Secrecy Transmission Scheme Based on 2D Polar ... - IEEE Xplore

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/LCOMM.2018.2810888, IEEE Communications Letters 1

Secrecy Transmission Scheme Based on 2D Polar Coding over Block Fading Wiretap Channels Wentao Hao, Liuguo Yin, Member, IEEE, and Qin Huang, Senior Member, IEEE

Abstract—This letter discusses a secrecy transmission scheme based on two dimensional (2D) polar coding over block fading wiretap channels. Unlike the previous approaches using one dimensional (1D) polar coding, we propose to encode the secret bits in two dimensions to adapt to variation of the instantaneous secrecy capacity. In the proposed scheme, intra-block coding in one dimension is used to guarantee reliability, and cross-block coding in the other dimension is used to combat eavesdropping. Theoretical analysis demonstrates that our scheme is able to achieve the maximum perfect secrecy rate asymptotically. Simulation results show that the equivocation rate of eavesdropper is close to the secrecy capacity of the system with finite codelength. Index Terms—Physical-layer security, polar coding, block fading channel, wiretap channel.

I. I NTRODUCTION IFFERENT from traditional cryptographic algorithms, physical-layer security is based on information theory rather than computational complexity. Shannon [1] first studied the secure communication from an information theoretic perspective. Later, Wyner [2] presented the degraded wiretap channel model and defined secrecy capacity as the supremum of all the achievable secure and reliable transmission rates. Wyner’s original work was then generalized to Gaussian channels [3] and fading channels [4]. Based on these previous works, capacity achieving codes were used to approach the secrecy capacity of wiretap channels. Polar codes are proved to be capacity achieving [5]. Recently, the authors in [6], [7] have shown that polar codes can achieve the secrecy capacity of binary input symmetric discrete memoryless channels. For relay-eavesdropper channels, reference [8] proved that polar codes can achieve the maximum perfect secrecy rate under the decode-and-forward strategy. For block fading wiretap channels, the authors in [9] proposed a hierarchical polar coding scheme under the assumption that the wiretap channel is degraded compared to the main channel in every block. It can achieve the secrecy capacity without any instantaneous channel state information (CSI). The above schemes [6]–[8] use 1D polar coding to guarantee reliability and security simultaneously. In block fading wiretap

D

This work was supported by the National Basic Research Project of China (973) (2013CB329006), and the National Natural Science Foundation of China (NSFC, 91538203). W. Hao is with the School of Aerospace, Tsinghua University, Beijing 100084, China. L. Yin is with the School of Information Science and Technology, Tsinghua University, Beijing 100084, China (E-mail: [email protected]). Q. Huang is with the School of Electronic and Information Engineering, Beihang University, Beijing 100191, China.

channels, the wiretap channel sometime is better than the main channel. Under this case, it is impossible to construct secrecy information bits set for 1D polar coding. In the hierarchical coding scheme [9], another layer of polar codes are constructed over the bit-channels with the same indices during different blocks no matter these bit-channels are good or bad. And the codeword rate at each block is constant. Secrecy capacities in some blocks cannot be fully utilized during the transmission in this case. Thus, there is still a gap between the achievable secrecy rate and the ergodic secrecy capacity. This letter proposes to encode the secret bits in two dimensions instead of one over the block fading wiretap channel. The intra-block coding in one dimension guarantees the reliability of data transmission, while the cross-block coding in the other dimension keeps the secrecy. In the intra-block coding, for each possible state of the main channel, we obtain N polarized bit-channels by polarizing the N copies of the main channel. Consider that Bob’s polarized bit-channels with different indices have different possibilities to be eavesdropped by Eve. Then, in the cross-block coding, we further polarize the polarized bit-channels during intra-block coding that are good for Bob with the same indices between B different blocks. After the polarization in two dimensions, we assign secret bits to the bit-channels that are good for Bob but bad for Eve, random bits to the bit-channels that are good for Bob and Eve, and frozen bits to the bit-channels that are bad for Bob and Eve, respectively. Finally, this codeword consists of B intra-block sub-codewords and will be transmitted in B blocks. During each block, we send the intra-block subcodeword whose rate matches with the instantaneous CSI of the main channel. Theoretical analysis shows that our scheme can achieve the maximum perfect secrecy rate asymptotically. Monte-Carlo simulations show that the equivocation rate of eavesdropper is higher than that with 1D polar coding and approaches the secrecy capacity of the system with finite codelength. II. S YSTEM M ODEL In our considered model, a transmitter (Alice) wants to send a secret message M to a legitimate receiver (Bob) through the main channel, but her transmission is also perceived by an eavesdropper (Eve) through the wiretap channel. Both channels are block fading binary symmetric channels (BSCs) or block fading binary erasure channels (BECs) with S states {si |i = P 1, ..., S}. With probability pi , the main channel state is S si , and i=1 pi = 1. With probability qi , the wiretap channel PS state is si , and i=1 qi = 1. Without loss of generality,

