Wiretap Channel in the Presence of Action-Dependent States and Noiseless Feedback

Abstract

We investigate the wiretap channel in the presence of action-dependent states and noiseless feedback. Given the message to be communicated, the transmitter chooses an action sequence that affects the formation of the channel states and then generates the channel input sequence based on the state sequence, the message, and the noiseless feedback, where the noiseless feedback is from the output of the main channel to the channel encoder. The main channel and the wiretap channel are two discrete memoryless channels (DMCs), and they are connected with the legitimate receiver and the wiretapper, respectively. The transition probability distribution of the main channel depends on the channel state. Measuring wiretapper’s uncertainty about the message by equivocation, the capacity equivocation regions are provided both for the case where the channel inputs are allowed to depend noncausally on the state sequence and the case where they are restricted to causal dependence. Furthermore, the secrecy capacities for both cases are formulated, which provide the best transmission rate with perfect secrecy. The result is further explained via a binary example.

1. Introduction

Equivocation was first introduced into channel coding by Wyner in his study of wiretap channel [1], see Figure 1. It is a kind of degraded broadcast channels. The object is to transmit messages to the legitimate receiver, while keeping the wiretapper as ignorant of the messages as possible.

Figure 1 

Wiretap channel.

After the publication of Wyner’s work, Csiszár and Körner [2] investigated a more general situation: the broadcast channels with confidential messages, see Figure 2. The model of [2] is to transmit confidential messages to receiver 1 at rate 𝑅₁ and common messages to both receivers at rate 𝑅₀, while keeping receiver 2 as ignorant of the confidential messages as possible. Measuring ignorance by equivocation, a single-letter characterization of all the achievable triples (𝑅₁,𝑅_𝑒,𝑅₀) was provided in [2], where 𝑅_𝑒 is the second receiver’s equivocation to the confidential messages. Note that the model of [2] is also a generalization of [3], where no confidentiality condition is imposed. In addition, Merhav [4] studied a specified wiretap channel and obtained the capacity region, where both the legitimate receiver and the wiretapper have access to some leaked symbols from the source, but the channels for the wiretapper are more noisy than the legitimate receiver, which shares a secret key with the encoder.

Figure 2 

Broadcast channels with confidential messages.

In communication systems there is often a feedback link from the receiver to the transmitter, for example, the two-way channels for telephone connections. It is well known that feedback does not increase the capacity of discrete memoryless channel (DMC). However, does the feedback increase the capacity region of the wiretap channel? In order to solve this problem, Ahlswede and Cai studied the general wiretap channel (the wiretap channel does not need to be degraded) with noiseless feedback from the legitimate receiver to the channel encoder [5] (see Figure 3), and both upper and lower bounds of the secrecy capacity were provided. Specifically, for the degraded case, they showed that the secrecy capacity is larger than that of Wyner’s wiretap channel (without feedback). In the achievability proof, Ahlswede and Cai [5] used the noiseless feedback as a secret key shared by the transmitter and the legitimate receiver, while the wiretapper had no additional knowledge about the key except his own received symbols. Based on the work of [5], Dai et al. [6] studied a special case of the general wiretap channel with noiseless feedback and found that the noiseless feedback enhances the secrecy capacity of the nondegraded wiretap channel. Besides Ahlswede and Cai’s work, the wiretap channel with noisy feedback was studied in [7], and the wiretap channel with secure rate-limited feedback was studied in [8], and both of them focused on bounds of the secrecy capacity. Since the feedback in the model of wiretap channel is often used as a shared secret key, the techniques used in the secret sharing scheme play an important role in the construction of the practical secure communication systems, see [9–11].

Figure 3 

The general wiretap channel with noiseless feedback.

Communication through state-dependent channels, with states known at the transmitter, was first investigated by Shannon [12] in 1958. In [12], the capacity of the discrete memoryless channel with causal (past and current) channel state information at the encoder was totally determined. After that, in order to solve the problem of coding for a computer memory with defective cells, Kuznecov and Cybakov [13] considered a channel in the presence of noncausal channel state information at the transmitter. They provided some coding techniques without the determination of the capacity. The capacity was found in 1980 by Gel’efand and Pinsker [14]. Furthermore, Costa [15] investigated a power-constrained additive noise channel, where part of the noise is known at the transmitter as side information. This channel is also called dirty paper channel. The assumption in these seminar papers, as well as in the work on communication with state-dependent channels that followed, is that the channel states are generated by nature and cannot be affected or controlled by the communication system.

In 2010, Weissman [16] revisited the above problem setting for the case where the transmitter can take actions that affect the formation of the states, see Figure 4. Specifically, Weissman considered a communication system where encoding is in two parts: given the message, an action sequence is created. The actions affect the formation of the channel states, which are accessible to the transmitter when producing the channel input sequence. The capacity of this model is totally determined both for the case where the channel inputs are allowed to depend noncausally on the state sequence and the case where they are restricted to causal dependence. Meanwhile, Weissman [16] found that the feedback from the channel output to the channel encoder cannot increase the channel capacity. This framework captures various new channel coding scenarios that may arise naturally in recording for magnetic storage devices or coding for computer memories with defects.

Figure 4 

Channel with action-dependent states.

Inspired by the above works, Mitrpant et al. [17] studied the transmission of confidential messages through the channels with channel state information (CSI). In [17], an inner bound on the capacity-equivocation region was provided for the Gaussian wiretap channel with CSI. Furthermore, Chen and Vinck [18] investigated the discrete memoryless wiretap channel with noncausal CSI (see Figure 5) and also provided an inner bound on the capacity-equivocation region. Note that the coding scheme of [18] is a combination of those in [1, 14]. Based on the work of [18], Dai and Luo [19] provided an outer bound on the wiretap channel with noncausal CSI and determined the capacity-equivocation region for the memoryless case.

Figure 5 

Wiretap channel with noncausal channel state information.

In this paper, we study the wiretap channel in the presence of action-dependent states and noiseless feedback, see Figure 6. This work is inspired by the wiretap channel with CSI [18], the channel with action-dependent CSI [16], and the wiretap channel with noiseless feedback [5]. The motivation of this work is to investigate the transmission of confidential messages through the channel with action-dependent CSI and noiseless feedback.

Figure 6 

Wiretap channel with action-dependent channel state information and noiseless feedback.

More concretely, in Figure 6, the transmitted message 𝑊 is encoded as an action sequence 𝐴^𝑁, and 𝐴^𝑁 is the input of a discrete memoryless channel (DMC). The output of this DMC is the channel state sequence 𝑆^𝑁. The main channel is a DMC with inputs 𝑋^𝑁 and 𝑆^𝑁 and output 𝑌^𝑁. The wiretap channel is also a DMC with input 𝑌^𝑁 and output 𝑍^𝑁. Moreover, there exists a noiseless feedback from the output of the main channel to the channel encoder; that is, the inputs of the channel encoder are the transmitted message 𝑊, the state sequence 𝑆^𝑁, and the noiseless feedback, while the output is 𝑋^𝑁. Since the action-dependent state captures various new coding scenarios for channels with a rewrite option that may arise naturally in storage for computer memories with defects or in magnetic recording, it is natural to ask the following two questions.(i)How about the security of these channel models in the presence of a wiretapper?(ii)What can the noiseless feedback do in the model of wiretap channel with action-dependent CSI?

Measuring wiretapper’s uncertainty about the transmitted message by equivocation, the capacity-equivocation regions of the model of Figure 6 are provided both for the case where the channel input is allowed to depend noncausally on the state sequence and the case where it is restricted to causal dependence.

The contribution of this paper is as follows.(i)Compared with the existing model of wiretap channel with side information [18] (see Figure 5), the channel state information in [18] is a special case of that in our new model; that is, the model of [18] is included in the model of Figure 6. Therefore, our result generalizes the result of [18].(ii)Our new model also extends the model of Figure 4 by considering an additional secrecy constraint, and therefore our result also generalizes the result of [16].

In this paper, random variab1es, sample values, and alphabets are denoted by capital letters, lowercase, letters and calligraphic letters, respectively. A similar convention is applied to the random vectors and their sample values. For example, 𝑈^𝑁 denotes a random 𝑁-vector (𝑈₁,…,𝑈_𝑁), and 𝑢^𝑁=(𝑢₁,…,𝑢_𝑁) is a specific vector value in 𝒰^𝑁, that is the, 𝑁th Cartesian power of 𝒰. 𝑈^𝑁_𝑖 denotes a random 𝑁−𝑖+1-vector (𝑈_𝑖,…,𝑈_𝑁), and 𝑢^𝑁_𝑖=(𝑢_𝑖,…,𝑢_𝑁) is a specific vector value in 𝒰^𝑁_𝑖. Let 𝑝_𝑉(𝑣) denote the probability mass function Pr{𝑉=𝑣}. Throughout the paper, the logarithmic function is taken to the base 2.

The remainder of this paper is organized as follows. In Section 2, we present the basic definitions and the main result on the capacity-equivocation region of wiretap channel with action-dependent channel state information and noiseless feedback. In Section 3, we provide a binary example of the model of Figure 6. Final conclusions are presented in Section 4.

2. Notations, Definitions, and the Main Results

In this section, the model of Figure 6 is considered into two parts. The model of Figure 6 with noncausal channel state information is described in Section 2.1, and the causal case is described in Section 2.2, see the following.

2.1. The Model of Figure 6 with Noncausal Channel State Information

In this section, a description of the wiretap channel with noncausal action-dependent channel state information is given by Definition 1 to Definition 5. The capacity-equivocation region 𝒞^𝑛 composed of all achievable (𝑅,𝑅_𝑒) pairs is given in Theorem 6, where the achievable (𝑅,𝑅_𝑒) pair is defined in Definition 5.

Definition 1 (action encoder). The message 𝑊 takes values in 𝒲, and it is uniformly distributed over its range. The action encoder is a deterministic mapping: 𝑓^𝑁₁∶𝒲→𝒜^𝑁. (1) The input of the action encoder is 𝑊, while the output is 𝐴^𝑁.

The channel state sequence 𝑆^𝑁 is generated by a DMC with input 𝐴^𝑁 and output 𝑆^𝑁. The transition probability distribution is given by 𝑝_{𝑆𝑁∣𝐴𝑁}𝑠^𝑁∣𝑎^𝑁=^𝑁_𝑖=1𝑝_{𝑆𝑖∣𝐴𝑖}𝑠_𝑖∣𝑎_𝑖. (2) Note that the components of the state sequence 𝑆^𝑁 may not be i.i.d. random variables, and this is due to the fact that 𝐴^𝑁 is not i.i.d. generated. The transmission rate of the message is log‖𝒲‖/𝑁.

