A New Wiretap Channel Model and its Strong Secrecy Capacity

TL;DR

This paper introduces a novel wiretap channel model with a flexible wiretapper access pattern, determines its strong secrecy capacity, and employs a dual secret key agreement approach to establish achievability and converse bounds.

Contribution

It proposes a new wiretap channel model encompassing classical variants and derives its strong secrecy capacity using innovative duality and probability approximation techniques.

Findings

Strong secrecy capacity is explicitly characterized.

Achievability is proved via a dual secret key agreement problem.

Converse bounds are established using Sanov's theorem.

Abstract

In this paper, a new wiretap channel model is proposed, where the legitimate transmitter and receiver communicate over a discrete memoryless channel. The wiretapper has perfect access to a fixed-length subset of the transmitted codeword symbols of her choosing. Additionally, she observes the remainder of the transmitted symbols through a discrete memoryless channel. This new model subsumes the classical wiretap channel and wiretap channel II with noisy main channel as its special cases. The strong secrecy capacity of the proposed channel model is identified. Achievability is established by solving a dual secret key agreement problem in the source model, and converting the solution to the original channel model using probability distribution approximation arguments. In the dual problem, a source encoder and decoder, who observe random sequences independent and identically distributed according to the input and output distributions of the legitimate channel in the original problem, communicate a confidential key over a public error-free channel using a single forward transmission, in the presence of a compound wiretapping source who has perfect access to the public discussion. The security of the key is guaranteed for the exponentially many possibilities of the subset chosen at wiretapper by deriving a lemma which provides a doubly-exponential convergence rate for the probability that, for a fixed choice of the subset, the key is uniform and independent from the public discussion and the wiretapping source's observation. The converse is derived by using Sanov's theorem to upper bound the secrecy capacity of the new wiretap channel model by the secrecy capacity when the tapped subset is randomly chosen by nature.

Equations

$$\mathcal{S}=\left\{S:S\subseteq [[1,n]],|S|=\mu \le n,\alpha =\frac{\mu }{n}\right\}.$$

$$Z_i^S=\{\begin{array}{l}{X}_i,i\in S\\ V_i,\text{otherwise},\end{array}$$

$$\underset{n\to \infty }{\lim }\mathbb{P}\left(\hat{M}\ne M|{\mathcal{C}}_n\right)=0\text{ Reliability},$$

$$\underset{n\to \infty }{\lim }\underset{S\in \mathcal{S}}{\max }I\left(M;{\mathbb{Z}}_S^n|{\mathcal{C}}_n\right)=0\text{Strong Secrecy},$$

$$\mathbb{V}(p_X,q_X)$$

$$\mathbb{D}(p_X||q_X)$$

$${\mathsf{C}}_s(\alpha )=\underset{U-X-YV}{\max }{\left[I(U;Y)-I(U;V)-\alpha I(U;X|V)\right]}^{+},$$

$${\mathsf{C}}_s(\alpha )=\underset{U-X-YV}{\max }{\left[I(U;Y)-\alpha I(U;X)-(1-\alpha )I(U;V)\right]}^{+},$$

$$I$$

$$=H(U)-I(U;V)-H(U|X)=I(U;X)-I(U;V),$$

$${\mathsf{C}}_s(0)=\underset{U-X-YV}{\max }{\left[I(U;Y)-I(U;V)\right]}^{+}.$$

$${\mathsf{C}}_s(\alpha )=\underset{U-X-Y}{\max }{\left[I(U;Y)-\alpha I(U;X)\right]}^{+}.$$

$${\tilde{P}}_{MC\mathbb{XY}{\mathbb{Z}}_S\hat{\mathbb{X}}}(m,c,$$

$$=p_{\mathbb{XY}{\mathbb{Z}}_S}(x,y,z)\text{mathbbm}1\{{\mathcal{B}}_{1,n}(\mathbb{X})=M\}\text{mathbbm}1\{{\mathcal{B}}_{2,n}(\mathbb{X})=C\}{\tilde{P}}_{\hat{\mathbb{X}}|\mathbb{Y}C}(\hat{x}|y,c)$$

$$={\tilde{P}}_{MC}(m,c){\tilde{P}}_{\mathbb{X}|MC}(x|m,c)p_{\mathbb{Y}{\mathbb{Z}}_S|\mathbb{X}}(y,z|x){\tilde{P}}_{\hat{\mathbb{X}}|\mathbb{Y}C}(\hat{x}|y,c).$$

$$P_{MC\mathbb{XY}{\mathbb{Z}}_S\hat{\mathbb{X}}}(m,c,x,y,z,\hat{x})=p_M^U{p}_C^U{\tilde{P}}_{\mathbb{X}|MC}(x|m,c)p_{\mathbb{Y}{\mathbb{Z}}_S|\mathbb{X}}(y,z|x){\tilde{P}}_{\hat{\mathbb{X}}|\mathbb{Y}C}(\hat{x}|y,c).$$

$${\mathcal{D}}_{\gamma }\triangleq \left\{x\in \mathcal{X}:\log \frac{1}{p_X(x)}>\gamma \right\}.$$

$${\mathbb{E}}_{\mathcal{B}}\left(\mathbb{V}\left(P_{MC},p_M^U{p}_C^U\right)\right)\le \mathbb{P}\left(X\notin {\mathcal{D}}_{\gamma }\right)+\frac{1}{2}\sqrt{\tilde{M}\tilde{C}{2}^{-\gamma }},$$

$${\mathcal{D}}_{\gamma }^S\triangleq \left\{(x,z)\in \mathcal{X}\times \mathcal{Z}:\log \frac{1}{p_{X|Z_S}(x|z)}>\gamma \right\}.$$

$${\mathbb{P}}_{\mathcal{B}}\left(\underset{S\in \mathcal{S}}{\max }\mathbb{D}\left(P_{MC{Z}_S}||p_M^U{p}_C^U{p}_{Z_S}\right)\ge \widetilde{ϵ}\right)\le |\mathcal{S}||\mathcal{Z}|\exp \left(\frac{-{ϵ}_1^2(1-\delta )2^{\gamma }}{3\tilde{M}\tilde{C}}\right),$$

$$\underset{n\to \infty }{\lim }{\mathbb{E}}_{{\mathcal{A}}^n}\left(f_{i,n}(A_n)\right)=0\text{ for all }i\in [[1,M]].$$

$$\underset{n\to \infty }{\lim }{f}_{i,n}(a_n^{\ast })=0\text{ for all }i\in [[1,M]].$$

$$\mathbb{V}(p_X,q_X)\le \mathbb{V}(p_{X,Y},q_{X,Y})$$

$$\mathbb{V}(p_X{p}_{Y|X},q_X{p}_{Y|X})=\mathbb{V}(p_X,q_X).$$

$$\mathbb{P}\left(\frac{1}{n}\sum _{i=1}^n{X}_i\le (1-ϵ)\bar{m}\right)\le \exp \left(\frac{-2{ϵ}^2{\bar{m}}^2}{b^2}n\right).$$

$$\mathbb{P}$$

$$={\mathbb{P}}_{p_X}\left(\frac{1}{n}\sum _{i=1}^n\log \frac{1}{p_X(X_i)}\le (1-{ϵ}_2)H(X)\right)$$

$$\le \exp \left(\frac{-2{ϵ}_2^{2}H(X{)}^2}{b_{\max }^2}n\right)=\exp (-{\beta }_{1}n),$$

$$\displaystyle{\mathbb{E}}_{\mathcal{B}_{n}}\big{(}{\mathbb{V}}(\tilde{P}_{MC},p_{M}^{U}p_{C}^{U})\big{)}\leq 2\exp(-\beta n),$$

$${\mathbb{E}}_{{\mathcal{B}}_n}\left(\mathbb{V}\left({\tilde{P}}_{MC\mathbb{XY}{\mathbb{Z}}_S\hat{\mathbb{X}}},P_{MC\mathbb{XY}{\mathbb{Z}}_S\hat{\mathbb{X}}}\right)\right)={\mathbb{E}}_{{\mathcal{B}}_n}\left(\mathbb{V}\left({\tilde{P}}_{MC},p_M^U{p}_C^U\right)\right)\le 2\exp (-\beta n).$$

$$\underset{n\to \infty }{\lim }{\mathbb{E}}_{{\mathcal{B}}_n}\left({\mathbb{P}}_{\tilde{P}}(\hat{\mathbb{X}}\ne \mathbb{X})\right)=0.$$

$${\mathbb{E}}_{{\mathcal{B}}_n}$$

$$={\mathbb{E}}_{{\mathcal{B}}_n}\sum _{\begin{array}{c}m,c,x,y,z,\hat{x}:\\ \tilde{P}(m,c,x,y,z,\hat{x})>\tilde{P}(m,c,x,y,z)\text{mathbbm}1\{\hat{x}=x\}\end{array}}\left[\tilde{P}(m,c,x,y,z,x)-\tilde{P}(m,c,x,y,z)\text{mathbbm}1\{\hat{x}=x\}\right]$$

$$={\mathbb{E}}_{{\mathcal{B}}_n}\sum _{m,c,x,y,z,\hat{x}:\hat{x}\ne x}\tilde{P}(m,c,x,y,z,x)={\mathbb{E}}_{{\mathcal{B}}_n}\left({\mathbb{P}}_{\tilde{P}}(\hat{\mathbb{X}}\ne \mathbb{X})\right).$$

$$\underset{n\to \infty }{\lim }{\mathbb{E}}_{{\mathcal{B}}_n}\left(\mathbb{V}\left({\tilde{P}}_{MC\mathbb{XY}{\mathbb{Z}}_S\hat{\mathbb{X}}},{\tilde{P}}_{MC\mathbb{XY}{\mathbb{Z}}_S}\text{mathbbm}1\{\hat{\mathbb{X}}=\mathbb{X}\}\right)\right)=0,$$