1089-7798 (c) 2018 IEEE. Translations and content mining are permitted for academic research only. Personal use is also permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.


we assume C(si ) > C(si+1 ), where C(si ) denotes the capacity of the channel with state si . We assume that Alice knows the statistical CSI of the main channel and the wiretap channel. As shown in [10], it is reasonable in the case that the eavesdropper is active. During the transmission, Alice also knows the instantaneous CSI of the main channel. Following a similar derivation as that of the ergodic secrecy capacity of Gaussian fading wiretap channel in [4], we can derive the ergodic secrecy capacity of block fading wiretap channel with S states by calculating the expectation of the instantaneous secrecy capacity: S S X X {pi qj [C(si ) − C(sj )]+ }. (1) Cs = i=1 j=1

In order to keep M as secret as possible, Alice encodes the length-K message M into a length-N B codeword X, where N is the length of a block and B is the number of blocks. The corresponding received codewords by Bob and Eve are denoted by Y and Z, respectively. Bob and Eve try to recover ˆ. M . The corresponding estimation at Bob is denoted by M The reliability and security of the transmission are guaranteed if condition (2) and (3) can be satisfied, respectively [6]: ˆ = 0, lim Pr{M 6= M} (2) N,B→∞ I(M; Z) lim = 0. (3) K→∞ K III. S ECRECY T RANSMISSION U SING 2D P OLAR C ODING In this section, the construction of 2D polar codes is proposed. A. Encoding process of the proposed scheme For the block fading channel with S states, we can divide the indices of polarized bit-channels into S + 1 sets: MS ,..., M0 . The reconstructed channels with indices in set M0 always polarize to bad ones, i.e., their symmetric channel capacities approach to 0 as the block length increase no matter what the channel state is [5]. The reconstructed channels with indices in set Mi , i = 1, ..., S, will polarize to good ones if the channel state is si or better than si . The cardinalities of these sets are [11]:   N [1 − C(s1 )], i = 0, N [C(si ) − C(si+1 )], 1 ≤ i ≤ S − 1, (4) |Mi | =  N C(sS ), i = S.

For each block, if the polarized bit-channels with indices in Mi are good for Bob, PSthe possibility that these bit-channels are bad for Eve is j=i+1 qj . In the case that Eve knows the instantaneous CSI of the main channel and the wiretap channel, the indices of bit-channels that are good for Bob but bad for her can be identified. Eve can’t get any information about the bits that are transmitted over bit-channels that are good for Bob but bad for her. Therefore, similar to [9], we can model Bob’s good polarized bit-channels with indices PS in Mi as BECs for Eve with erasure probability εE = i j=i+1 qj . In order to provide Bob with an advantage over Eve, we construct cross-block sub-codewords only over those polarized bit-channels that are good for Bob. The procedure of the 2D polar coding scheme is seen in Fig.1 for the case of S = 3. The cross-block encoding is done first and then the intra-block encoding is performed.

Fig. 1.

Encoding process for block fading channel with 3 states.

