Secure Polar Coding with Delayed Wiretapping Information

TL;DR

This paper develops secure polar coding schemes for wiretap channels with delayed channel state information, achieving near-optimal secrecy capacity under different channel conditions.

Contribution

It introduces explicit weak and strong security polar coding schemes for delay CSI scenarios, extending secure coding theory to more realistic, time-varying wiretap channels.

Findings

The weak security scheme approaches secrecy capacity with delay CSI.

The strong security scheme guarantees strong security with delay CSI.

Simulations confirm the effectiveness of both schemes.

Abstract

In this paper, we investigate the secure coding issue for a wiretap channel model with fixed main channel and varying wiretap channel, by assuming that legitimate parties can obtain the wiretapping channel state information (CSI) after some time delay. For the symmetric degraded delay CSI case, we present an explicit weak security scheme by constructing secure polar codes on a one-time pad chaining structure, and prove its weak security, reliability and capability of approaching the secrecy capacity of perfect CSI case with delay CSI assumption. Further for the symmetric no-degraded delay CSI case, we present a modified multi-block chaining structure in which the original subset of frozen bit is designed for conveying functional random bits securely. Then we combine this modified multi-block chaining structure with the weak security scheme to construct an explicit strong security polar coding scheme, and prove its strong security, reliability and also the capability of approaching the secrecy capacity of perfect CSI case with delay CSI assumption. At last, we carry out stimulations to prove the performance of both secure schemes.

Equations

$$p_{Y^N|X^N}\left(y^N|x^N\right)=\prod _{i=1}^N{p}_{Y|X}\left(y^i|x^i\right).$$

$$p_{Z^N|X^N}^{(s_t)}\left(z^N|x^N\right)=\prod _{i=1}^N{p}_{Z|X}^{(s_t)}\left(z^i|x^i\right);$$

$$p_{Z^N|X^N}^{(s_t^{1:N})}\left(z^N|x^N\right)=\prod _{i=1}^N{p}_{Z|X}^{(s_t^i)}\left(z^i|x^i\right).$$

$$\mathbf{s}=\{\begin{array}{ll}s,& \text{mbox}ifblockvaryingcase;\\ s^{1:N},& \text{mbox}ifarbitrarilyvaryingcase.\end{array}$$

$${\mathrm{P}}_{\mathrm{e}}=\mathrm{Pr}(M\ne \hat{M});$$

$$\mathrm{L}=I(Z_{{\mathbf{s}}_t}^N;M).$$

$$\underset{N\to \infty }{\lim }{\mathrm{P}}_{\mathrm{e}}=0;$$

$$\underset{N\to \infty }{\lim }\frac{1}{N}\mathrm{L}=0;$$

$$\underset{N\to \infty }{\lim }\mathrm{L}=0.$$

$${\mathrm{C}}_{\mathrm{s}-\mathrm{perfect}}=\underset{V-X-Y,Z_s}{\max }\left[I\left(V;Y\right)-I\left(V;Z_s\right)\right].$$

$$\begin{array}{rl}{\mathrm{C}}_{\mathrm{s}-\mathrm{Bperfect}}& =\frac{1}{N}\underset{V^N-X^N-Y^N,Z_s^N}{\max }\left[I(V^N;Y^N)-I(V^N;Z_s^N)\right]\\ & =\underset{V-X-Y,Z_s}{\max }\left[I\left(V;Y\right)-I\left(V;Z_s\right)\right];\end{array}$$

$${\mathrm{C}}_{\mathrm{s}-\mathrm{Aperfect}}=\frac{1}{N}\underset{V^N-X^N-Y^N,Z_{s^{1:N}}^N}{\max }\left[I(V^N;Y^N)-I(V^N;Z_{s^{1:N}}^N)\right]$$

$${\mathrm{C}}_{\mathrm{s}-\mathrm{Bdelay}}\le {\mathrm{C}}_{\mathrm{s}-\mathrm{Bperfect}},{\mathrm{C}}_{\mathrm{s}-\mathrm{Adelay}}\le {\mathrm{C}}_{\mathrm{s}-\mathrm{Aperfect}}.$$

$$Z(X|Y)=2\sum _{y\in \mathcal{Y}}{p}_Y(y)\sqrt{p_{X|Y}(0|y)p_{X|Y}(1|y)}.$$

$$\begin{array}{rl}& {\mathcal{H}}_{X|Y}=\left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Y^N\right)\ge 1-{\delta }_N\right\}\\ & {\mathcal{L}}_{X|Y}=\left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Y^N\right)\le {\delta }_N\right\}.\end{array}$$

$$\begin{array}{rl}& {\mathcal{H}}_{X|Z}^{(s)}=\left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Z_s^N\right)\ge 1-{\delta }_N\right\}\\ & {\mathcal{L}}_{X|Z}^{(s)}=\left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Z_s^N\right)\le {\delta }_N\right\}.\end{array}$$

$$I_{\infty }=\{\begin{array}{ll}1& \text{w.p.}\mathbb{A}[I(W^{1:N})]\\ 0& \text{w.p.}1-\mathbb{A}[I(W^{1:N})]\end{array}$$

$$\sum _{i\in {\mathcal{A}}_N}Z(W_N^{(i)})=o(2^{-N^{\beta }})$$

$${\mathrm{P}}_{\mathrm{e}}(N,R)=o(2^{-N^{\beta }})$$

$$\begin{array}{rl}& {\mathcal{H}}_{X|Z}^{(s^{1:N})}=\left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Z_{s^{1:N}}^N\right)\ge 1-{\delta }_N\right\}\\ & {\mathcal{L}}_{X|Z}^{(s^{1:N})}=\left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Z_{s^{1:N}}^N\right)\le {\delta }_N\right\}.\end{array}$$

$$\begin{array}{rl}& {\mathcal{I}}^{(\mathbf{s})}={\mathcal{L}}_{X|Y}\cap {\mathcal{H}}_{X|Z}^{(\mathbf{s})}\\ & {\mathcal{F}}^{(\mathbf{s})}={\left({\mathcal{L}}_{X|Y}\right)}^c\cap {\mathcal{H}}_{X|Z}^{(\mathbf{s})}\\ & {\mathcal{R}}^{(\mathbf{s})}={\mathcal{L}}_{X|Y}\cap {\left({\mathcal{H}}_{X|Z}^{(\mathbf{s})}\right)}^c\\ & {\mathcal{B}}^{(\mathbf{s})}={\left({\mathcal{L}}_{X|Y}\right)}^c\cap {\left({\mathcal{H}}_{X|Z}^{(\mathbf{s})}\right)}^c.\end{array}$$

$$\begin{array}{rl}& {\mathcal{I}}^{(\mathbf{s})}\cup {\mathcal{R}}^{(\mathbf{s})}={\mathcal{L}}_{X|Y}\text{ and }{\mathcal{F}}^{(\mathbf{s})}\cup {\mathcal{B}}^{(\mathbf{s})}={\left({\mathcal{L}}_{X|Y}\right)}^c\\ & \underset{N\to \infty }{\lim }\frac{1}{N}|{\mathcal{I}}^{(\mathbf{s})}\cup {\mathcal{R}}^{(\mathbf{s})}|=I(U;Y)\\ & \underset{N\to \infty }{\lim }\frac{1}{N}|{\mathcal{R}}^{(\mathbf{s})}\cup {\mathcal{B}}^{(\mathbf{s})}|=\underset{N\to \infty }{\lim }\frac{1}{N}I(U^N;Z_{\mathbf{s}}^N).\end{array}$$

$$\begin{array}{rl}\underset{N\to \infty }{\lim }\frac{1}{N}|{\mathcal{I}}^{(\mathbf{s})}|& =\underset{N\to \infty }{\lim }\frac{1}{N}|{\mathcal{L}}_{X|Y}\cap {\mathcal{H}}_{X|Z}^{(\mathbf{s})}|\\ & =I(U;Y)-\underset{N\to \infty }{\lim }\frac{1}{N}I(U^N;Z_{\mathbf{s}}^N)\end{array}$$

$$\underset{N\to \infty }{\lim }\frac{1}{N}|{\mathcal{B}}^{(\mathbf{s})}|=\underset{N\to \infty }{\lim }\frac{1}{N}|{\left({\mathcal{L}}_{X|Y}\right)}^c\cap {\left({\mathcal{H}}_{X|Z}^{(\mathbf{s})}\right)}^c|=0.$$

