Secure Index Coding: Existence and Construction

Transcription

1 Secure Index Codng: Exstence and Constructon Lawrence Ong 1, Badr N. Vellamb 2, Phee Lep Yeoh 3, Jörg Klewer 2, and Jnhong Yuan 4 1 The Unversty of Newcastle, Australa; 2 New Jersey Insttute of Technology, USA; 3 Unversty of Melbourne, Australa; 4 Unversty of New South Wales, Australa arxv: v2 [cs.it] 31 May 2016 Abstract We nvestgate the constructon of weakly-secure ndex codes for a sender to send messages to multple recevers wth sde nformaton n the presence of an eavesdropper. We derve a suffcent and necessary condton for the exstence of ndex codes that are secure aganst an eavesdropper wth access to any subset of messages of cardnalty t, for any fxed t. In contrast to the benefts of usng random keys n secure network codng, we prove that random keys do not promote securty n three classes of ndex-codng nstances. I. INTRODUCTION In classcal 1 ndex-codng problems, a sender sends multple messages to multple recevers through a common noseless broadcast medum, where each recever has a pror knowledge of a subset of messages [1] [5]. The subsets that each recever wants and knows can vary wth the recever. In ths work, we consder secure ndex codng, where n addton to the classcal setup, there s an eavesdropper who has access to a subset of messages from a collecton of subsets of messages. The sender and the recevers know a pror the collecton of message subsets, however, they do not know whch subset of messages n ths collecton s actually accessed by the eavesdropper. A weakly-secure ndex code must satsfy all recevers decodng requrements, whle ensurng that the eavesdropper s not able to decode any message t has no access to. A. Contrbutons of ths paper and related work The contrbutons of ths work are three-fold: 1) Exstence of secure ndex codes: Secure ndex codng was frst studed by Dau, Skachek, and Chee [6]. The authors derved condtons that any gven lnear code (of a gven message alphabet sze) must satsfy to smultaneously meet the recevers decodng requrements as well as be secure aganst an eavesdropper wth access to a message subset. In contrast to the code-centrc results by Dau et al., we obtan problem-centrc results. We derve a suffcent and necessary condton for the exstence of both lnear and nonlnear weakly-secure ndex codes over all fnte-feld alphabets for any ndex-codng problem where the eavesdropper can access any message subset of cardnalty t. We show how to construct such codes f they exst, and nvestgate ther optmalty. Ths work s supported by ARC grants FT , DE , and DP , and US NSF grants CNS and CCF We use the term classcal to ndcate the absence of any securty constrants. 2) Random keys: It has been shown [9] that there exst randomsed secure network codes (usng random keys) for nstances where no determnstc secure network code exsts. Owng to an equvalence between classcal versons of network and ndex codng [7, 8], t s plausble that there exst ndex-codng nstances where randomsed encodng can enable securty when determnstc encodng cannot. Whle we do not dentfy an nstance where ths s true, we have proven that random keys are not useful for weakly-secure ndex codes n the followng three cases: () the eavesdropper has access to any t messages, () the sender s encodng functon s lnear, or () the eavesdropper has access to only one message subset. 