Semantically Secure Lattice Codes for Compound MIMO Channels

TL;DR

This paper introduces lattice codes that achieve near-optimal secrecy capacity for compound MIMO wiretap channels with minimal channel information, ensuring semantic security and reduced complexity through algebraic constructions.

Contribution

It proposes a universal lattice coding scheme for compound MIMO channels that attains secrecy capacity up to a constant gap and simplifies code design via algebraic structures.

Findings

Achieves secrecy capacity within a constant gap proportional to transmit antennas.

Provides a universal lattice coding scheme for compound MIMO wiretap channels.

Reduces code and decoding complexity using algebraic number theory.

Abstract

We consider compound multi-input multi-output (MIMO) wiretap channels where minimal channel state information at the transmitter (CSIT) is assumed. Code construction is given for the special case of isotropic mutual information, which serves as a conservative strategy for general cases. Using the flatness factor for MIMO channels, we propose lattice codes universally achieving the secrecy capacity of compound MIMO wiretap channels up to a constant gap (measured in nats) that is equal to the number of transmit antennas. The proposed approach improves upon existing works on secrecy coding for MIMO wiretap channels from an error probability perspective, and establishes information theoretic security (in fact semantic security). We also give an algebraic construction to reduce the code design complexity, as well as the decoding complexity of the legitimate receiver. Thanks to the algebraic structures of number fields and division algebras, our code construction for compound MIMO wiretap channels can be reduced to that for Gaussian wiretap channels, up to some additional gap to secrecy capacity.

Figures

Equations

$$\begin{array}{rl}\underset{n_b\times T}{\underbrace{{\mathbf{Y}}_b}}& =\underset{n_b\times n_a}{\underbrace{{\mathbf{H}}_b}}\underset{n_a\times T}{\underbrace{\mathbf{X}}}+\underset{n_b\times T}{\underbrace{{\mathbf{W}}_b}}\\ \underset{n_e\times T}{\underbrace{{\mathbf{Y}}_e}}& =\underset{n_e\times n_a}{\underbrace{{\mathbf{H}}_e}}\underset{n_a\times T}{\underbrace{\mathbf{X}}}+\underset{n_e\times T}{\underbrace{{\mathbf{W}}_e}},\end{array}$$

$$\begin{array}{rl}\underset{n_{b}T\times 1}{\underbrace{{\mathbf{y}}_b}}& =\underset{n_{b}T\times n_{a}T}{\underbrace{{\mathcal{H}}_b}}\underset{n_{a}T\times 1}{\underbrace{\mathbf{x}}}+\underset{n_{b}T\times 1}{\underbrace{{\mathbf{w}}_b}}\\ \underset{n_{e}T\times 1}{\underbrace{{\mathbf{y}}_e}}& =\underset{n_{e}T\times n_{a}T}{\underbrace{{\mathcal{H}}_e}}\underset{n_{a}T\times 1}{\underbrace{\mathbf{x}}}+\underset{n_{e}T\times 1}{\underbrace{{\mathbf{w}}_e}},\end{array}$$

$$\mathcal{H}_{b}=\mathbf{I}_{T}\otimes\mathbf{H}_{b}=\left(\begin{array}[]{cccc}\mathbf{H}_{b}&&&\\ &\mathbf{H}_{b}&&\\ &&\ddots&\\ &&&\mathbf{H}_{b}\end{array}\right),$$

$$\mathcal{H}_{e}=\mathbf{I}_{T}\otimes\mathbf{H}_{e}=\left(\begin{array}[]{cccc}\mathbf{H}_{e}&&&\\ &\mathbf{H}_{e}&&\\ &&\ddots&\\ &&&\mathbf{H}_{e}\end{array}\right).$$

$${\rho }_b\triangleq \frac{P}{{\sigma }_b^2}\text{mbox}and{\rho }_e\triangleq \frac{P}{{\sigma }_e^2},$$

$$C_s\ge \underset{\mathbf{R}}{\max }\underset{{\mathbf{H}}_b,{\mathbf{H}}_e}{\min }{\left(\log |\mathbf{I}+{\sigma }_b^{-1}{\mathbf{H}}_b^{†}{\mathbf{H}}_b\mathbf{R}|-\log \left|\mathbf{I}+{\sigma }_e^{-1}{\mathbf{H}}_e^{†}{\mathbf{H}}_e\mathbf{R}\right|\right)}^{+},$$

$$\begin{array}{rl}{\mathcal{S}}_b& =\left\{{\mathbf{H}}_b\in {\mathbb{C}}^{n_b\times n_a}:|\mathbf{I}+{\rho }_b{\mathbf{H}}_b^{†}{\mathbf{H}}_b|=e^{C_b}\right\},\\ {\mathcal{S}}_e& =\left\{{\mathbf{H}}_e\in {\mathbb{C}}^{n_e\times n_a}:\left|\mathbf{I}+{\rho }_e{\mathbf{H}}_e^{†}{\mathbf{H}}_e\right|=e^{C_e}\right\},\end{array}$$

$$\begin{array}{rl}{\overline{\mathcal{S}}}_b& =\left\{{\mathbf{H}}_b\in {\mathbb{C}}^{n_b\times n_a}:|\mathbf{I}+{\rho }_b{\mathbf{H}}_b^{†}{\mathbf{H}}_b|\ge e^{C_b}\right\},\\ {\overline{\mathcal{S}}}_e& =\left\{{\mathbf{H}}_e\in {\mathbb{C}}^{n_e\times n_a}:|\mathbf{I}+{\rho }_e{\mathbf{H}}_e^{†}{\mathbf{H}}_e|\le e^{C_e}\right\},\end{array}$$

$$\frac{1}{T}\text{tr}\left(\mathbb{E}\left[f_T(m,U{)}^{†}{f}_T(m,U)]\right]\right)\le n_{a}P,$$

$${\mathbb{P}}_{\text{err}|M}\triangleq \mathbb{P}(\hat{M}\ne M)\to 0,\forall s_b\in {\mathcal{S}}_b\text{mbox},asT\to \infty .$$

$$\mathbb{I}(M;{\mathbf{Y}}_e)\to 0$$

$$\underset{f,p_M}{\sup }\left\{\underset{m^{\prime }}{\max }\mathbb{P}(f(M)=f(m^{\prime })|{\mathbf{Y}}_e)-\underset{m^{\prime \prime }}{\max }\mathbb{P}(f(M)=f(m^{\prime \prime }))\right\}\to 0$$

$$\underset{m^{\prime },m^{\prime \prime }\in {\mathcal{M}}_T}{\max }\mathbb{V}(p_{{\mathbf{Y}}_e|m^{\prime }},p_{{\mathbf{Y}}_e|m^{\prime \prime }})\to 0\text{mbox}forall{s}_e\in {\mathcal{S}}_e.$$

$$\Lambda =\mathcal{L}({\mathbf{B}}_c)=\left\{{\mathbf{B}}_c\mathbf{x}:\mathbf{x}\in {\mathbb{Z}}^{2n}\right\}.$$

$$\mathbf{B}_{r}=\left(\begin{array}[]{c}\Re(\mathbf{B}_{c})\\ \Im(\mathbf{B}_{c})\end{array}\right)\in\mathbb{R}^{2n\times 2n}.$$

$$\mathbf{X}=\left(\begin{array}[]{cccc}x_{1}&x_{2}&\cdots&x_{T}\\ x_{T+1}&x_{T+2}&\cdots&x_{2T}\\ x_{2T+1}&x_{2T+2}&\cdots&x_{3T}\\ \vdots&\vdots&\ddots&\vdots\\ x_{(n-1)T+1}&x_{(n-1)T+2}&\cdots&x_{nT}\end{array}\right).$$

$${\Lambda }^{\ast }=\left\{\mathbf{x}\in {\mathbb{C}}^n:\Re ⟨\mathbf{x},\mathbf{y}⟩\in \mathbb{Z}\text{mbox}forall\mathbf{y}\in \Lambda \right\}.$$

$$f_{\sigma ,\mathbf{c}}(\mathbf{x})=\frac{1}{(\pi {\sigma }^2{)}^n}{e}^{-(\mathbf{x}-\mathbf{c}{)}^{†}(\mathbf{x}-\mathbf{c})/{\sigma }^2}.$$

$${ϵ}_{\Lambda }(\sigma )\triangleq \underset{\mathbf{x}\in \mathcal{R}(\Lambda )}{\max }|V(\Lambda )f_{\sigma ,\Lambda }(\mathbf{x})-1|$$

$${ϵ}_{\Lambda }(\sigma )={\left(\frac{{\gamma }_{\Lambda }(\sigma )}{\pi }\right)}^n{\Theta }_{\Lambda }\left(\frac{1}{\pi {\sigma }^2}\right)-1={\Theta }_{{\Lambda }^{\ast }}\left(\pi {\sigma }^2\right)-1,$$

$$f_{\sqrt{\mathbf{\Sigma }},\mathbf{c}}(\mathbf{x})=\frac{1}{{\pi }^n|\mathbf{\Sigma }|}\exp \left\{-(\mathbf{x}-\mathbf{c}{)}^T{\mathbf{\Sigma }}^{-1}(\mathbf{x}-\mathbf{c})\right\},$$