$${\hat{u}}_0^i=\{\begin{array}{l}\arg \underset{u\in \left\{0,1\right\}}{\max }{p}_{U^i|U^{1:i-1}{Y}^N}\left(u|{\hat{u}}_0^{1:i-1}{y}_0^N\right)\text{, if }i\in {\mathcal{L}}_{X|Y}\\ \text{publicly known frozen bit, if }i\in {\left({\mathcal{L}}_{X|Y}\right)}^c\end{array}$$

$${\hat{u}}_t^i=\{\begin{array}{l}\arg \underset{u\in \left\{0,1\right\}}{\max }{p}_{U^i|U^{1:i-1}{Y}^N}\left(u|{\hat{u}}_t^{1:i-1}{y}_t^N\right)\text{, if }i\in {\mathcal{L}}_{X|Y}\\ \text{publicly known frozen bit, if }i\in {\left({\mathcal{L}}_{X|Y}\right)}^c\end{array}$$

$$\mathcal{A}\subseteq \left\{i\in [[1,N]]:Z\left(U^i|U^{1:i-1},Y^N\right)\le {\delta }_N\right\},$$

$${\mathrm{P}}_{\mathrm{e}}(\mathcal{A})\le \sum _{i\in \mathcal{A}}Z(U^i|U^{1:i-1},Y^N)=O(2^{-N^{\beta }}).$$

$$\begin{array}{rl}{\mathrm{P}}_{\mathrm{e}}(T+1)=& \sum _{t=1}^T\sum _{i\in {\mathcal{I}}_{t-1}}Z(U^i|U^{1:i-1},Y^N)+\sum _{t=0}^{T-1}\sum _{i\in {\mathcal{I}}_t}Z(U^i|U^{1:i-1},Y^N)\\ \stackrel{(a)}{\le }& TO(2^{-N^{\beta }})+TO(2^{-N^{\beta }})\\ =& 2TO(2^{-N^{\beta }}),\end{array}$$

$$H(U^{\mathcal{R}}|Z_{\mathbf{s}}^N,U^{\mathcal{I}})\le H({\delta }_N)+|\mathcal{R}|{\delta }_N$$

Full text

I Introduction

I-A The Delay CSI Assumption

Physical layer secure coding is an important and effective approach for secure and reliable communication over the wiretap channel (WTC)[1]. In the last decade, after the invention of polar code[2], secure polar coding schemes had successfully achieved the secrecy capacities of Wyner’s wiretap channel[3, 4] and several extended wiretap channel models[5, 6, 11, 8, 9, 7, 10]. All these studies are based on an idealized perfect channel state information (CSI) assumption that channels of the WTC model are fixed and known by the legitimate parties during the entire communication process.

However, in practical communication there are always limitation and uncertainties of CSI due to realistic reasons such as estimation inaccuracy or eavesdropper’s initiative[13]. Since perfect CSI cannot hold for practical concerns, WTC models with uncertain CSI are proposed and studied. For instance, the compound wiretap channel[14] and the arbitrarily varying wiretap channel[15] are the two typical uncertain CSI WTC models and their secrecy capacities are characterized in [16, 17]. Comparing with the perfect CSI, secure coding with uncertain CSI is much more difficult. In [18, 19], a hierarchical polar coding has been proposed which can achieve the secrecy capacity without any instantaneous CSI. However, this technique can only be applied in the case of block fading channels that the CSI is varying with degraded relations and keep constant within each blocks. In [20], an explicit secure polar coding has been proposed which can achieve the lower bounds of the secrecy capacities for both compound wiretap channel and arbitrarily varying wiretap channel with fixed and publicly known main channels. But achieving the upper bounds of these secrecy capacities are still open problems.

Although the actual CSI cannot be known instantly in practical uncertain CSI cases, there are feasible approaches to obtain it with delay. Existing studies have already begun to consider such delay cases. In [21], a delay CSI model has been studied that varying state is sent back to the legitimate transmitter by the legitimate receiver through a feedback channel after some time delay. In [22], a detectable assumption has been presented that legitimate parties can detect the physical effect in the environment caused by the varying of CSI and then learn the CSI from the detected information with high probability. In [23], deep learning algorithms are employed to learn the CSI of the time-varying massive MIMO channels from the feedback information. Accordingly, study the delay CSI could be a possible direction for the uncertain CSI problem.

Therefore, in this paper we setup a specific delay CSI assumption for the WTC model as follow:

• •

Main channel is fixed and publicly known.

• •

Wiretap channel can be either block varying (similar as the compound wiretap channel model) or arbitrarily varying.

• •

Main channel and all the possible wiretap channel states are symmetric discrete memoryless channels without necessarily degraded relations.

• •

Legitimate parties can accurately obtain the wiretap channel state information only after $N$ times channel transmission, thus we can divide the entire transmission by $N$-length channel blocks.

• •

We do not assume that legitimate parties know the uncertain set of CSI or decoder know the CSI when decoding.

I-B Contributions of This Paper and Organization

The objective of this paper is to investigate explicit information theoretical secure and reliable codes for the delay CSI WTC model. Since by our delay CSI assumption the main channel is fixed, achieving the reliability alone is not difficult. The real problem is to achieve reliability and security simultaneously without knowing the current wiretapping CSI over the entire encoding and decoding process, although the CSI can be obtained after.

First, we have constructed a secure polar coding scheme based on the one-time pad (OTP) chaining structure of [22]. To polarize the channel blocks, we use standard channel polarization on block varying model, and irregular channel polarization on arbitrarily varying model. Since this OTP chaining method has a similar sub-channel index partition structure as the secure polar coding of perfect CSI case, we can combine them together to form the secure polar coding scheme for the delay CSI cases. Theoretical analysis shows that this combined secure scheme achieves reliability and weak security in degraded delay CSI cases. However, it fails to achieve strong security in either degraded or non-degraded delay CSI cases.

Then based on the weak security scheme, we further construct a strong security polar coding scheme for the non-degraded delay CSI cases. Because the original multi-block chaining structure[4] cannot applied in the delay CSI cases, we have proposed a new modified multi-block chaining structure, in which part of the original frozen bit subset is designed for conveying functional random bits securely for the unreliable and insecure polarized sub-channels. Theocratical analysis indicates that the proposed strong security polar coding scheme achieves both reliability and strong security in non-degraded delay CSI cases. Also we have proven that the secrecy rate of our secure coding schemes can approach the secrecy capacity of the perfect CSI assumption in the delay CSI cases.

At last, we carry out stimulations to prove the performance of both secure schemes.

The outline of this paper is as follow. Section II presents the notations, communication models of delay CSI assumption and the main results of the paper. Section III presents the construction of a weak security polar coding scheme with discussions of the performance and remaining problems. Section IV presents the construction of a strong security polar coding scheme with a modified multi-block chaining structure, and then analyzes its performance theoretically. Section V presents the simulation results of both weak and strong security schemes. Finally, Section VI concludes the paper.

II Problem Statements and Main Results

II-A Notations

We define the integer interval $[\![a,b]\!]$ as the integer set between $\lfloor a\rfloor$ and $\lceil b\rceil$. For $n\in\mathbb{N}$, define $N\triangleq 2^{n}$. Denote $X$, $Y$, $Z$,… random variables (RVs) taking values in alphabets $\mathcal{X}$, $\mathcal{Y}$, $\mathcal{Z}$,… and the sample values of these RVs are denoted by $x$, $y$, $z$,… respectively. Then $p_{XY}$ denotes the joint probability of $X$ and $Y$, and $p_{X}$, $p_{Y}$ denotes the marginal probabilities. Also we denote vector $X^{a:b}\triangleq(X^{a},X^{a+1},...,X^{b})$ and when the context makes clear that we are dealing with vectors, we write $X^{N}$ in place of $X^{1:N}$ for simplification. And for any index set $\mathcal{A}\subseteqq[\![1,N]\!]$, we define $X^{\mathcal{A}}\triangleq\{X^{i}\}_{i\in\mathcal{A}}$. For the polar codes, we denote $\mathbf{G}_{N}$ the generator matrix , $\mathbf{R}$ the bit reverse matrix, $\mathbf{F}=\begin{bmatrix}\begin{smallmatrix}1&0\\ 1&1\end{smallmatrix}\end{bmatrix}$ , $\otimes$ the Kronecker product, and have $\mathbf{G}_{N}=\mathbf{RF}^{\otimes n}$. $\mathbb{A}[\cdot]$ denotes the average.

