Secure Broadcasting Using Independent Secret Keys

TL;DR

This paper investigates secure broadcasting with independent secret keys, establishing capacity results for degraded channels and proposing optimal schemes combining one-time pads and wiretap coding.

Contribution

It provides new capacity results and optimal coding schemes for secure broadcast channels with independent secret keys, especially in degraded scenarios.

Findings

One-time pad approach is optimal when legitimate channels are degraded versions of the eavesdropper's.

Wiretap coding is optimal when the eavesdropper's channel is degraded relative to legitimate channels.

A hybrid scheme combining both methods achieves capacity in complex scenarios.

Abstract

The problem of secure broadcasting with independent secret keys is studied. The particular scenario is analyzed in which a common message has to be broadcast to two legitimate receivers, while keeping an external eavesdropper ignorant of it. The transmitter shares independent secret keys of sufficiently high rates with both legitimate receivers, which can be used in different ways: they can be used as one-time pads to encrypt the common message, as fictitious messages for wiretap coding, or as a hybrid of these. In this paper, capacity results are established when the broadcast channels involving the three receivers are degraded. If both legitimate channels are degraded versions of the eavesdropper's channel, it is shown that the one-time pad approach is optimal for several cases, yielding corresponding capacity expressions. Alternatively, the wiretap coding approach is shown to be optimal if the eavesdropper's channel is degraded with respect to both legitimate channels, establishing capacity in this case as well. If the eavesdropper's channel is neither the strongest nor the weakest, an intricate scheme that carefully combines both concepts of one-time pad and wiretap coding with fictitious messages turns out to be capacity-achieving. Finally we also obtain some results for the general non-degraded broadcast channel.

Equations

$$E:\mathcal{M}\times \mathcal{K}\to \mathcal{P}({\mathcal{X}}^n)$$

$$\phi :{\mathcal{Y}}^n\times \mathcal{K}\to \mathcal{M}.$$

$$\begin{array}{rl}& {\bar{e}}_n=\frac{1}{|\mathcal{M}||\mathcal{K}|}\sum _{m\in \mathcal{M}}\sum _{k\in \mathcal{K}}\sum _{x^n\in {\mathcal{X}}^n}\\ & \times \sum _{y^n:\phi (y^n,k)\ne m}{P}_{Y|X}^n(y^n|x^n)E(x^n|m,k)\end{array}$$

$$I(M;Z^n)\le {\delta }_n$$

$$C=\max_{P_{UVX}}\min\big{\{}[I(V;Y|U)-I(V;Z|U)]^{+}+R_{K},I(V;Y)\big{\}}$$

$$C=\max_{P_{X}}\min\big{\{}R_{K},I(X;Y)\big{\}}$$

$$C=\max_{P_{X}}\min\big{\{}I(X;Y)-I(X;Z)+R_{K},I(X;Y)\big{\}}$$

$$M^{\oplus }=M\oplus K.$$

$$R=\max_{P_{X}}\min\big{\{}R_{K},I(X;Y)\big{\}}.$$

$$C=\max_{P_{X}}\min\big{\{}R_{K},H(X)\big{\}}.$$

$$|\mathcal{M}|$$

$$|\mathcal{K}|$$

$$|\mathcal{J}|$$

$$\frac{1}{n}\log (|\mathcal{K}||\mathcal{J}|)>I(X;Z)+ϵ,$$

$$|\mathcal{M}||\mathcal{J}|\le 2^{n(I(X;Y)-ϵ)}.$$

$$C=\max_{P_{VX}}\big{[}I(V;Y)-I(V;Z)\big{]}$$

$$C=\max_{P_{X}}\big{[}I(X;Y)-I(X;Z)\big{]}.$$

$$M=(M^{\prime },M^{\oplus })$$

$$|{\mathcal{M}}^{\prime }|$$

$$|{\mathcal{M}}^{\oplus }|$$

$$|\mathcal{J}|$$

$$\frac{1}{n}\log (|{\mathcal{M}}^{\oplus }||\mathcal{J}|)>I(X;Z)+ϵ,$$

$$|{\mathcal{M}}^{\prime }||{\mathcal{M}}^{\oplus }||\mathcal{J}|\le 2^{n(I(X;Y)-ϵ)},$$

$$E:\mathcal{M}\times {\mathcal{K}}_1\times {\mathcal{K}}_2\to \mathcal{P}({\mathcal{X}}^n)$$

$${\phi }_1$$

$${\phi }_2$$

$$\begin{array}{rl}& {\bar{e}}_{i,n}=\frac{1}{|\mathcal{M}||{\mathcal{K}}_{12}|}\sum _{m\in \mathcal{M}}\sum _{k_{12}\in {\mathcal{K}}_{12}}\sum _{x^n\in {\mathcal{X}}^n}\\ & \times \sum _{y_i^n:{\phi }_i(y_i^n,k_i)\ne m}{P}_{Y_i|X}^n(y_i^n|x^n)E(x^n|m,k_{12}).\end{array}$$

$$I(M;Z^n)\le {\delta }_n$$

$$M_1=M\oplus K_1,\text{and}{M}_2=M\oplus K_2.$$

$$C=\underset{P_X}{\max }\frac{1}{2}I(X;Y)$$

$$C=\underset{P_X}{\max }\frac{1}{2}H(X),$$

$$C=\max_{P_{UX}}\min\left\{\begin{array}[]{l}I(X;Y_{1}|U),\\ I(U;Y_{2})\end{array}\right\}$$

$$R=\min\left\{\begin{array}[]{l}I(U,W;Y_{1}),\\ I(V,W;Y_{2}),\\ \frac{1}{2}[I(U,W;Y_{1})+I(V;Y_{2}|W)-I(U;V|W)],\\ \frac{1}{2}[I(V,W;Y_{2})+I(U;Y_{1}|W)-I(U;V|W)]\end{array}\right\}$$

Full text

I Introduction

Shannon was the first who studied in [3] the problem of secure communication from an information theoretic perspective. He considered a noiseless communication scenario, in which transmitter and receiver share a secret key that is unknown to an eavesdropper. Used as a one-time pad, this secret key enables secure transmission of the confidential message.

Subsequently, Wyner considered the noisy case in [4], where he introduced the so-called wiretap channel. He extended the problem studied by Shannon insofar that the legitimate receiver and the eavesdropper now observe noisy versions of the channel input. In addition, there is no secret key available as in [3] so that the communication must be secured solely by exploiting the properties of the noisy channel. Recently, this area of information theoretic security or physical layer security has drawn considerable attention especially in the area of wireless communication where it provides a promising complement to cryptographic approaches; see for example [5, 6, 7, 8, 9] and references therein. These concepts have been extended to several multi-user scenarios such as the broadcast channel [10, 11, 12, 13], multiple access channel [14, 15], and interference channel [16]. All these works have in common that no secret key is available to the legitimate users.

These two approaches were combined in [17, 18, 19], which study the (noisy) wiretap channel with a shared secret key. This was done from a rate-distortion point of view in [17] and [18], while [19] established the secrecy capacity for the case in which no distortion is allowed at the legitimate receiver. The wiretap channel with a shared secret key and its main concepts and results are briefly reviewed in Section II. Related to this problem is the wiretap channel with secured feedback, as this feedback can be used to create a shared secret key [20, 21, 22].

A secret key shared between a transmitter and a receiver can be used to securely transmit to that receiver. If the rate of the secret key is sufficiently high, the problem becomes trivial in the single user setting (i.e., the wiretap channel with shared secret key) as the whole message can be encrypted with the secret key and the secrecy capacity is simply given by the regular channel capacity. However, when the transmitter shares independent secret keys with multiple receivers, a certain secret key can be used to securely transmit to the respective receiver, but might harm other receivers which do not share this key. Thus, multiple secret keys can result in conflicting payoffs at different receivers making it a challenging and non-trivial problem.

Surprisingly, to the best of our knowledge the use of multiple secret keys in noisy multi-user communication scenarios has not been studied previously. Accordingly, the question of secure communication in broadcast channels (BC) with independent secret keys is an interesting extension in this direction. In particular, this setting describes the problem of securely broadcasting a common message to two legitimate receivers, while keeping an eavesdropper ignorant of it. The transmitter shares independent secret keys of arbitrary key rates with the two receivers. This model is introduced in Section III.

Secure communication can now be realized by different approaches. As shared secret keys are available at the transmitter and both receivers, this suggests to follow [3] and use them as one-time pads to encrypt the common message. However, each receiver is aware of only one secret key. Thus, the more the secret key of one receiver is used to secure the message, the more the other receiver is hurt as the unknown secret key creates a useless message for it that interferes with the desired one. We show that when the eavesdropper has the “strongest” channel (i.e. both legitimate channels are degraded versions of it), the one-time pad approach is indeed capacity-achieving. More specifically, both secret keys are used to create two encrypted messages which are then accordingly encoded and transmitted with the help of a regular capacity-achieving (non-secure) broadcast channel code.