Full text

I Introduction

Wyner’s wiretap channel models a legitimate transmitter and a receiver communicating over a discrete memoryless channel (DMC), referred to as the main channel, in the presence of a passive wiretapper who only listens to the transmitted signal through a cascaded second DMC, referred to as the wiretapper channel **[1]**. Subsequently, reference **[2]** has generalized Wyner’s wiretap channel model to a general, not necessarily degraded, discrete memoryless wiretap channel. Later, Ozarow and Wyner, in reference **[3]**, have introduced the wiretap channel II model, which considers a noiseless main channel and a binary erasure channel to the wiretapper, where the wiretapper is able to select the positions of erasures. Interestingly, using random partitioning and combinatorial arguments, reference **[3]** has showed that the secrecy capacity for this channel is equal to that if the wiretapper is a passive observer unable to choose the positions of the erasures, thus demonstrating the ability of coding to neutralize this more powerful wiretapper.

While considerable research on code design for secure communication followed the randomized coset coding of **[3]**, see for example **[4, 5, 6]**, the idea of the wiretap channel II remained linked to the assumption of a noiseless main channel for several decades, mainly due to technical challenges in generalizing the model outside of this special model. Yet, the notion of providing the wiretapper with this additional capability of choosing what to observe is appealing and represents a positive step towards providing confidentiality guarantees in stronger attack models. Towards this end, reference **[7]** introduced a discrete memoryless (noisy) main channel to the wiretap channel II model, and derived outer and inner bounds for the capacity-equivocation region of the model, where the proposed achievability scheme is optimal for the special case of the maximizing input distribution being uniform. More recently, reference **[8]** found the secrecy capacity of this model, showing that, once again, the secrecy capacity is equal to that of the case when the wiretapper channel is replaced with a discrete memoryless erasure channel.

This work goes one step further and introduces a new wiretap channel model with a discrete memoryless main channel and a wiretapper who observes a subset of the transmitted codeword symbols of her choosing perfectly, as well as observing the remaining symbols through a second DMC. This general model includes as special cases both the classical wiretap channel in **[2]** by setting the subset size to zero, and the wiretap channel II with a noisy main channel in **[7]** by setting the wiretapper’s DMC to an erasure channel with erasure probability one. We characterize the strong secrecy capacity for the proposed wiretap channel model, quantifying precisely the cost in secrecy capacity due to the additional capability at the wiretapper, with respect to the previous wiretap models.

We first present the achievability. Recent independent work **[8]** has provided an achievability proof for the channel model considered in **[7]** using a stronger version of Wyner’s soft covering lemma **[9]**. Extending the achievability proof in **[8]** to the new wiretap channel model is challenging due to the additional noisy observations at the wiretapper, since the aforementioned lemma entails approximating the distribution of the wiretapper channel output with an independent and identically distributed (i.i.d.) $n$-letter distribution. Instead, we establish the achievability by a framework similar to the output statistics of random binning framework in **[10]**. In particular, we solve a dual secret key agreement problem in the source model sense **[11, 12]**, and infer the design for the encoder and decoder of the original channel model from the solution of the dual problem. The difference between our achievability proof and the framework presented in **[10]** is that we measure the statistical dependence between the transmitted message and the wiretapper’s observation in terms of the Kullback-Leibler (K-L) divergence instead of total variation distance, which requires establishing a convergence result, with a rate strictly faster than $\frac{1}{n}$, for the probability that the two induced distributions from the original and the dual models are close in the total variation distance sense. In addition, in the source model, we guarantee the secrecy of the confidential key for the exponentially many possibilities of the subset chosen at the wiretapper by deriving a one-shot result which provides a doubly-exponential convergence rate for the probability that the key is uniform and independent from the wiretapper’s observation. To summarize, the main advantage of working with the appropriate dual source coding problem is that it renders the analysis of the scenario at hand tractable.

The converse is derived by identifying a channel model whose secrecy capacity is identical to that of the proposed channel model, and is easier to establish the converse of. This is done by means of upper bounding its secrecy capacity with that of a discrete memoryless channel whose secrecy capacity is tractable.

The remainder of the paper is organized as follows. Section II describes the new wiretap channel model. Section III provides the main result of the paper, i.e., the strong secrecy capacity for the new wiretap channel. Sections IV and V provide the achievability and converse proofs. Section VII concludes the paper. The proofs for the supporting lemmas are provided in the Appendices.

II Channel Model and Definitions

We first remark the notation we use throughout the paper. Vectors are denoted by bold lower-case super-scripted letters while their components are denoted by lower-case sub-scripted letters. A similar convention but with upper-case letters is used for random vectors and their components. Vector superscripts are omitted when dimensions are clear from the context. We use $\mathbbm{1}\{\mathcal{A}\}$ to denote the indicator function of the event $\mathcal{A}$. For $a,b\in\mathbb{R}$, $\llbracket a,b\rrbracket$ denotes the set of integers $\{i\in\mathbb{N}:a\leq i\leq b\}$. For $S\subseteq\mathbb{N}$, ${\bf{X}}_{S}$ denotes the sequence $\{X_{i}\}_{i\in S}$. We use upper-case letters to denote random probability distributions, e.g., $P_{X}$, and lower-case letters to denote deterministic probability distributions, e.g., $p_{X}$. We use $p_{X}^{U}$ to denote a uniform distribution over the random variable $X$. The argument of the probability distribution is omitted when it is clear from its subscript. ${\mathbb{V}}(p_{X},q_{X})$ and ${\mathbb{D}}(p_{X}||q_{X})$ denote the total variation distance and the Kullback-Leibler (K-L) divergence between the probability distributions $p_{X}$ and $q_{X}$.

We consider the channel model illustrated in Figure 1. The main channel $\left\{\mathcal{X},\mathcal{Y},p_{Y|X}\right\}$ is a discrete memoryless channel (DMC) which consists of a finite input alphabet $\mathcal{X}$, a finite output alphabet $\mathcal{Y}$, and a transition probability $p_{Y|X}.$ The transmitter wishes to transmit a message $M$, uniformly distributed over $\mathcal{M}=\llbracket 1,2^{nR_{s}}\rrbracket$, to the legitimate receiver reliably, and to keep the message secret from the wiretapper. To do so, the transmitter maps the message $M$ to the transmitted codeword $\mathbb{X}^{n}\in\mathcal{X}^{n}$ using a stochastic encoder. The legitimate receiver observes $\mathbb{Y}^{n}\in\mathcal{Y}^{n}$ and maps its observation to the estimate $\hat{M}$ of the message $M$. The wiretapper chooses a subset $S\in\mathcal{S}$ where the set $\mathcal{S}$ is defined as

[TABLE]

Then, the wiretapper observes the sequence $\mathbb{Z}_{S}^{n}=[Z_{1}^{S},Z_{2}^{S},\cdots,Z_{n}^{S}]\in{\mathcal{Z}^{n}}$, with

[TABLE]

where $\mathbb{V}^{n}=[V_{1},V_{2},\cdots,V_{n}]\in\mathcal{V}^{n}$ is the output of the DMC $p_{V|X}$ when $\mathbb{X}^{n}$ is the input, and the alphabet $\mathcal{Z}$ is given by $\mathcal{Z}=\left\{\mathcal{X}\cup\mathcal{V}\right\}$.

An $(n,2^{nR_{s}})$ code $\mathcal{C}_{n}$ for the channel model in Figure 1 consists of

1. (i)

the message set $\mathcal{M}=\llbracket 1,2^{nR_{s}}\rrbracket$, 2. (ii)

the stochastic encoder $P_{\mathbb{X}^{n}|M,\mathcal{C}_{n}}$ at the transmitter, and 3. (iii)

the decoder at legitimate receiver.

We consider the strong secrecy constraint at the wiretapper **[13, 14]**. Rate $R_{s}$ is an achievable strong secrecy rate if there exists a sequence of $(n,2^{nR_{s}})$ channel codes, $\{\mathcal{C}_{n}\}_{n\geq 1}$, such that

[TABLE]

where $\mathcal{S}$ is defined as in (1). The strong secrecy capacity, $\mathsf{C}_{s}$, is the supremum of all achievable strong secrecy rates.

Finally, we will be using the following two measures extensively in the sequel. The total variation distance between two probability distributions $p_{X}$ and $q_{X}$, defined on the same probability space, is given by

[TABLE]

The Kullback-Leibler divergence, or relative entropy, between the two distributions $p_{X}$ and $q_{X}$, defined on the same probability space, is given by

[TABLE]

III Main Result

The main result of this paper is stated in the following theorem.

