Group-Based Reduction Schemes for Streaming Applications

Some peer-to-peer streaming systems make use of linear codes to reduce the rate of the data uploaded by peers with limited upload capabilities. Such “data reduction” techniques are based on a vector-space approach and produce the data to be uploaded by means of linear combinations of the content data in a suitable finite field. In this paper, we propose a more general approach based on group theory. The new approach, while including the vector space approach as a special case, allows to design schemes that cannot be modeled as linear codes. We analyze the properties of the schemes based on the new approach, showing also how a group-based scheme can be used to prevent stream poisoning and how a group-based scheme can be converted into a secret-sharing scheme. Examples of group-based schemes that cannot be described in the vector-space framework are also shown.


Introduction
A problem that is currently attracting attention in the research community is the problem of streaming live content to a large number of nodes.The main issue to be solved is due to the amount of upload bandwidth required to the server that, unless multicast is used, is equal to the bandwidth required by a single viewer multiplied by the number of viewers.Although multicast is a possible solution, it has its drawbacks too, especially if the audience is spread among several different autonomous systems (AS).
An approach that recently attracted interest in the research community is the use of peer-to-peer (P2P) solutions.With the P2P approach, each viewer resends the received data to other users, and, ideally, if each user retransmitted the video to another user, the server would just need to "feed" a handful of nodes, and the network would take care of itself.Unfortunately, the application of the P2P paradigm to multimedia streaming has some difficulties.Maybe the most important one is due to the fact that the typical residential user have enough download bandwidth to receive the stream but not enough upload bandwidth to retransmit it.This makes the application of the P2P paradigm to video streaming not trivial.Some peer-to-peer streaming systems [1][2][3][4][5] propose the use of linear codes (someone interprets this approach as an instance of network coding [6]) to overcome the asymmetric bandwidth problem.In order to adapt the upload bandwidth to the user capabilities, the node combines the content data by means of some linear combinations and forwards the result.If the node has a reduced upload bandwidth, the forwarded linear combinations will not be sufficient to recover the original content, but a node can contact more than one peer to receive different sets of linear combinations in order to be able to recover the content data.
The approaches proposed in [1][2][3][4][5] reduce the required data rate by using linear codes obtained as linear transformations of vector spaces over a finite field.The goal of this paper is to introduce a more general approach on data rate reduction based on group theory.We will show that the classical vector space approach is just a specialization of the theory presented here, since vector spaces are just a special type of groups.However, since groups are more general than vector spaces, the theory presented in this paper allows one to create new coding procedures that cannot be described as linear combinations in suitable vector spaces.Note that the only hypothesis required is that the groups involved have a finite number of elements, and in particular, it is not required that the groups are commutative.
Although the application that motivated this work was rate reduction for P2P streaming, we will show that the theory presented here has a wider application range and it allows, for example, the construction of systems that counteract poisoning attacks [7] or allow secret sharing [8,9].This paper is organized as follows: in Section 2, we introduce a formalism for group-based reduction schemes (GBRS), in Section 3, we study the properties of GBRS; in Section 4, we give some examples of GBRS that cannot be described with the vector space approach; in Section 5, we give the conclusions.

Group-Based Reduction Schemes
Some P2P systems for multimedia streaming solve the problem of the limited bandwidth of residential users by uploading, instead of the whole content, some linear combinations (in a suitable finite field) of the data that constitute the content [1][2][3]5].The goal of this section is to introduce an alternative description of this type of "data reduction" procedures not based, as usual, on vector spaces but on group theory.In order to make the introduction of the group theory approach easier, we first introduce (in Section 2.1) a very general formalization of the reduction process that will be specialized in Section 2.2 to the desired group-based formalization.
For the sake of concreteness, we will refer to the peerto-peer streaming application, but this does not prevent the application of the presented theory to other applicative contexts of network coding.