On the other hand, the properties of the noisy channels can be exploited by applying information theoretic secrecy concepts such as wiretap coding [5, 6, 7, 8, 9]. This approach is based on the idea of allocating some of the available rate for additional randomization to “confuse” the eavesdropper. The drawback of this is that it reduces the remaining rate available for the actual transmission of the confidential message. However, this approach turns out to be optimal if the eavesdropper’s channel is the “weakest” among all channels (i.e. it is degraded with respect to both legitimate channels). To this end, the secret keys are used as fictitious messages for the randomization. As each receiver knows one of the secret keys, the randomization overhead to be decoded at the receivers is reduced.

While in the previous cases the eavesdropper has either the strongest or the weakest channel, the much more challenging and complicated scenario occurs when one legitimate channel is stronger and one is weaker than the eavesdropper’s channel. In this case, it is shown that, to achieve capacity, a careful combination of one-time pad and wiretap coding with fictitious messages is needed. The converse involves a non-trivial “sum-rate”-like upper bound on the common message rate.

The above results are obtained in the context of discrete memoryless channels (DMCs). We further consider Gaussian channels, in which the legitimate receivers’ and the eavesdropper’s channel observations are impaired by additive Gaussian noise. The previous results are extended to this case resulting in a complete characterization of the capacity of the Gaussian BC with independent secret keys.

All results are stated in Section IV, while the corresponding proofs are delegated to Section V. A conclusion is then given in Section VI.

Notation

Discrete random variables are denoted by capital letters and their realizations and ranges by lower case and script letters, respectively; $\mathbb{N}$ and $\mathbb{R}_{+}$ are the sets of positive integers and non-negative real numbers; $X-Y-Z$ denotes a Markov chain of random variables $X$, $Y$, and $Z$ in this order; for a sequence $X^{n}=(X_{1},X_{2},...,X_{n})$ we frequently write $X^{i-1}=(X_{1},X_{2}...,X_{i-1})$ and $X_{i+1}^{n}=(X_{i+1},X_{i+2},...,X_{n})$; all logarithms, exponentials, and information quantities are with respect to the base 2; $H(\cdot)$ and $I(\cdot;\cdot)$ are the traditional entropy and mutual information; $\mathcal{P}(\cdot)$ is the set of all probability distributions; $\oplus$ denotes modulo addition and $[a]^{+}$ abbreviates $\max\{a,0\}$; $\text{lhs}\coloneqq\text{rhs}$ assigns the value of the right hand side (rhs) of an equation to its left hand side (lhs).

II Wiretap Channel with Shared Secret Key

In this section we review the wiretap channel with shared secret key as depicted in Fig. 1. This model generalizes and combines two important communication models: Shannon’s cypher system [3] and the classical (noisy) wiretap channel as introduced by Wyner in [4]. Both lead to fundamentally different approaches of how secrecy is realized. These are presented and discussed as well.

II-A System Model

Let $\mathcal{X}$, $\mathcal{Y}$, and $\mathcal{Z}$ be finite input and output sets. For input and output sequences $x^{n}\in\mathcal{X}$, $y^{n}\in\mathcal{Y}^{n}$, and $z^{n}\in\mathcal{Z}^{n}$ of length $n$, the discrete memoryless wiretap channel is given by the transition probability $P_{YZ|X}^{n}(y^{n},z^{n}|x^{n})\coloneqq\prod_{i=1}^{n}P_{YZ|X}(y_{i},z_{i}|x_{i})$.

The transmitter wishes to send a message $M$ to the legitimate receiver while keeping the eavesdropper ignorant of it. The transmitter and legitimate receiver share a common secret key $K$ of rate $R_{K}$ which is unknown to the eavesdropper. The message $M$ and the secret key $K$ are assumed to be independent of each other and uniformly distributed over the sets $\mathcal{M}\coloneqq\{1,...,M_{n}\}$ and $\mathcal{K}\coloneqq\{1,...,K_{n}\}$.

Definition 1*.*

An $(n,M_{n},K_{n})$-code for the wiretap channel with shared secret key consists of a (stochastic) encoder

[TABLE]

and a decoder at the legitimate receiver

[TABLE]

Then the average probability of decoding error at the legitimate receiver is given by

[TABLE]

where $E(x^{n}|m,k)$ denotes the probability that the message $m\in\mathcal{M}$ and the secret key $k\in\mathcal{K}$ are encoded into the codeword $x^{n}\in\mathcal{X}^{n}$.

To ensure the confidentiality of the message, we require

[TABLE]

for $\delta_{n}>0$ with $M$ the random variable uniformly distributed over the set of messages $\mathcal{M}$ and $Z^{n}=(Z_{1},...,Z_{n})$ the channel output at the eavesdropper. This condition is termed strong secrecy [23, 24] and the motivation is to have the total amount of information leaked to the eavesdropper small.

Definition 2*.*

For a given key rate $R_{K}>0$, a rate $R>0$ is an achievable secrecy rate for the wiretap channel with shared secret key if for every $\tau>0$ there exists an $n(\tau)\in\mathbb{N}$ and a sequence of $(n,M_{n},K_{n})$-codes such that for all $n\geq n(\tau)$ we have $\frac{1}{n}\log M_{n}\geq R-\tau$, $\frac{1}{n}\log K_{n}=R_{K}$, and $I(M;Z^{n})\leq\delta_{n}$ while $\bar{e}_{n},\delta_{n}\rightarrow 0$ as $n\rightarrow\infty$. The secrecy capacity $C$ is given by the supremum of all achievable secrecy rates $R$.

The wiretap channel with shared secret key has been studied in [17, 18, 19]. The secrecy capacity has been established and is restated in the following theorem.

Theorem 1* ([19]).*

The secrecy capacity $C$ of the wiretap channel with shared secret key of rate $R_{K}$ is

[TABLE]

*such that $U-V-X-(Y,Z)$ form a Markov chain. *

Depending on whether the term $I(V;Y|U)-I(V;Z|U)$ in (5) is positive or not, capacity can be achieved by using two fundamentally different approaches for realizing secrecy: the one-time pad approach or the principle of wiretap coding with fictitious messages. Both ingredients become most evident by considering either reversely degraded channels, i.e., $X-Z-Y$ form a Markov chain, or degraded channels, i.e., $X-Y-Z$ form a Markov chain. In these cases, the secrecy capacity simplifies as given in the following.

Corollary 1*.*

The secrecy capacity $C$ of the reversely degraded wiretap channel with shared secret key of rate $R_{K}$ is

[TABLE]

*if $X-Z-Y$ form a Markov chain. *

Corollary 2*.*

The secrecy capacity $C$ of the degraded wiretap channel with shared secret key of rate $R_{K}$ is

[TABLE]

*if $X-Y-Z$ form a Markov chain. *

Next we discuss both approaches of one-time pad and wiretap coding in detail and show how they achieve capacity in the respective scenarios.

II-B One-Time Pad

In this approach, we use the shared secret key for encryption to secure the message transmission. Following the thinking of [3], the secret key can be used as a one-time pad, for which the secret key and message must be of the same rate, so that the secrecy capacity is immediately limited by the secret key rate $R_{K}$. Then, the encrypted message is obtained based on a modulo-$|\mathcal{K}|$ addition as

[TABLE]

The encrypted message is then encoded using a classical channel encoder and transmitted over the noisy channel so that the secrecy capacity is further limited by the regular channel capacity, i.e., $\max_{P_{X}}I(X;Y)$. Having decoded the encrypted message $\hat{M}^{\oplus}$, the legitimate receiver can then use the secret key to recover the original message $\hat{M}$, i.e., $\hat{M}^{\oplus}\oplus K=\hat{M}\oplus K\oplus K=\hat{M}$. Since $M$ and $K$ are uniformly distributed and independent of each other, $M$ is perfectly secret from the eavesdropper, i.e., $I(M;Z^{n})=0$, even if it would be able to decode the encrypted message $M^{\oplus}$. We conclude that the one-time pad approach achieves the rate

[TABLE]

We observe that the rate in (9) is independent of the eavesdropper’s channel and depend only on the available key rate and the legitimate channel. Accordingly, this approach works for any configuration of legitimate and eavesdropper’s channels.

In particular, in the case of reversely degraded channels, i.e., $X-Z-Y$, the one-time pad approach is optimal as it achieves the secrecy capacity as given in Corollary 1. However, we observe that in the case of degraded channels, i.e., $X-Y-Z$, the one-time pad approach is suboptimal as the achieved rate (9) is in general strictly smaller than the secrecy capacity as given in Corollary 2 since $I(X;Y)-I(X;Z)>0$.

