d. and uniform over $\mathbb{F}_{q}$.

The network code $\mathcal{N}$ is said to be decodable at rate $R$ over network $\mathcal{G}$, if it satisfies the condition of (2). We consider the following lemma which we prove in Section VI-A.

Lemma 1**.**

Given integers $R,z$ that satisfy (4)-(6) of Theorem 1, the random linear network coding scheme $\mathcal{N}$ is decodable at rate $R$ with probability at least $1-\dfrac{2(|\mathcal{E}|+R+z)^{2}}{q}$.

We now consider a wiretapping adversary that can eavesdrop on any subset of edges $\mathcal{W}\subset\mathcal{E}$ such that $|\mathcal{W}|=z$. We denote the information gleaned by the adversary as $X_{\mathcal{W}}$ which may be expressed as

[TABLE]

Here, $\mathbf{A}_{\mathcal{W}}$ and $\mathbf{B}_{\mathcal{W}}$ are $z\times R$ and $z\times z$ matrices whose rows are global encoding vectors associated with each edge in $\mathcal{W}$, acting on $M$ and $N$, respectively. We consider the network coded information to be secure if and only if (3) holds for any $\mathcal{W}\subset\mathcal{E}$ of size $z$, i.e. the adversary gains no information about the source message symbols $M$ even after wiretapping a $z$-sized subset of edges in the network. In [3], Cai and Yeung show that a linear network coding scheme is secure if and only if the following condition holds.

[TABLE]

Here, ${\rm rk}(.)$ denotes the rank of a matrix.

The following lemma is proven in Section VI-B by analyzing the matrices $\mathbf{A}_{\mathcal{W}}$ and $\mathbf{B}_{\mathcal{W}}$.

Lemma 2**.**

Given integers $R,z$ that satisfy (4)-(6) of Theorem 1, the random linear network coding scheme $\mathcal{N}$ over $\mathcal{G}$ is $z$-secure with probability at least $1-\dfrac{\binom{|\mathcal{E}|}{z}2z}{q}$ for all wiretap sets $\mathcal{W}\subset\mathcal{E}$ of size $z$.

A network code is said to be $(R,z)$-feasible if it is both $R$-feasible and $z$-secure. It now follows that, given integers $R$ and $z$ that satisfy (4), (5), and (6), the suggested network code is $(R,z)$-feasible with probability at least

[TABLE]

which, for sufficiently large $q$, implies our achievability with high probability.

∎

V Proof of Theorem 1: Converse

Proof.

We prove the converse for any (not necessarily linear) $(R,z)$-feasible network code $\mathcal{N}$ over the network $\mathcal{G}$. We start with an $(R,z)$-feasible coding scheme and show that $R$ and $z$ satisfy the bounds of (4), (5) and (6). Here, we give a partial proof in which we only address bound (4). Proofs of a similar nature apply to the other bounds as well. Details of the converse proof, in the more general context of cyclic networks, appear in Appendix A.

We denote by $\mathbb{C}_{K-S}$ the minimum cut separating $K$ and $S$, and by $C_{K-S}$ the total capacity of the edges in $\mathbb{C}_{K-S}$. The random variable $X_{K-S}$, over the support set $\mathcal{X}_{K-S}$, represents the information on all edges of $\mathbb{C}_{K-S}$. We denote by $\mathcal{W}$ any subset of $z$ edges in $\mathcal{E}$ that is wiretapped by an eavesdropping adversary. Then $X_{\mathcal{W}}$ denotes the encoded information on all the edges in $\mathcal{W}$. We denote the set of edges that are incoming to $S$ as ${\rm In}(S)$, and the encoded information on all of the edges in ${\rm In}(S)$ as $X_{{\rm In}(s)}$ with support set $\mathcal{X}_{{\rm In}(S)}$. Similarly, for ${\rm Out}(S)$.

For the bound $z\leq\min(C_{K-S},C_{K-T})$ we consider two cases. First, assume by contradiction that $z>C_{K-S}$. Specifically set $z=C_{K-S}+1$. This implies that the eavesdropping adversary may choose to wiretap all the edges in $\mathbb{C}_{K-S}$ and an edge $e\in{\rm Out}(S)$ to obtain the wiretap set $\mathcal{W}=\mathbb{C}_{K-S}\cup\{e\}$ of size $z$. Then the wiretapped information is $X_{\mathcal{W}}=(X_{K-S},X_{e})$, where $X_{e}$ is the information on the chosen edge $e$. Note that $X_{e}=\bar{f}_{e}(X_{S})$, where, $X_{S}:=(M,X_{{\rm In}(S)})$ is the information present at the source $S$.

For $z$-security, we require that the mutual information ${\rm I}(M;X_{\mathcal{W}})=0$. Therefore,

[TABLE]

implying that, ${\rm I}(M;X_{K-S})=0$ and ${\rm I}(M;X_{e}|X_{K-S})=0$. Thus, we conclude that ${\rm H}(X_{e}|X_{K-S})={\rm H}(X_{e}|X_{K-S},M)$.

Suppose that cut $\mathbb{C}_{K-S}$ partitions $\mathcal{G}$ into disjoint sub-networks $\mathcal{A}$ and $\bar{\mathcal{A}}$, where $\mathcal{A}$ includes the key generating node $K$. Note that any information communicated through edges in $\bar{\mathcal{A}}$ must be a function of $X_{K-S}$. In addition, ${\rm In}(S)\subset\mathbb{C}_{K-S}\cup\mathcal{E}_{\bar{\mathcal{A}}}$, implying that all information reaching $S$ is a function of $X_{K-S}$. We conclude, for any edge $e\in{\rm Out}(S)$, that

[TABLE]

where, $h_{e}$ is some deterministic function. Equation (9) implies that ${\rm H}(X_{e}|X_{K-S},M)=0$ which in turn implies ${\rm H}(X_{e}|X_{K-S})=0$. This means that to be $z$-secure the information $X_{K-S}$ must completely determine $X_{e}$ for all $e\in{\rm Out}(S)$. Therefore, the information $X_{{\rm Out}(S)}:=\{X_{e}\}_{e\in{\rm Out}(S)}$ is also a deterministic function of $X_{K-S}$. As ${\rm I}(M;X_{K-S})=0$ shows that $X_{K-S}$ is independent of $M$, it follows that $X_{{\rm Out}(S)}$ is also independent of $M$ and thus ${\rm I}(M;X_{{\rm Out}(S)})=0$. This, in turn, implies that the rate realizable by the network code $\mathcal{N}$ is $R=0$ which is a contradiction.