Data Reduction
Schemes.We will model the content stream to be transmitted as a sequence of content symbols belonging to a finite content alphabet G.Each content symbol g ∈ G requires, clearly, log 2 |G| per element.The idea for reducing the rate necessary for the uploaded stream is to map every content symbol g to a reduced symbol u belonging to a smaller alphabet.Since the alphabet of u is smaller than G, the number of bits required for u will be smaller.Definition 1.A reduction scheme is given via (i) a finite set S and (ii) a set of reduction functions r s : G → K s , indexed by s ∈ S and sharing the same domain G (the content alphabet).
Remark 1.Note that no constraint is put on K s .In a practical context, it is expected that each K s has smaller cardinality than G.
A node with limited upload bandwidth chooses at startup a reduction parameter s ∈ S. Every time it receives a new content symbol g, it reduces it by processing it with the reduction function r s correspondent to the chosen s to obtain the reduced symbol that is encoded with log 2 |K s | < log 2 |G| bits and sent to the other peers.
A node that wants to recover the original content symbol g contacts R peers, receives the corresponding reduced versions u s1 , u s2 ,. . ., u sR and recovers g by solving the system u s1 = r s1 g , u s2 = r s2 g , . . .
Intuitively, if R is large enough, the peer can recover g.A key concept that we will use in this paper is the concept of a reduction scheme that it is R-recoverable.Informally, a scheme is R-recoverable if every g ∈ G can be recovered by the knowledge of any set of R different reduced versions.
The reduction scheme will be said to be R-tight if it is R-recoverable and for every choice of R − 1 reduction parameters s 1 , . ..,sR−1 ∈ S, the corresponding function φ s1,...,sR−1 is not injective.
Remark 2. Note that in Definition 2, we require only φ s1,...,sR to be injective, not bijective.That is, we do not require that system (2) have a solution for every choice of u si ∈ K si , i = 1, . . ., R (it could have none), but we require that if a solution exists, then it is unique.
The property of being R-recoverable is very interesting for applicative purposes, since it allows each node to choose its parameter s at random while granting (with large probability) the possibility of recovering the content g, since the probability of having two nodes choosing the same value can be made as small as desired by choosing |S| large enough.A reduction scheme that is R-recoverable has also other interesting characteristics such as being resilient to data loss (if the node contacts N > R peer, it can recover g as soon as it receives R reduced versions out of N), counteracting poisoning [7] (the node uses R reduced versions to recover g and uses the remaining N − R to check for the correctness of the result [1]), and reducing jitter [10].
Example 1 (Vandermonde reduction scheme).In order to give a concrete example of the just described abstract model, it is worthwhile to show how the reduction approach in [1] can be adapted to the described setup.The approach in [1] maps a block of Rd bits of the content stream in a column vector where each a i belongs to the Galois field with 2 d elements F 2 d .Each node chooses at start-up time an element s ∈ F 2 d and constructs the row vector r s := 1, s, . . ., s R−1 . (5) In order to produce the reduced version of vector c, the node multiplies c by r s to obtain u s = r s c.Value u s is sent to the other peers, and its transmission requires only d bits instead of Rd bits.Therefore, the required upload bandwidth is R times smaller.
In order to recover c, a node can ask for R different values u s1 ,. ..,u sR and solve the linear system Note that matrix R in ( 6) is a Vandermonde matrix, and it is invertible as soon as all the s i values are different.Reformulated with the language of the formalization presented here, we can say that the content alphabet is the set of R-dimensional vectors with entries in F 2 d ; that is, G = F R 2 d ; the reduction functions are parametrized by s ∈ S = F 2 d and are defined as r s (c) := 1, s, . . ., s R−1 c, ( 7 ) and, finally, K s = F 2 d for every s ∈ S. Note that this reduction scheme is R-tight.
2.2.Group-Based Reduction Procedures.The setup described in Section 2.1 is very general.In order to simplify the study, it is worthwhile to restrict the model above by adding to it some structure.A structure that is quite powerful but still quite general to be applied in several cases of practical interest is the structure of group.In this paper, we need only basic notions and results of group theory.For the sake of completeness, Appendix A summarizes the concepts used in this paper, and a more detailed description can be found in the literature [11,12].
In the following we will denote the group operation as a product and will use the symbol e for the neutral element of a group.We will denote with E = {e} the trivial group that contains only the neutral element.Group isomorphism will be denoted with .The ring of integers modulo N will be denoted as Z/N Z. Definition 3. A group-based reduction scheme (GBRS) is a reduction scheme {r s : G → K s , s ∈ S}, where the content alphabet G and each reduced alphabet K s , s ∈ S are finite groups and each r s is a group epimorphism (that is, a surjective homomorphism).Note that there is no loss of generality in requiring that each r s is an epimorphism, since one can always replace K s with Im(r s ).
Remark 3. Note that the reduction scheme presented in Example 1 is a group-based reduction scheme, since F R 2 d and F 2 d are groups (with respect to the sum) and maps r s (c) = r s c are clearly group homomorphisms.We will see in Section 4 examples of group-based schemes that are not based on a vector space structure.
2.2.1.Normalized Form.According to Definition 3, in order to specify a group-based scheme, one must specify the content group G, the reduced groups K s , and the epimorphisms r s .These requirements can be simplified by exploiting the fundamental homomorphism theorem [11] that implies that r s can be written as where π ker(rs) : G → G/ ker(r s ) is the natural map associated with G/ ker(r s ) [11] and η : G/ ker(r s ) → Im(r s ) = K s is an isomorphism.Since isomorphic groups are basically the same group, isomorphism η does not have any practical consequences in our context, so we can restrict ourselves to the case where reduced alphabets are quotient groups G/H, where H is a normal subgroup of G (the set of normal subgroups coincides with the set of subgroups that are kernel of some homomorphism [11]) and map r : where xH is the coset of G/H to which x belongs) [11].

