Secure Polar Coding for the Primitive Relay Wiretap Channel

Abstract

With the emergence of wireless networks, cooperation for secrecy is recognized as an attractive way to establish secure communications. Departing from cryptographic techniques, secrecy can be provided by exploiting the wireless channel characteristics; that is, some error-correcting codes besides reliability have been shown to achieve information-theoretic security. In this paper, we propose a polar-coding-based technique for the primitive relay wiretap channel and show that this technique is suitable to provide information-theoretic security. Specifically, we integrate at the relay an additional functionality, which allows it to smartly decide whether it will cooperate or not based on the decoding detector result. In the case of cooperation, the relay operates in a decode-and-forward mode and assists the communication by transmitting a complementary message to the destination in order to correctly decode the initial source’s message. Otherwise, the communication is completed with direct transmission from source to the destination. Finally, we first prove that the proposed encoding scheme achieves weak secrecy, then, in order to overcome the obstacle of misaligned bits, we implement a double-chaining construction, which achieves strong secrecy.

1. Introduction

The wiretap channel, introduced by A. Wyner in his seminal work [1], paved the way for the exploitation of the channel medium characteristics in terms of information-theoretic security. This approach has the major advantage that security does not rely on any shared secret key, i.e., keyless security. In view of the emergence of wireless communication and massive connectivity, this benefit has led to a rich literature, which investigates several channel models towards the design of low-complexity coding schemes for both reliability and secrecy.

After van der Meulen’s introduction of the relay channel in [2] and the extension of the work of Cover and El Gamal in [3], cooperative diversity is considered as an important advancement in wireless networks, since it can achieve higher rates in comparison to direct transmission. In practice, a network may be comprised with illegitimate users; cooperation between trusted users has been exploited as a way to establish secure communication. The rate-equivocation region was characterized in [4,5] for a four-terminal relay channel and an eavesdropper under several cooperation protocols. Half-duplex relay channel models are considered in [6], where the authors studied coding techniques for the relay channel with orthogonal components (primitive relay channel). The secrecy capacity for this class of channels was investigated in [7] for the binary-input discrete memoryless channel (B-DMC) and the Gaussian case. Although the importance of cooperation for reliability and security in large networks is well established, the aforementioned works presented bounds on the secrecy capacity while relying on random coding arguments. Undoubtedly, designing codes for these type of channels is of great importance as the evolution of networks require security solutions with low consumption and complexity.

Since the pioneering work of Arikan on the polar codes [8], which are capacity-achieving for the symmetric B-DMC, several polar coding schemes have been proposed to fulfill the secrecy requirement. These codes are constructed based on the phenomenon of channel polarization, that is, the channel is split into N “bit-channels”, which tend to be either error-free or fully noisy channels as N grows. This result is the basic tool in designing a polar coding scheme, which satisfies both reliability and secrecy conditions. In [9], a scheme for the degraded wiretap channel that meets the requirement for weak secrecy was proposed; in [10], the authors used a different partition of the index set to develop a scheme for strong secrecy. Under this framework, several coding schemes for multiuser channels have been investigated in [11,12,13]. However, although in the open literature there are some applications of polar codes without security constraints for the relay channel [14,15,16,17,18], the investigation of whether polar codes are suitable for the relay wiretap scenario has drawn little attention. Finally, the authors in [19] proposed a coding scheme capable of achieving weak secrecy for the relay-eavesdropper channel, whereas in [20], the proposed polar coding scheme guarantees strong secrecy for the case of symmetric channels and under the assumption that the eavesdropper’s channel is degraded. Note that the natural nested structure of polar codes and their low encoding/decoding complexity identify them as a promising choice for the practical implementation of merging coding and security into one scheme.

1.1. Related Work and Contributions

Since the introduction of the chaining technique [21] for polar codes, several explicit and efficient coding schemes for different information-theoretic models have been proposed. The work of [10] introduced the polar coding chaining construction in order to provide strong secrecy for the symmetric and degraded point-to-point wiretap channel. Later on, a polar code technique for asymmetric models was proposed in [22] and, along with the chaining construction, were the basic tools used to prove the secrecy capacity achievability of general wiretap channels. Specifically, in [12], the authors considered the chaining technique to deal with the nondegraded wiretap channel by artificially constructing the subset property and polar coding for asymmetric models to prove that polar codes achieve secrecy capacity in general. However, they considered only the weak secrecy case. Concurrently, refs. [11,13] developed a polar coding scheme for the general broadcast wiretap channel relying on different approaches. While both works considered the strong secrecy criterion, the first drew parallels between the achievability proof through output statistic of random binning and their proposed encoding scheme and avoided using randomized decisions during the encoding and decoding procedures ([23], Theorem 3), while the latter relied on shared random mappings ([22], Theorem 3) that may require exponential storage complexity. Recently, the authors of [24] extended the scheme of [13] by considering a more general model, in which the transmitter sends common and confidential messages over a broadcast wiretap channel. In their scheme, a new chaining construction is proposed to deal with the common information transmission.

Motivated by the above, in this paper, we consider the primitive relay wiretap channel and propose polar coding schemes based on different coordinate partitions. We prove that these schemes satisfy weak and strong secrecy requirements, while simultaneously guarantee a low probability of error at the legitimate receiver. Specifically, by careful partitioning of the coordinates, we first improve the analysis of [19] for the case of weak secrecy in a single transmission block. Then, we propose a new encoding algorithm under the strong secrecy criterion. In particular, we consider the general primitive relay wiretap channel, without assuming degradedness or symmetric channels as in [20]. The scheme utilizes previous polar coding techniques using the minimum rate of shared randomness and relies on both choosing the coordinate partitions properly and a transmission protocol that divides the communication into multiple blocks. Due to the nature of the channel under consideration, a new double-chaining construction is designed in order to satisfy the stronger secrecy requirement. Finally, an additional functionality is considered at the relay node; using the results from [15], the relay possesses a detector deciding if the result is erroneous or not and, based on that, discards it or cooperates in decode-and-forward (DF) mode.

1.2. Structure

The rest of the paper is organized as follows. In Section 2, some preliminaries on polar codes and the basic concept of the proposed scheme are introduced. The system model and the constraints in designing the coding scheme are presented in Section 3, followed by the main results of this paper; the encoding schemes for weak and strong secrecy and the analysis of reliability and security are presented in Section 4. Finally, Section 5 concludes the paper.

2. Polar Codes and the Relay Channel

2.1. Some Fundamentals on Polar Coding

We consider a binary-input channel with input alphabet $\mathcal{X}$, output alphabet $\mathcal{Y}$, and the conditional probability distribution $W_{X|Y}(·|·)$, with capacity $C\left(W\right)={max}_{P_X}I(X;Y)$. The symmetric capacity $I\left(W\right)$ is the value of mutual information $I(X;Y)$ when X is uniformly distributed. Moreover, if W is symmetric, then $I\left(W\right)=C\left(W\right)$.

The Bhattacharyya parameter of the channel W is defined as

$$Z\left(W\right)=\sum _{y\in \mathcal{Y}}\sqrt{W_{X|Y}\left(0\right|y)W_{Y|X}\left(y\right|1)}.$$

(1)

For length $N=2^n$ with $n\in \mathbb{N}$, let $G_N=B_N{F}^{\otimes n}$ be the polarizing matrix, where $B_N$ is the bit-reversal mapping, $F=\left[\begin{array}{cc}1& 0\\ 1& 1\end{array}\right]$ and $F^{\otimes n}$ denote the nth Kronecker power of F. By applying transformation $G_N$ to N bits $u_1^N$ and sending it through N independent uses of a B-DMC $W:X\to Y$, thus, an N-dimensional channel is created, defined by

$$W_N^{\left(i\right)}(y_1^N,u_1^{i-1}|u_i)=\frac{1}{2^{N-1}}\sum _{u_{i+1}^N\in {\{0,1\}}^{N-i}}{W}_N\left(y_1^N\right|u_1^N),$$

(2)

where $W_N^{\left(i\right)}$ denotes the i-th bit-channel created by synthesizing N uses of the channel W. As N grows, $W_N^{\left(i\right)}$ approaches either an error-free or a completely noisy channel. The idea is to transmit information only over the “good” channels while keeping the inputs of “bad” channels fixed and known to all parties. Thus, the N bit-channels are partitioned into “good” channels ${\mathcal{G}}_N\left(W\right)$ and “bad” channels ${\mathcal{B}}_N\left(W\right)$ based on the value of their Bhattacharyya parameter.

$$\begin{array}{cc}\hfill {\mathcal{G}}_N\left(W\right)& =\{i\in \left[N\right]:Z\left(W_N^{\left(i\right)}\right)\le {\delta }_N\}\hfill \\ \hfill {\mathcal{B}}_N\left(W\right)& =\{i\in \left[N\right]:Z\left(W_N^{\left(i\right)}\right)\ge 1-{\delta }_N\},\hfill \end{array}$$

