Over the past few years, the internet has started taking an ever growing place in our daily lives to become today the most used communication mean. This amplifies the need to strengthen the communication security by finding new techniques to protect the confidentiality of data during transfer and storage. These techniques should also anticipate the development in quantum computing and the eventual attacks arising from it.

Cryptography techniques are the basis for security protocols covering most layers of the communication system except for the physical layer. Physical layer security techniques rely on different principles than cryptography. Indeed, physical layer security exploits the specific nature of the used physical medium to protect data confidentiality while cryptography techniques rely on the computational complexity of mathematical problems.

This thesis on wireless communication security is divided into two parts. In the first part of this work, we focus on lattice-based public-key cryptography which is among the most promising techniques for the post-quantum cryptography systems. In particular, we focus on the Goldreich-Goldwasser-Halevi (GGH) cryptosystem which has been widely developed due to its simple encryption and decryption procedures. Despite many existing GGH improvements, its huge public key size remains its main drawback, which prevents the system from being used in practice. In order to overcome this drawback, we propose a new GGH cryptosystem using generalized low density lattices. Indeed, we show that this new GGH reduces the key size by one order of magnitude. In addition, we show that the key generation complexity as well as those of the encryption and decryption phases are significantly decreased. The security of this new GGH system is highlighted through a security analysis that reviews all known attacks on GGH systems. This allows us to conclude that our scheme does not add any new vulnerability as compared with the existing GGH schemes.

First, I would like to thank my PhD advisors, Professor Ghaya Rekaya Ben Othman and Doctor Mireille Sarkiss, for their consistent guidance and support throughout this thesis. I have an immense respect, appreciation and gratitude towards Doctor Michèle Wigger for sharing her invaluable knowledge, experience and advice which have been greatly beneficial to the successful completion of my thesis. I am also very grateful to Professor Joseph Boutros for his appreciable help and valuable discussions. I would like to extend my gratitude to the reviewers, Professor Mari Kobayashi and Professor Cong Ling for accepting to evaluate my thesis. My earnest thanks are also due to Doctor Daniel Augot, Professor Mérouane Debbah and Doctor Ligong Wang for accepting to be a member of the jury.

Thanks to all my colleagues in LSC team, especially Babis, Wael, Mathias, Ibrahim, Nourhene, Kim, Siwar, Sami, Mounir, Antoine, Pierre and Mohamed, for creating a great work atmosphere. Special thanks to Alexis for his endless support, valuable help and technical and non-technical discussions. Thank you Alexis for being a source of motivation, optimism and positive energy.

Thanks also to my colleagues in Télécom ParisTech Elie, Asma, Joe, Hussein, Abir, Wiem, Taghrid, Chadi, Antonio, Achraf, Alaa, Louise, Mohamed, Ehsan and all those I forgot to mention. I would also like to thank my friends Laure, Jad, Hadi, Marcelino and Damien for their support and all our happy get-togethers and for uplifting my spirit during the challenging times faced during this thesis. Ce besoin de sécurité a poussé les chercheurs à considérer les couches du système de communication jusqu'alors non sécurisées comme la couche physique. De plus, la sécurité couche physique ne s'appuyant pas sur la résolution de problèmes mathématiques complexes mais sur l'exploitation des caractéristiques du canal de transmission, le gain de sécurité offert n'est pas corrélé à celui offert par les mécanismes classiques de sécurité.

Un autre aspect à prendre en considération est la non homogénéité de l'utilisation de l'Internet au cours de la journée. Récemment, les techniques de caching ont été proposées pour équilibrer le débit Internet transmis au cours de le journée. Les techniques de caching offrant le meilleur débit sont appliquées au niveau de la couche physique mais ne considèrent aucune problématique de sécurité.

Cette thèse explore deux techniques complémentaires permettant d'assurer la confidentialité des données transmises sur des liens sans-fils. Dans la première partie de ce travail, nous nous concentrons sur la cryptographie à clé publique basée sur les réseaux de points, qui est l'une des techniques les plus prometteuses de cryptographie postquantique. Dans la seconde partie de ce travail, nous étudions la sécurité au niveau de la couche physique des systèmes de communication dans lesquels les utilisateurs ont accès à des mémoires de caches. xv Dans ce travail, le chapitre 1 est dédié à l'exploration de l'état de l'art relatif aux deux aspects de sécurité étudiés. Le chapitre 2 présente le premier résultat de cette thèse: un nouveau système GGH qui utilise les réseaux de points "generalized low density" GLD. Nous commençons par présenter le premier système GGH et ses améliorations. Ensuite, nous présentons notre nouveau système et nous étudions sa sécurité et sa complexité en comparant avec les systèmes existants.

La seconde partie du travail, relative au caching, est présentée dans les chapitre 3 et 4, qui considèrent respectivement la sécurité individuelle et la sécurité jointe. Nous commençons par considérer le cas de deux utilisateurs. Nous dérivons des bornes supérieures et inférieures du compromis sécurisé capacité-mémoire en considérant différentes distributions de cache. Nous proposons des schémas de codage permettant d'atteindre nos bornes inférieures. Nous comparons les différents bornes obtenues pour mettre en évidences les meilleures distributions de cache et schémas de codage. Finalement, nous étendons nos résultats pour le cas de K utilisateurs.

Chapitre 1: Sécurité des systèmes de communication

La protection des données contre l'espionnage peut être appliquée sur différentes couches du système OSI. Les approches de sécurités appliquées sur les couches deux à sept se basent sur des primitives cryptographiques, tel que AES. Ces schémas se basent sur des problèmes mathématiques complexes ou bien des programmes de clés complexes. Donc, leur sécurité résulte du fait que l'espion a des capacités de calcul limitées. D'autre part, la sécurité de la première couche, la couche physique, n'utilise pas les primitives cryptographique. Contrairement aux techniques cryptographique qui sont inconscient de la nature physique du canal de transmission, la sécurité couche physique exploite les caractéristiques de ce canal, tel que le bruit et les interférences, pour protéger la confidentialité des données transmises. Cette sécurité n'impose aucune contrainte sur la capacité de calcul des espions. Cette indépendance entre la sécurité au niveau de la couche physique et la cryptographie peut idéalement être exploitée pour créer un système de sécurité plus renforcé.

Dans cette thèse, nous nous intéressons à la cryptographie et à la sécurité couche physique dans les systèmes de transmission sans fil. Du point de vue cryptographie, nous nous concentrons sur les techniques basées sur les réseaux de points et nous étudions un schéma composé d'un émetteur, un récepteur et un espion. Du point de vue sécurité couche physique, nous considérons le schéma de caching avec un émetteur, plusieurs récepteurs et un espions et où les récepteurs ont accès à des mémoires caches. Nous présentons ici l'état de l'art lié au deux thématiques étudiées.

xvi

Cryptographie basée sur les réseaux de points

Les systèmes de cryptographie basés sur les réseaux de points sont des systèmes à clé publique basés sur des problèmes difficiles à résoudre dans ces réseaux. Ces cryptosystèmes ont attiré l'attention des chercheurs car ils sont supposés robustes contre les attaques d'ordinateurs quantiques. En 1996, Ajtai a proposé le premier cryptosystème de ce type, nommé Ajtai-Dwork (AD) [START_REF] Ajtai | A public-key cryptosystem with worst-case/average-case equivalence[END_REF]. Cependant, l'intérêt de ce système est principalement théorique et ne peut pas être utilisé en pratique.

Inspiré par AD, plusieurs systèmes ont été proposés comme Goldreich-Goldwasser-Halevi (GGH) [1] et NTRU [START_REF] Hoffstein | NTRU: a ring based public key cryptosystem[END_REF]. GGH est une alternative plus pratique du système AD. La sécurité du GGH est basée sur le problème du vecteur le plus proche (CVP) dans les réseaux de points. D'autre part, NTRU est un cryptosystème à clé publique basé sur les anneaux. Il peut être vu comme un problème de CVP ou de SVP.

En 2005, Regev a introduit le problème de "learning with errors (LWE)" [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. Il a proposé un système basé sur LWE qui est équivalent à un problème de décodage d'un code linéaire aléatoire. Plusieurs schémas de cryptages ont été conçus basés sur le problème LWE (eg. [START_REF] Kawachi | Multi-bit cryptosystems based on lattice problems[END_REF][START_REF] Peikert | A framework for efficient and composable oblivious transfer[END_REF]).

Parmi ces systèmes, GGH est le seul dans lequel on gère explicitement les réseaux de points. Mais malgré ces caractéristiques intéressantes et les efforts pour son amélioration [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF]3], l'inconvénient majeur du GGH reste la taille très grande de sa clé publique. Dans cette thèse, nous résolvons ce problème en remplaçant les réseaux de points aléatoires du GGH par des réseaux de points à faible densité, plus précisément les réseaux GLD.

Sécurité basé sur la théorie d'information

Wyner a introduit le concept de sécurité couche physique qui exploite l'aléa du bruit dans les canaux de transmission pour sécuriser [START_REF] Wyner | The Wire-tap channel[END_REF]. Il a modélisé le canal wiretap avec un émetteur, un récepteur et un espion qui écoute la transmission. Il a introduit la notion de capacité de secret qui correspond au débit maximal de transmission garantissant un décodage fiable au récepteur légitime tout en empêchant l'espion d'avoir aucune information du message. Dans son schéma, le canal de l'espion doit être dégradé par rapport à celui du récepteur légitime afin d'avoir une capacité de secret positive. Wyner a proposé de coder les bits d'informations avec des bits aléatoires afin d'atteindre cette capacité. Après la découverte de Wyner, la détermination de cette capacité de secret a été intensivement traité pour différentes classes de canaux tel que canal à effacement, canal Gaussien et canal à diffusion [START_REF] Mukherjee | Principles of physical layer security in multiuser wireless networks: A survey[END_REF].

Récemment, les problèmes de sécurité ont commencé a être exploré dans les scénarios de caching. Le concept du caching est de stocker des données dans des mémoires cache à xvii coté des utilisateurs préalablement à la communication dans le but d'augmenter le débit de transmission. En effet, le trafic dans les systèmes de communication varie en fonction du temps. On a des périodes dans la journée pendant lesquels le réseau est fortement utilisé, induisant des délais de transmissions, et d'autres périodes pendant lesquels il est à peine utilisé. L'idée est de profiter de ces dernières pour stocker les données dans les mémoires caches. Ensuite, quand les utilisateurs demandent des fichiers pendant les périodes de congestion, une partie de leurs fichiers est déjà présente dans leur mémoire et il suffit de leur transmettre la partie manquante. Donc, la communication est divisée en deux phases: la phase de caching et la phase de transmission.

Maddah-Ali et Niesen ont introduit le premier schéma de codage de cache qui a permis d'ajouter un gain de cache au delà du gain évident provenant de la présence locale d'une partie des fichiers [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF]. Ensuite, Saeedi, Timo, et Wigger ont montré que ce gain peut être encore augmenté en appliquant un codage joint de cache et canal [START_REF] Timo | Joint cache-channel coding over erasure broadcast channels[END_REF][START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]. En d'autres termes, dans ce dernier, le codeur et décodeur exploitent simultanément le contenu du cache et les statistiques du canal. Ils ont proposé un schéma de codage joint qu'ils ont nommé le codage piggyback. L'aspect de sécurité de ces systèmes a été adressé ultérieurement et des codes de caching sécurisés ont été proposés en [START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF][START_REF] Ravindrakumar | Fundamental limits of secretive coded caching[END_REF][START_REF] Hassan | Fundamental limits of caching in D2D networks with secure delivery[END_REF]. Dans ces schémas, la sécurité profite du fait que l'espion n'a pas accès aux mémoires caches dans lesquels des clés secrètes sont sauvegardées dans la phase de caching et utilisées dans la phase de transmission. Cependant, ces travaux ne considèrent pas le canal de transmission et se concentrent seulement sur le design de codeur/décodeurs de cache. Mais, cette approche a été montrée sousoptimale pour le scénario sans contrainte de sécurité [START_REF] Timo | Joint cache-channel coding over erasure broadcast channels[END_REF][START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]. Pour cela, dans ce travail, nous explorons la sécurité des systèmes de caching au niveau de la couche physique.

Chapitre 2: Schéma de cryptographie basé sur les réseau de points GLD Dans cette partie, nous analysons l'utilisation des réseaux de points à faible densité appelés generalized low density (GLD) dans le cryptosystème Goldreich-Goldwasser-Halevi (GGH). Nous nous sommes intéressés aux GLD grâce à leur faible complexité de génération du réseau et de décodage, ce qui constitue un facteur très important pour les systèmes de cryptographie, manquant dans les systèmes GGH existant. Notre but est de diminuer la complexité du système GGH pour qu'il devienne un candidat pour remplacer les systèmes de cryptage à clé publique traditionnels. Nous montrons que cette réduction en complexité ne réduit pas la sécurité du système.

xviii

Schéma GGH et ses améliorations

Dans le système GGH original [1], la clé privée R est une bonne base d'un réseau de point Λ de dimension n, défini par R = √ nI + Q, où I est la matrice d'identité et Q est une matrice aléatoire dont les éléments sont choisis dans l'intervalle {-4, . . . , 4}. La clé publique B est une mauvaise base du même réseau de point Λ. B est générée en appliquant des combinaisons linéaires sur les vecteurs de base de la clé privée R. Pour crypter un message m ∈ Z n , m est multiplié par la clé publique B pour générer x, qui est un point du réseau Λ. Ensuite, x est sécurisé en lui additionnant un vecteur de bruit e de dimension n qui est choisi aléatoirement dans l'ensemble {-σ, σ} n . Le texte chiffré obtenu est c = mB

+ e = x + e. (1)
Pour décrypter le texte chiffré et obtenir le message, il suffit de calculer

m = cR -1 RB -1 . (2)
Ce système peut être facilement cassé pour les petites dimensions à cause de la forme particulière du bruit utilisé [2]. Et pour les grandes dimensions, la taille de clé du GGH devient très grande et donc le système devient inutilisable en pratique.

Dans le but de surmonter les inconvénients du GGH original, plusieurs améliorations ont été proposées. Une amélioration intéressante a été proposée par Micciancio qui a suggéré de choisir le bruit e uniformément dans l'intervalle [-σ, σ]. Le choix de bruit uniforme a rendu ce système robuste contre l'attaque de Nguyen [2]. De plus, Micciancio a proposé de choisir pour la clé publique la base ayant la forme Hermite normal form (HNF). En fait, on dit qu'une base M est en HNF si elle est triangulaire inférieure vérifiant les conditions suivantes : m i,j = 0 ∀ i < j,, m i,i > 0 ∀ i, et 0 ≤ m i,j < m j,j ∀ i > j. Il a prouvé que cette forme de matrice réduit la taille de la clé de O(n 3 log 2 (n)) à O(n 2 log 2 (n)). Cependant, son système a des désavantages. En effet, la procédure de génération de la clé publique est très lente et sa procédure de décodage est aussi lente et instable. Ce système, donc, n'est pas non plus utilisable en pratique.

Récemment, Hooshmad et Aref ont proposé de remplacer les réseaux de points aléatoires utilisés dans les cryptosystèmes GGH par des réseaux de points à faible densité, notamment les low density lattice codes (LDLC) [3]. Dans leur schéma, ils ont suivi la proposition de Micciancio et ont choisi de prendre la matrice génératrice du LDLC qui est en HNF comme clé publique. Par contre, ils ont choisi de générer leur vecteur de bruit suivant une distribution gaussienne de moyenne nulle et de variance σ 2 , qui est choisi proche de la borne de Poltyrev [4]. L'utilisation des LDLC a permis de fixer le problème de décryptage puisqu'ils utilisent un décodage itératif qui offre des performances proches de l'optimal mais à faible complexité. Mais l'inconvénient de ce système est le fait que les LDLC sont des réseaux de points réels, ce qui augmente la complexité de génération de la matrice HNF.

xix

Réseaux de points GLD

Les réseaux de points GLD sont des réseaux entiers définis dans Z n et ils ont des matrices de parité de faible densité [START_REF] Boutros | Generalized low-density (GLD) lattices[END_REF]. Ils sont décodés à l'aide du décodage itératif qui est de faible complexité permettant l'utilisation facile de ces réseaux à grande dimensions.

Un réseau de point GLD de dimension n est généré suivant la construction A à partir d'un code linéaire GLD C GLD [n, k] de longueur n et dimension k, de la façon suivante:

Λ = C GLD + pZ n , (3)
où p est un nombre premier.

Dans cette construction, on commence par considérer un code élémentaire linéaire C 0 [n 0 , k 0 ] défini sur le corps fini F p de matrice de parité H C 0 . On génère un deuxième code C 1 obtenue comme la somme directe de L copies de C 0 , de matrice de parité

H C 1 =    H C 0 . . . 0 . . . . . . . . . 0 . . . H C 0    . (4)
Ensuite, on génère le code GLD

C GLD [n, k], défini par C GLD = J j=1 π j (C 1 ) = J j=1 π j (C ⊕L 0 ), où π 1 = id et π 2 , .
. . , π J sont J permutations de {1, 2, . . . , n} telles que π j (x 1 , x 2 , . . . , x n ) = (x π j (1) , x π j (2) , . . . , x π j (n) ). On trouve la forme systématique H C,syst = [I| -B t ] de la matrice de parité H C du code GLD en utilisant l'élimination de Gauss. Ensuite, la matrice génératrice du code est donnée par G C = [B|I]. Finalement, suivant la construction A (3), la matrice génératrice de Λ, qui est de forme HNF, est donnée par

G Λ = pI 0 B I . (5)

Schéma de cryptographie basé sur les GLD

Analyse de sécurité

Nous analysons la robustesse de notre système contre les attaques connues appliquées à ce genre de cryptosystèmes.

Attaque par force brute

Dans cette attaque, l'espion essaye de trouver la clé privée en essayant toutes les possibilités. Donc, la complexité de cette attaque dépend du nombre de clés possibles qui est dans notre cas

n! × (J -1) ∼ √ 2πn n e n , (6)
où l'approximation suit la formule de Stirling. Puisque ce nombre est exponentiel en n, l'attaque n'est pas faisable pour une dimension n = 1000.

Attaque de décodage

Dans cette attaque l'espion essaye de décrypter le texte chiffré et de retrouver le texte clair, ce qui est équivalent à trouver le point du réseau le plus proche du texte chiffré. L'espion commence par réduire la base publique du réseau pour trouver une base plus orthogonale dans laquelle le décodage est plus efficace. Pour cela, il applique une des deux techniques de réduction de bases suivantes: Lenstra-Lenstra-Lovász (LLL) ou Block Korkine-Zolotarev (BKZ). Ensuite, il applique un des deux algorithmes de décodage de Babai [START_REF] Babai | On Lovaśz' lattice reduction and the nearest lattice point problem[END_REF] Le succès ou l'échec de ces attaques dépendent de deux facteurs: l'orthogonalité de la base du réseau et le vecteur de bruit. En fait, si la base utilisée pour le décodage n'est pas orthogonale et si le vecteur de bruit est suffisamment grand, le décodage ne peut qu'échouer. Pour mesurer l'orthogonalité de la base, nous utilisons l'orthogonality defect défini par [1] OD

(G Λ ) = n i=1 g i | det(G Λ )| . (7)
OD(G Λ ) =

Analyse de complexité

Nous examinons la taille de notre clé publique, la complexité de sa génération et la complexité de décryptage et nous nous comparons aux systèmes GGH précédents.

Taille de la clé publique

L'espace nécessaire pour stocker la clé publique du GLD est de k × (n -k) × log 2 (p) bits. Tableau 2 présente la taille de clé publique pour plusieurs exemples de codes élémentaires. On voit que pour une dimension de réseau n ≈ 1000, la taille de la clé est autour de 100 KBs. La taille de clé du GGH original en dimension n = 400 est de 2.3 MBs [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF]. La taille de clé du système de Micciancio en dimension n = 800 est de 1 MB [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF]. Donc, nous pouvons clairement conclure que notre système basé sur les réseaux de points réduit dix fois la taille de clé. Les K récepteurs sont divisés en deux groupes. Le premier groupe K w := {1, . . . , K w } est formé par K w récepteurs faibles qui ont de mauvais canaux. Le deuxième groupe K s := {K w + 1, . . . , K} est formé par K s = K -K w récepteurs forts qui ont de bons canaux. Nous supposons que les trois probabilités d'effacement δ w , δ s et δ z aux récepteurs faibles, récepteurs forts et l'espion, respectivement, vérifient 0 ≤ δ s ≤ δ w ≤ δ z ≤ 1.

Nous supposons aussi que chaque récepteur faible a accès à une mémoire de cache de taille nM bits, tandis que les récepteurs forts n'ont pas de cache. L'émetteur a accès à une librarie de D > K messages indépendants W 1 , . . . , W D de débit R s ≥ 0 chacun. Soit D := {1, . . . , D}. Pour d ∈ D, chaque message W d est uniformément distribué sur l'ensemble 1, . . . , 2 nRs , où n est la longueur du block transmis.

Chaque récepteur k ∈ K := {1, . . . , K} demande un seul message W d k de la librairie. Nous notons par d k ∈ D la demande d'un récepteur et par d := {d 1 , . . . , d K } ∈ D K le vecteur de demande de tous les récepteurs. La communication est effectuée en deux phases: la phase de caching dans laquelle des fragments de messages sont stockés dans les mémoires caches et la phase de transmission dans laquelle les messages demandés sont transmis au récepteurs.

Durant la phase de caching, le vecteur de demande d n'est pas encore connu. Donc, le contenu du cache V i pour chaque récepteur faible i ∈ K w est une fonction de toute la librairie V i := g i (W 1 , . . . , W D ), pour une certaine fonction de caching Une paire débit-mémoire (R s , M) est atteinte en sécurité, en vérifiant la contrainte de sécurité individuelle, si pour chaque > 0 et longueur de bloc n suffisamment large, il existe des fonctions de caching, codage, et décodage telles que

P Worst e := max d∈D K P K k=1 Ŵk = W d k ≤ , et 1 n I(W d k ; Z n ) < , ∀k ∈ K. ( 8
)
Pour chaque taille de mémoire cache M, nous définissons le compromis sécurisé entre capacité et mémoire C s (M) comme la borne supérieure de tous les débits R s tel que la paire (R s , M) qui peuvent être atteints en sécurité:

C s (M) := sup R s : (R s , M) atteint en sécurité . (9)
Bornes supérieure et inférieure pour le scénario avec deux récepteurs et cache pour le récepteur faible

Nous considérons le scénario avec un utilisateur faible et un utilisateur fort où l'utilisateur faible seulement a accès à une mémoire cache de taille M.

La borne supérieure du compromis sécurisé capacité-mémoire C s (M) pour ce scénario est donnée par:

C s (M) ≤ (δ z -δ 1 )F + M, (10a)
C s (M) ≤ (δ z -δ 2 )F, (10b)
C s (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D . (10c)
La borne inférieure du compromis sécurisé capacité-mémoire C s (M) est formée par les débits R s vérifiant:

R s ≤ (δ z -δ 2 )F, (11a) R s ≤ (1 -δ 2 )(δ z -δ 2 ) 1 + δ z -2δ 2 F + 1 -δ 2 1 + δ z -2δ 2 M D , (11b)
xxv

R s ≤ (1 -δ 1 )(δ z -δ 2 ) 1 -δ 1 + δ z -δ 2 F + M D , (11c)
R s ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + D(δ z -δ 2 ) + (δ z -δ 1 ) 2δ z -δ 1 -δ 2 M D , (11d)
R s ≤ δ z -δ 2 2 F + D 2 M D , (11e)
R s ≤ D D + 1 (δ z -δ 2 )F + D D + 1 M D . ( 11f
)

Schéma de codage qui atteint cette borne inférieure

Cette borne inférieure est atteinte par le schéma de codage joint combinant le codage de cache et le codage canal, décrit ci-dessous:

Préparations: Pour chaque d ∈ D, on divise le message W d en deux sous-messages, tels que W d = W (0) d , W (1) d
, de débits R (0) et R (1) , respectivement. Le débit total de W d est R s = R (0) + R (1) . Si R (0) > (D -2)R (1) , on divise

W (0) d en deux sous-messages, tels que W (0) d = W (0,1) d , W (0,2) d , de débits (D -2)R (1) et R (0) -(D -2)R (1) , respectivement. Sinon, W (0,1) d = W (0) d est de débit R (0) et W (0,2) d est de débit nul. Génération du codebook piggyback: On génère codebook C 1 ayant Γ 1 := 2 nR (0) • 2 nR (1)
• 2 nR mots de code de longueur αn. Il est généré en choisissant chaque élément de chaque mot de code aléatoirement et indépendamment suivant une distribution Bernoulli-1/2. C 1 est partitionné en 2 nR (0) • 2 nR (1) blocs, contenant chacun 2 nR mots de codes. Ces blocs sont arrangés en une matrice ayant 2 nR (0) lignes et 2 nR (1) colonnes, comme on voit dans Figure 3 Phase de transmission: La transmission est divisée en deux périodes de longueurs

αn et (1 -α)n, pour α ∈ [0, 1].
Durant la première période, l'émetteur envoie le message W (0) (1) et génère

d 1 au récepteur 1 et le message W (1)
d 2 au récepteur 2. Il choisit aléatoirement un ensemble d'indices ι, tels que j 1 , j 2 , . . . , j ι ∈ D \ {d 1 , d 2 } , où ι = max 1, R (0) /R
W XOR := W (0,1) d 1 ⊕ W (1) j 1 , W (1) j 2 , . . . , W (1)
jι .

(

) 12
Ensuite, il choisit aléatoirement un indice J 1 de 1 : 2 nR et envoie le mot de code xxvi W1 1 2 . . .

2 nR (0) W2 1 2 . . . 2 nR (1) 2 nR Figure 3: Codebook piggyback sécurisé C 1 . numéro J 1 du codebook C 1 W1 , W2 = W (1) d 2 , où W1 := W XOR , W (0,2) d 1 .
Durant la deuxième période, l'émetteur envoie le message W

d 2 ) ∈ C 1 .
Décodage au récepteur 2: Récepteur 2 n'a pas de mémoire cache et doit donc décoder les deux phases de transmissions en se basant seulement sur son vecteur reçu y n 2 et en considérant tous les mots de codes des codebooks.

Analyse: Les deux récepteurs décodent leurs messages avec une probabilité d'erreur négligeable si

R (0) + R ≤ α(1 -δ 1 )F, (13a)
R s + R ≤ α(1 -δ 2 )F, (13b)
R (0) + R ≤ (1 -α)(1 -δ 2 )F. ( 13c
)
De plus, la contrainte de sécurité individuelle est respectée si

(D -1)R (1) + R ≥ α(1 -δ z )F, (14a)
R (0) + R ≥ α(1 -δ z )F, (14b) R ≥ (1 -α)(1 -δ z )F. ( 14c
)
xxvii En combinant ces contraintes et en éliminant R , R et α, on obtient la borne inférieure dans 11.

Borne inférieure obtenue par schéma de codage cache-canal séparé Pour montrer l'importance d'un schéma de codage cache-canal joint, nous calculons une borne inférieure du compromis capacité-mémoire obtenue par le meilleur schéma de codage cache-canal séparé connu, qu'on note C s,Sep (M). La borne inférieure de C s,Sep (M) est formée par les débits R s,Sep vérifiant:

R s,Sep ≤ (δ z -δ 2 )F, (15a) R s,Sep ≤ (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F + δ z -δ 2 1 + δ z -δ 1 -δ 2 M D , (15b)
R s,Sep ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + (δ z -δ 2 ) (D -1)(1 -δ z ) + (δ z -δ 1 ) (1 -δ 1 )(2δ z -δ 1 -δ 2 ) M D . (15c)
Bornes supérieure et inférieure pour le scénario avec deux récepteurs ayant des mémoires de cache égales

Pour montrer l'intérêt de notre choix d'affectation de cache pour le récepteur faible, nous étudions aussi le cas où la mémoire de cache disponible est divisée également entre les deux utilisateurs. Dans ce cas, chaque récepteur a donc accès à une mémoire de taille M/2. On note par C s,Sym (M) le compromis sécurisé capacité-mémoire dans ce cas.

La borne supérieure du compromis sécurisé capacité-mémoire C s,Sym (M) est donnée par:

C s,Sym (M) ≤ (δ z -δ 1 )F + M 2 , (16a)
C s,Sym (M) ≤ (1 -δ 1 )F + M 2D , (16b)
C s,Sym (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D . (16c)
La borne inférieure du compromis sécurisé capacité-mémoire C s,Sym (M) est formée par les R s,Sym vérifiant:

R s,Sym ≤ 2(1 -δ 1 )F, (17a) R s,Sym ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + 3 -2δ 1 -δ 2 2(2 -δ 1 -δ 2 ) M D , (17b)
R s,Sym ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + (δ z -δ 1 )(δ z -δ 2 )(3 -2δ 1 -δ 2 ) 2(1 -δ 1 )(1 -δ 2 )(2δ z -δ 1 -δ 2 ) xxviii + D(1 -δ z ) (1 -δ 1 )(δ z -δ 1 ) + (1 -δ 2 )(δ z -δ 2 ) 2(1 -δ 1 )(1 -δ 2 )(2δ z -δ 1 -δ 2 ) M D . (17c)
Discussion et résultats numériques

• Pour une mémoire cache M ≤ M 1 = D(1-δz)(δz-δ 2 ) (D-1)(1+δz-δ 1 -δ 2 )
, notre codage cache-canal joint atteint le débit suivant:

R s = R 0 + δ z -δ 2 2δ z -δ 1 -δ 2 + δ z -δ 1 D(2δ z -δ 1 -δ 2 ) M. (18)
Nous remarquons que pour des mémoires de petites tailles, la pente de C s (M) ne diminue pas rapidement avec D, contrairement au cas non sécurisé où la pente est fonction de • Pour une mémoire

M ≥ M 3 = F • max D (δ z -δ 2 ) 2 1 -δ 2 , (δ z -δ 2 ) , (19)
le compromis sécurisé capacité-mémoire est C s (M) = (δ z -δ 2 )F . Cette capacité correspond à la capacité du récepteur 2 en l'absence du récepteur 1.

xxix

• Nos bornes sont très proches pour tous les paramètres et sont exactes pour des tailles de M ≥ M 3 , définie en [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF].

• Notre schéma joint de codage cache-canal atteint une borne inférieure meilleure que celle atteinte par le schéma séparé. Cela est vrai pour tous les paramètres de canal et toutes les tailles de mémoires cache.

Figure 5

Bornes supérieures et inférieures pour le scénario avec K récepteurs

Nous considérons le cas général avec K w récepteurs faibles et K s récepteurs forts. Les récepteurs faibles seulement ont accès à des mémoires caches de taille M. La borne supérieure du compromis sécurisé capacité-mémoire C (K) s (M) est donnée par:

C (K) s (M) ≤ F (δ z -δ w ) + M, (20a)
C (K) s (M) ≤ F δ z -δ s K s , (20b)
xxx

C (K) s (M) ≤ F i 1 -δ w + K s 1 -δ s -1 + iM D , i ∈ {1, . . . , K w }. (20c)
Pour la borne inférieure, nous considérons les cinq paires débit-mémoire suivantes:

• R (K) 0 := K w δ z -δ w + K s δ z -δ s -1 F, M (K) 0 := 0; (21a) • R (K) 3 := (δ z -δ s ) K s F, M (K) 3 := DK w (δ z -δ s ) 2 K s K s (1 -δ z ) + K w (δ z -δ s ) F ; (21b) • R (K) 4 := (δ z -δ s ) K s F, M (K) 4 := D (δ z -δ s ) K s F ; (21c) Si K s (1 -δ z ) -(D -K w )(δ w -δ s ) ≤ 0, • R (K) 1 := 2(1 -δ w )(δ z -δ s ) (D -K w )(1 -δ w ) + K w (1 -δ z ) F β 1 , (21d)
M (K) 1 := 2D(1 -δ w )(δ z -δ s )(1 -δ z )F β 1 ; (21e) • R (K) 2 := 2(1 -δ w )(δ z -δ s ) K s (1 -δ w ) + K w (δ w -δ s ) F β 2 , (21f)
M (K) 2 := 2D(1 -δ w )(δ z -δ s )(δ w -δ s )F β 2 ; (21g) Sinon, si K s (1 -δ z ) -(D -K w )(δ w -δ s ) > 0, • R (K) 1 := 2(1 -δ w )(δ z -δ s ) K s (δ z -δ w ) + D(δ w -δ s ) F β 3 , (21h)
M (K) 1 := 2D(1 -δ w )(δ z -δ s )(δ w -δ s )F β 3 ; (21i) • R (K) 2 := 2(1 -δ w )(δ z -δ s ) (D -K)(1 -δ w ) + K w (1 -δ z -δ w + δ s ) F β 4 , (21j)
M (K) 2 := 2D(1 -δ w )(δ z -δ s )(1 -δ z -δ w + δ s )F β 4 ; (21k)
où

β 1 = 2K w (D -K w )(1 -δ w )(δ z -δ s ) + K w (K w -1)(1 -δ z )(δ z -δ s ) + 2K s (D -K w )(1 -δ w ) 2 , β 2 = 2K s K w (1 -δ w )(δ z -δ s ) + K w (K w -1)(δ w -δ s )(δ z -δ s ) + 2K 2 s (1 -δ w ) 2 , β 3 = 2K w K s (1 -δ w )(δ z -δ s ) + K w (K w -1)(δ w -δ s )(δ z -δ s ) + 2K s (1 -δ w ) K s (δ z -δ w ) + (D -K w )(δ w -δ s ) , xxxi R ÉSUM É D ÉTAILL É DE LA TH ÈSE β 4 = 2K w (D -K)(1 -δ w )(δ z -δ s ) + K w (K w -1)(δ z -δ s )(1 -δ z -δ w + δ s ) + 2(1 -δ w ) K s (D -K)(1 -δ w ) + K w K s (1 -δ z ) -K w (D -K w )(δ w -δ s ) .
La borne inférieure du compromis sécurisé capacité-mémoire C (K) s (M) est donnée par:

C (K) s (M) ≥ upper hull (R (K) , M (K) ) : ∈ {0, . . . , 4} . (22)
Figure 6 montre ces bornes pour un exemple avec K = 20 récepteurs.

M F •D C (K) s (M) F 0 0.1 0.2 0.05 0.1 0.15 Borne inf C (K) s (M) Borne sup C (K) s (M)

Chapitre 4: Sécurité jointe pour le caching

Dans ce chapitre, nous considérons le même modèle de canal que dans le chapitre précédent mais avec une contrainte de sécurité plus forte, qui est la contrainte de sécurité jointe. Cette contrainte impose que l'espion ne doit savoir aucune information à propos de tous les messages de la librairie conjointement à partir de son vecteur reçu Z n :

lim n→∞ 1 n I(W 1 , . . . , W D ; Z n ) < . (23)
Afin de satisfaire cette contrainte, l'émetteur a accès à un générateur d'aléa θ, défini sur un alphabet Θ. Cela induit un changement aux fonctions de caching et codage définies dans le chapitre précédent. Le contenu de la mémoire cache de chaque récepteur faible i ∈ K w devient V i := g i (W 1 , . . . , W D , θ), pour une certaine fonction de caching g i : 1, . . . , 2 nRs D × Θ → V. De plus, l'émetteur produit le vecteur à transmettre

X n := f d (W 1 , . . . , W D , θ), pour une certaine fonction de codage f d : 1, . . . , 2 nRs D × Θ → X n .
xxxii Bornes supérieure et inférieure pour le scénario avec deux récepteurs et cache pour le récepteur faible Dans cette section, nous considérons le scénario avec un utilisateur faible et un utilisateur fort où l'utilisateur faible seulement a accès à une mémoire cache de taille M.

