Secure network code over one-hop relay network
Masahito Hayashi Ning Cai
cs.IT math.IT







M. Hayashi 
and N. Cai: Secure network code over one-hop relay network

Secure network code over one-hop relay network
    Masahito Hayashi Fellow, IEEE

and Ning Cai Fellow, IEEE
The work of M. Hayashi was supported in part by
the Japan Society of the Promotion of Science (JSPS) Grant-in-Aid 
for Scientific Research (B) Grant 16KT0017 and
for Scientific Research (A) Grant 17H01280 and
for Scientific Research (C) Grant 16K00014,
in part by the Okawa Research Grant, and 
in part by the Kayamori Foundation of Informational Science Advancement.
The material in this paper was presented in part at the 2017 IEEE International Symposium on Information Theory (ISIT 2017),   Aachen (Germany), 25-30 June 2017 <cit.>.
Masahito Hayashi is with the Graduate School of Mathematics, Nagoya University, Nagoya, 464-8602, Japan. 
He is also with 
Shenzhen Institute for Quantum Science and Engineering, Southern University of Science and Technology,
Shenzhen, 518055, China,
Center for Quantum Computing, Peng Cheng Laboratory, Shenzhen 518000, China,
and the Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, 117542, Singapore
(e-mail:masahito@math.nagoya-u.ac.jp).


Ning Cai is with the School of Information Science and Technology, ShanghaiTech University, Middle Huaxia Road no 393,
Pudong, Shanghai  201210, China
(e-mail: ningcai@shanghaitech.edu.cn). 
    
=====================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================






When there exists a malicious attacker in the network,
we need to consider the possibilities of eavesdropping and the contamination simultaneously.
Under an acyclic broadcast network, the optimality of linear codes was shown 
when Eve is allowed to attack any r edges.
The optimality of linear codes is not shown under a different assumption for Eve.
As a typical example of an acyclic unicast network,
we focus on the one-hop relay network under the single transmission scheme
by assuming that Eve attacks only one edge in each level.
Surprisingly, as a result, we find that 
a non-linear code significantly improves the performance on the one-hop relay network
over linear codes.
That is, a non-liner code realizes the imperfect security on this model that cannot be realized by linear codes.
This kind of superiority of a linear code still holds even with considering the effect of sequential error injection on information leakage.



 
secure network coding,
one-hop relay network,
non-linear code,


passive attack,
active attack






§ INTRODUCTION

Security of information transmission over a network is a crucial problem
because there is a risk that 
a part of channels on the network are attacked by a malicious third party.
Secure network coding enables us to guarantee the security even under the existence of such an attacker.
Cai and Yeung <cit.> discussed the secrecy for the malicious
adversary, Eve, wiretapping a subset E_E of all channels in the network. 
The papers <cit.> developed several types of secure network coding.

Combining the codes in <cit.> and <cit.>,
the paper <cit.> proposed a linear code to keep the secrecy of the message 
and the robustness from the injection of error (contamination) simultaneously.
Like traditional error-correcting code and error correction network code (i.e. against Byzantine attack) in <cit.>, 
the paper <cit.> considered 
the robustness in the worst case, or equivalently 
it evaluated the error probability when the adversary to inject error knows the message to be sent. 
The papers <cit.> also made similar studies.
Also, the papers <cit.> showed the existence of a secrecy code that
universally works for any type of eavesdroppers under the size
constraint of E_E. 





However, two issues were not sufficiently studied in existing papers.
The first issue is the optimality of linear code.
Wile this optimality was shown in the papers <cit.>
under a general acyclic network with a single source and multiple receivers
(acyclic broadcast network),
they allowed Eve to attack any r edges in the network (See Table <ref>).

But in many cases, linear codes are not optimal, or in other words, non-linear code has better performance, for example, in coding for multiple source network and classical error-correcting code (which can be considered as error correction network coding for a two-node network, 
“point-to-point network)”. 
In several known examples of multiple source network, non-linear code can do better than linear one <cit.>.
Only a limited number of studies <cit.> discussed non-linear codes over networks.
Hence, it has been an open problem whether 
the optimality of linear code still holds for an acyclic broadcast network even under a different assumption for Eve.
That is, if we assume a different type of assumption is imposed for Eve,
there is a possibility that a non-linear code overcomes linear codes.

To resolve this problem,
in this paper, as a typical example for unicast networks,
we focus on the one-hop relay network (Fig. <ref>) 
when the sender sends a single element of a prime field _p 
(the single transmission scheme).

In this network, it is natural to assume that Eve can attack only one edge in each level
because any code is insecure for attacking both edges in one level. 
Hence, assuming that Eve attacks one edge before and after the intermediate node,
we study whether a non-linear code overcomes linear code in this model by adapting the imperfect secure criterion.

In fact, the perfect security is too restrictive for the single transmission scheme.
It is known that there exists an imperfectly secure linear code 
over a finite field _q of sufficiently large prime power q
when Eve may access a subset of channels that does not contain a cut between Alice and Bob 
even when the linear code does not employ private randomness in the intermediate nodes <cit.>.
Hence, we adopt the imperfectly secure criterion.

 


The second issue is the effect of Eve's contamination to help to have more information about the message. 


Indeed the existing studies <cit.> evaluated errors 
only when the information on a part of the network is changed,
but they evaluated the secrecy only when the information on the network is not changed[In other words, 
it seemed to be considered at that time that injecting error might only 
make Eve's wiretapping the message more difficult.] 
or Eve did not know the replaced information.
On the other hand, as another model, we assume that the goal of Eve to inject error is to help to have more information about the message. 
In this case, she may inject error according to the knowledge which she obtained from her previous action but not the message. 
This improvement for her ability of eavesdropping is essential,
and this type of attack is called an active attack
while the attack without this improvement is called a passive attack.
The recent paper <cit.> discussed this model, i.e., evaluated the secrecy as well as the error when Eve contaminates the eavesdropped information and knows the replaced information. 
Then, it showed that 
Eve's noise injection cannot improve her performance of eavesdropping
for linear network codes.
This kind of discussion over linear network codes was extended to a multilayer network <cit.>.
The effects of Eve's contamination depend on the type of network code.
This kind of reduction of security analysis was not shown for non-linear codes.
Therefore, we study the superiority of non-linear codes under both settings, i.e., passive attack and active attack.





First, we show the non-existence of imperfectly secure linear code over this network.
Then, in the binary case, we propose a non-linear code on this network, in which
even if Eve makes a passive attack, she cannot recover the original message, i.e., 
the imperfect security holds.
However, when she makes an active attack before the intermediate node,
she can recover the original message.