$${ϵ}_{\Lambda }(\sqrt{\mathbf{\Sigma }})\triangleq \underset{\mathbf{x}\in \mathcal{R}(\Lambda )}{\max }|V(\Lambda )f_{\sqrt{\mathbf{\Sigma }},\Lambda }(\mathbf{x})-1|$$

$${\gamma }_{\Lambda }(\sqrt{\mathbf{\Sigma }})=\frac{V(\Lambda {)}^{1/n}}{|\mathbf{\Sigma }{|}^{1/n}}.$$

$${ϵ}_{\Lambda }(\sqrt{\mathbf{\Sigma }})$$

$${\mathcal{D}}_{\Lambda +\mathbf{c},\sqrt{\mathbf{\Sigma }}}(\mathbf{\lambda }+\mathbf{c})=\frac{f_{\sqrt{\mathbf{\Sigma }}}(\mathbf{\lambda }+\mathbf{c})}{f_{\sqrt{\mathbf{\Sigma }},\Lambda }(\mathbf{c})}.$$

$$g(\mathbf{x})\in f_{\sqrt{{\mathbf{\Sigma }}_0}}(\mathbf{x})\left[1-4\epsilon ,1+4\epsilon \right].$$

$$\frac{1}{T}\log |{\Lambda }_b^T/{\Lambda }_e^T|=R,$$

$$R<(C_b-C_e-n_a{)}^{+}.$$

$$\mathbb{I}(M;{\mathbf{Y}}_e)\le 2n_{e}T{\epsilon }_{T}R-2{\epsilon }_T\log 2{\epsilon }_T.$$

$${\mathcal{H}}_e\mathbf{x}\sim {\mathcal{D}}_{{\mathcal{H}}_e({\Lambda }_e^T+{\mathbf{\lambda }}_m),\sqrt{({\mathcal{H}}_e{\mathcal{H}}_e^{†}){\sigma }_s^2}}.$$

Full text

I Introduction

Due to the open nature of the wireless medium, wireless communications are inherently vulnerable to eavesdropping attacks. Information theoretic security offers additional protection for wireless data, since it only relies on the physical properties of wireless channels, thus representing a competitive/complementary approach to security compared to traditional cryptography.

The fundamental wiretap channel model was first introduced by Wyner [1]. In this seminal paper, Wyner defined the secrecy capacity and presented the idea of coset coding to encode both data and random bits to mitigate eavesdropping. In recent years, the quest for the secrecy capacity of many classes of channels has been one of the central topics in wireless communications [2, 3, 4, 5, 6, 7, 8].

In the information theory community, a commonly used secrecy notion is strong secrecy: the mutual information $\mathbb{I}(M;Z^{T})$ between the confidential message $M$ and the channel output $Z^{T}$ should vanish when the code length $T\to\infty$. This common assumption of uniformly distributed messages was relaxed in [9], which considered the concept of semantic security: for any message distribution, the advantage obtained by an eavesdropper from its received signal vanishes for large block lengths. This notion is motivated by the fact that the plaintext can be fixed and arbitrary.

For the Gaussian wiretap channel, [10] introduced the secrecy gain of lattice codes while [11] proposed semantically secure lattice codes based on the lattice Gaussian distribution. To obtain semantic security, the flatness factor of a lattice was introduced in [11] as a fundamental criterion which implies that conditional outputs are indistinguishable for different input messages. Using a random coding argument, it was shown that there exist families of lattice codes which are good for secrecy, meaning that their flatness factor vanishes. Such families achieve semantic security for rates up to $1/2$ nat from the secrecy capacity.

Compared to the Gaussian wiretap channel, the cases of fading and multi-input multi-output (MIMO) wiretap channels are more technically challenging. The fundamental limits of fading wireless channels with secrecy constraints have been investigated in [12, 13, 2], where the achievable rates and the secrecy outage probability were given. The secrecy capacity of the MIMO wiretap channel was derived in [14, 15, 16, 17], assuming full channel state information at the transmitter (CSIT). A code design in this setting was given in [18] by reducing to scalar Gaussian codes. Although CSIT is sometimes available for the legitimate channel, it is hardly possible that it would be available for the eavesdropping channel. An achievability result was given in [19] for varying MIMO wiretap channels with no CSI about the wiretapper, under the condition that the wiretapper has less antennas than the legitimate receiver. Schaefer and Loyka [20] studied the secrecy capacity of the compound MIMO wiretap channel, where a transmitter has no knowledge of the realization of the eavesdropping channel, except that it remains fixed during the transmission block and belongs to a given set (the compound set). The compound model represents a well-accepted reasonable approach to information theoretic security, which assumes minimal CSIT of the eavesdropping channel [21, 22, 23]. It can also model a multicast channel with several eavesdroppers, where the transmitter sends information to all legitimate receivers while keeping it secret from all eavesdroppers [21].

When it comes to code design for fading and MIMO wiretap channels, an error probability criterion was used in several prior works [24, 25, 26], while information theoretic security was only addressed recently with the help of flatness factors [27, 28]. In particular, [28] established strong secrecy over MIMO wiretap channels for secrecy rates that are within a constant gap from the secrecy capacity.

I-A Main Contributions

In this paper, we propose universal codes for compound Gaussian MIMO wiretap channels that complement the recent work reported in [28]. The key method is discrete Gaussian shaping and a “direct” proof of the universal flatness of the eavesdropper’s lattice. This method is similar to that used in [29] to approach the capacity of compound MIMO channels so that the present paper can be considered a companion paper of [29] for wiretap channels. Note that [28] used an “indirect” proof, which was based on an upper bound on the smoothing parameter in terms of the minimum distance of the dual lattice. Besides considering different channel models ([28] is focused on ergodic stationary channels although it also briefly addresses compound channels), the code constructions of this paper and [28] are also different: the construction of [28] is based on a particular sequence of algebraic number fields with increasing degrees, while the algebraic construction of this work combines algebraic number fields of fixed degree and random error correcting codes of increasing lengths. The proposed construction enjoys a significantly smaller gap to secrecy capacity, as well as lower decoding complexity, than [28], over compound MIMO wiretap channels.

We focus on a compound channel formed by the set of all matrices with the same white-input capacity (see (3) for the precise model). Our lattice coding scheme universally achieves rates (in nats) up to $(C_{b}-C_{e}-n_{a})^{+}$, where $C_{b}$ is the capacity of the legitimate channel, $C_{e}$ is the capacity of the eavesdropper channel, $n_{a}$ is the number of transmit antennas and $(x)^{+}=\max\left\{x,0\right\}$. We believe the $n_{a}$-nat gap is an artifact of our proof technique based on the flatness factor, which may be removed by improving the flatness-factor method. This is left as an open problem for future research.

For this special compound model, we also show how to extend the analysis in order to accommodate number-of-antenna mismatch, i.e., security is valid regardless of the number of antennas at the eavesdropper111Previous works [24, 28] required that the number of the eavesdropper’s antennas be greater than or equal to $n_{a}$.. This is a very appealing property, since the number of receive antennas of an eavesdropper may be unknown to the transmitter.

We present two techniques to prove universality of the proposed lattice codes. The first technique is based on Construction A (see Sect. V-A for the definition) and the usual argument for compound channels [30, 31], which combines fine quantization of the channel space with mismatch encoding for quantized states. This method is a generic proof of the existence of good codes which potentially incurs large blocklengths and performance loss. The second technique is based on algebraic lattices and assumes that the codes admit an “algebraic reduction” and can absorb the channel state. In fact, any code which is good for the Gaussian wiretap channel can be coupled with this second technique, as long as it also possesses an additional algebraic structure (for precise terms see Definition 6). It is inspired by previous works on algebraic reduction for fading and MIMO channels [32], [33], which are revisited here in terms of secrecy.

I-B Relation to Previous Works

An idea of approaching the secrecy capacity of fading wiretap channels using nested lattice codes was outlined in [34]. Code construction for compound wiretap channels has been further developed in [35], which leads to the current work where proof details are given.

The technique for establishing universality of the codes in [20] over the compound MIMO channel with (uncountably) infinite uncertainty sets consists of quantizing the channel space and designing a (random Gaussian) codebook for the quantized channels. This method is similar to the proof of Theorem 1 in the present paper.

Compound MIMO channels without secrecy constraints have been considered earlier in [30, 31, 36] for random codebooks. Lattice codes are shown to achieve the optimal diversity-multiplexing tradeoff for MIMO channels in [37]. More recently it was proven that precoded integer forcing [38] achieves the compound capacity up to a gap, while algebraic lattice codes [29] achieve the compound capacity with ML decoding and a gap to the compound capacity of MIMO channels with reduced decoding complexity. As mentioned above, some techniques (generalized Construction A and channel quantization) of this paper are similar to those used in [29].

I-C Organization

The technical content of this paper is organized as follows. In Section II we discuss the main problem and notions of security. In Section III, we introduce the main notation on lattices and discrete Gaussians, stating generalized versions of known results for correlated Gaussian distributions. In Section IV we give an overview of the main coding scheme and analyze the information leakage and reliability. The proof of universality, however, is postponed until Section V, where we show that lattice codes can achieve vanishing information leakage under semantic security through the two aforementioned techniques. Section VI concludes the paper with a discussion of other compound models and future work.