La borne supérieure du compromis sécurisé capacité-mémoire C s (M) est donnée par:

C s (M) ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + δ z -δ 2 2δ z -δ 1 -δ 2 M, (24a)
C s (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D , (24b)
C s (M) ≤ (δ z -δ 2 )F. ( 24c
)
Pour la borne inférieure, nous considérons les six paires débit-mémoire suivantes:

• R 0 := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F, M 0 := 0; (25a) • R 1 := (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, M 1 := (1 -δ z )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F ; (25b) • R 2 := (1 -δ 2 ) min δ z -δ 1 1 -δ 1 , 1 -δ 1 2 -δ 1 -δ 2 F, M 2 := (1 -δ z )F ; (25c) • R 3 := (1 -δ 2 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, M 3 := (δ z -δ 2 ) (δ 1 -δ 2 )D + (1 -δ z ) 1 + δ z -δ 1 -δ 2 F ; (25d) • R 4 := (δ z -δ 2 )F, M 4 := (δ z -δ 2 ) (δ z -δ 2 )D + (1 -δ z ) 1 -δ 2 F ; (25e) • R 5 := (δ z -δ 2 )F, M 5 := D(δ z -δ 2 )F. ( 25f
)
La borne inférieure du compromis sécurisé capacité-mémoire C s (M) est donnée par:

C s (M) ≥ upper hull (R , M ) : = 0, . . . , 5 . (26)
Il suffit de prouver que les paires (R , M ) sont atteignables et la preuve du upper convex hull suit par des arguments de partage de mémoire et temps comme dans [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF].

xxxiii Schéma de codage atteignant (R 1 , M 1 ) On divise la phase de transmission en deux périodes de longueurs αn et (1 -α)n, pour α = δz-δs 1+δz-δw-δs . On génère aléatoirement une clé K 1 de débit α(1 -δ z )F et on la sauvegarde dans la mémoire cache du récepteur 1. Dans la première période, l'émetteur envoie le message W d 1 au récepteur 1 en utilisant un code wiretap avec clé secrète K 1 [11, (22.7)]. Dans la deuxième période, l'émetteur envoie le message W d 2 au récepteur 2 en utilisant un code wiretap sans clé secrète.

Schéma de codage atteignant

(R 2 , M 2 )
On divise la phase de transmission en deux périodes de longueurs αn et (1 Pour la communication dans la deuxième période, on génère un codebook de superposition avec un centre cloud ayant 2 n(1-α)(1-δz)F mots de code, et avec chaque codebook satellite contenant 2 nR 2 mots de code. L'émetteur code W ⊕

-α)n, pour α = max 0, (1-δs)(δz-δw)-(1-δz)(1-δw) (δz-δw)(2-δw-δs) . On divise chaque message W d , pour d ∈ D, en deux sous-messages W d = [W (0) d , W ⊕ d ] de débits α(1 -δ w )F et (1 -α)(1 -δ z )F . On génère deux clés aléatoires K 1 et K 2 de débits α(1 -δ z )F et (1 -α)(1 -δ z )F et
W d = [W (0) d , W (1)
d , W ⊕ d ] de débits α(δ z -δ w )F , α(δ w -δ s )F et α(1 -δ z )F . On génère une clé aléatoire K 1 de débit α(1 -δ z )F . On sauvegarde K 1 et W (1) 1 , . . . , W (1)
D dans la mémoire cache du récepteur 1.

On génère un piggyback codebook C 1 formé de 2 nα(δz-δ 1 )F • 2 nα(δ 1 -δ 2 )F blocs ayant 2 nα(1-δz)F mots de codes chacun. Ces blocs sont arrangés en une matrice de 2 nα(δz-δ 1 )F lignes 2 nα(δ 1 -δ 2 )F colonnes. La phase de transmission est divisée en deux périodes de longueurs αn et (1 -α)n. Dans la première période, l'émetteur transmet les messages W (0)

d 1 et W ⊕ d 1 au récepteur 1 et W (1)
d 2 au récepteur 2. Il envoie donc le mot de code correspondant à W XOR = W ⊕ d 1 ⊕ K 1 du bloc C 1 (W (0) d 1 , W (1)
d à R (1) = α(δ z -δ 2 )F et on choisit α(1 -δ z )F ≤ (1 -α)(δ z -δ 2 )F .
Bornes supérieure et inférieure pour le scénario avec deux récepteurs ayant des mémoires de cache égales Comme dans le chapitre précédent, nous étudions le cas où la mémoire de cache disponible est divisée également entre les deux utilisateurs. La borne supérieure du compromis sécurisé capacité-mémoire C s,Sym (M) est donnée par:

C s,Sym (M) ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + M 2 , (27a)
C s,Sym (M) ≤ (1 -δ 1 )F + M 2D , (27b)
C s,Sym (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D . (27c)
Pour la borne inférieure, nous considérons les trois paires débit-mémoire suivantes:

• R 0,Sym := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F, M 0,Sym := 0; (28a) • R 1,Sym := (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F, M 1,Sym := 2(1 -δ z )(1 -δ 2 ) 2 -δ 1 -δ 2 F ; (28b) • R 2,Sym := min 2(1 -δ 1 )F, (1 -δ 2 )F , (28c)
M 2,Sym := min 2 (1 -δ z ) + D(1 -δ 1 ) F, 2(1 -δ 2 ) 2(1 -δ z ) + D(1 -δ 2 ) 2(1 -δ 1 ) + (1 -δ 2 ) F . (28d)
La borne inférieure du compromis sécurisé capacité-mémoire C s,Sym (M) est donnée par:

C s,Sym (M) ≥ upper hull (R ,Sym , M ,Sym ) : = 0, 1, 2 . ( 29
)
xxxv Bornes supérieure et inférieure pour le scénario avec deux récepteurs avec des mémoires caches non égales Dans cette partie, nous étudions une distribution de cache pour les deux utilisateurs qui tient compte de leurs canaux. Récepteur 1 a accès à une mémoire de taille M R 1 et récepteur 2 a accès à une mémoire de taille M R 2 , tel que

M R 1 + M R 2 = M.
La borne supérieure du compromis sécurisé capacité-mémoire C s,Asym (M) est donnée par:

C s,Asym (M) ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + δ z -δ 2 2δ z -δ 1 -δ 2 M, (30a)
C s,Asym (M) ≤ 1 2 (δ z -δ 2 )F + M 2 , (30b)
C s,Asym (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D , (30c)
C s,Asym (M) ≤ (2 -δ 1 -δ 2 ) 2 F + M 2D . ( 30d
)
Pour la borne inférieure, nous considérons les cinq paires débit-mémoire suivantes:

• R 0,Asym := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F, M 0,Asym := 0; (31a) • R 1,Asym := (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, M 1,Asym := (1 -δ z )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F ; (31b) • R 2,Asym := (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F, M 2,Asym := (1 -δ z )F ; (31c) • R 3,Asym := (1 -δ 2 ) 2 2 -δ 1 -δ 2 F, (31d)
M 3,Asym := (1 -δ z ) + D(1 -δ 2 )(δ 1 -δ 2 ) 2 -δ 1 -δ 2 F ; (31e) • R 4,Asym := (2δ z -δ 1 -δ 2 ) + 1 -δ z 2 F, (31f)
M 4,Asym := D(2δ z -δ 1 -δ 2 ) + (1 -δ z ) F ; (31g)
La borne inférieure du compromis sécurisé capacité-mémoire C s,Asym (M) est donnée par:

C s,Asym (M) ≥ upper hull (R ,Asym , M ,Asym ) : = 0, . . . , 4 . (32)
Comme dans la preuve de [START_REF] Gamal | Network information theory[END_REF], il suffit de prouver que les paires (R ,Asym , M ,Asym ) sont atteignables. (R 1,Asym , M 1,Asym ) est similaire à (R 1 , M 1 ). xxxvi Schéma de codage atteignant (R 2,Asym , M 2,Asym ) On divise la phase de transmission en deux périodes de longueurs αn et (1 -α)n, pour α = δz-δs 1+δz-δw-δs . On génère deux clés aléatoires On génère un piggyback codebook C 1 formé de 2 n(δz-δ 1 )F • 2 n(δz-δ 2 )F blocs contenant chacun 2 n(1-δz)F mots de codes. Ces blocs sont arrangés en une matrice ayant 2 n(δz-δ 1 )F lignes et 2 n(δz-δ 2 )F colonnes. Dans la phase de transmission, l'émetteur envoie le mot de code représentant

K 1 et K 2 de débits α(1 -δ z )F et (1-α)(1-δ z )F . Pour i ∈ {1,
W d = [W (0) d , W (1)
d , W ⊕ d ], tel que R (0) = (δ z -δ 1 )F , R (1) = (δ z -δ 2 )F et R ⊕ = (1-δz)F 2 . Ensuite, on génère deux clés aléatoires K 1 et K 2 de débit (1-δz)F 2 chacun. On sauvegarde K 1 et W (1) 1 , . . . , W (1)
W XOR = [W ⊕ d 1 ⊕K 1 , W ⊕ d 2 ⊕K 2 ] du bloc C 1 (W (0) d 1 , W (1)
d 2 ).
Discussion et résultats numériques Figure 8 compare les bornes obtenues pour les différentes distributions de cache considérées. Nous remarquons que pour une mémoire totale petite, il est toujours préférable d'allouer celle-ci à l'utilisateur faible. Pour des mémoires de tailles moyennes, nous voyons que dans la plupart des cas, allouer la mémoire à l'utilisateur faible est plus avantageux que de la répartir également entre les deux utilisateurs. Nous voyons aussi que xxxviii répartir la mémoire d'une façon asymétrique est le meilleur choix puisque, contrairement à l'allocation unilatérale, cela permet à l'utilisateur fort de sécuriser sa transmission.

C s (M) = (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + δ z -δ 2 2δ z -δ 1 -δ 2 M. (33)
Bornes supérieure et inférieure pour le scénario avec K récepteurs Nous considérons le cas général avec K w récepteurs faibles et K s récepteurs forts. Les récepteurs faibles seulement ont accès à des mémoires caches de taille M. La borne supérieure du compromis sécurisé capacité-mémoire C (K) s (M) est donnée par:

C (K) s (M) ≤ δ z -δ s K s F, (34a)
C (K) s (M) ≤ j 1 -δ w + K s 1 -δ s -1 F + jM D , j ∈ {1, . . . , K w }, (34b)
C (K) s (M) ≤ max α i ∈[0,1] min α i (δ z -δ w ) + (1 -α i )(δ z -δ s ) i + K s F + i i + K s M, α i δ z -δ w i F + M , i ∈ {1, . . . , K w }. (34c)
Pour la borne inférieure, nous considérons les six paires débit-mémoire suivantes:

• R (K) 0 := K w δ z -δ w + K s δ z -δ s -1 F, M (K) 0 := 0; (35a) • R (K) 1 := (1 -δ w )(δ z -δ s )F K w (δ z -δ s ) + K s (1 -δ w ) , M (K) 1 := (1 -δ z )(δ z -δ s )F K w (δ z -δ s ) + K s (1 -δ w ) ; (35b) • R (K) 2 := min (1 -δ s )(δ z -δ w ) K s (1 -δ w ) , ( 1
-δ s )(1 -δ w ) K w (1 -δ s ) + K s (1 -δ w ) F, (35c)
M (K) 2 := (1 -δ z ) K w F ; (35d) • R (K) 3 := 2(1 -δ w )(δ z -δ s ) K s (1 -δ w ) + K w (δ w -δ s ) F K w (δ z -δ s ) (K w -1)(δ w -δ s )+2K s (1 -δ w ) +2K 2 s (1 -δ w ) 2 , (35e) M (K) 3 := 2D(δ z -δ s )(1 -δ w )(δ w -δ s )F K w (δ z -δ s ) (K w -1)(δ w -δ s )+2K s (1 -δ w ) +2K 2 s (1 -δ w ) 2 + 2(δ z -δ s )(1 -δ z ) (K w -1)(δ w -δ s ) + K s (1 -δ w ) F K w (δ z -δ s ) (K w -1)(δ w -δ s )+2K s (1 -δ w ) +2K 2 s (1 -δ w ) 2 . (35f) • R (K) 4 := (δ z -δ s ) K s F, M (K) 4 := K s (δ z -δ s )(1 -δ z ) + DK w (δ z -δ s ) 2 K s K s (1 -δ z ) + K w (δ z -δ s ) F ; (35g) • R (K) 5 := (δ z -δ s ) K s F, M (K) 5 := D (δ z -δ s ) K s F. (35h)
C (K) s (M) ≥ upper hull (R (K) , M (K) ) : ∈ {0, . . . , 5} . (36)

Conclusion

Dans cette thèse, nous avons étudié deux méthodes de sécurité pour les transmissions sans fil. Dans la première partie de ce travail, nous avons proposé une amélioration au cryptosystème GGH en utilisant les réseaux de points GLD. Cela a réduit la complexité de ce système tout en garantissant sa sécurité. En effet, nous avons réduit de 10 fois la taille de la clé publique et de 1300 fois la complexité de génération de la clé. De plus, le décodage itératif des GLD est plus efficace que les algorithmes précédemment utilisés.

Dans la seconde partie de ce travail, nous avons étudié la sécurité des canaux de diffusion multi-utilisateur, ayant accès à des mémoires de caches, en présence d'un espion. Nous avons considéré les deux contraintes de sécurité individuelle et jointe. Nous avons considéré le scénario avec K ≥ 2 récepteurs, parmi lesquels K w récepteurs sont faibles et ont accès à des mémoires de caches de même taille, et K s récepteurs sont forts et n'ont pas accès à des mémoires de cache. Nous avons dérivé des bornes supérieures et inférieures du compromis sécurisé capacité-mémoire en considérant différentes distributions de cache. Pour chaque contrainte, nous avons proposé des schémas de codage cache-canal joints qui atteignent les bornes inférieures, dont nous avons montré la pertinence en les comparant avec des schémas de codage séparé. De plus, pour K = 2, nous avons étudié une distribution symétrique de cache pour les deux utilisateurs ainsi qu'une distribution bilatérale asymétrique. Nous avons trouvé que la distribution symétrique est la plus mauvaise dans la plupart des cas. Pour les petites mémoires de cache, la distribution unilatérale est la meilleure. Pour des mémoires de cache plus grandes, la distribution bilatérale qui prend en considération les canaux des utilisateurs est le meilleur choix.

xl

The place that the Internet takes in our everyday lives is significantly growing over the years. In Europe, the proportion of households with Internet access increased from 30% to 84% over the last 10 years, according to the International Telegraph Union (ITU) [START_REF]ICT Facts and Figures[END_REF]. The fact that the Internet has become the main communication medium becomes apparent if one considers throughput numbers. For instance, a recent Cisco study revealed that the global traffic reached 1.1 ZB per year in the end of 2016 and is expected to reach 2.3 ZB per year by the end of 2020 [START_REF]White paper: Cisco VNI Forecast and Methodology[END_REF].

Accordingly, people get accustomed to use the Internet for more various purposes with less consideration for the privacy of the data they are exposing. Indeed, personal data is being daily exposed online through the Internet while achieving some critical private activities such as paying bills, banking and completing governmental processes. In addition, the Internet is also regularly being used as a mean to transmit personal data towards remote servers in order to perform secure storage, controlled sharing, among wider types of operations that are getting allowed by cloud-based computing power and storage means.

However, the Internet is highly vulnerable because of its open and global nature. Attacks carried out through the Internet are becoming more numerous and more sophisticated. The Identity Theft Resource Center reports show that 980 reported data breaches of companies and governmental agencies records occurred in 2016 in the US only [14]. These breaches exposed the personal data of millions of people including their names, addresses, credit card numbers, social security numbers, medical records and many other private information. At global level, Symantec reports that half a billion personal records were stolen or lost worldwide in 2015, including 78 million medical patient records [START_REF]Over Half a Billion Personal Information Records Stolen or Lost in 2015[END_REF].

There is therefore an urgent need to strengthen the Internet security. Among the security properties, there is a special need to enforce confidentiality of personal data INTRODUCTION while they are transmitted. Data security protocols are used for that purpose. However, due to advances in quantum computing technology, new attacks are about to emerge that will require changes in these protocol designs. Hence, post-quantum security solutions are being extensively studied. Yet, current post-quantum cryptography algorithms are too heavy to be usable, mainly because of their huge key sizes compared to classical cryptosystems.

This problem is further aggravated if one considers the device constraints. Indeed, devices with low processing power, low memory space and low transmission throughput will have to transmit secure data in the near future, over an Internet exposed to quantum computer threats. This emphasizes the necessity for low complexity and small key size post-quantum algorithms.

The need to enforce the Internet security urged researches to explore beyond the existing notions of security and consider unsecured layers of the communication system. A promising technique suggests to combine security protocols with physical layer security. This new type of security improves the system robustness against quantum computer attacks since it is not based on complex computational problems as in classical cryptography. Instead, physical layer security makes use of the characteristics of the transmission channel to ensure its secrecy unlike traditional cryptography where the physical channel is never considered. Thus, applying physical layer security techniques with higher layers security protocols provides a new layer of security uncorrelated with the others and greatly increases the overall system security.

Besides security related problems, another aspect of future networks that has to be taken into consideration is the way the Internet usage pattern is evolving. Cisco study also shows that the Internet traffic during peak times is increasing much faster than the average Internet traffic. Indeed, traffic during the busiest hour of the day increased by 51% in 2015 while average traffic only increased by 29% during the same period. This calls for solutions, beyond the classical ones which increase the network throughput in general, in order to moderate the network usage during high traffic periods by taking advantage of stiller periods.

Recently, caching emerged as a promising technique to balance the network load between peak and off-peak periods. Its concept relies on pre-storing data during periods when the network is barely used and benefiting from this data during high network traffic times. Caching methods are currently used on the application layer of the communication systems. However, recent studies show that caching can be more beneficial if its design considers also the particular medium over which the transmission will occur. These studies did not consider physical layer security aspects of caching systems. Thus, security solutions for caching systems taking into account the physical transmission layer have yet to be explored.

The objective of this thesis is to study new security solutions for confidentiality of Sarah Kamel INTRODUCTION data transmission. In a first phase, we focus on post-quantum cryptography solutions and in particular, lattice-based cryptography. Our aim is to design a lattice-based cryptosystem with a reduced key size that can be actually used in practice. In a second phase, we study physical layer secrecy of cache-aided communication systems. In these systems, security can be provided by exploiting both the nature of the transmission channel and the users' cache memories.

In this manuscript, Chapter 1 is dedicated to review the state of the art related to these two security aspects. We start by introducing post-quantum cryptography and in particular, lattice-based and code-based cryptography in Section 1.1. We then explore the advances in physical layer security and especially in cache-aided transmission systems in Section 1.2.

As a first part of the report, Chapter 2 presents our first thesis result which is a new GGH lattice-based cryptosystem using generalized low density lattices. First, we describe in detail the original GGH scheme and discuss its advantages and disadvantages in Section 2.1 and we review GGH-based improved schemes and discuss their drawbacks in Section 2.2. We then present in Section 2.3 our proposed public-key cryptography scheme based on generalized low density lattices. To demonstrate the robustness of our scheme, we carry out security analysis of all the known attacks against the GGH schemes and prove their failure against our proposed system. Our results are validated by some experimental results and are presented in Section 2.4. In Section 2.5, the advantage of our cryptosystem is emphasized by a complexity study and simulation results showing the effectiveness of the new scheme compared to existing ones.

The second part of the thesis report is devoted to securing cache-aided networks in Chapters 3 and 4 under different secrecy constraints. In Chapter 3, we study the security of the cache-aided packet-erasure broadcast channels under an individual secrecy constraint. We start by formally defining our problem in Section 3.1. Then, we present in Section 3.2 our joint cache-channel coding scheme and compute the lower bound on the secure capacity-memory tradeoff for the two-user scenario with cache only at the weaker of both receivers. The corresponding upper bound is proved in Section 3.3. To justify our choice for cache assignment, we compute the lower and upper bounds on the secure capacity-memory tradeoff for the two-user scenario under a symmetrical cache distribution in Sections 3.4 and 3.5. In Section 3.6, we compute the securely achievable lower bound using a separate cache-channel coding approach for the two-receiver case under one-sided cache assignment with the aim of emphasizing the profit of our joint coding scheme. In Section 3.7, we discuss and compare all of the bounds obtained in the previous sections. Finally, we extend our results to the K-receiver scenario and compute the general lower and upper bounds on the secure capacity-memory tradeoff in Sections 3.8 and 3.9.

In Chapter 4, we consider the joint secrecy constraint for the same scenario studied in the previous chapter. In Section 4.1, we present the modifications of the problem INTRODUCTION definition imposed by the new constraint. Then, for the two-receiver one-sided cache assignment, we present and prove a lower bound on the secure capacity-memory tradeoff in Section 4.2 and compute the corresponding upper bound in Section 4.3. We devote Sections 4.4 and 4.5 to the symmetric cache assignment case where we demonstrate its lower and upper bounds. After that, we study the case of asymmetric two-sided cache distribution and give lower and upper bounds on the secure capacity-memory tradeoff in Sections 4.6 and 4.7 respectively. We dedicate Section 4.8 to the interpretation and comparison of the obtained bounds. In the previous sections, we consider the special case with two receivers. We study the general case with K receivers with cache at weak receivers only and provide lower and upper bounds on the generalized secure capacitymemory tradeoff in Sections 4.9 and 4.10, respectively.

Finally, we summarize the results of this work and present some future research perspectives in a general conclusion.

Chapter 1

Security in Communication Systems

As the need to strengthen the internet security increases, new techniques have to be developed to protect the confidentiality of data during transfer and storage. These techniques should also anticipate the development in quantum computing and the eventual attacks that will arise from this evolution.

Before delving into details on the specific security schemes that we study in this thesis, we find it interesting to position them relative to other security approaches within the communication system.

Protecting data security against eavesdroppers can be done at various layers of the classical open systems interconnection (OSI) model. Figure 1.1 depicts the seven layers of the OSI model with some examples of security approaches applied at each of the layers. According to the OSI model, transmitted data go through encapsulation and encoding operations as they travel down the sender communication stack. Symmetrically, data are decapsulated and decoded upon reception, traveling upward the receiver communication stack. In parallel with encapsulation/decapsulation and encoding/decoding, ciphering/deciphering operations may be applied.

Applicative security solutions are used to secure traffic relative to a specific application only. Moving downward the OSI model, security solutions become applicable to a greater number of applications. Reaching the network layer, the Internet protocol security (IPsec) can be used to secure any IP packet. In addition, the network layer is the last layer where end-to-end protocols can be applied. Indeed, data link layer, which consists of the media access control (MAC) and logical link control (LLC) sub-layers, provides node-to-node data transfer between two nodes that are directly connected to each other. Finally, at the physical layer, data are encoded and modulated before being The security approaches employed at layers two to seven rely on cryptographic schemes. For example, the AES symmetric cryptosystem can be used in almost all protocol examples provided within Figure 1.1. These schemes ensure data security by means of complex mathematical problems or by reliance on complex key schedules. Thus, their security arises from the fact that the attacker has limited computational capacity.

On the other hand, physical layer security does not employ cryptosystems. While cryptography techniques are insensitive to the physical nature of the transmission channel, physical layer security exploits the characteristics of the wireless medium, such as multi-path fading and interference, to protect the confidential information against eavesdropping and other attacks. Since these security techniques do not make the same assumptions on the attacker as those relying on cryptographic primitives, they can be used to reinforce security of the higher communication layers.

Note that data security consists of confidentiality, integrity and availability properties. In this thesis, we focus on the confidentiality property only. Unless stated otherwise, we use the term "security" to refer to this confidentiality property as in most of the physical layer security literature. In this thesis, we will explore both cryptography and physical layer security of wireless communications. From a cryptographic perspective, we will study the scheme in Figure 1.2 where Alice wants to communicate a message, called plaintext, to Bob. She encrypts the plaintext with the public key generating the ciphertext to be transmitted. Upon message reception, Bob decrypts the ciphertext using its private key and obtains the plaintext. The ciphertext is also received by Eve who is eavesdropping the communication. However, Eve does not have access to the private key and thus, applies attack algorithms that may allow her to decrypt without the private key and retrieve some confidential information. The main goal here is to design an encryption method that guarantees a failed decryption to Eve using any known attack algorithm.

From a physical layer security perspective, we will study the caching scenario depicted in Figure 1.3. In this scheme, the transmitter conveys messages to multiple users through a broadcast channel. Legitimate receivers have access to cache memories where messages can be pre-stored. Some receivers have good channels and others have worse channels. The broadcasted message is also received by an eavesdropper who does not have any cache memory and has the most degraded channel. The purpose here is to code the messages in a way to be decoded reliably by the legitimate receivers while being perfectly secured from the intruder.

Cryptography

Cryptography is the art of hiding information using a secret key. A plaintext, which is understood by everybody, is encrypted using an encryption key into an unreadable form called ciphertext. Only those who have access to the decryption key can decrypt the ciphertext and extract the message. The fundamental purpose of cryptography is to allow two people to exchange information through a channel in a way that the transmitted messages cannot be understood by any intruder listening to their communication. The process of designing cryptography systems involves three phases. First, cryptographers design schemes that they believe to be secure. Then, cryptanalysts try to break these schemes. Finally, the fastest of the unbroken schemes are chosen to be implemented and used in practice.

Cryptographic systems can be grouped into two main categories: private-key ciphers and public-key ciphers. In private-key cryptography, also called symmetric-key cryptography, the same private key is used for both encryption and decryption. Conversely, public-key cryptosystems use asymmetric algorithms where a public key serves for encryption and another private key serves for decryption. The public key is known to everyone whereas the private key is possessed only by the legitimate receiver.

Nowadays, public-key encryption schemes are mainly based on three hard mathematical problems: the integer factorization problem, the discrete logarithm problem and the elliptic-curve discrete logarithm problem. No attack algorithm can solve these problems using a classical computer. However, Shor presented in [START_REF] Shor | Algorithms for quantum computation: discrete logarithms and factoring[END_REF] a quantum algorithm for integer factorization that runs in polynomial time making today's public-key cryptosystems easily breakable by a powerful quantum computer.

Most cryptography protocols that are adopted today to protect the Internet rely on public-key schemes, such as RSA and DSA. They are therefore proved to be broken by quantum computers according to Shor's algorithm. The day the construction of a powerful quantum computer succeeds, all of these protocols will be broken and the Internet will no longer be secure. Even though these computers do not exist today, cryptographers have to start preparing for this new era.

Quantum attacks do not present the same danger to symmetric cryptography algorithms. In fact, Grover designed another quantum algorithm that finds the input to a black box function based on its outputs [START_REF] Grover | A fast quantum mechanical algorithm for database search[END_REF]. However, it does not speed up attacks on symmetric ciphers as much as Shor's algorithm does on asymmetric ones. Therefore, doubling the key size of symmetric cryptography algorithms is enough to protect them against quantum computer attacks.

These facts directed the attention of cryptographers towards the design of postquantum asymmetric cryptosystems secure against quantum algorithms attacks. Four categories of public-key ciphers are believed to resist against Shor's algorithms: multivariate quadratic equations cryptography, hash-based cryptography, code-based cryptography and lattice-based cryptography. We explore in Sections 1.1.1 and 1.1.2 the last two fields that are of interest to us in this thesis.

Code-based cryptography

Code-based cryptography systems are public-key encryption schemes that use error correction codes. McEliece developed the first code-based scheme using binary irreducible Goppa codes [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF]. Encryption and decryption of this scheme are fast and efficient. However, it is not used in practice because of its large public and private keys sizes. The McEliece cryptosystem remains unbroken till today and it is believed to remain secure against attacks by quantum computers. It is described as follows:

• System parameters:

-n : Length of the code.

-t : Number of errors that the code can correct.

Sarah Kamel

• Key generation: Generate the following matrices -G : k × n generator matrix of a binary irreducible Goppa code C(n, k) of length n, dimension k and can correct t errors.

-P : n × n randomly chosen permutation matrix.

-S : k × k randomly chosen non-singular matrix.

• Public key: (G , t) where G = SGP .

• Private key: (G, S, P ).

• Encryption: Compute the ciphertext c as follows

c = mG + e, (1.1)
where m is the message of length k and e is an error vector of length n and weight t.

• Decryption: To decrypt the ciphertext, start by computing

cP -1 = mSG + eP -1 . (1.2)
Then, apply the decoding algorithm of the code C to eliminate the erroneous part eP -1 and obtain mSG. Finally, find m as

m = (mSG)G -1 S -1 . (1.3)
A variant of the McEliece system is the Niederreiter cryptosystem [START_REF] Niederreiter | Knapsack-type cryptosystems and algebraic coding theory[END_REF]. Niederreiter proposed to encode the message into the error vector instead of representing it as a codeword. Originally, Niederreiter scheme was proposed with generalized Reed-Solomon codes (GRS) but these codes were proven to be insecure [START_REF] Sidelnikov | On insecurity of cryptosystems based on generalized Reed-Solomon codes[END_REF]. However, when designed with binary Goppa codes, Niederreiter has the same security as the McEliece system [START_REF] Li | On the equivalence of McEliece's and Niederreiter's public-key cryptosystems[END_REF].

McEliece's main limitation is the size of its public key which is considerably larger than that of today's used publi-key encryption scheme, such as RSA. An interesting suggestion was to replace Goppa codes with low-density parity-check (LDPC) codes to overcome this drawback [START_REF] Monico | Using low density parity check codes in the McEliece cryptosystem[END_REF]. In fact, LDPC codes have sparse parity-check matrices with a storage size that increases linearly with the code length n [START_REF] Baldi | QC-LDPC code-based cryptography[END_REF]. However, this sparsity induces a vulnerability on the security of the system and hence cannot be exploited. To prevent this weakness, neither the public code nor its dual code should be too sparse. Yet by loosing the sparsity, the reduction in the key size is also lost. An alternative solution was to employ quasi-cyclic LDPC (QC-LDPC) codes, whose parity check matrices can be described by a single row of them and to increase their density resulting in quasi-cyclic moderate-density parity-check (QC-MDPC) codes [START_REF] Baldi | QC-LDPC code-based cryptography[END_REF].

Other codes were also investigated with the same aim of reducing the key size. Some examples of these codes are: Reed-Muller codes [START_REF] Sidelnikov | A public-key cryptosystem based on binary Reed-Muller codes[END_REF], Gabidulin codes [START_REF] Gabidulin | Ideals over a non-commutative ring and their applications to cryptography[END_REF] and BCH codes [START_REF] Gaborit | Shorter keys for code based cryptography[END_REF]. Many of these codes were broken, e.g. [START_REF] Minder | Cryptanalysis of the sidelnikov cryptosystem[END_REF][START_REF] Sidelnikov | On insecurity of cryptosystems based on generalized Reed-Solomon codes[END_REF]. The generalization of McEliece system with non-binary Goppa codes was also studied, e.g. [START_REF] Bernstein | Wild McEliece[END_REF], [START_REF] Bernstein | Wild McEliece incognito[END_REF], and attacks on these systems were examined [START_REF] Faugère | Algebraic attack against variants of McEliece with Goppa polynomial of a special form advances[END_REF]. The most secure system remains the original McEliece based on Goppa codes. However, it is not secure against chosen-ciphertext attacks [START_REF] Berson | Failure of the McEliece public-key cryptosystem under messageresend and related-message attack[END_REF][START_REF] Verheul | Sloppy Alice attacks! Adaptive chosen ciphertext attacks on the McEliece public-key cryptosystem[END_REF]. In this attack, the attacker can enter one or more known ciphertexts into the system and obtain the resulting plaintext. Then, from these results he can attempt to recover the secret key used for decryption. Many works focused on the design of McEliece systems secure against adaptive chosen-ciphertext attack (CCA2), e.g. [START_REF] Kobara | Semantically secure McEliece public-Key cryptosystems conversions for McEliece PKC[END_REF][START_REF] Dowsley | A CCA2 secure public key encryption scheme based on the McEliece assumptions in the standard model[END_REF][START_REF] Dottling | A CCA2 secure variant of the McEliece cryptosystem[END_REF][START_REF] Nojima | Semantic security for the McEliece cryptosystem without random oracles[END_REF].

Lattice-based cryptography

In this section, we introduce lattice codes and review the main results in lattice-based cryptography.

Lattice preliminaries

A real n-dimensional lattice Λ is a discrete subgroup of the Euclidean space R n . Λ can be represented by a set of n linearly independent vectors b 1 , . . . , b n in R n , called basis vectors. The matrix

B = [b 1 , . . . , b n ] T ∈ R n×n , (1.4)
having the basis vectors as rows is called a generator matrix for the lattice. Thus, the lattice is obtained by taking all integral linear combinations of the basis vectors

Λ = {λ = xB : x ∈ Z n }. (1.5)
Note that a lattice basis is not unique. There is an infinite number of bases for the same lattice but there exists only one basis that is of Hermite normal form (HNF).

A basis H is in Hermite normal form if it satisfies the following conditions:

1. H is lower-triangular , i.e. h i,j = 0 ∀ i < j. 2. h i,i > 0 ∀ i. 3. 0 ≤ h i,j < h j,j ∀ i > j.
For every basis B of Λ, there exists a unimodular matrix U that, multiplied by B, generates the HNF form matrix H, as follows

H = U B. (1.6)
The orthogonality of a basis B can be evaluated by its orthogonality defect. As introduced by Schnor in [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF], it is the product of the basis vector lengths divided by the matrix determinant, defined as

OD(B) = n i=1 ||b i || | det(B)| , (1.7)
where

||b i || is the Euclidean norm of the i'th row in B.
If OD(B) = 1, this means that B is an orthogonal basis of Λ. Conversely, when B is a bad basis, its OD(B) is high.

The n-dimensional space can be divided into an infinite number of similar regions, such that each copy of the region contains only one lattice point. This region is called fundamental region of the lattice. Its volume is denoted by the fundamental volume and is equal to the square of the determinant of B

vol(Λ) = (det(B)) 2 .
(

The fundamental region of a lattice is not unique but its fundamental volume is. An example of a fundamental region is the fundamental parallelotope which consists of the points

θ 1 b 1 + • • • + θ n b n (0 ≤ θ i < 1). (1.9)
It is clear that the fundamental parallelotope's form depends on the choice of the lattice basis.

Lattice-based cryptography schemes

Lattice-based cryptography systems are public-key systems based on some hard lattice problems. Lattices were first used in cryptanalysis to break various cryptographic schemes. In 1996, Ajtai showed a connection between the average-case complexity and the worst-case complexity of some lattice problems [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF]. This discovery opened the door for a different use of lattices in cryptography. From this point, lattices were greatly studied in the design of cryptosystems.

Lattice-based cryptosystems are believed to remain secure against quantum computers and hence they received a wide attention from the cryptography community. The first lattice-based cryptography scheme is the Ajtai-Dwork (AD) cryptosystem [START_REF] Ajtai | A public-key cryptosystem with worst-case/average-case equivalence[END_REF]. The security of AD is related to the hardness of the shortest vector problem (SVP). SVP refers to the computation of a vector u in a lattice Λ, defined by a basis B, with minimum non-zero Euclidean length min{ u ; u ∈ Λ, u = 0}. However, AD is mainly of theoretical interest and far from being a practical cryptosystem.

Many ciphers were inspired from the AD system, such as Goldreich-Goldwasser-Halevi cryptosystem (GGH) [1] and NTRU cryptosystem [START_REF] Hoffstein | NTRU: a ring based public key cryptosystem[END_REF]. The GGH scheme was proposed in [1] as a much more practical lattice-based alternative than the AD cryptosystem. GGH can be seen as the lattice-based analog of the McEliece cryptosystem, which uses linear codes for encryption [START_REF] Mceliece | A public-key cryptosystem based on algebraic coding theory[END_REF]. GGH security relies on the hardness of the closest vector problem (CVP) in a lattice, which consists in finding the vector u ∈ Λ that minimizes the distance to a given vector v ∈ R n . On the other hand, NTRU is a ring-based public-key cryptosystem whose encryption functions are designed using convolution polynomial rings and elementary probability theory. It can be interpreted as a SVP or CVP instance.

In 2005, Regev introduced the learning with errors (LWE) problem and proposed an LWE-based public-key cryptosystem that can be viewed as a decoding problem from a random linear code [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. Later, multiple public-key encryption schemes were also proposed based on LWE (eg. [START_REF] Kawachi | Multi-bit cryptosystems based on lattice problems[END_REF][START_REF] Peikert | A framework for efficient and composable oblivious transfer[END_REF]). Among these schemes, GGH is the only one that works explicitly with lattices. Despite some interesting properties and some efforts to improve it [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF]3], the drawback of GGH lattice-based cryptosystem remains the huge size of its public key. In this thesis, we propose to solve this issue by replacing random lattices used so far in GGH with structured low density lattices such as generalized low density (GLD) lattices. GLD lattices, GGH cryptosystems and the proposed GLD lattice-based GGH cryptosystem are the main focus of Chapter 2.

In the next section, we present physical layer security and the principal results in this domain. We also discuss in more detail security of the caching scenario on which we focus in the second part of this thesis.