A similar proof holds for $z\leq C_{K-T}$, in which we study the set $\mathcal{W}=\mathbb{C}_{K-T}\cup\{e\}$ for any edge $e\in{\rm In}(T)$. ∎

VI Proof of Lemmas

VI-A Proof of Lemma 1

We begin by considering the modified network $\mathcal{G}^{*}=(\mathcal{V}^{*},\mathcal{E}^{*})$, obtained from $\mathcal{G}$ as shown in Figure 1b. Specifically, $\mathcal{G}^{*}$ is obtained from $\mathcal{G}$ by adding a new node $T^{*}$ and $R+z$ parallel edges from $S$ to $T^{*}$. As in $\mathcal{G}$, the network $\mathcal{G}^{*}$ has nodes $S$ and $K$ holding $R$ symbols of $M$ and $z$ symbols of $N$, respectively. Here, the outgoing edges of $S$ include those in the original network $\mathcal{G}$, denoted as ${\rm Out}(S)$, and the additional $R+z$ edges. Both terminals $T$ and $T^{*}$ want to decode all $R$ symbols of $M$ and $z$ symbols of $N$. A network code, over $\mathcal{G}^{*}$, that satisfies the demands of terminals $T$ and $T^{*}$ is a multi-source multicast network code which is $\mathbf{R}$-feasible, where $\mathbf{R}=(R,z)$.

We use a random linear multi-source multicast network code $\mathcal{N}^{*}$ over network $\mathcal{G}^{*}$ and the finite field $\mathbb{F}_{q}$. In what follows, we set some notation.

Let $O_{K}\triangleq|{\rm Out}(K)|$, $I_{S}\triangleq|{\rm In}(S)|$ and $O_{S}\triangleq|{\rm Out}(S)|$.

• 2.

The node $K$ transmits $z$ linear combinations of $N$ through ${\rm Out}(K)$. We express the information on these edges as $X_{{\rm Out}(K)}=\mathbf{B}_{K}N$. Here, the rows of $\mathbf{B}_{K}$, which is an $O_{K}\times z$ matrix, are the local encoding vectors associated with each edge in ${\rm Out}(K)$. The entries of $\mathbf{B}_{K}$ are i.i.d. and uniform over the field $\mathbb{F}_{q}$.

• 3.

The message source $S$ receives $I_{S}$ linear combinations of $N$ through the edges in ${\rm In}(S)$. We express the information on these edges as $X_{{\rm In}(S)}=\mathbf{V}_{In(S)}\mathbf{B}_{K}N$. $\mathbf{V}_{{\rm In}(S)}$ is an $I_{S}\times O_{K}$ matrix, and the rows of $\mathbf{V}_{In(S)}\mathbf{B}_{K}$ are the global encoding vectors, associated with each edge in ${\rm In}(S)$, acting on $N$.

• 4.

$S$ “mixes" the received $I_{S}$ symbols of $X_{{\rm In}(S)}$ with the $R$ symbols of $M$ and transmits the resulting combinations through ${\rm Out}(S)$ and to $T^{*}$. We express the information on ${\rm Out}(S)$ as

[TABLE]

Here, the rows of the matrix $\begin{bmatrix}\mathbf{A_{S}}&\mathbf{B}_{S}\end{bmatrix}$ are the local encoding vectors associated with the edges in ${\rm Out}(S)$. $\mathbf{A}_{S}$ and $\mathbf{B}_{S}$ are $O_{S}\times R$ and $O_{S}\times I_{S}$ matrices respectively. The entries of $\mathbf{A}_{S}$ and $\mathbf{B}_{S}$ are i.i.d. and uniform over $\mathbb{F}_{q}$.

We now consider the following claims. Claim 2 is proven in Appendix C-A.

Claim 1**.**

The multi-source multicast random linear network code $\mathcal{N}^{*}$, as described above, is $\mathbf{R}$-feasible over the network $\mathcal{G}^{*}$ with probability at least $1-\dfrac{2(|\mathcal{E}|+R+z)^{2}}{q}$.

Proof of Claim 1.

Given integers $R$ and $z$, we start by observing the min-cut capacities in $\mathcal{G}^{*}$ between the subsets of the node set $\{S,K\}$ and each terminal $T$ and $T^{*}$ as follows.

[TABLE]

From (10)-(15), we see that for all source-terminal pairs in $\mathcal{G}^{*}$, the corresponding Min-Cut Max-Flow bounds are satisfied.

Let $L$ be the total number of encoding coefficients employed over all the edges in $\mathcal{E}^{*}$. We can bound $L$ by $\sum_{e\in\mathcal{E}^{*}}|\mathcal{E}^{*}|\leq|\mathcal{E}^{*}|^{2}=(|\mathcal{E}|+R+z)^{2}$. Using Theorem 8 of [13] and Theorem 5.4 of [14] (derived from [15]), we have that the network code $\mathcal{N}^{*}$ is $\mathbf{R}$-feasible over the network $\mathcal{G}^{*}$ with probability at least

[TABLE]

This proves the claim.

∎

Claim 2**.**

The $\mathbf{R}$-feasible network code $\mathcal{N}^{*}$ over $\mathcal{G}^{*}$, when restricted to $\mathcal{G}$, implies that $\mathcal{N}$ is $R$-decodable over $\mathcal{G}$.

