Distributed randomized network coding, a robust approach to multicasting in distributed network settings, can be extended to provide Byzantine modification detection without the use of cryptographic functions is presented in this paper

Effros, Michelle

Ho, Tracey

Karger, David R.

Koetter, Ralf

Leong, Ben

Médard, Muriel

English

Caltech Authors - Main

Byzantine Modiﬁcation Detection in Multicast Networks using
Randomized Network Coding
Tracey Ho∗, Ben Leong∗, Ralf Koetter†, Muriel Me´dard∗, Michelle Eﬀros‡ and David R. Karger∗1
∗Massachusetts Institute of Technology, †Univ. of Illinois, Urbana-Champaign, ‡California Institute of Technology
e-mail: ∗{trace@ , benleong@, medard@, karger@csail.}mit.edu, †koetter@uiuc.edu, ‡effros@caltech.edu
Abstract — We show how distributed randomized
network coding, a robust approach to multicasting in
distributed network settings, can be extended to pro-
vide Byzantine modiﬁcation detection without the use
of cryptographic functions.
Distributed randomized network coding is a ﬂexible, ro-
bust approach for multi-source multicast in distributed net-
work settings. In this technique, nodes independently select
random linear mappings from inputs onto outputs over some
ﬁnite ﬁeld. This achieves any feasible connections with prob-
ability tending to 1 as the ﬁeld size grows. The aggregate lin-
ear combinations can be communicated to receiver nodes as
coeﬃcient vectors which undergo the same operations as the
information signals. Such information allows receiver nodes
to decode the source messages if they receive enough inde-
pendent linear combinations [1]. This approach achieves eﬃ-
cient shared use of multiple paths, giving greater robustness
to link failures and random coding errors as excess capacity
in the network increases [2]. Reference [3] describes a practi-
cal packet-based implementation which divides source packets
into generations within which linear combinations may occur.
In this paper, we show how this approach can be extended
to detect Byzantine (i.e. arbitrary) modiﬁcation of data by
malicious or compromised nodes. This is particularly useful in
overlay or ad-hoc multicast settings where end hosts forward
information to others. Other Byzantine fault detection ap-
proaches have included message authentication codes [4] and
signed digests [5]. We consider a packet-based randomized
network coding scheme, where some hash symbols, calculated
as simple polynomial functions of the source data, are included
in each source packet. Receiver nodes check if decoded packets
are consistent, i.e. have matching data and hash values. Addi-
tional computation is minimal as no cryptographic functions
are involved. Detection probability can be traded oﬀ against
communication overhead, ﬁeld size (complexity) of the net-
work code and the time taken to detect an attack.
The only requirement is that receiver nodes obtain one or
more unmodiﬁed packets whose contents were unknown to the
Byzantine attacker at the time of design of the modiﬁed pack-
ets; we will refer to such packets as good. This expectation is
reasonable given the distributed randomness and path diver-
sity of network coding. Depending on the application, various
responses may be employed upon detection of a Byzantine
fault, such as collecting more packets from diﬀerent nodes to
obtain a consistent decoding set, or employing other more
complex Byzantine agreement algorithms.
I. Model and results
1This research is supported in part by NSF Grants CCR-
0325324, CCR-0220039 and CCR-0325496, University of Illinois
subaward #03-25673, Hewlett-Packard 008542-008, and Caltech’s
Lee Center for Advanced Networking.
Consider a set of r source packets which are multicast using
distributed randomized network coding in ﬁnite ﬁeld Fq. Let
the data content of each packet be represented by θ symbols
x1, . . . , xθ ∈ Fq, from which φ ≤ θ hash symbols y1, . . . , yφ
are calculated. We deﬁne the function π : Fhq → Fq mapping
(x1, . . . , xh) ∈ Fhq to π(x1, . . . , xh) = x21 + . . . + xh+1h , and set
yi = π(x(i−1)k+1, . . . , xik) for i = 1, . . . , φ− 1
yφ = π(x(φ−1)k+1, . . . , xθ)
where k =
⌈
θ
φ
⌉
is a design parameter inversely related with
communication overhead. Let M be the matrix whose ith row
is the concatenation of the data and corresponding hash value
for source packet i. A genuine packet contains a random linear
combination of one or more rows of M , along with the vector
of coeﬃcients of the combination.
Consider a set of s good packets and r−s modiﬁed packets
being used for decoding. The good packets can be represented
by matrix Ca [M |I], where the ith row of Ca is the coeﬃcient
vector of the ith packet. The modiﬁed packets may contain
arbitrary data and hash values, and can be represented by
[CbM + V |Cb], where V is an arbitrary (r−s)×(θ+φ) matrix.
Theorem 1 The attacker cannot determine which of a set of
qs×rank(V ) potential decoding outcomes the receiver will obtain.
For each of s or more packets, the decoded value will be one
of qrank(V ) possibilities {mi +
∑rank(V )
j=1 γi,jvj |γi,j ∈ Fq}, where
vectors mi, vj ∈ Fθ+φq are known to the attacker.
Theorem 2 The decoded packets can be consistent under at
most a fraction
(
k+1
q
)s
of potential values of the good packets;
at most a fraction
(
k+1
q
)s
of potential outcomes can be con-
sistent. If the receiver decodes from multiple sets containing
s′ good packets in total, then this fraction becomes
(
k+1
q
)s′
.
This result explicitly characterizes the relation between de-
tection probability, communication overhead ( 1
k+1
), network
code complexity q, and the number of good packets s′, which
may be viewed as a measure of the time taken to detect an
attack or an inverse measure of the seriousness of the attack.
References
[1] T. Ho, R. Koetter, M. Me´dard, D. R. Karger and M. Eﬀros,
“The beneﬁts of coding over routing in a randomized setting”,
ISIT 2003.
[2] T. Ho, M. Me´dard, J. Shi, M. Eﬀros and D. R. Karger, “On
randomized network coding”, Allerton 2003.
[3] P. A. Chou, Y. Wu and K. Jain, “Practical network coding”,
Allerton 2003.
[4] M. Castro and B. Liskov, “Practical Byzantine Fault Toler-
ance”, OSDI 1999.
[5] K. P. Kihlstrom, L. E. Moser and P. M. Melliar-Smith, “The
SecureRing Protocols for Securing Group Communication”,
HICSS 98.
ISIT 2004, Chicago, USA, June 27 – July 2, 2004
??????????????????????????? ?????????


Byzantine modification detection in multicast networks using randomized network coding

We show how distributed randomized network coding, a robust approach to multicasting in distributed network settings, can be extended to provide Byzantine modification detection without the use of cryptographic functions

Tracey Ho

Ben Leong

Ralf Koetter

Muriel Medard

Michelle Effros

David R. Karger

CiteSeerX

Byzantine Modification Detection in Multicast Networks using Randomized Network Coding

On randomized network coding”,

Practical Byzantine Fault Tolerance”,

Practical network coding”,

The benefits of coding over routing in a randomized setting”, ISIT

The SecureRing Protocols for Securing Group Communication”,

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.1.5621

Byzantine modification detection in multicast networks using randomized network coding

Abstract

Similar works

Full text

Available Versions

Caltech Authors - Main

CiteSeerX