3) Secure vs classcal ndex codng: We hghlght a sgnfcant dfference between classcal and secure ndex codng. In classcal ndex codng, messages not requred at any recever are not useful and can be removed from the system. In weaklysecure ndex codng, these messages may be used as keys. II. PROBLEM DEFINITION AND NOTATION Let m,n N. For each [n] {1,...,n}, defne two subsets K,W [m]. A classcal ndex-codng nstance (K,W ) n =1 conssts of a sngle sender and n recevers. The sender hasmmessagesx = [X 1 X 2 X m ], where{x } m =1 are ndependent and unformly dstrbuted over a fnte feldf q wth q elements. For a subset of ntegers I = { 1, 2,..., I } where 1 < 2 < < I, letx I [X 1 X 2 X I ]. Each recever [n] has a pror knowledge of X K, and needs to decode X W. The sender encodes X and gves the codeword to all recevers. The codeword must be chosen so that each recever [n] s able to decode the messages X W t wants usng the codeword and the messages X K t already knows. Wthout loss of generalty, we may assume that W \K for all [n], snce recevers wantng only messages they already know can be expunged from the problem. Let A 2 [m], where 2 [m] s the set of all subsets of [m]. A secure ndex-codng nstance ((K,W ) n =1,A) s a classcal ndex-codng nstance (K,W ) n =1 n the added presence of an eavesdropper who can access the sender s codeword and precsely one subset of messages X A, where A A. The eavesdropper cannot smultaneously access messages correspondng to the ndces contaned n more than one member of A. The set A contans the possble subsets of ndces of compromsed messages. Whle the sender and the recevers are aware of A, they are oblvous to the exact subset of ndces the eavesdropper knows. In addton to meetng the recevers decodng requrements, a weakly-secure ndex codeword must ensure that the eavesdropper gans no addtonal nformaton

2 about each ndvdual message X j, j [m] \ A, gven X A and the codeword. Formally, we have the followng: Defnton 1 (Determnstc weakly-secure ndex code): Gven a secure ndex-codng nstance ((K,W ) n =1,A), a determnstc weakly-secure ndex code (f,{g } n =1 ) of codelength l N conssts of an encodng functon for the sender, f : F m q F l q, to encode X nto C f(x), and a decodng functon for each recever [n], g : F l q F K q such that F q W, to decode X W from C and X K decodablty: g (f(x),x K ) = X W for each [n]; and weak securty: for all A A, an eavesdropper accessng X A has no nformaton about any sngle message n A c [m]\a,.e., H(X f(x),x A ) = H(X ), for all A c. Remark 1: If A = {[m]}, we have a classcal ndex-codng nstance wthout any securty constrant. The noton of weak securty consdered here, also known as 1-block weakly secure n the lterature [6, 10], does not preclude the eavesdropper from ganng nformaton about X A c despte ganng no knowledge about any sngle message thereof. Other notons of securty have also been consdered n the lterature. For example, Mojahedan, Aref, and Gohar [11] consdered strongly-secure ndex codng, where the eavesdropper has no access to any message, and must not gan any nformaton about the messages X. Ther approach nvolves the sender encodng messages wth keys that are pre-shared wth the recevers, but are unknown to the eavesdropper. It may be possble for the sender to use random keys along wth the messages X durng the encodng process to ensure securty aganst the eavesdropper. We therefore ntroduce the followng noton of random weakly-secure ndex codes that generalse determnstc weakly-secure ndex codes. Defnton 2 (Random weakly-secure ndex code): Let Y be a random varable takng values n a fnte alphabet Y known only to the the sender, and unknown to the recevers and the eavesdropper. A random weakly-secure ndex code (f,{g } n =1 ) of codelength l N s dentcal to the determnstc ndex-code setup wth the only excepton that the sender encodes X nto C f(x,y) usng the functon f : Fq m Y Fq. l The decodng operatons, decodablty condtons, and securty condtons are dentcal to those n Defnton 1. For the rest of ths paper, unless otherwse stated, by secure ndex codes, we mean weakly-secure ndex codes. Defnton 3 (Lnear ndex code): A random ndex code s lnear f and only f the key Y = [Y 1 Y 2 Y k ] for some k N, where {Y } k =1 are ndependent and unformly dstrbuted over F q, and the encodng functon C f(x,y ) = XG+Y G, (1) for some matrces G and G over F q of szes m