(3)

where $\left[N\right]=\{1,2,\dots ,N\}$, ${\delta }_N=2^{-N^{\beta }}$ with $0<\beta <1/2$ and $Z\left(W_N^{\left(i\right)}\right)$ is the Bhattacharyya parameter of channel $W_N^{\left(i\right)}$. It has been shown [25,26] that for any symmetric binary-input channel W and for any $\beta <1/2$,

$$\begin{array}{cc}\hfill \underset{N\to \infty }{lim}=\frac{{\mathcal{G}}_N\left(W\right)}{N}& =C\left(W\right)\hfill \\ \hfill \underset{N\to \infty }{lim}=\frac{{\mathcal{B}}_N\left(W\right)}{N}& =1-C\left(W\right).\hfill \end{array}$$

(4)

Based on the above, we can transmit a message of $k=|{\mathcal{G}}_N\left(W\right)|$ bits, which is written in the bits $u_i$, $i\in {\mathcal{G}}_N\left(W\right)$ and the rest $N-k$ bits of $u_1^N$ are frozen and set to 0. Thus, a code word $x_1^N=u_1^N{G}_N$ is sent over the channel. On the other side, the received sequence $y_1^N$ can be decoded by finding an estimate of $u_1^N$ by computing the values ${\widehat{u}}_i$, $i\in \left[N\right]$ based on the following successive cancellation (SC) rule:

$${\widehat{u}}_i=\left\{\begin{array}{cc}0,\hfill & \mathrm{if}\frac{W_N^{\left(i\right)}(y_1^N,{\widehat{u}}_1^{i-1}|0)}{W_N^{\left(i\right)}(y_1^N,{\widehat{u}}_1^{i-1}|1)}\ge 1\mathrm{and}i\in {\mathcal{G}}_N\left(W\right)\hfill \\ 0,\hfill & \mathrm{if}i\in {\mathcal{B}}_N\left(W\right)\hfill \\ 1,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(5)

Using this decoding rule [8,25], we can upper bound the error probability

$$P_e\le \sum _{i\in {\mathcal{G}}_N\left(W\right)}Z\left(W_N^{\left(i\right)}\right)\le {\delta }_N,$$

(6)

where $\beta \in (0,1/2)$.

2.2. Bounds and Nested Structure

In this paper, one of the main characteristics of the proposed coding scheme is the nested structure of the polar codes. Next, we briefly explain this structure and its usage for binning in multiterminal communication scenarios. In particular, the authors in [14] designed a coding scheme for the three-terminal stochastically degraded relay channel with orthogonal receivers. First however, let us review the capacity bounds of the relay channel.

It is well-known that a bound for the capacity of the general relay channel is given by the cut-set upper bound [3]

$$C\le \underset{P_X,P_{X_R}}{max}min\{I(X;Y_{SR}{Y}_{SD}),I(X;Y_{SD})+I(X_R;Y_{RD})\},$$

(7)

and for the primitive relay channel, the DF lower bound reduces to [6]

$$R^{DF}=\underset{P_X}{max}min\{I(X;Y_{SR}),I(X;Y_{SD})+I(X_R;Y_{RD})\}.$$

(8)

Next, we briefly describe the nested structure of polar codes proposed in [14] for DF relaying, which, for any rate $R<R^{DF}$, there exists a sequence of polar codes with a vanishing probability of error at the destination. The following Lemma from [27] is used to exploit the nested nature of polar codes.

Lemma 1.

Let Q and V be BSM channels such that Q is degraded with respect to V. Further, let $Q_1,\dots Q_i$ and $V_1,\dots V_i$ denote the N corresponding bit-channels. Then, $Q_i$ is degraded with respect to $V_i$, that is, $I\left(Q_i\right)\le I\left(V_i\right)$ and $Z\left(Q_i\right)\ge Z\left(V_i\right)$.

From the above lemma, it follows directly that if the channel Q is degraded with respect to V, the set of good channels for Q is a subset of the set of good channels of V, i.e., for all constants $\beta$, we have ${\mathcal{G}}_N\left(Q\right)\subseteq {\mathcal{G}}_N\left(V\right)$. Degradation implies that a channel is better than another one. The primitive relay channel is said to be degraded when the source-destination link is worse than that between source and relay. The encoding process starts at the source when a rate $R<I\left(W_{SR}\right)$ is chosen and a capacity-achieving polar code for the channel $W_{SR}$ is used. We define ${\mathcal{G}}_{SR}$ and ${\mathcal{B}}_{SR}$ as in (3) for channel $W_{SR}$ as the information and frozen set, respectively. Let $\mathbf{M}$ contain the information and the frozen bits transmitted by the source. Moreover, the bits $m_i$, $i\in {\mathcal{G}}_{SR}$ carry the message and $m_i$, $i\in {\mathcal{B}}_{SR}$ are the frozen bits, which are known to the relay and the destination prior to transmission. As shown in Figure 1, the destination cannot decode this sequence in its entirety due to its degraded channel. So, we also select a set of indices for direct communication over $W_{SD}$ and define ${\mathcal{G}}_{SD}$ and ${\mathcal{B}}_{SD}$ similarly. From Lemma 1, it holds that ${\mathcal{G}}_{SD}\subseteq {\mathcal{G}}_{SR}$, as $W_{SD}$ is degraded compared to $W_{SR}$, i.e., the decoder at the destination knows the values of the symbols $m_i$, $i\in {\mathcal{G}}_{SD}\cup {\mathcal{G}}_{SR}$ and in order to employ SC decoding, the relay must forward the information $m_i$, $i\in {\mathcal{G}}_{SR}\cup {\mathcal{B}}_{SD}$.

2.3. Smart Relaying

It has been shown in [15] that by providing the relay with a simple error detector, we can significantly improve the error performance by letting the decoder at the relay select whether it will cooperate or not. We consider a DF cooperative transmission, where the message is encoded by using the nested polar coding scheme of Section 2.2. The relay carries a detector for erroneous decoding, i.e., if the likelihood ratio is less than a threshold, then the relay discards the decoded result and does not transmit to the destination, otherwise, the communication takes place under the assistance of the relay node.

We consider a threshold s for the relay decoder and the log-likelihood ratio (LLR) as defined for the successive decoding process [8]:

$$L_N^{\left(i\right)}(y_1^N,{\widehat{u}}_1^{i-1})=log\frac{W_N^{\left(i\right)}(y_1^N,{\widehat{u}}_1^{i-1}|0)}{W_N^{\left(i\right)}(y_1^N,{\widehat{u}}_1^{i-1}|1)},$$

(9)

where the decoder decides based on the rule in (5). A flag F is used to determine if the decoding result will be discarded or not according to

$$F=\left\{\begin{array}{cc}0,\hfill & \mathrm{if}-s\le L_N^{\left(i\right)}(y_1^N,{\widehat{u}}_1^{i-1})\le s\hfill \\ 1,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(10)

The above procedure does not introduce any additional complexity during the relay’s decoding, thus, this functionality improves the error probability of the overall communication for free. In the next section, we bind together the smart relaying and the exploitation of the nested structure of polar codes to design a scheme that satisfies secrecy and reliability requirements for the primitive relay channel in the presence of an eavesdropper.

3. System Model and Requirements

In this section, we describe the primitive relay wiretap channel and set the goals of our encoding scheme; reliability and secrecy. Then, we present the architecture of the proposed communication model with the smart error detector at the relay.

3.1. The Relay Wiretap Channel

The relay wiretap channel models a multihop transmission scheme, where a relay cooperates with the source to communicate with the destination in the presence of an eavesdropper. We consider a four-terminal B-DMC with orthogonal receiver components, with the transition probability mass function

$$p(y,y_{sr},z|x_s,x_r)=p(y_{sd},y_{sr},z_{se}|x_s)p(y_{rd},z_{re}|x_r).$$

(11)

In this model, ${\mathcal{X}}_S$ and ${\mathcal{X}}_R$ are the channel inputs from the source and relay, respectively, while $\mathcal{Y}$, ${\mathcal{Y}}_{SR}$, and $\mathcal{Z}$ are the channel outputs at the destination, relay, and eavesdropper, respectively. The observation vectors at the destination’s and eavesdropper’s output are $\mathbf{Y}=(Y_{SD},Y_{RD})$ and $\mathbf{Z}=(Z_{SE},Z_{RE})$, respectively. Figure 2 illustrates the channel, which consists of a source, a relay, the legitimate receiver, and the eavesdropper. The source wishes to reliably communicate a message $\mathbf{M}$ with the legitimate receiver under the assistance of a trusted relay while keeping it safe from the eavesdropper. The transmission takes place in two stages as follows:

• In the first stage, the Source encodes a message $\mathbf{M}$ into a code word ${\mathbf{X}}_S$ and broadcasts it to the destination and relay.
• In the second stage, the Relay first decodes the $Y_{SR}$ and obtains ${\widehat{\mathbf{M}}}_R$, then re-encodes it and transmits ${\mathbf{X}}_R$ to the destination.
• The Destination combines the two observations to produce an estimate $\widehat{\mathbf{M}}$ of the original message.
• The Eavesdropper observes $\mathbf{Z}=(Z_{SE},Z_{RE})$ during both transmissions.

