On The Capacity of Broadcast Channels With Degraded Message Sets and Message Cognition Under Different Secrecy Constraints

0.31 MB·English

by  Ahmed S. Mansour

SUBMITTEDFORPUBLICATION 1
On The Capacity of Broadcast Channels With
Degraded Message Sets and Message Cognition
Under Different Secrecy Constraints
Ahmed S. Mansour, Rafael F. Schaefer, Member, IEEE, and Holger Boche, Fellow, IEEE
Abstract—This paper considers a three-receiver broadcast BC with two degraded message sets has been considered
channel with degraded message sets and message cognition. The in [4,5], where it has been shown that the straightforward
6 model consists of a common message for all three receivers, extension of the Ko¨rner and Marton inner bound is optimal
1 a private common message for only two receivers and two
for many special cases. In [6], Nair and El Gamal considered
0 additional private messages for these two receivers, such that
2 each receiver is only interested in one message, while being a three-receiver BC with degraded message sets, where a
fully cognizant of the other one. First, this model is investigated common message is sent to all three receivers, while a private
n without any secrecy constraints, where the capacity region is message is sent to only one receiver. They showed that the
a established, showing that the straightforward extension of the
J straightforward extension of the Ko¨rner and Marton inner
Ko¨rner and Marton inner bound to the investigated scenario is
bound for this scenario is no longer optimal. They presented
5 optimal. In particular, this agrees with Nair and Wang’s result,
2 which states that the idea of indirect decoding – introduced to anewcodingschemeknownasindirectdecodingandshowed
improvetheKo¨rnerandMartoninnerbound–doesnotprovidea that the resultant inner bound of this technique is strictly

] betterregionforthisscenario.Further,somesecrecyconstraints greater than the Ko¨rner and Marton inner bound. However,
T
are introduced by letting the private messages to be confidential
in [7], Nair and Wang showed that if the private message
I ones. Two different secrecy criteria are considered: joint secrecy
. is to be sent to two receivers instead of one, the idea of
s and individual secrecy. For both criteria, a general achievable
c rateregionisprovided.Moreover,thejointandindividualsecrecy indirect decoding does not yield any region better than the
[ capacity regions are established, if the two legitimate receivers Ko¨rner and Marton inner bound. Another scenario for three-

2 aremorecapablethantheeavesdropper.Theestablishedcapacity receiver BC with degraded message sets was considered in
regionsindicatethattheindividualsecrecycriterioncanprovide
v [8], where a common message is sent to all three receivers,
a larger capacity region as compared to the joint one, because
0 while two private messages are only sent to two receivers
each cognizant message can be used as a secret key for the
9
other individual message. Further, the joint secrecy capacity is withsomemessagecognitionatthesereceivers.Ingeneral,the
4
established for a more general class of more capable channels, transmission of degraded message sets over three-receiver BC
4
0 where only one of the two legitimate receivers is more capable has captured a lot of attention, yet it has not been completely
than the eavesdropper. This was done by showing that principle
. solved as many questions remained unanswered beyond the
1 ofindirectdecodingintroducedbyNairandElGamalisoptimal
two-receiver case.
0 forthisclassofchannels.Thisresultisincontrastwiththenon-
5 secrecy case, where the indirect decoding does not provide any Recent work does not only consider reliable transmission,
1 gain. but it also considers more complex scenarios that involve
v: IndexTerms—broadcastchannel,degradedmessagesets,mes- certain secrecy requirements. In particular, physical layer
i sagecognition,jointsecrecy,individualsecrecy,capacityregions, security has attracted a lot of researchers nowadays, see for
X
more capable channels. example [9–12] and references therein. Shannon was the first
r one to study the problem of secure communication from an
a
informationtheoreticperspectivein[13].Heshowedthatitcan
I. INTRODUCTION
be achieved by a secret key shared between the transmitter
The broadcast channel (BC) with degraded message sets
and the receiver if the entropy of this key is greater than
was initially introduced by Ko¨rner and Marton in [3]. They
or equal to the entropy of the message to be transmitted.
considered a two-receiver BC, where a common message
In [14], Wyner studied the degraded wiretap channel and
is transmitted to both receivers and a private message is
provedthatsecuretransmissionisstillachievableoveranoisy
transmittedtoonlyoneofthem.Theyestablishedthecapacity
channel without any secret key. In [15], Csisza´r and Ko¨rner
regionforthegeneralBCbyprovidingastrongconverse.The
extended Wyner’s result to the general BC with common and
extension of Ko¨rner and Marton results to the three-receiver
confidentialmessages.In[16,17],theprevioustwoapproaches
This work was presented in part at IEEE-SPAWC, Tronto, Canada, June were combined by studying the availability of a shared secret
2014[1]andatIEEE-ITW,Hobart,Tasmania,Australia,November2014[2]. key during secure transmission over a wiretap channel. In
AhmedS.MansourandHolgerBochearewiththeLehrstuhlfu¨rTheoretis-
[18], Kang and Liu proved that the secrecy capacity for this
che Informationstechnik, Technische Universita¨t Mu¨nchen, 80290 Mu¨nchen,
Germany(e-mail:[email protected];[email protected]).RafaelF.Schae- scenarioisachievedbycombiningthewiretapcodingprinciple
feriswiththeInformationTheoryandApplicationsGroup,TechnischeUni- along with Shannon’s one-time pad idea. Over the years, the
versita¨tBerlin,10587Berlin,Germany(email:[email protected]).
integration of confidential and public services over different
This work of R. F. Schaefer was supported by the German Research
Foundation(DFG)underGrantWY151/2-1. channels has become very important [19].
2 SUBMITTEDFORPUBLICATION
Despite the tremendous effort of researchers, the extension information. On the other hand, different individual secrecy
of Csisza´r and Ko¨rner’s work to BC with two or more codingtechniqueshasbeenintroducedinanearlyparalleland
legitimate receivers has remained an open topic. In [20], Chia independent work in [27] and more recently in [28–30].
and El Gamal investigated the transmission of one common Therestofthispaperisorganizedasfollows.InSectionII,
and one confidential message over a BC with two legitimate we introduce the model of three-receiver BC with degraded
receiversandoneeavesdropper.Theyderivedageneralachiev- message sets and full message cognition without any secrecy
able rate region and established the secrecy capacity if the constraints. We provide a weak converse showing that the
two legitimate receivers are less noisy than the eavesdropper. straightforward extension of the Ko¨rner and Marton inner-
Theyalsoshowedthatinsomecasestheindirectdecodingcan bound is in fact the capacity region. This result agrees with
provide an inner bound that is strictly larger than the direct the one in [7], that for this case indirect decoding can not
extension of Csisza´r and Ko¨rner’s approach. outperformtheKo¨rnerandMartoninnerbound.InSectionIII,
In this paper we investigate the transmission of degraded we introduce secrecy constraints to our model and discuss the
message sets with two layers over a three-receiver BC under differencesbetweenthejointandindividualsecrecycriteria.In
different secrecy constraints. Our model combines the scenar- Section IV, we provide an achievable rate region for the joint
iosin[7,8,20]asfollows:acommonmessageistransmittedto secrecy criterion. We then establish the joint secrecy capacity
all three receivers, a confidential common message to the two region if only one of the legitimate receivers is more capable
legitimate receivers and two confidential individual messages thantheeavesdropperusingtheprincipleofindirectdecoding.
to the two legitimate receivers, where each receiver is only In Section V, we provide an achievable rate region for the
interestedinonethem,whilebeingfullycognizantoftheother individual secrecy criterion. We then establish the individual
one. This problem is of high interest and importance because secrecycapacityregionifthetwolegitimatereceiversaremore
it does not only generalize and combine the previous works capable than the eavesdropper.
in[7,8,20],butitisalsoofpracticalrelevancesinceitcanbe
motivated by the concept of two-phase bidirectional relaying Notation
in a three-node network [21,22].