l and k l, respectvely. Smlarly, a determnstc ndex code s lnear f and only f the encodng functon f(x) = XG. We say that a secure ndex code exsts for a secure ndexcodng nstance I = ((K,W ) n =1,A) f and only f there exsts a (determnstc or random) secure ndex code (f,(g ) n =1 ) for some q that meets all the condtons n Defnton 1. If one such code exsts, we say that the code s secure aganst an eavesdropper havng access to any message subset n A. As we wll see later, a secure ndex code may or may not exst dependng on A. The optmal secure ndex codelength s(i) for a secure ndex-codng nstance I, for whch secure ndex codes exst, s defned as nfmum of the codelengths of secure ndex codes over all alphabet szes. III. FUNDAMENTAL PROPERTIES We begn wth the followng counter-ntutve proposton: Proposton 1: Let A A [m]. An ndex code secure aganst an eavesdropper who knows X A may not be secure aganst an eavesdropper who knows X A, and vce versa. Proof: The followng example proves ths clam. Consder four recevers, where W = {}, for all [4], K 1 = {2}, K 2 = {1}, K 3 = {2,4}, K 4 = {2,3}. Consder two eavesdroppers: the frst eavesdropper has access to A 1 = {{3,4}}; the second eavesdropper has access to A 2 = {{3}}. The ndex code C 1 f 1 (X) = [X 1 + X 2 X 3 + X 4 ], where + denotes addton of the fnte feld F q, s secure aganst the frst eavesdropper (because H(X C 1,X 3,X 4 ) = H(X ) for each {1, 2}) but not the second eavesdropper (because t can decode X 4 ). The ndex code C 2 f 2 (X) = [X 1 + X 2 X 2 +X 3 +X 4 ] s secure aganst the second eavesdropper, but not the frst. Proposton 1 s n contrast to secure network codng [9], where a network code that s strongly secure aganst an eavesdropper who can access a subset of lnks, say L, s also secure aganst an eavesdropper who can access any L L. Proposton 2: No secure ndex code exsts for any secure ndex-codng nstance ((K,W ) n =1,A) where there exsts A A and [n] such that K A and W A c. Proof: Pck j W A c. Let C = f(x,y) be the codeword of a random ndex code that uses a key Y. Snce H(X j C,X A ) H(X j C,X K ) = 0, the eavesdropper s able to decode X j. Thus, the code cannot be secure. IV. EXISTENCE OF SECURE INDEX CODES Here, we present a necessary and suffcent condton for the exstence of secure ndex codes, and ther constructon. Furthermore, we derve optmal secure ndex codes for certan classes of nstances. We begn wth a specfc type of eavesdroppers. Defnton 4: For a gven (K,W ) n =1, we say that an ndex code s secure aganst an eavesdropper wth t-level access, for some t {0,1,...,m 1}, f and only f t s a secure ndex code for ((K,W ) n =1,{A [m] : A = t}). Lemma 1: Any (determnstc or random) ndex code secure aganst an eavesdropper wth t-level access s also secure aganst an eavesdropper wth t -level access, for any t < t.

3 Proof: Consder an eavesdropper wth t-level access who has access to any member of A = {A [m] : A = t}. An ndex code secure aganst ths eavesdropper must satsfy H(X C,X A ) = H(X ), for all A A, A c. (2) Consder an eavesdropper wth an access level t < t who has access to any member of A = {B [m] : B = t }. Pck any A A and any [m] \ A. As t < t m 1, we can always fnd a subset A A such that A A and / A. So, H(X ) (a) = H(X C,X A ) (b) H(X C,X A ) (c) H(X ), where (a) follows from (2), and (b) and (c) follow snce condtonng cannot ncrease entropy. Snce the choces of A and are arbtrary, we must have H(X C,X A ) = H(X ), for all A A and all [m]\a. Thus, the ndex code s also secure aganst an eavesdropper wth t -level access. Remark 2: Lemma 1 generalses the result by Dau et al. [6, Theorem 4.9] that pertans specfcally to determnstc lnear ndex codes to any (random or determnstc, lnear or nonlnear) ndex code. Remark 3: Although Proposton 1 states that an ndex code secure aganst an eavesdropper wth access to A = {A} may not be secure aganst an eavesdropper