Polytope Codes Against Adversaries in Networks

37 Pages·2014·2 MB·English

3308 IEEETRANSACTIONSONINFORMATIONTHEORY,VOL.60,NO.6,JUNE2014
Polytope Codes Against Adversaries in Networks
Oliver Kosut, Member, IEEE, Lang Tong, Fellow, IEEE, and David N. C. Tse, Fellow, IEEE
Abstract—This paper investigates a network coding problem
wherein an adversary controls a subset of nodes in the network
oflimitedquantitybutunknownlocation.Thisproblemisshown
to be more difficult than that of an adversary controlling a
given number of edges in the network, in that linear codes are
insufficient.Tosolvethenodeproblem,theclassofpolytopecodes
is introduced. Polytope codes are constant composition codes
operating over bounded polytopes in integer vector fields. The
polytope structure creates additional complexity, but it induces
properties on marginal distributions of code vectors so that
validities of codewords can be checked by internal nodes of the
network.Itisshownthatpolytopecodesachieveacut-setbound
for a class of planar networks. It is also shown that this cut-set
bound is not always tight, and a tighter bound is given for an
example network.
Index Terms—Active adversaries, Byzantine attack, network
Fig.1. TheCockroachnetwork. Alledgeshaveunitcapacity. Thenetwork
coding, network error correction, nonlinear codes, polytope
capacitywithonetraitornodeis2,butnolinearcodecanachievearatehigher
codes, security.
than 4/3 (proved in Appendix A). A capacity-achieving code wherein linear
I. INTRODUCTION operations are supplemented by nonlinear comparisons is given in Sec. V,
andacapacity-achieving PolytopeCodeisgiven inSec.VII.
NETWORKcodingallowsroutersinanetworktoexecute
only linear networkcoding is needed.Furthermore,if there is
possiblycomplexcodesinadditiontorouting;ithasbeen
just one source and one destination, coding is needed only at
shownthatallowingthemtodosocanincreasecommunication
the source node; internal nodes need only do routing.
rate [1]. However, taking advantage of coding at internal
The above model assumes that any set of z edges may
nodes means that sources and destinations must rely on other
be adversarial, which may not accurately reflect all types of
nodes—nodes they may not have complete control over—to
attacks. This model is accurate if the attacker is able to cut
reliably perform certain functions. If these internal nodes do
transmission lines and change messages that are sent along
notbehavecorrectly,or,worse,maliciouslyattempttosubvert
them.However,if instead the attackeris able to seize a router
the goals of the users—constituting a so-called Byzantine
in a network, it will control the values on all links connected
attack [2], [3]—standard network coding techniques fail.
to that router. Depending on which router is attacked, the
Supposeanomniscientadversarycontrolsan unknownpor-
number of the links controlled by the adversary may vary.
tion of the network, and may arbitrarily corrupt the transmis-
In an effort to more accurately model this situation, in this
sions on certain communication links. We wish to determine
paper we assume that the adversary may control any set of
how the size of the adversarial part of the network influences
s nodes. We focus on the problem of a single unicast (one
reliablecommunicationrates.Iftheadversarymaycontrolany
source sending a message to one destination). We emphasize
z unit-capacityedgesin the network,then itwas shownin [4]
that with adversarial nodes, even unicast is an open problem.
and[5]thatforthemulticastproblem(onesourcesendingthe
Defeating node-based attacks is fundamentally different
same message to many destinations), the capacity reduces by
from defeating edge-based attacks. First, the edge problem
2z comparedtotheno-adversaryproblem.Toachievethisrate,
does not immediately solve the node problem. Consider, for
Manuscript received December 14, 2011; revised May29, 2013; accepted example, the Cockroach network, shown in Fig. 1. Suppose
March 4, 2014. Date of publication April 1, 2014; date of current version we wish to handle any single adversarialnode in the network
May 15, 2014. This work was supported in part by the National Science (i.e.s =1).Onesimpleapproachwouldbetoapplytheedge-
Foundation under Award CCF-0635070 and in part by the Army Research
OfficeunderGrantAROW911NF-06-1-0346.Thispaperwaspresentedatthe based result from [4], [5]: no node controls more than two
2009 Allerton Conference on Communication, Control and Computing, and unit-capacity edges, so we can defeat the node-based attack
the2010IEEEInternational SymposiumonInformationTheory.
byusingacodethatcanhandleadversarialcontrolofanytwo
O. Kosut is with the School of Electrical, Computer and Energy
Engineering, Arizona State University, Tempe, AZ 85287 USA (e-mail: edges (i.e. set z = 2). However, the no-adversary capacity of
[email protected]). thisnetworkis4,sotheresultingratelossof2z leavesuswith
L.TongiswiththeSchoolofElectricalandComputerEngineering,Cornell
an achievable rate of 0. As we will show, the actual capacity
University, Ithaca, NY14853USA(e-mail:[email protected]).
D. N. C. Tse is with the Department of Electrical Engineering, Stanford oftheCockroachnetworkwithonetraitornodeis2.Ineffect,
University, Stanford, CA94305USA(e-mail:[email protected]). relaxing the node attack problem to the edge attack problem
Communicated by M. Motani, Associate Editor for Communication
is too pessimistic, and we can do better if we treat the node
Networks.
Digital ObjectIdentifier 10.1109/TIT.2014.2314642 problem differently.
0018-9448©2014IEEE.Translations andcontent miningarepermitted foracademic researchonly. Personaluseisalsopermitted,
butrepublication/redistribution requires IEEEpermission. Seehttp://www.ieee.org/publications_standards/publications/rights/index.html formoreinformation.
KOSUTetal.: POLYTOPECODESAGAINSTADVERSARIESINNETWORKS 3309
Node-basedattacksandedge-basedattacksdifferinaneven studied for wireless network coding in [11], is for nodes to
more fundamental way. If the adversary may control any z police downstream nodes by overhearing their messages to
unit-capacity edges, it is clear that it should always take over detect modifications. In [12], a similar approachis taken, and
edges on the minimum cut of the network. However, if the they found that nonlinear operations similar to ours can be
adversary may control any s nodes, it is not so obvious: it helpful, in which comparisons are made to detect errors.
may have to choose between proximity to the min-cut and
B. Main Results
the number of output edges. For example, in the Cockroach
network, node 4 has only one output edge, but it is on the Many achievability results in network coding have been
min-cut (which divides nodes S,1,2,3,4,5 from D); node 1 proved using linear codes over a finite field. In this paper we
has two output edges, so apparently more power, but it is demonstratethatlinearcodesareinsufficientforthisproblem.