II-B Problem Statements

In this paper we consider the scenario of our delay CSI assumption as follow: two legitimate users are communicating over a publicly known and fixed main channel while an eavesdropper is wiretapping through a block varying or arbitrarily varying wiretap channel; legitimate users do not know the current wiretapping state when encoding and decoding, but they can obtain the state after $N$ times channel transmission by certain approaches. For this delay CSI case, we first define the system model.

Definition 1**.**

The system model of delay CSI assumption is defined as $(\mathcal{X},\mathcal{Y},\mathcal{Z},\mathcal{S},p_{Y|X})$. $\mathcal{X}$ is the input alphabet of main channel $W$. $\mathcal{Y}$ is the output alphabet of main channel. $\mathcal{Z}$ is the output alphabet of the varying wiretap channel $V$. $\mathcal{S}$ is the set of potential wiretap channel states (uncertainty set). For each $s\in\mathcal{S}$, $s$ represents a potential transition probability of wiretap channel as $p_{Z|X}^{(s)}$ . $p_{Y|X}$ is the transition probability of main channel. For main channel and all potential wiretap channels, they are symmetric but with no necessarily degraded relations. Then for each $N$-length channel blocks, $\left(x^{N},y^{N},z^{N}\right)\in\mathcal{X}^{N}\times\mathcal{Y}^{N}\times\mathcal{Z}^{N}$, the main channel block have

[TABLE]

For the varying wiretap channel, we define two different sub-models:

• •

block varying sub-model: denote $S_{t}$ the state of $t$-th wiretap channel block chosen by the eavesdropper from $\mathcal{S}$ with realization $s_{t}$. Then this state remains constant during the block communication. For the block transition probability, have

[TABLE]

• •

arbitrarily varying sub-model: denote $S_{t}^{1:N}$ the state of the $t$-th wiretap channel block chosen by the eavesdropper from $\mathcal{S}$ with realization $s_{t}^{1:N}$. Each $S_{t}^{i}$ represents the state for the $i$-th wiretap channel in the block. Then for the block transition probability, have

[TABLE]

For legitimate parties, they can know the precise CSI only after each block communication. Besides, we use $\mathbf{s}$ to represent the CSI realization of both block varying and arbitrarily varying cases, that

[TABLE]

The communication process of the system model for $t$-th channel block is illustrated in Fig. 1.

• •

Eavesdropper Eve chooses the CSI of the block as $\mathbf{s}_{t}$ and then obtains $Z^{N}_{\mathbf{s}_{t}}$ from her chosen wiretap channel with $p_{Z^{N}|X^{N}}^{(\mathbf{s}_{t})}$ .

• •

Legitimate transmitter Alice encodes the message $M$ into $X^{N}$ and transmits it to Bob over the main channel with $p_{Y^{N}|X^{N}}$, but she does not know the actual CSI $\mathbf{s}_{t}$ for the wiretap channel only until the end of $t$-th block communication.

• •

Legitimate receiver Bob receives the main channel outputs $Y^{N}$ and decodes it into $\hat{M}$. He also does not know the actual CSI $\mathbf{s}_{t}$ for the wiretap channel only until the end of $t$-th block communication.

Definition 2**.**

(Performance) Consider a $(2^{NR},N)$ code for the communication model of the delay CSI assumption, then the performance of this code can be measured by

• •

error probability:

[TABLE]

• •

information leakage to Eve:

[TABLE]

Definition 3**.**

(Criterions) A rate $R$ is achievable if sequence of $(2^{NR},N)$ code exists under the criterions listed below:

• •

reliability criterion:

[TABLE]

• •

weak security criterion:

[TABLE]

• •

strong security criterion:

[TABLE]

*For multi state cases, above criterions take the maximum over all possible channel realizations. *

Then based on the delay CSI model defined above, our aim is to construct explicit secure polar codes to achieve a secure and reliable communication. Particularly we consider the information theoretical security and reliability that our secure polar codes have to achieve both reliability criterion and security criterion of Definition 3.

II-C Main Results

Considering a perfect CSI case of our varying WTC model that legitimate parties can directly know the precise CSI when the wiretapping state is varying. Then the system model equals to a basic WTC model. Thus according to the capacity result in [24], for any CSI realization $s\in\mathcal{S}$ in this perfect CSI case, the current secrecy capacity of current channels is

[TABLE]

In case of block varying, the state realization for the block remains constant as $s\in\mathcal{S}$, so the average secrecy capacity of the $N$ length block with perfect CSI is

[TABLE]

In case of arbitrarily varying, the state realization of the block is $s^{1:N}\in\mathcal{S}^{N}$, so the average secrecy capacity of the $N$ length block with perfect CSI is

[TABLE]

For delay CSI cases, let $\mathrm{C_{s-Bdelay}}$ be the average secrecy capacity for block varying case and $\mathrm{C_{s-Adelay}}$ for arbitrarily case. Then we can observe that

[TABLE]

Note that in our delay CSI WTC model, all channels are set symmetric. This is because in delay CSI case it is almost impossible to know the optimal distribution of a asymmetric channel for achieving the asymmetric secrecy capacity. In fact if we could know the optimal distribution, we can directly add the mature asymmetric channel polar coding technique of [25, 26, 27] in our proposed secure coding scheme, which barely changes the structure.

Then here is the main results of the paper:

• •

For the degraded delay CSI WTC model, we propose a weak security polar coding scheme which satisfies $\lim_{N\rightarrow\infty}\mathrm{P_{e}}=0$ and $\lim_{N\rightarrow\infty}\mathrm{L}/N=0$. And with delayed CSI, the secrecy rate $\mathrm{R_{s}}$ of the weak security scheme approaches the secrecy capacity of perfect CSI in (11) for block varying case and (12) for arbitrarily varying case.

• •

For the non-degraded delay CSI WTC model, we propose a strong security polar coding scheme which satisfies $\lim_{N\rightarrow\infty}\mathrm{P_{e}}=0$ and $\lim_{N\rightarrow\infty}\mathrm{L}=0$. And with delayed CSI, the secrecy rate $\mathrm{R_{s}}$ of the strong security scheme also approaches the secrecy capacity of perfect CSI in (11) for block varying case and (12) for arbitrarily varying case.

• •

We carry out stimulations to prove the performance of both secure schemes.

III Weak Security Polar Coding Scheme

In this section, we construct a secure polar coding scheme based on the one-time pad (OTP) chaining structure in [22] for the delay CSI WTC model with both block varying and arbitrarily varying cases. Then we theoretically analyze its performance of the scheme and discuss the remaining problems.

III-A Polarized Subsets Partition

First we present the channel polarization for both main channel and wiretap channel.

Definition 4**.**

(Bhattaharyya parameter) Consider a pair of random variables $(X,Y)\sim p_{XY}$, where $X$ is a binary random variable and $Y$ is a finite-alphabet random variable. To measure the amount of randomness in $X$ given $Y$, the Bhattaharyya parameter is defined as

[TABLE]

For the main channel, we have the publicly know and fixed channel block $W^{1:N}$ with same transition probability $p_{Y|X}$. Then according to the standard channel polarization theory in [2], the main channel block can be polarized into almost full noise subset $\mathcal{H}_{X|Y}$ and almost noiseless subset $\mathcal{L}_{X|Y}$, that for $\beta\in\left(0,1/2\right)$, $\delta_{N}=2^{-N^{\beta}}$, have

[TABLE]

Then for the wiretap channel, we respectively consider the block varying case and arbitrarily varying case.

In the case of block varying, fory $s\in\mathcal{S}$, we have the wiretap channel block as $V_{s}^{1:N}$ with same transition probability $p_{Z|X}^{(s)}$. Then according to the standard channel polarization theory, the wiretap channel block $V_{s}^{1:N}$ can be polarized into almost full noise subset $\mathcal{H}_{X|Z}^{(s)}$ and almost noiseless subset $\mathcal{L}_{X|Z}^{(s)}$, that for $\beta\in\left(0,1/2\right)$, $\delta_{N}=2^{-N^{\beta}}$, have

[TABLE]

In the case of arbitrarily varying, we have the states $s^{1:N}\in\mathcal{S}^{N}$ for the wiretap channel block as $V_{s^{1:N}}^{1:N}$ with transition probability $p_{Z|X}^{(s^{i})}$ for the $i$-th channel $V_{s^{i}}^{i}$. Note that in the arbitrarily varying case, the wiretap channel block is non-stationary, so that the basic channel polarization theory cannot be applied. The polarization of such non-stationary channels has been first proofed in [28] and further studied in [29, 30].

