# Capacity-Equivocation Regions of the DMBCs with Noiseless Feedback

Authors: Xinxing Yin; Zhi Xue; Bin Dai
Journal: Mathematical Problems in Engineering
 (2013)

---

## Abstract

The discrete memoryless broadcast channels (DMBCs) with noiseless feedback are studied. The entire capacity-equivocation regions of two models of the DMBCs with noiseless feedback are obtained. One is the degraded DMBCs with rate-limited feedback; the other is theless and reversely less noisy DMBCs with causal feedback. In both models, two kinds of messages are transmitted. The common message is to be decoded by both the legitimate receiver and the eavesdropper, while the confidential message is only for the legitimate receiver. Our results generalize the secrecy capacity of the degraded wiretap channel with rate-limited feedback (Ardestanizadeh et al., 2009) and the restricted wiretap channel with noiseless feedback (Dai et al., 2012). Furthermore, we use a simpler and more intuitive deduction to get the single-letter characterization of the capacity-equivocation region, instead of relying on the recursive argument which is complex and not intuitive.


---

## Body

## 1. Introduction

Secure data transmission is an important requirement in wireless communication. Wyner first studied the degraded  (the wiretap channel is said to be (physically) degraded ifX→Y→Z form a Markov chain, where X is the channel input and Y and Z are the channel outputs of the legitimate receiver and wiretapper, resp.)  wiretap channel in [1], where the output ZN of the channel to the wiretapper is degraded to the output YN of the channel to the legitimate receiver. In Wyner’s model, the transmitter aimed to send a confidential message S to the legitimate receiver and keep the wiretapper as ignorant of the message as possible. Wyner obtained the secrecy capacity  (the secrecy capacity is the best data transmission rate under perfect secrecy; i.e., the equivocation at the wiretapper H(S∣ZN)=0. The formal definition of the secrecy capacity is given in Remark 3) and demonstrated that provable secure communication could be implemented by using information theoretic methods. This model was extended to a more general case by Csiszár and  Körner  [2], where broadcast channel with confidential messages was studied; see Figure 1. They considered transmitting not only the confidential messages S to the legitimate receiver, but also the common messages W to both the legitimate receiver and the eavesdropper. The capacity-equivocation region for the extended model was determined in [2]. This region contains all the achievable rate triples (R0,R1,Re), where R0 and R1 are the rates of the common and confidential messages and Re is the rate of the confidential message’s equivocation. Nevertheless, neither Wyner’s model nor Csiszár’s model considered feedback.Figure 1
Broadcast channel with confidential messages.To explore more ways in achieving secure data transmission, [3–5] studied the effects of the feedback on the capacities of several channel models. They all showed that feedback could help enhance the secrecy in wireless transmission. In [3], Ahlswede and Cai  presented both the inner and outer bounds on the secrecy capacity of the wiretap channel with secure causal feedback from the decoder and showed  that  the outer bound was tight for the degraded case. It was proved that, by using feedback, the secrecy capacity of the (degraded) wiretap channel was increased. After Ahlswede’s exploration, Ardestanizadeh et al. studied the wiretap channel with secure rate-limited feedback [4]. The main difference between Ardestanizadeh’s model and Ahlswede’s model is that the feedback in [4] is independent of the channel outputs, while the feedback in [3] is originated causally from the outputs of the channel to the legitimate receiver. In [4], the authors got an outer bound on the wiretap channel with rate-limited feedback through a recursive argument which was effective but not intuitive. They also showed the outer bound was tight for the degraded case. In addition, Dai et al. investigated the secrecy capacity of the restricted wiretap channel with noiseless causal feedback under the assumption that the main channel is independent of the wiretap channel [5].However, all of these explorations [3–5] focused on sending only the confidential messages. They did not consider sending both the common and confidential messages. In fact, transmitting the two kinds of messages can be seen in many systems with feedback. For example, in the satellite television service, some channels are available to all users for free, but some other channels are only for those who have paid  for  them. Recently, [6] studied the problem of transmitting both the common and confidential messages in the degraded broadcast channels with feedback. Note that, like [3], the feedback in [6] was originated causally from the legitimate receiver’s channel outputs and not rate-limited. Besides, [7–9] studied the broadcast channel with feedback where no secure constraints were imposed.To further investigate the secure data transmission with both common and confidential messages and noiseless feedback, this paper determines the capacity-equivocation regions of the following two DMBCs with both common and confidential messages. They are unsolved in the previous exploration.(i)
Degraded DMBCs with rate-limited feedback, where the feedback rate is limited byRf and the feedback is independent of the channel outputs; see Figure 2.(ii)
Less and reversely less noisy  (let X be the input of the DMBC, Y the legitimate receiver’s channel output, and Z the eavesdropper’s channel output. A DMBC p(y,z∣x) is said to be less noisy if I(U;Y)≥I(U;Z) for all p(u,x); a DMBC p(y,z∣x) is said to be reversely less noisy if I(U;Y)≤I(U;Z) for all p(u,x), where u is the value of the auxiliary random variable U) DMBCs with noiseless causal feedback, where the feedback is originated causally from the legitimate receiver’s channel outputs; see Figure 3.Figure 2
Degraded DMBCs with rate-limited feedback.Figure 3
Less and reversely less noisy DMBCs with noiseless causal feedback.The two channel models are characterized in Section2. The main results presented in Section 2 subsume some important previous findings about the secure data transmission with feedback. (1) By setting the auxiliary random variable U to be constant in the secrecy capacity of the first model (see (9) in Remark 3), the secrecy capacity of the degraded wiretap with rate-limited feedback [4] is obtained. (2) By eliminating the common message in the second model, the capacity-equivocation region of restricted wiretap channel with noiseless feedback [5] is obtained. (3) We utilize a simpler and more intuitive deduction to get the single-letter characterization of the capacity-equivocation region, instead of relying on the recursive argument (see [4]) which is complex and not intuitive. (4) We find that even if the eavesdropper is in a better position than the legitimate receiver, provable secure communication could also be implemented in the DMBCs with both common and confidential messages.The remainder of the paper is organized as follows. Section2 gives the notations and main results, that is, the capacity-equivocation regions of the two channel models. Section 3 proves Theorem 2. Section 4 proves Theorems 4 and 5. Section 5 concludes the whole work.


## 2. Channel Models and Main Results

### 2.1. Notations

Throughout this paper, we use calligraphic letters, for example,𝒳, 𝒴, to denote the finite sets and ∥𝒳∥ to denote the cardinality of the set 𝒳. Uppercase letters, for example, X, Y, are used to denote random variables taking values from finite sets, for example, 𝒳, 𝒴. The value of the random variable X is denoted by the lowercase letter x. We use Zij to denote the (j-i+1)-vectors (Zi,Zi+1,…,Zj) of random variables for 1≤i≤j and will always drop the subscript when i=1. Moreover, we use X~p(x) to denote the probability mass function of the random variable X. For X~p(x) and 0≤ϵ≤1, the set of the typical N-sequences xN is defined as 𝒯XN(ϵ)={xN:|π(x∣xN)-p(x)|≤ϵp(x) for all x∈𝒳}, where π(x∣xN) denotes the frequency of occurrences of letter x in the sequence xN (for more details about typical sequences, please refer to [10, Chapter 2]). The set of the conditional typical sequences, for example, 𝒯Y∣XN(ϵ), follows similarly.


### 2.2. Channel Models and Main Results

This paper studies the secure data transmission for two subclasses of DMBCs with noiseless feedback. One is the case where the feedback is rate-limited and independent of the channel outputs (see Figure2); the other is the case where the feedback is originated causally from the channel outputs (see Figure 3). Both models consist of a transmitter and two receivers, named receiver 1 (legitimate receiver) and receiver 2 (eavesdropper). The transmitter aims to convey a common message W to both receivers in addition to a confidential message S intended only for receiver 1. The confidential message S should be kept secret from receiver 2 as much as possible. We use equivocation at receiver 2 to characterize the secrecy of the confidential message. W and S are mutually independent and uniformly distributed over 𝒲 and 𝒮.


#### 2.2.1. Degraded DMBCs with Rate-Limited Feedback

The degraded DMBCs with rate-limited feedback (see Figure2) are under the condition that the channel to receiver 2 is physically degraded from the channel to receiver 1; that is, p(y,z∣x)=p(y∣x)p(z∣y) or X→Y→Z form a Markov chain, where X is the channel input and Y,Z are observations of receiver 1 and 2. In this model, the encoder encodes the messages (W,S) and feedback into codewords XN, where N is the length of the codeword. They are transmitted over a discrete memoryless channel (DMC) with transition probability ∏i=1Np(yi,zi∣xi). Receiver 1 obtains YN and decodes the common and confidential messages (W^,S^). Receiver 2 obtains ZN and decodes the common message W^. More precisely, we define the encoder-decoder (N,Δ,Pe1,Pe2) in Definition 1.Definition 1.
The encoder-decoder(N,Δ,Pe1,Pe2) for the degraded DMBCs with rate-limited feedback (with rate limited by Rf) is defined as follows.(i)
The feedback alphabet𝒦 satisfies limN→∞(log∥𝒦∥/N)≤Rf. The feedback is generated independent of the channel output symbols.(ii)
The stochastic channel encoderφ is specified by a matrix of conditional probability distributions φ(xN∣s,w,k) which denotes the probability that the message s,w and the feedback k are encoded as the channel input xN, where xN∈𝒳N,s∈𝒮,w∈𝒲,k∈𝒦, and ∑xNφ(xN∣s,w,k)=1. Note that 𝒮 and 𝒲 are the confidential and common message sets.(iii)
Decoder 1 is a mappingh1:𝒴N→𝒮×𝒲. The input of decoder 1 is YN, and the output is S^,W^. The decoding error probability of receiver 1 is defined as Pe1=Pr{h1(YN)≠(S,W)}. Similarly, Decoder 2 is defined as a mapping h2:𝒵N→𝒲. The input of decoder 2 is ZN, and the output is W^^. The decoding error probability of receiver 2 is defined as Pe2=Pr{h2(ZN)≠W}.(iv)
The equivocation at receiver 2 is defined as(1)Δ=1NH(S∣ZN).A rate triple(R0,R1,Re) is said to be achievable for the model in Figure 2 if there exists a channel encoder-decoder (N,Δ,Pe1,Pe2) defined in Definition 1, such that
(2)limN→∞log∥𝒲∥N=R0,(3)limN→∞log∥𝒮∥N=R1,(4)limN→∞log∥𝒦∥N=Rf′≤Rf,(5)limN→∞Δ≥Re,(6)Pe1≤ϵ,Pe2≤ϵ,
where ϵ is an arbitrary small positive real number, R0,R1,Rf′ are the rates of the common messages, confidential messages, and feedback, and Re is the equivocation rate of the confidential messages. Note that the feedback rate is limited by Rf. The capacity-equivocation region is defined as the convex closure of all achievable rate triples (R0,R1,Re). The capacity-equivocation region of the degraded DMBCs with rate-limited feedback is shown in the following theorem.Theorem 2.
For the degraded DMBCs with limited feedback rateRf, the capacity-equivocation region is the set
(7)ℛd={Re≤I(X;Y∣U)-I(X;Z∣U)+Rf(R0,R1,Re):0≤Re≤R1,R0≤I(U;Z),R1≤I(X;Y∣U),Re≤I(X;Y∣U)-I(X;Z∣U)+Rf},
where U is an auxiliary random variable and U→X→Y→Z form a Markov chain.The proof of Theorem2 is given in Section 3. The remark of Theorem 2 is shown below.Remark 3.
(i) The secrecy capacity of the model in Figure2 is defined as the maximum rate at which confidential messages can be sent to receiver 1 in perfect secrecy; that is,
(8)Cs=max(R0=0,R1,Re=R1)∈ℛR1,
where ℛ is the capacity-equivocation region. Therefore, by the definition in (8), the secrecy capacity of the degraded DMBCs with limited feedback rate Rf is
(9)Csd=maxmin{I(X;Y∣U),I(X;Y∣U)-I(X;Z∣U)+Rf}.
This result subsumes the secrecy capacity of the degraded wiretap channel with rate-limited feedback (see [4]) by setting the auxiliary random variable U to be constant in (9).
(ii) The capacity-equivocation region in (7) is bigger than that in [2] without feedback. This implies that  feedback can be used to enhance the secrecy in the DMBCs. Note that this finding had already been verified in [3–6].


#### 2.2.2. Less and Reversely Less Noisy DMBCs with Noiseless Causal Feedback

The model in Figure3 is based on the assumption that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). The definition of the encoder-decoder for this model is similar to Definition 1 except for the feedback and the encoder. Different from the model in Figure 2, the feedback in Figure 3 is originated causally from the channel outputs of receiver 1 to the transmitter. The stochastic encoder for this model at time i, 1≤i≤N, is defined as fi(xi∣wi,si,yi-1), where wi∈𝒲, si∈𝒮, yi-1∈𝒴i-1 (the channel outputs of receiver 1 before time i) and ∑xi∈𝒳fi(xi∣wi,si,yi-1)=1.A rate triple(R0,R1,Re) is said to be achievable for the model in Figure 3 if there exists a channel encoder-decoder (N,Δ,Pe1,Pe2) such that (2), (3), (5), and (6) hold. Note that the definition of “achievable” here does not include (4) since the feedback in the model of Figure 3 is not rate limited. The definition of secrecy capacity is the same as that in Remark 3. Then, we present the capacity-equivocation regions of the less and reversely less noisy DMBCs with noiseless causal feedback in Theorems 4 and 5, respectively.Theorem 4.
For the less noisy DMBCs with noiseless causal feedback, the capacity-equivocation region is the set(10)ℛl={(R0,R1,Re):0≤Re≤R1,R0≤I(U;Z),R1≤I(X;Y∣U),Re≤H(Y∣Z)},
where U→X→(Y,Z) form a Markov chain.Theorem 5.
For the reversely less noisy DMBCs with noiseless causal feedback, the capacity-equivocation region is the set(11)ℛrl={(R0,R1,Re):0≤Re≤R1,R0≤I(U;Y),R1≤I(X;Y∣U),Re≤H(Y∣X)},
where U→X→(Y,Z) form a Markov chain.The proof of Theorems4 and 5 is given in Section 4. The remark of Theorems 4 and 5 is given below.Remark 6.
(i) By the definition in (8), the secrecy capacity of the less noisy DMBCs with noiseless causal feedback is
(12)Csl=maxmin{I(X;Y∣U),H(Y∣Z)}.
The secrecy capacity of the reversely less noisy DMBCs with noiseless causal feedback is
(13)Csrl=maxmin{I(X;Y∣U),H(Y∣X)}.
Setting the auxiliary random variable U to be constant in (12) and (13), the capacity-equivocation region of the model in [5] is obtained.
(ii) In the model of Figure3, it is assumed that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). This implies Y→X→Z. Therefore, it is easy to see H(Y∣X)=H(Y∣XZ)≤H(Y∣Z); that is, the upper bound on the equivocation rate Re in (11) for the reversely less noisy case is smaller than that in (10) for the less noisy case. This tells that when the eavesdropper is in a better position than the legitimate receiver (see the reversely less noisy case), the uncertainty about the confidential messages at the eavesdropper is decreased. Besides, from (13), we see that even if the eavesdropper is in a better position, the secrecy capacity is a positive value, which means provable secure communication could also be implemented in such a bad condition.