Definition 2 (channel encoder and the main channel). The main channel is a DMC with finite input alphabet 𝒳×𝒮, finite output alphabet 𝒴, and transition probability 𝑄_𝑀(𝑦∣𝑥,𝑠), where 𝑥∈𝒳,𝑠∈𝒮,𝑦∈𝒴. 𝑄_𝑀(𝑦^𝑁∣𝑥^𝑁,𝑠^𝑁)=∏^𝑁_𝑛=1𝑄_𝑀(𝑦_𝑛∣𝑥_𝑛,𝑠_𝑛). The inputs of the main channel are 𝑋^𝑁 and 𝑆^𝑁, while the output is 𝑌^𝑁.

There is a noiseless feedback from the output of the main channel to the channel encoder. At the 𝑖th time, the feedback 𝑌^𝑖−1 (where 2≤𝑖≤𝑁 and 𝑌^𝑖−1 takes values in 𝒴^𝑖−1) is the previous 𝑖−1 time output of the main channel. Since the channel encoder knows the state sequence 𝑠^𝑁 in a noncausal manner, at the 𝑖th time, the inputs of the channel encoder are 𝑊, 𝑌^𝑖−1, and 𝑆^𝑁, while the output is 𝑋_𝑖; that is, the 𝑖th time channel encoder is a conditional probability 𝑓^𝑁_2,𝑖(𝑥_𝑖∣𝑤,𝑠^𝑁,𝑦^𝑖−1) that the message 𝑤, the feedback 𝑦^𝑖−1, and the channel state sequence 𝑠^𝑁 are encoded as the 𝑖th time channel input 𝑥_𝑖.

Definition 3 (wiretap channel). The wiretap channel is also a DMC with finite input alphabet 𝒴, finite output alphabet 𝒵, and transition probability 𝑄_𝑊(𝑧∣𝑦), where 𝑦∈𝒴,𝑧∈𝒵. The input and output of the wiretap channel are 𝑌^𝑁 and 𝑍^𝑁, respectively. The equivocation to the wiretapper is defined as 𝐻Δ=𝑊∣𝑍^𝑁𝑁. (3) The cascade of the main channel and the wiretap channel is another DMC with transition probability: 𝑄_𝑀𝑊(𝑧∣𝑥,𝑠)=_𝑦∈𝒴𝑄_𝑊𝑧∣𝑦𝑄_𝑀𝑦∣𝑥,𝑠. (4)

Note that 𝑊→𝐴^𝑁→(𝑋^𝑁,𝑆^𝑁)→𝑌^𝑁→𝑍^𝑁 is a Markov chain in the model of Figure 6.

Definition 4 (decoder). The decoder for the legitimate receiver is a mapping 𝑓_𝐷∶𝒴^𝑁→𝒲, with input 𝑌^𝑁 and output 𝑊. Let 𝑃_𝑒 be the error probability of the receiver, and it is defined as Pr{𝑊≠𝑊}.

Definition 5 (achievable (𝑅,𝑅_𝑒) pair in the model of Figure 6). A pair (𝑅,𝑅_𝑒) (where 𝑅,𝑅_𝑒>0) is called achievable if, for any 𝜖>0 (where 𝜖 is an arbitrary small positive real number and 𝜖→0), there exist channel encoders decoders (𝑁,𝑃_𝑒) such that lim_𝑁→∞log‖𝒲‖𝑁=𝑅,lim_𝑁→∞Δ≥𝑅_𝑒,𝑃_𝑒≤𝜖. (5)

The capacity-equivocation region ℛ^𝑛 is a set composed of all achievable (𝑅,𝑅_𝑒) pairs, and it is characterized by the following Theorem 6. The proof of Theorem 6 is in Appendices A and B.

Theorem 6. A single-letter characterization of the region ℛ^𝑛 is as follows: ℛ^(𝑛)=𝑅,𝑅_𝑒∶0≤𝑅_𝑒()(),𝑅≤𝑅,𝑅≤𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴_𝑒(),𝑅≤𝐻𝑌∣𝑍_𝑒≤𝐻(𝐴∣𝑍), (6) where 𝑝_{𝑈𝐴𝑆𝑋𝑌𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧)=𝑝_𝑍∣𝑌(𝑧∣𝑦)𝑝_{𝑌∣𝑋,𝑆}(𝑦∣𝑥,𝑠)𝑝_{𝑈𝐴𝑋𝑆}(𝑢,𝑎,𝑥,𝑠), which implies that (𝐴,𝑈)→(𝑋,𝑆)→𝑌→𝑍.

Remark 7. There are some notes on Theorem 6, see the following. (i) The region ℛ^(𝑛) is convex, and the proof is directly obtained by introducing a time-sharing random variable into Theorem 6, and, therefore, we omit the proof here.(ii) The range of the random variable 𝑈 satisfies ‖𝒰‖≤‖𝒳‖‖𝒜‖‖𝒮‖+1. (7) The proof is in Appendix C.(iii) Without the equivocation parameter, the capacity of the main channel with feedback is given by 𝐶_𝑀=max_{𝑝𝑋∣𝑈,𝑆()𝑝𝑥∣𝑢,𝑠𝑈∣𝐴,𝑆()𝑝𝑢∣𝑎,𝑠𝐴(𝑎)}(𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴)). (8) The formula (8) is proved by Weissman [16], and it is omitted here.(iv) Secrecy capacity:  the points in ℛ^(𝑛) for which 𝑅_𝑒=𝑅 are of considerable interest, which imply the perfect secrecy 𝐻(𝑊)=𝐻(𝑊∣𝑍^𝑁).

Definition 8 (the secrecy capacity 𝐶_𝑠^(𝑛)). The secrecy capacity 𝐶_𝑠^(𝑛) of the model of Figure 6 with noncausal channel state information is denoted by 𝐶_𝑠^(𝑛)=max_{(𝑅,𝑅𝑒=𝑅)∈ℛ(𝑛)}𝑅. (9) Clearly, we can easily determine the secrecy capacity 𝐶^𝑛_𝑠 of the model of Figure 6 with noncausal channel state information by 𝐶^𝑛_𝑠{𝐼()(),𝐻()(.=maxmin𝑈;𝑌−𝐼𝑈;𝑆∣𝐴𝑌∣𝑍,𝐻𝐴∣𝑍)} (10)

Proof of (10). Substituting 𝑅_𝑒=𝑅 into the region ℛ^(𝑛) in Theorem 6, we have (),()(),().𝑅≤𝐻𝑌∣𝑍𝑅≤𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴𝑅≤𝐻𝐴∣𝑍 (11) Therefore, the secrecy capacity 𝐶_𝑠^(𝑛)=max_{(𝑅,𝑅𝑒=𝑅)∈ℛ}^(𝑛)𝑅=maxmin{𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴),𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}. Thus the proof is completed.

2.2. The Model of Figure 6 with Causal Channel State Information

The model of Figure 6 with causal channel state information is similar to the model with noncausal channel state information in Section 2.1, except that the state sequence 𝑆^𝑁 in Definition 1 is known to the channel encoder in a causal manner, that is, at the 𝑖th time (1≤𝑖≤𝑁), the output of the encoder 𝑥_𝑖=𝑓_2,𝑖(𝑤,𝑠^𝑖,𝑦^𝑖−1), where 𝑠^𝑖=(𝑠₁,𝑠₂,…,𝑠_𝑖) and 𝑓_2,𝑖 is the probability that the message 𝑤, the feedback 𝑦^𝑖−1, and the state 𝑠^𝑖 are encoded as the channel input 𝑥_𝑖 at time 𝑖.

The capacity-equivocation region ℛ^𝑐 for the model of Figure 6 with causal channel state information is characterized by the following Theorem 9, and it is proved in Appendices D and E.

Theorem 9. A single-letter characterization of the region ℛ^𝑐 is as follows: ℛ^(𝑐)=𝑅,𝑅_𝑒∶0≤𝑅_𝑒(),𝑅≤𝑅,𝑅≤𝐼𝑈;𝑌_𝑒(),𝑅≤𝐻𝑌∣𝑍_𝑒≤𝐻(𝐴∣𝑍), (12) where 𝑝_{𝑈𝐴𝑆𝑋𝑌𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧)=𝑝_𝑍∣𝑌(𝑧∣𝑦)𝑝_{𝑌∣𝑋,𝑆}(𝑦∣𝑥,𝑠)𝑝_{𝑈𝐴𝑋𝑆}(𝑢,𝑎,𝑥,𝑠), which implies that (𝐴,𝑈)→(𝑋,𝑆)→𝑌→𝑍.

Remark 10. There are some notes on Theorem 9, see the following. (i) The region ℛ^(𝑐) is convex.(ii) The range of the random variable 𝑈 satisfies ‖𝒰‖≤‖𝒳‖‖𝒜‖‖𝒮‖. (13) The proof is similar to that in Theorem 6, and it is omitted here.(iii) Without the equivocation parameter, the capacity of the main channel with feedback is given by 𝐶^∗_𝑀=max_{𝑝𝑋∣𝑈,𝑆(𝑥∣𝑢,𝑠)𝑝𝑈∣𝐴,𝑆(𝑢∣𝑎,𝑠)𝑝𝐴(𝑎)}𝐼(𝑈;𝑌). (14) The formula (14) is proved by Weissman [16], and it is omitted here.(iv) Secrecy capacity:  the points in ℛ^(𝑐) for which 𝑅_𝑒=𝑅 are of considerable interest, which imply the perfect secrecy 𝐻(𝑊)=𝐻(𝑊∣𝑍^𝑁).

Definition 11 (the secrecy capacity 𝐶_𝑠^(𝑐)). The secrecy capacity 𝐶_𝑠^(𝑐) of the model of Figure 6 with causal channel state information is denoted by 𝐶_𝑠^(𝑐)=max_{(𝑅,𝑅𝑒=𝑅)∈ℛ(𝑐)}𝑅. (15) Clearly, we can easily determine the secrecy capacity 𝐶_𝑠^(𝑐) of the model of Figure 6 with causal channel state information by 𝐶_𝑠^(𝑐)=maxmin{𝐼(𝑈;𝑌),𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}. (16)

Proof of (16). Substituting 𝑅_𝑒=𝑅 into the region ℛ^(𝑐) in Theorem 9, we have (),(),().𝑅≤𝐻𝑌∣𝑍𝑅≤𝐼𝑈;𝑌𝑅≤𝐻𝐴∣𝑍 (17) Therefore, the secrecy capacity 𝐶_𝑠^(𝑐)=max_{(𝑅,𝑅𝑒=𝑅)∈ℛ}^(𝑐)𝑅=maxmin{𝐼(𝑈;𝑌),𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}. Thus the proof is completed.