Similar unexpected properties for a nonlinear network error-correcting code were reported in <cit.>.
Also,
we show that the network code is limited to this example
when we impose several natural secrecy conditions on the code over this network in the binary case.
This discussion shows that no code can guarantee the security over this type of active attack 
on the one-hop relay network in the binary case.
However, in the ternary case, there exists a code such that Eve cannot completely recover the message even with this type of active attack on the one-hop relay network.
To discuss this problem, we introduce a new concept an “anti-Latin square”, which is an opposite concept to a Latin square.
Therefore, the goal of this paper is summarized as the derivation of the following three facts over the one-hop relay network.

(1) No linear code is imperfectly secure. 
(2) In the binary case, there exists an imperfectly secure non-linear code for passive attacks, 
but no non-linear code is imperfectly secure for active attack
(3) In the ternary case, there exists an imperfectly secure non-linear code even for active attacks.
The relation with existing studies are summarized in Table <ref>.

Indeed, the assumption for the single transmission scheme is crucial.
The linearity of this setting is called the scalar linearity
In contrast, the linear setting is called the vector linearity when the sender sends multiple elements of a finite field[In fact, the paper <cit.> discussed this kind of imperfectly secure code under scalar linearity 
with a different type of network while it chooses large q. 
In contrast, the paper <cit.> discussed a similar imperfectly secure code construction
by increasing the number of transmitted elements of the finite field (the vector linearity) 
while it did not increase the size of q.
The paper <cit.> extended this type of vector linearity setting 
of imperfectly secure codes to the case with multi-source multicast.].
Our recent paper <cit.> discussed multilayer networks including the one-hop relay network.
However, it addressed the case when multiple letters are transmitted, in which, the linearity means vector linearity.
Then, the optimality of vector linearity was shown in such a setting.

Here, we remark our setting for the intermediate node.
In our setting, only the source node is allowed to employ scramble random numbers
and the intermediate node is not allowed to use it
due to the following reason[
Since stochastic encoder is essential for secure information transmission, 
we need to be careful for the availability of private randomness in each node.
However, a stochastic decoder cannot improve the performance even for 
secure information transmission due to the following reason.
The decoding error probability preserves the convex combination for the decoder.
Hence, the decoding error probability of 
a stochastic decoder can be written as a convex combination of 
the decoding error probabilities of 
deterministic decoders.].
A physical device is required for 
the realization of physical random numbers as scramble random numbers.
If a high quality physical random number is needed,
the physical device is expensive and/or 
consumes a non-negligible space because
it often needs high-level quantum information technologies with advanced security analysis <cit.>.
It might be possible to prepare such devices on the source side.
However, it increases the cost to prepare devices in the intermediate nodes
because networks with such devices require more complicated maintenance than a conventional network.
Therefore, from the economical reason, it is natural to impose this constraint to our network code
while only a few papers <cit.> discussed this type of restriction.


The remaining of this paper is organized as follows.
Section <ref> gives our formulation over the one-hop relay network.
Next, Section <ref> shows the non-existence of imperfectly secure linear code over this network.
Then, Section <ref> discusses the binary case.
Finally, Section <ref> studies the case when message size is a general number d,
which includes the ternary case.





§ FORMULATION
S4-1
In this paper, we focus on the imperfect security, i.e.,
the property that Eve cannot recover the original message with probability one <cit.>.
To cover a large possibility, we consider the two cases.
In one case, the message X set is a finite field _q.
In the other case, it is a quotient ring _d. 
The case  of a quotient ring _d contains the case of a prime field _p,
which is a special case of a finite field_q.


Then, we consider the secure codes over the one-hop relay network given in Fig. <ref> with 
edges E={e(1),e(2),e(3),e(4)}
only in the single transmission scheme, i.e., the case when
the sender sends only one element of X.
The linearity under this setting is called the scalar linearity 
when X is a field _q <cit.>.
That is, we consider the transmission of the message M in X by using the one-hop relay network given in Fig. <ref>
when the information at the edges is given as an element of X.
Here, d is an arbitrary natural number, and it is not necessarily a prime number.

Also, private randomness is allowed in the sender, but
no private randomness is allowed in the intermediate nodes.
Therefore, 
we are allowed to choose an arbitrary deterministic function
φ from X^2 to X^2

as our coding operation on the intermediate node.
Our encoder in the source node is given as a stochastic map ϕ
from X to X^2,

and our decoder is given as a deterministic function
ψ from X^2 to X.

Eve is allowed to attack the subset E_E of two edges of E except for the pairs {e(1),e(2)} and {e(3),e(4)}.
In this section, 
we call the triplet (ϕ,φ,ψ) a code over the one-hop relay network (Fig. <ref>).

We have two attack models, the passive attack and the active attack.
In the passive attack, Eve can eavesdrop two edges, but cannot change the information on the attacked edge.
In the active attack, 
Eve can insert another information on the attacked edge in the first group {e(1),e(2)},
and eavesdrop one edge in the second group {e(3),e(4)}.

Here, Eve cannot change the edge to be attacked by using the information 
on the attacked edge in the first group {e(1),e(2)}.
When a code satisfies the following two conditions in the respective models,
the code is called imperfectly secure in the respective models.
Otherwise, it is called insecure in the respective models.
In the following conditions, the information on the edge e(i) is written as Y_i.



  (B1) (Recoverability) 
Bob can recover the message M 
from Y_3 and Y_4 when Eve does not make any replacement.


  (B2) (Secrecy)
No active attack ψ̃ from X^3 to X 
satisfies one of the following conditions.

    ψ̃(Y_1,Y_1',Y_3)=M,  ψ̃(Y_1,Y_1',Y_4)=M, 
    ψ̃(Y_2,Y_2',Y_3)=M,  ψ̃(Y_2,Y_2',Y_4)=M,

where Y_1' and Y_2' are the information replaced by Eve at the edges e(1) and e(2),
and Y_3 and Y_4 are the information at the edges e(3) and e(4).
This kind of secrecy is called imperfect security <cit.>.




§ LINEAR CODE
S4-2
First, we address linear codes over the one-hop relay network
only when the message set X is a finite field _q.
As shown in the recent paper <cit.>,
Eve's noise injection cannot improve her performance of eavesdropping
for linear network codes.
Hence, it is sufficient for analysis of information leakage
to discuss the case when Eve does not contaminate the eavesdropped information.

Since the message is an element of _q,
the linearity in this problem can be regarded as scalar linearity <cit.>.
The following theorem shows the impossibility of secure communication by using linear codes.

TT5
There is no secure linear code even for passive attack 
when the message set X is a finite field _q.