Inthispaper,randomvariablesaredenotedbycapitalletters
In the first phase of the bidirectional relaying, node 1
and their realizations by the corresponding lower case letters,
and node 2 transmit their messages to the relay node which
while calligraphic letters are used to denote sets. Xn denotes
decodes them, while keeping the eavesdropper unable to
the sequence of variables (X ,...,X ), where X is the ith
intercept any information about the transmission. This phase 1 n i
variable in the sequence. Additionally, we use X˜i to denote
corresponds to the multiple access wiretap channel and was
the sequence (X ,...,X ). A probability distribution for the
investigatedin[23–25],wherethelatterdiscussesdifferentse- i n
random variable X is denoted by Q(x). U−V−X denotes
crecycriteria.Ourworkisrelatedtothesucceedingbroadcast
a Markov chain of random variable U, V and X in this order,
phase, where the relay re-encodes and transmits these mes-
while (U−V,K)−X−Y implies that U−V−X−Y and
sages back to the intended nodes. Since the receiving nodes
K−X−Y are Markov chains. R is used to denote the set
are cognizant of their own message from the previous phase, +
ofnonnegativerealnumbers.H(·)andI(·;·)arethetraditional
they can use it as an additional side information for decoding.
entropyandmutualinformation.Theprobabilityofaneventis
First results for the case where this communication scenario
given by P[·], while E[·] is used to represent the expectation.
mustbeprotectedagainstanadditionaleavesdropperappeared
Moreover, a,b isusedtorepresentthesetofnaturalnumbers
in [26], where different achievable rate regions and an outer
between a(cid:74)and(cid:75)b.
bound were provided. In our problem, we have an additional
feature as the relay transmits another common confidential
II. BCWITHDEGRADEDMESSAGESETSANDMESSAGE
message to both legitimate receivers and a common message
COGNITION
for all three nodes.
In [26], the authors claimed to define the secrecy re- In this section, we investigate the three-receiver BC with
quirement of their model based on a conservative secrecy degradedmessagesetsandmessagecognitionwithoutanyse-
measure known as joint secrecy. This measure assures the crecyconstraints.First,weintroduceourmodel,thenestablish
secrecy of each confidential message even if the other one is thecapacityregionforthegeneralthree-receiverBCwithtwo
compromised. However, they established an achievable region degraded message sets.
in [26, Theorem 1] using secret key approach, where the
confidential message of one user is used as a secret key A. System Model and Channel Comparison
for the other one. One can show that this encoding scheme Let X, Y , Y and Z be finite input and output sets. Then
1 2
does not fulfill the joint secrecy constraint. This observation for input and output sequences xn ∈Xn, yn ∈Yn, yn ∈Yn
1 1 2 2
encouragedustoconsideranothersecrecyconstraint,inwhich andzn ∈Zn oflengthn,thediscretememorylessBCisgiven
the legitimate receivers can cooperate together to protect their
by
confidential messages based on some form of mutual trust. n
(cid:89)
This led to the less conservative secrecy measure known as Qn(y1n,y2n,zn|xn)= Q(y1k,y2k,zk|xk),
individual secrecy. In [1,2], we investigated the effect of k=1
relaxingthesecrecyconstraintfromjointsecrecytoindividual where xn represents the transmitted sequence, yn, yn and zn
1 2
secrecy on the capacity region of the BC with receiver side represent the received sequence at the three receivers. Before
BCWITHDEGRADEDMESSAGESETSANDMESSAGECOGNITION 3
we discuss our model in details, we need to introduce two that maps each channel observation at the respective receiver
important classes of BCs, that we will address a lot in our and the cognizant message to the corresponding intended
investigation. messages or an error message {?}.
Definition 1. In a discrete memoryless BC Q(y,z|x), Y is We assume that the messages M , M , M and M are
c 0 1 2
said to be less noisy than Z, also written as Y (cid:23)Z, if for independent and chosen uniformly at random. The reliability
every random variable V such that V−X−(Y,Z) forms a performance of C is measured in terms of its average prob-
n
Markov chain, we have ability of error
I(V;Y)≥I(V;Z). (1) P (C )(cid:44)P(cid:104)(Mˆ ,Mˆ ,Mˆ )(cid:54)=(M ,M ,M ) or
e n c 0 1 c 0 1
On the other hand, Y is said to be more capable than Z, if (cid:105)
(M˜ ,M˜ ,M˜ )(cid:54)=(M ,M ,M ) or Mˇ (cid:54)=M , (3)
for every input distribution on X, we have c 0 2 c 0 2 c c
I(X;Y)≥I(X;Z). (2) where(Mˆ ,Mˆ ,Mˆ ),(M˜ ,M˜ ,M˜ )andMˇ aretheestimated
c 0 1 c 0 2 c
messages at Y , Y and Z respectively.
The class of more capable channels is strictly wider than 1 2
thelessnoisyone.Itcanbeshownthatanylessnoisychannel Definition 3. A rate quadruple (R ,R ,R ,R ) ∈ R4
c 0 1 2 +
is a more capable one. Further, it was shown that the class of is achievable for the BC with degraded message sets
less noisy channels contains the physically and stochastically and message cognition, if there exists a sequence of
degraded channels [31]. (2nRc,2nR0,2nR1,2nR2,n)codesCn andasequence(cid:15)n,such
We consider the standard model with a block code of arbi- that for n is large enough, the following holds
trary but fixed length n. We consider four different messages
sets. The first set contains the common messages for all three P (C )≤(cid:15) and lim (cid:15) =0. (4)
e n n n
n→∞
receiversandisdenotedbyMc = 1,2nRc .Thesecondsetis
mdeensostaegdesbyfoMr 0R=ece(cid:74)i1v,e2rnsR10(cid:75)aannddc2o(cid:74).nWtaihnislet(cid:75)htehperilvaasttetcwoommseotns B. Capacity Region
contain the individual private messages M1 = 1,2nR1 and Theorem1. Thecapacityregionofthethree-receiverBCwith
M2 = 1,2nR2 . Further, we assume full mess(cid:74)age cogn(cid:75)ition degraded message sets and message cognition is the set of all
atY1 an(cid:74)dY21,s(cid:75)uchthatY1 iscognizantoftheentiremessage rate quadruples (Rc,R0,R1,R2)∈R4+ that satisfy
M and Y of the entire message M as shown in Fig. 1.
2 2 1 R ≤I(U;Z)
c
Y1n (Mˆc,Mˆ0,Mˆ1) R0+R1 ≤I(X;Y1|U)
MMM0c1 Encoder Xn Channel MMY122n RReecceeiivveerr21 (Mˆc,Mˆ0,Mˆ2) RRc++RRR00+++RRR21 ≤≤≤III(((XXX;;;YYY21|))U) (5)
M2 Zn Mˆc c 0 2 2
Receiver3 for some (U,X), such that U−X−(Y ,Y ,Z) forms a
1 2
Markov chain. Further it suffices to have |U|≤|X|+2.