1) The cross-block encoding: In this stage, the cross-block encoding is done based on the statistical CSI of the main channel and the wiretap channel. The possibility that bitPthe i channels with indices in Mi are good for Bob is j=1 pj . For the cross-block sub-codeword that is constructed over Bob’s good polarized bit-channelsP with the same index in Mi , its codeword length is Li = B ij=1 pj . There are totally PS−1 i=1 |Mi | cross-block sub-codewords. We denote uki as the k-th message in secret message set Si , 1 ≤ i ≤ S − 1, 1 ≤ k ≤ |Mi |. For each uki , a cross-block sub-codeword with length Li will be generated. For identifying the good bit-channel indices set Ai and the bad bit-channel indices set Aci , we use the method proposed by Arikan [5] to calculate the Bhattacharyya parameter of every bit-channel. Their cardinalities are [5]: |Ai | = Li [1 − εE |Aci | = Li εE (5) i ], i . k We set the length of ui equal to |Aci |, and combine it with a random vector rik of length |Ai | to get a new vector µki = φ([ rik | uki ]), where φ is the permutation operation. Finally, e ki can be generated: the cross-block sub-codeword u k k e i = µi × G L i . u (6) where GLi is the polar generator matrix with size Li . The e ki is εE code rate of u i . 2) The intra-block encoding: In this stage, the intra-block encoding is done based on the instantaneous CSI of the main channel. There are totally B intra-block sub-codewords of length-N . When the main channel state is si , we will select one coded bit from the cross-block sub-codewords |M | |M | e 1S−1 , ..., u e S−1S−1 respectively to transmit e 1i , ..., u e i i , ..., u u through the bit-channels with indices in Mi , ..., MS−1 . The coded bit vector assigned to the bit-channels with indices in |M | e ki (ti ) is the e i i (ti )], where u e ki (ti ), ..., u Mi is [e u1i (ti ), ..., u k e i , and ti is a variable that is set to 1 initially and ti -th bit of u increased by 1 every time the vector is transmitted, 1 ≤ ti ≤ Li . We denote vit as the t-th coded bit vector that are assigned to the bit-channels with indices in Mi , ..., MS−1 , vit = |M | |M | e 1S−1 (tS−1 ), ..., u eS−1S−1 (tS−1 )]. e i i (ti ), ..., u [e u1i (ti ), ..., u t In the process of encoding, we combine vi with a rant dom a zero vector of length Pi−1vector ri of length |MS | and t |M | to get a new vector w = φ([ rit | vit | 0]). Finally, j i j=0 t the intra-block sub-codeword xi can be generated: xti = wit × GN . (7) where GN is theP polar generator matrix with size N . The code rate of xti is N1 S−1 j=i |Mj |.



B. Decoding process of the proposed scheme

where µ ˆ ki (j) is the j-th bit of µ ˆ ki , and WLj i is the j-th polarized E ˆ ki bit-channel for BEC(εi ). Finally, the receiver can obtain u k k k ˆ i ]). by µ ˆ i = φ([ rî | u AND

C OMPLEXITY A NALYSIS

PS−1 c For a length-N B codeword, there are i=1 |Mi ||Ai | secret bits. Therefore, the rate of the proposed scheme is: S−1 1 X Rs = |Mi ||Aci | (10) N B i=1 {[C(si ) − C(si+1 )][

i=1

=

S X S X

i X j=1

pj ][

S X

qj ]}

(11)

j=i+1

{pi qj [C(si ) − C(sj )]+ }.

B. Security analysis In order to show the security of our proposed scheme, we analyze the decoding performance of Eve. We show that Eve can recover all random bits successfully in the condition that all secret bits are known. Similar to Bob, the decoding process of Eve can be divided into two stages and all random bits can be decoded by Eve with a high probability: S−1 X β ˆ ≤ B2−N β + |Mi |2−Li , (14) Pr{R 6= R} i=1

where R is the collection of random variables representing for ˆ is the estimate. random bits and R ˆ is Then, according to Fano’s inequality and (14), H(R|R) upper bounded by: ˆ ≤ H(Pr{R 6= R}) ˆ + |R|Pr{R ˆ ˆ H(R|R) 6= R} (15) β

≤ H(B2−N +

S−1 X

β

|Mi |2−Li )

i=1

S−1 X

β

|Mi ||Ai | + B|MS |][B2−N +

(12)

i=1 j=1

The achievable secrecy rate of our scheme is equal to the ergodic secrecy capacity of the block fading wiretap channel. In [9], the authors have showed that there is a gap between the achievable secrecy rate and the ergodic secrecy capacity with the hierarchical polar coding scheme. Therefore, our scheme achieves a higher secrecy rate. In the intra-block decoding, we decode B intra-block subcodewords of length-N . The error probability of recovering vit P β j ) ≤ 2−N . In the cross-block is Pe (vit ) ≤ j∈Ii ∪MS Z(WN,i decoding, we decode |Mi | cross-block sub-codewords of length-Li. The error probability of recovering uki is Pe (uki ) ≤

S−1 X

β

|Mi |2−Li ].

i=1

i=1

A. Achievable rate and reliability analysis

S−1 X

i=1

As N and B go to infinity, the right-side of Equation (13) tends to 0. It indicates that the proposed scheme can achieve the reliable condition (2).

+[

In this section, we firstly derive the achievable rate of the 2D polar coding. Then, we show that our scheme achieves the secrecy capacity of the block fading wiretap channel. Finally, we analyze the complexity and the latency of the proposed scheme.