Information-theoretic security

In 1949, Shannon introduced the principle of measuring the secrecy level of a communication system by a quantitative value [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. He considered the model depicted in Figure 1.5 where a transmitter, Alice, wants to convey messages to a legitimate receiver, Bob, through a perfect channel, while an eavesdropper, Eve, is wiretapping the communication. He supposed that Eve also observes an error-free copy of all the transmitted messages.

He defined the notion of perfect secrecy which is achieved if the eavesdropper's equiv-

Alice M Encoding X Perfect Channel Y = X Decoding M Bob Secret key Z = X Eve Figure 1.5: Shannon's model.
ocation of the message remains the same with and without the knowledge of its received vector

H(M |Z) = H(M ). (1.10)
This is equivalent to having zero mutual information between the source message and the eavesdropper's received vector

I(M ; Z) = 0. (1.11)
In his considered model, this perfect secrecy is achieved if the transmitted codeword is statistically independent of the message. It can be guaranteed by means of a one-time pad where the message is secured using a secret key known only by the transmitter and the legitimate receiver, and the key is used only once. For instance, the codeword can be computed as the binary addition (XOR) of the message and the secret key. However, the problem is that, since each key cannot be used more than once, the transmitter and the legitimate receiver have to store long sequences of random keys and share them over a secure channel. That caused information-theoretic security to be regarded as a theoretical concept unfeasible in practice.

In 1975, Wyner was the first to introduce the concept of creating security by exploiting the randomness of the noise present in all communication systems [START_REF] Wyner | The Wire-tap channel[END_REF], which is known today as physical layer security. He considered the channel model depicted in Figure 1.6 which he called the wiretap channel. In this model, Alice conveys messages to Bob through a discrete memoryless channel (DMS). Eve observes the communication through a second discrete memoryless channel. The channel between Alice and Eve is called the wiretap channel and is considered to be degraded with respect to the main channel.

Wyner also introduced the notion of secrecy capacity as the maximal transmission rate that ensures a reliable decoding for Bob while preventing Eve from finding any information about the messages. It is equal to the difference between the capacity of the channel between Alice and Bob and that of the channel between Alice and Eve

C s = max p X I(X; Y |Z) = max p X I(X; Y ) -I(X; Z) , (1.12)
where, X is the channel input, Y is the channel output at the legitimate receiver, Z is the channel output at the eavesdropper and p X is the probability distribution of the channel inputs X.

Wyner proposed to use coset codes to encode the information bits with some random bits to achieve the secrecy capacity. The rate of the random bits should be at least equal to the eavesdropper channel capacity in order to sink it in total ambiguity. Moreover, since the notion of perfect secrecy is too strict, two other secrecy notions were defined: strong secrecy condition [START_REF] Csiszár | Almost independence and secrecy capacity[END_REF] and weak secrecy condition [START_REF] Wyner | The Wire-tap channel[END_REF]. The strong secrecy condition requires that the information leaked to the eavesdropper vanishes as the blocklength n of the codeword goes to infinity

lim n→∞ I(M ; Z n ) = 0.
(1.13)

The weak secrecy condition is less stringent. It requires that the rate of the information leaked to the eavesdropper vanishes as n goes to infinity lim n→∞

1 n I(M ; Z n ) = 0. (1.14)

Main results in physical layer security

After Wyner's discovery, determining this secrecy capacity has been addressed extensively and has led to a plethora of information-theoretical results for many classes of channels such as erasure, Gaussian, MIMO, broadcast, interference and relay channels (see [START_REF] Mukherjee | Principles of physical layer security in multiuser wireless networks: A survey[END_REF] and references therein). The Gaussian wiretap channel was introduced in [START_REF] Leung-Yan-Cheong | The Gaussian wire-tap channel[END_REF] and was then investigated in different scenarios [START_REF] Mitrpant | An achievable region for the Gaussian wiretap channel with side information[END_REF][START_REF] Tang | The Gaussian wiretap channel with a helping interferer[END_REF][START_REF] Shafiee | Achievable rates in Gaussian MISO channels with secrecy constraints[END_REF]. Secure communications over fading channels were also investigated [START_REF] Li | Secret communication with a fading eavesdropper channel[END_REF][START_REF] Liang | Secure communication over fading channels[END_REF][START_REF] Gopala | On the secrecy capacity of fading channels[END_REF]. The point-to-point scenario was extended to multi-user systems for different channels, e.g. multiple access channel [START_REF] Tekin | The general Gaussian multiple-access and two-way wiretap channels: Achievable rates and cooperative jamming[END_REF][START_REF] Liang | Multiple-access channels with confidential messages[END_REF][START_REF] Tekin | The Gaussian multiple access wire-tap channel[END_REF], broadcast channel [START_REF] Csiszar | Broadcast channels with confidential messages[END_REF][START_REF] Liu | Discrete memoryless interference and broadcast channels with confidential messages: Secrecy rate regions[END_REF][START_REF] Khisti | Secure broadcasting over fading channels[END_REF][START_REF] Liu | Secrecy capacity region of a multiple-antenna Gaussian broadcast channel with confidential messages[END_REF] and relay channel [START_REF] Lai | The relay-eavesdropper channel: Cooperation for secrecy[END_REF][START_REF] Oohama | Coding for relay channels with confidential messages[END_REF][START_REF] Ekrem | Secrecy in Cooperative Relay Broadcast Channels[END_REF].

In order to achieve this secrecy capacity, practical wiretap codes were designed based on the application of classic and modern coding techniques [START_REF] Bernstein | Post-quantum cryptography[END_REF][START_REF] Richardson | Modern coding theory[END_REF]. First approaches considered capacity-achieving graph-based codes such as LDPC codes [START_REF] Gallager | Low-density parity-check codes[END_REF] and extended their applications for secrecy [START_REF] Klinc | LDPC codes for the Gaussian wiretap channel[END_REF]. Then, some researches examined secrecy rate using structured nested lattice codes for wiretap coding [START_REF] He | Providing secrecy with structured codes: Tools and applications to Gaussian two-user channels[END_REF][START_REF] Ling | Semantically secure lattice codes for the Gaussian wiretap channel[END_REF][START_REF] Oggier | Lattice codes for the wiretap Gaussian channel: Construction and analysis[END_REF]. Polar codes were also considered as secrecy achieving codes for some wiretap channels [START_REF] Andersson | Nested polar codes for wiretap and relay channels[END_REF][START_REF] Mahdavifar | Achieving the secrecy capacity of wiretap channels using polar codes[END_REF][START_REF] Vardy | A new polar coding scheme for strong security on wiretap channels[END_REF]. Physical layer security issues were also studied based on network coding theory in [START_REF] Cai | Secure network coding on a wiretap network[END_REF].

Secrecy capacities of multiple antenna channels were extensively studied. The main challenge in securing multiple-input multiple-output (MIMO) channels is that the wiretap MIMO channel is not degraded in general. Secret communications in MIMO channels where multiple antennas are used for transmission and reception were first studied by Hero in [START_REF] Hero | Secure space-time communication[END_REF]. He introduced two constraints, called low probability of intercept and low probability of detection, and studied them in different scenarios where the transmitter, the legitimate receiver and the eavesdropper are either informed or uninformed about their channel states. The secrecy capacity of the single-input multiple-output (SIMO) wiretap channel where the eavesdropper has more than one antenna was analyzed in [START_REF] Parada | Secrecy capacity of SIMO and slow fading channels[END_REF]. The secrecy capacity of the multiple-input single-output (MISO) wiretap channel was also investigated when the eavesdropper has a single antenna [START_REF] Li | Secret communication via multi-antenna transmission[END_REF][START_REF] Shafiee | Achievable rates in Gaussian MISO channels with secrecy constraints[END_REF] or multiple antennas [START_REF] Khisti | On the Gaussian MIMO wiretap channel[END_REF][START_REF] Khisti | Secure transmission with multiple antennas I: The MISOME wiretap channel[END_REF]. These studies were then generalized to the MIMO channel with single or multiple eavesdropper antennas [START_REF] Shafiee | Towards the secrecy capacity of the Gaussian MIMO wire-tap channel: The 2-2-1 channel[END_REF][START_REF] Ekrem | The secrecy capacity region of the Gaussian MIMO multireceiver wiretap channel[END_REF][START_REF] Khisti | Secure transmission with multiple antennas-part II: The MIMOME wiretap channel[END_REF][START_REF] Oggier | The secrecy capacity of the MIMO wiretap channel[END_REF].

Secure communication over broadcast channels with receivers side information was also considerably investigated. In these channels, a legitimate receiver is given access to messages of other legitimate receivers as side information. This side information along with some random binning are used to secure the broadcasted messages. It is assumed that the eavesdropper does not have access to any side information. Security in these channels was studied under weak individual secrecy constraints [START_REF] Chen | On the individual secrecy for Gaussian broadcast channels with receiver side information[END_REF][START_REF] Chen | Individual secrecy for broadcast channels with receiver side information[END_REF][START_REF] Mansour | Secrecy measures for broadcast channels with receiver side information: Joint vs individual[END_REF] or weak joint secrecy constraint [START_REF] Mansour | Secrecy measures for broadcast channels with receiver side information: Joint vs individual[END_REF][START_REF] Wyrembelski | Secrecy in broadcast channels with receiver side information[END_REF]. Individual (respectively joint) secrecy constraint imposes that the messages should be individually (respectively jointly) secured from the eavesdropper.

Recently, security issues have started to be explored from an information-theoretic angle in caching systems. Caching is the process of storing data in local memories close to the users with the aim of reducing network congestion. Security in caching takes advantage of the fact that the eavesdropper does not have access to the users' cache memories. Secure caching codes have been designed in [START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF][START_REF] Ravindrakumar | Fundamental limits of secretive coded caching[END_REF][START_REF] Hassan | Fundamental limits of caching in D2D networks with secure delivery[END_REF] without considering transmission channels. The employed security techniques are inspired from Shannon's one-time-pad scheme [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. Hence, secure caching remains an interesting domain unexplored from a physical layer perceptive.

In the following section, we introduce cache-aided communication systems and review some secure coding methods designed for these systems.

Secrecy in caching scenario

Traffic in communication systems varies as a function of the time of the day resulting in periods where network congestion is high, causing packet loss, delivery delays and unsatisfied users, and other periods where the network is barely used. Lately, caching has emerged as a promising technique to reduce the network load and latency in such dense wireless networks. The main idea of caching is to benefit from the low network traffic periods to pre-store popular content in cache memories distributed across users. Then, when users request specific files during periods of peak-traffic, they are served partly from their cache memories and partly from the server, reducing thus the network load.

In such scenarios, communication is divided into two phases: the caching phase and the delivery phase. The caching phase occurs during the off-peak periods of the network. In this phase, fragments of popular contents are stored in users' cache memories or on nearby servers. The delivery phase occurs during the peak-traffic periods of the network. In this phase, the servers convey to the users their demanded files. The technical challenge in these networks is that in the caching phase the servers do not know exactly which files the receivers will demand during the delivery phase. They are thus obliged to store information about all possibly requested files, namely the library, in the receivers' cache memories.

First attempts to investigate the caching problem focused either on optimizing the cache content for a fixed delivery method or on optimizing the delivery phase for a fixed cache content and fixed users' demands. In the former case, the focus was directed towards studying the statistics of the users' demands in order to identify the most popular files [START_REF] Dowdy | Comparative models of the file assignment problem[END_REF][START_REF] Baev | Approximation algorithms for data placement problems[END_REF][START_REF] Borst | Distributed caching algorithms for content distribution networks[END_REF]; whereas in the latter case, the delivery problem was studied with the aim of reducing the transmission rate while ensuring users' capacity to decode their requested files [START_REF] Birk | Coding on demand by an informed source (ISCOD) for efficient broadcast of different supplemental data to caching clients[END_REF][START_REF] Bar-Yossef | Index coding with side information[END_REF]. In both cases, a caching gain is obtained since users can be locally served whenever they demand files present in their cache memories. These caching techniques were later referred to as uncoded caching schemes and their gain was called the local caching gain.

Afterwards, Maddah-Ali and Niesen showed in their seminal work [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF] that the delivery (high-traffic) communication can benefit from the cache memories more than the obvious local caching gain arising from locally retrieving parts of the requested files. They assumed that the delivery phase takes place over an error-free broadcast channel (BC) and that all the receivers have equal cache sizes. The additional gain, termed global caching gain, is obtained through carefully designing the cached contents and applying a new coded caching scheme where the transmitter can simultaneously serve multiple receivers.

Saeedi, Timo, and Wigger showed in [START_REF] Timo | Joint cache-channel coding over erasure broadcast channels[END_REF][START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF] that further global caching gain can be achieved by means of their new piggyback coding scheme, when the delivery phase is modeled as a packet-erasure BC and different receivers have different channel strengths. Piggyback coding is a joint cache-channel coding scheme where the encoder and the decoders simultaneously exploit the cache contents and the channel statistics. This is in contrast to separate cache-channel coding as in [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF] where the cache encoder/decoders depend only on the cache content and the channel encoder/decoders depend only on the receivers' channel statistics, and thus are designed separately.

A different line of research has addressed security issues in cache-aided BCs [START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF][START_REF] Ravindrakumar | Fundamental limits of secretive coded caching[END_REF]. In [START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF], an external eavesdropper is not allowed to learn any information about the messages. More precisely, a joint secrecy constraint, where the eavesdropper is not allowed to learn anything about the entire library, is considered. A noiseless BC for all legitimate receivers as well as for the eavesdropper is studied. Moreover, it is assumed that all legitimate receivers have cache memories of equal size, while the external eavesdropper does not have access to these caches. In the caching phase, random keys are stored in addition to the cached messages in users' cache memories. In the delivery phase, the stored keys are used to secure the transmitted messages in the form of a one-time pad scheme.

In [START_REF] Ravindrakumar | Fundamental limits of secretive coded caching[END_REF], the security between users themselves without an external eavesdropper is studied. As in [START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF], it is assumed that delivery communication takes place over a noisefree BC, and that all legitimate receivers have the same cache memory size. The same joint secrecy constraint is imposed, however in this scheme, any legitimate receiver also acts as an eavesdropper. It is thus not allowed to learn anything about the files requested by the other receivers from its cache content or the broadcasted message. Therefore, uncoded fragments of the messages cannot be stored in users' caches and it is proposed to cache random keys and combinations of the messages XORed with random keys. In the delivery phase, messages (or combination of messages) XORed with some random keys are transmitted in a way that each message is decoded only by its intended receiver.

Moreover, security in device to device cache-aided networks was studied in [START_REF] Hassan | Fundamental limits of caching in D2D networks with secure delivery[END_REF] where the transmission between the users is secured from an external eavesdropper. The problem of secure caching using maximum distance separable (MDS) codes at the wireless edge in heterogeneous networks was also addressed in [START_REF] Bioglio | Optimizing MDS codes for caching at the edge[END_REF][START_REF] Gabry | On edge caching with secrecy constraints[END_REF]. All of the previously described works assume a separate cache-channel coding approach as in [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF], and focus only on the design of the cache encoder and decoders while considering that the BC is a noise-free pipe from the transmitter to all receivers. However, this approach was shown in [START_REF] Timo | Joint cache-channel coding over erasure broadcast channels[END_REF][START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF] to be highly sub-optimal when there is no secrecy constraint. In this thesis, we investigate security in cache-aided networks from physical layer security perspective in Chapters 3 and 4.

Conclusion

In this chapter, we have introduced two important aspects of communications security, namely post-quantum cryptography and physical layer security, that will help to secure future networks. We have reviewed the state of the art of these two domains. This analysis have led us to identify a promising post-quantum cryptography solution, which is GGH cryptosystem. However, this cryptosystem suffers from drawbacks preventing its practical use. In the Chapter 2, we propose to improve GGH cryptosystem in a way to eliminate its disadvantages.

Regarding physical layer security, our state of the art analysis highlighted the need to study security in cache-aided networks by jointly considering the communication channel and the cache design in order to optimize the secure transmission rate. In Chapters 3 and 4, we investigate communication in cache-aided networks under individual and joint secrecy constraints, respectively.

Chapter 2

GLD Lattice-Based Cryptosystem

Inspired by LDPC and MDPC code-based cryptography, we investigate in this chapter the use of generalized low density lattices in the GGH cryptosystem. GLD lattices caught our attention because of their low complexity lattice generation and decoding which is a major factor in defining the practicality of cryptography systems and a weak point in the previous GGH schemes. Our main goal is to reduce the complexity of the GGH cryptosystem making it a candidate to replace the traditional public-key encryption schemes while verifying that this reduction in complexity does not affect the security of the scheme.

In the sequel, we start by reviewing some existing versions of GGH systems related to our work. Then, we introduce GLD lattices and describe our GLD lattice-based cryptosystem. Finally, we analyze the security and complexity of the proposed scheme and provide experimental results.

Original GGH scheme

The Goldreich-Goldwasser-Halevi cryptosystem stemmed from the lattice closest vector problem and was proposed originally in [1]. The authors took advantage of the fact that it is easy to generate a random vector close to a lattice point; however, it is hard to find the lattice point which is the closest to this random vector. This is the main idea on which is based the GGH trapdoor function.

Lattice-based GGH scheme uses also the lattice properties of having an infinite number of bases and generating easily a lattice point using any basis of the lattice. However, after adding a noise to the lattice point and obtaining a "close-to-lattice" point, only a near orthogonal basis can be used to recover the initial lattice point. Thus, the GGH private key is chosen as a good orthogonal basis allowing simple recovery of the encrypted message. For the public key, a bad non-orthogonal basis is chosen rendering the decryption by any attacker nearly impossible. The badness of the basis is measured by its orthogonality defect, defined in (1.7).

In fact, in the original GGH cryptosystem, the private key R, which is a good basis of an n-dimensional random lattice Λ, is an n × n non-singular integer matrix defined by

R = √ nI + Q, (2.1)
where I is the identity matrix and Q is a random matrix with elements uniformly chosen from the set {-4, . . . , 4}. The public key B is a bad basis of the same lattice Λ, hence, it is also an n×n integer matrix. B is generated by transforming the good basis of the lattice into a bad one. It can be obtained by applying some elementary linear combinations on the basis vectors of the private key R. In order to encrypt a message m ∈ Z n , m is multiplied by the public basis B generating a lattice point x. Then, x is secured by adding an n-dimensional error vector e chosen uniformly from the set {-A, A} n . The ciphertext c is given by

c = mB + e = x + e. (2.2)
To decrypt the ciphertext c, it is first multiplied by the inverse of the private basis R -1 since it is the good basis capable of canceling the error vector. Once the noise is removed, the result is multiplied by R and then by the inverse of the public basis used for encryption to recover the message m as

m = cR -1 RB -1 .
(2.

3)

The value of A was defined by studying the decryption errors at the legitimate receiver. Indeed, a decryption error occurs if eR -1 = 0. The authors in [1] considered two possible noise definitions. The first one allows zero error probability by taking A < 1/(2ρ) where ρ is the maximal L 1 norm of the columns of R -1 . In the second one, a threshold on the error probability is fixed and the maximal A is computed with respect to this threshold. The second method relaxes the constraint on the error probability yielding a higher A value in order to have better security.

Advantages:

The most appealing property in the GGH scheme is its low complexity encryption and decryption procedures in comparison with other cryptographic systems, for instance RSA and ElGamal encryption schemes. Indeed, its encryption time increases linearly with the key size. This makes the GGH lattice-based scheme interesting and deserving further studies.

Disadvantages:

The major flaw in this scheme is the particular form of the noise which makes the system vulnerable and hence, easily breakable by the embedding attack [2]. Indeed, the elements of the noise vector e are chosen from two exact values ±A. Nguyen showed in [2] that for this noise distribution, the CVP is reduced to a simpler CVP instance for which the noise vector is much smaller e ∈ { -1 /2, 1 /2}. By exploiting this weakness, he was able to break four of the five challenges published by the GGH authors from dimension n = 200 until n = 350. The only challenge that remained unbroken was for dimension n = 400, where the key size is 2 MB. Nguyen concluded that GGH requires working in high lattice dimensions to be secure. However, for high dimensions, the GGH has a huge public key size. Therefore, major improvements were needed on the original GGH cryptosystem in order for it to be considered as a serious alternative to the existing public-key cryptosystems.

GGH improvements

Despite Nguyen's conclusion on the practicality of the GGH system, its fast encryption procedure kept it an interesting scheme. Many GGH-based improvements were proposed in order to overcome the original GGH drawbacks. These works, on one side, focused on reducing the public key size resulting in new designs of public lattice bases. On the other side, they aimed at improving GGH security by proposing new methods of noise generation.

Micciancio's scheme

In [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF], Micciancio applied some changes to both aspects, public key generation and noise vector choice. He considered two encoding methods. In the first method, the message is encoded in the lattice point and the noise vector is chosen uniformly from an interval [-A, A] whereas in the second one, the lattice point is chosen at random and the message is embedded in the error vector. Since Nguyen's embedding attack relies on the fact that the noise entries have all the same absolute value, the uniform noise provides the GGH scheme with the necessary robustness against this attack. Note that the first method is analog to the McEliece cryptosystem and the second one is analog to the Niederreiter system which is a variant of McEliece.

For the public key, Micciancio proposed to use the HNF lattice basis. He proved that this HNF basis reduces the public key size while guaranteeing, at least, the same security level as the original GGH [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF]. Indeed, from a complexity perspective, he showed that the lower triangular form of the HNF matrix induces a reduction in the key storage size from O(n 3 log 2 (n)) to O(n 2 log 2 (n)). And from a security perspective, since for a lattice Λ there exists only one basis in the form of an HNF matrix, the HNF public key does not give any information about the private key from which it was generated. Moreover, HNF is a bad basis with high orthogonality defect. Thus, using the HNF for the public key can only improve the security of the scheme.

Advantages:

The decrease in the public key size induced by the HNF matrix makes the GGH system more likely to be used in practice. Moreover, the uniform noise allows to overcome the GGH weakness to the embedding attack.

Disadvantages:

The security and efficiency of Micciancio's cryptosystem were analyzed by Ludwig in [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF]. He highlighted the main disadvantages of Micciancio's system. On one hand, the decryption is slow and suffers from instability since it employs Babai's nearest plane algorithm. On the other hand, the public key generation process has high running time for the proposed lattice dimensions due to the non-existence of lowcomplexity algorithms for computing the HNF matrix.

Moreover, in Ludwig's results [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF], the public keys turned out to have larger size than in Micciancio's experiments. Ludwig also found that the minimal dimension for which the system is secure in practice is around 800, whereas Micciancio presumed this dimension to be 500. All these findings [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF] led to conclude that Micciancio's cryptosystem is still far from being practical.

LDLC scheme

Recently, Hooshmand and Aref suggested to replace random lattices by latin square low density lattice codes (LDLC) [3]. They chose these lattices because they can be decoded by means of an iterative low complexity decoding algorithm. To generate their private key, they start by defining a set of generating sequence The private generator matrix is then computed as G = H -1 . The public key G is defined as the HNF of the LDLC generator matrix G following Micciancio's proposition.

H = {h 1 , h 2 , . . . , h d }, (2.4
The encryption procedure of the LDLC scheme is similar to the previous schemes except for the choice of the error vector e. It follows a Gaussian distribution with zero mean and variance σ 2 upper bounded by the Poltyrev limit σ 2 < 1/(2πe) [4].

Advantages: Introducing low density lattices in GGH scheme helps fixing the ciphertext decryption problem. Indeed, the decoding of random lattices uses Babai's algo-rithms which are sub-optimal lattice decoding algorithms. On the contrary, iterative decoding algorithms offer faster and close to optimal decoding.

Disadvantages:

The main problem of this system is that the used LDLCs are rational lattices, which induces many drawbacks. First, the public key size is still very large because rational HNF matrices are employed. Second, the complexity of the HNF algorithm is further increased in this scheme. This is due to the fact that HNF cannot be applied on rational numbers and has to be applied on integer numbers. Thus, an additional procedure is applied before and after the HNF algorithm to transform rational numbers into integers and transforms them back at the end.

Other GGH improvements

Based on Micciancio's system, [START_REF] Yoshino | Improving GGH cryptosystem for large error vector[END_REF] focused on proposing a larger noise vector e to obtain a harder CVP problem. In fact, the original GGH defines e such that its product by the inverse of the private key generates a null vector, i.e. eR -1 = 0. In [START_REF] Yoshino | Improving GGH cryptosystem for large error vector[END_REF], the error vector e has (n -k) coordinates chosen from a set of integers I 1 = {-s, . . . , -1, 1, . . . s} and the remaining k from a second set of integers I 2 = {-h, h} with h > s. In this way, the product eR -1 results in (n -k) zero elements and k elements with value {±1}.

eR -1 = (v 1 , . . . , v n ), (2.6)
where

v i = 0 for (n -k) values of i, ±1 for k values of i. (2.7)
It was stated in [START_REF] Yoshino | Improving GGH cryptosystem for large error vector[END_REF] that this larger error vector fixes the GGH flaws showed by Nguyen [2]. However, it was shown in [START_REF] De Barros | GGH may not be dead after all[END_REF] that the GGH version of [START_REF] Yoshino | Improving GGH cryptosystem for large error vector[END_REF] has the same behavior as the original GGH and its security can be improved by optimizing the parameters s and h defining the sets I 1 and I 2 . The complexity and the key size of this GGH version [START_REF] De Barros | GGH may not be dead after all[END_REF] were studied in [START_REF] Barguil | Efficient variants of the GGH-YK-M cryptosystem[END_REF] and the use of polynomial rings was proposed.

Another independent attempt to reduce the public-key size of the GGH scheme using polynomial representations was proposed in [START_REF] Paeng | A lattice based public key cryptosystem using polynomial representations[END_REF] but then broken in [START_REF] Han | Cryptanalysis of the Paeng-Jung-Ha cryptosystem from PKC 2003[END_REF].

GLD lattice-based cryptosystem

Motivated by the benefits of low density lattices and to overcome the drawbacks of the LDLC-based scheme, we propose in the sequel to use the generalized low density lattices to design an improved version of GGH cryptosystem. In this section, we start first by introducing the construction of GLD lattices. We then present our GLD lattice-based cryptosystem.

GLD lattices

GLD lattices were proposed by Boutros et al. in [START_REF] Boutros | Generalized low-density (GLD) lattices[END_REF]. They are integer lattices in Z n and have sparse parity-check matrices. These properties enable low complexity iterative decoding, hence allowing the codes to be used in dimensions up to 1 million. It was shown that these lattices achieve asymptotically Poltyrev limit [4].

GLD lattices can be generated using construction A from linear GLD codes C GLD [n, k] with length n and dimension k as follows

Λ = C GLD + pZ n , (2.8)
where n is the lattice dimension and p is a prime number.

This construction considers an elementary small linear code C 0 [n 0 , k 0 ] defined over the finite field F p . Denote by H C 0 the parity-check matrix of C 0 . A second code C 1 is generated as the direct sum of L copies of C 0

C 1 = C ⊕L 0 .
(2.9)

The parity-check matrix of C 1 is given by

H C 1 =      H C 0 0 . . . 0 0 H C 0 . . . 0 . . . . . . . . . . . . 0 0 . . . H C 0      . (2.10)
Now, let π 1 = id and π 2 , . . . , π J be J permutations of {1, 2, . . . , n}. A GLD code C GLD [n, k] is defined as

C GLD = J j=1 π j (C 1 ) = J j=1 π j (C ⊕L 0 ), (2.11)
where π j (x 1 , x 2 , . . . , x n ) = (x π j (1) , x π j (2) , . . . , x π j (n) ).

The matrix H C of the GLD code is a non-square matrix obtained as

H C =       H C 1 π 2 (H C 1 ) . . . π J (H C 1 )       . (2.12)
Note that H C has n -k = JL(n 0 -k 0 ) rows and n = Ln 0 columns.

In order to define the generator matrix G C of the GLD code, the systematic form of the parity-check matrix H C is computed using the Gaussian elimination algorithm. H C,syst has the following form

H C,syst = [ I | -B t ].
(2.13)

Then, the k × n generator matrix of the code is defined by

G C = [ B | I ], (2.14)
Based on construction A (2.8), the generator matrix of Λ is given by

G Λ = pI 0 B I . (2.15)
B is a dense matrix whose elements belong to the finite field F p . We can see that G Λ is a lower triangular matrix. Its column elements are modulo the diagonal elements. Therefore, G Λ is in Hermite normal form.

Remark 2.1. For our experiments, we fix the number of permutations to J = 2. However, a bigger value can be used with a slight increase in the system's complexity. • The private key is the parity-check matrix H C of a GLD code. The non-zero elements of H are chosen from the field F p \ {0} where p is a prime number.

Proposed public-key scheme

Note that, to store the private key, it is enough to save the parity-check matrix H 0 of the elementary code and the (J -1) random permutations π 2 , . . . , π J .

• The public key is the generator matrix G Λ of the GLD lattice which is an HNF matrix.

• To encrypt a message m ∈ Z n , m is multiplied by the public key G Λ and an error vector e is added to obtain the ciphertext

c = mG Λ + e (2.16) = x + e.
The noise vector e is a random noise chosen uniformly from an interval [-A, A].

• To decrypt c and recover the message m, the GLD iterative decoding is applied.

Choice of the noise interval [-A, A]

In our scheme, we consider the uniform noise proposed by Micciancio since it is enough to ensure the system's security. The value of A defines the interval from which the noise elements are chosen. This value should not exceed the maximal noise variance for which the iterative decoder succeeds. On the other hand, it should be large enough to create sufficient ambiguity to prevent the attacker from decrypting the message.

We first start by finding the maximal value A tolerated by the GLD lattices decoder. It depends on the parameters, n 0 , k 0 and p of the elementary code C 0 . We describe how to compute A theoretically and experimentally. Theoretical definition: The Poltyrev limit of the noise variance expressed as function of the parameters of the GLD lattices is defined as

σ 2 Polt = vol(Λ) 2/n 2πe = p 2(n-k) n 2πe = p 2(1-R) 2πe , (2.17)
where R is the rate of the GLD code C GLD .

GLD lattices can be decoded with a negligible decoding error probability if the noise variance is smaller than the Poltyrev limit. Let b be a real noise value chosen uniformly from the interval B = [-A, A]. For large n, the variance of the noise b is given by

σ 2 b = A -A 1 2A b 2 db = A 2 3 . (2.18)
This variance and thus the noise interval, should satisfy

nσ 2 b < nσ 2 Polt ⇒ A 2 < 3 p 2(1-R) 2πe . (2.19)
Therefore, we choose the noise B = [-A, A] for a certain GLD by taking the maximal value of A that satisfies (2.19).

Experimental results: We also determine experimentally the maximum noise interval tolerated by the iterative decoding for different elementary codes C 0 with different n 0 , k 0 and p. The results of this experimentation are shown in Table 2.1. As we will see later, these A values are sufficient to ensure the security of our encryption scheme. In our scheme, we consider GLD lattices with dimension n ≈ 1000. This choice is inspired by previous works and based on the security analysis of the proposed GLD lattice-based GGH cryptosystem that we conducted. In the following sections, we prove through experimental results that our system is both secure and practical for this dimension.

Security analysis

In this section, the security of our proposed scheme is studied from three perspectives. First, we investigate the complexity of the exhaustive attack to recover the private key. Then, we analyze the decoding attacks to decrypt the transmitted ciphertext. Finally, we discuss the dual code attack to find the private matrix.

Brute-force attack

The most naive attack that can be applied is the brute-force attack. In this attack, the eavesdropper attempts to find the private key by exhaustively testing all the possibilities. Hence, the complexity of this attack depends on the number of private keys that are likely to be used.

In our case, the search space of the private key depends on the number of possible matrices H C . Recall that H C is generated by the concatenation of H C ⊕L of its permuted versions. The number of possible versions is n! since they are generated by permuting the n columns of H C ⊕L 0 . Therefore, the search space for the private key is n! × (J -1).

(2.20)

The formula is dominated by n!, which can be approximated using Stirling's formula

into n! ∼ √ 2πn n e n . (2.21)
Since it is exponential in n, then for n ≥ 1000, the search space becomes huge, making this attack unfeasible.

Decoding attacks

In the decoding attacks, the eavesdropper aims at decrypting the ciphertext, which is equivalent to finding the closest lattice vector to this ciphertext. In fact, the GGH system is essentially a closest vector problem instance which makes the decoding attacks the most obvious attacks on such cryptosystems. These approaches to attack GGH apply Babai's algorithms [START_REF] Babai | On Lovaśz' lattice reduction and the nearest lattice point problem[END_REF], namely round-off and nearest plane algorithms, resulting in the well-known round-off attack and nearest plane attack.

The performance of these attacks can be improved by applying bases reduction techniques, typically Lenstra-Lenstra-Lovász (LLL) and Block Korkine-Zolotarev (BKZ), before running the decoding algorithms.

The round-off attack

The round-off attack [START_REF] Babai | On Lovaśz' lattice reduction and the nearest lattice point problem[END_REF] consists in multiplying the ciphertext c by the inverse of the public basis G -1 Λ which results in a noisy message as follows:

cG -1 Λ = m + eG -1 Λ . (2.22)
By rounding this result, the message m can be found only if eG -1 Λ = 0. Thus, the feasibility of this attack depends mainly on the orthogonality of the public basis G Λ and the variance of the noise e.

The nearest plane attack

The nearest plane attack [START_REF] Babai | On Lovaśz' lattice reduction and the nearest lattice point problem[END_REF] is an improvement of the round-off attack that uses a better approximation for the CVP. The idea is to find the nearest lattice point by considering one dimension after the other. For every basis vector g i , i = 1, . . . , n, the nearest plane algorithm finds the closest hyperplane to the ciphertext c. It starts by finding the integer multiple k n of g n that minimizes the distance to the hyperplane spanned by the basis vectors {g 1 , . . . , g n-1 } by projecting c -k n g n , k n ∈ Z, onto this (n -1)-dimensional hyperplane. Then, the algorithm proceeds recursively until dimension 1. Finally, the lattice vector is obtained by the sum of all vectors k i g i .

Various improvements of the nearest plane attack have been proposed to increase its success probability. Some applied basis reduction procedures to the remaining basis vectors at each level of the recursion. Others considered more than one basis vector in each level of the recursion or examined more than one closest hyperplane.

Note that both Round-off attack and nearest plane attacks can be seen as Zeroforcing (ZF) and ZF-decision feedback equalizer (ZF-DFE) decoders, respectively. These decoders are known to be sub-optimal for lattice decoding. Though they have low complexity, they are prone to error propagation that can degrade considerably the performance for high dimensions.

Lattice reductions

Lattice reduction approaches are applied to generate good basis with short, nearly orthogonal vectors. They can reduce the decoding errors and thus improve the decryption. In high dimensions, these techniques need a huge running time to provide a shorter basis. Yet, they may fail to produce this basis rendering the decryption unfeasible. Indeed, the LLL algorithm succeeds to generate a reduced basis for small dimensions. For high dimensions, BKZ, which is an improved variant of LLL, needs to be used. While LLL operates on each basis vector alone, BKZ works on blocks of t basis vectors. The complexity of BKZ algorithm is O(n 3 t t+o(t) + n 4 ) [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF]. For small t, BKZ will not result in a reduced basis for high dimensions. Increasing t will increase the complexity and cannot guarantee a good basis. In our scheme, we consider lattices of dimension n ≈ 1000. For this dimension, t should be very large to increase the probability of obtaining a good basis making the BKZ reduction algorithm impractical.

Discussion and experimental results

The success of the previously described decoding attacks depends on two factors: the lattice public basis and the noise vector. a -Public basis: After applying the reduction algorithms, if the resulting basis is quasi-orthogonal these attacks will be able to decrypt the ciphertext and recover the message. Conversely, if the reduction fails, the attacks have to be applied on a bad basis, and thus, the decryption will certainly fail. Therefore, to strengthen the system's security, the public key should be a lattice basis as bad as possible with large dimension in order to prevent reduction success.

In our scheme, the generator matrix G Λ is in HNF. To evaluate its orthogonality, we compute the orthogonality defect of G Λ as

OD(G Λ ) = n i=1 g i | det(G Λ )| , (2.23)
where g i is the Euclidean norm of the i'th row in G Λ . Since G Λ is given by construction A in (2.15), the first (n -k) rows have norm p and the determinant is det

(G Λ ) = p n-k , then OD(G Λ ) = p n-k n i=n-k+1 g i p n-k = n i=n-k+1 g i = n i=n-k+1 1 + b i 2 ,
where b i is the Euclidean norm of the i'th row in B.