one step removed from the min-cut, and therefore its impact Moreover,wedevelopaclassofcodescalledPolytopeCodes,
may be diminished. This uncertainty about where a network originally introduced in [9] under the less descriptive term
is most vulnerable seems to make the problem hard. Indeed, “bounded-linearcodes”.PolytopeCodesareusedtoprovethat
we find that many standard network coding techniques—in a cut-set bound, stated and proved in Sec. III, is tight for a
particular, linear codes over a finite field—fail to achieve certain class of networks. Polytope Codes differ from linear
capacity. We introduce a new class of nonlinear codes called codes in three ways:
Polytope Codes that can do better. 1) Comparisons: A significant tool we use to defeat the
It thispaper(as in [4] and [5])we always assume an omni- adversary is that internal nodes in the network perform
scient adversary. It was shown in [6] that for the edge-based comparisons: they check whether their received data
attack model, achievable rates depend on the eavesdropping could have occurred if all nodes had been honest.
capability of the adversary. The omniscient adversary is one If not, then there must be an upstream traitor that
thathascompleteeavesdroppingpower:itknowsthemessage, altered one of the received values, in which case this
it knows the code, and it knows all messages sent in the traitor can be localized. The result of the comparison,
network. This may be an overly pessimistic model for many a bit signifying whether or not it succeeded, can be
cases, but it has the advantage that any strategy formulated transmitteddownstreamthroughthenetwork.Thedesti-
against this model is guaranteed to work against a weaker nation receives these comparison bits and uses them to
adversary. In addition, for example in wireless settings, one determine who may be the traitors, and how to decode.
expects an adversary’s eavesdropping capability to be greater These comparison operations are nonlinear, and, as we
that its ability to impersonate nodes. will demonstrate in Sec. V, incorporating them into a
standard finite-field linear code can increase achieved
A. Related Work
rate. However,evenstandardlinear codessupplemented
Byzantine attacks on network coding were first studied by these nonlinear comparison operations appears to
in [7], which looked at the problem of detecting adversaries be insufficient to achieve capacity in general. Polytope
in a random linear coding environment. The z unit-capacity Codes also incorporate comparisons, but of a more
edge adversary problem was solved in [4] and [5]. In [6], sophisticated variety.
the same problem is studied, providing distributed and low 2) Constant Composition Codebooks: Unlike usual linear
complexity coding algorithms to achieve the same asymptot- network codes, Polytope Codes are essentially constant
ically optimal rates. In addition, [6] looks at two adversary composition codes [13]. In particular, each Polytope
modelswith limited eavesdroppingcapability.Theyshow that Code is governed by a joint probability distribution
higher rates can be achieved under these alternate models. on a set of random variables, one for each edge in
In[8],a moregeneralviewoftheadversaryproblemisgiven, the network. The codebook is composed of the set
wherebythenetworkitselfisabstractedintoanarbitrarylinear of all sequences with joint type exactly equal to this
transformation. distribution. The advantage of this method of code
Network coding under Byzantine attacks that are more constructionisthataninternalnodeknowsexactlywhat
general than the simple edge-based model was first studied joint type to expect of its received sequences, because
in [9], a conference version of this work, and [10]. The latter it knows the original distribution. In a Polytope Code,
looked at the problem of edge-based attacks when the edges comparisons performed inside the network consist of
mayhaveunequalcapacities.Thisproblemwasfoundtohave checking whether the observed joint type matches the
similarcomplicationstothenode-basedproblem.Inparticular, expected distribution. If it does not, then the adversary
both [9] and [10] found that linear coding is suboptimal, and must have influenced one of the received sequences, so
that simple nonlinear operations used to augment a linear it can be localized.
code can improve throughput. Indeed, [10] used a network 3) Distributions Over Polytopes: The final difference
almost identical to what we call the Cockroach network to between linear codes and Polytope Codes—and the one
demonstrate that nonlinear operations are necessary for the for which the latter are named—comes from the nature
unequal edge problem. We show in Sec. XI that the unequal- oftheprobabilitydistributionsthatformthebasisofthe
capacity edge problem is subsumed by the node problem. code,asdescribedabove.Theyareuniformdistributions
Theseworksseek tocorrectfortheadversarialerrorsatthe over the set of integer lattice points on polytopes in
destination. An alternative strategy known as the watchdog, real vector fields. This choice for distribution provides
3310 IEEETRANSACTIONSONINFORMATIONTHEORY,VOL.60,NO.6,JUNE2014
two useful properties. First, the entropy function for nodes. Let Z be the set of values on these edges. For a
T
these distributionscan be easily calculated merely from particular code, specifying the message w as well as Z
T
propertiesofthelinearspaceinwhichthepolytopesits. determines exactly the values on all edges in the network,
For this reason, they share characteristics with finite- in addition to the destination’s estimate wˆ. A rate R is
field linear codes. In fact, a linear code can typically achievable if there exists a code operating at that rate with
be converted into a Polytope Code achieving the same some blocklength n such that for all messages, all sets of
rate.1 Thesecondusefulpropertyhastodowithhowthe traitorsT,andallvaluesofZ ,w =wˆ.Thatis,thedestination
T
comparisonsinside the network are used. These distrib- always decodes correctly no matter what the adversary does.
utionsare such that if enoughcomparisonssucceed, the Let the capacity C be the supremum of all achievable rates.
adversaryisforcedtoactasanhonestnodeandtransmit Notation: For a positive integer a, we write [a] :=
correct information. We consider this to be the funda- {1,2,...,a}. For an edge e ∈ E, with e = (i, j), where
mentalpropertyofPolytopeCodes.Itwillbeelaborated i, j ∈ V, let head(e) = j and tail(e) = i. For a node i ∈ V,
in examples in Sec. VI and Sec. VII, and then stated in let E (i) be the set of edges e with head(e) = i, and let
in
its most general form as Theorem 4 in Sec. VIII. E (i) be the set of edges e with tail(e) = i. Let N (i) be
out in
We formulate the problem in Sec. II. After stating and the set of input neighbors of i; that is, the set of tail(e) for
proving a cut-set bound in Sec. III, in Sec. IV we state an each e ∈ Ein(i). Similarly, let Nout(i) be the set of output
achievabilityboundthatis provedusingPolytopeCodes. This neighbors of i. For integers a,b, let Va,b be the set of nodes
bound is used to show that the cut-set boundcan be achieved with a inputs and b outputs. We will refer to such nodes
for a class of planar networks. Planarity requires that the as a-to-b nodes. For l ∈ {1,2}, let l¯ = 2 − l. A path p
graph can be embedded in a plane such that intersections is defined as an ordered list alternating between nodes and
between edges occur only at nodes. This ensures that enough edgesp=(v1,e1,v2,e2,...,vk,eL,vL+1) where vl ∈V and
opportunitiesforcomparisonsareavailable,allowingthecode el ∈ E, and where tail(el) = vl and head(el) = vl+1 for
to defeat the adversary. Achievability is proved in Sec. IX, l ∈ [L]. The tail and head of a path are defined as v1 and
but first we develop the theory of Polytope Codes through vL+1 respectively.For an edgee, we write e ∈p if e is in the
several examples in Sec. V–VII. In addition, we study the list defining p, and for a node v we define v ∈ p similarly.
relationship between linear codes and Polytope Codes in A node i is said to reach a node j if there exists a path with
Sec. X, and in Sec. XI we prove an upper bound that is tail i and head j. By convention, a node can reach itself.
strictly tighterthanthecut-setboundforanexamplenetwork.