Definition 4 (GBRS normalized form). A group-based reduction scheme {r
Observe that in order to specify a GBRS in normalized form, it suffices to specify a set {H 1 , H 2 , . . ., H L } of normal subgroups of G.With a minor abuse of language, we will use the term reduction scheme also for set {H With the normalized form, the reduced version of a content symbol g is always a coset gH which can be considered as "g reduced modulo H." The group H represents the "uncertainty" that one has about g when it knows its reduced version gH: the smaller the cardinality of H, the smaller the uncertainty about g.If H = E, no uncertainty is present, and g is exactly known.
Example 2. It is worthwhile to describe the Vandermonde reduction scheme of Example 1 as a GBRS in normalized form.The kernel of map r s (u) = r s u is the subspace of F R 2 d orthogonal to r s .The elements of the quotient group F R 2 d / ker(r s ) are translated versions of the subspace orthogonal to r s .Note that every coset U of F R 2 d / ker(r s ) is uniquely identified by the value of the product r s u, where u is any element of coset U (it is easy to see that the product does not depend on the chosen u).
Summarizing, value r s (u) can be computed as follows: first u is mapped to the coset u + ker(r s ) to which it belongs, then any representative of the coset is left multiplied by r s .It is easy to verify that the latter step is an isomorphism from Therefore, in order to study the theoretical properties of the Vandermonde reduction scheme, one can replace each r s with the natural map π ker(rs) .

Properties of GBRS
In this section, we will study some properties of GBRS.First, in Section 3.1, we will derive conditions for the existence of a solution of system (2), and we will show that depending on the choice of the subgroups, system (2) could have no solution for some choice of the values u si .If a reduction scheme is such that some R-ple of reduced values is not admissible, one expects that the R-ple of reduced values that can be obtained has some redundancy within.This idea is further pursued in Section 3.1.2,where it is also shown that the redundancy can be used to counteract stream poisoning attacks [7].
The Vandermonde reduction scheme described in Example 1 is deeply linked with the secret sharing scheme of [13].Actually, the secret sharing scheme of Shamir can be derived from the Vandermonde scheme by replacing some information data with random data.This idea is discussed in greater detail in Section 3.2, where it is shown how nonredundant reduction schemes (i.e., schemes such that (2) has always a solution for every R-ple of reduced values) can be easily converted in secret sharing schemes.

Reconstruction.
As explained in Section 2.1, recovering the original content requires to solve system (2).In this section, we are going to study the reconstruction problem by showing that given two reduced versions uH and vK, one can combine them in order to get a "virtual" reduced version w(H ∩ K), reduced with respect to the smaller uncertainty group H ∩ K. Intuitively, by combining the virtual reduced version with other reduced versions, one can make the uncertainty group smaller and smaller until the original content symbol is recovered.In some sense, this corresponds to solving system (2) by means of an iterative approach: first, we determine the set of values of g that satisfy the first two equations of (2), then we use the third equation to refine the solution, and so on until only one solution remains.The problem to be solved at the first step of the iterative algorithm can be formalized as follows.
Problem 1.Let H and K be normal subgroups of G, and let uH ∈ G/H and vK ∈ G/K.Find all the a ∈ G such that π H (a) = uH and π K (a) = vK (or, equivalently, find the intersection uH ∩ vK).
The following property gives an answer to Problem 1.
Property 1.Let H and K be normal subgroups of G, and let uH ∈ G/H and vK ∈ G/K.Let be the set of content symbols g ∈ G that have uH and vK as reduced versions.
(1) Set S is not empty if and only if or, equivalently, uHK = vHK ∈ G/HK.Note that since H ⊂ HK, . . .chosen to represent uH.
(2) if (10) is satisfied, set S can be written as where a is any element of S. In other words, S is a coset of G/(H ∩ K). Proof.
Step 2 (If condition (10) holds, then Since uh ∈ uH and vk −1 ∈ vK, it follows that uh ∈ S. Incidentally, note that if one knows how to decompose an element of HK into a product of an element of H and an element of K, this procedure allows to find a solution in S.
Step 3 (If S / = ∅, then (11) holds).Define homomorphism φ : G → G/H × G/K as φ(g) = (π H (g), π K (g)) and observe that S = φ −1 (uH, vK), that is, S is the inverse image of (uH, vK).Since φ is an homomorphism, it is known that (if . The thesis will follow if one can prove that Equation ( 13) can be proved by observing that a ∈ ker(φ) if and only if π H (a) = H (i.e., equivalent to a ∈ H) and π K (a) = K (i.e., equivalent to a ∈ K).
Several remarks about Property 1 are in order.
Remarks.(1) Suppose system (2) has solution g.Clearly, g must necessarily belong to set (11) so that set (11) can be written as g(H ∩ K).It follows that (11) is the reduced version of the solution g with respect to group H ∩ K.This implies that Property 1 can be applied to every step of the iterative algorithm outlined at the beginning of this section.Note that the availability of an iterative algorithm that solves system (2) one equation at time can be interesting from an implementation point of view, since it allows to spread the computational burden over the time, updating the solution as soon as new data are received.Depending on the applicative context, this can be more convenient than waiting for all data to arrive before starting the reconstruction.
(2) Note that condition (10) poses a compatibility condition on the pair (uH, vK).Such a condition can, however, be trivially true if HK is equal to the whole group G.If HK is a proper subset of G, not every pair (uH, vK) is admissible, and this, intuitively, implies that there is some redundancy in the pair (uH, vK).This aspect will be discussed more in detail in Section 3.1.2.