3.2. Coding Requirements

We aim to design a coding scheme that satisfies both reliability and secrecy requirements. Probability of error is used to quantify the reliability of the scheme, where the goal is to satisfy

$$\underset{N\to \infty }{lim}Pr\{\mathbf{M}\ne \widehat{\mathbf{M}}\}=0.$$

(12)

To measure the statistical independence between the message transmitted and eavesdropper observation, we use the following metrics:

$$\begin{array}{cc}\hfill \underset{N\to \infty }{lim}\frac{I(\mathbf{M};\mathbf{Z})}{N}& =0,\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill \underset{N\to \infty }{lim}I(\mathbf{M};\mathbf{Z})& =0.\hfill \end{array}$$

(14)

In (13), security is measured in terms of the normalized mutual information between the transmitted message $\mathbf{M}$ and received vector by the eavesdropper $\mathbf{Z}$. The encoding scheme is designed to satisfy this requirement in order to operate with weak secrecy. However, as shown by Maurer in [28], it is too weak for cryptographic applications as it is possible for the eavesdropper to retrieve a considerable amount of information even if (13) is satisfied. As a solution, we can use a stronger metric, that is, the encoding scheme operates with strong secrecy if (14) is satisfied.

3.3. Architecture

Our model is very similar to that described in Section 3.1, where in order to enjoy the benefits of smart relaying, we add an error detector at the relay. This allows the relay to select whether it is beneficial to cooperate with the source or not. As illustrated in Figure 3, the relay operates based on the detector result, i.e., if $F=0$, the relay discards the decoding result and the communication is completed via direct transmission from source to the destination. In this case, the secure polar coding scheme of [9] or [10] for the classic wiretap channel can be used. On the other hand, if $F=1$, the communication is assisted by the DF relay and the designing of such a coding scheme for reliability and secrecy is proposed in this paper.

4. Polar Coding for Secrecy

In this section, we present the encoding scheme, which simultaneously satisfies the reliability and weak secrecy constraints for the model of Section 3.2. Then, we identify the difficulties to achieve strong secrecy and introduce a new construction that satisfies this condition by using a double-chaining technique.

4.1. Weak Secrecy

As already mentioned above, polarization results into noiseless and pure-noisy bit-channels. Having in mind that the system needs to meet only the reliability requirement, one shall fill the good channels with information bits and keep the value of the bad channels fixed. However, when a third unauthorized party eavesdrops the communication, the secrecy constraint must be satisfied. The idea behind coding for secrecy is to confuse the nonlegitimate user with random messages, so their observation is different from the real message. Utilizing polar codes, we can design a secure coding scheme by properly partitioning the bit-channels. First, in order to achieve reliability, we send the message over the good channels (low entropy) for the legitimate users and bad channels (high entropy) for the eavesdropper. To confuse the eavesdropper and secure the transmission, we choose to hide the message by sending random bits over the reliable channels. That is, the goal is to construct an encoding process that makes the communication reliable and secure simultaneously, i.e., satisfying conditions (12) and (13). For the relay wiretap channel and under the DF protocol, these conditions must be satisfied in both transmission stages.

First, as in (3), we define the following subset of indices:

$$\begin{array}{cc}\hfill {\mathcal{G}}_N\left(W_{kl}\right)& =\{i\in \left[N\right]:Z\left(W_N^{\left(i\right)}\right)\le {\delta }_N\}\hfill \\ \hfill {\mathcal{B}}_N\left(W_{kl}\right)& =\{i\in \left[N\right]:Z\left(W_N^{\left(i\right)}\right)\ge 1-{\delta }_N\},\hfill \end{array}$$

(15)

where $k\in \{S,R\}$ and $l\in \{R,D,E\}$, for $k\ne l$. Next, we partition the set $\left[N\right]$ based on [9] as follows:

$$\begin{array}{cc}\hfill {\mathcal{I}}_1& ={\mathcal{G}}_N\left(W_{SR}\right)\cap {\mathcal{B}}_N\left(W_{SE}\right)\hfill \\ \hfill {\mathcal{F}}_1& ={\mathcal{B}}_N\left(W_{SR}\right)\hfill \\ \hfill {\mathcal{R}}_1& ={\mathcal{G}}_N\left(W_{SE}\right).\hfill \end{array}$$

(16)

Encoding at source: We choose a rate $R<I\left(W_{SR}\right)$ and use the indices in ${\mathcal{G}}_N\left(W_{SR}\right)$ to encode the information and broadcast it to the relay and the destination. All parties know the values of frozen bits ${\mathcal{F}}_1$. We fill with random bits the indices in ${\mathcal{R}}_1$ in order to protect the message. The information is stored in the bits of set ${\mathcal{I}}_1$. However, due to Lemma 1, degradation implies that the destination cannot decode the whole information due to ${\mathcal{G}}_N\left(W_{SD}\right)\subseteq {\mathcal{G}}_N\left(W_{SR}\right)$, we distribute the message in ${\mathcal{I}}_1^{SD}={\mathcal{G}}_N\left(W_{SD}\right)\cap {\mathcal{B}}_N\left(W_{SE}\right)$ and ${\mathcal{I}}_1^{RD}={\mathcal{G}}_N\left(W_{SR}\right)\cap {\mathcal{B}}_N\left(W_{SD}\right)$, with ${\mathcal{I}}_1={\mathcal{I}}_1^{SD}\cup {\mathcal{I}}_1^{RD}$ (Figure 4). The message bits in ${\mathcal{I}}_1^{RD}$ must be provided by the relay during the second transmission using the following partition.

$$\begin{array}{cc}\hfill {\mathcal{I}}_2& ={\mathcal{G}}_N\left(W_{RD}\right)\cap {\mathcal{B}}_N\left(W_{RE}\right)\hfill \\ \hfill {\mathcal{F}}_2& ={\mathcal{B}}_N\left(W_{RD}\right)\hfill \\ \hfill {\mathcal{R}}_2& ={\mathcal{G}}_N\left(W_{RE}\right).\hfill \end{array}$$

(17)

• Processing at the relay: The relay using SC and the knowledge of frozen bits decodes the message transmitted by the source, then extracts and encodes the information bits with indices in ${\mathcal{I}}_1^{RD}$ and forwards them to the destination using a capacity-achieving polar code for $W_{RD}$ and partition (17). To protect this transmission, we again fill with random bits the indices in ${\mathcal{R}}_2$, the information bits are in the set ${\mathcal{I}}_2$ and the bits in ${\mathcal{F}}_2$ are frozen and known (Figure 5).

• Decoding at the destination: Having received $Y_{RD}$ and recovered the missing bits from the relay, the destination uses these bits in addition to the first observation $Y_{SD}$ and employs the SC algorithm to recover the source’s message.

Based on the above encoding and decoding process, we prove that the coding scheme satisfies both requirements (12) and (13).

4.1.1. Reliability Analysis

The reliability follows immediately from the design of the coding scheme and the results developed in [8]. Specifically, the low error probability claim must be satisfied for the relay and destination. First, since ${\mathcal{I}}_1\cup {\mathcal{R}}_1={\mathcal{G}}_N\left(W_{SR}\right)$, the error probability at the relay is upper bounded as

$$P_e^{SR}\le \sum _{i\in {\mathcal{I}}_1\cup {\mathcal{R}}_1}Z\left(W_{SR}^{\left(i\right)}\right)\le 2^{-N^{\beta }}.$$

(18)

The probability of error for the relay–destination transmission of the second time-slot, since ${\mathcal{I}}_2\cup {\mathcal{R}}_2={\mathcal{G}}_N\left(W_{RD}\right)$ by design, is upper bounded as

$$P_e^{RD}\le \sum _{i\in {\mathcal{I}}_2\cup {\mathcal{R}}_2}Z\left(W_{RD}^{\left(i\right)}\right)\le 2^{-N^{\beta }}.$$

(19)

The bits from the relay are then decoded by the destination and, together with the source’s transmission $Y_{SD}$, the original message is retrieved using the SC algorithm. Consequently, the overall error probability at the destination is upper bounded by

$$P_e\le \mathcal{O}\left(2^{-N^{\beta }}\right).$$

(20)

Moreover, we obtain the constraints on the transmission rate, i.e., $R<I\left(W_{SR}\right)$ and $R<I\left(W_{SD}\right)+I\left(W_{RD}\right)$, which yields the symmetric DF rate for relay channels $R^{DF}$.