We conclude in Section XII. The appendices contain several
III. CUT-SET UPPERBOUND
auxiliary results and proofs.
Itisshownin[4]and[5]thatifanadversarycontrolsz unit-
II. PROBLEM FORMULATION capacity edges, the network coding capacity reduces by 2z.
Let (V,E) be an directed acyclic graph. We assume all Thisisaspecialcaseofamoregeneralprinciple:anadversary-
edges have unit capacity, and there may be more than one controlledpartofthenetworkdoesasmuchdamageinrateas
edge connectingthe same pair of nodes. We consider a single ifa partofnetworktwice aslargeweremerelyremoved.This
unicast: one node in V is denoted S, the source, and one is doublingeffectis forthe same reasonthat, in a classical error
denoted D, the destination. We wish to determine the maxi- correction code, the Hamming distance between codewords
mumachievablecommunicationratefromSto Dwhenanyset must be at least twice the number of errors to be corrected;
ofs nodesin V\{S,D} aretraitors;i.e.theyarecontrolledby this is the Singletonbound[14].Theorem1 is a cut-set upper
theadversary.Givenarate Randablocklengthn,themessage bound that generalizes the Singleton bound and its analogue
w is chosen at random from the set {1,...,2nR}. Each edge in [4] and [5] to the node-based adversary problem. We state
e ∈ E holds a value X ∈{1,...,2n}. and prove the bound after the following definitions.
e
A code is made up of three components: We define a cut in a network as a subset of nodes A ⊂ V
1) an encoding function at the source, which takes the containing the source but not the destination. Given a cut A,
message as input and produces values to place on all a forward edge is an edge (i, j) ∈ E with i ∈/ A and j ∈ A.
output edges, Abackwardedgeisanedge(i, j)∈ E withi ∈/ A and j ∈ A.
2) a coding function at each internal node i ∈ V\{S,D}, Theorem 1: Fix a cut A with no backwardedges, anda set
which takes the values on all input edges to i, and U ⊂ V \{S,D} with |U| = 2s. (Recall s is the number of
produces values to place on all output edges from i, traitor nodes.) The capacity is upper bounded by
3) and a decoding function at the destination, which takes
C ≤|{(i, j)∈ E :i ∈ A\U, j ∈/ A}|. (1)
the values on all input edges and produces an estimate
wˆ of the message. Proof: Divide U into two sets T1 and T2 with |T1| =
|T | = s. Let E and E be the sets of forward edges for
Suppose T ⊆ V \{S,D} is the set of traitors, with |T| = s. 2 1 2 ¯
the cut A out of nodes in T and T respectively. Let E be
They may subvert the coding functions at nodes i ∈ T by 1 2
the set of all forward edges not out of nodes in T or T .
1 2
placing arbitrary values on all the output edges from these
Observe that the upper bound in (1) is precisely the total
¯
1There would be no reason to do this in practice, since Polytope Codes capacity of all edges in E. Note also that, since there are
¯
requiremuchlongerblocklengths. SeeSec.Xformoredetails. no backward edges for the cut A, the values on edges in E
KOSUTetal.: POLYTOPECODESAGAINSTADVERSARIESINNETWORKS 3311
be shown in Sec. V using a linear code supplemented by
comparisonoperations,andagaininSec.VIIusingaPolytope
Code.
2) Discussion of Theorem 1: In traditionalnetworkcoding,
without adversaries, backward edges are not relevant to the
cut-set bound; the bound is simply the sum of the capacities
of all forward edges. As illustrated in Theorem 1, backward
edges matter in the adversarial problem. This is because the
boundrequiresthatforwardedgescontrolledbytheadversary
donotinfluenceforwardedgesnotcontrolledbytheadversary.
(In the notation of the proof of Theorem 1, E and E
1 2
¯
do not influence E.) This is not guaranteed in the presence
of a backward edge. In Appendix B, we give an example
network where the right-hand side of (1) is strictly smaller
Fig.2. DiagramoftheproofofTheorem1.Thevaluesonthelinkscrossing
than capacity, due to a backward edge. Theorem 1 resolves
the cut are such that it is impossible to determine whether T1 or T2 is the
truesetoftraitors, andwhichofw1 orw2 isthetruemessage. the backward edge problem by restricting to cuts without
backward edges. Theorem 1 will be strong enough to find
the capacity of the class of planar networks to be specified
are not influenced by the values on edges in E1 or E2. This in Sec. IV, but for the general problem it can be tightened.
setup is diagrammed in Fig. 2. We state and prove a tighter version of the cut-set bound in
Suppose (1) does not hold. Therefore there exists a code Appendix C. Unlike the problem without adversaries, there
with blocklength n achieving a rate R higher than the right appears to be no straightforward notion of a cut-set bound.
hand side of (1). For any set of edges F ⊆ E, for this code, Some evenmoreelaborateboundsare foundin [10]and [15].
we can define a function These papersstudy the unequal-edgeproblem,butthe bounds
(cid:2)
can be readily applied to the node problem.
X :[2nR]→ [2n] (2)
F It was originally conjectured in [10] that even the best cut-
e∈F set bound is not tight in general. In Sec. XI, we demonstrate
suchthatforamessagew,assumingallnodesacthonestly,the thattherecanbeanactiveupperboundoncapacityfundamen-
values on edges in F is given by X (w). Since R is greater tallyunlikeacut-setbound.Theexampleusedtodemonstrate
F
¯
than the total capacity for all edges in E, there exists two this, though it is a node adversary problem, can be easily
messages w1 and w2 such that XE¯(w1)= XE¯(w2). modified to confirm the conjecture stated in [10].
We demonstrate that it is possible for the adversary to
confuse the message w with w . Suppose w were the true IV. ACHIEVABILITY BOUNDS
1 2 1
message, and the traitors are T . The traitors replace the We define the following properties a network (V,E) may
1
values sent along edges in E with X (w ). If there are satisfy:
1 E1 2
edges out of nodes in T that are not in E —i.e. they do 2-OUT: No node other than the source has more than
1 1
not cross the cut—the traitors do not alter the valueson these two output edges.
