IN THE paradigm of network coding, a set of source nodes

Transcription

1 4496 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 64, NO. 6, JUNE 2018 Sngle-Uncast Secure Network Codng and Network Error Correcton are as Hard as Multple-Uncast Network Codng Wentao Huang, Tracey Ho, Senor Member, IEEE, Mchael Langberg, Senor Member, IEEE, and Jörg Klewer, Senor Member, IEEE Abstract Ths paper reduces multple-uncast network codng to sngle-uncast secure network codng and sngle-uncast network error correcton. Specfcally, we present reductons that map an arbtrary multple-uncast network codng nstance to a uncast secure network codng nstance n whch at most one lnk s eavesdropped, or a uncast network error correcton nstance n whch at most one lnk s erroneous, such that a rate tuple s achevable n the multple-uncast network codng nstance f and only f a correspondng rate s achevable n the uncast secure network codng nstance, or n the uncast network error correcton nstance. Conversely, we show that an arbtrary uncast secure network codng nstance n whch at most one lnk s eavesdropped can be reduced back to a multple-uncast network codng nstance. In addton, we show that the capacty of a uncast network error correcton nstance n general s not (exactly) achevable. Index Terms Network codng, equvalence, securty, error correcton, capacty. I. INTRODUCTION IN THE paradgm of network codng, a set of source nodes transmts nformaton to a set of termnal nodes over a network wth noseless lnks; nternal nodes of the network may mx receved nformaton before forwardng t. Ths mxng (or encodng) of nformaton has been extensvely studed over the last decade (see e.g., [4] [8], and references theren). In partcular, the problems of determnng the capacty of the network and desgnng optmal codes achevng the capacty Manuscrpt receved January 14, 2016; revsed January 6, 2017; accepted February 28, Date of publcaton March 29, 2018; date of current verson May 18, Ths work was supported n part by NSF under Grant CCF and Grant CNS and n part by the Caltech Lee Center. Ths paper was presented n part at the 2013 Internatonal Symposum on Network Codng [1], the 2014 Allerton Conference on Communcaton, Control and Computng [2], and the 2015 IEEE Internatonal Symposum on Informaton Theory [3]. W. Huang was wth the Department of Electrcal Engneerng, Calforna Insttute of Technology, Pasadena, CA USA. He s now wth Snap Inc., Vence, CA USA (e-mal: whuang@snap.com). T. Ho was wth the Department of Electrcal Engneerng, Calforna Insttute of Technology, Pasadena, CA USA. He s now wth Second Spectrum Inc., Los Angeles, CA USA (e-mal: tracey@secondspectrum.com). M. Langberg s wth the Department of Electrcal Engneerng, The State Unversty of New York at Buffalo, Buffalo, NY USA (emal: mkel@buffalo.edu). J. Klewer s wth the Department of Electrcal and Computer Engneerng, New Jersey Insttute of Technology, Newark, NJ USA (emal: jklewer@njt.edu). Communcated by C.-C. Wang, Assocate Edtor for Codng Technques. Dgtal Object Identfer /TIT are well understood under the multcast settng, where there s a sngle source node whose nformaton s demanded by all termnal nodes. However, much less s known regardng the multple-uncast settng where there are multple source nodes, each of them demanded by a sngle and dfferent termnal node (the more general settng of multple-multcast, where each termnal node may demand the nformaton from an arbtrary subset of source nodes, can be converted to an equvalent multple-uncast settng usng the constructons n [9], [10]). Determnng the capacty or the achevablty of a rate tuple n a multple-uncast network codng nstance remans an ntrgung, central, open problem, e.g., [11] [13]. Ths work connects multple-uncast network codng to two other fundamental network codng problems, namely secure network codng and network error correcton, usng the dea of reducton. We focus on the decson problem of determnng whether a rate tuple s achevable n the network, as well as the decson problem of determnng whether a rate tuple s n the capacty regon of the network. Here a rate tuple s achevable f there exsts a code that exactly acheves t, and the capacty regon s the closure of the set of all achevable rate tuples. Note that by defnton, a rate tuple that s achevable s always n the capacty regon, and a rate tuple that s n the capacty regon s always asymptotcally achevable but may not be (exactly) achevable. We study these problems usng the technque of reducton. Loosely speakng, we say a class of decson problems I can be reduced to a class of decson problems J f there exsts a scheme that maps any problem nstance n I to a correspondng problem nstance n J,such that the answers to the two nstances are the same. In other words, usng such a reducton methodology, one may take an nstance of I, map t to a correspondng nstance of J, solve the decson problem on the nstance of J, and deduce a soluton for the orgnal nstance of I; mplyng that f there s a way to solve the problems n J, then there s a way to solve the problems n I. In ths paper we construct a reducton,.e., a mappng, from the problem of multple-uncast network codng to the problem of uncast secure network codng. Note that the latter problem s asked under the smplest settng of uncast, where there s a sngle source node and a sngle termnal node n the network. Therefore under the uncast settng the rate tuple degenerates to a scalar, whch s referred to as rate. Our reducton addresses the problem of determnng whether IEEE. Personal use s permtted, but republcaton/redstrbuton requres IEEE permsson. See for more nformaton.

