A Numerical Study on the Wiretap Network with a Simple Network Topology

A Numerical Study on the Wiretap Network with a Simple

Network Topology

Fan Cheng and Vincent Tan

Department of Electrical and Computer Engineering National University of Singapore

Mathematical Tools of Information-Theoretic Security Workshop September, 23 – 25, 2015

Problem Statement

Source Sink

Wiretappers 1:

2:

Problem Statement

Source Sink

Wiretappers 1:

2:

Problem Statement

Wiretap Network Strategy

• Source

• M: message

• K: random key, I(M;K) =0

• Intermediate: mix the ciphertext

• Sink: recover M

• A: no information about M

Problem Statement

Wiretap Network Strategy

• Source

• M: message

• K: random key, I(M;K) =0

• Intermediate: mix the ciphertext

• Sink: recover M

• A: no information about M

Goal

• Maximize H

(

M

)

• Minimize H

(

K

)

Problem Statement

Wiretap Network Strategy

• Source

• M: message

• K: random key, I(M;K) =0

• Intermediate: mix the ciphertext

• Sink: recover M

• A: no information about M

Goal

• Maximize H

(

M

)

• Minimize H

(

K

)

Very hard!

Problem Statement

Our Model

S T R

X1

X₂

X3

X4

X₅

X6

Problem Statement

Our Model

S T R

X1

X₂

X3

X4

X₅

X6

Objective:

For a given wiretap pattern

A

:

τ

A

=

min_H^H₍⁽_M^K)₎

Problem Statement

Our Model

S T R

X1

X₂

X3

X4

X₅

X6

Objective:

For a given wiretap pattern

A

:

τ

A

=

min_H^H₍⁽_M^K)₎

Question:

Is routing optimal?

Outline

• Literature review

• Problem formulation and methods

• Results and open problems

Wiretap Network

• N. Cai and R. W. Yeung, “Secure network coding,” 2002 IEEE International Symposium on Information Theory.

• N. Cai and R. W. Yeung, “Secure Network Coding on a Wiretap Network,” IEEE Transactions on Information Theory, vol. 57, no.

1, pp. 424 - 435, Jan. 2011.

Sinks Sources

Wiretap network (

G = (V, E), S, U , A

)

Wiretapper, Wiretap Set, Wiretap Pattern

S T R

X1

X2

X₃

X4

X5

X₆

Wiretapper

→

Wiretap Set

→

Wiretapper Pattern

A

, wiretap pattern:

A = {

A₁

,

A₂

, ..., }

, where A_i

⊆ E

Example

Three Wiretappers with wiretap sets A₁

= {

X₁

,

X₂

}

, A₂

= {

X₂

,

X₃

,

X₅

}

, A3

= {

X1

,

X2

,

X4

,

X6

}

.

A = {

A1

,

A2

,

A3

}

.

(

H

(

M

),

H

(

K

))

? when

A

is given.

63 subsets of

E →

2⁶³wiretap patterns.

Wiretapper, Wiretap Set, Wiretap Pattern

S T R

X1

X2

X₃

X4

X5

X₆

Wiretapper

→

Wiretap Set

→

Wiretapper Pattern

A

, wiretap pattern:

A = {

A₁

,

A₂

, ..., }

, where A_i

⊆ E Example

Three Wiretappers with wiretap sets A₁

= {

X₁

,

X₂

}

, A₂

= {

X₂

,

X₃

,

X₅

}

, A3

= {

X1

,

X2

,

X4

,

X6

}

.

A = {

A1

,

A2

,

A3

}

.

(

H

(

M

),

H

(

K

))

? when

A

is given.

63 subsets of

E →

2⁶³wiretap patterns.

Wiretapper, Wiretap Set, Wiretap Pattern

S T R

X1

X2

X₃

X4

X5

X₆

Wiretapper

→

Wiretap Set

→

Wiretapper Pattern

A

, wiretap pattern:

A = {

A₁

,

A₂

, ..., }

, where A_i

⊆ E Example

Three Wiretappers with wiretap sets A₁

= {

X₁

,

X₂

}

, A₂

= {

X₂

,

X₃

,

X₅

}

, A3

= {

X1

,

X2

,

X4

,

X6

}

.

A = {

A1

,

A2

,

A3

}

.

(

H

(

M

),

H

(

K

))

? when

A

is given.