Due to the linearity of our code, 
we can choose 
a 2 × 2 matrix A on _p such that
the relations Y_3= A_1,1Y_1 +A_1,2Y_2
and
Y_4= A_2,1Y_1 +A_2,2Y_2
holds when there is no attack.

First, we assume that (A_1,1,A_1,2) is (0,0).

Eve can obtain all the information Bob obtains when Eve eavesdrops e(4).
Since Bob can recover the message, Eve can also do it.


Second, we assume that the vector (A_1,1,A_1,2)≠ (0,0) is a constant times of (1,0).

When Eve eavesdrops e(2) and e(3), 
Eve can obtain the information of Y_1 and Y_2, which contains the information that Bob obtains.
Since Bob can recover the message, Eve can also do it.
We obtain the same conclusion when (A_1,1,A_1,2)≠ (0,0) is 
a constant times of (0,1) and Eve eavesdrops e(1) and e(3).

Third, we assume that the vector (A_1,1,A_1,2)≠ (0,0) is not a constant times 
of (1,0) nor (1,0).
When Eve eavesdrops e(3) and e(1),
Eve can recover the information Y_4 from Y_3 and Y_1.
Hence, Eve obtains all information that the receiver gets.




§ ANALYSIS WITH _2
S3

The aim of this section is to prove the following theorem.
TT6
When the message set X is the finite field _q
and q is a power of 2,
there exists a imperfectly secure linear code for passive attack.
However, when the message set X is the prime field _2,
there exists no imperfectly secure linear code for active attack.





 §.§ Imperfectly secure non-linear code for passive attack
S3-1
First, to show Theorem <ref>,
we give a special example of our code on the prime field _2, in which,

the intermediate node performs a non-linear operation as

    Y_3   := Y_1(Y_2+Y_1)=Y_1(Y_2+1), Eq1
    
    Y_4   :=(Y_1+1)(Y_2+Y_1)
    =(Y_1+1)Y_2. Eq2


To send the binary information M ∈_2,
we prepare the binary uniform scramble random variable L∈_2.
We consider the following code.
The encoder ϕ is given as 

    Y_1:=L,   
    Y_2:=M+L. Eq3

The decoder ψ is given as ψ(Y_3,Y_4):=Y_3+Y_4.
Since Y_3 and Y_4 are given as follows under this code;

    Y_3= LM,   
    Y_4=LM+M,

the decoder can recover M whatever the value of L.

Now, we consider the leaked information for the passive attack.

As shown in Appendix,
the mutual information and the l_1 norm security measure
of these cases are calculated as

    I(M;Y_1,Y_3)= I(M;Y_1,Y_4) 
    
      =    I(M;Y_2,Y_3)=  I(M;Y_2,Y_4)=1/2,E9
        d_1(M|Y_1,Y_3)= d_1(M|Y_1,Y_4) 
    
      =    d_1(M|Y_2,Y_3)=  d_1(M|Y_2,Y_4)=1/2,F10

where the l_1 norm security measure d_1(X|Y) is defined as
d_1(X|Y):=∑_y ∑_x
|1/| X|P_Y(y) -P_XY(xy)|
by using the cardinality | X| of the set of outcomes of the variable X.
In this section, we choose 2 as the base of the logarithm.
The values in the above relations does not depend on the choice of 
the pair of the eavesdropping edges.
When Eve is allowed to use the above passive attack, (<ref>) shows that the code is secure in the sense of (B1).
Therefore, we obtain the first part of Theorem <ref> when q=2.
When q is a power 2^l of 2,
l repetitions of the above non-linear code on the prime field _2
give a an imperfectly secure non-linear code on the finite filed _q.
Hence, we obtain the first part of Theorem <ref> even when q
is a power of 2.

Next, we consider the active attack, which is classified into the following three cases.


  (i)
When E_E={e(1),e(3)},
Eve replaces Y_1 by 1. Then, I(M;Y_1,Y_3)=1 because Y_3+Y_1+1=M.


  (ii)
When E_E={e(1),e(4)},
Eve replaces Y_1 by 0. Then, I(M;Y_1,Y_4)=1 because Y_4+Y_1=M.


  (iii)
When E_E={e(2),e(3)} or {e(2),e(4)},
Eve has no advantageous active attack.

The cases (i) and (ii) show that this code is insecure under the above active attack.
Hence, this example can be regarded as a counterexample of the existing result <cit.>[Theorem 1] without linearity.













As another encoder, we can consider 

    Y_1:=M+L,   
    Y_2:=L.

Replacing M+L by L, 
the analysis can be reduced to the presented analysis.
When the message M is not leaked to e(1) or e(2) 
and M can be recovered,
the code is essentially the same as our code as follows.

Assume that the information Y_2 on e(2) is independent of M.
Then, we denote it by L.
In order that Y_1 is independent and M can be recovered from Y_1 and L,
Y_1 needs to be M+L or M+L+1.


In this model, Eve can completely contaminate the message M as follows.
When Eve takes choice (i), and replaces Y_3 by Y_3+1,
Bob's decoded message is M+1.
Under choice (ii), Eve can totally contaminate the message M in a similar way.



 §.§ Uniqueness of network code given in (<ref>) and (<ref>)

The previous subsubsection provided an example where Eve's active attack improves her performance.
To show the second part of Theorem <ref>, 
we need to show the following lemma.




T6
Assume that a code (ϕ,φ,ψ) satisfies the following conditions.
Let Y_1 and Y_2 be the random variable generated by the encoder 
ϕ when M is subject to the uniform distribution.
We assume that the random variables (Y_3,Y_4):=φ (Y_1,Y_2)
satisfies the following conditions.


  (C1) The relation ψ (Y_3,Y_4)=M holds.

  (C2) There is no deterministic function ψ̃
from _2^2 to _2 satisfying one of the following conditions.

    ψ̃(Y_1,Y_3)=M,  ψ̃(Y_1,Y_4)=M, 
    ψ̃(Y_2,Y_3)=M,  ψ̃(Y_2,Y_4)=M.


Then, there exist functions
f_1,f_2,f_3,f_4 on _2 such that
Y_i':=f_i(Y_i) is given in (<ref>), (<ref>), and (<ref>)
with a scramble random variable L while the variable L might be correlated with M.


Since 
the number of edges to be attacked
is the same as the transmission rate from Alice to Bob,
no linear code works in this scheme.
Hence, we need to introduce a non-linear coding operation in the intermediate node. 
Lemma <ref> shows that such a non-linear coding operation is limited to 
(<ref>) and (<ref>).
The combination of Lemma <ref> and the discussion in Subsection <ref>
implies that there is no code over the one-hop relay network (Fig. <ref>)
to guarantee the secrecy for an active attack.
Hence, we obtain the remaining part of Theorem <ref>.