B is a dense matrix with elements in the finite field

F p . Thus, b i 2 1 ⇒ g i √ 2, yielding an orthogonality defect OD(G Λ ) ( √ 2) k 1, showing hence that G Λ is a bad basis.
We have carried out some experiments to confirm this result. Table 2.2 presents the average length of the basis vectors and the orthogonality defect of G Λ in dimension n ≈ 1000 for different elementary codes C 0 . These values indicate that for this dimension, the orthogonality defect ranges approximately from O(10 500 ) to O(10 1000 ). Figure 2.2 presents the OD(G Λ ) in logarithmic scale as function of the GLD lattice dimension n for the elementary code C 0 [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF][START_REF] Babai | On Lovaśz' lattice reduction and the nearest lattice point problem[END_REF] 17 . The curves are illustrated for the initial GLD public basis as well as the reduced bases by LLL and BKZ for several block sizes t. We can see that OD(G Λ ) increases significantly with the dimension. Thus, applying either basis reduction is not efficient and cannot yield reduced basis. We also notice that increasing the block size for the BKZ algorithm from t = 20 to t = 40 does not improve the reduction while it increases considerably its running time.

b -Noise vector: The second factor that can lead to decryption failure is the added noise vector e. If e is small, the noisy point will not be translated far from the lattice point, which makes the decoding easier. Many methods were proposed to define the error vector and improve the security of the original GGH by defeating its attacks. In [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF], Micciancio proposed to use a random noise uniformly chosen from an interval [-A, A]. In [3], Hooshmand et al. suggested to choose a Gaussian noise N (0, σ 2 ), where the variance σ 2 is bounded by Poltyrev limit σ 2 < 1/(2πe). In [START_REF] Yoshino | Improving GGH cryptosystem for large error vector[END_REF], a larger noise vector was generated by selecting its elements from two different sets as described in (2.7).

GLD lattices were first proposed for channel coding and their performance was studied for a Gaussian channel with noise variance close to the Poltyrev limit. However, this does not prevent us from using these codes with any other noise distribution. In our GLD lattice-based scheme, we consider a uniform noise in [-A, A]. As mentioned in Section 2.3.2.1, A should not exceed the maximal noise value for which the iterative decoder succeeds. At the same time, it should be large enough to prevent the attacker from decrypting the message.

The maximal noise values A with the corresponding elementary codes C 0 were identified in Table 2.1. Considering these values, we have run both the round-off and nearest plane decoding attacks, in dimension n ≈ 1000, in an attempt to decrypt ciphertexts obtained as c = mG Λ + e for e ∈ [-A, A]. Before running these decoding algorithms, we have reduced G Λ using LLL and BKZ with different block sizes. For each code C 0 of Table 2.1 and its corresponding A, the decryption attempt fails regardless of the attack scheme and reduction method. We can therefore conclude that these A values are sufficient to ensure the security of our scheme against previous decoding attacks in dimension n ≈ 1000.

Dual code attacks

Dual code attacks are dangerous attacks applied on code-based cryptography systems using low density parity-check (LDPC) codes. These attacks exploit the low density property of the LDPC parity-check matrix H that corresponds to the generator matrix of the dual code. The main idea is to search for low weight codewords belonging to the dual code and recover H. One solution to avoid such attacks consists in increasing the density of the parity check-matrices. In this case, the resulting codes are called moderate Lattice dimension n density parity-check (MDPC) codes [START_REF] Misoczki | MDPC-McEliece: New McEliece variants from moderate density parity-check codes[END_REF].

Similarly, the robustness of the GLD lattice-based scheme against these attacks depends on the density of the lattice. This parameter can be managed by the selection of C 0 . To improve the security of our scheme, the density of the considered lattices should be increased by taking a code C 0 of higher length n 0 and working in a larger finite field F p . At the same time, this density should not exceed a given value which enables successful iterative decoding. The codes C 0 [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF][START_REF] Babai | On Lovaśz' lattice reduction and the nearest lattice point problem[END_REF] 17 and C 0 [START_REF] Shor | Algorithms for quantum computation: discrete logarithms and factoring[END_REF][START_REF]ICT Facts and Figures[END_REF] 17 satisfy this double requirement.

Complexity analysis

For the complexity analysis of our scheme, we will examine three key features, namely the public key size, the public key generation and the decryption and compare them to previous GGH schemes.

Public key size

Recall that the GLD lattice generator matrix has the following form

G Λ = pI 0 B I .
We can notice that only part B of G Λ needs to be stored. It is a k × (n -k) matrix with elements smaller than p by construction. Hence, the space needed to store this matrix is k × (n -k) × log 2 (p) bits.

(2.24)

Hence, for a fixed lattice dimension, the key size depends on the elementary code's parameters and the finite field over which it is defined. In order to analyze the GLD public key complexity, we consider some examples of GLD lattices Λ of dimension n ≈ 1000 and we compute their key size.

As a first example, let Λ be generated from the elementary code C 0 of length n 0 = 3 and dimension k 0 = 2 defined over the field F 11 . This elementary lattice is given by

Λ 0 = [3, 2] 11 + 11Z 3 .
(2.25)

Then, the generated GLD lattice Λ is of dimension n = n 0 L = 3L. The matrix B in this case has k = 333 rows and n -k = 666 columns. Thus, the necessary space to store B is 333 × 666 × log 2 (11) = 93.7 KBs.

In Table 2.3, we present the key size for other examples of elementary codes. We can see that for the considered lattice dimension, the key size is always in the order of 100 KBs. Even for very large p values, the key size does not attain 200 KBs.

For the previously described GGH based schemes, upper bounds were derived on the key size of the original GGH and Micciancio cryptosystems [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF]. Indeed, the size of the GGH public key is O(n 2 log 2 (det(Λ))) bits since the matrix has n 2 elements and they are bounded by the determinant of the lattice Λ. For the choice of GGH's private basis R = √ nI + Q, described previously in Section 2.1, the determinant can be estimated by applying Hadamard inequality as det(Λ) ≤ 2 O(n log 2 (n)) bits, (2.26) thus, the size of the public key is upper bounded by O(n 3 log 2 (n)) bits.

(2.27)

In Micciancio's cryptosystem, the public basis B is in HNF form. So, each column can be represented using log 2 (det(Λ)) bits. Hence, the public key has size of

O(n log 2 (det(Λ))) = O(n 2 log 2 (n)) bits, (2.28)
since the same private key is used as in the GGH system.

In [3], the size of the public key is claimed to be O(n 2 ). However, this estimation is not justified in their paper. In addition, LDLCs have real generator matrices for the private and public keys. Thus, their public key size depends on the precision used to represent the real elements and should be defined accordingly.

The estimations of the public key sizes for the GGH cryptosystem and its improvements are summarized in Table 2

(n)) Micciancio O(n 2 log 2 (n)) LDLC O(n 2 ) GLD k × (n -k) × log 2 (p)
Micciancio's experimental results showed that the public key size in dimension n = 400 is 2.3 MBs for GGH and 140 KBs for his system [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF]. In [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF], Ludvig also computed the public key size of Micciancio's scheme and found that its size in dimension n = 800 is 1 MB. In our scheme, the key can be represented in dimension n ≈ 1000 by approximately 100 KBs. Therefore, we can clearly state that the GLD lattice-based cryptosystem reduces at least by a factor of 10 the size of the public key.

Key generation

In the proposed GLD lattice-based cryptosystem, the public key is the HNF generator matrix of the GLD lattice. In order to compute this matrix, we apply the Gaussian elimination algorithm to represent the GLD code's parity-check matrix in its systematic form H C,syst . Therefore, the key generation complexity is mainly due to the Gaussian elimination algorithm. This time complexity is in the order of O(nm ω-1 ) for an m × n matrix with m ≤ n and ω < 2.38 the exponent of matrix multiplication [START_REF] Jeannerod | Rank-profile revealing Gaussian elimination and the CUP matrix decomposition[END_REF]. In our case, this reduces to O(n × (n -k) ω-1 ) < O(n 3 ). In Micciancio's system [START_REF] Micciancio | Improving lattice based cryptosystems using the Hermite normal form[END_REF], the main problem is the complexity of the HNF algorithm that generates the public key. In fact, there exist different algorithms for generating HNF matrices. The most basic algorithm for generating HNF matrices perfoms a polynomial number of arithmetic operations but has exponential space complexity due to the exponential increase of its matrix elements during the execution. Many improvements were proposed aiming to reduce the space complexity but resulted in increasing the running time. The most space efficient algorithm was designed in [START_REF] Micciancio | A linear space algorithm for computing the Hermite normal form[END_REF] with running time O(n 5 log 2 (M )) where M is the bound on the matrix entries. Therefore, it can be concluded that the public key generation in our case is at least O(n 2 ) times faster than Micciancio's system. Moreover, in [3], the LDLC-based cryptosystem used rational lattices. Thus, before proceeding to HNF, the rational matrix should be transformed into an integer matrix by multiplying its elements by the common denominator. This process increases the running time needed to generate the public key. Hence, for the LDLC-based proposition, generating public key increases the complexity compared to Micciancio's system, and our proposed scheme.

In order to compare the key generation running time of our GLD lattice-based scheme with those of the GGH and Micciancio systems, we experimentally measured the duration of these operations on an Intel i5 3320M (2.6 GHz) platform. The results are presented in Figure 2.3 for dimensions smaller than 1000. For n ≈ 1000, Miccianco's key generation procedure lasts more than 5 hours and for the GGH system, it is around 10 minutes. On the contrary, our GLD scheme allows to generate the public key in the order of seconds as we can see in Table 2.5 for different elementary GLD codes. Iterative decoding of GLD lattices is done via message passing along edges of the Sarah Kamel generalized Tanner graph. Messages are computed locally by a check node using a soft-input soft-output decoder. This soft decoding is made via the forward-backward algorithm on the syndrome trellis that has p (n 0 -k 0 +1) transitions where (n 0 -k 0 + 1) is small [START_REF] Bahl | Optimal decoding for linear codes for minimizing symbol error rate[END_REF]. For instance, for the codes C 0 in Table 2.2, its maximal value is 5.

L C 0 L C 0 L C 0 Λ ⊕L 0 L check nodes n 0 L C 0 L C 0 L C 0 Λ ⊕L 0 L check
Then, these messages are sent to the n 0 neighboring check nodes. The complexity of the iterative message passing is linear in the lattice dimension n and is given by

O(n • t • p (n 0 -k 0 +1
) ) where t is the number of iterations.

The LDLCs are also suitable for iterative decoding that is linear in the dimension n but the constant term multiplying n in O(•) is higher [START_REF] Sommer | Low-density lattice codes[END_REF]. In fact, in this decoder, the messages computed and passed by the check nodes are continuous Gaussian probability distribution functions (pdfs). These real functions are sampled and quantized into discrete vectors which increases the complexity of the decoding. In addition, the number of pdfs grows exponentially with the number of iterations. In order to limit the Gaussians number to M values, other algorithms were proposed in [START_REF] Kurkoski | Message-passing decoding of lattices using Gaussian mixtures[END_REF][START_REF] Yona | Efficient parametric decoder of low density lattice codes[END_REF]. However, these algorithms add a new complexity related to the Gaussian mixture reduction procedure applied at each iteration. Therefore, this decoding procedure results in high computational complexity and large storage requirements. Choosing a low value of M can reduce the complexity but at the expense of significant performance degradation. Unlike LDLC decoding, GLD iterative decoding exchanges a fixed number p of discrete messages regardless of the number of iterations. Therefore, we can conclude that GLD iterative decoding is less complex than LDLC decoding. For Micciancio's cryptosystem, Babai's nearest plane algorithm is applied to compute the closest lattice vector to the noisy ciphertext. This sub-optimal algorithm should be repeated many times to return the closest lattice point. In order to decrypt correctly without running the algorithm for a long time, the precision used to represent real numbers should be high but this induces large storage requirements. It was shown by simulations that this decryption procedure is very slow in high dimensions [START_REF] Ludwig | The Security and Efficiency of Micciancio's Cryptosystem[END_REF]. Conversely, GLD iterative decoding provides a performance close to the optimal decoding while keeping the complexity at a very low level. We can deduce that, in addition to offering better performance, the GLD decryption algorithm is also faster than Micciancio's decryption algorithm.

Conclusion

We have proposed a new GGH cryptosystem based on GLD lattices [START_REF] Boutros | Generalized low-density (GLD) lattices[END_REF]. In this scheme, the private key is the parity-check matrix H C of the GLD code and the public key is the lattice generator matrix G Λ which can be obtained by construction A and has a Hermite normal form. We have shown through analysis and experimental results that our cryptosystem reduces significantly the complexity compared to previous GGH schemes while guarantying the same level of security. Indeed, a large reduction in the key size is induced by the HNF form of the public key G Λ . The public key in dimension n ≈ 1000 is represented using 100 KBs approximately, which is one order of magnitude smaller than the public keys of the existing GGH schemes. In addition, the public key is in HNF form by design; hence, no HNF algorithms are applied, which reduces the complexity of the key generation phase making it 1300 times faster than Micciancio and LDLC systems. Finally, the iterative decoding of the GLD lattices offers performance close to the optimal decoding algorithms while operating at low complexity.

Chapter 3 Individual Secrecy in Caching Scenario

In this chapter, we address security in cache-aided communication systems. We consider a wiretap erasure broadcast channel with one transmitter, K ≥ 2 receivers and one eavesdropper. We partition the set of receivers into K w weak receivers and K s strong receivers, and assume that only the weak receivers have equal cache memories of size M. In this communication scenario, the eavesdropper can intercept the transmitted messages. We require that this transmission be secured under an individual secrecy constraint, i.e. the eavesdropper cannot learn any information about any of the messages individually. However, it is allowed to learn, for example, the XOR of two messages.

We propose a new secure coding scheme and a new information-theoretic converse for the wiretap erasure BC with cache memory at only the weaker receivers. Our secure coding scheme extends the piggyback coding in [START_REF] Timo | Joint cache-channel coding over erasure broadcast channels[END_REF][START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF] to a wiretap scenario. The so obtained secure piggyback coding is a joint cache-channel coding scheme where the design of the encoder and decoders simultaneously exploits the cache content and the channel statistics. Most previous works [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF][START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF][START_REF] Ravindrakumar | Fundamental limits of secretive coded caching[END_REF] assume a separate cache-channel architecture (both under secrecy constraints and in the standard model), and focus only on the design of the cache encoder and decoders while assuming that the BC is a noise-free pipe from the transmitter to all receivers. This approach was shown to be highly suboptimal when there is no secrecy constraint [START_REF] Timo | Joint cache-channel coding over erasure broadcast channels[END_REF][START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]; the same is proved here in the presence of such a constraint.

For more clarity, we present first our results for the two-user scenario with one weak receiver and one strong receiver. To study the effect of the secrecy constraint on the capacity-memory tradeoff, we compare our lower and upper bounds with the bounds obtained using also a joint cache-channel coding scheme but in the standard scenario without any secrecy constraint [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]. We also present lower and upper bounds on the secure capacity-memory tradeoff when both receivers have cache memories of equal size. We study the effect of the cache memory assignment on the secure capacity memory-tradeoff. Moreover, we compare our joint cache-channel coding with the separate cache-channel scheme. Finally, we extend our results to the scenario with K receivers.

Problem definition

Channel model

We consider a wiretap broadcast channel with a single transmitter, K receivers and one eavesdropper, as shown in Figure 3.1. We model this channel by a memoryless packet-erasure BC with input alphabet

X := {0, 1} F (3.1)
and the same output alphabet at all receivers and the eavesdropper

Y := X ∪ ∆. (3.2)
Here, F is a fixed positive integer, and an input symbol x ∈ X is an F -bit packet. The output erasure symbol ∆ indicates the loss of a packet at the receiver. Hence, each receiver k ∈ K := {1, . . . , K} observes y k = ∆ with a probability δ k ≥ 0, and it observes y k = x with probability 1 -δ k . The marginal transition laws of this BC channel are described by

P[Y k = y k |X = x] =    1 -δ k if y k = x δ k if y k = ∆ , ∀ k. 0 otherwise (3.3)
The K receivers are partitioned into two sets. The first set

K w := {1, . . . , K w } (3.4)
is formed by K w weak receivers which have bad channels. The second set

K s := {K w + 1, . . . , K} (3.5)
is formed by K s = K -K w strong receivers which have good channels.

We assume that the erasure probabilities of the receivers' channels and the eavesdropper are fixed to

δ k =    δ w if k ∈ K w δ s if k ∈ K s δ z if k = Eavesdropper, (3.6) Sarah Kamel Library W 1 , W 2 , . . . , W D T X X n Packet-Erasure Broadcast Channel Y n 1 Y n Kw Y n Kw+1 Y n K Z n R X 1 . . . R X Kw R X Kw +1 . . . R X K Eavesdropper M M Ŵ1 ŴKw ŴKw+1 ŴK
Weak receivers Strong receivers

≤ δ s ≤ δ w ≤ δ z ≤ 1. (3.7)
Thus, the eavesdropper has statistically the worst channel and the weak receivers have worse channels than the strong ones.

Moreover, we consider that every weak receiver has access to a local cache memory of size nM bits, while the stronger receivers have no cache memory.

Message library and receiver demands

The transmitter can access a library of D > K independent messages The communication takes place in two phases: the caching phase where the transmitter sends caching information to be stored in weak receivers' cache memories and the delivery phase where the demanded messages W d k , for k ∈ K, are conveyed to the receivers.

Caching phase

During the caching phase, the demand vector d is unknown to the transmitter and the receivers. Thus, the cache content V i of every weak receiver i ∈ K w will be a function of the entire library:

V i := g i (W 1 , . . . , W D ), i ∈ K w (3.11)
for some caching function

g i : 1, . . . , 2 nRs D → V (3.12)
and cache memory alphabet

V := 1, . . . , 2 nM . (3.13)
Since the caching phase occurs during low-network traffic periods, we assume that the transmission of the cache content is done via an error-free and erasure-free link. Thus, each weak receiver i ∈ K w stores V i in its cache memory.

Delivery phase

Prior to the delivery phase, the demand vector d is learned by the transmitter and the legitimate receivers. We can assume that the communication of the demand vector requires zero communication rate since it takes only K • log(D) bits to describe d.

Based on the demand vector, the transmitter sends

X n := f d (W 1 , . . . , W D ), (3.14)
for some function

f d : 1, . . . , 2 nRs D → X n . (3.15)
All the receivers attempt to decode their demanded messages based on the observed outputs Y n k , k ∈ K. Every weak receiver i ∈ K w uses its observed vector Y n i and its cache content V i to decode

Ŵi := ϕ i,d (Y n i , V i ), i ∈ K w (3.16)
for some function

ϕ i,d : Y n × V → 1, . . . ,

Secure capacity-memory tradeoff

A decoding error occurs whenever Ŵk = W d k , for k ∈ K. We consider the worst-case probability of error over all feasible demand vectors P Worst e := max

d∈D K P K k=1 Ŵk = W d k . (3.20)
We aim to secure the communication over the BC channel from the eavesdropper and we consider in this chapter the individual secrecy constraints defined as follows:

Definition 3.1. The communication is considered secure under an individual secrecy constraint if the eavesdropper's channel outputs Z n during the delivery phase provide no information about any of the demanded messages individually: This secure capacity-memory tradeoff C s (M) is unknown even for the case when there is no cache, i.e. when M = 0. We delimit C s (M) by computing lower and upper bounds on its values.

                     lim n→∞ 1 n I(W d 1 ; Z n ) < , lim n→∞ 1 n I(W d 2 ; Z n ) < , . . . lim n→∞ 1 n I(W d k ; Z n ) < . ( 3

Secure joint cache-channel coding scheme under onesided cache assignment for the two-user scenario

In this section, we consider the wiretap BC channel with only one weak receiver and one strong receiver. The weak receiver is provided with a cache memory of size M. The scenario is illustrated in Figure 3.2. We propose a secure joint cache-channel coding scheme and compute the lower bound on the secure capacity-memory tradeoff C s (M) for the two-receiver scenario under one-sided cache assignment. During the delivery phase, our joint cache-channel coding is based on piggyback coding [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]. We will see that this coding increases the transmission rate by piggybacking parts of the strong receiver message on the message intended for the weak receiver. The lower bound on the secure capacity-memory tradeoff C s (M) is stated in the following theorem: Theorem 3.1 (Lower Bound on C s (M)). A rate-memory pair (R s , M) is securely achievable over the two-user wiretap erasure BC with cache memory M only at the weak receiver using a joint cache-channel coding scheme, if it satisfies the following six conditions:

Library W 1 , W 2 , . . . , W D T X X n Packet-Erasure Broadcast Channel Y n 1 Y n 2 Z n R X 1 R X 2 Eavesdropper Ŵ1 Ŵ2 M
R s ≤ (δ z -δ 2 )F, (3.25a) R s ≤ (1 -δ 2 )(δ z -δ 2 ) 1 + δ z -2δ 2 F + 1 -δ 2 1 + δ z -2δ 2 M D , (3.25b)
R s ≤ (1 -δ 1 )(δ z -δ 2 ) 1 -δ 1 + δ z -δ 2 F + M D , (3.25c)
R s ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + D(δ z -δ 2 ) + (δ z -δ 1 ) 2δ z -δ 1 -δ 2 M D , (3.25d)
R s ≤ δ z -δ 2 2 F + D 2 M D , (3.25e)
R s ≤ D D + 1 (δ z -δ 2 )F + D D + 1 M D . (3.25f)
Thus, any R s satisfying (3.25) forms a lower bound on C s (M).

Proof. We derive the proof of this theorem in the next subsections by describing the joint cache-channel coding that can achieve this lower bound.

Remark 3.1. The scenario which is of most interest to us is when receiver 2 is sufficiently stronger than receiver 1. In this case, constraints (3.25e) and (3.25f) are not active and the lower bound is defined only by (3.25a)-(3.25d).

Message splitting

For each d ∈ D, split the message W d into two sub-messages, such that

W d = W (0) d , W (1) d , (3.26)
with rates R (0) and R (1) , respectively. The total rate of W d is

R s = R (0) + R (1) . (3.27) If R (0) > (D -2)R (1) , divide W (0) d into two further sub-messages, such that W (0) d = W (0,1) d , W (0,2) d , (3.28)
with rates (D -2)R (1) and R (0) -(D -2)R (1) , respectively. Otherwise, W

Codebook generation

Generate two codebooks that will be used later to securely encode the messages before their transmission. The first one is a piggyback codebook and the second one is a regular wiretap codebook.

Generate the first codebook C 1 with

Γ 1 := 2 nR (0) • 2 nR (1) • 2 nR (3.29)
codewords of length αn,

C 1 := X (αn) 1 (l 1 ) Γ 1 l 1 =1 . (3.30)
by drawing each entry of each codeword at random according to a Bernoulli-1/2 distribution independently of all other entries.

The codebook C 1 is partitioned into 2 nR (0) • 2 nR (1) subcodebooks (bins) each with 2 nR codewords. The subcodebooks are arranged into an array with 2 nR (0) rows and 2 nR (1) columns, as depicted in Figure 3.3 where each square represents a subcodebook. The subcodebook in row w1 and column w2 is denoted C 1 ( w1 , w2 ). W1 1 2 . . . Then, generate the second codebook C 2 with C 2 is also generated by drawing each entry of each codeword at random according to a Bernoulli-1/2 distribution independently of all the other entries.

2 nR (0) W2 1 2 . . . 2 nR (1) 2 nR
Γ 2 := 2 nR (1) • 2 nR (3.31) codewords of length (1 -α)n, C 2 := X ((1-α)n) 2 (l 2 ) Γ 2 l 2 =1 , (3.32) 1 2 . . . 2 nR (0) W 2 nR
We assume that both codebooks C 1 and C 2 are revealed to the transmitter, both receivers and the eavesdropper.

Caching phase

For each d ∈ D, store W

(1) d in the cache memory of receiver 1. Thus, the cache content

V 1 of receiver 1 is V 1 = W (1) 1 , W (1)
2 , . . . , W

Delivery phase

The delivery phase is divided into two periods of lengths αn and (1 -α)n, for some α ∈ [0, 1].

During the first period, the transmitter conveys message W (0)

d 1 to receiver 1 and message W (1)
d 2 to receiver 2.
It randomly chooses a set of ι indices such that

j 1 , j 2 , . . . , j ι ∈ D \ {d 1 , d 2 } , (3.35)
Those indices serve to select the messages from receiver 1's cache that will be XORed with the transmitted message W (0) 1) , ι = 1 and only a part of the chosen message W

d 1 . Thus, if R (0) ≤ R (
(1) (1) , then it needs ι = R (0) /R (1) . Now, if the messages in the cache are not enough to cover the whole message W (0) (1) , it XORs only the part W (0,1)

d jι is used in the XOR operation. Otherwise, if R (1) < R (0) ≤ (D -2)R
d 1 , i.e. if R (0) > (D-2)R
d 1 of W (0)
d 1 with the (D-2) messages from the cache memory and it secures the remaining part W (0,2) d 1 by the binning. Thus, ι is defined by 1) , (D -2) .

ι := max 1, min R (0) R (
(3.36)

Afterwards, the transmitter forms

W XOR := W (0,1) d 1 ⊕ W (1) j 1 , W (1)
j 2 , . . . , W (1)
jι .

(3.37)

It then uses the secure piggyback codebook C 1 in Figure 3.3. Specifically, it picks an index J 1 uniformly at random from 1 : 2 nR and transmits the

J 1 -th codeword of subcodebook C 1 W1 , W2 = W (1) d 2 (3.38)
where

W1 := W XOR , W (0,2) d 1 . (3.39)
During the second period, the transmitter conveys message W (0) d 2 to receiver 2 using the wiretap codebook C 2 . Specifically, it picks an index J 2 uniformly at random from 1 : 2 nR , and transmits the

J 2 -th codeword of subcodebook C 2 W = W (0) d 2 .
(3.40)

Decoding at receiver 1

Receiver 1 demands the message

W d 1 . But since W (1)
d 1 is stored in its cache memory, it only needs to decode message W (0) d 1 based on its observed outputs y αn 1 in the first phase and its cache memory V 1 . To decode W (0) d 1 , it performs the following steps:

1. It retrieves the message W (1) d 2 from its cache memory.

It forms the column-subcodebook

C 1 ( W2 = W (1) d 2 ) ∈ C 1 that
contains all the codewords that represent the retrieved message:

C 1 (W (1) d 2 ) := X (αn) 1 (l 1 |W (1) d 2 ) l 1 ∈Γ 1 (W (1) d 2 ) , (3.41)
where Γ 1 (W

(1)

d 2 ) is a subset of Γ 1 of cardinality 2 nR (0) • 2 nR . C 1 (W (1)
d 2 ) corresponds to the subcodebook in column W

It finds ŵ1 by restricting its attention to this column

-subcodebook C 1 (W (1) d 2 ). It looks for a unique l 1 ∈ Γ 1 (W (1) d 2 ) so that x (αn) 1 (l 1 |W (1)
d 2 ) is jointly typical with its observed outputs y αn 1 :

x (αn) 1

(l 1 |W

(1)

d 2 ), y αn 1 ∈ T (αn) p X • p Y 1 |X , (3.42)
where p X stands for the Bernoulli-1/2 distribution, p Y 1 |X stands for the channel law to receiver 1, and T (αn) stands for the typical set [START_REF] Gamal | Network information theory[END_REF].

If the desired unique index l 1 exists, it finds the bin C 1 ( ŵ1 , W

d 2 ) containing l 1 . Then, the value of ŵ1 is determined as the row index of the C 1 ( ŵ1 , W

(1)

d 2 ).
Otherwise, if the unique index does not exit, receiver 1 declares a decoding error.

4. If ŵ1 is found in the previous step, receiver 1 splits it as follows ŵ1 = ŵXOR , ŵ(0,2)

d 1 . (3.43)
Then, it retrieves messages W

(1)

j 1 , W (1)
j 2 , . . . , W (1)
jι from its cache memory and forms ŵ(0,1)

d 1 = ŵXOR ⊕ W (1) j 1 , W (1)
j 2 , . . . , W (1) jι . (3.44)
It finally retrieves W

d 1 from its cache memory and declares its decoded message ŵ1 = ŵ(0,1)

d 1 , ŵ(0,2) d 1 , W (1)
d 1 .
(3.45)

Decoding at receiver 2

Receiver 2 does not have any cache memory and hence, it decodes both transmission periods using its observed outputs only. It decodes W (l 1 ) is jointly typical with its observed outputs y αn 2 :

x

(αn) 1 (l 1 ), y αn 2 ∈ T (αn) p X • p Y 2 |X , (3.46)
where p X stands for the Bernoulli-1/2 distribution and p Y 2 |X stands for the channel law to receiver 2.

If the desired unique index l 1 exists, receiver 2 finds the bin C 1 ( ŵ1 , ŵ(1) d 2 ) containing l 1 and it determines the value of ŵ(1) d 2 as the column index of this bin. Otherwise, receiver 2 declares a decoding error.

To decode

W (0) d 2 , it considers the codebook C 2 . It looks for a unique l 2 ∈ Γ 2 such that x ((1-α)n) 2
(l 2 ) is jointly typical with its observed outputs y

(1-α)n 2 : x ((1-α)n) 2 (l 2 ), y (1-α)n 2 ∈ T (αn) p X • p Y 2 |X .
(3.47)

If the desired unique index l 2 exists, receiver 2 finds the bin C 2 ( ŵ(0) d 2 ) containing l 2 and it determines the value of ŵ(0) d 2 as the index of this bin. Otherwise, receiver 2 declares a decoding error.

3. If the decoding of both periods succeeds, receiver 2 declares its decoded message ŵ2 = ŵ(0)

d 2 , ŵ(1) d 2 .
(3.48)

Analysis of the error probability

As seen in Section 3.2.5, receiver 1 decodes only the first transmission period and its decoding is restricted to the column-subcodebook C 1 (W

d 2 ). Hence, the probability of error at receiver 1 averaged over the codebooks C 1 , C 2 , the channel realizations, and the messages,

P Worst e,1 ---→ n→∞ 0,
if the following condition is satisfied:

R (0) + R ≤ α(1 -δ 1 )F. (3.49)
Receiver 2 decodes both transmission periods without the help of any cache memory. Thus, the probability of error at receiver 2, averaged over the codebooks C 1 , C 2 , the channel realizations, and the messages,

P Worst e,2 ---→ n→∞ 0,
if the following two conditions are satisfied:

R s + R ≤ α(1 -δ 2 )F, (3.50a) R (0) + R ≤ (1 -α)(1 -δ 2 )F. (3.50b)

Analysis of the information leakage

In this section, we analyze the individual secrecy of each transmitted message W d 1 and

W d 2 .
Secrecy of receiver 1's message W d 1 :

For the secrecy of the message W d 1 , we derive the mutual information between W d 1 and the received vector Z n at the eavesdropper knowing the codebooks C 1 and C 2 as follows

I(W d 1 ; Z n |C 1 , C 2 ) = I W (0,1) d 1 , W (0,2) d 1 , W (1)
d 1 ; Z n |C 1 , C 2 (a) = I W (0) d 1 ,1 , W (0,2) d 1 ; Z αn |C 1 = I W (0,1)
d 1 ; Z αn |W (0,2) d 1 , C 1 + I W (0,2) d 1 ; Z αn |C 1 , (3.51)
where (a) holds because W

(1) d 1 is in the cache memory of receiver 1 and it is not sent over the channel. Furthermore, I(W (0,1)

d 1 ; Z αn |W (0,2) d 1 , C 1 ) ≤ I W (0,1)
d 1 ; Z αn , W XOR , W (0,2) d 1 |C 1 (a) = I W (0,1)
d 1 ; W XOR , W (0,2) d 1 |C 1 (b) = 0, (3.52)
where (a) holds because of the Markov chain W (0,1)

d 1 → (W XOR , W (0,2) d 1 ) → Z n ; and (b) holds because W (0,1) d 1 is independent of the pair W XOR , W (0,2) d 1 .
The secrecy of W (0,2) d 1 is proved as follows I(W (0,2)

d 1 ; Z αn |C 1 ) = H(W (0,2) d 1 |C 1 ) -H(W (0,2) d 1 |Z αn , C 1 ) = n R (0) -(D -2)R (1) -H(W (0,2) d 1 , L 1 |Z αn , C 1 ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) (a) = n R (0) -(D -2)R (1) -H(L 1 |Z αn , C 1 ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) = n R (0) -(D -2)R (1) -H(L 1 |C 1 ) + I(L 1 ; Z αn |C 1 ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) = n R (0) -(D -2)R (1) -n R (0) + R (1) + R + I(L 1 ; Z αn |C 1 ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) (b) = -n (D -1)R (1) + R + I(X αn 1 , L 1 ; Z αn |C 1 ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) (c) ≤ -n (D -1)R (1) + R + I(X αn 1 , L 1 , C 1 ; Z αn ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) (d) ≤ -n (D -1)R (1) + R + I(X αn 1 ; Z αn ) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ) (e) ≤ -n (D -1)R (1) + R + αnI(X 1 ; Z) + H(L 1 |Z αn , W (0,2) d 1 , C 1 ), = -n (D -1)R (1) + R + αn(1 -δ z )F + H(L 1 |Z αn , W (0,2) d 1 , C 1 ), ( 3
d 1 ; Z αn |C 1 ) ≤ δ( ),
for some function δ( ) ---→ n→∞ 0, we need

lim n→∞ 1 n H(L 1 |Z αn , W (0,2) d 1 , C 1 ) ≤ (D -1)R (1) + R -α(1 -δ z )F + δ( ). ( 3
(D -1)R (1) + R ≥ α(1 -δ z )F. (3.55)
Proof. The proof of Lemma 3.1 is given in the appendix.

Note that the condition in Lemma 3.1 is relevant only in case R (0) > (D -2)R (1) .

Secrecy of receiver 2's message W d 2 :

Following the same steps, we can prove the secrecy of message W d 2 . We can show that lim

n→∞ 1 n I(W (0) d 2 ; Z n |C 1 , C 2 ) → 0 whenever R (0) + R ≥ α(1 -δ z )F, (3.56)
and lim

n→∞ 1 n I(W (1)
d 2 ; Z n |C 1 , C 2 ) → 0 whenever R ≥ (1 -α)(1 -δ z )F. (3.57)
We can state finally that under constraints (3.34), (3.49), (3.50) and (3.55)-(3.57), when averaged over the random choice of the codebooks C 1 and C 2 , the probabilities of error tend to zero and the information leakage constraints are satisfied. There must thus exist at least one choice of C 1 and C 2 with these properties.

Securely achievable rate-memory tuples

We consider all the constraints (3.34), (3.49), (3.50) and (3.55)-(3.57) of our scheme and compute the securely achievable transmission rate R s as function of the cache memory size M, as follows:

R (1) ≤ M D , (3.58a)
R (0) + R ≤ α(1 -δ 1 )F, (3.58b) R s + R ≤ α(1 -δ 2 )F, (3.58c) R (0) + R ≤ (1 -α)(1 -δ 2 )F, (3.58d) R (0) + R ≥ α(1 -δ z )F, (3.58e) (D -1)R (1) + R > α(1 -δ z )F, (3.58f) R ≥ (1 -α)(1 -δ z )F. (3.58g)
Since R ≥ 0 and R ≥ 0, we apply the Fourier-Motzkin elimination to remove R and R and obtain:

R (1) ≤ M D , (3.59a)
R (0) ≤ α(1 -δ 1 )F, (3.59b) R s ≤ α(1 -δ 2 )F, (3.59c) 1 -δ z ≤ 1 -δ 1 , (3.59d) R (0) -(D -1)R (1) ≤ α(δ z -δ 1 )F, (3.59e) R (1) ≤ α(δ z -δ 2 )F, (3.59f) R s -(D -1)R (1) ≤ α(δ z -δ 2 )F, (3.59g) R (0) ≤ (1 -α)(1 -δ 2 )F, (3.59h) R (0) ≤ (1 -α)(δ z -δ 2 )F. (3.59i)
Notice that the bound in (3.59i) is tighter than that of (3.59h). Hence, we can remove condition (3.59h) without any effect on the result. Moreover, constraint (3.59d) is always valid since by definition δ z ≥ δ 1 . We replace R (0) by R s -R (1) and remove R (1) using Fourier-Motzkin elimination since 0 ≤ R (1) ≤ R. We obtain:

R s ≤ α(1 -δ 1 )F + M D , (3.60a) R s ≤ α(1 -δ 2 )F, (3.60b) R s ≤ α(δ z -δ 1 )F + D M D , (3.60c) Sarah Kamel 55 R s ≤ α(δ z -δ 2 )F + (D -1) M D , (3.60d) R s ≤ (1 -α)(δ z -δ 2 )F + M D , (3.60e) R s ≤ α(1 -δ 1 + δ z -δ 2 )F, (3.60f) R s ≤ α D(δ z -δ 2 ) + (δ z -δ 1 ) F, (3.60g) R s ≤ αD(δ z -δ 2 )F, (3.60h) R s ≤ (δ z -δ 2 )F. (3.60i)
Finally, since 0 ≤ α ≤ 1, we apply Fourier-Motzkin elimination one last time to remove α and we get: is tighter than (3.61a); and (3.61l) is tighter than (3.61c). We can remove all the loose constraints without affecting the result. We conclude that the rate-memory tuples securely achievable by our joint cache-channel coding scheme satisfy the constraints given in Theorem 3.1.