3. A Binary Example for the Model of Figure 6 with Causal Channel State Information

In this section, we calculate the secrecy capacity of a special case of the model of Figure 6 with causal channel state information.

Suppose that the channel state information 𝑆^𝑁 is available at the channel encoder in a casual manner. Meanwhile, the random variables 𝑈, 𝐴, 𝑋, 𝑆, 𝑌, and 𝑍 take values in {0,1}, and the transition probability of the main channel is defined as follows.

When 𝑠=0, 𝑝_{𝑌∣𝑋,𝑆}𝑦∣𝑥,𝑠=0=1−𝑝,if𝑦=𝑥,𝑝,otherwise. (18)

When 𝑠=1, 𝑝_{𝑌∣𝑋,𝑆}𝑦∣𝑥,𝑠=1=𝑝,if𝑦=𝑥,1−𝑝,otherwise. (19) Note that here 0≤𝑝≤1.

The wiretap channel is a (binary symmetric channel) BSC with crossover probability 𝑞(0≤𝑞≤1/2), that is, 𝑝_𝑍∣𝑌𝑧∣𝑦=1−𝑞,if𝑦=𝑥,𝑞,otherwise. (20)

The channel for generating the state sequence 𝑆^𝑁 is a BSC with crossover probability 𝑟 (0≤𝑟≤1), that is, 𝑝_𝑆∣𝐴(𝑠∣𝑎)=1−𝑟,if𝑦=𝑥,𝑟,otherwise. (21)

From Remark 10 we know that the secrecy capacity for the causal case is given by 𝐶^𝑐_𝑠=maxmin{𝐼(𝑈;𝑌),𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}. (22) Note that max𝐼(𝑈;𝑌), max𝐻(𝐴∣𝑍), and max𝐻(𝑌∣𝑍) are achieved if 𝐴 is a function of 𝑈 and 𝑋 is a function of 𝑈 and 𝑆, and this is similar to the argument in [16]. Define 𝑎=𝑔(𝑢) and 𝑥=𝑓(𝑢,𝑠), then (22) can be written as 𝐶^𝑐_𝑠=max_{𝑓,𝑔,𝑝𝑈(𝑢)}min{𝐼(𝑈;𝑌),𝐻(𝐴∣𝑍),𝐻(𝑌∣𝑍)}, (23) and this is because the joint probability distribution 𝑝_{𝐴𝑈𝑆𝑋𝑌𝑍}(𝑎,𝑢,𝑠,𝑥,𝑦,𝑧) can be calculated by 𝑝_{𝐴𝑈𝑆𝑋𝑌𝑍}𝑎,𝑢,𝑠,𝑥,𝑦,𝑧=𝑝_𝑍∣𝑌𝑧∣𝑦𝑝_{𝑌∣𝑋,𝑆}𝑦∣𝑥,𝑠1_{𝑥=𝑓(𝑢,𝑠)}𝑝_𝑆∣𝐴×(𝑠∣𝑎)1_{𝑎=𝑔(𝑢)}𝑝_𝑈(𝑢). (24)

Since 𝐴 is a function of 𝑈, we have 𝐻(𝐴∣𝑍)=𝐻(𝑈∣𝑍). (25) Then, it is easy to see that max_{𝑓,𝑔,𝑝𝑈(𝑢)}min{𝐼(𝑈;𝑌),𝐻(𝐴∣𝑍),𝐻(𝑌∣𝑍)}=max_{𝑓,𝑔,𝑝𝑈(𝑢)}max_{𝑓,𝑔,𝑝𝑈(𝑢)}min{𝐼(𝑈;𝑌),𝐻(𝑈∣𝑍),𝐻(𝑌∣𝑍)}. (26)

Now it remains to calculate the characters max_{𝑓,𝑔,𝑝𝑈(𝑢)}𝐻(𝑌∣𝑍), max_{𝑓,𝑔,𝑝𝑈(𝑢)}𝐻(𝑈∣𝑍), and max_{𝑓,𝑔,𝑝𝑈(𝑢)}𝐼(𝑈;𝑌); see the remaining of this section.

Let 𝑈 take values in {0,1}. The probability of 𝑈 is defined as follows: 𝑝_𝑈(0)=𝛼 and 𝑝_𝑈(1)=1−𝛼.

In addition, there are 16 kinds of 𝑓 and 4 kinds of 𝑔. Define the following: 𝑓⁽¹⁾()∶𝑓𝑢,𝑠00⟶0,01⟶0,10⟶0,11⟶0,₍₂₎()∶𝑓𝑢,𝑠00⟶0,01⟶0,10⟶0,11⟶1,₍₃₎()∶𝑓𝑢,𝑠00⟶0,01⟶0,10⟶1,11⟶0,₍₄₎()∶𝑓𝑢,𝑠00⟶0,01⟶0,10⟶1,11⟶1,₍₅₎()∶𝑓𝑢,𝑠00⟶0,01⟶1,10⟶0,11⟶0,₍₆₎()∶𝑓𝑢,𝑠00⟶0,01⟶1,10⟶0,11⟶1,₍₇₎()∶𝑓𝑢,𝑠00⟶0,01⟶1,10⟶1,11⟶0,₍₈₎()∶𝑓𝑢,𝑠00⟶0,01⟶1,10⟶1,11⟶1,₍₉₎()∶𝑓𝑢,𝑠00⟶1,01⟶0,10⟶0,11⟶0,₍₁₀₎()∶𝑓𝑢,𝑠00⟶1,01⟶0,10⟶0,11⟶1,₍₁₁₎()∶𝑓𝑢,𝑠00⟶1,01⟶0,10⟶1,11⟶0,₍₁₂₎()∶𝑓𝑢,𝑠00⟶1,01⟶0,10⟶1,11⟶1,₍₁₃₎()∶𝑓𝑢,𝑠00⟶1,01⟶1,10⟶0,11⟶0,₍₁₄₎()∶𝑓𝑢,𝑠00⟶1,01⟶1,10⟶0,11⟶1,₍₁₅₎()∶𝑓𝑢,𝑠00⟶1,01⟶1,10⟶1,11⟶0,₍₁₆₎()∶𝑔𝑢,𝑠00⟶1,01⟶1,10⟶1,11⟶1,₍₁₎(𝑢)∶𝑔0⟶0,1⟶0,⁽²⁾(𝑢)∶𝑔0⟶0,1⟶1,₍₃₎(𝑢)∶𝑔0⟶1,1⟶0,⁽⁴⁾(𝑢)∶0⟶1,1⟶1. (27) The character 𝐼(𝑈;𝑌) depends on the joint probability mass functions 𝑝_𝑈𝑌(𝑢,𝑦), and we have 𝑝_𝑈𝑌𝑢,𝑦=_{𝑥,𝑠,𝑎}𝑝_{𝑈𝑌𝑋𝑆𝐴}𝑢,𝑦,𝑥,𝑠,𝑎=_{𝑥,𝑠,𝑎}𝑝_{𝑌∣𝑋𝑆}𝑦∣𝑥,𝑠𝑝_{𝑋∣𝑈,𝑆}(𝑥∣𝑢,𝑠)𝑝_𝑈(𝑢)×𝑝_𝐴∣𝑈(𝑎∣𝑢)𝑝_𝑆∣𝐴(𝑠∣𝑎). (28) The character 𝐻(𝑈∣𝑍) depends on the joint probability mass functions 𝑝_𝑈𝑍(𝑢,𝑧), and we have 𝑝_𝑈𝑍(𝑢,𝑧)=_𝑦𝑝_𝑈𝑌𝑍𝑢,𝑦,𝑧=_𝑦𝑝_𝑍∣𝑌𝑧∣𝑦𝑝_𝑈,𝑌𝑢,𝑦. (29)

The character 𝐻(𝑌∣𝑍) depends on the joint probability mass functions 𝑝_𝑌𝑍(𝑢,𝑧), and we have 𝑝_𝑌𝑍𝑦,𝑧=_𝑢𝑝_𝑈𝑌𝑍=𝑢,𝑦,𝑧_(𝑎)𝑢𝑝_𝑍∣𝑌𝑧∣𝑦𝑝_𝑈,𝑌𝑢,𝑦, (30) where (𝑎) is from 𝑈→𝑌→𝑍.

By choosing the above 𝑓, 𝑔, and 𝛼, we find that max_{𝑓,𝑔,𝑝𝑈(𝑢)}𝐻(𝑈∣𝑍)=ℎ𝑝+𝑞−2𝑝𝑞, (31) where ℎ(𝑝+𝑞−2𝑝𝑞)=(𝑝+𝑞−2𝑝𝑞)log(1/(𝑝+𝑞−2𝑝𝑞))+(1−𝑝−𝑞+2𝑝𝑞)log(1/(1−𝑝−𝑞+2𝑝𝑞)). Moreover, ℎ(𝑝+𝑞−2𝑝𝑞) is achieved when 𝑓=𝑓⁽⁷⁾, 𝑔=𝑔⁽²⁾ and 𝛼=1/2.

On the other hand, max_{𝑓,𝑔,𝑝𝑈(𝑢)}𝐼(𝑈;𝑌)=1−ℎ𝑝, (32) and “=” is achieved if 𝑓=𝑓⁽⁷⁾, 𝑔=𝑔⁽²⁾ and 𝛼=1/2.

Moreover, max_{𝑓,𝑔,𝑝𝑈(𝑢)}𝐻(𝑌∣𝑍)=ℎ𝑞, (33) and “=” is achieved if 𝑓=𝑓⁽⁷⁾, 𝑔=𝑔⁽²⁾ and 𝛼=1/2.

Therefore, the secrecy capacity for the causal case is given by 𝐶^𝑐_𝑠=minℎ𝑝+𝑞−2𝑝𝑞,1−ℎ𝑝,ℎ𝑞. (34)

Figures 7, 8, and 9 give the secrecy capacity of the model of Figure 6 with causal channel state information for several values of 𝑞. It is easy to see that the secrecy capacity 𝐶^𝑐_𝑠 is increasing while 𝑞 is getting larger.

Figure 7 

When 𝑞=0.2, the secrecy capacity of the model of Figure 6 is with causal channel state information.

Figure 8 

When 𝑞=0.1, the secrecy capacity of the model of Figure 6 is with causal channel state information.

Figure 9 

When 𝑞=0.02, the secrecy capacity of the model of Figure 6 is with causal channel state information.

4. Conclusion

In this paper, we study the model of the wiretap channel with action-dependent channel state information and noiseless feedback. The capacity-equivocation regions are provided both for the case where the channel inputs are allowed to depend noncausally on the state sequence and the case where they are restricted to causal dependence. Furthermore, the secrecy capacities for both cases are formulated, which provide the best transmission rate with perfect secrecy. The result is further explained via a binary example.