I-D Notation

Matrices and column vectors are denoted by upper and lowercase boldface letters, respectively. For a matrix $\mathbf{A}$, its Hermitian transpose, inverse, determinant and trace are denoted by $\mathbf{A}^{{\dagger}}$, $\mathbf{A}^{-1}$, $|\mathbf{A}|$ and $\mathrm{tr}(\mathbf{A})$, respectively. We denote the Frobenius norm of a matrix by $\left\|\mathbf{A}\right\|_{F}\triangleq\sqrt{\mbox{tr}(\mathbf{A}^{\dagger}\mathbf{A})}$ and the spectral norm (i.e., $2$-norm) by $\left\|\mathbf{A}\right\|\triangleq\sqrt{\lambda_{1}}$, where $\lambda_{1}$ is the largest eigenvalue of $\mathbf{A}^{\dagger}\mathbf{A}$. $\mathbf{I}$ denotes the identity matrix. We write $\mathbf{A}\succeq\mathbf{0}$ for a symmetric matrix $\mathbf{A}$ if it is positive semi-definite. Similarly, we write $\mathbf{A}\succeq\mathbf{B}$ if $(\mathbf{A}-\mathbf{B})\succeq\mathbf{0}$. We use the standard asymptotic notation $f\left(x\right)=O\left(g\left(x\right)\right)$ when $\lim\sup_{x\rightarrow\infty}|f(x)|/g(x)<\infty$ , $f\left(x\right)=o\left(g\left(x\right)\right)$ when $\lim_{x\rightarrow\infty}f(x)/g(x)=0$, $f\left(x\right)=\Omega\left(g\left(x\right)\right)$ when $\lim\inf_{x\rightarrow\infty}f(x)/g(x)>0$, and $f\left(x\right)=\omega\left(g\left(x\right)\right)$ when $\lim_{x\rightarrow\infty}f(x)/g(x)=\infty$. Finally, in this paper, the logarithm is taken with respect to base $e$ (where $e$ is the Neper number) and information is measured in nats.

II Problem Statement

Consider the following wiretap model. A transmitter (Alice) sends information through a MIMO channel to a legitimate receiver (Bob) and is eavesdropped by an illegitimate user (Eve). The channel equations for Bob and Eve read:

[TABLE]

where $n_{a}$ is the number of transmit antennas, $n_{b}$ ($n_{e}$, resp.) is the number of receive antennas for Bob (Eve, resp.), $T$ is the coherence time, and $\mathbf{W}_{b}$ ($\mathbf{W}_{e}$, resp.) has circularly symmetric complex Gaussian i.i.d. entries with variance $\sigma_{b}^{2}$ ($\sigma_{e}^{2}$, resp.) per complex dimension. We can vectorize (1) in a natural way:

[TABLE]

where $\mathcal{H}_{b}$ and $\mathcal{H}_{e}$ are the block diagonal matrices

[TABLE]

[TABLE]

For convenience, we denote the transmit signal-to-noise ratio (SNR) in Bob and Eve’s channels by

[TABLE]

respectively, where $P$ is the power constraint, i.e., the transmitted signal satisfies $\mathbb{E}[\mathbf{x}^{\dagger}\mathbf{x}]\leq n_{a}TP$.

We assume that the channel realizations $(\mathbf{H}_{b},\mathbf{H}_{e})$ are unknown to Alice but belong to a compound set $\mathcal{S}=\mathcal{S}_{b}\times\mathcal{S}_{e}\in\mathbb{C}^{n_{b}\times n_{a}}\times\mathbb{C}^{n_{e}\times n_{a}}$. From the security perspective, we further make the conservative assumption that Eve knows both $\mathbf{H}_{b}$ and $\mathbf{H}_{e}$. Under this general scenario the (strong) secrecy capacity is bounded by [20]:

[TABLE]

where the minimum is over all realizations in $\mathcal{S}$ and the maximum over the matrices $\mathbf{R}\succeq 0$ such that $\text{tr}(\mathbf{R})\leq n_{a}P$. Suppose that $\mathcal{S}_{b}$ and $\mathcal{S}_{e}$ are the set of channels with the same isotropic mutual information, i.e.,

[TABLE]

for fixed $C_{b},C_{e}\geq 0$. In this case, the bound gives $C_{s}\geq(C_{b}-C_{e})^{+}$. The worst case is achieved by taking a specific “isotropic” realization $\mathbf{H}_{b}^{\dagger}\mathbf{H}_{b}=\alpha_{b}\mathbf{I}$, $\mathbf{H}_{e}^{\dagger}\mathbf{H}_{e}=\alpha_{e}\mathbf{I}$, where $\alpha_{b}$ and $\alpha_{e}$ are such that $\mathbf{H}_{b}$ and $\mathbf{H}_{e}$ belong to $\mathcal{S}_{b}$ and $\mathcal{S}_{e}$, respectively. From this we conclude that $C_{s}=C_{b}-C_{e}$. The goal of this paper is to construct universal lattice codes that approach the secrecy capacity $C_{s}$ with semantic security. As a corollary, the semantic security capacity and the strong secrecy capacity of the compound set $\mathcal{S}_{b}\times\mathcal{S}_{e}$ coincide.

A practical motivation to consider the compound model (3) is the following. Firstly, notice that the secrecy capacity is the same if we replace the equality in the definition of $\mathcal{S}_{b}$ and $\mathcal{S}_{e}$ with upper/lower bounds; more precisely the secrecy capacity of the channel with compound set $\overline{\mathcal{S}}_{e}\times\overline{\mathcal{S}}_{b}$, where

[TABLE]

is the same as for $\mathcal{S}_{e}\times\mathcal{S}_{b}$. Note that the sets $\mathcal{S}_{b}$, $\mathcal{S}_{e}$ and $\overline{\mathcal{S}}_{e}$ are compact whereas $\overline{\mathcal{S}}_{b}$ is not. In other words, universal codes are robust, in the sense that only a lower bound on the legitimate channel capacity and an upper bound on the eavesdropper channel are needed. From the security perspective, this is a safe strategy in the scenario where the capacities are not known precisely. Even if Bob and Eve’s channels are random, an acceptable secrecy-outage probability can be guaranteed by setting $C_{b}$ and $C_{e}$ properly. Then, the problem still boils down to the design of universal codes for the compound model (3).

II-A Notions of Security

A secrecy code for the compound MIMO channel can be formally defined as follows.

Definition 1**.**

An $(R,R^{\prime},T)$-secrecy code for a compound MIMO channel with set $\mathcal{S}=\mathcal{S}_{b}\times\mathcal{S}_{e}$ consists of

• (i)

A set of messages $\mathcal{M}_{T}=\left\{1,\ldots,e^{TR}\right\}$ (the secret message rate $R$ is measured in nats and $e^{TR}$ is assumed to be an integer for convenience).

• (ii)

An auxiliary (not necessarily uniform) source $U$ taking values in $\mathcal{U}_{T}$ with entropy $R^{\prime}=H(U)$.

• (iii)

A stochastic encoding function $f_{T}:\mathcal{M}_{T}\times\mathcal{U}_{T}\to\mathbb{C}^{n_{a}\times T}$ satisfying the power constraint

[TABLE]

for any $m\in\mathcal{M}_{T}$.

• (iv)

A decoding function $g_{T}:\mathcal{S}_{b}\times\mathbb{R}^{n_{b}\times T}\to\mathcal{M}_{T}$ with output $\hat{m}=g_{T}(s_{b},\mathbf{Y}_{b})$.

A pair $(s_{b},s_{e})\in\ \mathcal{S}_{b}\times\mathcal{S}_{e}$ is referred to as a channel state (or channel realization). To ensure reliability for all channel states we require a sequence of codes whose error probability for message $M$ vanishes uniformly:

[TABLE]

Let $p_{M}$ be a message distribution over $\mathcal{M}_{T}$. For strong secrecy, $p_{M}$ is usually assumed to be uniform; however, this assumption is not sufficient from the viewpoint of semantic security, which is the standard notion of security in modern cryptography. Let $\mathbf{Y}_{e}$ be the output of the channel to the eavesdropper, who is omniscient. The following security notions are adapted from [9, 11] and should hold in the limit $T\to\infty$:

• •

Mutual Information Security (MIS): Unnormalized mutual information

[TABLE]

for any message distribution $p_{M}$ and $\mbox{for {all} }s_{e}\in\mathcal{S}_{e}$.

• •

Semantic Security (SemanticS): Adversary’s advantage

[TABLE]

for any function $f$ from $M$ to finite sequences of bits in $\left\{0,1\right\}^{*}$, and all $s_{e}\in\mathcal{S}_{e}$.

• •

Distinguishing Security (DistS): The maximum variational distance

[TABLE]

We stress that all three notions require a sequence of codes to be universally secure for all channel states. Treating these notions as classes, we have the inclusions $\textsc{MIS}\subseteq\textsc{SemanticS}=\textsc{DistS}$, i.e., the sequences of codes satisfying DistS are the same as the ones satisfying SemanticS and also include those satisfying MIS [11, Prop. 1]. Moreover, if in the above notions we require that the convergence rate is $o(1/T)$, the three sets coincide. We thus define universally secure codes as follows.

Definition 2**.**

A sequence of codes of rate $R$ is universally secure for the MIMO wiretap channel if for all $(s_{b},s_{e})\in\mathcal{S}$, it satisfies the reliability condition (6) and mutual information security (7) uniformly.

