Resilient Network Coding in the presence of Byzantine Adversaries

1. Resilient Network Coding in the presence of Byzantine Adversaries Sidharth Jaggi Michelle Effros Michael Langberg Tracey Ho Sachin Katti Muriel Médard Dina Katabi

2. Obligatory Example/History s [ACLY00] [ACLY00] Characterization Non-constructive b1 b2 E V E R B E T T E R C=2 [LYC03], [KM02] Constructive (linear) Exp-time design b1 b2 [JCJ03], [SET03] Poly-time design Centralized design b1 b1 b2 [HKMKE03], [JCJ03]Decentralized design b1+b2 . . . b1 b1 b1+b2 b1+b2 Tons of work t1 t2 [This work]All the above, plus security (b1,b2) b1 (b1,b2) [SET03] Gap provably exists

3. Multicast Network Model ALL of Alice’s information decodable EXACTLY by EACH Bob Simplifying assumptions • All links unit capacity • (1 packet/transmission) [GDPHE04],[LME04] – No intereference • Acyclic network

4. Multicast Network Model 2 ALL of Alice’s information decodable EXACTLY by EACH Bob 2 3 Upper bound for multicast capacity C, C ≤ min{Ci} [ACLY00] With mixing, C = min{Ci} achievable! [LCY02],[KM01],[JCJ03],[HKMKE03] Simple (linear) distributed codes suffice!

5. Problem! Corrupted links Eavesdropped links Attacked links

6. Setup Eureka Who knows what Stage • Scheme A B C • Network C • Message A C • Code C • Bad links C • Coin A • Transmit B C • Decode B Eavesdropped links ZI Attacked links ZO Privacy

7. Results First codes • Optimal rates (C-2ZO,C-ZO) • Poly-time • Distributed • Unknown topology • End-to-end • Rateless • Information theoretically secure • Information theoretically private • Wired/wireless [HLKMEK04],[JLHE05],[CY06],[CJL06],[GP06]

8. Error Correcting Codes T Y X Y=TX+E Generator matrix Low-weight vector (Reed-Solomon Code) R=C-2ZO E

9. Distributed multicast [HKMKE03] • Alice: Sends packets. • Bob gets (Each column encoded with same transform T) • Now Bob knows Tand can decode. A “Small” rate-loss I X C packets T TX B2

10. What happens with errors? • What happens when we implement previous distributed algorithm? • Key idea: think of Calvin's error as an addition to original information flow. • Alice: • Calvin: • Bob: I X R packets ZO packets E2 E1 • Bob: • T,T’ are unknown. • E1,E2are unknown. • System is not linear. • How can Bob recover X? +T’E1 TX T +T’E2 C packets

11. Overview • Alice: • Calvin: • Bob: Step 1: Show how to construct system of linear equations to help recover X. Step 2: System may have many solutions. Need to add redundancy to X. Calvin I X Step 1: “list decoding” will work as long as R ≤ C-ZO. Step 2: “unique decoding” will need an additional redundancy of ZO. All in all: R = C-2ZO. E2 E1 +T’E1 TX T +T’E2 TX+E T B1 B2 E= T’(E1-E2X)

12. Properties of E • Col. inTX+E. • = col. ofTX + col. of E. • Claim 1: Ehas column rank ZO(=Calvin's strength). • Proof: Follows from fact that Calvin controls ZO links. • Claim 2: Columns of TX and E span disjoint spaces. • Proof:R≤C-ZO, random encoding. R I X • Alice: • Calvin: • Bob: E2 ZO E1 +T’E1 TX T +T’E2 C = T TX+E = +

13. Limited eavesdropping: • Calvin can only see the information on ZI links • If ZI<C-ZO=R, can implement a secret channel [JL07] Theorems • Scheme achieves rate C-2ZO (optimal) • Step 1: list decode (R ≤ C-ZO) • Step 2: unique decode (Redundancy = ZO) • Secret channel: Instead of Step 2, send hash of X. Rate = C-ZO (optimal) • Limited Adversary: Calvin limited in eavesdropping – can implement secret channel and obtain rate C-ZO.

14. Summary Optimal rates Poly-time Distributed Unknown topology End-to-end Rateless Information theoretically secure/private Wired/wireless