63 subsets of

E →

2⁶³wiretap patterns.

Existing Results on Wiretap Networks

• 1. Single source multiple sinks,

A = {

W

: |

W

| =

r

,

W

⊆ E}

:

• H(M) ≤ (n−r)log q;

• H(K) ≥r/(n−r)H(M). (Cai and Yeung, 2010)

• 2. General multi-source multi-sink wiretap network

⇐⇒

General entropic region problem. (Chan and Grant, 2014)

Open problem

Single source and single sink network witharbitrary

A

.

Existing Results on Wiretap Networks

• 1. Single source multiple sinks,

A = {

W

: |

W

| =

r

,

W

⊆ E}

:

• H(M) ≤ (n−r)log q;

• H(K) ≥r/(n−r)H(M). (Cai and Yeung, 2010)

• 2. General multi-source multi-sink wiretap network

⇐⇒

General entropic region problem. (Chan and Grant, 2014)

Open problem

Single source and single sink network witharbitrary

A

.

CutSet Bound

F. Cheng and R. W. Yeung,“Performance Bounds on a Wiretap Network withArbitraryWiretap Sets,” IEEE Trans. Inform. Theory, vol. 60, no.

6, pp. 3345-3358, Jun. 2014.

Graph Cut

S

T

x1

x2

x_n−1 xn

Cutset bound

H

(

K

)

H

(

M

) ≥

max

n

X

i=1

x_i

−

1 s.t. 0

≤

x_i

≤

1

,

1

≤

i

≤

n

X

e_j∈A

x_j

≤

1

, ∀

A

∈ A

Assume H

(

K

)

= 1

Problem Formulation: a Simple Network

Network model

S T R

X1

X₂ X₃

X4

X₅ X₆

(3, 3) wiretap network

•

G = (V, E)

•

S = {

S

}

,

U = {

R

}

•

A ⊆

2^E

Entropy Equations Network model

S T R

X₁

X2

X3

X₄

X5

X6

(3, 3) wiretap network

Source: I

(

M

;

K

) =

0

H

(

X1

,

X2

,

X3

|

M

,

K

) =

0 Node T: H

(

X4

,

X5

,

X6

|

X1

,

X2

,

X3

) =

0

Sink: H

(

M

|

X₄

,

X₅

,

X₆

) =

0 (Level-I) or H

(

M

,

K

|

X₄

,

X₅

,

X₆

) =

0 (Level-II) Security: I

(

XA

;

M

) =

0

, ∀

A

∈ A

Question

τ

A

=

minH

(

K

)

H

(

M

)

For a fixed

A

, is routing optimal?

Numerical Study!

Lower and Upper Bounds on τ

_A

• Lower bounds: Cutset bound, Shannon Bound

• Upper bounds: Routing bound, Linear network coding bound Cutset

≤

Shannon

≤ τ

A

≤

Linear network coding

≤

Routing

Shannon Bound

• All information measures H

(·|·)

, I

(·; ·|·)

are non-negative;

H

(

X1

|

X2

),

H

(

X1

,

X2

,

X3

),

I

(

X

;

Y

) ≥

0

• Linearity exists among information measures;

H

(

X1

,

X2

) =

H

(

X1

|

X2

) +

H

(

X2

)

• All information inequalities are linear; H

(

K

) ≥

H

(

M

)

⇒

Idea: choose some asdecision variablesto represent the others.

Shannon Cipher System

Message: X1, Key: X2, Ciphertext: X3:

X₁

S R

X₁ X₂

X₃

I

(

X1

;

X2

) =

0

;

H

(

X3

|

X1

,

X2

) =

0

;

H

(

X1

|

X2

,

X3

) =

0

;

I

(

X1

;

X3

) =

0 Objective: H

(

X2

) ≥

H

(

X1

)

(Perfect Secrecy Theorem)

Shannon Bound

• All information measures H

(·|·)

, I

(·; ·|·)

are non-negative;

H

(

X1

|

X2

),

H

(

X1

,

X2

,

X3

),

I

(

X

;

Y

) ≥

0

• Linearity exists among information measures;

H

(

X1

,

X2

) =

H

(

X1

|

X2

) +

H

(

X2

)

• All information inequalities are linear; H

(

K

) ≥

H

(

M

)

⇒

Idea: choose some asdecision variablesto represent the others.