4.1.2. Secrecy Analysis

Let us turn to the security analysis. Let $\mathbf{U}$ denote the intermediate vector constructed by the encoding process, with ${\mathbf{U}}_{\mathcal{I}}={\mathbf{U}}_{{\mathcal{I}}_1\cup {\mathcal{I}}_2}$, ${\mathbf{U}}_{\mathcal{R}}={\mathbf{U}}_{{\mathcal{R}}_1\cup {\mathcal{R}}_2}$, and ${\mathbf{U}}_{\mathcal{F}}={\mathbf{U}}_{{\mathcal{F}}_1\cup {\mathcal{F}}_2}=0$. Moreover, the source’s message $\mathbf{M}=({\mathbf{M}}_1,{\mathbf{M}}_2)$ and takes values in ${\{0,1\}}^{\left|\mathcal{I}\right|}$, with ${\mathbf{M}}_1$ and ${\mathbf{M}}_2$ denoting messages from the source and relay, respectively. We need to prove that the normalized mutual information, (13), between $\mathbf{M}$ and $\mathbf{Z}$ vanishes asymptotically. We evaluate the statistical independence between the message and eavesdropper’s observations using random frozen vector over all possible choices of frozen bits as follows:

$$\begin{array}{cc}\hfill I(\mathbf{M};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}})& =I({\mathbf{U}}_{\mathcal{I}};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}})\hfill \end{array}$$

(21)

$$\begin{array}{cc}\hfill & =I({\mathbf{U}}_{\mathcal{I}},{\mathbf{U}}_{\mathcal{R}};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}})-I({\mathbf{U}}_{\mathcal{R}};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill & =I(\mathbf{U};\mathbf{Z})-I({\mathbf{U}}_{\mathcal{R}};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill & =I(\mathbf{U};\mathbf{Z})-H\left({\mathbf{U}}_{\mathcal{R}}\right|{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})+H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(24)

$$\begin{array}{cc}\hfill & =I(\mathbf{U};\mathbf{Z})-H\left({\mathbf{U}}_{\mathcal{R}}\right)+H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(25)

$$\begin{array}{cc}\hfill & =I(\mathbf{U};\mathbf{Z})-\left|\mathcal{R}\right|+H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(26)

$$\begin{array}{cc}\hfill & \le N(I\left(W_{SE}\right)+I\left(W_{RE}\right))-\left|\mathcal{R}\right|+H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}}),\hfill \end{array}$$

(27)

where (22) is derived from the chain rule of mutual information and (23) is due to $I({\mathbf{U}}_{\mathcal{I}},{\mathbf{U}}_{\mathcal{R}};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}})=I({\mathbf{U}}_{\mathcal{I}},{\mathbf{U}}_{\mathcal{R}};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}})+I({\mathbf{U}}_{\mathcal{F}};\mathbf{Z})=I({\mathbf{U}}_{\mathcal{I}},{\mathbf{U}}_{\mathcal{R}},{\mathbf{U}}_{\mathcal{F}};\mathbf{Z})=I(\mathbf{U};\mathbf{Z})$ and that $I({\mathbf{U}}_{\mathcal{F}};\mathbf{Z})=0$. Consequently, (25) follows from the independence of ${\mathbf{U}}_{\mathcal{R}},{\mathbf{U}}_{\mathcal{F}}$, and ${\mathbf{U}}_{\mathcal{I}}$, while (27) is concluded by the fact that $I\left(W_{SE}\right)$ and $I\left(W_{RE}\right)$ are the capacity of $W_{SE}$ and $W_{RE}$, respectively, and the data processing inequality.

Examining (27), we observe that in order to upper bound the mutual information of (21), we need to find an upper bound for the entropy term $H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})$. Hence, we have the following lemma:

Lemma 2.

The conditional entropy is upper bounded as

$$H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\le h_2\left(2^{-N^{\beta }}\right)+\left|\mathcal{R}\right|2^{-N^{\beta }},$$

where $h_2(·)$ is the binary entropy function and $\left|\mathcal{R}\right|$ is the size of random vector ${\mathbf{U}}_{\mathcal{R}}$.

Proof. 

Let us assume that the eavesdropper has knowledge of ${\mathbf{U}}_{\mathcal{I}}$ in addition to $\mathbf{Z}$ and the frozen bits. Therefore, the eavesdropper can compute an estimate of ${\widehat{\mathbf{U}}}_{\mathcal{R}}$ (since $\mathcal{R}$ is transmitted via the good channels ${\mathcal{G}}_N\left(W_{SE}\right)$ and ${\mathcal{G}}_N\left(W_{RE}\right)$), by using the SC algorithm with

$$\begin{array}{c}\hfill P_e^{Eve}=\mathbb{P}[{\widehat{\mathbf{U}}}_{\mathcal{R}}\ne {\mathbf{U}}_{\mathcal{R}}]\le \sum _{i\in \mathcal{R}}\left(Z\left(W_{SE}^{\left(i\right)}\right)+Z\left(W_{RE}^{\left(i\right)}\right)\right)\le 2^{-N^{\beta }}.\end{array}$$

(28)

We then introduce a random variable E for the error as follows:

$$\begin{array}{c}\hfill E=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}{\widehat{\mathbf{U}}}_{\mathcal{R}}\ne {\mathbf{U}}_{\mathcal{R}}\hfill \\ 0,\hfill & \mathrm{if}{\widehat{\mathbf{U}}}_{\mathcal{R}}={\mathbf{U}}_{\mathcal{R}},\hfill \end{array}\right.\end{array}$$

(29)

and we derive the following

$$\begin{array}{cc}\hfill H(E,{\mathbf{U}}_{\mathcal{R}}|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})& =H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})+H\left(E\right|{\mathbf{U}}_{\mathcal{R}},\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(30)

$$\begin{array}{cc}\hfill & =H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}}),\hfill \end{array}$$

(31)

since the second entropy term in (30) equals zero. Moreover, note that

$$\begin{array}{cc}\hfill H(E,{\mathbf{U}}_{\mathcal{R}}|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})& =H\left({\mathbf{U}}_{\mathcal{R}}\right|E,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})+H\left(E\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(32)

$$\begin{array}{cc}\hfill & \le H\left({\mathbf{U}}_{\mathcal{R}}\right|E,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})+H\left(E\right),\hfill \end{array}$$

(33)

since the second entropy term in (32) can be upper bounded by $H\left(E\right)=H\left(P_e^{Eve}\right)$. Thus, from (31) and (33), we get

$$\begin{array}{cc}\hfill H\left({\mathbf{U}}_{\mathcal{R}}\right|\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})& \le H\left({\mathbf{U}}_{\mathcal{R}}\right|E,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})+H\left(\mathbb{E}\right)\hfill \\ \hfill & =\mathbb{P}[E=0]H\left({\mathbf{U}}_{\mathcal{R}}\right|E=0,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\hfill \end{array}$$

(34)

$$\begin{array}{c}\hfill +\mathbb{P}[E=1]H\left({\mathbf{U}}_{\mathcal{R}}\right|E=1,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})+H\left(P_e^{Eve}\right)\end{array}$$

(35)

$$\begin{array}{cc}\hfill & \le P_e^{Eve}\left|\mathcal{R}\right|+H\left(P_e^{Eve}\right),\hfill \end{array}$$

(36)

where (36) is because $H\left({\mathbf{U}}_{\mathcal{R}}\right|E=0,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})=0$ and $H\left({\mathbf{U}}_{\mathcal{R}}\right|E=1,\mathbf{Z},{\mathbf{U}}_{\mathcal{F}},{\mathbf{U}}_{\mathcal{I}})\le H\left({\mathbf{U}}_{\mathcal{R}}\right)=\left|\mathcal{R}\right|$. Rearranging (36) and using (28), we get the desired upper bound and the proof is completed. □

Finally, considering Lemma 2 and (27), we get the following upper bound:

$$\begin{array}{cc}\hfill I(\mathbf{M};\mathbf{Z}|{\mathbf{U}}_{\mathcal{F}})& \le N{ϵ}_N+h_2\left(2^{-N^{\beta }}\right)+\left|\mathcal{R}\right|2^{-N^{\beta }},\hfill \end{array}$$

(37)

where ${ϵ}_N=I\left(W_{SE}\right)+I\left(W_{RE}\right)-\left|\mathcal{R}\right|/N$ and if we divide both sides of (37) by N, all terms tend to zero as $N\to \infty$, since $\underset{N\to \infty }{lim}{ϵ}_N=0$, with ${\mathcal{R}}_1\in {\mathcal{G}}_N\left(W_{SE}\right)$ and ${\mathcal{R}}_2\in {\mathcal{G}}_N\left(W_{RE}\right)$.

Thus, the proposed polar coding scheme satisfies the weak secrecy requirement for all possible choices of frozen vector,

$$\underset{N\to \infty }{lim}\frac{I(\mathbf{M};\mathbf{Z})}{N}=0$$

(38)

and the achievable rate under this encoding procedure is given by

$$R_s^{weak}=R^{DF}-(I\left(W_{SE}\right)+I\left(W_{RE}\right)),$$

(39)

for large enough N.