wth access toa = {A } where A A, any ndex code secure aganst an eavesdropper wth t-level access,.e., A = {A [m] : A = t}, s also secure aganst an eavesdropper wth any access level t < t. A. Exstence of secure ndex codes and ther constructon We now present a necessary and suffcent condton for the exstence of secure ndex codes. Theorem 1: Consder a secure ndex-codng nstance ((K,W ) n =1,A) wth A = {A [m] : A = t} for some t < m,.e., the eavesdropper has t-level access. Secure ndex codes exst f and only f t < K mn mn [n] K. (3) Determnstc lnear secure ndex codes exst f (3) s satsfed. Proof: We frst prove the converse. Suppose thatt K mn. By defnton, there exsts a recever, say, wth K = K mn, and W \K. Pck some j W \K,.e., K [m]\{j}. SnceK mn t m 1, we can always fnd somea A such that K A [m] \{j}. From Proposton 2, we conclude that no secure ndex code exsts. Next, we prove the forward part. Consder a determnstc lnear ndex code of length l = m K mn, formed by C = XG = X g, (4) [m] where G s an m l matrx over F q, and g Fq l s the -th row of G. Let G be the transpose of the generatng matrx of a maxmum-dstance-separable (MDS) code, whch always exsts for a suffcently large q. For any such code, t follows that any l rows of G are lnearly ndependent over F q. (Decodng) Recever [n] forms C X k g k = X j g j. (5) k K j [m]\k Snce [m]\k = m K m K mn = l, t follows that {g j : j [m] \ K } are lnearly ndependent. So, by usng C and {X k : k K }, recever can decode X [m]\k, and consequently the message(s) X W t wants, by solvng (5). (Securty) Denote the Hammng dstance between two vectors a = [a 1 a 2 a m ] Fq m and b = [b 1 b 2 b m ] Fq m by d(a,b) { [m] : a b }, the mnmum dstance of a vector space S by d(s) = mn {a,b S:a b} d(a,b), and the vector space spanned by the rows and columns of a matrx M byrowsp(m) andcolsp(g), respectvely. Dau et al. [6] showed that the lnear ndex code of the form (4) s secure aganst an eavesdropper wth an access level d(colsp(g)) 2. Note that G T s the generator matrx of an MDS code (m,l,d) whose codewords are vectors n rowsp(g T ). The mnmum dstance of ths MDS code equals d = d(rowsp(g T )) = d(colsp(g)) = m l+1. Invokng Lemma 1, we see that the ndex code (4) s secure aganst an eavesdropper wth an access level up to and ncludng (m l+1) 2 = K mn 1. Some remarks are now n order. Remark 4: MDS codes are also used n the partal-clquecover codng scheme [1] and ts tme-shared verson [4], and the local-chromatc-number codng scheme [12] for uncast ndex codng, where W = {} for all recevers [n]. Remark 5: Recever cooperaton can ncrease the securty level. Allowng two recevers, say and j, to cooperate and share ther messages s equvalent to solvng a new secure ndex-codng nstance where everythng remans the same except that recevers and j both know X K K j. Thus, cooperaton can potentally ncrease K mn (see (3)), whch then translates to securty aganst eavesdroppers wth hgher access levels. Remark 6: Theorem 1 also holds f we consder b-block securty (see Dau et al. [6]) for b 1 n Defnton 1. In the settng of b-block securty, an eavesdropper who knows X A, A A, gans no nformaton about any b messages t does not know,.e., H(X B C,X A ) = H(X B ), for all B A c wth B = b. In ths case, the necessary and suffcent condton for the exstence of secure ndex codes n (3) s replaced by t K mn b. Corollary 1.1: If A max max A A A < K mn, then determnstc lnear secure ndex codes exst. Proof: Proof follows from Theorem 1 and Lemma 1. Intutvely, Corollary 1.1 says that we can always fnd secure ndex codes f the eavesdropper can access fewer messages than each recever can. However, unlke Theorem 1, we do not have a converse for Corollary 1.1. Ths s because even f an eavesdropper can access (numercally) more messages than some recevers can, we may stll be able to construct secure ndex codes, dependng on the sets of messages to whch the eavesdropper has access. For example, see the secure ndex codes for the two nstances wth A max K mn n the proof of Proposton 1. B. Optmalty of secure ndex codes From the constructon of secure ndex codes n Theorem 1, we have the followng:

