© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes,creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.A family F of w-subsets of a finite set X is called a set system with the identifiable parent property if for any w-subset contained in the union of some t sets, called traitors, of F at least one of these sets can be uniquely determined, i.e. traced. A set system with traceability property (TSS, for short) allows to trace at least one traitor by minimal distance decoding of the corresponding binary code, and hence the complexity of tracing procedure is of order O(M), where M is the number of users or the code's cardinality. We propose a new construction of TSS which is based on the old Kautz-Singleton concatenated construction with algebraic-geometry codes as the outer code and Guruswami-Sudan decoding algorithm. The resulting codes (set systems) have exponentially many users (codevectors) M and polylog(M) complexity of code construction and decoding, i.e. tracing traitors. This is the first construction of traceability set systems with such properties.Peer ReviewedPostprint (author's final draft

Egorova, Elena

Fernández Muñoz, Marcel

Kabatiansky, Grigory

English

Crossref

A Construction of Traceability Set Systems with Polynomial Tracing Algorithm

UPCommons. Portal del coneixement obert de la UPC

A Construction of Traceability Set Systems withPolynomial Tracing AlgorithmElena Egorova ∗ Marcel Fernandez † Grigory Kabatiansky ‡Abstract—A family F of w-subsets of a finite set X is called aset system with the identifiable parent property if for any w-subsetcontained in the union of some t sets, called traitors, of F atleast one of these sets can be uniquely determined, i.e. traced.A set system with traceability property (TSS, for short) allows totrace at least one traitor by minimal distance decoding of thecorresponding binary code, and hence the complexity of tracingprocedure is of order O(M), where M is the number of usersor the code’s cardinality. We propose a new construction ofTSS which is based on the old Kautz-Singleton concatenatedconstruction with algebraic-geometry codes as the outer codeand Guruswami-Sudan decoding algorithm. The resulting codes(set systems) have exponentially many users (codevectors) M andpolylog(M) complexity of code construction and decoding, i.e.tracing traitors. This is the first construction of traceability setsystems with such properties.I. INTRODUCTIONThe concept of tracing traitors was introduced in [1] in thecontext of broadcast encryption. The aim of a tracing traitorsscheme is to encrypt data in a way preventing its illegalredistribution. Namely, a distributor encrypts the data blockswith session keys and gives the authorized users personal keysto decrypt them. In order to create unauthorized decryptionkeys (decoders), some authorized users can form a group(coalition of traitors) and based on their common knowledge(keys/decoders) create a forged key/decoder. Assuming thatthe cardinality of possible coalition is not greater than t, oncea forged key is observed, the distributor should be able toidentify at least one traitor from a malicious coalition. Suchschemes called tracing traitors schemes as in [1] or schemeswith Identifiable Parent Property (IPP schemes, for short) asin [2]. All known such schemes are based on perfect secretsharing schemes (SSS, for short), see [4], [5]. Namely, t-IPPcodes introduced in [2] are based on the simplest thresholdn-out-of-n SSS.A general w-out-of-n threshold SSS [4], [5], in whichany w (or more) participants can recover the secret key kand any set of less than w participants get no a posterioriinformation about k, was used for constructing the so-calledIPP set systems. Recall, that a family F = {F1, . . . , FM} ofw-subsets of a n-set {1, ..., n} = [n] is called a t-IPP setsystem if for any w-subset which belongs to the union of∗Elena Egorova is with Skolkovo Institute of Science and Technology(Skoltech), Russia. Email egorovahelene@gmail.com† M.Fernandez is with Universitat Politecnica de Catalunya, Barcelona,Spain. Email marcelf@entel.upc.edu‡G. Kabatiansky is with Skoltech, Russia. Emailg.kabatyansky@skoltech.ru.some t (or less) sets of F at least on of these sets