Theorem 1**.**

([30]) for any non-stationary B-DMC block $W^{1:N}$, by applying the irregular channel transformation $\mathbf{G}_{N}$, the generated channels ${W_{N}^{i}}$ can be polarized in the sense that, for any fixed $\delta\in(0,1)$, as $N\rightarrow\infty$, the fraction of indices $i\in[\![1,N]\!]$ for which $I(W_{N}^{i})\in(1-\delta,1]$ goes to $\mathbb{A}[I(W^{1:N})]$ and the fraction for which $I(W_{N}^{i})\in[0,\delta)$ goes to $1-\mathbb{A}[I(W^{1:N})]$. Also can be write as

[TABLE]

*where $\mathbb{A}[I(W^{1:N})]$ is the average of the initial $I(W^{i})$ for all the $i\in[\![1,N]\!]$. *

Theorem 2**.**

([30]) For any non-stationary B-DMC blocks $W^{1:N}$ with $I(W^{i})\geq 0$, and any fixed $R<\mathbb{A}[I(W^{1:N})]$ and constant $\beta<1/2$, there exists index set $\mathcal{A}_{N}\subset[\![1,N]\!]$, $|\mathcal{A}_{N}|\leq NR$ that

[TABLE]

and

[TABLE]

Thus according to the irregular channel polarization theory, the non-stationary wiretap channel block $V_{s^{1:N}}^{1:N}$ of arbitrarily varying case can be polarized into almost full noise subset $\mathcal{H}_{X|Z}^{(s^{N})}$ and almost noiseless subset $\mathcal{L}_{X|Z}^{(s^{N})}$, that for $\beta\in\left(0,1/2\right)$, $\delta_{N}=2^{-N^{\beta}}$, have

[TABLE]

Note the transition probability $p_{Y|X}$ of the main channel is known and fixed over the entire multi-block communication, so that legitimate parties directly have the polarization result of main channel. But they cannot know the polarization result of current wiretap channel block until they obtain the block state $\mathbf{s}$ by the end of current block communication. For eavesdropper Eve, she directly knows all the polarization results of main channel block and wiretap channel block.

Next based on the above channel polarization results with block CSI $\mathbf{s}$, defined in (4), we can divide the channel block index $[\![1,N]\!]$ for both block varying case and arbitrarily varying case as follow:

[TABLE]

Note that for both block varying and arbitrarily varying cases, subset $\mathcal{I}^{(\mathbf{s})}$ is secure and reliable, subset $\mathcal{F}^{(\mathbf{s})}$ is secure but unreliable, subset $\mathcal{R}^{(\mathbf{s})}$ is reliable but insecure, subset $\mathcal{B}^{(\mathbf{s})}$ is neither secure nor reliable. Subset reliable for Bob is fixed to $\mathcal{L}_{X|Y}$, subset unreliable for Bob is fixed to $\left(\mathcal{L}_{X|Y}\right)^{c}$, and have

[TABLE]

And for degraded wiretap channel cases, have

[TABLE]

and

[TABLE]

III-B *OTP Chain Based Secure Polar Coding Scheme *

With the polarized subsets partition in (21), now we construct the secure polar coding scheme for the delay CSI case. The basic idea of our construction is to embed the OPT chaining structure[22] in the secure polar coding scheme. Note that in the rest of the paper, we use simplified expression $(\mathcal{I},\mathcal{R},\mathcal{B},\mathcal{F})$ to represent the partition $(\mathcal{I}^{(\mathbf{s})},\mathcal{R}^{(\mathbf{s})},\mathcal{B}^{(\mathbf{s})},\mathcal{F}^{(\mathbf{s})})$.

Fig. 2 illustrates the entire structure of our proposed OTP chain based secure polar coding scheme which contains $T+1$ $N$-length block communication from block [math] to block $T$. For block $t\in[\![0,T]\!]$ with the CSI realization $\mathbf{s}_{t}$, the actual partition of polarized subsets is denoted as $(\mathcal{I}_{t},\mathcal{R}_{t},\mathcal{B}_{t},\mathcal{F}_{t})$. For legitimate parties, since they do not have the CSI realization of the current wiretap channel at the point of encoding and decoding, they can only guarantee the reliability of the transmitted information by the fixed reliable polarized subset $\mathcal{L}_{X|Y}$ of the main channel. But every time when the current block communication is complete, they can accurately have the CSI realization $\mathbf{s}_{t}$ and then obtain the polarized subsets $(\mathcal{I}_{t},\mathcal{R}_{t},\mathcal{B}_{t},\mathcal{F}_{t})$. Therefore they can identify the bits that have just been reliably and securely transmitted, as the part in $\mathcal{I}_{t}$, and also the bits that have just been reliably but insecurely transmitted, as the part in $\mathcal{R}_{t}$.

According to the idea of the OTP chaining structure in [22], legitimate users can identify the secure and reliable part of the just completed communication block by the delay CSI and then use it as the key stream for the next block communication.

It seems that the polarized subset partition of secure polar codes can perfectly match the idea of the OTP chaining structure: bits in $\mathcal{I}_{t}$ are secure and reliable, so they can be used as the key stream to one-time-pad the message $M_{t+1}$ for $(t+1)$-th block communication by the legitimate transmitter, then the legitimate receiver can correctly decode the corresponding bits for decrypting the received message in $(t+1)$-th block communication.

Unfortunately, there are serious flaws for this combined structure. In the non-degraded delay CSI cases, since the realization of CSI can only be obtained by the legitimate parties after each block communication, the unreliable and insecure subset $\mathcal{B}$ of the current block can not be identified from the unreliable subset $\left(\mathcal{L}_{X|Y}\right)^{c}$ at the time of encoding. Thus for reliability consideration, as a preliminary solution for the structure, subset $\mathcal{B}$ is assigned with the publicly known frozen bits together with the original frozen subset $\mathcal{F}$. However, this preliminary solution may compromise the security in non-degraded cases, which will be discussed in the next section.

Now we present the construction of the OTP chain based secure polar coding scheme in Fig. 2. Note that polarized subsets $(\mathcal{H}_{X|Y},\mathcal{L}_{X|Y})$ remain constant during the entire $(T+1)$ times communication, and for any $t\in[\![1,T]\!]$, have $\mathcal{I}_{t-1}\subseteq\mathcal{L}_{X|Y}$, thus subset $\mathcal{I}_{t-1}$ is reliable for both $U_{t-1}^{N}$ and $U_{t}^{N}$, where $U_{t}^{N}$ represents the $U^{N}$ of $t$-th time block transmission

Block [math]:

• •

Legitimate parties obtain the polarized subsets of the known and fixed main channel as $\mathcal{L}_{X|Y}$ and $\left(\mathcal{L}_{X|Y}\right)^{c}$;

• •

Assigning the $u_{0}^{N}$ for polar coding:

• –

uniformly distributed random bits are assigned to the reliable subset $\mathcal{L}_{X|Y}$, also as $\mathcal{I}_{0}\cup\mathcal{R}_{0}$;

• –

publicly known frozen bits are assigned to the unreliable subset $\left(\mathcal{L}_{X|Y}\right)^{c}$, also as $\mathcal{B}_{0}\cup\mathcal{F}_{0}$;

• •

Alice encodes $u^{N}_{0}$ into the channel input $x^{N}_{0}$ by polar encoding $x^{N}_{0}=u^{N}_{0}\mathbf{G}_{N}$, and then transmits $x^{N}_{0}$ to Bob over the main channel block;

• •

Bob receives $y^{N}_{0}$ from the main channel block and then decodes it into the estimated $\hat{u}^{N}_{0}$ by using the succussive cancelation (SC) decoding [2]:

[TABLE]

• •

After the block communication, both Alice and Bob obtain the CSI of block [math] as $\mathbf{s}_{0}$ and subset $\mathcal{I}_{0}$. Then Alice extracts $u^{\mathcal{I}_{0}}_{0}$ as the key stream for next block’s encryption and Bob extracts $\hat{u}^{\mathcal{I}_{0}}_{0}$ as the key stream for next block’s decryption.