However, this theorem assumes a deterministic coding operation on the intermediate node.
If we are allowed to use a randomized operation on the intermediate node 
in a similar way to an encoder,
we can construct a code whose secrecy holds even against Eve's active attack
in this situation as follows.
In the first step, we employ the code given in (<ref>).
Using another scramble random variable L',
the intermediate node performs the following coding operation:

    Y_3:=Y_1+Y_2+L'=M_L',   
    Y_4:=L'.

Then, Eve cannot recover the message M from 
(Y_1,Y_3), (Y_1,Y_4), (Y_2,Y_3), nor (Y_2,Y_4).
This example shows that the deterministic condition for φ is crucial in Lemma <ref>.

Lemma <ref>

Step (1):  To satisfy condition (C1),
we need to recover the message M from (Y_1,Y_2) from a deterministic function f.
Functions from _2^2 to _2 are classified as follows.

    Y_1,  Y_1+1,Y_2,  Y_2+1,0,1D1
       Y_1+Y_2,   Y_1+Y_2+1, D2
       Y_1Y_2,
    (Y_1+1)(Y_2+1),
    (Y_1+1)Y_2,
    Y_1(Y_2+1),
    C3
       Y_1Y_2+1,
    (Y_1+1)(Y_2+1)+1,
    (Y_1+1)Y_2+1, 
    
       Y_1(Y_2+1)+1.
    C4

The cases in (<ref>) are non-secure or
do not satisfy (C1).
The cases in (<ref>) are reduced to the case M=Y_1+Y_2.
The cases in (<ref>) and (<ref>) 
are reduced to the case M=Y_1Y_2.
Hence, we consider only these two cases.

Step (2):  Now, we consider the case M=Y_1+Y_2.
When Y_3 or Y_4 is given as a non-zero linear function of Y_1 and Y_2,
we denote the random variable as Y_*.
Hence, Y_1 or Y_2 is linearly independent of Y_*.
We denote the linearly independent variable as Y_**.
When Eve eavesdrops Y_* and Y_**, 
she can recover Y_1 and Y_2 and so she can also recover M.
To satisfy Condition (C2), we need to avoid such an attack, 
which requires both Y_3 and Y_4 to be non-linear functions of (Y_1,Y_2).
They are given as two of the functions given in (<ref>) and (<ref>).
Since any function in (<ref>) is deterministically given from 
a function given in (<ref>),
we consider only functions in (<ref>).
Under this constraint,
if and only if (Y_3,Y_4) is given as 
the pair 
(Y_1Y_2,(Y_1+1)(Y_2+1)) or (Y_1(Y_2+1),(Y_1+1)Y_2),
we can recover M=Y_1+Y_2 from Y_3 and Y_4.
The latter case is the same as (<ref>) and (<ref>). 
In the former case, we obtain (<ref>) and (<ref>)
by replacing Y_2 by Y_2+1.

Step (3):  Now, we consider the case where M=Y_1Y_2.
For the same reason as with Step (2), 
condition (C2) requires 
both Y_3 and Y_4 to be non-linear functions of 
(Y_1,Y_2).
Thus, we consider only functions in (<ref>).
For secrecy, i.e., to satisfy (C2), we cannot use Y_1Y_2.
Hence, we need to choose two from
(Y_1+1)(Y_2+1),(Y_1+1)Y_2, and Y_1(Y_2+1).
However, no two of them can recover M.
To observe this fact, we consider cases with (Y_1+1)Y_2 and Y_1(Y_2+1).
In these cases, when (Y_1,Y_2)=(0,0) or (1,1),
both values are zero.
That is, we cannot distinguish (0,0) and (1,1).
Hence, we cannot recover M from (Y_1+1)Y_2 and Y_1(Y_2+1), i.e.,
condition (C1) does not hold.
We can show this fact in other pairs in the same way.
Therefore, there is no operation satisfying the required conditions
when M=Y_1Y_2.




§ ANALYSIS WHEN CHARACTERISTIC IS NOT 2
S3-5
The aim of this section is to prove the statements.

TT7
When the message set X is the quotient ring _d with d≥ 3, 
there exists an imperfectly secure non-linear code even for active attack.


When q is p^l,
l repetitions of the above non-linear code on the prime field _p
give an imperfectly secure non-linear code on the finite filed _q.
Hence, we obtain the following corollary.
TT72
When the message set X is the finite field _q and q is not a power of 2,
there exists an imperfectly secure non-linear code even for active attack.




 §.§ Construction of imperfectly secure code for active attacks

To show Theorem <ref>, we construct a secure network coding against any active attack 
on the one-hop relay network given in Fig. <ref>
when the message and the information at the edges
are given as an element of _d.
Here, we define our code (ϕ,φ,ψ)
in the same way as in Subsection <ref>.
That is, the coding operation φ on the intermediate node
has no additional scramble random variable. 

It shows Theorem <ref>, it is sufficient to construct a code to satisfy the conditions (B1) and (B2) given in Subsection <ref>.
Since it is not so easy to check the conditions (B1) and (B2),
we seek equivalent conditions.
For simplicity, 
we employ a scramble variable L taking values in _d.
Hence, we assume that the encoder ϕ in the source node is given as 
a pair of functions (ϕ^(1),ϕ^(2))
that maps two random variables (M,L)
to the two variables (Y_1,Y_2).
That is, the encoder ϕ forms a function from _d^2 to itself.
Now, we fix the function ϕ as follows

    Y_1= ϕ^(1)(M,L):= M+L,   
    Y_2= ϕ^(2)(M,L):=L.


For a coding operation φ, we define 
the functions φ^(3) and φ^(4) as 

    (φ^(3)(i,j),φ^(4)(i,j)):=φ(i,j).

Then, we regard 
the functions φ^(3) and φ^(4) as matrices as follows,

    φ^(3)_i,j:=φ^(3)(i,j),  φ^(4)_i,j:=φ^(4)(i,j).

To discuss condition (B2),
we introduce an anti-Latin square.
A matrix a_i,j on _d is called an anti-Latin square
when each row and each column have duplicate elements as

    (
    [ 1 0 0; 0 0 2; 1 2 2 ]),  (
    [ 1 0 1; 1 2 1; 0 2 0 ]),Ex1
       (
    [ 1 0 3 3; 0 0 2 3; 1 1 3 2; 0 2 2 1 ]),  (
    [ 2 2 1 0; 0 3 3 1; 0 3 3 0; 1 1 2 2 ]), Ex2

which is the opposite requirement to a Latin square.
Therefore, we have the following lemma.