The contribution of this paper is as follows.(i)Compared with the existing model of wiretap channel with side information [18] (see Figure 5), the channel state information in [18] is a special case of that in our new model; that is, the model of [18] is included in the model of Figure 6. Therefore, our result generalizes the result of [18].(ii)Our new model also extends the model of Figure 4 by considering an additional secrecy constraint, and therefore our result also generalizes the result of [16].

Appendices

A. Proof of the Direct Part of Theorem 6

In this section, we will show that any pair (𝑅,𝑅_𝑒)∈ℛ^𝑛 is achievable. Gel’efand-Pinsker’s binning, block Markov coding, and Ahlswede-Cai’s secret key on the feedback system are used in the construction of the code book.

Now the remainder of this section is organized as follows. The code construction is in Appendix  A.1. The proof of achievability is given in Appendix  A.2.

A.1. Code Construction

Since 𝑅_𝑒≤𝐻(𝑌∣𝑍), 𝑅_𝑒≤𝐻(𝐴∣𝑍) and 𝑅_𝑒≤𝑅≤𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴), it is sufficient to show that the pair (𝑅,𝑅_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍),𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴)} is achievable, and note that this implies that 𝑅≥𝑅_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍),𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴)}.

The construction of the code and the proof of achievability are considered into two cases.(i)Case  1:  𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴)≥min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}.(ii)Case  2:  𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴)≤min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}.

We use the block Markov coding method. The random vectors 𝑈^𝑁, 𝐴^𝑁, 𝑆^𝑁, 𝑋^𝑁, 𝑌^𝑁, and 𝑍^𝑁 consist of 𝑛 blocks of length 𝑁. The message for 𝑛 blocks is 𝑊^𝑛≜(𝑊₂,𝑊₃,…,𝑊_𝑛), where 𝑊_𝑖 (2≤𝑖≤𝑛) are i.i.d. random variables uniformly distributed over 𝒲. Note that in the first block, there is no 𝑊₁.

Let 𝑍_𝑖 (1≤𝑖≤𝑛) be the output of the wiretap channel for block 𝑖, 𝑍^𝑛=(𝑍₁,…,𝑍_𝑛), 𝑍^𝑗=(𝑍₁,…,𝑍_𝑗−1,𝑍_𝑗+1,…,𝑍_𝑛)  (1≤𝑗≤𝑛). Similarly, 𝑌^𝑛=(𝑌₁,…,𝑌_𝑛), and 𝑌_𝑖 (1≤𝑖≤𝑛) is the output of the main channel for block 𝑖. The specific values of the above random vectors are denoted by lowercase letters.

(i) Code Construction for Case  1. Given a pair (𝑅,𝑅_𝑒), choose a joint probability mass function 𝑝_{𝑈,𝐴,𝑆,𝑋,𝑌,𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧) such that 0≤𝑅_𝑒()(),𝑅≤𝑅,𝑅≤𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}. (A.1) The message set 𝒲 satisfies the following condition: lim_𝑁→∞1𝑁‖𝒲‖()()log=𝑅=𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴−𝛾, (A.2) where 𝛾 is a fixed positive real numbers and 0≤𝛾≤^(𝑎)𝐼()(){𝐻()(.𝑈;𝑌−𝐼𝑈;𝑆∣𝐴−min𝑌∣𝑍,𝐻𝐴∣𝑍)} (A.3) Note that (𝑎) is from 𝑅≥𝑅_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)} and (A.2). Let 𝒲={1,2,…,2^𝑁𝑅}.

Code-book generation:

(a) Construction of 𝐴^𝑁 and 𝑆^𝑁. In the first block, generate a i.i.d. sequence 𝑎^𝑁 according to the probability mass function 𝑝_𝐴(𝑎), and choose it as the output of the action encoder. Let 𝑠^𝑁 be the state sequence generated in response to the chosen action sequence 𝑎^𝑁.

For the 𝑖th block (2≤𝑖≤𝑛), generate 2^𝑁𝑅 i.i.d. sequences 𝑎^𝑁, according to the probability mass function 𝑝_𝐴(𝑎). Index each sequence by 𝑖∈{1,2,…,2^𝑁𝑅}. For a given message 𝑤_𝑖 (𝑤_𝑖∈𝒲), choose a corresponding 𝑎^𝑁(𝑤_𝑖) as the output of the action encoder. Let 𝑠^𝑁 be the state sequence generated in response to the action sequence 𝑎^𝑁(𝑤_𝑖).

(b) Construction of the Secret Key. For the 𝑖th block (2≤𝑖≤𝑛), firstly we generate a mapping 𝑔_𝑓∶𝒴^𝑁→𝒲 (note that ‖𝒴‖^𝑁≥‖𝒲‖). Define a random variable 𝐾_𝑖=𝑔_𝑓(𝑌_𝑖−1) (2≤𝑖≤𝑛), which is uniformly distributed over 𝒲, and 𝐾_𝑖 is independent of  𝑊_𝑖. Reveal the mapping 𝑔_𝑓 to both receivers and the transmitter.

Then, when the transmitter receives the output 𝑦_𝑖−1 of the 𝑖-1th block, he computes 𝑘_𝑖=𝑔_𝑓(𝑦_𝑖−1)∈𝒲 as the secret key used in the 𝑖th block.

(c) Construction of 𝑈^𝑁. In the first block, for the transmitted action sequence 𝑎^𝑁 and the corresponding state sequence 𝑠^𝑁, generate a i.i.d. sequence 𝑢^𝑁 according to the probability mass function 𝑝_{𝑈∣𝐴,𝑆}(𝑢_𝑖∣𝑎_𝑖,𝑠_𝑖). Choose 𝑢^𝑁 as a realization of 𝑈^𝑁 for the first block.

For the 𝑖th block (2≤𝑖≤𝑛), given the transmitted action sequence 𝑎^𝑁(𝑤_𝑖) and the corresponding state sequence 𝑠^𝑁, generate 2^{𝑁(𝐼(𝑈;𝑌)−𝜖2,𝑁)} (𝜖_2,𝑁→0 as 𝑁→∞) i.i.d. sequences 𝑢^𝑁, according to the probability mass function 𝑝_{𝑈∣𝐴,𝑆}(𝑢_𝑖∣𝑎_𝑖(𝑤_𝑖),𝑠_𝑖). Distribute these sequences at random into 2^𝑁𝑅=2^{𝑁(𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴)−𝛾)} bins such that each bin contains 2^{𝑁(𝐼(𝑈;𝑆∣𝐴)+𝛾−𝜖2,𝑁)} sequences. Index each bin by 𝑖∈{1,2,…,2^𝑁𝑅}.

For a given 𝑤_𝑖, 𝑎^𝑁(𝑤_𝑖), 𝑠^𝑁, and a secret key 𝑘_𝑖, the transmitter chooses a sequence 𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗^∗) from the bin 𝑤_𝑖⊕𝑘_𝑖 (where ⊕ is the modulo addition over 𝒲) such that (𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗^∗),𝑎^𝑁(𝑤_𝑖),𝑠^𝑁)∈𝑇^𝑁_{𝑈𝑆∣𝐴}(𝜖). If such multiple sequences in bin 𝑤_𝑖⊕𝑘_𝑖 exist, choose the one with the smallest index in the bin. If no such sequence exists, declare an encoding error.

(d) Construction of 𝑋^𝑁.  For each block, the 𝑥^𝑁 is generated according to a new discrete memoryless channel (DMC) with inputs 𝑢^𝑁, 𝑠^𝑁, and output 𝑥^𝑁. The transition probability of this new DMC is 𝑝_{𝑋∣𝑈,𝑆}(𝑥∣𝑢,𝑠), which is obtained from the joint probability mass function 𝑝_{𝑈,𝐴,𝑆,𝑋,𝑌,𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧).

The probability 𝑝_{𝑋𝑁∣𝑈𝑁,𝑆𝑁}(𝑥^𝑁∣𝑢^𝑁,𝑠^𝑁) is calculated as follows: &𝑝_{𝑋𝑁∣𝑈𝑁,𝑆𝑁}𝑥^𝑁∣𝑢^𝑁,𝑠^𝑁=^𝑁_𝑖=1𝑝_{𝑋∣𝑈,𝑆}𝑥_𝑖∣𝑢_𝑖,𝑠_𝑖. (A.4)

Decoding. For the 𝑖th block (2≤𝑖≤𝑛), given a vector 𝑦^𝑁∈𝒴^𝑁 and a secret key 𝑘_𝑖 (𝑘_𝑖 is known by the receiver), try to find a sequence 𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗)̂ such that (𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗)̂,𝑦^𝑁)∈𝑇^𝑁_𝑈𝑌(𝜖₃). If there exist sequences with the same 𝑤_𝑖⊕𝑘_𝑖, by using the secret key 𝑘_𝑖, put out the corresponding 𝑤_𝑖. Otherwise, that is, if no such sequence exists or multiple sequences have different message indices, declare a decoding error.

(ii) Code Construction for Case  2.  Given a pair (𝑅,𝑅_𝑒), choose a joint probability mass function 𝑝_{𝑈,𝐴,𝑆,𝑋,𝑌,𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧) such that 0≤𝑅_𝑒()(),𝑅≤𝑅,𝑅=𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴_𝑒=𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴). (A.5) The message set 𝒲 satisfies the following condition: lim_𝑁→∞1𝑁‖𝒲‖()().log=𝑅=𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴 (A.6) Let 𝒲={1,2,…,2^𝑁𝑅}.

Code-book generation:

(a) Construction of 𝐴^𝑁 and 𝑆^𝑁.  In the first block, generate a i.i.d.  sequence 𝑎^𝑁 according to the probability mass function 𝑝_𝐴(𝑎), and choose it as the output of the action encoder. Let 𝑠^𝑁 be the state sequence generated in response to the chosen action sequence 𝑎^𝑁.

For the 𝑖th block (2≤𝑖≤𝑛), generate 2^𝑁𝑅 i.i.d. sequences 𝑎^𝑁, according to the probability mass function 𝑝_𝐴(𝑎). Index each sequence by 𝑖∈{1,2,…,2^𝑁𝑅}. For a given message 𝑤_𝑖 (𝑤_𝑖∈𝒲), choose a corresponding 𝑎^𝑁(𝑤_𝑖) as the output of the action encoder. Let 𝑠^𝑁 be the state sequence generated in response to the action sequence 𝑎^𝑁(𝑤_𝑖).