From Claim 1 and Claim 2, we have that the network code $\mathcal{N}$ is $R$-decodable over $\mathcal{G}$ with probability at least

[TABLE]

This proves the lemma. $\blacksquare$

VI-B Proof of Lemma 2

We use the notation introduced in the proof of Lemma 1. For any edge $e\in\mathcal{E}$, we express the information on $e$ as,

[TABLE]

Here, $u_{e}$ is an edge-$e$ encoding vector of dimension $O_{K}+O_{S}$, acting on $X_{{\rm Out}(K)}$ and $X_{{\rm Out}(S)}$. We partition $u_{e}=\begin{bmatrix}u_{K}&u_{S}\end{bmatrix}$ such that the $O_{K}$-dimensional vector $u_{K}$ acts on the information from ${\rm Out}(K)$ and the $O_{S}$-dimensional vector $u_{S}$ acts on the information from ${\rm Out}(S)$. Thus, we rewrite (16) as follows.

[TABLE]

We now consider an adversary that wiretaps any subset $\mathcal{W}\subset\mathcal{E}$ of edges such that $|\mathcal{W}|=z$. Then, using (17), we obtain the information observed by the adversary as follows.

[TABLE]

Here, $\begin{bmatrix}\mathbf{U}_{K}&\mathbf{U}_{S}\end{bmatrix}$ is a $z\times(O_{K}+O_{S})$ matrix where $\mathbf{U}_{K}$ is a $z\times O_{K}$ matrix and $\mathbf{U}_{S}$ is a $z\times O_{S}$ matrix. We assume that $\begin{bmatrix}\mathbf{U}_{K}&\mathbf{U}_{S}\end{bmatrix}$ has full row-rank of $z$, as otherwise, the adversary could simply drop an edge in $\mathcal{W}$ and not lose any information. Using (17), we rewrite (18) as follows.

[TABLE]

From (7) and (19), we have that

[TABLE]

Let,

[TABLE]

From our decodability proof, we know that ${\rm rk}(\mathbf{V}_{{\rm In}(S)})=z$, as otherwise, $T^{*}$ could not have decoded the keys $N$. For the security condition of (8) to hold, we show that ${\rm rk}(\mathbf{B}_{\mathcal{W}})={\rm rk}(\mathbf{\Phi}\mathbf{B}_{K})=z$. Therefore, we compute the following.

[TABLE]

We now consider the following claims proven in Appendix C-B and Appendix C-C, respectively.

Claim 3**.**

$\Pr_{\mathbf{B}_{S}}\{{\rm rk}(\mathbf{\Phi})=z\}>1-\dfrac{z}{q}$**

Claim 4**.**

Given an $n\times m$ matrix $\mathbf{A}$ and an $m\times n$ matrix $\mathbf{B}$ such that ${\rm rk}(\mathbf{A})=n$ and the entries of $\mathbf{B}$ are i.i.d. and uniform over the field $\mathbb{F}_{q}$, then ${\rm rk}(\mathbf{A}\mathbf{B})=n$ with probability at least $1-\dfrac{n}{q}$, over $\mathbf{B}$.

Let us consider the following event.

• •

$\mathbb{E}_{\mathcal{W}}$: The condition of (8) holds for a given wiretap set $\mathcal{W}$ of size $z$.

Using Claim 3 and Claim 4 we conclude from (VI-B) that

[TABLE]

Denoting the complementary event of $\mathbb{E}_{\mathcal{W}}$ by $\bar{\mathbb{E}}_{\mathcal{W}}$ and using the union bound over event $\bar{\mathbb{E}}_{\mathcal{W}}$ for any $\mathcal{W}\subset\mathcal{E}$ of size $z$, we have the following.

[TABLE]

Namely, the probability over the i.i.d. entries of $\mathbf{B}_{S}$ and $\mathbf{B}_{K}$, of the network code being secure against an adversary with a wiretap set $\mathcal{W}$ of size $z$ is at least $1-\dfrac{\binom{|\mathcal{E}|}{z}2z}{q}$. This proves the lemma. $\blacksquare$

VII Conclusion

In this paper, we characterize the capacity-security region for single unicast network codes over a directed acyclic network in which only one node, which is not necessarily the source node, can generate random keys. We present a random linear achievability proof and a matching coverse proof. Our converse can be extended to cyclic networks as well. (Details appear in Appendix A.) Our work establishes an intermediate step between the well understood problem of characterizing the capacity-security region in which only the source node generates random keys and the problem of characterizing the capacity-security region when every node can generate random keys.

Several problems are left open. An extension of our result to the context of multicast network coding is within reach and the subject of future research. It would also be interesting to extend our achievability to single unicast network coding over networks with cycles. Additional possible extensions include the study of single unicast networks in which more than one node can independently generate random keys.

Acknowledgements

Work supported in part by NSF grants CCF-1526771 and CCF-1817241.

Appendix A Proof of Theorem 1: Converse (For cyclic networks)

Proof.

We prove the converse for the more general setting of directed networks $\mathcal{G}_{\rm cyc}=(\mathcal{V}_{\rm cyc},\mathcal{E}_{\rm cyc})$ that may contain cycles. As before, $\mathcal{G}_{\rm cyc}$ has the message generating source node $S$, the random key generating node $K$ and the terminal $T$, as shown in Figure 2. We show that for such a network and for any network coding scheme, the bounds given in (4), (5) and (6) are upper bounds for the capacity-security region.