=

β

Z(WLj i ) ≤ 2−Li . Based on the union bound, the total decoding error probability is upper bounded by: S−1 X β ˆ } ≤ B2−N β + (13) |Mi |2−Li . Pr{M 6= M j∈Ai ∪Aci

After B blocks, all intra-block sub-codewords are received by Bob. We denote the output of the main channel as yit . The decoding process can be divided into two stages. 1) The intra-block decoding: In this stage, Bob adopts the Successive Cancelation (SC) decoding algorithm [5] to obtain ˆ jt : estimates w ( S ˆ it (1:j−1)|1) W j (yit ,w 1, if i ∈ Ii MS , and WN,i ≥ 1, t i (y t ,w t ˆ i (j) = w i ˆ i (1:j−1)|0) N,i 0, otherwise. (8) S S ˆ it (j) is the j-th bit of w ˆ it where Ii = Mi ... MS−1 , w j and WN,i is the j-th polarized bit-channel for the channel ˆ it = with state si . Then, the receiver can obtain vît by w t t t φ([ rî | vî | 0]). When Bob gets all vî , he can get all estimate ê k based on their relations. u i 2) The cross-block decoding: In this stage, Bob also adopts the SC algorithm to obtain estimate µ ˆ ki :  k ˆ e i ,µ W j (u ˆk  i (1:j−1)|1) 1, if Lj i ˆ k k ≥ 1, k µ ˆ i (j) = e i ,µ (9) ˆ i (1:j−1)|0) WL (u i  0, otherwise.

IV. P ERFORMANCE

P

(16)

When the main channel state is si , there are totally Bpi intra-block sub-codewords to be transmitted. If Eve’s channel state sj is better than si , the mutual information between the intra-block sub-codeword and Eve’s received sub-codeword in a block is upper bounded by N C(si ). If Eve’s channel state sj is worse than si , this mutual information is upper bounded by N C(sj ). Therefore, we have: S i−1 X X qj C(sj )], (17) qj C(si ) + I(Cit , Cie ) ≤ N Bpi [ j=i

j=1

where Cit is the collection of intra-block sub-codewords and Cie is the collection of Eve’s received codewords. Consequently, the mutual information between M , R and Z is upper bounded by: S i−1 S X X X qj C(sj )]}. qj C(si ) + {N Bpi [ I(M, R; Z) ≤ i=1

j=i

j=1

(18)

The entropy of R can be calculated as follows: S−1 X |Mi ||Ai | + B|MS | H(R) = = N B{

i=1 S−1 X

[C(si ) − C(si+1 )][

i=1

i X j=1

pj ][

i X

(19)

qj ] + C(sS )}.

j=1

(20)

It is easy to verify that the right-side of (20) is equal to the right-side of (18), which means I(M, R; Z) ≤ H(R). Based



on this, the mutual information between M and Z is provided:

0.06

(21)

= I(M, R; Z) − H(R) + H(R|Z, M )

(22)

≤ H(R|Z, M ) ˆ ≤ H(R|R).

(23) (24)

where (22) is due to the independence of M and R, (23) holds ˆ is a because I(M, R; Z) ≤ H(R), and (24) holds because R function of Z and M . Finally, combining with (16), we have: I(M; Z) = 0. (25) lim N,B→∞ NB Along with the obvious fact that K = Ω(N B), the secrecy condition (3) is guaranteed. Hence, the proposed scheme achieves the maximum perfect secrecy rate asymptotically. C. Complexity and decoding latency analysis In our scheme, we use B polar codes of length-N in one dimension and |Mi | polar codes of length-Li in the other dimension. The encoding and decoding complexity of polar codes of length N is O(N logN ) [5]. Consequently, the overall complexity for the encoding and decoding can be calculated as: S−1 X |Mi |O(Li logLi ) = O(N BlogN B). BO(N logN ) + i=1

(26) The above complexity is independent to the value of S. Hence, the proposed scheme inherits the low encoding and decoding complexity of polar codes. For the conventional SC decoder, the latency of decoding a polar code of length N is 2(N − 1). Consequently, the overall latency of the decoding can be calculated as: S−1 X 2|Mi |(Li − 1) + B2(N − 1). (27) i=1

In the case where S is moderate, the latency of our scheme can be tolerable. In particular, our proposed scheme is suitable for these communication systems that tolerate latency, e.g. satellite communication systems and broadcasting systems. V. S IMULATION R ESULTS