4.2. Strong Secrecy

The above scheme can only achieve the weak secrecy requirement, due to the assumptions that ${\mathcal{B}}_N^c\left(W_{SE}\right)\subset {\mathcal{G}}_N\left(W_{SR}\right)$ and ${\mathcal{B}}_N^c\left(W_{RE}\right)\subset {\mathcal{G}}_N\left(W_{RD}\right)$, while in general, this is not true. Although the number of coordinates in ${\mathcal{G}}_N^c\left(W_{SR}\right)\cap {\mathcal{B}}_N^c\left(W_{SE}\right)$ and ${\mathcal{G}}_N^c\left(W_{RD}\right)\cap {\mathcal{B}}_N^c\left(W_{RE}\right)$ is very small, this constitutes the difficulty in obtaining reliability and strong secrecy simultaneously. The authors in [10] proposed a different partition of the coordinates which resolves the above problem. For the case of the symmetric relay wiretap channel and degraded eavesdropper link, the strong secrecy claim was proved in [20]. In the following, we provide a solution for a more general case, where we do not make any assumption on eavesdropper’s channel quality and consider a nonsymmetric channel model.

4.2.1. Asymmetric Channel Coding

In [22], the authors presented a polar coding scheme, which achieves the capacity of a B-DMC, to cover the general case of arbitrary input distributions. Let $U^N=X^N{G}_N$ and define the following sets:

$$\begin{array}{cc}\hfill {\mathcal{H}}_X& =\{i\in \left[N\right]:Z\left(U_i\right|U^{i-1})\ge 1-{\delta }_N\}\hfill \\ \hfill {\mathcal{L}}_X& =\{i\in \left[N\right]:Z\left(U_i\right|U^{i-1})\le {\delta }_N\}\hfill \\ \hfill {\mathcal{H}}_{X|Y}& =\{i\in \left[N\right]:Z\left(U_i\right|U^{i-1},Y^N)\ge 1-{\delta }_N\}\hfill \\ \hfill {\mathcal{L}}_{X|Y}& =\{i\in \left[N\right]:Z\left(U_i\right|U^{i-1},Y^N)\le {\delta }_N\},\hfill \end{array}$$

(40)

where $Z\left(X\right|Y)$ is the Bhattacharyya parameter of a random variable pair $(X,Y)$, defined as

$$\begin{array}{c}\hfill Z\left(X\right|Y)=2\sum _{y\in \mathcal{Y}}{P}_Y\left(y\right)\sqrt{P_{X|Y}\left(0\right|y)P_{X|Y}\left(1\right|y)}.\end{array}$$

(41)

From [29], we have

$$\begin{array}{cc}\hfill \underset{N\to \infty }{lim}\frac{{\mathcal{H}}_X}{N}& =H\left(X\right),\hfill \end{array}$$

(42)

$$\begin{array}{cc}\hfill \underset{N\to \infty }{lim}\frac{{\mathcal{H}}_{X|Y}}{N}& =H\left(X\right|Y).\hfill \end{array}$$

(43)

For a nonsymmetric B-DMC channel $W:X\to Y$, it is not possible to use all the good bit-channels to transmit information. Hence, in [22], a different partition of the set $\left[N\right]$ was proposed:

$$\begin{array}{cc}\hfill \mathcal{I}& ={\mathcal{H}}_X\cap {\mathcal{L}}_{X|Y}\hfill \\ \hfill {\mathcal{F}}_r& ={\mathcal{H}}_X\cap {\mathcal{L}}_{X|Y}^c\hfill \\ \hfill {\mathcal{F}}_d& ={\mathcal{H}}_X^c.\hfill \end{array}$$

(44)

For $i\in {\mathcal{H}}_X$, $U_i$ is almost uniformly distributed and independent of the past $U^{i-1}$, therefore, it can carry information. For $i\in {\mathcal{L}}_{X|Y}$, $U_i$ is almost determined by $U^{i-1}$ and $Y^N$, implying that it can be decoded in a successive manner, and from (42) and (43), we have

$$\underset{N\to \infty }{lim}\frac{\left|\mathcal{I}\right|}{N}=I(X;Y).$$

(45)

The remaining indices are frozen; for $i\in {\mathcal{F}}_r$, $U_i$ is almost uniformly distributed and independent of the past $U^{i-1}$ but cannot be reliably decoded given $Y^N$; for $i\in {\mathcal{F}}_d$, $U_i$ is almost determined by $U^{i-1}$. As suggested in [22], the values of bits in $\{i\in {\mathcal{F}}_r\cup {\mathcal{F}}_d\}$ are assigned by random mappings ${\lambda }_i:{\{0,1\}}^{i-1}\to \{0,1\}$ according to the following probability rule:

$$\begin{array}{c}\hfill {\lambda }_i\left(u^{i-1}\right)=u,w.p.P_{U_i|U^{i-1}},\end{array}$$

(46)

which are shared between the encoder and the decoder. However, this operation requires sharing a large amount of randomness which is often undesirable. As a remedy to this, simplified schemes that require a vanishing rate of shared randomness were proposed in [23,30].

Let the bits in $\{i\in \mathcal{I}\}$ be used to store information as mentioned above, and let bits in $\{i\in {\mathcal{F}}_r\}$ be uniformly distributed random bits shared between the encoder and the decoder. This sequence can be reused over several blocks, making the rate loss negligible. The values of $\{i\in {\mathcal{F}}_d\}$ are sampled from the distribution $P_{U_i|U^{i-1}}$, and the bits in $\{i\in {\mathcal{H}}_X^c\cap {\mathcal{L}}_{X|Y}^c\}$ are transmitted to the receiver separately with some reliable code, with negligible rate loss (since $|{\mathcal{L}}_{X|Y}^c\setminus {\mathcal{H}}_{X|Y}|=o\left(n\right)$ and ${\mathcal{H}}_{X|Y}\subseteq {\mathcal{H}}_X$, we have that $|{\mathcal{H}}_X^c\cap {\mathcal{L}}_{X|Y}^c|=o\left(n\right)$).

After the transmission of $x^N=u^N{G}_N$, the receiver knows the sequences $\{i\in {\mathcal{F}}_r\}$ and $\{i\in {\mathcal{H}}_X^c\cap {\mathcal{L}}_{X|Y}^c\}$ and successively constructs the estimate $\widehat{u}$ using the following rule for each bit-channel:

$${\widehat{u}}_i=\left\{\begin{array}{cc}arg\underset{u\in [0,1]}{max}{P}_{U_i|U^{i-1},Y^N}\left(u\right|{\widehat{u}}^{i-1},y^N),\hfill & \mathrm{if}i\in {\mathcal{L}}_{X|Y}\hfill \\ u_i,\hfill & \mathrm{if}i\in {\mathcal{L}}_{X|Y}^c.\hfill \end{array}\right.$$

(47)

This scheme’s rate approaches $I(X;Y)$ and the error probability can be upper bounded by $P_e\le {\sum }_{i\in {\mathcal{L}}_{X|Y}}Z\left(U_i\right|U^{i-1},Y^N)=\mathcal{O}\left({\delta }_N\right)$.

4.2.2. Encoding Scheme

In the following, we develop the main contribution of this work, the encoding scheme for the primitive relay wiretap channel, and remove the assumptions on degradedness and symmetry. The transmission takes place over $k+1$ blocks of N bits. Prior to the communication, trusted parties share a secret seed of random bits $\mathcal{D}$, which is used as a “chain” between transmitted blocks. In particular, encoding is performed so that the bits of $\mathcal{D}$ are passed on the legitimate receiver (relay or destination) using their reliable and secure indices. The chaining is implemented by sending the bits in $\mathcal{D}\left(j\right)$ of block j as part of the message block $j-1$ for all $j\in [1,\dots ,k]$. This construction allows the legitimate receiver to employ SC for block j and recover these bits reliably, while security is guaranteed.

Let us apply the aforementioned construction to the relay wiretap channel under investigation. We consider the following partition of the index set

$$\begin{array}{cc}\hfill {\mathcal{I}}_1& ={\mathcal{H}}_{X_S}\cap {\mathcal{G}}_N\left(W_{SR}\right)\cap {\mathcal{B}}_N\left(W_{SE}\right)\hfill \\ \hfill {\mathcal{F}}_1& ={\mathcal{H}}_{X_S}\cap {\mathcal{G}}_N^c\left(W_{SR}\right)\cap {\mathcal{B}}_N\left(W_{SE}\right)\hfill \\ \hfill {\mathcal{R}}_1& ={\mathcal{H}}_{X_S}\cap {\mathcal{G}}_N\left(W_{SR}\right)\cap {\mathcal{B}}_N^c\left(W_{SE}\right)\hfill \\ \hfill {\mathcal{D}}_1& ={\mathcal{H}}_{X_S}\cap {\mathcal{G}}_N^c\left(W_{SR}\right)\cap {\mathcal{B}}_N^c\left(W_{SE}\right)\hfill \\ \hfill {\mathcal{B}}_1& ={\mathcal{H}}_{X_S}^c,\hfill \end{array}$$