(b) Construction of the Secret Key.  For the 𝑖th block (2≤𝑖≤𝑛), firstly we generate a mapping 𝑔_𝑓∶𝒴^𝑁→𝒲 (note that ‖𝒴‖^𝑁≥‖𝒲‖). Define a random variable 𝐾_𝑖=𝑔_𝑓(𝑌_𝑖−1) (2≤𝑖≤𝑛),  which is uniformly distributed over 𝒲, and 𝐾_𝑖 is independent of  𝑊_𝑖. Reveal the mapping 𝑔_𝑓 to both receivers and the transmitter.

Then, when the transmitter receives the output 𝑦_𝑖−1 of the 𝑖-1th block, he computes 𝑘_𝑖=𝑔_𝑓(𝑦_𝑖−1)∈𝒲 as the secret key used in the 𝑖th block.

(c) Construction of 𝑈^𝑁.  In the first block, for the transmitted action sequence 𝑎^𝑁 and the corresponding state sequence 𝑠^𝑁, generate a i.i.d. sequence 𝑢^𝑁 according to the probability mass function 𝑝_{𝑈∣𝐴,𝑆}(𝑢_𝑖∣𝑎_𝑖,𝑠_𝑖). Choose 𝑢^𝑁 as a realization of 𝑈^𝑁 for the first block.

For the 𝑖th block (2≤𝑖≤𝑛), given the transmitted action sequence 𝑎^𝑁(𝑤_𝑖) and the corresponding state sequence 𝑠^𝑁, generate 2^{𝑁(𝐼(𝑈;𝑌)−𝜖2,𝑁)} (𝜖_2,𝑁→0 as 𝑁→∞) i.i.d. sequences 𝑢^𝑁, according to the probability mass function 𝑝_{𝑈∣𝐴,𝑆}(𝑢_𝑖∣𝑎_𝑖(𝑤_𝑖),𝑠_𝑖). Distribute these sequences at random into 2^𝑁𝑅=2^{𝑁(𝐼(𝑈;𝑌)−𝐼(𝑈;𝑆∣𝐴))} bins such that each bin contains 2^{𝑁(𝐼(𝑈;𝑆∣𝐴)−𝜖2,𝑁)} sequences. Index each bin by 𝑖∈{1,2,…,2^𝑁𝑅}.

For a given 𝑤_𝑖, 𝑎^𝑁(𝑤_𝑖), 𝑠^𝑁, and a secret key 𝑘_𝑖, the transmitter chooses a sequence 𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗^∗) from the bin 𝑤_𝑖⊕𝑘_𝑖 (where ⊕ is the modulo addition over 𝒲) such that (𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗^∗),𝑎^𝑁(𝑤_𝑖),𝑠^𝑁)∈𝑇^𝑁_{𝑈𝑆∣𝐴}(𝜖). If such multiple sequences in bin 𝑤_𝑖⊕𝑘_𝑖 exist, choose the one with the smallest index in the bin. If no such sequence exists, declare an encoding error.

(d) Construction of 𝑋^𝑁.  The 𝑥^𝑁 is generated the same as that for the case 1, and it is omitted here.

Decoding. For the 𝑖th block (2≤𝑖≤𝑛), given a vector 𝑦^𝑁∈𝒴^𝑁 and a secret key 𝑘_𝑖 (𝑘_𝑖 is known by the receiver), try to find a sequence 𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗)̂ such that (𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖,𝑗)̂,𝑦^𝑁)∈𝑇^𝑁_𝑈𝑌(𝜖₃). If there exist sequences with the same 𝑤_𝑖⊕𝑘_𝑖, by using the secret key 𝑘_𝑖, put out the corresponding 𝑤_𝑖. Otherwise, that is, if no such sequence exists or multiple sequences have different message indices, declare a decoding error.

A.2. Proof of Achievability

The rate of the message 𝑊^𝑛 is defined as 𝑅^∗≜lim_𝑁→∞lim_𝑛→∞𝐻𝑊^𝑛,𝑛𝑁 (A.7) and it satisfies 𝑅^∗=lim_𝑁→∞lim_𝑛→∞𝐻𝑊^𝑛𝑛𝑁=lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝑊_𝑖𝑛𝑁=lim_𝑁→∞lim_𝑛→∞(𝑛−1)𝐻(𝑊)𝑛𝑁=𝑅. (A.8)

In addition, note that the encoding and decoding scheme for Theorem 6 is exactly the same as that in [16], except that the transmitted message for the legitimate receiver is 𝑤⊕𝑘. Since the legitimate receiver knows 𝑘, the decoding scheme for Theorem 6 is in fact the same as that in [16]. Hence, we omit the proof of 𝑃_𝑒≤𝜖 here.

It remains to show that lim_𝑁→∞Δ≥𝑅_𝑒, see the following.

Since the message 𝑊 is encrypted by 𝑊⊕𝐾, the equivocation about 𝑊 is equivalent to the equivocation about the secret key 𝐾. There are two ways for the wiretapper to obtain the secret key 𝑘. One way is that he tries to guess the 𝑘 from its alphabet 𝒲. The other way is that he tries to guess the feedback 𝑦^𝑁 (𝑦^𝑁 is the output of the main channel for the previous block, and 𝑘=𝑔_𝑓(𝑦^𝑁)) from the conditional typical set 𝑇^𝑁_{[𝑌∣𝑍]}(𝛿), and this is because for a given 𝑧^𝑁 and sufficiently large 𝑁, Pr{(𝑦^𝑁∉𝑇^𝑁_{[𝑌∣𝑍]}(𝛿)}→0. Note that there are 2^{𝑁𝐻(𝑌∣𝑍)} sequences 𝑦^𝑁∈𝑇^𝑁_{[𝑌∣𝑍]}(𝛿) when 𝑁→∞ and 𝛿→0. Therefore, the equivocation about 𝑊 is min{(log‖𝒲‖)/𝑁=𝑅,𝐻(𝑌∣𝑍)}, and note that 𝑅≥𝑅_𝑒 and 𝐻(𝑌∣𝑍)≥𝑅_𝑒, and then lim_𝑁→∞Δ≥𝑅_𝑒 is obtained.

The details about the proof are as follows.

First, we will show that 𝐾_𝑖⊕𝑊_𝑖 is independent of 𝐾_𝑖 and 𝑊_𝑖, and this is used in the proof of lim_𝑁→∞Δ≥𝑅_𝑒.

Since 𝐾_𝑖 is independent of 𝑊_𝑖 (2≤𝑖≤𝑛), and all of them are uniformly distributed over 𝒲, the fact that 𝐾_𝑖⊕𝑊_𝑖 is independent of 𝐾_𝑖 and 𝑊_𝑖 is proved by the following (A.9): Pr𝐾_𝑖⊕𝑊_𝑖=𝑎=_{𝑘𝑖∈𝒲}Pr𝐾_𝑖⊕𝑊_𝑖=𝑎,𝐾_𝑖=𝑘_𝑖=_{𝑘𝑖∈𝒲}Pr𝑊_𝑖=𝑎⊖𝑘_𝑖,𝐾_𝑖=𝑘_𝑖=_{𝑘𝑖∈𝒲}Pr𝑊_𝑖=𝑎⊖𝑘_𝑖Pr𝐾_𝑖=𝑘_𝑖=1‖𝒲‖,Pr𝐾_𝑖⊕𝑊_𝑖=𝑎,𝐾_𝑖=𝑘_𝑖=Pr𝑊_𝑖=𝑎⊖𝑘_𝑖,𝐾_𝑖=𝑘_𝑖=Pr𝑊_𝑖=𝑎⊖𝑘_𝑖Pr𝐾_𝑖=𝑘_𝑖=1‖𝒲‖². (A.9) Then, lim_𝑁→∞Δ≥𝑅_𝑒 for both cases is proved by the following (A.10): lim_𝑁→∞Δ≜lim_𝑁→∞lim_𝑛→∞𝐻𝑊^𝑛∣𝑍^𝑛𝑛𝑁=lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝑊_𝑖∣𝑊^𝑖−1,𝑍^𝑛=𝑛𝑁_(𝑎)lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝑊_𝑖∣𝑍_𝑖,𝑍_𝑖−1𝑛𝑁≥lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝑊_𝑖∣𝑍_𝑖,𝑍_𝑖−1,𝑊_𝑖⊕𝐾_𝑖=𝑛𝑁_(𝑏)lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝑊_𝑖∣𝑍_𝑖−1,𝑊_𝑖⊕𝐾_𝑖𝑛𝑁=lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝐾_𝑖∣𝑍_𝑖−1,𝑊_𝑖⊕𝐾_𝑖=𝑛𝑁_(𝑐)lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2𝐻𝐾_𝑖∣𝑍_𝑖−1=𝑛𝑁_(𝑑)lim_𝑁→∞lim_𝑛→∞∑^𝑛_𝑖=2min{𝑁𝐻(𝑌∣𝑍),𝑁𝑅}𝑛𝑁=lim_𝑁→∞lim_𝑛→∞(𝑛−1)min{𝑁𝑅,𝑁𝐻(𝑌∣𝑍)}{(𝑛𝑁=min𝑅,𝐻𝑌∣𝑍)}≥𝑅_𝑒, (A.10) where (𝑎) is from 𝑊_𝑖→(𝑍_𝑖,𝑍_𝑖−1)→(𝑊^𝑖−1,𝑍^𝑖−2,𝑍^𝑛_𝑖+1) that is a Markov chain, (𝑏) is from 𝑊_𝑖→(𝑊_𝑖⊕𝐾_𝑖,𝑍_𝑖−1)→𝑍_𝑖 that is a Markov chain, (𝑐) follows from the fact that 𝐾_𝑖⊕𝑊_𝑖 is independent of 𝐾_𝑖 and 𝑍_𝑖−1, and (𝑑) is from the fact that the wiretapper can guess the specific vector 𝑌_𝑖−1 (corresponding to the key 𝐾_𝑖) from the conditional typical set 𝑇^𝑁_{[𝑌∣𝑍]}(𝛿), and 𝐾_𝑖 is uniformly distributed over 𝒲 (𝐾_𝑖 is the key used in block 𝑖).

On the other hand, lim_𝑁→∞Δ≜lim_𝑁→∞lim_𝑛→∞𝐻𝑊^𝑛∣𝑍^𝑛=𝑛𝑁₍₁₎lim_𝑁→∞lim_𝑛→∞1𝐻𝐴𝑛𝑁^𝑛2∣𝑍^𝑛₂=⁽²⁾lim_𝑁→∞lim_𝑛→∞1)(()𝑛𝑁((𝑛−1𝑁𝐻𝐴∣𝑍))=𝐻𝐴∣𝑍≥𝑅_𝑒, (A.11) where (1) is from the fact that 𝑊^𝑛≜(𝑊₂,𝑊₃,…,𝑊_𝑛), 𝐴_𝑖 (2≤𝑖≤𝑛) is the state sequence for block 𝑖, 𝐴^𝑛₂=(𝐴₂,…,𝐴_𝑛) and 𝐴_𝑖 is a function of 𝑊_𝑖, (2) is from 𝐴^𝑛 and 𝑋^𝑛 that are i.i.d. generated random vectors, and the channels are discrete memoryless.

