Resilient Network Coding in the presence of Byzantine Adversaries Michelle Effros Michael Langberg Tracey Ho Sachin Katti Muriel Médard Dina Katabi Sidharth Jaggi

Obligatory Example/History s t1t1 t2t2 b1b1 b2b2 b2b2 b2b2 b1b1 b1b1 b1b1 b1b1 b1b1 b1b1 (b 1,b 2 ) b 1 +b 2 (b 1,b 2 ) [ACLY00] [ACLY00] Characterization Non-constructive [LYC03], [KM02] Constructive (linear) Exp-time design [JCJ03], [SET03] Poly-time design Centralized design [HKMKE03], [JCJ03] Decentralized design EVERBETTEREVERBETTER... C=2 [This work] All the above, plus security Tons of work [SET03] Gap provably exists

Multicast Simplifying assumptions All links unit capacity (1 packet/transmission) Acyclic network ALL of Alice’s information decodable EXACTLY by EACH Bob Network Model [GDPHE04],[LME04] – No intereference

Multicast Network Model ALL of Alice’s information decodable EXACTLY by EACH Bob Upper bound for multicast capacity C, C ≤ min{C i } [ACLY00] With mixing, C = min{C i } achievable! [LCY02],[KM01],[JCJ03],[HKMKE03] Simple (linear) distributed codes suffice!

Problem! Eavesdropped links Attacked links Corrupted links

Setup 1.Scheme A B C 2.Network C 3.Message A C 4.Code C 5.Bad links C 6.Coin A 7.Transmit B C 8.Decode B Eurek a Eavesdropped links Z I Attacked links Z O Who knows what Stage Privacy

Results First codes Optimal rates (C-2Z O,C-Z O ) Poly-time Distributed Unknown topology End-to-end Rateless Information theoretically secure Information theoretically private Wired/wireless [HLKMEK04],[JLHE05],[CY06],[CJL06],[GP06]

Error Correcting Codes Y=TX+E Generator matrix Low-weight vector Y X (Reed-Solomon Code) T E R=C-2Z O

Alice: Sends packets. Bob gets (Each column encoded with same transform T) Now Bob knows T and can decode. Distributed multicast A B2B2 X I TX T C packets “Small” rate-loss [HKMKE03]

What happens when we implement previous distributed algorithm? Key idea: think of Calvin's error as an addition to original information flow. Alice: Calvin: Bob: C packets Z O packets What happens with errors? X I TX T +T’E 1 +T’E 2 E1E1 E2E2 Bob: T,T’ are unknown. E 1,E 2 are unknown. System is not linear. How can Bob recover X? R packets

Alice: Calvin: Bob: Overview B1B1 B2B2 X I TX T Calvin +T’E 1 +T’E 2 E1E1 E2E2 Step 1: Show how to construct system of linear equations to help recover X. Step 2: System may have many solutions. Need to add redundancy to X. Step 1: “list decoding” will work as long as R ≤ C-Z O. Step 2: “unique decoding” will need an additional redundancy of Z O. All in all: R = C-2Z O. T T X+ E E = T ’ (E 1 -E 2 X)

Alice: Calvin: Bob: +T’E 2 +T’E 1 Properties of E X I E1E1 E2E2 T X+ E T Col. in T X+ E. = col. of T X + col. of E. Claim 1: E has column rank Z O (=Calvin's strength). Proof: Follows from fact that Calvin controls Z O links. Claim 2: Columns of T X and E span disjoint spaces. Proof: R≤C-Z O, random encoding. T TX = + = R ZOZO C

Theorems Scheme achieves rate C-2Z O (optimal)  Step 1: list decode (R ≤ C-Z O )  Step 2: unique decode (Redundancy = Z O ) Secret channel: Instead of Step 2, send hash of X. Rate = C-Z O (optimal) Limited Adversary: Calvin limited in eavesdropping – can implement secret channel and obtain rate C-Z O. Limited eavesdropping: Calvin can only see the information on Z I links If Z I <C-Z O =R, can implement a secret channel [JL07]

Summary RateConditions Thm 1C-Z O Secret Thm 2C-2Z O Omniscient Thm 3C-Z O Limited Optimal rates Poly-time Distributed Unknown topology End-to-end Rateless Information theoretically secure/private Wired/wireless