Block $t$, $t\in[\![1,T]\!]$:

• •

Legitimate parties obtain the divided subsets of last block as $(\mathcal{I}_{t-1},\mathcal{R}_{t-1},\mathcal{B}_{t-1},\mathcal{F}_{t-1})$;

• •

Assume a binary message $M_{t}$ that satisfies $|M_{t}|=|\mathcal{I}_{t-1}|$. Then encrypt $|M_{t}|$ into ciphertext $E_{t}$ by $E_{t}=M_{t}\oplus u^{\mathcal{I}_{t-1}}_{t-1}$, where $\oplus$ is the XOR operation;

• •

Assigning the $u_{t}^{N}$ for polar coding:

• –

ciphertext $E_{t}$ is assigned to subset $\mathcal{I}_{t-1}$;

• –

uniformly distributed random bits are assigned to subset $\mathcal{R}_{t-1}$;

• –

publicly known frozen bits are assigned to subset $\left(\mathcal{L}_{X|Y}\right)^{c}$;

• •

Alice encodes $u^{N}_{t}$ into the optimally distributed channel input $x^{N}_{t}$ by polar encoding $x^{N}_{t}=u^{N}_{t}\mathbf{G}_{N}$, then transmits $x^{N}_{t}$ to Bob over the main channel block;

• •

Bob receives $y^{N}_{t}$ from the main channel block and decodes it into the estimated $\hat{u}^{N}_{t}$ by using the SC decoding:

[TABLE]

• •

Bob extracts $\hat{u}^{\mathcal{I}_{t-1}}_{t}$ as the ciphertext and decrypts it by $\widehat{M}_{t}=\hat{u}^{\mathcal{I}_{t-1}}_{t}\oplus\hat{u}^{\mathcal{I}_{t-1}}_{t-1}$;

• •

After the block communication, both Alice and Bob obtain the CSI of block $t$ as $\mathbf{s}_{t}$ and subset $\mathcal{I}_{t}$. Then Alice extracts $u^{\mathcal{I}_{t}}_{t}$ as the key stream for next block’s encryption and Bob extracts $\hat{u}^{\mathcal{I}_{t}}_{t}$ as the key stream for next block’s decryption.

III-C Performance Discussion

Now we analyze the performance of the proposed OTP chain based secure polar coding scheme and discuss its existing problems.

In the scheme, ciphertext is carried by $U_{t}^{\mathcal{I}_{t-1}}$, and key stream is carried by $U_{t}^{\mathcal{I}_{t}}$, thus the reliability of the secure polar coding scheme is measured by the error probability of decoding the ciphertext and key stream from time [math] to time $t$.

Lemma 1**.**

([2])Considering an arbitrary subset $\mathcal{A}$ of block index $[\![1,N]\!]$ for DMC $W$, in case of $\mathcal{A}$ used as the information set and $\mathcal{A}^{c}$ used as frozen set for polar coding with

[TABLE]

then for the successive cancellation decoding, $\beta\in\left(0,1/2\right)$, $\delta_{N}=2^{-N^{\beta}}$, the block error probability is bounded by

[TABLE]

Proposition 1**.**

The proposed OTP chain based secure polar coding scheme, with setting $\mathcal{B}$ as frozen bit set, achieves reliability over the delay CSI WTC model.

Proof:

In the entire $T+1$ times block communication, there are $T$ times ciphertext transmissions from time $1$ to time $T$, and $T$ times key stream transmissions from time [math] to time $T-1$. Let $\mathrm{P_{e}}(T+1)$ be the decoding error probability of Bob for both ciphertext and key stream, have

[TABLE]

*where $(a)$ is due to Lemma 1 and $(\mathcal{I}_{t},\mathcal{I}_{t-1})\subseteq\mathcal{L}_{X|Y}$. Therefore the reliability can be achieved with a fixed $T$. *

Next we discuss the security of the polar coding based encrypted chaining structure under the reliability criterion.

Lemma 2**.**

Considering a single block transmission with polar subset division in (21) that $(U^{\mathcal{I}},U^{\mathcal{F}},U^{\mathcal{B}},U^{\mathcal{R}})-X^{N}-Z^{N}_{\mathbf{s}}$, in case that Eve have received $Z^{N}$ and knows $U^{\mathcal{I}}$, $U^{\mathcal{F}}$ and $U^{\mathcal{B}}$, then for $\beta\in\left(0,1/2\right)$, $\delta_{N}=2^{-N^{\beta}}$, have

[TABLE]

Proof:

Define $\widehat{U}^{\mathcal{R}}=\mathbb{F}_{\mathrm{sc}}(Z^{N}_{\mathbf{s}},U^{\mathcal{I}})$ the SC decoding for Eve. Since $\mathcal{R}\subseteq\mathcal{L}_{X|Z}$, from Lemma 1, have

[TABLE]

Thus by applying the Fano’s inequality, have

[TABLE]

Note that in the structure, message are encrypted by one-time pad, thus the security can be measured by the information leakage of the key streams which are carried by $U^{\mathcal{I}_{t}}_{t}$. Let $\mathrm{L}_{t}$ be the information leakage of block $t$, then have $\mathrm{L}_{t}=I(U^{\mathcal{I}_{t}}_{t};Z^{N}_{t})$. Since for the entire $T+1$ blocks the transmission of key streams are independent between each blocks, the overall information leakage of key streams is $\sum_{t=0}^{T-1}\mathrm{L}_{t}$.

Proposition 2**.**

The proposed OTP chain based secure polar coding scheme, with setting $\mathcal{B}$ as frozen bit set, achieves weak security over the degraded delay CSI WTC model, but fails to achieve strong security over either degraded or non-degraded delay CSI WTC models.

Proof:

To simplify the expression, we omit most of the subscript $t$ in the following discussion. Note that in the structure, in order to maintain the reliability, subsets $U^{\mathcal{F}}$ and $U^{\mathcal{B}}$ are set for the publicly known frozen bits together. Therefore Eve can have the $U^{\mathcal{F}\cup\mathcal{B}}$ when she decodes the wiretapped message. Thus for the single block information leakage $\mathrm{L}_{t}$, have

[TABLE]

where $(a)$ is because $U^{\mathcal{F}\cup\mathcal{B}}$ is the publicly known frozen bits, $(b)$ is due to Lemma 2 and $U^{\mathcal{R}}$ are uniformly distributed random bits. From (22), have

[TABLE]

Thus we have

[TABLE]

In the case of degraded delay CSI WTC model, we can have $\lim_{N\rightarrow\infty}\mathrm{L}_{t}/N=0$ by (24), which implies that only the weak security can be achieved by the proposed scheme.

*However in the case of non-degraded delay CSI WTC model, neither $|\mathcal{B}|$ nor $|\mathcal{B}|/N$ is vanishing when $N\rightarrow\infty$, thus the security criterions cannot be achieved for either the single block or the entire $T+1$ blocks. *

Since the proposed OTP chain based secure polar coding scheme achieves reliability and weak security over the degraded delay CSI WTC model, we analyze the corresponding achievable secrecy rate.

Proposition 3**.**

Over the degraded delay CSI WTC model, with a large enough $T$, the achievable secrecy rate of the proposed OTP chain based secure polar coding scheme can approach the secrecy capacity of perfect CSI case.

Proof:

Let $\mathrm{R_{s}}(T+1)$ be the secrecy rate of entire $T+1$ block communication. Since in $t$-th block communication encrypted messages are transmitted in the subset $\mathcal{I}_{t-1}$, we have

[TABLE]

*where $(a)$ is due to (23) of degraded wiretap channel cases. Then by comparing with (11) and (12), we can observe that $I(U;Y)-\lim_{N\rightarrow\infty}\frac{1}{N}I(U^{N};Z_{\mathbf{s}}^{N})$ can reach the perfect CSI average secrecy capacity of a block with state $\mathbf{s}$. Thus the secrecy rate of $T+1$ blocks can approach the average secrecy capacity of perfect CSI case by choosing a large enough $T$. *

In the next section, we will discuss the remaining problem of subset $\mathcal{B}$ and explore a new strong security solution for the non-degraded delay CSI WTC model.

IV Strong Security Polar Coding Scheme

As previously discussed, the proposed OTP chain based secure polar coding scheme fail to achieve strong security over the delay CSI WTC model because of the neither secure nor reliable subset $\mathcal{B}_{t}$. Thus in this section, we will present a new solution for this remaining problem and construct a modified secure polar coding scheme which can achieve strong security and reliability simultaneously.

IV-A Further Discussions on Strong Security

In our preliminary solution for subset $\mathcal{B}_{t}$ of the delay CSI WTC, $U^{\mathcal{B}_{t}}_{t}$ is assigned with publicly known frozen bits for achieving the reliability, which however has been proven for compromising the security.