can beuniquely determined, see [6], [7].Let us call a family of codes Ci of length ni and cardinalityMi or a family of set systems Fi of Mi wi-subsets of a ni-element set a good family if there is a constant c > 0 s.t.Ri = n−1i logMi ≥ cFor a general t-IPP set system, the traitor tracing procedure,i.e., finding at least one of the “involved” sets, has complexityO(nM t). It was suggested in the original paper [1] toconstruct IPP codes in which traitor tracing can be done viaminimal distance decoding for the corresponding code. Thisproperty was called traceability. Surely IPP systems withtraceability has much smaller complexity, namely of orderO(nM). It is proved in [1] that q-ary code has traceabilityproperty if its minimal code distance d > (1 − t−2)n, andhence q > t2 in order to get in this way a good family of IPPcodes (an easy consequence of the Plotkin bound). For anIPP set system, which can be considered as a constant weightcode of weight w, the analogous condition which guaranteesthe traceability property is that the minimal code distanced > 2(1− t−2)w [9].Nevertheless even such smaller complexity is still too bigfor good families of IPP codes and IPP set systems since theircardinality grows exponentially with the length n and hencethe overall decoding complexity is very large for practicalapplications. A problem of constructing a good family of IPPcodes with polynomial complexity, i.e., with the complexityof order poly(n) = polylog(M), was affirmatively solved in[10] and [11]. The main goal of this paper is to construct agood family of IPP set systems with polynomial complexity.A. Related workWe strongly believe that our work and the works in [3],[8] are different at heart. These papers deal with collisionsecure fingerprinting codes. This name was introduced in [1]as “secret” tracing schemes and later it was coined by Bonehand Shaw [20] under the name “collusion-secure fingerprintingcodes”. These codes have a probabilistic nature in the sensethat the identification of traitors is only performed with highprobability. Moreover, a collision secure fingerprinting code isnot a single code, but a family of codes from which a particularcode is chosen randomly and is not known to traitors.In our present work we deal with zero error identification,i.e. with “open” tracing traitors schemes (according to the2739978-1-5386-9291-2/19/$31.00 ©2019 IEEE ISIT 2019Authorized licensed use limited to: UNIVERSITAT POLITECNICA DE CATALUNYA. Downloaded on January 12,2022 at 11:40:04 UTC from IEEE Xplore.  Restrictions apply. language of [1]), which later became known as codes withIdentifiable Parent Property (IPP). So in this sense they areincomparable. Moreover, set systems can be viewed as a dif-ferent paradigm since we are not dealing with ordered vectorsas fingerprinting marks but with unordered sets. It is only ourapproach that seems to make both paradigms comparable. Letus note also that, to our knowledge, all known identificationalgorithms for Tardos codes have “decoding times which aresublinear in the total number of users”, i.e. exponential in thecode length, and our algorithms have polynomial complexity.II. CONCATENATED CONSTRUCTION OF GOOD IPP SETSYSTEMS WITH POLYNOMIAL COMPLEXITY BASED ONALGEBRAIC-GEOMETRIC CODESWe start from some definitions and previous results on IPPset systems.Definition 1: A family F = {F1, . . . , FM} of w-subsets of{1, . . . , n} is called a (t, w)-traceability set system ((t, w)-TSS) if for any coalition U ⊂ [M ], |U | ≤ t and any set S s.t.S ⊂ ∪u∈UFu and |S| ≥ w, it holds|S ∩ Fj | < maxu∈U|S ∩ Fu| for all j ∈ [M ] \ UIt will be more convenient to consider instead of subsetsFi their corresponding characteristic vectors ci, instead of afamily F = {F1, . . . , FM} the corresponding constant weightcode C = {c1, . . . , cM} of weight w and length n. We shallsay that a binary vector a = (a1, . . . , an) is covered by avector b = (b1, . . . , bn) and denote a ≺ b if ai ≤ bi for all i.Then, Definition 1 can be reformulated as followsDefinition 2: A binary constant weight code C of weight wis called a (t, w)-traceability code if for any subset U ⊂ C,|U | ≤ t and any vector s s.t. s ≺∨u∈U u and wt(s) ≥ w, itholdsd(s, c) > minu∈Ud(s, u) for all