(48)

where in the set ${\mathcal{I}}_1$, information bits are stored; set ${\mathcal{F}}_1$ is the set of frozen bits; ${\mathcal{R}}_1$ are the randomly chosen bits; ${\mathcal{D}}_1$ are the misaligned bits; and ${\mathcal{B}}_1$ are the almost deterministic bits. We note that, as in the weak secrecy case in Section 4.1, the information bits in ${\mathcal{I}}_1$ are distributed in both ${\mathcal{I}}_1^{SD}$, which can be decoded by the destination, and ${\mathcal{I}}_1^{RD}$, which is the message that the relay forwards through the $W_{RD}$. Thus, for this transmission, the relay uses the following partition:

$$\begin{array}{cc}\hfill {\mathcal{I}}_2& ={\mathcal{H}}_{X_R}\cap {\mathcal{G}}_N\left(W_{RD}\right)\cap {\mathcal{B}}_N\left(W_{RE}\right)\hfill \\ \hfill {\mathcal{F}}_2& ={\mathcal{H}}_{X_R}\cap {\mathcal{G}}_N^c\left(W_{RD}\right)\cap {\mathcal{B}}_N\left(W_{RE}\right)\hfill \\ \hfill {\mathcal{R}}_2& ={\mathcal{H}}_{X_R}\cap {\mathcal{G}}_N\left(W_{RD}\right)\cap {\mathcal{B}}_N^c\left(W_{RE}\right)\hfill \\ \hfill {\mathcal{D}}_2& ={\mathcal{H}}_{X_R}\cap {\mathcal{G}}_N^c\left(W_{RD}\right)\cap {\mathcal{B}}_N^c\left(W_{RE}\right)\hfill \\ \hfill {\mathcal{B}}_2& ={\mathcal{H}}_{X_R}^c.\hfill \end{array}$$

(49)

Before describing the encoding procedure, we define the following set $\mathcal{D}={\mathcal{D}}_1\cup {\mathcal{D}}_2$, which is used as the secret seed and is shared among the source, relay, and destination. Additionally, we fix two arbitrary sets ${\mathcal{E}}_1\subset {\mathcal{I}}_1$ and ${\mathcal{E}}_2\subset {\mathcal{I}}_2$ with $|{\mathcal{E}}_1|=|{\mathcal{D}}_1|$ and $|{\mathcal{E}}_2|=|{\mathcal{D}}_2|$, and $\mathcal{E}={\mathcal{E}}_1\cup {\mathcal{E}}_2$ with $\left|\mathcal{E}\right|=\left|\mathcal{D}\right|$. Consequently, the messages of the two-hop transmission are indexed by the bits in ${\tilde{\mathcal{I}}}_1={\mathcal{I}}_1\setminus \mathcal{E}$ and ${\tilde{\mathcal{I}}}_2={\mathcal{I}}_2\setminus \mathcal{E}$, respectively. As a consequence of removing the eavesdropper’s degraded channel assumption, the cardinality of ${\mathcal{D}}_1$ and ${\mathcal{D}}_2$ is not $o\left(N\right)$ anymore and we must ensure that by removing the bits ${\mathcal{E}}_1$ and ${\mathcal{E}}_2$ from ${\mathcal{I}}_1$ and ${\mathcal{I}}_2$, respectively, there is no loss in the rate. However, the preshared rate can be made very small by choosing a large enough k, i.e., $\left|\mathcal{D}\right|/kN$.

Overall, the transmission is performed in two stages, where in order to satisfy the strong secrecy requirement while the probability of error vanishes, we manipulate the misaligned bits in both transmissions by creating a double-chaining structure, i.e., the bits in $\mathcal{D}$ and their links $\mathcal{E}$ of the previous block create a chain for each transmission, as in Figure 6.

Let us describe this double-chaining construction, assuming that the legitimate parties have knowledge of the seed $\mathcal{D}\left(1\right)$. By transmitting $\mathcal{E}\left(0\right)$ with a separate code, the first chain is formed by ${\mathcal{D}}_1\left(j\right)={\mathcal{E}}_1(j-1)$ during the source transmission towards the relay and the destination, and the second chain is formed by ${\mathcal{D}}_2\left(j\right)={\mathcal{E}}_2(j-1)$ when the relay sends the missing bits to the legitimate receiver. After each source block transmission, the first $|{\mathcal{D}}_1|$ bits of $\mathcal{D}$ are used to create the chain and are being replaced block by block. Similarly, the second-hop chain is created after each block is transmitted by the relay by using the remaining $|{\mathcal{D}}_2|$ bits of $\mathcal{D}$.

• Source encoding: For block $j=1,\dots ,k$, set ${\tilde{\mathcal{I}}}_1$ carries the message bits; set ${\mathcal{R}}_1$ is filled with uniformly distributed random bits; the first $|{\mathcal{D}}_1|$ bits of the set $\mathcal{D}$ are chained with the bits of ${\mathcal{E}}_1$, i.e., ${\mathcal{D}}_1\left(j\right)={\mathcal{E}}_1(j-1)$; the bits in ${\mathcal{F}}_1$ are fixed, known, and can be reused over blocks; and the bits of ${\mathcal{B}}_1$ are sampled from $P_{U_{i,S}|U_S^{i-1}}$. Moreover, since the source–destination link is weaker, the bits in $\mathcal{G}\left(W_{SR}\right)\cap \mathcal{B}\left(W_{SD}\right)$ need to be delivered to the destination by the relay during the second-hop transmission. That is, the message bits of ${\tilde{\mathcal{I}}}_1$ are loaded in ${\tilde{\mathcal{I}}}_1^{SD}=\mathcal{G}\left(W_{SD}\right)\cap \mathcal{B}\left(W_{SE}\right)$ and ${\tilde{\mathcal{I}}}_1^{RD}=\mathcal{G}\left(W_{SR}\right)\cap \mathcal{B}\left(W_{SD}\right)$. Finally, as described in Section 4.2.1, let ${\Phi }_1$ be the vector storing the not completely polarized bit-channels $\{i\in {\mathcal{H}}_{X_S}^c\cap {\mathcal{G}}_N^c\left(W_{SR}\right)\}$, which is shared secretly between the legitimate users with some reliable error-correcting code. Figure 7 shows the coding scheme, the lines on ${\mathcal{D}}_2$ and ${\mathcal{E}}_2$ imply the first chain construction.

• Processing at the relay: The relay decodes message block j, knowing ${\mathcal{F}}_1$, the seed ${\mathcal{D}}_1\left(j\right)={\mathcal{E}}_1(j-1)$, and the bits of ${\Phi }_1$, then extracts the bits in ${\tilde{\mathcal{I}}}_1^{RD}$ and forwards them to the destination by using a polar code for the channel $W_{RD}$ using partition (49). Specifically, for block $j=1,\dots ,k$ message bits are loaded in the set ${\tilde{\mathcal{I}}}_2$; random bits in the set ${\mathcal{R}}_2$; the bits in the set ${\mathcal{D}}_2$ are chained with those of ${\mathcal{E}}_2$, i.e., ${\mathcal{D}}_2\left(j\right)={\mathcal{E}}_2(j-1)$, as shown in Figure 8; and the bits of ${\mathcal{B}}_2$ are sampled from $P_{U_{i,R}|U_R^{i-1}}$. Furthermore, let ${\Phi }_2$ be the vector storing the not completely polarized bit-channels $\{i\in {\mathcal{H}}_{X_R}^c\cap {\mathcal{G}}_N^c\left(W_{RD}\right)\}$, which is shared secretly with the destination using some reliable error-correcting code. The frozen set for this transmission is ${\mathcal{F}}_2$, which is known to the destination.

• Destination decoding: At the destination, the process starts by decoding the first block message of the relay transmission, knowing ${\mathcal{F}}_2$ and ${\mathcal{D}}_2\left(j\right)={\mathcal{E}}_2(j-1)$ and the bits of ${\Phi }_2$. Then, it uses those bits and the knowledge of ${\mathcal{F}}_1$, ${\mathcal{D}}_1$, and ${\Phi }_1$ to decode the corresponding message block received from the source transmission at the first stage by employing the SC algorithm.

Remark 1.

The encoding scheme above requires a certain amount of shared randomness between the legitimate users. Specifically, ${\mathcal{F}}_1$, ${\mathcal{F}}_2$ are available to all users (including the eavesdropper), while ${\mathcal{D}}_1$, ${\mathcal{D}}_2$, and ${\Phi }_1$, ${\Phi }_2$ are known only to the legitimate users. Note that ${\mathcal{F}}_i$, for $i=1,2$, can be reused over blocks and since $|{\mathcal{F}}_1|+|{\mathcal{F}}_2|=\mathcal{O}\left(N\right)$, the rate needed can become arbitrarily small by choosing a large k. The rate of secret seed ${\mathcal{D}}_i$, and the rate of the not completely polarized bit-channels ${\Phi }_i$, for $i=1,2$, can also become negligible by choosing a sufficiently large k. In general, the rate loss caused by the shared randomness is minor compared to the overall message rate.