## 2.1. Notations

Throughout this paper, we use calligraphic letters, for example,𝒳, 𝒴, to denote the finite sets and ∥𝒳∥ to denote the cardinality of the set 𝒳. Uppercase letters, for example, X, Y, are used to denote random variables taking values from finite sets, for example, 𝒳, 𝒴. The value of the random variable X is denoted by the lowercase letter x. We use Zij to denote the (j-i+1)-vectors (Zi,Zi+1,…,Zj) of random variables for 1≤i≤j and will always drop the subscript when i=1. Moreover, we use X~p(x) to denote the probability mass function of the random variable X. For X~p(x) and 0≤ϵ≤1, the set of the typical N-sequences xN is defined as 𝒯XN(ϵ)={xN:|π(x∣xN)-p(x)|≤ϵp(x) for all x∈𝒳}, where π(x∣xN) denotes the frequency of occurrences of letter x in the sequence xN (for more details about typical sequences, please refer to [10, Chapter 2]). The set of the conditional typical sequences, for example, 𝒯Y∣XN(ϵ), follows similarly.


## 2.2. Channel Models and Main Results

This paper studies the secure data transmission for two subclasses of DMBCs with noiseless feedback. One is the case where the feedback is rate-limited and independent of the channel outputs (see Figure2); the other is the case where the feedback is originated causally from the channel outputs (see Figure 3). Both models consist of a transmitter and two receivers, named receiver 1 (legitimate receiver) and receiver 2 (eavesdropper). The transmitter aims to convey a common message W to both receivers in addition to a confidential message S intended only for receiver 1. The confidential message S should be kept secret from receiver 2 as much as possible. We use equivocation at receiver 2 to characterize the secrecy of the confidential message. W and S are mutually independent and uniformly distributed over 𝒲 and 𝒮.


### 2.2.1. Degraded DMBCs with Rate-Limited Feedback

The degraded DMBCs with rate-limited feedback (see Figure2) are under the condition that the channel to receiver 2 is physically degraded from the channel to receiver 1; that is, p(y,z∣x)=p(y∣x)p(z∣y) or X→Y→Z form a Markov chain, where X is the channel input and Y,Z are observations of receiver 1 and 2. In this model, the encoder encodes the messages (W,S) and feedback into codewords XN, where N is the length of the codeword. They are transmitted over a discrete memoryless channel (DMC) with transition probability ∏i=1Np(yi,zi∣xi). Receiver 1 obtains YN and decodes the common and confidential messages (W^,S^). Receiver 2 obtains ZN and decodes the common message W^. More precisely, we define the encoder-decoder (N,Δ,Pe1,Pe2) in Definition 1.Definition 1.
The encoder-decoder(N,Δ,Pe1,Pe2) for the degraded DMBCs with rate-limited feedback (with rate limited by Rf) is defined as follows.(i)
The feedback alphabet𝒦 satisfies limN→∞(log∥𝒦∥/N)≤Rf. The feedback is generated independent of the channel output symbols.(ii)
The stochastic channel encoderφ is specified by a matrix of conditional probability distributions φ(xN∣s,w,k) which denotes the probability that the message s,w and the feedback k are encoded as the channel input xN, where xN∈𝒳N,s∈𝒮,w∈𝒲,k∈𝒦, and ∑xNφ(xN∣s,w,k)=1. Note that 𝒮 and 𝒲 are the confidential and common message sets.(iii)
Decoder 1 is a mappingh1:𝒴N→𝒮×𝒲. The input of decoder 1 is YN, and the output is S^,W^. The decoding error probability of receiver 1 is defined as Pe1=Pr{h1(YN)≠(S,W)}. Similarly, Decoder 2 is defined as a mapping h2:𝒵N→𝒲. The input of decoder 2 is ZN, and the output is W^^. The decoding error probability of receiver 2 is defined as Pe2=Pr{h2(ZN)≠W}.(iv)
The equivocation at receiver 2 is defined as(1)Δ=1NH(S∣ZN).A rate triple(R0,R1,Re) is said to be achievable for the model in Figure 2 if there exists a channel encoder-decoder (N,Δ,Pe1,Pe2) defined in Definition 1, such that
(2)limN→∞log∥𝒲∥N=R0,(3)limN→∞log∥𝒮∥N=R1,(4)limN→∞log∥𝒦∥N=Rf′≤Rf,(5)limN→∞Δ≥Re,(6)Pe1≤ϵ,Pe2≤ϵ,
where ϵ is an arbitrary small positive real number, R0,R1,Rf′ are the rates of the common messages, confidential messages, and feedback, and Re is the equivocation rate of the confidential messages. Note that the feedback rate is limited by Rf. The capacity-equivocation region is defined as the convex closure of all achievable rate triples (R0,R1,Re). The capacity-equivocation region of the degraded DMBCs with rate-limited feedback is shown in the following theorem.Theorem 2.
For the degraded DMBCs with limited feedback rateRf, the capacity-equivocation region is the set
(7)ℛd={Re≤I(X;Y∣U)-I(X;Z∣U)+Rf(R0,R1,Re):0≤Re≤R1,R0≤I(U;Z),R1≤I(X;Y∣U),Re≤I(X;Y∣U)-I(X;Z∣U)+Rf},
where U is an auxiliary random variable and U→X→Y→Z form a Markov chain.The proof of Theorem2 is given in Section 3. The remark of Theorem 2 is shown below.Remark 3.
(i) The secrecy capacity of the model in Figure2 is defined as the maximum rate at which confidential messages can be sent to receiver 1 in perfect secrecy; that is,
(8)Cs=max(R0=0,R1,Re=R1)∈ℛR1,
where ℛ is the capacity-equivocation region. Therefore, by the definition in (8), the secrecy capacity of the degraded DMBCs with limited feedback rate Rf is
(9)Csd=maxmin{I(X;Y∣U),I(X;Y∣U)-I(X;Z∣U)+Rf}.
This result subsumes the secrecy capacity of the degraded wiretap channel with rate-limited feedback (see [4]) by setting the auxiliary random variable U to be constant in (9).
(ii) The capacity-equivocation region in (7) is bigger than that in [2] without feedback. This implies that  feedback can be used to enhance the secrecy in the DMBCs. Note that this finding had already been verified in [3–6].


### 2.2.2. Less and Reversely Less Noisy DMBCs with Noiseless Causal Feedback

The model in Figure3 is based on the assumption that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). The definition of the encoder-decoder for this model is similar to Definition 1 except for the feedback and the encoder. Different from the model in Figure 2, the feedback in Figure 3 is originated causally from the channel outputs of receiver 1 to the transmitter. The stochastic encoder for this model at time i, 1≤i≤N, is defined as fi(xi∣wi,si,yi-1), where wi∈𝒲, si∈𝒮, yi-1∈𝒴i-1 (the channel outputs of receiver 1 before time i) and ∑xi∈𝒳fi(xi∣wi,si,yi-1)=1.A rate triple(R0,R1,Re) is said to be achievable for the model in Figure 3 if there exists a channel encoder-decoder (N,Δ,Pe1,Pe2) such that (2), (3), (5), and (6) hold. Note that the definition of “achievable” here does not include (4) since the feedback in the model of Figure 3 is not rate limited. The definition of secrecy capacity is the same as that in Remark 3. Then, we present the capacity-equivocation regions of the less and reversely less noisy DMBCs with noiseless causal feedback in Theorems 4 and 5, respectively.Theorem 4.
For the less noisy DMBCs with noiseless causal feedback, the capacity-equivocation region is the set(10)ℛl={(R0,R1,Re):0≤Re≤R1,R0≤I(U;Z),R1≤I(X;Y∣U),Re≤H(Y∣Z)},
where U→X→(Y,Z) form a Markov chain.Theorem 5.
For the reversely less noisy DMBCs with noiseless causal feedback, the capacity-equivocation region is the set(11)ℛrl={(R0,R1,Re):0≤Re≤R1,R0≤I(U;Y),R1≤I(X;Y∣U),Re≤H(Y∣X)},
where U→X→(Y,Z) form a Markov chain.The proof of Theorems4 and 5 is given in Section 4. The remark of Theorems 4 and 5 is given below.Remark 6.
(i) By the definition in (8), the secrecy capacity of the less noisy DMBCs with noiseless causal feedback is
(12)Csl=maxmin{I(X;Y∣U),H(Y∣Z)}.
The secrecy capacity of the reversely less noisy DMBCs with noiseless causal feedback is
(13)Csrl=maxmin{I(X;Y∣U),H(Y∣X)}.
Setting the auxiliary random variable U to be constant in (12) and (13), the capacity-equivocation region of the model in [5] is obtained.
(ii) In the model of Figure3, it is assumed that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). This implies Y→X→Z. Therefore, it is easy to see H(Y∣X)=H(Y∣XZ)≤H(Y∣Z); that is, the upper bound on the equivocation rate Re in (11) for the reversely less noisy case is smaller than that in (10) for the less noisy case. This tells that when the eavesdropper is in a better position than the legitimate receiver (see the reversely less noisy case), the uncertainty about the confidential messages at the eavesdropper is decreased. Besides, from (13), we see that even if the eavesdropper is in a better position, the secrecy capacity is a positive value, which means provable secure communication could also be implemented in such a bad condition.


## 2.2.1. Degraded DMBCs with Rate-Limited Feedback

The degraded DMBCs with rate-limited feedback (see Figure2) are under the condition that the channel to receiver 2 is physically degraded from the channel to receiver 1; that is, p(y,z∣x)=p(y∣x)p(z∣y) or X→Y→Z form a Markov chain, where X is the channel input and Y,Z are observations of receiver 1 and 2. In this model, the encoder encodes the messages (W,S) and feedback into codewords XN, where N is the length of the codeword. They are transmitted over a discrete memoryless channel (DMC) with transition probability ∏i=1Np(yi,zi∣xi). Receiver 1 obtains YN and decodes the common and confidential messages (W^,S^). Receiver 2 obtains ZN and decodes the common message W^. More precisely, we define the encoder-decoder (N,Δ,Pe1,Pe2) in Definition 1.Definition 1.
The encoder-decoder(N,Δ,Pe1,Pe2) for the degraded DMBCs with rate-limited feedback (with rate limited by Rf) is defined as follows.(i)
The feedback alphabet𝒦 satisfies limN→∞(log∥𝒦∥/N)≤Rf. The feedback is generated independent of the channel output symbols.(ii)
The stochastic channel encoderφ is specified by a matrix of conditional probability distributions φ(xN∣s,w,k) which denotes the probability that the message s,w and the feedback k are encoded as the channel input xN, where xN∈𝒳N,s∈𝒮,w∈𝒲,k∈𝒦, and ∑xNφ(xN∣s,w,k)=1. Note that 𝒮 and 𝒲 are the confidential and common message sets.(iii)
Decoder 1 is a mappingh1:𝒴N→𝒮×𝒲. The input of decoder 1 is YN, and the output is S^,W^. The decoding error probability of receiver 1 is defined as Pe1=Pr{h1(YN)≠(S,W)}. Similarly, Decoder 2 is defined as a mapping h2:𝒵N→𝒲. The input of decoder 2 is ZN, and the output is W^^. The decoding error probability of receiver 2 is defined as Pe2=Pr{h2(ZN)≠W}.(iv)
The equivocation at receiver 2 is defined as(1)Δ=1NH(S∣ZN).A rate triple(R0,R1,Re) is said to be achievable for the model in Figure 2 if there exists a channel encoder-decoder (N,Δ,Pe1,Pe2) defined in Definition 1, such that
(2)limN→∞log∥𝒲∥N=R0,(3)limN→∞log∥𝒮∥N=R1,(4)limN→∞log∥𝒦∥N=Rf′≤Rf,(5)limN→∞Δ≥Re,(6)Pe1≤ϵ,Pe2≤ϵ,
where ϵ is an arbitrary small positive real number, R0,R1,Rf′ are the rates of the common messages, confidential messages, and feedback, and Re is the equivocation rate of the confidential messages. Note that the feedback rate is limited by Rf. The capacity-equivocation region is defined as the convex closure of all achievable rate triples (R0,R1,Re). The capacity-equivocation region of the degraded DMBCs with rate-limited feedback is shown in the following theorem.Theorem 2.
For the degraded DMBCs with limited feedback rateRf, the capacity-equivocation region is the set
(7)ℛd={Re≤I(X;Y∣U)-I(X;Z∣U)+Rf(R0,R1,Re):0≤Re≤R1,R0≤I(U;Z),R1≤I(X;Y∣U),Re≤I(X;Y∣U)-I(X;Z∣U)+Rf},
where U is an auxiliary random variable and U→X→Y→Z form a Markov chain.The proof of Theorem2 is given in Section 3. The remark of Theorem 2 is shown below.Remark 3.
(i) The secrecy capacity of the model in Figure2 is defined as the maximum rate at which confidential messages can be sent to receiver 1 in perfect secrecy; that is,
(8)Cs=max(R0=0,R1,Re=R1)∈ℛR1,
where ℛ is the capacity-equivocation region. Therefore, by the definition in (8), the secrecy capacity of the degraded DMBCs with limited feedback rate Rf is
(9)Csd=maxmin{I(X;Y∣U),I(X;Y∣U)-I(X;Z∣U)+Rf}.
This result subsumes the secrecy capacity of the degraded wiretap channel with rate-limited feedback (see [4]) by setting the auxiliary random variable U to be constant in (9).
(ii) The capacity-equivocation region in (7) is bigger than that in [2] without feedback. This implies that  feedback can be used to enhance the secrecy in the DMBCs. Note that this finding had already been verified in [3–6].