c ∈ C \ UWe need the following statement which can be proved alongthe line of analogous fact for IPP codes [1]. We prove thefollowing Proposition for completeness.Proposition 1: [9] A binary constant weight code C ofweight w is a (t, w)-traceability code if for its minimal codedistance d(C) the following inequality holdsd(C) > 2(1− t−2)w (1)Proof. Let define for two binary vectors a = (a1, . . . , an) andb = (b1, . . . , bn) the “intersection” functionI(a, b) = |{i : ai = bi = 1}|Then the Hamming distanced(a, b) = wt(a) + wt(b)− 2I(a, b),where wt(a) = |{i : ai = 1}| is the Hamming weight of a.Hence the equation (1) is equivalent to I(C) < t−2w, whereI(C) = maxc6=c′∈C I(c, c′). Consider any subset (coalition)U ⊂ C, |U | ≤ t and any vector s s.t. s ≺∨u∈U u andwt(s) ≥ w. Then∑u∈U I(u, s) ≥ wt(s) and hencemaxu∈UI(u, s) ≥ wt(s)t≥ wtSince s ≺∨u∈U u then for any c ∈ C \ U one has thatI(c, s) ≤∑u∈U I(u, c) < t× w/t2 = w/t.Note, that constant weight codes satisfying (1) possessa stronger property than the traceability property. Namely,consider for a given vector s generated by a coalition U , i.e.,s ≺∨u∈U u and wt(s) ≥ w, the following list of codewordsL(s) = {c ∈ C : I(s, c) ≥ wt−1}Then it follows from the proof that the list is nonempty andbelongs to U .A. KS-EZ constructionTo construct a family of good (t, w)-traceability codeswith polynomial complexity of encoding and decoding(tracing traitors) procedures we employ the same idea as inEricson and Zinoviev paper [12] where constant weight codesasymptotically better than the corresponding GV-bound wereconstructed based on algebraic-geometry codes [13] as outercodes and the old concatenation construction of Kautz andSingleton paper [14].Consider a Q = q2 = p2m-ary one-point algebraic-geometry (AG) code W , see [15], of length N , dimensionK, code rate R = K/N and the minimal code distanceD = N(1−R− (q − 1)−1 + o(1)) (2)We choose the following binary code C of length Q andcardinality Q, which consists of codevectors a1, . . . , aQ eachof the Hamming weight 1, where the vector ai has the onlyone in the i-th coordinate and other coordinates equal to zero.Let us denote the elements of the finite field GF (Q) ={α1, . . . , αQ}. Now, construct the concatenated code V byreplacing coordinates of a code vector of AG code on thecorresponding binary code vectors of the code C. The resultingbinary code V has the following parameters: length n = NQ,distance d(V ) = 2D, cardinality M = QK and hence its rateisR(V ) = n−1 log2M = Rlog2QQMoreover, the code V is a constant weight code of weightw = N .Theorem 1: For any rateR ≤ R(t) = 1 + log2 t8(t3 + t)2(3)there exists a family of good (t, w)-traceability codes of rateat least R.Proof. By (2) and Proposition 1 the code V is a (t, w)-traceability code for all enough large N if1−R− (q − 1)−1 > 1− t−2 (4)2740Authorized licensed use limited to: UNIVERSITAT POLITECNICA DE CATALUNYA. Downloaded on January 12,2022 at 11:40:04 UTC from IEEE Xplore.  Restrictions apply. Let R = 12t2 and q be the minimal prime number or power ofprime s.t. q ≥ 2t2 + 2. Then1−R−(q−1)−1 ≥ 1−( 12t2+12t2 + 1) = 1−t−2+ 12t2(2t2 + 1)and hence the inequality (4) holds for all N such that o(1)in (2) is smaller than (2t2(2t2 + 1))−1. Now, let us estimatethe rate R(V ) of the code V . By Bertrand’s postulate q <2(2t2 + 1), and, hence, q < 4(t2 + 1). ThereforeR(V ) = Rlog2QQ=12t2log2 q2q2>2 + log2(t2 + 1)16(t3 + t)2> R(t)B. Decoding (tracing) for KS-EZ constructionIn this subsection we design tracing (decoding) algorithmswith decoding complexity polynomial in the code length forthe above constructed asymptotically good (t, w)-traceabilitycodes. Traditional decoding algorithms realizing bounded dis-tance decoding of a concatenated code, like Forney’s algorithm[16], do not fit as we need to correct the number of errors muchhigher than the half of the code distance (moreover, we needto correct the number of errors bigger than half of the codelength). This takes us to the concept of list decoding [17],[19]. Instead of trying to deliver a single codeword, a listdecoder outputs a list of all codewords within distance largerthan half of the code distance of the received word, thusoffering a potential way to recover from errors