¯
edges. Thus, the values sent along edges in E are given by IN-OUT:Nonodeotherthanthesourcehasmoreoutput
XE¯(w1). Now suppose w2 were the true message, and the edges than input edges.
traitors are T . They replace the messages going along edges PLANAR: The graph defined by (V,E) is planar.
2
in E with X (w ),againleavingallotheredgesalone.Note Almost all networks we study in this paper satisfy 2-OUT
2 E2 1
that in both these cases, the values on E are X (w ), the and IN-OUT. The following theorem gives the capacity for
values on E2 are XE2(w1), and the values1on E¯ aEre1 XE2¯(w1). networks also satisfying PLANAR with one traitor. It is
This comprises all edges crossing the cut, so the destination a consequence of Theorem 3 and Lemma 1, stated below.
receives the same values under each case; therefore it cannot Theorem 2: Let s = 1, and let (V,E) be a network
distinguish w from w . satisfying 2-OUT, IN-OUT, and PLANAR. The capacity is
1 2
1) Example Use of Theorem 1: We illustrate the use of equal to the cut-set bound given in Theorem 1.
Theorem 1 on the Cockroach network, as shown in Fig. 1, Perhaps the most interesting condition in the statement of
with a single adversary node (i.e. s = 1). To apply the Theorem 2 is PLANAR. Recall that a graph is said to be
bound, we choose a cut A and a set U with |U| = 2s = 2. embedded ina surface(typicallyatwo-dimensionalmanifold)
Take A = {S,1,2,3,4,5}, and U = {1,4}. There are no whenit isdrawnin thissurface so thatedgesintersectonlyat
backwardedges,andfourforwardedges,buttheonlyforward nodes. A graph is planar if it can be embedded in the plane.
edges not out of nodes U are (3,D) and (5,D). Hence, However, we will prove a stronger achievability bound than
by Theorem 1, the capacity is at most 2. Alternatively, we Theorem2thatalsoappliestonon-planargraphs,basedonan
could take A = {S,1,2,3} and U = {1,2}, again yielding additional network property that we define in several steps as
an upper bound of 2. It is not hard to see that 2 is the follows.
smallest upper bound given by Theorem 1 for the capacity Let M be the numberof edgesconnectedto the destination
oftheCockroachnetwork.Infact,rate2isachievable,aswill (i.e. M = |E (D)|). Note that for any network satisfying
in
3312 IEEETRANSACTIONSONINFORMATIONTHEORY,VOL.60,NO.6,JUNE2014
Fig.3. Examplesofnon-planarnetworks.Subplot(a)showsanetworksatisfyingPATHSbutnotPLANAR.Thetwopathspv areindicatedbyboldedges.
Subplot (b) shows anetwork satisfying neither PATHSnor PLANAR. Both networks have M =6and cut-set bound M−2=4.ByTheorem 3,rate 4is
achievable fornetwork(a),butthetheorem onlyassertsthatrate3isachievable fornetwork (b).Infact,thecapacity ofnetwork(b)isunknown.
IN-OUT, no node has more output edges than input edges, 1) The capacity satisfies C ≥ M −4.
so the min-cut is that between the destination and the rest 2) Ifthecut-setboundgivenbyTheorem1isatleast M−3,
of the network. Hence, the value of the min-cut is M. For then C ≥ M −3.
each node v with exactly one more input than output (i.e. 3) If (V,E) satisfies PATHS, then C = M −2.
a 2-to-1 node or a 3-to-2 node), let (cid:2)v be the set of nodes 4) The cut-set bound is not greater than M −2.
i such that v is the only node reachable from i with more Note that if the cut-set bound is no more than M − 3,
inputs than outputs. Define the following condition on a then Theorem 3 already establishes Theorem 2. The follow-
network (V,E): ing lemma, proved in Appendix D, completes the proof of
PATHS: For each a-to-b node with a > b, there exists Theorem 2.
b−a paths pv,i for i ∈[a−b] such that tail(pv,i)= S, Lemma 1: If a network (V,E) satisfies 2-OUT, IN-OUT,
head(pv,i)=v, all paths are edge-independent,and and PLANAR, and the cut-set bound with s = 1 is M −2,
(cid:3) (cid:3) then the network also satisfies PATHS.
Nin(D)∪ (cid:2)v ⊂ pv,i. (3) Polytope Codes are used to prove achievability for Theo-
a>0 a,b∈Z rem 3 (and hence Theorem 2). Before proving the theorem,
v∈Va+1,a v∈Va,b we develop Polytope Codes by means of several examples in
i∈[b−a]
Sec. V–VII, and then we describe their general properties of
For a-to-b nodes v with a − b = 1, we adopt the sim- in Sec. VIII.
plified notation pv := pv,1. The Cockroach network can
be easily seen to satisfy PATHS: The only nodes in the
V. A LINEARCODE WITH COMPARISONS
Cockroach network with more inputs than outputs are the
FORTHECOCKROACH NETWORK
2-to-1 nodes4 and 5. Moreover(cid:2) ={1,4}, (cid:2) ={3,5}, and
4 5
N (D)={1,3,4,5}. We may satisfy (3) by setting TheCockroachnetworkiseasilyseentosatisfy2-OUTand
in
(cid:4) (cid:5) IN-OUT. Fig 1 shows a plane embedding; hence it satisfies
p4 := (cid:4)S,(S,1),1,(1,4),4(cid:5) (4) PLANAR.Pathspv satisfying(3)weregivenin(4)–(5);hence
p := S,(S,3),3,(3,5),5 . (5) it also satisfies PATHS. Therefore, since the smallest cut-set
5
bound given by Theorem 1 for a single traitor node is 2,
Fig. 3 illustrates PATHS for two non-planar graphs. Fig. 3(a) Theorem 2 (or Theorem 3) asserts that the capacity of the
shows a network satisfying PATHS but not PLANAR, and Cockroachnetworkis2.Inthissection,wepresentacapacity-
Fig. 3(b) shows a network satisfying neither PATHS nor achieving code for the Cockroach network that is composed
PLANAR. As we show in Lemma 1, stated below, the con- of a linear code over a finite-field supplemented by nonlinear
dition PATHS is a more general one than PLANAR. The comparisons. This illustrates the usefulness of comparisons
usefulness of PATHS will become clear after we develop the in defeating adversaries network coding. Before doing so, we
theory of Polytope Codes in Sec. V–VIII. provideanintuitiveargumentthatlinearcodesareinsufficient.
The following theorem is our most general achievability A more technical proofthat the linear capacity is 4/3 is given
bound. It is proved in Sec. IX. in Appendix A.