2 HUANG et al.: SINGLE-UNICAST SECURE NETWORK CODING AND NETWORK ERROR CORRECTION 4497 a rate/rate tuple s achevable, as well as the problem of determnng whether a rate/rate tuple s n the capacty regon. Secondly, we construct another reducton from the problem of multple-uncast network codng to the problem of uncast network error correcton. Note that agan the latter problem s asked under the smplest settng of uncast. Surprsngly, we show that our reducton only works for the problem of determnng whether a rate/rate tuple s achevable. In contrast, for the problem of determnng whether a rate/rate tuple s n the capacty regon, we show that the same reducton mappng no longer guarantees that t does not change the answers to the nstances. An nterestng consequence of ths negatve result s that the capacty of a uncast network error correcton nstance n general s not (exactly) achevable. Compared to the standard network codng problem, secure network codng and network error correcton have addtonal secrecy and relablty requrements, descrbed n the followng subsectons. A. Secure Network Codng Secure network codng s a natural generalzaton of network communcaton to networks wth eavesdroppers. Specfcally, n the secure network codng problem, a subset A A of lnks may be eavesdropped, where A s gven and s the collecton of all possble eavesdroppng patterns. A vald code desgn for the secure network codng problem needs to ensure the secrecy of the source nformaton. Namely, for any choce of A from A, the mutual nformaton between the set of sgnals transmtted on the lnks n A and the source messages must be neglgble. The secure network codng problem s well studed n the lterature and n partcular s well understood n the multcast settng under the assumpton that 1) all lnks have equal capactes, and 2) A s unform,.e., A ncludes all subsets of lnks of sze z w,wherez w s the number of wretapped lnks, and 3) only the source node can generate randomness, e.g., [14] [17]. In the cases that ether lnk capactes are not equal, or A s arbtrary, or non-source nodes may generate randomness, determnng the capacty or the achevablty of a rate n a secure network codng nstance remans an open problem, e.g., [18] [22]. Ths paper shows that an arbtrary multple-uncast network codng nstance I can be reduced to a partcular uncast secure network codng nstance I s that has a very smple setup. Specfcally, the reducton mappng ensures that n I s :a)there s a sngle source node and a sngle termnal node n an acyclc network; b) all lnks have equal capacty; c) there s a sngle wretapped lnk and ths lnk can be any lnk n the network, namely, A s unform wth z w = 1; and d) non-source nodes are allowed to generate randomness. The setup of I s s smple n the sense that setup a) s the smplest connecton requrement, b) s the smplest assumpton on lnk capactes, and c) gves the smplest structure of a non-trval A. Indeed, under the setup of a) - c) the secure capacty of the network s characterzed by the cut-set bound and s acheved by lnear codes [14]. In ths sense, our reducton suggests that the addton of setup d) s crtcal; as the secure network codng problem s smple and well understood under settng a) - c), but under settng a) - d) we show that t s as hard as the long standng open problem of multple-uncast network codng. We remark that allowng non-source nodes to generate randomness s realstc and preferable because ths can sgnfcantly ncrease the capacty of the network [21], [23]. Our reducton addresses the problem of determnng the achevablty of a rate/rate tuple, as well as the problem of determnng whether a rate/rate tuple s n the capacty regon. Furthermore, our reducton holds for dfferent types of securty requrements. Namely, n I s we may assume ether perfect, strong, or weak securty. Our reducton has an operatonal aspect. Namely, n our reducton, from a code for I s one can construct a code for I. Thus, usng our reducton, to solve an nstance of the multpleuncast network codng problem, one may frst reduce t to an nstance of the uncast secure network codng problem, then solve the latter, and fnally use ths soluton to obtan a soluton to the orgnal multple-uncast problem. We conclude, speakng loosely, that uncast secure network codng under the smple settng descrbed above s at least as hard as multple-uncast network codng. Our formal results are gven n Theorem 1 of Secton III. The hardness of general secure network codng problems are prevously studed n [18] and [21]. Specfcally, Chan and Grant [18] show that determnng the zero-error achevablty of a rate n the multcast secure network codng problem wth general setup (.e., arbtrary edge capactes, arbtrary A, and arbtrary nodes may generate randomness) and wth perfect securty s at least as hard as determnng the zero-error achevablty of a rate tuple n the multplemultcast network codng problem. Cu et al. [21] show that determnng the capacty of a uncast secure network codng problem s NP-hard f ether the edge capactes are arbtrary or A s arbtrary. Our work strengthens the result n [18] by showng that the secure network codng problem under an extremely smple setup (.e., uncast, equal lnk capactes, unform A wth a sngle wretap lnk) s stll hard, under varous defntons of achevablty and securty. B. Network Error Correcton We now turn to the network error correcton problem, whch s a natural generalzaton of network communcaton to networks wth adversaral errors. Specfcally, n the network error correcton problem a subset B B of lnks may be erroneous, where B s gven and s the collecton of all possble lnk error patterns. A vald code desgn for the error correcton problem needs to ensure relable communcaton between the sources and termnals n the worst case no matter whch set B B of lnks are erroneous or whch error has been mposed on these lnks. Namely, n ths context, the communcaton of a message s successful f for any choce of B from B, and for any (error) sgnals to be transmtted on the lnks n B, the message s correctly decoded at the termnal node. The network error correcton problem s extensvely studed and n partcular s well understood under the multcast settng wth the assumpton that 1) all lnks have equal capactes, and 2) B s unform,.e., B ncludes all subsets of lnks of sze z e, where z e s the number of erroneous lnks, e.g., [24] [29]. In the cases that ether lnk capactes are

3 4498 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 64, NO. 6, JUNE 2018 not equal or B s arbtrary, determnng the capacty of the network or the achevablty of a rate remans an open problem, e.g., [30] [34]. In a flavor smlar to the reducton descrbed n Secton I.A, we show that an arbtrary multple-uncast network codng nstance I can be reduced to a partcular uncast network error correcton nstance I c that has a very smple setup. Specfcally, the reducton mappng ensures that n I c :a)there s a sngle source node and a sngle termnal node n an acyclc network; b) all lnks have equal capacty; c) there s a sngle error lnk; and d) the error lnk can be any lnk n the network except a gven subset of (well protected) lnks. The setup of I c s smple n the sense that setup a) s the smplest connecton requrement, b) s the smplest assumpton on lnk capactes and c) gves the smallest number of error lnks. Indeed, f the error lnk can be any one lnk n the network (namely f B s unform), then under the setup of a) - c) the capacty of the network s characterzed by the cut-set bounds and s acheved by lnear codes [24]. In ths sense, our reducton suggests that the addton of setup d), whch wll result n a non-unform B, s crtcal; as a network error correcton problem s smple and well understood under settng a) - c), but under settng a) - d) we show that t s as hard as the long standng open problem of multple-uncast network codng. Our reducton addresses the problem of determnng the achevablty of a rate/rate tuple. Namely we show, usng our reducton, that one can determne the achevablty of a rate tuple n I by determnng the achevablty of a correspondng rate n I c. However, rather nterestngly, the same reducton (.e., the same mappng) does not address the problem of determnng whether a rate/rate tuple s n the capacty regon. Specfcally, we show that there exsts a multple-uncast network codng nstance I and a rate tuple, such that the rate tuple s not n the capacty regon of I, and that after usng our reducton mappng, the correspondng rate s n the capacty regon of the correspondng uncast network error correcton nstance I c. The fact that our reducton works when consderng (exact) achevablty and does not work when consderng capacty, mples that n general the capacty of a uncast network error correcton nstance s not (exactly) achevable, whch s a result of separate nterest. Smlar to the prevous dscusson, our reducton has an operatonal aspect that from a code for I c one can construct a code for I. Indeed, usng our reducton, to solve an nstance of the multple-uncast network codng problem, one may frst reduce t to an nstance of the uncast network error correcton problem, then solve the latter, and fnally use ths soluton to obtan a soluton to the orgnal problem. We conclude, speakng loosely, that uncast network error correcton under the smple settng descrbed above s at least as hard as multple-uncast network codng. Our formal results are gven n Theorems 