Local-Encoding-Preserving Secure Network Coding---Part II: Flexible Rate and Security Level
aa r X i v : . [ c s . I T ] N ov Local-Encoding-Preserving Secure NetworkCoding—Part II: Flexible Rate andSecurity Level
Xuan Guang,
Member, IEEE,
Raymond W. Yeung,
Fellow, IEEE, and Fang-Wei Fu,
Member, IEEE
Abstract
In this two-part paper, we consider the problem of secure network coding when the information rateand the security level can change over time. To efficiently solve this problem, we put forward local-encoding-preserving secure network coding, where a family of secure linear network codes (SLNCs) iscalled local-encoding-preserving if all the SLNCs in this family share a common local encoding kernelat each intermediate node in the network. In the current paper (i.e., Part II of the two-part paper), wefirst consider the design of a family of local-encoding-preserving SLNCs for a fixed rate and a flexiblesecurity level. We present a novel and efficient approach for constructing upon an SLNC that exists alocal-encoding-preserving SLNC with the same rate and the security level increased by one. Next, weconsider the design of a family of local-encoding-preserving SLNCs for a fixed dimension (equal tothe sum of rate and security level) and a flexible pair of rate and security level. We propose anothernovel approach for designing an SLNC such that the same SLNC can be applied for all the rate andsecurity-level pairs with the fixed dimension. Also, two polynomial-time algorithms are developed forefficient implementations of the two proposed approaches, respectively. Furthermore, we prove that bothapproaches do not incur any penalty on the required field size for the existence of SLNCs in terms of thebest known lower bound by Guang and Yeung. Finally, we consider the ultimate problem of designing afamily of local-encoding-preserving SLNCs that can be applied to all possible pairs of rate and securitylevel. By combining the construction of a family of local-encoding-preserving SLNCs for a fixed securitylevel and a flexible rate (which has been obtained in Part I [1]) with the constructions of the two familiesof local-encoding-preserving SLNCs in the current paper in suitable ways, we can obtain a family oflocal-encoding-preserving SLNCs that can be applied for all possible pairs of rate and security level.Three possible such constructions are presented.
November 9, 2018 DRAFT
I. I
NTRODUCTION
As discussed in Part I [1] of this two-part paper, in a secure network coding system, the requirementsfor information transmission and information security may vary, and so the information rate and thesecurity level of the system may need to be chosen differently at different times. Thus we are motivatedto put forward local-encoding-preserving secure network coding , where a family of secure linear networkcodes (SLNCs) is called local-encoding-preserving if all the SLNCs in this family share a common localencoding kernel at each intermediate node in the network. In other words, regardless of which SLNCin this family to be used, the same local encoding kernel at each intermediate node is applied for localencoding. Further, we considered the design of a family of local-encoding-preserving SLNCs for a fixedsecurity level and a flexible rate. Specifically, we proposed an approach to constructing a family of local-encoding-preserving SLNCs with a fixed security level r ( ≤ r ≤ C min ) and multiple rates from to C min − r , the allowed maximum rate, where C min is the smallest minimum cut capacity between the sourcenode and the sink nodes. We also developed a polynomial-time algorithm for efficient implementation ofour approach. Furthermore, it was proved that our approach does not incur any penalty on the requiredfield size for the existence of SLNCs in terms of the best known lower bound in [2].In the current paper (i.e., Part II of the two-part paper), we continue the studies in Part I by consideringthe design of a family of local-encoding-preserving SLNCs for a fixed rate and a flexible security level.Our approach is totally different from all the previous approaches used in related problems (includingthe approach in Part I) [1], [3], [4]. Upon an SLNC that exists, we construct a local-encoding-preservingSLNC with the same rate and at one security level higher, which leads to an increase of the codedimension (equal to the sum of rate and security level). In contrast, in all the previous approaches, thedimension of the newly constructed linear network code decreases.Specifically, we start with an SLNC with the required rate, denoted by ω , and the security level (whichin fact is an ω -dimensional linear network code), and apply the proposed approach repeatedly. As such,we can obtain a family of local-encoding-preserving SLNCs with the fixed rate ω and multiple securitylevels from to C min − ω , the allowed maximum security level. Based on this approach, we furtherdevelop a polynomial-time algorithm for efficient implementation. Also, we prove that our approachincurs no penalty (even better for some cases) on the required field size for the existence of SLNCs interms of the best known lower bound [2].Next, we consider the design of a family of local-encoding-preserving SLNCs for a fixed dimensionand a flexible pair of rate and security level, i.e., all rate and security-level pairs such that the sum of therate and the security level is equal to a constant. Toward this end, we use another novel approach to design November 9, 2018 DRAFT an SLNC such that with the same SLNC, all the rate and security-level pairs with the fixed dimensionare applicable. With this approach, we develop a polynomial-time algorithm for the construction of suchan SLNC. Again, for our approach, there is no penalty on the field size of the existence of SLNCs interms of the best known lower bound [2].Finally, we consider the design of a family of local-encoding-preserving SLNCs which can be appliedto all possible pairs of rate and security level, i.e., all the nonnegative integer pairs ( ω, r ) of rate ω and security level r with ω + r ≤ C min . The set of all such the pairs forms the rate and security-levelregion . By combining the constructions of the 3 families of local-encoding-preserving SLNCs in Part Iand Part II in suitable ways, we can construct a family of local-encoding-preserving SLNCs achievingall the pairs in the rate and security-level region. Three possible such constructions are presented.The organization of this paper is as follows. In Section II, we present secure network coding andthe preliminaries, and introduce the necessary definitions and a proposition. In Sections III and IV, wedesign a family of local-encoding-preserving SLNCs for a fixed rate and a flexible security level, and afamily of local-encoding-preserving SLNCs for a fixed dimension and a flexible rate and security-levelpair. Section V is devoted to the design of a family of local-encoding-preserving SLNCs achieving allthe pairs in the rate and security-level region. We conclude in Section VI with a summary of our results.II. P RELIMINARIES
For the completeness of this paper, in this section we briefly present secure network coding andintroduce the necessary notation and definitions. We refer the reader to Section II of Part I [1] of thecurrent paper for more details.We consider a finite directed acyclic network G = ( V, E ) with a single source s and a set of sinknodes T ⊆ V \ { s } , where V is the set of nodes and E is the set of edges of G . For a directed edge e from node u to node v , the node u is called the tail of e and the node v is called the head of e , denotedby tail( e ) and head( e ) , respectively. Further, for a node u , let In( u ) = { e ∈ E : head( e ) = u } and Out( u ) = { e ∈ E : tail( e ) = u } . Without loss of generality, assume that there are no incoming edges forthe source node s and no outgoing edges for any sink node t ∈ T . For convenience sake, however, we let In( s ) be a set of n imaginary incoming edges , denoted by d i , ≤ i ≤ n , terminating at the source node s but without tail nodes, where the nonnegative integer n is equal to the dimension of the network code indiscussion. This will become clear later (see Definition 1). Then, we see that In( s ) = (cid:8) d i : 1 ≤ i ≤ n (cid:9) .An index taken from an alphabet can be transmitted on each edge e in E . In other words, the capacityof each edge is taken to be . Parallel edges between two adjacent nodes are allowed. November 9, 2018 DRAFT
In a network G , a cut between the source node s and a non-source node t is defined as a set of edgeswhose removal disconnects s from t . The capacity of a cut between s and t is defined as the number ofedges in the cut, and the minimum of the capacities of all the cuts between s and t is called the minimumcut capacity between them, denoted by C t . A cut between s and t is called a minimum cut if its capacityachieves the minimum cut capacity between them. These concepts can be extended from a non-sourcenode t to an edge subset A of E (cf. [1, Section II-A]).It has been shown in [5], [6] that linear network coding over a finite field is sufficient for achieving C min , min t ∈ T C t , the theoretical maximum information rate for multicast [7]. The formal definition ofa linear network code is given as follows. Definition 1.
Let F q be a finite field of order q , where q is a prime power, and n be a nonnegativeinteger. An n -dimensional F q -valued linear network code C n on the network G = ( V, E ) consists of an F q -valued | In( v ) | × | Out( v ) | matrix K v = [ k d,e ] d ∈ In( v ) ,e ∈ Out( v ) for each non-sink node v in V , i.e., C n = (cid:8) K v : v ∈ V \ T (cid:9) , where K v is called the local encoding kernel of C n at v , and k d,e ∈ F q is called the local encodingcoefficient for the adjacent edge pair ( d, e ) . For a linear network code C n , the local encoding kernels K v at all the non-sink nodes v ∈ V \ T induce an n -dimensional column vector ~f ( n ) e for each edge e in E , called the global encoding kernel of e , which can be calculated recursively according to a given ancestral order of edges in E by ~f ( n ) e = X d ∈ In(tail( e )) k d,e · ~f ( n ) d , (1)with the boundary condition that ~f ( n ) d , d ∈ In( s ) form the standard basis of the vector space F nq . Theset of global encoding kernels for all e ∈ E , i.e., (cid:8) ~f ( n ) e : e ∈ E (cid:9) , is also used to represent this linearnetwork code C n . However, we remark that a set of global encoding kernels (cid:8) ~f ( n ) e : e ∈ E (cid:9) maycorrespond to more than one set of local encoding kernels (cid:8) K v : v ∈ V \ T (cid:9) .In using of this linear network code C n , let x = (cid:0) x x · · · x n (cid:1) ∈ F nq be the input of the sourcenode s . We assume that the input x is transmitted to s through the n imaginary incoming channels of thesource node s . Without loss of generality, x i is transmitted on the i th imaginary channel d i , ≤ i ≤ n .For each edge e ∈ E , we use y e to denote the message transmitted on e . Then y e can be calculatedrecursively by the equation y e = X d ∈ In(tail( e )) k d,e · y d (2) November 9, 2018 DRAFT according to the given ancestral order of edges in E , with y d i , x i , ≤ i ≤ n . We see that y e in fact isa linear combination of the n symbols x i , ≤ i ≤ n of x . It is readily seen that y d i = x · ~f ( n ) d i ( = x i ), ≤ i ≤ n . Then it can be shown by induction via (1) and (2) that y e = x · ~f ( n ) e , ∀ e ∈ E. (3)Furthermore, for each sink node t ∈ T , we define the matrix F ( n ) t = h ~f ( n ) e : e ∈ In( t ) i . The sink node t can decode the source message with zero error if and only if F ( n ) t is full rank, i.e., Rank (cid:0) F ( n ) t (cid:1) = n .We say that an n -dimensional linear network code C n is decodable if for each sink node t in T , the rankof the matrix F ( n ) t is equal to the dimension n of the code. Next, we present the transformation of alinear network code. Proposition 1 ([1, Theorem 1]) . Let C n = (cid:8) K v : v ∈ V \ T (cid:9) be an n -dimensional decodable linearnetwork code over a finite field F q on the network G = ( V, E ) , of which the global encoding kernelsare ~f ( n ) e , e ∈ E . Let Q be an m × n ( m ≤ n ) matrix over F q and Q · C n = (cid:8) K ( Q ) v : v ∈ V \ T (cid:9) with K ( Q ) s = Q · K s and K ( Q ) v = K v for all v ∈ V \ ( { s }∪ T ) . Then Q ·C n is an m -dimensional linear networkcode over F q on G , of which the global encoding kernels are Q · ~f ( n ) e , e ∈ E . This linear network code Q · C n is called the transformation of C n by the matrix Q . In particular, Q · C n is decodable providedthat Q is full row rank, i.e., Rank (cid:0) Q (cid:1) = m . Now, we present the secure network coding model. The source node s generates a random sourcemessage M taking values in the message set F ωq according to the uniform distribution, where thenonnegative integer ω is called the information rate . The source message M needs to be multicastto each sink node t ∈ T , while being protected from a wiretapper who can access one but not more thanone arbitrary edge subset of size at most r , where the nonnegative integer r is called the security level .The network G with a required security level r is called an r - wiretap network . To combat the wiretapperin our wiretap network model, a random key generated at the source node is used to randomize the sourcemessage. This key is a random variable K taking values in a set of keys F rq according to the uniformdistribution.We now consider a secure linear network code (SLNC) on an r -wiretap network G . Let n = ω + r ,the sum of the information rate ω and the security level r . An F q -valued n -dimensional SLNC on the r -wiretap network G is an F q -valued n -dimensional linear network on G such that the following aresatisfied: • decoding condition : every sink node is able to decode the source message M with zero error; November 9, 2018 DRAFT • security condition : I ( Y A ; M ) = 0 , ∀ A ⊆ E with | A | ≤ r , where we denote by Y e the randomvariable transmitted on the edge e that is a linear function of the random source message M andthe random key K , and denote ( Y e : e ∈ A ) by Y A for a subset A ⊆ E .The nonnegative integers ω and r are also referred to as the information rate and security level of theSLNC, respectively. When r = 0 , the secure network coding model reduces to the original networkcoding model.Next, we specify a construction of SLNCs which will be used subsequently. Before specifying thiscode construction, we need several graph-theoretic concepts. By applying these concepts, the requiredfield size for the existence of SLNCs can be reduced significantly. Let A ⊆ E be an edge subset. Aminimum cut between s and A is primary if it separates s and all the minimum cuts between s and A .Such a primary minimum cut is unique and can be found in polynomial time [2]. Furthermore, we sayan edge subset is primary if this edge subset itself is its primary minimum cut from s . We use A r todenote the set of primary edge subsets of size r , i.e., A r = (cid:8) A ⊆ E : A is primary and | A | = r (cid:9) . Guang and Yeung [2] showed that | A r | is an improved lower bound on the field size for the existenceof SLNCs, and the improvement can be significant.Now, we present the construction of SLNCs of Cai and Yeung [8]. Let ω and r be the information rateand the security level, respectively, and n , ω + r ≤ C min . Let C n be an n -dimensional linear networkcode with global encoding kernels ~f ( n ) e , e ∈ E over a finite field F q on the network G . Let ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) ω be ω linearly independent column vectors in F nq such that (cid:10) ~b ( n ) i : 1 ≤ i ≤ ω (cid:11) \ (cid:10) ~f ( n ) e : e ∈ A (cid:11) = { ~ } , ∀ A ∈ A r . (4)Let ~b ( n ) ω +1 , ~b ( n ) ω +2 , · · · , ~b ( n ) n be another n − ω column vectors in F nq such that the total n vectors ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) n are linearly independent, and let Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i . Then, ( Q ( n ) ) − · C n , thetransformation of C n by ( Q ( n ) ) − (cf. Proposition 1), is an n -dimensional SLNC of information rate ω and security level r . In using the SLNC ( Q ( n ) ) − · C n , we let m , a row ω -vector in F ωq , be the value ofthe source message M , and k , a row r -vector in F rq , be the value of the random key K . Then x = (cid:0) m k (cid:1) is the input of the source node s . With this setting, it was proved in [8] that this coding scheme not onlymulticasts the source message M to all the sink nodes at rate ω but also achieves security level r . Here, I ( Y A ; M ) denotes the mutual information between Y A and M . We refer the reader to Example 1 in Section III-B for illustrations of A r . November 9, 2018 DRAFT
III. S
ECURE N ETWORK C ODING FOR A F IXED R ATE AND A F LEXIBLE S ECURITY L EVEL
In this section, we consider the problem of designing a family of local-encoding-preserving SLNCs fora fixed information rate and multiple security levels. First, we present the following lemma that showsthe existence of a family of local-encoding-preserving decodable linear network codes in which the linearnetwork codes have distinct dimensions.