R s ≤ (1 -δ 1 )F + M D , (3.61a) R s ≤ (1 -δ 2 )F, (3.61b) R s ≤ (δ z -δ 1 )F + D M D , (3.61c) R s ≤ (δ z -δ 2 )F + (D -1) M D , (3.61d) R s ≤ (δ z -δ 2 )F + M D , (3.61e)
R s ≤ (1 -δ 1 + δ z -δ 2 )F, (3.61f) R s ≤ D(δ z -δ 2 ) + (δ z -δ 1 ) F, (3.61g)
R s ≤ D(δ z -δ 2 )F, (3.61h) R s ≤ (δ z -δ 2 )F, (3.61i) R s ≤ (1 -δ 1 )(δ z -δ 2 ) 1 -δ 1 + δ z -δ 2 F + M D , (3.61j) R s ≤ (1 -δ 2 )(δ z -δ 2 ) 1 + δ z -2δ 2 F + 1 -δ 2 1 + δ z -2δ 2 M D , (3.61k) R s ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + D(δ z -δ 2 ) + (δ z -δ 1 ) 2δ z -δ 1 -δ 2 M D , (3.61l) R s ≤ δ z -δ 2 2 F + D 2 M D , (3.61m) R s ≤ (δ z -δ 2 )(1 -δ 1 + δ z -δ 2 ) 1 -δ 1 + 2δ z -2δ 2 F + 1 -δ 1 + δ z -δ 2 1 -δ 1 + 2δ z -2δ 2 M D , (3.61n) R s ≤ (δ z -δ 2 ) D(δ z -δ 2 ) + (δ z -δ 1 ) (D + 1)(δ z -δ 2 ) + (δ z -δ 1 ) F + D(δ z -δ 2 ) + (δ z -δ 1 ) (D + 1)(δ z -δ 2 ) + (δ z -δ 1 ) M D , (3.61o) R s ≤ D D + 1 (δ z -δ 2 )F + M D . ( 3

Upper bound on the secure capacity-memory trade-

off under one-sided cache assignment for the two-user scenario

In this section, we provide the upper bound on the secure capacity-memory tradeoff C s (M) for the two-receiver channel under one-sided cache assignment. This upper bound is stated in the following theorem:

Theorem 3.2 (Upper Bound on C s (M)).
The secure capacity-memory tradeoff C s (M) of the two-user wiretap erasure BC with cache memory M only at the weaker receiver satisfies the following three conditions:

C s (M) ≤ (δ z -δ 1 )F + M, (3.62a)
C s (M) ≤ (δ z -δ 2 )F, (3.62b)
C s (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D .
(3.62c)

Proof of the upper bound

Constraint (3.62c) follows from [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]Theorem 9] and by ignoring the secrecy constraints (3.21).

Constraint (3.62a) is proved as follows. For each blocklength n, we fix caching, encoding and decoding functions as in (3.12), (3.15), (3.17) and (3.19), so that both the probability of worst-case error and the secrecy leakage satisfy:

P Worst e ---→ n→∞ 0 and 1 n I(W d k ; Z n ) ---→ n→∞ 0, for k ∈ {1, 2},
where P Worst e is defined in (3.20).

By Fano's inequality, there exists a sequence of real numbers

{ n } ∞ n=1 with n n ---→ n→∞ 0, so that H(W d 1 |Y n 1 , V 1 ) ≤ n 2 . (3.63) Sarah Kamel 57 = n i=1 I(X i , W d 1 , V 1 , Y i-1 1 , Z n i+1 ; Y 1,i ) -I(X i , W d 1 , V 1 , Y i-1 1 , Z n i+1 ; Z i ) + nM + n (f ) = n i=1 I(X i ; Y 1,i ) -I(X i ; Z i ) + nM + n , (3.64)
where (a) holds because I(W

d 1 ; V 1 |Z n ) is
(V 1 , W d 1 , Y i-1 1 , Z n i+1 ) → X i → (Y 1,i , Z i ).
Dividing by n, we get

R s ≤ n i=1 1 n I(X i ; Y 1,i ) -I(X i ; Z i ) + M + n n . (3.65)
Then, we define a random variable Q uniform over {1, . . . , n} and independent of all the previously defined random variables. Also, we define the following random variables:

X := X Q , (3.66)
Y 1 := Y 1,Q , (3.67)
Z := Z Q . (3.68)
We can now rewrite the above inequality as

R s ≤ n q=1 Pr{Q = q} I(X q ; Y 1,q |Q = q) -I(X q ; Z q |Q = q) + M + n n ≤ I(X; Y 1 |Q) -I(X; Z|Q) + M + n n . (3.69)
When n → ∞, R s is achievable if there exists a pmf p QX that satisfies (3.69):

R s ≤ max p QX I(X; Y 1 |Q) -I(X; Z|Q) + M = max p QX (1 -δ 1 )H(X|Q) -(1 -δ z )H(X|Q) + M = max p QX (δ z -δ 1 )H(X|Q) + M (a) = (δ z -δ 1 )F + M, (3.70)
where (a) holds because the maximum is achieved for Q = ∅ and X uniform over {1, . . . , 2 F }.

Constraint (3.62b) can be proved along similar lines, when index 1 is replaced by index 2; cache content V 1 by a constant, and thus, cache memory size M by 0.

Lower bound on the secure capacity-memory tradeoff under symmetric cache assignment for the two-user scenario

With the purpose of highlighting the interest of one-sided cache assignment, we study, in this section, the same wiretap BC channel model but with a symmetric cache assignment among users. We consider one weak receiver and one strong receiver and we assume that the total cache memory M is split equally among both receivers, irrespective of their channel statistics. Hence, each receiver gets a cache memory of size M/2, as shown in Figure 3.5. We compute the lower bound on the securely achievable capacity-memory tradeoff for this scenario. We denote by C s,Sym (M) the secure capacity-memory tradeoff for symmetric cache assignment in analogy to the secure capacity-memory tradeoff C s (M) for one-sided cache memory given in Definition 3.3. The lower bound on C s,Sym (M) is stated in the following proposition: Proposition 3.1 (Lower Bound on C s,Sym (M)). A rate-pair (R s,Sym , M) is securely achievable over the two-user wiretap erasure BC with symmetric cache assignment M/2 at both receivers, if it satisfies the following three conditions:

Library W 1 , W 2 , . . . , W D T X X n Packet-Erasure Broadcast Channel Y n 1 Y n 2 Z n R X 1 R X 2 Eavesdropper M 2 M 2 Ŵ1 Ŵ2
R s,Sym ≤ 2(1 -δ 1 )F, (3.71a) R s,Sym ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + 3 -2δ 1 -δ 2 2(2 -δ 1 -δ 2 ) M D , (3.71b) R s,Sym ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + (δ z -δ 1 )(δ z -δ 2 )(3 -2δ 1 -δ 2 ) 2(1 -δ 1 )(1 -δ 2 )(2δ z -δ 1 -δ 2 ) + D(1 -δ z ) (1 -δ 1 )(δ z -δ 1 ) + (1 -δ 2 )(δ z -δ 2 ) 2(1 -δ 1 )(1 -δ 2 )(2δ z -δ 1 -δ 2 ) M D . (3.71c)
Thus, any R s,Sym satisfying (3.71) forms a lower bound on C s,Sym (M).

Proof. We derive the proof of this proposition in the next subsections by describing the coded caching scheme that can achieve this lower bound.

Message splitting

For d ∈ [1 : D], split every message W d into three sub-messages, such that

W d = W (0) d , W (1)
d , W (2) d , (3.72)
with rates R (0) , R (1) 2 , and R (1) 2 , respectively. The total rate of W d is

R s,Sym = R (0) + R (1) . (3.73) If R (0) > (D -2) R (1)
2 , divide W

Caching phase

Store sub-messages {W

(k) d } D d=1 in cache memory V k , k ∈ {1, 2}.
The cache contents of receivers 1 and 2 are

V 1 = W (1) 1 , W (1) 2 , . . . , W (1) D and V 2 = W (2) 1 , W (2) 2 , . . . , W (2) D .
(3.75)

Therefore, R (1) should satisfy

R (1) ≤ M D .
(3.76)

Delivery phase

If R (0) > (D -2) R (1)
2 , the delivery phase takes place in five periods, otherwise it takes only three periods to transmit. For = 1, . . . , 5, let α n be the length of period , such that 0 ≤ α ≤ 1 and

5 =1 α = 1. If R (0) ≤ (D -2) R (1)
2 , α 4 and α 5 are null.

In the first and second periods, the transmitter randomly chooses a set of

ι := max 1, min 2R (0) R (1) , (D -2) (3.77) indices {j 1 , j 2 , . . . , j ι } ∈ (D \ {d 1 , d 2 }) and forms W k,XOR := W (0,1) d k ⊕ W (k) j 1 , W (k) j 2 , . . . , W (k) jι , k ∈ {1, 2}. (3.78)
It uses an optimal regular (non-wiretap) code to send W 1,XOR to receiver 1 in period 1 and W 2,XOR to receiver 2 in period 2. For each k ∈ {1, 2}, receiver k first decodes the XOR message W k,XOR and, with its cache content, it reconstructs the desired W (0,1)

d k .
In period 3, the transmitter sends the common message

W XOR = W (2)
d 1 ⊕ W (1) d 2 , (3.79)
to both receivers using an optimal regular code. Each receiver k, k ∈ {1, 2}, decodes the XOR message W XOR and, with its cache content, it reconstructs the desired submessage W

(3-k) d k .
In period 4, the transmitter sends message W (0,2)

d 1
to receiver 1 and in period 5, it sends message W (0,2)

d 2
to receiver 2 using optimal wiretap codes.

Analysis of the error probability

According to the defined delivery phase, receiver 1 decodes period 1, 3 and 4 and receiver 2 decodes period 2, 3 and 5. Hence, their error probabilities averaged over the codebooks C 1 , C 2 , the channel realizations, and the messages,

P Worst e,1 ---→ n→∞ 0 and P Worst e,2 ---→ n→∞ 0, if the following six conditions are satisfied: min R (0) , D -2 2 R (1) ≤ α 1 (1 -δ 1 )F, (3.80a) min R (0) , D -2 2 R (1) ≤ α 2 (1 -δ 2 )F, (3.80b)
R (1) 2 ≤ α 3 (1 -δ 1 )F, (3.80c)
R (1) 2 ≤ α 3 (1 -δ 2 )F, (3.80d) max 0, R (0) - D -2 2 R (1) + R ≤ α 4 (1 -δ 1 )F, (3.80e) max 0, R (0) - D -2 2 R (1) + R ≤ α 5 (1 -δ 2 )F. (3.80f)

Analysis of the information leakage

If R (0) ≤ (D-2) R (1)
2 , all the sent messages are secured by the XOR operation. Otherwise, phases 4 and 5 are secured by means of a random binning. In the later case, the security conditions in (3.21) are satisfied whenever

R ≥ α 4 (1 -δ z )F, (3.81a)
R ≥ α 5 (1 -δ z )F. (3.81b) Combining constraints (3.76), (3.80) and (3.81)
yields the securely achievable ratememory tuples for the symmetric caching case defined in Proposition 3.1.

Upper bound on the secure capacity-memory tradeoff under symmetric cache assignment for the two-user scenario

The upper bound on the secure capacity-memory tradeoff C s,Sym (M) under symmetric cache assignment is stated in the following proposition:

Proposition 3.2 (Upper Bound on C s,Sym (M)).
The secure capacity-memory tradeoff C s,Sym (M) of the two-user wiretap erasure BC with symmetric cache memory M/2 at both receivers satisfies the following three conditions:

C s,Sym (M) ≤ (δ z -δ 1 )F + M 2 , (3.82a)
C s,Sym (M) ≤ (1 -δ 1 )F + M 2D , (3.82b)
C s,Sym (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D . (3.82c)
Proof. Constraints (3.82b) and (3.82c) follow from [9, Theorem 9] and by ignoring the secrecy constraints in (3.21). The proof of constraint (3.82a) is analogous to that of (3.62a) in Section 3.3.

3.6 Separate cache-channel coding under one-sided cache assignment for the two-user scenario

In order to emphasize the strength of the joint cache-channel coding approach, we characterize in this section the rates that are securely achievable under the separate cachechannel coding approach. In the separate scheme, the encoder consists of a cache-encoder that does not depend on the channel statistics followed by a channel encoder that does not depend on the cache content. In addition, the decoder consists of a channel decoder followed by a cache decoder that are subject to similar restrictions, as depicted in Figure 3.6. For comparison purposes, we consider the same scenario as in Section 3.2 where the total cache memory M is given to the weak receiver 1, while the strong receiver 2 has no cache memory.

W 1 W 2 . . . W D

Cache Encoder

Channel Encoder The lower bound achieved by the best separate cache-channel coding scheme is stated in the following proposition:

X n Packet Erasure BC Y n 1 Y n 2 Z n

Channel

Proposition 3.3 (Lower Bound on C s,Sep (M)).
A rate-memory pair (R s,Sep , M) is securely achievable over the two-user wiretap erasure BC with cache memory M only at the weak receiver using a separate cache-channel coding scheme, if it satisfies the following three conditions:

R s,Sep ≤ (δ z -δ 2 )F, (3.83a) R s,Sep ≤ (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F + δ z -δ 2 1 + δ z -δ 1 -δ 2 M D , (3.83b)
R s,Sep ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + (δ z -δ 2 ) (D -1)(1 -δ z ) + (δ z -δ 1 ) (1 -δ 1 )(2δ z -δ 1 -δ 2 ) M D . (3.83c)
Thus, any R s,Sep satisfying (3.25) forms a lower bound on C s,Sep (M).

Proof. We derive the proof of this proposition in the next subsections by describing the separate cache-channel coding that can achieve this lower bound.

Message splitting

As in Section 3.2.1, split every message W d , d ∈ D, into three sub-messages, such that

W d = W (0,1) d , W (0,2) d , W (1) d , (3.84)
with rates min{R (0) , (D -2)R (1) }, max{0, R (0) -(D -2)R (1) } and R (1) , respectively. The total rate of W d is R s,Sep = R (0) + R (1) .

(3.85)

Caching phase

The caching phase is similar to the case of joint cache-channel coding in Section 3.2.3.

Here, we also store {W

d } D d=1 in cache memory of receiver 1. Hence, the cache content V 1 is given in (3.33) and R (1) has to satisfy (3.34).

Delivery phase

Let α 1 , α 2 and α 3 be three values chosen from the interval [0, 1], such that (1) , the delivery phase takes place in three periods of lengths α 1 n, α 2 n and α 3 n respectively. Otherwise, we fix α 2 = 0 and it takes two periods to transmit.

α 1 + α 2 + α 3 = 1. If R (0) > (D -2)R
In the first period, the transmitter conveys message W (0,1)

d 1 to receiver 1. It randomly chooses a set of ι indices j 1 , j 2 , . . . , j ι ∈ D \ {d 1 , d 2 }
, where ι is defined in (3.36). It uses then these indices to select ι messages from receiver 1's cache and generate a key K 1 of the same length as message W (0,1) d 1 as:

K 1 = W (1) j 1 , W (1)
j 2 , . . . , W (1) jι , (3.86)
Then, it sends W (0,1) d 1 using a wiretap code with secret key K 1 [START_REF] Yamamoto | Rate-distortion theory for the Shannon cipher system[END_REF], [11, (22.7)].

In the second period, the transmitter conveys W (0,2)

d 1
to receiver 1 using a wiretap code with random binning of rate R .

In the third period, it conveys message W d 2 to receiver 2 using a wiretap code with random binning of rate R .

Analysis of the probability of error

R (0) , D -2 2 R (1) ≤ α 1 (1 -δ 1 )F, (3.87a)
max 0, R (0) - D -2 2 R (1) + R ≤ α 2 (1 -δ 1 )F, (3.87b)
R s,Sep + R ≤ α 3 (1 -δ 2 )F. (3.87c)

Analysis of the information leakage

The message W (0,1)

d 1
sent to receiver 1 is secured by the key

K 1 . If R (0) > (D -2)R (1) , the message W (0,2) d 1
is secured by means of random binning whenever

R ≥ α 2 (1 -δ z )F, (3.88)
and the message W d 2 is similarly secured whenever

R ≥ α 3 (1 -δ z )F. (3.89)
Combining constraints (3.33) and (3.87)-(3.89) yields the securely achievable ratememory tuples using the separate cache-channel coding under asymmetric cache assignment defined in Proposition 3.3.

Discussion and numerical results

In the sequel, we discuss our derived bounds in Sections 3.2 and 3.3 and compare them to the bounds proposed in [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF] for the scenario without secrecy. We also compare these bounds to the ones derived for the symmetric cache assignment and the separate cache channel coding in Sections 3.4, 3.5 and 3.6, respectively. We assume that receiver 2 is much stronger than receiver 1.

Impact of the secrecy constraint

In Figures 3.7 and 3.8, we compare the upper and lower bounds on the capacity-memory tradeoffs C s (M) and C(M) with and without secrecy constraints.

Based on the lower and upper bounds on C s (M) defined in Theorems 3.1 and 3.2, and comparing them with the bound without secrecy [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF], we can conclude the following:

• Secure capacity without caching:

When no cache memory exists at the receivers, i.e. at M = 0, the best lower bound on C s (M = 0) can be obtained from Theorem 3.1 as

C s (M = 0) ≥ R 0 := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F. (3.90)
The right-hand side R 0 coincides with the secrecy capacity of the two-user wiretap BC without caching when the individual secrecy constraints in (3.21) are replaced by the stronger joint secrecy constraint [START_REF] Ekrem | Multi-receiver wiretap channel with public and confidential messages[END_REF] lim

n→∞ 1 n I(W d 1 , W d 2 ; Z n ) = 0. (3.91)
• Small cache memories regime:

For cache memories M below a given threshold M 1 ,

M ≤ M 1 = D(1 -δ z )(δ z -δ 2 ) (D -1)(1 + δ z -δ 1 -δ 2 ) , (3.92)
our joint cache-channel coding scheme achieves rates

R s = R 0 + δ z -δ 2 2δ z -δ 1 -δ 2 + δ z -δ 1 D(2δ z -δ 1 -δ 2 ) M. (3.93)
For small cache memories, the slope of the secure capacity-memory tradeoff C s (M) decreases negligibly with the library size D. In fact, the slope is given by the sum of the two terms in brackets in (3.93), where the first term is constant and the second one decreases with D. This is different in a scenario without secrecy, where the slope is at most 1 D [9, Corollary 7.1]. Therefore, caching is more useful in a wiretap-communication scenario than in a standard scenario. The reason is that the cache memory does not only render the transmission more efficient, but also more secure (for example by means of a one-time pad) adding thus an additional gain, namely the secrecy gain, to the case without secrecy.

M F •D Cs(M) F , C(M) F 0 0.8 0.6 0.4 0.2 0.6 0.4 0.2 LB on Cs(M) UB on Cs(M) LB on C(M) UB on C(M) (R1, M1) (R2, M2) (R3, M3)

• Intermediate regime:

In this regime, two changes in the slope of the lower bound on C s (M) occur at points (R 1 , M 1 ) and (R 2 , M 2 ).

-(R 1 , M 1 ): When the cache memory M = M 1 , the securely achievable rate is

R 1 = (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 + (1 -δ z )(δ z -δ 2 ) (D -1)(1 + δ z -δ 1 -δ 2 ) F. (3.94)
At this point, the slope of C s (M) decreases to 1 D . This change in the slope occurs when the secrecy gain saturates. Recall that, the first transmission period of our coding scheme is secured partly by the random binning of rate R and partly by the W XOR message which plays the role of a one time-pad key. When the cache memory is small, it is entirely exploited in our scheme: message W

(1)

d 1 is used to increase the efficiency, message W (1)
d 2 serves for efficiency and security and the rest are XORed with the transmitted message to improve the security. Thus, the rate of W XOR increases with the size of M, decreasing with it the rate needed for random binning. At (R 1 , M 1 ), W XOR attains the capacity of the eavesdropper's channel, the secrecy gain saturates and the increase in cache memory is only used to improve the system's efficiency. Hence, the slope of the C s (M) becomes 1 D as in the standard scenario without secrecy.

-(R 2 , M 2 ): (R 2 , M 2 ) = (1 -δ 2 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, D(δ z -δ 2 )(δ 1 -δ 2 ) 1 + δ z -δ 1 -δ 2 F . (3.95)
At this point, the total rate of the transmitted messages attains the capacity of receiver 2's channel in both transmission periods. Within this rate, messages conveyed to receiver 1 attain also its channel capacity. After this point, the increase in the cache memory size is used in the first period to decrease the rate of messages meant for receiver 1 and replace them with messages for receiver 2.

• Saturation regime: At this point, the maximal secure rate is achieved. In fact, since the strong receiver has no cache memory, the secure capacity-memory tradeoff C s (M) is limited to (δ z -δ 2 )F . It can be trivially achieved when the weak receiver can store the entire library in its cache memory, i.e. when M = DF (δ z -δ s ). In our scheme, this saturation capacity is achieved for a cache memory smaller than DF (δ z -δ s ), as we see in the following corollary.

Corollary 3.1. The capacity-memory tradeoff C s (M) of the two-user wiretap erasure BC with cache memory M at the weaker receiver achieves

C s (M) = (δ z -δ 2 )F, (3.96)

Impact of joint cache-channel coding

In Figure 3.11, we compare the lower bounds obtained by means of the joint and separate cache-channel coding schemes. From the lower bounds in Theorem 3.1 and Proposition 3.3, we can observe the following:

• Without cache memory, M = 0, both schemes achieve the same rate R 0 in (3.90).

• As in the case without secrecy [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF], our joint cache-channel coding scheme achieves significantly larger rate-memory tradeoff than the equivalent separate cachechannel coding scheme for all channel parameters and cache memory sizes.

General lower bound on the secure capacity-memory tradeoff

In this section, we consider the general scheme, depicted in Figure 3.1, with K w weak receivers and K s strong receivers. Only the weak receivers are provided with cache memories of size M. For this scheme, we compute the general lower bound on the secure capacity-memory tradeoff

C (K) s (M).
Consider the following five rate-memory pairs:

• R (K) 0 := K w δ z -δ w + K s δ z -δ s -1 F, (3.98a)
M (K) 0 := 0; (3.98b) • R (K) 3 := (δ z -δ s ) K s F, (3.98c)
M (K) 3 := DK w (δ z -δ s ) 2 K s K s (1 -δ z ) + K w (δ z -δ s ) F ; (3.98d) • R (K) 4 := (δ z -δ s ) K s F, (3.98e)
M (K) 4 := D (δ z -δ s ) K s F ; (3.98f) If K s (1 -δ z ) -(D -K w )(δ w -δ s ) ≤ 0, • R (K) 1 := 2(1 -δ w )(δ z -δ s ) (D -K w )(1 -δ w ) + K w (1 -δ z ) F β 1 , (3.98g)
M (K) 1 := 2D(1 -δ w )(δ z -δ s )(1 -δ z )F β 1 ; (3.98h) • R (K) 2 := 2(1 -δ w )(δ z -δ s ) K s (1 -δ w ) + K w (δ w -δ s ) F β 2 , (3.98i)
M (K) 2 := 2D(1 -δ w )(δ z -δ s )(δ w -δ s )F β 2 ; (3.98j) Otherwise, if K s (1 -δ z ) -(D -K w )(δ w -δ s ) > 0, • R (K) 1 := 2(1 -δ w )(δ z -δ s ) K s (δ z -δ w ) + D(δ w -δ s ) F β 3 , (3.98k)
M (K) 1 := 2D(1 -δ w )(δ z -δ s )(δ w -δ s )F β 3 ; (3.98l) • R (K) 2 := 2(1 -δ w )(δ z -δ s ) (D -K)(1 -δ w ) + K w (1 -δ z -δ w + δ s ) F β 4 , (3.98m)
M (K) 2 := 2D(1 -δ w )(δ z -δ s )(1 -δ z -δ w + δ s )F β 4 ; (3.98n)
where

β 1 = 2K w (D -K w )(1 -δ w )(δ z -δ s ) + K w (K w -1)(1 -δ z )(δ z -δ s ) + 2K s (D -K w )(1 -δ w ) 2 , (3.99a)
β 2 = 2K s K w (1 -δ w )(δ z -δ s ) + K w (K w -1)(δ w -δ s )(δ z -δ s ) + 2K 2 s (1 -δ w ) 2 , (3.99b)
β 3 = 2K w K s (1 -δ w )(δ z -δ s ) + K w (K w -1)(δ w -δ s )(δ z -δ s ) + 2K s (1 -δ w ) K s (δ z -δ w ) + (D -K w )(δ w -δ s ) , (3.99c)
β 4 = 2K w (D -K)(1 -δ w )(δ z -δ s ) + K w (K w -1)(δ z -δ s )(1 -δ z -δ w + δ s ) + 2(1 -δ w ) K s (D -K)(1 -δ w ) + K w K s (1 -δ z ) -K w (D -K w )(δ w -δ s ) . (3.99d)
Theorem 3.3 (Lower Bound on C (K) s (M)).
The upper convex hull of the five ratememory pairs (R (K) , M (K) ) : ∈ {0, . . . , 4} in (3.98) lower bounds the secure capacity-memory tradeoff of the K-receiver channel with K w weak receivers and K s strong receivers with cache memories only at the weak receivers:

C (K) s (M) ≥ upper hull (R (K) , M (K) ), ∈ {0, . . . , 4} . (3.100)
Proof. It suffices to prove the achievability of the six rate-memory pairs {(R , M ) : = 0, . . . , 5}. The achievability of the upper convex hull follows by time/memory sharing arguments as in [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF].

Remark 3.2. When there is no cache, i.e., M = 0, the secure capacity-memory tradeoff C s (M) was determined in [START_REF] Ekrem | Multi-receiver wiretap channel with public and confidential messages[END_REF] as:

C s (M) = K k=1 1 δ z -δ k -1 F, (3.101)
showing the achievability of the pair (R

(K) 0 , M (K) 0 ). Remark 3.3.
For the achievability of (R

(K) 4 , M (K)
4 ), since the strong receivers have no cache memories, the secure capacity-memory tradeoff

C (K) s (M) cannot exceed (δz-δ 2 )F Ks .
It is trivially achieved when the weak receivers can store the entire library in their cache memories, i.e. for M = D (δz-δs)F Ks . Remark 3.4. Since the weak receivers can always choose to ignore parts of their cache memories, the secure capacity-memory tradeoff is monotonically non-decreasing and thus if for some M the maximum (δz-δ 2 )F Ks is achieved, it is also achieved for all M ≥ M:

C s ( M) = (δ z -δ 2 )F K s ⇒ C s (M) = (δ z -δ 2 )F K s , ∀M ≥ M.
The achievability of the remaining rate-memory pairs is outlined in the following subsections.

Scheme achieving rate-memory pair (R

(K) 1 , M (K) 1 ) • If K s (1 -δ z ) -(D -K w )(δ w -δ s ) ≤ 0,
apply the following scheme:

Preparations: Let α 1 , α 2 , α 3 ∈ [0, 1], such that α 1 + α 2 + α 3 = 1. For d ∈ D, split each message into two sub-messages, such that W d = W (0) d , W (1) d , (3.102)
with rates

R (0) = α 2 F (1 -δ w ) K w and R (1) = α 2 F (1 -δ z ) (D -K w ) . (3.103)
Then, split every sub-message W

(1)

d into K w sub-messages W (1)
d = W (1)
d,i : i ∈ K w , (3.104)
of rate R (1) Kw each. If R (0) > (D -K)R (1) /K w , divide every sub-message W (0) d into two further sub- messages, such that W (0) d = W (0,1) d , W (0,2) d , (3.105)
with rates (D -K)R (1) /K w and R (0) -(D -K)R (1) /K w , respectively. Otherwise, W

(0) d has rate R (0) and W (0,2) d has zero rate.

Caching phase: For every weak receiver i ∈ K w , store the cache content

V i = W (1)
d,i : d ∈ {1, . . . , D} . (3.106)
Thus, the cache memory size is

M (K) 1 = D R (1) K w . (3.107)
Delivery phase: The delivery phase is divided into three sub-phases of lengths α 1 n, α 2 n and α 3 n.

In the first sub-phase, the transmitter conveys message W

d i to every weak receiver i ∈ K w by time-sharing over Kw 2 periods. In each period, it sends W (1)

d i 1 ,i 2 ⊕W (1) d i 2 ,i 1 to receivers i 1 and i 2 .
In the second sub-phase, the transmitter conveys message W (0) d i to every weak receiver i ∈ K w and message W

(1) d j to every strong receiver j ∈ K s by time-sharing over K w periods. For each period, it generates a piggyback codebook C with 2 nR (0) • 2 nKsR (1) /Kw subcodebooks C W1 , W2 with one codeword each.

For each period, it chooses a set of indices {j 1 , . . . , j ι } ∈ D \ d, where

ι := max 1, min K w R (0) R (1) , (D -K) , (3.108)
and generates

W XOR,i = W (0,1) d i ⊕ W (1)
d j 1 ,i , . . . , W (1)
d jι ,i . (3.109)
Then, it transmits the codeword of C W1 , W2 for W1 = W XOR,i , W (0,2)

d i and W2 = W (1) d j ,i : j ∈ K s .
In the third sub-phase, the transmitter conveys message W (0) d j to every strong receiver j ∈ K s by time-sharing over K s periods. In each period, it sends W (0) d j to receiver j using a wiretap code.

Analysis: Only the weak receivers decode the first transmission sub-phase. Thus, it is reliably decoded if

Kw 2 R (1) Kw F (1 -δ w ) ≤ α 1 ⇒ Kw-1 2 R (1) F (1 -δ w ) ≤ α 1 . (3.110)
Only the strong receivers decode the third transmission sub-phase. Thus, it is reliably decoded if

K s R (0) F (δ z -δ s ) ≤ α 3 . (3.111)
Every weak receiver i ∈ K w decodes only message W

d i transmitted in the second sub-phase, whereas every strong receiver j ∈ K s decodes all the transmitted messages. Thus, the second sub-phase is reliably decoded whenever max

K w R (0) F (1 -δ w ) , K w R (0) + K s R (1) F (1 -δ s ) ≤ α 2 . (3.112)
Moreover, the messages conveyed in the first sub-phase are secured by the XOR operation and the messages conveyed in the third sub-phase are secured by the random binning. In the second sub-phase, the messages are secure because

(D -K w )R (1) = α 2 (1 -δ z )F .
Maximizing constraints (3.110), (3.111) and (3.112) achieves the rate-memory pair (R

(K) 1 , M (K)
1 ) in (3.98g) and (3.98h), for

α 1 = K w (K w -1)(1 -δ z )(δ z -δ s ) β 1 , (3.113a)
α 2 = 2K w (D -K w )(1 -δ w )(δ z -δ s ) β 1 , (3.113b)
α 3 = 2K s (D -K w )(1 -δ w ) 2 β 1 , (3.113c)
where β 1 is defined in (3.99a).

• Otherwise, if K s (1 -δ z ) -(D -K w )(δ w -δ s ) > 0, apply the following scheme:

Preparations: Let α 1 , α 2 , α 3 ∈ [0, 1], such that α 1 + α 2 + α 3 = 1. Let R = α 2 F K s (1 -δ z ) -(D -K w )(δ w -δ s ) K w K s . (3.114)
The messages are split similarly to the previous case but with a change in the message rates. In this case,

R (0) = α 2 F (1 -δ w ) K w -R and R (1) = α 2 F (δ w -δ s ) K s . (3.115)
Caching phase: The caching phase is also similar to the previous case.

Delivery phase:

The delivery phase is divided into three sub-phases of lengths α 1 n, α 2 n and α 3 n. The first and third sub-phases are similar to the previous case. However, the second one is different.

In the second sub-phase, the transmitter conveys message W (0) d i to every weak receiver i ∈ K w and message W

(1) d j to every strong receiver j ∈ K s by time-sharing over K w periods. For each period, it generates a piggyback codebook C with 2 nR (0) • 2 nKsR (1) /Kw subcodebooks C W1 , W2 . Each subcodebook has 2 nR codewords.

For each period, it chooses a set of indices {j 1 , . . . , j ι } ∈ D \ d, where ι is defined in (3.108), and generates W XOR,i as in (3.109). Then, it picks an index J 1,i uniformly at random from 1 : 2 nR , and transmits the

J 1,i -th codeword of the subcodebook C W1 , W2 , (3.116)
for W1 = W XOR,i , W (0,2)

d i and W2 = W (1)
d j ,i : j ∈ K s . Analysis: Since the first and third sub-phases do not change, the same conditions (3.110) and (3.111) should be satisfied in order to ensure reliable decoding in these phases.

As for the second sub-phase, it is reliably decoded whenever max

K w R (0) + R F (1 -δ w ) , K w R (0) + R + K s R (1) F (1 -δ s ) ≤ α 2 . ( 3
α 1 = K w (K w -1)(δ w -δ s )(δ z -δ s ) β 3 , (3.118a)
α 2 = 2K w K s (1 -δ w )(δ z -δ s ) β 3 , (3.118b
)

α 3 = 2K s (1 -δ w ) K s (δ z -δ w ) + (D -K w )(δ w -δ s ) β 3 , (3.118c)
where β 3 is defined in (3.99c).

3.8.2 Scheme achieving rate-memory pair (R

(K) 2 , M (K)
2 )

• If K s (1 -δ z ) -(D -K w )(δ w -δ s )
≤ 0, apply the same scheme as in the first case of Section 3.8.1 but with a change in the messages rates:

R (0) = α 2 F (1 -δ w ) K w and R (1) = α 2 F (δ w -δ s ) K s . (3.119)
Maximizing the rate achieves the rate-memory pair (R

(K) 2 , M (K)
2 ) in (3.98i) and (3.98j), for

α 1 = K w (K w -1)(δ w -δ s )(δ z -δ s ) β 2 , (3.120a
)

α 2 = 2K s K w (1 -δ w )(δ z -δ s ) β 2 , (3.120b
)

α 3 = 2K 2 s (1 -δ w ) 2 β 2 , (3.120c)
where β 2 is defined in (3.99b).

• Otherwise, if K s (1 -δ z ) -(D -K w )(δ w -δ s ) > 0, apply the following scheme:

Preparations: Let α 1 , α 2 , α 3 ∈ [0, 1], such that α 1 + α 2 + α 3 = 1.
For d ∈ D, split each message into three sub-messages, such that

W d = W (0) d , W (1)
d , W (2) d , (3.121)
with rates

R (0) = α 2 F (1 -δ w ) K w , (3.122a)
R (1) = α 2 F (δ w -δ s ) K s , (3.122b)
R (2) = α 2 F K s (1 -δ z ) -(D -K w )(δ w -δ s ) K s (D -K) . (3.122c)
Then, split every sub-message W

(2)

d into K w sub-messages W (1)
d = W (1)
d,i : i ∈ K w and W

(2)

d = W (2)
d,i : i ∈ K w , (3.123)
of rates R (1) Kw and R (2) Kw , respectively. If R (0) > (D -K)R (1) /K w , divide every sub-message W (0) d into two further submessages, such that

W (0) d = W (0,1) d , W (0,2) d , (3.124)
with rates (D -K)R (1) /K w and R (0) -(D -K)R (1) /K w , respectively. Otherwise, W Caching phase: For every weak receiver i ∈ K w , store the cache content

V i = W (1)
d,i : d ∈ {1, . . . , D} W (2)
d,i : d ∈ {1, . . . , D} .