3, 4 and 5 of Secton V. C. Equvalence va Reverse Reducton The above constructons reduce nstances of the multpleuncast network codng problem to nstances of the uncast secure network codng or the uncast network error correcton problem. A natural and ntrgung queston s whether these problems are equvalent, namely, whether t s possble to construct the reverse reductons. Usng the technque of A-enhanced networks [35], we show that an arbtrary uncast secure network codng nstance n whch at most one lnk s eavesdropped (.e., A ncludes only sngleton sets) can be reduced to a multple-uncast network codng nstance, thus mplyng an equvalence between the two problems. For more complcated A whether a reverse reducton exsts or not remans an open problem. Smlarly, the exstence of a reverse reducton from uncast network error correcton to multpleuncast network codng remans open. The paper s organzed as follows. In Secton II we ntroduce the models and defntons. Secton III reduces multpleuncast network codng to uncast secure network codng. The reverse reducton s dscussed n Secton IV. In Secton V we reduce multple-uncast network codng to uncast network error correcton. Secton VI concludes the paper. II. MODELS AND DEFINITIONS A. Multple-Uncast Network Codng A network s a drected acyclc graph G = (V, E), where vertces represent network nodes and edges represent lnks. Each edge e E has a capacty c e, whch s the number of bts that can be transmtted on e n one transmsson. An nstance I = (G, S, T, B) of the multple-uncast network codng problem, ncludes a network G, a set of source nodes S V, a set of termnal nodes T V and an S by T connecton requrement matrx B. The(, j)-th entry of B equals 1 f termnal j requres the nformaton from source and equals 0 otherwse. B s assumed to be a permutaton matrx so that each source s pared wth a sngle termnal. Denote by s(t) the source requred by termnal t. Denote [n] {1,.., n}. Each source s S s assocated wth an ndependent message, represented by a random varable M s unformly dstrbuted over [2 nr s ].Anetwork code of length n s a set of encodng functons φ e for every e E and a set of decodng functons φ t for each t T. For each e = (u,v), the encodng functon φ e s a functon takng as nput the sgnals receved from the ncomng edges of node u, aswell as the random varable M u f u S. φ e evaluates to a value n {0, 1} nc e, whch s the sgnal transmtted on e. For each t T, the decodng functon φ t maps the tuple of sgnals receved from the ncomng edges of t, toanestmatedmessage ˆM s(t) wth values n [2 nr s(t)]. A network code {φ e,φ t } e E,t T s sad to satsfy atermnal t under transmsson (m s, s S) f ˆM s(t) = m s(t) when (M s, s S) = (m s, s S), namely, termnal t decodes correctly when the message tuple takes the specfc value (m s, s S). A network code s sad to satsfy the multpleuncast network codng problem I wth error probablty ɛ f the probablty that all t T are smultaneously satsfed s at least 1 ɛ. The probablty s taken over the jont dstrbuton on (M s, s S). Formally, the network code satsfes I wth error probablty ɛ f { } Pr t s satsfed under (M s, s S) 1 ɛ. (M s,s S) t T

4 HUANG et al.: SINGLE-UNICAST SECURE NETWORK CODING AND NETWORK ERROR CORRECTION 4499 For an nstance I of the multple-uncast network codng problem, the rate tuple (R s, s S) s sad to be achevable f for any ɛ>0, there exsts a network code that satsfes I wth error probablty at most ɛ. (R s, s S) s sad to be achevable wth zero error f there exsts a network code that satsfes I wth zero error probablty. (R s, s S) s sad to be asymptotcally achevable f for any δ>0, rate tuple ((1 δ)r s, s S) s achevable. Loosely speakng, under our defnton, zeroerror achevablty does not allow any slackness n nether the probablty of error nor rate; achevablty allows slackness n the probablty of error but not n rate; and asymptotc achevablty allows slackness n both the probablty of error and rate. We remark that asymptotc achevablty s the most commonly used defnton n the lteratures. However, n addton to asymptotc achevablty, extra efforts wll be placed on exact achevablty wth vanshng error n Secton V because nterestngly, the reducton theren allows slackness n the probablty of error but does not allow slackness n rate. Wthout loss of generalty, n the remanng part of the paper we assume that all entres n the rate tuple are unt,.e., R s = 1, s S, because a varyng rate source s can be modeled by multple unt rate sources co-located at s. We say that unt rate s achevable, achevable wth zero error, or asymptotcally achevable f R s = 1, s S and (R s, s S) s achevable, achevable wth zero error, or asymptotcally achevable, respectvely. B. Uncast Secure Network Codng An nstance I s = (G, s, t, A) of the uncast secure network codng problem ncludes a network G, a source node s, a termnal node t and a collecton of subsets of lnks A 2 E susceptble to eavesdroppng. Each node V generates an ndependent random varable K. 1 The source node holds a rate-r s secret message M unformly dstrbuted over [2 nr s ]. A (secure) network code of length n s a set of encodng functons φ e for every e E and a decodng functon φ t.for each e = (u,v), the encodng functon φ e s a functon takng as nput the locally generated randomness K u, the sgnals receved from the ncomng edges of node u, and the message M f u = s. φ e evaluates to a value n {0, 1} nc e, whch s the sgnal transmtted on e. The decodng functon φ t maps the tuple of sgnals receved from the ncomng edges of t, toan estmated message ˆM wth values n [2 nr s ]. A secure network code {φ e,φ t } e E s sad to satsfy nstance I s wth error probablty ɛ f the probablty that M = ˆM s at least 1 ɛ, where the probablty s taken over the dstrbuton on M and K, V. For any edge e E, denote by X (e) the sgnal transmtted on e durng the -th channel use. For a subset of edges A, denote by X n (A) = (X (e) : 1 n, e A). The network code s sad to satsfy the perfect securty requrement f for all A A, I (M; X n (A)) = 0; the strong securty requrement f for all A A, 1 We remark that n the secure network codng problem, allowng non-source nodes to generate randomness can sgnfcantly ncrease the capacty [21], [23] and therefore s preferable. In contrast, for smplcty n the multple-uncast problem and the network error correcton problem we do not assume that non-source nodes can generate randomness. I (M; X n (A)) 0asn ; and the weak securty I (M;X requrement f A A, n (A)) n 0asn. For a uncast secure network codng problem I s,rater s s sad to be achevable wth perfect, strong, or weak securty f for any ɛ > 0, there exst network codes that satsfy I s wth error probablty at most ɛ and the correspondng securty requrement. Rate R s s sad to be achevable wth zero error and wth perfect, strong, or weak securty f there exsts network codes that satsfy I s wth zero error probablty and the correspondng securty requrement. Rate R s s sad to be asymptotcally achevable wth perfect, strong, or weak securty f for any δ>0, rate (1 δ)r s s achevable wth the correspondng securty requrement. The capacty of I s under perfect, strong, or weak securty s the supremum over all rates that are asymptotcally achevable wth the correspondng securty requrement. C. Uncast Network Error Correcton An nstance I c = (G, s, t, B) of the uncast network error correcton problem ncludes a network G, a source node s, a termnal node t and a collecton of subsets of lnks B 2 E susceptble to errors. An error occurs n a lnk f the output of the lnk s dfferent from the nput. More precsely, the output of a lnk e s the addton of the nput sgnal and an error sgnal r e {0, 1} nc e, and an error occurs n lnk e f and only f r e s not the zero vector. 2 For a subset B of lnks, a B-error s sad to occur f errors occur n every lnk n B. The source node holds a rate-r c message M unformly dstrbuted over [2 nr c ], and the decoder of the termnal outputs an estmated message ˆM. Let r = (r e ) e E be the tuple of error sgnals, called an error pattern. Denote by R B the set of all possble error patterns,.e., R B = {r : non-zero entres n r correspond to B-errors, B B}. A network code {φ e,φ t } e E, defned smlarly as n Secton II-A, s sad to satsfy I c under transmsson m f ˆM = m when M = m, regardless of the occurrence of any error pattern r R B. A network code s sad to satsfy problem I c wth error probablty ɛ f the probablty that I c s satsfed s at least 1 ɛ. The probablty s taken over the dstrbuton on the source message M. Note that our model targets the worst-case (or adversaral) scenaro, namely the probablty of error s upper bounded by ɛ even n the occurrence of the worst case error pattern. For a uncast network error correcton problem I c, rate R c s sad to be achevable f for any ɛ > 0, there exsts a network code that satsfes I c wth error probablty at most ɛ. RateR c s sad to be achevable wth zero error f there exsts a network code that satsfes I c wth zero error probablty. Rate R c s sad to be asymptotcally achevable f for any δ>0, rate (1 δ)r c s achevable. The capacty of I c s the supremum over all rates that are asymptotcally achevable. 2 Note that our model and results can be generalzed naturally to arbtrary alphabets n whch addton may not be defned, as long as we make the conventon that r e = 0 f and only f the output of e s dentcal to the nput.