Theorem 3: Let s = 1, and let the network (V,E) satisfy Is it possible to construct a linear code achieving
2-OUT and IN-OUT. rate 2 for the Cockroach network? We know from the
KOSUTetal.: POLYTOPECODESAGAINSTADVERSARIESINNETWORKS 3313
symbols = or (cid:9)=. If the two received copies of y agree, it
sends=,otherwiseitsends(cid:9)=.Thelink(4,D) canaccommo-
date this, since it may have up to 2pk messages placed on it.
Node5 doesthe same with its two copiesofthe vector x+y.
The destination’s decoding strategy depends on the two
comparison bits sent from nodes 4 and 5, as follows:
• If node 5 sends (cid:9)= but node 4 sends =, then the traitor
must be one of nodes 1, 2, or 4. In any case, the vector
x −y received from node 3 is certainly trustworthy.
Moreover,x+y canbetrusted,becauseevenifnode2 is
the traitor, its transmission must have matched whatever
was sent by node 3; if not, node 5 would have transmit-
ted (cid:9)=. Thereforethe destinationcan trustboth x+y and
x−y,fromwhichitcandecodethemessagew=(x,y).
• If node 5 sends (cid:9)= but node 4 sends =, then we are in
Fig.4. AnonlinearcodefortheCockroachNetworkachievingthecapacity the symmetric situation and can reliably decode w from
of2.
x and y.
• If both nodes 4 and 5 send (cid:9)=, then the traitor must be
argument underlying the Singleton bound—and the proof of node2, in whichcase the destinationcanreliable decode
Theorem1—that,inordertodefeatasingletraitornode,ifwe from x and x −y.
take out everything controlled by two nodes, the destination • If both messages are =, then the destination cannot
must be able to decode from whatever remains. Suppose we eliminate any node as a possible traitor. However, we
take out nodes 2 and 3. These nodes certainly control the claim that at most one of x,y,x + y,x − y can have
values on (5,D) and (3,D), so if we hope to achieve rate 2, been corrupted by the traitor. If node 1 is the traitor, it
the values on (1,D) and (4,D) must be incorruptible by may choose whatever it wants for x, and the destination
nodes 2 and 3. Edge (1,D) is not a problem, but consider would never know. However, node 1 cannot impact the
(4,D). With a linear code, the value on this edge is a linear valueof y withoutinducinga(cid:9)=,becauseitstransmission
combinationofthevalueson(1,4)and(2,4).Inordertokeep to node 4 is verified against that from node 2. Similarly,
the value on (4,D) incorruptible by node 2, the coefficient node 3 controls x − y but not x + y. Nodes 4 and 5
used to construct the value on (4,D) from (2,4) must be control only y and x + y respectively. Node 2 controls
zero. In other words, node 4 must ignore the value on (2,4) nothing, because both y and x + y are checked against
when constructing the value it sends on (4,D). If this is the othertransmissions.Therefore,if thedestinationcan find
case, we lose nothing by removing (2,4) from the network. three of x,y,x +y,x −y that all agree on the message
However, without this edge, we may apply Theorem 1 with w, then this message must be the truth because only one
A ={S,1,2,3} and U ={1,3} to conclude that the capacity of the four could be corrupted, and w can be decoded
is no more than 1. Therefore no linear code can successfully fromthe othertwo. Conversely,theremustbe a groupof
achieve rate 2. three of x,y,x + y,x +2y that agree, because at most
This argument does not rigorously show that the linear onehasbeencorrupted.Hence,thedestinationcanalways
capacity is less than 2, because it shows only that a linear decode w.
code cannot achieve exactly rate 2, but it does not bound the Even though our general proof of Theorem 2 uses a Poly-
achievableratewitha linearcodeawayfrom2.However,itis topeCode, which differssignificantlyfromthis one,the man-
meanttobeanintuitiveexplanationforthelimitationsoflinear ner in which the comparisons comes into play is essentially
codes for this problem, as compared with the successful non- the same. The key insight is to consider the code from the
linear codes that we will subsequently present. The complete perspectiveofthetraitor.Supposeitisnode1,andconsiderthe
proof that the linear capacity is 4/3 is given in Appendix A. choiceofwhatvaluefory tosendalongedge(1,4).Ifitsends
We now introduce a nonlinear code to achieve the capacity a false value for y, then the comparison at node 4 will fail,
of 2. We work in the finite field of p elements. Let the whichwillleadthedestinationtosuspecttheupperpartofthe
messagewbea2k-lengthvectorsplitintotwok-lengthvectors network, and thereby ignore all values influenced by node 1.
x and y. We will use a blocklengthlarge enoughto place one The only other choice for node 1 is to cause the comparison
of 2pk values on each link. In particular, this is enough so at node 4 to succeed; but this requires sending the true value
that a link can hold some linear combination of x and y, as of y, which means it has no hope to corrupt the decoding
well as one additional bit. For large enough k, this extra bit process. This is the general principle that makes our codes
becomes insignificant, so the code achieves rate 2. work: force the traitor to choose between acting honestly, or
The scheme is shown in Figure 4. Node 4 receives the acting otherwise and thereby giving away its position.
vector y from both nodes 1 and 2. It forwards one of We make one further note on this code, regarding why
these copies to D (it does not matter which). In addition, it the specific approach used here for the Cockroach network
performs a nonlinear comparison between the two received fails on the more general problem. Recall that in order to
copies of y, resulting in a bit comprised of one of the special make an effective comparison, the values sent along edges
3314 IEEETRANSACTIONSONINFORMATIONTHEORY,VOL.60,NO.6,JUNE2014
satisfyingthispropertyis totakethe massagetobecomposed
of two elements x,y of a finite field, and transmit on these
four edges x,y,x+y,x−y. However, as we will show, this
choice does not succeed.
Foranycode,wemayassumewithoutlossofgeneralitythat
nodes 5–8 forward whatever they receive on their incoming
edges to all their outgoing edges. Any code that does not
havethispropertycanbeconvertedintoonethatdoeswithout
changing the achieved rate. For example, suppose node 5
transmits something different along (5,9) than it received
along (1,5). Let x(5,9) and x(1,5) be these two values respec-
tively. There is some function f such that x(5,9) = f(x(1,5)).