The Reconstruction Problem and the Lattice of Normal Subgroups
. Property 1 has a nice interpretation in the context of the lattice of the normal subgroups of G (see Appendix B for a brief summary about lattices and [11] for a more detailed exposition).According to Property 1, the uncertainty group H ∩ K of the combined version is the greatest lower bound H ∧ K of H and K (i.e., their first common descendant on the lattice graph), while the group associated with constraint (10) is the smallest upper bound H ∨K (i.e., their first common ancestor on the lattice graph).
Example 3. Figure 1 shows the lattice graph of the subspaces of F 3 4 , together with the subspaces involved in the Vandermonde reduction scheme.In the case of Figurge 1, F 4 is implemented as the polynomials with coefficients in Z/2Z modulo z 2 + z + 1.
Each node in Figure 1 is labeled with a basis of the space, and the elements of F 4 are represented as integer numbers in {0, 1, 2, 3} whose digits in the binary representation are the coefficients of the corresponding element of F 4 (e.g., 3 corresponds to z+1).The top node, labeled with I, represents the whole space F 3 4 , while the bottom node, labeled with {0}, represents the trivial space.
As explained in Example 2, the groups associated with the Vandermonde scheme are the R − 1-dimensional subspaces orthogonal to vectors of type (5).In Figure 1, these vector spaces are 2-dimensional and correspond to the four nodes marked with a bold circle.In order to obtain the intersection of two of the spaces associated with the Vandermonde scheme, one needs to find the first common descendant of the two spaces.By considering all the six different unordered pairs of spaces, one obtains the six onedimensional spaces marked with bold hexagons in Figure 1.
Note that any triple of spaces has as common descendant the trivial space {0}, coherently with the fact that the scheme is 3-recoverable.Moreover, any pair of spaces has as common ancestor, the whole space F 3 4 , coherently with the fact that system (6) is solvable for any vector [u b1 , . . ., u bR ] of reduced values.

Redundancy in a GBRS.
It is worthwhile commenting about the meaning of constraint (10) in the context of network coding for peer-to-peer streaming.Remember that uH and vK represent two reduced versions received from two peers.According to Property 1, if uH and vK have been obtained by reducing the same content symbol g, then uH and vK are "compatible" according to (10).If HK / = G, constraint (10) is not trivial, and not all the pairs (uH, vK) are valid.
Intuitively, this is very similar to the case when redundant bits are added to protect communications from errors.Actually, adding redundant bits to the information to be transmitted constrains the set of admissible sequences of bits, and if the received sequence does not satisfy the constraints induced by the redundant bits, the receiver can deduce that an error occurred.Here, similarly, if uH and vK do not satisfy (10), we can deduce that at least one reduced value must be incorrect.In Section 3.1.3,it is shown how it is possible to exploit this possibility to counteract poisoning attacks when network coding is used for streaming over peer-to-peer networks.