Fig. 1. Three-receiver broadcast channel with degraded message sets and
messagecognition. Proof: The achievability follows directly from the
straightforward extension of the Ko¨rner and Marton inner
Remark 1. If we let M = M = ∅, our model reduces to bound in [3] to the three-receiver BC with degraded message
1 2
the three-receiver BC with two degraded message sets studied setsandmessagecognitionasin[7,8].Superpositionencoding
in [6,7]. is used as follows: m is encoded in the cloud centers
c
codewords Un, while (m ,m ,m ) are superimposed in the
Definition 2. A (2nRc,2nR0,2nR1,2nR2,n) code Cn for the satellitecodewordsXn.Jo0intt1ypica2litydecodersarethenused
BC with degraded message sets and message cognition con-
at each receiver leading to the bounds in (5).
sists of: four independent message sets M , M , M and
c 0 1 For the converse, we start by establishing the reliability
M ; an encoding function at the transmitter
2 upper bounds for any achievable rates. Based on Fano’s
E :M ×M ×M ×M →Xn inequality, the expression of the average error probability in
c 0 1 2
(3) and the reliability constraint given by (4), we have
which maps a message quadruple (m ,m ,m ,m )∈M ×
c 0 1 2 c
M0 ×M1 ×M2 to a codeword xn(mc,m0,m1,m2); and H(M |Zn),H(M |YnM ),H(M |YnM )≤nγ ((cid:15) ) (6)
c c 1 2 c 2 1 c n
three decoders, one at each receiver
H(M M |YnM M )≤nγ ((cid:15) ) (7)
0 1 1 2 c 1 n
ϕ1 :Y1n×M2 →Mc×M0×M1∪{?} H(M0M2|Y2nM1Mc)≤nγ2((cid:15)n) (8)
ϕ :Yn×M →M ×M ×M ∪{?}
2 2 1 c 0 2
where γ ((cid:15) ) = 1/n+(cid:15) R , γ ((cid:15) ) = 1/n+(cid:15) (R +R )
ϕ :Zn →M ∪{?} c n n c 1 n n 0 1
3 c and γ ((cid:15) )=1/n+(cid:15) (R +R ).
2 n n 0 2
1From this point, we will refer to different receivers by their respective Next, we let Ui (cid:44) (Mc,Z˜i+1), K1i (cid:44) Y1i−1, K2i (cid:44) Y2i−1,
channeloutputsinterchangeably. M(cid:44)(M0,M1,M2), Vi (cid:44)(M,Ui), Vi1 (cid:44)(Vi,K1i) and Vi2 (cid:44)
4 SUBMITTEDFORPUBLICATION
(V ,K2). We then start by considering the common rate R . R +R ≤I(V2;Y |UK2)−I(V2;Z|UK2)+I(V;Z|U),
i i c 0 2 2
Using Eq. (6), we have (12c)
1(cid:104) (cid:105)
Rc ≤ H(Mc)−H(Mc|Zn) +γc((cid:15)n) where(U−V,K1)−V1−X−(Y1,Y2,Z) and(U−V,K2)−V2
n
−X−(Y ,Y ,Z) form Markov chains. Since the conditional
1 1 2
= I(M ;Zn)+γ ((cid:15) ) mutualinformationistheexpectationoftheunconditionalone,
c c n
n
Eq. (12b) can be further upper-bounded as follows:
n
1 (cid:88)
= I(Mc;Zi|Z˜i+1)+γc((cid:15)n) (cid:104) (cid:105)
n R +R ≤E I(V1;Y |UK1)−I(V1;Z|UK1) +I(V;Z|U)
i=1 0 1 K1 1
n
≤ 1 (cid:88)I(McZ˜i+1;Zi)+γc((cid:15)n) (≤a)I(V1;Y |U,K1 =k1∗)−I(V1;Z|U,K1 =k1∗)
n 1
i=1 +I(V;Z|U)
n
1 (cid:88)
= n I(Ui;Zi)+γc((cid:15)n). (9) (=b)I(V1∗;Y1|U)−I(V1∗;Z|U)+I(V;Z|U) (13)
i=1
Next, we consider the sum of the private rates (R + R ) where (a) follows as k1∗ is the value of K1 that maximizes
0 1
which are intended for receiver Y1. We have the difference I(V1;Y1|U,K1 =k1)−I(V1;Z|U,K1 =k1);
while (b) follows because V1∗ is distributed according to
R +R (≤a) 1I(M M ;Yn|M M )+γ ((cid:15) ) the following probability distribution Q(v1|u,k1 =k1∗) [11,
0 1 n 0 1 1 2 c 1 n Corollary 2.3]. This implies that the right hand side of Eq.
(≤b) 1(cid:104)I(M;Yn|M )+I(M;Zn|M )−I(M;Zn|M )(cid:105) (12b) is maximized by setting K1 = k1∗. Using this result,
n 1 c c c we can upper-bound Eq. (12b) as follows:
+γ ((cid:15) )
1 n
1 (cid:88)n (cid:104) R0+R1 ≤I(V1;Y1|UK1)−I(V1;Z|UK1)+I(V;Z|U)
= I(M;Y |M Yi−1)+I(M;Z |M Z˜i+1)
n 1i c 1 i c (=a)I(V1;Y |UK1)+I(K1;Z|U)−I(K1;Z|V)
i=1 1
(cid:105)
−I(M;Zi|McZ˜i+1) +γ1((cid:15)n) (≤b)I(V1;Y1|U,K1 =k1∗)+I(K1 =k1∗;Z|U)
(=c) 1 (cid:88)n (cid:104)I(M;Y |M Yi−1Z˜i+1)+I(M;Z |M Z˜i+1) −I(K1 =k1∗;Z|V)
n i=1 1i c 1 i c (=c)I(V1∗;Y1|U)
(cid:105)
−I(M;Z |M Yi−1Z˜i+1) +γ ((cid:15) ) (d)
i c 1 1 n ≤ I(X;Y |U), (14)
1
1 (cid:88)n (cid:104)
= I(V1;Y |U K1)−I(V1;Z |U K1)
n i 1i i i i i i i where (a) follows by the mutual information chain rule;
i=1 (b) follows because setting K1 = k1∗ maximizes the right
(cid:105)
+I(Vi;Zi|Ui) +γ1((cid:15)n), (10) hand side of Eq. (12b); (c) follows because I(k1∗;Z|U) and
I(k1∗;Z|V) vanish for a fixed realization of K1 =k1∗; while
where (a) follows from (7); (b) follows as I(M;Yn1|Mc) ≥ (d) follows from the data processing inequality and the fact
I(M0M1;Yn1|M2Mc) and (c) follows by the Csisza´r sum that U−V1∗−X−(Y1,Y2,Z) forms a Markov chain, which
identity[15,Lemma7].IfweuseEq.(8)andfollowtheexact implies that I(V1∗;Y |U)≤I(X;Y |U).
1 1
same steps, we can derive a similar bound for the sum of the Now,IfweapplythesamestepsandideastoEq.(12c),we
private rates (R0+R2) intended for receiver Y2 as follows: can derive the following bound:
R +R ≤ 1 (cid:88)n (cid:104)I(V2;Y |U K2)−I(V2;Z |U K2) R0+R2 ≤I(V2∗;Y2|U)
0 2 n i=1 i 2i i i i i i i ≤I(X;Y2|U), (15)
(cid:105)
+I(V ;Z |U ) +γ ((cid:15) ). (11)
i i i 2 n whereU−V2∗−X−(Y ,Y ,Z)formsaMarkovchainand
1 2
Now using (9), (10) and (11) followed by introduc- V2∗ is distributed as Q(v2|u,k2 = k2∗) such that, k2∗ is the
ing a time sharing random variable T independent of value of K2 that maximizes the difference I(V2;Y2|U,K2 =
all others and uniformly distributed over 1;n , and let k2)−I(V2;Z|U,K2 =k2). At this point we need to illustrate
U=(U ,T), K1 =K1, K2 =K2, V=V(cid:74) , (cid:75)V1 =V1, an important fact. One might argue that getting rid of the
T T T T T
V2 =V2, Y =Y , Y =Y and Z=Z , then take the two conditional random variables K1 and K2 as we did, can
T 1 1T 2 2T T
limit as n → ∞ such that, γ ((cid:15) ), γ ((cid:15) ) and γ ((cid:15) ) → 0, not be done simultaneously because K1 and K2 might be
c n 1 n 2 n
we reach the following dependent, such that the maximizing values k1∗ and k2∗ can
notoccurconcurrently.However,thisargumentdoesnotaffect
R ≤I(U;Z) (12a) our converse because it only implies that the derived upper
c
R +R ≤I(V1;Y |UK1)−I(V1;Z|UK1)+I(V;Z|U) bounds might not be as tight as the original ones. To finalize
0 1 1
(12b) our converse, we need to highlight the standard upper bounds
BCWITHDEGRADEDMESSAGESETSANDMESSAGECOGNITION 5
for reliable transmission thatmapseachchannelobservationattherespectivenodeand
thecognizantmessagetothecorrespondingrequiredmessages
R +R +R ≤I(X;Y )
c 0 1 1 or an error message {?}.