## 2.2.2. Less and Reversely Less Noisy DMBCs with Noiseless Causal Feedback

The model in Figure3 is based on the assumption that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). The definition of the encoder-decoder for this model is similar to Definition 1 except for the feedback and the encoder. Different from the model in Figure 2, the feedback in Figure 3 is originated causally from the channel outputs of receiver 1 to the transmitter. The stochastic encoder for this model at time i, 1≤i≤N, is defined as fi(xi∣wi,si,yi-1), where wi∈𝒲, si∈𝒮, yi-1∈𝒴i-1 (the channel outputs of receiver 1 before time i) and ∑xi∈𝒳fi(xi∣wi,si,yi-1)=1.A rate triple(R0,R1,Re) is said to be achievable for the model in Figure 3 if there exists a channel encoder-decoder (N,Δ,Pe1,Pe2) such that (2), (3), (5), and (6) hold. Note that the definition of “achievable” here does not include (4) since the feedback in the model of Figure 3 is not rate limited. The definition of secrecy capacity is the same as that in Remark 3. Then, we present the capacity-equivocation regions of the less and reversely less noisy DMBCs with noiseless causal feedback in Theorems 4 and 5, respectively.Theorem 4.
For the less noisy DMBCs with noiseless causal feedback, the capacity-equivocation region is the set(10)ℛl={(R0,R1,Re):0≤Re≤R1,R0≤I(U;Z),R1≤I(X;Y∣U),Re≤H(Y∣Z)},
where U→X→(Y,Z) form a Markov chain.Theorem 5.
For the reversely less noisy DMBCs with noiseless causal feedback, the capacity-equivocation region is the set(11)ℛrl={(R0,R1,Re):0≤Re≤R1,R0≤I(U;Y),R1≤I(X;Y∣U),Re≤H(Y∣X)},
where U→X→(Y,Z) form a Markov chain.The proof of Theorems4 and 5 is given in Section 4. The remark of Theorems 4 and 5 is given below.Remark 6.
(i) By the definition in (8), the secrecy capacity of the less noisy DMBCs with noiseless causal feedback is
(12)Csl=maxmin{I(X;Y∣U),H(Y∣Z)}.
The secrecy capacity of the reversely less noisy DMBCs with noiseless causal feedback is
(13)Csrl=maxmin{I(X;Y∣U),H(Y∣X)}.
Setting the auxiliary random variable U to be constant in (12) and (13), the capacity-equivocation region of the model in [5] is obtained.
(ii) In the model of Figure3, it is assumed that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). This implies Y→X→Z. Therefore, it is easy to see H(Y∣X)=H(Y∣XZ)≤H(Y∣Z); that is, the upper bound on the equivocation rate Re in (11) for the reversely less noisy case is smaller than that in (10) for the less noisy case. This tells that when the eavesdropper is in a better position than the legitimate receiver (see the reversely less noisy case), the uncertainty about the confidential messages at the eavesdropper is decreased. Besides, from (13), we see that even if the eavesdropper is in a better position, the secrecy capacity is a positive value, which means provable secure communication could also be implemented in such a bad condition.


## 3. Proof of Theorem2

In this section, Theorem2 is proved. The converse part of Theorem 2 gives the outer bound on the capacity-equivocation region of the degraded DMBCs with rate-limited feedback. The proof of the converse part is shown in Section 3.1. The key tools used in the proof include the identification of the random variables and Csiszár’s sum equality [2]. In Section 3.2, to prove the direct part of Theorem 2, a coding scheme is provided to achieve the achievable rate triples in ℛd. The key ideas in the coding scheme are inspired by [4]. However, [4] only considers the transmission of the confidential messages. Our coding scheme considers both the confidential and common messages.


### 3.1. The Converse Part of Theorem2

In order to find the identification of the auxiliary random variables that satisfy the capacity-equivocation region characterized byℛd, we prove the converse part for the equivalent region (the fact that the two regions are equivalent follows similarly from [10, Chapter 5, problem 5.8]) containing all the rate triples (R0,R1,Re) such that
(14)0≤Re≤R1,(15)R0≤I(U;Z),(16)R0+R1≤I(X;Y∣U)+I(U;Z),(17)Re≤I(X;Y∣U)-I(X;Z∣U)+Rf.Now we show that allachievable triples (R0,R1,Re) satisfy (14), (15), (16), and (17).Condition (14) is proved as follows:
(18)Re≤limN→∞Δ=limN→∞H(S∣ZN)N≤limN→∞H(S)N=R1.To prove condition (15), we calculate
(19)H(W)=I(W;ZN)+H(W∣ZN)≤(a3.1)I(W;ZN)+ϵ1=∑i=1N‍I(W;Zi∣Zi-1)+ϵ1=∑i=1N‍I(W;Zi∣Zi+1N)+ϵ1=∑i=1N‍[I(WYi-1;Zi∣Zi+1N)-I(Yi-1;Zi∣Zi+1NW)]+ϵ1≤∑i=1N‍[I(WYi-1Zi+1N;Zi)-I(Yi-1;Zi∣Zi+1NW)]+ϵ1≤∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1,
where (a3.1) follows from Fano’s inequality and ϵ1 is a small positive number. Note that KN=(K1,K2,…,KN), where Ki is the feedback symbol at time i, 1≤i≤N.To prove condition (16), we consider
(20)H(S)+H(W)=H(S∣WKN)+H(W)=I(S;YN∣WKN)+H(S∣YNWKN)+I(W;ZN)+H(W∣ZN)≤(a3.2)I(S;YN∣WKN)+ϵ2+I(WKN;ZN)+ϵ1=∑i=1N‍I(S;Yi∣Yi-1WKN)+∑i=1N‍I(WKN;Zi∣Zi+1N)+ϵ1+ϵ2=∑i=1N‍[I(SZi+1N;Yi∣Yi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍[I(WKNYi-1;Zi∣Zi+1N)-I(Yi-1;Zi∣Zi+1NWKN)]+ϵ1+ϵ2=∑i=1N‍[I(Zi+1N;Yi∣Yi-1WKN)+I(S;Yi∣Zi+1NYi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍[I(WKNYi-1;Zi∣Zi+1N)-I(Yi-1;Zi∣Zi+1NWKN)]+ϵ1+ϵ2≤∑i=1N‍[I(Zi+1N;Yi∣Yi-1WKN)+I(S;Yi∣Zi+1NYi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍[I(WKNYi-1Zi+1N;Zi)-I(Yi-1;Zi∣Zi+1NWKN)]+ϵ1+ϵ2=(a3.3)∑i=1N‍[I(S;Yi∣Zi+1NYi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1+ϵ2≤∑i=1N‍I(S;Yi∣Zi+1NYi-1WKN)+∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1+ϵ2,
where ϵ2 is a small positive number and (a3.2) and (a3.3) follow from Fano’s inequality and Csiszár’s sum equality [2]; that is, ∑i=1NI(Zi+1N;Yi∣Yi-1WKN)=∑i=1NI(Yi-1;Zi∣Zi+1NWKN).To prove condition (17), we calculate
(21)H(S∣ZN)=H(S∣ZN,W)+I(S;W∣ZN)≤H(S∣ZN,W)+H(W∣ZN)=I(S;KN,YN∣ZN,W)+H(S∣ZN,KN,YN,W)+H(W∣ZN)≤I(S;KN,YN∣ZN,W)+H(S∣KN,YN)+H(W∣ZN)=I(S;KN∣ZN,W)+I(S;YN∣KN,ZN,W)+H(S∣KN,YN)+H(W∣ZN)≤H(KN)+I(S;YN∣KN,ZN,W)+H(S∣KN,YN)+H(W∣ZN)≤NRf+I(S;YN∣KN,ZN,W)+ϵ1+ϵ2.The last inequality in (21) follows from the Fano’s inequality and the fact that the feedback rate is limited by Rf. Then, I(S;YN∣KN,ZN,W) will be calculated as follows:
(22)I(S;YN∣KN,ZN,W)=∑i=1N‍I(S;Yi∣Yi-1ZNWKN)=∑i=1N‍I(S;Yi∣Yi-1,Zi-1,Zi,Zi+1N,W,KN)=(a3.4)∑i=1N‍[I(S;Yi∣Yi-1,Zi-1,Zi,Zi+1N,W,KN)+I(Zi-1;Yi∣Yi-1,ZiN,W,KN)-I(Zi-1;Yi∣Yi-1,ZiN,W,S,KN)]=∑i=1N‍[I(S,Zi-1;Yi∣Yi-1,Zi,Zi+1N,W,KN)-I(Zi-1;Yi∣Yi-1,ZiN,W,S,KN)]=∑i=1N‍I(S;Yi∣Yi-1,Zi,Zi+1N,W,KN),
where (a3.4) follows from the Markov chain Yi→Yi-1ZiNWKN→Zi-1 and Yi→Yi-1ZiNWSKN→Zi-1. Then, we introduce a random variable Q which is independent of SWKNXNYNZN and uniformly distributed over {1,2,…,N}. Set U=ZQ+1NYQ-1WKNQ,V=US,Y=YQ,X=XQ,Z=ZQ. It is straightforward to see that U→V→X→Y→Z form a Markov chain. After using the standard time sharing argument [10, Section 5.4], (19), (20), and (22) are simplified into
(23)H(W)≤∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1=NI(U;Z)+ϵ1,(24)H(S)+H(W)≤∑i=1N‍I(S;Yi∣Zi+1NYi-1WKN)+∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1+ϵ2=NI(S;Y∣U)+NI(U;Z)+ϵ1+ϵ2=NI(V;Y∣U)+NI(U;Z)+ϵ1+ϵ2,(25)I(S;YN∣KN,ZN,W)=∑i=1N‍I(S;Yi∣Yi-1,Zi,Zi+1N,W,KN)=NI(S;Y∣Z,U)=NI(US;Y∣Z,U)=NI(V;Y∣Z,U).
Substituting (25) into (21) and utilizing (5), we get
(26)Re≤limN→∞Δ=limN→∞H(S∣ZN)N≤limN→∞NRf+I(S;YN∣KN,ZN,W)+ϵ1+ϵ2N=I(V;Y∣Z,U)+Rf=I(V;Y∣U)-I(V;Z∣U)+Rf.
The last equality in (26) follows from the Markov chain U→V→Y→Z.To finish the proof of (16) and (17), we need to show that  I(V;Y∣U)≤I(X;Y∣U) and I(V;Y∣U)-I(V;Z∣U)≤I(X;Y∣U)-I(X;Z∣U). We first prove I(V;Y∣U,X)=0 and I(V;Z∣U,X)=0:
(27)I(V;Y∣U,X)=H(Y∣U,X)-H(Y∣U,V,X)=(a3.5)H(Y∣X)-H(Y∣X)=0,I(V;Z∣U,X)=H(Z∣U,X)-H(Z∣U,V,X)=(a3.6)H(Z∣X)-H(Z∣X)=0,
where (a3.5) follows from the Markov chains U→X→Y and (UV)→X→Y and (a3.6) follows from the Markov chains U→X→Z and (UV)→X→Z. Utilizing (27), we obtain
(28)I(V;Y∣U)=I(V,X;Y∣U)-I(X;Y∣U,V)=I(X;Y∣U)+I(V;Y∣U,X)-I(X;Y∣U,V)=I(X;Y∣U)-I(X;Y∣U,V),(29)I(V;Z∣U)=I(V,X;Z∣U)-I(X;Z∣U,V)=I(X;Z∣U)+I(V;Z∣U,X)-I(X;Z∣U,V)=I(X;Z∣U)-I(X;Z∣U,V).From (28), it is straightforward to see that  I(V;Y∣U)≤I(X;Y∣U). This proves condition (16).Then, we proveI(V;Y∣U)-I(V;Z∣U)≤I(X;Y∣U)-I(X;Z∣U). Since the channel model in Figure 1 is (physically) degraded, I(X;Y∣U=u,V=v)-I(X;Z∣U=u,V=v)≥0 holds for every (u,v), which implies
(30)I(X;Y∣U,V)-I(X;Z∣U,V)≥0.Therefore, utilizing (28), (29), and (30), we get
(31)I(V;Y∣U)-I(V;Z∣U)=I(X;Y∣U)-I(X;Z∣U)-[I(X;Y∣U,V)-I(X;Z∣U,V)]≤I(X;Y∣U)-I(X;Z∣U).
This proves condition (17).The converse part of Theorem2 is proved.


### 3.2. A Coding Scheme Achievingℛd

A coding scheme is provided to achieve the achievable triples(R0,R1,Re)∈ℛd. The key methods used in the scheme include the superposition coding, rate splitting, and random binning. The confidential message is split into two parts. One part is reliably transmitted using superposition coding and random binning; the other part is securely transmitted with the help of the feedback. Note that Section 3.1 has already given the outer bound on the capacity-equivocation region. When Rf≥I(X;Z∣U), it can be seen from (9) that the secrecy capacity for the degraded DMBCs with rate-limited feedback always equals to I(X;Y∣U). Therefore, in order to investigate the effects of the feedback, the feedback rate Rf<I(X;Z∣U) will only be considered in this subsection.We need to prove that all the triples(R0,R1,Re)∈ℛd for the model of Figure 2 with any feedback rate Rf′ limited by Rf are achievable (see Definition 1). This subsection is organized as follows. The codebook generation and encoding scheme is given in Section 3.2.1. The decoding scheme is given in Section 3.2.2. The analysis of error probability and equivocation are shown in Sections 3.2.3 and 3.2.4, respectively.


#### 3.2.1. Codebook Generation and Encoding

Split the confidential message into two parts; that is,𝒮=(ℳ1,ℳ2). The corresponding variables M1, M2 are uniformly distributed over {1,2,3,…,2NR′} and {1,2,3,…,2NRf′}, where (when Rf≥R1, the confidential message S can be totally protected by using part of the feedback (as the shared key between the transmitter and receiver 1). The remaining part of the feedback is redundant. Therefore, in order to study the effects of the feedback on the capacity region, only Rf<R1 comes into our consideration)
(32)0≤Rf′≤Rf,R′=R1-Rf′>0.It is important to notice thatR1 is the rate of the private message 𝒮, which consists of ℳ1 and ℳ2. This means that
(33)R1=limN→∞log(∥ℳ1∥∥ℳ2∥)N=limN→∞(log∥ℳ1∥N+log∥ℳ2∥N).Define the index sets𝒥N, ℒN, ℱN, and ℳN satisfying
(34)limN→∞1Nlog∥𝒥N∥=I(X;Z∣U)-Rf′,limN→∞1Nlog∥ℒN∥=I(X;Y∣U)-I(X;Z∣U),limN→∞1Nlog∥ℱN∥=Rf′,limN→∞1Nlog∥ℳN∥=I(U;Z).We usej∈𝒥N, l∈ℒN, f∈ℱN, m∈ℳN to index the codeword xN. Take 𝒲⊂ℳN such that (2) holds. Since R1≤I(X;Y∣U), it is easy to see ∥𝒥N×ℒN×ℱN∥≥2NR1. Therefore, let ℳ1=𝒟N×ℒN, ℳ2=ℱN, where 𝒟N is an arbitrary set such that (3) holds. Let gj be a mapping of 𝒥N into 𝒟N partitioning 𝒥N into subsets of size ∥𝒥N∥/∥𝒟N∥; that is,
(35)gj:𝒥N⟶𝒟N,
where gj(j)=d,j∈𝒥N,d∈𝒟N.For eachw∈𝒲, we generate a codeword uN(w) according to ∏i=1Np(ui). Then, for each uN(w), a codebook 𝒞ℬw (see Figure 4) containing ∥𝒥N∥·∥ℒN∥·∥ℱN∥ codewords xjlfmN is constructed according to ∏i=1Np(xi∣ui), where j∈𝒥N,l∈ℒN,f∈ℱN,m=w∈ℳ. Those xN are put into ∥ℒN∥·∥ℱN∥ bins so that each bin contains ∥𝒥N∥ codewords. Each bin is indexed by (l,f), where l∈ℒN, f∈ℱN. Then, we divide each bin into ∥𝒟N∥ subbins such that each subbin contains ∥𝒥N∥/∥𝒟N∥ codewords. The codebook structure is presented in Figure 4.Figure 4
The codebook𝒞ℬw for each uN(w).Let𝒦={1,2,3,…,2NRf′}, where k∈𝒦 is the key sent to the transmitter from receiver 1 through the secure feedback link. It is kept secret from receiver 2. The corresponding variable K is uniformly distributed over 𝒦 and independent of S and W.In order to sends=(d,l,m2)∈𝒟N×ℒN×ℱN and w∈𝒲, a codeword xjlfmN is chosen as follows. According to the common message w, we first find the sequence uN(w). For the determined uN(w), there is a corresponding codebook 𝒞ℬw; see Figure 4. Then, the corresponding codeword xjlfmN is sent into the channel, where j is chosen randomly from the set gj-1(d), f=k⊕m2, and m=w (here ⊕ is modulo addition over ℱN). Figure 4 shows how to select xjlfmN in detail. According to uN(w), we can find the corresponding codebook 𝒞ℬw. In the codebook 𝒞ℬw, we choose the corresponding bin according to f and l. Then, in that bin, the subbin is found according to d. Finally, a codeword xN (which is denoted by xjlfmN) is randomly chosen from that subbin.


