Polar Coding for Common Message Only Wiretap Broadcast Channel

TL;DR

This paper introduces a novel polar coding scheme for a wiretap broadcast channel that securely delivers the same confidential message to two receivers without assuming channel symmetry or degradedness.

Contribution

It extends polar coding techniques with a new chaining construction enabling secure, reliable transmission of a common confidential message to multiple receivers in a wiretap setting.

Findings

Achieves secure communication without channel symmetry assumptions

Introduces a chaining construction for reliable, secure message delivery

Provides a new analysis of dependencies for secrecy proof

Abstract

A polar coding scheme is proposed for the Wiretap Broadcast Channel with two legitimate receivers and one eavesdropper. We consider a model in which the transmitter wishes to send a private and a confidential message that must be reliably decoded by the receivers, and the confidential message must also be (strongly) secured from the eavesdropper. The coding scheme aims to use the optimal rate of randomness and does not make any assumption regarding the symmetry or degradedness of the channel. This paper extends previous work on polar codes for the wiretap channel by proposing a new chaining construction that allows to reliably and securely send the same confidential message to two different receivers. This construction introduces new dependencies between the random variables involved in the coding scheme that need to be considered in the secrecy analysis.

Equations

$$\underset{n\to \infty }{\lim }\mathbb{P}\left[(W,S)\ne ({\hat{W}}_{(k)},{\hat{S}}_{(k)})\right]=0,k\in [1,2].$$

$$\underset{n\to \infty }{\lim }I\left(S;Z^n\right)=0.$$

$$R_W+R_S$$

$$R_S$$

$$R_W+R_R$$

$$R_R$$

$${\mathcal{H}}_{X|Y}^{(n)}$$

$${\mathcal{L}}_{X|Y}^{(n)}$$

$$H(V|Z)>H(V|Y_{(1)})\ge H(V|Y_{(2)}).$$

$$\text{IEEEeqnarraymulticol}3l(R_W,R_S,R_R)$$

$$=$$

$${\mathcal{H}}_V^{(n)}$$

$${\mathcal{H}}_{V|Z}^{(n)}$$

$$\displaystyle\IEEEeqnarraymulticol{3}{r}{\geq 1-\delta_{n}\big{\}},}$$

$${\mathcal{L}}_{V|Z}^{(n)}$$

$${\mathcal{L}}_{V|Y_{(k)}}^{(n)}$$

$${\mathcal{H}}_{X|V}^{(n)}$$

$$\displaystyle\IEEEeqnarraymulticol{3}{r}{\geq 1-\delta_{n}\big{\}}.}$$

$${\mathcal{H}}_{X|VZ}^{(n)}$$

$$\displaystyle\IEEEeqnarraymulticol{3}{r}{\geq 1-\delta_{n}\big{\}}.}$$

$$\text{IEEEeqnarraymulticol}3l{p}_{A^n{T}^n}(a^n,t^n)$$

$$=$$

$${\mathcal{G}}^{(n)}$$

$${\mathcal{C}}^{(n)}$$

$${\mathcal{G}}_0^{(n)}$$

$${\mathcal{G}}_1^{(n)}$$

$${\mathcal{G}}_2^{(n)}$$

$${\mathcal{G}}_{1,2}^{(n)}$$

$${\mathcal{C}}_0^{(n)}$$

$${\mathcal{C}}_1^{(n)}$$

$${\mathcal{C}}_2^{(n)}$$

$${\mathcal{C}}_{1,2}^{(n)}$$

$$\displaystyle\big{|}\mathcal{G}^{(n)}_{1}\big{|}-\big{|}\mathcal{C}^{(n)}_{2}\big{|}\geq\big{|}\mathcal{G}^{(n)}_{2}\big{|}-\big{|}\mathcal{C}^{(n)}_{1}\big{|}>\big{|}\mathcal{C}^{(n)}_{1,2}\big{|}-\big{|}\mathcal{G}^{(n)}_{0}\big{|}.$$

$$\displaystyle\IEEEeqnarraymulticol{3}{l}{\big{|}\mathcal{C}^{(n)}_{1}\cup\mathcal{G}^{(n)}_{1}\big{|}-\big{|}\mathcal{C}^{(n)}_{2}\cup\mathcal{G}^{(n)}_{2}\big{|}}$$

$$=$$

$$\displaystyle\IEEEeqnarraymulticol{3}{l}{\lim_{n\rightarrow\infty}\frac{1}{n}\big{|}\mathcal{H}^{(n)}_{V}\cap\big{(}\mathcal{L}^{(n)}_{V|Y_{(k)}}\big{)}^{\text{C}}\big{|}}$$

$$=$$

$$\displaystyle\IEEEeqnarraymulticol{3}{l}{\big{|}\mathcal{G}^{(n)}_{0}\cup\mathcal{G}^{(n)}_{2}\big{|}-\big{|}\mathcal{C}^{(n)}_{1}\cup\mathcal{C}^{(n)}_{1,2}\big{|}}$$

$$=$$

$${\Psi }_i^{(V)}$$

$${\Gamma }_i^{(V)}$$

$${\Theta }_i^{(V)}$$

$${\bar{\Theta }}_i^{(V)}\triangleq {\tilde{A}}_i[{\mathcal{C}}_1^{(n)}]\oplus {\kappa }_{\Theta }^{(V)},$$

Full text

I Introduction

Information-theoretic security over noisy channels was introduced by Wyner in [1], which characterized the secrecy-capacity of the degraded wiretap channel. Later, Csiszár and Körner in [2] generalized Wyner’s results to the general wiretap channel. In these settings, one transmitter wishes to reliably send one message to a legitimate receiver, while keeping it secret from an eavesdropper, where secrecy is defined based on a condition on some information-theoretic measure that is fully quantifiable. One of these measures is the information leakage, defined as the mutual information $I(W;Z^{n})$ between a uniformly distributed random message $W$ and the channel observations $Z^{n}$ at the eavesdropper, $n$ being the number of uses of the channel. Based on this measure, the most common secrecy conditions required to be satisfied by channel codes are the weak secrecy, which requires $\lim_{n\rightarrow\infty}\frac{1}{n}I(W;Z^{n})=0$, and the strong secrecy, requiring $\lim_{n\rightarrow\infty}I(W;Z^{n})=0$. Although the second notion of security is stronger, surprisingly both conditions result in the same secrecy-capacity [3].

In the last decade, information-theoretic security has been extended to a large variety of contexts, and polar codes have become increasingly popular in this area due to their easily provable secrecy capacity achieving property. Polar codes were originally proposed by Arikan in [4] to achieve the capacity of binary-input, symmetric, point-to-point channels under Successive Cancellation (SC) decoding. Secrecy capacity achieving polar codes for the binary symmetric degraded wiretap channel were introduced in [5] and [6], satisfying the weak and the strong secrecy condition, respectively. Recently, polar coding has been extended to the general wiretap channel in [7, 8, 9, 10] and to different multiuser scenarios (for instance, see [11] and [12]). Indeed, [9] and [10] generalize their results providing polar codes for the broadcast channel with confidential messages.

This paper provides a polar coding scheme that allows to transmit strongly confidential common information to two legitimate receivers over the Wiretap Broadcast Channel (WBC). Although [13] provided an obvious lower-bound on the secrecy-capacity of this model, no constructive polar coding scheme has already been proposed so far. Our polar coding scheme is based mainly on the one introduced by [10] for the broadcast channel with confidential messages. Therefore, the proposed polar coding scheme aims to use the optimal amount of randomness in the encoding. Moreover, in order to construct an explicit polar coding scheme that provides strong secrecy, the distribution induced by the encoder must be close in terms of statistical distance to the original one considered for the code construction, and transmitter and legitimate receivers need to share a secret key of negligible size in terms of rate. Nevertheless, the particularization for the model proposed in this paper is not straightforward. Specifically, we propose a new chaining construction [14] (transmission will take place over several blocks) that is crucial to secretly transmit common information to different legitimate receivers. This construction introduces new dependencies between the random variables that are involved in the polar coding scheme that must be considered carefully in the secrecy analysis. These dependencies are bidirectional between random variables of adjacent blocks and, consequently, we need to introduce an additional privately-shared key of negligible length in terms of rate for the polar coding scheme to provide strong secrecy.

I-A Notation

Through this paper, let the interval $[a,b]$, where $a,b\in\mathbb{Z}_{+}$ and $a\leq b$, denote the set of integers between $a$ and $b$ (both included). Let $u^{n}$ denote a row vector $(u(1),\dots,u(n))$. We write $u^{1:j}$ for $j\in[1,n]$ to denote the subvector $(u(1),\dots,u(j))$. For any set of indices $\mathcal{S}\subseteq[1,n]$, we write $u[\mathcal{S}]$ to denote the sequence $\{u(j)\}_{j\in\mathcal{S}}$, and we use $\mathcal{S}^{\text{C}}$ to denote the set complement in $[1,n]$, that is, $\mathcal{S}^{\text{C}}=[1,n]\setminus\mathcal{S}$. If $\mathcal{S}$ denotes an event, then $\mathcal{S}^{\text{C}}$ also denotes its complement. Consider some index $i\in[1,L]$, where $L\in\mathbb{Z}^{+}$, and consider the vector $u_{i}^{n}$. We write $u_{1:L}^{n}$ to denote the set of vectors $\{u_{1}^{n},\dots,u_{L}^{n}\}$. We use $\ln$ to denote the natural logarithm, whereas $\log$ denotes the logarithm base 2. Let $X$ be a random variable taking values in $\mathcal{X}$, and let $q_{x}$ and $p_{x}$ be two different distributions with support $\mathcal{X}$, then $\mathbb{D}(q_{x},p_{x})$ and $\mathbb{V}(q_{x},p_{x})$ denote the Kullback-Leibler divergence and the total variation distance respectively. Finally, $h_{2}(p)$ denotes the binary entropy function, i.e., $h_{2}(p)=-p\log p-(1-p)\log(1-p)$, and we define the indicator function $\mathds{1}\{u\}$ such that equals to 1 if the predicate $u$ is true and 0 otherwise.

I-B Organization

The remaining of this paper is organized as follows. Section II introduces the channel model formally. In Section III, the fundamental theorems of polar codes are revisited. Section IV describes the proposed polar coding scheme. In Section V, the performance of the coding scheme is analyzed. Finally, the concluding remarks are presented in Section VI.

II Channel Model and Achievable Region

Formally, a WBC $(\mathcal{X},p_{Y_{(1)}Y_{(2)}Z|X},\mathcal{Y}_{(1)}\times\mathcal{Y}_{(2)}\times\mathcal{Z})$ with 2 legitimate receivers and an external eavesdropper is characterized by the probability transition function $p_{Y_{(1)}Y_{(2)}Z|X}$, where $X\in\mathcal{X}$ denotes the channel input, $Y_{(k)}\in\mathcal{Y}_{(k)}$ denotes the channel output corresponding to the legitimate receiver $k\in[1,2]$, and $Z\in\mathcal{Z}$ denotes the channel output corresponding to the eavesdropper. We consider a model, namely Common Information over the WBC (CI-WBC), in which the transmitter wishes to send a private message $W$ and a confidential message $S$ to both legitimate receivers. A code \big{(}\lceil 2^{nR_{W}}\rceil,\lceil 2^{nR_{S}}\rceil,\lceil 2^{nR_{R}}\rceil,n\big{)} for the CI-WBC consist of a private message set \mathcal{W}\triangleq\big{[}1,\lceil 2^{nR_{W}}\rceil\big{]}, a confidential message set \mathcal{S}\triangleq\big{[}1,\lceil 2^{nR_{S}}\rceil\big{]}, a randomization sequence set \mathcal{R}\triangleq\big{[}1,\lceil 2^{nR_{R}}\rceil\big{]} (typically referred as local randomness and needed to confuse the eavesdropper about the confidential message $S$), an encoding function $f:\mathcal{W}\times\mathcal{S}\times\mathcal{R}\rightarrow\mathcal{X}^{n}$ that maps $(w,s,r)$ to a codeword $x^{n}$, and two decoding functions $g_{(1)}$ and $g_{(2)}$ such that $g_{(k)}:\mathcal{Y}_{(k)}^{n}\rightarrow\mathcal{W}\times\mathcal{S}$ ($k\in[1,2]$) maps the $k$-th legitimate receiver observations $y_{(k)}^{n}$ to the estimates $(\hat{w}_{(k)},\hat{s}_{(k)})$. The reliability condition to be satisfied by this code is measured in terms of the average probability of error and is given by

[TABLE]

The strong secrecy condition is measured in terms of the information leakage and is given by

[TABLE]

This model is graphically illustrated in Figure 1. A triple of rates $(R_{W},R_{S},R_{R})\in\mathbb{R}_{+}^{3}$ will be achievable for the CI-WBC if there exists a sequence of $(\lceil 2^{nR_{W}}\rceil,\lceil 2^{nR_{S}}\rceil,\lceil 2^{nR_{R}}\rceil,n)$ codes such that satisfy the reliability and secrecy conditions (1) and (2) respectively.