4 Corollary 1.2: If A max < K mn, the optmal secure ndex codelength s upper-bounded as s(i) m K mn. The upper bound s achevable by determnstc lnear ndex codes. Proof: See the proof of Theorem 1. We say that a recever has complementary message requests f t wants all messages t does not know,.e., K W = [m]. Proposton 3: If A max < K mn, and f any recever knowng exactly K mn messages has complementary message requests, then the optmal codelength s(i) = m K mn, and s achevable by determnstc secure lnear ndex codes. Proof: Wthout loss of generalty, let K 1 = K mn and K 1 W 1 = [m]. For any (determnstc or random) ndex code C, we have H(X W1 C,X K1 ) = 0. Thus, mlog 2 q = H(X) H(C,X K1,X W1 ) = H(C,X K1 ) log 2 q l +log 2 q Kmn, where we have made use of the facts that X = X K1 W 1, H(X W1 C,X K1 ) = 0, H(C) log 2 C = log 2 q l, and H(X K1 ) = log 2 q Kmn. Therefore, l m K mn. Snce C was arbtrary, t follows that s(i) = nfl m K mn. The proof s then complete by nvokng Corollary 1.2. V. SECURE VS CLASSICAL INDEX CODING We can represent a secure ndex-codng nstance ((G,K ) n =1,A) by a drected bpartte graph D = (U,M,E), smlar to that by Neely, Tehran, and Zhang [13]. Here, U and M are ndependent vertex sets, where each arc (.e., drected edge) n E connects a vertex n U to a vertex n M. We further partton U nto two dsjont sets: R = {r 1,r 2,...,r n } representng the n recevers, and V = {v 1,v 2,...,v A } representng the possble sets of messages to whch the eavesdropper can access. The set M = [m] represents the message ndces. The arc set E s defned as follows: There s an arc from r R to j M f and only f recever knows the message X j,.e., j K. There s an arc from j M to r R f and only f recever wants the message X j,.e., j W. For each A A, we have a unque v V such that N + D (v ) = A, where N + D (v ) {j M : (v j) E} s the out-neghbourhood of v. For a gven secure ndex-codng nstance D, f we gnore the securty constrant, the subgraph D[R M] nduced by (R,M) s n fact the bpartte graph used by Neely et al. [13] to represent the classcal ndex-codng nstance. Proposton 4: Consder a secure ndex-codng nstance ((G,K ) n =1,A), where A {[m]}. Let D = ((R,V),M,E) be ts drected bpartte graph representaton. If (C1) D[R M] s acyclc, or equvalently, D s acyclc, and (C2) every message s wanted by some recever,.e., for each [m], we have W j for some j [n], then no secure ndex code exsts. Proof: For the classcal ndex-codng nstance D[R M], Neely et al. [13, Appendx A] have shown that f condton C1 s true (condton C2 s always assumed to be true for non-secure ndex codng), one can obtan all messages from any ndex code, even wthout usng sde nformaton. Snce any secure ndex code for D, denoted by C, s an ndex code for D[R M], we have H(X [m] C) = 0. Therefore, for any A [m] and any [m] \ A, we have H(X C,X A ) H(X [m] C) = 0 < H(X ). Snce A {[m]}, there exsts some A [m]. It follows that no ndex code can be secure. Condton C2 n Proposton 4 that every message s wanted by some recever s mplct n classcal ndex codng as removng messages not wanted by any recever wll change nether the ndex code nor the optmal ndex codelength. However, removng unwanted messages may affect secure ndex codng, because these messages can be used as keys to protect the ndex code aganst the eavesdropper. The followng example llustrates ths dea. Example 1: Consder the followng secure ndex-codng nstance depcted by ts drected bpartte graph representaton. 