ISRN Communications and Networking
The idea that if HK / = G, then some redundancy is present, is confirmed by the following result.Property 2. Let the notation be as in Property 1.The following equality holds: Proof.Since HK/K is isomorphic to H/(H ∩ K) [11], it follows that By exploiting (15), one can write By taking the logarithms of ( 14) and reorganizing, one obtains Observe that the sum in parenthesis represents the number of bits that we used to receive the two reduced versions, while the last term on the right-hand side of ( 17) can be interpreted as the number of bits necessary to describe the result of the combination of the two reduced versions.It follows that their difference can be interpreted as the "redundancy" of the system in the sense that it is the difference between the number of bits spent and the number of bits that we got after the combination.Note that if HK = G (the case when condition ( 10) is always verified), then the last term of ( 17) is zero; that is, no redundancy is added.
Definition 5. Scheme {H 1 , H 2 , . . .H K } will be said to be nonredundant if for every choice of different Example 4. Consider the case of the Vandermonde reduction scheme.In this case, H and K are two spaces, of dimension R − 1, orthogonal, respectively, to vectors r 1 and r 2 .The intersection H ∩ K is the space of the vectors that are orthogonal to both r 1 and r 2 , and, as known, it has dimension R−2.In the Vandermonde scheme, product HK is the vector space sum r ⊥ 1 + r ⊥ 2 .Since spaces r ⊥ 1 and r ⊥ 2 have dimension R − 1, their sum has dimension R (that corresponds to the no redundancy case HK = G) unless the two spaces coincide.Therefore, the Vandermonde scheme has no redundancy.
We will introduce in the following a reduction scheme based on the Chinese remainder theorem (CRT) that allows for the introduction of redundancy.

Counteracting Stream Poisoning.
One important security threat in P2P streaming is the stream poisoning attack where a node sends wrong packets on the P2P network with the objective of disrupting the communication [7].A reduction-based approach can help counteracting this attack.The idea is very simple: if the reduction scheme is Rrecoverable, a node asks data to N > R peers, uses R reduced versions to recover the content, and then uses the remaining N − R reduced versions to check the correctness of the result; by the knowledge of which tests fail, it is possible to spot who tried the attack [1] (if all the tests fail, it means that a corrupted value was used in the reconstruction process; the node can retry the tests using a different subset of R in the reconstruction step).It is possible to show that this test is robust against a coordinated attack of at most N − R peers [1].
A drawback of the test above is that one needs to recover first the content symbol and then do the test.If, by chance, a corrupted value is used in the reconstruction process, the node needs to try the reconstruction again.It would be more efficient if the node was able to spot the corrupted data before doing the reconstruction process.
This can be done by using a redundant scheme and exploiting Property 1 by checking (10) before attempting the reconstruction.