The achievable rate region is defined as the closure of the set of all achievable rate triples $(R_{W},R_{S},R_{R})$. The following proposition defines an inner-bound on the achievable rate region.

Proposition 1** (Adapted from [13, 15]).**

The region $\mathfrak{R}_{\text{\emph{CI-WBC}}}$ defined by the union over the tiples of rates $(R_{W},R_{S},R_{R})\in\mathbb{R}_{+}^{3}$ satisfying

[TABLE]

where the union is taken over all distributions $p_{VX}$ such that $V-X-(Y_{(1)},Y_{(2)},Z)$ forms a Markov chain, defines an inner-bound on the achievable region of the CI-WBC.

III Review of Polar Codes

Let $(\mathcal{X}\times\mathcal{Y},p_{XY})$ be a Discrete Memoryless Source (DMS), where111Throughout this paper, we assume binary polarization. Nevertheless, an extension to $q$-ary alphabets is possible [16, 17]. ${X}\in\{0,1\}$ and $Y\in\mathcal{Y}$. The polar transform over the $n$-sequence $X^{n}$, $n$ being any power of $2$, is defined as $U^{n}\triangleq X^{n}G_{n}$, where G_{n}\triangleq\bigl{[}\begin{smallmatrix}1&1\\ 1&0\end{smallmatrix}\bigr{]}^{\otimes n} is the source polarization matrix [18]. Since $G_{n}=G_{n}^{-1}$, then $X^{n}=U^{n}G_{n}$.

The polarization theorem for source coding with side information [18, Theorem 1] states that the polar transform extracts the randomness of $X^{n}$ in the sense that, as $n\rightarrow\infty$, the set of indices $j\in[1,n]$ can be divided practically into two disjoint sets, namely $\smash{\mathcal{H}_{X|Y}^{(n)}}$ and $\smash{\mathcal{L}_{X|Y}^{(n)}}$, such that $U(j)$ for $j\in\mathcal{H}_{X|Y}^{(n)}$ is practically independent of $(U^{1:j-1},Y^{n})$ and uniformly distributed, that is, $H({U(j)|U^{1:j-1},Y^{n}})\rightarrow 1$, and $U(j)$ for $j\in\smash{\mathcal{L}_{X|Y}^{(n)}}$ is almost determined by $(U^{1:j-1},Y^{n})$, which means that $H(U(j)|U^{1:j-1},Y^{n})\rightarrow 0$. Formally, let $\delta_{n}\triangleq 2^{-n^{\beta}}$, where $\beta\in(0,\frac{1}{2})$, and

[TABLE]

Then, by [18, Theorem 1] we have $\smash{\lim_{n\rightarrow\infty}\frac{1}{n}|\mathcal{H}_{X|Y}^{(n)}|}=H(X|Y)$ and $\smash{\lim_{n\rightarrow\infty}\frac{1}{n}|\mathcal{L}_{X|Y}^{(n)}|}=1-H(X|Y)$. Consequently, the number of elements $U(j)$ that have not polarized is asymptotically negligible in terms of rate, that is, $\smash{\lim_{n\rightarrow\infty}\frac{1}{n}|(\mathcal{H}_{X|Y}^{(n)})^{\text{C}}\setminus\mathcal{L}_{X|Y}^{(n)}|}=0$.

Furthermore, [18, Theorem 2] states that given the part $U[(\mathcal{L}_{X|Y}^{(n)})^{\text{C}}]$ and the channel output observations $Y^{n}$, the remaining part $\smash{U[\mathcal{L}_{X|Y}^{(n)}]}$ can be reconstructed by using SC decoding with error probability in $O(n\delta_{n})$.

Similarly to $\mathcal{H}_{X|Y}^{(n)}$ and $\mathcal{L}_{X|Y}^{(n)}$, the sets $\mathcal{H}_{X}^{(n)}$ and $\mathcal{L}_{X}^{(n)}$ can be defined by considering that the observations $Y^{n}$ are absent. Since conditioning does not increase the entropy, we have $\mathcal{H}_{X}^{(n)}\supseteq\mathcal{H}_{X|Y}^{(n)}$ and $\mathcal{L}_{X}^{(n)}\subseteq\mathcal{L}_{X|Y}^{(n)}$. A discrete memoryless channel $(\mathcal{X},p_{Y|X},\mathcal{Y})$ with some arbitrary $p_{X}$ can be seen as a DMS $(\mathcal{X}\times\mathcal{Y},p_{X}p_{Y|X})$. In channel polar coding, first we define the sets of indices $\mathcal{H}_{X|Y}^{(n)}$, $\mathcal{L}_{X|Y}^{(n)}$, $\mathcal{H}_{X}^{(n)}$ and $\mathcal{L}_{X}^{(n)}$ from the target distribution $p_{X}p_{Y|X}$. Then, based on the previous sets, the encoder somehow constructs222Since the polar-based encoder will construct random variables that must approach the target distribution of the DMS, throughout this paper we use tilde above the random variables to emphazise this purpose. $\tilde{U}^{n}$ and applies the inverse polar transform $\tilde{X}^{n}=\tilde{U}^{n}G_{n}$. Afterwards, the transmitter sends $\tilde{X}^{n}$ over the channel, which induces $\tilde{Y}^{n}$. Let $(\tilde{X}^{n},\tilde{Y}^{n})\sim\tilde{q}_{X^{n}}\tilde{q}_{Y^{n}|X^{n}}$, if $\mathbb{V}(\tilde{q}_{X^{n}Y^{n}},p_{X^{n}Y^{n}})\rightarrow 0$ then the receiver can reliably reconstruct $\tilde{U}[\mathcal{L}_{X|Y}^{(n)}]$ from $\tilde{Y}^{n}$ and $\smash{\tilde{U}[(\mathcal{L}_{X|Y}^{(n)})^{\text{C}}]}$ by performing SC decoding [19].

IV Polar Coding Scheme

Let $(\mathcal{V}\times\mathcal{X}\times\mathcal{Y}_{(1)}\times\mathcal{Y}_{(2)}\times\mathcal{Z},p_{VXY_{(1)}Y_{(2)}Z})$ denote the DMS that represents the input $(V,X)$ and the output $(Y_{(1)},Y_{(2)},Z)$ random variables of the CI-WBC, where $|\mathcal{V}|=|\mathcal{X}|=2$. Without loss of generality, and to avoid the trivial case $R_{S}=0$ in Proposition 1, we assume that

[TABLE]

If $H(V|Y_{(1)})<H(V|Y_{(2)})$, one can simply exchange the role of $Y_{(1)}$ and $Y_{(2)}$ in the encoding scheme of Section IV. We propose a polar coding scheme that achieves the following rate triple,

[TABLE]

which corresponds to the one of the region in Proposition 1 such that the confidential message rate is maximum and the amount of local randomness is minimum.

For the input random variable $V$ of the DMS, we define the polar transform $A^{n}\triangleq V^{n}G_{n}$ and the sets

[TABLE]

where $k\in[1,2]$. For the input random variable $X$, we define $T^{n}\triangleq X^{n}G_{n}$ and the associated sets

[TABLE]

We have $p_{A^{n}T^{n}}(a^{n},t^{n})=p_{V^{n}X^{n}}(a^{n}G_{n},t^{n}G_{n})$ due to the invertibility of $G_{n}$ and, for convenience, we write

[TABLE]

The non-degraded nature of the broadcast channel means having to use a chaining construction [14]. Hence, consider that the encoding takes place over $L$ blocks indexed by $i\in[1,L]$. At the $i$-th block, the encoder will construct $\tilde{A}_{i}^{n}$, which will carry the private and the confidential messages intended to both legitimate receivers. Additionally, the encoder will store into $\tilde{A}_{i}^{n}$ some elements from $\tilde{A}_{i-1}^{n}$ (if $i\in[2,L]$) and $\tilde{A}_{i+1}^{n}$ (if $i\in[1,L-1]$) so that both legitimate receivers are able to reliably reconstruct $\tilde{A}_{1:L}^{n}$. Then, given $\tilde{V}_{i}^{n}=\tilde{A}_{i}^{n}G_{n}$, the encoder will perform the polar-based channel prefixing to construct $\tilde{T}_{i}^{n}$. Finally, it will obtain $\tilde{X}_{i}^{n}=\tilde{T}_{i}^{n}G_{n}$, which will be transmitted over the WBC inducing the channel outputs $(\tilde{Y}_{(1),i}^{n},\tilde{Y}_{(2),i}^{n},\tilde{Z}_{i}^{n})$.

IV-A General polar-based encoding

Consider the construction of $\tilde{A}^{n}_{1:L}$. Besides the sets defined in (5)–(8), we define the partition of $\mathcal{H}_{V}^{(n)}$:

[TABLE]

Moreover, we also define

[TABLE]

which form a partition of the set $\mathcal{G}^{(n)}$, and

[TABLE]

which form a partition of $\mathcal{C}^{(n)}$. These sets are graphically represented in Figure 2. Roughly speaking, according to (5), $A[\mathcal{H}^{(n)}_{V}]$ is the nearly uniformly distributed part of $A^{n}$. Thus, $\tilde{A}_{i}[\mathcal{H}^{(n)}_{V}]$, $i\in[1,L]$, is suitable for storing uniformly distributed random sequences. According to (6), $A[\mathcal{H}^{(n)}_{V|Z}]$ is almost independent of $Z^{n}$. Thus, $\tilde{A}_{i}[\mathcal{G}^{(n)}]$ is suitable for storing information to be secured from the eavesdropper, whereas $\tilde{A}_{i}[\mathcal{C}^{(n)}]$ is not. Sets in (14)–(21) with subscript 1 (sets inside the red curve in Figure 2) form $\mathcal{H}^{(n)}_{V}\cap(\mathcal{L}^{(n)}_{V|Y_{(1)}})^{\text{C}}$, while those with subscript 2 (sets inside the blue curve) form $\smash{\mathcal{H}^{(n)}_{V}\cap(\mathcal{L}^{(n)}_{V|Y_{(2)}})^{\text{C}}}$. From Section III, $\smash{\tilde{A}_{i}[\mathcal{H}^{(n)}_{V}\cap(\mathcal{L}^{(n)}_{V|Y_{(k)}})^{\text{C}}]}$ is the nearly uniformly distributed part of the sequence $\tilde{A}_{i}^{n}$ required by legitimate receiver $k$ to reliably reconstruct the entire sequence by performing SC decoding.

For sufficiently large $n$, assumption (3) imposes the following restriction on the size of the previous sets:

[TABLE]

The left-hand inequality in (22) holds from the fact that

[TABLE]

where the positivity holds by [18, Theorem 1] because

[TABLE]

for any $k\in[1,2]$. Similarly, the right-hand inequality in (22) follows from [18, Theorem 1] and the fact that

[TABLE]

Thus, according to (22), we must consider four cases:

• A.

$|\mathcal{G}^{(n)}_{1}|>|\mathcal{C}^{(n)}_{2}|$, ${|\mathcal{G}^{(n)}_{2}|>|\mathcal{C}^{(n)}_{1}|}$ and ${|\mathcal{G}^{(n)}_{0}|\geq|\mathcal{C}^{(n)}_{1,2}|}$;

• B.