Remark 1*.*

We immediately also obtain the corresponding result for Shannon’s cypher system, which corresponds to the noiseless case, i.e., $X=Y=Z$. The secrecy capacity $C$ of the noiseless wiretap channel with shared secret key of rate $R_{K}$ is

[TABLE]

Remark 2*.*

For sufficiently large key rate, we see from (6) and (10) that the secrecy capacity is limited by the regular channel capacity, i.e., $C=\max_{P_{X}}I(X;Y)$ and $C=\max_{P_{X}}H(X)$ respectively. The influence of the eavesdropper on the capacity completely vanishes in this case.

II-C Wiretap Coding with Fictitious Messages

In contrast to the one-time pad approach, this approach exploits the noisy channel to realize secure communication. If there is no secrecy requirement, all available resources are used for message transmission. To incorporate secrecy, the crucial idea of wiretap coding [5, 6, 7, 8, 9] is now to use a certain part for randomization by introducing “dummy” messages. This induces multiple valid codewords for each confidential message and the one used for the actual transmission is chosen uniformly at random. The key insight is now to choose the randomization rate (i.e. the rate of the dummy message) for each confidential message according to the eavesdropper’s channel quality, i.e., roughly as $I(X;Z)$. This will saturate the eavesdropper with useless information carried by the dummy messages leaving no remaining resources for decoding the confidential message itself [25].

In the following we present a wiretap coding scheme and show how the secret key is incorporated. Let us assume that $I(X;Y)-I(X;Z)>0$ and $R_{K}\leq I(X;Z)$. For any input distribution $P_{X}\in\mathcal{P}(\mathcal{X})$ we generate $|\mathcal{M}||\mathcal{K}||\mathcal{J}|$ independent codewords $x_{mkj}^{n}\in\mathcal{X}^{n}$ where

[TABLE]

The crucial idea here is to treat the secret key as a fictitious message for additional randomization. As the size of the secret key and the dummy randomization messages satisfy

[TABLE]

we have enough resources allocated to saturate the eavesdropper to ensure that $I(M;Z^{n})\leq\delta_{n}$ holds, i.e., strong secrecy (4) is satisfied, cf. for example [26, 27, 28].

It remains to verify that the legitimate receiver can reliably decode the confidential message. Since the legitimate receiver has the secret key $k\in\mathcal{K}$ as side information available, the remaining unknown indices are $m\in\mathcal{M}$ and $j\in\mathcal{J}$ which are appropriately chosen to satisfy

[TABLE]

It is easy to verify that this enables the legitimate receiver to reliably decode the remaining indices.

In particular, in the case of degraded channels, i.e., $X-Y-Z$ so that $I(X;Y)-I(X;Z)>0$, wiretap coding with fictitious messages is optimal as it achieves the secrecy capacity as given in Corollary 2. However, we observe that in the case of reversely degraded channels, i.e., $X-Z-Y$, wiretap coding with fictitious messages is in general suboptimal (except for sufficiently large key rates for which the secrecy capacity becomes $\max_{P_{X}}I(X;Y)$).

Remark 3*.*

From (12) we observe that the maximum useful secret key rate is $I(X;Z)$. Indeed, even if $R_{K}>I(X;Z)$, it suffices to only use $R_{K}=I(X;Z)+\epsilon$ as this already saturates the eavesdropper’s channel. The secrecy capacity in this case is then $\max_{P_{X}}I(X;Y)$ and there is no need for additional dummy messages for randomization in this case, i.e., $\mathcal{J}=\emptyset$.

Remark 4*.*

If $I(X;Y)-I(X;Z)<0$, e.g., for reversely degraded channels $X-Z-Y$, wiretap coding with fictitious messages in general performs worse than the one-time pad approach. In particular, if $I(X;Z)\geq I(X;Y)+R_{K}$, no secure communication is possible at all, i.e., $R=0$, while the one-time pad approach still achieves the rate $R=\max_{P_{X}}I(X;Y)$ in this case.

From the previous reasoning and particularly Theorem 1 and Corollary 2 we obtain the corresponding secrecy capacity for the classical wiretap channel without shared key, i.e., $R_{K}=0$, as stated next.

Corollary 3*.*

The secrecy capacity $C$ of the wiretap channel is

[TABLE]

such that $V-X-(Y,Z)$ form a Markov chain. If the wiretap channel is degraded, i.e., $X-Y-Z$ form a Markov chain, the secrecy capacity $C$ becomes

[TABLE]

II-D A Combination of Both

The previous discussion has shown that neither of the two approaches of one-time pad and wiretap coding with fictitious messages is superior to the other. In fact, whenever the eavesdropper’s channel is “stronger” than the legitimate channel ($I(X;Y)-I(X;Z)<0$) the one-time pad performs better than the wiretap coding approach and vice versa when the eavesdropper’s channel is weaker ($I(X;Y)-I(X;Z)>0$).

In the following, we present a scheme that combines both approaches of one-time pad and wiretap coding. To make things non-trivial, we assume $R_{K}<I(X;Y)$, since otherwise the secrecy capacity is $C=\max_{P_{X}}I(X;Y)$ as discussed above. The main idea is now to use the secret key as a one-time pad to encrypt as much of the message as possible and use the wiretap coding approach to protect the remaining part of the message. Accordingly, we split the message $M$ into two parts

[TABLE]

with rates $R^{\prime}$ and $R_{K}$, where the part $M^{\prime}$ will be protected by the wiretap coding approach and $M^{\oplus}$ by the one-time pad approach. For any input distribution $P_{X}\in\mathcal{P}(\mathcal{X})$ we generate $|\mathcal{M}^{\prime}||\mathcal{M}^{\oplus}||\mathcal{J}|$ independent codewords $x_{m^{\prime}m^{\oplus}j}^{n}\in\mathcal{X}^{n}$ where

[TABLE]

First, we observe that whenever $I(X;Y)-I(X;Z)\leq 0$, the sets $\mathcal{M}^{\prime}$ and $\mathcal{J}$ are empty and we are falling back to the one-time pad approach as discussed in Section II-B. If $I(X;Y)-I(X;Z)>0$, we use both approaches and secrecy is ensured similarly as in (12) and (13). To be specific, the sets are chosen appropriately to satisfy

[TABLE]

which gives us secrecy, and further

[TABLE]

which gives us reliability.

Remark 5*.*

For both wiretap coding with fictitious messages, cf. Section II-C, and the combined approach, the secret key contributes to the equivocation of the eavesdropper by saturating its channel. But note that in wiretap coding with fictitious messages the secret key does not carry any useful information while in the combined approach it further carries part of the confidential message.

Remark 6*.*

For the case $I(X;Y)-I(X;Z)>0$, both approaches have the same performance in terms of achievable secrecy rate. However, they fundamentally differ in the construction and their codebooks are of different size. In particular, while the overall codebook size of the combined approach is matched to the legitimate channel (as the receiver has to decode all three indices), wiretap coding with fictitious messages uses a codebook whose size is larger than the legitimate channel would allow, but the receiver can use its secret key as side information to reduce it to a suitable subset.

III BC with Independent Secret Keys

In the remainder of this paper we study the broadcast channel (BC) with independent secret keys as depicted in Fig. 2. Let $\mathcal{X}$, $\mathcal{Y}_{1}$, $\mathcal{Y}_{2}$, and $\mathcal{Z}$ be finite input and output sets. For input and output sequences $x^{n}\in\mathcal{X}^{n}$, $y_{1}^{n}\in\mathcal{Y}_{1}^{n}$, $y_{2}^{n}\in\mathcal{Y}_{2}^{n}$, and $z^{n}\in\mathcal{Z}^{n}$ of length $n$, the discrete memoryless broadcast channel is given by the transition probability $P_{Y_{1}Y_{2}Z|X}^{n}(y_{1}^{n},y_{2}^{n},z^{n}|x^{n})\coloneqq\prod_{i=1}^{n}P_{Y_{1}Y_{2}Z|X}(y_{1,i},y_{2,i},z_{i}|x_{i})$.

Throughout the rest of the paper we study the particular communication scenario in which the transmitter broadcasts a common message $M$ to receivers 1 and 2, while keeping the eavesdropper ignorant of it. The transmitter shares independent secret keys $K_{1}$ and $K_{2}$ with receivers 1 and 2. The message and both keys are assumed to be independent of each other and uniformly distributed over the sets $\mathcal{M}\coloneqq\{1,...,M_{n}\}$ and $\mathcal{K}_{i}\coloneqq\{1,...,K_{i,n}\}$, $i=1,2$. We also write $K_{12}=(K_{1},K_{2})$ and $\mathcal{K}_{12}=\mathcal{K}_{1}\times\mathcal{K}_{2}$ for short.