Lemma 1.
Let C C min = (cid:8) ~f ( C min ) e : e ∈ E (cid:9) be a C min -dimensional decodable linear network code overthe finite field F q on the network G = ( V, E ) , where C min = min t ∈ T C t . Let C n = (cid:2) I n (cid:3) · C C min = n ~f ( n ) e , (cid:2) I n (cid:3) · ~f ( C min ) e : e ∈ E o , ≤ n ≤ C min , where we use in bold face to stand for an all-zero matrix of size n × ( C min − n ) and thus ~f ( n ) e is thesub-vector of ~f ( C min ) e containing the first n components. Then, (cid:8) C n : n = 1 , , · · · , C min (cid:9) constitute afamily of decodable linear network codes over F q on G with dimensions from 1 to C min , and have thesame local encoding kernels at the non-source nodes.Proof: This lemma can be proved straightforwardly by involving Corollary 2 in [1], in which wetake the column vector ~ℓ to be the all-zero column vector ~ repeatedly with appropriate dimension.Based on the SLNC construction at the end of Section II and Lemma 1, we naturally put forward thefollowing approach for constructing a family of local-encoding-preserving SLNCs of the same informationrate ω and security levels from to C min − ω . First, we apply Lemma 1 to obtain a family of local-encoding-preserving linear network codes (cid:8) C n : n = ω, ω + 1 , · · · , C min (cid:9) of dimensions from ω to C min . Next, for each n -dimensional linear network code C n , we let r = n − ω and design an n × n invertible matrix Q ( n ) satisfying (4). Then, we construct a family of SLNCs (cid:8) ( Q ( n ) ) − · C n : n = ω, ω + 1 , · · · , C min (cid:9) , which have the same rate ω and different security levels from to C min − ω .However, the above approach not only requires the construction of the matrix Q ( n ) for each n , incurringa high computational complexity, but also requires the source node s to store all the matrices Q ( n ) . Toavoid these shortcomings, we put forward the following more efficient approach to solve this problem.
A. Approach and Technique
We first present the following lemma which is instrumental to our approach. The computational complexity of the construction of Q ( n ) is shown to be O (cid:0) ωn | A r | + ωn | A r | + rn (cid:1) in Appendix Ain [1], and the storage cost is O (cid:0) n (cid:1) . November 9, 2018 DRAFT
Lemma 2.
Let ω and r be the information rate and the security level, respectively, and let n = ω + r .Consider an n -dimensional linear network code C n = (cid:8) ~f ( n ) e : e ∈ E (cid:9) over a finite field F q on thenetwork G , and an n × n invertible matrix Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i over F q . Then, ( Q ( n ) ) − · C n is a rate- ω and security-level- r SLNC over F q on G if and only if (4) is satisfied, i.e., (cid:10) ~b ( n ) i : 1 ≤ i ≤ ω (cid:11) \ (cid:10) ~f ( n ) e : e ∈ A (cid:11) = { ~ } , ∀ A ∈ A r . In order to prove Lemma 2, we need the following lemma. Before stating this lemma, we first let B ( n ) j = (cid:10) ~b ( n ) i : 1 ≤ i ≤ j (cid:11) and L ( n ) A = (cid:10) ~f ( n ) e : e ∈ A (cid:11) for any j ≤ n ≤ C min and any A ⊆ E . Lemma 3.
Let ω and r be the information rate and the security level, respectively, and let n = ω + r .Consider an n -dimensional linear network code C n = (cid:8) ~f ( n ) e : e ∈ E (cid:9) over a finite field F q on thenetwork G and ω linearly independent column n -vectors ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) ω . Then, B ( n ) ω \ L ( n ) A = { ~ } , ∀ A ∈ A r (5) if and only if B ( n ) ω \ L ( n ) A = { ~ } , ∀ A ∈ E r , (6) where E r is the set of the edge subsets of size not larger than r , i.e., E r = { A ⊆ E : | A | ≤ r } .Proof: The “if” part is evident since A r ⊆ E r . We prove the “only if” part in the following. Consideran arbitrary wiretap set A in E r (not necessarily regular) and a minimum cut CUT A between s and A .Clearly, this minimum cut CUT A is regular and | CUT A | ≤ r . Since r ≤ n ≤ C min , we can chooseanother r ′ , r − | CUT A | edges e , e , · · · , e r ′ such that the edge subset B , CUT A S { e , e , · · · , e r ′ } is regular. Let B ′ be the primary minimum cut between s and B , which, together with | B | = r , impliesthat B ′ is primary and | B ′ | = r . We thus obtain that the wiretap set A in E r is separated by the primaryedge subset B ′ in A r from s . It follows from the mechanism of network coding that (cid:10) ~f ( n ) e : e ∈ A (cid:11) ⊆ (cid:10) ~f ( n ) e : e ∈ B ′ (cid:11) , which, together with (5) implies that B ( n ) ω \ L ( n ) A = { ~ } . The lemma is proved.
Proof of Lemma 2:
The “if” part can be proved immediately by combining Lemma 3 with the proofof Theorem 2 in [8] (cf. [8, Section V]). So, it suffices to prove the “only if” part. In fact, Remark 1
November 9, 2018 DRAFT in [8] gives an intuitive explanation about the “only if” part. In the following, we will give a rigorousproof.Let Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i be an n × n invertible matrix over F q such that ( Q ( n ) ) − · C n is arate- ω and security-level- r SLNC over F q on G . Assume the contrary that there exists a nonzero column n -vector ~v such that ~v ∈ (cid:10) ~b ( n ) i : 1 ≤ i ≤ ω (cid:11) T (cid:10) ~f ( n ) e : e ∈ A (cid:11) for some wiretap subset A in A r . Thenthere exist α , α , · · · , α ω in F q , not all zero, such that ~v = ω X i =1 α i ~b ( n ) i , (7)and another r elements in F q , denoted by β e , e ∈ A , which are not all zero, such that ~v = X e ∈ A β e ~f ( n ) e . (8)Combining (7) and (8), we have ~v = X e ∈ A β e ~f ( n ) e = ω X i =1 α i ~b ( n ) i . (9)With the invertibility of the matrix Q ( n ) , the equality (9) is equivalent to the following: ~ = ~v ′ , ( Q ( n ) ) − · ~v = X e ∈ A β e · ( Q ( n ) ) − · ~f ( n ) e = ω X i =1 α i · ( Q ( n ) ) − · ~b ( n ) i = ω X i =1 α i ~ ( n ) i , (10)where we note that ( Q ( n ) ) − · ~b ( n ) i = ~ ( n ) i , ≤ i ≤ ω , with ~ ( n ) i being the n -column indicator vector ofthe i th component. Let ~v ′ = (cid:0) v ′ , v ′ , · · · , v ′ n (cid:1) . By (10), we obtain v ′ ω +1 = v ′ ω +2 = · · · = v ′ n = 0 . (11)Now, we consider an arbitrary row ω -vector m in F ωq and an arbitrary row r -vector k in F rq . Togetherwith (11), we have (cid:0) m k (cid:1) · ~v ′ = (cid:0) m k (cid:1) ω X i =1 α i ~ ( n ) i = (cid:0) m k (cid:1) X e ∈ A β e · ( Q ( n ) ) − · ~f ( n ) e = X e ∈ A β e · h(cid:0) m k (cid:1) · ( Q ( n ) ) − · ~f ( n ) e i = X e ∈ A β e · y e , (12)where y e in F q is the message transmitted in the edge e when the source message M and the randomkey K takes the values m and k , respectively.Combining (11) and (12), we thus obtain (cid:0) m k (cid:1) · ~v ′ = m · (cid:0) v ′ v ′ · · · v ′ ω (cid:1) ⊤ = X e ∈ A β e · y e . (13)In other words, the effects of the random key K on the messages transmitted on the edges in A can beremoved by taking a linear combination of these messages. Also, we see from the second equality abovethat for any given set of messages transmitted on the edges in A , the source message m is constrained. November 9, 2018 DRAFT0