As we address networks with cycles, we consider the notion of time in our definition of a network code. Namely, we consider an $n$-time step system. In such a system, we assume that communication starts at time step $i=1$. The source $S$ holds a message $M$ uniformly distributed in $[q^{nR}]$ and node $K$ holds random keys $N$ uniformly distributed in $[q^{R_{K}}]$, where $R_{K}$ is not restricted in any way. For any edge $e\in\mathcal{E}$ such that $e=(u,v)$, where $u,v\in\mathcal{V}_{\rm cyc}$, we define the information on $e$ at the $i$-th time step, for all $i\in[n]=\{1,\cdots,n-1\}$, as

[TABLE]

Here, $\bar{f}_{e}^{(i)}$ is the time-variant local encoding function at edge $e$ at the $i$-th time step, ${\rm In}(u)$ denotes the set of incoming edges in $\mathcal{E}$ to node $u$ and $[i-1]=\{1,\cdots,i-1\}$. In our work, we consider $X_{e}^{(i)}$ to be a random variable with the support set $\mathcal{X}_{e}$, for all $i\in[n]$. For a given cut $\mathbb{C}$, we denote by $X_{\mathbb{C}}^{(i)}$ the composite of the variables corresponding to edges $e\in\mathbb{C}$ at time step $i$, i.e. $X_{\mathbb{C}}^{(i)}=(\{X_{e}^{(i)}\}_{e\in\mathbb{C}})$. The support set of $X_{\mathbb{C}}^{(i)}$ for all $i\in[n]$ is denoted by $\mathcal{X}_{\mathbb{C}}$. We use the notation $X_{e}^{[n]}$ to denote the information on edge $e$ for the $n$-time step system, i.e. $X_{e}^{[n]}:=\{X_{e}^{(j)}\}_{j\in[n]}$.

For the network model $\mathcal{G}_{\rm cyc}$, the following definitions are useful for the discussions that follow:

• •

For any cut $\mathbb{C}_{u-v}$, separating any two nodes $u,v\in\mathcal{V}$, we define two sub-networks $\mathcal{A}=(\mathcal{V}_{\mathcal{A}},\mathcal{E}_{\mathcal{A}})$ and $\bar{\mathcal{A}}=(\mathcal{V}_{\bar{\mathcal{A}}},\mathcal{E}_{\bar{\mathcal{A}}})$, with $u\in\mathcal{V}_{\mathcal{A}}$ and $v\in\mathcal{V}_{\bar{\mathcal{A}}}$, as shown in Figure 2. Here, $\mathcal{V}=\mathcal{V}_{\mathcal{A}}\cup\mathcal{V}_{\bar{\mathcal{A}}}$ and $\mathcal{E}=\mathcal{E}_{\mathcal{A}}\cup\mathcal{E}_{\bar{\mathcal{A}}}\cup\mathbb{C}_{u-v}$.

• •

We denote by $\mathbb{C}_{K-S}$, the minimum cut separating $K$ and $S$ and by $C_{K-S}$, the total capacity of the edges in $\mathbb{C}_{K-S}$. The random variable $X_{K-S}^{(i)}$, over the support set $\mathcal{X}_{K-S}$, represents the information, at the $i$-th time step on all the edges of $\mathbb{C}_{K-S}$. $X_{K-S}^{[n]}=\{X_{K-S}^{[j]}\}_{j\in[n]}$ represents the information on all the edges of $\mathbb{C}_{K-S}$ for the $n$-time step system. We use similar notations for the time variant random variables which represent the information on the edges in $\mathbb{C}_{K-T}$, $\mathbb{C}_{S-T}$, and $\mathbb{C}_{KS-T}$.

• •

We denote by $\mathcal{W}$ any subset of $z$ edges in $\mathcal{E}$ that is wiretapped by an eavesdropping adversary. $X_{\mathcal{W}}^{(i)}$ denotes the encoded information on all the edges in $\mathcal{W}$ at the $i$-th time step. We assume that the wiretap set $\mathcal{W}$ is time invariant, i.e. it does not change with the time step $i$. Thus, the information obtained by the adversary for the $n$-time step system is $X_{\mathcal{W}}^{[n]}$.

• •

We denote by ${\rm In}(S)$, the set of edges that are incoming to $S$. We denote the encoded information at the $i$-th time step on all the edges in ${\rm In}(S)$ as $X_{{\rm In}(s)}^{(i)}$ with support set $\mathcal{X}_{{\rm In}(S)}$. Similarly, for ${\rm Out}(S)$.

• •

For any sub-graph $\mathcal{A}=(\mathcal{V}_{\mathcal{A}},\mathcal{E}_{\mathcal{A}})\subset\mathcal{G}_{\rm cyc}$, let

[TABLE]

Given the definitions above, we start with an $(R,z)$-feasible coding scheme and show that $R$ and $z$ satisfy the bounds of (4), (5) and (6). Here, a scheme is $(R,z)$-feasible with blocklength $n$ if $T$ can decode $M\in[q^{nR}]$ and any wiretapped subset of edge $\mathcal{W}$ hold no information on $M$. We shall now consider each of the bounds separately in the following subsections.

A-A Bound on $z$: $z\leq\min(C_{K-S},C_{K-T})$

A-A1 $\mathbf{z\leq C_{K-S}}$

Suppose, by contradiction, that $z>C_{K-S}$. Particularly, assume $z=C_{K-S}+1$ This implies that the eavesdropping adversary may choose to wiretap all the edges in $\mathbb{C}_{K-S}$ and an edge $e\in{\rm Out}(S)$ to obtain the wiretap set $\mathcal{W}=\mathbb{C}_{K-S}\cup\{e\}$ of size $z$. Then the wiretapped information is $X_{\mathcal{W}}^{[n]}=(X_{K-S}^{[n]},X_{e}^{[n]})$, where $X_{e}^{[n]}$ is the information on the chosen edge $e$ for the $n$-time step system. From (23), we see that

[TABLE]

Where, $X_{S}^{[i-1]}:=(M,X_{{\rm In}(S)}^{[i-1]})$ is the information present at the source $S$ for all time steps up to the $(i-1)$-th time-step. For $z$-security, we require that the mutual information ${\rm I}(M;X_{\mathcal{W}}^{(i)})=0$. Therefore,

[TABLE]

Implying that,

[TABLE]

From (28), we obtain the following.