Therefore, it is easy to see that, for the case 1, lim_𝑁→∞Δ≥𝑅_𝑒 is proved by (A.10) and (A.11). For the case 2, lim_𝑁→∞Δ≥𝑅_𝑒 is proved by the formula (A.10).

Thus, lim_𝑁→∞Δ≥𝑅_𝑒 for both cases is proved. The proof of Theorem 6 is completed.

B. Proof of the Converse Part of Theorem 6

In this section, we prove the converse part of Theorem 6: all the achievable (𝑅,𝑅_𝑒) pairs are contained in the set ℛ^(𝑛). Suppose that (𝑅,𝑅_𝑒) is achievable; that is, for any given 𝜖>0, there exists a channel encoder-decoder (𝑁,Δ,𝑃_𝑒) such that lim_𝑁→∞log‖𝒲‖𝑁=𝑅,lim_𝑁→∞Δ≥𝑅_𝑒,𝑃_𝑒≤𝜖. (B.1) Then we will show the existence of random variables (𝐴,𝑈)→(𝑋,𝑆)→𝑌→𝑍 such that 0≤𝑅_𝑒()(),𝑅≤𝑅,𝑅≤𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴_𝑒(),𝑅≤𝐻𝑌∣𝑍_𝑒≤𝐻(𝐴∣𝑍). (B.2)(B.3)(B.4)(B.5) Since 𝑊 is uniformly distributed over 𝒲, we have 𝐻(𝑊)=log‖𝒲‖. The formulas (B.3), (B.4), and (B.5) are proved by Lemma  B.1; see the following.

Lemma  B.1. The random vectors 𝑌^𝑁 and 𝑍^𝑁 and the random variables 𝑊, 𝑈, 𝐴, 𝑆, 𝑋, 𝑌, and 𝑍 of Theorem 6 satisfy 1𝑁𝐻(𝑊)()()+1≤𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴𝑁𝛿𝑃_𝑒,1𝑁𝐻𝑊∣𝑍^𝑁()+1≤𝐻𝑌∣𝑍𝑁𝛿𝑃_𝑒,1𝑁𝐻𝑊∣𝑍^𝑁≤𝐻(𝐴∣𝑍), (B.6)(B.7)(B.8) where 𝛿(𝑃_𝑒)=ℎ(𝑃_𝑒)+𝑃_𝑒log(|𝒲|−1). Note that ℎ(𝑃_𝑒)=−𝑃_𝑒log𝑃_𝑒−(1−𝑃_𝑒)log(1−𝑃_𝑒).

Substituting 𝐻(𝑊)=log‖𝒲‖ and (5) into (B.6), (B.7), and (B.8) and using the fact that 𝜖→0, the formulas (B.3), (B.4), and (B.5) are obtained. The formula (B.2) is from 𝑅_𝑒≤lim_𝑁→∞Δ=lim_𝑁→∞1𝑁𝐻𝑊∣𝑍^𝑁≤lim_𝑁→∞1𝑁𝐻(𝑊)=𝑅. (B.9) It remains to prove Lemma  B.1; see the following.

Proof of Lemma  B.1.  The formula (B.6) follows from (B.10), (B.13), and (B.21). The formula (B.7) is from (B.11), (B.17) and (B.22). The formula (B.8) is proved by (B.12), (B.18), and (B.23).

Part (i). We begin with the left parts of the inequalities (B.6), (B.7), and (B.8); see the following.

Since 𝑊→𝑌^𝑁→𝑍^𝑁 is a Markov chain, for the message 𝑊, we have 1𝑁𝐻(𝑊)=1𝑁𝐻𝑊∣𝑌^𝑁+1𝑁𝐼𝑌^𝑁≤;𝑊_(𝑎)1𝑁𝛿𝑃_𝑒+1𝑁𝐼𝑌^𝑁;𝑊. (B.10)

For the equivocation to the wiretapper, we have 1𝑁𝐻𝑊∣𝑍^𝑁=^(𝑏)1𝑁𝐻𝑊∣𝑍^𝑁+𝛿𝑃_𝑒−𝐻𝑊∣𝑍^𝑁,𝑌^𝑁=1𝑁𝐼𝑊;𝑌^𝑁∣𝑍^𝑁+𝛿𝑃_𝑒≤1𝑁𝐻𝑌^𝑁∣𝑍^𝑁+𝛿𝑃_𝑒. (B.11)

Moreover, 1𝑁𝐻𝑊∣𝑍^𝑁=1𝑁𝐻𝐴^𝑁∣𝑍^𝑁. (B.12)

Note that (𝑎) and (𝑏) follow from Fano’s inequality, and (B.12) is from the fact that 𝐴^𝑁 is a deterministic function of 𝑊.

Part (ii). By using chain rule, the character 𝐼(𝑌^𝑁;𝑊) in formulas (B.10) and (B.11) can be bounded as follows: 1𝑁𝐼𝑌^𝑁=1;𝑊𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊∣𝑌^𝑖−1=⁽¹⁾1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊∣𝑌^𝑖−1−𝐼𝑆_𝑖;𝑊∣𝑆^𝑁_𝑖+1,𝐴^𝑁=1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁∣𝑌^𝑖−1−𝐼𝑌_𝑖;𝑆^𝑁_𝑖+1,𝐴^𝑁∣𝑊,𝑌^𝑖−1−𝐼𝑆_𝑖;𝑊,𝑌^𝑖−1∣𝑆^𝑁_𝑖+1,𝐴^𝑁+𝐼𝑆_𝑖;𝑌^𝑖−1∣𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁=⁽²⁾1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁∣𝑌^𝑖−1−𝐼𝑆_𝑖;𝑊,𝑌^𝑖−1∣𝑆^𝑁_𝑖+1,𝐴^𝑁=1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑌^𝑖−1−𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁−𝐻𝑆_𝑖∣𝑆^𝑁_𝑖+1,𝐴^𝑁+𝐻𝑆_𝑖∣𝑆^𝑁_𝑖+1,𝐴^𝑁,𝑊,𝑌^𝑖−1≤⁽³⁾1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖−𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁−𝐻𝑆_𝑖∣𝐴_𝑖+𝐻𝑆_𝑖∣𝑆^𝑁_𝑖+1,𝐴^𝑁,𝑊,𝑌^𝑖−1, (B.13) where formula (1) follows from that 𝑊→𝐴^𝑁→𝑆^𝑁, and formula (2) follows from that ^𝑁_𝑖=1𝐼𝑌_𝑖;𝑆^𝑁_𝑖+1,𝐴^𝑁∣𝑊,𝑌^𝑖−1=^𝑁_𝑖=1𝐼𝑆_𝑖;𝑌^𝑖−1∣𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁, (B.14) and formula (3) follows from that 𝑆_𝑖→𝐴_𝑖→(𝑆^𝑁_𝑖+1,𝐴^𝑖−1,𝐴^𝑁_𝑖+1).

Proof of (B.14).  The left part of (B.14) can be rewritten as ^𝑁_𝑖=1𝐼𝑌_𝑖;𝑆^𝑁_𝑖+1,𝐴^𝑁∣𝑊,𝑌^𝑖−1=^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑊,𝑌^𝑖−1−𝐻𝑌_𝑖∣𝑊,𝑌^𝑖−1,𝑆^𝑁_𝑖+1,𝐴^𝑁=^𝑁(1)_𝑖=1𝐻𝑌_𝑖∣𝐴^𝑁,𝑌^𝑖−1−𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑆^𝑁_𝑖+1,𝐴^𝑁=^𝑁_𝑖=1𝐼𝑌_𝑖;𝑆^𝑁_𝑖+1∣𝐴^𝑁,𝑌^𝑖−1=^𝑁𝑁_{𝑖=1𝑗=𝑖+1}𝐼𝑌_𝑖;𝑆_𝑗∣𝐴^𝑁,𝑌^𝑖−1,𝑆^𝑁_𝑗+1=^𝑁𝑁_{𝑗=1𝑖=𝑗+1}𝐼𝑌_𝑗;𝑆_𝑖∣𝐴^𝑁,𝑌^𝑗−1,𝑆^𝑁_𝑖+1=^𝑁_𝑖=1^𝑖+1_𝑗=1𝐼𝑌_𝑗;𝑆_𝑖∣𝐴^𝑁,𝑌^𝑗−1,𝑆^𝑁_𝑖+1, (B.15) where (1) is from the fact that 𝐴^𝑁 is a deterministic function of 𝑊.

The right part of (B.14) can be rewritten as ^𝑁_𝑖=1𝐼𝑆_𝑖;𝑌^𝑖−1∣𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁=^𝑁(2)_𝑖=1𝐼𝑆_𝑖;𝑌^𝑖−1∣𝑆^𝑁_𝑖+1,𝐴^𝑁=^𝑁_𝑖=1^𝑖−1_𝑗=1𝐼𝑌_𝑗;𝑆_𝑖∣𝐴^𝑁,𝑌^𝑗−1,𝑆^𝑁_𝑖+1, (B.16) where (2) is from the fact that 𝐴^𝑁 is a deterministic function of 𝑊.

The formula (B.14) is proved by (B.15) and (B.16). The proof is completed.