beyond theerror correction bound of the code.In hard-decision decoding the decoder estimates the sentcodeword symbols from the received word symbols. On theother hand, soft-decision decoding applies to the cases wherethe decoding process takes advantage of “side information”generated by the receiver and instead of using the receivedword symbols, the decoder uses probabilistic reliability infor-mation about these received symbols.Hard decision and soft decision list decoding algorithmsfor AG codes are given in [17], [19]. The idea of the harddecision decoding algorithm is to interpolate and find a bi-variate polynomial. The factorization this polynomial gives theestimated sent codewords. In the soft decision decoding casethe polynomial is forced to pass through i different points adifferent number of ri times, where this ri is related to thesoft information gien by the decoder. See equation (5) below.We shall use Guruswami-Sudan list decoding algorithm [17]in a way somewhat similar as it was employed in [18] for thefamily of good digital fingerprinting codes, see also [11] wherean analogous tracing algorithm was proposed for IPP codes.Recall that for arbitrary non-negative integer “weights” rijassigned to symbols of GF (Q) the Guruswami-Sudan (GS)list soft-decoding algorithm [17], [19] returns all codewordsw ∈W that satisfy the following inequalityr(w) :=N∑i=1ri,wi ≥√(N −D)∑i,jr2ij , (5)Let U ⊂ V be a coalition of at most t users and let UQ ={u = (uQ1 , . . . , uQN} ⊂ W be the corresponding set of Q-aryvectors. Denote by UQi = {uQi : uQ ∈ UQ} the i-th projectionof the set UQ.Consider a binary vectors = (s11, . . . , s1Q, s21, . . . , s2Q, . . . , sN1, . . . , sNQ)generated by a coalition U , i.e., s ≺∨u∈U u and wt(s) =w′ ≥ w.Substitute to each subblock s(i) = (si1, . . . , siQ) the corre-sponding set Hi = {αj : j ∈ supp(s(i))} ⊂ UQi ⊂ GF (Q).Let us define ri,j := 1 if αj ∈ Hi and zero otherwise. Thenr(w) :=N∑i=1ri,wi = |{i : wi ∈ Hi}| ≤ |{i : wi ∈ UQi }|since Hi ⊂ UQi . For the choosen values of R = (2t2)−1 andQ the minimal code distance D of the outer code W is atleast N(1− t−2) for enough large N . Then, on the one hand,for any w /∈ Ur(w) ≤∑u∈U|{i : wi = ui}| < t×N/t2 = N/t (6)On the other hand,∑u∈Ur(u) ≥N∑i=1|Hi| = wt(s) = w′ = λN, (7)where 1 ≤ λ ≤ t, and hencemaxu∈Ur(u) ≥ t−1NλIt follows from (5) that the GS decoding algorithm outputs thefollowing listL = {w ∈W : r(w) ≥ t−1N√λ},which does not contain any w /∈ U , see (6), i.e., L ⊂ U , andL is non empty because of (7).Remark: Our contribution presents a “structured” modelof set systems just so we can apply well established ideasof coding theory in the decoding process, in particular listdecoding techniques. In [21] hard decision list decoding isused as the underlying routine in the tracing process.In our case we have to deal with a concatenated constructionthat demands to use soft-decision list decoding with thechallenge of having to assign the appropriate weights to eachsymbol so as to be able to discern between guilty and innocentusers.III. EXAMPLESConsider KS-EZ construction for small t.For t = 2 consider an AG-code W over GF (64), i.e., q = 8,and with rate R < 14 −17 =328 . Then according to (2) andProposition 1 the corresponding concatenated code C is a2-traceability code with total rate R(C) = R log2 6464 . Hence2741Authorized licensed use limited to: UNIVERSITAT POLITECNICA DE CATALUNYA. Downloaded on January 12,2022 at 11:40:04 UTC from IEEE Xplore.  Restrictions apply. for any rate R < 328664 = 0.010... there exists a familyof 2-traceability codes with rate R and a tracing algorithmof polynomial complexity. For comparison the best known2-traceability codes have rate 0.018 [9] but their tracingcomplexity is exponential in the code length.For t = 3 consider an AG-code W over GF (256), i.e.,q = 16, and with rate R < 19 −115 =245 . Then accordingto (2) and Proposition 1 the corresponding concatenated codeC is a 3-traceability code with total rate R(C) = R log2 256256 .Hence for any rate R < 245132 ≈ 0.0014 there exists a familyof 3-traceability codes with rate R and tracing algorithmof polynomial complexity. For comparison the best known3-traceability codes have rate 0.003 [9] but their tracingcomplexity