Generalized Secret Sharing.
Secret-sharing techniques allow one to share a secret among N people with the constraint that (i) R people, putting their information together, can recover the secret and (ii) R − 1 people that put their information together cannot deduce anything about the secret [8,13].We will say that the scheme achieves perfect secrecy.Note that secret sharing is a problem very similar to the reduction problem described in this paper but with the additional constraint of (ii).
Actually, the Vandermonde reduction scheme described in Example 1 can be easily converted into the secret-sharing scheme described in [8,13].More precisely, suppose that the secret to be shared is represented by a value x ∈ F 2 d .The scheme of [13] builds vector c in (4) by setting a 1 = x and choosing a 2 , . . ., a R at random.Successively, N reduced values are created and distributed among the participants.In order to recover the secret, one collects R reduced versions, gets c by solving (6), and takes the first component of the result.Note that taking the first component of c is equivalent to right-multiplying c by e t 1 = [1, 0, . . ., 0].As said above, secret sharing has the additional constraint of perfect secrecy; that is, any set of R − 1 participants cannot deduce anything about the secret.This can be easily verified by observing that e 1 does not belong to the space generated by any set of R − 1 vectors of type r s , s / = 0 (note that e 1 = r 0 ), and this implies that from the knowledge of R − 1 reduced values, nothing can be inferred about the value of x = a 1 = e 1 c.
In this section we will show how the procedure used to convert the Vandermonde scheme into a secret sharing scheme can be generalized to any GBRS.Observe that the above described secret sharing procedure can be reformulated as follows: map the information to be shared x into a vector v = xe 1 belonging to the one-dimensional space V 1 := span{e 1 } generated by e 1 , successively add to v a random vector q belonging to the R − 1-dimensional space e ⊥ 1 orthogonal to e 1 , and finally vector v + q is processed with the reduction scheme.The fact that the intersection between V 1 and e ⊥ 1 is trivial allows one to recover uniquely v (and x) from v + q.
In order to extend the secrete sharing scheme in the GBRS context, we need an obfuscating subgroup M G that will play the role of e ⊥ 1 .The generalized secret sharing scheme is the following: let I be any set of representatives of G/M; we encode the information to be shared as an element v ∈ I, we draw at random q ∈ M and compute h = vq ∈ vM, then we apply the reduction scheme to h.After recovering h, one can obtain v by applying π M , the natural map associated with M, to h.The only thing that remains to be checked is to verify when this scheme achieves perfect secrecy.Remember that a reduced value is a coset of a quotient group G/H, where H is a normal subgroup of G. Let uH be the reduced version of h = vq, with q a random element of M. Our objective is to deduce some information about v from the knowledge of uH.We will say that a value ∈ G is compatible with uH if there are m ∈ M and k ∈ H such that m = uk, or, alternatively, Note that if is not compatible with uH, then we obtain some information about the secret value, since we know that the secret cannot be .Therefore, the scheme will achieve perfect secrecy with reduction group H if every ∈ I is compatible with uH for every u ∈ G.
Remark 4. From (18), it follows at once that is compatible with uH if and only if any other element of M is compatible with uH.This implies that one can change the set of representatives I without changing the secrecy characteristics of the scheme.Definition 6.Let H and M be normal subgroups of G.We say that perfect secrecy is achieved if for every u ∈ G, every ∈ I is compatible with uH.
Property 3. Let H and M be normal subgroups of G. Perfect secrecy is achieved if and only if HM = G.
Proof.If HM = G, then perfect secrecy is achieved.
If HM / = G, then perfect secrecy is not achieved.Suppose now that HM / = G; that is, there is o ∈ G that does not belong to HM. Observe that according to Remark 4, we can suppose without loss of generality, e ∈ I; we will prove that e is not compatible with o −1 .Indeed, if e was compatible with o, (18) would imply o ∈ HM.Therefore, e is not compatible with o −1 , and perfect secrecy is not achieved.
If condition HM = G is fulfilled, it is possible to prove that perfect secrecy is achieved even in a stronger, information theoretical sense.Indeed, although Property 3 claims that if HM = G, then any uH can be obtained from any information symbol ∈ I, it could happen that the probability of obtaining uH from could depend on .In this case, an attacker could deduce from uH something about .The following result shows that this is not the case.
Property 4. Let L be a random variable assuming values in I, and let Q be a random variables assuming values in M and uniformly distributed.If HM = G, then for every α ∈ G, According to Property 4, π H (LQ), the reduced version of LQ, is statistically independent on L, and this implies that mutual information I(π H (LQ); L) [14] is zero, so that an attacker cannot deduce anything about L from π H (LQ).
The proof of Property 4 is simplified by using the following lemma.
Step 3 (C β = C e for every β ∈ G).Since both M and 0 are normal subgroups of G, MH = HM = G.It follows that every β ∈ G can be written as β = mh with m ∈ M and h ∈ H.By exploiting Steps 1 and 2 above, one deduces that

ISRN Communications and Networking
Proof of Property 4. It is a simple verification One can interpret Property 3 by saying that in order to have perfect secrecy, one must choose M large enough so that, when combined with any H that can result from the combining process, it generates the whole group G.This is what is done in the secret sharing scheme based on the Vandermonde scheme.In this case, M is a space of dimension R−1 that when combined with any nontrivial space resulting from the Vandermonde scheme, it generates the whole space Property 5. Let {H 0 , H 1 , H 2 , . . .H K } be a nonredundant Rrecoverable reduction scheme with R ≤ K. Obfuscating group M = H 0 together with reduction scheme {H 1 , H 2 , . . .H K } is a secret-sharing scheme that achieves perfect secrecy.
Proof.Since scheme {H 0 , H 1 , . . .H K } is not redundant, then we have, by definition, According to Property 5, constructing secret-sharing schemes that achieve perfect secrecy is simple as soon as one has a nonredundant scheme with enough subgroups: just use one of the subgroups as the obfuscating group.

Examples of Alternative Reduction Schemes
In order to show the flexibility and the generality of the presented theory, in this section, we present some schemes that are not expressible as schemes based on vector spaces over finite fields.With respect to the Vandermonde scheme, the schemes presented here have the characteristic that they do not require arithmetic in finite fields but only ordinary integer arithmetic, and this, depending on the applicative context, could be interesting from a complexity point of view.Moreover, the redundancy of the schemes presented here can be easily adapted to the specific application requirements: low redundancy (or none at all) if efficiency is required and more redundancy if error protection is needed.