Then, semantic security follows as a corollary, which is a direct consequence of established relations between MIS and SemanticS [9]:

Corollary 1**.**

The sequence of codes given in Definition 2 is semantically secure for the compound MIMO wiretap channel.

In what follows we proceed to construct universally secure codes for the MIMO wiretap channel using lattice coset codes.

III Correlated Discrete Gaussian Distributions

In this subsection, we exhibit essential results and concepts for the definition and analysis of our lattice coding scheme.

III-A Preliminary Lattice Definitions

A (complex) lattice $\Lambda$ with generator matrix $\mathbf{B}_{c}\in\mathbb{C}^{n\times 2n}$ is a discrete additive subgroup of $\mathbb{C}^{n}$ given by

[TABLE]

A complex lattice has an equivalent real lattice generated by the matrix obtained by stacking real and imaginary parts of matrix $\mathbf{B}_{c}$:

[TABLE]

A fundamental region $\mathcal{R}(\Lambda)$ for $\Lambda$ is any interior-disjoint region that tiles $\mathbb{C}^{n}$ through translates by vectors of $\Lambda$. For any $\mathbf{y},\mathbf{x}\in\mathbb{C}^{n}$ we say that $\mathbf{y}=\mathbf{x}\pmod{\Lambda}$ iff $\mathbf{y}-\mathbf{x}\in\Lambda$. By convention, we fix a fundamental region and denote by $\mathbf{y}\pmod{\Lambda}$ the unique representative $\mathbf{x}\in\mathcal{R}(\Lambda)$ such that $\mathbf{y}=\mathbf{x}\pmod{\Lambda}$. The volume of $\Lambda$ is defined as the volume of a fundamental region for the equivalent real lattice, given by $V(\Lambda)=|\mathbf{B}_{r}|.$

Throughout this text, for convenience, we also use the matrix-notation of lattice points. If $\Lambda\subset\mathbb{C}^{nT}$ is a full-rank lattice, the matrix form representation of $\mathbf{x}=(x_{1},\ldots,x_{nT})\in\Lambda$ is

[TABLE]

The dual $\Lambda^{*}$ of a complex lattice is defined as

[TABLE]

III-B The Flatness Factor

The flatness factor has been introduced in [11], and will be used here to bound the information leakage of information transmission of our coding scheme.

The p.d.f. of the complex Gaussian centered at $\mathbf{c}\in\mathbb{C}^{n}$ is defined as

[TABLE]

We write $f_{\sigma,\Lambda}(\mathbf{x})$ for the sum of $f_{\sigma,\mathbf{c}}(\mathbf{x})$ over $\mathbf{c}\in\Lambda$. The flatness factor of a lattice quantifies the distance between $f_{\sigma,\Lambda}(\mathbf{x})$ and the uniform distribution over $\mathcal{R}(\Lambda)$ and, as we will see, bounds the amount of leaked information in a lattice coding scheme.

Definition 3** (Flatness factor for spherical Gaussian distributions).**

For a lattice $\Lambda$ and a parameter $\sigma$, the flatness factor is defined by:

[TABLE]

where $\mathcal{R}(\Lambda)$ is a fundamental region of $\Lambda$.

For a complex lattice $\Lambda\subset\mathbb{C}^{n}$, let $\gamma_{\Lambda}(\sigma)=\frac{V(\Lambda)^{\frac{1}{n}}}{\sigma^{2}}$ be the volume-to-noise ratio (VNR). We recall the formulas of the flatness factor and smoothing parameter, adapted to complex lattices. The flatness factor can be written as [11, Prop. 2]:

[TABLE]

where $\Theta_{\Lambda}$ is the theta series of the lattice $\Lambda$.

Definition 4** (Smoothing parameter [39]).**

For a lattice $\Lambda$ and $\varepsilon>0$, the smoothing parameter is defined by the function $\eta_{\varepsilon}(\Lambda)=\sqrt{2\pi}\sigma$, for the smallest $\sigma>0$ such that $\sum_{{\bm{\lambda}^{*}}\in\Lambda^{*}\setminus\{\mathbf{0}\}}e^{-\pi^{2}\sigma^{2}\|{\bm{\lambda}^{*}}\|^{2}}\leq\varepsilon$.

When we have a correlated Gaussian distribution with covariance matrix $\mathbf{\Sigma}$

[TABLE]

the flatness factor is similarly defined.

Definition 5** (Flatness factor for correlated Gaussian distributions).**

[TABLE]

where $\mathcal{R}(\Lambda)$ is a fundamental region of $\Lambda$.

The usual smoothing parameter in Definition 4 is a scalar. To extend its definition to matrices, we say $\sqrt{2\pi\mathbf{\Sigma}}\succeq\eta_{\varepsilon}(\Lambda)$ if $\epsilon_{\Lambda}(\sqrt{\mathbf{\Sigma}})\leq\varepsilon$. This induces a partial order because $\epsilon_{\Lambda}(\sqrt{\mathbf{\Sigma}_{1}})\leq\epsilon_{\Lambda}(\sqrt{\mathbf{\Sigma}_{2}})$ if $\mathbf{\Sigma}_{1}\succeq\mathbf{\Sigma}_{2}$.

When $\mathbf{c}=0$ we ignore the index and write $f_{\sqrt{\mathbf{\Sigma}},\mathbf{0}}(\mathbf{x})=f_{\sqrt{\mathbf{\Sigma}}}(\mathbf{x})$. For a covariance matrix $\mathbf{\Sigma}$ we define the generalized-volume-to-noise ratio as

[TABLE]

Clearly, the effect of correlation on the flatness factor may be absorbed if we use a new lattice $\frac{\sqrt{\mathbf{\Sigma}}}{\sigma}\cdot\Lambda$, i.e., $\epsilon_{\Lambda}({\sigma})=\epsilon_{\frac{\sqrt{\mathbf{\Sigma}}}{\sigma}\cdot\Lambda}(\sqrt{\mathbf{\Sigma}})$. From this, and from the expression of the flatness factor, we have

[TABLE]

In our applications, the matrix $\mathbf{\Sigma}$ will be determined by the channel realization (1). Figure 1 shows the effect of fading on the lattice Gaussian function. A function (10) which is flat over the Gaussian channel (corresponding to $\mathbf{\Sigma}=\mathbf{I}$) need not be flat for a channel in deep fading (corresponding to an ill-conditioned $\mathbf{\Sigma}$), in which case an eavesdropper could clearly distinguish one dimension of the signal.

III-C The Discrete Gaussian Distribution

In order to define our coding scheme, we need a last element, which is the distribution of the sent signals. To this end, we define the discrete Gaussian distribution $\mathcal{D}_{\Lambda+\mathbf{c},\sqrt{\mathbf{\Sigma}}}$ as the distribution assuming values on $\Lambda+\mathbf{c}$, such that the probability of each point $\bm{\lambda}+\mathbf{c}$ is given by

[TABLE]

Its relation to the continuous Gaussian distribution can be shown via the smoothing parameter or the flatness factor. For instance, a vanishing flatness factor guarantees that the power per dimension of $\mathcal{D}_{\Lambda+\mathbf{c},\sigma\mathbf{I}}$ is approximately $\sigma^{2}$ [11, Lemma 6].

The next proposition says that the sum of a continuous Gaussian and a discrete Gaussian is approximately a continuous Gaussian, provided that the flatness factor is small. The proof can be found in [28, Appendix I-A]:

Lemma 1**.**

Given $\mathbf{x}_{1}$ sampled from the discrete Gaussian distribution $D_{\Lambda+\mathbf{c},\sqrt{\mathbf{\Sigma}_{1}}}$ and $\mathbf{x}_{2}$ sampled from the continuous Gaussian distribution $f_{\sqrt{\mathbf{\Sigma}_{2}}}$. Let $\mathbf{\Sigma}_{0}=\mathbf{\Sigma}_{1}+\mathbf{\Sigma}_{2}$ and let $\mathbf{\Sigma}_{3}^{-1}=\mathbf{\Sigma}_{1}^{-1}+\mathbf{\Sigma}_{2}^{-1}$. If $\sqrt{\mathbf{\Sigma}_{3}}\succeq\eta_{\varepsilon}(\Lambda)$ for $\varepsilon\leq\frac{1}{2}$, then the distribution $g$ of $\mathbf{x}=\mathbf{x}_{1}+\mathbf{x}_{2}$ is close to $f_{\sqrt{\mathbf{\Sigma}_{0}}}$:

[TABLE]

IV Coding Scheme and Analysis

IV-A Overview

Given a pair of nested lattices $\Lambda_{e}^{T}\subset\Lambda_{b}^{T}\subset\mathbb{C}^{n_{a}T}$ such that

[TABLE]

the transmitter maps a message $m$ to a coset of $\Lambda_{e}^{T}$ in quotient $\Lambda_{b}^{T}/\Lambda_{e}^{T}$, then samples a point from that coset. Concretely, one can use a a one-to-one map $\phi$ such that $\phi(m)=\bm{\lambda}_{m}$, where $\bm{\lambda}_{m}$ is a representative of the coset and then samples the signal $\mathbf{x}\sim\mathcal{D}_{\Lambda_{e}^{T}+\bm{\lambda}_{m},\sigma_{s}},$ broadcasting it to the channels. A block diagram for the transmission until the front-end receivers Bob and Eve is depicted in Figure 2a.