For the non-degraded WTC with perfect CSI, this conflict between reliability and security has already been solved by the technique of polar code based multi-block chaining structure proposed in [4]. The basic idea of this strong security solution is to convey the bits of $U^{\mathcal{B}}$ to legitimate receiver Bob separately while keeping it safe from the eavesdropper Eve. Therefore, in the original multi-block chaining structure, for any channel block $t$, a reliable and secure subset $\mathcal{E}_{t}$ that satisfies $|\mathcal{E}_{t}|=|\mathcal{B}_{t+1}|$ is separated from the subset $\mathcal{I}_{t}$. Then $\mathcal{E}_{t}$ is set for carrying uniformly distributed random bits which will be used for assigning the subset $\mathcal{B}_{t+1}$ in block $t+1$. Thus when decoding, Bob can directly decode the bits in subset $\mathcal{B}_{t+1}$ by the decoded random bits of $\mathcal{E}_{t}$ from block $t$.

However, in the delay CSI WTC model, the original multi-block chaining structure cannot be applied. According to the delay CSI assumption, the subset $\mathcal{B}_{t+1}$ cannot be identified by the legitimate parties only until $(t+1)$-th block communication is complete. Thus without knowing the subset $\mathcal{B}_{t+1}$, bits in subset $\mathcal{B}_{t}$ can not be assigned independently from $\mathcal{F}_{t}$, and the corresponding subset $\mathcal{E}_{t}$ in $t$-th block communication cannot be constructed as well. Therefore, to achieve both strong security and reliability over the delay CSI WTC, we have solve this unidentifiable problem of $\mathcal{B}_{t}$.

In fact, there is an easy way around this problem to achieve both reliability and security, but it will also cause unacceptable secrecy rate sacrifice. According to the delay CSI assumption, although subset $\mathcal{B}_{t}$ is unidentifiable, subset $\left(\mathcal{L}_{X|Y}\right)^{c}$ is known and fixed over the blocks. Thus we can directly apply the multi-block chaining structure on the subset $\left(\mathcal{L}_{X|Y}\right)^{c}$ instead of the unknown subset $\mathcal{B}_{t}$. For example, considering the $\left(\mathcal{L}_{X|Y}\right)^{c}$ based multi-block chaining structure, for block $t$, construct a subset $\mathcal{E}_{t}$ from $\mathcal{I}_{t}$ that satisfies $|\mathcal{E}_{t}|=|\left(\mathcal{L}_{X|Y}\right)^{c}|$. Then for the achievable secrecy rate of block $t$, have

[TABLE]

where $\mathrm{C_{s}}$ is the secrecy capacity of a single block, $\mathrm{R}_{\mathcal{F}}$ is the rate of subset $\mathcal{F}$. Thus as shown in (37), large part of the secrecy capacity is sacrificed if directly apply the multi-block chaining structure on the subset $\left(\mathcal{L}_{X|Y}\right)^{c}$.

IV-B Modified Multi-block Chaining Structure

In order to achieve the strong security and reliability, we have to find a method to convey random bits for the known and fixed $\left(\mathcal{L}_{X|Y}\right)^{c}$ in the delay CSI WTC model without unacceptable rate sacrifice. Thus in this subsection, we present a new solution for this problem named as modified multi-block chaining structure.

Note that in our preliminary weak security solution, subset $\left(\mathcal{L}_{X|Y}\right)^{c}$ is set as publicly known frozen bits for maintaining reliability. But what if we use it to transmit random bits instead? Since $\mathcal{F}\subseteq\mathcal{H}_{X|Z}$, random bits in $\mathcal{F}$ is secure from eavesdropper Eve. And with a delay CSI, by the end of every block communication, legitimate parties can know the actual subset $\mathcal{F}$ and $\mathcal{B}$ for identifying the secure part of the random bits in $\mathcal{H}_{X|Z}$ in the just completed block communication. Based on this point, we can use the subset $\mathcal{F}$ to construct a modified multi-block chaining structure.

The modified multi-block chaining structure is illustrated in Fig. 3. Every time when legitimate parties obtain the CSI realization of the just completed block communication, they can know the actual divided subsets $(\mathcal{I},\mathcal{R},\mathcal{B},\mathcal{F})$ by (21). Assuming that over $\mathcal{S}$ have $|\mathcal{B}^{(\mathbf{s})}|<|\mathcal{I}^{(\mathbf{s})}|$ (if $|\mathcal{B}^{(\mathbf{s})}|\geq|\mathcal{I}^{(\mathbf{s})}|$, the secrecy capacity of state $\mathbf{s}$ is [math]), then we can divide the subset $\mathcal{I}$ into two parts, $\mathcal{B}^{\prime}$ and $\mathcal{I}^{\prime}$, which satisfies

[TABLE]

At the beginning of time [math], set a secure pre-shared frozen bits between Alice and Bob for assigning the $\left(\mathcal{L}_{X|Y}\right)^{c}$. Then random bits are assigned to $\mathcal{L}_{X|Y}$. When the block communication of time [math] is completed, legitimate parties can obtain the CSI realization $s_{0}$. Accordingly they can identify the part of the pre-shared frozen bits that remains secure in the just completed transmission as the $U^{\mathcal{F}_{0}}_{0}$. Also they can identify the securely and reliably transmitted bit of $\mathcal{L}_{X|Y}$, as the $U^{\mathcal{B}^{\prime}_{0}}_{0}$ and $U^{\mathcal{I}^{\prime}_{0}}_{0}$ for Alice, $\widehat{U}^{\mathcal{B}^{\prime}_{0}}_{0}$ and $\widehat{U}^{\mathcal{I}^{\prime}_{0}}_{0}$ for Bob.

Then for the block communication of time $1$, since $|\mathcal{F}_{0}|+|\mathcal{B}^{\prime}_{0}|=|\left(\mathcal{L}_{X|Y}\right)^{c}|$, Alice can use the bits of $U^{\mathcal{F}_{0}}_{0}$ and $U^{\mathcal{B}^{\prime}_{0}}_{0}$ together to assign the $U_{1}^{\left(\mathcal{L}_{X|Y}\right)^{c}}$. Since Bob already have the $U^{\mathcal{F}_{0}}_{0}$ and $\widehat{U}^{\mathcal{B}^{\prime}_{0}}_{0}$, he can directly use these bits to decode $\widehat{U}_{1}^{\left(\mathcal{L}_{X|Y}\right)^{c}}$.

After the block communication of time $1$, legitimate parties can obtain the CSI realization $s_{1}$. Then Alice can identify the bits in $\left(\mathcal{L}_{X|Y}\right)^{c}$ that remains secure as $U^{\mathcal{F}_{1}}_{1}$, and for Bob as $\widehat{U}^{\mathcal{F}_{1}}_{1}$. Also they can identify the securely and reliably transmitted bit in $\mathcal{L}_{X|Y}$ as the $U^{\mathcal{B}^{\prime}_{1}}_{1}$ and $U^{\mathcal{I}^{\prime}_{1}}_{1}$ for Alice, $\widehat{U}^{\mathcal{B}^{\prime}_{1}}_{1}$ and $\widehat{U}^{\mathcal{I}^{\prime}_{1}}_{1}$ for Bob. Then $(U^{\mathcal{F}_{1}}_{1},U^{\mathcal{B}^{\prime}_{1}}_{1})$ and $(\widehat{U}^{\mathcal{F}_{1}}_{1},\widehat{U}^{\mathcal{B}^{\prime}_{1}}_{1})$ can be used for the $\left(\mathcal{L}_{X|Y}\right)^{c}$ in the block communication of time $2$.

Then the following blocks just repeat these operations. Therefore random bits of $\left(\mathcal{L}_{X|Y}\right)^{c}$ can be conveyed from Alice to Bob separately and securely over the blocks.

IV-C Strong Security Polar Coding Scheme

Now we combine this modified multi-block chaining structure with the OTP chain based secure polar coding scheme to construct the strong security polar coding scheme for the non-degraded delay CSI WTC model.

Block [math]:

• •

Legitimate parties obtain the polarized subsets of main channel as $\mathcal{L}_{X|Y}$ and $\left(\mathcal{L}_{X|Y}\right)^{c}$;

• •

Assigning the $u_{0}^{N}$ for polar coding:

• –

uniformly distributed random bits are assigned to subset $\mathcal{L}_{X|Y}$;

• –

pre-shared and secure frozen bits are assigned to subset $\left(\mathcal{L}_{X|Y}\right)^{c}$;

• •

Alice encodes $u^{N}_{0}$ into the optimally distributed channel input $x^{N}_{0}$ by polar encoding $x^{N}_{0}=u^{N}_{0}\mathbf{G}_{N}$, and transmits $x^{N}_{0}$ to Bob over the known and fixed main channel block;

• •

Bob receives $y^{N}_{0}$ and decodes it into the estimated $\hat{u}^{N}_{0}$ by using the SC decoding:

[TABLE]

• •

After the block communication, with the delay CSI realization $\mathbf{s}_{0}$.