$|\mathcal{G}^{(n)}_{1}|>|\mathcal{C}^{(n)}_{2}|$, ${|\mathcal{G}^{(n)}_{2}|>|\mathcal{C}^{(n)}_{1}|}$ and ${|\mathcal{G}^{(n)}_{0}|<|\mathcal{C}^{(n)}_{1,2}|}$;

• C.

$|\mathcal{G}^{(n)}_{1}|\geq|\mathcal{C}^{(n)}_{2}|$, $|\mathcal{G}^{(n)}_{2}|\leq|\mathcal{C}^{(n)}_{1}|$ and $|\mathcal{G}^{(n)}_{0}|>|\mathcal{C}^{(n)}_{1,2}|$;

• D.

$|\mathcal{G}^{(n)}_{1}|<|\mathcal{C}^{(n)}_{2}|$, $|\mathcal{G}^{(n)}_{2}|<|\mathcal{C}^{(n)}_{1}|$ and $|\mathcal{G}^{(n)}_{0}|>|\mathcal{C}^{(n)}_{1,2}|$.

The generic encoding process for all cases is summarized in Algorithm 1. For $i\in[1,L]$, let $W_{i}$ be a uniformly distributed vector of length $|\mathcal{C}^{(n)}|$ that represents the private message. The encoder forms $\tilde{A}_{i}[\mathcal{C}^{(n)}]$ by simply storing $W_{i}$. Indeed, if $i\in[1,L-1]$, notice that the encoder forms $\tilde{A}_{i+1}[\mathcal{C}^{(n)}]$ before constructing the entire sequence $\tilde{A}_{i}^{n}$.

From $\tilde{A}_{i}[\mathcal{C}^{(n)}]$, $i\in[1,L]$, we define the sequences

[TABLE]

Notice that $[\Psi_{i}^{(V)},\Gamma_{i}^{(V)}]=\tilde{A}_{i}[\mathcal{C}^{(n)}_{2}\cup\mathcal{C}^{(n)}_{1,2}]$ is required by legitimate receiver 2 to reliably estimate $\tilde{A}_{i}^{n}$ entirely and, thus, the encoder repeats $[\Psi_{i}^{(V)},\Gamma_{i}^{(V)}]$, if $i\in[1,L-1]$, conveniently in $\tilde{A}_{i+1}[\mathcal{G}^{(n)}]$ (the function form_A${}_{\text{{G}}}$ is responsible of the chaining construction and is described later). On the other hand, $[\Theta_{i}^{(V)},\Gamma_{i}^{(V)}]=\tilde{A}_{i}[\mathcal{C}^{(n)}_{1}\cup\mathcal{C}^{(n)}_{1,2}]$ is required by legitimate receiver 1. Nevertheless, in order to satisfy the strong secrecy condition in (2), $[\Theta_{i}^{(V)},\Gamma_{i}^{(V)}]$, $i\in[2,L]$, is not repeated directly into $\tilde{A}_{i-1}[\mathcal{G}^{(n)}]$, but the encoder copies instead $\bar{\Theta}_{i}^{(V)}$ and $\bar{\Gamma}_{i}^{(V)}$ obtained as follows. Let $\kappa_{\Theta}^{(V)}$ and $\kappa_{\Gamma}^{(V)}$ be uniformly distributed keys with length $\smash{|\mathcal{C}_{1}^{(n)}|}$ and $\smash{|\mathcal{C}_{1,2}^{(n)}|}$ respectively, which are privately shared between transmitter and both legitimate receivers. For any $i\in[2,L]$, we define the sequences

[TABLE]

Since these secret keys are reused in all blocks, their size becomes negligible in terms of rate for $L$ large enough.

The function form_A${}_{\text{{G}}}$ in Algorithm 1 constructs sequences $\tilde{A}_{1:L}[\mathcal{G}^{(n)}]$ differently depending on which case, among cases A, B, C or D described before, characterizes the given CI-WBC. This part of the encoding is described in detail in Section IV-B and Algorithm 2.

Then, given $\tilde{A}_{i}[\mathcal{C}^{(n)}\cup\mathcal{G}^{(n)}]$, the encoder forms the remaining entries of $\tilde{A}_{i}^{n}$, i.e., $\tilde{A}_{i}[(\mathcal{H}_{V}^{(n)})^{\text{C}}]$, as follows. If $j\in\mathcal{L}_{V}^{(n)}$, it constructs $\tilde{A}_{i}(j)$ deterministically by using SC encoding as in [20]. Thus, we define the SC encoding function $\xi^{(V)}_{(j)}:\{0,1\}^{j-1}\rightarrow\{0,1\}$ in Algorithm 1 as

[TABLE]

$p_{A(j)|A^{1:j-1}}$ corresponding to the distribution of the original DMS –see (11)–. Therefore, notice that only the part $\tilde{A}_{i}[(\mathcal{H}^{(n)}_{V})^{\text{C}}\setminus\mathcal{L}^{(n)}_{V}]$ of $\tilde{A}_{i}^{n}$ is constructed randomly.

Finally, for $i\in[1,L]$, given $\tilde{V}_{i}^{n}=\tilde{A}_{i}^{n}G_{n}$, a randomization sequence $R_{i}$ and a uniformly distributed random sequence $\Lambda_{0}^{(V)}$, the encoder performs the polar-based channel prefixing (function pb_ch_pref in Algorithm 1) to obtain $\tilde{X}_{i}^{n}$, which is transmitted over the WBC inducing outputs $\tilde{Y}_{(1),i}^{n}$, $\tilde{Y}_{(2),i}^{n}$ and $\tilde{Z}_{i}^{n}$. This part of the encoding is described in detail in Section IV-C.

Furthermore, the encoder obtains

[TABLE]

for any $k\in[1,2]$ and $i\in[1,L]$, which is required by legitimate receiver $k$ to reliably estimate $\tilde{A}_{i}^{n}$ entirely. Since $\Phi_{(k),i}^{(V)}$ is not nearly uniform, the encoder cannot make it available to the legitimate receiver $k$ by means of the chaining structure. Also, the encoder obtains

[TABLE]

The sequence $\smash{\Upsilon_{(1)}^{(V)}}$ is required by legitimate receiver 1 to initialize the decoding process, while the sequence $\Upsilon_{(2)}^{(V)}$ is required by legitimate receiver 2. Therefore, the transmitter additionally sends $\smash{(\Upsilon_{(k)}^{(V)},\Phi_{(k),i}^{(V)})\oplus\kappa_{{\Upsilon\Phi}_{(k)}}^{(V)}}$ to legitimate receiver $k$, $\kappa_{{\Upsilon\Phi}_{(k)}}^{(V)}$ being a uniformly distributed key with size

[TABLE]

that is privately shared between transmitter and the corresponding receiver. We show in Section V-A that the length of $\kappa_{{\Upsilon\Phi}_{(1)}}^{(V)}$ and $\kappa_{{\Upsilon\Phi}_{(2)}}^{(V)}$ is asymptotically negligible in terms of rate.

IV-B Function form_A${}_{\text{{G}}}$.

Function form_A${}_{\text{{G}}}$ encodes the confidential messages $S_{1:L}$ and builds the chaining construction.

Based on the sets in (12)–(21), let $\mathcal{R}^{(n)}_{1}\subseteq\mathcal{G}^{(n)}_{0}\cup\mathcal{G}^{(n)}_{2}$, $\mathcal{R}^{\prime(n)}_{1}\subseteq\mathcal{G}^{(n)}_{2}$, $\mathcal{R}^{(n)}_{2}\subseteq\mathcal{G}^{(n)}_{1}$, $\mathcal{R}^{\prime(n)}_{2}\subseteq\mathcal{G}^{(n)}_{1}$, $\mathcal{R}^{(n)}_{1,2}\subseteq\mathcal{G}^{(n)}_{0}$, $\mathcal{R}^{\prime(n)}_{1,2}\subseteq\mathcal{G}^{(n)}_{0}$, $\mathcal{I}^{(n)}\subseteq\mathcal{G}^{(n)}_{0}\cup\mathcal{G}^{(n)}_{2}$, $\mathcal{R}^{(n)}_{\text{S}}\subseteq\mathcal{G}^{(n)}_{1}$ and $\mathcal{R}^{(n)}_{\Lambda}\subseteq\mathcal{G}^{(n)}_{1}$ form an additional partition of $\mathcal{G}^{(n)}$. The definition of $\mathcal{R}^{(n)}_{1}$, $\mathcal{R}^{\prime(n)}_{1}$, $\mathcal{R}^{(n)}_{2}$, $\mathcal{R}^{\prime(n)}_{2}$, $\mathcal{R}^{(n)}_{1,2}$ and $\smash{\mathcal{R}^{\prime(n)}_{1,2}}$ will depend on the particular case (among A to D), while

[TABLE]

For $i\in[1,L]$, let $S_{i}$ denote a uniformly distributed vector that represents the confidential message. The message $S_{1}$ has size $|\mathcal{I}^{(n)}\cup\mathcal{G}^{(n)}_{1}\cup\mathcal{G}^{(n)}_{1,2}|$; for $i\in[2,L-1]$, $S_{i}$ has size $|\mathcal{I}^{(n)}|$; and $S_{L}$ has size $|\mathcal{I}^{(n)}\cup\mathcal{G}_{2}^{(n)}|$.

For $i\in[1,L]$, we write \Psi_{i}^{(V)}\triangleq\big{[}\Psi_{1,i}^{(V)},\Psi_{2,i}^{(V)}\big{]}, \Gamma_{i}^{(V)}\triangleq\big{[}\Gamma_{1,i}^{(V)},\Gamma_{2,i}^{(V)}\big{]}, \bar{\Theta}_{i}^{(V)}\triangleq\big{[}\bar{\Theta}_{1,i}^{(V)},\bar{\Theta}_{2,i}^{(V)}\big{]} and \bar{\Gamma}_{i}^{(V)}\triangleq\big{[}\bar{\Gamma}_{1,i}^{(V)},\bar{\Gamma}_{2,i}^{(V)}\big{]}; and we define $\Psi_{p,i}$, $\Gamma_{p,i}$, $\bar{\Theta}_{p,i}$ and $\bar{\Gamma}_{p,i}$, for any $p\in[1,2]$, accordingly in each case.

IV-B1 Case A

In this case, recall that $|\mathcal{G}^{(n)}_{1}|>|\mathcal{C}^{(n)}_{2}|$, ${|\mathcal{G}^{(n)}_{2}|>|\mathcal{C}^{(n)}_{1}|}$ and ${|\mathcal{G}^{(n)}_{0}|\geq|\mathcal{C}^{(n)}_{1,2}|}$. We define

[TABLE]

and $\mathcal{R}^{\prime(n)}_{1}=\mathcal{R}^{\prime(n)}_{2}=\mathcal{R}^{\prime(n)}_{1,2}\triangleq\emptyset$. By the assumption of Case A, it is clear that $\mathcal{R}^{(n)}_{1}$, $\mathcal{R}^{(n)}_{2}$ and $\mathcal{R}^{(n)}_{1,2}$ exist. Also, by (22), the set $\mathcal{I}^{(n)}$ exists, and so will $\mathcal{R}^{(n)}_{\text{S}}$ because

[TABLE]

For $i\in[1,L]$, we define $\Psi_{1,i}^{(V)}\triangleq\Psi_{i}^{(V)}$, $\Gamma_{1,i}^{(V)}\triangleq\Gamma_{i}^{(V)}$, $\bar{\Theta}_{1,i}^{(V)}\triangleq\bar{\Theta}_{i}^{(V)}$, $\bar{\Gamma}_{1,i}^{(V)}\triangleq\bar{\Gamma}_{i}^{(V)}$ and, therefore, we have $\Psi_{2,i}^{(V)}=\Gamma_{2,i}^{(V)}=\bar{\Theta}_{2,i}^{(V)}=\bar{\Gamma}_{2,i}^{(V)}\triangleq\varnothing$.