We construct a new code where instead x(5,9) = x(1,5), and
thennode9computes f(x(5,9))andproceedsasintheoriginal
Fig. 5. The Caterpillar Network. All edges have unit capacity. One node
maybeatraitor, butonlyoneoftheblacknodes:nodes1–4. code with this value in place of x(5,9). All other values are
unaffected, so the rate does not change. The same argument
can be used for all edges out of nodes 5–8.2
(1,4) and (2,4) needed to be exactly the same. If they had Now consider the two edges (9,D) and (10,D). As these
been independent vectors, no comparison could be useful. aretheonlyedgesincidenttothedestination,toachieverate2,
This highly constrains the construction of the code. While it both must hold values guaranteed to be uncorrupted by the
succeeds for the Cockroach network, it fails for many other traitor. Consider, in particular, the operation at node 9. Since,
examples, such as the Caterpillar network to be introduced as argued above, nodes 5–8 forward whatever they receive,
in the next section. The advantage of the Polytope Code node 9 receives three of the four values sent from nodes
is that it relaxes the constraint on the values that must be 1–4. That is, in a capacity-achieving code, node 9 receives
available in order to form a useful comparison; in fact, it the values sent on edges (1,5),(2,6),(3,7) (one of which
becomes possible to have useful comparisons between nearly may be corrupted) and constructs a trustworthy value to send
independentvariables, which is not possible with a code built on (9,D).
on a finite-field. Given the properties derived above for any code achieving
rate2,howcanweconstructsuchacode?Thekeyproblemis
VI. AN EXAMPLEPOLYTOPE CODE: todesignvaluesonedges(1,5),(2,6),(3,7)thatarepairwise
THECATERPILLARNETWORK independent, but such that if one of them is corrupted, one
can construct a trustworthy value to transmit on (9,D). The
The Caterpillar Networkis shown in Figure 5. We consider
finitefieldexamplementionedabovewouldnotwork:Suppose
a slightly different version of the node-based attack on this
node 9 receives values for x,y,x + y, one of which may be
network: at most one node may be a traitor, but only nodes
corrupted by the traitor. If the linear constraint among these
1–4.ThisnetworkdoesnotsatisfytheconditionsofTheorem2
three values does not hold—that is, if the received value for
or 3, but we introduce it in order to motivate the Polytope
x+y doesnotmatchthesumofthevaluefor x andthevalue
Code.
for y—then any of the three values may be the incorrectone.
Even though this problem differs from the one defined
Therefore, from node 9’s perspective, any of nodes 1, 2, or 3
earlierinthatnoteverynodeinthenetworkmaybeatraitor,it
couldbethetraitor.Onewaytoproduceatrustworthysymbol
iseasytoseethatwemaystillapplythecut-setboundofThe-
is to correctly conclude that one of these three nodes is not
orem1aslongaswetakethesetU tobeasubsetoftheallow-
able traitors. If we apply Theorem 1 with A = {S,1,2,3,4} the traitor. If, for example, it could determine that the traitor
was node 1 or node 2 but not node 3, then the value sent
and U = {1,2}, we find that the capacity of this network is
along (3,7) could be forwardedto (9,D) with a guaranteeof
no more than 2. As we will show, the capacity is 2. Before
correctness. A Polytope Code allows for precisely this.
proving this, we pause to develop intuition for the problem.
A. Properties of Capacity-Achieving Codes B. Coding Strategy
Suppose we are given a code that achieves rate 2. What We now begin to describe a capacity-achieving Polytope
propertiesmustithave?Thefollowinganalysisisnotrigorous, Codeforthe Caterpillarnetwork.We dosofirstbydescribing
but we provide it to build intuition for the Polytope Code how the code is built out of a probability distribution, and
solution. Of the four values on the edges (1,5), (2,6), (3,7), the properties we need this probability distribution to satisfy.
and(4,8),onemaybecorruptedbytheadversary.Thismeans Subsequently,wegiveanexplicitconstructionforaprobability
that in any capacity-achieving code, these four values form
a (4,2) MDS code. That is, given any uncorrupted pair of 2Thisargument—and,indeed,muchofthepaper—reliesonthefactthatthe
thesefourvalues,itispossibletodecodethemessageexactly. adversary is omniscient. If instead the adversary had limited eavesdropping
capability,asin[16],thentheremightbereasontohidedatasentalongsome
Since each edgehascapacity1, in orderto achieverate 2, the
edgesevenifnotlimitedbylinkcapacity.Becauseweassumeanomniscient
valuesoneachpairofedgesareindependent.Anexamplecode adversary,this isnotaconcern.
KOSUTetal.: POLYTOPECODESAGAINSTADVERSARIESINNETWORKS 3315
distribution derived from a polytope, and show that it has the because of the traitor at most one of these may differ from
desired properties. xn,yn,zn,wn. Let random variables X˜,Y˜,Z˜,W˜ have joint
Let X,Y,Z,W bejointlydistributedrandomvariables,each distribution equal to the joint type of (x˜n,y˜n,z˜n,w˜n). This
definedoverthefinitealphabetX.Assumeallprobabilitieson is a formal definition; these variables do not exist per se
theserandomvariablesarerational.LetTn(XYZW)∈X4n be in the network, but defining them makes it convenient to
the set of joint sequences (xnynznwn) with joint type equal describe the behavior of the code. Since node 9 receives
to the distribution on X,Y,Z,W. Our coding strategy will x˜n,y˜n,z˜n,itknowsexactlythejointdistributionof X˜,Y˜,Z˜.In
be to associate each element of Tn(XYZW) with a distinct particular,itcancheckwhichof (8)–(11)aresatisfiedforthese
message. Given the message, we find the associated four variables.
sequencesxn,yn,zn,wn,andtransmitthemonthefouredges Suppose(11)holds.Thenallthree sequencesx˜n,y˜n,z˜n are
out of nodes 1, 2, 3, 4 respectively. trustworthy, because if a traitor is among nodes 1–3, it must
Typically used in a channel coding context, a constant have transmitted the true value of its output sequence, or else
composition code [13] is one in which every codeword has theempiricaltypewouldnotmatch,duetoProperty2. Inthis
the same type. We are using a similar strategy here, in that case, node 9 forwards x˜n to the destination, confident that it
(xnynznwn) always has the same type. Our reason for using is correct.Meanwhile,node 10 can also observe X˜,Y˜,Z˜, and
a constant composition code is that it can be used to detect so it forwards y˜n to the destination.
the traitor; that is, if the observed type differs from the Now suppose (11) does not hold. Then by Property 3,
anticipatedtype,thenthe traitormusthavetouchedoneofthe one of (8)–(10) must not hold. Suppose, for example, that
sequences. (X˜,Y˜) (cid:9)∼ (X,Y). Because of our constant composition code
We now calculate the rate achieved by the code described construction, this can only occur if either node 1 or 2 is
above.Forn suchthatTn(XYZW)isnotempty,abasicresult the traitor. Hence, node 3 is honest, so Node 9 forwards z˜n
from the theory of types states that to the destination without error. Similarly, no matter which
pairwise distribution does not match, node 9 always forwards
1
|Tn(XYZW)|≥ 2nH(XYZW). (6) the sequence not involved in the mismatch. Meanwhile, node
(n+1)|X|4
10 forwards w˜n to the destination, since in any case the
Each edge holds a sequence in Xn. Since the number of traitorhasbeenlocalizedtonodes1–3.Thedestinationalways
messages is precisely the cardinality of Tn(XYZW), the rate receives two of the four sequences, both correct; therefore
is it may decode.