Theorem 1

For $0\leq\alpha\leq 1$, the strong secrecy capacity of the new wiretap channel model in Figure 1 is given by

[TABLE]

where the maximization is over all the distributions $p_{UX}$ which satisfy the Markov chain $U-X-YV$, and the cardinality of $U$ can be restricted as $|\mathcal{U}|\leq|\mathcal{X}|$.

*Proof: *** The achievability and converse proofs for Theorem 1 are provided in Sections IV and V, respectively. ** $\blacksquare$

Remark 1

An equivalent characterization for the strong secrecy capacity of the new wiretap channel model is given by

[TABLE]

since $I(U;X|V)$ in (7) can be written as

[TABLE]

where (9) follows from the Markov chain $U-X-V$.**

Corollary 1

By setting the tapped subset by the wiretapper, $S$, to the null set, or equivalently $\alpha=0$, the secrecy capacity in (7) is equal to the secrecy capacity of the discrete memoryless wiretap channel in [2, Corollary 2], i.e.,

[TABLE]

Remark 2

Comparing (7) and (11), we observe that the secrecy cost, with respect to the classical wiretap channel, of the additional capability of the wiretapper to choose a subset of size $\alpha n$ of the codewords to access perfectly, is equal to $\alpha I(U;X|V)$.**

Corollary 2

By setting the wiretapper’s DMC through which she observes the $(1-\alpha)n$ symbols she does not choose, $p_{V|X}$, to be an erasure channel with erasure probability one, the secrecy capacity in (7) is equal to the secrecy capacity of the wiretap channel II with a noisy main channel in [8, Theorem 2], i.e.,

[TABLE]

Remark 3

Comparing (8) and (12), the secrecy cost, with respect to the wiretap channel II with a noisy main channel, of the additional capability of the wiretapper of observing $(1-\alpha)$ fraction of the codeword through the DMC $p_{V|X}$, is equal to $(1-\alpha)I(U;V)$.**

IV Achievability

We establish the achievability for Theorem 1 using an indirect approach as in **[15, 16, 10]**. We define a dual secret key agreement problem in the source model which introduces a set of random variables similar to the set of variables introduced by the original problem. The alphabets of the random variables in the original and dual problems are identical. A subset of the random variables in the dual problem are considered to have distributions identical to the distributions of the corresponding variables in the original problem. Yet, the distribution of the random variables can differ from those of the original problem due to the different dynamics in the original and dual problems. The main trick is to search for conditions such that the joint distributions of the random variables in the two problems are almost identical in the total variation distance sense. This enables converting the solution, i.e., finding an encoder and decoder which satisfy certain reliability and secrecy conditions, for the dual problem, which is more tractable, to a solution of the original problem. Duality here is an operational duality **[17]** in which the solution for the dual problem is converted to a solution for the original problem.

We first prove the achievability for the case $U=X$. We fix the input distribution $p_{X}$ and define two protocols; each of these protocols introduces a set of random variables and random vectors and induces a joint distribution over them. The first protocol, protocol A, describes a dual secret key agreement problem in which a source encoder and decoder observe random sequences independently and identically distributed (i.i.d.) according to the input and output distributions of the original channel model. The source encoder and decoder intend to communicate a confidential key via transmitting a public message over an error-free channel, in the presence of a compound wiretapping source who has perfect access to the public message and observes another random sequence whose distribution belongs to a finite class of distributions, with no prior distribution over the class. The second protocol, protocol B, describes the original channel model in Figure 1, with the addition of assuming a common randomness that is available at all terminals.

We first derive rate conditions for protocol A such that its induced distribution is close in the total variation distance sense to the induced distribution from protocol B. Then, we derive rate conditions for protocol A such that (i) the communication of the key is reliable, and that (ii) the probability of the key being uniform and independent from the public message and the wiretapping source observation converges doubly exponentially to one with the block-length. Next, we use the closeness of the two induced distributions from the two protocols to show that, under the same rate conditions for protocol B, properties (i) and (ii) hold for protocol B as well. Finally, we eliminate the assumed common randomness from protocol B by conditioning on a certain instance of the common randomness. Property (ii) for protocol B after removing the common randomness results in an achievable strong secrecy rate for the original channel model. In the following, we describe the two protocols in detail.

Protocol A (Secret key agreement in source model): The protocol is illustrated in Figure 2. The random vectors $\mathbb{X}^{n},\mathbb{Y}^{n}$ are i.i.d. according to $p_{XY}=p_{X}p_{Y|X}$, where $p_{Y|X}$ is the transition probability of the main channel in Figure 1. The source encoder observes the sequence $\mathbb{X}^{n}$ and randomly assigns (bins) it into the two bin indices $M=\mathcal{B}_{1,n}(\mathbb{X}^{n})$ and $C=\mathcal{B}_{2,n}(\mathbb{X}^{n})$, where $\mathcal{B}_{1,n}$ and $\mathcal{B}_{2,n}$ are uniformly distributed over $\llbracket 1,2^{nR_{s}}\rrbracket$ and $\llbracket 1,2^{n\tilde{R}_{s}}\rrbracket$, respectively. That is, each $\mathbb{x}^{n}\in\mathcal{X}^{n}$ is randomly and independently assigned to the indices $m\in\llbracket 1,2^{nR_{s}}\rrbracket$ and $c\in\llbracket 1,2^{n\tilde{R}_{s}}\rrbracket$. The bin index $C$ represents the public message which is transmitted over a noiseless channel to the decoder and perfectly accessed by the wiretapper. The bin index $M$ represents the confidential key to be generated at the encoder and reconstructed at the decoder. The source decoder observes $C$ and the i.i.d. sequence $\mathbb{Y}^{n}$, and outputs the estimate $\hat{\mathbb{X}}^{n}$ of $\mathbb{X}^{n}$, which in turn generates the estimate $\hat{M}$ of $M$. For any $S\in\mathcal{S}$, where $\mathcal{S}$ is defined as in (1), the wiretapper source node observes $C$ and the sequence $\mathbb{Z}_{S}^{n}$ in (2). The subset $S$ is selected by the wiretapper and her selection is unknown to the legitimate parties. Thus, the wiretapper can be represented as a compound source ${\mathbb{Z}_{S}^{n}}\triangleq\left\{\mathcal{Z},{p_{\mathbb{Z}_{S}^{n}},S\in\mathcal{S}}\right\}$ whose distribution is only known to belong to the finite class $\{p_{\mathbb{Z}_{S}^{n}}\}_{S\in\mathcal{S}}$ with no prior distribution over the class, with $|\mathcal{S}|=\binom{n}{\alpha n}\leq 2^{n}$. For $S\in\mathcal{S}$, the induced joint distribution for this protocol is

[TABLE]

Protocol B (Main problem assisted with common randomness): This protocol is defined as the channel model in Figure 1, with an addition of a common randomness $C$ that is uniform over $\llbracket 1,2^{n\tilde{R}_{s}}\rrbracket$, independent from all other variables, and known at all terminals. In fact, the assumed common randomness represents the random nature in generating the codebook, which is known at all nodes. At the end of the proof, we eliminate the assumed common randomness from the channel model in this protocol by conditioning on a certain instance of it. The encoder and decoder in this protocol are defined as in (15), i.e., $P_{\mathbb{X}|MC}=\tilde{P}_{\mathbb{X}|MC}$ and $P_{\hat{\mathbb{X}}|\mathbb{Y}C}=\tilde{P}_{\hat{\mathbb{X}}|\mathbb{Y}C}$. The induced joint distribution for this protocol is given by

[TABLE]

The induced joint distributions in (15) and (16) are random due to the random binning of $\mathbb{X}^{n}$. Note that we have ignored the random variables $\hat{M}$ from the induced joint distributions at this stage. We will introduce them later to the joint distributions as deterministic functions of the random vectors $\hat{\mathbb{X}}^{n}$, after fixing the binning functions.

The remaining steps of the proof are outlined as follows:

1. (i)

We derive a condition on the rates $R_{s}$ and $\tilde{R}_{s}$ such that the two induced joint distributions (15) and (16) are close in the total variation distance sense, when averaged over the random binning. 2. (ii)

We then use Slepian-Wolf source coding theorem **[18, 19]** to derive a condition on the rate $\tilde{R}_{s}$ such that the decoding of $\hat{\mathbb{X}}$ in protocol A is reliable. 3. (iii)

Next, for protocol A, we derive another condition on the rates $R_{s}$ and $\tilde{R}_{s}$ such that the probability, with respect to the random binning, that for any $S\in\mathcal{S}$, the messages $M$ and $C$ are uniform and independent from the wiretapper’s observation $\mathbb{Z}_{S}^{n}$, goes to one as $n$ goes to infinity, i.e., protocol A is secure. 4. (iv)

We use the closeness of the two induced distributions for the two protocols to show that the aforementioned reliability and secrecy properties hold for protocol B as well. 5. (v)

Finally, we eliminate the common randomness $C$ from the channel model in protocol B by showing that the reliability and secrecy constraints still hold when we condition on a certain instance of $C$, i.e., $C=c^{*}$.