Next, we calculate the conditional probability Pr (cid:0) M = m | Y A = y A ) , where Y A = ( Y e , e ∈ A ) and y A = ( y e , e ∈ A ) . We first let F A = h ( Q ( n ) ) − · ~f ( n ) e : e ∈ A i , so that (cid:0) m k (cid:1) · F A = y A . (14)Then Pr (cid:0) M = m | Y A = y A )= Pr (cid:0) M = m , Y A = y A )Pr (cid:0) Y A = y A )= P k ′ ∈ F rq Pr (cid:0) M = m , K = k ′ , Y A = y A )Pr (cid:0) Y A = y A )= P k ′ ∈ F rq Pr (cid:0) Y A = y A | M = m , K = k ′ ) · Pr (cid:0) M = m , K = k ′ )Pr (cid:0) Y A = y A )= P k ′ ∈ F rq s.t. ( m k ′ ) · F A = y A · Pr (cid:0) M = m , K = k ′ ) P ( m ′ k ′ ) ∈ F nq s.t. ( m ′ k ′ ) · F A = y A Pr (cid:0) Y A = y A | M = m ′ , K = k ′ ) · Pr (cid:0) M = m ′ , K = k ′ )= P k ′ ∈ F rq s.t. ( m k ′ ) · F A = y A Pr (cid:0) M = m , K = k ′ ) P ( m ′ k ′ ) ∈ F nq s.t. ( m ′ k ′ ) · F A = y A Pr (cid:0) M = m ′ , K = k ′ )= (cid:8) k ′ ∈ F rq : ( m k ′ ) · F A = y A (cid:9) (cid:8) ( m ′ k ′ ) ∈ F nq : ( m ′ k ′ ) · F A = y A (cid:9) , (15)where we use “ {·} ” to stand for the cardinality of the set, and the last equality (15) holds because M and K are independent and uniformly distributed over F ωq and F rq , respectively.We further write F A = F A,ω F A,r , (16)where F A,ω is the sub-matrix containing the first ω row vectors of F A , and F A,r is the one containingthe remaining r row vectors of F A . With (16), we have (cid:8) k ′ ∈ F rq : ( m k ′ ) · F A = y A (cid:9) = (cid:8) k ′ ∈ F rq : k ′ F A,r = y A − m F A,ω (cid:9) = q r − Rank( F A,r ) , (17)where the last equality holds since there exists a solution k ′ (e.g., k by (14)) for the equation k ′ F A,r = y A − m F A,ω .Furthermore, since we have proved that the equality (13) holds for all pairs ( m k ) of m ∈ F ωq and k ∈ F rq satisfying (14), we obtain that (cid:8) ( m ′ k ′ ) ∈ F nq : ( m ′ k ′ ) · F A = y A (cid:9) November 9, 2018 DRAFT1 = n ( m ′ k ′ ) ∈ F nq : ( m ′ k ′ ) · F A = y A and m ′ · (cid:0) v ′ v ′ · · · v ′ ω (cid:1) ⊤ = X e ∈ A β e y e o = [ m ′ ∈ F ωq s.t. m ′ · (cid:0) v ′ v ′ ··· v ′ ω (cid:1) ⊤ = P e ∈ A β e y e (cid:8) ( m ′ k ′ ) ∈ F nq : ( m ′ k ′ ) · F A = y A (cid:9) = X m ′ ∈ F ωq s.t. m ′ · (cid:0) v ′ v ′ ··· v ′ ω (cid:1) ⊤ = P e ∈ A β e y e (cid:8) k ′ ∈ F rq : ( m ′ k ′ ) · F A = y A (cid:9) = X m ′ ∈ F ωq s.t. m ′ · (cid:0) v ′ v ′ ··· v ′ ω (cid:1) ⊤ = P e ∈ A β e y e (cid:8) k ′ ∈ F rq : k ′ F A,r = y A − m ′ F A,ω (cid:9) ≤ X m ′ ∈ F ωq s.t. m ′ · (cid:0) v ′ v ′ ··· v ′ ω (cid:1) ⊤ = P e ∈ A β e y e q r − Rank( F A,r ) (18) = n m ′ ∈ F ωq : m ′ · (cid:0) v ′ v ′ · · · v ′ ω (cid:1) ⊤ = X e ∈ A β e y e o · q r − Rank( F A,r ) = q ω − · q r − Rank( F A,r ) , (19)where the inequality (18) follows from the fact that for the given m ′ ∈ F ωq , (cid:8) k ′ ∈ F rq : k ′ F A,r = y A − m ′ F A,ω (cid:9) = q r − Rank( F A,r ) , if k ′ F A,r = y A − m ′ F A,ω has a solution, , otherwise.Substituting (17) and (19) into (15), we immediately prove that Pr (cid:0) M = m | Y A = y A ) ≥ q ω − . Hence, Pr (cid:0) M = m | Y A = y A ) = Pr (cid:0) M = m (cid:1) = 1 q ω , a contradiction to H ( M ) = H ( M | Y A ) , namely that the SLNC ( Q ( n ) ) − · C n achieves the security level r .The lemma is proved.Let C C min = (cid:8) ~f ( C min ) e : e ∈ E (cid:9) be a C min -dimensional linear network code over F q on the network G . Let ω be the fixed information rate. By Lemma 1, C n = n ~f ( n ) e , (cid:2) I n (cid:3) · ~f ( C min ) e : e ∈ E o , n = ω, ω + 1 , · · · , C min constitute a family of local-encoding-preserving linear network codes with dimensions from ω to C min .Note that C ω can be regarded as an ω -dimensional SLNC with rate ω and security level . Further, for any Here, in bold face stands for an all-zero matrix of size n × ( C min − n ) . November 9, 2018 DRAFT2 ω × ω invertible matrix Q ( ω ) = h ~b ( ω )1 ~b ( ω )2 · · · ~b ( ω ) ω i , it follows from Proposition 1 that ( Q ( ω ) ) − · C ω also is an ω -dimensional SLNC with rate ω and security level .Now, consider any n -dimensional ( ω ≤ n ≤ C min − ) SLNC ( Q ( n ) ) − · C n with the fixed rate ω and security level r , n − ω , where we write Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i . By Lemma 2, this isequivalent to that Q ( n ) is an n × n invertible matrix satisfying (cid:10) ~b ( n ) i : 1 ≤ i ≤ ω (cid:11) \ (cid:10) ~f ( n ) e : e ∈ A (cid:11) = { ~ } , ∀ A ∈ A r . Based on the SLNC ( Q ( n ) ) − · C n , we will construct an ( n +1) -dimensional SLNC ( Q ( n +1) ) − · C n +1 withrate ω and security level r +1 . Our idea is to design an appropriate row ω -vector ~c = (cid:0) c c · · · c ω (cid:1) ∈ F ωq to obtain ω column ( n + 1) -vectors ~b ( n +1) i , ~b ( n ) i c i , ≤ i ≤ ω , such that ~b ( n +1) i , ≤ i ≤ ω , arelinearly independent, and (cid:10) ~b ( n +1) i : 1 ≤ i ≤ ω (cid:11) \ (cid:10) ~f ( n +1) e : e ∈ A (cid:11) = { ~ } , ∀ A ∈ A r +1 . Then with ~b ( n +1) i , ≤ i ≤ ω , we construct another n + 1 − ω column ( n + 1) -vectors ~b ( n +1) ω +1 , ~b ( n +1) ω +2 , · · · , ~b ( n +1) n +1 such that h ~b ( n +1)1 ~b ( n +1)2 · · · ~b ( n +1) n +1 i , denoted by Q ( n +1) , is an ( n + 1) × ( n + 1) invertiblematrix. In this way, we can construct an ( n +1) -dimensional SLNC ( Q ( n +1) ) − ·C n +1 that retains the fixedrate ω , achieves a higher security level r + 1 , and has the same local encoding kernels as ( Q ( n ) ) − · C n at all the non-source nodes by Proposition 1.Next, we will design such an appropriate vector ~c , which is the crucial to our proposed approach.Based on C n , we partition A r +1 into two disjoint subsets: f A ′ r +1 = (cid:8) A ∈ A r +1 : ~f ( n ) e , e ∈ A, are linearly dependent (cid:9) , (20) f A ′′ r +1 = (cid:8) A ∈ A r +1 : ~f ( n ) e , e ∈ A, are linearly independent (cid:9) . (21) Lemma 4.
For f A ′ r +1 and f A ′′ r +1 , f A ′ r +1 = (cid:8) A ∈ A r +1 : B ( n ) ω \ L ( n ) A = { ~ } (cid:9) , (22) and f A ′′ r +1 = (cid:8) A ∈ A r +1 : B ( n ) ω \ L ( n ) A = { ~ } (cid:9) . (23) Proof:
It suffices to prove that for any A ∈ A r +1 , the vectors ~f ( n ) e , e ∈ A , are linearly independentif and only if B ( n ) ω T L ( n ) A = { ~ } . For the “only if” part, since ~f ( n ) e , e ∈ A , are linearly independent, wehave dim (cid:0) L ( n ) A (cid:1) = r + 1 . Thus, dim (cid:0) B ( n ) ω \ L ( n ) A (cid:1) = dim (cid:0) B ( n ) ω (cid:1) + dim (cid:0) L ( n ) A (cid:1) − dim (cid:0) B ( n ) ω + L ( n ) A (cid:1) ≥ ω + ( r + 1) − n = 1 , November 9, 2018 DRAFT3 where the inequality follows from dim (cid:0) B ( n ) ω + L ( n ) A (cid:1) ≤ n = ω + r . This implies B ( n ) ω T L ( n ) A = { ~ } .For the “if” part, we let A ′ ⊆ A such that (cid:8) ~f ( n ) e : e ∈ A ′ (cid:9) is a maximal linearly independent subsetof (cid:8) ~f ( n ) e : e ∈ A (cid:9) . Then, we have B ( n ) ω \ L ( n ) A ′ = B ( n ) ω \ L ( n ) A = { ~ } . (24)This immediately implies A ′ = A , because otherwise | A ′ | ≤ r , which together with B ( n ) ω T L ( n ) A ′ = { ~ } in (24), contradicts to (6) and thus (5) by Lemma 3. Therefore, ~f ( n ) e , e ∈ A are linearly independent.The lemma is proved.We first consider those wiretap sets in f A ′ r +1 . The following theorem asserts that any vector ~c ∈ F ωq isfeasible for the wiretap sets in f A ′ r +1 . Theorem 5.
For any row ω -vector ~c = ( c c · · · c ω ) ∈ F ωq , the following are satisfied: • the column ( n + 1) -vectors ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω , are linearly independent; • B ( n +1) ω T L ( n +1) A = { ~ } , ∀ A ∈ f A ′ r +1 .Proof: First, we note that the column n -vectors ~b ( n ) i , ≤ i ≤ ω , are linearly independent, and soare the column ( n + 1) -vectors ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω .Next, we prove by contradiction that for any ~c = ( c c · · · c ω ) ∈ F ωq , B ( n +1) ω \ L ( n +1) A = { ~ } , ∀ A ∈ f A ′ r +1 . Assume that there exists an edge subset A ∈ f A ′ r +1 such that B ( n +1) ω T L ( n +1) A = { ~ } , and let ~v ( n +1) = (cid:2) v v · · · v n +1 (cid:3) ⊤ be a nonzero vector in B ( n +1) ω T L ( n +1) A . Then, there exist α , α , · · · , α ω in F q ,not all zero, such that ~v ( n +1) = ω X i =1 α i ~b ( n +1) i , (25)and another r + 1 elements in F q , denoted by β e , e ∈ A , which are not all zero, such that ~v ( n +1) = X e ∈ A β e ~f ( n +1) e . (26)We further write (25) and (26) respectively as ~v ( n ) v n +1 = ω X i =1 α i ~b ( n ) i c i , (27)and ~v ( n ) v n +1 = X e ∈ A β e ~f ( n ) e f e,n +1 , (28) November 9, 2018 DRAFT4 where ~v ( n ) is the sub-vector of ~v ( n +1) obtained by deleting the last component v n +1 , i.e., ~v ( n ) = (cid:2) v v · · · v n (cid:3) ⊤ , and f e,n +1 is the last component of ~f ( n +1) e . Combining (27) and (28), we immediatelyobtain ~v ( n ) = ω X i =1 α i ~b ( n ) i = X e ∈ A β e ~f ( n ) e , which implies ~v ( n ) ∈ B ( n ) ω T L ( n ) A . On the other hand, since ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) ω are linearly independent,and α , α , · · · , α ω are not all zero, we immediately have ~v ( n ) = ~ , implying that B ( n ) ω T L ( n ) A = { ~ } .This is a contradiction to the assumption that A ∈ f A ′ r +1 (cf. (22) in Lemma 4). The theorem is proved.Next, we consider the vectors ~c ∈ F ωq that are feasible for the wiretap sets in f A ′′ r +1 . We first prove thefollowing lemma. Lemma 6.