R +R +R ≤I(X;Y ). (16)
c 0 2 2
We assume that the messages M , M , M and M are
c 0 1 2
Now, if we combine (12a), along with (14), (15) and (16),
chosen uniformly at random and use the average error prob-
such that U−X−(Y ,Y ,Z) forms a Markov chain, we
1 2 ability in (3) to measure the reliability performance of the
reach the same region given by (5). In order to complete our code Cs. On the other hand, the secrecy performance of Cs
n n
converse, we need to point out that the cardinality argument
is measured with respect to two different criteria. These two
|U|≤|X|+2followsfromtheFenchel-Buntstrengtheningof criteria identify the level of ignorance of the eavesdropper2
the usual Carathe´odory’s theorem [31, Appendix C].
about the confidential messages M , M and M as follows:
0 1 2
Remark 2. It is important to note that, Theorem 1 implies
1. Joint Secrecy: This criterion requires the leakage of the
that the inner bound established in [7] is in fact the capacity
confidential messages of one user to the eavesdropper given
region.
the individual message of the other user to be small. For our
model, this requirement can be expressed as follows:
III. SECRECYINBCWITHDEGRADEDMESSAGESETS
ANDMESSAGECOGNITION I(M0M1;Zn|M2)≤τ1n and I(M0M2;Zn|M1)≤τ2n,
In this section, we will investigate the three-receiver BC where lim τ ,τ =0. (17)
1n 2n
with degraded message sets and message cognition under n→∞
two different secrecy constraints: joint secrecy and individual This criterion guarantees that the rate of information leaked
secrecy. We compare these two criteria by investigating their to the eavesdropper from one user is small even if the other
capacity regions for some special cases and show that the individual transmitted message is compromised. Thus, in this
individualsecrecyprovidesalargersecrecycapacitycompared scenariothelegitimatereceiversdonothavetotrusteachother.
to the joint one. In some literature, the joint secrecy criterion is defined such
that, the mutual leakage of all confidential messages to the
A. Secrecy Model and Criteria eavesdropper is small as follows:
Westartbymodifyingthemodelintroducedintheprevious I(M M M ;Zn)≤τ and lim τ =0. (18)
0 1 2 n n
section, such that the private messages M ,M and M are n→∞
0 1 2
nowconfidentialmessagesthatneedtobekeptsecretfromthe One can easily show that the definition in (17) is equivalent
eavesdropper as shown in Figure 2. Our new code is defined to the one in (18) for some τn as follows:
as follows: I(M M M ;Zn)=I(M M ;Zn|M )+I(M ;Zn)
0 1 2 0 1 2 2
Y1n (Mˆc,Mˆ0,Mˆ1) (≤a)I(M M ;Zn|M )+I(M ;Zn|M )
M2 Receiver1 0 1 2 2 1
MMM0c1 Encoder Xn Channel MY12n Receiver2 (Mˆc,Mˆ0,Mˆ2) (≤≤b)τI(M+0Mτ1;Z≤n|τM,2)+I(M0M2;Zn|M1)
M2 Zn Eavesdropper Mˆc 1n 2n n
(M0,M1,M2)Secret where(a)followsbecauseM1 andM2 areindependentwhich
impliesthatI(M ;Zn)≤I(M ;Zn|M );while(b)followsbe-
2 2 1
Fig.2. Wiretapbroadcastchannelwithdegradedmessagesetsandmessage cause I(M ;Zn|M )≤I(M M ;Zn|M ). On the other hand,
cognition if Eq. (18)2holds, i1t follows0dir2ectly tha1t I(M M ;Zn|M )≤
0 1 2
τ and I(M M ;Zn|M ) ≤ τ . However, we prefer the
n 0 2 1 n
Definition 4. A (2nRc,2nR0,2nR1,2nR2,n) code Cns for the definition in (17), because it provides a better understanding
wiretapBCwithdegradedmessagesetsandmessagecognition to the relation between the legitimate receivers and allows
consistsof:fourindependentmessagesetsMc,M0,M1 and us to interpret the immunity of the joint secrecy against
M2; a source of local randomness at the encoder R which compromised receivers.
is distributed according to Q(r); an encoding function at the
2. Individual Secrecy: This criterion requires the leakage
relay node
of the confidential messages of each user to the eavesdropper
E :Mc×M0×M1×M2×R→Xn to be small without conditioning on the confidential messages
of the others users. This requirement can be formulated as
which maps a common message m ∈ M , a confidential
c c
follows:
message triple (m ,m ,m ) ∈ M × M × M and a
0 1 2 0 1 2
realization of the local randomness r ∈ R to a codeword I(M M ;Zn)≤τ and I(M M ;Zn)≤τ , (19)
0 1 1n 0 2 2n
xn(m ,m ,m ,m ,r),andthreedecoders,oneforeachnode
c 0 1 2
where τ and τ are defined as before. Differently from the
ϕ :Yn×M →M ×M ×M ∪{?} 1n 2n
1 1 2 c 0 1 conservative constraint in (17), where different users do not
ϕ :Yn×M →M ×M ×M ∪{?}
2 2 1 c 0 2
ϕ :Zn →M ∪{?} 2Althoughthethirdreceiver(Z)ispartofourmodelandnotanexternal
3 c user,wewillrefertoitintherestofthepaperasaneavesdropper.
6 SUBMITTEDFORPUBLICATION
trust each other, this secrecy measure allows the legitimate K
receivers to cooperate in protecting their messages against M X Mˆ
eavesdropping. In some literatures the individual secrecy cri- M1,M2 Encoder Decoder Mˆ1,Mˆ2
terion requires the sum of the leakages of each confidential
MSecret
message to the eavesdropper to be small as: Eavesdropper
M1,M2Secret
I(M ;Zn)+I(M ;Zn)+I(M ;Zn)≤τ . (20)
0 1 2 n Fig.3. Shannon’sCipherSystem
However, this definition is only equivalent to the one in (19)
if M = ∅, but in general they are not the same. In fact, the
0
constraint in (19) is stronger than this one. This is because condition because secret keys are usually shorter than the
Eq. (19) directly implies Eq. (20), while the opposite is not message. Now assume that we have a secret key such that
correct. The difference between these two definitions is in the H(K)= 1H(M).Wecanconstructthefollowingcodingstrat-
2
interpretation of the word individual. In (19), individuality egy. First, we divide M into two messages M and M ,
1 2
means different transmission flows, while in (20) it means suchthatH(M )=H(M )=H(K).Wethenconstructanew
1 2
different confidential messages. In this paper, we will use the secret key K˜ by concatenating K and M . Now the encoder
1
individual secrecy constraint given in (19) because it implies outputs X=M⊗K˜, which is equivalent to the concatenation
theotherconstraintin(20)andwethinkitismoreconvenient ofM ⊗KandM ⊗M .Thedecoderworksinthefollowing
1 2 1
and meaningful. order, it first extracts Mˆ from the first part of X by Xoring
1
it with the shared secret key K, then it use Mˆ to extract Mˆ
Definition 5. A rate quadruple (R ,R ,R ,R ) ∈ R4 1 2
c 0 1 2 + from the second part of X.