[TABLE]

Suppose the cut $\mathbb{C}_{K-S}$ partitions $\mathcal{G}_{\rm cyc}$ into disjoint sub-networks $\mathcal{A}$ and $\bar{\mathcal{A}}$ . Then, as per the definition in (24), $\mathcal{S}_{\bar{\mathcal{A}}}=\{S\}$. We denote by $X_{\bar{\mathcal{A}}}$, the source message $M$ and/or key $N$ held by the nodes in $\bar{\mathcal{A}}$. We see that ${\rm In}(S)\subset\mathbb{C}_{K-S}\cup\mathcal{E}_{\bar{\mathcal{A}}}$, which implies that any edge $e^{\prime}\in{\rm In}(S)$ either belongs to the set ${\rm In}(S)\cap\mathbb{C}_{K-S}$ or the set ${\rm In}(S)\cap\mathcal{E}_{\bar{\mathcal{A}}}$.

For any edge $e^{\prime}\in{\rm In}(S)\cap\mathbb{C}_{K-S}$, we observe that

[TABLE]

For $e^{\prime}\in{\rm In}(S)\cap\mathcal{E}_{\bar{\mathcal{A}}}$, we consider the following lemma which we prove in Appendix B.

Lemma 3**.**

For any cut $\mathbb{C}$ that partitions graph $\mathcal{G}_{\rm cyc}$ into disjoint sub-networks $\mathcal{A}$ and $\bar{\mathcal{A}}$, there exists, for any edge $e\in\mathcal{E}_{\bar{\mathcal{A}}}$ and any time step $i\in[n]$, a deterministic mapping $g_{e}^{(i)}$ such that $g_{e}^{(i)}(\{X_{\mathbb{C}}^{(j)}\}_{j\in[i-1]},X_{\bar{\mathcal{A}}})=X_{e}^{(i)}$.

Therefore, using Lemma 3 for edge $e^{\prime}\in{\rm In}(S)\cap\mathcal{E}_{\bar{\mathcal{A}}}$:

[TABLE]

where, $\bar{h}_{e^{\prime}}$ is a deterministic function.

Then, using (A-A1) we obtain the information on ${\rm In}(S)$ as follows.

[TABLE]

Thus, for the chosen edge $e\in{\rm Out}(S)$, using (A-A1) and (A-A1) we have

[TABLE]

Thus, (A-A1) shows that $X_{e}^{[n]}$ is a deterministic function of $M$ and $X_{K-S}^{[n-1]}$. As ${\rm H}(X_{e}^{[n]}|X_{K-S}^{[n]},M)\leq{\rm H}(X_{e}^{[n]}|X_{K-S}^{[n-1]},M)$, this implies that

[TABLE]

Therefore by (29) and (34), we have,

[TABLE]

Thus, to be $z$-secure, (35) shows that for all $e\in{\rm Out}(S)$, the random variable $X_{e}^{[n]}$ must be completely determined by $X_{K-S}^{[n]}$. Therefore, the information $X_{{\rm Out}(S)}^{[n]}:=\{X_{e}^{[n]}\}_{e\in{\rm Out}(S)}$ is also a deterministic function of $X_{K-S}^{[n]}$. As (27) shows that $X_{K-S}^{[n]}$ is independent of the message symbols $M$, it follows that $X_{{\rm Out}(S)}^{[n]}$ is also independent of $M$ and thus

[TABLE]

Equation (36), in turn implies that the rate realizable by the network code $\mathcal{N}$ is $R=0$ which is a contradiction.

A-A2 $\mathbf{z\leq C_{K-T}}$

Suppose, by contradiction, that $z>C_{K-T}$, specifically assuming that $z=C_{K-T}+1$. This implies that the eavesdropping adversary may choose to wiretap all the edges in $\mathbb{C}_{K-T}$ and any edge $e\in{\rm In}(T)$ to obtain the wiretapped set $\mathcal{W}=\mathbb{C}_{K-T}\cup\{e\}$ of size $z$. Then the wiretapped information is $X_{\mathcal{W}}^{[n]}=(X_{K-T}^{[n]},X_{e}^{[n]})$, where $X_{e}^{[n]}$ is the information on the chosen edge $e$. For $z$-security, we require that the mutual information ${\rm I}(M;X_{\mathcal{W}}^{[n]})=0$. Therefore,

[TABLE]

Further implying that,

[TABLE]

From (39),

[TABLE]

We now consider the cut $\mathbb{C}_{K-T}$ and the corresponding partitions $\mathcal{A}$ and $\bar{\mathcal{A}}$. Note that corresponding to the cut $\mathbb{C}_{K-T}$, the set of information and key generating source nodes in $\mathcal{G}_{\rm cyc}$ which are also present in $\bar{\mathcal{A}}$ is $\mathcal{S}_{\bar{\mathcal{A}}}$ where $\mathcal{S}_{\bar{\mathcal{A}}}\subseteq\{S,K\}$.

Note that ${\rm In}(T)\subset\mathbb{C}_{K-T}\cup\mathcal{E}_{\bar{\mathcal{A}}}$. Due to the cut $\mathbb{C}_{K-T}$, it follows that either $S\in\mathcal{V}_{\bar{\mathcal{A}}}$ or $S\in\mathcal{V}_{\mathcal{A}}$. For any edge $e^{\prime}\in{\rm In}(T)\cap\mathbb{C}_{K-T}$, we have the following.

[TABLE]

where, $h_{e^{\prime}}$ is a deterministic function.

For any edge $e^{\prime}\in{\rm In}(T)\cup\mathcal{E}_{\bar{\mathcal{A}}}$, by Lemma 3, we have the following.

[TABLE]

Equation (A-A2) shows that for any edge $e\in{\rm In}(T)$, the random variable $X_{e}^{[n]}$ is completely determined by $X_{K-T}^{[n-1]}$ and $M$. As ${\rm H}(X_{e}^{[n]}|X_{K-T}^{[n]},M)\leq{\rm H}(X_{e}^{[n]}|X_{K-T}^{[n-1]},M)$, we have.