LOF
When the encoder ϕ satisfies condition (<ref>),
conditions (B1) and (B2) are rewritten as


  (B1') 
For each a ∈_d and
m≠ m'∈_d,
the relation Ξ_a,m(φ^(3),φ^(4))
∩Ξ_a,m'(φ^(3),φ^(4))
=∅ holds,
where Ξ_a,m(φ^(3),φ^(4)):=
φ^(4) ({(i,i+m)| φ^(3)_i,i+m=a}).


  (B2') 
The matrices φ^(3) and φ^(4) are anti-Latin squares.




We have the equivalence between conditions (B1) and (B1')
because (B1') means that the pair of φ^(3)(i,j) and 
φ^(4)(i,j) uniquely identifies the difference m=j-i.

Next, we show the equivalence between (B2) and (B2').
Assume that Eve eavesdrops and contaminates Y_1 and eavesdrops Y_3.
Choosing the replaced information Y_1', 
Eve can choose a row of the matrix φ^(3).
To prevent Eve from recovering M perfectly,
all the rows of the matrix φ^(3) need to have duplicate elements.
Hence, to satisfy condition (B2),
both matrices φ^(3) and φ^(4) need to satisfy this duplication requirement  for all rows and columns.


Due to Lemma <ref>, to show Theorem <ref>,
it is sufficient to construct a pair of anti-Latin squares to satisfy conditions (B1') and (B2').
While it is trivial to find anti-Latin squares, they need to satisfy condition (B1') as well.
Condition (B2') forbids a linear operation on the intermediate node in the finite field case.
A pair of anti-Latin squares is called decodable when it satisfies condition (B1').
That is, a decodable pair of anti-Latin squares gives a code on the one-hop relay network given in Fig. <ref> satisfying conditions (B1) and (B2).
Lemma <ref> says that there is no decodable pair of 2 × 2 anti-Latin squares.
Fortunately, Eq. (<ref>) (Eq. (<ref>))
is a decodable pair of  3 × 3 (4 × 4) anti-Latin squares. 

However, we can systematically construct decodable pairs of anti-Latin squares.
The following are pairs of  anti-Latin squares for d=3,5,7:

    (
    [ 0 1 0; 1 1 2; 0 2 2 ]),  (
    [ 0 2 2; 0 1 0; 1 1 2 ]),Ex3
       (
    [ 0 1 2 0 0; 1 1 2 3 1; 2 2 2 3 4; 0 3 3 3 4; 0 1 4 4 4 ]),  (
    [ 0 3 3 3 4; 0 1 4 4 4; 0 1 2 0 0; 1 1 2 3 1; 2 2 2 3 4 ]),Ex5
       (
    [ 0 1 2 3 0 0 0; 1 1 2 3 4 1 1; 2 2 2 3 4 5 2; 3 3 3 3 4 5 6; 0 4 4 4 4 5 6; 0 1 5 5 5 5 6; 0 1 2 6 6 6 6 ]),
       (
    [ 0 4 4 4 4 5 6; 0 1 5 5 5 5 6; 0 1 2 6 6 6 6; 0 1 2 3 0 0 0; 1 1 2 3 4 1 1; 2 2 2 3 4 5 2; 3 3 3 3 4 5 6 ]).Ex7

These constructions are generalized to the case with a general odd number
d=2ℓ+1 as follows.
The functions 
φ^(3) 
and
φ^(4) 
are defined as

    (φ^(3))^-1(k)
       :=
    {[     (k,k-ℓ),(k,k-ℓ+1),…,; (k,k-1),(k,k),(k-1,k),…,;       (k-ℓ+1,k),
    (k-ℓ,k) ]}
    
    (φ^(4))^-1(k)
       :=
    {[ (k+ℓ,k-ℓ),(k+ℓ,k-ℓ+1),;          …, (k+ℓ,k-1),;     (k+ℓ,k),(k+ℓ-1,k),;      …,
    (k+1,k),
    (k,k) ]} .

Then, we have

    φ^(4)(k,k-ℓ)   =k-ℓ,
    φ^(4)(k,k-ℓ+1)   =k-ℓ+1,
    ⋮
    φ^(4)(k,k-1)   = k-1
    φ^(4)(k,k)   =k
    φ^(4)(k-1,k)   =k+ℓ
    ⋮
    φ^(4)(k-ℓ+1,k)   =k+2
    φ^(4)(k-ℓ,k)   =k+1,

which satisfy condition (B1').
Hence, the functions φ^(3) and φ^(4) give a pair of  anti-Latin squares. 


Next, we consider the even case with d ≥ 4.
The following are pairs of  anti-Latin squares for d=4,6,8:

    (
    [ 0 1 3 3; 0 1 2 0; 1 1 2 3; 0 2 2 3 ]),  (
    [ 0 0 1 0; 1 1 1 2; 3 2 2 2; 3 0 3 3 ]), Ex4
       (
    [ 0 1 2 5 5 5; 0 1 2 3 0 0; 1 1 2 3 4 1; 2 2 2 3 4 5; 0 3 3 3 4 5; 0 1 4 4 4 5 ]),  (
    [ 1 1 1 2 3 1; 2 2 2 2 3 4; 5 3 3 3 3 4; 5 0 4 4 4 4; 5 0 1 5 5 5; 0 0 1 2 0 0 ]), Ex6
       (
    [ 0 1 2 3 7 7 7 7; 0 1 2 3 4 0 0 0; 1 1 2 3 4 5 1 1; 2 2 2 3 4 5 6 2; 3 3 3 3 4 5 6 7; 0 4 4 4 4 5 6 7; 0 1 5 5 5 5 6 7; 0 1 2 6 6 6 6 7 ]),
       (
    [ 2 2 2 2 3 4 5 2; 3 3 3 3 3 4 5 6; 7 4 4 4 4 4 5 6; 7 0 5 5 5 5 5 6; 7 0 1 6 6 6 6 6; 7 0 1 2 7 7 7 7; 0 0 1 2 3 0 0 0; 1 1 1 2 3 4 1 1;   ]). Ex8

These constructions are generalized to the case with a general even number
d=2ℓ with ℓ≥ 2 as follows.
The functions 
φ^(3) 
and
φ^(4) 
are defined as

    (φ^(3))^-1(k)
       :=
    {[         (k+1,k-ℓ+1),;       (k+1,k-ℓ+2),…,;   (k+1,k-1),(k+1,k),;    (k,k),(k-1,k),
    …,; (k-ℓ+2,k),
    (k-ℓ+1,k) ]}
    
    (φ^(4))^-1(k)
       :=
    {[    (k-ℓ+1,k-ℓ+2),; (k-ℓ+2,k-ℓ+2),
    …,;        (k,k-ℓ+2),;      (k+1,k-ℓ+2),;   (k+1,k-ℓ+1),
    …,;     (k+1,k-2ℓ+4),;      (k+1,k-2ℓ+3) ]} .