For any edge subset A ∈ f A ′′ r +1 , dim (cid:0) B ( n ) ω T L ( n ) A (cid:1) = 1 .Proof: Let A be an arbitrary edge subset in f A ′′ r +1 . By (23) in Lemma 4, we assume that there existtwo linearly independent vectors ~v ( n )1 and ~v ( n )2 in B ( n ) ω T L ( n ) A . Then, there exist ( α ,i , ≤ i ≤ ω ) and ( α ,i , ≤ i ≤ ω ) in F ωq , and ( β ,e , e ∈ A ) and ( β ,e , e ∈ A ) in F r +1 q such that ~v ( n )1 = ω X i =1 α ,i ~b ( n ) i = X e ∈ A β ,e ~f ( n ) e , (29)and ~v ( n )2 = ω X i =1 α ,i ~b ( n ) i = X e ∈ A β ,e ~f ( n ) e . (30)The linear independence of ~v ( n )1 and ~v ( n )2 implies that both of them are nonzero. Together with thelinear independence of ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) ω , we obtain that ( α ,i , ≤ i ≤ ω ) and ( α ,i , ≤ i ≤ ω ) arenonzero vectors.Next, we prove that β ,e , e ∈ A are all nonzero. Assume otherwise, i.e., β ,e ′ = 0 for some e ′ ∈ A .Then, by (29) we have ~ = ~v ( n )1 ∈ B ( n ) ω \ (cid:10) ~f ( n ) e : e ∈ A \ { e ′ } (cid:11) = B ( n ) ω \ L ( n ) A \{ e ′ } . (31)We further note that the edge subset A \ { e ′ } has cardinality r , implying that A \ { e ′ } ∈ E r . This isa contradiction to B ( n ) ω T L ( n ) B = { ~ } for all B ∈ E r , which follows from Lemmas 2 and 3 because ( Q ( n ) ) − · C n is an n -dimensional SLNC with rate ω and security level r . Thus, β ,e , e ∈ A are allnonzero. Likewise, β ,e , e ∈ A are all nonzero. November 9, 2018 DRAFT5
Fix any e ′′ ∈ A . Then β ,e ′′ and β ,e ′′ are both nonzero. Let γ = − β ,e ′′ /β ,e ′′ which is a nonzeroelement in F q . Then β ,e ′′ + γβ ,e ′′ = 0 . (32)On the other hand, ~v ( n )1 + γ~v ( n )2 = ~ because ~v ( n )1 and ~v ( n )2 are linearly independent. By (29) and (30),we obtain ~v ( n )1 + γ~v ( n )2 = ω X i =1 ( α ,i + γα ,i ) ~b ( n ) i = X e ∈ A ( β ,e + γβ ,e ) ~f ( n ) e = X e ∈ A \{ e ′′ } ( β ,e + γβ ,e ) ~f ( n ) e , where the last equality follows from (32).Therefore, the nonzero vector ~v ( n )1 + γ~v ( n )2 is in B ( n ) ω T (cid:10) ~f ( n ) e : e ∈ A \ { e ′′ } (cid:11) = B ( n ) ω T L ( n ) A \{ e ′′ } ,which implies B ( n ) ω \ L ( n ) A \{ e ′′ } = { ~ } . By the same argument following (31), this contradicts B ( n ) ω T L ( n ) B = { ~ } for all B ∈ E r . Thus we haveproved that there cannot exist ~v ( n )1 and ~v ( n )2 in B ( n ) ω T L ( n ) A that are linearly independent. Together with(23) in Lemma 4, this implies that dim (cid:0) B ( n ) ω T L ( n ) A (cid:1) = 1 . The lemma is proved. Theorem 7.
For each wiretap set A ∈ f A ′′ r +1 , define a set of row ω -vectors as follows: Γ A = n ~c = (cid:0) c c · · · c ω (cid:1) ∈ F ωq : ω X i =1 α i c i = X e ∈ A β e f e,n +1 , where (cid:0) α i , ≤ i ≤ ω (cid:1) ∈ F ωq and (cid:0) β e , e ∈ A (cid:1) ∈ F r +1 q s.t. ω X i =1 α i ~b ( n ) i = X e ∈ A β e ~f ( n ) e = ~ o , (33) where f e,n +1 is the last component of the global encoding kernel ~f ( n +1) e . Then for any row ω -vector ~c = (cid:0) c c · · · c ω (cid:1) ∈ F ωq \ S A ∈ f A ′′ r +1 Γ A , the following are satisfied: • the column ( n + 1) -vectors ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω , are linearly independent; • B ( n +1) ω T L ( n +1) A = { ~ } , ∀ A ∈ f A ′′ r +1 . Remark 8.
In the definition of Γ A in (33) , by virtue of Lemma 6, there always exist (cid:0) α i , ≤ i ≤ ω (cid:1) ∈ F ωq and (cid:0) β e , e ∈ A (cid:1) ∈ F r +1 q that satisfy the required condition. Then for any given such (cid:0) α i , ≤ i ≤ ω (cid:1) November 9, 2018 DRAFT6 and (cid:0) β e , e ∈ A (cid:1) , there always exists ~c ∈ F ωq satisfying P ωi =1 α i c i = P e ∈ A β e f e,n +1 . Therefore, Γ A isalways nonempty.Proof of Theorem 7: First, the ω column n -vectors ~b ( n ) i , ≤ i ≤ ω , are linearly independent, and soare the ω column ( n +1) -vectors ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω , for any row ω -vector ~c = (cid:0) c c · · · c ω (cid:1) in F ωq . Thus, we obtain dim (cid:0) B ( n ) ω (cid:1) = dim (cid:0) B ( n +1) ω (cid:1) . (34)Let A be an arbitrary wiretap set in f A ′′ r +1 . By the definition (cf. (21)), we have dim (cid:0) L ( n ) A (cid:1) = | A | .This implies dim (cid:0) L ( n +1) A (cid:1) = dim (cid:0) L ( n ) A (cid:1) = r + 1 , (35)or equivalently, ~f ( n +1) e , e ∈ A are linearly independent. By (34) and (35), we see that dim (cid:0) B ( n +1) ω \ L ( n +1) A (cid:1) = dim (cid:0) B ( n +1) ω (cid:1) + dim (cid:0) L ( n +1) A (cid:1) − dim (cid:0) B ( n +1) ω + L ( n +1) A (cid:1) ≤ dim (cid:0) B ( n ) ω (cid:1) + dim (cid:0) L ( n ) A (cid:1) − dim (cid:0) B ( n ) ω + L ( n ) A (cid:1) = dim (cid:0) B ( n ) ω \ L ( n ) A (cid:1) = 1 , (36)where the last equality follows from Lemma 6.Let ~v ( n ) be any nonzero column n -vector in B ( n ) ω T L ( n ) A . It then follows from Lemma 6 that B ( n ) ω \ L ( n ) A = (cid:8) γ~v ( n ) , γ ∈ F q (cid:9) . (37)Next, we will prove the claim that dim (cid:0) B ( n +1) ω T L ( n +1) A (cid:1) = 1 if and only if the vector ~c = (cid:0) c c · · · c ω (cid:1) satisfies ω X i =1 α i c i = X e ∈ A β e f e,n +1 , (38)where (cid:0) α i , ≤ i ≤ ω (cid:1) and (cid:0) β e , e ∈ A (cid:1) are two nonzero row vectors over F q such that ~v ( n ) = ω X i =1 α i ~b ( n ) i = X e ∈ A β e ~f ( n ) e . (39)For the “if” part, since ~b ( n ) i , ≤ i ≤ ω , are linearly independent and ~f ( n ) e , e ∈ A are also linearlyindependent (because A ∈ f A ′′ r +1 ), it follows from (39) that the vectors (cid:0) α i , ≤ i ≤ ω (cid:1) and (cid:0) β e , e ∈ A (cid:1) are unique. Let v ∈ F q be the common value of both sides of (38). Then by combining (39) and (38),we have ~ = ~v ( n ) v = ω X i =1 α i ~b ( n ) i c i = X e ∈ A β e ~f ( n ) e f e,n +1 , November 9, 2018 DRAFT7 which immediately implies dim (cid:0) B ( n +1) ω T L ( n +1) A (cid:1) ≥ . Together with (36), it follows that dim (cid:0) B ( n +1) ω \ L ( n +1) A (cid:1) = 1 . For the “only if” part, since dim (cid:0) B ( n +1) ω T L ( n +1) A (cid:1) = 1 , we let ~ = ~u ( n +1) , ~u ( n ) u n +1 ∈ B ( n +1) ω \ L ( n +1) A , where ~u ( n ) is a column n -vector and u n +1 is an element in F q . Then, there exist unique vectors (cid:0) α ′ i , ≤ i ≤ ω (cid:1) and (cid:0) β ′ e , e ∈ A (cid:1) , both nonzero, such that ~u ( n +1) = ω X i =1 α ′ i ~b ( n +1) i = X e ∈ A β ′ e ~f ( n +1) e , or equivalently, ~u ( n ) = ω X i =1 α ′ i ~b ( n ) i = X e ∈ A β ′ e ~f ( n ) e , (40)and u n +1 = ω X i =1 α ′ i c i = X e ∈ A β ′ e f e,n +1 . (41)From (40), since ~b ( n ) i , ≤ i ≤ ω is linearly independent and (cid:0) α ′ i , ≤ i ≤ ω (cid:1) is a nonzero vector, itfollows that ~u ( n ) = ~ and ~u ( n ) ∈ B ( n ) ω T L ( n ) A . Thus, we have ~u ( n ) = γ~v ( n ) for some γ ∈ F q \ { } .Together with (39), we further have ~u ( n ) = γ~v ( n ) = ω X i =1 γα i ~b ( n ) i = X e ∈ A γβ e ~f ( n ) e . (42)Upon comparing (40) and (42), we obtain (cid:0) α ′ i , ≤ i ≤ ω (cid:1) = γ (cid:0) α i , ≤ i ≤ ω (cid:1) (43)and (cid:0) β ′ e , e ∈ A (cid:1) = γ (cid:0) β e , e ∈ A (cid:1) . (44)Thus, from (43), (44), and the second equality in (41), we obtain (38), proving the “only if” part of theclaim.Next, we define a set of row ω -vectors associated with each nonzero vector ~v ( n ) in B ( n ) ω T L ( n ) A asfollows: Γ A (cid:0) ~v ( n ) (cid:1) = n ~c = (cid:0) c c · · · c ω (cid:1) ∈ F ωq : ω X i =1 α i c i = X e ∈ A β e f e,n +1 , where (cid:0) α i , ≤ i ≤ ω (cid:1) ∈ F ωq November 9, 2018 DRAFT8 and (cid:0) β e , e ∈ A (cid:1) ∈ F r +1 q s.t. ~v ( n ) = ω X i =1 α i ~b ( n ) i = X e ∈ A β e ~f ( n ) e = ~ o . (45)Then, in light of (36), the foregoing claim is equivalent to B ( n +1) ω \ L ( n +1) A = { ~ } ⇐⇒ ~c ∈ Γ A (cid:0) ~v ( n ) (cid:1) . (46)Since the LHS above does not depend on ~v ( n ) , we see immediately that Γ A (cid:0) ~v ( n ) (cid:1) also does not dependon ~v ( n ) . Upon noting by (33) that Γ A = [ ~v ( n ) ∈B ( n ) ω T L ( n ) A \{ ~ } Γ A (cid:0) ~v ( n ) (cid:1) , (47)we obtain that Γ A = Γ A (cid:0) ~v ( n ) (cid:1) , (48)where ~v ( n ) is any vector in B ( n ) ω T L ( n ) A \ { ~ } . Hence, (46) is equivalent to B ( n +1) ω \ L ( n +1) A = { ~ } ⇐⇒ ~c ∈ Γ A , or equivalently, B ( n +1) ω \ L ( n +1) A = { ~ } ⇐⇒ ~c ∈ F ωq \ Γ A . Based on the above, the theorem can be proved immediately by considering all wiretap sets A ∈ f A ′′ r +1 .By combining Theorems 5 and 7, we present the following theorem which gives the prescription fordesigning the vector ~c for A r +1 . Theorem 9.