Definition 3*.*

An $(n,M_{n},K_{1,n},K_{2,n})$-code for the BC with independent secret keys consists of a (stochastic) encoder

[TABLE]

and decoders at receivers 1 and 2

[TABLE]

Then the average probability of decoding error at receiver $i$, $i=1,2$, is given by

[TABLE]

As for the wiretap channel with a shared secret key, we require strong secrecy of the common message, i.e.,

[TABLE]

with $\delta_{n}>0$.

Definition 4*.*

A rate $R>0$ is an achievable secrecy rate for the BC with independent secret keys if for every $\tau>0$ there exists an $n(\tau)\in\mathbb{N}$, key rates $R_{1}>0$, $R_{2}>0$, and a sequence of $(n,M_{n},K_{1,n},K_{2,n})$-codes such that for all $n\geq n(\tau)$ we have $\frac{1}{n}\log M_{n}\geq R-\tau$, $\frac{1}{n}\log K_{i,n}=R_{i}$, $i=1,2$, and $I(M;Z^{n})\leq\delta_{n}$ while $\bar{e}_{1,n},\bar{e}_{2,n},\delta_{n}\rightarrow 0$ as $n\rightarrow\infty$. The secrecy capacity $C$ is given by the supremum of all achievable secrecy rates $R$.

Remark 7*.*

Note that in contrast to Definition 2, the rates of the secret keys are not fixed and specified a priori. In particular, Definition 4 allows us to choose arbitrary key rates $R_{1}$ and $R_{2}$. In other words, the key rates are sufficiently high in the sense that we are provided with as much secret key as we desire.

From the problem definition, in principle there are different methods possible to keep the common message secret. The shared secret keys suggest that we might use a one-time pad approach which protects the message with the help of the secret keys similarly as discussed in Section II-B. On the other hand, the transmitter can exploit the nature of the wireless channel by using a channel code based on the idea of wiretap coding as discussed in Section II-C. In the following we will explore these different approaches and show that which particular approach should be used depends on the channel conditions.

IV Main Results

In this section we present the main results for the BC with independent secret keys and discuss the insights that we obtain from them. The corresponding proofs are relegated to Section V and the appendix, respectively.

IV-A Equal Channel Outputs

We start with the simplest scenario, in which both legitimate receivers and the eavesdropper receive signals of the same quality and, in particular, $Y=Y_{1}=Y_{2}=Z$.

If a legitimate receiver has no advantage over the eavesdropper at the physical layer, wiretap coding as discussed in Section II-C cannot be used. Accordingly, to secure the message transmission, we use the secret keys as one-time pads as presented in Section II-B to create two encrypted messages

[TABLE]

These two messages are independent of each other and then encoded using a classical broadcast channel encoder and transmitted to the corresponding receivers. Having decoded the encrypted messages $M_{1}$ and $M_{2}$, each receiver can then use its own secret key to obtain the desired original message $\hat{M}$, i.e., $\hat{M}_{1}\oplus K_{1}=\hat{M}\oplus K_{1}\oplus K_{1}=\hat{M}$ and $\hat{M}_{2}\oplus K_{2}=\hat{M}\oplus K_{2}\oplus K_{2}=\hat{M}$ respectively. It becomes apparent that this one-time pad approach requires a total secret key rate of twice the common message rate. Since the message $M$ and both keys $K_{1}$ and $K_{2}$ are uniformly distributed and independent of each other, $M$ is kept perfectly secret from the eavesdropper, i.e., $I(M;Z^{n})=0$, even if it would be able to decode the encrypted messages $M_{1}$ or $M_{2}$. This encoding-decoding process is depicted in Fig. 3.

For the case of equal channel outputs we then obtain the following result.

Theorem 2*.*

The secrecy capacity $C$ of the BC with independent secret keys for equal channel outputs is

[TABLE]

*with $Y=Y_{1}=Y_{2}=Z$, i.e., time-sharing between both legitimate receivers is optimal. *

Proof:

Achievability follows from using the secret keys as one-time pads to create encrypted individual messages as in (24) and time-sharing between these two encrypted messages. The converse follows from Fano’s inequality and the standard properties of entropy and mutual information to exploit the tension from using independent secret keys from the two receivers. A detailed proof can be found in Section V-A.

From this we immediately obtain the result for the noiseless case where the output at all receivers equals the input, i.e., $X=Y_{1}=Y_{2}=Z$.

Corollary 4*.*

The secrecy capacity $C$ of the noiseless BC with independent secret keys is

[TABLE]

*with $X=Y_{1}=Y_{2}=Z$, i.e., time-sharing between both legitimate receivers is optimal. *

Remark 8*.*

These results show that in the case of equal channel outputs the simple strategy of time-sharing is already capacity-achieving. Thereby, the secret keys are used as one-time pads to transform the common message into multiple individual encrypted messages.

IV-B Strongest Eavesdropper

After having obtained some first insights for the case of equal channel outputs, we now turn to the case in which all channel outputs are of different quality but the eavesdropper has the strongest channel among all receivers in a certain sense.

Let us first assume that the channels are reversely degraded, i.e., we have the following Markov chain: $X-Z-Y_{1}-Y_{2}$.

Theorem 3*.*

The secrecy capacity of the BC with independent secret keys for reversely degraded channels is

[TABLE]

*such that $U-X-Z-Y_{1}-Y_{2}$ form a Markov chain, i.e., superposition coding is optimal. Further, the cardinality of the range of $U$ can be bounded by $|\mathcal{U}|\leq|\mathcal{X}|+1$. *

Proof:

Achievability follows from using the secret keys as one-time pads to create encrypted individual messages and then using superposition coding. The converse follows from Fano’s inequality and standard arguments for the degraded broadcast channel. A detailed proof is given in Section V-B.

Remark 9*.*

The fact that the eavesdropper’s channel is the strongest among all channels (in the sense that both legitimate channels are degraded versions of it) suggests to use the secret keys as one-time pads to secure the message as classical wiretap coding approaches will not work. In addition, the fact that the legitimate channels themselves can be ordered due to their degradedness suggests then to use a superposition coding scheme (as for the classical degraded BC). The previous result shows that this reasoning indeed yields a capacity-achieving coding scheme.

We have seen that using the secret keys in this way essentially turns the problem of securely broadcasting a common message into the problem of broadcasting two independent individual messages. Having this observation in mind, we immediately obtain the following achievable rate which is based on the idea of Marton coding for the classical BC, cf. [29, Sec. 8.4].

Lemma 1*.*

An achievable secrecy rate for the BC with independent secret keys is given by

[TABLE]

*for any $P_{UVWX}(u,v,w,x)$ such that $(U,V,W)-X-(Y_{1},Y_{2},Z)$ form a Markov chain. *

Proof:

A sketch of the proof is provided in Appendix -A.

We want to stress that Lemma 1 yields an achievable secrecy rate for the BC with independent secret keys for the general case, i.e., no constraints on the channels to the legitimate receivers and the eavesdropper are imposed.

The previous Theorem 3 assumed that the channels are reversely degraded. Let us now generalize this discussion in the sense that we do not impose any ordering between the legitimate channels $Y_{1}$ and $Y_{2}$. But we still assume that the eavesdropper’s channel is the “strongest” of all channels in the sense that the following Markov chains are satisfied: $X-Z-Y_{1}$ and $X-Z-Y_{2}$. Then we obtain the following outer bound which is somewhat similar to the UV-outer bound [30] or the Körner-Marton outer bound [31].

Theorem 4*.*

The secrecy capacity $C$ of the BC with independent secret keys for reversely degraded channels $X-Z-(Y_{1},Y_{2})$ is upper bounded by

[TABLE]

*for all $P_{UVX}(u,v,x)$ such that $(U,V)-X-Z-(Y_{1},Y_{2})$ form a Markov chain. Further, the cardinalities of the ranges of $U$ and $V$ can be bounded by $|\mathcal{U}|\leq|\mathcal{X}|+1$ and $|\mathcal{V}|\leq|\mathcal{X}|+1$. *

Proof:

The proof of the upper bound in (33) resembles those of the UV-bound [30] and Körner-Marton bound [31]. A detailed proof is given in Section V-C.

Remark 10*.*

Similar to the achievability schemes discussed before, the UV-type upper bound indicates that in the case of a strongest eavesdropper, the communication problem resembles the structure of the BC with two independent individual messages (stemming from the two independent secret keys). Accordingly, similar to the classical UV-outer bound for the BC with two individual messages, our UV-type upper bound becomes tight for the previous special cases of equal channel outputs and reversely degraded channels. Thus, it recovers the converses of the corresponding Theorems 2 and 3.