#### 3.2.2. Decoding

Receiver 2 tries to find a unique sequenceuN(w^^) such that (uN(w^^),zN)∈TUZN(ϵ1). If there exists such a unique sequence, decoder 2 outputs w^^; otherwise, an error is declared. Since the size of 𝒲 is smaller than 2NI(U;Z), the decoding error probability for receiver 2 approaches zero.For receiver 1, he can also decode the common messagew^ since the output of channel 2 is a degraded version of the output of channel 1. Then, receiver 1 tries to find a unique codeword xj^l^f^m^N indexed by j^, l^, f^, m^, such that (xj^l^f^m^N,yN)∈TXY∣UN(ϵ2). If there exists such a unique codeword xj^l^f^m^N, receiver 1 calculates f^⊖k as m^2 (here ⊖ is modulo subtraction over ℱN, and m^=w^) and finds d^ according to gj(j^). Note that receiver 1 knows the secret key k. Decoder 1 outputs s^=(d^,l^,m^2) and w^. If no such xj^l^f^m^N or more than one such xj^l^f^m^N exist, an error is declared.


#### 3.2.3. Analysis of Error Probability

Since the number ofuN(w) is upper bound by 2NI(U;Z) and the DMBCs under discussion are degraded, both receivers can decode the common message w with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, it can be calculated that given the codeword uN(w), the number of xN is
(36)∥ℱN∥·∥𝒥N∥·∥ℒN∥=2NI(X;Y∣U).So, after determining the codeworduN(w), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. This proves (6).


#### 3.2.4. Analysis of Equivocation

The proof of (5) is given below:
(37)H(S∣ZN)=H(M1,M2∣ZN)=H(M1∣ZN)+H(M2∣ZN,M1)≥H(M1∣ZN)+H(M2∣ZN,M1,K⊕M2)=(b3.1)H(M1∣ZN)+H(M2∣K⊕M2)=(b3.2)H(M1∣ZN)+H(M2)=(b3.3)H(M1∣ZN)+NRf′,
where (b3.1) follows from the Markov chain M2→M2⊕K→(ZN,M1), (b3.2) follows from the fact that M2 is independent of M2⊕K, and (b3.3) follows from that M2 is uniformly distributed over {1,2,3,…,2NRf′}. The proof of the fact that M2 is independent of M2⊕K is shown as follows (the proof can also be seen in [6]):
(38)p(M2⊕K=a)=∑k‍p(M2⊕K=a∣K=k)p(K=k)=(b3.4)∑k‍p(M2⊕K=a∣K=k)1∥ℱN∥=1∥ℱN∥∑k‍p(M2⊕K=a∣K=k)=1∥ℱN∥∑k‍p(M2=a⊖k∣K=k)=(b3.5)1∥ℱN∥∑k‍p(M2=a⊖k)=1∥ℱN∥p(M2⊕K=a,M2=m2)=p(K=a⊖m2,M2=m2)=(b3.6)p(K=a⊖m2)p(M2=m2)=(b3.7)1∥ℱN∥·1∥ℱN∥,
where (b3.5) and (b3.6) follow from that M2 is independent of K, and (b3.4) and (b3.7) follow from that M2 and K are both uniformly distributed over ℱN. According to (38),
(39)p(M2⊕K=a,M2=m2)=p(M2⊕K=a)p(M2=m2).
Therefore, M2 is independent of M2⊕K.Next, we focus on the first term in (37). The method of the equivocation analysis in [2] will be used:
(40)H(M1∣ZN)≥H(M1∣ZN,W)=H(M1,ZN∣W)-H(ZN∣W)=H(M1,ZN,XN∣W)-H(XN∣M1,ZN,W)-H(ZN∣W)=H(M1,XN∣W)+H(ZN∣M1,XN,W)-H(XN∣M1,ZN,W)-H(ZN∣W)≥H(XN∣W)+H(ZN∣M1,XN,W)-H(XN∣M1,ZN,W)-H(ZN∣W).
Note that W in inequality (40) is the random variable of the common message 𝒲. The four terms H(XN∣W), H(ZN∣M1,XN,W), H(XN∣M1,ZN,W), and H(ZN∣W) will be bounded as follows.Givenw∈𝒲, the number of xN is ∥𝒥N∥·∥ℒN∥·∥ℱN∥. By applying [12, Lemma 2.5], we obtain
(41)H(XN∣W)≥log(∥𝒥N∥·∥ℒN∥·∥ℱN∥)-1=NI(X;Y∣U)-1.Since(M1,W)→XN→ZN and the channel to receiver 2 is discrete memoryless, it is easy to get
(42)H(ZN∣M1,XN,W)=H(ZN∣XN)=NH(Z∣X).With the knowledge of(d,l)∈ℳ1 and w∈𝒲, the number of xN is
(43)2NRf′·∥𝒥N∥∥𝒟N∥<2NRf′·∥𝒥N∥=2NRf′·2N(I(X;Z∣U)-Rf′)=2NI(X;Z∣U).So, receiver 2 can decode the codewordxN with error probability approaching zero by using the standard channel coding theorem [11, Theorem 7.7.1]. Therefore, using Fano’s inequality, we get
(44)H(XN∣M1,ZN,W)⟶0.Moreover, using the similar deduction in [2, Section 4], we get
(45)H(ZN∣W)≤log∥TZ∣UN(ϵ1)∥≤NH(Z∣U).Substituting (41), (42), (44), and (45) into (40), we get
(46)H(M1∣ZN)≥NI(X;Y∣U)+NH(Z∣X)-NH(Z∣U)=NI(X;Y∣U)-NI(X;Z∣U),
where the equality in (46) follows from the Markov chain U→X→Z.Finally, (5) is verified by substituting (46) into (37):
(47)limN→∞Δ=limN→∞H(S∣ZN)N≥limN→∞(H(M1∣ZN)N+Rf′)≥limN→∞(NI(X;Y∣U)-NI(X;Z∣U)N+Rf′)=I(X;Y∣U)-I(X;Z∣U)+Rf′≥Re.
This completes the proof of Theorem 2.


## 3.1. The Converse Part of Theorem2

In order to find the identification of the auxiliary random variables that satisfy the capacity-equivocation region characterized byℛd, we prove the converse part for the equivalent region (the fact that the two regions are equivalent follows similarly from [10, Chapter 5, problem 5.8]) containing all the rate triples (R0,R1,Re) such that
(14)0≤Re≤R1,(15)R0≤I(U;Z),(16)R0+R1≤I(X;Y∣U)+I(U;Z),(17)Re≤I(X;Y∣U)-I(X;Z∣U)+Rf.Now we show that allachievable triples (R0,R1,Re) satisfy (14), (15), (16), and (17).Condition (14) is proved as follows:
(18)Re≤limN→∞Δ=limN→∞H(S∣ZN)N≤limN→∞H(S)N=R1.To prove condition (15), we calculate
(19)H(W)=I(W;ZN)+H(W∣ZN)≤(a3.1)I(W;ZN)+ϵ1=∑i=1N‍I(W;Zi∣Zi-1)+ϵ1=∑i=1N‍I(W;Zi∣Zi+1N)+ϵ1=∑i=1N‍[I(WYi-1;Zi∣Zi+1N)-I(Yi-1;Zi∣Zi+1NW)]+ϵ1≤∑i=1N‍[I(WYi-1Zi+1N;Zi)-I(Yi-1;Zi∣Zi+1NW)]+ϵ1≤∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1,
where (a3.1) follows from Fano’s inequality and ϵ1 is a small positive number. Note that KN=(K1,K2,…,KN), where Ki is the feedback symbol at time i, 1≤i≤N.To prove condition (16), we consider
(20)H(S)+H(W)=H(S∣WKN)+H(W)=I(S;YN∣WKN)+H(S∣YNWKN)+I(W;ZN)+H(W∣ZN)≤(a3.2)I(S;YN∣WKN)+ϵ2+I(WKN;ZN)+ϵ1=∑i=1N‍I(S;Yi∣Yi-1WKN)+∑i=1N‍I(WKN;Zi∣Zi+1N)+ϵ1+ϵ2=∑i=1N‍[I(SZi+1N;Yi∣Yi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍[I(WKNYi-1;Zi∣Zi+1N)-I(Yi-1;Zi∣Zi+1NWKN)]+ϵ1+ϵ2=∑i=1N‍[I(Zi+1N;Yi∣Yi-1WKN)+I(S;Yi∣Zi+1NYi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍[I(WKNYi-1;Zi∣Zi+1N)-I(Yi-1;Zi∣Zi+1NWKN)]+ϵ1+ϵ2≤∑i=1N‍[I(Zi+1N;Yi∣Yi-1WKN)+I(S;Yi∣Zi+1NYi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍[I(WKNYi-1Zi+1N;Zi)-I(Yi-1;Zi∣Zi+1NWKN)]+ϵ1+ϵ2=(a3.3)∑i=1N‍[I(S;Yi∣Zi+1NYi-1WKN)-I(Zi+1N;Yi∣Yi-1WKNS)]+∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1+ϵ2≤∑i=1N‍I(S;Yi∣Zi+1NYi-1WKN)+∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1+ϵ2,
where ϵ2 is a small positive number and (a3.2) and (a3.3) follow from Fano’s inequality and Csiszár’s sum equality [2]; that is, ∑i=1NI(Zi+1N;Yi∣Yi-1WKN)=∑i=1NI(Yi-1;Zi∣Zi+1NWKN).To prove condition (17), we calculate
(21)H(S∣ZN)=H(S∣ZN,W)+I(S;W∣ZN)≤H(S∣ZN,W)+H(W∣ZN)=I(S;KN,YN∣ZN,W)+H(S∣ZN,KN,YN,W)+H(W∣ZN)≤I(S;KN,YN∣ZN,W)+H(S∣KN,YN)+H(W∣ZN)=I(S;KN∣ZN,W)+I(S;YN∣KN,ZN,W)+H(S∣KN,YN)+H(W∣ZN)≤H(KN)+I(S;YN∣KN,ZN,W)+H(S∣KN,YN)+H(W∣ZN)≤NRf+I(S;YN∣KN,ZN,W)+ϵ1+ϵ2.The last inequality in (21) follows from the Fano’s inequality and the fact that the feedback rate is limited by Rf. Then, I(S;YN∣KN,ZN,W) will be calculated as follows:
(22)I(S;YN∣KN,ZN,W)=∑i=1N‍I(S;Yi∣Yi-1ZNWKN)=∑i=1N‍I(S;Yi∣Yi-1,Zi-1,Zi,Zi+1N,W,KN)=(a3.4)∑i=1N‍[I(S;Yi∣Yi-1,Zi-1,Zi,Zi+1N,W,KN)+I(Zi-1;Yi∣Yi-1,ZiN,W,KN)-I(Zi-1;Yi∣Yi-1,ZiN,W,S,KN)]=∑i=1N‍[I(S,Zi-1;Yi∣Yi-1,Zi,Zi+1N,W,KN)-I(Zi-1;Yi∣Yi-1,ZiN,W,S,KN)]=∑i=1N‍I(S;Yi∣Yi-1,Zi,Zi+1N,W,KN),
where (a3.4) follows from the Markov chain Yi→Yi-1ZiNWKN→Zi-1 and Yi→Yi-1ZiNWSKN→Zi-1. Then, we introduce a random variable Q which is independent of SWKNXNYNZN and uniformly distributed over {1,2,…,N}. Set U=ZQ+1NYQ-1WKNQ,V=US,Y=YQ,X=XQ,Z=ZQ. It is straightforward to see that U→V→X→Y→Z form a Markov chain. After using the standard time sharing argument [10, Section 5.4], (19), (20), and (22) are simplified into
(23)H(W)≤∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1=NI(U;Z)+ϵ1,(24)H(S)+H(W)≤∑i=1N‍I(S;Yi∣Zi+1NYi-1WKN)+∑i=1N‍I(WKNYi-1Zi+1N;Zi)+ϵ1+ϵ2=NI(S;Y∣U)+NI(U;Z)+ϵ1+ϵ2=NI(V;Y∣U)+NI(U;Z)+ϵ1+ϵ2,(25)I(S;YN∣KN,ZN,W)=∑i=1N‍I(S;Yi∣Yi-1,Zi,Zi+1N,W,KN)=NI(S;Y∣Z,U)=NI(US;Y∣Z,U)=NI(V;Y∣Z,U).
Substituting (25) into (21) and utilizing (5), we get
(26)Re≤limN→∞Δ=limN→∞H(S∣ZN)N≤limN→∞NRf+I(S;YN∣KN,ZN,W)+ϵ1+ϵ2N=I(V;Y∣Z,U)+Rf=I(V;Y∣U)-I(V;Z∣U)+Rf.
The last equality in (26) follows from the Markov chain U→V→Y→Z.To finish the proof of (16) and (17), we need to show that  I(V;Y∣U)≤I(X;Y∣U) and I(V;Y∣U)-I(V;Z∣U)≤I(X;Y∣U)-I(X;Z∣U). We first prove I(V;Y∣U,X)=0 and I(V;Z∣U,X)=0:
(27)I(V;Y∣U,X)=H(Y∣U,X)-H(Y∣U,V,X)=(a3.5)H(Y∣X)-H(Y∣X)=0,I(V;Z∣U,X)=H(Z∣U,X)-H(Z∣U,V,X)=(a3.6)H(Z∣X)-H(Z∣X)=0,
where (a3.5) follows from the Markov chains U→X→Y and (UV)→X→Y and (a3.6) follows from the Markov chains U→X→Z and (UV)→X→Z. Utilizing (27), we obtain
(28)I(V;Y∣U)=I(V,X;Y∣U)-I(X;Y∣U,V)=I(X;Y∣U)+I(V;Y∣U,X)-I(X;Y∣U,V)=I(X;Y∣U)-I(X;Y∣U,V),(29)I(V;Z∣U)=I(V,X;Z∣U)-I(X;Z∣U,V)=I(X;Z∣U)+I(V;Z∣U,X)-I(X;Z∣U,V)=I(X;Z∣U)-I(X;Z∣U,V).From (28), it is straightforward to see that  I(V;Y∣U)≤I(X;Y∣U). This proves condition (16).Then, we proveI(V;Y∣U)-I(V;Z∣U)≤I(X;Y∣U)-I(X;Z∣U). Since the channel model in Figure 1 is (physically) degraded, I(X;Y∣U=u,V=v)-I(X;Z∣U=u,V=v)≥0 holds for every (u,v), which implies
(30)I(X;Y∣U,V)-I(X;Z∣U,V)≥0.Therefore, utilizing (28), (29), and (30), we get
(31)I(V;Y∣U)-I(V;Z∣U)=I(X;Y∣U)-I(X;Z∣U)-[I(X;Y∣U,V)-I(X;Z∣U,V)]≤I(X;Y∣U)-I(X;Z∣U).
This proves condition (17).The converse part of Theorem2 is proved.