Let F q be a finite field of order q > | f A ′′ r +1 | . Then the set F ωq \ S A ∈ f A ′′ r +1 Γ A is nonempty,and for any ~c = (cid:0) c c · · · c ω (cid:1) in this set, the following are satisfied: • the column ( n + 1) -vectors ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω , are linearly independent; • B ( n +1) ω T L ( n +1) A = { ~ } , ∀ A ∈ A r +1 .Proof: We only need prove that if q > | f A ′′ r +1 | , then F ωq \ S A ∈ f A ′′ r +1 Γ A is nonempty. The rest of thetheorem follows immediately from Theorems 5 and 7.Let A be an arbitrary wiretap set in f A ′′ r +1 . By the proof of Theorem 7, we have Γ A = Γ A (cid:0) ~v ( n ) (cid:1) (cf. (48)) for any nonzero vector ~v ( n ) ∈ B ( n ) ω ∩ L ( n ) A . By the uniqueness of the vectors (cid:0) α i , ≤ i ≤ ω (cid:1) November 9, 2018 DRAFT9 and (cid:0) β e , e ∈ A (cid:1) in (39) for a fixed ~v ( n ) , we further have | Γ A | = (cid:12)(cid:12) Γ A (cid:0) ~v ( n ) (cid:1)(cid:12)(cid:12) = q ω − from (38). So, if q > | f A ′′ r +1 | , we obtain (cid:12)(cid:12)(cid:12)(cid:12) F ωq \ [ A ∈ f A ′′ r +1 Γ A (cid:12)(cid:12)(cid:12)(cid:12) = (cid:12)(cid:12)(cid:12)(cid:12) F ωq (cid:12)(cid:12)(cid:12)(cid:12) − (cid:12)(cid:12)(cid:12)(cid:12) [ A ∈ f A ′′ r +1 Γ A (cid:12)(cid:12)(cid:12)(cid:12) ≥ q ω − X A ∈ f A ′′ r +1 | Γ A | = q ω − q ω − (cid:12)(cid:12) f A ′′ r +1 (cid:12)(cid:12) = q ω − (cid:0) q − (cid:12)(cid:12) f A ′′ r +1 (cid:12)(cid:12)(cid:1) > . The theorem is proved.Based on Theorem 9, for any vector ~c = (cid:0) c c · · · c ω (cid:1) in F ωq \ S A ∈ f A ′′ r +1 Γ A , we let ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω, ~b ( n +1) i = ~b ( n ) i , ω + 1 ≤ i ≤ n, and ~b ( n +1) n +1 = ~ . Then we let Q ( n +1) , h ~b ( n +1)1 ~b ( n +1)2 · · · ~b ( n +1) n ~b ( n +1) n +1 i , which is an ( n + 1) × ( n + 1) matrix. Consider Rank( Q ( n +1) ) = Rank ~b ( n )1 · · · ~b ( n ) ω ~b ( n ) ω +1 · · · ~b ( n ) n ~ c · · · c ω · · · = Rank ~b ( n )1 · · · ~b ( n ) ω ~b ( n ) ω +1 · · · ~b ( n ) n ~ c · · · c ω · · · · I n ~ − ~c = Rank ~b ( n )1 · · · ~b ( n ) ω ~b ( n ) ω +1 · · · ~b ( n ) n ~ · · · · · · (49) = Rank Q ( n ) ~ ~ ⊤ = n + 1 , (50)where the equality (49) follows because I n ~ − ~c is unit lower triangular and hence invertible, and theequality (50) follows from Rank( Q ( n ) ) = Rank (cid:16)h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i(cid:17) = n. In other words, Q ( n +1) is full rank. Then, ( Q ( n +1) ) − · C n +1 is an ( n + 1) -dimensional SLNC whichnot only retains the fixed rate ω and achieves the higher security level r + 1 , but also has the same localencoding kernels as the original n -dimensional SLNC ( Q ( n ) ) − · C n at all the non-source nodes. November 9, 2018 DRAFT0
B. An Algorithm for Code Construction
In the last subsection, we presented an approach for designing a family of local-encoding-preservingSLNCs for a fixed information rate and multiple security levels. In particular, Theorem 9 gives theprescription for designing an appropriate vector ~c which is crucial for constructing a local-encoding-preserving SLNC at one security level higher. However, Theorem 9 does not provide a method to find ~c readily. This is tackled in Algorithm 1, which gives a polynomial-time implementation for constructingan ( n +1) -dimensional SLNC with rate ω and security level r +1 (here n = ω + r ) from an n -dimensionalSLNC with rate ω and security level r , where the ( n + 1) -dimensional SLNC has the same local encodingkernels as the original n -dimensional SLNC at all the non-source nodes. Starting from r = 0 , by applyingAlgorithm 1 repeatedly, we can obtain a family of local-encoding-preserving SLNCs with a fixed rate ω and security levels from to C min − ω . This procedure is illustrated in Fig. 1. r ωC min C min ω Fig. 1: Local-encoding-preserving SLNCs for a fixed rate and a flexible security level.
November 9, 2018 DRAFT1
Algorithm 1:
Construction of a rate- ω and security-level- ( r + 1) SLNC from a rate- ω and security-level- r SLNC, both of which have the same local encoding kernels at all the non-source nodes.
Let C n and C n +1 be linear network codes defined in Lemma 1 with q > (cid:12)(cid:12) f A ′′ r +1 (cid:12)(cid:12) . Input:
An invertible n × n matrix Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i over F q such that ( Q ( n ) ) − · C n is an n -dimensionalSLNC with rate ω and security level r , where n = ω + r < C min . Output:
An invertible ( n + 1) × ( n + 1) matrix Q ( n +1) such that ( Q ( n +1) ) − · C n +1 is an ( n + 1) -dimensional SLNCwith rate ω and security level r + 1 . begin Set A = ∅ and ~c ∗ = (cid:0) c ∗ c ∗ · · · c ∗ ω (cid:1) = ~ ; for each A ∈ A r +1 do find a nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) for P ωi =1 α A,i ~b ( n ) i = P e ∈ A β e ~f ( n ) e ; // By Lemma 10, there always exists such a nonzero solution. if (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ then // By Lemma 10, (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ ⇔ A ∈ f A ′′ r +1 . compute λ A = P e ∈ A β e f e,n +1 ; save the pair (cid:0) α A,i , ≤ i ≤ ω (cid:1) and λ A ; // for the use in subsequent iterations of the “for” loop compute τ A = P ωi =1 α A,i c ∗ i ; if τ A = 0 then // Obtain a new ~c ∗ s.t. P ωi =1 α B,i c ∗ i = 0 , ∀ B ∈ A ∪ { A } . find ~h A = (cid:0) h A, h A, · · · h A,ω (cid:1) ∈ F ωq such that π A = P ωi =1 α A,i h A,i = 0 ; if A = ∅ then set ~c ∗ = ~h A ; else compute τ B = P ωi =1 α B,i c ∗ i and π B = P ωi =1 α B,i h A,i , ∀ B ∈ A ; // (cid:0) α B,i , ≤ i ≤ ω (cid:1) , B ∈ A have been saved in Line 6 in previous iterations of the “for” loop. // τ B = P ωi =1 α B,i c ∗ i = 0 , ∀ B ∈ A from the last iteration of the “for” loop. choose ξ ∈ F q such that ξ · τ B + π B = 0 , ∀ B ∈ A ; replace ~c ∗ by ξ~c ∗ + ~h A ; // For the updated ~c ∗ , τ A = 0 and τ B = 0 , ∀ B ∈ A . endend add A into A ; // Update A . Then τ B = 0 , ∀ B ∈ A . endend // After the “for” loop, A = f A ′′ r +1 and ~c ∗ satisfies τ A = 0 , ∀ A ∈ A = f A ′′ r +1 . choose an element θ in F q such that θ · τ A = λ A , ∀ A ∈ A ; calculate ~c = (cid:0) c c · · · c ω (cid:1) = θ (cid:0) c ∗ c ∗ · · · c ∗ ω (cid:1) = θ~c ∗ ; // θ · τ A = λ A , ∀ A ∈ A ⇒ P ωi =1 α A,i c i = λ A , ∀ A ∈ f A ′′ r +1 . // This ensures that ~c ∈ F ωq \ S A ∈ f A ′′ r +1 Γ A . let ~b ( n +1) i = ~b ( n ) i c i , ≤ i ≤ ω , ~b ( n +1) i = ~b ( n ) i , ω + 1 ≤ i ≤ n , and ~b ( n +1) n +1 = ~ ; return Q ( n +1) = h ~b ( n +1)1 ~b ( n +1)2 · · · ~b ( n +1) n +1 i . end November 9, 2018 DRAFT2
Verification of Algorithm 1:
For the purpose of verifying Algorithm 1, it suffices to verify that the vector ~c = (cid:0) c c · · · c ω (cid:1) obtained in Line 17 satisfies that ~c ∈ F ωq \ S A ∈ f A ′′ r +1 Γ A . First, we present the following lemma. Lemma 10.
Let A be any wiretap set in A r +1 . Then there always exists a nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) ∈ F n +1 q for the equation ω X i =1 α A,i ~b ( n ) i = X e ∈ A β e ~f ( n ) e , (51) and (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ ⇐⇒ A ∈ f A ′′ r +1 . (52) Proof:
The equation (51) can be written as the following system of linear equations h ~b ( n ) i , ≤ i ≤ ω, ~f ( n ) e , e ∈ A i · (cid:0) α A,i , ≤ i ≤ ω, − β e , e ∈ A (cid:1) ⊤ = ~ . (53)In view of the matrix on the LHS of the above equation of size n × ( n + 1) , (53) contains n linearequations and n + 1 variables (i.e., α A,i , ≤ i ≤ ω and β e , e ∈ A ), which implies that there must existnonzero solutions for (53), or equivalently, (51).We now prove the “only if” part of (52). Let (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) be a nonzero solution with (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ for (51). Together with the linear independence of ~b ( n ) i , ≤ i ≤ ω , we have ~ = ω X i =1 α A,i ~b ( n ) i = X e ∈ A β e ~f ( n ) e . This immediately implies that B ( n ) ω ∩ L ( n ) A = { ~ } , proving that A ∈ f A ′′ r +1 by Lemma 4.To prove the “if” part of (52), we assume the contrary that for a wiretap set A ∈ f A ′′ r +1 , there existsa nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) but (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ for the equation (51). Thus,we see that (cid:0) β e , e ∈ A (cid:1) = ~ . Together with the linear independence of ~f ( n ) e , e ∈ A (by the definition of f A ′′ r +1 in (21)), we obtain that P e ∈ A β e ~f ( n ) e = ~ . On the other hand, we have P ωi =1 α A,i ~b ( n ) i = ~ because (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ . This immediately contradicts the assumption that (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) is a solution for (51). This lemma is proved.By Lemma 10, it follows from Lines 3, 4, and 15 that after the “for” loop (Lines 2–15), the outputset A is equal to f A ′′ r +1 . Next, we will verify by induction that after every iteration for a wiretap set A ∈ A r +1 (Lines 3–15), the condition τ B = ω X i =1 α B,i c ∗ i = 0 , ∀ B ∈ A (54) November 9, 2018 DRAFT3 is satisfied for the updated ~c ∗ and the updated A . Then, upon completion of the “for” loop, with A = f A ′′ r +1 , this implies that the vector ~c ∗ satisfies τ A = ω X i =1 α A,i c ∗ i = 0 , ∀ A ∈ f A ′′ r +1 . (55)First, we note that the condition (54) is satisfied for A = ∅ and ~c ∗ = ~ . Assume that (54) is satisfiedafter a number of iterations of the “for” loop, with at least one wiretap set A ∈ A r +1 that has not beenprocessed. In the next iteration, one such A is processed. At this point, the set A contains the wiretapsets B in f A ′′ r +1 that have already been processed in the previous iterations. Case 1:
For the wiretap set A , if the nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) of the equation (51)found in Line 3 satisfies (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ (i.e., A ∈ f A ′ r +1 by Lemma 10), the “if” statement(Lines 4–15) is not executed. Then, the vector ~c ∗ and the set A are unchanged, so that by the inductionhypothesis, the condition (54) is satisfied. Case 2:
Otherwise, we let (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) with (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ be the nonzerosolution of the equation (51) found in Line 3 (i.e., A ∈ f A ′′ r +1 by Lemma 10). For this case, the “if”statement (Lines 4–15) is executed. Then, we compute τ A = P ωi =1 α A,i c ∗ i and consider the followingtwo subcases. Case 2A: τ A = 0 .The second “if” statement (Lines 8–14) is not executed, so that the vector ~c ∗ is unchanged. By Line 15,the set A is updated by including A . Combining τ A = 0 and the induction hypothesis, (54) is satisfiedfor the unchanged vector ~c ∗ and the updated set A . Case 2B: τ A = 0 .The second “if” statement (Lines 8–14) is executed. Then, we find ~h A = (cid:0) h A, h A, · · · h A,ω (cid:1) ∈ F ωq such that π A = P ωi =1 α A,i h A,i = 0 in Line 9. If A = ∅ (Line 10), then for this wiretap set A ,Algorithm 1 finds a nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) of P ωi =1 α A,i ~b ( n ) i = P e ∈ A β e ~f ( n ) e with (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ for the first time. On the other hand, ~c ∗ = ~ , the initial value, so that τ A = P ωi =1 α A,i c ∗ i = 0 . Then, we update ~c ∗ = ~h A in Line 11 and update A from ∅ to { A } in Line 15.Now, we have τ A = ω X i =1 α A,i c ∗ i = ω X i =1 α A,i h A,i = π A = 0 . In other words, after this iteration for A , the condition (54) holds for the updated ~c ∗ ( = ~h A ) and theupdated A ( = { A } ). November 9, 2018 DRAFT4
Otherwise, i.e., A = ∅ . We compute τ B = P ωi =1 α B,i c ∗ i and π B = P ωi =1 α B,i h A,i for all B ∈ A in Line 12. By Line 13, we choose ξ ∈ F q such that ξ · τ B + π B = 0 , ∀ B ∈ A , which is equivalent tochoosing ξ ∈ F q \ [ B ∈ A (cid:26) − π B τ B (cid:27) , where we note that τ B = 0 for each B ∈ A by the induction hypothesis. This immediately impliesthat the field size q > | f A ′′ r +1 | ≥ | A | is sufficient for the existence of such a ξ . Now, we update ~c ∗ to ξ~c ∗ + ~h A in Line 14. For the wiretap sets B in A , it follows from Line 13 that ω X i =1 α B,i · ( ξc ∗ i + h A,i ) = ξ · ω X i =1 α B,i c ∗ i + ω X i =1 α B,i h A,i = ξ · τ B + π B = 0 , and for the wiretap set A , it follows from τ A = 0 and Line 8 that ω X i =1 α A,i · ( ξc ∗ i + h A,i ) = ξ · ω X i =1 α A,i c ∗ i + ω X i =1 α A,i h A,i = ξ · τ A + π A = π A = 0 . Thus, for this updated vector ~c ∗ (i.e., ξ~c ∗ + ~h A ) and the updated A that includes A , (54) is satisfied.Therefore, we have verified that after every iteration of the “for” loop (Lines 3–15), the condition(54) is satisfied for the updated ~c ∗ and the updated A . Finally, we verify that the vector ~c obtainedin Lines 16 and 17 satisfies ~c ∈ F ωq \ S A ∈ f A ′′ r +1 Γ A . Let A be an arbitrary wiretap set in f A ′′ r +1 , and (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) with (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ be the solution found in Line 3. Let ~v ( n ) = ω X i =1 α A,i ~b ( n ) i = X e ∈ A β e ~f ( n ) e , (56)where we note that ~v ( n ) is a nonzero vector because (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ and ~b ( n ) i , ≤ i ≤ ω arelinearly independent. Together with the linear independence of ~f ( n ) e , e ∈ A (by the definition of f A ′′ r +1 in (21)), for ~v ( n ) in (56), both (cid:0) α A,i , ≤ i ≤ ω (cid:1) ∈ F ωq and (cid:0) β e , e ∈ A (cid:1) ∈ F r +1 q are unique. Consequently,by Γ A = Γ A (cid:0) ~v ( n ) (cid:1) (cf. (48)) and the definition of Γ A (cid:0) ~v ( n ) (cid:1) (cf. (45)), we obtain that ~c ∈ F ωq \ Γ A ⇐⇒ ~c ∈ F ωq \ Γ A (cid:0) ~v ( n ) (cid:1) ⇐⇒ ω X i =1 α A,i c i = X e ∈ A β e f e,n +1 = λ A , where the RHS is exactly the requirement in Line 16 (with ~c = θ · ~c ∗ ). Thus, we have verified that thevector ~c obtained in Line 17 satisfies that ~c ∈ F ωq \ S A ∈ f A ′′ r +1 Γ A .It remains to verify the existence of such an element θ in Line 16. For each A ∈ f A ′′ r +1 , we haveverified that τ A = P ωi =1 α A,i c ∗ i = 0 (cf. (55)). Thus, in order to choose θ ∈ F q satisfying θ · τ A = λ A for all A ∈ f A ′′ r +1 , it is equivalent to choosing θ ∈ F q \ S A ∈ f A ′′ r +1 (cid:8) λ A · τ − A (cid:9) . This immediately impliesthat the field size q > | f A ′′ r +1 | is sufficient for the existence of such a θ . November 9, 2018 DRAFT5 sv v v v t t e e e e e e e e e e e Fig. 2: The network G = ( V, E ) .Next, we give an example to illustrate Algorithm 1, in which the same setup as in Example 1 in [1]is used. Example 1.