Let us now introduce the following random variables needed for the reliability and secrecy analysis. For the transmission in blocks $j=1,\dots ,k$, denote the source’s message bits in ${\tilde{\mathcal{I}}}_1$ by $M_{1,k}$ and let $M_{2,k}$ be the message transmitted by the relay with bits in ${\tilde{\mathcal{I}}}_2$, frozen bits in ${\mathcal{F}}_1$ and ${\mathcal{F}}_2$ are denoted by $F_{1,k}$, and let $F_{2,k}$. Further, let $E_{1,k}$ and $E_{2,k}$ correspond to the bits belonging to ${\mathcal{E}}_1\left(j\right)$ and ${\mathcal{E}}_2\left(j\right)$, respectively, for $j=0,\dots ,k$. To make the analysis compact, we also denote ${\mathbf{M}}_k=(M_{1,k},M_{2,k})$, ${\mathbf{F}}_k=(F_{1,k},F_{2,k})$, ${\mathbf{E}}_k=(E_{1,k},E_{2,k})$; the k-length vectors ${\mathbf{M}}_1^k=({\mathbf{M}}_1,\dots ,{\mathbf{M}}_k)$, ${\mathbf{F}}_1^k=({\mathbf{F}}_1,\dots ,{\mathbf{F}}_k)$, ${\mathbf{E}}_0^k=({\mathbf{E}}_0,\dots ,{\mathbf{E}}_k)$; and let ${\mathbf{Z}}_0^k=({\mathbf{Z}}_0,\dots ,{\mathbf{Z}}_k)$ be the sequence of eavesdropper’s observations $\mathbf{Z}=(Z_{SE},Z_{RE})$ during the k-th block transmission from source and relay.

4.2.3. Total Variation Distance and Reliability Analysis

We now analyze the proposed scheme by first examining the closeness in terms of total variation distance of the distribution induced by the encoding process and the target distribution. We would like to find an upper bound on the variation distance between these two distributions. Let $\mathbb{V}(P,Q)$ be the total variation distance and $\mathbb{D}\left(P\right|\left|Q\right)$ be the Kullback–Leibler divergence between distributions P and Q. Following the analysis of [13], we have that

$$\begin{array}{cc}\hfill \mathbb{D}\left(P_{X_S}\right|\left|Q_{X_S}\right)& =\mathbb{D}\left(P_{U_S}\right|\left|Q_{U_S}\right)\hfill \end{array}$$

(50)

$$\begin{array}{cc}\hfill & =\sum _{i=1}^N\mathbb{D}\left(P_{U_{i,S}\left|\right|U_S^{i-1}}\right|Q_{U_{i,S}|U_S^{i-1}})\hfill \end{array}$$

(51)

$$\begin{array}{cc}\hfill & =\sum _{i\in {\mathcal{H}}_{X_S}}(1-H\left(U_{i,S}\right|U_S^{i-1}))\hfill \end{array}$$

(52)

$$\begin{array}{cc}\hfill & \le \sum _{i\in {\mathcal{H}}_{X_S}}(1-Z^2\left(U_{i,S}\right|U_S^{i-1}))\hfill \end{array}$$

(53)

$$\begin{array}{cc}\hfill & \le 2|{\mathcal{H}}_{X_S}|{\delta }_N\le 2N{\delta }_N,\hfill \end{array}$$

(54)

where (50) is due to the polar transform $X_S=U_S{G}_N$, (51) holds by the chain rule of KL divergence, (52) holds since the values of ${\mathcal{H}}_{X_S}$ are chosen uniformly, (53) follows from the inequality $Z{\left(X\right|Y)}^2\le H\left(X\right|Y)$ ([29], Proposition 2), and (54) follows by the design of ${\mathcal{H}}_{X_S}$. Similarly, we have

$$\mathbb{D}(P_{X_R}\left|\right|Q_{X_R})\le 2N{\delta }_N.$$

(55)

To obtain the desired bound in terms of total variation distance between the two joint distributions, we note that

$$\begin{array}{cc}\hfill \mathbb{V}(P_{X_S,X_R,Y_{SR},Y_{SD},Y_{SE},Y_{RD},Y_{RE}},Q_{X_S,X_R,Y_{SR},Y_{SD},Y_{SE},Y_{RD},Y_{RE}})& =\mathbb{V}(P_{X_S,X_R},Q_{X_S,X_R})\hfill \end{array}$$

(56)

$$\begin{array}{cc}\hfill & \le 4\sqrt{ln2}\sqrt{N{\delta }_N}\stackrel{\mathrm{\Delta }}{=}{\delta }_N^{\left(1\right)},\hfill \end{array}$$

(57)

where (56) and (57) follow from [31] (Lemma 17) and Pinsker’s inequality, using (54) and (55), respectively. This result indicates that the induced joint distribution is asymptotically indistinguishable from the target one.

We next examine the reliability of this scheme by estimating the error probability for the legitimate parties. First, for the relay, since the rate of the transmission uses a polar coding sequence with $R<I\left(W_{SR}\right)$, and assuming that $Pr\{{\widehat{\mathbf{E}}}_0\ne {\mathbf{E}}_0\}\to 0$—i.e., there is a code with ${ϵ}_N\to 0$ used to convey the seed to the legitimate users—the probability of erroneous decoding at the relay in the $k+1$ blocks is

$$P_e^{SR}\le {ϵ}_N+k\mathcal{O}\left(2^{-N^{\beta }}\right),$$

(58)

for all $\beta <1/2$.

Similarly, the destination will recover the relay’s message ${\mathbf{M}}_2$, with the error probability bounded by

$$P_e^{RD}\le k\mathcal{O}\left(2^{-N^{\beta }}\right),$$

(59)

since ${\tilde{\mathcal{I}}}_2\cup {\mathcal{R}}_2\subset \mathcal{G}\left(W_{RD}\right)$, and knowing ${\mathcal{F}}_2$ and ${\mathcal{D}}_2\left(j\right)$. Then, using those bits, it can decode the source’s message ${\mathbf{M}}_1$ using the SC algorithm. Overall, the probability of error at the destination after the second transmission is then bounded as

$$P_e\le {ϵ}_N+k\mathcal{O}\left(2^{-N^{\beta }}\right),$$

(60)

where ${ϵ}_N$ is the vanishing error of the code transmitting the seed prior to the communication.

4.2.4. Secrecy Analysis

We will show that the strong secrecy requirement is satisfied by utilizing the double-chaining construction described above. For the proposed encoding scheme, the information leakage to the eavesdropper can be analyzed as follows:

$$\begin{array}{cc}\hfill I({\mathbf{M}}_1^k;{\mathbf{Z}}_0^k|{\mathbf{F}}_1^k)& \le I({\mathbf{M}}_1^k,{\mathbf{E}}_k;{\mathbf{Z}}_0^k|{\mathbf{F}}_1^k)\hfill \\ \hfill & =I({\mathbf{M}}_1^k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_1^k)+I({\mathbf{M}}_1^k,{\mathbf{E}}_k;{\mathbf{Z}}_0^{k-1}|{\mathbf{Z}}_k,{\mathbf{F}}_1^k)\hfill \end{array}$$

(61)

$$\begin{array}{cc}\hfill & =I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_1^k)+I({\mathbf{M}}_1^k,{\mathbf{E}}_k;{\mathbf{Z}}_0^{k-1}|{\mathbf{Z}}_k,{\mathbf{F}}_1^k)\hfill \\ \hfill & \le I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_1^k)+I({\mathbf{M}}_1^k,{\mathbf{E}}_k{\mathbf{Z}}_k;{\mathbf{Z}}_0^{k-1}|{\mathbf{F}}_1^k)\hfill \\ \hfill & \le I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_1^k)+I({\mathbf{M}}_1^k,{\mathbf{E}}_{k-1},{\mathbf{E}}_k,{\mathbf{Z}}_k;{\mathbf{Z}}_0^{k-1}|{\mathbf{F}}_1^k)\hfill \end{array}$$

(62)

$$\begin{array}{cc}\hfill & =I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_1^k)+I({\mathbf{M}}_1^{k-1},{\mathbf{E}}_{k-1};{\mathbf{Z}}_0^{k-1}|{\mathbf{F}}_1^k)\hfill \end{array}$$

(63)

$$\begin{array}{cc}\hfill & =I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_k)+I({\mathbf{M}}_1^{k-1},{\mathbf{E}}_{k-1};{\mathbf{Z}}_0^{k-1}|{\mathbf{F}}_1^{k-1}),\hfill \end{array}$$

(64)

where (62) and (63) are due to the Markov chains ${\mathbf{M}}_1^{k-1}\to {\mathbf{M}}_k{\mathbf{E}}_k\to {\mathbf{Z}}_k$ and ${\mathbf{M}}_k{\mathbf{E}}_k{\mathbf{Z}}_k\to {\mathbf{M}}_1^{k-1}{\mathbf{E}}_{k-1}\to {\mathbf{Z}}_0^{k-1}$, respectively. (64) is obtained by noticing that using the chain rule for mutual information, we get

$$\begin{array}{cc}\hfill I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_1^k)& =I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_k)+I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{F}}_1^{k-1}|{\mathbf{Z}}_k,{\mathbf{F}}_k)-I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{F}}_1^{k-1}|{\mathbf{F}}_k)\hfill \end{array}$$

(65)

$$\begin{array}{cc}\hfill & =I({\mathbf{M}}_k,{\mathbf{E}}_k;{\mathbf{Z}}_k|{\mathbf{F}}_k),\hfill \end{array}$$

(66)

where the last two terms equal zero, similar to the second term of (64). Next, from (61), we have the following:

$$I({\mathbf{M}}_1^k;{\mathbf{Z}}_0^k|{\mathbf{F}}_1^k)\le \sum _{j=1}^{k}I({\mathbf{M}}_j{\mathbf{E}}_j;{\mathbf{Z}}_j|{\mathbf{F}}_1^k)+\underset{{ϵ}_N}{\underbrace{I({\mathbf{E}}_0;{\mathbf{Z}}_0)}},$$

(67)

where the last term is the secret seed shared between the legitimate parties prior to the communication and we assume that there exists a secure coding scheme with ${ϵ}_N\to 0$. In order to complete the proof of strong secrecy, it remains to be shown that the first term of the RHS in (67) vanishes as well. Therefore, we need to bound the capacity of the eavesdropper’s channel induced by our encoding. For this purpose, we prove the following lemma.