## 3.2. A Coding Scheme Achievingℛd

A coding scheme is provided to achieve the achievable triples(R0,R1,Re)∈ℛd. The key methods used in the scheme include the superposition coding, rate splitting, and random binning. The confidential message is split into two parts. One part is reliably transmitted using superposition coding and random binning; the other part is securely transmitted with the help of the feedback. Note that Section 3.1 has already given the outer bound on the capacity-equivocation region. When Rf≥I(X;Z∣U), it can be seen from (9) that the secrecy capacity for the degraded DMBCs with rate-limited feedback always equals to I(X;Y∣U). Therefore, in order to investigate the effects of the feedback, the feedback rate Rf<I(X;Z∣U) will only be considered in this subsection.We need to prove that all the triples(R0,R1,Re)∈ℛd for the model of Figure 2 with any feedback rate Rf′ limited by Rf are achievable (see Definition 1). This subsection is organized as follows. The codebook generation and encoding scheme is given in Section 3.2.1. The decoding scheme is given in Section 3.2.2. The analysis of error probability and equivocation are shown in Sections 3.2.3 and 3.2.4, respectively.


### 3.2.1. Codebook Generation and Encoding

Split the confidential message into two parts; that is,𝒮=(ℳ1,ℳ2). The corresponding variables M1, M2 are uniformly distributed over {1,2,3,…,2NR′} and {1,2,3,…,2NRf′}, where (when Rf≥R1, the confidential message S can be totally protected by using part of the feedback (as the shared key between the transmitter and receiver 1). The remaining part of the feedback is redundant. Therefore, in order to study the effects of the feedback on the capacity region, only Rf<R1 comes into our consideration)
(32)0≤Rf′≤Rf,R′=R1-Rf′>0.It is important to notice thatR1 is the rate of the private message 𝒮, which consists of ℳ1 and ℳ2. This means that
(33)R1=limN→∞log(∥ℳ1∥∥ℳ2∥)N=limN→∞(log∥ℳ1∥N+log∥ℳ2∥N).Define the index sets𝒥N, ℒN, ℱN, and ℳN satisfying
(34)limN→∞1Nlog∥𝒥N∥=I(X;Z∣U)-Rf′,limN→∞1Nlog∥ℒN∥=I(X;Y∣U)-I(X;Z∣U),limN→∞1Nlog∥ℱN∥=Rf′,limN→∞1Nlog∥ℳN∥=I(U;Z).We usej∈𝒥N, l∈ℒN, f∈ℱN, m∈ℳN to index the codeword xN. Take 𝒲⊂ℳN such that (2) holds. Since R1≤I(X;Y∣U), it is easy to see ∥𝒥N×ℒN×ℱN∥≥2NR1. Therefore, let ℳ1=𝒟N×ℒN, ℳ2=ℱN, where 𝒟N is an arbitrary set such that (3) holds. Let gj be a mapping of 𝒥N into 𝒟N partitioning 𝒥N into subsets of size ∥𝒥N∥/∥𝒟N∥; that is,
(35)gj:𝒥N⟶𝒟N,
where gj(j)=d,j∈𝒥N,d∈𝒟N.For eachw∈𝒲, we generate a codeword uN(w) according to ∏i=1Np(ui). Then, for each uN(w), a codebook 𝒞ℬw (see Figure 4) containing ∥𝒥N∥·∥ℒN∥·∥ℱN∥ codewords xjlfmN is constructed according to ∏i=1Np(xi∣ui), where j∈𝒥N,l∈ℒN,f∈ℱN,m=w∈ℳ. Those xN are put into ∥ℒN∥·∥ℱN∥ bins so that each bin contains ∥𝒥N∥ codewords. Each bin is indexed by (l,f), where l∈ℒN, f∈ℱN. Then, we divide each bin into ∥𝒟N∥ subbins such that each subbin contains ∥𝒥N∥/∥𝒟N∥ codewords. The codebook structure is presented in Figure 4.Figure 4
The codebook𝒞ℬw for each uN(w).Let𝒦={1,2,3,…,2NRf′}, where k∈𝒦 is the key sent to the transmitter from receiver 1 through the secure feedback link. It is kept secret from receiver 2. The corresponding variable K is uniformly distributed over 𝒦 and independent of S and W.In order to sends=(d,l,m2)∈𝒟N×ℒN×ℱN and w∈𝒲, a codeword xjlfmN is chosen as follows. According to the common message w, we first find the sequence uN(w). For the determined uN(w), there is a corresponding codebook 𝒞ℬw; see Figure 4. Then, the corresponding codeword xjlfmN is sent into the channel, where j is chosen randomly from the set gj-1(d), f=k⊕m2, and m=w (here ⊕ is modulo addition over ℱN). Figure 4 shows how to select xjlfmN in detail. According to uN(w), we can find the corresponding codebook 𝒞ℬw. In the codebook 𝒞ℬw, we choose the corresponding bin according to f and l. Then, in that bin, the subbin is found according to d. Finally, a codeword xN (which is denoted by xjlfmN) is randomly chosen from that subbin.


### 3.2.2. Decoding

Receiver 2 tries to find a unique sequenceuN(w^^) such that (uN(w^^),zN)∈TUZN(ϵ1). If there exists such a unique sequence, decoder 2 outputs w^^; otherwise, an error is declared. Since the size of 𝒲 is smaller than 2NI(U;Z), the decoding error probability for receiver 2 approaches zero.For receiver 1, he can also decode the common messagew^ since the output of channel 2 is a degraded version of the output of channel 1. Then, receiver 1 tries to find a unique codeword xj^l^f^m^N indexed by j^, l^, f^, m^, such that (xj^l^f^m^N,yN)∈TXY∣UN(ϵ2). If there exists such a unique codeword xj^l^f^m^N, receiver 1 calculates f^⊖k as m^2 (here ⊖ is modulo subtraction over ℱN, and m^=w^) and finds d^ according to gj(j^). Note that receiver 1 knows the secret key k. Decoder 1 outputs s^=(d^,l^,m^2) and w^. If no such xj^l^f^m^N or more than one such xj^l^f^m^N exist, an error is declared.


### 3.2.3. Analysis of Error Probability

Since the number ofuN(w) is upper bound by 2NI(U;Z) and the DMBCs under discussion are degraded, both receivers can decode the common message w with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, it can be calculated that given the codeword uN(w), the number of xN is
(36)∥ℱN∥·∥𝒥N∥·∥ℒN∥=2NI(X;Y∣U).So, after determining the codeworduN(w), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. This proves (6).


### 3.2.4. Analysis of Equivocation

The proof of (5) is given below:
(37)H(S∣ZN)=H(M1,M2∣ZN)=H(M1∣ZN)+H(M2∣ZN,M1)≥H(M1∣ZN)+H(M2∣ZN,M1,K⊕M2)=(b3.1)H(M1∣ZN)+H(M2∣K⊕M2)=(b3.2)H(M1∣ZN)+H(M2)=(b3.3)H(M1∣ZN)+NRf′,
where (b3.1) follows from the Markov chain M2→M2⊕K→(ZN,M1), (b3.2) follows from the fact that M2 is independent of M2⊕K, and (b3.3) follows from that M2 is uniformly distributed over {1,2,3,…,2NRf′}. The proof of the fact that M2 is independent of M2⊕K is shown as follows (the proof can also be seen in [6]):
(38)p(M2⊕K=a)=∑k‍p(M2⊕K=a∣K=k)p(K=k)=(b3.4)∑k‍p(M2⊕K=a∣K=k)1∥ℱN∥=1∥ℱN∥∑k‍p(M2⊕K=a∣K=k)=1∥ℱN∥∑k‍p(M2=a⊖k∣K=k)=(b3.5)1∥ℱN∥∑k‍p(M2=a⊖k)=1∥ℱN∥p(M2⊕K=a,M2=m2)=p(K=a⊖m2,M2=m2)=(b3.6)p(K=a⊖m2)p(M2=m2)=(b3.7)1∥ℱN∥·1∥ℱN∥,
where (b3.5) and (b3.6) follow from that M2 is independent of K, and (b3.4) and (b3.7) follow from that M2 and K are both uniformly distributed over ℱN. According to (38),
(39)p(M2⊕K=a,M2=m2)=p(M2⊕K=a)p(M2=m2).
Therefore, M2 is independent of M2⊕K.Next, we focus on the first term in (37). The method of the equivocation analysis in [2] will be used:
(40)H(M1∣ZN)≥H(M1∣ZN,W)=H(M1,ZN∣W)-H(ZN∣W)=H(M1,ZN,XN∣W)-H(XN∣M1,ZN,W)-H(ZN∣W)=H(M1,XN∣W)+H(ZN∣M1,XN,W)-H(XN∣M1,ZN,W)-H(ZN∣W)≥H(XN∣W)+H(ZN∣M1,XN,W)-H(XN∣M1,ZN,W)-H(ZN∣W).
Note that W in inequality (40) is the random variable of the common message 𝒲. The four terms H(XN∣W), H(ZN∣M1,XN,W), H(XN∣M1,ZN,W), and H(ZN∣W) will be bounded as follows.Givenw∈𝒲, the number of xN is ∥𝒥N∥·∥ℒN∥·∥ℱN∥. By applying [12, Lemma 2.5], we obtain
(41)H(XN∣W)≥log(∥𝒥N∥·∥ℒN∥·∥ℱN∥)-1=NI(X;Y∣U)-1.Since(M1,W)→XN→ZN and the channel to receiver 2 is discrete memoryless, it is easy to get
(42)H(ZN∣M1,XN,W)=H(ZN∣XN)=NH(Z∣X).With the knowledge of(d,l)∈ℳ1 and w∈𝒲, the number of xN is
(43)2NRf′·∥𝒥N∥∥𝒟N∥<2NRf′·∥𝒥N∥=2NRf′·2N(I(X;Z∣U)-Rf′)=2NI(X;Z∣U).So, receiver 2 can decode the codewordxN with error probability approaching zero by using the standard channel coding theorem [11, Theorem 7.7.1]. Therefore, using Fano’s inequality, we get
(44)H(XN∣M1,ZN,W)⟶0.Moreover, using the similar deduction in [2, Section 4], we get
(45)H(ZN∣W)≤log∥TZ∣UN(ϵ1)∥≤NH(Z∣U).Substituting (41), (42), (44), and (45) into (40), we get
(46)H(M1∣ZN)≥NI(X;Y∣U)+NH(Z∣X)-NH(Z∣U)=NI(X;Y∣U)-NI(X;Z∣U),
where the equality in (46) follows from the Markov chain U→X→Z.Finally, (5) is verified by substituting (46) into (37):
(47)limN→∞Δ=limN→∞H(S∣ZN)N≥limN→∞(H(M1∣ZN)N+Rf′)≥limN→∞(NI(X;Y∣U)-NI(X;Z∣U)N+Rf′)=I(X;Y∣U)-I(X;Z∣U)+Rf′≥Re.
This completes the proof of Theorem 2.


## 3.2.1. Codebook Generation and Encoding

Split the confidential message into two parts; that is,𝒮=(ℳ1,ℳ2). The corresponding variables M1, M2 are uniformly distributed over {1,2,3,…,2NR′} and {1,2,3,…,2NRf′}, where (when Rf≥R1, the confidential message S can be totally protected by using part of the feedback (as the shared key between the transmitter and receiver 1). The remaining part of the feedback is redundant. Therefore, in order to study the effects of the feedback on the capacity region, only Rf<R1 comes into our consideration)
(32)0≤Rf′≤Rf,R′=R1-Rf′>0.It is important to notice thatR1 is the rate of the private message 𝒮, which consists of ℳ1 and ℳ2. This means that
(33)R1=limN→∞log(∥ℳ1∥∥ℳ2∥)N=limN→∞(log∥ℳ1∥N+log∥ℳ2∥N).Define the index sets𝒥N, ℒN, ℱN, and ℳN satisfying
(34)limN→∞1Nlog∥𝒥N∥=I(X;Z∣U)-Rf′,limN→∞1Nlog∥ℒN∥=I(X;Y∣U)-I(X;Z∣U),limN→∞1Nlog∥ℱN∥=Rf′,limN→∞1Nlog∥ℳN∥=I(U;Z).We usej∈𝒥N, l∈ℒN, f∈ℱN, m∈ℳN to index the codeword xN. Take 𝒲⊂ℳN such that (2) holds. Since R1≤I(X;Y∣U), it is easy to see ∥𝒥N×ℒN×ℱN∥≥2NR1. Therefore, let ℳ1=𝒟N×ℒN, ℳ2=ℱN, where 𝒟N is an arbitrary set such that (3) holds. Let gj be a mapping of 𝒥N into 𝒟N partitioning 𝒥N into subsets of size ∥𝒥N∥/∥𝒟N∥; that is,
(35)gj:𝒥N⟶𝒟N,
where gj(j)=d,j∈𝒥N,d∈𝒟N.For eachw∈𝒲, we generate a codeword uN(w) according to ∏i=1Np(ui). Then, for each uN(w), a codebook 𝒞ℬw (see Figure 4) containing ∥𝒥N∥·∥ℒN∥·∥ℱN∥ codewords xjlfmN is constructed according to ∏i=1Np(xi∣ui), where j∈𝒥N,l∈ℒN,f∈ℱN,m=w∈ℳ. Those xN are put into ∥ℒN∥·∥ℱN∥ bins so that each bin contains ∥𝒥N∥ codewords. Each bin is indexed by (l,f), where l∈ℒN, f∈ℱN. Then, we divide each bin into ∥𝒟N∥ subbins such that each subbin contains ∥𝒥N∥/∥𝒟N∥ codewords. The codebook structure is presented in Figure 4.Figure 4
The codebook𝒞ℬw for each uN(w).Let𝒦={1,2,3,…,2NRf′}, where k∈𝒦 is the key sent to the transmitter from receiver 1 through the secure feedback link. It is kept secret from receiver 2. The corresponding variable K is uniformly distributed over 𝒦 and independent of S and W.In order to sends=(d,l,m2)∈𝒟N×ℒN×ℱN and w∈𝒲, a codeword xjlfmN is chosen as follows. According to the common message w, we first find the sequence uN(w). For the determined uN(w), there is a corresponding codebook 𝒞ℬw; see Figure 4. Then, the corresponding codeword xjlfmN is sent into the channel, where j is chosen randomly from the set gj-1(d), f=k⊕m2, and m=w (here ⊕ is modulo addition over ℱN). Figure 4 shows how to select xjlfmN in detail. According to uN(w), we can find the corresponding codebook 𝒞ℬw. In the codebook 𝒞ℬw, we choose the corresponding bin according to f and l. Then, in that bin, the subbin is found according to d. Finally, a codeword xN (which is denoted by xjlfmN) is randomly chosen from that subbin.