CRT-Based Reduction Scheme.
Let p 1 , p 2 , . . ., p L be mutually prime numbers (i.e., the greatest common divisor of p i and p j / = p i is 1), and let N = p 1 • • • p L .We will consider the group Z/N Z of the integers modulo N. Every subgroup of Z/N Z has the form MZ/NZ, where M divides N. The reduction of x = u+NZ ∈ Z/N Z with subgroup MZ/NZ is (u mod M) + MZ/NZ.Note that since M divides N, coset (u mod M) + MZ/NZ does not depend on the representative chosen for u + NZ.
Let us consider, as an example, the case N = 210.In this case, the content symbols are integers in the range 0  Subgroup MZ/210Z is labeled with M in Figure 2; therefore, the bottom node of Figure 2 represents the trivial group E 210Z/210Z, while the top node represents the content alphabet G = Z/210Z.By choosing the nodes marked with a star, one obtains a reduction scheme with no redundancy that enjoys the 4-reconstruction (tight) property, while choosing the node marked with a circle, one obtains a scheme that enjoys a 3-reconstruction property but not tight, since in some cases, only two reduced versions suffice.Moreover, the scheme associated with the circles is redundant, since the least upper bound of two nodes marked with circles is not the top node.

Point Lattice Reduction Schemes.
Let M ∈ Z D×D be a square matrix with integer entries with det M / = 0.The point lattice of base M is the set MZ D ⊂ R D obtained by taking integer linear combinations of the columns of M; that is, (Typically, MZ D is called simply lattice; here we use the term point lattice in order to avoid confusion with the lattices introduced in Appendix B.) A point lattice is clearly a subgroup of Z D .It is known [11,15] that Since Z D /MZ D is finite, it is a suitable group for building reduction schemes.Consider, for example, the case where M = diag(4, 4).It is easy to see that each class of Z 2 /MZ 2 can be uniquely identified by its representative belonging to the set {0, . . .3}× {0, . . ., 3}.Such a representative can be encoded by using four bits: two bits per component.Note that each subgroup of Z 2 /MZ 2 has the form NZ 2 /MZ 2 , where N is an integer matrix such that N −1 M has integer entries [15].By exploiting the Hermite normal form theorem, it is possible to show that N can be supposed without loss of generality in lower triangular form.If n 1 and n 2 are the diagonal elements of N, it is easy to check that every class of [Z 2 /MZ 2 ]/[NZ 2 /MZ 2 ] can be uniquely identified by its representative belonging to the set {0, . . ., n 1 − 1} × {0, . . ., n 2 − 1}.Since det N = n 1 n 2 must divide det M = 16, we are granted that both n 1 and n 2 must be powers of two, making the binary representation of the representative trivial.Figure 3 shows the lattice graph of the subgroups of Z 2 /MZ 2 .(The lattice graph of Figure 3 can be obtained by using the algorithm in [16].)As for the case of Figure 2, each node in Figure 3 is labeled with the corresponding N matrix; therefore, the top node corresponds to the content alphabet Z 2 /MZ 2 , while the bottom node corresponds to the trivial group E MZ 2 /MZ 2 .
Several choices for reduction schemes are possible.
(1) Use the two subgroups marked with full circles and the one marked with an empty circle.This gives a 2-tight scheme (the first common descendant of each pair of nodes is the node corresponding to E MZ 2 /MZ 2 ) without redundancy (the first common ancestor of each pair of nodes is the node corresponding to G = Z 2 /MZ 2 ).
If [x, y] t , x, y ∈ {0, . . ., 3} represents the symbol to be reduced, it is easy to show that the reduction with respect to the subgroups shown in Figure 3 can be done as follows: Note that the result of each reduction in (23) requires two bits to be encoded, and this is coherent with the fact that this scheme is 2-tight and non redundant.
Note that reductions (23) do not require arithmetic in a Galois field but only normal integer arithmetic.This can be interesting from an implementation point of view.
(2) If the two subgroups marked with full circles and the one marked with the star are chosen, one obtains a scheme that is not 2-tight anymore, since, for example, node 2 and node 6 have as common descendant node 13.The scheme, however, is not redundant, since every pair of nodes has as common ancestor node 1.
(3) If the two subgroups marked with full circles and the ones marked with a triangle are chosen (nodes 6, 11, and 12) one obtains a redundant scheme, since nodes 6 and 12 have as common ancestor node 9.
Remark 5.It is worth observing that the scheme proposed here is not to be confused with lattice-based error correction codes proposed in the literature (see [17] for an introduction).Generally speaking, lattice-based error correction schemes exploits the "metric" properties of lattices that derive from the fact that a lattice is subset of R N .In our case, we use the lattice only as an abstract group and not as the subset of a metric space.This distinction can be made clearer by observing that if one in an error correction scheme replaces the lattice with another one, almost surely the properties of the error correction scheme will change; in our scheme, one can replace the lattice with any other isomorphic group, and the overall properties of the scheme will not change.