(3.125) Thus, the cache memory size is

M (K) 2 = D R (1) + R (2) K w . ( 3

.126)

Delivery phase: The delivery phase is divided into three sub-phases of lengths α 1 n, α 2 n and α 3 n.

(1)

d i and W (2)
d i to every weak receiver i ∈ K w by time-sharing over Kw 2 periods. In each period, it sends W (1)

d i 1 ,i 2 ⊕ W (1)
d i 2 ,i 1 and W (2) d i 1 ,i 2 ⊕ W (2) d i 2 ,i 1 to receivers i 1 and i 2 .
In the second sub-phase, the transmitter conveys message W (0) d i to every weak receiver i ∈ K w and message W

(1) d j to every strong receiver j ∈ K s by time-sharing over K w periods. For each period, it generates a piggyback codebook C with 2 nKsR (1) /Kw subcodebooks C W with 2 nR (0) codewords each.

For each period, it chooses a set of indices {j 1 , . . . , j ι } ∈ D \ d, where

ι := max 1, min K w R (0) R (1) + R (2) , (D -K) , (3.127)
and generates

W XOR,i = W (0,1) d i ⊕ W (1)
d j 1 ,i , . . . , W (1)
d jι ,i , W (2)
d j 1 ,i , . . . , W (2)
d jι ,i . (3.128) Then, it generates W i = W XOR,i , W (0,2) d i
and transmits the W i -th codeword of the subcodebook C W , with W = W

(1)

d j ,i : j ∈ K s .
In the third sub-phase, the transmitter conveys messages W (0)

d j and W (2)
d j to every strong receiver j ∈ K s by time-sharing over K s periods. In each period, it sends W (0) d j and W

(2) d j to receiver j using a wiretap code without secret key. Analysis: Only the weak receivers decode the first transmission sub-phase. Thus, it is reliably decoded if

Kw 2 R (1) +R (2) Kw F (1 -δ w ) ≤ α 1 ⇒ Kw-1 2 R (1) + R (2) F (1 -δ w ) ≤ α 1 . (3.129)
Only the strong receivers decode the third transmission sub-phase. Thus, it is reliably decoded if

K s R (0) + R (2) F (δ z -δ s ) ≤ α 3 . (3.130)
Every weak receiver i ∈ K w decodes only message W (0) d i transmitted in the second sub-phase, whereas every strong receiver j ∈ K s decodes all the transmitted messages. Thus, the second sub-phase is reliably decoded whenever max 2 ) in (3.98m) and (3.98n), for

K w R (0) F (1 -δ w ) , K w R (0) + K s R (1) F (1 -δ s ) ≤ α 2 . ( 3
α 1 = K w (K w -1)(δ z -δ s )(1 -δ z -δ w + δ s ) β 4 , (3.132a
)

α 2 = 2K w (D -K)(1 -δ w )(δ z -δ s ) β 4 , (3.132b
)

α 3 = 2(1 -δ w ) K s (D -K)(1 -δ w ) + K w K s (1 -δ z ) -K w (D -K w )(δ w -δ s ) β 4 , (3.132c)
where β 4 is defined in (3.99d).

3.8.3 Scheme achieving rate-memory pair (R

(K) 3 , M (K)
3 )

Preparations: Let α ∈ [0, 1]. For d ∈ D, split each message into two sub-messages, such that W d = W (0) d , W (1) d , (3.133)
with rates

R (0) = αF (1 -δ z ) K w and R (1) = αF (δ z -δ s ) K s . (3.134)
Caching phase: For every weak receiver i ∈ K w , store the D-tuple W

1 , . . . , W

D . Thus, the cache memory size is

M (K) 3
= DR (1) .

(3.135)

Delivery phase: The delivery phase is divided into two sub-phases of lengths αn and (1 -α)n.

In the first sub-phase, the transmitter conveys message W (0) d i to every weak receiver i ∈ K w and message W

(1) d j to every strong receiver j ∈ K s following a similar scheme as the second sub-phase in Section 3.8.2.

In the second sub-phase, the transmitter conveys message W (0) d j to every strong receiver j ∈ K s by time sharing over K s periods. In each period, it sends W (0) d j to receiver j using a wiretap code. Analysis: Every weak receiver i ∈ K w decodes reliably its message W (0) d i conveyed in the first transmission sub-phase since R (0) rate is smaller than its channel capacity.

Strong receivers also decode reliably the first transmission sub-phase. They decode the second transmission sub-phase reliably whenever

R (0) = α(1 -δ z )F K w ≤ (1 -α)(δ z -δ s )F K s , (3.136)
which is maximized for

α = K w (δ z -δ s ) K w (δ z -δ s ) + K s (1 -δ z ) , (3.137)
giving the rate-memory pair (R

(K) 3 , M (K)
3 ) in (3.98c) and (3.98d).

General upper bound on the secure capacity-memory tradeoff

In this section, we provide the upper bound on the secure capacity-memory tradeoff of the more general setup with K w weak receivers and K s strong receivers where the K w weak receivers have cache memories of size M. This upper bound is stated in the following theorem: s (M) of the K-receiver channel with K w weak receivers and K s strong receivers with cache memories only at the weak receivers is upper bounded by the following K w + 2 conditions:

C (K) s (M) ≤ F (δ z -δ w ) + M, (3.138a)
C (K) s (M) ≤ F δ z -δ s K s , (3.138b)
C (K) s (M) ≤ F i 1 -δ w + K s 1 -δ s -1 + iM D , i ∈ {1, . . . , K w }. (3.138c)
Proof. The proof of constraint (3.138a) is similar to that of (3.62a) in Section 3.3.

(3.138b) holds because strong receivers have no cache and their capacity cannot be larger than in the absence of weak receivers. Constraint (3.138a) follows from [9, Theorem 9] by ignoring the secrecy constraint.

Examples

We illustrate in Figure 3.12 and 3.13 the lower and upper bounds derived for the general setup assuming a total of K = 20 users, a library size D = 30 and different channel parameters.

Conclusion

In this chapter, we have derived lower and upper bounds on the securely achievable capacity-memory tradeoff of the two-user wiretap packet-erasure BC where the weaker receiver has a cache memory and where the eavesdropper is not allowed to learn any information about each of the delivered messages individually. The corresponding lower and upper bounds on the secure capacity-memory tradeoff are close for most scenarios and coincide when the weak receiver's cache memory exceeds a certain size. We have thus established the exact secure capacity-memory tradeoff for cache memory sizes above this threshold.

The lower bound under our secrecy constraint exhibits that cache memories provide larger gains than in the standard scenario without any secrecy constraints [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF]. The reason being that the cache content can not only help to improve the communication rate, but also to make it more secure, for example, by means of a one-time pad.

For comparison, we have derived the lower bound on the secure capacity-memory tradeoff obtained by the best separate cache-channel coding scheme. We have found that the benefits of the cache memories are much more important when applying a joint cache-channel coding scheme that simultaneously leverages on the cache contents and the channel statistics.

Moreover, we have presented lower and upper bounds on the secure capacity-memory tradeoff when both receivers have cache memories of equal size. These bounds show that for a large range of parameters, the capacity-memory tradeoff is larger when all the cache memory is allocated to the weaker receiver instead of allocating half of it to each receiver. However, in contrast to the scenario without secrecy constraint, there exist situations where one receiver is weaker, but it is still better to allocate the cache memory symmetrically. The reason seems to be that a receiver can benefit from the cache memory at another receiver to increase its transmission rate, but it can only exploit its own cache memory to make it secure.

Finally, we have also computed the generalized lower and upper bounds for the general K-user scenario.

Chapter 4 Joint Secrecy in Caching Scenario

In this chapter, we consider the same cache-aided wiretap erasure BC as Chapter 3 under a joint secrecy constraint. We establish lower and upper bounds on the securely achievable capacity-memory tradeoff. To obtain the lower bound, we propose four different secure coding schemes that build on sophisticatedly combining wiretap coding, superposition coding and piggyback coding with random secret keys. Those keys are independent of all the data and are stored in the receivers' caches. The necessity for secret keys stems from the joint-secrecy constraint and had already been observed in [START_REF] Sengupta | Fundamental limits of caching with secure delivery[END_REF][START_REF] Ravindrakumar | Fundamental limits of secretive coded caching[END_REF]. In such setups, the eavesdropper has no access to cache memories and is not allowed to learn anything about the set of all possible receivers' messages. In the previous chapter, we were able to use cached data as "secret keys" because only an individual secrecy-constraint had to be satisfied.

For the remaining of the chapter, we start by deriving our bounds and describing our coding schemes for the case of K = 2 users. We compare these bounds with the ones derived in Chapter 3 with the individual secrecy constraint. We also derive the lower and upper bounds on the secure capacity-memory tradeoff for the two-user scenario under a joint secrecy constraint with symmetric cache assignment and with asymmetric two-sided cache assignment. We compare these bounds with our scheme and determine the impact of the cache distribution on the secure capacity. Finally, we generalize our results for the K-user scenario.

Problem definition

We consider the same channel model described in Section 3.1 with a stronger joint secrecy constraint, i.e. we assume that the communication is secure if the eavesdropper does not learn any information about the library messages from its outputs Z n :

lim n→∞ 1 n I(W 1 , . . . , W D ; Z n ) < . (4.1)
In order to satisfy this secrecy constraint, the transmitter is given access to a source of randomness θ in addition to its access to the message library. θ is defined over some alphabet Θ. As a result, the caching and encoding functions are changed accordingly.

The caching content V i at each weak receiver i ∈ K w becomes

V i := g i (W 1 , . . . , W D , θ), i ∈ K w (4.2)
for some caching function

g i : 1, . . . , 2 nRs D × Θ → V. (4.3)
The transmitter will produce its channel inputs as

X n := f d (W 1 , . . . , W D , θ), (4.4)
for some encoding function

f d : 1, . . . , 2 nRs D × Θ → X n . (4.5)
Finally, the securely achievable rate-memory pairs are defined as follows. 4.2 Lower bound on the secure capacity-memory tradeoff under one-sided cache assignment for the two-user scenario

In this section, we consider only one weak and one strong receiver with erasure probabilities δ 1 and δ 2 , respectively. We give the lower bound on the secure capacity-memory tradeoff C s (M) as defined in Definition 3.3 and prove its achievability.

Consider the six rate-memory pairs:

• R 0 := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F, (4.7a)
M 0 := 0; (4.7b)

• R 1 := (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, (4.7c
) Proof. It suffices to prove the achievability of the six rate-memory pairs {(R , M ) : = 0, . . . , 5}. The achievability of the upper convex hull follows by time/memory sharing arguments as in [START_REF] Maddah-Ali | Fundamental limits of caching[END_REF].

M 1 := (1 -δ z )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F ; (4.7d) • R 2 := (1 -δ 2 ) min δ z -δ 1 1 -δ 1 , 1 -δ 1 2 -δ 1 -δ 2 F, (4.7e)
M 2 := (1 -δ z )F ; (4.7f) • R 3 := (1 -δ 2 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, (4.7g)
M 3 := (δ z -δ 2 ) (δ 1 -δ 2 )D + (1 -δ z ) 1 + δ z -δ 1 -δ 2 F ; (4.7h) • R 4 := (δ z -δ 2 )F, (4.7i)
M 4 := (δ z -δ 2 ) (δ z -δ 2 )D + (1 -δ z ) 1 -δ 2 F ; (4.7j) • R 5 := (δ z -δ 2 )F, (4.7k)
The achievability of the pairs (R 0 , M 0 ) and (R 5 , M 5 ) follows from Remarks 3.2 and 3.3, respectively.

The achievability of the remaining rate-memory pairs is outlined in the next subsections.

Remark 4.1. For all M ≥ M 5 , the securely achievable capacity is C s (M) = R 5 . This can be deduced from Remark 3.4.

Scheme achieving rate-memory pair

(R 1 , M 1 ) Preparations: Let α ∈ [0, 1]. Generate a random key K 1 of rate α(1 -δ z )F .
Caching phase: Store K 1 in receiver 1's cache memory. Thus, the cache memory size is

M 1 = α(1 -δ z )F.
(4.9)

Delivery phase: The delivery phase is divided into two periods of lengths αn and (1-α)n.

In the first period, the transmitter sends W d 1 to receiver 1 using a wiretap code with secret key K 1 [START_REF] Yamamoto | Rate-distortion theory for the Shannon cipher system[END_REF], [11, (22.7)]. In the second period, the transmitter sends W d 2 to receiver 2 using a wiretap code without secret key.

Analysis: Receiver 1 decodes message W d 1 sent in the first transmission period. The total decoded rate should not exceed its capacity, hence

R 1 ≤ α(1 -δ 1 )F. (4.10)
Receiver 2 decodes W d 2 conveyed in the second transmission period. It can reliably decode its message if its rate satisfies,

R 1 ≤ (1 -α)(δ z -δ 2 )F. (4.11)
Thus, R 1 is maximized when (4.10) and (4.11) are equal. The equality is obtained when

α = δ z -δ 2 1 + δ z -δ 1 -δ 2 . (4.12)
Replacing α by its value in (4.10) and (4.9) gives the rate-memory pair (R 1 , M 1 ) in (4.7c) and (4.7d).

Moreover, considering a key's rate larger than the channel capacity at the eavesdropper guarantees the security of the transmitted message.

W d = W (0) d , W ⊕ d , with rates R (0) = α(1 -δ 1 )F , R ⊕ = (1 -α)(1 -δ z )F , respectively.
Then, generate two random keys K 1 and K 2 of rates α(1 -δ z )F and (1 -α)(1 -δ z )F .

Caching phase: Store K 1 and K 2 in receiver 1's cache. Thus, the cache memory size is

M 2 = (1 -δ z )F. (4.13)
Delivery phase: The delivery phase is divided into two periods of lengths αn and (1-α)n.

In the first period, the transmitter sends message W (0) d 1 to receiver 1 using a wiretap code with secret key K 1 .

For the communication in the second period, generate a superposition codebook with a cloud center that contains 2 n(1-α)(1-δz)F codewords, and with each of the satellite codebooks containing 2 nR 2 codewords. The transmitter encodes W ⊕ d 1 ⊕ K 2 into the cloud center and W d 2 into the satellite.

Analysis: Receiver 1 decodes the first transmission period and only message W ⊕ d 1 ⊕ K 2 from the second one. Hence, receiver 1 decodes reliably its messages whenever

R 2 ≤ α(1 -δ 1 )F + (1 -α)(1 -δ 1 )F × (1 -γ).
(4.14)

Receiver 2 decodes only the second transmission period. It decodes reliably its messages whenever

R 2 ≤ (1 -α)(1 -δ 2 )F × γ. (4.15)
From the second transmission period, receiver 1 decodes only message

W ⊕ d 1 ⊕ K 2 from the cloud center, thus R ⊕ should satisfy R ⊕ = (1 -α)(1 -δ z )F ≤ (1 -α)(1 -δ 1 )F × (1 -γ).
(4.16)

Equality in (4. [START_REF] Shor | Algorithms for quantum computation: discrete logarithms and factoring[END_REF]) is obtained for

γ = δ z -δ 1 1 -δ 1 . (4.17)
For this γ value, conditions (4.14) and (4.15) become

R 2 ≤ α(1 -δ 1 ) + (1 -α)(1 -δ z )F, (4.18a) R 2 ≤ (1 -α) (δ z -δ 1 )(1 -δ 2 ) 1 -δ 1 F. (4.18b) If (1 -δ z )(1 -δ 1 ) ≤ (1 -δ 2 )(δ z -δ 1 )
, equality of (4.18a) and (4.18b) is achieved for

α = (1 -δ 2 )(δ z -δ 1 ) -(1 -δ z )(1 -δ 1 ) (δ z -δ 1 )(2 -δ 1 -δ 2 ) , (4.19)
yielding a rate

R 2 = (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F. (4.20)
Otherwise, (4.18b) gives a smaller R 2 than (4.18a) ∀ α ∈ [0, 1] and the maximal rate, achieved for α = 0, is

R 2 = F (δ z -δ 1 )(1 -δ 2 ) 1 -δ 1 . (4.21)
Secrecy of the proposed scheme can be proved by following the steps in Section 3.2.8, where in the proof of Lemma 3.1 we use the fact that the entire superposition codebook contains 2 n(1-α)(1-δz)F codewords that are compatible with a given satellite message

W d 2 .
Combining (4.13), (4.20) and (4.21) gives the desired rate-memory pair (R 2 , M 2 ) in (4.7e) and (4.7f).

Scheme achieving rate-memory pair

(R 3 , M 3 ) Preparations: Let α ∈ [0, 1]. For d ∈ D, split each message W d into three sub-messages, such that W d = W (0) d , W (1)
d , W ⊕ d , (4.22)
with rates

R (0) = α(δ z -δ 1 )F , R (1) = α(δ 1 -δ 2 )F and R ⊕ = α(1 -δ z )F , respectively.
Then, generate a random key K 1 of rate α(1 -δ z )F .

Generate a piggyback codebook C 1 with Γ 1 := 2 nα(1-δz)F • 2 nα(δz-δ 1 )F • 2 nα(δ 1 -δ 2 )F codewords of length αn,

C 1 := X (αn) 1 (l 1 ) Γ 1 l 1 =1 , (4.23)
by drawing each entry of each codeword at random according to a Bernoulli-1/2 distribution independently of all the other entries.

The codebook is partitioned into 2 nα(δz-δ 1 )F • 2 nα(δ 1 -δ 2 )F subcodebooks (bins) each with 2 nα(1-δz)F codewords. The subcodebooks are arranged into an array with 2 nα(δz-δ 1 )F rows and 2 nα(δ 1 -δ 2 )F columns.

Caching phase: Store K 1 and the D-tuple W

D in receiver 1's cache. Thus, the cache memory size is

M 3 = α(1 -δ z )F + D • α(δ 1 -δ 2 )F. (4.24)
Delivery phase: The delivery phase is divided into two periods of lengths αn and (1-α)n.

In the first period, the transmitter conveys messages W

d 1 , W (1)
d 2 ) over the channel. In the second period, it sends message

W (0),⊕ d 2 = [W (0) d 2 , W ⊕ d 2 ]
to receiver 2 using a wiretap code without secret key.

Decoding at receiver 1: Receiver 1 retrieves message W

d 2 from its cache memory, and considers its outputs y αn 1 from the first period. It looks for a unique index-pair ( ŵXOR , ŵ(0) d 1 ) ∈ 1 : 2 nα(1-δz)F × 1 : 2 nα(δz-δ 1 )F so that the ŵXOR -th codeword in subcodebook C 1 ( ŵ(0)

d 1 , W (1)
d 2 ), which we denote by x

(αn) 1 ŵXOR , ŵ(0) d 1 , W (1)
d 2 , is jointly typical with its observed outputs:

x (αn) 1 ŵXOR , ŵ(0) d 1 , W (1)
d 2 , y αn 1 ∈ T (αn) p X • p Y 1 |X , (4.25)
where p X stands for the Bernoulli-1/2 distribution, p Y 1 |X the channel law to receiver 1, and T (αn) the typical set [START_REF] Gamal | Network information theory[END_REF].

If the desired unique pair of indexes ( ŵXOR , ŵ(0) d 1 ) does not exist, receiver 1 declares an error. Otherwise, if the pair exists, receiver 1 retrieves the key K 1 from its cache memory and generates ŵ⊕

d 1 = ŵXOR ⊕ K 1 . (4.26)
It finally retrieves W

d 1 from its cache memory and declares the tuple

ŵ1 = ŵ⊕ d 1 , ŵ(0) d 1 , W (1)
d 2 ) so that

x (αn) 1 ŵXOR , ŵ(0) d 1 , ŵ(1) d 2 , y αn 2 ∈ T (αn) p X • p Y 2 |X . (4.28)
Then, it looks for a unique pair ( ŵ(0),⊕

d 2 , l) such that x ((1-α)n) 2 ŵ(0),⊕ d 2 , l , y (1-α)n 2 ∈ T ((1-α)n) p X • p Y 2 |X . ( 4
R (0) + R ⊕ = R 3 -R (1) ≤ α(1 -δ 1 )F ⇒ R 3 ≤ α(1 -δ 2 )F. ( 4
C s (M) ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + δ z -δ 2 2δ z -δ 1 -δ 2 M, (4.37a)
C s (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D , (4.37b)
C s (M) ≤ (δ z -δ 2 )F. ( 4
nR s = H(W d 1 ) = H(W d 1 |Z n ) + I(W d 1 ; Z n ) ≤ H(W d 1 |Z n ) + n 2 ≤ I(W d 1 ; Y n 1 , V 1 ) -I(W d 1 ; Z n ) + H(W d 1 |Y n 1 , V 1 ) + n 2 ≤ I(W d 1 ; Y n 1 , V 1 ) -I(W d 1 ; Z n ) + n ≤ I(W d 1 ; Y n 1 |V 1 ) -I(W d 1 ; Z n |V 1 ) + I(W d 1 ; V 1 |Z n ) + n (a) = n i=1 I(W d 1 ; Y 1,i |V 1 , Y i-1 1 , Z n i+1 ) -I(W d 1 ; Z i |V 1 , Y i-1 1 , Z n i+1 ) + I(W d 1 ; V 1 |Z n ) + n (b) ≤ n i=1 I(W d 1 ; Y 1,i |V 1 , Y i-1 1 , Z n i+1 ) -I(W d 1 ; Z i |V 1 , Y i-1 1 , Z n i+1 ) + n i=1 I(V 1 , Y i-1 1 , Z n i+1 ; Y 1,i ) -I(V 1 , Y i-1 1 , Z n i+1 ; Z i ) + I(W d 1 ; V 1 |Z n ) + n (c) ≤ n i=1 I(W d 1 , V 1 , Y i-1 1 , Z n i+1 ; Y 1,i ) -I(W d 1 , V 1 , Y i-1 1 , Z n i+1 ; Z i ) + I(W d 1 ; V 1 |Z n ) + n + n i=1 I(Y i-1 2 ; Y 1,i |W d 1 , V 1 , Y i-1 1 , Z n i+1 ) -I(Y i-1 2 ; Z i |W d 1 , V 1 , Y i-1 1 , Z n i+1 ) (d) ≤ n i=1 I(W d 1 , V 1 , Y i-1 1 , Y i-1 2 , Z n i+1 ; Y 1,i ) -I(W d 1 , V 1 , Y i-1 1 , Y i-1 2 , Z n i+1 ; Z i ) + nM + n (e) ≤ n i=1 I(W d 1 , V 1 , Y i-1 2 , Z n i+1 ; Y 1,i ) -I(W d 1 , V 1 , Y i-1 2 , Z n i+1 ; Z i ) + nM + n , (4.39)
where (a) follows by the chain rule of mutual information and by applying Csiszar's sum-identity [11, p. 25]; (b) and (c) hold because the eavesdropper is degraded with respect to receiver 1 and thus, for each i ∈ {1, . . . , n}:

I(V 1 , Y i-1 1 , Z n i+1 ; Y 1,i ) -I(V 1 , Y i-1 1 , Z n i+1 ; Z i ) ≥ 0; and I(Y i-1 2 ; Y 1,i |W d 1 , V 1 , Y i-1 1 , Z n i+1 ) -I(Y i-1 2 ; Z i |W d 1 , V 1 , Y i-1 1 , Z n i+1 ) ≥ 0; (d) holds because I(W d 1 ; V 1 |Z n ) is
limited by the entropy of V 1 which cannot exceed nM; and finally (e) holds because receiver 1 is degraded with respect to receiver 2 and thus the following Markov chain holds:

(V 1 , W d 1 , Z n i+1 , Y 1,i , Z i ) → Y i-1 2 → Y i-1 1 .
Let Q be a random variable uniform over {1, . . . , n} and independent of all previously defined random variables. We define the random variables

Y 1 := Y 1,Q , (4.40)
Z := Z Q , (4.41)
U 1 := (W d 1 , V 1 , Y Q-1 2 , Z n Q+1 ). ( 4

.42)

Dividing by n, we can rewrite constraint (4.39) as

R s ≤ I(U 1 ; Y 1 |Q) -I(U 1 ; Z|Q) + M + n n . (4.43)
Accounting for receiver 2, we derive in a similar way:

2nR s = H(W d 1 , W d 2 ) = H(W d 1 , W d 2 |Z n ) + I(W d 1 , W d 2 ; Z n ) Sarah Kamel
where (a) follows by the chain rule of mutual information and by applying Csiszar's sum-identity; (b) hold because the eavesdropper is degraded with respect to receiver 2; and (c) follows from the Markov chain:

W d 2 → X i → (Y 2,i , Z i ). (4.48)
We define then the random variables:

X := X Q , (4.49)
Y 2 := Y 2,Q . ( 4
≤ I(U 1 ; Y 1 |Q) -I(U 1 ; Z|Q) + M = I(U 1 , X; Y 1 |Q) -I(X; Y 1 |U 1 , Q) -I(U 1 , X; Z|Q) + I(X; Z|U 1 , Q) + M (a) = I(X; Y 1 |Q) -I(X; Y 1 |U 1 , Q) -I(X; Z|Q) + I(X; Z|U 1 , Q) + M = (δ z -δ 1 ) H(X|Q) -H(X|U 1 , Q) + M (a) = (δ z -δ 1 )(β -α) + M, (4.52)
where (a) holds because of the Markov chain U 1 → X → (Z, Y 1 ) and (b) follows by defining 4.4 Lower bound on the secure capacity-memory tradeoff under symmetric cache assignment for the two-user scenario bound on C s,Sym (M) when each receiver has a cache memory of size M/2.

α := H(X|U 1 , Q) and β := H(X|Q), such that 0 ≤ β ≤ α ≤ F . R s ≤ 1 2 I(U 1 ; Y 1 |Q) -I(U 1 ; Z|Q) + I(X; Y 2 |Q, U 1 ) -I(X; Z|Q, U 1 ) + M ≤ 1 2 (δ z -δ 1 ) H(X|Q) -H(X|U 1 , Q) + (δ z -δ 2 )H(X|U 1 , Q) + M = 1 2 (δ z -δ 1 )(β -α) + (δ z -δ 2 )α + M . ( 4
Consider the three rate-memory pairs:

• R 0,Sym := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F, (4.54a)
M 0,Sym := 0; (4.54b) Proof. As in proof of Theorem 4.1, it suffices to prove the achievability of the three ratememory pairs {(R , M ) : = 0, 1, 2}. At M 0,Sym , R 0,Sym = R 0 since there is no cache. We prove the achievability of the two remaining points in the following subsections.

• R 1,Sym := (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F, (4.54c) M 1,Sym := 2(1 -δ z )(1 -δ 2 ) 2 -δ 1 -δ 2 F ; (4.54d) • R 2,Sym := min 2(1 -δ 1 )F, (1 -δ 2 )F , (4.54e) M 2,Sym := min 2 (1 -δ z ) + D(1 -δ 1 ) F, 2(1 -δ 2 ) 2(1 -δ z ) + D(1 -δ 2 ) 2(1 -δ 1 ) + (1 -δ 2 ) F . (4.54f)
Remark 4.2. Since both receivers can store messages in their cache memories, an increase of M in cache memory size implies at least an increase of M 2D in the achievable rate. Hence, Caching phase: Store K 1 in receiver 1's cache memory and K 2 in receiver 2's cache memory. Thus, the total cache memory size is

if (R s , M) is achievable ⇒ R s + M -M 2D , M is achievable. Therefore, for M > M 2,Sym , R Sym = R 2,Sym + M -M 2,Sym 2D . ( 4
M 1,Sym = 2α(1 -δ z )F. ( 4

.57)

Delivery phase: The delivery phase is divided into two periods of lengths αn and (1-α)n.

In the first period, the transmitter sends W d 1 to receiver 1 using a wiretap code with secret key K 1 and in the second period, it sends W d 2 to receiver 2 using a wiretap code with secret key K 2 .

Analysis: Both receivers reliably decode their messages whenever

R 1,Sym ≤ α(1 -δ 1 )F, (4.58a) R 1,Sym ≤ (1 -α)(1 -δ 2 )F. (4.58b)
Thus, R 1,Sym is maximized and the rate-memory pair (R 1,Sym , M 1,Sym ) in (4.54c) and (4.54d) is obtained when

α = 1 -δ 2 2 -δ 1 -δ 2 . ( 4
W d = W (0) d , W (1)
d , W

, with rates R (0) , R (1) 2 and R (1) 2 , respectively.

Moreover, generate three random keys K 1 , K 2 and K 3 of rates α

1 (1 -δ z )F , α 1 (1 -δ z )F and (1 -α 1 -α 2 )(1 -δ z )F , respectively.
Caching phase: Store K 1 , K 3 and the D-tuple W

1 , . . . , W

D in receiver 1's cache and K 2 , K 3 and the D-tuple W

D in receiver 2's cache. Hence, the total cache memory size is M 2,Sym = 2(1 -α 2 )(1 -δ z )F + DR (1) . (4.60)

Delivery phase: The delivery phase is divided into three periods of lengths α 1 n, α 2 n and (1 -α 1 -α 2 )n. In the first period, the transmitter conveys message W (0) d 1 to receiver 1 using a wiretap code with secret key K 1 . In the second period, it conveys message W (0) d 2 to receiver 2 using a wiretap code with secret key K 2 . In the third period, it sends W

(2)

d 1 ⊕ W (1)
d 2 using a wiretap code with secret key K 3 .

Analysis: Receiver 1 decodes periods 1 and 3 and receiver 2 decodes periods 2 and 3. Periods 1 and 2 are decoded reliably if

R (0) = min α 1 (1 -δ 1 ), α 2 (1 -δ 2 ) F, (4.61)
which is maximized for

α 2 = 1 -δ 1 1 -δ 2 α 1 . (4.62)
The third period is reliably decoded whenever

R (1) 2 = min (1 -α 1 -α 2 )(1 -δ 1 ), (1 -α 1 -α 2 )(1 -δ 2 ) F = (1 -α 1 -α 2 )(1 -δ 1 )F. ( 4.63)
The maximal rate in (4.54e) is obtained for

α 1 = max 0, (1 -δ 2 ) 2(1 -δ 1 ) -(1 -δ 2 ) (1 -δ 1 ) 2(1 -δ 1 ) + (1 -δ 2 ) . ( 4
C s,Sym (M) ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + M 2 , (4.65a) C s,Sym (M) ≤ (1 -δ 1 )F + M 2D , (4.65b) C s,Sym (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D . ( 4

.65c)

Proof. Constraint (4.65a) is obtained following the same steps as in the proof of (4.37a). Constraints (4.65b) and (4.65c) follow from [START_REF] Saeedi Bidokhti | Noisy broadcast networks with receiver caching[END_REF] by ignoring the secrecy constraint.

4.6 Lower bound on the secure capacity-memory tradeoff under two-sided asymmetric cache assignment for the two-user scenario

In this section, we study a cache distribution between the one-sided cache assignment and the symmetric cache distribution. We consider the same two-user wiretap BC model with a total cache memory M. Receiver 1 and 2 have access to a cache memory of size M R 1 and M R 2 , respectively, such that M R 1 + M R 2 = M. We choose the cache memories M R 1 and M R 2 based on the channel statistics of both users. We compute the lower and upper bounds on the secure capacity-memory tradeoff C s,Asym (M) for this cache distribution.

Consider the five rate-memory pairs:

• R 0,Asym := (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F, (4.66a)
M 0,Asym := 0; (4.66b) Proof. As in proof of Theorem 4.1, it suffices to prove the achievability of the five ratememory pairs {(R , M ) : = 0, . . . , 4}. At M 0,Asym , R 0,Asym = R 0 since there is no cache. (R 1,Asym , M 1,Asym ) is similar to the first pair (R 1 , M 1 ) of Section 4.2 since it is obtained by taking M R 1 = M and M R 2 = 0 and following the same analysis.

• R 1,Asym := (1 -δ 1 )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F, (4.66c) M 1,Asym := (1 -δ z )(δ z -δ 2 ) 1 + δ z -δ 1 -δ 2 F ; (4.66d) • R 2,Asym := (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F, (4.66e)
M 2,Asym := (1 -δ z )F ; (4.66f) • R 3,Asym := (1 -δ 2 ) 2 2 -δ 1 -δ 2 F, (4.66g)
M 3,Asym := (1 -δ z ) + D(1 -δ 2 )(δ 1 -δ 2 ) 2 -δ 1 -δ 2 F ; (4.66h) • R 4,Asym := (2δ z -δ 1 -δ 2 ) + 1 -δ z 2 F, (4.66i) M 4,Asym := D(2δ z -δ 1 -δ 2 ) + (1 -δ z ) F ; ( 4
We prove the achievability of the remaining points in the following subsections.

Preparations: Let α ∈ [0, 1]. Generate two random keys K 1 and K 2 of rates α(1 -δ z )F and (1 -α)(1 -δ z )F , respectively.
Caching phase: Store K 1 in the cache memory of receiver 1 and K 2 in the cache of receiver 2. Thus, the total cache memory size is

M 2,Asym = (1 -δ z )F.
Delivery phase: The delivery phase is divided into two periods of lengths αn and (1-α)n, respectively. In the first period, the transmitter conveys message W d 1 to receiver 1 using wiretap code with secret key K 1 . In the second period, it conveys message W d 2 to receiver 2 using wiretap code with secret key K 2 .

Analysis: Both receivers decode reliably whenever

R 2,Asym ≤ α(1 -δ 1 )F, (4.68a) R 2,Asym ≤ (1 -α)(1 -δ 2 )F. ( 4

.68b)

The maximal rate in (4.66e) is obtained for

α = 1 -δ 2 2 -δ 1 -δ 2 . ( 4
D in receiver 1's cache. Moreover, we store K 2 and the D-tuple W (0) 1 , . . . , W (0) D in receiver 2's cache. Thus, the total cache memory size is

M 4,Asym = (1 -δ z )F + D(2δ z -δ 1 -δ 2 )F. ( 4
W XOR = W ⊕ d 1 ⊕ K 1 , W ⊕ d 2 ⊕ K 2 ,
and transmits the W XOR -th codeword of the subcodebook C 1 (W (0)

d 1 , W (1)
d 2 ) over the channel.

Analysis: Receiver 1 reliably decodes messages W XOR and W (0) From Theorem 4.2, upper bound (4.37a) is tight when the cache memory is small and upper bound (4.37c) is tight when the cache memory is sufficiently large. From Theorems 4.1 and 4.2, we can see that our lower and upper bounds coincide for small and large cache memory regimes.

C s,Asym (M) ≤ (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + δ z -δ 2 2δ z -δ 1 -δ 2 M, (4.77a)
C s,Asym (M) ≤ 1 2 (δ z -δ 2 )F + M 2 , (4.77b) C s,Asym (M) ≤ (1 -δ 1 )(1 -δ 2 ) 2 -δ 1 -δ 2 F + M D , (4.77c)
C s,Asym (M) ≤ (2 -δ 1 -δ 2 ) 2 F + M 2D . ( 4
Corollary 4.1. When the cache memory is small:

C s (M) = (δ z -δ 1 )(δ z -δ 2 ) 2δ z -δ 1 -δ 2 F + δ z -δ 2 2δ z -δ 1 -δ 2 M, 0 ≤ M ≤ M 1 , (4.78)
where M 1 is defined in (4.7d).

Corollary 4.2. When the cache memory is large:

C s (M) = (δ z -δ 2 )F, M ≥ M 4 , (4.79)
where M 4 is defined in (4.7j). We observe from Corollary 4.1 and Figure 4.1 that for small cache memories, the rate-memory pairs (R 0 , M 0 ), (R 1 , M 1 ), and (R 2 , M 2 ) determine the performance of our lower bound in Theorem 4.1. The first point takes no cache memories. We achieve the other two points by storing only random keys in the cache memory, but no data. We thus conclude that for small cache memories it is not worth caching data, but only secret keys. The reason is that each piece of data will be useful for only a subset of all possible user demands, whereas a secret key serves with any demand. This also explains why in the regime of small M, the secure capacity-memory tradeoff C s (M) can grow as a factor times M, irrespective of the library size D. For larger values of M, it grows at most like M/D. 4.2 shows that the upper bound on the capacity-memory tradeoff under an individual secrecy constraint is higher only for small cache memory regime and it coincides with the one under a joint constraint for large cache memories. This is trivial because in our upper bound's proof, we neglected the secrecy constraints for large cache memories.