## 3.2.2. Decoding

Receiver 2 tries to find a unique sequenceuN(w^^) such that (uN(w^^),zN)∈TUZN(ϵ1). If there exists such a unique sequence, decoder 2 outputs w^^; otherwise, an error is declared. Since the size of 𝒲 is smaller than 2NI(U;Z), the decoding error probability for receiver 2 approaches zero.For receiver 1, he can also decode the common messagew^ since the output of channel 2 is a degraded version of the output of channel 1. Then, receiver 1 tries to find a unique codeword xj^l^f^m^N indexed by j^, l^, f^, m^, such that (xj^l^f^m^N,yN)∈TXY∣UN(ϵ2). If there exists such a unique codeword xj^l^f^m^N, receiver 1 calculates f^⊖k as m^2 (here ⊖ is modulo subtraction over ℱN, and m^=w^) and finds d^ according to gj(j^). Note that receiver 1 knows the secret key k. Decoder 1 outputs s^=(d^,l^,m^2) and w^. If no such xj^l^f^m^N or more than one such xj^l^f^m^N exist, an error is declared.


## 3.2.3. Analysis of Error Probability

Since the number ofuN(w) is upper bound by 2NI(U;Z) and the DMBCs under discussion are degraded, both receivers can decode the common message w with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, it can be calculated that given the codeword uN(w), the number of xN is
(36)∥ℱN∥·∥𝒥N∥·∥ℒN∥=2NI(X;Y∣U).So, after determining the codeworduN(w), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. This proves (6).


## 3.2.4. Analysis of Equivocation

The proof of (5) is given below:
(37)H(S∣ZN)=H(M1,M2∣ZN)=H(M1∣ZN)+H(M2∣ZN,M1)≥H(M1∣ZN)+H(M2∣ZN,M1,K⊕M2)=(b3.1)H(M1∣ZN)+H(M2∣K⊕M2)=(b3.2)H(M1∣ZN)+H(M2)=(b3.3)H(M1∣ZN)+NRf′,
where (b3.1) follows from the Markov chain M2→M2⊕K→(ZN,M1), (b3.2) follows from the fact that M2 is independent of M2⊕K, and (b3.3) follows from that M2 is uniformly distributed over {1,2,3,…,2NRf′}. The proof of the fact that M2 is independent of M2⊕K is shown as follows (the proof can also be seen in [6]):
(38)p(M2⊕K=a)=∑k‍p(M2⊕K=a∣K=k)p(K=k)=(b3.4)∑k‍p(M2⊕K=a∣K=k)1∥ℱN∥=1∥ℱN∥∑k‍p(M2⊕K=a∣K=k)=1∥ℱN∥∑k‍p(M2=a⊖k∣K=k)=(b3.5)1∥ℱN∥∑k‍p(M2=a⊖k)=1∥ℱN∥p(M2⊕K=a,M2=m2)=p(K=a⊖m2,M2=m2)=(b3.6)p(K=a⊖m2)p(M2=m2)=(b3.7)1∥ℱN∥·1∥ℱN∥,
where (b3.5) and (b3.6) follow from that M2 is independent of K, and (b3.4) and (b3.7) follow from that M2 and K are both uniformly distributed over ℱN. According to (38),
(39)p(M2⊕K=a,M2=m2)=p(M2⊕K=a)p(M2=m2).
Therefore, M2 is independent of M2⊕K.Next, we focus on the first term in (37). The method of the equivocation analysis in [2] will be used:
(40)H(M1∣ZN)≥H(M1∣ZN,W)=H(M1,ZN∣W)-H(ZN∣W)=H(M1,ZN,XN∣W)-H(XN∣M1,ZN,W)-H(ZN∣W)=H(M1,XN∣W)+H(ZN∣M1,XN,W)-H(XN∣M1,ZN,W)-H(ZN∣W)≥H(XN∣W)+H(ZN∣M1,XN,W)-H(XN∣M1,ZN,W)-H(ZN∣W).
Note that W in inequality (40) is the random variable of the common message 𝒲. The four terms H(XN∣W), H(ZN∣M1,XN,W), H(XN∣M1,ZN,W), and H(ZN∣W) will be bounded as follows.Givenw∈𝒲, the number of xN is ∥𝒥N∥·∥ℒN∥·∥ℱN∥. By applying [12, Lemma 2.5], we obtain
(41)H(XN∣W)≥log(∥𝒥N∥·∥ℒN∥·∥ℱN∥)-1=NI(X;Y∣U)-1.Since(M1,W)→XN→ZN and the channel to receiver 2 is discrete memoryless, it is easy to get
(42)H(ZN∣M1,XN,W)=H(ZN∣XN)=NH(Z∣X).With the knowledge of(d,l)∈ℳ1 and w∈𝒲, the number of xN is
(43)2NRf′·∥𝒥N∥∥𝒟N∥<2NRf′·∥𝒥N∥=2NRf′·2N(I(X;Z∣U)-Rf′)=2NI(X;Z∣U).So, receiver 2 can decode the codewordxN with error probability approaching zero by using the standard channel coding theorem [11, Theorem 7.7.1]. Therefore, using Fano’s inequality, we get
(44)H(XN∣M1,ZN,W)⟶0.Moreover, using the similar deduction in [2, Section 4], we get
(45)H(ZN∣W)≤log∥TZ∣UN(ϵ1)∥≤NH(Z∣U).Substituting (41), (42), (44), and (45) into (40), we get
(46)H(M1∣ZN)≥NI(X;Y∣U)+NH(Z∣X)-NH(Z∣U)=NI(X;Y∣U)-NI(X;Z∣U),
where the equality in (46) follows from the Markov chain U→X→Z.Finally, (5) is verified by substituting (46) into (37):
(47)limN→∞Δ=limN→∞H(S∣ZN)N≥limN→∞(H(M1∣ZN)N+Rf′)≥limN→∞(NI(X;Y∣U)-NI(X;Z∣U)N+Rf′)=I(X;Y∣U)-I(X;Z∣U)+Rf′≥Re.
This completes the proof of Theorem 2.


## 4. Proof of Theorems4 and 5

In this section, Theorems4 and 5 are proved. In the model of Figure 3, it is assumed that the channel to receiver 1 is independent of the channel to receiver 2; that is, p(y,z∣x)=p(y∣x)p(z∣x). To prove Theorem 4, we first give the outer bound on the capacity-equivocation region of the less noisy DMBCs with noiseless causal feedback in Section 4.1. Then, a coding scheme is provided to achieve the outer bound. Similarly, to prove Theorem 5, the outer bound on the capacity-equivocation region of the reversely less noisy DMBCs with noiseless causal feedback is given in Section 4.2. Moreover, we also provide a coding scheme to achieve the outer bound. The methods used to prove the converse parts of the two theorems are from [5]. The coding schemes are inspired by [3, 5].


### 4.1. Less Noisy DMBCs with Noiseless Causal Feedback

We first show the converse part of Theorem4, and then  we  prove the direct part of Theorem 4 by providing a coding scheme.In order to find the identification of the auxiliary random variables that satisfy the capacity-equivocation region characterized byℛl, we prove the converse part for the equivalent region containing all the rate triples (R0,R1,Re) such that
(48)0≤Re≤R1,(49)R0≤I(U;Z),(50)R0+R1≤I(X;Y∣U)+I(U;Z),(51)Re≤H(Y∣Z).The proof of (48), (49), and (50) follows exactly the same line of proving (14), (15), and (16) in Section 3 except for the identification of the auxiliary random variable U,V (which will be given subsequently) and therefore is omitted. We focus on proving (51):
(52)H(S∣ZN)≤H(S∣ZN)+I(S;ZN∣YN)=H(S∣ZN)+H(S∣YN)-H(S∣YN,ZN)=I(S;YN∣ZN)+H(S∣YN)≤H(YN∣ZN)+H(S∣YN)=∑i=1N‍H(Yi∣Yi-1,ZN)+H(S∣YN)≤∑i=1N‍H(Yi∣Zi)+ϵ3,
where ϵ3 is a small positive number. The last inequality in (52) follows from the fact that conditioning does not increase entropy and Fano’s inequality. To complete the proof of (51), define a time-sharing random variable Q which is uniformly distributed over 1,2,…,N and independent of SWXNYNZN. Set U=ZQ+1NYQ-1WQ, V=US, X=XQ, Y=YQ, Z=ZQ. It is easy to see U→V→X→(Y,Z) form a Markov chain. After using the standard time-sharing argument [10, Section 5.4], (52) simplifies to
(53)H(S∣ZN)≤NH(Y∣Z)+ϵ3.Finally, utilizinglimN→∞Δ≥Re in the definition of “achievable” and (53), we obtain (51). This completes the proof of the converse part of Theorem 4.Next, a coding scheme is presented to achieve the rate triple(R0,R1,Re)∈ℛl. We should prove that all triples (R0,R1,Re)∈ℛl are achievable. Note that the noiseless feedback for the less noisy DMBCs is causally transmitted from receiver 1 to the transmitter. The scheme includes codebook generation and encoding scheme in Section 4.1.1, decoding scheme in  Section 4.1.2, analysis of error probability in  Section 4.1.3, and equivocation analysis in  Section 4.1.4. Techniques like block Markov coding, superposition coding, and random binning are used.To serve the block Markov coding, let random vectorsUN, XN, YN, and ZN consist of n blocks of length N. Let Wn≜(W1,…,Wn) stand for the common messages of n blocks, where W1,…,Wn are independent and identically distributed random variables over 𝒲. Let Sn≜(S2,…,Sn) stand for the confidential messages of n blocks, where S2,…,Sn are independent and identically distributed random variables over 𝒮. Note that in the first block, there is no S1. Let Z~n=(Z~1,Z~2,…,Z~n), Z~b-=(Z~1,Z~2,…,Z~b-1,Z~b+1,…,Z~n), where Z~b is the output vector at receiver 2 at the end of the bth block, where 1≤b≤n. Similarly, Y~b denotes the output vector at receiver 1 at the end of the bth block, and X~b denotes the input vector of the channel in the bth block. These notations coincide with [6].


#### 4.1.1. Codebook Generation and Encoding

Let the common message set𝒲 and the confidential message set 𝒮 satisfy
(54)limN→∞log∥𝒲∥N=R0,limN→∞log∥𝒮∥N=R1,
where R0 and R1 satisfy (10).Fixp(u) and p(x∣u). In the bth block, 1≤b≤n, we generate 2NR0 independent and identically distributed (i.i.d) sequences uN(wb) according to ∏i=1Np(ui), where wb∈𝒲 is the common message to be sent in the bth block. For each uN(wb), generate 2NI(X;Y∣U) codewords xN(uN(wb)) according to ∏i=1Np(xi∣ui). Put the 2NI(X;Y∣U) codewords into 2NR1 bins, so each bin contains 2N(I(X;Y∣U)-R1) codewords. The 2NR1 bins are denoted by Q1,Q2,…,Q∥𝒮∥, where ∥𝒮∥=2NR1. The codebook structure is shown in Figure 5. Reveal all the codebooks to the transmitter, receiver 1, and receiver 2.Figure 5
The codebook structure.Letg be a mapping from 𝒴N into 𝒮. Reveal the mapping g to the transmitter, receiver 1, and receiver 2. Define a random variable S′=g(YN) uniformly distributed over 𝒮 and independent of the confidential message S. It can be similarly proved from (39) that S⊕S′ is independent of S. In the first block, that is, b=1, to send the common message w1 (note that there is no confidential message to be sent in the first block), the transmitter tries to find uN(w1) and randomly choose a codeword xN(uN(w1)) from the corresponding 2NI(X;Y|U) codewords. In the bth block (b=2,3,…,n), to send the common message wb and confidential message sb, the transmitter calculates sb′=g(y~b-1) and randomly chooses a codeword xN(uN(wb),sb) from the bin Qsb⊕sb′. Here, y~b-1 is the output vector of the (b-1)th block at receiver 1, and ⊕ is the modulo addition over 𝒮.


#### 4.1.2. Decoding

In the first block, as there is no confidential message, only the common message needs to be decoded for both receivers. For receiver 2, he tries to find a unique sequenceuN(w^^1) such that (uN(w^^1),z~1)∈TUZN(ϵ1′), where ϵ1′ is a small positive number. If there exists such a unique sequence, decoder 2 outputs w^^1; otherwise, an error  is  declared. For receiver 1, he tries to find a unique sequence uN(w^1) such that (uN(w^1),y~1)∈TUYN(ϵ1′′), where ϵ1′′ is a small positive number. If there exists such a unique sequence, output  is w^1; otherwise, declare an error.In thebth block, 2≤b≤n, receiver 2 aims to decode the common message, and receiver 1 aims to decode both confidential and common messages. The method of decoding the common message wb for both receivers follows the same as that in the first block. Then, receiver 1 tries to find a unique sequence xN(uN(w^b),s^b) such that (xN(uN(w^b),s^b),y~b)∈TXY∣UN(ϵ2′), where ϵ2′ is a small positive number. If there exists such a unique sequence in one bin, denoting the corresponding index of that bin by sb′′, receiver 1 calculates sb′′⊖sb′ as s^b (here ⊖ is modulo subtraction over 𝒮, and receiver 1 knows sb′=g(y~b-1)); otherwise, declare an error.