is achievable for the wiretap BC with degraded message
Usingthistechnique,wecanovercometheproblemofshort
sets and message cognition, if there exist a sequence of
secret key, however we need to understand the drawbacks of
(2nRc,2nR0,2nR1,2nR2,n) codes Cs and three sequences
n such technique. Aside form the problem of error progression
(cid:15) ,τ ,τ , where n is large enough, such that
n 1n 2n that arises form using the estimated Mˆ to decode M ,
1 2
P (C )≤(cid:15) , lim (cid:15) ,τ ,τ =0. (21) this technique does not fulfill the secrecy constraint in (22).
e n n n 1n 2n
n→∞
However, it fulfill the following individual secrecy constraint:
anddependingontheselectedsecrecycriterion,theconditions
in (17) or (19) are fulfilled. I(M1;X)+I(M2;X)=0. (23)
Remark 3. It is worth mentioning that the previous definition In general, we can extend this coding technique for short
and the requirements of the joint and individual secrecy keys with smaller entropy by dividing the message M into
criteria use the notation of strong secrecy [32,33], where the smaller messages of the same entropy as the given key as
intuition is to have the total amount of information leaked to M = (cid:81)L M . We can show that, the previous technique
i=1 i
the eavesdropper to be small. grantsacertainsecrecylevelsuchthat,thesumoftheleakage
of the small messages to the eavesdropper is small.
Remark 4. It is important to note how our model generalize
The difference between the two secrecy measures in the
different works on the wiretap BC with more than one legiti-
previous example is related to how to address the secrecy of
mate receiver as follows:
information transmitted to a single user; whether it should be
• If we let M = M = ∅, our model reduces to the
1 2 protected as a one big entity or it can be divided into smaller
three receivers BC with common and confidential messages
parts, where each part is protected separately. This issue is
investigated in [20].
identical to the problem of identifying the individual secrecy
• If we let M = M = ∅, our model reduces to the and whether individuality means different users or different
c 0
wiretap BC with receiver side information. This channel was messages. That is why, we preferred the individual secrecy
investigated under the joint secrecy constraint in [1,26] and constraint in (19) because it requires the whole information
under the individual secrecy constraint in [1,27]. transmittedtoacertainusertobeprotectedasonebigentity.In
ouropinion,thisisamoreconsistentandmeaningfulnotation.
B. Individual Secrecy in Shannon’s Ciphering System
C. Secrecy Capacity Regions: Joint Vs Individual
In this subsection, we will use Shannon’s ciphering system
to show why addressing individual secrecy with respect to In this subsection, we will try to highlight the differences
different messages might be misleading, and that it is more betweenthejointandtheindividualsecrecycriteria.Todoso,
consistent to interpret individuality with respect to different we will compare the secrecy capacity region of both criteria
transmission flows. We consider the scenario given by Fig- for some special cases. Before we discuss these results, we
ure3.Shannonstudiedthismodelunderthefollowingsecrecy need to introduce the following lemma.
constraint:
Lemma 1. Let Q(y,z|x) be a discrete memoryless BC and
I(M;X)=0. (22)
assumethatY islessnoisythan Z.Considertwoindependent
He proved that this requirement is achieved if H(M)≤H(K), random variables M and W, such that (M,W) − Xn −
where K is the secret key shared between the transmit- (Yn,Zn) forms a Markov chain. Then the following holds:
ter and the receiver. In practical, it is hard to fulfill this I(M;Yn|W)≥I(M;Zn|W).
BCWITHDEGRADEDMESSAGESETSANDMESSAGECOGNITION 7
Proof: The proof uses a combination of standard tech- (1+τ )/n+(cid:15) R ; (c) follows from Lemma 1 because Z(cid:23)
n n 1
niques from [11,15] and is given in Appendix A for com- Y , which implies that I(M M ;Yn) − I(M M ;Zn) ≤ 0
1 1 2 1 1 2
pleteness. and (d) follows because R ≥ 1/nI(M ;Zn|M ). If we let
2 2 1
γ ((cid:15) ,τ )=(1+τ )/n+(cid:15) R and follow the same steps
2 n 2n 2n n 2
In the first scenario, we consider a class of less noisy we can derive a similar bound for R as follows:
2
wiretap BC as in Figure 2, where the eavesdropper is less
R ≤R +γ ((cid:15) ,τ ). (26)
noisy than the two legitimate receivers. We also modify the 2 1 2 n 2n
model such that, we only have the two individual confidential
Now in order to finalize our converse we need to highlight
messages M and M , without the common message M
1 2 c the standard upper bound for reliable transmission for each
and the common confidential message M . Thus, the joint
0 receiver given by:
secrecyconditionsin(17)changetoI(M ;Zn|M )≤τ and
1 2 1n
I(M ;Zn|M )≤τ , while the individual secrecy conditions R ≤I(X;Y ) and R ≤I(X;Y ). (27)
2 1 2n 1 1 2 2
in (19) change to I(M ;Zn)≤τ and I(M ;Zn)≤τ .
1 1n 2 2n
Finally,ifwetakethelimitasn→∞for(25),(26),suchthat
Theorem 2. Consider a wiretap BC with message cognition, γ ((cid:15) ,τ )andγ ((cid:15) ,τ )→0,Ourconversefortheindividual
1 n n 2 n n
wheretheeavesdropperZislessnoisythanthetwolegitimate secrecy capacity region in (24) is complete.
receivers Y1 and Y2, i.e. Z(cid:23)Y1 and Z(cid:23)Y2. Then the joint Now, we turn to the other half of the theorem that indicates
secrecy capacity region is empty, while the individual secrecy that the joint secrecy capacity region is empty if the eaves-
capacityregionisgivenbythesetofallratepairs(R1,R2)∈ dropper is less noisy than the two legitimate receivers. The
R2 that satisfy proof is based on Lemma 1 and is a direct consequence of
+
(cid:104) (cid:105) [10, Proposition 3.4] and [15] as follows:
R =R ≤min I(X;Y ),I(X;Y ) . (24)
1 2 1 2
(a) 1
Proof: We start with the individual secrecy capacity R1 ≤ nI(M1;Yn1|M2)+γ1((cid:15)n)
region. The proof of the achievability is based on interpreting
(b) 1(cid:104) (cid:105)
each individual message as a secret key for the other one. ≤ I(M ;Yn|M )−I(M ;Zn|M ) +γ ((cid:15) ,τ )
n 1 1 2 1 2 1 n n
The encoder constructs the Xored message M by Xoring the
⊗ (c)
corresponding elements of M1 and M2 as follows: ≤ γ1((cid:15)n,τn). (28)
m⊗ =m1⊗m2. where (a) follows from Fano’s inequality; (b) follows from
(17), for M = ∅; while (c) follows from Lemma 1 because
In order to transmit a message pair (m ,m ), the encoder 0
1 2 Z (cid:23) Y , which implies that I(M ;Yn|M ) ≤ I(M ;Zn|M ).
generates the sequence Xn(m⊗), then transmits it to both 1 1 1 2 1 2
Similarly, we have for R the following
receivers. The problem simplifies to a multicast problem and 2
reliable transmission is only guaranteed by the condition in
R ≤γ ((cid:15) ,τ ). (29)
2 2 n n
(24).EachlegitimatereceiverdecodestheXored messageM
⊗
then uses the side information to extract it is own message. Now if we take the limit as n → ∞ for (28), (29), such that
On the other hand, the eavesdropper can not extract any γ ((cid:15) ,τ ) and γ ((cid:15) ,τ ) → 0, we have R = R = 0. This
1 n n 2 n n 1 2
information about M and M , although it can correctly implies that the joint secrecy capacity region for this scenario
1 2
decode M , because I(M ,M )=0 and I(M ,M )=0. is empty.