5 4500 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 64, NO. 6, JUNE 2018 Fg. 1. In the uncast secure network codng problem I s, the source s communcates wth the termnal t. N s the network on whch I s defned. All lnks outsde N (.e., lnks for whch at least one end-pont does not belong to N ) have unt capacty. The eavesdropper can wretap on any sngle lnk n the network. Namely, A ncludes all sets of a sngle edge. Note that there are k parallel branches n total gong from s to t but only the frst and the k-th branches are drawn explctly. Fg. 2. A scheme of length n that asymptotcally acheves rate k n I s.fxanyɛ>0, for node u, letv u be a length-(1 ɛ)n random vector generated by node u. TheV u s are ndependently generated and are unformly dstrbuted over {0, 1} (1 ɛ)n. The source message s a k-tuple of..d. unformly dstrbuted length-(1 ɛ)n vectors,.e., M = (M, = 1,...,k), wherethem s are..d. unformly dstrbuted over {0, 1} (1 ɛ)n. Snce unt rate s asymptotcally achevable n I, node t obtans ˆV B such that ˆV B = V B wth hgh probablty. ˆV B s then transmtted to node C for key cancellaton. III. REDUCING MULTIPLE-UNICAST TO SECURE UNICAST Recall from Secton II-A that n a multple-uncast problem, unt rate s asymptotcally achevable f R s = 1, s S and rate tuple (R s, s S) s asymptotcally achevable. The followng theorem reduces the problem of determnng the asymptotcal achevablty of unt rate n a general multple-uncast network codng nstance to the problem of determnng the asymptotcal achevablty of a rate n a partcular uncast secure network codng nstance that has a very smple setup. We remark that although the theorem addresses the achevablty of unt rate nstead of a general rate tuple n the multple-uncast network codng problem, ths s wthout loss of generalty, because the problem of determnng the achevablty of an arbtrary rate tuple wth ratonal entres n a multple-uncast problem can be converted to the problem of determnng the achevablty of unt rate n a correspondng multple-uncast problem, by modelng a varyng rate source s as multple unt rate sources co-located at s. Theorem 1: Gven any multple-uncast network codng problem I wth source-destnaton pars {(s, t ), = 1,...,k}, a correspondng uncast secure network codng problem I s = (G, s, t, A), n whch A ncludes all sets of a sngle edge (.e., all sngletons), can be constructed accordng to Constructon 1, such that unt rate s asymptotcally achevable n I f and only f rate k s asymptotcally achevable n I s under ether perfect, strong, or weak securty. Constructon 1: Gven any multple-uncast network codng problem I on a network N wth source-destnaton pars {(s, t ), = 1,...,k}, a uncast secure network codng problem I s s constructed as specfed n Fgure 1. Proof (of Theorem 1):. In ths drecton, we show that the asymptotc achevablty of unt rate n I mples the asymptotc achevablty of rate k n I s under perfect secrecy, whch n turn mples the asymptotc achevablty of rate k n I s under strong and weak secrecy. The scheme asymptotcally achevng rate k s descrbed n Fgure 2. Specfcally, the rate of the scheme s (1 ɛ)k f rate 1 ɛ s achevable n I. Letɛ = Pr{ ˆV B = V B },then the probablty of error n I s s upper bounded by k =1 ɛ, whch can be made arbtrarly small by choosng the ɛ s to be small enough. Note that the scheme acheves perfect securty, snce lnks n N are not downstream of s (and therefore the sgnals transmtted on them are ndependent of the message), and all other lnks are one-tme padded by unformly chosen keys.. To prove ths drecton t suffces to show that asymptotc achevablty of rate k n I s under weak securty mples asymptotc achevablty of unt rate n I, because asymptotc achevablty of rate k n I s under perfect or strong securty

6 HUANG et al.: SINGLE-UNICAST SECURE NETWORK CODING AND NETWORK ERROR CORRECTION 4501 mples asymptotc achevablty of the same rate under weak securty. Suppose n I s rate k s asymptotcally acheved by a code wth length n. Let M be the source nput message, then H (M) = kn. We use the notaton of Fgure 1. Our objectve s lower bound the mutual nformaton between sgnals b n and d n,for = 1,...,k. Wthout loss of generalty our analyss wll focus on the case of = 1. We start wth, H (M c1 n, dn 1, f 2 n,..., f k n ) (a) = H (M, c1 n dn 1, f 2 n,..., f k n ) H (cn 1 dn 1, f 2 n,..., f k n ) H (M d1 n, f 2 n,..., f k n ) H (cn 1 dn 1, f 2 n,..., f k n ) (b) kn H (c1 n dn 1, f 2 n,..., f k n ) kn n = (k 1)n, (1) where (a) follows from the chan rule, and (b) follows from our constructon whch guarantees ndependence between M and {d1 n, f n, = 1,...,k}. On the other hand, H (M c1 n, dn 1, f 2 n,..., f k n ) H (M, e2 n,...,en k cn 1, dn 1, f 2 n,..., f k n ) H (M c1 n, dn 1, f 2 n,..., f k n, en 2,...,en k ) +H (e2 n,...,en k cn 1, dn 1, f 2 n,..., f k n ) (c) nɛ n + H (e2 n,...,en k cn 1, dn 1, f 2 n,..., f k n ) nɛ n + (k 1)n, (2) where ɛ n 0 as n and (c) s due to the cutset {c1 n, dn 1, f 2 n,..., f k n, en 2,...,en k } from s to t and Fano s nequalty. We lower bound the entropy of c1 n, H (c1 n ) H (cn 1 dn 1, f 2 n,..., f k n ) = H (M, c1 n dn 1, f 2 n,..., f k n ) H (M c1 n, dn 1, f 2 n,..., f k n ) H (M d1 n, f 2 n,..., f k n ) H (M cn 1, dn 1, f 2 n,..., f k n ) = H (M) H (M c1 n, dn 1, f 2 n,..., f k n ) (d) kn ((k 1)n + nɛ n ) = n nɛ n, (3) where (d) follows from (2). We next lower bound the entropy of d1 n, H (d1 n ) H (dn 1 cn 1, f 2 n,..., f k n ) = H (M, d1 n cn 1, f 2 n,..., f k n ) H (M c1 n, dn 1, f 2 n,..., f k n ) H (M c1 n, f 2 n,..., f k n ) H (M cn 1, dn 1, f 2 n,..., f k n ) (e) = H (M c n 1 ) H (M cn 1, dn 1, f n 2,..., f n k ) ( f ) kn nδ n H (M c n 1, dn 1, f n 2,..., f n k ) (g) n nɛ n nδ n, (4) where δ n 0asn 0, (e) follows from the ndependence between {M, c1 n} and { f n, = 1,...,k}, (f) follows from the weak securty requrement, and (g) follows from (2). By the ndependence between {M, c1 n, dn 1 } and { f n, = 1,...,k} we have H (M c1 n, dn 1, f 2 n,..., f k n ) = H (M cn 1, dn 1 ). (5) By (1) and (2), the R.H.S of (5) s sandwched by (k 1)n H (M c n 1, dn 1 ) nɛ n + (k 1)n. (6) Now consder the jont entropy of M, c1 n, dn 1 and