Secure Multiterminal Source Codingwith Side Information at the Eavesdropper
Joffrey Villard and Pablo Piantanida
SUPELEC, Dpt. of Telecommunications, Gif-sur-Yvette, France.
Email: {joffrey.villard, pablo.piantanida}@supelec.fr
1st International ICST Workshop on Secure Wireless Networks
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 1 / 31
Introduction
Context
An Alice Bob E[d(An, An)
]. D
J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn CharlieK (rate RC)
Tradeoff: Min. rates + Min. distortion + Max. equivocation
Our Aim: Find all achievable tuples (RA,RC,D,∆)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 2 / 31
Introduction
Context
An Alice Bob E[d(An, An)
]. D
J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn CharlieK (rate RC)
Tradeoff: Min. rates + Min. distortion + Max. equivocation
Our Aim: Find all achievable tuples (RA,RC,D,∆)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 2 / 31
Introduction
Context
An Alice BobE[d(An, An)
]. D
(+Cn)
J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn CharlieK (rate RC)
Tradeoff: Min. rates + Min. distortion + Max. equivocation
Our Aim: Find all achievable tuples (RA,RC,D,∆)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 2 / 31
Introduction
Context
An Alice BobE[d(An, An)
]. D
(+Cn)
J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn CharlieK (rate RC)
Tradeoff: Min. rates + Min. distortion + Max. equivocation
Our Aim: Find all achievable tuples (RA,RC,D,∆)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 2 / 31
Introduction
ReferencesMultiterminal source coding.D. Slepian and J. Wolf. Noiseless coding of correlated information sources. IEEE Trans. IT, 19(4):471–480, 1973.
T. Berger. Multiterminal source coding. in The information theory approach to communications, 1977.
Source coding with side-information.A. Wyner and J. Ziv. The rate-distortion function for source coding with side information at the decoder. IEEE Trans. IT,22(1):1–10, 1976.
Information-theoretic security.C.E. Shannon. Communication theory of secrecy systems. BSTJ, 28:656–715, 1949.
A.D. Wyner. The wire-tap channel. BSTJ, 54(8):1355–1387, 1975.
I. Csiszar and J. Korner. Broadcast channels with confidential messages. , 24(3):339–348, 1978.
Y. Liang, H.V. Poor, and S. Shamai. Information theoretic security. Now Publishers, 2009.
Secure source coding.H. Yamamoto. Rate-distortion theory for the Shannon cipher system. IEEE Trans. IT, 43(3):827–835, 1997.
V. Prabhakaran and K. Ramchandran. On secure distributed source coding. In Proc. ITW, p. 442–447, 2007.
D. Gunduz, E. Erkip, and H.V. Poor. Lossless compression with security constraints. In Proc. ISIT, p. 111–115, 2008.
R. Tandon, S. Ulukus, and K. Ramchandran. Secure source coding with a helper. In Proc. Allerton, p. 1061–1068, 2009.
N. Merhav. Shannon’s secrecy system with informed receivers and its application to systematic coding for wiretappedchannels. IEEE Trans. IT, 54(6):2723–2734, 2008.
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 3 / 31
Introduction
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 4 / 31
Definitions and First Results Definitions
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 5 / 31
Definitions and First Results Definitions
Definitions
A, C and E : three finite sets
(Ai,Ci,Ei)i≥1: i.i.d random variables on A× C × Ewith known joint distribution p(a, b, e)
d : A×A → [0 ; dmax]: a finite distortion measure
An (n,RA,RC)-code for source coding in this setup is defined by
Two encoding functions at Alice and CharliefA : An → {1, . . . , 2nRA} and fC : Cn → {1, . . . , 2nRC}, resp.
A decoding function at Bobg : {1, . . . , 2nRA} × {1, . . . , 2nRC} → An
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 6 / 31
Definitions and First Results Definitions
Definitions (cont.)
An Alice Bob E[d(An, An)
]. D
J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn CharlieK (rate RC)
A tuple (RA,RC,D,∆) ∈ R4+ is achievable if,
for any ε > 0, there exists an (n,RA + ε,RC + ε)-code (fA, fC, g)such that:
E[d(An, g(fA(An), fC(Cn)))
]≤ D + ε
1n
H(An|fA(An),En) ≥ ∆− ε
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 7 / 31
Definitions and First Results Inner and Outer Bounds
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 8 / 31
Definitions and First Results Inner and Outer Bounds
Inner and Outer Bounds
Theorem (Inner bound)
If
(RA,RC,D,∆) ∈ R4+ is achievable if there exist
r.v. U, V, W on some finite sets U , V,W, resp., s.t.p(uvwace) = p(u|v)p(v|a)p(w|c)p(ace) ,
a function A : V ×W → A, s.t.