[TABLE]

which implies by (40) that ${\rm H}(X_{e}^{[n]}|X_{K-T}^{[n]})=0$. This holds for all $e\in{\rm In}(T)$ and thus ${\rm H}(X_{{\rm In}(T)}|X_{K-T}^{[n]})=0$. As (38) shows that $X_{K-T}^{[n]}$ is independent of $M$, therefore we conclude that,

[TABLE]

This in turn implies that the rate realizable by the network code $\mathcal{N}$ is $R=0$ which is a contradiction. Thus, for $R>0$, an $(R,z)$-feasible network code exists only if $z\leq\min(C_{K-S},C_{K-T})$, i.e., bound (4) holds.

A-B Upper Bound of $R$

The bound (5) is a direct consequence of Theorem 2.1 of [14] and therefore the proof is not included here.

A-C Upper Bound of $R+z$: $R+z\leq C_{KS-T}$

To show that an $(R,z)$-feasible network code exists only if bound (6) holds, we start by considering the following cases:

• •

Case 1: $z\geq C_{KS-T}$

• •

Case 2: $z<C_{KS-T}$

For Case 1, we see that the eavesdropping adversary has the option of wiretapping all the edges in $\mathbb{C}_{KS-T}$. Therefore, we set $\mathbb{C}_{KS-T}\subseteq\mathcal{W}$ thereby forcing ${\rm I}(M;X_{KS-T}^{[n]})=0$. This, implies that $X_{KS-T}^{[n]}$ is independent of the message symbols $M$. We also observe that ${\rm In}(T)\subset\mathbb{C}_{KS-T}\cup\mathcal{E}_{\bar{\mathcal{A}}}$. From our previous discussions, we note that the random variable $X_{{\rm In}(T)}^{[n]}$ is a deterministic function of $X_{KS-T}^{[n]}$ and therefore is also independent $M$. Thus, the terminal $T$ receives no information regarding the message symbols $M$ and therefore the rate realizable by the network code in this case is $R=0$ which is a contradiction.

For Case 2, let $\mathcal{W}\subset\mathbb{C}_{KS-T}$. Then, $\mathbb{C}_{KS-T}=\mathcal{W}\cup\mathcal{W}^{C}$ where, $\mathcal{W}^{C}=\mathbb{C}_{KS-T}\setminus\mathcal{W}$. We denote the information on the edges of the set $\mathcal{W}^{C}$ as $X_{\mathcal{W}^{C}}^{[n]}$ and thus we have that $X_{KS-T}^{[n]}=(X_{\mathcal{W}}^{[n]},X_{\mathcal{W}^{C}}^{[n]})$ where ${\rm H}(X_{\mathcal{W}^{C}}^{[n]})\leq n(C_{KS-T}-z)$. Here, our measure ${\rm H}(.)$ of entropy equals 1 for a uniform random variable in $\mathbb{F}_{q}$. Thus, we have the following.

[TABLE]

Here, (45) is due to our assumption of correctly decoding $M$ and the min-cut max-flow theorem as the cut $\mathbb{C}_{KS-T}$ is an $(S-T)$-cut. (46) is due to the security condition. Thus, one may realize an $(R,z)$-feasible network code over the network $\mathcal{G}_{\rm cyc}$ only if the bound (6) holds for integers $R>0$ and $z$.

Combining our analysis for bounds (4), (5) and (6) proves the theorem.

∎

Appendix B Proof of Lemma 3

We prove this lemma using an induction hypothesis on the time step parameter $i$. At time $i=0$, we assume that the network edges do not carry any information. Thus, at time $i=1$, the information on all network edges in $\bar{\mathcal{A}}$ are solely a function of the random variable $X_{\bar{\mathcal{A}}}$.

We assume by induction that the hypothesis holds for $1<i\leq I-1$, i.e. for $i=I-1$, we have the following.

[TABLE]

We now consider time step $i=I$. For an edge $e=(u,v)$, $X_{e}^{(N)}$ is a function of the incoming edges to $u$ and $X_{\bar{\mathcal{A}}}$ (the latter only if $u\in\mathcal{S}_{\bar{\mathcal{A}}}$). Namely,

[TABLE]

For $u\in\mathcal{V}_{\bar{\mathcal{A}}}$, the incoming edges of $u$ are either included in the cut $\mathbb{C}$ or are in $\mathcal{E}_{\bar{\mathcal{A}}}$. Thus,

[TABLE]

By induction, as $X_{e^{\prime}}^{(I-1)}$ is a function of $X_{\mathbb{C}}^{[I-2]}$ and $X_{\bar{\mathcal{A}}}$ for $e^{\prime}\in\mathcal{E}_{\bar{\mathcal{A}}}$. We conclude that there exists a function $g_{e}^{(I)}$ such that,

[TABLE]

This proves the lemma. $\blacksquare$

Appendix C Proof of Claims

C-A Proof of Claim 2

.

To prove that the network code $\mathcal{N}$ is $R$-decodable over network $\mathcal{G}$, given that $\mathcal{N}^{*}$ is $\mathbf{R}$-feasible over $\mathcal{G}^{*}$, we consider the following steps.

We disconnect terminal $T^{*}$ from $S$ by removing the edges connecting $S$ to $T^{*}$.

• 2.

We keep the random assignment of the local coding coefficients for each edge in $\mathcal{E}$ unchanged.

• 3.

As in $\mathcal{N}^{*}$, the source $S$ does not decode the keys $N$ but “mixes” the incoming combinations of the keys in $N$ with the message $M$ that it holds, and transmits the resulting combinations through ${\rm Out}(S)$.

• 4.

The information that terminal $T$ wants to decode also remains unchanged.

By initiating the steps above, we obtain the network code $\mathcal{N}$ from $\mathcal{N}^{*}$. It also follows that the network code $\mathcal{N}$ allows $T$ to decode all $R$ symbols of $M$ as the $\mathbf{R}$-feasible $\mathcal{N}^{*}$ allows $T$ to decode all $R$ symbols of $M$ and $z$ symbols of $N$, thereby satisfying condition (2). This proves the claim. ∎

C-B Proof of Claim 3

.