From (20), we have $\mathcal{C}_{2}^{(n)}\subseteq\mathcal{L}_{V|Y_{(1)}}^{(n)}\setminus\mathcal{L}_{V|Y_{(2)}}^{(n)}$. Thus, $\smash{\Psi_{i-1}^{(V)}=\tilde{A}_{i-1}[\mathcal{C}_{2}^{(n)}]}$ is needed by receiver 2 to reliably reconstruct $\tilde{A}_{i-1}^{n}$, but can be reliably inferred by receiver 1 given $\smash{\tilde{A}_{i-1}[(\mathcal{L}_{V|Y_{(1)}}^{(n)})^{\text{C}}]}$. Thus, according to Algorithm 2, the encoder repeats the entire sequence $\Psi_{i-1}^{(V)}$ in $\tilde{A}_{i}[\mathcal{R}_{2}^{(n)}]\subseteq\tilde{A}_{i}[\mathcal{L}_{V|Y_{(2)}}^{(n)}\setminus\mathcal{L}_{V|Y_{(1)}}^{(n)}]$.

Similarly, from (19), we have $\mathcal{C}_{1}^{(n)}\subseteq\mathcal{L}_{V|Y_{(1)}}^{(n)}\setminus\mathcal{L}_{V|Y_{(2)}}^{(n)}$. Thus, $\smash{\Theta_{i+1}^{(V)}=\tilde{A}_{i+1}[\mathcal{C}_{1}^{(n)}]}$ is needed by receiver 1 to reliably reconstruct $\smash{\tilde{A}_{i+1}^{n}}$ but given $\smash{\tilde{A}_{i}[(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}]}$ can be inferred by receiver 2. Thus, the encoder repeats the sequence $\bar{\Theta}_{i+1}^{(V)}$ in $\tilde{A}_{i}[\mathcal{R}_{1}^{(n)}]\subseteq\tilde{A}_{i}[\mathcal{L}_{V|Y_{(2)}}^{(n)}\setminus\mathcal{L}_{V|Y_{(1)}}^{(n)}]$.

Finally, from (21), $\mathcal{C}_{1,2}^{(n)}\subseteq(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}\cap(\mathcal{L}_{V|Y_{(1)}}^{(n)})^{\text{C}}$. Thus, $\smash{\Gamma_{i-1}^{(V)}}$ and $\smash{\Gamma_{i+1}^{(V)}}$ are needed by both receivers to reliably reconstruct the sequences $\smash{\tilde{A}_{i-1}^{n}}$ and $\smash{\tilde{A}_{i+1}^{n}}$ respectively. Consequently, the encoder repeats $\Gamma_{i-1}^{(V)}$ and $\bar{\Gamma}_{i+1}^{(V)}$ in $\smash{\tilde{A}_{i}[\mathcal{R}_{1,2}^{(n)}]\subseteq\tilde{A}_{i}[\mathcal{L}_{V|Y_{(1)}}^{(n)}\cap\mathcal{L}_{V|Y_{(2)}}^{(n)}]}$. Indeed, both sequences are repeated in the same entries of $\tilde{A}_{i}[\mathcal{G}_{0}^{(n)}]$ by performing $\Gamma_{i-1}^{(V)}\oplus\bar{\Gamma}_{i+1}^{(V)}$. Since $\Gamma_{0}^{(V)}=\bar{\Gamma}_{L+1}^{(V)}=\varnothing$, only $\bar{\Gamma}_{2}^{(V)}$ is repeated at block 1 and $\Gamma_{L-1}^{(V)}$ at block $L$.

Moreover, part of secret message $S_{i}$, $i\in[1,L]$, is stored into some entries of $\tilde{A}_{i}^{n}$ whose indices belong to $\mathcal{G}_{2}^{(n)}$. Thus, in any block $i\in[2,L]$, the encoder repeats

[TABLE]

in $\tilde{A}_{i}[\mathcal{R}_{\text{S}}^{(n)}]\subseteq\tilde{A}_{i}[\mathcal{L}_{V|Y_{(2)}}^{(n)}\setminus\mathcal{L}_{V|Y_{(1)}}^{(n)}]$. Also, it repeats

[TABLE]

in $\tilde{A}_{i}[\mathcal{R}_{\Lambda}^{(n)}]$. Hence, $\Lambda_{1}^{(V)}$ is repeated in all blocks.

These sets that form the partition of $\mathcal{G}^{(n)}$ in Case A can be seen in Figure 3, which also displays the encoding process that aims to construct $\tilde{A}_{1:L}[\mathcal{C}^{(n)}\cup\mathcal{G}^{(n)}]$.

IV-B2 Case B

In this case, recall that $|\mathcal{G}^{(n)}_{1}|>|\mathcal{C}^{(n)}_{2}|$, ${|\mathcal{G}^{(n)}_{2}|>|\mathcal{C}^{(n)}_{1}|}$ and ${|\mathcal{G}^{(n)}_{0}|<|\mathcal{C}^{(n)}_{1,2}|}$. We define $\mathcal{R}^{(n)}_{1}$ and $\mathcal{R}^{(n)}_{2}$ as in (35) and (36) respectively, and $\mathcal{R}_{1,2}^{\prime(n)}\triangleq\emptyset$. Now, since $|\mathcal{G}^{(n)}_{0}|<|\mathcal{C}^{(n)}_{1,2}|$, for any $i\in[1,L]$ only a part of $\Gamma_{i-1}^{(V)}\oplus\bar{\Gamma}_{i+1}^{(V)}$ can be repeated entirely in $\tilde{A}_{i}[\mathcal{G}_{0}^{(n)}]$. Thus, we define $\mathcal{R}^{(n)}_{1,2}\triangleq\mathcal{G}^{(n)}_{0}$ and

[TABLE]

Obviously, $\smash{\mathcal{R}^{(n)}_{1,2}}$ exists and, by the assumption of Case B, so do $\smash{\mathcal{R}^{(n)}_{1}}$ and $\smash{\mathcal{R}^{(n)}_{2}}$. By (22), $\smash{\mathcal{R}^{\prime(n)}_{1}}$ exists and so does $\smash{\mathcal{I}^{(n)}}$. Indeed, since $\smash{\mathcal{G}^{(n)}_{0}\setminus\mathcal{R}^{(n)}_{1,2}=\emptyset}$, then $\smash{\mathcal{I}^{(n)}\subseteq\mathcal{G}^{(n)}_{2}}$. Again by (22), $\smash{\mathcal{R}^{\prime(n)}_{2}}$ exists and so does $\smash{\mathcal{R}^{(n)}_{\text{S}}}$ because

[TABLE]

Indeed, since $\smash{\mathcal{I}^{(n)}\subseteq\mathcal{G}^{(n)}_{2}}$, notice that $|\smash{\mathcal{R}_{\text{S}}^{(n)}}|=|\smash{\mathcal{I}^{(n)}}|$. These sets that form the partition of $\mathcal{G}^{(n)}$ in Case B can be seen in Figure 4, which also displays the encoding process that aims to construct $\tilde{A}_{1:L}[\mathcal{C}^{(n)}\cup\mathcal{G}^{(n)}]$.

In this case, for any $i\in[1,L]$, $\Psi_{1,i}^{(V)}\triangleq\Psi_{i}^{(V)}$, $\bar{\Theta}_{1,i}^{(V)}\triangleq\bar{\Theta}_{i}^{(V)}$ and $\Psi_{2,i}^{(V)}=\bar{\Theta}_{2,i}^{(V)}\triangleq\varnothing$; and we define $\Gamma_{1,i}^{(V)}$ and $\bar{\Gamma}_{1,i}^{(V)}$ as any part of $\Gamma_{i}^{(V)}$ and $\bar{\Gamma}_{i}^{(V)}$, respectively, with size $|\mathcal{R}^{(n)}_{1,2}|$, and $\Gamma_{2,i}^{(V)}$ and $\bar{\Gamma}_{2,i}^{(V)}$ as the remaining parts with size $|\mathcal{C}^{(n)}_{1,2}|-|\mathcal{R}^{(n)}_{1,2}|$. Now, the encoder copies $\Gamma_{1,i-1}^{(V)}\oplus\bar{\Gamma}_{1,i+1}^{(V)}$ into $\tilde{A}_{i}[\mathcal{R}_{1,2}^{(n)}]$, and $\Gamma_{2,i-1}^{(V)}$ and $\bar{\Gamma}_{2,i+1}^{(V)}$ into $\tilde{A}_{i}[\mathcal{R}_{2}^{\prime(n)}]$ and $\tilde{A}_{i}[\mathcal{R}_{1}^{\prime(n)}]$ respectively. Moreover, since $\mathcal{I}^{(n)}\subseteq\mathcal{G}_{2}^{(n)}$, notice that $\Pi_{i}^{(V)}=S_{i}$ for any $i\in[2,L-1]$.

IV-B3 Case C

In this case, recall that $|\mathcal{G}^{(n)}_{1}|\geq|\mathcal{C}^{(n)}_{2}|$, $|\mathcal{G}^{(n)}_{2}|\leq|\mathcal{C}^{(n)}_{1}|$ and $|\mathcal{G}^{(n)}_{0}|>|\mathcal{C}^{(n)}_{1,2}|$. Hence, we define $\mathcal{R}^{(n)}_{2}$ and $\mathcal{R}^{(n)}_{1,2}$ as in (36) and (37) respectively, and $\mathcal{R}^{\prime(n)}_{1}=\mathcal{R}^{\prime(n)}_{2}=\mathcal{R}^{\prime(n)}_{1,2}\triangleq\emptyset$. On the other hand, since $|\mathcal{G}^{(n)}_{2}|\leq|\mathcal{C}^{(n)}_{1}|$, now for $i\in[1,L-1]$ only a part of $\bar{\Theta}_{i+1}^{(V)}$ can be repeated entirely in $\tilde{A}_{i}[\mathcal{G}_{2}^{(n)}]$, and we define

[TABLE]

It is clear that $\mathcal{R}^{(n)}_{2}$ and $\mathcal{R}^{(n)}_{1,2}$ exist. By (22), $\mathcal{R}^{(n)}_{1}$ also exists and, hence, so does $\mathcal{I}^{(n)}$. Since $\mathcal{R}^{(n)}_{1}\supseteq\mathcal{G}^{(n)}_{2}$, $\mathcal{I}^{(n)}\cap\mathcal{G}^{(n)}_{2}=\emptyset$ and $\mathcal{R}^{(n)}_{\text{S}}=\emptyset$. These sets that form $\mathcal{G}^{(n)}$ are represented in Figure 5, which also displays the part of the encoding that aims to construct $\tilde{A}_{1:L}[\mathcal{C}^{(n)}\cup\mathcal{G}^{(n)}]$.

In this case, for $i\in[1,L]$, we define $\Psi_{1,i}^{(V)}\triangleq\Psi_{i}^{(V)}$, $\Gamma_{1,i}^{(V)}\triangleq\Gamma_{i}^{(V)}$, $\bar{\Theta}_{1,i}^{(V)}\triangleq\bar{\Theta}_{i}^{(V)}$, $\bar{\Gamma}_{1,i}^{(V)}\triangleq\bar{\Gamma}_{i}^{(V)}$, and $\Psi_{2,i}^{(V)}=\Gamma_{2,i}^{(V)}=\bar{\Theta}_{2,i}^{(V)}=\bar{\Gamma}_{2,i}^{(V)}\triangleq\varnothing$. Moreover, notice that $\Pi_{i}^{(V)}=\varnothing$ because $\mathcal{I}^{(n)}\cap\mathcal{G}^{(n)}_{2}=\emptyset$.