In order to find pairs of sequences of nested lattices $\Lambda_{b}^{T}$ and $\Lambda_{e}^{T}$ we employ constructions of lattices from error-correcting codes. The analysis and full construction are explained in Section V. Essentially, the lattice $\Lambda_{b}^{T}$ controls reliability and has to be chosen in such a way that it is universally good for the legitimate compound channel. The lattice $\Lambda_{e}^{T}$ controls the information leakage to the eavesdropper, and has to be chosen in such a way that the flatness factor vanishes universally for any eavesdropper realization (universally good for secrecy). The main result of this section is the following theorem, stating the existence of schemes with vanishing probability of error and vanishing information leakage for all pairs of realizations in the compound set $\mathcal{S}_{b}\times\mathcal{S}_{e}$.

Theorem 1**.**

There exists a sequence of pairs of nested lattices $(\Lambda_{b}^{T},\Lambda_{e}^{T})_{T=1}^{\infty}$, $\Lambda_{b}^{T}\subset\Lambda_{e}^{T}\subset\mathbb{C}^{n_{a}T}$ such that as $T\to\infty$, the lattice coding scheme universally achieves any secrecy rate

[TABLE]

Moreover, we show that both the probability of error and information leakage in Theorem 1 vanishes uniformly for all realizations.

IV-B The Eavesdropper Channel: Security

For a fixed realization $\mathbf{H}_{e}$, the key element for bounding the information leakage is the following lemma [11, Lem 2]:

Lemma 2**.**

Suppose that there exists a probability density function $q$ taking values in $\mathbb{C}^{n_{e}\times T}$ such that $\mathbb{V}(p_{\mathbf{Y}_{e}|m},q_{\mathbf{Y}_{e}})\leq\varepsilon_{T}$ for all $m\in\mathcal{M}_{T}$. Then, for all message distributions, the information leakage is bounded as:

[TABLE]

We will show that if the distribution is sufficiently flat, then $\mathbf{Y}_{e}|m$ is statistically close to a multivariate Gaussian for any $m\in\mathcal{M}_{T}$. Let us assume for now that $\mathbf{H}_{e}$ is an invertible square matrix (we next show how to reduce the other cases to this one). In this case, given a message $m$, we have

[TABLE]

According to Lemma 1, the distribution of $\mathcal{H}_{e}\mathbf{x}+\mathbf{w}_{e}$ is within variational distance $4\varepsilon_{T}$ from the normal distribution $\mathcal{N}(0,\sqrt{\mathbf{\Sigma}_{0}})$, where $\varepsilon_{T}=\varepsilon_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})$ and

[TABLE]

We thus have the following bound for the information leakage ((11) with $\varepsilon_{T}$ replaced by $4\varepsilon_{T}$):

[TABLE]

Therefore, if $\varepsilon_{T}=\varepsilon_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})=o(1/T)$, the leakage vanishes as $T$ increases for the specific realization $\mathcal{H}_{e}$. To achieve strong secrecy universally, we must, however, ensure the existence of a lattice with vanishing flatness factor for all possible $\mathbf{\mathbf{\Sigma}}_{3}$. We postpone the universality discussion to Section V where it is proven that a vanishing flatness factor is possible simultaneously for all $\mathbf{H}_{e}\in\mathcal{S}_{e}$ and $\gamma_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})<\pi$. This condition implies that semantic security is possible for any VNR,

[TABLE]

[TABLE]

Number-of-Antenna Mismatch. The above analysis assumed that $n_{e}=n_{a}$, i.e., the number of eavesdropper receive antennas is equal to the the number of transmit antennas. Although analytically simpler, this assumption is not reasonable in practice, since we expect a compound scheme to perform well for any number of eavesdropper antennas. We show next how to reduce the other cases to the square case.

(i) $n_{e}<n_{a}$: Recall that the signal received by the eavesdropper is given in matrix form by

[TABLE]

Let $\tilde{\mathbf{H}}_{e}\in\mathbb{C}^{(n_{a}-n_{e})\times n_{a}}$ be a completion of $\mathbf{H}_{e}$ such that

[TABLE]

is a full-rank sqaure matrix and $\beta>0$ is some small number. Let $\tilde{\mathbf{W}}_{e}\in\mathbb{C}^{(n_{a}-n_{e})\times T}$ be a matrix corresponding to circularly symmetric Gaussian noise. Consider the following surrogate MIMO channel:

[TABLE]

where $\tilde{\mathbf{H}}_{e}$ is scaled so that the capacity of the new channel is arbitrarily close to the original one. Indeed for any full rank completion $\tilde{\mathbf{H}}_{e}$, from the matrix determinant lemma, we have

[TABLE]

Therefore, by letting $\beta\to 0$, the left-hand side tends to $e^{C_{e}}$. For any signal $\mathbf{X}$, the information leakage of the surrogate channel is strictly greater than the original one. Indeed, the the eavesdropper’s original channel is stochastically degraded with respect to the augmented one, thus $\mathbb{I}(M;(\mathbf{Y}_{e},\tilde{\mathbf{Y}}_{e}))\geq\mathbb{I}(M;\mathbf{Y}_{e}).$ A universally secure code for the $n_{a}\times n_{a}$ MIMO compound channel will have vanishing information leakage for the surrogate $n_{a}\times n_{a}$ channel (for any completion) and therefore will also be secure for the original $n_{e}\times n_{a}$ channel.

(ii) $n_{e}>n_{a}$: Performing a rectangular $QR$ factorization of $\mathbf{H}_{e}$ we have:

[TABLE]

where ${\mathbf{Q}}\in\mathbb{C}^{n_{e}\times n_{e}}$ and $\hat{\mathbf{R}}\in\mathbb{C}^{n_{a}\times n_{a}}$ are square matrices. Therefore the eavesdropper’s received signal is equivalent to

[TABLE]

where the components of the noise matrices $\tilde{\mathbf{W}}_{e}^{(1)},\tilde{\mathbf{W}}_{e}^{(2)}$ are i.i.d. Gaussian. The leakage is therefore the same as for the square channel $\hat{\mathbf{R}}$ and a universal code will also achieve vanishing leakage for the non-square channel.

IV-C The Legitimate Channel: Reliability

It was shown in [29] that if $\mathbf{X}\sim\mathcal{D}_{\Lambda_{b}^{T},\sigma_{s}}$, then the maximum-a-posteriori (MAP) decoder for the signal $\mathbf{Y}_{b}$ is equivalent to lattice decoding of $\mathbf{F}_{b}\mathbf{Y}_{b}$, where $\mathbf{F}_{b}$ is the MMSE-GDFE matrix to be defined in the sequel. We cannot claim directly that $\mathbf{X}\sim\mathcal{D}_{\Lambda_{b}^{T},\sigma_{s}}$, since the message distribution in $\mathcal{M}_{T}$ need not be uniform. Nonetheless, we show that reliability is still possible for all individual messages.

The full decoding process is depicted in Figure 2b. Bob first applies a filtering matrix $\mathbf{F}_{b}$ so that

[TABLE]

where $\mathbf{R}_{b}^{\dagger}\mathbf{R}_{b}=\mathbf{H}_{b}^{\dagger}\mathbf{H}_{b}+\rho_{b}^{-1}\mathbf{I}$ and $\mathbf{F}_{b}^{\dagger}\mathbf{R}_{b}=\rho_{b}^{-1}\mathbf{H}_{b}$, and the effective noise is

[TABLE]

The next step is to decode $\tilde{\mathbf{Y}}_{b}$ in $\mathbf{R}_{b}\Lambda_{b}^{T}$, in order to obtain $Q_{\mathbf{R}_{b}\Lambda_{b}^{T}}(\tilde{\mathbf{Y}}_{b}),$ which is then remapped into the element of the coset $\mathbf{R}_{b}\Lambda_{b}^{T}/\mathbf{R}_{b}\Lambda_{e}^{T}$ through the operation $\mbox{mod }\mathbf{R}_{b}\Lambda_{e}^{T}$. We can then invert the linear transformation associated to $\mathbf{R}_{b}$ (notice that $\mathbf{R}_{b}$ has full rank) in order to obtain the coset in $\Lambda_{b}^{T}/\Lambda_{e}^{T}$ and re-map it to the message space $\mathcal{M}_{T}$ through $\phi^{-1}$.

In the first step, from Lemma 1, the effective noise $\mathbf{W}_{b,\text{eff}}$ is statistically close to a Gaussian noise with covariance:

[TABLE]

provided that $\varepsilon_{(F_{b}\mathbf{H}_{b}-\mathbf{R}_{b})\Lambda_{e}^{T}}(\mathbf{\Sigma}_{b,\text{inv}})$ is small, where

[TABLE]

The probability of error given any message $m$ is thus bounded by

[TABLE]

where each entry of $\tilde{\mathbf{W}}_{b,\text{eff}}$ is i.i.d. normal with variance $\sigma_{b}^{2}$. Therefore, if we guarantee that $\varepsilon_{(F_{b}\mathbf{H}_{b}-\mathbf{R}_{b})\Lambda_{e}^{T}}(\mathbf{\Sigma}_{b,\text{inv}})$ is bounded and if we choose a universally good lattice, the probability vanishes for all possible $\mathbf{R}_{b}$. This is possible [29] provided that

[TABLE]

namely,

[TABLE]

However, the evaluation of $\mathbf{\Sigma}_{b,\text{inv}}$ is cumbersome and implies an extra condition for the flatness of $\Lambda_{e}^{T}$. Next we show, instead, how to circumvent this problem by using the fact that that the effective noise is “asymptotically” sub-Gaussian with covariance matrix $\sigma_{b}^{2}\mathbf{I}$. We say that a centred random vector $\mathbf{w}\in\mathbb{R}^{n}$ is sub-Gaussian with (proxy) parameter $\sigma$ if

[TABLE]

for all $t\in\mathbb{R}$ and all unit norm vectors $\mathbf{u}\in\mathbb{R}^{n}$.