Part (iii). The character 𝐻(𝑌^𝑁∣𝑍^𝑁) in formula (B.11) can be rewritten as follows: 1𝑁𝐻𝑌^𝑁∣𝑍^𝑁=1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑍_𝑖. (B.17)

Part (iv). The character 𝐻(𝐴^𝑁∣𝑍^𝑁) in formula (B.12) can be rewritten as follows: 1𝑁𝐻𝐴^𝑁∣𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝐴_𝑖∣𝑍_𝑖. (B.18)

Part (v) (single letter). To complete the proof, we introduce a random variable 𝐽, which is independent of 𝑊, 𝐴^𝑁, 𝑋^𝑁, 𝑆^𝑁, 𝑌^𝑁 and 𝑍^𝑁. Furthermore, 𝐽 is uniformly distributed over {1,2,…,𝑁}. Define 𝑈=𝑊,𝑌^𝐽−1,𝑆^𝑁_𝐽+1,𝐴^𝑁,𝐽,𝑋=𝑋_𝐽,𝑌=𝑌_𝐽,𝑍=𝑍_𝐽,𝑆=𝑆_𝐽,𝐴=𝐴_𝐽. (B.19)(B.20)Part (vi). Then (B.13) can be rewritten as 1𝑁𝐼𝑊;𝑌^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖−𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁−𝐻𝑆_𝑖∣𝐴_𝑖+𝐻𝑆_𝑖∣𝑆^𝑁_𝑖+1,𝐴^𝑁,𝑊,𝑌^𝑖−1=1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝐽=𝑖−𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑊,𝑆^𝑁_𝑖+1,𝐴^𝑁𝑆,𝐽=𝑖−𝐻_𝑖∣𝐴_𝑖𝑆,𝐽=𝑖+𝐻_𝑖∣𝑆^𝑁_𝑖+1,𝐴^𝑁,𝑊,𝑌^𝑖−1,𝐴_𝑖𝑌,𝐽=𝑖=𝐻_𝐽∣𝐽−𝐻𝑌_𝐽∣𝑌^𝐽−1,𝑊,𝑆^𝑁_𝐽+1,𝐴^𝑁𝑆,𝐽−𝐻_𝐽∣𝐴_𝐽,𝐽+𝐻𝑆_𝐽∣𝑆^𝑁_𝐽+1,𝐴^𝑁,𝑊,𝑌^𝐽−1,𝐴_𝐽𝑌,𝐽≤𝐻_𝐽−𝐻𝑌_𝐽∣𝑌^𝐽−1,𝑊,𝑆^𝑁_𝐽+1,𝐴^𝑁,𝐽−𝐻𝑆_𝐽∣𝐴_𝐽𝑆,𝐽+𝐻_𝐽∣𝑆^𝑁_𝐽+1,𝐴^𝑁,𝑊,𝑌^𝐽−1,𝐴_𝐽(𝑌)()()()()().,𝐽=𝐻−𝐻𝑌∣𝑈−𝐻𝑆∣𝐴+𝐻𝑆∣𝑈,𝐴=𝐼𝑈;𝑌−𝐼𝑈;𝑆∣𝐴 (B.21) Analogously, (B.17) is rewritten as follows: 1𝑁𝐻𝑌^𝑁∣𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑍_𝑖=1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑍_𝑖𝑌,𝐽=𝑖=𝐻_𝐽∣𝑍_𝐽().,𝐽≤𝐻𝑌∣𝑍 (B.22) Similarly, (B.18) can be rewritten as follows: 1𝑁𝐻𝐴^𝑁∣𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝐴_𝑖∣𝑍_𝑖=1𝑁^𝑁_𝑖=1𝐻𝐴_𝑖∣𝑍_𝑖𝐴,𝐽=𝑖=𝐻_𝐽∣𝑍_𝐽𝐴,𝐽≤𝐻_𝐽,𝐽∣𝑍_𝐽=𝐻(𝐴∣𝑍). (B.23) Substituting (B.21), (B.22), (B.23) into (B.10), (B.11), and (B.12), Lemma  B.1 is proved.

The proof of Theorem 6 is completed.

C. Size Constraint of the Auxiliary Random Variable in Theorem 6

By using the support lemma (see [20, page 310]), it suffices to show that the random variable 𝑈 can be replaced by new one, preserving the Markovity (𝑈,𝐴)→(𝑋,𝑆)→𝑌→𝑍 and the mutual information 𝐼(𝑈;𝑍), 𝐼(𝑈;𝑌), 𝐼(𝑈;𝑆∣𝐴), and furthermore, the range of the new 𝑈 satisfies, ‖𝒰‖≤‖𝒳‖‖𝒮‖‖𝒜‖+1. The proof is in the reminder of this section.

Let 𝑝=𝑝_𝑋𝑆𝐴(𝑥,𝑠,𝑎). (C.1) Define the following continuous scalar functions of 𝑝: 𝑓_𝑋𝑆𝐴𝑝=𝑝_𝑋𝑆𝐴(𝑥,𝑠,𝑎),𝑓_𝑌𝑝=𝐻(𝑌),𝑓_𝑆∣𝐴𝑝=𝐻(𝑆∣𝐴). (C.2)

Since there are ‖𝒳‖‖𝒮‖‖𝒜‖−1 functions of 𝑓_𝑋𝑆𝐴(𝑝), the total number of the continuous scalar functions of 𝑝 is ‖𝒳‖‖𝒮‖‖𝒜‖+1.

Let 𝑝_{𝑋𝑆𝐴∣𝑈}=Pr{𝑋=𝑥,𝑆=𝑠,𝐴=𝑎∣𝑈=𝑢}. With these distributions 𝑝_{𝑋𝑆𝐴∣𝑈}=Pr{𝑋=𝑥,𝑆=𝑠,𝐴=𝑎∣𝑈=𝑢}, we have 𝑝_𝑋𝑆𝐴(𝑥,𝑠,𝑎)=_𝑢∈𝒰𝑝(𝑈=𝑢)𝑓_𝑋𝑆𝐴𝑝_{𝑋𝑆𝐴∣𝑈},𝐼(𝑈;𝑆∣𝐴)=𝑓_𝑆∣𝐴𝑝−_𝑢∈𝒰𝑝(𝑈=𝑢)𝑓_𝑆∣𝐴𝑝_{𝑋𝑆𝐴∣𝑈},𝐻(𝑌∣𝑈)=_𝑢∈𝒰𝑝(𝑈=𝑢)𝑓_𝑌𝑝_{𝑋𝑆𝐴∣𝑈}. (C.3)(C.4)(C.5)

According to the support lemma ([20, page 310]), the random variable 𝑈 can be replaced by new ones such that the new 𝑈 takes at most ‖𝒳‖‖𝒮‖‖𝒜‖+1 different values and the expressions (C.3), (C.4), and (C.5) are preserved.

D. Proof of the Direct Part of Theorem 9

In this section, we will show that any pair (𝑅,𝑅_𝑒)∈ℛ^𝑐 is achievable. Block Markov coding and Ahlswede-Cai’s secret key on the feedback system are used in the construction of the code-book.

Now the remainder of this section is organized as follows. The code construction is in Appendix D.1. The proof of achievability is given in Appendix D.2.

D.1. Code Construction

 Since 𝑅_𝑒≤𝐻(𝑌∣𝑍), 𝑅_𝑒≤𝐻(𝐴∣𝑍), and 𝑅_𝑒≤𝑅≤𝐼(𝑈;𝑌), it is sufficient to show that the pair (𝑅,𝑅_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍),𝐼(𝑈;𝑌)} is achievable, and note that this implies that 𝑅≥𝑅_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍),𝐼(𝑈;𝑌)}.

We use the block Markov coding method. The random vectors 𝑈^𝑁, 𝐴^𝑁, 𝑆^𝑁, 𝑋^𝑁, 𝑌^𝑁, and 𝑍^𝑁 consist of 𝑛 blocks of length 𝑁. The message for 𝑛 blocks is 𝑊^𝑛≜(𝑊₂,𝑊₃,…,𝑊_𝑛), where 𝑊_𝑖 (2≤𝑖≤𝑛) are i.i.d. random variables uniformly distributed over 𝒲. Note that, in the first block, there is no 𝑊₁.

Let 𝑍_𝑖 (1≤𝑖≤𝑛) be the output of the wiretap channel for block 𝑖, 𝑍^𝑛=(𝑍₁,…,𝑍_𝑛), 𝑍^𝑗=(𝑍₁,…,𝑍_𝑗−1,𝑍_𝑗+1,…,𝑍_𝑛)  (1≤𝑗≤𝑛). Similarly, 𝑌^𝑛=(𝑌₁,…,𝑌_𝑛) and 𝑌_𝑖 (1≤𝑖≤𝑛) are the output of the main channel for block 𝑖. The specific values of the above random vectors are denoted by lowercase letters.

Given a pair (𝑅,𝑅_𝑒), choose a joint probability mass function 𝑝_{𝑈,𝐴,𝑆,𝑋,𝑌,𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧) such that 0≤𝑅_𝑒(),𝑅≤𝑅,𝑅≤𝐼𝑈;𝑌_𝑒=min{𝐻(𝑌∣𝑍),𝐻(𝐴∣𝑍)}. (D.1) The message set 𝒲 satisfies the following condition: lim_𝑁→∞1𝑁log‖𝒲‖=𝑅=𝐼(𝑈;𝑌)−𝛾, (D.2) where 𝛾 is a fixed positive real numbers.

Code-book generation:

(i) Construction of 𝐴^𝑁 and 𝑆^𝑁.  In the first block, generate a i.i.d. sequence 𝑎^𝑁 according to the probability mass function 𝑝_𝐴(𝑎), and choose it as the output of the action encoder. Let 𝑠^𝑁 be the state sequence generated in response to the chosen action sequence 𝑎^𝑁.

For the 𝑖th block (2≤𝑖≤𝑛), generate 2^𝑁𝑅 i.i.d. sequences 𝑎^𝑁, according to the probability mass function 𝑝_𝐴(𝑎). Index each sequence by 𝑖∈{1,2,…,2^𝑁𝑅}. For a given message 𝑤_𝑖 (𝑤_𝑖∈𝒲), choose a corresponding 𝑎^𝑁(𝑤_𝑖) as the output of the action encoder. Let 𝑠^𝑁 be the state sequence generated in response to the action sequence 𝑎^𝑁(𝑤_𝑖).

(ii) Construction of the Secret Key.  For the 𝑖th block (2≤𝑖≤𝑛), firstly we generate a mapping 𝑔_𝑓∶𝒴^𝑁→𝒲 (note that ‖𝒴‖^𝑁≥‖𝒲‖). Define a random variable 𝐾_𝑖=𝑔_𝑓(𝑌_𝑖−1) (2≤𝑖≤𝑛), which is uniformly distributed over 𝒲, and 𝐾_𝑖 is independent of 𝑊_𝑖. Reveal the mapping 𝑔_𝑓 to both receivers and the transmitter.

Then, when the transmitter receives the output 𝑦_𝑖−1 of the 𝑖-1th block, he computes 𝑘_𝑖=𝑔_𝑓(𝑦_𝑖−1)∈𝒲 as the secret key used in the 𝑖th block.

(iii) Construction of 𝑈^𝑁.  In the first block, for the transmitted action sequence 𝑎^𝑁 and the corresponding state sequence 𝑠^𝑁, generate a i.i.d. sequence 𝑢^𝑁 according to the probability mass function 𝑝_{𝑈∣𝐴,𝑆}(𝑢_𝑖∣𝑎_𝑖,𝑠_𝑖). Choose 𝑢^𝑁 as a realization of 𝑈^𝑁 for the first block.