Note that, for the secrecy constraint, we have required the independence of the assumed common random $C$ from both $M$ and $\mathbb{Z}_{S}^{n}$ so that when we condition over an instance of $C$, the independence of $M$ and $\mathbb{Z}_{S}^{n}$ is not affected. Before continuing with the proof, we state the following lemmas.

IV-A Useful Lemmas

Lemma 1 is a one-shot result, which provides an exponential decay rate for the average, over the random binning, of the total variation distance between the two induced distributions from the two protocols. We utilize this lemma to show a convergence in probability result that allows converting the secrecy property from protocol A to protocol B. A result similar to Lemma 1 was derived in **[10, Appendix A]** which does not provide the required convergence rate, hence the need for Lemma 1.

Lemma 1

Let the source $X\triangleq\{\mathcal{X},p_{X}\}$ be randomly binned into $M=\mathcal{B}_{1}(X)$ and $C=\mathcal{B}_{2}(X)$, where $\mathcal{B}_{1}$ and $\mathcal{B}_{2}$ are uniform over $\llbracket 1,\tilde{M}\rrbracket$ and $\llbracket 1,\tilde{C}\rrbracket$, respectively. Let $\mathcal{B}\triangleq\{\mathcal{B}_{1}(x),\mathcal{B}_{2}(x)\}_{x\in\mathcal{X}}$, and for $\gamma>0$, define

[TABLE]

Then, we have

[TABLE]

where $P$ is the induced distribution over $M$ and $C$.

*Proof: *** The proof is provided in Appendix A. ** $\blacksquare$

Lemma 2 below is again a one-shot result which provides a doubly-exponential decay rate for the probability of failure of achieving the secrecy property for protocol A, for a fixed choice of the subset $S$. This lemma is needed, along with the union bound, to guarantee secrecy against the exponentially many possibilities of the tapped subset $S$.

Lemma 2

Let $X\triangleq\{\mathcal{X},p_{X}\}$ and $\{Z_{S}\}\triangleq\left\{\mathcal{Z},p_{Z_{S}},S\in\mathcal{S}\right\}$ be two correlated sources with $|\mathcal{X}|,|\mathcal{Z}|$, and $|\mathcal{S}|<\infty$, where $\{Z_{S}\}_{S\in\mathcal{S}}$ is a compound source whose distribution is known to belong to the finite class $\{p_{Z_{S}}\}_{S\in\mathcal{S}}$. Let $X$ be randomly binned into the bin indices $M$ and $C$ as in Lemma 1. For $\gamma>0$ and any $S\in\mathcal{S}$, define

[TABLE]

If there exists $\delta\in\left(0,\frac{1}{2}\right)$ such that for all $S\in\mathcal{S}$, ${\mathbb{P}}_{p_{XZ_{S}}}\left((X,Z_{S})\in\mathcal{D}_{\gamma}^{S}\right)\geq 1-\delta^{2}$, then, we have, for every $\epsilon_{1}\in[0,1]$, that

[TABLE]

where $\tilde{\epsilon}=\epsilon_{1}+(\delta+\delta^{2})\log(\tilde{M}\tilde{C})+H_{b}(\delta^{2})$, $H_{b}$ is the binary entropy function, and $P$ is the induced distribution over $M,C,$ and $Z_{S}$.

*Proof: *** The proof of Lemma 2 is given in Appendix B. ** $\blacksquare$

The selection lemma below is used to show the existence of a binning realization such that both the secrecy and reliability properties hold for protocol B. It is also used to eliminate the common randomness $C$ from the channel model in protocol B.

Lemma 3

*(Selection Lemma)[20, Lemma 2.2]:

Let $A_{1},A_{2},\cdots,A_{n}$ be a sequence of random variables where $A_{n}\in\mathcal{A}^{n}$, and let $\mathcal{F}_{n}=\left\{f_{1,n},\cdots,f_{M,n}\right\}$ be a finite set of bounded functions $f_{i,n}:\mathcal{A}^{n}\mapsto\mathbb{R}^{+},\;i\in\llbracket 1,M\rrbracket$, such that $|\mathcal{F}_{n}|=M$ does not depend on $n$, and*

[TABLE]

Then, there exists a specific realization $\{a^{*}_{n}\}$ of the sequence $\{A_{n}\}$ such that

[TABLE]

The following Lemma states two properties of the total variation distance, which we utilize through the achievability proof.

Lemma 4

*(Properties of Total Variation Distance)[16, Lemmas V.1 and V.2]:

Consider the joint distributions $p_{X,Y}=p_{X}p_{Y|X}$ and $q_{X,Y}=q_{X}q_{Y|X}$, defined on the same probability space. Then, we have,*

[TABLE]

In order to apply Lemmas 1 and 2 to protocol A, we use Hoeffding’s inequality, which is stated in the following Lemma.

Lemma 5

*(Hoeffding’s Inequality) [21, Theorem 2]:

Let $X_{1},X_{2},\cdots,X_{n}$ be independent random variables with $X_{i}\in[0,b]$ for all $i\in\llbracket 1,n\rrbracket$, and let $\bar{m}=\frac{1}{n}\sum_{i=1}^{n}{\mathbb{E}}(X_{i})$. Then, for $\epsilon>0$, we have*

[TABLE]

IV-B Proof

First, we apply Lemma 1 to protocol A. In Lemma 1, set $X=\mathbb{X}^{n}$, $\tilde{M}=2^{nR_{s}}$, $\tilde{C}=2^{n\tilde{R}_{s}}$, $\mathcal{B}=\mathcal{B}_{n}=\left\{\mathcal{B}_{1,n}(\mathbb{x}),\mathcal{B}_{2,n}(\mathbb{x})\right\}_{\mathbb{x}\in\mathcal{X}^{n}}$, and $\gamma=n(1-\epsilon_{2})H(X)$, where $\epsilon_{2}>0$ and $\mathbb{X}^{n}$ is defined as in protocol A, i.e., is an i.i.d. sequence. Without loss of generality, we assume that for all $x\in\mathcal{X}$, we have $p_{X}(x)>0$. Let $p_{\rm{min}}=\min_{x\in\mathcal{X}}\;p_{X}(x)$, where the minimum exists since the input alphabet $\mathcal{X}$ is finite111If the input alphabet $\mathcal{X}$ is infinite, $\min_{x\in\mathcal{X}}\;p_{X}(x)$ might not exist. As a result, there might not be a finite upper bound on the random variables $\log\frac{1}{p_{X}(X_{i})}$. In such a case, Hoeffding inequality can not be applied.. Thus, the random variables $\log\frac{1}{p_{X}(X_{i})},i\in\llbracket 1,n\rrbracket,$ are i.i.d. and each is bounded by the interval $\left[0,b_{\rm{max}}\right]$, where $b_{\rm{max}}=\log\frac{1}{p_{{\rm{min}}}}$.

We also have that $\bar{m}=\frac{1}{n}\sum_{i=1}^{n}{\mathbb{E}}_{p_{X}}\left(\log\frac{1}{p_{X}(X_{i})}\right)=H(X)$. Using Hoeffding’s inequality in (25), we have, for any $\epsilon_{2}>0$, that

[TABLE]

where $\beta_{1}=\frac{2\epsilon_{2}^{2}H(X)^{2}}{b_{\rm{max}}^{2}}>0$.

By substituting the choices for $\tilde{M},\tilde{C},\gamma$ and (28) in (18), we have, as long as $R_{s}+\tilde{R}_{s}<(1-\epsilon_{2})H(X)$, that

[TABLE]

where $\beta_{2}=\frac{\ln 2}{2}\left((1-\epsilon_{2})H(X)-R_{s}-\tilde{R}_{S}\right)$ and $\beta=\min\{\beta_{1},\beta_{2}\}>0$. By applying (24) to (15) and (16), and using (29), we have

[TABLE]

Consider Slepian-Wolf decoder for protocol A. As long as $\tilde{R}_{s}\geq H(X|Y)$, we have **[22, Theorem 10.1]**

[TABLE]

Next, we observe

[TABLE]

Equation (33) follows because $\tilde{P}(m,c,\mathbb{x},\mathbb{y},\mathbb{z},\hat{\mathbb{x}})>\tilde{P}(m,c,\mathbb{x},\mathbb{y},\mathbb{z})\mathbbm{1}\{\hat{\mathbb{x}}=\mathbb{x}\}$ holds if and only if $\mathbbm{1}\{\hat{\mathbb{x}}=\mathbb{x}\}=0$, where $\tilde{P}(m,c,\mathbb{x},\mathbb{y},\mathbb{z},\hat{\mathbb{x}})$ factorizes as $\tilde{P}(m,c,\mathbb{x},\mathbb{y},\mathbb{z},\hat{\mathbb{x}})=\tilde{P}(m,c,\mathbb{x},\mathbb{y},\mathbb{z})\tilde{P}(\hat{\mathbb{x}}|\mathbb{y},c)$ and $\tilde{P}(\hat{\mathbb{x}}|\mathbb{y},c)\leq 1$. Thus, using (31) and (33), we have that

[TABLE]

as long as $\tilde{R}_{s}\geq H(X|Y)$.