#### 4.1.3. Analysis of Error Probability

Since the number ofuN(wb) is upper bounded by 2NI(U;Z), receiver 2 can decode the common message wb with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, since the DMBCs under discussion in Section 4.1 are less noisy, receiver 1 can also decode the common message with error probability approaching zero. It can be calculated that given the codeword uN(wb), the number of xN is 2NI(X;Y∣U). So, after determining the codeword uN(wb), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1] and obtain the confidential message with the help of the feedback.


#### 4.1.4. Analysis of Equivocation

In this part,limN→∞Δ≥Re is proved by utilizing the methods in [5, 6]:
(55)limN→∞Δ=limN,n→∞H(Sn∣Z~n)nN=limN,n→∞∑i=2n‍H(Si∣Si-1,Z~n)nN=(a4.1)limN,n→∞∑i=2nH(Si∣Z~i)nN≥limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1,Si⊕Si′)nN=(a4.2)limN,n→∞∑i=2nH(Si∣Z~i-1,Si⊕Si′)nN=(a4.3)limN,n→∞∑i=2nmin{NH(Y∣Z),log∥𝒮∥}nN=limn→∞∑i=2nmin{H(Y∣Z),R1}n=min{H(Y∣Z),R1}≥(a4.4)Re.In the above deduction,(a4.1) follows from Si→Z~i→(Si-1,Z~i-). (a4.2) follows from Si→(Si⊕Si′,Z~i-1)→Z~i. (a4.3) follows from the fact that receiver 2 can choose a better way to intercept the secret key at will and Si⊕Si′ is independent of Si and uniformly distributed over 𝒮. (a4.4) follows from (10).This completes the proof of Theorem4.


### 4.2. Reversely Less Noisy DMBCs with Noiseless Causal Feedback

In this subsection, Theorem5 will be proved. The converse part will be shown first, and then a coding scheme is given for proving the direct part.In order to find the identification of the auxiliary random variables that satisfy the capacity-equivocation region characterized byℛrl, we prove the converse part for the equivalent region containing all the rate triples (R0,R1,Re) such that
(56)0≤Re≤R1,(57)R0≤I(U;Y),(58)R0+R1≤I(X;Y∣U)+I(U;Y),(59)Re≤H(Y∣X).The inequalities (56), (57), and (58) can be proved using similar deduction of the converse part of Theorem 2 in Section 3 except for the identification of the auxiliary random variables. We focus on (59):
(60)H(S∣ZN)=H(S∣XN,ZN)+I(S;XN∣ZN)=(b4.1)H(S∣XN)+I(XN;S∣ZN)=H(S,YN∣XN)-H(YN∣XN,S)+I(XN;S∣ZN)=H(YN∣XN)+H(S∣YN,XN)-H(YN∣XN,S)+I(XN;S∣ZN)≤H(YN∣XN)+H(S∣YN,XN)+I(XN;S∣ZN)≤H(YN∣XN)+H(S∣YN,XN)+H(XN∣ZN)=(b4.2)H(YN∣XN)+H(S∣YN,XN)+H(XN∣YN)=H(YN∣XN)+H(S,XN∣YN)=(b4.3)H(YN∣XN)+H(S∣YN)=∑i=1N‍H(Yi∣Yi-1,XN)+H(S∣YN)≤(b4.4)∑i=1N‍H(Yi∣Xi)+ϵ3,
where (b4.1) from the Markov chain S→XN→ZN, (b4.2) from the assumption that the channel is reversely less noisy (by setting U=X), (b4.3) from that XN is a function of S,YN, and (b4.4) from the fact that conditioning does not increase entropy and Fano’s inequality. To complete the proof of (59), define a time-sharing random variable Q which is uniformly distributed over {1,2,…,N} and independent of SWXNYNZN. Set U=ZQ+1NYQ-1WQ, V=US, X=XQ, Y=YQ, Z=ZQ. It is easy to see U→V→X→(Y,Z) form a Markov chain. After using the standard time-sharing argument [10, Section 5.4], (60) simplifies to
(61)H(S∣ZN)≤NH(Y∣X)+ϵ3.Finally, utilizinglimN→∞Δ≥Re in the definition of “achievable” and (61), we obtain (59). This completes the proof of the converse part of Theorem 5.Next, a coding scheme will be provided for achieving the triple(R0,R1,Re)∈ℛrl. We should prove that all triples (R0,R1,Re)∈ℛrl are achievable. The codebook generation, encoding, and decoding follow exactly the lines of the coding scheme for the less noisy case in Section 4.1. We present the analysis of error probability and equivocation as follows.


#### 4.2.1. Analysis of Error Probability

Since the number ofuN(wb) is upper bounded by 2NI(U;Y), receiver 1 can decode the common message wb with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, since the DMBCs under discussion in Section 4.2 are reversely less noisy, receiver 2 can also decode the common message with error probability approaching zero. It can be calculated that given the codeword uN(wb), the number of xN is 2NI(X;Y∣U). So, after determining the codeword uN(wb), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1] and obtain the confidential message with the help of the feedback.


#### 4.2.2. Analysis of Equivocation

In this part,limN→∞Δ≥Re will be proved. Special attention should be paid to receiver 2 since the DMBCs are reversely less noisy; that is, I(U;Z)≥I(U;Y) for all p(u,x), which implies 2NI(X;Z∣U)≥2NI(X;Y∣U). Therefore, receiver 2 can also decode the codeword xN. With the knowledge of xN and zN, receiver 2 can guess receiver 1’s channel output yN from the conditional typical set 𝒯Y∣XZN(ϵ3). Note that receiver 2 can intercept the confidential messages in two ways. One is guessing the secret key sb′ from 𝒮 directly; the other is guessing the channel output y~b-1 and finding sb′ through g(y~b-1) indirectly. Intuitively, receiver 2 will always choose a better way to implement eavesdropping. More formally,
(62)limN→∞Δ=limN,n→∞H(Sn∣Z~n)nN=limN,n→∞∑i=2n‍H(Si∣Si-1,Z~n)nN=(b4.5)limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1)nN≥limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1,X~i-1,Si⊕Si′)nN=(b4.6)limN,n→∞∑i=2nH(Si∣Z~i-1,X~i-1,Si⊕Si′)nN=(b4.7)limN,n→∞∑i=2nmin{NH(Y∣XZ),log∥𝒮∥}nN=(b4.8)limN,n→∞∑i=2nmin{NH(Y∣X),log∥𝒮∥}nN=limn→∞∑i=2nmin{H(Y∣X),R1}n=min{H(Y∣X),R1}≥(b4.9)Re.In the above deduction,(b4.5) follows from Si→(Z~i,Z~i-1)→(Si-1,Z~i-2,Z~i+1n).(b4.6) follows from Si→(Si⊕Si′,Z~i-1,X~i-1)→Z~i. (b4.7) follows from the fact that receiver 2 can choose a better way to intercept the secret key at will, and Si⊕Si′ is independent of Si and uniformly distributed over 𝒮. Note that the number of yN∈TY|XZN(ϵ3) is about 2NH(Y∣XZ) based on the property of strong typical sequence [10]. (b4.8) follows from  the fact  that Y is independent of Z conditioning on X, which is obtained from the assumption p(y,z∣x)=p(y∣x)p(z∣x). (b4.9) follows from (11).This completes the proof of Theorem5.


## 4.1. Less Noisy DMBCs with Noiseless Causal Feedback

We first show the converse part of Theorem4, and then  we  prove the direct part of Theorem 4 by providing a coding scheme.In order to find the identification of the auxiliary random variables that satisfy the capacity-equivocation region characterized byℛl, we prove the converse part for the equivalent region containing all the rate triples (R0,R1,Re) such that
(48)0≤Re≤R1,(49)R0≤I(U;Z),(50)R0+R1≤I(X;Y∣U)+I(U;Z),(51)Re≤H(Y∣Z).The proof of (48), (49), and (50) follows exactly the same line of proving (14), (15), and (16) in Section 3 except for the identification of the auxiliary random variable U,V (which will be given subsequently) and therefore is omitted. We focus on proving (51):
(52)H(S∣ZN)≤H(S∣ZN)+I(S;ZN∣YN)=H(S∣ZN)+H(S∣YN)-H(S∣YN,ZN)=I(S;YN∣ZN)+H(S∣YN)≤H(YN∣ZN)+H(S∣YN)=∑i=1N‍H(Yi∣Yi-1,ZN)+H(S∣YN)≤∑i=1N‍H(Yi∣Zi)+ϵ3,
where ϵ3 is a small positive number. The last inequality in (52) follows from the fact that conditioning does not increase entropy and Fano’s inequality. To complete the proof of (51), define a time-sharing random variable Q which is uniformly distributed over 1,2,…,N and independent of SWXNYNZN. Set U=ZQ+1NYQ-1WQ, V=US, X=XQ, Y=YQ, Z=ZQ. It is easy to see U→V→X→(Y,Z) form a Markov chain. After using the standard time-sharing argument [10, Section 5.4], (52) simplifies to
(53)H(S∣ZN)≤NH(Y∣Z)+ϵ3.Finally, utilizinglimN→∞Δ≥Re in the definition of “achievable” and (53), we obtain (51). This completes the proof of the converse part of Theorem 4.Next, a coding scheme is presented to achieve the rate triple(R0,R1,Re)∈ℛl. We should prove that all triples (R0,R1,Re)∈ℛl are achievable. Note that the noiseless feedback for the less noisy DMBCs is causally transmitted from receiver 1 to the transmitter. The scheme includes codebook generation and encoding scheme in Section 4.1.1, decoding scheme in  Section 4.1.2, analysis of error probability in  Section 4.1.3, and equivocation analysis in  Section 4.1.4. Techniques like block Markov coding, superposition coding, and random binning are used.To serve the block Markov coding, let random vectorsUN, XN, YN, and ZN consist of n blocks of length N. Let Wn≜(W1,…,Wn) stand for the common messages of n blocks, where W1,…,Wn are independent and identically distributed random variables over 𝒲. Let Sn≜(S2,…,Sn) stand for the confidential messages of n blocks, where S2,…,Sn are independent and identically distributed random variables over 𝒮. Note that in the first block, there is no S1. Let Z~n=(Z~1,Z~2,…,Z~n), Z~b-=(Z~1,Z~2,…,Z~b-1,Z~b+1,…,Z~n), where Z~b is the output vector at receiver 2 at the end of the bth block, where 1≤b≤n. Similarly, Y~b denotes the output vector at receiver 1 at the end of the bth block, and X~b denotes the input vector of the channel in the bth block. These notations coincide with [6].


### 4.1.1. Codebook Generation and Encoding

Let the common message set𝒲 and the confidential message set 𝒮 satisfy
(54)limN→∞log∥𝒲∥N=R0,limN→∞log∥𝒮∥N=R1,
where R0 and R1 satisfy (10).Fixp(u) and p(x∣u). In the bth block, 1≤b≤n, we generate 2NR0 independent and identically distributed (i.i.d) sequences uN(wb) according to ∏i=1Np(ui), where wb∈𝒲 is the common message to be sent in the bth block. For each uN(wb), generate 2NI(X;Y∣U) codewords xN(uN(wb)) according to ∏i=1Np(xi∣ui). Put the 2NI(X;Y∣U) codewords into 2NR1 bins, so each bin contains 2N(I(X;Y∣U)-R1) codewords. The 2NR1 bins are denoted by Q1,Q2,…,Q∥𝒮∥, where ∥𝒮∥=2NR1. The codebook structure is shown in Figure 5. Reveal all the codebooks to the transmitter, receiver 1, and receiver 2.Figure 5
The codebook structure.Letg be a mapping from 𝒴N into 𝒮. Reveal the mapping g to the transmitter, receiver 1, and receiver 2. Define a random variable S′=g(YN) uniformly distributed over 𝒮 and independent of the confidential message S. It can be similarly proved from (39) that S⊕S′ is independent of S. In the first block, that is, b=1, to send the common message w1 (note that there is no confidential message to be sent in the first block), the transmitter tries to find uN(w1) and randomly choose a codeword xN(uN(w1)) from the corresponding 2NI(X;Y|U) codewords. In the bth block (b=2,3,…,n), to send the common message wb and confidential message sb, the transmitter calculates sb′=g(y~b-1) and randomly chooses a codeword xN(uN(wb),sb) from the bin Qsb⊕sb′. Here, y~b-1 is the output vector of the (b-1)th block at receiver 1, and ⊕ is the modulo addition over 𝒮.


### 4.1.2. Decoding

In the first block, as there is no confidential message, only the common message needs to be decoded for both receivers. For receiver 2, he tries to find a unique sequenceuN(w^^1) such that (uN(w^^1),z~1)∈TUZN(ϵ1′), where ϵ1′ is a small positive number. If there exists such a unique sequence, decoder 2 outputs w^^1; otherwise, an error  is  declared. For receiver 1, he tries to find a unique sequence uN(w^1) such that (uN(w^1),y~1)∈TUYN(ϵ1′′), where ϵ1′′ is a small positive number. If there exists such a unique sequence, output  is w^1; otherwise, declare an error.In thebth block, 2≤b≤n, receiver 2 aims to decode the common message, and receiver 1 aims to decode both confidential and common messages. The method of decoding the common message wb for both receivers follows the same as that in the first block. Then, receiver 1 tries to find a unique sequence xN(uN(w^b),s^b) such that (xN(uN(w^b),s^b),y~b)∈TXY∣UN(ϵ2′), where ϵ2′ is a small positive number. If there exists such a unique sequence in one bin, denoting the corresponding index of that bin by sb′′, receiver 1 calculates sb′′⊖sb′ as s^b (here ⊖ is modulo subtraction over 𝒮, and receiver 1 knows sb′=g(y~b-1)); otherwise, declare an error.


### 4.1.3. Analysis of Error Probability

Since the number ofuN(wb) is upper bounded by 2NI(U;Z), receiver 2 can decode the common message wb with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, since the DMBCs under discussion in Section 4.1 are less noisy, receiver 1 can also decode the common message with error probability approaching zero. It can be calculated that given the codeword uN(wb), the number of xN is 2NI(X;Y∣U). So, after determining the codeword uN(wb), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1] and obtain the confidential message with the help of the feedback.