Conclusions
This paper proposed a general framework for reduction schemes based on group theory.The new framework, while containing the vector space approach as a special case, allows to design schemes that cannot be modeled as linear codes.The properties of the GBRS have been analyzed, and it has also been shown how a GBRS can be used to prevent stream poisoning and how GBRS can be converted into a secret-sharing scheme achieving perfect secrecy.Examples of group-based schemes that cannot be described in the vector space framework have also been shown.

A. Basic Concepts of Group Theory
In this paper, we are going to use some basic results and concepts from group theory.In order to make this paper as self-contained as possible, we recall here the main concepts used in this paper and refer the reader to the literature for more details [11].
If G is a group and H is a subgroup of G, H is said to be a normal subgroup of G (and will write H G) if for every c ∈ G and h ∈ H, it holds c −1 hc ∈ H.If H is a subgroup of G, one can define their quotient G/H as the set of the classes associated with the equivalence relation a ≡ b(mod H) ⇔ b −1 a ∈ H.If H G, one can give to G/H the structure of a group by defining the group operation, as usual, by (uH)(vH) := (uv)H [11].If H is a subgroup of G we will denote with π H : G → G/H the natural map associated with G/H, that is, the map that associates with each x ∈ G the coset π H (x) := xH of G/H to which x belongs.It is known that if H and K are normal subgroups of G, then HK is a normal subgroup of G, and it is equal to KH [11].

B. Ordered Lattices
A structure that we will need in this paper is the lattice structure, a special type of partially ordered set.Many algebraic structures are lattices.The simplest example is maybe the set of subsets of a given set ordered by inclusion.In this case, the least upper bound corresponds to set union, while the least lower bound corresponds to set intersection.Another example of lattice is given by natural numbers ordered by divisibility (i.e., a ≥ b if a divides b).In this case, the least upper bound is the greatest common divisor, while the least lower bound corresponds is the least common multiple [11].Here, we are interested in the lattice of normal subgroups of a given group.It is possible to show that the set of normal subgroups of G is a lattice, with set inclusion as the relation order, and that the least upper bound of H and K is HK, while the greatest lower bound is H ∩ K. B.1.Lattice Graph.Finite lattices have a useful graphic representation exploiting the idea of covering.We say that a covers b if "a is immediately above b;" that is, if a > b and there exists no u such that a > u > b.We can represent the order relation by creating an oriented graph whose nodes are the lattice points, and there is an edge going from a to b if a covers b.Since it is possible to show that in a finite lattice a > b if and only if there exist a sequence of c i , i = 1, . . ., n such that (i) c i covers c i+1 for every i = 1, . . ., n − 1 and (ii) a = c 1 , b = c n , it is easy to see that a > b if and only if there is a path that goes from a to b.It is easy to verify that the least upper bound of a and b is the first common ancestor of a and b, while the greatest lower bound is the first common descendant.
Figure 4 shows two examples of lattice graphs.In Figure 4(a), one can see the graph of {1, . . ., 12} ordered by divisibility, while in Figure 4(b), one can see the graph of the subsets of {a, b, c}.It is common to draw the graph representing a lattice in order to have the edges always going from top to bottom.

Figure 2 :
Figure 2: Lattice of the subgroups of Z/210Z.A node labeled with M represents group MZ/210Z.

Figure 2
Figure2shows the lattice of the subgroups of Z/210Z.Subgroup MZ/210Z is labeled with M in Figure2; therefore, the bottom node of Figure2represents the trivial group E 210Z/210Z, while the top node represents the content alphabet G = Z/210Z.By choosing the nodes marked with a star, one obtains a reduction scheme with no redundancy that enjoys the 4-reconstruction (tight) property, while choosing the node marked with a circle, one obtains a scheme that enjoys a 3-reconstruction property but not tight, since in some cases, only two reduced versions suffice.Moreover, the scheme associated with the circles is redundant, since the least upper bound of two nodes marked with circles is not the top node.

Figure 4 :
Figure 4: (a) The graph of the lattice of integers {1, . . ., 12} by divisibility.(b) The of the lattice of the subsets of {a, b, c} ordered by inclusion.

Definition 7 .
A lattice L is a partially ordered set in which any two elements a, b ∈ L have a least upper bound a ∨ b and a greatest lower bound a ∧ b[11].
• • • 209, the reduction with subgroup MZ/210Z is the usual reduction modulo M, and Property 1 reduces itself to the Chinese remainder theorem.A reduction scheme based on the group Z/210Z is uniquely specified by giving a set of subgroups of