Shannon Cipher System

Message: X1, Key: X2, Ciphertext: X3:

X₁

S R

X₁ X₂

X₃

I

(

X1

;

X2

) =

0

;

H

(

X3

|

X1

,

X2

) =

0

;

H

(

X1

|

X2

,

X3

) =

0

;

I

(

X1

;

X3

) =

0 Objective: H

(

X2

) ≥

H

(

X1

)

(Perfect Secrecy Theorem)

Shannon Bound (cont’d)

• Decision variables: H

(

X1

|

X2

,

X3

)

, H

(

X2

|

X1

,

X3

),

H

(

X3

|

X1

,

X2

)

, I

(

X₁

;

X₂

),

I

(

X₁

;

X₂

|

X₃

)

,I

(

X₁

;

X₃

),

I

(

X₁

;

X₃

|

X₂

)

,I

(

X₂

;

X₃

),

I

(

X₂

;

X₃

|

X₁

)

Denote

z

:=









H

(

X₁

|

X₂

,

X₃

)

H

(

X2

|

X1

,

X3

)

. . .

I

(

X₂

;

X₃

|

X₁

)









• H

(

X₂

) ≥

H

(

X₁

)

⇔

c^Tz

≥

0

• I

(

X1

;

X2

) =

0

;

H

(

X3

|

X1

,

X2

) =

0

;

H

(

X1

|

X2

,

X3

) =

0

;

I

(

X1

;

X3

) =

0

⇔





a11

. . . . . . . . . . . . . . . . . . . . . . . .





z

≥

0

⇔

Az

≥

0

•

min c^Tz

,

s.t. Az

≥

0

Shannon Bound (cont’d)

Minimal representation

Let

[

n

] = {

1

,

2

, . . . ,

n

}

. X1, X2,

. . .

, Xn. The minimal decision variables:

(i) H

(

Xi

|

X_[n]−{i}

),

i

∈ [

n

]

;

(ii) I

(

Xi

;

Xj

|

XK

)

, where i

6=

j and K

⊆ [

n

] − {

i

,

j

}

.

⇒

Shannon bound:

min c^Tz s.t. Az

≥

0

Remark

• Always exists

• Hard to compute, hard to understand, optimality is unknown

• Automatical tools

Shannon Bound (cont’d)

Minimal representation

Let

[

n

] = {

1

,

2

, . . . ,

n

}

. X1, X2,

. . .

, Xn. The minimal decision variables:

(i) H

(

Xi

|

X_[n]−{i}

),

i

∈ [

n

]

;

(ii) I

(

Xi

;

Xj

|

XK

)

, where i

6=

j and K

⊆ [

n

] − {

i

,

j

}

.

⇒

Shannon bound:

min c^Tz s.t. Az

≥

0

Remark

• Always exists

• Hard to compute, hard to understand, optimality is unknown

• Automatical tools

Shannon Bound: ITIP/Xitip

Information Theoretic Inequalities Prover

For n random variables, a linear program in n

+

ⁿ₂

2ⁿ⁻²variables

Routing Bound and Linear Network Coding Bound

S T R

X1

X₂ X₃

X4

X5

X₆

Routing bound

⇒

Special Cutset bound Linear network coding bound (LNCB): V1

,

V2

, ...,

Vm

⊆ F

ⁿq

rank

(

V1

)

,rank

(

V1

,

V2

) →

entropy functions.

rank

(

V1

,

V2

) ≤

rank

(

V1

) +

rank

(

V2

)

LNCB

→

All the inequalities over V1

,

V2

, ...,

Vm

• m

=

4, Ingleton

• m

=

5, Dougherty, Freiling, Zeger, 28

• m

=

6, unknown, at least 1 million

Reduction of Wiretap Patterns Network model

S T R

X1

X₂ X₃

X4

X₅ X₆

A ⊆

2^E, 2²⁶⁻¹

A₁

= {

1

,

2

,

4

},

A₂

= {

2

,

4

} ⇒

delete A₂from

A A

: A_i

6⊂

A_j

(

i

6=

j

)

(antichain)

|

E

| 0 1 2 3 4 5 6 7

# 2 3 6 20 168 7581 7

.

8

∗

10⁶ 2

.