Now, we apply Lemma 2 to protocol A. In Lemma 2, set $X=\mathbb{X}^{n}$, $\tilde{M}=2^{nR_{s}}$, $\tilde{C}=2^{n\tilde{R}_{s}}$, $\mathcal{B}=\mathcal{B}_{n}$, $Z_{S}=\mathbb{Z}_{S}^{n}$, for all $S\in\mathcal{S}$, and $\gamma=n(1-\tilde{\epsilon}_{2})(1-\alpha)H(X|V)$, where $\tilde{\epsilon}_{2}>0$ and $\mathbb{X}^{n},\mathbb{Z}_{S}^{n},\mathcal{S}$ are defined as in protocol A. In order to calculate ${\mathbb{P}}_{p_{\mathbb{X}\mathbb{Z}_{S}}}\left((\mathbb{X},\mathbb{Z}_{S})\notin\mathcal{D}_{\gamma}^{S}\right)$, we only need to consider the pairs $(\mathbb{x},\mathbb{z})$ such that $p_{\mathbb{X}|\mathbb{Z}_{S}}(\mathbb{x}|\mathbb{z})>0$, since all the pairs $(\mathbb{x},\mathbb{z})$ with $p_{\mathbb{X}|\mathbb{Z}_{S}}(\mathbb{x}|\mathbb{z})=0$ belong to $\mathcal{D}_{\gamma}^{S}$, by the definition of $\mathcal{D}_{\gamma}^{S}$ in (19). Since the sequence $\mathbb{X}$ is i.i.d. and the channel $p_{V|X}$ is memoryless, we have, for all $(\mathbb{x},\mathbb{z})$ with $p_{\mathbb{X}|\mathbb{Z}_{S}}(\mathbb{x}|\mathbb{z})>0$, that

[TABLE]

Once again, using Hoeffding’s inequality, we have, for all $S\in\mathcal{S}$,

[TABLE]

where $\beta_{2}>0$, and (38) follows from (36). From (39), ${\underset{n\rightarrow\infty}{\lim}}\delta^{2}=0$, and hence, for sufficiently large $n$ , we have $\delta^{2}\in\left(0,\frac{1}{4}\right)$. Thus, the conditions in Lemma 2 are satisfied.

Note that ${\underset{n\rightarrow\infty}{\lim}}n(\delta+\delta^{2})=0$, and ${\underset{n\rightarrow\infty}{\lim}}H_{b}(\delta^{2})=H_{b}({\underset{n\rightarrow\infty}{\lim}}\delta^{2})=0$ since $H_{b}$ is a continuous function. Thus,

[TABLE]

By substituting the choices for $\tilde{M},\tilde{C},\gamma$, and $|\mathcal{S}||\mathcal{Z}^{n}|\leq\exp\left(n\left[\ln 2+\ln\left(|\mathcal{X}|+|\mathcal{V}|\right)\right]\right)$ in (20), and using (40), we have that, for all $\epsilon_{1},\epsilon^{\prime}_{1}>0$ and $\tilde{\epsilon}=\epsilon_{1}+\epsilon_{1}^{\prime}$, there exist $n^{*}\in\mathbb{N}$ and $\phi(\epsilon_{1}),\kappa>0$ such that, for all $n\geq n^{*}$,

[TABLE]

as long as $R_{s}+\tilde{R}_{s}<(1-\tilde{\epsilon}_{2})(1-\alpha)H(X|V)$.

Take $r>0$ and let $D_{n}=\max_{S}{\mathbb{D}}(\tilde{P}_{MC\mathbb{Z}_{S}}||p_{M}^{U}p_{C}^{U}p_{\mathbb{Z}_{S}})$ and $\mathcal{K}_{n}\triangleq\left\{D_{n}\geq r\right\}$. Using (41), we have that $\sum_{n=1}^{\infty}{\mathbb{P}}_{\mathcal{B}_{n}}(\mathcal{K}_{n})<\infty$. Thus, using the first Borel-Cantelli lemma yields

[TABLE]

This implies that, for all $r>0$, ${\mathbb{P}}_{\mathcal{B}_{n}}\left(\{D_{n}<r\}\text{ i.o.}\right)=1$, i.e., the sequence $D_{n}$ converges to zero almost surely. Thus, the sequence $D_{n}$ converges to zero in probability as well. We conclude that, for $R_{s}+\tilde{R}_{s}<(1-\tilde{\epsilon}_{2})(1-\alpha)H(X|V)$, we have

[TABLE]

That is, protocol A is secure.

Next, we deduce that protocol B is also reliable and secure when $\tilde{R}_{s}\geq H(X|Y)$ and $R_{s}+\tilde{R}_{s}<(1-\tilde{\epsilon}_{2})(1-\alpha)H(X|V)$. First, we show that the reliability in (34) holds for protocol B as well. We have

[TABLE]

where (IV-B) and (IV-B) follow from the triangle inequality, and (46) follows since (15), (16) and (24) imply that

[TABLE]

Substituting (29) and (34) in (46) yields

[TABLE]

Second, we show that the secrecy property in (43) holds for protocol B. Using the union bound, we have

[TABLE]

Equation (50) follows since ${\mathbb{V}}(\tilde{P}_{MC},p_{M}^{U}p_{C}^{U})=0$ if and only if $\tilde{P}_{MC}(m,c)=p_{M}^{U}p_{C}^{U}$ for all $m$ and $c$, and hence $P_{MC\mathbb{Z}_{S}}=p_{M}^{U}p_{C}^{U}P_{\mathbb{Z}_{S}|MC}=\tilde{P}_{MC}\tilde{P}_{\mathbb{Z}_{S}|MC}=\tilde{P}_{MC\mathbb{Z}_{S}}$, where

[TABLE]

Using the exponential decay in (29) and Markov inequality, we have, for any $r>0$, that

[TABLE]

where $\beta>0$. Thus, using the Borel-Cantelli lemma, as in the derivation for (43), we have

[TABLE]

By substituting (43) and (54) in (50), we get

[TABLE]

Now, we show the existence of a binning realization, and hence an encoder and decoder, such that the reliability and secrecy properties, in (48) and (55), hold for protocol B. By applying Lemma 3 to the random sequence $\{\mathcal{B}_{n}\}_{n\geq 1}$ and the functions ${\mathbb{V}}\left(P_{MC\mathbb{X}\mathbb{Y}\mathbb{Z}_{S}\hat{\mathbb{X}}},P_{MC\mathbb{X}\mathbb{Y}\mathbb{Z}_{S}}\mathbbm{1}\{\hat{\mathbb{X}}=\mathbb{X}\}\right)$, $\mathbbm{1}\left\{\max_{S\in\mathcal{S}}{\mathbb{D}}(P_{MC\mathbb{Z}_{S}}||p_{M}^{U}p_{C}^{U}p_{\mathbb{Z}_{S}})>0\right\}$, while using (48) and (55), there exists a sequence of binning realizations $\mathbb{b}_{n}^{*}=(b_{1,n}^{*},b_{2,n}^{*})$, with a corresponding joint distribution $p^{*}$ for protocol B, such that

[TABLE]

where $M=b^{*}_{1,n}(\mathbb{X}^{n})$ and $C=b^{*}_{2,n}(\mathbb{X}^{n})$.

Next, we introduce the random variable $\hat{M}$ to the two joint distributions in (56), where $\hat{M}$ is a deterministic function of the random sequence $\hat{\mathbb{X}}^{n}$, i.e., $p^{*}_{\hat{M}|\hat{\mathbb{X}}}(\hat{m}|\hat{\mathbb{x}})=\mathbbm{1}\left\{\hat{m}=b_{1,n}^{*}(\hat{\mathbb{x}})\right\}$. Using (24) and (56), we have

[TABLE]

where (IV-B) follows since p^{*}_{\hat{M}|MC\mathbb{X}\mathbb{Y}\mathbb{Z}_{S}\hat{\mathbb{X}}}=p^{*}_{\hat{M}|\hat{\mathbb{X}}}=\mathbbm{1}\big{\{}\hat{M}=b_{1,n}^{*}(\hat{\mathbb{X}})\big{\}}, and that $\hat{M}=M$ if and only if $\hat{\mathbb{X}}=\mathbb{X}$ and $\hat{M}=b_{1,n}^{*}(\hat{\mathbb{X}})$. We then have

[TABLE]

Equation (62) follows because $p^{*}_{M\hat{M}C}>p_{M}^{U}p_{C}^{U}\mathbbm{1}\{\hat{M}=M\}$ if and only if $\mathbbm{1}\{\hat{M}=M\}=0$ where $p^{*}_{M\hat{M}C}$ factorizes as $p_{M}^{U}p_{C}^{U}p^{*}_{\hat{M}|MC}$ and $p^{*}_{\hat{M}|MC}\leq 1$, while equation (64) follows from (24) and (59).