Finally, we want to address the case of deterministic broadcast channels, for which the channel outputs at the legitimate receivers $Y_{1}$ and $Y_{2}$ are functions of the input $X$, i.e. $Y_{1}=\phi_{1}(X)$ and $Y_{2}=\phi_{2}(X)$. For reversely degraded channels $X-Z-(Y_{1},Y_{2})$ we then obtain the following.

Theorem 5*.*

The secrecy capacity $C$ of the BC with independent secret keys for reversely degraded channels $X-Z-(Y_{1},Y_{2})$, for which $Y_{1}$ and $Y_{2}$ are deterministic functions of $X$, is given by

[TABLE]

Proof:

Achievability follows from the Marton coding appraoch in Lemma 1 and the converse follows from the UV-type upper bound in Theorem 4. A detailed proof is given in Section V-D.

IV-C Weakest Eavesdropper

Next, we study the opposite case in which the eavesdropper has the weakest channel among all receivers in a certain sense. As the legitimate receivers now have an advantage over the eavesdropper at the physical layer, it is possible to use wiretap coding principles as discussed in Section II-C. Recall that the basic idea of wiretap coding is not to use all available rate for transmitting the message, but to allocate some of the rate to “confuse” the eavesdropper by applying randomized encoding strategies [5, 6, 7, 8, 9]. If a sufficient amount of rate is spent for confusion, the eavesdropper will not be able to decode the transmitted message. Obviously, the more rate is allocated to this confusion, the less rate is available for the actual transmission of the message. Here is where the shared secret keys enter the picture in this approach. They will be treated as fictitious messages playing the role of the randomization resources which are (partly) available at the legitimate receivers. This approach is visualized in Fig. 4.

In the following we consider the case in which the eavesdropper has the “worst” channel in the sense that its channel is degraded with respect to both legitimate channels. Thus, we assume Markov chains $X-Y_{1}-Z$ and $X-Y_{2}-Z$; however, we impose no ordering between the legitimate channels themselves.

Theorem 6*.*

The secrecy capacity $C$ of the BC with independent secret keys and degraded channels $X-Y_{1}-Z$ and $X-Y_{2}-Z$ is

[TABLE]

Proof:

Achievability follows by treating the secret keys as fictitious messages as part of the wiretap code. The converse follows by Fano’s inequality applied to a suitably chosen sum-rate like bound. A detailed proof is given in Section V-E.

Remark 11*.*

An interesting observation is that in a capacity-achieving coding scheme, the sum rate of both secret keys must be equal to the eavesdropper’s channel quality. This saturation leaves then no remaining resources for decoding of the actual common message.

Next, we want to weaken the “worst” eavesdropper channel assumption in the sense that we study the case of less noisy channels instead of degraded channels.

Definition 5*.*

A BC given by its joint probability $P_{YZ|X}$ is said to be less noisy if

[TABLE]

holds for all $P_{UX}(u,x)$ such that $U-X-(Y,Z)$ form a Markov chain. In this case we say receiver $Y$ is less noisy than receiver $Z$ and write $Y\succeq Z$.

Accordingly, we assume $Y_{1}\succeq Z$ and $Y_{2}\succeq Z$ and, again, we impose no ordering between the legitimate channels themselves. The following shows that the capacity result given in Theorem 6 for degraded channels also holds for less noisy channels.

Theorem 7*.*

The secrecy capacity $C$ of the BC with independent secret keys and less noisy channels $Y_{1}\succeq Z$ and $Y_{2}\succeq Z$ is

[TABLE]

Proof:

Achievability follows immediately from Theorem 6. The converse is an adaptation of that used in Theorem 6 incorporating the less noisy condition. A detailed proof is given in Section V-F.

IV-D Eavesdropper in the Middle

The previous considerations either used the secret keys solely as one-time pads or solely as fictitious messages. In particular, the first approach is optimal if the eavesdropper has the “strongest” channel and the second approach is optimal if the eavesdropper has the “weakest” channel. The analysis becomes much more involved if the eavesdropper’s channel is neither the strongest nor the weakest.

Accordingly, we study what happens if the eavesdropper’s channel is in the middle (i.e. $X-Y_{1}-Z-Y_{2}$ form a Markov chain). That is, it is stronger than one legitimate channel, but weaker than the other one. In this case, a combination of one-time pad and fictitious messages is capacity-achieving.

Theorem 8*.*

The secrecy capacity $C$ of the BC with independent secret keys for $X-Y_{1}-Z-Y_{2}$ is

[TABLE]

*such that $U-X-Y_{1}-Z-Y_{2}$ form a Markov chain. The cardinality of the range of $U$ can be bounded by $|\mathcal{U}|\leq|\mathcal{X}|+1$. *

Proof:

Achievability follows by applying a combination of the one-time pad approach and the fictitious messages approach. In particular, a superposition coding scheme is used in which the auxiliary random variable $U$ serves as a “cloud center” protecting the confidential message using the fictitious messages approach. On top of that, “satellite codewords” for the stronger receiver are superimposed protected by the one-time pad approach. The converse follows from Fano’s inequality applied to a suitably chosen sum-rate like bound with a careful identification of the auxiliary random variable. A detailed proof is given in Section V-G.

IV-E Gaussian Channels

The results above can be extended to Gaussian channels, where input-output relations are given by

[TABLE]

where the additive Gaussian noise terms $N_{1}$, $N_{2}$, and $N_{Z}$ have zero means and variances $\sigma_{1}^{2}$, $\sigma_{2}^{2}$, and $\sigma_{Z}^{2}$, i.e., $N_{i}\sim\mathcal{N}(0,\sigma_{i}^{2})$, $i\in\{1,2,Z\}$. We consider an average transmit power constraint $P$.

Since Gaussian broadcast channels are inherently degraded, the relation among the noise variances $\sigma_{1}^{2}$, $\sigma_{2}^{2}$, and $\sigma_{Z}^{2}$ immediately determines the degradedness order. Accordingly, we extend the previous results to completely characterize the Gaussian case. W.l.o.g. we assume $\sigma_{1}^{2}\leq\sigma_{2}^{2}$, making receiver 1 the stronger of the two legitimate receivers.

IV-E1 Strongest Eavesdropper ($\sigma_{Z}^{2}\leq\sigma_{1}^{2}\leq\sigma_{2}^{2}$)

The eavesdropper having the smallest noise power, i.e., the ordering is $\sigma_{Z}^{2}\leq\sigma_{1}^{2}\leq\sigma_{2}^{2}$, is analogous to the Markov chain condition $X-Z-Y_{1}-Y_{2}$. Then the eavesdropper has the strongest channel as discussed in Section IV-B. In this case, the secrecy capacity is established in the following theorem.

Theorem 9*.*

The secrecy capacity $C$ of the Gaussian BC with independent secret keys for $\sigma_{Z}^{2}\leq\sigma_{1}^{2}\leq\sigma_{2}^{2}$ is

[TABLE]

Proof:

Achievability follows immediately from Theorem 3 by extending the achievability scheme from the discrete memoryless case to the Gaussian case. The converse follows also from Theorem 3 and from the converse for the classical Gaussian BC, cf. for example [29, Theorem 5.3]. The details are omitted for brevity.

IV-E2 Weakest Eavesdropper ($\sigma_{1}^{2}\leq\sigma_{2}^{2}\leq\sigma_{Z}^{2}$)

The eavesdropper having the highest noise power, i.e., the ordering is $\sigma_{1}^{2}\leq\sigma_{2}^{2}\leq\sigma_{Z}^{2}$, is analogous to the Markov chain condition $X-Y_{1}-Y_{2}-Z$. Then the eavesdropper has the weakest channel as discussed in Section IV-C. In this case, the secrecy capacity is established in the following theorem.

Theorem 10*.*

The secrecy capacity $C$ of the Gaussian BC with independent secret keys for $\sigma_{1}^{2}\leq\sigma_{2}^{2}\leq\sigma_{Z}^{2}$ is

[TABLE]

Proof:

Achievability follows immediately from Theorem 6 by extending the achievability scheme from the discrete memoryless case to the Gaussian case. The converse follows also from Theorem 6 together with the ideas for the converse of the classical Gaussian wiretap channel, cf. for example [29, Example 22.2]. The details are omitted for the sake of brevity.

IV-E3 Eavesdropper in the Middle ($\sigma_{1}^{2}\leq\sigma_{Z}^{2}\leq\sigma_{2}^{2}$)

When the eavesdropper’s noise power satisfies $\sigma_{1}^{2}\leq\sigma_{Z}^{2}\leq\sigma_{2}^{2}$, it is analogous to the Markov chain condition $X-Y_{1}-Z-Y_{2}$. Then the eavesdropper has neither the strongest nor the weakest channel as discussed in Section IV-D. In this case, the secrecy capacity is established in the following theorem.