⊗ ⊗ 1 ⊗ 2
Nowfortheconverse,usingLemma1,wewillshowthat,if
Remark5. ThepreviousresultwasestablishedforwiretapBC
ZislessnoisythanbothY andY ,thetworatesR andR
1 2 1 2 with receiver side information, where the legitimate receivers
are equal. Let (cid:15) and τ =max(τ ,τ ) be two sequences,
n n 1n 2n Y and Y are degraded from the eavesdropper Z in [28].
such that as n→∞, (cid:15) and τ →0, we have 1 2
n n
In the next scenario, we will continue with the previous
(a) 1
R ≤ I(M ;Yn|M )+γ ((cid:15) ) model,wherewediscussthewiretapBCinFigure2withonly
1 n 1 1 2 1 n
M and M . However, we will investigate a different class of
1 1 2
≤ nI(M1M2;Yn1)+γ1((cid:15)n) lessnoisychannels,wherethetwolegitimatereceiversY1 and
Y are less noisy than the eavesdropper Z.
(b) 1(cid:104) (cid:105) 2
≤ I(M M ;Yn)−I(M ;Zn) +γ ((cid:15) ,τ )
n 1 2 1 1 1 n n Theorem 3. Consider a wiretap BC with message cognition,
= 1(cid:104)I(M M ;Yn)−I(M M ;Zn)+I(M ;Zn|M )(cid:105) where the two legitimate receivers Y1 and Y2 are less noisy
n 1 2 1 1 2 2 1 than the eavesdropper Z, i.e. Y (cid:23)Z and Y (cid:23)Z. Then the
1 2
+γ ((cid:15) ,τ ) joint secrecy capacity region is given by the set of all rate
1 n n
(≤c) 1I(M ;Zn|M )+γ ((cid:15) ,τ ) pairs (R1,R2)∈R2+, such that
2 1 1 n n
n R ≤I(X;Y )−I(X;Z)
1 1
(d) (30)
≤ R +γ ((cid:15) ,τ ), (25) R ≤I(X;Y )−I(X;Z).
2 1 n n 2 2
where (a) follows from Fano’s inequality as γ ((cid:15) )=1/n+ While, the individual secrecy capacity region for the same
1 n
(cid:15) R ; (b) follows from (19), when M =∅ and γ ((cid:15) ,τ )= scenario is given by the set of all rate pairs (R ,R ) ∈ R2
n 1 0 1 n n 1 2 +
8 SUBMITTEDFORPUBLICATION
that satisfy following lower bounds:
(cid:104) (cid:105)
(cid:104) (cid:105) Rc ≤min I(U;Y1),I(U;Y2),I(U;Z)
R ≤min I(X;Y )−I(X;Z)+R , I(X;Y )
1 (cid:104) 1 2 1 (cid:105) (31) R0 ≤I(V;Y1|U)−I(V;Z|U)
R2 ≤min I(X;Y2)−I(X;Z)+R1 , I(X;Y2) . R0 ≤I(V;Y2|U)−I(V;Z|U). (33)
Since Y (cid:23)Y , which implies that I(U;Y )≤I(U;Y ) and
1 2 2 1
Remark 6. Since the class of less noisy channels includes I(V;Y |U)≤I(V;Y |U). Substituting these two relations in
2 1
the class of physically and stochastically degraded channels, (33) leads the achievability of the region in (32). On the
the previous theorem generalizes the secrecy capacity regions other hand, the converse follows directly using the standard
establishedin[28],forthewiretapBCwithmessagecognition, techniques in [15, Theorem 1].
where the eavesdropper is degraded from both legitimate
receivers. D. Discussion
Thepreviousexamplesareveryhelpfulinunderstandingthe
Proof: We will only give a sketch for the ideas of the
differences between the joint and individual secrecy criteria.
proof as we will present a detailed proof in the next sections
Theyalsohelpsincapturingtheadvantagesanddisadvantages
for a more general case. The achievability of the joint secrecy
of each one. This can be summarized in the following points:
regionfollowsfrom techniqueofrandom codingwithproduct
structure as in [15], while the achievability of the individual
secrecy region combines the techniques of wiretap random 1.Anycodethatsatisfiesthejointsecrecycriterionwillalso
codingalongwithShannon’sonetimepadciphersystemused satisfy the individual one as well. This advocates the fact that
in Theorem 2, where the ciphered message is used as a part the individual secrecy is a less conservative secrecy measure
of the randomization index needed for the wiretap random as compared to the joint one.
coding. This encoding scheme was first introduced in [27]. 2.Theindividualsecrecycriterionprovidesalargercapacity
On the other hand, the converse for the joint secrecy region region ascompared tothe jointone. Evenif the jointcapacity
follows using the standard techniques and procedures used region is zero, the individual criterion can provide an non
in [20] for less noisy channels. While the converse for the vanishing achievable rate. This increase in the rate comes
individualsecrecyregionfollowsbyadaptingthosetechniques from the usage of secret key encoding in addition to the
to the individual secrecy constraint. standard random wiretap encoding. That is why the value
of this increase is directly proportional with the size of the
Differentlyfromtheprevioustwoscenarios,wherethejoint
individual messages cf. (30) and (31).
and the individual secrecy criteria lead to different capacity
regions, in the next example, we will investigate a scenario 3. The joint secrecy criterion is a very conservative secrecy
where the two secrecy criteria are equivalent. Consider a measure. Even if one of the confidential messages is revealed
wiretap BC as in Figure 2, where we only have the common to the eavesdropper in a genie-aided way, the other message
message M and the common confidential message M . One is still protected as follows:
c 0
can easily conclude by comparing the requirements of the I(M ;ZnM )=I(M ;M )+I(M ;Zn|M )
1 2 1 2 1 2
jointsecrecyandtheindividualsecrecyin(17)and(19)when
M = M = ∅, that the two secrecy criteria are the same. (=a)I(M ;Zn|M )≤τ , (34)
1 2 1 2 n
Again, we will focus on a class of less noisy channels, where
where (a) follows because M and M are independent.
oneofthelegitimatereceiversislessnoisythantheotherone, 1 2
The previous equation shows that the leakage of M to the
while the relation to the eavesdropper is arbitrary. 1
eavesdropper when M is revealed to it is still small.
2
Theorem 4. The joint and individual secrecy capacity region 4. On the other hand, the individual secrecy criterion is
forthewiretapBCwithacommonmessageandoneconfiden- based on the mutual trust between the legitimate receivers.
tialmessage,ifoneofthelegitimatereceiversislessnoisythan Thus if one of the messages is compromised, this might also
theotherone(Y (cid:23)Y ),isthesetofallrates(R ,R )∈R2 affects the secrecy of the other one. In order to understand
1 2 c 0 +
that satisfy this property, imagine that in the previous two examples, M
2
was revealed to the eavesdropper as follows:
(cid:104) (cid:105)
Rc ≤min I(U;Y2),I(U;Z) I(M1;ZnM2)=H(M1)−H(M1|ZnM2). (35)
R0 ≤I(V;Y2|U)−I(V;Z|U) (32) In the first scenario, where the eavesdropper Z is less noisy
than the two legitimate receivers, the term H(M |ZnM ) will
1 2
vanish. This is because the eavesdropper can correctly decode
forsome(U,V,X),suchthatU−V−X−(Y ,Y ,Z)forms
1 2
M , then using the secret key M , it can extract M as well.
a Markov chain. Further it suffices to have |U|≤|X|+3 and ⊗ 2 1
|V|≤|X|2+4|X|+3. ThisimpliesthatM1 isfullyleakedtotheeavesdropperwhen
M is revealed to it. However, in the second scenario, the
2
Proof:Theachievabilityfollowsfromthestraightforward situation is a little bit different. This is because the term
extension of the Csisza´r-Ko¨rner results in [15], leading to the H(M |ZnM ) does not vanish, yet it is smaller than H(M ).