We also have that

[TABLE]

where (IV-B) follows since \max_{S}{\mathbb{D}}\Big{(}p^{*}_{MC\mathbb{Z}_{S}^{n}}||p_{M}^{U}p_{C}^{U}p_{\mathbb{Z}_{S}}\Big{)}=0, if and only if, for all $S\in\mathcal{S}$, $p^{*}_{MC\mathbb{Z}_{S}}(m,c,\mathbb{z})=p_{M}^{U}p_{C}^{U}p_{\mathbb{Z}_{S}}(\mathbb{z})$ for all $m,c,$ and $\mathbb{z}$. (67) follows because the first probability term on the right hand side of (IV-B) is equal to zero. Thus, using (57), we get

[TABLE]

Let us express the random variable $C$ as an explicit function of $n$, i.e., $C=C_{n}=b_{2,n}^{*}(\mathbb{X}^{n})$. In order to eliminate $C_{n}$ from the channel model in protocol B, we apply Lemma 3 to the random sequence $\{C_{n}\}_{n\geq 1}$ and the functions ${\mathbb{P}}_{p^{*}}\left(\hat{M}\neq M|C_{n}\right)$, $\mathbbm{1}\left\{\max_{S\in\mathcal{S}}{\mathbb{D}}\left(p^{*}_{M\mathbb{Z}_{S}|C_{n}}||p_{M}^{U}p^{*}_{\mathbb{Z}_{S}|C_{n}}\right)>0\right\}$, while using (64) and (68), which implies that there exists at least one realization $\{c_{n}^{*}\}$ such that

[TABLE]

where $I_{p^{*}}$ is the mutual information with respect to the distribution $p^{*}$. Equation (70) follows because {\underset{n\rightarrow\infty}{\lim}}\mathbbm{1}\big{\{}\max_{S\in\mathcal{S}}{\mathbb{D}}(p^{*}_{M\mathbb{Z}_{S}|C_{n}=c_{n}^{*}}||p_{M}^{U}p^{*}_{\mathbb{Z}_{S}|C_{n}=c_{n}^{*}})>0\big{\}}=0 implies that there exists $n^{\prime}$ large enough such that, for all $n\geq n^{\prime}$, we have

[TABLE]

Finally, let $\tilde{p}^{*}$ be the induced distribution for protocol A corresponding to $\mathbb{b}_{n}^{*}$. We use $\tilde{p}^{*}_{\mathbb{X}|M,C_{n}=c_{n}^{*}}$ as the encoder and $(\tilde{p}^{*}_{\hat{\mathbb{X}}|\mathbb{Y},C_{n}=c_{n}^{*}},b_{1,n}^{*}(\hat{\mathbb{X}}))$ as the decoder for the original model. By combining the rate conditions $R_{s}+\tilde{R}_{s}<(1-\tilde{\epsilon}_{2})(1-\alpha)H(X|V)$, $\tilde{R}_{s}\geq H(X|Y)$, and taking $\tilde{\epsilon}_{2}\rightarrow 0$, the rate $R_{s}=\max_{p_{X}}[I(X;Y)-I(X;V)-\alpha H(X|V)]$ is achievable.

So far, we have considered the case $U=X$. Next, we prefix a discrete memoryless channel $p_{X|U}$ to the original channel model in Figure 1. The main channel for the new model is $p_{Y|U}$ and the wiretapper channel is described by $p_{X|U}$ and (2). The proof for this case follows similar steps to the proof above. In particular, for protocol A, we consider the i.i.d. input sequence $\mathbb{U}^{n}=[U_{1},U_{2},\cdots,U_{n}]$. When we apply Lemma 2 to protocol A, we set $\gamma=n(1-\tilde{\epsilon}_{2})[\alpha H(U|X)+(1-\alpha)H(U|V)]$, and for $p_{\mathbb{U}|\mathbb{Z}_{S}}(\mathbb{u}|\mathbb{z})>0$, we have, for any $S\in\mathcal{S}$, that

[TABLE]

where (74) and (75) follow since the sequences $\mathbb{U}^{n},\mathbb{X}^{n},$ and $\mathbb{V}^{n}$ are i.i.d. and the channels $p_{X|U}$ and $p_{V|X}$ are discrete memoryless channels. Using (75), the choice for $\gamma$, and Hoeffding’s inequality, the conditions of Lemma 2 are satisfied, and we deduce the rate condition

[TABLE]

required for secrecy of protocol A. Note that $H(U|X)=H(U|X,V)$ because of the Markov chain $U-X-V$. By combining (76) with the rate condition $\tilde{R}_{s}\geq H(U|Y)$ required for the Slepian-Wolf decoder, we obtain the achievability of (7). The cardinality bound on $\mathcal{U}$, $|\mathcal{U}|\leq|\mathcal{X}|$, follows using **[22, Appendix C]**. This completes the achievability proof of Theorem 1.

V Converse

Consider the channel model illustrated in Figure 3, where the wiretapper observes the outputs of two independent channels, with $\mathbb{X}^{n}$ being the input to both the channels. The first channel to the wiretapper is the DMC $p_{V|X}$ which outputs $\mathbb{V}^{n}$. The second channel is the wiretapper channel in the wiretap II channel model, i.e., the wiretapper chooses $S\subseteq\llbracket 1,n\rrbracket$ and observes $\tilde{\mathbb{Z}}_{S}^{n}=[\tilde{Z}_{1}^{S},\cdots,\tilde{Z}_{n}^{S}]$, where $\tilde{Z}_{i}^{S}=X_{i}$ for $i\in S$, and $\tilde{Z}_{i}^{S}=?$, i.e., erasures, otherwise.

We show that, for $0\leq\alpha\leq 1$, the strong secrecy capacity for this channel model, $\mathsf{C}_{s}^{\rm{EQ}}(\alpha)$, is equal to the strong secrecy capacity of the original channel model, $\mathsf{C}_{s}(\alpha)$, in (7). Since the main channels in the two models are the same, it suffices to show that $I(M;\mathbb{Z}_{S}^{n})=I(M;\tilde{\mathbb{Z}}_{S}^{n}\mathbb{V}^{n})$ for all $S\in\mathcal{S}$, where $\mathbb{Z}_{S}^{n}$ is defined as in (2). This follows because, for all $S\in\mathcal{S}$, we have

[TABLE]

where (79) and (84) follow because $H(M|\mathbb{X})=0$, and (82) follows since the channel $p_{V|X}$ is memoryless which results in the Markov chains $\mathbb{X}_{S^{c}}-\mathbb{X}_{S}\mathbb{V}_{S^{c}}-\mathbb{V}_{S}$ and $\mathbb{X}_{S^{c}}-M\mathbb{X}_{S}\mathbb{V}_{S^{c}}-\mathbb{V}_{S}$.

Next, consider the channel model illustrated in Figure 4, which is the same as the channel model in Figure 3, except we replace the second channel to the wiretapper with a discrete memoryless erasure channel (DM-EC) with erasure probability $1-\alpha$. The output of the second channel to the wiretapper is $\mathbb{Z}^{n}$. For this model, we have the Markov chain $\mathbb{V}^{n}-\mathbb{X}^{n}-\mathbb{Z}^{n}$ since the two channels to the wiretapper are independent. Since the two channels to the wiretapper are discrete memoryless, we have

[TABLE]

That is, the combined channel to the wiretapper is a discrete memoryless channel, making the channel model in Figure 4 a discrete memoryless wiretap channel. The strong secrecy capacity for this model $\mathsf{C}_{s}^{{\rm{EQ2}}}(\alpha)$ is given by

[TABLE]

In order to compute $\mathsf{C}_{s}^{{\rm{EQ2}}}(\alpha)$ in (86), we define the random variable $\Phi\sim{\rm{Bern}}(\alpha)$ whose $n$ i.i.d. samples represent the erasure process in the DM-EC, where $\Phi=0$ when $Z=X$ and $\Phi=1$ when $Z=?$. Thus, $\Phi$ is determined by $Z$, and hence, the Markov chains $U-X-YVZ$ and $V-X-Z$ imply the Markov chains $U-X-YVZ\Phi$ and $V-X-Z\Phi$. Also, $\Phi$ is independent from $X$, since the erasure process is independent from the input to the channel. Thus, we have

[TABLE]

where (V) and (V) follow since $p_{\Phi|XUV}=p_{\Phi|XV}=p_{\Phi|X}=p_{\Phi}$ due to the Markov chains $U-XV-\Phi$ and $V-X-\Phi$, and the independence of $\Phi$ and $X$. Since $p_{\Phi|UV}=p_{\Phi|V}=p_{\Phi}$, then $\Phi$ and $U$ are conditionally independent given $V$. Thus, we have

[TABLE]

Substituting (91) in (86), we have

[TABLE]

Next, we use similar arguments to **[8, Section V-C]** to show that $\mathsf{C}_{s}^{{\rm{EQ}}}(\alpha)\leq\mathsf{C}_{s}^{{\rm{EQ2}}}(\alpha)$ for any $0\leq\alpha\leq 1$ and sufficiently large $n$. The idea is that when the number of erasures of the DM-EC in the latter channel model (Figure 4) is greater than or equal to $(1-\alpha)n$, the wiretapper’s channel in the former (Figure 3) is better than her channel in the latter, since the wiretapper in the former is more capable and encounters a smaller number of erasures. Thus, $\mathsf{C}_{s}^{{\rm{EQ}}}(\alpha)\leq\mathsf{C}_{s}^{{\rm{EQ2}}}(\alpha)$ for this case. The result is established by using Sanov’s theorem in method of types **[23, Theorem 11.4.1]** to show that the probability that the DM-EC causes erasures less than $(1-\alpha)n$ goes to [math] as $n\rightarrow\infty$.