1 r 1 2 The message X 2 s not wanted by any recever. If we remove t from the setup, by nvokng Proposton 4, we conclude that there s no secure ndex code. However, keepng X 2 n the system, by nvokng Corollary 1.1, we conclude that secure ndex codes exst. Indeed, the ndex code C = X 1 + X 2 s secure. Here, X 2 acts as a key between the sender and recever 1 to protect message X 1 aganst the eavesdropper. VI. RANDOM KEYS FOR SECURE INDEX CODING We saw n Example 1 that usng unwanted messages as keys may be essental n ensurng securty. One wonders f generatng random keys unknown to the recevers and the eavesdropper can also help n secure ndex codng. Whle the answer to ths queston s not known n general, we show that n the followng three scenaros, random keys are not useful n the sense that random secure ndex codes exst f and only f determnstc secure ndex codes also exst. A. Eavesdroppers wth t-level access From Theorem 1, t follows that usng random keys does not provde greater securty aganst an eavesdropper wth t- level access,.e., when A = {A [m] : A = t}, for any t < m. B. Lnear ndex codes We now restrct the secure ndex codes to be lnear, whle A s arbtrary. Theorem 2: Gven any secure ndex-codng nstance I. Random secure lnear ndex codes of codelength l exst for I f and only f determnstc secure lnear ndex codes of codelength l also exst for I. Proof: We only need to prove the only f drecton of the clam. Any random lnear ndex code can be expressed as C = XG + Y G. Snce each recever recovers ts ntended v 1

5 messages, for each recever [n] and each j W, there exst an l 1 vector D,j and a K 1 vector E,j such that X j = CD,j +X K E,j. (7) Let V be defned as the nullspace of G,.e., V = Null( G) {A F l q : GA = 0}. (8) Note that V s a vector space. From (7), t follows that D,j V for any [n] and j W, snce X j X K E,j = CD,j = XGD,j +Y GD,j, (9) whch can hold only f GD,j = 0 for any [n] and j W. Now, let A 1,...,Aˆl be a bass for V. Note that ˆl l, snce V F l q. If the sender broadcastsĉ [Ĉ1 Ĉ2 Ĉˆl], where Ĉ = CA = XGA, [ˆl], then each recever wll stll be able to recover ts ntended messages, snce for any [m] and j W, X j X K E,j = ĈD,j s a lnear combnaton of Ĉ1,...,Ĉˆl. Furthermore, for any A A and any j A c, H(X j ) H(X j X A,Ĉ) H(X j X A,C) = H(X j ), (10) where the second nequalty follows snce Ĉ s a functon of C. Hence, the new code Ĉ s also secure. The proof s then complete by notng that Ĉ s a determnstc ndex code. Remark 7: Random keys have also been shown not to be useful for lnear secure ndex codes n the strong-securty settng consdered by Mojahedan et al. [11]. C. Eavesdroppers havng access to only one message subset Lastly, we consder the class of secure ndex-codng nstances where the eavesdropper can access only one message subset. Proposton 5: Gven any ndex-codng nstance I wth A = 1, random secure ndex codes exst for I f and only f determnstc secure ndex codes also exst for I. Proof: Note that we only need to consder ndex-codng nstances where for each recever [n], ether (Type 1) K W A; (Type 2) K \A and W \A ; or (Type 3) K \A and W A. Otherwse, accordng to Proposton 2, no (determnstc or random) secure ndex code exsts. Let recevers 1,...,n be of Type 2, for some 0 n n, and the rest, of Type 1 or 3. Consder a related ndex-codng nstance I = ((K,W )n =1,A ) wth only A c messages X A c, n recevers that are of Type 2 n I, where A = { }, K = (K A c ), and W = (W A c ), for all [n ]. By the defnton of Type-2 recever, K 1 for all [n ]. For I, as A max = 0 and K mn 1, by nvokng Corollary 1.1, we see that there exsts a determnstc secure ndex code, say, C = f (X A c). Ths means that there exsts a functon g (C,X K ) = X W for each [n ], and H(X C ) = H(X ) for each A c. We now show that C = [X A C ] s a secure ndex code for I. For any recever of Type 1 or 3, ts decodng requrement s fulflled from observngx A, becausew A. Any recever of Type 2 gets X W A from X A, and X W A c = X W from g (C,X K ), snce t knows X K X K. Fnally,H(X C,X A ) = H(X C,X A ) (a) = H(X