log|Tn(XYZW)| H(XYZW) |X|4log(n+1)
≥ − . (7)
nlog|X| log|X| nlog|X|
C. The Polytope Distribution
In particular,for sufficientlylargen, we mayoperateat a rate
arbitrarilyclose to H(XYZW). Therefore,to achieverate 2, we All that remains to prove that rate 2 can be achieved for
log|X| the Caterpillar network is to show that there exists variables
would like the following property to hold. X,Y,Z,W such that Properties 1–3 hold. In fact, this is
Property 1: H(XYZW) =2. not quite possible. In particular, Property 1 implies that
log|X|
X,Y,Z,W are pairwise independent.If so, Property 3 cannot
The adversary may alter the value of one of the sequences hold, because we can take X˜,Y˜,Z˜ to be jointly independent
sent out of nodes 1–4. By the Singleton bound argument, it with X˜ ∼ X, Y˜ ∼ Y, and Z˜ ∼ Z. This satisfies (8)–(10) but
must be possible to reconstruct the message from any two
not (11). We therefore replace Property 1 with the following
of these four sequences. We therefore need the following
slight relaxation.
property.
Property 2: Any two of X,Y,Z,W determine the other Property 4: H(XYZW) ≥2−(cid:3).
log|X|
two. If for every (cid:3) > 0, there exists a set of random vari-
For reasons that will become clear, we also need the
ables satisfying Properties 2–4, then by (7) we achieve
following property. It is an example of the fundamental
rate 2.
property of Polytope Codes.
Property 3: Any random variables X˜,Y˜,Z˜ satisfying the ThemostunusualaspectofthePolytopeCodeisProperty3
and its generalization,to be stated as Theorem4 in Sec. VIII.
three conditions
Therefore, before constructing a distribution satisfying all
(X˜,Y˜) ∼ (X,Y) (8) three properties, we illustrate in Table I a very simple dis-
(X˜,Z˜) ∼ (X,Z) (9) tribution on three binary variables variables that satisfies just
Property3.Thisdistributionisonlyon X,Y,Z;forsimplicity
(Y˜,Z˜) ∼ (Y,Z) (10)
we leave out W, as it is not involved in Property 3. We
also satisfy encourage the reader to manually verify Property 3 for this
distribution. Observe that X,Y,Z as given in Table I may be
(X˜,Y˜,Z˜)∼(X,Y,Z). (11)
alternatively expressed as being uniformly distributed on the
Supposewe aregivenrandomvariables X,Y,Z,W satisfy-
following set:
ing Properties 1–3. We now describe what nodes 9 and 10
(cid:6) (cid:7)
transmit to the destination. Let x˜n,y˜n,z˜n,w˜n be the four x,y,z ∈{0,1}: x +y+z =1 . (12)
sequences that are sent on the edges out of nodes 1–4;
3316 IEEETRANSACTIONSONINFORMATIONTHEORY,VOL.60,NO.6,JUNE2014
TABLEI We now consider Property 3. Assuming X˜,Y˜,Z˜ satisfy
ASIMPLEDISTRIBUTIONONTHREEBINARYRANDOMVARIABLESTHAT (8)–(10), we may write
(cid:8) (cid:9)
SATISFIESPROPERTY3.THATIS,FORANYALTERNATIVEDISTRIBUTION E (X˜ +Y˜ +Z˜)2 (15)
q(xyz),IFq(xy)= p(xy),q(xz)= p(xz),ANDq(yz)= p(yz),THEN (cid:8) (cid:9)
q(xyz)= p(xyz).THISSORTOFPROPERTYCOMPRISESTHEMAIN =E X˜2+Y˜2+Z˜2+2X˜Y˜ +2X˜Z˜ +2Y˜Z˜ (16)
(cid:8) (cid:9)
ADVANTAGEOFPOLYTOPECODES.UNDERTHEDISTRIBUTIONp, =E X2+Y2+Z2+2XY +2XZ +2YZ (17)
THEVARIABLESX,Y,Z SITINAPOLYTOPEDEFINED =E(cid:8)(X +Y +Z)2] (18)
BYX+Y+Z =0ANDX,Y,Z ∈[0,1]
=0 (19)
where (17)holdsfrom (8)–(10), andbecause eachterm in the
suminvolvesatmosttwoofthethreevariables;and(19)holds
because X+Y+Z =0byconstruction.Hence X˜+Y˜+Z˜ =0,
so we may write
(X˜,Y˜,Z˜) = (X˜,Y˜,−X˜ −Y˜) (20)
∼ (X,Y,−X −Y) (21)
= (X,Y,Z) (22)
where (21) holds by (8). This verifies Property 3, and we
maynowconcludethatthedistributionon X,Y,Z,W satisfies
all desired properties, so the induced Polytope Code achieves
rate 2 for the Caterpillar network.
D. Remarks on the Polytope Code for the
Caterpillar Network
Theaboveargumenttookadvantageofthe linearconstraint
X +Y + Z = 0, but this constraint was in no way special.
Property 3 would hold as long as X,Y,Z are subject to
any linear constraint with nonzero coefficients for all three
variables.
Fig.6. Anexample polytopeprojected intothe(x,y)plane.
Observe that when k is large, any pair of the four variables
are nearly independent, in that their joint entropy is close
to the sum of their individual entropies. We have therefore
This is the set of integer lattice points in a polytope. (Hence
constructed something like a (4,2) MDS code. In fact, if
“Polytope Code.”) The distribution in Table I—and in par-
we reinterpret the linear constraints in (13) as constraints
ticular the parameterization in (12)—is a special case of the
on elements x,y,z,w from a finite field, the resulting finite
construction of the distributions in the sequel.
subspacewouldbeexactlya(4,2)MDScode.Thisillustrates
We now construct a distribution satisfying Properties 2–4
a general principle of Polytope Codes: any code construction
for arbitrarily small (cid:3). Take k to be a positive integer, and let
onafinitefieldcanbeusedtoconstructaPolytopeCode,and
X,Y,Z,W be uniform over the set
manyofthepropertiesoftheoriginalcodewillholdover.The
(cid:6) resultingcodewillbesubstantiallyhardertoimplement,inthat
(x,y,z,w)∈{−k,...,k}4 :
(cid:7) it involves much longer blocklengths, and more complicated
x +y+z =0 and 3x −y+2w=0 . (13) codingfunctions,butadditionalproperties,suchasProperty3,
may hold. Sec. X provides details on transforming any linear
Like (12),thisisthesetofintegerlattice pointsina polytope. code into a mostly-equivalentPolytope Code.