IV-B4 Case D

In this case, recall that $|\mathcal{G}^{(n)}_{1}|<|\mathcal{C}^{(n)}_{2}|$, $|\mathcal{G}^{(n)}_{2}|\leq|\mathcal{C}^{(n)}_{1}|$ and $|\mathcal{G}^{(n)}_{0}|>|\mathcal{C}^{(n)}_{1,2}|$. As in Case A and Case C, since $|\mathcal{G}^{(n)}_{0}|>|\mathcal{C}^{(n)}_{1,2}|$ we define $\mathcal{R}^{(n)}_{1,2}$ as in (37) and $\mathcal{R}^{\prime(n)}_{1}=\mathcal{R}^{\prime(n)}_{2}\triangleq\emptyset$. Thus, for $i\in[1,L]$, we set $\Gamma_{1,i}^{(V)}\triangleq\Gamma_{i}^{(V)}$, $\bar{\Gamma}_{1,i}^{(V)}\triangleq\bar{\Gamma}_{i}^{(V)}$ and $\bar{\Gamma}_{2,i}^{(V)}=\Gamma_{2,i}^{(V)}\triangleq\varnothing$. On the other hand, since $|\mathcal{G}^{(n)}_{1}|<|\mathcal{C}^{(n)}_{2}|$, now for $i\in[2,L]$ only a part of $\bar{\Psi}_{i-1}^{(V)}$ can be repeated entirely in $\tilde{A}_{i}[\mathcal{G}_{1}^{(n)}]$, and we define $\mathcal{R}^{(n)}_{2}\triangleq\mathcal{G}_{1}^{(n)}$ and

[TABLE]

By (22), it is clear that $\mathcal{R}_{1,2}^{\prime(n)}$ exists. Also, for $i\in[1,L]$, we define $\Psi_{1,i}^{(V)}$ as any part $\Psi_{i}^{(V)}$ with size $|\mathcal{G}_{1}^{(n)}|$, and $\Psi_{2,i}^{(V)}$ as the remaining part with size |\mathcal{C}_{2}^{(n)}\big{|}-\big{|}\mathcal{G}_{1}^{(n)}|.

Despite \big{|}\mathcal{G}^{(n)}_{2}\big{|}<\big{|}\mathcal{C}^{(n)}_{1}\big{|} as in Case C, the set $\mathcal{R}_{1}^{(n)}$ is not defined as in (42), but

[TABLE]

By the assumption in (22), the set $\mathcal{R}_{1}^{(n)}$ exists because

[TABLE]

Also, for $i\in[1,L]$, we define $\bar{\Theta}_{1,i}^{(V)}$ as any part $\bar{\Theta}_{i}^{(V)}$ with size $|\mathcal{C}^{(n)}_{1}|-(|\mathcal{C}^{(n)}_{2}|-|\mathcal{G}^{(n)}_{1}|)$, and $\bar{\Theta}_{2,i}^{(V)}$ as the remaining part with size |\mathcal{C}_{2}^{(n)}\big{|}-\big{|}\mathcal{G}_{1}^{(n)}|.

Thus, according to Algorithm 2, instead of repeating $\Psi_{2,i-1}^{(V)}$, that is, the part of $\Psi_{i-1}^{(V)}$ that does not fit in $\tilde{A}_{i}^{n}[\mathcal{G}_{1}^{(n)}]$, in a specific part of $\tilde{A}_{i}^{n}[\mathcal{G}_{0}^{(n)}]$, the encoder stores $\Psi_{2,i-1}^{(V)}\oplus\bar{\Theta}_{2,i+1}^{(V)}$ into $\tilde{A}_{i}[\mathcal{R}_{1,2}^{\prime(n)}]\subseteq\tilde{A}_{i}[\mathcal{G}_{0}^{(n)}]$, where $\bar{\Theta}_{2,i+1}^{(V)}$ denotes part of those elements of $\bar{\Theta}_{i+1}^{(V)}$ that do not fit in $\tilde{A}_{i}^{n}[\mathcal{G}_{2}^{(n)}]$. Furthermore, as in Case C, since $\mathcal{I}^{(n)}\cap\mathcal{G}^{(n)}_{2}=\emptyset$, we have $\Pi_{i}^{(V)}=\varnothing$.

The sets that form the partition of $\mathcal{G}^{(n)}$ in Case D can be seen in Figure 6, which also displays the encoding process that aims to construct of $\tilde{A}_{1:L}[\mathcal{C}^{(n)}\cup\mathcal{G}^{(n)}]$.

IV-C Channel prefixing

For $i\in[1,L]$, let $R_{i}$ be a uniformly distributed vector of length $|\mathcal{H}^{(n)}_{X|V}\setminus\mathcal{H}^{(n)}_{X|VZ}|$ that represents the randomization sequence (local randomness). Moreover, let $\Lambda^{(X)}_{0}$ be a uniformly distributed random sequence of size $|\mathcal{H}^{(n)}_{X|VZ}|$. The channel prefixing aims to construct $\tilde{X}_{i}^{n}=\tilde{T}_{i}^{n}G_{n}$ and is summarized in Algorithm 3.

Notice that the sequence $\Lambda^{(X)}_{0}$ is copied in $\tilde{T}_{i}[\mathcal{H}^{(n)}_{X|VZ}]$ at any block $i\in[1,L]$, while $R_{i}$ is stored into $\tilde{T}_{i}[\mathcal{H}^{(n)}_{X|V}\cap(\mathcal{H}^{(n)}_{X|VZ})^{\text{C}}]$. After obtaining $\tilde{T}_{i}[\mathcal{H}^{(n)}_{X|V}]$, and given the sequence $\tilde{V}_{i}^{n}\triangleq\tilde{A}_{i}^{n}G_{n}$, the encoder forms the remaining entries of $\tilde{T}_{i}^{n}$, that is, $\tilde{T}_{i}[(\mathcal{H}_{X|V}^{(n)})^{\text{C}}]$ as follows. If $j\in(\mathcal{H}_{X|V}^{(n)})^{\text{C}}\setminus\mathcal{L}_{X|V}^{(n)}$, the encoder randomly draws $\tilde{T}_{i}(j)$ from $p_{T(j)|T^{1:j-1}|V^{n}}$ corresponding to the joint distribution of the original DMS –see (11)–. Otherwise, if $j\in\mathcal{L}_{X|V}^{(n)}$, it constructs $\tilde{T}_{i}(j)$ deterministically by using SC encoding as in [20]. Thus, we define the SC encoding function $\xi^{(X)}_{(j)}:\{0,1\}^{(j-1)\cdot n}\rightarrow\{0,1\}$ as

[TABLE]

Hence, besides the required local randomness, only $\Lambda^{(X)}_{0}$ and $\tilde{T}_{1:L}[(\mathcal{H}^{(n)}_{V})^{\text{C}}\setminus\mathcal{L}^{(n)}_{X|V}]$ are constructed randomly.

IV-D Decoding

Consider that $(\Upsilon_{(k)}^{(V)},\Phi_{(k),1:L}^{(V)})$, $k\in[1,L]$, is available to the $k$-th legitimate receiver. In the decoding process, both legitimate receivers form the estimates $\hat{A}^{n}_{1:L}$ of $\tilde{A}^{n}_{1:L}$ and then output the messages $(\hat{W}_{1:L},\hat{S}_{1:L})$.

IV-D1 Legitimate receiver 1

This receiver forms the estimates $\hat{A}^{n}_{1:L}$ by going forward, i.e., from $\hat{A}^{n}_{1}$ to $\hat{A}^{n}_{L}$, and this process is summarized in Algorithm 4.

In all cases (among Case A to Case D), receiver 1 constructs $\hat{A}^{n}_{1}$ as follows. Given $\smash{\Upsilon_{(1)}^{(V)}}$ (all the elements inside the red curve at block 1 in Figures 3–6) and $\Phi_{(1),1}^{(V)}$, notice that receiver 1 knows $\smash{\tilde{A}_{1}[(\mathcal{L}_{V|Y_{(1)}}^{(n)})^{\text{C}}]}$. Therefore, from $(\Upsilon_{(1)}^{(V)}$, $\Phi_{(1),1}^{(V)})$ and channel observations $\tilde{Y}_{(1),1}^{n}$, receiver 1 performs SC decoding for source coding with side information [18] to form $\hat{A}^{n}_{1}$. Moreover, since $\Lambda_{1}^{(V)}\subseteq\Upsilon_{(1)}^{(V)}$ has been replicated in all blocks, legitimate receiver 1 gets $\smash{\hat{\Lambda}_{1:L-1}^{(V)}}$ (gray pentagons at all blocks).

For $i\in[1,L-1]$, consider the construction of $\hat{A}_{i+1}^{n}$. First, from $\hat{A}_{i}^{n}$ that has already been estimated, receiver 1 gets $\hat{\Psi}_{i}^{(V)}=\hat{A}_{i}[\mathcal{C}_{2}^{(n)}]$ (e.g., blue or red circles at block 1 or 2 respectively in Figures 3–6) and $\hat{\Gamma}_{i}^{(V)}=\hat{A}_{i}[\mathcal{C}_{1,2}^{(n)}]$ (blue or red triangles at block 1 or 2 respectively).

Also, from $\hat{A}_{i}^{n}$, receiver 1 obtains $\hat{\Theta}_{i+1}^{(V)}$ as follows. At block 1, in all cases it gets $\smash{\hat{\bar{\Theta}}_{2}^{(V)}}=\tilde{A}_{1}[\mathcal{R}_{1}^{(n)}\cup\mathcal{R}_{1,2}^{\prime(n)}]$ (all the red squares with a line through them at block 1 in Figures 3–6). At block $i\in[2,L-1]$, we distinguish two situations. In Case D, receiver 1 gets $\smash{\hat{\bar{\Theta}}_{1,i+1}^{(V)}=\hat{A}_{i}[\mathcal{R}^{(V)}_{1}]}$ (e.g., yellow squares with a line through them at block 2 in Figure 6) and $\smash{\hat{\Psi}_{2,i-1}^{(V)}\oplus\hat{\bar{\Theta}}_{2,i+1}^{(V)}}$ (yellow squares with a line through them overlapped by blue circles). Since $\hat{\Psi}_{2,i-1}^{(V)}\subset\hat{A}_{i-1}^{n}$ (blue circles) has already been estimated, receiver 1 obtains $\smash{\hat{\bar{\Theta}}_{2,i+1}^{(V)}}$ (yellow squares with a line through them). Otherwise, in other cases, receiver 1 obtains $\hat{\bar{\Theta}}_{i+1}^{(V)}=\hat{A}_{i}[\mathcal{R}_{1}^{(n)}]$ directly (yellow squares with a line through them at block 2 in Figures 3–5). Then, given $\hat{\bar{\Theta}}_{i+1}^{(V)}=[\hat{\bar{\Theta}}_{1,i+1}^{(V)},\hat{\bar{\Theta}}_{2,i+1}^{(V)}]$, in all cases receiver 1 recovers the sequence $\hat{\Theta}_{i+1}^{(V)}=\hat{\bar{\Theta}}_{i+1}^{(V)}\oplus\kappa_{\Theta}^{(V)}$.

From $\hat{A}_{i}^{n}$, receiver 1 also obtains $\hat{\Gamma}_{i+1}^{(V)}$ as follows. At block $1$, in all cases it gets $\hat{\bar{\Gamma}}_{2}^{(V)}=\tilde{A}_{1}[\mathcal{R}^{(n)}_{1,2}\cup\mathcal{R}^{\prime(n)}_{1}]$ directly (e.g., all red triangles with a line through them at block 1 in Figures 3–6). At block $i\in[2,L-1]$, in all cases receiver 1 obtains $\hat{\Gamma}_{1,i-1}^{(V)}\oplus\hat{\bar{\Gamma}}_{1,i+1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{(n)}_{1,2}]$ (e.g., blue and yellow diamonds with a line through them at block 2). Since $\hat{\Gamma}_{1,i-1}^{(V)}\subset\tilde{A}_{i-1}^{n}$ (blue triangles) has already been estimated, receiver 1 obtains $\hat{\bar{\Gamma}}_{1,i+1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{(n)}_{1,2}]\oplus\hat{\Gamma}_{1,i-1}^{(V)}$ (yellow triangles with a line through them). Also, only in Case B, receiver 1 obtains $\hat{\bar{\Gamma}}_{2,i+1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{\prime(n)}_{1}]$ (remaining yellow triangles with a line through them at block 3 in Figure 4). Then, given $\hat{\bar{\Gamma}}_{i+1}^{(V)}=[\hat{\bar{\Gamma}}_{1,i+1}^{(V)},\hat{\bar{\Gamma}}_{2,i+1}^{(V)}]$, in all cases receiver 1 recovers the sequence $\hat{\Gamma}_{i+1}^{(V)}=\hat{\bar{\Gamma}}_{i+1}^{(V)}\oplus\kappa_{\Gamma}^{(V)}$.