expand t n two ways H (M, c1 n, dn 1 ) = H (cn 1 M, dn 1 ) + H (M dn 1 ) + H (dn 1 ) = H (M c1 n, dn 1 ) + H (dn 1 cn 1 ) + H (cn 1 ) (k + 1)n + nɛ n, where the last nequalty holds because of (6) and H (d1 n cn 1 ) n, H (c1 n ) n. Therefore H (c1 n M, dn 1 ) = H (M, cn 1, dn 1 ) H (M dn 1 ) H (dn 1 ) = H (M c1 n, dn 1 ) + H (dn 1 cn 1 ) + H (cn 1 ) H (M d1 n ) H (dn 1 ) (h) (k + 1)n + nɛ n H (M d n 1 ) H (dn 1 ) () = (k + 1)n + nɛ n kn H (d n 1 ) ( j) 2nɛ n + nδ n, (7) where (h) follows from (6) and H (d1 n cn 1 ) n, H (cn 1 ) n; () follows from the ndependence between M and d1 n ; (j) follows from (4). Now we have, H (b1 n M, cn 1 ) = H (M, b1 n, cn 1 ) H (M cn 1 ) H (cn 1 ) = H (c1 n M, bn 1 ) + H (M bn 1 ) + H (bn 1 ) H (M cn 1 ) H (cn 1 ) (k + 1)n + H (c1 n M, bn 1 ) H (M cn 1 ) H (cn 1 ) (k) = (k + 1)n + H (c1 n M, bn 1, dn 1 ) H (M cn 1 ) H (cn 1 ) (k + 1)n + H (c1 n M, dn 1 ) H (M cn 1 ) H (cn 1 ) (l) (k + 1)n + 2nɛ n + nδ n H (M c n 1 ) H (cn 1 ) (m) n + 2nɛ n + 2nδ n H (c n 1 ) (n) 3nɛ n + 2nδ n, (8) where (k) follows from constructon,.e., H (c1 n M, bn 1 ) = H (c1 n M, bn 1, dn 1 ); (l) follows from (7); (m) follows from the weak securty requrement; (n) follows from (3). Therefore, H (b1 n dn 1 ) (o) = H (b1 n M, dn 1 ) H (b1 n, cn 1 M, dn 1 ) = H (b1 n cn 1, M, dn 1 ) + H (cn 1 M, dn 1 ) H (b1 n cn 1, M) + H (cn 1 M, dn 1 ) (p) 3nɛ n + 2nδ n + 2nɛ n + nδ n = 5nɛ n + 3nδ n, (9) where (o) follows as M s ndependent of {b1 n, dn 1 }, and (p) follows from (8) and (7). (9) suggests that the sgnals b1 n and dn 1 are strongly dependent. Next we need to lower

7 4502 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 64, NO. 6, JUNE 2018 bound H (b n 1 ). H (b1 n ) = H (M, bn 1, cn 1 ) H (cn 1 M, bn 1 ) H (M bn 1 ) = H (b1 n M, cn 1 ) + H (M cn 1 ) + H (cn 1 ) H (c1 n M, bn 1 ) H (M bn 1 ) H (M c1 n ) + H (cn 1 ) H (cn 1 M, bn 1 ) H (M bn 1 ) (q) kn nδ n + H (c n 1 ) H (cn 1 M, bn 1 ) H (M bn 1 ) (r) (k + 1)n nɛ n nδ n H (c n 1 M, bn 1 ) H (M bn 1 ) (s) n nɛ n 2nδ n H (c n 1 M, bn 1 ) (t) = n nɛ n 2nδ n H (c1 n M, bn 1, dn 1 ) n nɛ n 2nδ n H (c1 n M, dn 1 ) (u) n 3nɛ n 3nδ n, (10) where (q) follows from the weak securty requrement; (r) follows from (3); (s) follows agan from the weak securty; (t) follows from constructon; (u) follows from (7). Fnally, by (9) and (10), I (b n 1 ; dn 1 ) = H (bn 1 ) H (bn 1 dn 1 ) n 8nɛ n 6nδ n, The above argument extends to all other paths naturally (by renumberng the notaton accordngly), so I (b n ; dn ) n 8nɛ n 6nδ n, = 1,...,k. (11) Lemma 1, stated below and proved n the Appendx, shows that (11) mples the asymptotc achevablty of unt rate n I, whch completes the proof of ths drecton. Intutvely, snce the mutual nformaton between b n and d n s asymptotcally n, we can use a random codng argument smlar to that used n the proof of the channel codng theorem to show the exstence of a network code achevng unt rate asymptotcally n I. The reason that we do not use the standard pont-to-pont channel codng theorem s that there are multple nteractng sourcetermnal pars n I and we need to make sure the exstence of a code that s good for all pars. Lemma 1: For any ɛ>0, f there exsts a network code of length n for I s such that I (b n; dn )>n(1 ɛ), then unt rate s asymptotcally achevable n I. Ths completes the proof. Theorem 1 can be easly adapted to the case of zero-error communcaton. Corollary 1: Gven any multple-uncast network codng problem I wth source-destnaton pars {(s, t ), = 1,...,k}, a correspondng uncast secure network codng problem I s = (G, s, t, A), nwhcha ncludes all sets of a sngle edge (.e., all sngletons), can be constructed accordng to Constructon 1, such that unt rate s achevable wth zero error n I f and only f rate k s achevable wth zero error n I s under perfect securty. The proof of Corollary 1 follows the same lne as the proof of Theorem 1, wth the dfference that all ɛ and δ become strctly 0. For example, (9) mples that b1 n s a functon of dn 1, and hence that t can be perfectly decoded from d1 n. We remark that our reducton has an operatonal aspect that from a code for I s one can construct a code for I. Indeed, usng our reducton, to solve a multple-uncast network codng problem, one may frst reduce t to a uncast secure network codng problem, then solve the latter, and fnally use ths soluton to obtan a soluton to the orgnal multple-uncast problem. Chan and Grant [18] prevously show that determnng the zero-error achevablty of a rate n a multcast secure network codng problem wth general setup (.e., arbtrary edge capactes, arbtrary A, and arbtrary nodes may generate randomness) and wth perfect securty s at least as hard as determnng the zero-error achevablty of a rate tuple n multple-multcast network codng. The result n ths secton sgnfcantly strengthens the result n [18] by showng that the secure network codng problem under a much smpler setup (.e., uncast, equal lnk capactes, unform A wth a sngle wretap lnk) s stll hard, under varous defntons of achevablty and securty. IV. REDUCING SECURE UNICAST TO MULTIPLE-UNICAST In the prevous secton we have reduced an arbtrary multple-uncast network codng problem nto a partcular uncast secure network codng problem wth a very smple setup, n whch at most one lnk can be eavesdropped. Conversely, gven an arbtrary uncast secure network codng problem where at most one lnk can be eavesdropped, we can reduce t nto a partcular multple-multcast network codng problem wthout securty requrements (whch can n turn be reduced nto an equvalent multple-uncast network codng problem [9]). A more general constructon was frst proposed n [35] for the purpose of lower boundng the capacty of a secure network codng nstance by studyng a correspondng multple-multcast network codng nstance. In ths paper we smplfy the constructon to address the specal case that at most one lnk can be eavesdropped,.e., A comprses only sngletons. Loosely speakng, we show that for ths specal case the multple-multcast network codng nstances not only lower bound but also upper bound the capacty of the secure network codng nstances, hence gvng a reducton. Constructon 2: Gven a uncast secure network codng problem I s on a drected graph G = (V, E) wth source s, termnal t, and a collecton of wretap sets A comprsng only sngletons. We construct a correspondng multple-multcast network codng problem I on an augmented graph Ǧ = ( ˇV, E). ˇ We defne Ě and ˇV from E and V. InE, denote by c e the capacty of lnk e, and by E out () the set of outgong edges of node. 1) For V, add to ˇV. Fore E such that {e} / A (n the remanng part of ths subsecton we wll wrte e / A or e A nstead, because the elements of A are sngletons), add e to Ě. 2) For e = (, j) E such that e A, create nodes u e, v e n ˇV; create edges (, u e ), (u e, j) and (u e,v e ) n Ě, all of capacty c e. 3) Create a key aggregaton node v T n ˇV. For each node V, create a key source node v n ˇV. Create two lnks ( v,v T ) and ( v, ) n Ě, both of