In particular, we first show that, for $0\leq\lambda<\alpha\leq 1$, we have $\mathsf{C}_{s}^{{\rm{EQ}}}(\alpha)\leq\mathsf{C}_{s}^{{\rm{EQ2}}}(\lambda)$. To do so, we show that every achievable strong secrecy rate for the channel model in Figure 3 is also achievable for the channel model in Figure 4. Fix $\lambda$ such that $0\leq\lambda<\alpha\leq 1$, and let $R_{s}$ be an achievable strong secrecy rate for the former channel model. Thus, there exists a sequence of $(n,2^{nR_{S}})$ channel codes $\left\{\mathcal{C}_{n}^{\rm{EQ}}\right\}_{n\geq 1}$ such that

[TABLE]

We show that the rate $R_{s}$ is also an achievable strong secrecy rate for the channel model in Figure 4 by showing that the sequence of $(n,2^{nR_{s}})$ codes $\left\{\mathcal{C}_{n}^{\rm{EQ}}\right\}_{n\geq 1}$ satisfies the constraints ${\underset{n\rightarrow\infty}{\lim}}{\mathbb{P}}\left(\hat{M}\neq M|\mathcal{C}_{n}^{\rm{EQ}}\right)=0$ and ${\underset{n\rightarrow\infty}{\lim}}\max_{S\in\mathcal{S}}I\left(M;\mathbb{Z},\mathbb{V}|\mathcal{C}_{n}^{\rm{EQ}}\right)=0$ for this channel model.

The main channel in the two models is the same, and hence, the sequence of $(n,2^{nR_{s}})$ codes $\left\{\mathcal{C}_{n}^{\rm{EQ}}\right\}_{n\geq 1}$ achieves the reliability constraint for both channel models. Thus, it remains to show that $\left\{\mathcal{C}_{n}^{\rm{EQ}}\right\}_{n\geq 1}$ achieves ${\underset{n\rightarrow\infty}{\lim}}\max_{S\in\mathcal{S}}I\left(M;\mathbb{Z},\mathbb{V}|\mathcal{C}_{n}^{\rm{EQ}}\right)=0$.

Since ${\underset{n\rightarrow\infty}{\lim}}\max_{S\in\mathcal{S}}I(M;\tilde{\mathbb{Z}}_{S},\mathbb{V})=0$, then for any $\epsilon_{0}>0$, there exists $n_{0}\in\mathbb{N}$ such that for all $n\geq n_{0}$, we have

[TABLE]

Let us define $\tilde{\mathcal{Z}}=\mathcal{X}\cup\{?\}$. For every $\mathbb{z}^{n}\in\tilde{\mathcal{Z}}^{n}$, define

[TABLE]

That is, $\mathcal{N}(\mathbb{z}^{n})$ represents the number of erasures in the sequence $\mathbb{z}^{n}$, while $\Theta(\mathbb{z}^{n})$ indicates whether the sequence $\mathbb{z}^{n}$ has erasures less than or equal to $\lceil(1-\alpha)n\rceil$.

For simplicity of notation, we drop $\mathcal{C}_{n}^{\rm{EQ}}$ from the conditioning in (94); it is understood implicitly that the mutual information is calculated with respect to the code $\mathcal{C}_{n}^{\rm{EQ}}$. Since $\Theta(\mathbb{Z}^{n})$ is a deterministic function of $\mathbb{Z}^{n}$, the Markov chains $M-\mathbb{X}^{n}-\mathbb{V}^{n}\mathbb{Z}^{n}$ and $M\mathbb{V}^{n}-\mathbb{X}^{n}-\mathbb{Z}^{n}$ imply the Markov chains $M-\mathbb{X}^{n}-\mathbb{V}^{n}\mathbb{Z}^{n}\Theta(\mathbb{Z}^{n})$ and $M\mathbb{V}^{n}-\mathbb{X}^{n}-\mathbb{Z}^{n}\Theta(\mathbb{Z}^{n})$. Also, $\Theta(\mathbb{Z}^{n})$ is independent from $\mathbb{X}^{n}$. Thus, we have

[TABLE]

From (V) and (V), $M$ and $\Theta(\mathbb{Z})$ are conditionally independent given $\mathbb{V}^{n}$, and hence,

[TABLE]

We upper bound each term in the right hand side of (102). The first term is upper bounded by

[TABLE]

We also have that

[TABLE]

Next we upper bound ${\mathbb{P}}(\Theta(\mathbb{Z})=1)$. Take $\nu$ such that $\lambda<\nu<\alpha$, and hence, we have $\lceil(1-\alpha)n\rceil\leq(1-\nu)n<(1-\lambda)n$. Let $\Phi_{1},\Phi_{2},\cdots,\Phi_{n}$ be a sequence of i.i.d. binary random variables which represents the erasure process of the DM-EC in the model in Figure 4 ($\Phi_{i}=1$* if $Z_{i}=X_{i}$, and $\Phi_{i}=0$ if $Z_{i}=?$), where $\Phi_{i}$ is distributed according to $Q_{\Phi}={\rm{Bern}}(\lambda)$. Let $Q_{\Phi}^{n}$ be the $n$-letter distribution of the sequence $\{\Phi_{i}\}_{i=1}^{n}$. For each $\xi=\frac{l}{n}$, with $l\in\llbracket\lceil\nu n\rceil,n\rrbracket$, i.e., $\nu\leq\xi<1$, define the distribution $P_{\Phi}^{(\xi)}={\rm{Bern}}(\xi)$, and let $\mathcal{P}$ be the set of all of these distributions. Let $T(P)$ denote the type class of the distribution $P$, i.e., all possible $n$-length sequences with the type (empirical distribution) $P$ [23, Section 11.1]. Define the set $\mathcal{T}\triangleq\left\{T(P_{\Phi}^{(\xi)}):(1-\xi)\leq(1-\nu)\right\}$. Using Sanov’s theorem [23, Theorem 11.4.1], we have*

[TABLE]

where

[TABLE]

Note that ${\mathbb{D}}(P_{\Phi}^{*}||Q_{\Phi})>0$ since $\nu\neq\lambda$.

Using (106) and (110), the second term in the right hand side of (102) is upper bounded by

[TABLE]

Thus, for $\epsilon_{0}>0$, there exists $n_{1}\in\mathbb{N}$ such that, for all $n\geq n_{1}$,

[TABLE]

Using (94), (102), (105), and (113), we have, for sufficiently large $n$, that

[TABLE]

Thus, for $0\leq\lambda<\alpha\leq 1$, we have $\mathsf{C}_{s}^{\rm{EQ}}(\alpha)\leq\mathsf{C}_{s}^{\rm{EQ2}}(\lambda)$. The right hand side of (92) is a continuous function of $\alpha$, for $0<\alpha<1$ **[8, Lemma 6]**. Thus, by taking $\lambda\rightarrow\alpha$, we have $\mathsf{C}_{s}^{\rm{EQ}}(\alpha)\leq\mathsf{C}_{s}^{\rm{EQ2}}(\alpha)$. Note that for $\alpha=0,1,$ we have $\mathsf{C}_{s}^{\rm{EQ}}(\alpha)=\mathsf{C}_{s}^{\rm{EQ2}}(\alpha)$. Thus, the secrecy capacity of the original model in Figure 1 is upper bounded by (92). This completes the proof for Theorem 1.

VI Discussion

In the converse proof for Theorem 1, we have shown that the strong secrecy capacity $\mathsf{C}_{s}(\alpha)$ for the new wiretap channel model is equal to the strong secrecy capacity when the wiretapper, in addition to observing $\mu$ transmitted symbols of her choice noiselessly, observes the whole sequence $\mathbb{V}^{n}$. This is not surprising because observing noisy versions of the transmitted symbols through the DMC $p_{V|X}$ in the positions where noiseless versions are available does not increase the wiretapper’s information about the message. The expression for the strong secrecy capacity of the new wiretap channel model in (7) is thus intuitive where $I(U,V)$ represents the secrecy cost due to observing the whole sequence $\mathbb{V}^{n}$, and $\alpha I(U;X|V)$ represents the secrecy cost due to observing a fraction $\alpha$ of the transmitted symbols noiselessly, given the wiretapper’s knowledge of the $V$ outputs in these positions. Furthermore, the alternative characterization for the strong secrecy capacity of the new wiretap channel model in (8) is again intuitively pleasing, where the overall secrecy cost is represented by a weighted sum of the secrecy costs due to the noiseless and the noisy observations at the wiretapper, i.e., $\alpha I(U;X)$ and $(1-\alpha)I(U;V)$.

VII Conclusion

In this work, we have introduced a new wiretap channel model and derived its strong secrecy capacity. This model generalizes the classical wiretap channel **[1, 2]** to one with a wiretapper who chooses a fixed-length subset of the transmitted codeword symbols to perfectly access, and generalizes the wiretap channel II with a discrete memoryless main channel in **[7]** to one with a wiretapper who observes the output of a noisy channel instead of the erasures. The wiretapper in this model is still passive, yet she is more capable than a classical wiretapper since she can tap a subset of the symbols of her choosing noiselessly, while still receiving the remaining symbols through a channel. Our secrecy capacity result quantifies the secrecy cost of this additional capability of the wiretapper, with respect to the previous wiretap channel models.