4

∗

10¹²

Numerical Study: Algorithm

Cut-set

≤

Shannon

≤ τ

_A

≤

Linear Network Coding

≤

Routing

Algorithm for assessing the tightness of the routing bound

For each wiretap pattern,

1. Compute the cut-set bounds on

(

S

,

T

)

and

(

T

,

R

)

: l₁. 2. Compute the routing bound on S

→

T

→

R: l₂. 3. If l1==l2, then

τ

A

=

l1. Proceed to Step 5.

4. Compare l2with the Shannon bound in ITIP/Xitip: If equal, then

τ

A

=

l₂. Otherwise, agapis detected.

5. Proceed to the next wiretap pattern.

Numerical Study: Result

• Gaps exist only if 4

≤ |A| ≤

12

• For almost 80

%

of the wiretap patterns, cut-set bounds

=

routing bounds

• In the Level-I

(

3

,

3

)

network, there are around 159

,

258 wiretap patterns (2

%

of all the wiretap patterns) routing bounds

6=

Shannon bounds

• In the Level-II

(

3

,

3

)

network, there are around 32

,

472 wiretap patterns (0.4

%

of all the wiretap patterns) routing bounds

6=

Shannon bounds

Problem

How to fill this gap?

Cut-set

≤

Shannon

≤ τ

_A

≤

Linear Network Coding

≤

Routing

Numerical Study: Result

• Gaps exist only if 4

≤ |A| ≤

12

• For almost 80

%

of the wiretap patterns, cut-set bounds

=

routing bounds

• In the Level-I

(

3

,

3

)

network, there are around 159

,

258 wiretap patterns (2

%

of all the wiretap patterns) routing bounds

6=

Shannon bounds

• In the Level-II

(

3

,

3

)

network, there are around 32

,

472 wiretap patterns (0.4

%

of all the wiretap patterns) routing bounds

6=

Shannon bounds

Problem

How to fill this gap?

Cut-set

≤

Shannon

≤ τ

_A

≤

Linear Network Coding

≤

Routing

Case Study: Routing Vs. Coding

S T R

X1

X2

X3

X4

X₅

X6

A1

= {

2

,

3

,

5

}

, A2

= {

1

,

4

,

5

}

, A3

= {

1

,

3

,

6

}

, and A4

= {

2

,

4

,

6

}

. Routing bound: 3. Both of the Shannon bounds (Level I/II): 2.

X1

=

K1 X4

=

M

+

2K1

+

2K2

X2

=

K2 X5

=

M

+

K1

+

2K2

X₃

=

M

+

K₁

+

K₂ X₆

=

M

+

2K₁

+

K₂

Case Study: Routing Vs. Coding

S T R

X1

X2

X3

X4

X₅

X6

A1

= {

2

,

3

,

5

}

, A2

= {

1

,

4

,

5

}

, A3

= {

1

,

3

,

6

}

, and A4

= {

2

,

4

,

6

}

. Routing bound: 3. Both of the Shannon bounds (Level I/II): 2.

X1

=

K1 X4

=

M

+

2K1

+

2K2

X2

=

K2 X5

=

M

+

K1

+

2K2

X3

=

M

+

K1

+

K2 X6

=

M

+

2K1

+

K2

Case Study: Level I Vs. Level II

S T R

X1

X2

X3

X4

X₅

X6

A1

= {

1

,

4

}

, A2

= {

2

,

3

,

4

}

, A3

= {

1

,

2

,

5

,

6

}

, and A4

= {

3

,

5

,

6

}

. Routing bound

=

3. Shannon bounds: 2 (Level-I) and 3 (Level-II).

X1

=

M

+

K1 X4

=

K1

+

K2

X2

=

K2 X5

=

M

+

K1

+

K2

X₃

=

K₁

Case Study: Level I Vs. Level II

S T R

X1

X2

X3

X4

X₅

X6

A1

= {

1

,

4

}

, A2

= {

2

,

3

,

4

}

, A3

= {

1

,

2

,

5

,

6

}

, and A4

= {

3

,

5

,

6

}

. Routing bound

=

3. Shannon bounds: 2 (Level-I) and 3 (Level-II).

X1

=

M

+

K1 X4

=

K1

+

K2

X2

=

K2 X5

=

M

+

K1

+

K2

X3

=

K1

Heuristic Observations

Objective:H(K) ≥3H(M) Constraints from network:

I

(

M

;

K

) =

0

H

(

X₁

,

X₂

,

X₃

|

M

,

K

) =

0 H

(

X₄

,

X₅

,

X₆

|

X₁

,

X₂

,

X₃

) =

0 H

(

M

,

K

|

X₄

,

X₅

,

X₆

) =

0 I

(

M

;