8 HUANG et al.: SINGLE-UNICAST SECURE NETWORK CODING AND NETWORK ERROR CORRECTION 4503 Fg. 3. An example of Constructon 2. (a) A uncast secure network codng nstance I s where s s the source, t s the termnal and A ={{e 1 }, {e 2 }}. (b) The multple-multcast network codng nstance I obtaned from I s accordng to Constructon 2. In ths problem, t demands the message orgnated from v s ; v e1 and v e2 demand the messages orgnated from v s, v s, v A, v B and v t. capacty č = e E out () 4) Create a vrtual source node v s n ˇV. For all e A, create lnks (v s, s) and (v s,v e ) n Ě, both of capacty out (s) c e. 5) For all e A, create a lnk (v T,v e ) n Ě of capacty c e c e. In I, nodes v s and v, V are assocated wth ndependent messages. Node t demands the message of v s. For all e A, node v e demands the messages of v s and all v. Note that n I there s no securty requrement. Refer to Fgure 3 for an example of Constructon 2. Denote for short č V = (č, V). Consder any uncast secure network codng nstance I s = (G, s, t, A) such that A comprses only sngletons. Let I be the multple-multcast network codng nstance obtaned from I s accordng to Constructon 2. The next theorem reveals a connecton between I s and I. Theorem 2: Rate R s asymptotcally achevable n I s subject to the weak or strong securty requrement f and only f c e. rate tuple (R, č V ) s asymptotcally achevable n I, wherer s the rate of the message of v s, and č V s the rate tuple of messages of v, V. Proof: We frst note that by [20], the capacty regon of I s subject to the weak securty requrement s the same as the capacty regon subject to the strong securty requrement. Therefore, a rate s asymptotcally achevable n I s subject to weak securty f and only f t s asymptotcally achevable subject to strong securty. In the proof we assume that weak securty s mposed n I s, and the case of strong securty follows drectly from the equvalence.. Assumng that rate tuple (R, č V ) s asymptotcally achevable n I, t s proved n [35] that rate R s asymptotcally achevable n I s under the weak securty requrement. Here we gve a smplfed proof of ths fact for completeness. By hypothess, for any ɛ > 0 and δ>0, there exsts a network code φ of length n that acheves rate tuple (R, č V ) ɛ n I wth error probablty δ. In problem I s, we smulate the network code φ. Specfcally, the message orgnally assocated wth v s s replaced by the secret source message, and the messages orgnally assocated wth v, V are replaced by the ndependent random keys generated at node. Let every edge e = (, j) n E smulate the encodng functon of edge e Ě f e / A or the encodng functon of (, u e ) n Ě f e A; then the termnal t, by smulatng the decodng functon, can

9 4504 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 64, NO. 6, JUNE 2018 decode the source message wth error probablty δ. Therefore decodablty s not a problem. It remans to show that smulatng the code φ meets the weak securty requrement. For an edge ě Ě, letxě be the sgnal transmtted on ě nduced by φ. We denote by M the message assocated wth v s, and by K the message assocated wth v.theforanye A, the nequalty n (12), as shown at the bottom of the next page follows, where (a) follows from expandng I (M; X (vs,v e ) X (ue,v e )) n two ways; (b) follows from the constructon that X (vs,v e ) s a functon of M; (c) follows form the chan rule; (d) follows from the fact that H (X (ue,v e )) nc (ue,v e ) = nc e and H (X (vt,v e ) X (ue,v e ), X (vs,v e )) nc (vt,v e ) = n c e nc e; (e) follows from the chan rule; (f) follows from H (M, K V ) nr + n c e nɛ, whereɛ s the sum of the entres of ɛ; and (g) follows from Fano s nequalty, where δ 0 as δ 0. (12) mples that I (M; X (ue,v e )) n(ɛ + δ ). And because X (ue,v e ) can be vewed as the observaton of an adversary eavesdroppng on edge e, the weak securty requrement s met.. Assumng that rate R s asymptotcally achevable n I s under the weak securty requrement, we show that rate tuple (R, č A ) s asymptotcally achevable n I. Fore E, denote by X e the sgnal transmtted on edge e. By hypothess, for arbtrary ɛ R > 0, ɛ S > 0andδ>0, there exsts a network code φ wth length n that acheves rate R ɛ R weakly securely n I s wth error probablty δ, such that I (M; X e ) nɛ S,for all e A. For arbtrary ɛ E > 0, wthout loss of generalty we assume that H (X e ) n(c e ɛ E ),foralle E. Thss because f H (X e )<nc e,.e.,fx e s not almost unform, then we can repeat φ for m tmes and perform a source code of length m (over the supersymbol alphabet {0, 1} n ) on edge e to compress X e by encodng only the typcal sequences [11, Sec. 3.2], and use the spare capacty of the edge to transmt random bts. Meanwhle, source s and termnal t perform an outer channel code of length m (also over alphabet {0, 1} n ) to keep the error probablty small. For suffcently large m, the overall concatenated code asymptotcally acheves the same rate weakly securely as φ does, and such that H (X e )/mn, as desred, s arbtrarly close to c e due to the asymptotc equpartton property. Note that n general a node V wll generate an ndependent random varable K as nput to the encodng functons. The rate of K s upper bounded by č,whchs the sum capactes of all outgong edges of. We now turn to the problem I. We construct a