C ) = H(X ), for any A c, where (a) follows from the ndependence of (X,C ) and X A. Hence, C s a determnstc secure ndex code for I. So, for any I wth A = 1, ether no (determnstc or random) secure ndex codes exst, or we can always fnd a determnstc secure ndex code. D. Secure ndex vs network codng We now dscuss some ssues n extendng the equvalence 2 [7, 8] between classcal ndex and network codng to the secure settng. Consder the followng network-codng nstance N wth a source s havng two lnks e 1 and e 2 to a recever d. e 1 X 1 F q s d X 1 The codewords conveyed on lnks e 1 and e 2 n any network code can be wrtten as Y 1 = f 1 (X 1 ) and Y 2 = f 2 (X 1 ), respectvely, and the decodng operaton X 1 = g(y 1,Y 2 ). An equvalent [8] ndex-codng nstance I has three ndependent messages ˆX 1,Ŷ1,Ŷ2, and four recevers, as follows: Recever Has ˆX1 ˆX1 (Ŷ1,Ŷ2) ˆX1 Wants Ŷ 1 Ŷ 2 ˆX1 (Ŷ1,Ŷ2) Snce the codes for nstances I and N can be translated to one another [8], we can translate the above code for N to an ndex code Ĉ = [Ŷ1 +f 1 ( ˆX 1 ) Ŷ2 +f 2 ( ˆX 1 )] for I. Next, consder a secure verson of N, wth an eavesdropper who has access to any one lnk (e 1 ore 2 ) [9]. A secure network code must strongly secure X 1 aganst the eavesdropper. To ths end, we need random network codes, e.g., f 1 (X 1 ) = K, where K s a random key unformly dstrbuted on F q and ndependent of X 1, and f 2 (X 1 ) = X 1 +K. Unfortunately, the code translaton breaks down here n the presence of securty constrants. In I, for recever 1 to decode Ŷ 1 from Ĉ and the message ˆX 1 t knows, t addtonally needs to know the random key K = f 1 ( ˆX 1 ) generated by the sender. One dffculty n establshng an equvalence between secure network codng and secure ndex codng s that random keys used by the sender for encodng need not be avalable to the recevers for decodng. Furthermore, t s also not straghtforward to translate (strong or weak) securty constrants for the eavesdropper n N to equvalent and meanngful (strong or weak) securty constrants n I, and vce versa. e 2 REFERENCES [1] Y. Brk and T. Kol, Codng on demand by an nformed source (ISCOD) for effcent broadcast of dfferent supplemental data to cachng clents, IEEE Trans. Inf. Theory, 52(6), pp , June [2] Z. Bar-Yossef, Y. Brk, T. S. Jayram, and T. Kol, Index codng wth sde nformaton, IEEE Trans. Inf. Theory, 57(3), pp , Mar [3] A. Blasak, R. Klenberg, and E. Lubetzky, Broadcastng wth sde nformaton: Boundng and approxmatng the broadcast rate, IEEE Trans. Inf. Theory, 59(9), pp , Sept [4] H. Yu and M. J. Neely, Dualty codes and the ntegralty gap bound for ndex codng, IEEE Trans. Inf. Theory, 60(11), pp , Nov The nstances are equvalent n the sense that a code for one nstance can be translated to a code for the other, and vce versa.

6 [5] F. Arbabjolfae, B. Bandemer, Y.-H. Km, E. Şaşoğlu, and L. Wang, On the capacty regon for ndex codng, n Proc. ISIT, 2013, pp [6] S. H. Dau, V. Skachek, and Y. M. Chee, On the securty of ndex codng wth sde nformaton, IEEE Trans. Inf. Theory, 58(6), pp , June [7] S. El Rouayheb, A. Sprntson, and C. Georghades, On the ndex codng problem and ts relaton to network codng and matrod theory, IEEE Trans. Inf. Theory, 56(7), pp , July [8] M. Effros, S. El Rouayheb, and M. Langberg, An equvalence between network codng and ndex codng, IEEE Trans. Inf. Theory, 61(5), pp , May [9] N. Ca and R. W. Yeung, Secure network codng on wretap network, IEEE Trans. Inf. Theory, 57(1), pp , Jan [10] K. Bhattad and K. R. Narayanan, Weakly secure network codng, n Proc. Netcod, [11] M. M. Mojahedan, M. R. Aref, and A. Gohar, Perfectly secure ndex codng [Onlne]. Avalable: [12] K. Shanmugam, A. G. Dmaks, and M. Langberg, Local graph colorng and ndex codng, n Proc. ISIT, 2013, pp [13] M. J. Neely, A. S. Tehran, and Z. Zhang, Dynamc ndex codng for wreless broadcast networks, n Proc. INFOCOM, 2012, pp