For the 𝑖th block (2≤𝑖≤𝑛), given the transmitted action sequence 𝑎^𝑁(𝑤_𝑖) and the corresponding state sequence 𝑠^𝑁, generate 2^𝑁𝑅 i.i.d. sequences 𝑢^𝑁, according to the probability mass function 𝑝_{𝑈∣𝐴,𝑆}(𝑢_𝑖∣𝑎_𝑖(𝑤_𝑖),𝑠_𝑖). Index each sequence by 𝑖∈{1,2,…,2^𝑁𝑅}.

For a given 𝑤_𝑖 and a secret key 𝑘_𝑖, the transmitter chooses a sequence 𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖) (where ⊕ is the modulo addition over 𝒲) to transmit.

(iv) Construction of 𝑋^𝑁. For each block, the 𝑥^𝑁 is generated according to a new discrete memoryless channel (DMC) with inputs 𝑢^𝑁, 𝑠^𝑁, and output 𝑥^𝑁. The transition probability of this new DMC is 𝑝_{𝑋∣𝑈,𝑆}(𝑥∣𝑢,𝑠), which is obtained from the joint probability mass function 𝑝_{𝑈,𝐴,𝑆,𝑋,𝑌,𝑍}(𝑢,𝑎,𝑠,𝑥,𝑦,𝑧).

The probability 𝑝_{𝑋𝑁∣𝑈𝑁,𝑆𝑁}(𝑥^𝑁∣𝑢^𝑁,𝑠^𝑁) is calculated as follows: 𝑝_{𝑋𝑁∣𝑈𝑁,𝑆𝑁}𝑥^𝑁∣𝑢^𝑁,𝑠^𝑁=^𝑁_𝑖=1𝑝_{𝑋∣𝑈,𝑆}𝑥_𝑖∣𝑢_𝑖,𝑠_𝑖. (D.3)

Decoding. For the 𝑖th block (2≤𝑖≤𝑛), given a vector 𝑦^𝑁∈𝒴^𝑁 and a secret key 𝑘_𝑖 (𝑘_𝑖 is known by the receiver), try to find a sequence 𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖) such that (𝑢^𝑁(𝑤_𝑖⊕𝑘_𝑖),𝑦^𝑁)∈𝑇^𝑁_𝑈𝑌(𝜖₃). If there exist sequences with the same 𝑤_𝑖⊕𝑘_𝑖, by using the secret key 𝑘_𝑖, put out the corresponding 𝑤_𝑖. Otherwise, that is, if no such sequence exists or multiple sequences have different message indices, declare a decoding error.

D.2. Proof of Achievability

 The proof of achievability for Theorem 9 is along the lines of that for Theorem 6, and, therefore, we omit the proof here.

The proof of Theorem 9 is completed.

E. Proof of the Converse Part of Theorem 9

In this section, we prove Theorem 9: all the achievable (𝑅,𝑅_𝑒) pairs are contained in the set ℛ^(𝑐). Suppose that (𝑅,𝑅_𝑒) is achievable; that is, for any given 𝜖>0, there exists a channel encoder-decoder (𝑁,Δ,𝑃_𝑒) such that lim_𝑁→∞log‖𝒲‖𝑁=𝑅,lim_𝑁→∞Δ≥𝑅_𝑒,𝑃_𝑒≤𝜖. (E.1) Then we will show the existence of random variables (𝐴,𝑈)→(𝑋,𝑆)→𝑌→𝑍 such that 0≤𝑅_𝑒(),𝑅≤𝑅,𝑅≤𝐼𝑈;𝑌_𝑒(),𝑅≤𝐻𝑌∣𝑍_𝑒≤𝐻(𝐴∣𝑍). (E.2)(E.3)(E.4)(E.5)

Since 𝑊 is uniformly distributed over 𝒲, we have 𝐻(𝑊)=log‖𝒲‖. The formulas (E.3), (E.4), and (E.5) are proved by Lemma  E.1; see the following.

Lemma  E.1.  The random vectors 𝑌^𝑁 and 𝑍^𝑁 and the random variables 𝑊, 𝑋, 𝑈, 𝑆, 𝐴, 𝑌, and 𝑍 of Theorem 9 satisfy 1𝑁𝐻(𝑊)()+1≤𝐼𝑈;𝑌𝑁𝛿𝑃_𝑒,1𝑁𝐻𝑊∣𝑍^𝑁()+1≤𝐻𝑌∣𝑍𝑁𝛿𝑃_𝑒,1𝑁𝐻𝑊∣𝑍^𝑁≤𝐻(𝐴∣𝑍), (E.6)(E.7)(E.8) where 𝛿(𝑃_𝑒)=ℎ(𝑃_𝑒)+𝑃_𝑒log(∣𝒲∣−1). Note that ℎ(𝑃_𝑒)=−𝑃_𝑒log𝑃_𝑒−(1−𝑃_𝑒)log(1−𝑃_𝑒).

Substituting 𝐻(𝑊)=log‖𝒲‖ and (5) into (E.6), (E.7), and (E.8) and using the fact that 𝜖→0, the formulas (E.3), (E.4), and (E.5) are obtained. The formula (E.2) is from 𝑅_𝑒≤lim_𝑁→∞Δ=lim_𝑁→∞1𝑁𝐻𝑊∣𝑍^𝑁≤lim_𝑁→∞1𝑁𝐻(𝑊)=𝑅. (E.9)

It remains to prove Lemma  E.1; see the following.

Proof of Lemma  E.1. The formula (E.6) follows from (E.10), (E.13), and (E.17). The formula (E.7) is from (E.11), (E.14), and (E.18). The formula (E.8) is proved by (E.12), (E.15), and (E.19).

Part (i). We begin with the left parts of the inequalities (E.6), (E.7), and (E.8); see the following.

Since 𝑊→𝑌^𝑁→𝑍^𝑁 is a Markov chain, for the message 𝑊, we have 1𝑁𝐻(𝑊)=1𝑁𝐻𝑊∣𝑌^𝑁+1𝑁𝐼𝑌^𝑁≤;𝑊_(𝑎)1𝑁𝛿𝑃_𝑒+1𝑁𝐼𝑌^𝑁;𝑊. (E.10) For the equivocation to the wiretapper, we have 1𝑁𝐻𝑊∣𝑍^𝑁=^(𝑏)1𝑁𝐻𝑊∣𝑍^𝑁+𝛿𝑃_𝑒−𝐻𝑊∣𝑍^𝑁,𝑌^𝑁=1𝑁𝐼𝑊;𝑌^𝑁∣𝑍^𝑁+𝛿𝑃_𝑒≤1𝑁𝐻𝑌^𝑁∣𝑍^𝑁+𝛿𝑃_𝑒,1𝑁𝐻𝑊∣𝑍^𝑁=1𝑁𝐻𝐴^𝑁∣𝑍^𝑁. (E.11)(E.12)

Note that (𝑎) and (𝑏) follow from Fano’s inequality, and (E.12) is from the fact that 𝐴^𝑁 is a deterministic function of 𝑊.

Part (ii). By using chain rule, the character 𝐼(𝑌^𝑁;𝑊) in formulas (E.10) and (E.11) can be bounded as follows: 1𝑁𝐼𝑌^𝑁=1;𝑊𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊∣𝑌^𝑖−1≤1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊,𝑌^𝑖−1≤1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊,𝑌^𝑖−1,𝑆^𝑖−1. (E.13)

Part (iii). Similar to (E.13), the character 𝐼(𝑊;𝑍^𝑁) in formula (E.11) can be rewritten as follows: 1𝑁𝐻𝑌^𝑁∣𝑍^𝑁=1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑌^𝑖−1,𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑍_𝑖. (E.14)

Part (iv). The character 𝐻(𝐴^𝑁∣𝑍^𝑁) in formula (E.12) can be rewritten as follows: 1𝑁𝐻𝐴^𝑁∣𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝐴_𝑖∣𝑍_𝑖. (E.15)

Part (v) (single letter). To complete the proof, we introduce a random variable 𝐽, which is independent of 𝑊, 𝐴^𝑁, 𝑋^𝑁, 𝑆^𝑁, 𝑌^𝑁, and 𝑍^𝑁. Furthermore, 𝐽 is uniformly distributed over {1,2,…,𝑁}. Define 𝑈=𝑊,𝑌^𝐽−1,𝑆^𝐽−1,𝐽,𝑋=𝑋_𝐽,𝑌=𝑌_𝐽,𝑍=𝑍_𝐽,𝑆=𝑆_𝐽,𝐴=𝐴_𝐽. (E.16)

Part (vi). Then (E.13) can be rewritten as 1𝑁𝐼𝑊;𝑌^𝑁≤1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊,𝑌^𝑖−1,𝑆^𝑖−1=1𝑁^𝑁_𝑖=1𝐼𝑌_𝑖;𝑊,𝑌^𝑖−1,𝑆^𝑖−1𝑌∣𝐽=𝑖=𝐼_𝐽;𝑊,𝑌^𝐽−1,𝑆^𝐽−1𝑌∣𝐽≤𝐼_𝐽;𝑊,𝑌^𝐽−1,𝑆^𝐽−1().,𝐽=𝐼𝑈;𝑌 (E.17) Analogously, (E.14) is rewritten as follows: 1𝑁𝐻𝑌^𝑁∣𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑍_𝑖=1𝑁^𝑁_𝑖=1𝐻𝑌_𝑖∣𝑍_𝑖𝑌,𝐽=𝑖=𝐻_𝐽∣𝑍_𝐽().,𝐽≤𝐻𝑌∣𝑍 (E.18) Similarly, (E.15) can be rewritten as follows, 1𝑁𝐻𝐴^𝑁∣𝑍^𝑁≤1𝑁^𝑁_𝑖=1𝐻𝐴_𝑖∣𝑍_𝑖=1𝑁^𝑁_𝑖=1𝐻𝐴_𝑖∣𝑍_𝑖𝐴,𝐽=𝑖=𝐻_𝐽∣𝑍_𝐽𝐴,𝐽≤𝐻_𝐽∣𝑍_𝐽=𝐻(𝐴∣𝑍). (E.19) Substituting (E.17), (E.18), and (E.19) into (E.10), (E.11), and (E.12), Lemma  E.1 is proved.

The proof of Theorem 9 is completed.

Acknowledgments

The authors would like to thank Professor N. Cai for his help to improve this paper. This work was supported by a subproject in National Basic Research Program of China under Grant 2012CB316100 on Broadband Mobile Communications at High Speeds, the National Natural Science Foundation of China under Grant 61271222, and the Research Fund for the Doctoral Program of Higher Education of China (no. 20100073110016).