network code φ of a slghtly longer length n = (1 + ɛ L )n. Inthefrst n channel uses, φ smulates the operaton of φ. Specfcally, node v s generates a random varable M unformly dstrbuted over [2 n(r ɛr) ], and transmt t to s va edge (v s, s). For V, node v generates a random varable K unformly dstrbuted over [2 nč ], and transmt t to va edge ( v, ). The rate of M 1 (over code length n )s 1+ɛ L (R ɛ R ) and the rate of K s 1 1+ɛ L č.theratesofm and K V can be made arbtrarly close to R and č V by choosng suffcently small ɛ R and ɛ L. To smulate φ, φ performs the same encodng functon on edge e E (f e remans n Ě) asφ dd n I s. Otherwse f e s replaced by (, u e ) and (u e, j), thenφ performs the same encodng functon on (, u e ) Ě as φ dd on edge e E. The nduced sgnal X (,ue ) s then relayed to edge (u e, j) and (u e,v e ).Intheextraɛ L channel uses, these edges (from E) keep slent (or smply transmt dummy zeros). At termnal node t, by smulatng the decodng functon, t s able to decode M correctly wth probablty of error δ. We next show that (K, V) and M can be decoded at v e, for all e A. Note that v e has three ncomng edges,.e., (u e,v e ), (v s,v e ) and (v T,v e ). The sgnal X (ue,v e ) transmtted on (u e,v e ), as descrbed n the prevous paragraph, s the same as the sgnal X e on edge e n the secure network codng problem I s. Let edge (v s,v e ) transmt M. Now consder a dstrbuted source codng problem wth three correlated sources (K, V), X e and M. Note the X e and M are avalable at v e by constructon, and the queston s that whether v e can decode K V from X e, M and the sgnal receved from edge (v T,v e ). It follows that, H (K V X e, M) = H (X e, K V M) H (X e M) = H (X e K V, M) + H (K V M) H (X e M) (a) = H (K V M) H (X e M) (b) = H (K V ) H (X e M) n c e H (X e M) = n c e (H (X e ) I (M; X e )) (c) n( c e c e ) + n(ɛ S + ɛ E ) (d) < n( c e c e ) + nɛ L ( c e c e ) = n ( c e c e ), (13) where (a) follows because X e s a functon of K V and M; (b) follows from the fact that K V s ndependent of M; (c) follows from the weak securty requrement and that H (X e ) n(c e ɛ E ); and (d) follows by choosng a suffcently small ɛ S and ɛ E such that ɛ S + ɛ E <ɛ L ( c e c e), forall e A. Note that c e c e s the capacty of edge (v T,v e ), and so by (13) and the Slepan-Wolf Theorem of dstrbuted source codng, the rate tuple of the correlated sources are n the achevable regon. Therefore by concatenatng a (outer) Slepan-Wolf code wth the (nner) network code φ,foralle A, v e s able to decode (M, K V ) wth vanshng probablty of error. Ths completes the proof. V. REDUCING MULTIPLE-UNICAST TO UNICAST NETWORK ERROR CORRECTION In ths secton we reduce nstances of the multple-uncast network codng problem to nstances of the uncast network error correcton problem. We start wth the zero-error case. A. Zero-Error Achevablty The followng theorem reduces the problem of determnng the zero-error achevablty of a rate n a general multpleuncast network codng nstance to the problem of determnng

10 HUANG et al.: SINGLE-UNICAST SECURE NETWORK CODING AND NETWORK ERROR CORRECTION 4505 Fg. 4. In the uncast network error correcton problem I c, s s the source and t s the termnal. N s the network on whch I s defned. All edges outsde N (.e., edges for whch at least one of ts end-pont does not belong to N )have unt capacty. There s at most one error n ths network, and ths error can occur at any edge except {a, b, 1 k}. Namely, B ncludes all sngleton sets of a sngle edge n the network except {a } and {b }, = 1,...,k (the thckened edges). Note that there are k parallel branches n total gong from s to t but only the frst and the k-th branches are drawn explctly. the zero-error achevablty of a rate n a partcular uncast network error correcton nstance that has a very smple setup. Recall from the remark before Theorem 1 that there s no loss of generalty n addressng the achevablty of a rate nstead of a rate tuple n the multple-uncast network codng problem. Constructon 3: Gven any multple-uncast network codng problem I on a network N wth source-destnaton pars {(s, t ), = 1,...,k}, a uncast network error correcton problem I c s constructed as specfed n Fgure 4. Theorem 3: Gven any multple-uncast network codng problem I wth source-destnaton pars {(s, t ), = 1,...,k}, a correspondng uncast network error correcton Fg. 5. A scheme to acheve zero-error rate k n I c gven that unt rate s achevable wth zero error n I. M = (M 1,...,M k ) and node B performs majorty decodng. problem I c = (G, s, t, B) n whch B ncludes sets wth at most one edge can be constructed accordng to Constructon 3, such that unt rate s achevable wth zero-error n I f and only f rate k s achevable wth zero-error n I c. Proof:. We show that the zero-error achevablty of unt rate n I mples the zero-error achevablty of rate k n I c. A constructve scheme s shown n Fgure 5. In I c, the source lets M = (M 1,...,M k ),wherethem s are..d. unformly dstrbuted over [2 n ].InN, we smulate the network code for I that acheves unt rate wth zero error. Outsde N, let the network code be a (M) = x (M) = y (M) = z (M) = z (M) = M, = 1,...,k. Note that the sgnals on edges x, y and z form a repetton code and node B, by performng majorty decodng, can correct any sngle error to obtan M. Hence the scheme ensures that b (M) = M under all possble error patterns, and so rate k s achevable wth zero error n I c. H (M X (ue,v e )) (a) = H (X (vs,v e ) X (ue,v e )) + H (M X (vs,v e ), X (ue,v e )) H (X (vs,v e ) X (ue,v e ), M) H (X (vs,v e ) X (ue,v e )) H (X (vs,v e ) X (ue,v e ), M) (b) = H (X (vs,v e ) X (ue,v e )) (c) = H (X (vt,v e ), X (ue,v e ), X (vs,v e )) H (X (ue,v e )) H (X (vt,v e ) X (ue,v e ), X (vs,v e )) (d) H (X (vt,v e ), X (ue,v e ), X (vs,v e )) n c e (e) = H (M, K V, X (vt,v e ), X (ue,v e ), X (vs,v e )) H (M, K V X (vt,v e ), X (ue,v e ), X (vs,v e )) n c e H (M, K V ) H (M, K V X (vt,v e ), X (ue,v e ), X (vs,v e )) n ( f ) nr nɛ H (M, K V X (vt,v e ), X (ue,v e ), X (vs,v e )) (g) nr nɛ nδ H (M) n(ɛ + δ ) (12) c e