RA ≥ I(V; A|W)
RC ≥ I(W; C|V)
RA + RC ≥ I(VW; AC)
D ≥ E[d(A, A(V,W))
]∆ ≤ H(A|UE)− I(V; A|UW)
∆− RC ≤ H(A|V)− I(A; E|U)− I(W; C|V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 9 / 31
Definitions and First Results Inner and Outer Bounds
Inner and Outer Bounds
Theorem (Inner bound)
If
(RA,RC,D,∆) ∈ R4+ is achievable if there exist
r.v. U, V, W on some finite sets U , V,W, resp., s.t.p(uvwace) = p(u|v)p(v|a)p(w|c)p(ace) ,
a function A : V ×W → A, s.t.
RA ≥ I(V; A|W)
RC ≥ I(W; C|V)
RA + RC ≥ I(VW; AC)
D ≥ E[d(A, A(V,W))
]∆ ≤ H(A|UE)− I(V; A|UW)
∆− RC ≤ H(A|V)− I(A; E|U)− I(W; C|V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 9 / 31
Definitions and First Results Inner and Outer Bounds
Inner and Outer Bounds
Theorem (Inner bound)
If
(RA,RC,D,∆) ∈ R4+ is achievable if there exist
r.v. U, V, W on some finite sets U , V,W, resp., s.t.p(uvwace) = p(u|v)p(v|a)p(w|c)p(ace) ,
a function A : V ×W → A, s.t.
RA ≥ I(V; A|W)
RC ≥ I(W; C|V)
RA + RC ≥ I(VW; AC)
D ≥ E[d(A, A(V,W))
]∆ ≤ H(A|UE)− I(V; A|UW)
∆− RC ≤ H(A|V)− I(A; E|U)− I(W; C|V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 9 / 31
Definitions and First Results Inner and Outer Bounds
Inner and Outer Bounds
Theorem (Inner bound)
If
(RA,RC,D,∆) ∈ R4+ is achievable if there exist
r.v. U, V, W on some finite sets U , V,W, resp., s.t.p(uvwace) = p(u|v)p(v|a)p(w|c)p(ace) ,
a function A : V ×W → A, s.t.
RA ≥ I(V; A|W)
RC ≥ I(W; C|V)
RA + RC ≥ I(VW; AC)
D ≥ E[d(A, A(V,W))
]∆ ≤ H(A|UE)− I(V; A|UW)
∆− RC ≤ H(A|V)− I(A; E|U)− I(W; C|V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 9 / 31
Definitions and First Results Inner and Outer Bounds
Inner and Outer Bounds
Theorem (Inner bound)
If
(RA,RC,D,∆) ∈ R4+ is achievable if there exist
r.v. U, V, W on some finite sets U , V,W, resp., s.t.p(uvwace) = p(u|v)p(v|a)p(w|c)p(ace) ,
a function A : V ×W → A, s.t.
RA ≥ I(V; A|W)
RC ≥ I(W; C|V)
RA + RC ≥ I(VW; AC)
D ≥ E[d(A, A(V,W))
]∆ ≤ H(A|UE)− I(V; A|UW)
∆− RC ≤ H(A|V)− I(A; E|U)− I(W; C|V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 9 / 31
Definitions and First Results Inner and Outer Bounds
Inner and Outer Bounds
Theorem (Outer bound)
If (RA,RC,D,∆) ∈ R4+ is achievable, then there exist
r.v. U, V, W on some finite sets U , V,W, resp., s.t.p(wace) = p(w|c)p(ace), p(uvace) = p(u|v)p(v|a)p(ace) ,
a function A : V ×W → A, s.t.