Only in cases A and B, it gets $\hat{\Pi}_{i}^{(V)}=\hat{A}_{i}[\mathcal{I}^{(n)}\cap\mathcal{G}_{2}^{(n)}]$ (e.g. purple crosses at block 2 in Figures 3–4). Let

[TABLE]

Notice that $\Upsilon^{\prime(V)}_{(1),i+1}=\tilde{A}_{i+1}[\mathcal{H}_{V}^{(n)}\cap(\mathcal{L}_{V|Y_{(1)}}^{(n)})^{\text{C}}]$ (all the elements inside red curve at block $i+1$ in Figures 3–6). Thus, receiver 1 performs SC decoding to form $\hat{A}^{n}_{i+1}$ by using $\Upsilon^{\prime(V)}_{(1),i+1}$, $\Phi_{(1),i+1}^{(V)}$ and the observations $\tilde{Y}_{(1),i+1}^{n}$.

IV-D2 Legitimate receiver 2

This receiver forms the estimates $\hat{A}^{n}_{1:L}$ by going backward, i.e., from $\hat{A}^{n}_{L}$ to $\hat{A}^{n}_{1}$, and this process is summarized in Algorithm 5.

In all cases (among Case A to Case D), receiver 2 constructs $\hat{A}^{n}_{L}$ as follows. Given $\smash{\Upsilon_{(2)}^{(V)}}$ (all the elements inside blue curve at block 4 in Figures 3–6) and $\Phi_{(2),L}^{(V)}$, notice that receiver 2 knows $\smash{\tilde{A}_{L}[(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}]}$. Hence, from $(\Upsilon_{(2)}^{(V)}$, $\Phi_{(2),L}^{(V)})$ and channel observations $\tilde{Y}_{(2),L}^{n}$, receiver 2 performs SC decoding for source coding with side information to form $\hat{A}^{n}_{L}$. Since $\Lambda_{1}^{(V)}$ has been replicated in all blocks, from $\tilde{A}_{L}^{n}$ receiver 2 obtains $\smash{\hat{\Lambda}_{1:L-1}^{(V)}}=\tilde{A}_{L}[\mathcal{R}_{\Lambda}^{(n)}]$ (gray pentagons at all blocks).

For $i\in[2,L]$, consider the construction of $\hat{A}_{i-1}^{n}$. First, from $\hat{A}_{i}^{n}$ that has already been estimated, legitimate receiver 2 obtains the sequence $\hat{\Theta}_{i}^{(V)}=\tilde{A}_{i}[\mathcal{C}_{1}^{(n)}]$ (e.g., cyan or yellow squares at block 4 or 3 respectively in Figures 3–6). Given $\hat{\Theta}_{i}^{(V)}$, the encoder computes $\hat{\bar{\Theta}}_{i}^{(V)}=\hat{\Theta}_{i}^{(V)}\oplus\kappa_{\Theta}^{(V)}$ (corresponding previous squares with a line through them). Also, receiver 2 obtains $\hat{\Gamma}_{i}^{(V)}=\tilde{A}_{i}[\mathcal{C}_{1,2}^{(n)}]$ (cyan or yellow triangles at block 4 or 3 respectively in Figures 3–6). Given this sequence, receiver 2 computes $\hat{\bar{\Gamma}}_{i}^{(V)}=\hat{\Gamma}_{i}^{(V)}\oplus\kappa_{\Gamma}^{(V)}$ (corresponding previous triangles with a line through them).

Also, from $\hat{A}_{i}^{n}$, receiver 2 obtains $\hat{\Theta}_{i+1}^{(V)}$ as follows. At block $L$, in all cases it gets $\hat{\Psi}_{L-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{(n)}_{2}\cup\mathcal{R}^{\prime(n)}_{1,2}]$ directly (all yellow circles at block $L$ in Figures 3–6). At block $i\in[2,L-1]$, we distinguish two situations. In Case D, it obtains $\hat{\Psi}_{1,i-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{(n)}_{2}]$ (e.g., red circles at block 3 in Figure 6) and $\hat{\Psi}_{2,i-1}^{(V)}\oplus\hat{\bar{\Theta}}_{2,i+1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{\prime(n)}_{1,2}]$ (cyan squares with a line through them overlapped by red circles). Since $\smash{\hat{\bar{\Theta}}_{2,i+1}^{(V)}}$ (cyan squares with a line through them) has already been estimated, receiver 2 obtains $\hat{\Psi}_{2,i-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{\prime(n)}_{1,2}]\oplus\hat{\bar{\Theta}}_{2,i+1}^{(V)}$ (red circles). Otherwise, in other cases, receiver 2 obtains directly $\hat{\Psi}_{i-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}_{2}^{(n)}]$ (e.g., red circles at block 3 in Figures 3–5).

From $\hat{A}_{i}^{n}$, receiver 2 also obtains $\hat{\Gamma}_{i-1}^{(V)}$ as follows. At block $L$, in all cases it gets $\hat{\bar{\Gamma}}_{L-1}^{(V)}=\tilde{A}_{L}[\mathcal{R}^{(n)}_{1,2}\cup\mathcal{R}^{\prime(n)}_{2}]$ (e.g., all yellow triangles at block $L$ in Figures 3–6). At block $i\in[2,L-1]$, in all cases receiver 2 obtains $\hat{\Gamma}_{1,i-1}^{(V)}\oplus\hat{\bar{\Gamma}}_{1,i+1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{(n)}_{1,2}]$ (e.g., red and cyan diamonds with a line through them at block 3). Since $\hat{\bar{\Gamma}}_{1,i+1}^{(V)}$ (cyan triangles with a line through them) has already been estimated, receiver 2 obtains $\hat{\Gamma}_{1,i-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{(n)}_{1,2}]\oplus\hat{\bar{\Gamma}}_{1,i+1}^{(V)}$ (red triangles). Also, only in Case B, receiver 2 obtains the sequence $\hat{\Gamma}_{2,i-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}^{\prime(n)}_{2}]$ (remaining red triangles at block 3 in Figure 4).

Finally, only in Case A and Case B, receiver 2 obtains the sequence $\smash{\hat{\Pi}_{i-1}^{(V)}=\tilde{A}_{i}[\mathcal{R}_{\text{S}}]}$ (e.g., purple crosses at block 3 in Figures 3–4). Let

[TABLE]

Notice that333We have $\smash{\Upsilon^{\prime(V)}_{(2),i-1}\supseteq\tilde{A}_{i-1}[\mathcal{H}_{V}^{(n)}\cap(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}]}$ because part of $\hat{\bar{\Theta}}_{1,i}^{(V)}$ in cases C and D could be copied in some entries of $\tilde{A}_{i-1}[\mathcal{G}_{0}^{(n)}]$. $\Upsilon^{\prime(V)}_{(2),i-1}\supseteq\tilde{A}_{i-1}[\mathcal{H}_{V}^{(n)}\cap(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}]$ (all the elements inside blue curve at block $i-1$ in Figures 3–6). Thus, receiver 2 performs SC decoding to form $\hat{A}^{n}_{i-1}$ by using $\smash{\Upsilon^{\prime(V)}_{(2),i-1}}$, $\smash{\Phi_{(2),i-1}^{(V)}}$ and $\smash{\tilde{Y}_{(2),i-1}^{n}}$.

V Performance of the Polar Coding Scheme

The analysis of the polar coding scheme of Section IV leads to the following theorem.

Theorem 1**.**

Let $(\mathcal{X},p_{Y_{(1)}Y_{(2)}Z|X},\mathcal{Y}_{(1)}\times\mathcal{Y}_{(2)}\times\mathcal{Z})$ be an arbitrary WBC such that $\mathcal{X}\in\{0,1\}$. The polar coding scheme described in Section IV achieves the corner point in (4) of the region $\mathfrak{R}_{\text{\emph{CI-WBC}}}$ defined in Proposition 1.

The proof of Theorem 1 follows in four steps and is provided in the following subsections. In Section V-A we show that the polar coding scheme approaches (4). Then, in Section V-A we prove that the joint distribution of $(\tilde{V}_{i}^{n},\tilde{X}_{i}^{n},\tilde{Y}_{(1),i}^{n},\tilde{Y}_{(2),i}^{n},\tilde{Z}_{i}^{n})$ is asymptotically indistinguishable of the one of the original DMS. Finally, in Section V-C and Section V-D we show that the polar coding scheme satisfies the reliability and the secrecy conditions (1) and (2) respectively.

V-A Transmission Rates

We prove that the polar coding scheme described in Section IV approaches the rate tuple (4). Also, we show that the overall length of the secret keys $\kappa_{\Theta}^{(V)}$, $\kappa_{\Gamma}^{(V)}$, $\kappa_{\Upsilon\Phi_{(1)}}^{(V)}$ and $\kappa_{\Upsilon\Phi_{(2)}}^{(V)}$, and the additional randomness used in the encoding (besides the randomization sequences) are asymptotically negligible in terms of rate.

V-A1 Private message rate

For $i\in[1,L]$, we have $W_{i}=\tilde{A}_{i}[\mathcal{C}^{(n)}]$. According to the definition of $\mathcal{C}^{(n)}$ in (13), and since $\mathcal{H}^{(n)}_{V|Z}\subseteq\mathcal{H}^{(n)}_{V}$, the rate of $W_{1:L}$ is

[TABLE]

where the limit holds by [18, Theorem 1]. Therefore, the private message rate achieved by the polar coding scheme is $R_{W}$ in (4).

V-A2 Confidential message rate

From Section IV-B, in all cases $|S_{1}|=\tilde{A}_{1}[\mathcal{I}^{(n)}\mathcal{G}^{(n)}_{1}\cup\mathcal{G}^{(n)}_{1,2}]$; for $i\in[2,L-1]$, $S_{i}=\tilde{A}_{i}[\mathcal{I}^{(n)}]$; and $S_{L}=\tilde{A}_{L}[\mathcal{I}^{(n)}\mathcal{G}^{(n)}_{2}]$. Thus, we have

[TABLE]

where $(a)$ holds by the definition of $\mathcal{I}^{(n)}$ in (32); $(b)$ holds because, in all cases, $|\mathcal{R}^{(n)}_{1,2}|+|\mathcal{R}^{\prime(n)}_{1}|=|\mathcal{C}_{1,2}^{(n)}|$ and $|\mathcal{R}^{(n)}_{1}|+|\mathcal{R}^{\prime(n)}_{1,2}|=|\mathcal{C}_{1}^{(n)}|$, $(c)$ follows from the partition of $\mathcal{H}_{V}^{(n)}$ defined in (14)–(21); and the limit when $n$ goes to infinity holds by [18, Theorem 1]. Hence, the coding scheme achieves the confidential message rate $R_{S}$ in (4).

V-A3 Randomization sequence rate.

For $i\in[1,L]$, we have $R_{i}=\tilde{T}_{i}[\mathcal{H}^{(n)}_{X|V}\cap(\mathcal{H}^{(n)}_{X|VZ})^{\text{C}}]$. Therefore, we have

[TABLE]

where $(a)$ holds because $\mathcal{H}^{(n)}_{X|VZ}\supseteq\mathcal{H}^{(n)}_{X|V}$, and the limit by [18, Theorem 1]. Thus, the randomization sequence rate used by the polar coding scheme is $R_{R}$ in (4).

V-A4 Privacy shared sequence rate

The transmitter and the $k$-th legitimate receiver must privately share the keys $\kappa_{\Theta}^{(V)}$, $\kappa_{\Gamma}^{(V)}$ and $\kappa_{\Upsilon\Phi_{(k)}}^{(V)}$. Hence, the overall rate is

[TABLE]

where $(a)$ follows from the definition of $\mathcal{C}^{(n)}_{1}$ and $\mathcal{C}^{(n)}_{1,2}$ in (19) and (21) respectively; for the second term in $(b)$ we have used $(\mathcal{H}_{V}^{(n)})^{\text{C}}\subseteq(\mathcal{H}_{V|Y_{(k)}})^{\text{C}}$; and the limit when $n$ goes to infinity holds by [18, Theorem 1].