Lemma 3** ([28]).**

Let $\mathbf{x}$ be a random vector with distribution $\mathcal{D}_{\Lambda_{e}^{T}+\bm{\lambda}_{m},\sigma_{s}}$, and let $\varepsilon^{\prime}=\varepsilon_{\Lambda_{e}^{T}}\left(\sigma_{s}\right).$ For any matrix $\mathbf{A}$ and any vector $\mathbf{u}\in\mathbb{C}^{n_{b}T}$, we have:

[TABLE]

Notice that the average power per dimension of a sub-Gaussian random variable is always less than or equal to its parameter $\sigma_{s}^{2}$. Moreover, the sum of two sub-Gaussians is also a sub-Gaussian (for more properties, the reader is referred to [28]). The above lemma, along with (IV-C), allows us to establish that $\mathbf{W}_{b,\text{eff}}$ is almost sub-Gaussian with parameter $\sigma_{b}^{2}$. Therefore, as long as $\varepsilon^{\prime}\approx 0$ the probability of error tends to zero if we choose $\Lambda_{b}^{T}$ to be universally AWGN-good.

IV-D Proof of Theorem 1: Achievable Secrecy Rates

From the previous subsections, semantic security is achievable if $\Lambda_{b}^{T}$ and $\Lambda_{e}^{T}$ satisfy:

Reliability (22): $\gamma_{\mathbf{R}_{b}\Lambda_{b}^{T}}(\sigma_{b})>\pi e$ 2. 2.

Secrecy (14): $\gamma_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})<\pi$ 3. 3.

Sub-Gaussianity of equivalent noise and power constraint: $\varepsilon_{\Lambda_{e}^{T}}(\sigma_{s})\to 0$.

From and (23), the first two conditions can be satisfied for rates up to

[TABLE]

nats per channel use, but the last conditions may, a priori, limit these rates to certain SNR regimes. Fortunately, if condition $2)$ is satisfied, we automatically satisfy the condition for $\varepsilon_{\Lambda_{e}^{T}}(\sigma_{s})\to 0$, since

[TABLE]

Therefore, if $(\Lambda_{b}^{T},\Lambda_{e}^{T})$ is a sequence of nested lattices, where

$\Lambda_{b}^{T}$ is universally good for the compound channel with set $\mathcal{S}_{b}$, 2. 2.

$\Lambda_{e}^{T}$ is universally secure for the compound channel with set $\mathcal{S}_{e}$,

then nested lattice Gaussian coding achieves any secrecy rate up to

[TABLE]

The existence of such nested pairs is proved subsequently in Section V and Appendix B, which concludes the proof of Theorem 1.

In fact using a method in [40] we can further reduce the gap to approximately $n_{a}\log(e/2)$. We conjecture that this gap can be completely removed with tighter bounds for the variational distance between the discrete and continuous Gaussians. This is left as an open question.

Remark 1**.**

Theorem 1 is also a slight improvement on the main result of [11, Theormm 5] in the sense that one of the conditions on the SNR of Bob ($\rho_{b}>e$) is not needed any longer. Indeed, for the Gaussian channel, $n_{a}=1$ and the SNR condition for non-zero secrecy rates is $C_{b}>C_{e}+1$, which is equivalent to

[TABLE]

V Universally Flat Gaussians

The results in the previous section require the existence of sequences of lattices which are universally good for the wiretap channel. More specifically, we need a sequence $\Lambda_{b}^{T}$ which is universally AWGN-good and a sequence $\Lambda_{e}^{T}$ whose leakage vanishes for all channel realizations of the eavesdropper. The first condition was studied in [29], where it was shown, through a compactness argument, that random lattices are universal. In this section we deal with the second condition and prove the existence of lattices $\Lambda_{e}^{T}$ which are universally good for secrecy of the MIMO channel.

Two methods are provided to establish the main result. The first method relies solely on random lattice coding arguments and achieves secrecy capacity up to a gap of $n_{a}$ nats per channel use. The second method is based on algebraic reductions and exhibits a larger gap (by a factor of $\omega(n_{a}\log n_{a})$) to capacity, but has the appealing property of reducing the problem to the one of constructing secrecy-good lattices for the AWGN channel, making it potentially more useful in practice.

V-A Construction A

Construction A (or “mod-$p$”) lattices are certainly the simplest choice for constructing pairs of nested lattices, however generalizations based on algebraic lattices may offer greater flexibility in the code design, which could be leveraged to obtain better decoding complexity, diversity, or other parameters. Moreover, the coding scheme in Section V-C entails an extra condition on the ensemble, which can be satisfied by assuming an algebraic structure. A general “flexible” construction can be defined via “generalized reductions”. Let $\psi:\Lambda_{\text{base}}\to\mathbb{F}_{p}^{T}$ be a surjective homomorphism from a base lattice $\Lambda_{\text{base}}$ of complex dimension $N\geq T$ to the vector space $\mathbb{F}_{p}^{T}$ (also referred to as a reduction). Define the lattice $\Lambda(\mathcal{C})$ as the pre-image of a linear code $\mathcal{C}$,

[TABLE]

If $\mathcal{C}$ has length $T$ and dimension $k$, the volume of $\Lambda(\mathcal{C})$ equals to $p^{T-k}V(\Lambda_{\text{base}})$. For instance if $N=T$, $\Lambda_{\text{base}}=\mathbb{Z}[i]^{T}$ the mapping $\psi$ is the reduction modulo $p$:

[TABLE]

we recover an analogue of Loeliger’s (mod-$p$) Construction A [41]. In this case we obtain a nested lattice beween $\mathbb{Z}[i]^{T}$ and $p\mathbb{Z}[i]^{T}$. More refined “direct” constructions can be obtained by using number theory and prime ideals of $\mathbb{Z}[i]$. For instance, if $\Lambda_{\text{base}}$ is the embedding of the ring of integers of a number field and $\psi$ is the reduction modulo a prime ideal we can recover the constructions in [29]. Notice that, for this construction, if $\mathcal{C}_{1}\subset\mathcal{C}_{2}$, we obtain two nested lattices $\Lambda(\mathcal{C}_{1})\subset\Lambda(\mathcal{C}_{2})$.

It was shown in [42] that if $\{\psi\}$ is an infinite sequence of mappings, under mild conditions222More specifically, it is required that that the sequence of lattices corresponding to the kernels of $\psi$ has a non-vanishing Hermite parameter. the ensemble of lattices averaged over all linear codes $\mathcal{C}$ of same dimension $k$ satisfies the Minkowski-Hlawka theorem, namely:

[TABLE]

where $\beta=V^{1/2N}(p^{T-k}V(\Lambda))^{1/2N}$ is a constant so that all lattices have volume $V$. The result holds for any integrable function $f$ which decays sufficiently fast (in particular any function upper bounded by a constant times $1/(\left\|\mathbf{x}\right\|+1)^{2N+\delta}$ for some $\delta>0$). Clearly the Gaussian probability density function satisfies this restriction.

V-B Lattices Which Are Good for Secrecy

In what follows we will apply the generalized version of Construction A to construct a sequence of lattices $\Lambda_{e}^{T}$ which is good for secrecy, i.e., which has vanishing flatness factor for all eavesdropper channel realizations. As usual, $T$ will denote the blocklength (cf. Equation (1)), $N$ will be set to $n_{a}T$ (the complex dimension of the coding lattice) and $k<T$ is any positive integer.

Using the above Minkowski-Hlawka theorem, there exists an ensemble of lattices $\mathbb{L}$ of volume $V$ such that

[TABLE]

for any $\varepsilon>0$ . Equation (25) implies that

[TABLE]

therefore

[TABLE]

Hence as long as $\varepsilon$ is bounded and $V^{1/T}/\pi|\mathbf{\Sigma}|^{1/T}$ is bounded by a constant less than $1$, the flatness factor tends to zero exponentially in the proposed lattice coding scheme. The condition for $\varepsilon$ can be achieved, for instance, by choosing $p$ sufficiently large in Construction A.

Lemma 4** (Universally Flat Lattice Gaussians).**

Let $\mathcal{H}_{e}=\mathbf{H}_{e}\otimes\mathbf{I}$ and $\mathbf{\Sigma}_{3}^{-1}=(\mathcal{H}_{e}\mathcal{H}_{e}^{\dagger})^{-1}\sigma_{s}^{-2}+\sigma_{e}^{-2}\mathbf{I},$ as in Equation (12). For any $\gamma<\pi$, there exists a sequence of lattices $\Lambda_{e}^{T}\subset\mathbb{C}^{n_{a}T}$ with $\gamma_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})\leq\gamma$ and universally vanishing flatness factor, i.e.,

[TABLE]

Moreover, the convergence rate is exponential, i.e., for all $\mathbf{H}_{e}\in\mathcal{S}_{e}$, $\varepsilon_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})=e^{-\Omega(T)}$.