We consider the network G = ( V, E ) depicted in Fig. 2. Let C = n K s = h i , K = K = K = [ ] , K = (cid:2) (cid:3)o (57) be a -dimensional linear network code over the field F on G , where K i represents the local encodingkernels at the intermediate nodes v i , ≤ i ≤ . As defined in Lemma 1, C = h I ~ i · C = nh I ~ i · K s = [ ] , K = K = K = [ ] , K = (cid:2) (cid:3)o is a local-encoding-preserving -dimensional linear network code C over F , of which all the globalencoding kernels ~f (2) i for e i , ≤ i ≤ , are ~f (2)1 = (cid:2) (cid:3) , ~f (2)2 = ~f (2)5 = ~f (2)6 = (cid:2) (cid:3) , ~f (2)3 = ~f (2)7 = ~f (2)8 = (cid:2) (cid:3) ,~f (2)4 = (cid:2) (cid:3) , ~f (2)9 = ~f (2)10 = ~f (2)11 = (cid:2) (cid:3) . Let ω = 1 be the fixed rate. We first consider the security level r = 1 , and the set of the primary edgesubsets of size is A = (cid:8) { e } , { e } , { e } , { e } , { e } (cid:9) . (58) Let Q (2) = h ~b (2)1 ~b (2)2 i = (cid:2) (cid:3) be a × invertible matrix over F . It can be verified that ( Q (2) ) − · C is a -dimensional SLNC with rate and security level . November 9, 2018 DRAFT6
In the following, we will use Algorithm 1 to construct a local-encoding-preserving -dimensional SLNCfor the fixed rate and a higher security level . First, we give the set of the primary edge subsets ofsize as follows: A = n { e , e } , { e , e } , { e , e } , { e , e } , { e , e } , { e , e } , { e , e } , { e , e } o . (59) With ~b (2)1 = (cid:2) (cid:3) , there exists a solution ( α A, , β e , e ∈ A ) of α A, ~b (2)1 = P e ∈ A β e ~f (2) e with α A, = 0 (cf. Line 3) if and only if ~b (2)1 ∈ L (2) A . Thus, after finishing the “for” loop, the output A contains theprimary edge subsets A ∈ A satisfying ~b (2)1 ∈ L (2) A , i.e., A = (cid:8) { e , e } , { e , e } , { e , e } , { e , e } (cid:9) (we can verify that A = f A ′′ ), and for each A ∈ A , L (2) A = (cid:10) ~f (2) e : e ∈ A (cid:11) = (cid:10)(cid:2) (cid:3) , (cid:2) (cid:3)(cid:11) . In the sequel, we use { i, j } to represent an edge subset { e i , e j } for notational simplicity. Then, wefind ( α = 1 , β i = β j = 1) , which is a nonzero solution of α ~b (2)1 = β i ~f (2) i + β j ~f (2) j (cf. Line 3)for each { i, j } ∈ f A ′′ . We compute λ { i,j } = β i f i, + β j f j, (cf. Line 5) for all { i, j } ∈ f A ′′ to obtain λ { , } = 2 , λ { , } = λ { , } = 3 , and λ { , } = 4 . According to the “for” loop of Algorithm 1, we canobtain ~c ∗ = c ∗ = 2 that satisfies τ A = α c ∗ = 2 = 0 , ∀ A ∈ f A ′′ . In Line 16, we choose θ = 3 such that θ · α c ∗ = 1 = λ { i,j } , ∀ { i, j } ∈ f A ′′ , and then in Line 17 we calculate ~c = c = θ · c ∗ = 1 . In fact, wecan calculate Γ { , } = { } , Γ { , } = Γ { , } = { } , and Γ { , } = { } by (33) , and thus we can verifythat ~c = 1 ∈ F \ [ A ∈ f A ′′ Γ A = { , } . Finally, in Lines 18 and 19, respectively, we let ~b (3)1 = h i , ~b (3)2 = h i , and ~b (3)3 = h i and output the × invertible matrix Q (3) = h ~b (3)1 ~b (3)2 ~b (3)3 i . Then ( Q (3) ) − · C is a -dimensional SLNC with rate and security level which has the same local encoding kernels as the SLNC ( Q (2) ) − · C at all theintermediate nodes. Field Size of Algorithm 1:
By the forgoing verification of Algorithm 1, a finite field F q with q > (cid:12)(cid:12)(cid:12) f A ′′ r +1 (cid:12)(cid:12)(cid:12) is sufficient forconstructing the matrix Q ( n +1) . Therefore, for the fixed rate ω , the field size q > max n(cid:12)(cid:12)(cid:12) T (cid:12)(cid:12)(cid:12) , (cid:12)(cid:12)(cid:12) f A ′′ r (cid:12)(cid:12)(cid:12) , ≤ r ≤ C min − ω o (60)is sufficient for constructing a family of local-encoding-preserving SLNCs with the fixed rate ω andsecurity levels from to C min − ω . The reason for requiring q > | T | here is to guarantee the existence of a C min -dimensional linear network code C C min on G . November 9, 2018 DRAFT7
In addition, for a security level r , ≤ r ≤ C min − ω , we note that max (cid:8) | T | , | A r | (cid:9) is the best knownlower bound on the required field size for the existence of an SLNC with rate ω and security level r (cf. [2]). Together with (cid:12)(cid:12)(cid:12) A r (cid:12)(cid:12)(cid:12) ≥ (cid:12)(cid:12)(cid:12) f A ′′ r (cid:12)(cid:12)(cid:12) for each ≤ r ≤ C min − ω , we thus see that there is no penaltyat all on the field size (in terms of the best known lower bound) for constructing such a family oflocal-encoding-preserving SLNCs. Upon comparing with the required field size q > max n(cid:12)(cid:12) T (cid:12)(cid:12) , (cid:12)(cid:12) A r (cid:12)(cid:12) , ≤ r ≤ C min − ω o of the approach proposed at the beginning of Section III for constructing such a family of local-encoding-preserving SLNCs, by (60) we see that our approach here requires a field with a smaller size. Complexity of Algorithm 1:
For the purpose of determining the computational complexity of Algorithm 1, we do not differentiate anaddition from a multiplication over a finite field, although in general the time needed for a multiplicationis much longer than that needed for an addition. We further assume that the computational complexityof each operation, i.e., an addition or a multiplication, is O (1) regardless of the finite field.Now, we discuss the complexity of Algorithm 1. • In Line 3, for each wiretap set A ∈ A r +1 , we can find a nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) ∈ F n +1 q of the equation P ωi =1 α A,i ~b ( n ) i = P e ∈ A β e ~f ( n ) e by solving the system of linear equations h ~b ( n ) i , ≤ i ≤ ω, ~f ( n ) e , e ∈ A i · (cid:0) α A,i , ≤ i ≤ ω, − β e , e ∈ A (cid:1) ⊤ = ~ , which takes at most O (cid:0) n (cid:1) operations by Gaussian elimination. • In view of the nonzero solution (cid:0) α A,i , ≤ i ≤ ω, β e , e ∈ A (cid:1) with (cid:0) α A,i , ≤ i ≤ ω (cid:1) = ~ fora wiretap set A ∈ f A ′′ r +1 , we compute λ A = P e ∈ A β e f e,n +1 in Line 5 and τ A = P ωi =1 α A,i c ∗ i inLine 7, which take at most O (cid:0) r + 1 (cid:1) operations and O (cid:0) ω (cid:1) operations, respectively. • For Line 9, to find ~h A = (cid:0) h A, h A, · · · h A,ω (cid:1) ∈ F ωq such that π A = P ωi =1 α A,i h A,i = 0 , itsuffices to take h A,i = 1 for some i with α A,i = 0 , and h A,j = 0 for other ≤ j ≤ ω and j = i .Thus, the calculation of π B = P ωi =1 α B,i h A,i for a wiretap set B ∈ A in Line 12 takes O (cid:0) (cid:1) operations. Further, the calculation of τ B = P ωi =1 α B,i c ∗ i for a wiretap set B ∈ A in Line 12 takes O (cid:0) ω (cid:1) operations. • Based on the above analyses, the complexity of Line 13, i.e., choosing ξ ∈ F q such that ξ · τ B + π B = 0 for all B ∈ A , is at most O (cid:0) ω | A | (cid:1) . • For Line 14, the calculation of the vector ξ~c ∗ + ~h A takes at most O (cid:0) ω (cid:1) operations. November 9, 2018 DRAFT8 • For the “for” loop (Lines 2–15), the worst case in terms of the complexity is that τ A = 0 for eachexecution of the “if” condition (Line 8) with respect to a wiretap set A ∈ f A ′′ r +1 . Combining theforgoing analyses, the total complexity of the “for” loop is at most O (cid:0) n | A r +1 | + ω P | f A ′′ r +1 |− i =1 (cid:1) . • For Line 16, with the calculation of τ A = P ωi =1 α A,i c ∗ i taking O (cid:0) ω (cid:1) operations, the complexity ofchoosing θ ∈ F q such that θ · τ A = λ A for all A ∈ f A ′′ r +1 is at most O (cid:0) ω | f A ′′ r +1 | (cid:1) . • For Line 17, the calculation of ~c = θ~c ∗ takes at most O (cid:0) ω (cid:1) operations.Therefore, by combining all the foregoing analyses, the total complexity of Algorithm 1 is not largerthan O (cid:16) n | A r +1 | + ω | f A ′′ r +1 | (cid:17) . With this complexity, we see that the complexity of Algorithm 1 even for the worst case is considerablysmaller than one ω th of the complexity O (cid:16) ωn (cid:12)(cid:12) A r +1 (cid:12)(cid:12) + ωn (cid:12)(cid:12) A r +1 (cid:12)(cid:12) + ( r + 1) n (cid:17) (cf. the 3th footnote or Appendix A in [1]) of the approach proposed at the beginning of Section III.On the other hand, for our approach here, in order to store the matrix Q ( n +1) at the source node s , itsuffices to store the row ω -vector ~c only. This implies that the storage cost is O (cid:0) ω (cid:1) , which is independentof the dimensions of linear network codes and considerably smaller than the storage cost O (cid:0) ( n + 1) (cid:1) of the approach proposed at the beginning of Section III. Thus, our approach here reduces considerablythe complexity and storage cost further.IV. F IXED -D IMENSION S ECURE N ETWORK C ODING
In this section, we consider the problem of designing a family of local-encoding-preserving SLNCs witha fixed dimension n ( ≤ n ≤ C min ), i.e., a family of n -dimensional local-encoding-preserving SLNCswith the rate and security-level pair ( ω, r ) satisfying ω + r = n . These pairs are all the nonnegativeinteger points on the line ω + r = n , as shown in Fig. 3. Note that the pair (0 , r ) is always achievablefor ≤ r ≤ C min .Based on the SLNC construction at the end of Section II, we naturally put forward the followingapproach to solve this problem. First, we construct an n -dimensional linear network code C n . With thiscode C n , for each nontrivial security level ≤ r ≤ n − , we design an n × n invertible matrix Q ( n ) r suchthat the condition (4) is satisfied (here we use Q ( n ) r in place of the matrix Q ( n ) in the SLNC constructionat the end of Section II). Then, we obtain a family of n -dimensional local-encoding-preserving SLNCs n(cid:0) Q ( n ) r (cid:1) − · C n : 0 ≤ r ≤ n − o (here Q ( n )0 can be taken as the n × n identity matrix) with rate andsecurity-level pairs ( n − r, r ) for ≤ r ≤ n − . However, the above approach not only requires the November 9, 2018 DRAFT9 r ωC min C min n n Fig. 3: SLNCs with a fixed dimension n , ≤ n ≤ C min .construction of the matrix Q ( n ) r for each r but also requires the source node s to store all the matrices Q ( n ) r . To avoid these shortcomings, we present the following more efficient approach to construct an n -dimensional SLNC such that with the same SLNC, all the pairs ( ω, r ) on the line ω + r = n can beachieved. The next theorem asserts the existence of such an SLNC. Theorem 11.