Theorem 11*.*

The secrecy capacity $C$ of the Gaussian BC with independent secret keys for $\sigma_{1}^{2}\leq\sigma_{Z}^{2}\leq\sigma_{2}^{2}$ is

[TABLE]

Proof:

Achievability follows immediately from Theorem 8 by extending the achievability scheme from the discrete memoryless case to the Gaussian case. The converse follows from Theorem 8 together with careful applications of the entropy power inequality and the maximum entropy theorem for Gaussian random variables. A detailed proof is given in Section V-H.

IV-E4 Numerical Evaluation

Here we present a numerical evaluation of the secrecy capacity of the Gaussian BC with independent secret keys. Fig. 5 illustrates the behavior of the secrecy capacity for fixed noise variances of the legitimate receivers as the noise variance of the eavesdropper increases. As long as $\sigma_{Z}^{2}<\sigma_{1}^{2}$, the eavesdropper has the strongest channel and the optimal coding scheme relies solely on the one-time pad approach. Accordingly, the secrecy capacity is constant in this regime since it depends only on the fixed legitimate channels and is independent of the actual eavesdropper channel. If $\sigma_{Z}^{2}\geq\sigma_{1}^{2}$ but $\sigma_{Z}^{2}<\sigma_{2}^{2}$, the eavesdropper is in the middle and the secrecy capacity is achieved by a combination of one-time pad and wiretap coding. Finally, if $\sigma_{Z}^{2}\geq\sigma_{2}^{2}$, the eavesdropper has the weakest channel and the optimal coding scheme is wiretap coding using the secret keys as fictitious messages. At some point, the sum-rate-like bound is no longer active and the secrecy capacity is given by the capacity of the weaker link to the second receiver.

V Proofs

In this section we present the proofs of the main results.

V-A Proof of Theorem 2

As both legitimate receivers and the eavesdropper all receive channel outputs of the same quality, we use the secret keys $K_{1}$ and $K_{2}$ as one-time pads to create secure individual messages $M_{1}$ and $M_{2}$ as in (24). Since $M$, $K_{1}$, and $K_{2}$ are independent of each other, we immediately have ensured that $I(M;Z^{n})=0$. Thus, the communication problem reduces to the reliable transmission of two independent individual messages. Obviously, the rate in (25) is easily achievable via time-sharing. (Note that achievability also follows immediately from the Marton coding approach in Lemma 1. By setting $U=V=W=X$ in (28) we obtain the desired rate (25). However, the time-sharing interpretation is more intuitive and yields valuable insights for the converse.)

Thus, it remains to show that time-sharing is already optimal. At receiver $i$, $i=1,2$, we have the following version of Fano’s inequality:

[TABLE]

with $\epsilon_{i,n}\rightarrow 0$ as $n\rightarrow\infty$. Making extensive use of the definition of mutual information and the chain rule, we get

[TABLE]

where (65) follows from the independence of $M$ and $K_{i}$, (66) from Fano’s inequality (64), and (69) from the secrecy condition.

As (71) must hold for both receivers simultaneously, we obtain

[TABLE]

with $\epsilon_{n}=\epsilon_{1,n}+\epsilon_{2,n}+2\delta_{n}$ and $\epsilon_{n}\rightarrow 0$ as $n\rightarrow\infty$. Here, the last step follows from Jensen’s inequality and from defining the distribution $P_{X}$ in (81) as the average of all $P_{X_{i}}$, $i=1,..,n$. This completes the converse and proves the desired result.

V-B Proof of Theorem 3

As for the equal channel case in Theorem 2 we generate individual messages $M_{1}$ and $M_{2}$ by using the available secret keys $K_{1}$ and $K_{2}$ as one-time pads, cf. (24). Then the achievability of (27) follows immediately by superposition coding. Here, we choose the auxiliary random variable $U$ to carry the individual message $M_{1}$ (as the “cloud center”) for the weaker receiver 2. The other message $M_{2}$ for the stronger receiver 1 is superimposed as a “satellite codeword” in $X$. (Again, achievability can also be deduced from the Marton coding approach in Lemma 1. By setting $U=X$ and $V=\emptyset$ in (28) we obtain the desired rate (27).)

Again, the crucial part is the converse. We have to show that this superposition coding strategy is already optimal. Using Fano’s inequality (64) as in the proof of Theorem 2 led to (66) from which we proceed as follows:

[TABLE]

with $\epsilon_{n}=\delta_{n}+\epsilon_{1,n}$ where (84) follows from the chain rule and the secrecy condition, and (85) from the degradedness so that $I(M;Y_{i}^{n})-I(M;Z^{n})\leq 0$, $i=1,2$.

Now, we define the auxiliary random variable

[TABLE]

and obtain for the weaker receiver 2

[TABLE]

where (91) follows from the degradedness condition. Now, let $Q$ be a time-sharing random variable independent of all others in the model and uniformly distributed over $\{1,...,n\}$. We set $U=(U_{Q},Q)$, $X=X_{Q}$, $Y_{1}=Y_{1,Q}$, and $Y_{2}=Y_{2,Q}$ and obtain

[TABLE]

With the same definition of $U_{i}$, cf. (86), we obtain for the stronger receiver 1

[TABLE]

with $\epsilon_{n}=\delta_{n}+\epsilon_{2,n}$ which proves the converse.

The bound $|\mathcal{U}|\leq|\mathcal{X}|+1$ on the cardinality of the range of the auxiliary random variable $U$ follows from the strengthened version of Carathéodory’s theorem, cf. for example [32], and standard arguments. The details are omitted for the sake of brevity. This completes the proof of the theorem.

V-C Proof of Theorem 4

The proof of the upper bound in (33) resembles ideas of [30] and [31]. Proceeding as in the proof of Theorem 3 we use Fano’s inequality (64) and the fact that $Y_{1}$ and $Y_{2}$ are degraded with respect to $Z$ to conclude on (85), i.e., at receiver $i$, $i=1,2$, the rate is upper bounded by

[TABLE]

with $\epsilon_{n}=\max\{\epsilon_{1,n},\epsilon_{2,n}\}+\delta_{n}$. Now, we define the auxiliary random variables

[TABLE]

and obtain for receiver 1

[TABLE]

Similarly, we obtain for receiver 2

[TABLE]

We continue by considering the sum of the rates in (102) of both receivers. We obtain

[TABLE]

where (113) follows from the chain rule for mutual information and the last step follows the idea of the Gelfand-Pinsker converse in [33], cf. also [34, Section 7.9.2] and [29, Theorem 8.5 and Appendix 8B] for similar derivations. We continue as

[TABLE]

Similarly, by interchanging the order of $Y_{1}$ and $Y_{2}$ we obtain

[TABLE]

where the last step follows the idea of the Gelfand-Pinsker converse, cf. [33]. We continue as

[TABLE]

Now, let $Q$ be a time-sharing random variable independent of all others in the model and uniformly distributed over $\{1,...,n\}$. We set $U=(U_{Q},Q)$, $V=(V_{Q},Q)$, $X=X_{Q}$, $Y_{1}=Y_{1,Q}$, and $Y_{2}=Y_{2,Q}$ and obtain for (110)

[TABLE]

and similarly for (111)

[TABLE]

Accordingly, we get for (120) and (129)

[TABLE]

and

[TABLE]

This establishes the desired bounds in (33) and it remains to bound the cardinalities as stated. This can be done exactly as for the UV-bound for the classical BC in [35, Sec. II-C] and is therefore omitted for brevity. This completes the proof.

V-D Proof of Theorem 5

Achievability follows from the Marton coding approach in Lemma 1. By setting $U=Y_{1}$, $V=Y_{2}$, and $W=\emptyset$, the rate expression (28) simplifies to the desired rate (37).

The converse follows then from the UV-type upper bound in Theorem 4. We observe that the first two bounds in (33) can be bounded as $I(U;Y_{1})\leq H(Y_{1})$ and $I(V;Y_{2})\leq H(Y_{2})$. Further,

[TABLE]

where (138) follows from $H(Y_{2}|X,U)=0$ since the channel is deterministic and (143) follows from the fact that $-H(Y_{1},Y_{2}|U)+H(Y_{2}|U)\leq 0$. In a similar way we also get $\frac{1}{2}[I(V;Y_{2})+I(X;Y_{1}|V)]\leq H(Y_{1},Y_{2})$ which give the desired bounds.

V-E Proof of Theorem 6

We start with the achievability of the rate (41) and then prove the corresponding converse.

V-E1 Proof of Achievability

The following equivalent description of (41) turns out to be beneficial for the proof of achievability.

Lemma 2*.*

The rate expression in (41) can equivalently be expressed as

[TABLE]

Proof:

A proof is provided in Appendix -B.