V-A5 Rate of the additional randomness

Besides the randomization sequences $R_{1:L}$, the encoder uses the random sequence $\Lambda_{0}^{(X)}$, with size $|\mathcal{H}_{X|V}^{(n)}|$, for the polar-based channel prefixing. Moreover, for $i\in[1,L]$, the encoder randomly draws those elements $\tilde{A}_{i}(j)$ such that $j\in(\mathcal{H}_{V}^{(n)})^{\text{C}}\setminus\mathcal{L}_{V}^{(n)}$, and those elements $\tilde{T}_{i}(j)$ such that $j\in(\mathcal{H}_{X|V}^{(n)})^{\text{C}}\setminus\mathcal{L}_{X|V}^{(n)}$. Nevertheless, we have

[TABLE]

where the limit when $n$ approaches to infinity follows from applying [18, Theorem 1].

V-B Distribution of the DMS after the polar encoding

For $i\in[1,L]$, let $\tilde{q}_{A_{i}^{n}T_{i}^{n}}$ denote the distribution of $(\tilde{A}_{i}^{n},\tilde{T}_{i}^{n})$ after the encoding. The following lemma proves that $\tilde{q}_{A_{i}^{n}T_{i}^{n}}$ and $p_{A^{n}T^{n}}$, the later being a marginal of the joint distribution of the original DMS in (11), are nearly statistically indistinguishable for sufficiently large $n$ and, consequently, so are $\tilde{q}_{V_{i}^{n}X_{i}^{n}Y_{(1),i}^{n}Y_{(2),i}^{n}Z_{i}^{n}}$ and $p_{V^{n}X^{n}Y_{(1)}^{n}Y_{(2)}^{n}Z^{n}}$. This result is crucial for the reliability and secrecy performance of the polar coding scheme.

Lemma 1**.**

For $i\in[1,L]$, we have

[TABLE]

which implies

[TABLE]

where

[TABLE]

Proof.

See Appendix A ∎

V-C Reliability analysis

We prove that both legitimate receivers can reliably reconstruct the private and the confidential messages $(W_{1:L},S_{1:L})$ with arbitrary small error probability.

For $i\in[1,L]$ and $k\in[1,2]$, let $\tilde{q}_{V_{i}^{n}Y_{(k),i}^{n}}$ and $p_{V^{n}Y_{(k)}^{n}}$ be marginals of $\tilde{q}_{V_{i}^{n}X_{i}^{n}Y_{(1),i}^{n}Y_{(2),i}^{n}Z_{i}^{n}}$ and $p_{V^{n}X^{n}Y_{(1)}^{n}Y_{(2)}^{n}Z^{n}}$ respectively, and define an optimal coupling [21, Proposition 4.7] between $\tilde{q}_{V_{i}^{n}Y_{(k),i}^{n}}$ and $p_{V^{n}Y_{(k)}^{n}}$ such that

[TABLE]

where \mathcal{E}_{V_{i}^{n}Y_{(k),i}^{n}}\triangleq\big{\{}\big{(}\tilde{V}_{i}^{n},\tilde{Y}_{(k),i}^{n}\big{)}\neq\big{(}V^{n},Y_{(k)}^{n}\big{)}\big{\}}. Additionally, define the error event

[TABLE]

Recall that $(\Upsilon_{(k)}^{(V)},\Phi_{(k),1:L}^{(V)})$ is available to the $k$-th legitimate receiver. Thus, notice that we have

[TABLE]

because given $\Upsilon_{(1)}^{(V)}$ and $\Phi_{(1),1}^{(V)}$ legitimate receiver 1 knows $\tilde{A}_{1}[(\mathcal{L}_{V|Y_{(1)}}^{(n)})^{\text{C}}]$, and given $\Upsilon_{(2)}^{(V)}$ and $\Phi_{(2),L}^{(V)}$ legitimate receiver 2 knows $\tilde{A}_{L}[(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}]$. Moreover, due to the chaining structure, in Section IV-D we have seen that $\hat{A}_{i}[\mathcal{H}^{(n)}_{V}\cap(\mathcal{L}_{V|Y_{(1)}}^{(n)})^{\text{C}}]\subset\hat{A}_{i-1}^{n}$ for $i\in[2,L]$. Therefore, at legitimate receiver 1, for $i\in[2,L]$ we obtain

[TABLE]

Similarly, due to the chaining construction, we have seen that $\hat{A}_{i}[\mathcal{H}^{(n)}_{V}\cap(\mathcal{L}_{V|Y_{(2)}}^{(n)})^{\text{C}}]\subset\hat{A}_{i+1}^{n}$ for $i\in[1,L-1]$. Thus, at legitimate receiver 2, for $i\in[1,L-1]$ we obtain

[TABLE]

Therefore, the probability of incorrectly decoding $(W_{i},S_{i})$ at the $k$-th receiver can be bounded as

[TABLE]

where $(a)$ holds by [18, Theorem 2]; $(b)$ holds by the union bound; and $(c)$ follows from the optimal coupling and Lemma 1. Therefore, we have

[TABLE]

where $(a)$ follows from applying the union bound, and $(b)$ holds by induction and (48)–(50).

V-D Secrecy analysis

Since encoding in Section IV takes place over $L$ blocks of size $n$, we need to prove that

[TABLE]

For clarity and with slight abuse of notation, for any block $i\in[1,L]$ let

[TABLE]

which denotes the entire random sequence depending on $\tilde{A}_{i}^{n}$ at block $i$ that is repeated at block $i+1$. Also, let

[TABLE]

which represents the sequence at block $i$ that is repeated at block $i-1$. Also, we define $\kappa_{\Omega}^{(V)}\triangleq[\kappa_{\Theta}^{(V)},\kappa_{\Gamma}^{(V)}]$.

A Bayesian graph describing the dependencies between all the variables involved in the coding scheme of Section IV is given in Figure 7. Despite $\Gamma_{i}^{(V)}\subseteq\Xi_{i}^{(V)}$ and $\bar{\Gamma}_{i}^{(V)}=\Gamma_{i}^{(V)}\oplus\kappa_{\Gamma}^{(V)}\subseteq\bar{\Omega}_{i}^{(V)}$, we represent $\Xi_{i}^{(V)}$ and $\bar{\Omega}_{i}^{(V)}$ as two independent nodes in the Bayesian graph because, by crypto lemma [22], $\Gamma_{i}^{(V)}$ and $\bar{\Gamma}_{i}^{(V)}$ are statistically independent. Furthermore, for convenience, we have considered that dependencies only take place forward (from block $i$ to block $i+1$), which is possible by reformulating the encoding as follows. According to Section IV-A, for any $i\in[1,L]$ we have $\tilde{A}_{i}[\mathcal{C}_{i}^{(n)}]=W_{i}$. Consequently, we can write $W_{i}\triangleq[W_{1,i},W_{2,i}]$, where $W_{1,i}\triangleq\tilde{A}_{i}[\mathcal{C}_{1}^{(n)}\cup\mathcal{C}_{1,2}^{(n)}]$ and $W_{2,i}\triangleq\tilde{A}_{i}[\mathcal{C}_{2}^{(n)}\cup\mathcal{C}_{0}^{(n)}]$. Thus, we regard $\bar{\Omega}_{i}^{(V)}$ as an independent random sequence generated at block $i-1$, which is stored properly into some part of $\tilde{A}_{i-1}[\mathcal{G}^{(n)}]$. Then, we consider that the encoder obtains $W_{1,i}\triangleq\bar{\Omega}_{i}^{(V)}\oplus\kappa_{\Omega}^{(V)}$, which is stored into $\tilde{A}_{i}[\mathcal{C}_{1}^{(n)}\cup\mathcal{C}_{1,2}^{(n)}]$. On the other hand, the remaining part $W_{2,i}$ is independently generated at block $i$.

The following lemma shows that secrecy holds for any block $i\in[1,L]$ (block-wise strong secrecy).

Lemma 2**.**

For $i\in[1,L]$ and sufficiently large $n$,

[TABLE]

*where \delta_{n}^{(\text{\emph{S}})}\triangleq 2n\delta_{n}+2\delta_{n}^{(*)}\big{(}4n-\log\delta_{n}^{(*)}\big{)} and $\delta_{n}^{(*)}$ defined as in Lemma 1. *

Proof.

See Appendix B. ∎

Next, the following lemma shows that eavesdropper observations $\tilde{Z}_{i}^{n}$ are asymptotically statistically independent of observations $\tilde{Z}_{1:i-1}^{n}$ from previous blocks.

Lemma 3**.**

For $i\in[1,L]$ and sufficiently large $n$,

[TABLE]

where $\delta_{n}^{(\text{\emph{S}})}$ is defined as in Lemma 2.

Proof.

See Appendix C. ∎

Therefore, we obtain

[TABLE]

where $(a)$ follows from applying the chain rule; $(b)$ holds by Lemma 3; $(c)$ holds by independence between $S_{2:L}$ and any random variable from block $1$; and $(d)$ holds by Lemma 2 because $S_{1}\subseteq\tilde{A}_{1}[\mathcal{H}^{(n)}_{V|Z}]$.

Remark 1**.**

We conjecture that the use $\kappa_{\Omega}^{(V)}$ is not needed for the polar coding scheme to satisfy the strong secrecy condition. However, the key is required in order to prove this condition by using a causal Bayesian graph similar to the one in Figure 7.

Remark 2**.**

Although non-causual (backward) dependencies between random variables of different blocks appear in [12], a secret seed as $\kappa_{\Omega}^{(V)}$ is not necessary for the polar coding scheme to provide strong secrecy. This is because random sequences that are repeated in adjacent blocks are stored only into those corresponding entries whose indices belong to the “high entropy set given eavesdropper observations”, i.e., the equivalent sets of $\mathcal{H}_{V|Z}^{(n)}$ and $\mathcal{H}_{X|VZ}^{(n)}$ in our polar coding scheme. By contrast, notice that our polar coding scheme stores $[\Theta_{i}^{(V)},\Gamma_{i}^{(V)}]$ into some part of $\smash{\tilde{A}_{i}[(\mathcal{H}_{V|Z}^{(n)})^{\text{\emph{C}}}]}$.

Remark 3**.**

Another possibility for the polar coding scheme is to repeat at block $i+1$ the modulo-2 addition between $[\Psi_{i}^{(V)},\Gamma_{i}^{(V)}]$ and a secret-key, instead of repeating an encrypted version of $[\Theta_{i}^{(V)},\Gamma_{i}^{(V)}]$ at block $i-1$. Then, it is not difficult to prove that I\big{(}S_{1:L}\tilde{Z}_{i+1:L}^{n};\tilde{Z}_{i}^{n}\big{)}\leq\delta_{n}^{(\text{\emph{S}})} (similar to Lemma 3). Thus, we can minimize the length of the secret seed depending on whether $|\mathcal{C}_{1}^{(n)}|<|\mathcal{C}_{2}^{(n)}|$ or vice versa.

VI Conclusion

A strongly secure polar coding scheme has been proposed for the WBC with two legitimate receivers and one eavesdropper. This polar code achieves the best known inner-bound on the achievable region of the CI-WBC model, where transmitter wants to send private and confidential messages to both receivers. Due to the non-degradedness assumption of the channel, the encoder builds a chaining construction that induces bidirectional dependencies between adjacent blocks. These dependencies need to be taken carefully into account in the secrecy analysis and make the use of secret seeds crucial.

Appendix A Proof of Lemma 1

We generalize the results obtained in [20] for any DMS $(\mathcal{V}_{1}\times\cdots\times\mathcal{V}_{M}\times\mathcal{O}_{1}\times\cdots\times\mathcal{O}_{K},p_{V_{1:M}O_{1:K}})$ such that $\mathcal{V}_{\ell}\triangleq\{0,1\}$ for any $\ell\in[1,M]$, and $p_{V_{1:M}O_{1:K}}$ satisfies the Markov chain condition $V_{1}-\cdots-V_{M}-O_{1:K}$. This DMS characterizes an encoding procedure for the broadcast channel with $K$ receivers (legitimate ones or eavesdroppers), where $O_{k}$ denotes the channel output $k\in[1,K]$, and $V_{\ell}$ denotes the binary encoding input random variable $\ell\in[1,M]$. Consider an i.i.d. $n$-sequence $(V_{1:M}^{n},O_{1:K}^{n})$ of this DMS, $n$ being any power of two. We define the polar transforms $U_{1:M}^{n}\sim p_{U_{1:M}^{n}}$, where $U_{\ell}^{n}\triangleq V_{\ell}^{n}G_{n}$ for any $\ell\in[1,M]$, and the sets

[TABLE]

Note that the model considered in this paper can be represented by the previous DMS if we take $K\triangleq 3$ (two legitimate receivers and one eavesdropper), $M\triangleq 2$ defining $V\triangleq V_{1}$, $X\triangleq V_{2}$ and the associated polar transforms $A^{n}\triangleq U_{1}^{n}$ and $T^{n}\triangleq U_{2}^{n}$.