Since ${\rm rk}(\begin{bmatrix}\mathbf{U}_{K}&\mathbf{U}_{S}\end{bmatrix})=z$, we assume, without loss of generality, that the first $\sigma_{K}$ columns of $\mathbf{U}_{K}$ and $\sigma_{S}$ columns of $\mathbf{U}_{S}$ are jointly linearly independent with $\sigma_{K}+\sigma_{S}=z$. Then, we have that $\mathbf{U}_{S}=\begin{bmatrix}\mathbf{\bar{U}}_{S}&\mathbf{\bar{U}}_{S}\mathbf{\Gamma}\end{bmatrix}$, where $\mathbf{\bar{U}}_{S}$ is $z\times\sigma_{S}$ matrix of full column-rank $\sigma_{S}$, and $\mathbf{\Gamma}$ is a $\sigma_{S}\times(O_{S}-\sigma_{S})$ matrix. Let $\mathbf{\bar{U}}_{K}$ be the sub-matrix of $\mathbf{U}_{K}$ containing the $\sigma_{K}$ linearly independent columns of $\mathbf{U}_{K}$, and $\mathbf{\Delta}$ be a $\sigma_{K}\times O_{K}$ matrix such that $\mathbf{U}_{K}=\mathbf{\bar{U}}_{K}\mathbf{\Delta}$. Then, as per our assumption, the first $\sigma_{K}$ columns $\mathbf{\Delta}$ form a $\sigma_{K}\times\sigma_{K}$ identity matrix. Therefore, we have that ${\rm rk}(\mathbf{\Delta})=\sigma_{K}$

We now consider the matrix $\mathbf{V}_{{\rm In}(S)}$. Since, ${\rm rk}(\mathbf{V}_{{\rm In}(S)})=z$, we may express $\mathbf{V}_{{\rm In}(S)}$ as follows.

[TABLE]

Here, $\mathbf{V}$ is a $z\times z$ invertible sub-matrix of $\mathbf{V}_{{\rm In}(S)}$. The columns of the $z\times(O_{K}-z)$ sub-matrix $\mathbf{V}_{1}$ and the rows of the $(I_{S}-z)\times z$ sub-matrix $\mathbf{V}_{2}$ are spanned by the columns and rows of $\mathbf{V}$ respectively, while the rows of the sub-matrix $\mathbf{V}_{3}$ are spanned by the rows of $\mathbf{V}_{1}$. Thus we may rewrite (49) as follows

[TABLE]

Here, $\mathbf{A}$ is an $(I_{S}-z)\times z$ matrix. We now partition the matrix $\mathbf{B}_{S}=\begin{bmatrix}\mathbf{B}_{S,1}&\mathbf{B}_{S,2}\end{bmatrix}$ such that $\mathbf{B}_{S,1}$ and $\mathbf{B}_{S,2}$ are $O_{S}\times z$ and $O_{S}\times(I_{S}-z)$ matrices respectively. Let $\mathbf{B}\triangleq\mathbf{B}_{S}\mathbf{V}_{{\rm In}(S)}$, then by using (50) we obtain the following.

[TABLE]

Here, the matrices $\mathbf{\bar{B}}$ and $\mathbf{\tilde{B}}$ are $O_{S}\times z$ and $O_{S}\times(I_{S}-z)$, respectively. Furthermore, we partition $\mathbf{\bar{B}}=\begin{bmatrix}\mathbf{\bar{B}}^{1}\\ \mathbf{\bar{B}}^{2}\end{bmatrix}$, where $\mathbf{\bar{B}}^{1}$ and $\mathbf{\bar{B}}^{2}$ are $\sigma_{S}\times z$ and $(O_{S}-\sigma_{S})\times z$ sub-matrices respectively. Likewise, we partition $\mathbf{\tilde{B}}=\begin{bmatrix}\mathbf{\tilde{B}}^{1}\\ \mathbf{\tilde{B}}^{2}\end{bmatrix}$. Then, using (50) and (C-B), we may rewrite (20) as follows.

[TABLE]

We now consider partition $\mathbf{\Delta}=\begin{bmatrix}\mathbf{\Delta}_{z}&\mathbf{\hat{\Delta}}\end{bmatrix}$, where $\mathbf{\Delta}_{z}$ consists of the first $z$ columns of $\mathbf{\Delta}$. Then, we have that $\mathbf{\Delta}_{z}=\begin{bmatrix}\mathbf{I}_{\sigma_{K}}&\mathbf{\bar{\Delta}}_{z}\end{bmatrix}$ where $\mathbf{I}_{K}$ is the $\sigma_{K}\times\sigma_{K}$ identity matrix and $\mathbf{\bar{\Delta}}_{z}$ is a $\sigma_{K}\times(z-\sigma_{K})$ matrix whose columns are spanned by $\mathbf{I}_{\sigma_{K}}$. Thus, we see that the $\sigma_{K}$ rows of $\mathbf{\Delta}_{z}$ are linearly independent. We may rewrite (52) as follows.

[TABLE]

Since $\begin{bmatrix}\mathbf{\bar{U}}_{K}&\mathbf{\bar{U}}_{S}\end{bmatrix}$ is invertible, ${\rm rk}(\mathbf{Q})=z$ implies ${\rm rk}(\mathbf{\Phi})=z$. To prove that ${\rm rk}(\mathbf{Q})=z$, we show that the $\sigma_{S}$ rows of $\mathbf{\bar{B}}^{1}+\mathbf{\Gamma}\mathbf{\bar{B}}^{2}$, having dimension $z$, are linearly independent and not spanned by the $\sigma_{K}$ rows of $\mathbf{\Delta}_{z}$.