Thus, instead of proving the achievability of (41), we prove the achievability of (146) for any $0\leq\alpha\leq 1$.

Next we sketch the proof of achievability. Basically, it follows the ideas of [36, 27, 28] which all present coding schemes that achieve strong secrecy as required in (23). Accordingly, for any input distribution $P_{X}\in\mathcal{P}(\mathcal{X})$ and $\alpha\in[0,1]$ we generate $|\mathcal{M}||\mathcal{K}_{1}||\mathcal{K}_{2}|$ independent codewords $x_{mk_{1}k_{2}}^{n}\in\mathcal{X}^{n}$ where

[TABLE]

The crucial idea is to use the available secret keys as randomization resources instead of generating “dummy” randomization indices as in the classical wiretap coding approach. As the sizes of the secret keys satisfy

[TABLE]

we have enough randomization resources to show that $I(M;Z^{n})\leq\delta_{n}$ holds, i.e., strong secrecy (23) is satisfied. This can be done similarly as in [36, 27, 28].

Next, we check the reliability constraints at the legitimate receivers. Receiver 1 has the secret key $k_{1}\in\mathcal{K}_{1}$ as side information available and therefore the unknown indices of the transmitted codeword are $m\in\mathcal{M}$ and $k_{2}\in\mathcal{K}_{2}$. As its size satisfies

[TABLE]

it is straightforward to show that receiver 1 can decode the remaining indices $m\in\mathcal{M}$ and $k_{2}\in\mathcal{K}_{2}$. Similarly, receiver 2 has $k_{2}\in\mathcal{K}_{2}$ as side information available and the unknown indices are $m\in\mathcal{M}$ and $k_{1}\in\mathcal{K}_{1}$ of size

[TABLE]

Again, it is easy to show that receiver 2 can decode the remaining indices $m\in\mathcal{M}$ and $k_{1}\in\mathcal{K}_{1}$. Thus, we conclude that (146) is an achievable rate.

Remark 12*.*

For classical wiretap coding, the rate needed for additional randomization is roughly $I(X;Z)$. This suffices to keep the eavesdropper ignorant of the transmitted message. The use of secret keys as the randomization resource has the advantage that parts of the needed randomization resource are already available as side information at the receivers. This reduces the loss in rate in the sense that it is only reduced by the remaining unknown randomization part (and not by the whole amount of randomization).

V-E2 Proof of the Converse

It remains to show the optimality of the above presented coding scheme. The first two bounds in (41) are the obvious single-user bounds and follow immediately. The crucial part is to prove the third “sum-rate”-like bound. We proceed as follows:

[TABLE]

with $\epsilon_{n}=\delta_{n}+\epsilon_{1,n}+\epsilon_{2,n}$ and $\epsilon_{n}\rightarrow 0$ as $n\rightarrow\infty$. Here, (153) follows from Fano’s inequality, cf. (64), (154) from the secrecy criterion, and (157) from the fact that $-I(K_{2};Y_{1}^{n}|M,K_{1})-I(K_{1};Y_{2}^{n}|M,K_{2})+I(K_{1},K_{2};Z^{n}|M)\leq 0$. To see this last step, we write

[TABLE]

where (159) follows from the fact that $M$, $K_{1}$, and $K_{2}$ are independent so that $-H(K_{2}|M,K_{1})-H(K_{1}|M,K_{2})+H(K_{12}|M)=0$, and (160) from the Markov chain relationships $X-Y_{1}-Z$ and $X-Y_{2}-Z$ due to the degradedness. Now, with this we can proceed with the “sum-rate” in (157) as

[TABLE]

where (163) and (166) follow from the degradedness of the channels. This completes the proof of the converse.

V-F Proof of Theorem 7

The proof of achievability follows immediately from Theorem 6 so that it remains to prove the converse for the less noisy case. In the following we will highlight the differences from the converse proof for the degraded case in Theorem 6.

Following the lines (151)-(157) for the “sum-rate” term we also obtain

[TABLE]

with $\epsilon_{n}=\delta_{n}+\epsilon_{1,n}+\epsilon_{2,n}$ and $\epsilon_{n}\rightarrow 0$ as $n\rightarrow\infty$. Here, (168) follows again from the fact that $-I(K_{2};Y_{1}^{n}|M,K_{1})-I(K_{1};Y_{2}^{n}|M,K_{2})+I(K_{1},K_{2};Z^{n}|M)\leq 0$. To see that this also holds for less noisy channels, we proceed as follows. With $I(K_{1},K_{2};Z^{n}|M)=I(K_{1};Z^{n}|M)+I(K_{2};Z^{n}|M,K_{1})$ we observe that

[TABLE]

which is a consequence of the less noisy condition $Y_{1}\succeq Z$, cf. for example [37, Proposition 1]. With $I(K_{1};Z^{n}|M)\leq I(K_{1};Z^{n}|M,K_{2})$ we also have

[TABLE]

which validates the correctness of the inequality in (168).

Now, we can proceed with the “sum-rate” in (168) as

[TABLE]

where (173) follows from the Csiszár sum identity [10, Lemma 7] and (174) from the definition of auxiliary random variables $U_{i}\coloneqq(Y_{1}^{i-1},Z_{i+1}^{n})$ and $V_{i}\coloneqq(M,K_{12},U_{i})$. Now, let $Q$ be a time-sharing random variable independent of all others in the model and uniformly distributed over $\{1,...,n\}$. We set $U=(U_{Q},Q)$, $V=V_{Q}$, $X=X_{Q}$, $Y_{1}=Y_{1,Q}$, and $Z=Z_{Q}$ to obtain

[TABLE]

where (176) follows from letting $V^{*}$ be a random variable distributed according to the choice $U=u^{*}$ that maximizes the difference in (175). Finally, the inequality in (178) follows from the less noisy condition $Y\succeq Z$ which implies $I(X;Y_{1}|V^{*})\geq I(X;Z|V^{*})$. This concludes the proof of the converse.

V-G Proof of Theorem 8

Proof of Achievability

For achievability we want to exploit both previously discussed approaches: secret keys as one-time pads and secret keys as fictitious messages in wiretap codes. Therefore, we split the message $M$ into two parts

[TABLE]

with rates $R^{\prime}$ and $R^{\oplus}$, where the part $M^{\prime}$ will be protected by the wiretap coding approach and $M^{\oplus}$ by the one-time pad approach. Accordingly, we split the secret keys as

[TABLE]

such that $R^{\oplus}=R_{K_{1}}^{\oplus}=R_{K_{2}}^{\oplus}$ to ensure that $M^{\oplus}$ can be protected following the one-time pad idea by creating encrypted messages

[TABLE]

both of rate $R^{\oplus}$.

We use a superposition coding scheme with two layers. For the random code construction, for any $P_{U}$ we first generate “cloud centers” carrying $M^{\prime}$, $K_{1}^{\prime}$, $K_{2}^{\prime}$, and $M_{2}^{\oplus}$. Here, $M^{\prime}$ will be protected by a wiretap code approach. Then, according to $P_{X|U}$ we generate “satellite codewords” carrying $M_{1}^{\oplus}$.

Now, the stronger receiver 1 decodes the cloud center (having $K_{1}^{\prime}$ as side information available) and the satellite codeword, while the weaker receiver 2 decodes only the cloud center (having $K_{2}^{\prime}$ as side information available). If we choose the rates of all messages such that they satisfy

[TABLE]

the average probabilities of error become arbitrarily small. Having decoded $M_{1}^{\oplus}$ and $M_{2}^{\oplus}$ respectively, the receivers obtain the desired part $M^{\oplus}$ with the help of their side information $K_{1}^{\oplus}$ and $K_{2}^{\oplus}$ respectively.

It remains to check the security of the transmitted message. As $R_{K_{1}}^{\prime}+R_{K_{2}}^{\prime}+R^{\oplus}>I(U;Z)$ and $R^{\oplus}>I(X;Z|U)$, the rate of the fictitious messages is high enough to show that $I(M^{\prime};Z^{n})\leq\delta_{n}$ holds, i.e., strong secrecy (23) is satisfied. This can be done similarly as in [36, 27, 28]. Note that no information about $M^{\oplus}$ is leaked to the eavesdropper due to the one-time pad $K_{2}^{\oplus}$ even if the eavesdropper is able to decode the encrypted message $M_{2}^{\oplus}$. The second part $M_{1}^{\oplus}$ in the satellite codeword is immediately protected by the one-time pad $K_{1}^{\oplus}$.