By the linear constraints in (13), this distribution satisfies The code described above illustrates one significant draw-
Property 2. Now consider Property 4. The region of (X,Y) back of Polytope Codes compared to linear codes: the rates
pairs with positive probability is shown in Figure 6. Note they achieve are asymptotic. For linear codes, it is often the
that X and Y are not independent, because the boundedness case that the maximum rate can be achieved with a finite
of Z and W requires that X and Y satisfy certain linear field that is not too large. This is not the case for a Polytope
inequalities. Nevertheless, the area of the polygon shown in Code. In fact, in order to achieve the best rate, both the
Figure 6 grows as O(k2). Hence integers n and k must go to infinity. We need n to be large
in order for the cardinality of Tn(XYZW) to be close to
logH(XYZW) logO(k2) 2nH(XYZW) (see (6)), and we need k to be large in order to
= ≥2−(cid:3) (14)
log|X| log(2k+1) satisfyProperty4(see(14)).Thispaperisprimarilyinterested
in fundamental limits rather than implementation, so we will
where the last inequality holds for sufficiently large k. Thus not comment much on how large n and k must be for the
these variables satisfy Property 4. asymptotics to “kick in”.
KOSUTetal.: POLYTOPECODESAGAINSTADVERSARIESINNETWORKS 3317
VII. A POLYTOPECODE FORTHECOCKROACH NETWORK
We return to the Cockroach network, and demonstrate a
capacity-achievingPolytopeCodeforit.Wedothisnottofind
the capacity for the network, because we have already done
so with the simpler code in Sec. V, but rather to illustrate
a Polytope Code on a network satisfying the conditions of
Theorem 3, which have a somewhat different flavor than the
Caterpillar network.
In Sec. V, we illustrated how performing comparisons and
transmitting comparison bits through the network can help
defeat traitors. In Sec. VI, we illustrated how a code can
be built out a distribution on a polytope, and how a special
property of that distribution comes into play in the operation
of the code. The Polytope Code for the Cockroach network
combines these two ideas: the primary data sent through the
Fig. 7. A capacity-achieving Polytope Code for the Cockroach Network.
network comes from the distribution on a polytope, but then The symbols shown in the network represent a sequences that have a pre-
comparisonsareperformedin thenetworkin orderto localize determined joint type. At nodes 4 and 5, the joint types of the incoming
sequences are compared against what they “should be”, and = or (cid:9)= is sent
the traitor.
tothedestination depending ontheoutcomeofthecomparison.
ThefirststepinconstructingaPolytopeCodeistodescribe
a distribution over a polytope. That is, we define a linear
subspaceina realvectorfield, andtake a uniformdistribution
networkdescribedin Sec. V, theyeach performa comparison
over the polytopedefined by the set of vectorswith entries in andtransmiteither=or(cid:9)=dependingonwhetherthecompar-
{−k,...,k}forsomeintegerk.Thenatureofthisdistribution
ison succeeds. In particular, they compare the types of their
depends on the characteristics of the linear subspace. For
receivedsequenceswiththeoriginaldistribution.Forexample,
our code for the Cockroach network, we need one that is node4receivesthetwosequencesbn andcn,fromwhichitcan
equivalent to a (6,2) MDS code. That is, the linear subspace construct B˜ and C˜. If the joint distributionof (B˜,C˜) matches
sits in R6, has dimension2, andis definedby fourconstraints thatof(B,C),itsends=tothedestination;ifnot,itsends(cid:9)=.
such that any two variables determine the others. One choice
This single bit costs asymptotically negligible rate, so it has
for the subspace, for example, is the set of (a,b,c,d,e, f)
no effect on the achieved rate of the code for large n and k.
satisfying
Node 5 performs a similar action, comparing the distribution
a+b+c = 0 (23) of (D˜,E˜) with that of (D,E), and transmitting a comparison
bit to the destination.
a−b+d = 0 (24)
Nowweprovethatitispossibletodecodeatthedestination.
a+2b+e = 0 (25) If the traitor is node i, then the set of values received at the
2a+b+ f = 0. (26) destination is a deterministic function of the message w and
thevaluessentontheoutputofnodei,whichwedenotez .We
Let the random variables A,B,C,D,E,F have joint dis- denote this function f (w,z ). Assuming an optimal decioder,
i i
tribution uniformly distributed over the polytope defined by
anerrorcanonlyiftwomessagesleadtothesamesetofvalues
(23)–(26) and a,b,c,d,e, f ∈ {−k,...,k}. By a similar
at the destination. There are two cases: (1) for two messages
argument to that in Sec. VI, for large k, w1,w2 there exists a node i and zi,1,zi,2 such that
H(ABCDEF)
log(2k+1) ≈2. (27) fi(w1,zi,1)= fi(w2,zi,2) (28)
We chooseablocklengthn andassociateeachmessagewitha and(2)fortwomessagesw ,w thereexistsa pairofdistinct
1 2
joint sequence (anbncndnenfn) with joint type exactly equal nodes i, j and z ,z such that
i j
to the distribution of the six variables. Like the code in
Sec. VI, to achieve capacity we need both n and k to be fi(w1,zi)= fj(w2,zj). (29)
large. Indeed, for large n and k, we may place one sequence
Because any error is of the form either (28) or (29), we
an–fn on each unit capacity edge in the network and operate
neverneedtoconsidermorethan2potentialtraitornodesata
near rate 2. These six sequences are generated at the source
time.3 Effectively,(28)representsa single node confusingthe
and then routed through the network as shown in Fig. 7. For
destinationbetweentwomessages,eventhoughthedestination
convenience, the figure omits the n superscript.
As in Sec. VI, we define A˜,B˜,C˜,D˜,E˜,F˜ to have joint mightknowtheidentityofthetraitor,whereas(29)represents
atraitornodeactinginawaythatappearsasifadifferentnode
distribution equal to the type of the six sequences an they
couldbethe traitor. We use thisidea to parameterizedifferent
actually appear in the network, which may differ from the
sequencessentbythesourcebecauseoftheadversary.Inaddi-
3It is for the same reason that the Singleton bound is often tight, since
tion to forwarding a sequence, nodes 4 and 5 perform more
theSingleton boundrepresents anerroroftheform (29),wherethedecoder
elaborate operations. Like in the code for the Cockroach cannotdistinguish betweentwopossibletraitors.