In this section, we simulate Eve’s equivocation rate by Monte-Carlo simulation. We assume that both the main channel and the wiretap channel are fading BECs with 2 states. The corresponding erasure probabilities are e1 = 0.25 with q1 = q and e2 = 0.5 with q2 = 1 − q, respectively. The secrecy capacity of the system is Cs = q(1 − q)(e2 − e1 ). For 1D polar coding scheme, similar to [6], we choose N = 1024. When the main channel state is e2 , no codeword will be transmitted because eavesdropper’s channel is better than the main channel. When the main channel state is e1 , secrecy codeword will be constructed and transmitted. To make the transmission rate Rs be equal to Cs , the size of secret bitchannels set is fixed to (Cs )/q1 = (1 − q)(e2 − e1 ) instead of (e2 − e1 ). The equivocation rates are calculated using the methods in [6]. For 2D polar coding scheme, we choose N = 1024, B = 1024/q or 128/q. To simplify the calculation of Eve’s equivocation rate, we assume she can recover all intra-block sub-codewords successfully when her channel is

0.05

rate

I(M ; Z) = I(M, R; Z) − [H(R|M ) − H(R|Z, M )]

0.07

0.04

0.03

0.02 Secrecy Capacity 2D polar coding with B=1024/q 2D polar coding with B=128/q 1D polar coding

0.01

0 0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

q

Fig. 2. The secrecy capacity of the system versus q and the equivocation rate at Eve for Rs = Cs .

better than Bob’s channel. In this case, the calculation method is the same as that in [6]. As shown in Fig. 2, the equivocation rate at Eve with our scheme is higher than that with 1D polar coding. It means Eve’s uncertainty about the secret message with our scheme is greater. Moreover, Eve’s equivocation rate is close to the secrecy capacity of the system. It means there is little secrecy information leakage. VI. C ONCLUSION This letter considers the secure and reliable communication over the block fading wiretap channel with multiple states. In order to combat the message leakage in some blocks, a practical secrecy transmission scheme based on 2D polar coding is proposed. The analysis validates that the proposed scheme can achieve the maximum perfect secrecy rate while enjoying low encoding and decoding complexities. Simulation results show that Eve’s equivocation rate is close to the secrecy capacity of the system with finite codelength. It is interesting to extend our scheme to other scenarios, such as the relayeavesdropper channel model [8]. R EFERENCES [1] C. E. Shannon, “Communication theory of secrecy systems,” Bell Syst. Tech. J., vol. 28, no. 4, pp. 656–715, Oct, 1949. [2] A. D. Wyner, “The wire-tap channel,” Bell Syst. Tech. J., vol. 54, no. 8, pp. 1355–1387, Oct. 1975. [3] S. Leung-Yan-Cheong, “On a special class of wiretap channels,” IEEE Trans. Inf. Theory, vol. 23, no. 5, pp. 625–627, Sep. 1977. [4] P. K. Gopala, L. Lai, and H. El Gamal, “On the secrecy capacity of fading channels,” IEEE Trans. Inf. Theory, vol. 54, no. 10, pp. 4687– 4698, Oct. 2008. [5] E. Arikan, “Channel polarization: A method for constructing capacityachieving codes for symmetric binary-input memoryless channels,” IEEE Trans. Inf. Theory, vol. 55, no. 7, pp. 3051–3073, Jul. 2009. [6] M. Andersson, V. Rathi, R. Thobaben, J. Kliewer, and M. Skoglund, “Nested polar codes for wiretap and relay channels,” IEEE Commun. Lett., vol. 14, no. 8, pp. 752–754, Aug. 2010. [7] H. Mahdavifar and A. Vardy, “Achieving the secrecy capacity of wiretap channels using polar codes,” IEEE Trans. Inf. Theory, vol. 57, no. 10, pp. 6428–6443, Oct, 2011. [8] B. Duo, P. Wang, Y. Li, and B. Vucetic, “Secure transmission for relayeavesdropper channels using polar coding,” in proc. IEEE ICC, Jun. 2014, pp. 2197–2202. [9] H. Si, O. O. Koyluoglu, and S. Vishwanath, “Hierarchical polar coding for achieving secrecy over fading wiretap channels without any instantaneous csi,” IEEE Trans. Commun., vol. 64, no. 9, pp. 3609–3623, Sep. 2016. [10] Y. Wu, R. Schober, D. W. K. Ng, C. Xiao, and G. Caire, “Secure massive mimo transmission with an active eavesdropper,” IEEE Trans. Inf. Theory, vol. 62, no. 7, pp. 3880–3900, Jul. 2016. [11] H. Si, O. O. Koyluoglu, and S. Vishwanath, “Polar coding for fading channels: Binary and exponential channel cases,” IEEE Trans. Commun., vol. 62, no. 8, pp. 2638–2650, Aug. 2014.