• –

Alice identifies $u^{\mathcal{I}^{\prime}_{0}}_{0}$ as the key stream for next block encryption, also identifies $u^{\mathcal{F}_{0}}_{0}$ and $u^{\mathcal{B}^{\prime}_{0}}_{0}$ as the random bits for assigning the $u_{1}^{\left(\mathcal{L}_{X|Y}\right)^{c}}$ in the next block;

• –

Bob identifies $\hat{u}^{\mathcal{I}^{\prime}_{0}}_{0}$ from the decoded message as the key stream for next block decryption, also identifies $u^{\mathcal{F}_{0}}_{0}$ and $\hat{u}^{\mathcal{B}^{\prime}_{0}}_{0}$ as the random bits for decoding the $u_{1}^{\left(\mathcal{L}_{X|Y}\right)^{c}}$ in the next block;

Block $t$, $t\in[\![1,T]\!]$:

• •

Legitimate parties obtain the divided subsets of last block as $(\mathcal{I}^{\prime}_{t-1},\mathcal{B}^{\prime}_{t-1},\mathcal{R}_{t-1},\mathcal{B}_{t-1},\mathcal{F}_{t-1})$ by the CSI realization $s_{t-1}$;

• •

Assume a message $M_{t}$ that satisfies $|M_{t}|=|\mathcal{I}^{\prime}_{t-1}|$. Then encrypt $|M_{t}|$ into ciphertext $E_{t}$ by $E_{t}=M_{t}\oplus u^{\mathcal{I}^{\prime}_{t-1}}_{t-1}$;

• •

Assigning the $u_{t}^{N}$ for polar coding:

• –

ciphertext $E_{t}$ is assigned to subset $\mathcal{I}^{\prime}_{t-1}$;

• –

uniformly distributed random bits are assigned to subset $\mathcal{R}_{t-1}$;

• –

random bits of $u^{\mathcal{F}_{t-1}}_{t-1}$ and $u^{\mathcal{B}^{\prime}_{t-1}}_{t-1}$ are assigned to subset $\left(\mathcal{L}_{X|Y}\right)^{c}$;

• •

Alice encodes $u^{N}_{t}$ into the optimally distributed channel input $x^{N}_{t}$ by polar encoding $x^{N}_{t}=u^{N}_{t}\mathbf{G}_{N}$, and transmit $x^{N}_{t}$ to Bob over the main channel;

• •

Bob receives $y^{N}_{t}$ and decodes it into the estimated $\hat{u}^{N}_{t}$ by using the SC decoding:

[TABLE]

• •

Bob extracts $\hat{u}^{\mathcal{I}^{\prime}_{t-1}}_{t}$ as the ciphertext and decrypts it by $\widehat{M}_{t}=\hat{u}^{\mathcal{I}^{\prime}_{t-1}}_{t}\oplus\hat{u}^{\mathcal{I}^{\prime}_{t-1}}_{t-1}$;

• •

After the block communication, with the delay CSI realization $\mathbf{s}_{t}$.

• –

Alice identifies $u^{\mathcal{I}^{\prime}_{t}}_{t}$ as the key stream for next block encryption, also identifies $u^{\mathcal{F}_{t}}_{t}$ and $u^{\mathcal{B}^{\prime}_{t}}_{t}$ as the random bits for assigning the $u_{t+1}^{\left(\mathcal{L}_{X|Y}\right)^{c}}$ in the next block;

• –

Bob identifies $\hat{u}^{\mathcal{I}^{\prime}_{t}}_{t}$ from the decoded message as the key stream for next block decryption, also identifies $\hat{u}^{\mathcal{F}_{t}}_{t}$ and $\hat{u}^{\mathcal{B}^{\prime}_{t}}_{t}$ as the random bits for decoding the $\hat{u}_{t+1}^{\left(\mathcal{L}_{X|Y}\right)^{c}}$ in the next block;

IV-D Performance Analysis

Now we analyze the performance of the proposed strong security polar coding scheme and theoretically discuss its reliability, security and secrecy rate under the delay CSI assumption.

IV-D1 Reliability

reliability of the proposed strong security polar coding scheme is on the error probability of decoding the ciphertext, key stream and the random bits of subset $\mathcal{B}^{\prime}$ from time [math] to time $T$.

Proposition 4**.**

The proposed strong security polar coding scheme achieves reliability over the delay CSI WTC model.

Proof:

Similar as in Proposition 1, for the error probability of entire $T+1$ block communication, have

[TABLE]

*which proves the reliability. *

IV-D2 Strong security

In the proposed strong security polar coding scheme, key streams are carried by $U^{\mathcal{I}^{\prime}_{t}}_{t}$ while ciphertexts are carried by $U^{\mathcal{I}^{\prime}_{t-1}}_{t}$. Thus for the entire $T+1$ times block communication, the strong security can be measured by the overall information leakage of all the subset $\mathcal{I}^{\prime}$ from time [math] to time $T$.

Definition 5**.**

For arbitrary subset $\mathcal{A}$ of index $[\![1,N]\!]$, define $\mathrm{a}_{1}<\mathrm{a}_{2}<...<\mathrm{a}_{|\mathcal{A}|}$ the corresponding indices of the elements $U^{\mathcal{A}}$, and

[TABLE]

Proposition 5**.**

The proposed strong security polar coding scheme achieves strong security over the non-degraded delay CSI WTC model.

Proof:

For block $t$, denote $\mathbf{I}^{t}=U^{\mathcal{I}^{\prime}_{t}}_{t}$, $\mathbf{B}^{t}=U^{\mathcal{B}^{\prime}_{t}}_{t}$, $\mathbf{F}^{t}=U^{\mathcal{F}_{t}}_{t}$ and $\mathbf{Z}^{t}=Z_{\mathbf{s}_{t}}^{N}$. Then for the entire $T+1$ times block communication, the general information leakage is

[TABLE]

Now we perform a similar analysis operation as in **[4]** on the $\mathrm{L}(T+1)$ for the modified multi-block chaining structure. Let

[TABLE]

then for $t\in[\![1,T]\!]$, have

[TABLE]

where $(a)$ is due to Markov chain

[TABLE]

and $(b)$ is due to Markov chain

[TABLE]

Since Eve do not know the initially pre-shared frozen bits for $\left(\mathcal{L}_{X|Y}\right)^{c}$ at time [math], have

[TABLE]

Also because $\mathcal{R}_{t}$ are set for transmitting random bits, have

[TABLE]

where $(a)$ is because each $U^{\mathrm{a}_{i}}$ is independent; $(b)$ is due to $\mathcal{I}^{\prime}_{t}\cup\mathcal{B}^{\prime}_{t}\cup\mathcal{F}_{t}=\mathcal{H}_{X|Z}^{(\mathbf{s}_{t})}$, $Z(X|Y)^{2}\leq H(X|Y)$ and $\mathcal{H}_{X|Z}^{(\mathbf{s}_{t})}=\left\{j\in[\![1,N]\!]:Z\left(U^{j}|U^{1:j-1},Z^{N}_{\mathbf{s}_{t}}\right)\geq 1-\delta_{N}\right\}$. Therefore, we finally have

[TABLE]

*which proves the strong security. *

IV-D3 Secrecy rate

Now we discuss the achievable secrecy rate under the reliability and strong security criterions.

Proposition 6**.**

Over the non-degraded delay CSI WTC model, with a large enough $T$, the achievable secrecy rate of the proposed strong security polar coding scheme can approach the secrecy capacity of perfect CSI case.

Proof:

According to the proposed strong security polar coding scheme, ciphertext are carried by $U_{t}^{\mathcal{I}^{\prime}_{t-1}}$ for $t\in[\![1,T]\!]$, hence for the secrecy rate, have

[TABLE]

According to (22), have

[TABLE]

Thus have

[TABLE]

Then by comparing with (11) and (12), we can observe that $I(U;Y)-\lim_{N\rightarrow\infty}\frac{1}{N}I(U^{N};Z_{\mathbf{s_{t-1}}}^{N})$ can reach the perfect CSI average secrecy capacity of a block with state $\mathbf{s_{t-1}}$. Thus with a large enough $T$, we have

[TABLE]

*which indicates that under the delay CSI assumption, the achievable secrecy rate of the proposed strong security polar coding scheme can approach the average secrecy capacity of the perfect CSI case with a sufficiently large $T$. *

V Simulation of the Schemes

In this section we present simulations of the proposed secure polar coding schemes.