Let n be a nonnegative integer with n ≤ C min , and C n be an n -dimensional linear networkcode on the network G over a finite field F q with q > max (cid:8) | T | , | A r | , ≤ r ≤ n − (cid:9) , of which all the global encoding kernels are ~f ( n ) e , e ∈ E . Then, there exists an n × n invertible matrix Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i over F q such that for each ≤ r ≤ n , the following condition is satisfied: (cid:10) ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) n − r (cid:11) \ (cid:10) ~f ( n ) e : e ∈ A (cid:11) = { ~ } , ∀ A ∈ A r . (61) In other words, ( Q ( n ) ) − · C n is an F q -valued n -dimensional SLNC applicable to any rate and security-level pair ( n − r, r ) for r = 0 , , , · · · , n .Proof: If there exists an n × n invertible matrix Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i over F q satisfyingthe condition (61) for each ≤ r ≤ n , then by Lemma 2, ( Q ( n ) ) − · C n is an F q -valued n -dimensionalSLNC applicable to any rate and security-level pair ( n − r, r ) for ≤ r ≤ n . Thus, it remains to prove For notational convenience, we let A = ∅ and (cid:8) ~b ( n )1 ,~b ( n )2 , · · · ,~b ( n ) i (cid:9) = ∅ for i = 0 . Then, the condition (61) is alwayssatisfied for r = 0 and r = n . November 9, 2018 DRAFT0 that if q > max (cid:8) | T | , | A r | , ≤ r ≤ n − (cid:9) , there exists such an n × n invertible matrix Q ( n ) over F q . Toward this end, we choose the n vectors ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) n sequentially such that the followingis satisfied: ~b ( n ) i ∈ F nq \ [ A ∈ A n − i (cid:0) B ( n ) i − + L ( n ) A (cid:1) , ≤ i ≤ n. (62)Then we prove that Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i satisfies the condition (61).We first prove that all the sets on the RHS of (62) are nonempty provided that q > max (cid:8) | T | , | A r | , ≤ r ≤ n − (cid:9) . For any ≤ i ≤ n , we consider (cid:12)(cid:12)(cid:12)(cid:12) F nq \ [ A ∈ A n − i (cid:0) B ( n ) i − + L ( n ) A (cid:1)(cid:12)(cid:12)(cid:12)(cid:12) = (cid:12)(cid:12)(cid:12)(cid:12) F nq (cid:12)(cid:12)(cid:12)(cid:12) − (cid:12)(cid:12)(cid:12)(cid:12) [ A ∈ A n − i (cid:0) B ( n ) i − + L ( n ) A (cid:1)(cid:12)(cid:12)(cid:12)(cid:12) ≥ q n − X A ∈ A n − i (cid:12)(cid:12)(cid:12) B ( n ) i − + L ( n ) A (cid:12)(cid:12)(cid:12) ≥ q n − X A ∈ A n − i q n − = q n − ( q − | A n − i | ) > , where the last inequality follows because for any ≤ i ≤ n and A ∈ A n − i , dim (cid:0) B ( n ) i − + L ( n ) A (cid:1) ≤ dim (cid:0) B ( n ) i − (cid:1) + dim (cid:0) L ( n ) A (cid:1) = i − n − i = n − . Now, by (62), we see that ~b ( n )1 = ~ and ~b ( n ) i ∈ F nq \ B ( n ) i − , ≤ i ≤ n, which immediately implies that ~b ( n ) i , ≤ i ≤ n are linearly independent. Next, we will prove that foreach ≤ i ≤ n , the condition (cid:10) ~b ( n )1 , ~b ( n )2 , · · · , ~b ( n ) i (cid:11) \ (cid:10) ~f ( n ) e : e ∈ A (cid:11) = { ~ } , ∀ A ∈ A n − i , i.e., B ( n ) i \ L ( n ) A = { ~ } , ∀ A ∈ A n − i (63)is satisfied, which is equivalent to (61) by taking r = n − i for ≤ i ≤ n . The condition (63) is clearlysatisfied for i = 0 and i = n . It remains to prove that (63) is satisfied for ≤ i ≤ n − , which will bedone by induction as follows. November 9, 2018 DRAFT1
We now assume that (63) is satisfied for i − and will prove that (63) is satisfied for i , ≤ i ≤ n − .Suppose the contrary that (63) is not satisfied for i , namely that there exists a wiretap set A in A n − i such that B ( n ) i T L ( n ) A = { ~ } . Then there exist two nonzero vectors (cid:0) α j , ≤ j ≤ i (cid:1) ∈ F iq and (cid:0) β e , e ∈ A (cid:1) ∈ F n − iq such that ~ = i X j =1 α j ~b ( n ) j = X e ∈ A β e ~f ( n ) e , (64)where in the above P ij =1 α j ~b ( n ) j = ~ because ~b ( n ) j , ≤ j ≤ i are linearly independent. We first claimthat α i = 0 because otherwise ~b ( n ) i = ( α i ) − · (cid:18) X e ∈ A β e ~f ( n ) e − i − X j =1 α j ~b ( n ) j (cid:19) ∈ B ( n ) i − + L ( n ) A , contradicting the condition (62) that must be satisfied by ~b ( n ) i . For i = 1 , we have α = 0 whichcontradicts that (cid:0) α (cid:1) is a nonzero vector. This proves (63) for i = 1 . For i ≥ , we can rewrite (64) as ~ = i − X j =1 α j ~b ( n ) j = X e ∈ A β e ~f ( n ) e , implying that B ( n ) i − \ L ( n ) A = { ~ } . (65)Let e ∈ E be an edge not in A . Such an edge e exists since | E | ≥ C min ≥ n > n − i = | A | for any ≤ i ≤ n − . Then we have A ∪ { e } ∈ E n − ( i − = (cid:8) A ⊆ E : | A | ≤ n − ( i − (cid:9) and B ( n ) i − T L ( n ) A S { e } = { ~ } by (65). By Lemma 3, there must exist a wiretap set A ′ ∈ A n − ( i − such that B ( n ) i − T L ( n ) A ′ = { ~ } , which is a contradiction to the induction hypothesis that (63) is satisfied for i − .This proves that (63) is satisfied for i , and the theorem follows.Algorithm 2 is an implementation for the construction of the SLNC in the proof of Theorem 11. Wenote that max (cid:8) | T | , | A r | (cid:9) is the best known lower bound on the required field size for the existence of anSLNC with security level r (cf. [2]). Thus, for Algorithm 2, there is no penalty on the field size (in termsof the best known lower bound) for constructing such an SLNC applicable to all rate and security-levelpairs ( ω, r ) with ω + r = n .Next, we discuss the complexity of Algorithm 2. Similar to the previous complexity analyses, we donot differentiate an addition from a multiplication over a finite field, and instead we assume that thecomputational complexity of each operation is O (1) regardless of the finite field. In Lines 1 and 2, thevector ~b ( n ) i for ≤ i ≤ n − can be found in time O (cid:0) n (cid:12)(cid:12) A n − i (cid:12)(cid:12) + n (cid:12)(cid:12) A n − i (cid:12)(cid:12) (cid:1) , and the vector ~b ( n ) n in November 9, 2018 DRAFT2
Algorithm 2:
Construction of an n -dimensional SLNC applicable to all rate and security-level pairs ( ω, r ) with ω + r = n . Input: An n -dimensional linear network code C n over a finite field F q with q > max (cid:8) | T | , | A r | , ≤ r ≤ n − (cid:9) . Output: An n × n invertible matrix Q ( n ) such that ( Q ( n ) ) − · C n is an n -dimensional SLNCapplicable to all rate and security-level pairs ( ω, r ) with ω + r = n . begin choose ~b ( n )1 ∈ F nq \ S A ∈ A n − L ( n ) A ; for i = 2 to n − do choose ~b ( n ) i ∈ F nq \ S A ∈ A n − i (cid:0) B ( n ) i − + L ( n ) A (cid:1) ; end choose ~b ( n ) n ∈ F nq \ B ( n ) n − ; return Q ( n ) = h ~b ( n )1 ~b ( n )2 · · · ~b ( n ) n i . end Line 3 can be found in at most O (cid:0) n + n (cid:1) operations (cf. the complexity analysis of Line 3 in Algorithm 1in [1] or Appendix A in [1]). Combining the above analyses, the total complexity of Algorithm 2 is thusat most O n (cid:16) n − X i =1 (cid:12)(cid:12) A n − i (cid:12)(cid:12)(cid:17) + n (cid:16) n − X i =1 (cid:12)(cid:12) A n − i (cid:12)(cid:12) (cid:17)! . (66)For the approach proposed at the beginning of this section, we note that the computational complexityof the construction of Q ( n ) r is O (cid:0) ( n − r ) n | A r | + ( n − r ) n | A r | + rn (cid:1) for ≤ r ≤ n − (cf. Appendix Ain [1]), and thus the total complexity of the construction of all the n − matrices Q ( n ) r , ≤ r ≤ n − is O n (cid:16) n + n − X r =1 ( n − r ) (cid:12)(cid:12) A r (cid:12)(cid:12)(cid:17) + n (cid:16) n + n − X r =1 ( n − r ) (cid:12)(cid:12) A r (cid:12)(cid:12) (cid:17)! , or equivalently, O n (cid:16) n + n − X i =1 i (cid:12)(cid:12) A n − i (cid:12)(cid:12)(cid:17) + n (cid:16) n + n − X i =1 i (cid:12)(cid:12) A n − i (cid:12)(cid:12) (cid:17)! . (67)Comparing (66) and (67), we see that the complexity of Algorithm 2 is considerably smaller than thatof the approach proposed at the beginning of this section. On the other hand, for our approach here,it suffices to store the matrix Q ( n ) only at the source node s , which implies that the storage cost is at November 9, 2018 DRAFT3 most O (cid:0) n (cid:1) . This is also considerably smaller than the storage cost O (cid:0) n (cid:1) of the approach proposed atthe beginning of this section that needs to store all the matrices Q ( n ) r , ≤ i ≤ n − .We continue to use the setup in Example 1 to illustrate Algorithm 2. Example 2.