1 2 1
BCWITHDEGRADEDMESSAGESETSANDMESSAGECOGNITION 9
ThismeansthatapartofM isleakedtotheeavesdropperup m ∈ M by generating symbols u (m ) with i ∈ 1,n
1 c c i c
on revealing M . The size of this part depends on how much independentlyaccordingtoQ(u).Foreveryun(m ),gen(cid:74)erate(cid:75)
2 c
the eavesdropper can infer using its received signal Zn and codewords vn(m ,m,m ) for m ∈ M and m ∈ M by
0 c r r r
M . generating symbols v (m ,m,m ) independently at random
2 0i c r
5. The preference in choosing among the two secrecy according to Q(v0|ui(mc)). Next, for each v0n(mc,m,mr)
criteria is a trade of between conservative secrecy measure generate the codewords v1n(mc,m,mr,mr1,mt1) and
and a larger capacity region and the decision should always v2n(mc,m,mr,mr2,mt2) for mr1 ∈ Mr1, mr2 ∈ Mr2,
be based on whether the legitimate receivers can trust one mt1 ∈ Mt1 and mt2 ∈ Mt2 by generating symbols
another or not. v1i(mc,m,mr,mr1,mt1) and v2i(mc,m,mr,mr2,mt2)
independently at random according to Q(v |v (m ,m,m ))
1 0i c r
IV. THEJOINTSECRECYCAPACITYREGION and Q(v2|v0i(mc,m,mr)) respectively.
In this section, we investigate the joint secrecy criterion for 3. Encoder E: Given a message pair (m ,m), where
c
the general model of the wiretap BC with degraded message m = (m ,m ,m ), the transmitter chooses three random-
0 1 2
sets and message cognition given by Figure 2. ization messages m , m and m uniformly at random
r r1 r2
from the sets M , M and M respectively. Then, it
r r1 r2
finds a pair (m ,m ) such that vn(m ,m,m ,m ,m )
A. Achievable Rate Region t1 t2 1 c r r1 t1
and vn(m ,m,m ,m ,m ) are jointly typical. Finally, it
Proposition 1. Anachievablejointsecrecyrateregionforthe 2 c r r2 t2
generates a codeword xn independently at random according
wiretapBCwithdegradedmessagesetsandmessagecognition to (cid:81)n Q(x |v ,v ) and transmits it.
is given by the set of all rate quadruples (R ,R ,R ,R ) ∈ i=1 i 1i 2i
c 0 1 2
R4 that satisfy 4. First Legitimate Decoder ϕ : Given yn and its
+ 1 1
own message m , outputs (mˆ ,mˆ ,mˆ ,mˆ ); if they are
Rc ≤I(U;Z) the unique mess2ages, such thact u0n(mˆ1), rvn(mˆ ,mˆ,mˆ ),
c 0 c r
R0+R1 ≤I(V0V1;Y1|U)−I(V0V1;Z|U) v1n(mˆc,mˆ,mˆr,mˆr1,mˆt1) and y1n are jointly typical, for
R0+R2 ≤I(V0V2;Y2|U)−I(V0V2;Z|U) some (mˆr1,mˆt1) ∈ Mr1 ×Mt1, where mˆ = (mˆ0,mˆ1,m2).
R +R +R ≤I(V V ;Y )−I(V V ;Z|U) Otherwise declares an error.
c 0 1 0 1 1 0 1
Rc+R0+R2 ≤I(V0V2;Y2)−I(V0V2;Z|U) 5. Second Legitimate Decoder ϕ2: Given y2n and its
2R +R +R ≤I(V V ;Y |U)+I(V V ;Y |U) own message m1, outputs (m˜c,m˜0,m˜2,m˜r); if they are
0 1 2 0 1 1 0 2 2 the unique messages, such that un(m˜ ), vn(m˜ ,m˜,m˜ ),
−I(V1;V2|V0)−I(V0V1V2;Z|U)−I(V0;Z|U) vn(m˜ ,m˜,m˜ ,m˜ ,m˜ ) and yn are jointcly typ0ical,cfor somre
Rc+2R0+R1+R2 ≤I(V0V1;Y1)+I(V0V2;Y2|U) (m2˜r2,cm˜t2) ∈r Mr2r2 ×t2 Mt2, 2where m˜ = (m˜0,m1,m˜2).
−I(V ;V |V )−I(V V V ;Z|U)−I(V ;Z|U) Otherwise declares an error.
1 2 0 0 1 2 0
R +2R +R +R ≤I(V V ;Y |U)+I(V V ;Y ) 6. Third Eavesdropper Decoder ϕ : Given zn, outputs
c 0 1 2 0 1 1 0 2 2 3
−I(V1;V2|V0)−I(V0V1V2;Z|U)−I(V0;Z|U) mˇc; if it is the unique message, such that un(mˇc) and zn
(36) are jointly typical. Otherwise declares an error.
for random variables with joint probability distribution Q(u) 7. Reliability Analysis: We define the average error prob-
Q(v |u) Q(v ,v |v ) Q(x|v ,v ) Q(y ,y ,z|x), such that ability of this scheme as
0 1 2 0 1 2 1 2
U−V0−(V1,V2)−X−(Y1,Y2,Z)formsaMarkovchain. Pˆ (C )(cid:44)P(cid:2)(Mˆ ,Mˆ ,Mˆ ,Mˆ )(cid:54)=(M ,M ,M ,M ) or
e n c 0 1 r c 0 1 r
(M˜ ,M˜ ,M˜ ,M˜ )(cid:54)=(M ,M ,M ,M ) or Mˇ (cid:54)=M (cid:3).
c 0 2 r c 0 2 r c c
Proof:Theproofcombinestheprincipleofsuperposition
We then observe that Pˆ (C ) ≥ P (C ), cf. (3). Using the
randomcoding[15]inadditiontotheusageofMartoncoding e n e n
standard analysis of random coding we can prove that for a
for secrecy as in [20], where strong secrecy is achieved as in
sufficiently large n, with high probability Pˆ (C )≤(cid:15) if
[34–36]. e n n
1. Message sets: We consider the following sets: The set Rc ≤I(U;Z)−δn((cid:15)n)
of common messages Mc = 1,2nRc , the set of confidential Rt1+Rt2 ≥I(V1;V2|V0)+δn((cid:15)n)
icnodmivmidounalmmesessasgaegsesMM01==(cid:74)1(cid:74),12,n2Rn0R(cid:75)1,(cid:75)twaondseMts2of=con1fi,d2ennRt2ial, RR0++RR1++RRr++RRr1++RRt1 ≤≤II((VV0VV1;;YY1||UU))−−δδn(((cid:15)(cid:15)n))
three sets of randomization(cid:74)messag(cid:75)es for secrecy(cid:74) M =(cid:75) 0 2 r r2 t2 0 2 2 n n
1,2nRr , Mr1 = 1,2nRr1 and Mr2 = 1,2nRr2 , finrally Rc+R0+R1+Rr+Rr1+Rt1 ≤I(V0V1;Y1)−δn((cid:15)n)
t(cid:74)wo addi(cid:75)tional sets(cid:74)Mt1 = (cid:75)1,2nRt1 and M(cid:74) t2 = 1(cid:75),2nRt2 Rc+R0+R2+Rr+Rr2+Rt2 ≤I(V0V2;Y2)−δn((cid:15)n). (37)
needed for the construction(cid:74)of Mart(cid:75)on coding. Ad(cid:74)ditionally(cid:75)
The validity of (37) follows from the product structure of
we use M = M ×M ×M to abbreviate the set of all
0 1 2 the codebook, the full cognition of the individual messages at
confidential messages.