11 4506 IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 64, NO. 6, JUNE We show that the zero-error achevablty of rate k n I c mples the zero-error achevablty of unt zero-error rate n I. Suppose rate k s acheved wth zero-error n I c by a network code wth length n, and denote the source message by M, whch s unformly dstrbuted over [2 nk ]. Recall from Secton II-C that, r = (r e ) e E s the tuple of addtve error sgnals called an error pattern, and R B the set of all possble error patterns,.e., R B = {r : non-zero entres n r correspond to B-errors, B B}. For any edge e E, we denote by e(m, r) :[2 nk ] R B [2 n ] the sgnal receved on edge e when the source message equals m and the error pattern r occurs n the network. Let b(m, r) = (b 1 (m, r),...,b k (m, r)), then because the edges b 1,...,b k form a cut-set from s to t, b(m, r) must be njectve wth respect to m due to the zero error decodablty constrant. Formally, for two dfferent messages m 1 = m 2, t follows from the zero error decodablty constrant that b(m 1, r 1 ) = b(m 2, r 2 ), r 1, r 2 R B. Note that the codoman of b s [2 n ] k, whch has the same sze as the set of messages [2 nk ]. Therefore denote by b(m) = b(m, 0), then b(m) s a bjectve functon. Ths mples that b(m, r) = b(m), r R B, because otherwse f there exst m 1, r 1 such that b(m 1, r 1 ) = b(m 1 ), then there s a m 2 = m 1 such that b(m 1, r 1 ) = b(m 2 ), volatng the decodablty requrement. Smlarly, let a(m, r) = (a 1 (m, r),...,a k (m, r)) and a(m) = a(m, 0),thena(m) s a bjectve functon and a(m, r) = a(m), r R B. For any e E, denote e(m) = e(m, 0). We make the followng clam: Clam: For = 1,...,k and any two messages m 1, m 2 [2 nk ] such that a (m 1 ) = a (m 2 ), t follows that x (m 1 ) = x (m 2 ), y (m 1 ) = y (m 2 ) and z (m 1 ) = z (m 2 ). To prove the clam, suppose for contradcton that there exst m 1, m 2 such that a (m 1 ) = a (m 2 ) and that the clam s not true,.e., x (m 1 ) = x (m 2 ) or y (m 1 ) = y (m 2 ) or z (m 1 ) = z (m 2 ). Frst consder the case that x (m 1 ) = x (m 2 ). Because of the one-to-one correspondence between m and a, there exsts a message m 3 = m 1 and such that a(m 3 ) = (a 1 (m 1 ),...,a 1 (m 1 ), a (m 2 ), a +1 (m 1 ),...,a k (m 1 )). Then x (m 1 ) = x (m 3 ) because by constructon x (m 3 ) = x (m 2 ), and by hypothess x (m 1 ) = x (m 2 ). Consder the followng two scenaros. In the frst scenaro, m 1 s transmtted, and an error turns y (m 1 ) nto y (m 3 ); n the second scenaro, m 3 s transmtted, and an error turns z (m 3 ) nto z (m 1 ). Then the cut-set sgnals a 1,...,a 1, x, y, z, a +1,...,a k are exactly the same n both scenaros, and so t s mpossble for t to dstngush m 1 from m 3, a contradcton to the zero error decodablty constrant. Therefore x (m 1 ) = x (m 2 ). Wth a smlar argument t follows that y (m 1 ) = y (m 2 ) and z (m 1 ) = z (m 2 ), and the clam s proved. The clam above suggests that (the sgnals on) x, y and z, as functons of (the sgnals on) a, are njectve. They are also surjectve functons because the doman and codoman are both [2 n ]. Hence there are one-to-one correspondences between a, x, y and z. Next we show that for any two messages m 1, m 2, f b (m 1 ) = b (m 2 ), then z (m 1) = z (m 2). Suppose for contradcton that there exsts m 1 = m 2 such that b (m 1 ) = b (m 2 ) and z (m 1) = z (m 2). Thenfm 1 s transmtted and an error r 1 turns x (m 1 ) nto x (m 2 ), the node B wll receve the same sgnals as n the case that m 2 s transmtted and an error r 2 turns y (m 2 ) nto y (m 1 ). Therefore b (m 1, r 1 ) = b (m 2, r 2 ). But, as shown above, because b (m 1, r 1 ) = b (m 1 ) and b (m 2, r 2 ) = b (m 2 ), t follows that b (m 1 ) = b (m 2 ), a contradcton. Ths clam suggests that f z (m 1) = z (m 2) then b (m 1 ) = b (m 2 ) and therefore b s a functon of z.ths functon s surjectve because b takes all 2 n possble values. Then snce the doman and the codoman are both [2 n ], b must be a bjectve functon of z. Wth the same argument t follows that b s also a bjectve functon of x. Hence z s a bjecton of a, a s a bjecton of x, x s a bjecton of b,andb s a bjecton of z. Therefore for all 1 k, z s a bjecton of z, and therefore unt rate s achevable wth zero error n I. B. Achevablty Allowng Vanshng Error In ths subsecton we show that Constructon 3 gves a reducton from multple-uncast network codng to uncast network error correcton not only n terms of zero-error achevablty, but also n terms of achevablty that allows vanshng error. Recall from Secton II that we say a rate s achevable f there exsts a code achevng the rate wth a vanshng error probablty. Theorem 4: Gven any multple-uncast network codng problem I wth source-destnaton pars {(s, t ), = 1,...,k}, a correspondng uncast network error correcton problem I c = (G, s, t, B) n whch B ncludes sets wth at most a sngle edge can be constructed accordng to Constructon 3, such that unt rate s achevable n I f and only f rate k s achevable n I c. We frst prove the forward drecton of the theorem, whch s smple and s smlar to the proof of the zero-error case. Proof: [Proof ( part of Theorem 4)] We show that f unt rate s achevable n I, thenratek s achevable n I c.agan we use the constructve scheme n Fgure 5. In I c, the source lets M = (M 1,...,M k ),wherethem s are..d. unformly dstrbuted over [2 n ].InN, we smulate the network code for I that acheves unt rate. Outsde N, let the network code be a (M) = x (M) = y (M) = z (M) = M, = 1,...,k. Consder the M s as the source messages of the smulated I, and denote by ˆM, = 1,...,k the outputs of the decoders of I. Letz (M) = ˆM, = 1,...,k, and let node B, = 1,...,k performs majorty decodng. The termnal t wll not decode an error as long as the multple-uncast nstance I does not commt an error,.e., ˆM = M. The error probablty of I s neglgble, whch mples the achevablty of rate k n I c. In the remander of ths subsecton we prove the other drecton of Theorem 4,.e., that the achevablty of rate k n I c mples the achevablty of unt rate n I. The man dea of the proof s as follows. In I the network wll smulate the gven network code for I c, and by dong so the termnal t wll obtan the sgnal on z n I c. The man task therefore s to estmate the sgnal on z, whch