RA ≥ I(V; A|W)
RC ≥ I(W; C|V)
RA + RC ≥ I(VW; AC)
D ≥ E[d(A, A(V,W))
]∆ ≤ H(A|UE)− I(V; A|UW)
∆− RC ≤ H(A|V)− I(A; E|U)− I(W; C|V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 9 / 31
Definitions and First Results Inner and Outer Bounds
Auxiliary Variables
Inner Bound
U V A E
CW
Outer Bound
U V A E
C
A E
CW
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 10 / 31
Definitions and First Results Inner Bound–Insight
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 11 / 31
Definitions and First Results Inner Bound–Insight
Three Corner Points
3 three-step schemes to deliver (U,V) and W, usingsuperposition coding (U − V − A− C −W)previously received information used as side informationrandom binningtime-sharing
Corner point (I)
(II) (III)
Comm. order W, U, V
U, W, V U, V, W
RA I(V; A|W)
I(U; A) + I(V; A|UW) I(V; A)
RC I(W; C)
I(W; C|U) I(W; C|V)
D E[d(A, A(V,W))
]
— —
∆ H(A|UE)− I(V; A|UW)
H(A|UE)− I(V; A|UW) H(A|UE)− I(V; A|U)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 12 / 31
Definitions and First Results Inner Bound–Insight
Three Corner Points
3 three-step schemes to deliver (U,V) and W, usingsuperposition coding (U − V − A− C −W)previously received information used as side informationrandom binningtime-sharing
Corner point (I) (II)
(III)
Comm. order W, U, V U, W, V
U, V, W
RA I(V; A|W) I(U; A) + I(V; A|UW)
I(V; A)
RC I(W; C) I(W; C|U)
I(W; C|V)
D E[d(A, A(V,W))
]—
—
∆ H(A|UE)− I(V; A|UW) H(A|UE)− I(V; A|UW)
H(A|UE)− I(V; A|U)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 12 / 31
Definitions and First Results Inner Bound–Insight
Three Corner Points
3 three-step schemes to deliver (U,V) and W, usingsuperposition coding (U − V − A− C −W)previously received information used as side informationrandom binningtime-sharing
Corner point (I) (II) (III)
Comm. order W, U, V U, W, V U, V, W
RA I(V; A|W) I(U; A) + I(V; A|UW) I(V; A)
RC I(W; C) I(W; C|U) I(W; C|V)
D E[d(A, A(V,W))
]— —
∆ H(A|UE)− I(V; A|UW) H(A|UE)− I(V; A|UW) H(A|UE)− I(V; A|U)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 12 / 31
Definitions and First Results Inner Bound–Insight
Time-Sharing
Segment (I)–(II)
D = E[d(A, A(V,W))
]∆ = H(A|UE)− I(V; A|UW)
RA + RC = I(VW; AC)
(I)
(II)
(III)RA
RC
Segment (II)–(III)
D = E[d(A, A(V,W))
]∆− RC = H(A|UE)− I(V; A|U)− I(W; C|V)
RA + RC = I(VW; AC)
(I)
(II)
(III)
RC
∆
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 13 / 31
Definitions and First Results Inner Bound–Insight
Time-Sharing
Segment (I)–(II)
D = E[d(A, A(V,W))
]∆ = H(A|UE)− I(V; A|UW)
RA + RC = I(VW; AC)
(I)
(II)
(III)RA
RC
Segment (II)–(III)
D = E[d(A, A(V,W))
]∆− RC = H(A|UE)− I(V; A|U)− I(W; C|V)
RA + RC = I(VW; AC)
(I)
(II)
(III)
RC
∆
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 13 / 31
Definitions and First Results Inner Bound–Insight
Achievable Region for Some Fixed D
(I)
(II)
(III)
RA
RC
∆
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 14 / 31
Results of Optimality Uncoded Side Information
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 15 / 31
Results of Optimality Uncoded Side Information
Context
An Alice Bob E[d(An, An)
]. D
J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 16 / 31
Results of Optimality Uncoded Side Information
Auxiliary Variables
Inner Bound
U V A E
CW
Outer Bound
U V A E
C
A E
CW
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 17 / 31
Results of Optimality Uncoded Side Information
Uncoded Side Information
Theorem (Rate-Distortion-Equivocation Region)
If
(RA, D,∆) ∈ R3+ is achievable i.f.f. there exist
r.v. U, V
, W
on some finite sets U , V
,W
, resp., s.t.p(uvace) = p(u|v)p(v|a)p(ace) ,
a function A : V × C → A, s.t.
RA ≥ I(V; A|C)
D ≥ E[d(A, A(V,C))
]∆ ≤ H(A|UE)− I(V; A|UC)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 18 / 31
Results of Optimality Uncoded Side Information
Uncoded Side Information (cont.)
Achievability: point (I) with W = C
(I)(II)
(III)
RA
∆
Converse: new proof
Wyner-Ziv coding achieves the optimal performanceif one side information is less noisy than the other(optimal choice: U∗ = ∅ or U∗ = V)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 19 / 31
Results of Optimality Lossless Compression of Both Sources
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 20 / 31
Results of Optimality Lossless Compression of Both Sources
Context
An Alice Bob (An, Cn) ≈ (An,Cn)J (rate RA)
En Eve 1n H(An|JEn) & ∆
Cn CharlieK (rate RC)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 21 / 31
Results of Optimality Lossless Compression of Both Sources
Auxiliary Variables
Inner Bound
U V A E
CW
Outer Bound
U V A E
C
A E
CW
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 22 / 31
Results of Optimality Lossless Compression of Both Sources
Lossless Compression of Both Sources
Theorem (Compression-Equivocation Rates Region)
If
(RA,RC, ∆) ∈ R3+ is achievable i.f.f. there exists
r.v. U
, V, W
on some finite set
s
U
, V,W, resp.,
s.t.p(uace) = p(u|a)p(ace),
a function A : V ×W → A, s.t.