Lemma 3.

For any $j=1,\dots ,k$, we have

$$I({\mathbf{M}}_j,{\mathbf{E}}_j;{\mathbf{Z}}_j|{\mathbf{F}}_j)\le {\delta }_N^{\left(3\right)},$$

where ${\delta }_N^{\left(3\right)}\stackrel{\mathrm{\Delta }}{=}2N{\delta }_N+{\delta }_N^{\left(1\right)}(N-log{\delta }_N^{\left(1\right)})$.

Proof. 

Let $\mathcal{I}=|{\mathcal{I}}_1|+|{\mathcal{I}}_2|$ with indices labeled as $\{a_1,\dots ,a_{\mathcal{I}}\}$ with $a_1<...<a_{\mathcal{I}}$; similarly, let $\mathcal{F}=|{\mathcal{F}}_1|+|{\mathcal{F}}_2|$ and label the indices as $\{b_1,\dots ,b_{\mathcal{F}}\}$ with $b_1<...<b_{\mathcal{F}}$. Moreover, let $\mathcal{S}=\mathcal{I}+\mathcal{F}$ with labels $\{c_1,\dots ,c_{\mathcal{S}}\}$ and assume that $c_1<...<c_{\mathcal{S}}$. -4.6cm0cm

$$\begin{array}{cc}\hfill I({\mathbf{M}}_j,{\mathbf{E}}_j;{\mathbf{Z}}_j|{\mathbf{F}}_j)& =H({\mathbf{M}}_j,{\mathbf{E}}_j|{\mathbf{F}}_j)-H({\mathbf{M}}_j,{\mathbf{E}}_j|{\mathbf{Z}}_j,{\mathbf{F}}_j)\hfill \\ \hfill & =H({\mathbf{M}}_j,{\mathbf{E}}_j)-H({\mathbf{M}}_j,{\mathbf{E}}_j,{\mathbf{F}}_j|{\mathbf{Z}}_j)+H\left({\mathbf{F}}_j\right|{\mathbf{Z}}_j)\hfill \\ \hfill & =\sum _{i=1}^{\mathcal{I}}H\left(T_{a_i}\right|T^{a_1},\dots ,T_{a_{i-1}})-\sum _{i=1}^{\mathcal{S}}H\left(T_{c_i}\right|{\mathbf{Z}}_j,T_{c_1},\dots ,T_{c_{i-1}})+\sum _{i=1}^{\mathcal{F}}H\left(T_{b_i}\right|{\mathbf{Z}}_j,T_{b_1},\dots ,T_{b_{i-1}})\hfill \\ \hfill & \le \sum _{i=1}^{\mathcal{S}}(1-H\left(T_{c_i}\right|{\mathbf{Z}}_j,T^{c_{i-1}})),\hfill \end{array}$$

(68)

where (68) is due to the fact that conditioning reduces entropy. Considering the entropy term in (68) and noticing that it is derived under the induced distribution of the coding scheme, we would like to find the distance between the induced entropy and the entropy under the target distribution $\tilde{H}\left(T_{c_i}\right|{\mathbf{Z}}_j,T^{c_{i-1}})$, where $\tilde{H}$ denotes the entropy under the target distribution $P_{X^N,Z^N}$. First, using the inequality $Z{\left(X\right|Y)}^2\le H\left(X\right|Y)$ ([29], Proposition 2), we get that

$$\begin{array}{cc}\hfill \tilde{H}\left(T_{c_i}\right|{\mathbf{Z}}_j,T^{c_{i-1}})& \ge Z{\left(T_{c_i}\right|{\mathbf{Z}}_j,T^{c_{i-1}})}^2\hfill \\ \hfill & \ge 1-2{\delta }_N.\hfill \end{array}$$

(69)

To estimate the distance, we rely on Th. 17.3.3 [32], and we have

$$\begin{array}{cc}\hfill |H\left(T_{c_i}\right|{\mathbf{Z}}_j,T^{c_{i-1}})-\tilde{H}\left(T_{c_i}\right|{\mathbf{Z}}_j,T^{c_{i-1}})|& \le \mathbb{V}(P_{X^N,Z^N},Q_{X^N,Z^N})\times log\frac{2^N}{\mathbb{V}(P_{X^N,Z^N},Q_{X^N,Z^N})}\hfill \end{array}$$

(70)

$$\begin{array}{cc}\hfill & \le {\delta }_N^{\left(1\right)}(N-log{\delta }_N^{\left(1\right)})\stackrel{\mathrm{\Delta }}{=}{\delta }_N^{\left(2\right)},\hfill \end{array}$$

(71)

where (71) follows from (57) and the fact that $f\left(x\right)=x(N-logx)$ is increasing for $0<x<1$.

Thus, from (68), (69), and (70), we conclude that

$$I({\mathbf{M}}_j,{\mathbf{E}}_j;{\mathbf{Z}}_j|{\mathbf{F}}_j)\le 2N{\delta }_N+{\delta }_N^{\left(2\right)}\stackrel{\mathrm{\Delta }}{=}{\delta }_N^{\left(3\right)}.$$

(72)

□

Finally, combining Lemma 3 and (67), we get the desired result:

$$I({\mathbf{M}}_1^k;{\mathbf{Z}}_0^k|{\mathbf{F}}_1^k)\le I({\mathbf{M}}_1^k{\mathbf{E}}_k;{\mathbf{Z}}_0^k|{\mathbf{F}}_1^k)\le {ϵ}_N+k{\delta }_N^{\left(3\right)},$$

(73)

where, for k fixed and $N\to \infty$, we observe that $I({\mathbf{M}}_1^k;{\mathbf{Z}}_0^k|{\mathbf{F}}_1^k)$ vanishes as we have assumed that ${ϵ}_N\to 0$, and that completes the secrecy analysis.

Moreover, the achievable rate under this encoding scheme is given by

$$R_s^{strong}=\frac{k}{k+1}[R^{DF}-(I\left(W_{SE}\right)+I\left(W_{RE}\right))-2\mathrm{\Delta }],$$

(74)

as N grows large and by choosing k to be large enough, where $2\mathrm{\Delta }$ is a vanishing small rate penalty induced by the double-chaining structure and the shared seed. Undoubtedly, designing a coding scheme that takes into account reliability and secrecy as requirements, a trade-off between achievable rate and secrecy is introduced. In our scheme (Although we are discussing the strong secrecy encoding scheme, the same applies for the scheme of Section 4.1, where the rate loss is lower due to the absence of the double-chaining construction). the random bits and the bits allocated to convey the misaligned indices are the factors that mean the achievable secret rate is lower than the $R^{DF}$, which is the lower bound without secrecy constraints. To reduce this loss and attain a higher achievable rate, a line of work exists that proposes a cross-layer security scheme, which combines information-theoretic security with classical encryption mechanisms [33,34].

5. Conclusions

The construction of practical coding schemes for information-theoretic security is of great significance. In this work, we have proposed an efficient coding scheme based on polar codes for the primitive relay wiretap channel, which guarantees a level of information-theoretic security. In our setup, we exploited the nested structure of polar codes for cooperative relaying in a DF strategy. We presented an encoding scheme that achieves reliability and weak secrecy, but fails to provide strong secrecy. Through a different partition of the coordinates and a chaining construction, we were able to prove that reliability and strong secrecy can be obtained simultaneously for the channel model, without any assumption regarding symmetry and the eavesdropper’s channel condition. Moreover, in our strong secrecy scheme, we considered a simplified mechanism that only requires a vanishing rate of shared randomness, instead of sharing random mappings that may heavily increase the storage complexity. Finally, as en extra functionality, a “smart” relay is added, where an erroneous detector at the relay’s decoder operates to reduce the error probability while the complexity remains the same.