We consider the network G (cf. Fig. 2) and the -dimensional F -valued linear network code C (cf. (57) ) in Example 1. Next, we use Algorithm 2 to construct a -dimensional SLNC ( Q (3) ) − · C achieving all rate and security-level pairs (3 , , (2 , , (1 , and (0 , on the line ω + r = 3 , wherewe remark that the pair (0 , is always achievable. For the nontrivial security levels and , with thelinear network code C , we calculate that • according to the set A of the primary edge subsets with size (cf. (58) ), L (3) { e } = Dh iE , L (3) { e } = Dh iE , L (3) { e } = Dh iE , L (3) { e } = Dh iE , L (3) { e } = Dh iE ; • according to the set A of the primary edge subsets with size (cf. (59) ), L (3) { e ,e } = Dh i , h iE , L (3) { e ,e } = Dh i , h iE , L (3) { e ,e } = L (3) { e ,e } = L (3) { e ,e } = Dh i , h iE , L (3) { e ,e } = Dh i , h iE , L (3) { e ,e } = Dh i , h iE , L (3) { e ,e } = Dh i , h iE . In Lines 1–3, we sequentially choose column -vectors ~b (3)1 , ~b (3)2 , ~b (3)3 as follows: ~b (3)1 = h i ∈ F \ [ A ∈ A L (3) A ,~b (3)2 = h i ∈ F \ [ A ∈ A (cid:0) B (3)1 + L (3) A (cid:1) = F \ [ A ∈ A (cid:10) ~b (3)1 , ~f (3) e , e ∈ A (cid:11) ,~b (3)3 = h i ∈ F \ B (3)2 = F \ (cid:10) ~b (3)1 , ~b (3)2 (cid:11) , and output the invertible Q (3) = h ~b (3)1 ~b (3)2 ~b (3)3 i = h i . Now, ( Q (3) ) − · C is an F -valued -dimensional SLNC that is applicable to the rate and security-level pairs (2 , and (1 , . Clearly, ( Q (3) ) − · C is also applicable to the rate and security-level pair (3 , by the invertibility of Q (3) andProposition 1.Theorem 11 guarantees the existence of an SLNC for the current example if | F q | > max (cid:8) | T | , | A | , | A | (cid:9) = 8 . However, such an SLNC may exist in a base field with size less than or equal to , which is the case forthe SLNC constructed here. November 9, 2018 DRAFT4
V. S
ECURE N ETWORK C ODING FOR F LEXIBLE R ATE AND S ECURITY L EVEL
Cai and Yeung [8] have proved that there exists an n -dimensional SLNC with rate ω and security level r (here n = ω + r ) on the network G if and only if ω + r ≤ C min , where C min is the smallest minimumcut capacity between the source node and each sink node. We say a nonnegative integer pair ( ω, r ) ofrate ω and security level r is achievable if ω + r ≤ C min , and the set of all the achievable pairs is calledthe rate and security-level region , depicted in Fig. 4. In this section, we consider the ultimate problem ofdesigning a family of local-encoding-preserving SLNCs for a flexible rate and a flexible security level,more precisely, a family of local-encoding-preserving SLNCs achieving all achievable pairs ( ω, r ) in therate and security level region.To solve this problem, we combine Algorithm 1 in [1] and Algorithms 1 and 2 in the current paper,which respectively are designed to construct local-encoding-preserving SLNCs for a fixed security leveland a flexible rate, for a fixed rate and a flexible security level, and for a fixed dimension and a flexiblepair of rate and security level. By considering different combinations, we can provide multiple waysto construct a family of local-encoding-preserving SLNCs such that all pairs in the rate and security-level region are achieved. In the following, we present 3 possible constructions of such a family oflocal-encoding-preserving SLNCs. Construction 1:
Start with a C min -dimensional linear network code C C min . We first apply Algorithm 2to construct a C min -dimensional SLNC (cid:0) Q ( C min ) (cid:1) − · C min such that all the rate and security-level pairson the line ω + r = C min are achieved. Here, all the achievable pairs ( ω, r ) with ω + r = C min share r ωC min C min Fig. 4: The rate and security-level region. r ωC min C min Fig. 5: Construction 1.
November 9, 2018 DRAFT5 the same SLNC (cid:0) Q ( C min ) (cid:1) − · C min and clearly the local-encoding-preserving property is guaranteed. ByTheorem 11, a field F q of size q > max (cid:8) | T | , | A r | , ≤ r ≤ C min − (cid:9) is sufficient for applying Algorithm 2 to construct such an SLNC.Next, for each achievable pair ( ω, r ) on the line ω + r = C min , we start with the SLNC (cid:0) Q ( C min ) (cid:1) − ·C min with rate ω and security level r . Then, we apply Algorithm 1 in [1] repeatedly to construct a familyof local-encoding-preserving SLNCs with the fixed security level r and rates decreasing one by onefrom ω to . It follows from Theorem 6 in [1] that a field F q of size q > max (cid:8) | T | , | A r | (cid:9) is sufficientfor applying Algorithm 1 in [1] to construct such a family of local-encoding-preserving SLNCs. Weremark that all the SLNCs in this family have the same local encoding kernels as (cid:0) Q ( C min ) (cid:1) − · C min at all the intermediate nodes. Therefore, the SLNCs in all the families with respect to distinct securitylevels r , ≤ r ≤ C min share a common local encoding kernel at each intermediate node, namely thatall the SLNCs are local-encoding-preserving.As such, we obtain a family of local-encoding-preserving SLNCs achieving all the pairs in the rateand security-level region. Furthermore, it follows from the above discussions that the field size (cid:12)(cid:12) F q (cid:12)(cid:12) > max (cid:8) | T | , | A r | , ≤ r ≤ C min − (cid:9) (68)is sufficient for constructing such a family of local-encoding-preserving SLNCs. By (68), we see thatwith this method, there is no penalty on the field size (in terms of the best known lower bound [2]) forconstructing such a family of SLNCs. Construction 1 is illustrated in Fig. 5. Construction 2:
Start with a C min -dimensional linear network code C C min . We first apply Lemma 1to construct local-encoding-preserving linear network codes C n for ≤ n ≤ C min , and a base field F q of size q > | T | is sufficient (cf. [9], [10]). Thus, we have obtained a family of local-encoding-preservingSLNCs with rate and security-level pairs ( n, for all ≤ n ≤ C min . These pairs are all the nonnegativeinteger points on the line r = 0 .Next, for each pair ( n, , ≤ n ≤ C min , we start with the SLNC C n (with the rate and security-levelpair ( n, ). Then, we apply Algorithm 1 repeatedly to construct a family of local-encoding-preservingSLNCs with the fixed rate n and security levels increasing one by one from to C min − n . Note that thisconstruction is unnecessary for n = 0 because the pair (0 , r ) is always achievable for any ≤ r ≤ C min .It follows from Theorem 9 that a field F q of size q > max (cid:8) | T | , | A r | , ≤ r ≤ C min − n (cid:9) is sufficientfor applying Algorithm 1 to construct such a family of local-encoding-preserving SLNCs. We note thatall the SLNCs in this family have the same local encoding kernels as C n at all the intermediate nodes. November 9, 2018 DRAFT6 r ωC min C min Fig. 6: Construction 2. r ωC min C min Fig. 7: Construction 3.Together with the assertion in Lemma 1 that all the linear network codes C n , ≤ n ≤ C min share acommon local encoding kernel at each intermediate node, we see that the SLNCs in all the families withrespect to distinct rates n , ≤ n ≤ C min share a common local encoding kernel at each intermediatenode, or equivalently, all the SLNCs are local-encoding-preserving.As such, we have obtained a family of local-encoding-preserving SLNCs achieving all the pairs in therate and security-level region, and by the above discussions, the field size (cid:12)(cid:12) F q (cid:12)(cid:12) > max (cid:8) | T | , | A r | , ≤ r ≤ C min − (cid:9) is sufficient. Similar to Construction 1, there is no penalty on the field size (in terms of the best knownlower bound [2]) for constructing such a family of SLNCs. Construction 2 is illustrated in Fig. 6. Construction 3:
Start with a C min -dimensional linear network code C C min . Similar to Construction 2,we first apply Lemma 1 to construct a family of local-encoding-preserving SLNCs with rate and security-level pairs ( n, , ≤ n ≤ C min , where the field size | F q | > | T | is sufficient.Next, for each pair ( n, , ≤ n ≤ C min , we start with the SLNC C n and apply Algorithm 2 to constructan n -dimensional SLNC (cid:0) Q ( n ) (cid:1) − · C n achieving all the nonnegative rate and security-level pairs ( ω, r ) with ω + r = n . It follows from Theorem 11 that a base field F q of size q > max (cid:8) | T | , | A r | , ≤ r ≤ n − (cid:9) is sufficient for applying Algorithm 2 to construct such an SLNC. Furthermore, by Proposition 1,the SLNC (cid:0) Q ( n ) (cid:1) − · C n has the same local encoding kernels as C n at all the intermediate nodes. ByLemma 1, all C n , ≤ n ≤ C min share a common local encoding kernel at each intermediate node. We November 9, 2018 DRAFT7 thus see that all the SLNCs (cid:0) Q ( n ) (cid:1) − · C n , ≤ n ≤ C min share a common local encoding kernel at eachintermediate node, namely that all the SLNCs are local-encoding-preserving.As such, we have obtained a family of local-encoding-preserving SLNCs achieving all the pairs in therate and security-level region, and by the above discussions, the field size (cid:12)(cid:12) F q (cid:12)(cid:12) > max (cid:8) | T | , | A r | , ≤ r ≤ C min − (cid:9) is sufficient. Again, we see that no penalty on the field size (in terms of the best known lower bound [2])exists for constructing such a family of SLNCs. Construction 3 is illustrated in Fig. 7.VI. C ONCLUSION
In this Part II of a two-part paper, we continue the studies of local-encoding-preserving secure networkcoding in Part I [1]. We first tackle the problem of local-encoding-preserving secure network coding fora fixed rate and a flexible security level. We develop a novel approach for designing a family of local-encoding-preserving SLNCs with a fixed rate and the security level ranging from to the maximumpossible. Our approach, which increases the dimension of the code (equal to the sum of the rate and thesecurity level) step by step, is totally different from all the previous approaches for related problemswhich decreases the dimension of the code. A polynomial-time algorithm is presented for efficientimplementation of our approach. We also prove that our approach does not incur any penalty on therequired field size for the existence of SLNCs in terms of the best known lower bound by Guang andYeung [2], and has a constant storage cost that is independent of the dimension of the SLNC.We further tackle the problem of local-encoding-preserving secure network coding for a fixed di-mension. We develop another novel approach for designing an SLNC that can be applied for all therate and security-level pairs with the fixed dimension. Clearly, the local-encoding-preserving propertyis guaranteed since only one SLNC is applied for all such pairs. Based on this approach, we present apolynomial-time algorithm for implementation and prove that there is no penalty on the required fieldsize for the existence of SLNCs (also in terms of the best known lower bound by Guang and Yeung [2]).The code constructions presented in Part I and the current paper can be applied individually. At theend of the paper, we show that by combining these constructions in suitable ways, they can be used forsolving the ultimate problem of local-encoding-preserving secure network coding for the whole rate andsecurity-level region. R EFERENCES [1] X. Guang, R. W. Yeung, and F.-W. Fu, “Local-Encoding-Preserving Secure Network Coding—Part I: Fixed Security Level,”submitted.
November 9, 2018 DRAFT8 [2] X. Guang and R. W. Yeung, “Alphabet Size Reduction for Secure Network Coding: A Graph Theoretic Approach,”
IEEETrans. Inf. Theory , vol. 64, no. 6, pp. 4513–4529, June 2018.[3] S. L. Fong and R. W. Yeung, “Variable-rate linear network coding,”
IEEE Trans. Inf. Theory , vol. 56, no. 6, pp. 2618–2625,June 2010.[4] X. Guang, F.-W. Fu, and Z. Zhang, “Variable-rate linear network error correction MDS codes,”
IEEE Trans. Inf. Theory ,vol. 62, no. 6, pp. 3147–3164, June 2016.[5] S.-Y. R. Li, R. W. Yeung, and N. Cai, “Linear network coding,”
IEEE Trans. Inf. Theory , vol. 49, no. 2, pp. 371–381, Jul.2003.[6] R. Koetter and M. M´edard, “An algebraic approach to network coding,”
IEEE/ACM Trans. Netw. , vol. 11, no. 5, pp. 782–795,Oct. 2003.[7] R. Ahlswede, N. Cai, S.-Y. R. Li, and R. W. Yeung, “Network information flow,”
IEEE Trans. Inf. Theory , vol. 46, no. 4,pp. 1204–1216, Jul. 2000.[8] N. Cai and R. W. Yeung, “Secure network coding on a wiretap network,”
IEEE Trans. Inf. Theory , vol. 57, no. 1, pp.424–435, Jan. 2011.[9] R. W. Yeung,
Information Theory and Network Coding . New York: Springer, 2008.[10] R. W. Yeung, S.-Y. R. Li, N. Cai, and Z. Zhang, “Network coding theory,”
Foundations and Trends in Communicationsand Information Theory , vol. 2, nos.4 and 5, pp. 241–381, 2005., vol. 2, nos.4 and 5, pp. 241–381, 2005.