Now, by applying Fourier-Motzkin elimination to get rid of $R^{\prime}$, $R^{\oplus}$, $R_{K_{1}}^{\prime}$, and $R_{K_{2}}^{\prime}$ in (182)-(186) having in mind that $R=R^{\prime}+R^{\oplus}$, yields

[TABLE]

where we observe that the first condition can be omitted as $I(U;Y_{2})\leq I(U;Y_{1})$ holds due to the degradedness. This concludes the proof of achievability.

Remark 13*.*

We want to highlight the difference from the previous approach in Theorem 6. There, the available secret keys are solely used as fictitious messages. From a legitimate receiver’s perspective, using its own secret key as a fictitious message increases the equivocation rate at the eavesdropper but does not contribute to the message rate. However, Theorem 6 shows that for degraded channels $X-Y_{1}-Z$ and $X-Y_{2}-Z$ this is already sufficient to achieve capacity, cf. Theorem 6.

The one-time pad approach enters the picture when one legitimate receiver is stronger than the eavesdropper. Additionally to using the secret keys as fictitious messages, one part of the secret key is used to create an encrypted message $M_{2}^{\oplus}$ which is also used as a fictitious message part to increase the equivocation rate. Again, it does not contribute to the message rate of receiver 1, but it is useful for receiver 2. To resolve the mismatch, the stronger receiver 1 receives the missing part encrypted in the satellite codeword.

This approach is in particular beneficial if receiver 2 is much weaker than the eavesdropper while receiver 1 and the eavesdropper are close in terms of channel quality.

Proof of the Converse

We define the auxiliary random variable

[TABLE]

The first bound in (49) is a single-user bound and follows as

[TABLE]

with $\epsilon_{1,n}\rightarrow 0$ as $n\rightarrow\infty$. Here, (192) follows from Fano’s inequality and (198) from the definition of $U_{i}$, cf. (191).

The crucial part is the second “sum-rate”-like bound. From the proof of Theorem 6 in [1], we know that $n2R\leq I(M,K_{1};Y_{1}^{n})+I(M,K_{2};Y_{2}^{n})-I(M;Z^{n})+n\epsilon_{n}$. Following this, we obtain

[TABLE]

with $\epsilon_{n}=\delta_{n}+\epsilon_{1,n}+\epsilon_{2,n}$ and $\epsilon_{n}\rightarrow 0$ as $n\rightarrow\infty$. Here, (201) follows from the fact that $-I(K_{2};Y_{1}^{n}|M,K_{1})+I(K_{2};Z^{n}|M)\leq 0$. Now we proceed as

[TABLE]

where the first and third term are bounded as

[TABLE]

Here, (204) holds due $X-Y_{1}-Z$. The second term becomes

[TABLE]

which follows as in (193)-(198). And finally, the last term is

[TABLE]

Now, by following standard arguments of introducing a time-sharing random variable independent of all others and uniformly distributed over $\{1,...,n\}$, it is straightforward to finally obtain $R\leq I(U;Y_{2})+\epsilon_{1,n}$ and 2R\leq\big{[}I(X;Y_{1})+I(U;Y_{2})-I(U;Z)\big{]}+\epsilon_{n}.

The bound $|\mathcal{U}|\leq|\mathcal{X}|+1$ on the cardinality of the range of the auxiliary random variable $U$ follows from the strengthened version of Carathéodory’s theorem, cf. [32].

V-H Proof of Theorem 11

Achievability follows from the corresponding scheme for discrete memoryless channels in Theorem 8, where we choose $U\sim\alpha P$ (wiretap coding), $V\sim(1-\alpha)P$ (additional one-time pad part), and $X=U+V$ with $0\leq\alpha\leq 1$ parametrizing the power allocation between the two schemes.

The converse follows from an application of the entropy power inequality and the maximum entropy theorem. We write the first condition in (49) as

[TABLE]

with $h(\cdot)$ the differential entropy. By the maximum entropy theorem, the first term is upper bounded by $h(Y_{2})\leq\frac{1}{2}\log(2\pi e(P+\sigma_{2}^{2}))$. For the second term $h(Y_{2}|U)$ we observe

[TABLE]

so that there must exist an $\alpha\in[0,1]$ such that

[TABLE]

With this, we obtain for the first expression in (49)

[TABLE]

which already establishes the first bound in (63) as desired.

With $I(X;Z)=I(U;Z)+I(X;Z|U)$ we can write the second condition in (49) as

[TABLE]

In the following, we will bound each term separately. From (214) we already know that $I(U;Y_{2})\leq\frac{1}{2}\log(1+\frac{\alpha P}{(1-\alpha)P+\sigma_{2}^{2}})$. Following the proof for the classical Gaussian wiretap channel by using the entropy power inequality, we further get

[TABLE]

Thus, it remains to bound the last term $I(X;Z|U)$ as

[TABLE]

To bound the remaining term, we apply the entropy power inequality as follows:

[TABLE]

where $\tilde{N}$ is Gaussian distributed with variance $\sigma_{2}^{2}-\sigma_{Z}^{2}$. Now, we choose $\alpha$ as in (213) to obtain

[TABLE]

so that

[TABLE]

Now, putting everything together yields

[TABLE]

which yields the remaining bound in (63). This completes the converse and therewith the proof.

VI Conclusion

A secret key shared between a transmitter and a receiver clearly helps to securely communicate in the presence of an eavesdropper. In the “single-user” user scenario of the wiretap channel with shared secret key, the gain in secrecy capacity can immediately be quantified. It corresponds to the key rate of the shared secret key which agrees with common intuition. The same question becomes much more involved and non-trivial to answer for more complex communication scenarios in which multiple secret keys are shared among the legitimate users. Shared secret keys suggest the use of one-time pads to encrypt confidential messages for keeping external eavesdroppers ignorant. However, a secret key shared between the transmitter and one receiver might harm other receivers which do not share this key. Thus, multiple secret keys can result in conflicting payoffs at different receivers, which raises the question of how these keys should be used in an optimal way. In this paper, we have studied the BC with independent secret keys in which a common message must be securely transmitted to two legitimate receivers each of which shares an independent secret key with the transmitter. This is the simplest extension beyond the single-user wiretap channel that captures the above mentioned effects.

For situations in which the eavesdropper’s channel is “stronger” than the legitimate channels, classical wiretap coding does not work and the message must be protected by using the secret keys as one-time pads. For several special cases such as the noiseless BC, BC with equal channel outputs, or degraded BC, it has been shown that this strategy is actually optimal and the secrecy capacity has been established. On the other hand, in situations in which the eavesdropper’s channel is the “weakest” channel, it has been shown that it is optimal to use the secret keys not as one-time pads but as fictitious messages for randomization in wiretap coding. The corresponding secrecy capacity has been established as well. The most challenging case is when the eavesdropper has neither the strongest nor the weakest channel. Here, a careful combination of the one-time pad approach and wiretap coding with fictitious messages is needed to establish the secrecy capacity for this case. First, these problems have been addressed for the situation in which all channels are discrete memoryless. Then, Gaussian channels have been considered and the previous results have been extended to this case as well yielding a complete characterization of the secrecy capacity of the Gaussian BC with independent secret keys.

For future work, it would be interesting to study how these results obtained for the case of two legitimate receivers extend to an arbitrary number of legitimate receivers. Another direction for future work would be to characterize how large of secret key rates are needed to achieve capacity and what happens if the secret key rates are bounded below those rates.

-A Sketch of Proof of Lemma 1

As described in Section IV-A, the secret keys are used as one-time pads to create individual encrypted messages $M_{1}=M\oplus K_{1}$ and $M_{2}=M\oplus K_{2}$, cf. (24) and Fig. 3, which are then encoded and transmitted. As $M$, $K_{1}$, and $K_{2}$ are independent of each other, we immediately have $I(M;Z^{n})=0$ even if the eavesdropper would able to decode the encrypted messages $M_{1}$ or $M_{2}$.

Now, the achievability of the rate given in (28) follows from the idea of Marton coding for the classical BC, cf. [29, Sec. 8.4]. In particular, the created individual messages $M_{1}$ and $M_{2}$ are encoded following this approach which yields the bounds on the rate as given in (28), cf. [29, Proposition 8.1].

-B Proof of Lemma 2

With the function

[TABLE]

we can express the rate expression in (41) as

[TABLE]

As the function $f(t)$ is piecewise linear, it is sufficient to evaluate it at the corner points, i.e., when $t=0$, $t=1$, and $t=\frac{1}{2}$, to convince ourself that the rate expressions in (41) and (226) are equivalent.

Now we have to show that (226) is equivalent to the desired expression (146). Therefore, we rewrite (146) (where we omit the outer maximization for short) as

[TABLE]

where the equality follows from the minimax theorem. Now eliminating $\alpha$ in (227) yields for $t\leq\frac{1}{2}$ and $t\geq\frac{1}{2}$ the corresponding expressions in (226) which are then equivalent to the original formulation (41).