the legitimate receivers and the principle of indirect decoding
2. Random Codebook Cs: Fix an input distribution used in [20]. In addition, the second constraint follows due
n
Q(u,v ,v ,v ,x). Construct the codewords un(m ) for to Marton coding technique, where the summation of R
0 1 2 c t1
10 SUBMITTEDFORPUBLICATION
and R should be greater than I(V ;V |V ) to guarantee the For the converse, we start by modifying the joint secrecy
t2 1 2 0
existence of a typical pair (vn,vn). constraint in (18) to include the conditioning on the common
1 2
message. For this we need the following lemma:
8. Secrecy Analysis: Our secrecy analysis is based on
different strong secrecy techniques as in [34–36]. We start Lemma 2. Consider two independent random variables M
by identifying all the virtual channels that exist between the and W, such that H(W|Zn) ≤ α and I(M;Zn) ≤ β, where
confidential messages and the eavesdropper. Based on the α,β >0. Then, I(M;Zn|W)≤α+β holds.
codebook structure, we can define four possible channels
Proof:Theproofisbasedonthepropertiesoftheentropy
as follow: Q : V → P(Z), Q : V × V → P(Z),
1 0 2 0 1 function and is given in Appendix B for completeness.
Q : V ×V → P(Z) and Q : V ×V ×V → P(Z).
3 0 2 4 0 1 2
According to [35], in order to fulfill the joint strong secrecy
Since Eq. (6) implies that H(M |Zn) ≤ nγ ((cid:15) ) and Eq.
criterionin(18),weneedtomakesurethattherandomization c c n
(18) implies that I(M M M ;Zn) ≤ τ , we can use the
rate in the input sequence to each of these virtual channels 0 1 2 n
previous lemma to reformulate the joint secrecy constraint for
is at least equivalent to the mutual information between the
our scenario as:
channel input and the eavesdropper. Thus, for a sufficiently
large n and τn >0, the joint secrecy constraints given in (18) I(M0M1M2;Zn|Mc)≤nγc((cid:15)n)+τn. (40)
is with high probability smaller than τ , if
n
Now, we are ready to formulate our converse. First, we
Rr ≥I(V0;Z|U)+δn(τn) let Ui (cid:44) (Mc,Z˜i+1), K1i (cid:44) Y1i−1, K2i (cid:44) Y2i−1, M(cid:44)
Rr+Rr1 +Rt1 ≥I(V0V1;Z|U)+δn(τn) (M0,M1,M2), Vi1 (cid:44)(M,Ui,K1i) and Vi2 (cid:44)(M,Ui,K2i). We
R +R +R ≥I(V V ;Z|U)+δ (τ ) then start by considering the common rate Rc, applying the
r r2 t2 0 2 n n same steps used in (9), we have
R +R +R ≥I(V V V ;Z|U)+δ (τ ). (38)
r r1 r2 0 1 2 n n
n
1 (cid:88)
IfwecombineEq.(37)andEq.(38)thenapplytheFourier- R ≤ I(U ;Z )+γ ((cid:15) ). (41)
c i i c n
n
Motzkin elimination procedure, followed by taking the limit i=1
as n → ∞, which implies that δ ((cid:15) ) and δ (τ ) → 0, we
n n n n Next, we consider the confidential rates (R +R ) intended
0 1
provetheachievabilityofanyratequadruple(R ,R ,R ,R )
c 0 1 2 for the first legitimate receiver. We have
satisfying (36).
(a) 1
R +R ≤ I(M M ;Yn|M M )+γ ((cid:15) )
0 1 n 0 1 1 2 c 1 n
B. Secrecy Capacity For A Class of More Capable Channels
1
≤ I(M;Yn|M )+γ ((cid:15) )
Theorem 5. Consider a wiretap BC with degraded message n 1 c 1 n
sets and message cognition, where one of the legitimate (b) 1(cid:104) (cid:105)
≤ I(M;Yn|M )−I(M;Zn|M ) +γ ((cid:15) ,τ )
receivers Y1 is more capable than the eavesdropper Z, while n 1 c c 1 n n
the relation between the other legitimate receiver Y2 and 1 (cid:88)n (cid:104) (cid:105)
the eavesdropper Z is arbitrary. Then, the joint secrecy = n I(M;Y1i|McY1i−1)−I(M;Zi|McZ˜i+1)
capacity region is given by the set of all rate quadruples i=1
(Rc,R0,R1,R2)∈R4+ that satisfy +γ1((cid:15)n,τn)
Rc ≤I(U;Z) (=c) n1 (cid:88)n (cid:104)I(M;Y1i|McY1i−1Z˜i+1)
R0+R1 ≤I(X;Y1|U)−I(X;Z|U) i=1
(cid:105)
R +R ≤I(V;Y |U)−I(V;Z|U) −I(M;Z |M Yi−1Z˜i+1) +γ ((cid:15) ,τ )
0 2 2 i c 1 1 n n
Rc+R0+R1 ≤I(X;Y1)−I(X;Z|U) 1 (cid:88)n (cid:104) (cid:105)
Rc+R0+R2 ≤I(V;Y2)−I(V;Z|U) (39) = n I(Vi1;Y1i|UiK1i)−I(Vi1;Zi|UiK1i)
i=1
forsome(U,V,X),suchthatU−V−X−(Y ,Y ,Z)forms +γ ((cid:15) ,τ ), (42)
1 2 1 n n
a Markov chain. Further it suffices to have |U|≤|X|+3 and
|V|≤|X|2+4|X|+3. where (a) follows from (7); (b) follows from (40), where
γ ((cid:15) ,τ ) = τ /n + γ ((cid:15) ) + γ ((cid:15) ) and (c) follows by
1 n n n c n 1 n
Proof: The achievability is based on the principle of the Csisza´r sum identity [15, Lemma 7]. Following the same
indirectdecodingintroducedin[6]anditsextensiontosecrecy steps we can derive a similar bound for the confidential rates
scenarios discussed in [20]. It also follows directly from (R +R ) intended for the second legitimate receiver as:
0 2
Proposition1,bylettingV =∅,V =VandV =Xin(36).
Thisimpliesthatthefirstle2gitimate0receiverY11whichismore R +R ≤ 1 (cid:88)n (cid:104)I(V2;Y |U K2)−I(V2;Z |U K2)(cid:105)
capablethantheeavesdropperZfindsitsintendedmessagesby 0 2 n i 2i i i i i i i
i=1
direct decoding from X, while the second legitimate receiver
+γ ((cid:15) ,τ ), (43)
2 n n
Y which has no stastical advantage over the eavesdropper
2
Z finds its intended messages by indirect decoding from the whereγ ((cid:15) ,τ )=τ /n+γ ((cid:15) )+γ ((cid:15) ).Ontheotherhand,
2 n n n c n 2 n
auxiliary random variable V. ifweconsiderthesumofthecommonrateandtheconfidential