Given that the entries of the matrix $\mathbf{B}_{S}$ are i.i.d and uniform in $\mathbb{F}_{q}$, for any $\psi\in\mathbb{F}_{q}^{z}$ and for $i\in[O_{S}]$, we compute the probability $\Pr_{\mathbf{B}_{S}}\{(\bar{b})^{i}=\psi\}$, where $(\bar{b})^{i}$ denotes the $i$-th row of $\mathbf{\bar{B}}$ of dimension $z$. From (C-B), we see that

[TABLE]

Here, $(b_{S,1})^{i}$ and $(\mathbf{B}_{S,2}\mathbf{A})^{i}$ denotes the $i$-th row of $\mathbf{B}_{S,1}$ and $\mathbf{B}_{S,2}\mathbf{A}$ respectively. As $\mathbf{V}$ is invertible, we have the following.

[TABLE]

Here, (55) is due to that fact that the entries of $\mathbf{B}_{S,1}$, which is a sub-matrix of $\mathbf{B}_{S}$, are i.i.d. and uniform in $\mathbb{F}_{q}$. From (56), we see that the rows of $\mathbf{\bar{B}}$ are uniform in $\mathbb{F}_{q}^{z}$. For a fixed matrix $\mathbf{B}_{S,2}$ in (54) and due to the invertibility of matrix $\mathbf{V}$, there exists a 1-1 map between $(b_{S,1})^{i}\in\mathbb{F}_{q}^{z}$ and $(\bar{b}^{i})\in\mathbb{F}_{q}^{z}$, for all $i\in[O_{S}]$. Now, as the vectors $(b_{S,1})^{i}$ are chosen independently for each $i\in[O_{S}]$, it follows that the corresponding vectors $(\bar{b}^{i})$ must also be independent for all $i\in[O_{S}]$. This implies that the rows of $\mathbf{\bar{B}}^{1}$, which is a sub-matrix of $\mathbf{\bar{B}}$ containing its first $\sigma_{S}$ rows, are also i.i.d and uniform in $\mathbb{F}_{q}^{z}$.

Let $\mathbf{C}\triangleq\mathbf{\bar{B}}^{1}+\mathbf{\Gamma}\mathbf{\bar{B}}^{2}$ and $c^{i}$ denote the $i$-th row of $\mathbf{C}$ for $i\in[\sigma_{S}]$. For any $\rho\in\mathbb{F}_{q}^{z}$, we compute the probability $\Pr_{\mathbf{\bar{B}}}\{c^{i}=\rho\}$. Denoting the $i$-th rows of $\mathbf{\bar{B}}^{1}$ and $\mathbf{\Gamma}\mathbf{\bar{B}}^{2}$ as $(\bar{b}^{1})^{i}$ and $(\mathbf{\Gamma}\mathbf{\bar{B}}^{2})^{i}$, respectively, we have that,

[TABLE]

Note that the rows of $\mathbf{\bar{B}}^{1}$ form the first $\sigma_{S}$ rows of $\mathbf{\bar{B}}$ and therefore are i.i.d. and uniform in $\mathbb{F}_{q}^{z}$. Thus, by applying the same argument as in (56), we obtain $\Pr_{\mathbf{\bar{B}}}\{c^{i}=\rho\}=\dfrac{1}{q^{z}}$. The vectors $\{c^{i}\}_{i\in[O_{S}]}$ are mutually independent due to the fact that the vectors $\{(\bar{b}^{1})^{i}\}_{i\in[O_{S}]}$ are mutually independent. Thus, as $\sigma_{K}+\sigma_{S}=z$, we have the following.

[TABLE]

This proves our claim.

∎

C-C Proof of Claim 4

.

Let $\mathbf{AB}=\begin{bmatrix}\lambda_{1}&\lambda_{2}&\cdots&\lambda_{n}\end{bmatrix}$, where $\lambda_{j}\in\mathbb{F}_{q}^{n}$ for $j\in[n]$, $\mathbf{A}=\begin{bmatrix}a_{1}&a_{2}&\cdots&a_{m}\end{bmatrix}$, where $a_{i}\in\mathbb{F}_{q}^{n}$ for $i\in[m]$ and $\mathbf{B}=\{b_{i,j}\}_{i\in[m],j\in[n]}$, where $b_{i,j}$’s are i.i.d. and uniform over $\mathbb{F}_{q}$.

For any $j\in[n]$, we have

[TABLE]

For any $\omega\in\mathbb{F}_{q}^{n}$, we first compute $\Pr_{b_{j}}\{\lambda_{j}=\omega\}$, where $b_{j}$ is the $m$-dimensional $j$-th column of $\mathbf{B}$. Since ${\rm rk}(\mathbf{A})=n$, we assume, without loss of generality, that the last $n$ columns of $\mathbf{A}$ are linearly independent. We also partition $b_{j}$ such that $b_{j}=\begin{bmatrix}\bar{b}_{j}\\ \tilde{b}_{j}\end{bmatrix}$ where $\tilde{b}_{j}$ consists of the last $n$ entries of $b_{j}$. Then, we may rewrite (58) as

[TABLE]

Then,

[TABLE]

Since the $n$-dimensional columns $\{a_{i}\}_{i=m-n+1}^{m}$ are linearly independent, the $n$-system of equations $\sum_{i=m-n+1}^{m}a_{i}b_{i,j}=\omega-\hat{\omega}$ must have a unique solution for each $\tilde{b}_{j}\in\mathbb{F}_{q}^{n}$, and as the entries of $\tilde{b}_{j}$ are i.i.d. uniform in $\mathbb{F}_{q}$, we have that $\Pr_{\tilde{b}_{j}}\{\sum_{i=m-n+1}^{m}a_{i}b_{i,j}=\omega-\hat{\omega}\}=1/q^{n}$. Thus, we may rewrite (C-C) as follows.

[TABLE]

Equation (C-C) implies that the columns $\{\lambda_{j}\}_{j\in[n]}$ are uniform in $\mathbb{F}_{q}^{n}$. The columns $\lambda_{j}$ are also mutually independent due to the fact that the columns $b_{j}$ are independent for all $j\in[n]$. Thus, we have

[TABLE]

This proves the claim.

∎