Consider an encoder that forms $\tilde{U}_{1:M}^{n}$ with joint distribution $\tilde{q}_{U_{1:M}^{n}}\triangleq\prod_{\ell=1}^{M}\prod_{j=1}^{n}\tilde{q}_{{U}_{\ell}(j)|U_{\ell}^{1:j-1}V_{\ell-1}^{n}}$, where

[TABLE]

for any $\ell\in[1,M]$, $V_{0}^{n}\triangleq\varnothing$ and $\xi^{(j)}$ being the deterministic $\operatorname*{arg\,max}$ function defined as

[TABLE]

Notice that the encoder in Section IV-A constructs, for any block $i\in[1,L]$, the sequences $(\tilde{A}_{i}^{n},\tilde{X}_{i}^{n})$ with joint distribution $\tilde{q}_{A_{i}^{n}T_{i}^{n}}$ defined as in (LABEL:eq:dist_tilde).

Consider another encoder that omits the use of the $\operatorname*{arg\,max}$ function, but draws the corresponding elements randomly. Let $\check{U}_{1:M}^{n}$ denote the sequences constructed by this encoder. Then, their joint distribution is given by $\check{q}_{U_{1:M}^{n}}\triangleq\prod_{\ell=1}^{M}\prod_{j=1}^{n}\check{q}_{{U}_{\ell}(j)|U_{\ell}^{1:j-1}V_{\ell-1}^{n}}$, where

[TABLE]

for any $\ell\in[1,M]$, and $V_{0}^{n}\triangleq\varnothing$.

The following lemma shows that the joint distributions $p_{U_{1:M}^{n}}$ and $\check{q}_{U_{1:M}^{n}}$ are nearly statistically indistinguishable for sufficiently large $n$.

Lemma 4**.**

Let $\delta_{n}=2^{-n^{\beta}}$ for some $\beta\in(0,\frac{1}{2})$. Then

[TABLE]

where ${\delta}^{(1)}_{n}\triangleq\sqrt{2n\delta_{n}\ln 2}$.

Proof.

The Kullback-Leibler distance between the distributions $p_{U_{1:M}^{n}}$ and $\check{q}_{U_{1:M}^{n}}$ is

[TABLE]

where $(a)$ holds by the chain rule, the invertibility of $G_{n}$ and the Markov chain condition satisfied by $U_{1:M}^{n}$ and $\check{U}_{1:M}^{n}$; and $(b)$ holds by the chain rule and by taking the expectation with respect to $(U_{\ell}^{1:j-1},V_{\ell-1}^{n})$. Thus, we obtain

[TABLE]

where $(a)$ holds by (LABEL:eq:dist_check) and [6975233, Lemma 10], i.e., $\mathbb{D}(p\|\check{q})=1-H(p)$ if $\check{q}$ denotes the uniform distribution; and $(b)$ holds by the definition of $\mathcal{H}_{V_{\ell}|V_{\ell-1}}^{(n)}$.

Finally, we get $\mathbb{V}(\check{q}_{U_{1:M}^{n}},p_{U_{1:M}^{n}})\leq\sqrt{2Mn\delta_{n}\ln 2}$ by Pinsker’s inequality and because $|\mathcal{H}_{V_{\ell}|V_{\ell-1}}^{(n)}|\leq n$. ∎

Now, the following lemma proves that the joint distributions $\check{q}_{U_{1:M}^{n}}$ and $\tilde{q}_{U_{1:M}^{n}}$ are nearly statistically indistinguishable for $n$ large enough.

Lemma 5**.**

Let $\delta_{n}=2^{-n^{\beta}}$ for some $\beta\in(0,\frac{1}{2})$. Then

[TABLE]

where {\delta}^{(2)}_{n}\triangleq Mn\sqrt{2\sqrt{2}\delta_{n}^{(1)}\big{(}2n-\log\sqrt{2}\delta_{n}^{(1)}\big{)}+\delta_{n}}, and ${\delta}^{(1)}_{n}$ defined as in Lemma 4.

Proof.

The proof follows similar reasoning as the one for [20, Lemma 2]. Define a coupling [21] for $\check{U}_{1:M}^{n}$ and $\tilde{U}_{1:M}^{n}$ such that $\check{U}_{\ell}[(\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)})^{\text{C}}]=\tilde{U}_{\ell}[(\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)})^{\text{C}}]$ for any $\ell\in[1,M]$. Thus, we have

[TABLE]

where $(a)$ holds by the coupling lemma [21, Proposition 4.7]; $(b)$ by the union bound, the invertibility of $G_{n}$ and the Markov chain condition satisfied by $\tilde{U}_{1:M}^{n}$ and $\check{U}_{1:M}^{n}$; $(c)$ also holds by the union bound and defining $\mathcal{E}_{U^{n}_{\ell}V^{n}_{\ell-1}}\triangleq\{(\check{U}_{\ell}^{1:j-1},\check{V}_{\ell-1}^{n})=(\tilde{U}_{\ell}^{1:j-1},\tilde{V}_{\ell-1}^{n})\}$; and $(d)$ follows from (LABEL:eq:dist_tilde) and (LABEL:eq:dist_check) given that $\check{U}_{\ell}[(\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)})^{\text{C}}]=\tilde{U}_{\ell}[(\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)})^{\text{C}}]$ and from defining

[TABLE]

Next, for any $j\in[n]$ and sufficiently large $n$, we have

[TABLE]

where $(a)$ holds by the chain rule of entropy and the triangle inequality; $(b)$ holds by [24, Lemma 2.7], the invertibility of $G_{n}$, and because

[TABLE]

and $(c)$ holds by Lemma 4 (taking $M=2$) because

[TABLE]

$x\mapsto x\log x$ is decreasing for $x>0$ small enough, and $j\leq n$. Thus, for $\ell\in[1,M]$ and $j\in\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)}$, we have

[TABLE]

where $(a)$ holds by the definition of $\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)}$; $(b)$ holds by (66); in $(c)$ the expectation is taken with respect to $(\check{U}_{\ell}^{1:j-1},\check{U}_{\ell-1}^{n})$ and $h_{2}(p)$ denotes the binary entropy function, i.e., $h_{2}(p)=-p\log p-(1-p)\log(1-p)$; $(d)$ holds because $p_{U_{\ell}(j)|U_{\ell}^{1:j-1}V_{\ell-1}^{n}}(u_{\ell}^{\star}(j)|\check{U}_{\ell}^{1:j-1},\check{V}_{\ell-1}^{n})\geq 1/2$ and $\log(x)<-x$ if $x\in[0,1/2)$; and $(e)$ follows from applying Jensen’s inequality.

Finally, by combining Equations (LABEL:eq:comb1) and (67), and because $|\mathcal{L}_{V_{\ell}|V_{\ell-1}}^{(n)}|\leq n$, we have

[TABLE]

and the proof is complete. ∎

Hence, by Lemma 4, Lemma 5 and by applying the triangle inequality, we obtain

[TABLE]

Moreover, since

[TABLE]

the joint distributions $p_{U_{1:M}^{n}O_{1:K}^{n}}$ and $\check{q}_{U_{1:M}^{n}O_{1:K}^{n}}$ are also nearly statistically indistinguishable for $n$ large enough.

Additionally, we provide the following lemma, which relates the total variation distance between $\tilde{q}_{U_{1:M}^{n}O_{1:K}^{n}}$ and $p_{U_{1:M}^{n}O_{1:K}^{n}}$ with the corresponding entropies.

Lemma 6**.**

Define $\mathcal{J}_{\ell}$ as any subset of $[1,n]$, where $\ell\in[1,M]$. Let $(U_{1:M}^{n},O_{1:K}^{n})\sim p_{U_{1:M}^{n}O_{1:K}^{n}}$ and $(\tilde{U}_{1:M}^{n},\tilde{O}_{1:K}^{n})\sim\tilde{q}_{U_{1:M}^{n}O_{1:K}^{n}}$ such that the total variation distance \mathbb{V}\big{(}p_{U_{1:M}^{n}O_{1:K}^{n}},\tilde{q}_{U_{1:M}O_{1:K}^{n}}\big{)}\leq\delta, where $\delta\rightarrow 0$. Then, for sufficiently large $n$, we have

[TABLE]

Proof.

From applying [24, Lemma 2.7], we obtain

[TABLE]

where the last inequality holds by assumption, because the function $x\mapsto x\log x$ is decreasing for $x>0$ small enough, and because $|\mathcal{J}_{\ell}|\leq n$ for any $\ell\in[1,M]$. ∎

Appendix B Proof of Lemma 2

We prove that $\smash{\tilde{A}_{i}[\mathcal{H}_{V|Z}^{(n)}]}$ and $\smash{\tilde{A}_{i}[\mathcal{H}_{X|VZ}^{(n)}]}$ are asymptotically jointly independent of eavesdropper channel observations $\tilde{Z}_{i}^{n}$. To do so, we use the following lemma.

First, for any $i\in[1,L]$ and $n$ large enough,

[TABLE]

where $(a)$ follows from applying the chain rule of entropy and the triangle inequality; and $(b)$ holds by Lemma 6 and Lemma 1 because

[TABLE]

Therefore, we have

[TABLE]

where $(a)$ holds by the definition of mutual information in terms of entropies and the uniformity of $\tilde{A}_{i}[\mathcal{H}_{V|Z}^{(n)}]$ and $\tilde{T}_{i}[\mathcal{H}_{V|Z}^{(n)}]$; $(b)$ holds by (68); and $(c)$ holds because

[TABLE]

where we have used the fact that conditioning does not increase entropy, the invertibility of $G_{n}$, and the definition of $\mathcal{H}_{V|Z}^{(n)}$ and $\mathcal{H}_{X|VZ}^{(n)}$ in (6) and (10) respectively.

Appendix C Proof of Lemma 3

We prove that all confidential messages and eavesdropper observations from blocks $1$ to $i-1$, that is, $(S_{1:L},\tilde{Z}_{1:i-1}^{n})$, are asymptotically statistically independent of eavesdropper observations $\tilde{Z}_{i}^{n}$ at block $i$.

For any $i\in[2,L]$ and sufficiently large $n$, we have

[TABLE]

where $(a)$ holds by independence between $S_{i+1:L}$ and any random variable from blocks $1$ to $i$; $(b)$ holds by Lemma 2 because $(S_{i},\Xi_{i-1}^{(V)})$ is stored into $\tilde{A}_{i}[\mathcal{H}^{(n)}_{V|Z}]$ and $\Lambda_{i-1}^{(X)}=\tilde{T}_{i}[\mathcal{H}^{(n)}_{X|VZ}]$; $(c)$ follows from applying d-separation [23] over the Bayesian graph in Figure 7 to obtain that $\tilde{Z}_{i}^{n}$ and $(S_{1:i-1},\tilde{Z}_{1:i-1}^{n})$ are conditionally independent given $(S_{i},\Xi_{i-1}^{(V)},\Lambda_{i-1}^{(X)},W_{1,i})$; $(d)$ also follows from applying d-separation to obtain that $W_{1,i}$ and $\tilde{Z}_{1:i-1}^{n}$ are conditionally independent given $(\tilde{A}_{1:i-1}^{n},S_{i},\Xi_{i-1}^{(V)},\Lambda_{i-1}^{(X)})$; $(e)$ holds by definition; and $(f)$ holds because $\bar{\Omega}_{i}^{(V)}$ is independent of $(S_{i},\Xi_{i-1}^{(V)},\Lambda_{i-1}^{(X)})$ and any random variable from blocks $1$ to $i-2$ and, moreover, because by crypto-lemma [22] we have $\bar{\Omega}_{i}^{(V)}\oplus\kappa_{\Omega}^{(V)}$ independent of $\tilde{A}_{i-1}^{n}$.