RA ≥ H(A|C)
RC ≥ H(C|U)
RA + RC ≥ H(AC)
∆ ≤ H(A|UE)− H(A|UC)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 23 / 31
Results of Optimality Lossless Compression of Both Sources
Lossless Compression of Both Sources (cont.)
Achievability: points (I) and (II) with V = A and W = C
(I)
(II)
(III)RA
RC
Converse: new proof
Slepian-Wolf coding is sufficientif E is less noisy than C (U∗ = A, and ∆ = 0)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 24 / 31
Results of Optimality Alternative Characterizations
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 25 / 31
Results of Optimality Alternative Characterizations
Giving U to Eve is also optimal
Alice can enable Eve to decode the common message U:
RA ≥ (·) + [I(U; C)− I(U; E)]+ ,
with no loss on secrecy
Achievability: OKConverse: new proof
cf. broadcast channel with confidential messages[Csiszàr & Körner–1978]
optimal choice U∗:part of V which conveys “more information” about E than C
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 26 / 31
Application Example (Uncoded Side Information)
Outline
1 Definitions and First ResultsDefinitionsInner and Outer BoundsInner Bound–Insight
2 Results of OptimalityUncoded Side InformationLossless Compression of Both SourcesAlternative Characterizations
3 Application Example (Uncoded Side Information)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 27 / 31
Application Example (Uncoded Side Information)
Binary Source with BEC and BSC Side Informations
A0
1
C0
e
1
E0
1
1− p
pp
1− p
1− ε
εε
1− ε
(1/2)
(1/2)
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 28 / 31
Application Example (Uncoded Side Information)
Binary Source with BEC and BSC Side Informations
A0
1
C0
e
1
E0
1
1− p
pp
1− p
1− ε
εε
1− ε
(1/2)
(1/2)
Neither Bob nor Eve is a lessnoisy decoder for all values of (p, ε):
0 2p 4p(1− p) h2(p) 1 ε
E stoch. degr.A − C − E
C less noisyU − A− (C,E)⇒I(U; C) ≥ I(U; E)
C more capableI(A; C) ≥ I(A; E)
X
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 28 / 31
Application Example (Uncoded Side Information)
Binary Source with BEC and BSC Side Informations
A0
1
C0
e
1
E0
1
1− p
pp
1− p
1− ε
εε
1− ε
(1/2)
(1/2)
Neither Bob nor Eve is a lessnoisy decoder for all values of (p, ε):
0 2p 4p(1− p) h2(p) 1 ε
E stoch. degr.
A − C − E
C less noisy
U − A− (C,E)⇒I(U; C) ≥ I(U; E)
C more capable
I(A; C) ≥ I(A; E)
X
Wyner-Ziv is optimal Wyner-Ziv is insufficient
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 28 / 31
Application Example (Uncoded Side Information)
Binary Source with BEC and BSC Side Informations
A0
1
C0
e
1
E0
1
1− p
pp
1− p
1− ε
εε
1− ε
(1/2)
(1/2)
distortion d: Hamming distance
source A: uniformly distributed
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 28 / 31
Application Example (Uncoded Side Information)
Illustration (p = 0.1, ε = h2(p) ≈ 0.469)
10−4 10−3 10−2 10−1
10−2
10−1
D
∆
Optimal U, VWyner-Ziv
Equivocation rate at Eve as a function of the distortion level at Bob
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 29 / 31
Conclusion
Summary and Discussion
Single-letter inner and outer bounds on the generalrates-distortion-equivocation region
Results of optimalityuncoded side informationdistributed lossless compression
Ongoing work:
Source-channel coding with security constraints
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 30 / 31
This is the end...
with P. PiantanidaSecure Multiterminal Source Coding with Side Information at the Eavesdroppersubmitted to IEEE Trans. on Inf. Theory, available on arXiv:1105.1658.
with P. Piantanida and S. ShamaiSecure Lossy Source-Channel Wiretapping with Side Information at theReceiving Terminalsto be presented at ISIT 2011.
Thank you for your attention.
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 31 / 31
This is the end...
with P. PiantanidaSecure Multiterminal Source Coding with Side Information at the Eavesdroppersubmitted to IEEE Trans. on Inf. Theory, available on arXiv:1105.1658.
with P. Piantanida and S. ShamaiSecure Lossy Source-Channel Wiretapping with Side Information at theReceiving Terminalsto be presented at ISIT 2011.
Thank you for your attention.
Securenets 2011 Secure Multiterminal Source Coding with SI at Eve 31 / 31