### 4.1.4. Analysis of Equivocation

In this part,limN→∞Δ≥Re is proved by utilizing the methods in [5, 6]:
(55)limN→∞Δ=limN,n→∞H(Sn∣Z~n)nN=limN,n→∞∑i=2n‍H(Si∣Si-1,Z~n)nN=(a4.1)limN,n→∞∑i=2nH(Si∣Z~i)nN≥limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1,Si⊕Si′)nN=(a4.2)limN,n→∞∑i=2nH(Si∣Z~i-1,Si⊕Si′)nN=(a4.3)limN,n→∞∑i=2nmin{NH(Y∣Z),log∥𝒮∥}nN=limn→∞∑i=2nmin{H(Y∣Z),R1}n=min{H(Y∣Z),R1}≥(a4.4)Re.In the above deduction,(a4.1) follows from Si→Z~i→(Si-1,Z~i-). (a4.2) follows from Si→(Si⊕Si′,Z~i-1)→Z~i. (a4.3) follows from the fact that receiver 2 can choose a better way to intercept the secret key at will and Si⊕Si′ is independent of Si and uniformly distributed over 𝒮. (a4.4) follows from (10).This completes the proof of Theorem4.


## 4.1.1. Codebook Generation and Encoding

Let the common message set𝒲 and the confidential message set 𝒮 satisfy
(54)limN→∞log∥𝒲∥N=R0,limN→∞log∥𝒮∥N=R1,
where R0 and R1 satisfy (10).Fixp(u) and p(x∣u). In the bth block, 1≤b≤n, we generate 2NR0 independent and identically distributed (i.i.d) sequences uN(wb) according to ∏i=1Np(ui), where wb∈𝒲 is the common message to be sent in the bth block. For each uN(wb), generate 2NI(X;Y∣U) codewords xN(uN(wb)) according to ∏i=1Np(xi∣ui). Put the 2NI(X;Y∣U) codewords into 2NR1 bins, so each bin contains 2N(I(X;Y∣U)-R1) codewords. The 2NR1 bins are denoted by Q1,Q2,…,Q∥𝒮∥, where ∥𝒮∥=2NR1. The codebook structure is shown in Figure 5. Reveal all the codebooks to the transmitter, receiver 1, and receiver 2.Figure 5
The codebook structure.Letg be a mapping from 𝒴N into 𝒮. Reveal the mapping g to the transmitter, receiver 1, and receiver 2. Define a random variable S′=g(YN) uniformly distributed over 𝒮 and independent of the confidential message S. It can be similarly proved from (39) that S⊕S′ is independent of S. In the first block, that is, b=1, to send the common message w1 (note that there is no confidential message to be sent in the first block), the transmitter tries to find uN(w1) and randomly choose a codeword xN(uN(w1)) from the corresponding 2NI(X;Y|U) codewords. In the bth block (b=2,3,…,n), to send the common message wb and confidential message sb, the transmitter calculates sb′=g(y~b-1) and randomly chooses a codeword xN(uN(wb),sb) from the bin Qsb⊕sb′. Here, y~b-1 is the output vector of the (b-1)th block at receiver 1, and ⊕ is the modulo addition over 𝒮.


## 4.1.2. Decoding

In the first block, as there is no confidential message, only the common message needs to be decoded for both receivers. For receiver 2, he tries to find a unique sequenceuN(w^^1) such that (uN(w^^1),z~1)∈TUZN(ϵ1′), where ϵ1′ is a small positive number. If there exists such a unique sequence, decoder 2 outputs w^^1; otherwise, an error  is  declared. For receiver 1, he tries to find a unique sequence uN(w^1) such that (uN(w^1),y~1)∈TUYN(ϵ1′′), where ϵ1′′ is a small positive number. If there exists such a unique sequence, output  is w^1; otherwise, declare an error.In thebth block, 2≤b≤n, receiver 2 aims to decode the common message, and receiver 1 aims to decode both confidential and common messages. The method of decoding the common message wb for both receivers follows the same as that in the first block. Then, receiver 1 tries to find a unique sequence xN(uN(w^b),s^b) such that (xN(uN(w^b),s^b),y~b)∈TXY∣UN(ϵ2′), where ϵ2′ is a small positive number. If there exists such a unique sequence in one bin, denoting the corresponding index of that bin by sb′′, receiver 1 calculates sb′′⊖sb′ as s^b (here ⊖ is modulo subtraction over 𝒮, and receiver 1 knows sb′=g(y~b-1)); otherwise, declare an error.


## 4.1.3. Analysis of Error Probability

Since the number ofuN(wb) is upper bounded by 2NI(U;Z), receiver 2 can decode the common message wb with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, since the DMBCs under discussion in Section 4.1 are less noisy, receiver 1 can also decode the common message with error probability approaching zero. It can be calculated that given the codeword uN(wb), the number of xN is 2NI(X;Y∣U). So, after determining the codeword uN(wb), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1] and obtain the confidential message with the help of the feedback.


## 4.1.4. Analysis of Equivocation

In this part,limN→∞Δ≥Re is proved by utilizing the methods in [5, 6]:
(55)limN→∞Δ=limN,n→∞H(Sn∣Z~n)nN=limN,n→∞∑i=2n‍H(Si∣Si-1,Z~n)nN=(a4.1)limN,n→∞∑i=2nH(Si∣Z~i)nN≥limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1,Si⊕Si′)nN=(a4.2)limN,n→∞∑i=2nH(Si∣Z~i-1,Si⊕Si′)nN=(a4.3)limN,n→∞∑i=2nmin{NH(Y∣Z),log∥𝒮∥}nN=limn→∞∑i=2nmin{H(Y∣Z),R1}n=min{H(Y∣Z),R1}≥(a4.4)Re.In the above deduction,(a4.1) follows from Si→Z~i→(Si-1,Z~i-). (a4.2) follows from Si→(Si⊕Si′,Z~i-1)→Z~i. (a4.3) follows from the fact that receiver 2 can choose a better way to intercept the secret key at will and Si⊕Si′ is independent of Si and uniformly distributed over 𝒮. (a4.4) follows from (10).This completes the proof of Theorem4.


## 4.2. Reversely Less Noisy DMBCs with Noiseless Causal Feedback

In this subsection, Theorem5 will be proved. The converse part will be shown first, and then a coding scheme is given for proving the direct part.In order to find the identification of the auxiliary random variables that satisfy the capacity-equivocation region characterized byℛrl, we prove the converse part for the equivalent region containing all the rate triples (R0,R1,Re) such that
(56)0≤Re≤R1,(57)R0≤I(U;Y),(58)R0+R1≤I(X;Y∣U)+I(U;Y),(59)Re≤H(Y∣X).The inequalities (56), (57), and (58) can be proved using similar deduction of the converse part of Theorem 2 in Section 3 except for the identification of the auxiliary random variables. We focus on (59):
(60)H(S∣ZN)=H(S∣XN,ZN)+I(S;XN∣ZN)=(b4.1)H(S∣XN)+I(XN;S∣ZN)=H(S,YN∣XN)-H(YN∣XN,S)+I(XN;S∣ZN)=H(YN∣XN)+H(S∣YN,XN)-H(YN∣XN,S)+I(XN;S∣ZN)≤H(YN∣XN)+H(S∣YN,XN)+I(XN;S∣ZN)≤H(YN∣XN)+H(S∣YN,XN)+H(XN∣ZN)=(b4.2)H(YN∣XN)+H(S∣YN,XN)+H(XN∣YN)=H(YN∣XN)+H(S,XN∣YN)=(b4.3)H(YN∣XN)+H(S∣YN)=∑i=1N‍H(Yi∣Yi-1,XN)+H(S∣YN)≤(b4.4)∑i=1N‍H(Yi∣Xi)+ϵ3,
where (b4.1) from the Markov chain S→XN→ZN, (b4.2) from the assumption that the channel is reversely less noisy (by setting U=X), (b4.3) from that XN is a function of S,YN, and (b4.4) from the fact that conditioning does not increase entropy and Fano’s inequality. To complete the proof of (59), define a time-sharing random variable Q which is uniformly distributed over {1,2,…,N} and independent of SWXNYNZN. Set U=ZQ+1NYQ-1WQ, V=US, X=XQ, Y=YQ, Z=ZQ. It is easy to see U→V→X→(Y,Z) form a Markov chain. After using the standard time-sharing argument [10, Section 5.4], (60) simplifies to
(61)H(S∣ZN)≤NH(Y∣X)+ϵ3.Finally, utilizinglimN→∞Δ≥Re in the definition of “achievable” and (61), we obtain (59). This completes the proof of the converse part of Theorem 5.Next, a coding scheme will be provided for achieving the triple(R0,R1,Re)∈ℛrl. We should prove that all triples (R0,R1,Re)∈ℛrl are achievable. The codebook generation, encoding, and decoding follow exactly the lines of the coding scheme for the less noisy case in Section 4.1. We present the analysis of error probability and equivocation as follows.


### 4.2.1. Analysis of Error Probability

Since the number ofuN(wb) is upper bounded by 2NI(U;Y), receiver 1 can decode the common message wb with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, since the DMBCs under discussion in Section 4.2 are reversely less noisy, receiver 2 can also decode the common message with error probability approaching zero. It can be calculated that given the codeword uN(wb), the number of xN is 2NI(X;Y∣U). So, after determining the codeword uN(wb), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1] and obtain the confidential message with the help of the feedback.


### 4.2.2. Analysis of Equivocation

In this part,limN→∞Δ≥Re will be proved. Special attention should be paid to receiver 2 since the DMBCs are reversely less noisy; that is, I(U;Z)≥I(U;Y) for all p(u,x), which implies 2NI(X;Z∣U)≥2NI(X;Y∣U). Therefore, receiver 2 can also decode the codeword xN. With the knowledge of xN and zN, receiver 2 can guess receiver 1’s channel output yN from the conditional typical set 𝒯Y∣XZN(ϵ3). Note that receiver 2 can intercept the confidential messages in two ways. One is guessing the secret key sb′ from 𝒮 directly; the other is guessing the channel output y~b-1 and finding sb′ through g(y~b-1) indirectly. Intuitively, receiver 2 will always choose a better way to implement eavesdropping. More formally,
(62)limN→∞Δ=limN,n→∞H(Sn∣Z~n)nN=limN,n→∞∑i=2n‍H(Si∣Si-1,Z~n)nN=(b4.5)limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1)nN≥limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1,X~i-1,Si⊕Si′)nN=(b4.6)limN,n→∞∑i=2nH(Si∣Z~i-1,X~i-1,Si⊕Si′)nN=(b4.7)limN,n→∞∑i=2nmin{NH(Y∣XZ),log∥𝒮∥}nN=(b4.8)limN,n→∞∑i=2nmin{NH(Y∣X),log∥𝒮∥}nN=limn→∞∑i=2nmin{H(Y∣X),R1}n=min{H(Y∣X),R1}≥(b4.9)Re.In the above deduction,(b4.5) follows from Si→(Z~i,Z~i-1)→(Si-1,Z~i-2,Z~i+1n).(b4.6) follows from Si→(Si⊕Si′,Z~i-1,X~i-1)→Z~i. (b4.7) follows from the fact that receiver 2 can choose a better way to intercept the secret key at will, and Si⊕Si′ is independent of Si and uniformly distributed over 𝒮. Note that the number of yN∈TY|XZN(ϵ3) is about 2NH(Y∣XZ) based on the property of strong typical sequence [10]. (b4.8) follows from  the fact  that Y is independent of Z conditioning on X, which is obtained from the assumption p(y,z∣x)=p(y∣x)p(z∣x). (b4.9) follows from (11).This completes the proof of Theorem5.


## 4.2.1. Analysis of Error Probability

Since the number ofuN(wb) is upper bounded by 2NI(U;Y), receiver 1 can decode the common message wb with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1]. Moreover, since the DMBCs under discussion in Section 4.2 are reversely less noisy, receiver 2 can also decode the common message with error probability approaching zero. It can be calculated that given the codeword uN(wb), the number of xN is 2NI(X;Y∣U). So, after determining the codeword uN(wb), receiver 1 can decode the codeword xN with error probability approaching zero by applying the standard channel coding theorem [11, Theorem 7.7.1] and obtain the confidential message with the help of the feedback.


## 4.2.2. Analysis of Equivocation

In this part,limN→∞Δ≥Re will be proved. Special attention should be paid to receiver 2 since the DMBCs are reversely less noisy; that is, I(U;Z)≥I(U;Y) for all p(u,x), which implies 2NI(X;Z∣U)≥2NI(X;Y∣U). Therefore, receiver 2 can also decode the codeword xN. With the knowledge of xN and zN, receiver 2 can guess receiver 1’s channel output yN from the conditional typical set 𝒯Y∣XZN(ϵ3). Note that receiver 2 can intercept the confidential messages in two ways. One is guessing the secret key sb′ from 𝒮 directly; the other is guessing the channel output y~b-1 and finding sb′ through g(y~b-1) indirectly. Intuitively, receiver 2 will always choose a better way to implement eavesdropping. More formally,
(62)limN→∞Δ=limN,n→∞H(Sn∣Z~n)nN=limN,n→∞∑i=2n‍H(Si∣Si-1,Z~n)nN=(b4.5)limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1)nN≥limN,n→∞∑i=2nH(Si∣Z~i,Z~i-1,X~i-1,Si⊕Si′)nN=(b4.6)limN,n→∞∑i=2nH(Si∣Z~i-1,X~i-1,Si⊕Si′)nN=(b4.7)limN,n→∞∑i=2nmin{NH(Y∣XZ),log∥𝒮∥}nN=(b4.8)limN,n→∞∑i=2nmin{NH(Y∣X),log∥𝒮∥}nN=limn→∞∑i=2nmin{H(Y∣X),R1}n=min{H(Y∣X),R1}≥(b4.9)Re.In the above deduction,(b4.5) follows from Si→(Z~i,Z~i-1)→(Si-1,Z~i-2,Z~i+1n).(b4.6) follows from Si→(Si⊕Si′,Z~i-1,X~i-1)→Z~i. (b4.7) follows from the fact that receiver 2 can choose a better way to intercept the secret key at will, and Si⊕Si′ is independent of Si and uniformly distributed over 𝒮. Note that the number of yN∈TY|XZN(ϵ3) is about 2NH(Y∣XZ) based on the property of strong typical sequence [10]. (b4.8) follows from  the fact  that Y is independent of Z conditioning on X, which is obtained from the assumption p(y,z∣x)=p(y∣x)p(z∣x). (b4.9) follows from (11).This completes the proof of Theorem5.


## 5. Conclusion

This paper studies two models of the DMBCs with noiseless feedback. One is the degraded DMBCs with rate-limited feedback; the other is theless and reversely less noisy DMBCs with feedback. The difference between them is that the feedback in the first model is independent of the channel outputs and rate limited, while the feedback in the second model is originated causally from the channel outputs. The capacity-equivocation regions of the two models are obtained in this paper. We should point out that the second model studied in this paper is under the assumption that the channel to receiver 1 (the legitimate receiver) is independent of the channel to receiver 2 (the eavesdropper); that is, the channel output YN is independent of ZN given the channel input XN. However, without this assumption, the capacity-equivocation region remains unknown for the general DMBCs with noiseless feedback.



---

*Source: 102069-2013-08-22.xml*