Proof.

The proof is analogous to the quantization argument for the probability of error in [29], which, in turn follows [36].

(i) Fixed $\mathbf{H}_{e}$. If $\mathbb{L}$ is a Minkowski-Hlawka ensemble with volume $V$, then

[TABLE]

which guarantees a sequence $\Lambda_{e}^{(T)}$ (at this point, possibly depending on $\mathbf{H}_{e}$) with vanishing flatness factor as long as $\gamma<\pi$.

(ii) Finite set. Let $\mathcal{S}_{Q}\subset\mathcal{S}_{e}$ be a finite subset of $\mathcal{S}_{e}$ with cardinality $Q$. We have

[TABLE]

which guarantees a sequence $\Lambda_{e}^{(T)}$ with exponentially vanishing flatness factor for any $\mathbf{H}_{e}\in\mathcal{S}_{e}$.

(iii) Quantization step. By quantizing the channel space, we can extend step (ii) into a universal code for any channel in $\mathcal{S}_{e}$. This analysis is described in Appendix A. Here we provide a sketch of the argument. Suppose $\mathcal{S}_{Q}$ is a $\delta$-covering for $\mathcal{S}_{e}$, i.e., for all $\mathbf{H}_{e}\in\mathcal{S}_{e}$, there exists $\mathbf{H}_{q}\in\mathcal{S}_{Q}$ such that $\left\|\mathbf{H}_{e}-\mathbf{H}_{q}\right\|\leq\delta$. From the compactness of $\mathcal{S}_{e}$, such a covering exists for any arbitrarily small $\delta>0$, and the size of the covering depends only on $n_{a}$, which is fixed for the whole transmission. Furthermore, the theta series is a continuous function of $\mathbf{H}_{e}$, which implies that the flatness factor in different channel realizations are also close. From this, we can choose $\delta$ independently of $T$ that guarantees that the total exponent is negative. Therefore, the flatness factor tends to zero uniformly as $T\to\infty$. ∎

The above proof does not rely on a specific realization but rather on the knowledge of the compact compound set $\mathcal{S}_{e}$. It is reminiscent of a widely used technique in coding for compound channels (e.g., [36]). Essentially, an encoder develops a code for $Q_{\delta}$ channels, where $Q_{\delta}$ is the cardinality of a good quantizer of the channel space. However the quantization $Q_{\delta}$ may increase the effective blocklength for a target information leakage. Moreover, the proof does not give us insights on how to effectively quantize $\mathcal{S}_{e}$, making algebraic approaches appealing in practice.

Lemma 4 shows the existence of universally flat Gaussians or, in other words, the existence of a sequence of lattices $\Lambda_{e}^{T}$ which are good for secrecy. Recall that in our construction IV-A, we required $\Lambda_{e}^{T}$ to be nested with $\Lambda_{b}^{T}\supset\Lambda_{e}^{T}$, where $\Lambda_{b}^{T}$ is a sequence of lattices which are good for the legitimate compound channel. The existence of $\Lambda_{b}^{T}$ was proven in [29]. In Appendix B we argue that both conditions can be achieved by a nested pair $(\Lambda_{b}^{T},\Lambda_{e}^{T})$ which is the last missing part of the proof of Theorem 1.

V-C Algebraic Approach

Following [33], we now define a lattice admitting algebraic reduction.

Definition 6** (EU Decomposition).**

We say that $\Lambda$ admits algebraic reduction if for any unit determinant matrix $\mathbf{A}\in\mathbb{C}^{n_{a}\times n_{a}}$ there exists a matrix decomposition of the form $\mathbf{A}=\mathbf{E}\mathbf{U}$, where $\mathbf{E}$ and $\mathbf{U}$ are also unit-determinant satisfying the following properties:

$\mathbf{U}\Lambda=\Lambda$, 2. 2.

$\left\|\mathbf{E}^{-1}\right\|_{F}\leq\alpha$* for some absolute constant $\alpha$ that does not depend on $\mathbf{A}$.*

The Golden Code is one example of a lattice that admits algebraic reduction [33]. Lattices built from generalized versions of Construction A based on number fields and division algebras also admit a similar reduction (if necessary we may relax requirement 1) to include equivalence instead of equality). This property was used in [29] to achieve capacity of the infinite compound MIMO channel. Note that $\alpha$ grows with $n_{a}$. See [29, Theorem 3] for an upper bound on $\alpha$ in the case of number fields, and [33] in the case of division algebras. Next, we show that an ensemble of lattices satisfying Definition 6 achieves the secrecy capacity of the compound MIMO channel up to a constant gap.

Recall the following relation between the spectral norm and the Frobenius norm:

[TABLE]

for the identity matrix $\mathbf{I}$ of any dimension.

Lemma 5**.**

Suppose that $\Lambda\subset\mathbb{C}^{n_{a}T}$ is such that its dual lattice $\Lambda^{*}$ admits algebraic reduction. Then for $\mathbf{A}\in\mathbb{C}^{n_{a}\times n_{a}}$,

[TABLE]

Proof.

From the Poisson summation formula and the expression for the flatness factor (9):

[TABLE]

Upon decomposing $\frac{\sqrt{\mathbf{A}}}{\left(\sqrt{|\mathbf{A}|}\right)^{1/n_{a}}}=\mathbf{E}\mathbf{U}$ as in Definition 6, the last equation becomes

[TABLE]

where $(a)$ is due to the bound $\left\|\bm{\lambda}\right\|\leq\left\|(\mathbf{I}\otimes\mathbf{E})^{-1}\right\|\left\|(\mathbf{I}\otimes\mathbf{E})\bm{\lambda}\right\|$ and the fact that $\left\|(\mathbf{I}\otimes\mathbf{E})^{-1}\right\|=\left\|(\mathbf{I}\otimes\mathbf{E}^{-1})\right\|=\left\|\mathbf{E}^{-1}\right\|$, $(b)$ is due to the inequality between the $2$-norm and the Frobenius norm and $(c)$ follows from Definition 6. ∎

Since

[TABLE]

where $\mathbf{\Sigma}^{-1}=\mathcal{H}_{e}^{\dagger}\mathbf{\Sigma}_{3}^{-1}\mathcal{H}_{e}$ and $\mathbf{\Sigma}_{3}^{-1}=(\mathcal{H}_{e}\mathcal{H}_{e}^{\dagger})^{-1}\sigma_{s}^{-2}+\sigma_{e}^{-2}\mathbf{I}$ is block-diagonal, we can apply the above lemma. Therefore, if we construct an ensemble of lattices such that their duals admit algebraic reduction for some constant $\alpha>0$, then there exist lattices with vanishing flatness factor $\varepsilon_{\mathcal{H}_{e}\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}_{3}})$ provided that

[TABLE]

This can be achieved if:

[TABLE]

Notice that the right-hand side of (29) depends only on the determinant of $\mathbf{\Sigma}_{3}$ or on the capacity of the eavesdropper channel, not on any individual realization. For this condition to hold, we only need a sequence of secrecy-good lattices for a surrogate eavesdropper channel with smaller noise variance (by a factor ${\alpha^{-2}}$). Therefore, by combining (23) and (29), we arrive at the the following result:

Theorem 2**.**

Let $(\Lambda_{b}^{T},\Lambda_{e}^{T})$ be a sequence of nested lattices where: (i) $\Lambda_{b}^{T}$ is universally good for the compound MIMO channel and (ii) $\Lambda_{e}^{T}$ satisfies Definition 6 and is secrecy good for the AWGN channel (Condition (28)). Then nested lattice Gaussian coding achieves any secrecy rate up to

[TABLE]

Notice that the gap has a different nature than the one in the previous subsection. It consists of two parts: $n_{a}$ due to the same restriction on the flatness factor in Theorem 1, and $\log\alpha$ due to algebraic reduction. Although we have conjectured that the gap in Theorem 1 can be essentially removed, this is not the case for $\log\alpha$ in Theorem 2. Indeed, since $\alpha$ cannot be smaller than $\sqrt{n_{a}}$ [29, Theorem 3], this gap is always larger than $n_{a}\log{n_{a}}$. However, the code construction can be reduced to the problem of finding good lattices for the Gaussian wiretap channel (with some additional algebraic structure), making the design potentially more practical.

Notice also that this strategy is closely related to the “decoupled design” for compound MIMO channels [29, Sect. VI]. Both strategies can indeed be combined, i.e., Bob’s code can also benefit from algebraic reduction. In this case both the original channel decoder and the code design can be greatly simplified, at the cost of an extra gap (i.e.,, an extra factor $2n_{a}\log(\alpha)$) to the compound capacity.

VI Discussion

In this paper, we have presented a construction of nested lattice codes to achieve the secrecy capacity of compound MIMO wiretap channels, up to a gap equal to the number of transmit antennas. Compared to [28], the construction in this work is not only more practical, but also enjoys a smaller gap. With algebraic reduction, further simplification has been made, at the cost of an extra gap to the secrecy capacity. Interestingly, the algebraic approach reaffirms the important role of the dual lattice of $\Lambda_{e}^{T}$ in wiretap channels, firstly discovered in [28].