Impact of the joint secrecy constraint

We also observe that the lower bound under an individual secrecy constraint is higher than under a joint constraint for all parameters of M. Therefore, we conclude that the additional security imposes loss in the transmission rate. By comparing Theorems 4.1 and 4.2 with Propositions 4.1 and 4.2, we observe that in the regime of small cache memory, our coding scheme for cache only at the weak receiver has a slope, namely δz-δs 2δz-δw-δs , much steeper than the best possible coding scheme assuming that each receiver has the same cache memory size M 2 . In fact, by (4.65), the capacity in the latter case is upper bounded by 1 2 . So, for small cache memory regime, allocating all the cache memory to the weaker receiver results in a significantly higher performance than allocating the available cache memory equally between the two receivers.

We now compare Theorems 4.1 and 4.2 with Propositions 4.3 and 4.4. For the twosided asymmetric cache assignment, the upper bound on C s,Asym (M) coincides with that of C s (M) in the one-sided cache assignment case for

M ≤ (1 -δ 2 )(δ z -δ 2 ) -(1 -δ 1 )(1 -δ z ) 2 -δ 1 -δ 2 F.
However, the lower bound C s,Asym (M) is better for the two-sided asymmetric cache assignment when storing only keys in the strong receiver's cache memory. This indicates that for the wiretap BC scenario, it is better to allocate a small cache memory even to the strong receiver to secure its communication. This is in contrast to the scenario without secrecy where no gain can be obtained from assigning cache memories to strong receiver.

For large cache memories, depending on the channel parameters, the bounds for equal cache sizes are sometimes higher than the bounds for cache only at receiver 1. However, distributing the cache asymmetrically to both receivers is always better than assigning it only to receiver 1. This is due to the fact that the capacity for the one-sided cache assignment saturates when the strong receiver does not have any cache memory; whereas the capacity for the two-sided cache assignment continues to increase with the memory size. Moreover, since asymmetric cache distribution takes into consideration the channel parameters, it is always better than having symmetric caches regardless of the channel parameters and total cache sizes. For each weak receiver i ∈ K w , generate one random key K i,1 of rate α(1-δz)F Kw and K s random keys K (j) i,2 , j ∈ K s , of rate (1-α)(1-δz)F KwKs each. The keys are generated by drawing each entry randomly according to a Bernoulli-1/2 distribution independently of all other entries. Caching phase: For each i ∈ K w , store in receiver i's cache the following

V i = K i,1 K (j)
i,2 , ∀j ∈ K s . (4.87)

Hence, the cache memory size is

M (K) 2 = (1 -δ z )F K w . (4.88)
Delivery phase: The delivery phase is divided into K periods such that the first K w periods have length αn Kw each and the last K s periods have length (1-α)n Ks each.

In the first K w periods, the transmitter conveys messages W (0) d i to the weak receivers. In each period i ∈ K w , the transmitter sends message W (0) d i to receiver i using a wiretap code with secret key K i,1 .

In the last K s periods, the transmitter conveys messages W ⊕ d i to the weak receivers and messages W d j to the strong receivers. Each period j ∈ {K w + 1, . . . , K} is further divided into K w sub-periods. Each message W d j is split into K w parts W (i) d j , i = {1, . . . , K w } and each message W ⊕ d i is split into K s parts W ⊕,(j) d i , j = {1, . . . , K s }. For each sub-period i of the period j, generate a superposition codebook with a cloud center that contains 2 n(1-α)(1-δz)F/(KsKw) codewords, and with each of the satellite codebooks containing 2 nR Analysis: Every weak receiver i ∈ K w decodes reliably if

R (K) 2 ≤ α (1 -δ w )F K w + (1 -α) (1 -δ z )F K w (4.89)
In the first sub-phase, the transmitter conveys messages W ⊕ d i to every weak receiver i ∈ K w and messages W

(1) d j to every strong receiver j ∈ K s by time sharing over K w periods. For each of the periods, it generates a piggyback codebook C with 2 nKsR (1) /Kw subcodebooks C W . Each subcodebook has 2 nR ⊕ codewords. It generates then W XOR = W ⊕ d i ⊕ K i and transmits the W XOR -th codeword of the codebook C W , where W = {W (1) d j ,i : j ∈ K s }.

In the second sub-phase, the transmitter conveys messages W ⊕ d j to every strong receiver j ∈ K s by time sharing over K s periods using wiretap codes without secret key.

Analysis: Weak receivers decode reliably message W ⊕ d i conveyed in the first transmission sub-phase since R ⊕ is smaller than their channel capacity.

Strong receivers also decode reliably the first transmission sub-phase. They decode the transmission sub-phase reliably if

R ⊕ = α(1 -δ z )F K w ≤ (1 -α)(δ z -δ s )F K s , (4.105)
which is maximized for

α = K w (δ z -δ s ) K w (δ z -δ s ) + K s (1 -δ z ) , (4.106)
giving the rate-memory pair (R

(K) 4 , M (K)
4 ) in (4.80i) and (4.80j).

General upper bound on the secure capacity-memory tradeoff

In this section, we provide the upper bound on the secure capacity-memory tradeoff of the general setup with K w weak receivers and K s strong receivers. This upper bound is stated in the following theorem: s (M) of the K-receiver channel with K w weak receivers and K s strong receivers with cache memories only at the weak receivers is upper bounded by the following 2K w + 1 conditions:

C (K) s (M) ≤ δ z -δ s K s F, (4.107a)
C (K) s (M) ≤ j 1 -δ w + K s 1 -δ s -1 F + jM D
, j ∈ {1, . . . , K w }, (4.107b) Finally, we bound the following sum: (4.118)

C (K) s (M) ≤ max α i ∈[0,1] min α i (δ z -δ w ) + (1 -α i )(δ z -δ s ) i + K s F + i i + K s M, (b) ≤ 1 n I(W d 1 ; Y n 1 , V 1 ) + I(W d 2 ; Y n 2 , V 1 , V
I(W d 1 ; V 1 |Z n ) + k =2 I(W d ; V 1 , . . . , V |W d 1 , . . . , W d , Z n ) ≤ I(W d 1 ; V 1 . . . , V k |Z n ) + k =2 I(W d ; V 1 ,
Let n → ∞, from constraints (4.108) and (4.118), we conclude that if a rate-memory tuple (R s , M 1 , . . . , M K ) is securely-achievable (under the joint secrecy condition), then there exist auxiliaries (U 1 , U 2 , . . . , U K , Q) so that for each realization of Q = q the following Markov chain holds:

U 1 → U 2 → • • • → U K → X → Y K → Y K-1 → • • • Y 1 → Z (4.119)
and so that the following K inequalities are satisfied: For the erasure BC, it is not hard to show that the weakest constraints are obtained by choosing U 1 , . . . , U K Bernoulli random variables and Q a constant.

So, constraints (4.120) become

R s ≤ α 1 (δ z -δ 1 ) + M 1 , (4.121a)
R s ≤ 1 k k =1 α (δ z -δ ) + M , ∀k ∈ {1, . . . , K} (4.121b)
for a tuple α 1 , . . . , α K ≥ 0 summing up to 1.

Let i be the number of weak receivers among the k considered ones, and j = k -i be the number of strong receivers. We can rewrite constraints (4.121) as follows: R s ≤ max We notice that for i = K s , (4.122) generates a constraint tighter than for i < K s . Thus, we can remove all constraints for i < K s without affecting the result and we retain only the K w constraints in (4.107c). We illustrate in Figure 4.5 and 4.6 the lower and upper bounds derived for the general setup under individual and joint secrecy constraints assuming a total of K = 20 users and different choices of K w and K s . We can see that the lower bounds under both secrecy constraints are close.

Examples

Conclusion

In this chapter, we have derived lower and upper bounds on the secure capacity-memory tradeoff of the two-user wiretap packet-erasure BC with cache memory only at the weaker receiver under a joint secrecy constraint. Our bounds match for small and large cache memories. For small cache memory regime, they achieve optimality when only storing secret keys in the caches, but no data. The reason being that a cached secret key serves in securing any possible user's demand, whereas cached data serves only for a subset of demands. As a consequence, in the low cache memory regime, the capacity-memory tradeoff grows proportionally with the cache memory size, irrespective of the number of possible messages in the library.

For comparison, we have provided lower and upper bounds for the two-user scenario on the secure capacity-memory tradeoff under a joint secrecy constraint when both receivers have equal cache size. We observe that in the regime of small cache memory, it is highly beneficial to allocate all the available cache to the weaker receiver compared to allocating the cache memory uniformly across receivers. In fact, in our proposed coding schemes, the data and secret keys cached at the weak receivers are also used to secure the communication to the stronger receivers and to make it more efficient. This situation can however be reversed for larger cache sizes depending on the channel parameters.

Moreover, we have studied the two-user scenario with an asymmetric cache distribution for both receivers depending on their channel capacities. We have computed lower and upper bounds on the secure capacity-memory tradeoff in this case showing that this cache assignment is always better than the symmetric distribution. However, it is beneficial compared to the one-sided cache distribution only when both receivers have close erasure probabilities. In fact, in the two-sided distribution, a small cache memory can be allocated to strong receivers allowing them to secure their messages, removing thus the need for a random binning.

We have also compared with the bounds derived in the previous chapter under an individual secrecy constraint. The results reveal that the loss in performance due to the stronger secrecy constraint is small. Finally, we have extended the results to K users, where K w receivers are weak and have cache memories of equal size, and K s receivers are strong and have no cache.

Conclusion

In this thesis, we have considered two lines of research in communication security. We have started by studying lattice-based cryptosystems. We have suggested improving the GGH scheme to make it an efficient post-quantum cryptography candidate. Then, we have investigated physical layer security in cache-aided wiretap broadcast channels.

In the first part of this thesis, we have proposed an improvement to the lattice-based GGH cryptosystem using generalized low density lattices. While guarantying the same level of security, our cryptosystem significantly reduces the complexity compared with previous GGH schemes. In fact, the specific form of the lattice generator matrix G Λ induces a huge reduction in the key size. In dimension n ≈ 1000, the key can be represented by approximately 100 KBs whereas the key size of previous GGH systems was in the order of MBs. Moreover, since G Λ is by design in HNF, the complexity of the public key generation reduces by 1300 times compared to Micciancio and LDLC systems. Finally, the GLD lattice iterative decoding offers a better performance than Babai's algorithms and decreases the decryption complexity compared to LDLCs iterative decoding.

Next steps will consist in investigating other noise models. While uniform noise was considered in this study, further work will be needed to define the best noise distribution in our lattice-based system, through deeper theoretical and experimental studies of the error vector. Moreover, the dual code attack needs further in-depth study to determine the optimal density for GLD lattices and the best elementary codes to be employed.

In the second part of this thesis, we have focused on securing multi-user packeterasure broadcast channels against eavesdropping attacks. Our scheme consists of a transmitter, K receivers and an eavesdropper. Among the K receivers, K w are weak receivers and are provided with cache memories of size M each; whereas the remaining K s are strong receivers and have no cache. We have considered two secrecy constraints: the individual constraint where each message should be individually secured from the eavesdropper and the joint constraint where all the messages are jointly secured against the eavesdropper. We have computed lower and upper bounds on the secure capacitymemory tradeoff C s (M) for both constraints. For each secrecy condition, we have proposed a joint cache-channel coding scheme that can achieve the lower bound on C s (M). We have found that the individual secrecy constraint allows for a better capacity-memory tradeoff, while the joint secrecy constraint is more interesting from a security point of view.

To motivate our choice of cache distribution, we have provided lower and upper bounds on the secure capacity-memory tradeoff for the symmetric cache distribution for the two-user case and for both constraints. For the joint secrecy constraint, we have also computed bounds with an asymmetric cache distribution at both receivers depending on their channel states. We have compared the different cache distribution and have concluded that, for most cache memory sizes and channel parameters, cache only at weak receiver is the most beneficial case. Moreover, the pertinence of the joint cache-channel coding scheme is proved when compared with the best separate cachechannel coding scheme for the two-user case. This comparison clearly showed that our joint cache-channel coding achieves better lower bounds for all cache memory sizes and channel parameters for both secrecy constraints.

For future work, it would be interesting to replace our theoretical joint cache-channel coding approach with a practical coding scheme. In this purpose, the design of nested lattice coding schemes could be investigated. It would be also interesting to consider the case where the eavesdropper does not have the most degraded channel. In this case, the cache memory can still help to secure the messages for the receiver with the worst channel.

On a more general level, it would also be worth exploring the ways physical layer security and upper layer security could interact. These security schemes could benefit from each other especially to strengthen the overall system security. For instance, shared secret keys needed for network layer security protocols can be established at the physical layer by exploiting the channel characteristics. Symmetrically, network layer could securely convey secret keys to be used later in cache-aided transmissions. A well-optimized combination between physical layer security and network layer security could actually help building an efficient, secure and easily implementable system. where p Z|X stands for the channel law to the eavesdropper.

We are interested in the expectation and the variance of N C 1 (l 1 , z αn ) over the choices of the index l 1 , the sequence z αn , and the random code construction.

Lemma 4.1. The desired expectation and variance satisfy E C 1 ,l 1 ,z αn N C 1 (l 1 , z αn ) ≥ 2 n((D-1)R (1) +R -αI(X 1 ;Z)-δ( )-n) , (4.125) E C 1 ,l 1 ,z αn N C 1 (l 1 , z αn ) ≤ 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n) (4.126)

and Var(N C 1 (l 1 , z αn )) ≤ 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n) , (4.127)

where n tends to 0 as n → ∞.

Proof. The upper bound on the expectation of N C 1 (l 1 , z αn ) is computed as follows The lower bound on the expectation follows the same proof except for the step (c) where we should use the lower bound of the joint typicality lemma to get the desired result.

E C 1 ,l 1 ,z αn N C 1 (l 1 , z αn ) = E l 1 E C 1 ,z αn N C 1 (l 1 , z αn
As for the variance, ),z αn )∈T (αn)

Var(N C 1 (l 1 , z αn )) = E C 1 ,l 1 ,z αn N C 1 (l 1 , z αn ) 2 -E C 1 ,l 1 ,z αn N C 1 (l 1 , z αn ) 2 ≤ E C 1 ,l 1 ,z αn N C 1 (l 1 , z αn
(p XZ ) = E l 1 l 1 =l 1 l 1 =l 1 E C 1 ,z αn 1 (x (αn) 1 (l 1 |w (0,2) d 1
),z αn )∈T ),z αn )∈T (αn)

(p XZ ) = E l 1 l 1 =l 1 l 1 =l 1 l 1 =l 1 E C 1 ,z αn 1 (x (αn) 1 (l 1 |w (0,2) d 1
),z αn )∈T ),z αn )∈T (αn) (p XZ )

≤ 2 2n[(D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n] + 2 n[(D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n] , We define the random process E C 1 (l 1 , z αn ) = N C 1 (l 1 , z αn ) ≥ 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2)+1 .

(4.131)

It represents the case when N C 1 (l 1 , z αn ) exceeds the upper bound on its expected value. The probability of this process is Pr{E C 1 (l 1 , z αn )} = Pr N C 1 (l 1 , z αn ) ≥ 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2)+1

= Pr N C 1 (l 1 , z αn ) ≥ 2 × 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2) (a)

≤ Pr N C 1 (l 1 , z αn ) ≥ E C 1 ,L 1 ,Z αn N C 1 (l 1 , z αn ) + 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2) ≤ Pr N C 1 (l 1 , z αn ) -E C 1 ,L 1 ,Z αn N C 1 (l 1 , z αn ) ≥ 2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2) (b) ≤ Var(N C 1 (l 1 , z αn )) 2 2n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2) . (4.132)

where (a) holds because of (4.126); and (b) holds because of the Chebyshev inequality Pr(|V -µ| ≥ kσ) ≤ 1 k 2 where V is a random variable of mean µ and variance σ 2 and k is a constant. Hence, from (4.127) and (4.132), we conclude that, for every message w (0,2)

d 1 , if (D -1)R (1) + R -αI(X 1 ; Z) ≥ 0 then Pr{E C 1 (l 1 , z αn )} → 0 as n → ∞.
Furthermore, for a given codebook C 1 and for every message w

I 1 1

 1 am also grateful to my cousins Rima, Nour and Sami, and to my friends, Nathalie, i Introduction Security in Communication Systems 5 1.1 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.1.1 Code-based cryptography . . . . . . . . . . . . . . . . . . . . . . . 9 1.1.2 Lattice-based cryptography . . . . . . . . . . . . . . . . . . . . . . 1.2 Information-theoretic security . . . . . . . . . . . . . . . . . . . . . . .

3

 3 sur les GLD . . . . . . . . . . . . . . . . . . . . xx 2 Orthogonality defect de la clé publique avec et sans reduction pour C 0 (8, 6) 17 .xxii 3 Codebook piggyback sécurisé C 1 . . . . . . . . . . . . . . . . . . . . . . . . . xxvii 4 Bornes inférieures et supérieures de C(M)/C s (M) pour K = 2, δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, et D = 5. . . . . . . . . . . . . . . . . . . . . . .xxix 5 Bornes inférieures et supérieures de C s (M)/C s,Sym (M) pour K = 2, D = 5, δ 1 = 0.7, δ z = 0.8. Dans la figure à gauche δ 2 = 0.2 et dans la figure à droite δ 2 = 0.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxx 6 Bornes inférieure et supérieure de C (K) s (M) pour δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 et K s = 15. . . . . . . . . . . . . . . . . xxxii 7 Bornes inférieures et supérieures de C s (M) pour les contraintes de sécurité jointes et individuelles pour K = 2, δ 1 = 0.7, δ 2 = 0.3, δ z = 0.8, F = 5 et D = 5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxviii 8 Bornes inférieures et supérieures de C s (M)/C s,Sym (M)/C s,Asym (M) pour K = 2, δ 1 = 0.7, δ 2 = 0.5, δ z = 0.8, F = 5 et D = 5. . . . . . . . . . . . . xxxviii 1.1 Communication security in the OSI model. . . . . . . . . . . . . . . . . . 6 1.2 Cryptography scheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.3 Caching scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.4 Public-key cryptography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.5 Shannon's model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1.6 The wiretap channel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2.1 GLD-based GGH cryptosystem . . . . . . . . . . . . . . . . . . . . . . . . 27 2.2 Public key orthogonality defect w/wo reduction for C 0 (8, 6) 17 . . . . . . . . 34 2.3 Key generation running time for GGH, Micciancio and GLD cryptosystem. 38 2.4 Generalized Tanner graph of GLD lattices. . . . . . . . . . . . . . . . . . . 38 3.1 Packet-erasure BC with K legitimate receivers and an eavesdropper. The K w weaker receivers have cache memories of size M. . . . . . . . . . . . . 43 3.2 Packet-erasure BC with two legitimate receivers and an eavesdropper. Receiver 1 has cache memory of size M. . . . . . . . . . . . . . . . . . . . 46 3.Secure piggyback codebook C 1 where each dot symbolizes a codeword. Subcodebooks (bins) C 1 ( w1 , w2 ) are depicted by the squares, each containing 2 nR codewords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 ix LIST OF FIGURES 3.4 Wiretap codebook C 2 where each dot symbolizes a codeword. Subcodebooks C 2 ( w) are depicted by the squares, each containing 2 nR codewords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Packet-erasure BC with two legitimate receivers and an eavesdropper. Both receivers have equal cache memory of size M 2 . . . . . . . . . . . . . . 3.6 Separate cache-channel coding architecture. . . . . . . . . . . . . . . . . .3.7 Lower and upper bounds on C(M)/C s (M) wo/w secrecy constraint for δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5 and D = 5. . . . . . . . . . . . . . . . . 3.8 Lower and upper bounds on C(M)/C s (M) wo/w secrecy constraint for δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5 and D = 30. . . . . . . . . . . . . . . . 3.9 Lower and upper bounds on C s (M)/C s,Sym (M) for δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5 and D = 5. . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 Lower and upper bounds on C s (M)/C s,Sym (M) for δ 1 = 0.7, δ 2 = 0.5, δ z = 0.8, F = 5 and D = 5. . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11 Lower and upper bounds on C s (M)/C s,Sep (M) for δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5 and D = 5. . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12 Lower and upper bounds on C (K) s (M) under individual secrecy constraint for δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 and K s = 15. . . 3.13 Lower and upper bounds on C (K) s (M) under individual secrecy constraint for δ w = 0.4, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 and K s = 15. . . 4.1 Lower and upper bounds on C s (M) under joint secrecy constraint for δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5 and D = 15. . . . . . . . . . . . . . . . . 4.2 Lower and upper bounds on C s (M) under joint and individual secrecy constraints for δ 1 = 0.7, δ 2 = 0.3, δ z = 0.8, F = 5 and D = 5. . . . . . . . . 4.3 Lower and upper bounds on C s (M)/C s,Sym (M)/C s,Asym (M) for δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5 and D = 5. . . . . . . . . . . . . . . . 4.4 Lower and upper bounds on C s (M)/C s,Sym (M)/C s,Asym (M) for δ 1 = 0.7, δ 2 = 0.5, δ z = 0.8, F = 5 and D = 5. . . . . . . . . . . . . . . . 4.5 Lower and upper bounds on C (K) s (M) under individual and joint secrecy constraints for δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 and K s = 15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Lower and upper bounds on C (K) s (M) under individual and joint secrecy constraints for δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 15 and K s = 5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x List of Tables

Figure 2 :

 2 Figure 2: Orthogonality defect de la clé publique avec et sans reduction pour C 0 (8, 6) 17 .

  g i : 1, . . . , 2 nRs D → V et un alphabet de cache V := 1, . . . , 2 nM . xxiv Avant la phase de transmission, d est communiqué à l'émetteur et aux récepteurs légitimes. Selon d, l'émetteur transmet X n := f d (W 1 , . . . , W D ), pour une certaine fonction f d : 1, . . . , 2 nRs D → X n . Chaque récepteur faible i ∈ K w utilise son vecteur reçu Y n i et le contenu de son cache V i pour décoder Ŵi := ϕ i,d (Y n i , V i ), pour une certaine fonction ϕ i,d : Y n × V → 1, . . . , 2 nRs . Chaque récepteur fort j ∈ K s utilise seulement son vecteur reçu Y n j pour décoder Ŵj := ϕ j,d (Y n j ), pour une certaine fonction ϕ j,d : Y n → 1, . . . , 2 nRs .

  où chaque carré représente un bloc. Le bloc dans la ligne w1 et la colonne w2 est noté par C 1 ( w1 , w2 ). Phase de caching: On sauvegarde W (1) 1 , . . . , W (1) D dans la mémoire cache du récepteur 1. Cela est faisable si: R (1) ≤ M D .

d 2 1 ) d 1 ,

 211 au récepteur 2 en utilisant un code wiretap. Décodage au récepteur 1: Récepteur 1 récupère le message W (1) d 1 de sa mémoire cache et décode seulement le message W (0) d 1 en se basant sur son vecteur reçu dans la première phase y αn 1 et sa mémoire cache V 1 . Connaissant W (il réduit sa recherche à la colonne correspondante et donc, aux mots de code dans C 1 ( W2 = W (1)

Figure 4

 4 Figure 4 montre nos bornes supérieure et inférieure du compromis sécurisé capacitémémoire C s (M), celle du cas non sécurisé C(M) [9] et la borne inférieure obtenu avec le schéma de codage cache-canal séparé. Nous observons les points suivants:

  Borne inf Cs(M) Borne inf Cs,Sep(M) Borne sup C(M) Borne inf C(M)

Figure 4 :

 4 Figure 4: Bornes inférieures et supérieures de C(M)/C s (M) pour K = 2, δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, et D = 5.

Figure 5 :

 5 Figure 5: Bornes inférieures et supérieures de C s (M)/C s,Sym (M) pour K = 2, D = 5, δ 1 = 0.7, δ z = 0.8. Dans la figure à gauche δ 2 = 0.2 et dans la figure à droite δ 2 = 0.5.

Figure 6 :

 6 Figure 6: Bornes inférieure et supérieure de C (K) s (M) pour δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 et K s = 15.

  on les sauvegarde dans la mémoire cache du récepteur 1. Dans la première période, l'émetteur envoie le message W (0) d 1 au récepteur 1 en utilisant un code wiretap avec clé secrète K 1 .

d 1 ⊕

 1 K 2 dans le centre cloud et W d 2 dans le satellite. Récepteur 1 décode seulement le message W ⊕ d 1 ⊕ K 2 tandis que récepteur 2 décode les deux messages. Schéma de codage atteignant (R 3 , M 3 ) Soit α = δz-δs 1+δz-δw-δs . On divise chaque message W d , pour d ∈ D, en trois sous-messages

d 2 )d 2 ]

 22 . Dans la deuxième période, il transmet le message W au récepteur 2 en utilisant un code wiretap. xxxiv Schéma de codage atteignant (R 4 , M 4 ) On applique le même schéma de codage décrit pour (R 3 , M 3 ) avec les changements suivant: on annule le débit de W (0) d , on change le débit de W (1)

D

  dans la mémoire du récepteur 1 et on sauvegarde K 2 et W

Figure 7 :

 7 Figure 7: Bornes inférieures et supérieures de C s (M) pour les contraintes de sécurité jointes et individuelles pour K = 2, δ 1 = 0.7, δ 2 = 0.3, δ z = 0.8, F = 5 et D = 5.

Figure 8 :

 8 Figure 8: Bornes inférieures et supérieures de C s (M)/C s,Sym (M)/C s,Asym (M) pour K = 2, δ 1 = 0.7, δ 2 = 0.5, δ z = 0.8, F = 5 et D = 5.

Figure 1 . 1 :

 11 Figure 1.1: Communication security in the OSI model.

  Figure 1.2: Cryptography scheme.

Figure 1 . 3 :

 13 Figure 1.3: Caching scenario.

Figure 1 . 4 :

 14 Figure 1.4: Public-key cryptography.

Figure 1 . 6 :

 16 Figure 1.6: The wiretap channel.

Figure 2 . 1 :

 21 Figure 2.1: GLD-based GGH cryptosystem

= 40 Figure 2 . 2 :

 4022 Figure 2.2: Public key orthogonality defect w/wo reduction for C 0 (8, 6) 17 .

Figure 2 . 4 :

 24 Figure 2.4: Generalized Tanner graph of GLD lattices.

Figure 3 . 1 :

 31 Figure 3.1: Packet-erasure BC with K legitimate receivers and an eavesdropper. The K w weaker receivers have cache memories of size M.

W 1 ,

 1 . . . , W D (3.8) of rate R s ≥ 0 each. Let D := {1, . . . , D}. (3.9) For d ∈ D, every message W d is uniformly distributed over the set 1, . . . , 2 nRs , where n is the transmission blocklength. Every receiver k ∈ K := {1, . . . , K} demands exactly one message W d k from the library. We denote the demand of receiver k by d k ∈ D, and the demand vector of all receivers by d := {d 1 , . . . , d K } ∈ D K . (3.10)

Figure 3 . 2 :

 32 Figure 3.2: Packet-erasure BC with two legitimate receivers and an eavesdropper. Receiver 1 has cache memory of size M.

Figure 3 . 3 :

 33 Figure 3.3: Secure piggyback codebook C 1 where each dot symbolizes a codeword. Subcodebooks (bins) C 1 ( w1 , w2 ) are depicted by the squares, each containing 2 nR codewords.

Figure 3 . 4 :

 34 Figure 3.4: Wiretap codebook C 2 where each dot symbolizes a codeword. Subcodebooks C 2 ( w) are depicted by the squares, each containing 2 nR codewords.

  whenever the cache memory size of receiver 1 is larger than the size of the D sub-messages W

d 2

 2 of the secure piggyback codebook depicted in Figure3.3.

d 2

 2 based on its outputs y αn 2 in the first period, and it decodes W (0) d 2 based on its outputs y (1-α)n 2 in the second period. It proceeds as follows: 1. To decode W (1) d 2 , it considers the whole codebook C 1 . It looks for a unique l 1 ∈ Γ 1 such that x

  of the index L 1 ; (b) holds because X αn 1 is a function of L 1 and C 1 ; (c) holds because I(X αn 1 , L 1 ; Z αn |C 1 ) = I(X αn 1 , L 1 , C 1 ; Z αn ) -I(C 1 ; Z αn ) and I(C 1 ; Z αn ) ≥ 0; (d) holds because of the Markov chain (L 1 , C 1 ) → X αn 1 → Z αn ; and (e) holds because by construction p(x αn 1 , z αn ) = αn i=1 p XZ (x 1,i , z i ).In order to satisfy the individual secrecy constraint lim

. 54 )

 54 Lemma 3.1. (3.54) holds for some function δ( ) ---→ n→∞ 0 if

  .61p) Notice that (3.61i) is tighter than (3.61b), (3.61d), (3.61e), (3.61f),(3.61g) and (3.61h). Moreover, (3.61p) is tighter than (3.61o); (3.61k) is tighter than (3.61n); (3.61j)

  limited by the entropy of V 1 which cannot exceed nM; (b) and (c) follow by the chain rule of mutual information and by applying Csiszar's sum-identity [11, pp. 25]; (d) and (e) hold because the eavesdropper is degraded with respect to receiver 1; and (f) holds because of the Markov chain

Figure 3 . 5 :

 35 Figure 3.5: Packet-erasure BC with two legitimate receivers and an eavesdropper. Both receivers have equal cache memory of size M 2 .

  rates (D -2) R (1) 2 and R (0) -(D -2) R (1)2 , respectively. Otherwise, W

Figure 3 . 6 :

 36 Figure 3.6: Separate cache-channel coding architecture.

Receiver 1

 1 decodes periods 1 and 2 and receiver 2 decodes period 3. Hence, their probabilities of error averaged over the codebooks C 1 , C 2 , the channel realizations, and the messages, the following three conditions are satisfied: min

Figure 3 . 7 :Figure 3 . 8 :

 3738 Figure 3.7: Lower and upper bounds on the capacity-memory tradeoffs C(M)/C s (M) wo/w secrecy constraint for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, and for library size D = 5.

Figure 3 . 9 :Figure 3 . 10 :

 39310 Figure 3.9: Lower and upper bounds on the secure capacity-memory tradeoffs C s (M)/C s,Sym (M) for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, and library size D = 5.

Figure 3 . 11 :

 311 Figure 3.11: Lower and upper bounds on the secure capacity-memory tradeoffs C s (M)/C s,Sep (M) for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, and library size D = 5.

  .117) Maximizing constraints (3.110), (3.111) and (3.117) achieves the rate-memory pair (R (3.98k) and (3.98l), for

Theorem 3 . 4 (

 34 Upper Bound on C (K) s (M)). The secure capacity-memory tradeoff C (K)

Figure 3 . 12 :Figure 3 . 13 :

 312313 Figure 3.12: Lower and upper bounds on the secure capacity-memory tradeoff C (K) s (M) under individual secrecy constraint for the K-user wiretap erasure BC with δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 and K s = 15.

M 5 :

 5 = D(δ z -δ 2 )F. (4.7l) Theorem 4.1 (Lower Bound on C s (M)). The upper convex hull of the six rate-memory pairs (R , M ); ∈ {0, 1, . . . , 5} in (4.7) lower bounds the secure capacity-memory tradeoff under one-sided cache assignment: C s (M) ≥ upper hull (R , M ) : = 0, . . . , 5 . (4.8)

4. 2 . 2

 22 Scheme achieving rate-memory pair (R 2 , M 2 )Preparations: Let α ∈ [0, 1] and γ ∈ [0, 1]. For d ∈ D, split each message W d into two sub-messages, such that

d 2 to receiver 2 .

 22 It generates W XOR = W ⊕ d 1 ⊕ K 1 and transmits the W XOR -th codeword of the subcodebook C 1 (W (0)

d 2

 2 based on its outputs y αn 2 in the first period, and it decodes W (0),⊕ d 2 based on its outputs y (1-α)n 2 in the second period. It looks for a unique triple ( ŵXOR , ŵ(0) d 1 , ŵ

Proposition 4 . 1 (

 41 Lower Bound on C s,Sym (M)). The upper convex hull of the three rate-memory pairs (R ,Sym , M ,Sym ); ∈ {0, 1, 2} in (4.54) lower bounds the secure capacity-memory tradeoff under symmetric cache assignment: C s,Sym (M) ≥ upper hull (R ,Sym , M ,Sym ) : = 0, 1, 2 .(4.55)

Remark 4 . 3 . 2 4. 6 . 1

 43261 After (R 4,Asym , M 4,Asym ), the lower bound keeps increasing with a slope 1 2D . This can be deduced from Remark 4.Scheme achieving rate-memory pair (R 2,Asym , M 2,Asym )

.69) 4 . 7 .

 47 UPPER BOUND UNDER ASYMMETRIC CACHE ASSIGNMENTCaching phase: We store K 1 and the D-tuple W

Figure 4 .

 4 Figure 4.1 shows lower and upper bounds on the capacity-memory tradeoff C s (M) for a specific example.

  Cs(M) UB on Cs(M)

Figure 4 . 1 :

 41 Figure 4.1: Lower and upper bounds on the secure capacity-memory tradeoff C s (M) under joint secrecy constraint for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, and library size D = 15.

  We compare our bounds in Theorems 4.1 and 4.2 with the lower and upper bounds on the secure capacity-memory tradeoff under the individual secrecy constraint (see Chapter 3, Theorems 3.1 and 3.2). Cs(M) for joint constraint UB on Cs(M) for joint constraint LB on Cs(M) for individual constraint UB on Cs(M) for individual constraint

Figure 4 . 2 :

 42 Figure 4.2: Lower and upper bounds on the secure capacity-memory tradeoff C s (M) under joint and individual secrecy constraints for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.3, δ z = 0.8, F = 5, and library size D = 5.

Figure

  Figure 4.2 shows that the upper bound on the capacity-memory tradeoff under an individual secrecy constraint is higher only for small cache memory regime and it coincides with the one under a joint constraint for large cache memories. This is trivial because in our upper bound's proof, we neglected the secrecy constraints for large cache memories.

Figures 4 .

 4 Figures 4.3 and 4.4 depict the lower and upper bounds on the capacity memory tradeoffs for the different cases of cache assignment.

Figure 4 . 3 :

 43 Figure 4.3: Lower and upper bounds on the secure capacity-memory tradeoffs C s (M)/C s,Sym (M)/C s,Asym (M) for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.2, δ z = 0.8, F = 5, and library size D = 5.

Figure 4 . 4 :

 44 Figure 4.4: Lower and upper bounds on the secure capacity-memory tradeoffs C s (M)/C s,Sym (M)/C s,Asym (M) for the two-user wiretap erasure BC with erasure probabilities δ 1 = 0.7, δ 2 = 0.5, δ z = 0.8, F = 5 and library size D = 5.

4. 9

 9 General lower bound on the secure capacity-memory tradeoff 4.9.2 Scheme achieving rate-memory pair (R Let α ∈ [0, 1]. For d ∈ D, split each message into two sub-messages, such thatW d = W (0) d , W ⊕ d , with rates R (0) = α(1-δw)F Kw and R ⊕ = (1-α)(1-δz)FKw, respectively.