is exponential in the code length.IV. CONCLUSIONFor the first time, for any fixed number t of traitors, weconstructed tracing traitor schemes of set systems type withnon-vanishing rate and polynomial complexity in the tracingprocess. One more advantage of such schemes is that they arebinary as opposed to IPP-codes that have to be nonbinary [2].ACKNOWLEDGMENTSThe work of M. Fernandez has been supported by the Span-ish Government Grant TEC2015-68734-R (MINECO/FEDER)“ANFORA” and Catalan Government Grant 2017 SGR 782.The work of E. Egorova and G. Kabatiansky has been sup-ported by the RFBR Grants 18-07-01427.REFERENCES[1] B.Chor, A.Fiat, and M.Naor. “Tracing traitors”. Advances in Cryptology-Crypto’94, LNCS, 839, pp. 480–491, 1994.[2] H. D. L. Hollmann, J. H. van Lint, J.-P. Linnartz, and L. M. G. M.Tolhuizen, “On codes with the Identifiable Parent Property,” J. Combi-natorial Theory, Ser. A, vol. 82, no. 2, pp. 121–133, May 1998.[3] G. Tardos. “Optimal Probabilistic Fingerprint Codes”. Proceedings ofthe Thirty-fifth Annual ACM Symposium on Theory of Computing, ACM,pp. 116–125, 2003.[4] G. R. Blakley. Safeguarding cryptographic keys. Proceedings of theNational Computer Conference 48: 313-317, 1979.[5] A. Shamir. How to share a secret, Communications of the ACM 22 (11),612-613, 1979.[6] D. R. Stinson, R. Wei. Combinatorial properties and constructions oftraceability schemes and frameproof codes, SIAM Journal on DiscreteMathematics, 11(1), 41-53, 1998.[7] M. J. Collins. Upper bounds for parent-identifying set systems. Designs,Codes and Cryptography, 51(2), 167-173, 2009.[8] K. Nuida, S. Fujitsu, M. Hagiwara, T. Kitagawa, H. Watanabe, K.Ogawa, H. Imai. An improvement of discrete Tardos fingerprintingcodes. Designs, Codes and Cryptography, 52(3), 339-362, 2009.[9] Egorova, E., Kabatiansky, G. Analysis of two tracing traitor schemesvia coding theory. Coding Theory and Applications, LNCS, vol. 10495,pp. 84-92, 2017.[10] A. Silverberg ; J. Staddon ; J.L. Walker, Applications of list decodingto tracing traitors, IEEE Trans. Information Theory vol. 49, no 5, pp1312-1318, 2003.[11] A.Barg and G. Kabatiansky, Class of i.p.p codes with effective tracingalgorithm , Journal of Complexity, vol. 20, no 2-3, pp.137-147, 2004.[12] T.H.E. Ericson, V.A. Zinoviev. An improvement of the Gilbert boundfor constant weight codes. IEEE Trans. Information Theory vol. 33, no5, pp 721-723, 1987.[13] M.A. Tsfasman, S.G. Vladuts, T. Zink. Modular curves, Shimura curves,and Goppa codes, better than Varshamov-Gilbert bound, MathematischeNachrichten 109 (1), 21-28, 1982.[14] W. Kautz, R. Singleton. Nonrandom binary superimposed codes, IEEETransactions on Information Theory 10(4), 363-377, 1964.[15] M.A. Tsfasman, S.G. Vladuts, T. Zink. Algebraic geometric codes: basicnotions, American Mathematical Soc., vol. 139, 2007[16] G.D. Forney,Jr., Concatenated Codes. Cambridge,MA: MITPress, 1966.[17] V. Guruswami and M. Sudan, “Improved decoding of Reed-Solomonand algebraic-geometry codes”, IEEE Trans. Inform. Theory, vol. 45,pp. 1757-1767, 1999.[18] A. Barg, G. R. Blakley, and G. Kabatiansky, “Digital fingerprintingcodes: Problem statements, constructions, identification of traitors,”IEEE Trans. Inform. Theory, vol. 49, no. 4, pp. 852–865, 2003.[19] V. Guruswami, “List decoding of error-correcting codes,” Ph.D. disser-tation, MIT, Cambridge, MA, 2001.[20] D. Boneh and J. Shaw, Collusion-secure fingerprinting for digital data,IEEE Trans. Inform. Theory vol. 44, no. 5, pp. 1897–1905, 1998.[21] A. Silverberg, J. Staddon, J.L. Walker, Applications of list decoding totracing traitors, IEEE Trans. Inform. Theory vol. 49, no. 5, pp. 1312–1318, 2003.2742Authorized licensed use limited to: UNIVERSITAT POLITECNICA DE CATALUNYA. Downloaded on January 12,2022 at 11:40:04 UTC from IEEE Xplore.  Restrictions apply. 

A construction of traceability set systems with polynomial tracing algorithm

https://upcommons.upc.edu/bitstream/2117/360833/1/A_Construction_of_Traceability_Set_Systems_with_Polynomial_Tracing_Algorithm.pdf

A construction of traceability set systems with polynomial tracing algorithm

Abstract

Similar works

Full text

Available Versions

Crossref

UPCommons. Portal del coneixement obert de la UPC