Then, we have

    φ^(4)(k+1,k-ℓ+1)   =k+ℓ,
    φ^(4)(k+1,k-ℓ+2)   =k+ℓ+1,
    ⋮
    φ^(4)(k+1,k-1)   = k+2ℓ-2
    φ^(4)(k+1,k)   =k+ℓ-1
    φ^(4)(k,k)   =k+ℓ-2
    φ^(4)(k-1,k)   =k+ℓ-3
    ⋮
    φ^(4)(k-ℓ+2,k)   =k 
    φ^(4)(k-ℓ+1,k)   =k-1,

which satisfy condition (B1').
Hence, the functions φ^(3) and φ^(4) give a pair of  anti-Latin squares. 

In summary, since these examples work with d≥ 3, 
we have proven Theorem <ref>, i.e., 
there exists a secure code over the active attacks on the one-hop relay network (Fig. <ref>)

when d≥ 3.

Furthermore, when φ is given by these pairs of anti-Latin squares, 
Bob can decode L as well as M
while the code given by (<ref>) or (<ref>) cannot.
That is, these systematic constructions work well whenever the encoder
ϕ=(ϕ^(1),ϕ^(2)) is a one-to-one function 
on _d^2

to satisfy the condition
{i|∃ j,  ϕ^(1)(i,j)=k}=
{i|∃ j,  ϕ^(2)(i,j)=k}=
_d for any k.











 §.§ Leaked information of our code for passive attacks

Next, we discuss the leaked information under the above code under passive attacks
in a way similar to (<ref>) and (<ref>).

Since for i=1,2 and j=3,4, the pair M,Y_i decides Y_1,Y_2,
we have H(Y_j|M Y_i)=0.
Since Y_i is independent of M,
we have

    I(M;Y_i Y_j)
    = H(M)-H(M|Y_iY_j) 
    
    =    H(M|Y_i)-H(M|Y_iY_j)
    =I(M; Y_j|Y_i)
     
    =    H(Y_j|Y_i)-H(Y_j|M Y_i)
    = H(Y_j|Y_i).

When d is odd,
we have

    H(Y_j|Y_i)= H(Y_j|Y_i=y_i) 
    
    =   d+1/2·1/dlog2d/d+1
    +
    d-1/2·1/dlog d

for any y_i with i=1,2 and j=3,4.

When d≥ 4 and d is even,
we have

    H(Y_3|Y_2)=H(Y_3|Y_2=y_2)
    = H(Y_4|Y_1)
    
    =    H(Y_4|Y_1=y_1)=
    d+2/2·1/dlog2d/d+2
    +
    d-2/2·1/dlog d ,
       H(Y_3|Y_1)=H(Y_3|Y_1=y_1)= H(Y_4|Y_2)
    
    
    =    H(Y_4|Y_2=y_2)
    = 
    1/2log 2
    +
    1/2log d

for any y_1,y_2.
In summary, when d is large, we have

    I(M;Y_i Y_j) = 1/2log d +1/2log 2
    + O(log d/d).F29-6




 §.§ Lower bound of leaked information for passive attacks
S3-6
Next, to show the optimality of the code defined in Subsection <ref>, 
we show that the amount in (<ref>) is close to the minimum leaked information
under a certain condition when d is large.
To derive a lower bound, we consider the following conditions for our code.







  (D1)
The coding operation on the intermediate node is deterministic.


  (D2)
Alice can use a scramble random variable L.

Since our encoder is given as a stochastic map ϕ
from _2 to _2^2 in Section <ref>,
condition (D2) is a more restrictive condition for our encoder.

Then, we have the following theorem.


Any network code satisfies 
the inequality

    I(M; Y_i Y_3)+I(M; Y_i Y_4) ≥ 2 H(M) - log d

for i=1,2.




Since M is decoded by Y_3 Y_4,

    H(M| Y_i Y_3)
    ≤ H(Y_3Y_4 | Y_i Y_3)
    = H(Y_4 | Y_i Y_3)
     ≤ H(Y_4| Y_i ).

Similarly, we have H(M| Y_i Y_4) ≤ H(Y_3| Y_i Y_4) by replacing Y_3 and Y_4.
Let i' be the integer 1 or 2 that is different from i.
Combining them, we have

    H(M| Y_i Y_3)+H(M| Y_i Y_4)
     ≤ H(Y_4| Y_i )+H(Y_3| Y_i Y_4) 
    
     =    H(Y_3 Y_4| Y_i ) 
     (a)≤
     H(Y_i Y_i'| Y_i ) 
    
    =    H(Y_i'| Y_i ) ≤log d,

where (a) follows from the fact that 
Y_3 Y_4 is decided by Y_1 Y_2.
Thus, we obtain

    I(M; Y_i Y_3)+I(M; Y_i Y_4) 
    
    =    2 H(M) - (H(M| Y_i Y_3)+H(M| Y_i Y_4)) 
    ≥    2 H(M) - log d.




Lemma <ref> shows that

    max_i,jI(M; Y_i Y_j) ≥ H(M)- 1/2log d,NHT

where the maximum is chosen from i=1,2 and j=3,4.
That is, to realize max_i,jI(M; Y_i Y_j)=0, 
the message M needs to satisfy 

    H(M)≤1/2log d.

When M is the uniform random variable, (<ref>) can be rewritten as 

    max_i,jI(M; Y_i Y_j) ≥1/2log d.

This lower bound is almost equal to the RHS of (<ref>) when d is large.




§ CONCLUSION
SCon



In this paper, we have discussed how sequential error injection affects the information leakage over the one-hop relay network.
For this aim, we have studied secure network coding for active attacks 
over the one-hop relay network (Fig. <ref>) including non-linear operations on the intermediate node.
The obtained results are summarized in Table <ref>.

First, we show that no linear code realizes the security (even imperfect security)
when Eve eavesdrops one channel in both layers, the intermediate node can make only a deterministic operation, and 
the message set X is a finite field _q.
Hence, to meet the security, 
the coding operation on the intermediate node needs to be non-linear.
When the message set X is the finite field _2,
we propose a code to satisfy the imperfect security under the passive attack by Eve.
However, it does not satisfy the imperfect security under the active attack.
As shown in Section <ref>, any code to satisfy the imperfect security is limited to 
a code equivalent to this non-linear code.
Hence, unfortunately, no code on the one-hop relay network is imperfectly secure under active attacks
in the binary case.