V-A Simulation of the Weak Security Scheme

First, we setup a precise degraded delay CSI WTC model. Specifically, the main channel is a binary erase channel (BEC) with erase probability $\epsilon_{m}=0.1$; the degraded wiretap channel is varying BEC (block varying and arbitrarily varying) with uncertainty erase set $\{\epsilon_{w1}=0.4,\epsilon_{w2}=0.5\}$.

Then on this model we carry out the performance stimulation of the weak security coding scheme by choosing $T=1000$, $\beta$ from $0.18$ to $0.30$ and $N$ from $2^{10}$ to $2^{24}$. Results of the performance stimulation are illustrated Fig. 4. Note that all these results are the sum of entire $T+1$ blocks. Fig. 4a shows that when the block length $N$ increases, the theoretical upper bounds of the legitimate BER is vanishing, which meets the Proportion 1 for reliability. Fig. 4b and Fig. 4c shows that the information leakage is increasing but the information leakage rate is vanishing when $N$ increases, which meets the Proportion 2 for weak security. Fig. 4d shows the tendency of secrecy rate approaching the perfect CSI secrecy capacity $0.35$ with an increasing $N$, which meets the Proportion 3 for secrecy rate. Also, by comparing the performance of different $\beta$, we can observe that when the parameter $\beta$ gets larger, the weak security scheme can obtain a better legitimate BER, but a worse information leakage rate and secrecy rate, which indicates the significance of parameter $\delta_{N}=2^{-N^{\beta}}$ for finite block length secure polar codes.

We also setup a test for the weak security communication process with $T=3$, $\beta$ from $0.20$ to $0.30$ and $N$ from $2^{8}$ to $2^{12}$. As illustrated in Fig. 5, when the block length increases, the experimental legitimate BER is dropping to an acceptable low level, and the experimental eavesdropper BER is approaching $0.5$ for uniformly distributed binary confidential message. Thus both reliability and security is obtained.

V-B Simulation of the Strong Security Scheme

Note that in degraded WTC model, subset $\mathcal{B}$ unstably exists according to different parameter $\beta$ and block length $N$. Thus to test the effectiveness of strong security scheme on subset $\mathcal{B}$, we built a stable subset $\mathcal{\widetilde{B}}$ on the degraded delay CSI WTC model.

Recall that for the precise degraded model in the previous subsection, we have a BEC main channel with erase probability $\epsilon_{m}=0.1$ and a varying BEC wiretap channel with uncertainty erase set $\{\epsilon_{w1}=0.4,\epsilon_{w2}=0.5\}$. Then we fix three kinds of $N$ length wiretap channel blocks:

• •

block1: stationary BEC channel block with $\epsilon_{w1}$;

• •

block2: stationary BEC channel block with $\epsilon_{w1}$;

• •

block3: non-stationary BEC channel block with erase probabilities uniformly choosing from $\{\epsilon_{w1},\epsilon_{w2}\}$.

And we assume that eavesdropper uniformly chooses wiretap channel blocks from them.

According to (21), for each block fixed above, we have subsets $\{\mathcal{I}^{(i)},\mathcal{R}^{(i)},\mathcal{B}^{(i)},\mathcal{F}^{(i)}\}$. Next, we separate a same subset $\mathcal{B}_{add}$ with fixed rate $\mathrm{R}_{add}=0.05$ from each $\mathcal{R}^{(i)}$ and satisfies $\mathcal{B}_{add}\subseteq\mathcal{R}^{(1)}\cap\mathcal{R}^{(2)}\cap\mathcal{R}^{(3)}$. Note that $\mathcal{B}_{add}\subseteq\mathcal{R}^{(i)}\subseteq\left(\mathcal{H}_{X|Z}^{(i)}\right)^{c}$, so it has a same reliability as the subset $\mathcal{B}^{(i)}$ from eavesdropper’s perspective. Also, since bits in subset $\mathcal{B}^{(i)}$ are directly decoded by the decoded bits of previous block, it can be pretended unreliable to legitimate parties (even though it is reliable). Therefore, we can have a stable subset $\mathcal{\widetilde{B}}^{(i)}=\mathcal{B}^{(i)}\cup\mathcal{B}_{add}$ for each block, which plays a same role as the original $\mathcal{B}^{(i)}$. Then we have the adjusted subsets for strong security scheme as $\{\mathcal{\widetilde{L}}_{X|Y},\mathcal{\widetilde{I}}^{\prime(i)},\mathcal{\widetilde{B}}^{\prime(i)},\mathcal{\widetilde{R}}^{(i)},\mathcal{\widetilde{B}}^{(i)},\mathcal{F}^{(i)}\}$, where $\mathcal{\widetilde{L}}_{X|Y}=\mathcal{L}_{X|Y}\setminus\mathcal{B}_{add}$, $\mathcal{\widetilde{I}}^{\prime(i)}=\mathcal{I}^{(i)}\setminus\mathcal{\widetilde{B}}^{\prime(i)}$, $|\mathcal{\widetilde{B}}^{\prime(i)}|=|\mathcal{\widetilde{B}}^{(i)}|$ and $\mathcal{\widetilde{R}}^{(i)}=\mathcal{R}^{(i)}\setminus\mathcal{B}_{add}$.

Next, based on this constructed model and subsets, we carry out the performance stimulation of the strong security coding scheme by choosing $T=1000$, $\beta$ from $0.18$ to $0.30$ and $N$ from $2^{10}$ to $2^{24}$. Results of the stimulation are illustrated in Fig. 6. Note that all these results of strong security scheme are the sum of entire $T+1$ blocks. Fig. 6a shows that when the block length $N$ increases, the theoretical upper bounds of the legitimate BER is vanishing, which meets the Proportion 4 for reliability. Fig. 6b shows that the information leakage rate is vanishing when $N$ increases, which meets the Proportion 5 for strong security. Fig. 6c shows the tendency of secrecy rate approaching the perfect CSI secrecy capacity $0.30$ with an increasing $N$, which meets the Proportion 6 for secrecy rate. Also, for the performance of different $\beta$, we can observe that when the parameter $\beta$ gets larger, the strong security scheme can obtain a better legitimate BER and information leakage but worse secrecy rate.

Further, we perform a communication test for the strong security scheme with $T=3$, $\beta$ from $0.20$ to $0.30$ and $N$ from $2^{8}$ to $2^{12}$. As illustrated in Fig. 7, when the block length increases, the experimental legitimate BER is dropping to an acceptable low level, and the experimental eavesdropper BER is approaching $0.5$ for uniformly distributed binary confidential message. Thus both reliability and security is obtained.

VI Conclusion

In this paper, we have presented a practical delay CSI WTC model with varying wiretap channel, and then investigate the corresponding secure polar coding scheme to achieve a secure and reliable communication.

As the first step, we proposed a OTP chain based secure polar coding scheme with a preliminary solution for the unidentifiable problem of the neither secure nor reliable subset $\mathcal{B}$ that we assign the subset $\mathcal{H}_{X}\cap\left(\mathcal{L}_{X|Y}\right)^{c}$ with publicly known frozen bits. However, this preliminary solution can only achieve weak security over degraded delay CSI WTC.

In the aim of achieving both strong security and reliability over non-degraded delay CSI WTC, we have further discussed the remaining limitation for applying the multi-block chaining structure and presented an new solution named as modified multi-block chaining structure which uses the secure subset $\mathcal{F}$ and subset $\mathcal{B}^{\prime}$ for conveying the bits for $\left(\mathcal{L}_{X|Y}\right)^{c}$. Finally by combining this modified multi-block chaining structure with weak security coding scheme, we have proposed a strong security polar coding scheme which can approach the secrecy capacity of perfect CSI case only with delay CSI assumption, with both reliability and strong security.

At last, we have carried out stimulations which has verified the performance of both weak and strong security coding schemes.

Acknowledgment

This work is supported in part by the Natural Science Foundation of Hubei Province (Grant No.2019CFB137) and the Fundamental Research Funds for the Central Universities (Grant No.2662017QD042, No.2662018JC007).