X2

,

X4

,

X5

) =

0 I

(

M

;

X2

,

X3

,

X6

) =

0 I

(

M

;

X1

,

X5

,

X6

) =

0 I

(

M

;

X₁

,

X₃

,

X₄

) =

0 I

(

M

;

X₁

,

X₂

,

X₄

,

X₆

) =

0

More useful constraints:

H

(

X₁

,

X₂

,

X₃

) =

H

(

X₁

) +

H

(

X₂

) +

H

(

X₃

)

H

(

X4

,

X5

,

X6

) =

H

(

X4

) +

H

(

X5

) +

H

(

X6

)

H

(

X4

|

X1

,

X3

) =

0

H

(

X5

|

X1

,

X2

,

X3

) =

0 H

(

X6

|

X2

,

X3

) =

0 H

(

X3

) =

2H

(

X1

)

H

(

X₁

) =

H

(

X₂

)

H

(

X₅

) =

2H

(

X₄

)

H

(

X4

) =

H

(

X6

)

Helpful in designing a LNC!

Heuristic Observations (cont’d)

Initial constraints:

H(K) =3H(M) I

(

M

;

K

) =

0

H

(

X₁

,

X₂

,

X₃

|

M

,

K

) =

0 H

(

X₄

,

X₅

,

X₆

|

X₁

,

X₂

,

X₃

) =

0 H

(

M

,

K

|

X4

,

X5

,

X6

) =

0 I

(

M

;

X2

,

X4

,

X5

) =

0 I

(

M

;

X2

,

X3

,

X6

) =

0 I

(

M

;

X₁

,

X₅

,

X₆

) =

0 I

(

M

;

X₁

,

X₃

,

X₄

) =

0 I

(

M

;

X₁

,

X₂

,

X₄

,

X₆

) =

0

⇒

Implications:

H

(

X1

,

X2

,

X3

) =

H

(

X1

) +

H

(

X2

) +

H

(

X3

)

H

(

X₄

,

X₅

,

X₆

) =

H

(

X₄

) +

H

(

X₅

) +

H

(

X₆

)

H

(

X₄

|

X₁

,

X₃

) =

0

H

(

X₅

|

X₁

,

X₂

,

X₃

) =

0 H

(

X6

|

X2

,

X3

) =

0 H

(

X3

) =

2H

(

X1

)

H

(

X1

) =

H

(

X2

)

H

(

X₅

) =

2H

(

X₄

)

H

(

X₄

) =

H

(

X₆

)

Necessary conditions!

A Hard Example: |A| =

12

S T R

X1

X₂ X3

X4

X₅ X6

A₁

= {

3

,

5

,

6

}

, A₂

= {

3

,

4

,

6

}

, A₃

= {

3

,

4

,

5

}

, A₄

= {

2

,

5

,

6

}

, A5

= {

2

,

4

,

6

}

, A6

= {

2

,

3

,

6

}

, A7

= {

2

,

3

,

5

}

, A8

= {

2

,

3

,

4

}

, A₉

= {

1

,

5

,

6

}

, A₁₀

= {

1

,

3

,

5

}

, A₁₁

= {

1

,

3

,

4

}

, A₁₂

= {

1

,

2

,

4

,

5

}

Routing bound: 4. Shannon bound: 19/5. LNC on

F

²⁴q .

H

(

X₁

,

X₂

,

X₃

) =

H

(

X₁

) +

H

(

X₂

) +

H

(

X₃

)

H

(

X₄

,

X₅

,

X₆

) =

H

(

X₄

) +

H

(

X₅

) +

H

(

X₆

)

7H

(

X1

) =

9H

(

X2

)

8H

(

X1

) =

9H

(

X3

) ⇒

9

:

7

:

8 3H

(

X4

) =

4H

(

X5

)

5H

(

X₄

) =

4H

(

X₆

) ⇒

8

:

6

:

10

Conclusion

F. Cheng and V. Y. F. Tan, “A Numerical Study on the Wiretap Network with a Simple Network Topology,” arxiv:1505.02862.

• A simple network model

• Numerical study by ITIP/Xitip

• Initial progress:

|A| =

4

• Some very interesting wiretap patterns

• Open

|A| =

5

, ...,

12