To realize the imperfect security even under active attacks,
we have studied the case when 
the message set X is the finite field _q with q ≠ 2^l, which includes the ternary case. 
This can be obtained as a simple extension of the case with the prime field _p.
To characterize the desired security in this case, 
we have introduced a new concept an “anti-Latin square”, which is an opposite concept to a Latin square.
That is, such a secure code can be given as a decodable pair of anti-Latin squares while the concept of “decodable” is also introduced in Section <ref>.
We have also shown the existence of a decodable pair of 
p × p anti-Latin squares when p ≥ 3.
This fact shows that 
there exists an imperfectly secure code over active attacks except for the binary case.
The obtained analysis of this part
still holds when the message set X is _d.




In fact, it is still remained an open problem whether there exists an imperfectly secure 
code over active attack on the one-hop relay network
when the message set X is _2^l with l ≥ 2.
This is an interesting future study.
Also, the obtained analysis depends on the property of 
the single transmission scheme.
As shown in the paper <cit.>, under the setting of transmission of multiple letters, 
there exists a secure code to satisfy the vector linearity.
Since our analysis is limited to the one-hop relay network,
it is a challenging future study to investigate 
a similar security analysis over a multiple-layered network.

Due to our analysis, a secure code on our model is limited to 
non-linear code to satisfy the conditions (B1') and (B2').
Clearly, as mentioned in the end of Subsection <ref>,
this type of codes do not satisfy the robustness when 
Eve contaminates the information on the attacked edges.
Hence, to realize the robustness as well as the secrecy,
we need to increase the number of edges between nodes.
Since the robustness is another important issue in secure network coding,
it is another interesting future study to the secrecy and the robustness jointly over a modified network model.




§ ACKNOWLEDGMENTS

MH and NC are very grateful to 
Prof. Masaki Owari, Dr. Go Kato, and 
Dr. Wangmei Guo


for helpful discussions and comments.







First, we calculate I(M;Y_1,Y_3) and d_1(M|Y_1,Y_3).
We find that

    P_Y_1,Y_3|M(0,0|0)=
    P_Y_1,Y_3|M(1,0|0) =1/2,
    
    P_Y_1,Y_3|M(0,0|1)=
    P_Y_1,Y_3|M(1,1|1)=1/2,

where the remaining conditional probabilities are zero.
Hence, 

    H(Y_1,Y_3|M)=1,  
    H(Y_1,Y_3)=1/2log 2 +1/2log 4 =3/2,

which implies I(M;Y_1,Y_3)=1/2.

Since

    P_Y_1,Y_3(0,0)=1/2, 
    P_Y_1,Y_3(1,0)=
    P_Y_1,Y_3(1,1)=1/4,

we have

    P_M|Y_1,Y_3(0|0,0)   =
    P_M|Y_1,Y_3(1|0,0)=1/2,
    
    P_M|Y_1,Y_3(0|1,0)   =
    P_M|Y_1,Y_3(1|1,1)=1,

where the remaining conditional probabilities are zero.
Therefore,

    d_1(M|Y_1,Y_3) 
    
    =    |1/2P(0,0)-1/2P(0|0,0)|
    +|1/2P(1,0)-1/2P(0|1,0)| 
       +|1/2P(1,1)-1/2P(0|1,1)| 
    +|1/2P(0,0)-1/2P(1|0,0)|
       
    +|1/2P(1,0)-1/2P(1|1,0)|
    +|1/2P(1,1)-1/2P(1|1,1)|
    
    =   0+1/8+1/8
    +0+1/8+1/8
    =
    1/2.

Replacing M and L by M+1 and L+1, respectively,
we can calculate I(M;Y_1,Y_4) and d_1(M|Y_1,Y_4)
in the same way.

Next, we consider 
I(M;Y_2,Y_3) and d_1(M|Y_2,Y_3).
We find that

    P_Y_2,Y_3|M(0,0|0)=
    P_Y_2,Y_3|M(1,0|0) =1/2,
    
    P_Y_2,Y_3|M(0,1|1)=
    P_Y_2,Y_3|M(1,0|1)=1/2,

where the remaining conditional probabilities are zero.
Hence, replacing (0,0) and (1,1) by (1,0) and (0,1), respectively, in the above
derivation, we can show 
I(M;Y_2,Y_3)=1/2
and d_1(M|Y_2,Y_3)=1/2.
Finally, replacing M and L by M+1 and L+1, respectively,
we can calculate I(M;Y_2,Y_4) and d_1(M|Y_2,Y_4) in the same way.

10
Cai2002
N. Cai and R. Yeung, “Secure network coding,” 
Proc. 2002 IEEE Int. Symp. Information Theory (ISIT 2002), Lausanne, Swiss, July 2002, p. 323.

CY
N. Cai and R. W. Yeung,
“Secure Network Coding on a Wiretap Network,”
IEEE Trans. Inform. Theory, 
vol. 57, no. 1, 424 – 435 (2011).

YN
R. W. Yeung and N. Cai, 
“On the optimality of a construction of secure network codes,” 
Proc. 2008 IEEE Int. Symp. Information Theory (ISIT 2008), 
Toronto, ON, Canada, Jul. 6 – 11, 2008, pp. 166 – 170.


CG
T. Chan and A. Grant, 
“Capacity bounds for secure network coding,” 
Proc. Australian Commun. Theory Workshop, 
Christchurch, NZ, Jan. 30 – Feb. 1, 2008, pp. 95 – 100.


RSS
S. El Rouayheb, E. Soljanin, and A. Sprintson, 
“Secure network coding for wiretap, networks of type II,” 
IEEE Trans. Inform. Theory, 
vol. 58, no. 3, pp. 1361 – 1371 (2012).                      


FMSS
J. Feldman, T. Malkin, C. Stein, and R. A. Servedio, 
“On the capacity of secure network coding,” 
Proc. 42nd Annu. Allerton Conf. Commun. Control Comput., Monticello, IL, Sep. 29 – Oct. 1, 2004.


NYZ
C.-K. Ngai, R. W. Yeung, and Z. Zhang, 
“Network generalized hamming weight,” 
Proc. Workshop Network Coding Theory Appl., 
Lausanne, Switzerland, 2009, pp. 48 – 53.  


HY
K. Harada and H. Yamamoto, 
“Strongly secure linear network coding,” 
IEICE Trans. Fund., 
vol. E91-A, no. 10, pp. 2720 – 2728 (2008).