Encoding and decoding

Encoding and decoding are not much different from those of lattice codes for compound MIMO channels in [29]. The generalized Construction A employed in this paper may be viewed as a concatenated code, where the inner code is a lattice with some desired properties, while the outer code is an error correction code. Therefore, decoding can be run successively, which greatly reduces the decoding complexity. As for encoding, the discrete Gaussian shaping can be facilitated by choosing a nice base lattice, e.g., a rotated $\mathbb{Z}^{n_{a}}$ lattice whose Gaussian shaping is easy. There are highly efficient algorithms for Gaussian shaping over specific lattices [43], but more research is needed for Gaussian shaping over generalized Construction A. Practical implementation of the proposed codes is left as future work.

Comparison to other compound models

When the channel $\mathbf{H}_{b}$ is known and the eavesdropper channel has bounded norm, [20] has shown that the eavesdropper’s worst channel is also isotropic. In this case the capacity can be achieved by decomposing the channels into different independent substreams with appropriate power, and applying independent coding for the Gaussian channel. This is also the case when $\mathbf{H}_{b}$ has a linear uncertainty. In these cases, a combination of correct power allocation and a similar argument to Lemma 4 shows that semantic secrecy is also achievable by random lattice codes. On the other hand, the algebraic approach (Theorem 2) heavily relies on the fact that the channels in $\mathcal{S}_{e}$ have the same white-input mutual information.

Finite-length performance

The results of this work are based on asymptotic analysis as $T\to\infty$. The practical performance of the proposed universal codes at finite block lengths warrants an investigation. In particular, how large $T$ is required to approach the promised gap in practice? For given $T$, how far do practical codes perform from secrecy capacity? It may be a challenging problem to design good, practical universal codes.

As a further perspective, one may consider an “outage” analysis of the MIMO wiretap channel in a finite blocklength regime, where the channel matrices $\mathbf{H}_{b}$ and $\mathbf{H}_{e}$ may be random. In other words, one may analyze the probability that the code rate $R$ exceeds the secrecy capacity. In such scenarios, we believe that lattices with the non-vanishing determinant property will be able to provide universal bounds for the outage probability. We leave it as an open problem.

Appendix A Quantization of Channel Space

In this appendix we show bounds on the flatness factor in the quantized channel space, formalizing part (iii) in the proof of Lemma 4. Instead of performing the quantization directly in the eavesdropper space $\mathcal{S}_{b}$, we will consider the corresponding covariance matrices. Following the notation of Lemma 4, we have:

[TABLE]

where $\mathbf{\Sigma}^{-1}=\mathcal{H}_{e}^{\dagger}\mathbf{\Sigma}_{3}^{-1}\mathcal{H}_{e}$ and $\mathbf{\Sigma}_{3}^{-1}=(\mathcal{H}_{e}\mathcal{H}_{e}^{\dagger})^{-1}\sigma_{s}^{-2}+\sigma_{e}^{-2}\mathbf{I}$. Let $\Omega_{e}$ be the space of co-variance matrices of the form $\mathbf{\Sigma}$, where $\mathbf{H}_{e}$ can be any matrix in the space of eavesdropper matrices $\mathcal{S}_{b}$:

[TABLE]

By using the definition of the flatness factor, we can show the following:

Lemma 6**.**

Let $\mathbf{\Sigma},\bar{\mathbf{\Sigma}}\in\Omega_{e}$ be two matrices satisfying $\left\|\mathbf{\mathbf{\Sigma}}-\overline{\mathbf{\mathbf{\Sigma}}}\right\|\leq\delta$. If $\delta$ is sufficiently small, then $\overline{\mathbf{\Sigma}}-\delta\mathbf{I}$ is positive-definite and

[TABLE]

Proof.

For any $\bm{\lambda}\in\mathbb{C}^{n_{a}T}$ we have $|\bm{\lambda}^{\dagger}(\mathbf{\Sigma}-\overline{\mathbf{\Sigma}})\bm{\lambda}|\leq\left\|\bm{\lambda}\right\|^{2}\delta.$ Therefore

[TABLE]

∎

Suppose now that $\mathcal{S}_{\delta}$ is a $\delta$-quantizer for $\Omega_{e}$ with cardinality $Q_{\delta}$, i.e., for all $\mathbf{\Sigma}$ there exists $\overline{\mathbf{\Sigma}}\in\mathcal{S}_{\delta}$ such that $\left\|\mathbf{\mathbf{\Sigma}}-\overline{\mathbf{\mathbf{\Sigma}}}\right\|\leq\delta$. For any $\mathbf{\Sigma}$ we have:

[TABLE]

where

[TABLE]

The last upper bound is universal, in the sense that it does not depend on the specific realization $\mathbf{H}_{e}$. Note that if the VNR condition is satisfied, namely $\gamma_{\Lambda_{e}^{T}}(\sqrt{{\mathbf{\Sigma}}})<\pi$, then the term $(\gamma_{\Lambda_{e}^{T}}(\sqrt{{\mathbf{\Sigma}}})/\pi)^{n_{a}T}$ decays exponentially in $T$ with exponent given by

[TABLE]

From this, we obtain the bound

[TABLE]

which holds for any $\mathbf{\Sigma}\in\Omega_{e}$. We can therefore choose a small $\delta$ (independently of $T$) such that the total exponent is negative. Since $Q_{\delta}$ does not depend on $T$, and $\varepsilon_{T}$ can be made arbitrarily small, we obtain an exponential decay of the flatness factor.

Appendix B Simultaneous Goodness

From Section V, the construction of universally secure codes boils down to finding a sequence of pairs of nested lattices $\Lambda_{b}^{T}\subset\Lambda_{e}^{T}$ such that

• •

$\Lambda_{b}^{T}$ has vanishing probability of error: $\mathbb{P}_{\Lambda_{b}}(\mathbf{R}_{b})\triangleq\mathbb{P}(\tilde{\mathbf{W}}_{b,\text{eff}}\notin\mathcal{V}(\mathbf{R}_{b}\Lambda_{b}^{T}))\to 0$ as $T\to\infty$;

• •

$\Lambda_{e}^{T}$ has vanishing flatness factor: $\varepsilon_{\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}})\to 0$ as $T\to\infty$,

where we recall that $\tilde{\mathbf{W}}_{b,\text{eff}}$ is the effective noise, sub-Gaussian with co-variance matrix $\sigma_{b}^{2}\mathbf{I}$, $\mathbf{R}_{b}^{\dagger}\mathbf{R}_{b}=\mathbf{H}_{b}^{\dagger}\mathbf{H}_{b}+\rho_{b}^{-1}\mathbf{I}$, and

[TABLE]

First suppose that $\mathbf{R}_{b}$ and $\mathbf{\Sigma}$ are fixed. Let $\Lambda_{b}^{T}=\Lambda(\mathcal{C}_{b})$ be obtained by choosing $\mathcal{C}_{b}$ uniformly in the set of all codes with parameters $(T,k_{b},p)$. Let $\Lambda_{e}^{T}=\Lambda(\mathcal{C}_{e})$ be obtained by expurgating $k_{b}-k_{e}$ columns from $\mathcal{C}_{b}$. With this process $\mathcal{C}_{e}$ will be also chosen uniformly from all $(T,k_{e},p)$ codes. We have:

[TABLE]

Convergence of both terms in the last equation is guaranteed to be exponentially fast. Indeed:

• •

The term $\mathbb{E}_{\mathcal{C}_{b}}[\mathbb{P}_{\Lambda_{b}^{T}}(\mathbf{R}_{b})]$ tends to zero exponentially provided that $\gamma_{\mathbf{R}_{b}}(\Lambda_{b})>\pi e$, due to AWGN-goodness of $\Lambda_{b}^{T}$.

• •

The term $\mathbb{E}_{\mathcal{C}_{e}}[\varepsilon_{\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}})]$ tends to zero exponentially provided that $\gamma_{\Lambda_{e}^{T}}(\sqrt{\mathbf{\Sigma}})\to 0$, due to Appendix A, Equation (30).

Furthermore, by considering the quantized channel spaces, similarly to Appendix A, we conclude that the convergence is universal. Therefore, there exists a pair of lattices ${\Lambda_{b}^{T},\Lambda_{e}^{T}}$ where $\Lambda_{b}^{T}$ is universally AWGN-good and $\Lambda_{e}^{T}$ is universally secrecy-good, and Theorem 1 follows.

Remark 2**.**

Although the above argument only demonstrates the existence of a pair of good lattices, it is possible to show a concentration result on the performance of the ensemble of nested lattices. Suppose some exponential bound $e^{-cT}$ on (31) for some $c>0$. Then, using Markov’s inequality, we have that for the ensemble of nested lattices considered,

[TABLE]

That is, with probability higher than $1-e^{-c^{\prime}T}$ over the choice of $\mathcal{C}_{b}$, (31) stays below $e^{-(c-c^{\prime})T}$. In other words, most of these nested lattices have a performance concentrating around $e^{-cT}$.

Acknowledgment

The authors would like to thank Laura Luzzi and Roope Vehkalahti for helpful discussions.