(K) 2 /

 2 Kw codewords. The transmitter encodes Wd j into the satellite. Receiver i decodes only message W ⊕ d i ⊕ K (j) i,2 . Receiver j decodes both messages W ⊕ d i ⊕ K

Theorem 4 . 4 (

 44 Upper Bound on C (K) s (M)). The secure capacity-memory tradeoff C (K)

(4. 110 ) 2 , 2 , 2 , 2 , 2 , 2 , 2 , 2 , 2 , 2 , 2 , 2 , 1 , 2 ,

 11022222222222212 Then, we prove that for each ∈ {1, . . . , k}, the following set of inequalities hold:I(W d ; Y n |V 1 , . . . , V , W d 1 , . . . , W d -1 ) -I(W d ; Z n |V 1 , . . . , V , W d 1 , . . . , W -1 ) d ; Y ,i |V 1 , . . . , V , W d 1 , . . . , W d -1 , Y i-1 , Z n i+1 ) -I(W d ; Z i |V 1 , . . . , V , W d 1 , . . . , W d -1 , Y i-1 , Z n i+1 ) d ; Y ,i |V 1 , . . . , V , W d 1 , . . . , W d -1 , Y i-1 . . . , Y i-1 , Z n i+1 ) -I(W d ; Z i |V 1 , . . . , V , W d 1 , . . . , W d -1 , Y i-1 d ; Y ,i |V 1 , . . . , V , W d 1 , . . . , W d -1 , Y i-1 . . . , Y i-1 , Z n i+1 ) -I(W d ; Z i |V 1 , . . . , V , W d 1 , . . . , W d -1 , Y i-1 ; Y ,i |V 1 , . . . , V -1 , W d 1 , . . . , W d -1 , Y i-1 . . . , Y i-1 , Z n i+1 ) -I(V ; Z i |V 1 , . . . , V -1 , W d 1 , . . . , W d -1 , Y i-1 d , V ; Y ,i |V 1 , . . . , V -1 , W d 1 , . . . , W d -1 , Y i-1 . . . , Y i-1 , Z n i+1 ) -I(W d , V ; Z i |V 1 , . . . , V -1 , W d 1 , . . . , W d -1 , Y i-1 i-1 +1 ; Y ,i |V 1 , . . . , V , W d 1 , . . . , W d , Y i-1 . . . , Y i-1 , Z n i+1 ) -I(Y i-1 +1 ; Z i |V 1 , . . . , V , W d 1 , . . . , W d , Y i-1 d , V , Y i-1 +1 ; Y ,i |V 1 , . . . , V -1 , W d 1 , . . . , W d -1 , Y i-1 . . . , Y i-1 , Z n i+1 ) -I(W d , V , Y i-1 +1 ; Z i |V 1 , . . . , V -1 , W d 1 , . . . , W d -1 , Y i-1 . . . , Y i-1 , Z n i+1 ) , (4.111)where (a) follows from the chain rule of mutual information and by applying Csiszar's sum-identity; (b) because receivers 1, . . . , -1 are degraded with respect to receiver , and so the following Markov chain holds:(W d ; Y ,i |V 1 , . . . , V k , W d 1 , . . . , W d -1 , Z n i+1 ) → Y i-1 → (Y i-1 . . . , Y i-1 );(4.112)and (c) and (d) hold because the eavesdropper is degraded with respect to receiver , implying the following Markov chain:(V 1 , . . . , V , W d 1 , . . . , W d , Y i-1 . . . , Y i-1 +1 , Z n i+1 ) → Y ,i → Z i .(4.113)We define for each k ∈ {2, . . . , K} the random variablesY k := Y k,Q(4.114)U k := (W d k , V k , Y Q-1 k+1 , U k-1 ). (4.115) Dividing by n, we can rewrite constraint (4.111) as 1 n I(W ; Y n |V 1 , . . . , V , W d 1 , . . . , W d -1 ) -I(W ; Z n |V 1 , . . . , V , W d 1 , . . . , W d -1 ) ≤ k =2 I(U ; Y |U -1 , Q) -I(U ; Z|U -1 , Q). (4.116)

  kR s ≤ I(U 1 ; Y 1 |Q) -I(U 1 ; Z|Q) + ; Y |U -1 , Q) -I(U ; Z|U -1 , Q) .

R s < I(U 1 ;

 1 Y 1 |Q) -I(U 1 ; Z|Q) + M 1 ; (4.120a) and for k ∈ {2, . . . , K}: kR s ≤ I(U 1 ; Y 1 |Q)-I(U , 1; Z|Q)+ k =2 I(U ; Y |U -1 , Q)-I(U ; Z|Q)+ k =1 M . (4.120b)

  -δ w ) + M, 1 i + j α i (δ z -δ w ) + (1 -α i )(δ z -δ s ) + iM ,Sarah Kamel 118 4.11. EXAMPLES ∀k ∈ {1, . . . , K}, k = i + j. (4.122)

Figure 4 . 5 :

 45 Figure 4.5: Lower and upper bounds on the secure capacity-memory tradeoff C (K) s (M) under individual and joint secrecy constraints for the K-user wiretap erasure BC with δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 5 and K s = 15.

Figure 4 . 6 :

 46 Figure 4.6: Lower and upper bounds on the secure capacity-memory tradeoff C (K) s (M) under individual and joint secrecy constraints for the K-user wiretap erasure BC with δ w = 0.7, δ s = 0.2, δ z = 0.8, F = 5, D = 30, K w = 15 and K s = 5.

)|l 1 123 APPENDIX= E l 1 E C 1 ,z αn l 1 =l 1 1d 1 )= E l 1 l 1 =l 1 E C 1 ,z αn 1 (d 1 )d 1 )≤ E l 1 l 1 =l 1 2

 123111111111111 ,z αn )∈T(αn) (p X p Z|X ) ,z αn )∈T (αn) (p X p Z|X ) , z αn ) ∈ T (αn) (p X p Z|X ) -αn(I(X 1 ;Z)-δ( )) = (2 n[(D-1)R (1) +R ] -1)2 -αn(I(X 1 ;Z)-δ( )) = 2 n[(D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n] , (4.128) where (a) holds because of the total law of expectations; (b) holds because E[1 A ] = Pr(A); and (c) holds because of the upper bound of the joint typicality lemma.

) 2 - 2 = E l 1 E 2 = E l 1 E C 1 ,z αn l 1 =l 1 1d 1 )l 1 =l 1 1

 221211111 2 2n[(D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n] , (4.129) Now, let us bound the first termE C 1 ,l 1 ,z αn N C 1 (l 1 , z αn ) C 1 ,z αn N C 1 (l 1 , z αn )|l 1 ,z αn )∈T (αn) (p XZ )

( 1 (

 1 αn) (p XZ ) 1 (x (αn)

  holds because E[AB] = E[A] E[B] if A and B are independent, and E[(1 A ) 2 ] = E[1 A ].

Finally

  , by combining (4.129) and (4.130), we get the desired upper bound in (4.127).

(0, 2 )d 1 ,d 1

 211 we define the set:N C 1 := l1 = L 1 : x ), Z αn ∈ T (αn) (p X p Z|X ) ,(4.133)

  Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Original GGH scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 GGH improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1 Micciancio's scheme . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 LDLC scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.3 Other GGH improvements . . . . . . . . . . . . . . . . . . . . . . . 2.3 GLD lattice-based cryptosystem . . . . . . . . . . . . . . . . . . . . . . . 2.3.1 GLD lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2 Proposed public-key scheme . . . . . . . . . . . . . . . . . . . . . . 2.4 Security analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brute-force attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4.2 Decoding attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4.3 Dual code attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Complexity analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.1 Public key size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.2 Key generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.3 Decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Individual Secrecy in Caching Scenario 3.1 Problem definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 Channel model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Message library and receiver demands . . . . . . . . . . . . . . . . 3.1.3 Caching phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.4 Delivery phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.5 Secure capacity-memory tradeoff . . . . . . . . . . . . . . . . . . . 3.2 Secure joint cache-channel coding . . . . . . . . . . . . . . . . . . . . . . . Upper bound under symmetric cache assignment . . . . . . . . . . . . . . 3.6 Separate cache-channel coding . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.1 Message splitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.2 Caching phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.3 Delivery phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.4 Analysis of the probability of error . . . . . . . . . . . . . . . . . . 3.6.5 Analysis of the information leakage . . . . . . . . . . . . . . . . . . 3.7 Discussion and numerical results . . . . . . . . . . . . . . . . . . . . . . . 3.7.1 Impact of the secrecy constraint . . . . . . . . . . . . . . . . . . . Impact of cache assignment . . . . . . . . . . . . . . . . . . . . . . 3.7.3 Impact of joint cache-channel coding . . . . . . . . . . . . . . . . . 3.8 General lower bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8.1 Scheme achieving rate-memory pair (R

	vi 2.4.1 CONTENTS 3.7.2 (K) 1 , M (K) 1 ) . . . . . . . . . CONTENTS vii
	3.8.2 Scheme achieving rate-memory pair (R
	2 GLD Lattice-Based Cryptosystem	21
	2.1 v

. . 1.2.1 Main results in physical layer security . . . . . . . . . . . . . . . . 1.2.2 Secrecy in caching scenario . . . . . . . . . . . . . . . . . . . . . . 1.3 3.2.1 Message splitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Codebook generation . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.3 Caching phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4 Delivery phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.5 Decoding at receiver 1 . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.6 Decoding at receiver 2 . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.7 Analysis of the error probability . . . . . . . . . . . . . . . . . . . 3.2.8 Analysis of the information leakage . . . . . . . . . . . . . . . . . . 3.2.9 Securely achievable rate-memory tuples . . . . . . . . . . . . . . . 3.3 Upper bound under one-sided cache assignment . . . . . . . . . . . . . . . 3.3.1 Proof of the upper bound . . . . . . . . . . . . . . . . . . . . . . . 3.4 Lower bound under symmetric cache assignment . . . . . . . . . . . . . . 3.4.1 Message splitting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.2 Caching phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.3 Delivery phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.4 Analysis of the error probability . . . . . . . . . . . . . . . . . . . 3.4.5 Analysis of the information leakage . . . . . . . . . . . . . . . . . . 3.5

1

  Valeur de A pour une dimension n ≈ 1000. . . . . . . . . . . . . . . . . . xxi 2 Taille de la clé publique pour n ≈ 1000. . . . . . . . . . . . . . . . . . . .xxiii 2.1 Maximal value A defining the noise interval for lattice dimension n ≈ 1000. 2.2 Average value of the norm of g i and the orthogonality defect of G Λ for lattice dimension n ≈ 1000. . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Public key size for lattice dimension n ≈ 1000. . . . . . . . . . . . . . . . 2.4 Public key size estimate for GGH-based cryptosystems. . . . . . . . . . . 2.5 Public key generation running time of the GLD cryptosystem for lattice dimension n ≈ 1000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Decryption time of the GLD cryptosystem for lattice dimension n ≈ 1000.

	List of Abbreviations Résumé détaillé de la thèse
	AD	Ajtai-Dwork
	BC	Broadcast Channel
	BKZ	Block Korkine-Zolotarev
	CVP	Closest Vector Problem
	DMS	Discrete Memoryless Channel
	GGH	Goldreich-Goldwasser-Halevi
	GLD	Generalized Low Density
	HNF	Hermite Normal Form
	LB	Lower bound
	LDLC	Low Density Lattice Codes
	LDPC	Low-Density Parity-Check
	LLL	Lenstra Lenstra Lovàsz
	LWE	Learning With Errors
	MDPC	Moderate-Density Parity-Check
	MIMO	Multiple-Input Multiple-Output
	OD	Orthogonality Defect
	OSI	Open Systems Interconnection
	pdf	probability distribution function
	QC-LDPC	Quasi-Cyclic Low-Density Parity-Check
	QC-MDPC	Quasi-Cyclic Moderate-Density Parity-Check
	SVP	Shortest Vector Problem
	UB	Upper bound
		xi xiii	xii xiv

De nos jours, la place que l'Internet occupe dans notre vie s'accroit de manière significative. Par ailleurs, l'Internet est utilisé pour envoyer et stocker des données privées telles que les informations personnelles, les dossiers médicaux, etc. Cependant, en raison sa nature ouverte et globalisée, l'Internet est exposé à toutes sortes d'attaques qui deviennent actuellement de plus en plus sophistiquées. Pour cette raison, le renforcement de la sécurité des systèmes de communications devient une nécessité. Plus précisément, c'est la confidentialité des données transmises qu'il est nécessaire de garantir. En outre, le développement des ordinateurs quantiques et les nouvelles attaques qui en découleront nécessitent des techniques de sécurité post-quantiques.

Table 1 :

 1 Notre schéma de cryptographie basé sur les GLD est décrit dans Figure1. Dans ce système, la clé privée est la matrice de parité H C du code GLD et la clé publique est la matrice génératrice G Λ du réseau de point. La dimension choisie du réseau est n ≈ 1000. Le bruit e est choisi uniformément dans un intervalle [-A, A] où A est la valeur maximale tolérée par le décodage itératif du réseau GLD. Cette valeur peut être définie théoriquement par A < 3p 2(1-R) /(2πe). Nous avons aussi calculé expérimentalement la valeur de A pour différents codes élémentaires C 0 . Quelques exemples sont montrés dans Tableau 1. Valeur de A pour une dimension n ≈ 1000.

		G Λ	e		H Λ
	Alice	m	x	c	décodeur GLD	m	Bob
		Cryptage		Décryptage
		Figure 1: Cryptosystème GGH basé sur les GLD
				xx

  suivants: round-off algorithm ou nearest plane algorithm.

		400
				Sans reduction
		350		LLL
		300		BKZ -t = 20 BKZ -t = 40
	10 (OD)	250 200
	log	150
		100
		50
		0	0	50	100	150	200	250	300	350	400
						Dimension du réseau n
						xxi

  Le deuxième facteur qui peut faire échouer cette attaque est le vecteur de bruit. Nous avons aussi tourné des simulations d'attaques en appliquant les deux algorithmes de réduction et les deux algorithmes de décodage et en considérant les réseaux de points et les valeurs de bruit correspondant du Tableau 1. Dans chacun des cas, le décryptage ne donnait pas le bon résultat. Nous déduisons que le bruit considéré est suffisant pour sécuriser notre système contre les attaques de décodage.

	xxii

1 si la base est orthogonale. Plus OD(G Λ ) est grand, plus la base est loin de l'orthogonalité et plus le décodage est difficile, voire impossible. Nous avons conduit des simulations pour calculer OD(G Λ ) pour des réseaux GLD générés à partir du code élémentaire C 0 (8, 6) 17 avant et après l'application de méthodes de réduction. Les résultats sont montrés dans Figure

2

avec une échelle logarithmique en fonction de la dimension n. Nous remarquons que le OD(G Λ ) reste très grand, et donc la base reste mauvaise, même après réduction.

Table 2 :

 2 Taille de la clé publique pour n ≈ 1000. = 1000, le temps de décodage des GLD varie de quelques ms à quelques secondes (selon le code C 0 choisi), tandis que celui de Micciancio est autour de 2 minutes.

	C 0	p	n	Taille (KBs)
	C 0 [3, 2]	17 999	110.66
	C 0 [8, 6]	17 1000	124.74
	C 0 [8, 6]	53 1000	174.8
	C 0 [16, 12] 17 992	122.75

Génération de la clé

Dans notre schéma, la clé publique est en HNF mais elle est générée en utilisant la réduction de Gauss. Dans Micciancio et dans le système basé sur LDLC, la clé est générée en utilisant un des algorithmes de génération de HNF. Pour comparer la complexité de génération de clé de notre système avec les précédent, nous avons tourné des simulations sur un Intel i5 3320M (2.6 GHz). Nous avons trouvé que pour une dimension n ≈ 1000, le génération de clé pour le système de Micciancio prend 5 heures, celle du GGH original prend 10 minutes, alors que pour le GLD, cela ne prend que quelques secondes.

Nous considérons un canal wiretap de diffusion (BC) avec un émetteur, K récepteurs et un espion. Il est modélisé par un canal BC à effacement par blocs sans mémoire, ayant pour alphabet d'entrée X := {0, 1} F , où F est un entier positif. L'alphabet de sortie Y := X ∪ ∆ est le même pour tous les utilisateurs et l'espion. ∆ indique l'effacement d'un bloc à la réception.

  1 D [9, Corollary 7.1]. Nous pouvons déduire que, quand M est petit, le caching est plus avantageux dans le scénario avec contrainte de sécurité. Cela est dû au fait que dans ce cas, la mémoire est utilisée non seulement pour augmenter l'efficacité mais aussi pour sécuriser, ce qui augmente le gain du caching.

  compare les bornes supérieures et inférieures pour le cas où l'utilisateur faible a toute la mémoire cache avec le cas où la mémoire est divisée également entre les deux utilisateurs. Nous constatons que: • Quand M est petit, la borne inférieure de C s (M) est meilleure que celle pour le cas du cache symétrique pour les deux utilisateurs C s,Sym (M). Cela est vrai pour tous les paramètres de canal. • Quand M est grand, si la différence entre les canaux du récepteur faible et fort est grande, il est plus avantageux que la mémoire cache soit pour l'utilisateur faible. Mais, si δ 1 et δ 2 ont des valeurs proches, C s,Sym (M) dépasse C s (M).

	Cs(M) F	,	C s,Sym (M) F			Cs(M) F	,	C s,Sym (M) F
										Borne inf
	0.6					0.4				Cs(M)
	0.4					0.3				Borne sup Cs(M)
						0.2				Borne inf Cs,Sym(M)
	0.2				M F •D	0.1				M Borne sup Cs,Sym(M)
	0		0.2	0.4	0.6	0		0.1	0.2	0.3	F •D

  2}, on sauvegarde K i dans la mémoire cache du récepteur i. Dans chaque période i ∈ {1, 2}, l'émetteur envoie le message W d i au récepteur i en utilisant un code wiretap avec clé secrète K i . Schéma de codage atteignant (R 3,Asym , M 3,Asym ) Cette paire est obtenue suivant un schéma similaire à (R 3 , M 3 ) sauf que dans ce cas, on génère une deuxième clé K 2 de débit (1 -α)(1 -δ z )F et on la sauvegarde dans la mémoire cache du récepteur 2. Elle est utilisée pour sécuriser les messages W Schéma de codage atteignant (R 4,Asym , M 4,Asym ) On divise chaque message W d , d ∈ D, en trois sous-messages:

	(0) d 2 et W ⊕ d 2
	transmis au récepteur 2 pendant la deuxième période.

Table 2 .

 2 1: Maximal value A defining the noise interval for lattice dimension n ≈ 1000.

	C 0	p	n	A
	C 0 [3, 2] 11 999 1
	C 0 [3, 2] 17 999 2
	C 0 [3, 2] 29 999 3
	C 0 [8, 6] 17 1000 1
	C 0 [8, 6] 53 1000 2
	2.3.2.2 Choice of the lattice dimension n

Table 2 .

 2 2: Average value of the norm of g i and the orthogonality defect of G Λ for lattice dimension n ≈ 1000.

	C 0	p	n	k	g i	OD(G Λ )
	C 0 [3, 2]	11 999 333 39.9	O(10 531 )
	C 0 [3, 2]	17 999 333 63.2	O(10 598 )
	C 0 [3, 2]	29 999 333 109.8 O(10 678 )
	C 0 [8, 6]	17 1000 500 116.8 O(10 1034 )
	C 0 [8, 6]	53 1000 500 365.3 O(10 1281 )
	C 0 [16, 12] 17 992 496 145, 6 O(10 1073 )

Table 2 .

 2

	C 0	p	n	Key size (KBs)
	C 0 [3, 2]	17 999	110.66
	C 0 [3, 2]	29 999	131.52
	C 0 [8, 6]	17 1000	124.74
	C 0 [8, 6]	53 1000	174.8
	C 0 [16, 12] 17 992	122.75

3: Public key size for lattice dimension n ≈ 1000.

Table 2 .

 2 .4. 4: Public key size estimate for GGH-based cryptosystems.

	Cryptosystem Public key size (bits)
	GGH	O(n 3 log 2

Table 2 .

 2 5: Public key generation running time of the GLD cryptosystem for lattice dimension n ≈ 1000.As mentioned in[START_REF] Basha | Non-binary GLD codes and their lattices[END_REF], GLD lattices are suitable for iterative decoding. In fact, the parity-check matrices H C of the GLD code can be associated with a Tanner graph with n variable nodes and LJ check nodes. A variable node x j , j = 1, . . . , n, represents a lattice coordinate and a check node represents one copy of the elementary code C 0 or equivalently the elementary lattice Λ 0 . An edge connects a variable node x j and a check

	C 0	p	n	Running time (s)
	C 0 [3, 2]	11 999	1.07
	C 0 [3, 2]	17 999	1.17
	C 0 [3, 2]	29 999	1.25
	C 0 [8, 6]	17 1000	7.95
	C 0 [8, 6]	53 1000	8.99
	C 0 [16, 12] 17 992	13.95
	2.5.3 Decryption

node C 0 if the corresponding position in the parity check matrix H C has a non zero element. Since in our GLD construction all variable nodes have degree J = 2, the graph can be converted into a simple generalized Tanner graph with L check nodes on the right and L check nodes on the left each with degree n 0 , as represented in Figure

2

.4. The total number of edges n = n 0 L represents the lattice dimension thus, one lattice coordinate is assigned to one graph edge.

Table 2 .

 2 6: Decryption time of the GLD cryptosystem for lattice dimension n ≈ 1000. Micciancio scheme requires 2 minutes for n ≈ 1000. For the GLD system, this time varies depending on C 0 as shown in Table2.6.

	C 0	p	n	Decryption time
	C 0 [3, 2] 11 999	17 ms
	C 0 [3, 2] 17 999	0.13 s
	C 0 [3, 2] 29 999	0.4 s
	C 0 [8, 6] 17 1000	2.3 s
	C 0 [8, 6] 53 1000	53 s
	By conducting another experiment on the time needed to decrypt one ciphertext, we
			Sarah Kamel

  Definition 3.3. For a cache memory size M, the secure capacity-memory tradeoff C s (M) is the supremum of all rates R s so that the pair (R s , M) is securely achievable: C

		Therefore, we define the secure capacity-memory tradeoff as follows.
					0 and
	sufficiently large blocklength n, there exist caching, encoding, and decoding functions as
	in (3.12), (3.15), (3.17) and (3.19) so that
			P Worst e	≤ ,	(3.22)
	and	1 n	I(W d k ; Z n ) < , ∀k ∈ K.	(3.23)

.21) Definition 3.2. A rate-memory pair (R s , M) is securely achievable if for every > s (M) := sup R s : (R s , M) securely achievable . (3.24)

  .31) Theorem 4.2 (Upper Bound on C s (M)). The secure capacity-memory tradeoff C s (M) of the two-user wiretap erasure BC with cache memory M only at the weaker receiver under the joint secrecy constraint is upper bounded by the following three conditions:

  I(U 1 ; Y 1 |Q) -I(U 1 ; Z|Q) + I(X; Y 2 |Q, U 1 ) -I(X; Z|Q, U 1 ) + M +

		.50)
	Combining (4.45), (4.46) and (4.47) gives
	2R s ≤ n n	. (4.51)
	Let n → ∞. We derive constraint (4.43) and (4.51) for the erasure BC as follows:
	R s

  .56) 4.4.1 Scheme achieving rate-memory pair (R 1,Sym , M 1,Sym ) Preparations: Let α ∈ [0, 1]. Generate two random keys K 1 and K 2 of rate α(1 -δ z )F each.

  Proposition 4.2 (Upper Bound on C s,Sym (M)). The secure capacity-memory tradeoff C s,Sym (M) of the two-user wiretap erasure BC with cache size M/2 at both receivers under the joint secrecy constraint is upper bounded by the following three conditions:

	4.5 Upper bound on the secure capacity-memory tradeoff
	under symmetric cache assignment for the two-user
	scenario

.64) Combining (4.60), (4.62), (4.63) and (4.64) gives the desired cache memory in (4.54f).

The upper bound on the secure capacity memory tradeoff C s,Sym (M) under symmetric cache assignment is stated in the following proposition:

  Proposition 4.3 (Lower Bound on C s,Asym (M)). The upper convex hull of the five rate-memory pairs (R ,Asym , M ,Asym ); ∈ {0, 1, . . . , 4} in (4.66) lower bounds the secure capacity-memory tradeoff under two-sided asymmetric cache assignment: C s,Asym (M) ≥ upper hull (R ,Asym , M ,Asym ) : = 0, . . . , 4 .

	(4.67)
		.66j)
	Sarah Kamel	100

  .76) Delivery phase: The transmitter uses the piggyback codebook C 1 to encode messages W

	(0) d 1 and W ⊕ d 1 to receiver 1 and messages W	(1) d 2 and W ⊕ d 2 to receiver 2. It generates

  d 1 since their total rate is (1 -δ 1 )F . Receiver 2 also decodes reliably messages W XOR and W )F . Thus, the pair (R 4,Asym , M 4,Asym ) in (4.66i) and (4.66j) is securely achievable.

	(1) d 2 of total rate
	(1-δ 2 4.7 Upper bound on the secure capacity-memory tradeoff
	under two-sided asymmetric cache assignment for the
	two-user scenario

The upper bound on the secure capacity memory tradeoff C s,Sym (M) under two-sided asymmetric cache assignment is stated in the following proposition: Proposition 4.4 (Upper Bound on C s,Asym (M)). The secure capacity-memory tradeoff C s,Asym (M) of the two-user wiretap erasure BC with cache size M R 1 at receiver 1 and M R 2 at receiver 2, such that M R 1 + M R 2 = M, under the joint secrecy constraint is upper bounded by the following four conditions:

  2 |W d 1 ) + . . .+ I(W d k ; Y n k , V 1 , . . . , V k |W d 1 , . . . , W d k-1 ) -I(W d 1 , . . . , W d k ; Z n ) + ; Y n , V 1 , . . . , V |W d 1 , . . . , W d -1 ) -I(W d ; Z n |W d 1 , . . . , W d -1 ) + d 1 ; Y n 1 |V 1 ) -I(W d 1 ; Z n |V 1 ) + I(W d 1 ; V 1 |Z n ) ; Y n |V 1 , . . . , V , W d 1 , . . . , W d -1 ) -I(W d ; Z n |V 1 , . . . , V , W d 1 , . . . , W d -1 ) + I(W d ; V 1 , . . . , V |W d 1 , . . . , W d -1 , Z n ) + )follows from the chain rule of mutual information; (b) follows from Fano's inequality; and (c) follows from the chain rule of mutual information.

					n
					n
	(c) =	1 n	I(W d 1 ; Y n 1 , V 1 ) -I(W d 1 ; Z n )
	+	1 n	k =2	I(W n n
	= I(W + 1 n k 1 n =2	I(W n n	,	(4.109)
	where (a

d d

In a similar way to (4.43), we can prove that

1 n I(W d 1 ; Y n 1 |V 1 ) -I(W d 1 ; Z n |V 1 ) ≤ I(U 1 ; Y 1 |Q) -I(U 1 ; Z|Q).

  . . . , V k |W d 1 , . . . , W d , Z n ) Sarah Kamel = I(W d 1 , . . . , W d k ; V 1 , . . . , V k |Z n )

	k
	≤ n	M .	(4.117)
	=1
	Taking into consideration constraints (4.110), (4.116) and (4.117), we can rewrite
	constraint (4.109) as:

  E C 1 ,z αn 1 (x (αn)

	(a) = E l 1	l 1 =l 1			1	(l 1 |w d 1 (0,2)	),z αn )∈T	(αn) (p XZ )
	× E l 1	l 1 =l 1	E C 1 ,z αn 1 (x (αn) 1	(l 1 |w d 1 (0,2)	),z αn )∈T	(αn) (p XZ )
			l 1 =l 1
	+ E l 1	l 1 =l 1	E C 1 ,z αn 1 (x (αn) 1	(0,2) d 1 (l 1 |w
								(αn) (p XZ ) 1 (x (αn) 1	(l 1 |w d 1 (0,2)	),z αn )∈T	(αn) (p XZ )
			+ E l 1	l 1 =l 1	1 E C 1 ,z αn 1 (x (αn)	(l 1 |w d 1 (0,2)	),z αn )∈T	(αn) (p XZ )	2
								Sarah Kamel	124

Sarah Kamel

with (J -1) Sarah Kamel

As in the previous chapter, here we also study the symmetric cache assignment for the two-user wiretap BC channel under a joint secrecy constraint. We compute the lower Sarah Kamel

We extend the results in Sections 4.2 and 4.3 to the general setup with K w weak receivers and K s strong receivers.Sarah Kamel

Acknowledgements

I would like to take the opportunity to thank all those who supported me during this experience.

ACKNOWLEDGEMENTS

Alex, Nancy, Serge and Roy for their priceless friendship and precious support, and for continuously giving me the courage to make this thesis better.

Thus,

when

Proof. Under condition (3.97), constraints (3.25b)-(3.25f) are less stringent than constraint (3.25a).

Note that in the scenario without secrecy, the maximal capacity is (1 -δ 2 )F . This explains the difference between the bounds on C s (M) and C(M) that we see in Figures 3.7 and 3.8.

• We also notice in Figures 3.7 and 3.8 that our lower and upper bounds are very close for many parameters. However, they seem to coincide only for large cache memories M ≥ M 3 , defined in (3.97).

Note that the observations stated above are not specific only to the considered example and are true for all channel parameters.

Impact of cache assignment

In Figures 3.9 and 3.10, we compare the capacity-memory tradeoff for one-sided and symmetric cache assignments.

Based on the lower and upper bounds on C s (M) defined in Theorems 3.1 and 3.2, and comparing them with the bound in Propositions 3.1 and 3.2, we can observe the following:

• For M = 0, both schemes achieve the same rate R 0 in (3.90).

• For small cache memories, our joint cache-channel coding scheme for one-sided cache assignment improves over the best possible coding scheme for symmetric cache assignment.

• For large cache memories, when the difference of channel capacities between the weak and strong receivers is large, one-sided cache assignment is more efficient. Nevertheless, when δ 1 and δ 2 are close, the secure capacity-memory tradeoff is larger under a symmetric cache assignment than under a one-sided cache assignment. The reason is that in the former case the cache contents can be used to secure the communication to both receivers and thus, the capacity of receiver 2 can attain F (1 -δ 2 ).

Receiver 2 reliably decodes both transmission periods whenever

Equality of (4.31) and (4.32) is obtained for We apply the same coding scheme described for (R 3 , M 3 ) with the following changes: we cancel the rate of W rate to R (1) = α(δ z -δ 2 )F . We keep R ⊕ = α(1 -δ z )F . In this case, the cache memory becomes

Receiver 1 reliably decodes the message W ⊕ d 1 of rate R ⊕ < α(1 -δ 1 )F . Receiver 2 decodes the first transmission phase without error since R ⊕ + R (1) = α(1 -δ 2 )F . As for the second phase, the rate of W ⊕ d should satisfy

Thus, the value of α that maximizes the transmission rate is

giving the rate-memory pair (R 4 , M 4 ) in (4.7i) and (4.7j).

Upper bound on the secure capacity-memory tradeoff under one-sided cache assignment for the two-user scenario

In this section, we derive the upper bound on the secure capacity-memory tradeoff for the two-receiver channel. This upper bound is stated in the following theorem:

where (a) follows by Fano's inequality and the chain rule of mutual information; (b) follows from the chain rule of mutual information; and (c) holds because

Dividing by n, (4.44) becomes

and following (4.39)-(4.42), we can prove that

and

4.6.2 Scheme achieving rate-memory pair (R 3,Asym , M 3,Asym )

This pair is obtained by following a similar analysis to the one in Section 4.2.3. The only difference is that we generate a second key K 2 of rate (1 -α)(1 -δ z )F and store it in receiver 2's cache. This key is used to secure messages W (0) d 2 and W ⊕ d 2 conveyed to receiver 2 in the second period.

In this case, the total cache memory size is

and the transmission rate should satisfy

The rate is maximized for

giving the rate memory pair (R

with rates

, respectively. Thus, the total rate is

Then, generate two random keys K 1 and K 2 of rate (1-δz)F 2 each.

Moreover, generate a piggyback codebook

by drawing each entry of each codeword at random according to a Bernoulli-1/2 distribution independently of all other entries.

The codebook is partitioned into 2 n(δz-δ 1 )F • 2 n(δz-δ 2 )F subcodebooks (bins) each with 2 n(1-δz)F codewords. The subcodebooks are arranged into an array with 2 n(δz-δ 1 )F rows and 2 n(δz-δ 2 )F columns.

Impact of the cache assignment

Consider the following six rate-memory pairs:

The upper convex hull of the six ratememory pairs (R (K) , M (K) ) : ∈ {0, . . . , 5} in (4.80) lower bounds the secure capacity-memory tradeoff of the K-receiver channel with K w weak receivers and K s strong receivers with cache memories only at the weak receivers:

Proof. As in proof of Theorem 4.1, it suffices to prove the achievability of the six ratememory pairs {(R (K) , M (K) ) : = 0, . . . , 5}. The achievability of the pairs (R

) can be proved following the same analysis for (R 0 , M 0 ) and (R 5 , M 5 ).

The achievability of the remaining rate-memory pairs is outlined in the following subsections. 4.9.1 Scheme achieving rate-memory pair (R

Preparations: Let α ∈ [0, 1]. For each weak receiver i ∈ K w , generate a random key K i of rate α (1-δz)F Kw by drawing each entry randomly according to a Bernoulli-1/2 distribution independently of all other entries. Caching phase: For each i ∈ K w , store K i in the cache memory of receiver i, hence,

Delivery phase: The delivery phase is divided into K periods such that the first K w periods have length αn Kw and the last K s periods have length (1-α)n Ks . In each period i ∈ K w , the transmitter sends W d i to receiver i using a wiretap code with secret key K i . In each period j ∈ K s , it sends W d j to receiver j using a wiretap code without secret key.

Analysis: Every weak receiver i ∈ K w decodes its message reliably whenever

Every strong receiver j ∈ K s decodes its message reliably whenever

Thus, the achievable rate is

which is maximized for

generating the rate-memory pairs (R

1 ) in (4.80c) and (4.80d).

Moreover, every strong receiver j ∈ K s decodes reliably if

Thus, the achievable rate is

which is maximized for

generating the rate-memory pair (R

2 ) in (4.80e) and (4.80f).

4.9.3 Scheme achieving rate-memory pair (R

3 )

For d ∈ D, split each message into three sub-messages, such that

and R ⊕ = α 2 (1-δz)F

Kw

, respectively.

Then, split every sub-message W

(1)

For each i ∈ K w , generate a random key K (0) i of rate R ⊕ by drawing each entry randomly according to a Bernoulli-1/2 distribution independently of all other entries. Similarly, generate Kw 2 random keys of rate 1-δz 1-δw • R (1) Kw :

Caching phase: For every weak receiver i ∈ K w , store the cache content

Thus, the cache memory size is

Delivery phase: The delivery phase is divided into three sub-phases of lengths α 1 n, α 2 n and α 3 n.

In the first sub-phase, the transmitter conveys messages W

d i for every weak receiver i ∈ K w by time-sharing over Kw 2 periods. In each period, it sends W (1)

d i 2 ,i 1 to receivers i 1 and i 2 using a wiretap code with secret key K

(1)

In the second sub-phase, the transmitter conveys messages W (0) d i and W ⊕ d i for every weak receiver i ∈ K w and message W (1) d j for every strong receiver j ∈ K s by time-sharing over K w periods. For each of the periods, it generates a piggyback codebook C with

Ks . Each subcodebook has 2 nR ⊕ codewords. It generates then

and transmits the W XOR -th codeword of the codebook C W (0)

Ks , where W

(1)

In the third sub-phase, the transmitter conveys messages

for every strong receiver j ∈ K s by time-sharing over K s periods. In each of the periods, it sends W (0),⊕ d j to receiver j using a wiretap code without secret key.

Analysis: Weak receivers only decode the first transmission period. Thus, it is reliably decoded if

The third transmission period is reliably decoded only by strong receivers if

Every weak receiver i ∈ K w decodes only messages W

d i and W ⊕ d i transmitted in the second period; whereas every strong receiver j ∈ K s decodes all the transmitted messages. Thus, the second period is reliably decoded whenever max

The above inequality is maximized by equalizing both terms in the maximization yielding

Combining (4.97)-(4.100) gives the rate R (K) 3 in (4.80g) and the corresponding values:

where

The cache memory size M (K) 3

is obtained as in (4.80h).

4.9.4 Scheme achieving rate-memory pair (R

)

with rates R ⊕ = αF (1-δz)

Kw

and R (1) = αF (δz-δs)

Ks

, respectively.

Then, split every sub-message W

(1) d into K w sub-messages

Kw each.

For each i ∈ K w , generate a random key K i of rate R ⊕ by drawing each entry randomly according to a Bernoulli-1/2 distribution independently of all other entries.

Caching phase: For every weak receiver i ∈ K w , store K i and the D-tuple W

D . Thus, the cache memory size is

We proved in Section 4.3 that the first inequality implies the following constraint

Accounting for receivers 1, . . . , k among the K receivers, we derive:

Appendix: Proof of Lemma 3.1

We bound H(L 1 |Z αn , W

d 1 ,2 , C 1 ) for every w (0,2)

d 1 ) be the subcodebook of C 1 that contains all the codewords that are compatible with w (0,2)

and for each sequence z αn ∈ T (αn) (p Z ), the set:

and the random process

In addition, define the indicator random variable E(w (0,2) + log 2 (2 n((D-1)R (1) +R -αI(X 1 ;Z)+δ( )-n/2)+1 ),