Cai
N. Cai, “Valuable messages and random outputs of channels in linear
network coding,” 
Proc. 2009 IEEE Int. Symp. Information Theory (ISIT 2009), 
Seoul, Korea, Jun. 28 – Jul. 3, 2009, pp. 413 – 417. 

CC
N. Cai and T. Chan,
“Theory of Secure Network Coding,”
Proceedings of the IEEE, vol. 99, no. 3, 421 – 437 (2011).

AVF16-1
G. K. Agarwal, M. Cardone, and C. Fragouli, 
“Coding across unicast sessions can increase the secure message capacity,” 
Proc. 2016 IEEE Int. Symp. Information Theory (ISIT 2016), 
Barcelona, Spain, 10 – 15 July, 2016, pp. 2134 – 2138.

AVF16-2
G. K. Agarwal, M. Cardone, and C. Fragouli, 
“On secure network coding for two unicast sessions: studying butterflies,”
Proc. 2016 IEEE Globecom Workshops (GC Wkshps), 
Washington, DC, USA, 4 – 8 Dec., 2016, pp. 1 – 6.


AVF17
G. K. Agarwal, M. Cardone, and C. Fragouli, 
“Secure Network Coding for Multiple Unicast: On the Case of Single Source,”
In International Conference on Information Theoretic Security (pp. 188-207). 
Springer, Cham. 2017, November. 

CY2 N. Cai and R. W. Yeung, 
“Network error correction, Part II: lower bounds,” 
Communications in Information and Systems,
vol. 6, no. 1, pp.37 – 54 (2006).

NY C. K. Ngai and S. Yang, 
“Deterministic Secure Error-Correcting (SEC) Network Codes,” 
Information Theory Workshop, Lake Tahoe, USA, 2007.

YC2 R. W. Yeung and N. Cai, 
“Network error correction, Part I: basic concepts and upper bounds,” 
Communications in Information and Systems, vol. 6, no. 1, pp. 19 – 36 (2006).

Yao2014
H. Yao, D. Silva, S. Jaggi, and M. Langberg,
“Network Codes Resilient to Jamming and Eavesdropping,”
IEEE/ACM Transactions on Networking, vol. 22, no. 6, 1978 - 1987 (2014).

SK
D. Silva and F. R. Kschischang, 
“Universal Secure Network Coding via Rank-Metric Codes,”
IEEE Trans. Inform. Theory, Volume: 57, Issue:2, 1124 - 1135 (2011).



KMU
J. Kurihara, R. Matsumoto, and T. Uyematsu,
“Relative generalized rank weight of linear codes and its applications to network coding,”
IEEE Trans. Inform. Theory, 
vol. 61, no. 7, pp. 3912–3936 (2013).

Matsumoto2011
R. Matsumoto and M. Hayashi, “Secure Multiplex Network Coding,” 
2011 International Symposium on Networking Coding (2011):
DOI: 10.1109/ISNETCOD.2011.5979076.

Matsumoto2011a
R. Matsumoto and M. Hayashi, 
“Universal Secure Multiplex Network Coding with Dependent and Non-Uniform Messages,” 
IEEE Trans. Inform. Theory, vol. 63, no. 6, pp. 3773 – 3782, (2017).

HOKC1
M. Hayashi, M. Owari, G. Kato, and N. Cai, 
“Reduction Theorem for Secrecy 
over Linear Network Code for Active Attacks”
arXiv:2003.11722 (2019).

CH
N. Cai and M. Hayashi,
“Secure Network Code for Adaptive and Active Attacks with No-Randomness in Intermediate Nodes,”
IEEE Transactions on Information Theory, (In Press).

LYC
S.-Y. R. Li, R. W. Yeung, and N. Cai, 
“Linear network coding,” 
IEEE Trans. Inform. Theory, 
vol. 49, pp. 371 – 381, 2003.

DFZ R. Dougherty, C.  Freiling, and K. Zeger, 
“Insufficiency of Linear Coding in Network Information Flow,” 
IEEE Trans. Inform. Theory, 
vol. 51, no. 8, 2745 – 2759 (2005).

YYZ
S. Yang, R.W. Yeung, and Z. Zhang, 
“Weight properties of network codes,” 
Trans. on Emerging Telecommunications Technologies, 
vol. 19, no. 4, 371-383 (2008).

HG
M. Herrero-Collantes and J. C. Garcia-Escartin
“Quantum Random Number Generators,”
Rev. Mod. Phys., vol. 89, 015004 (2017).

HZ
M. Hayashi and H. Zhu
“Secure uniform random number extraction via incoherent strategies,”
Phys. Rev. A, 97, 012302 (2018).

CY-07
N. Cai and R. W. Yeung,
“A Security Condition for Multi-Source Linear Network Coding,”
Proc. 2007 IEEE Int. Symp. Information Theory (ISIT 2007),  
Nice, France, June 2007, p. 561 – 565.

CHK-10
T. Cui, T. Ho, and J. Kliewer,
“Achievable strategies for general secure network coding”,
Information Theory and Applications Workshop (ITA), 2010.

CHK-13
T. Cui, T. Ho, and J. Kliewer,
“On Secure Network Coding With Nonuniform or Restricted Wiretap Sets”,
IEEE Trans. Inform. Theory, 
vol. 59, pp. 166 – 176, (2013).

CN11
N. Cai and T. Chan, 
“Theory of Secure Network Coding,” 
Proceedings of the IEEE, vol. 99, no. 3, 421-437 (2011).

CN11b
N. Cai and R. W. Yeung, 
“Secure Network Coding on a Wiretap Network,” 
IEEE Trans. Inform. Theory, vol. 57, no. 1, 424-435 (2011).

Bhattad
K. Bhattad, and  K. R. Narayanan,  “Weakly secure network coding,”
1st Workshop on Network Coding, Theory, and App., April 2005.


CCMG
A. Cohen, A. Cohen, M. Médard,  and O. Gurewitz, 
“Individually-secure multi-source multicast,” 
Proc. 2017 IEEE Int. Symp. Information Theory (ISIT 2017), 
Aachen, Germany, Jun. 25 – 30, 2017, pp. 3105 – 3109;
arXiv:1702.03012

HOKC
M. Hayashi, M. Owari, G. Kato, and N. Cai, 
“Secrecy and Robustness for Active Attack in Secure Network Coding,”
Proc. 2017 IEEE Int. Symp. Information Theory (ISIT 2017), 
Aachen, Germany, 25-30 June 2017. pp. 1172 – 1177.