As for future directions, exploring the multi-terminal extensions of this new model is the natural next step, similar to multi-terminal extensions for Wyner’s original model, e.g., **[24, 25, 26, 27, 28, 29]**. Additionally, it is of interest to seek new and more powerful wiretapper models against which information theoretic security guarantees can be established.

Appendix A Proof of Lemma 1

For $m,c\in\llbracket 1,\tilde{M}\rrbracket\times\llbracket 1,\tilde{C}\rrbracket$, we have

[TABLE]

We also have that, for all $x\in\mathcal{X}$,

[TABLE]

Thus, we have ${\mathbb{E}}_{\mathcal{B}}({P}_{MC})=\frac{1}{\tilde{M}\tilde{C}}=p_{M}^{U}p_{C}^{U}$. For all $m$ and $c$, define the random variables

[TABLE]

Note that ${P}_{MC}(m,c)={P}_{1}(m,c)+{P}_{2}(m,c)$. Thus, we have

[TABLE]

where (122) follows from the triangle inequality. We now upper bound each term on the right hand side of (122). For the first term, we have

[TABLE]

where (123) follows from the triangle inequality.

For the second term in the right hand side of (122), we have

[TABLE]

where (127) follows from Jensen’s inequality and the concavity of square root. The inequality in (128) follows because, for all $m$ and $c$, we have

[TABLE]

where (130) follows since the random variables \Big{\{}p_{X}(x)\mathbbm{1}\{\mathcal{B}_{1}(x)=m\}\mathbbm{1}\{\mathcal{B}_{2}(x)=c\}\Big{\}}_{x\in\mathcal{D}_{\gamma}} are independent due to the structure of the random binning, and (133) follows because $p_{X}(x)\leq 2^{-\gamma}$ for all $x\in\mathcal{D}_{\gamma}$. Lemma 1 follows from substituting (125) and (128) in (122).

Appendix B Proof of Lemma 2

We first state the following lemma, which provides a variation of Chernoff bound.

Lemma 6

(A variation on Chernoff bound:) Let $U_{1},U_{2},\cdots,U_{n}$ be a sequence of non-negative independent random variables with respective means ${\mathbb{E}}(U_{i})=\bar{m}_{i}$. If $U_{i}\in[0,b]$, for all $i\in\llbracket 1,n\rrbracket$, and $\sum_{i=1}^{n}\bar{m}_{i}\leq\bar{m}$, then, for every $\epsilon\in[0,1]$, we have

[TABLE]

*Proof: *** The proof is adapted from [8, Appendix C]. The details are relegated to Appendix C. ** $\blacksquare$

B-A High probability $\mathcal{Z}$-set:

For all $S\in\mathcal{S}$, define the set

[TABLE]

Recall that ${\mathbb{P}}_{p_{XZ_{S}}}\left((X,Z_{S})\in\mathcal{D}_{\gamma}^{S}\right)\geq 1-\delta^{2}$ by assumption. Using Markov inequality, we have

[TABLE]

B-B Typical and non-typical events:

For all $m,c\in\llbracket 1,\tilde{M}\rrbracket\times\llbracket 1,\tilde{C}\rrbracket$, $z\in\mathcal{Z}$, and $S\in\mathcal{S}$, define the random variables

[TABLE]

Thus, we have, for all $m,c,z,$ and $S$, that

[TABLE]

Note that, for fixed $z\in\mathcal{Z}$ and $S\in\mathcal{S}$, each of the the random variables $P_{i}^{S}(m,c|z),i=1,2,$ is identically distributed for all $m,c\in\llbracket 1,\tilde{M}\rrbracket\times\llbracket 1,\tilde{C}\rrbracket$ due to the symmetry in the random binning. We then fix $z\in\mathcal{Z}$ and $S\in\mathcal{S}$, and let ${P}_{1}^{S}(m,c|z)=\sum_{x\in\mathcal{X}}U_{x}(m,c,z,S)$, where

[TABLE]

The random variables $\{U_{x}(m,c,z,S)\}_{x\in\mathcal{X}}$ are non-negative and independent, and for all $x\in\mathcal{X}$,

[TABLE]

where $p_{X|Z_{S}}(x|z)<2^{-\gamma}$, for all $(x,z)\in\mathcal{D}_{\gamma}^{S}$. Also, we have

[TABLE]

By applying Lemma 6 to the random variables $\{U_{x}(m,c,z,S)\}_{x\in\mathcal{X}}$, with $\bar{m}=\frac{{\mathbb{P}}_{p_{X|Z_{S}}}\left((X,z)\in\mathcal{D}_{\gamma}^{S}\right)}{\tilde{M}\tilde{C}}$ and $b=2^{-\gamma}$, we have, for every $\epsilon_{1}\in[0,1]$ and $z\in\mathcal{A}_{S}$, that

[TABLE]

where (149) follows since ${\mathbb{P}}_{p_{X|Z_{S}}}\left((X,z)\in\mathcal{D}_{\gamma}^{S}\right)\leq 1$, and (151) follows because, for all $z\in\mathcal{A}_{S}$, we have ${\mathbb{P}}_{p_{X|Z_{S}}}\left((X,z)\in\mathcal{D}_{\gamma}^{S}\right)\geq(1-\delta)$.

We also have have that,

[TABLE]

where (153) follows since every $x\in\mathcal{X}$ is assigned to only one pair $(m,c)$, and hence,

[TABLE]

B-C Good binning functions:

Let $\mathbb{b}\triangleq(b_{1},b_{2}):\mathcal{X}\mapsto\llbracket 1,\tilde{M}\rrbracket\times\llbracket 1,\tilde{C}\rrbracket$ be a realization of the random binning $\mathcal{B}$. Recall that the random variable $P_{1}^{S}(m,c|z)$ is identically distributed for every $m$ and $c$. We then define the class $\mathcal{G}$ of binning functions $\mathbb{b}$ as

[TABLE]

Using the union bound and (151), we have that

[TABLE]

Take $\mathbb{b}$ such that $\mathbb{b}\in\mathcal{G}$, and set $M=b_{1}(X)$ and $C=b_{2}(X)$. For every $S\in\mathcal{S}$, we have

[TABLE]

where (165) follows because $\sum_{m,c}\sum_{i=1}^{2}{P}_{i}^{S}(m,c|Z_{S})=\sum_{m,c}P_{MC|Z_{S}}(m,c|z)=1$, and (166) follows from the log-sum inequality.

Now, we upper bound each in (B-C) term. For $\mathbb{b}\in\mathcal{G}$ and every $S\in\mathcal{S}$, we have

[TABLE]

where (169) follows because, for every $\mathbb{b}\in\mathcal{G}$ and $S\in\mathcal{S}$, we have $\tilde{M}\tilde{C}{P}_{1}^{S}(m,c|Z_{S})<(1+\epsilon)$ for $Z_{S}\in\mathcal{A}_{S}$ and every $m,c$, and (171) follows from (139).

Using (154), we have, for every $S\in\mathcal{S}$, that

[TABLE]

We also have, for every $S\in\mathcal{S}$, that

[TABLE]

where (174) follows from Jensen’s inequality and the concavity of $H_{b}$, and (176) follows since $H_{b}(x)$ is monotonically decreasing in $x\in\left(\frac{1}{2},1\right)$. Equation (B-C) follows since $\sum_{i=1}^{2}\sum_{m,c}{P}_{i}^{S}(m,c|Z_{S})=1$, and $\sum_{m,c}{P}_{1}^{S}(m,c|Z_{S})={\mathbb{P}}_{p_{X|Z_{S}}}\left((X,Z_{S})\in\mathcal{D}_{\gamma}^{S}\right)$.

By substituting (171), B-C), and (176) in (B-C), we have, for every $\mathbb{b}\in\mathcal{G}$ and $S\in\mathcal{S}$, that

[TABLE]

Thus, we have

[TABLE]

where the inequality in (180) follows because (177) implies that

[TABLE]

This completes the proof for Lemma 2. The analysis in this proof is adapted from **[30, Appendix]**.

Appendix C Proof of Lemma 6

Let $U_{1},U_{2},\cdots,U_{n}$ be a sequence of non-negative independent random variables, which satisfy the conditions of the Lemma. For any $\theta>0$, we have

[TABLE]

where (184) follows from Markov’s inequality. (186) follows because $e^{\theta x}\leq 1+\frac{e^{\theta b}-1}{b}x$ for $x\in[0,b]$, as $e^{x}$ is a convex function in $x$, (187) follows because $1+x\leq e^{x}$ for all $x\geq 0$, and (188) follows because $\sum_{i=1}^{n}\bar{m}_{i}\leq\bar{m}.$

The value of $\theta$ which maximizes the right hand side of (189) is $\theta^{*}=\frac{1}{b}\ln(1+\epsilon)>0$, for which we have

[TABLE]

By considering Taylor’s expansion of $x[ln(x)-1]$ around $x=1$, we have, for all $x\geq 1$, that

[TABLE]

We also have, for $x\in[1,2]$, that

[TABLE]

Thus, for all $x\in[1,2]$, we have

[TABLE]

By applying (193), with $x=(1+\epsilon)$, to the right hand side of (190), we have, for $\epsilon\in[0,1]$, that

[TABLE]