Probability Bounds for Two-Dimensional Algebraic Lattice Codes

Transcription

1 Noname manuscript No. (will be inserted by the editor) Probability Bounds for Two-Dimensional Algebraic Lattice Codes David A. Karpuk, Member, IEEE Camilla Hollanti, Member, IEEE Emanuele Viterbo, Fellow, IEEE the date of receipt and acceptance should be inserted later Abstract In this paper we provide easily computable probability bounds for the correct decision for an eavesdropper, over a fast fading channel, when coset coding using two-dimensional algebraic lattices is employed. These bounds are stated in terms of the group of units and Dedekind zeta function of the underlying number field. Keywords fading channel wiretap channel number fields lattices unit group Dedekind zeta function 1 Introduction Lattices and lattice codes provide an efficient and robust means for many applications in wireless communications [11]. In particular, number field lattice codes have been applied to Gaussian and fading wiretap channels [7, 9, 10, 4, 3], where number theoretic invariants allow one to perform analysis using algebraic data. In addition, lattice codes from totally real number fields exhibit full diversity. In [7], the authors estimate the probability of the correct decision of an eavesdropper, for lattice codes coming from number fields whose ring of integers is a principal ideal domain (PID). We improve on and generalize these The research of D. Karpuk and C. Hollanti is supported by the Emil Aaltonen Foundation s Young Researcher s Project, and by the Academy of Finland grant # Part of this work was performed at the Monash Software Defined Telecommunications Lab and was supported by the Monash Professional Fellowship and the Australian Research Council under Discovery grants ARC DP D. Karpuk and C. Hollanti are with the Department of Mathematics and System Analysis, P.O. Box 11100, FI Aalto University, Finland. davekarpuk@aalto.fi, camilla.hollanti@aalto.fi E. Viterbo is with the Department of Electrical and Computer System Engineering, Monash University, Clayton, VIC 3800, Australia. emanuele.viterbo@monash.edu

2 2 David A. Karpuk, Member, IEEE et al. results for two-dimensional number field lattice codes. In particular, we provide easily computable estimates for this probability for lattices coming from arbitrary degree two number fields, and compare these new estimates with those of [7], where the new estimates are shown to perform better. Similar purely number theoretic work has also been carried out in [6] and [5] on estimating the number of algebraic integers of bounded height. In the realm of information theory, related work has been done by Vehkalahti and Lu in [12 14], where a connection is demonstrated between the unit group and the diversity-multiplexing gain trade-off of division algebra-based spacetime codes via inverse determinant sums. Subsequent work in [15] explores this relation further, showing that the density of unit group completely determines the growth of the inverse determinant sum. Our estimates are similarly based on the growth of the unit group, but our goal is to make such estimates as explicit as possible, while providing theoretical tools which can ideally be used to generalize these results to higher dimensions. Lastly, we provide asymptotic analysis of the estimates of [7], and show that the estimates remain accurate as the size of the underlying constellation increases. Numerical data is provided for examples of number field lattice codes coming from number fields whose ring of integers is not a PID, for which the results of [7] do not apply. The reader can see the performance of our new bounds explicitly from the experimental results. 2 Lattices and Coset Coding A lattice Λ is a discrete abelian subgroup of a real vector space, and can be described as the set M Z n, where M M n (R) is the generator matrix for the lattice. The rank of the lattice is the rank of the matrix M. Lattices and lattice codes are ubiquitous in the study of fading channels; see [11]. In a wiretap channel, Alice is transmitting confidential data to the intended receiver Bob over a fading channel, while an eavesdropper Eve tries to intercept the data received over another fading channel. Following [2], we model this channel by the equations y b = H b x + z b, y e = H e x + z e (1) where y b R n is Bob s received vector, and z b is Bob s noise vector, assumed to be zero-mean Gaussian with variance σb 2. Bob s channel matrix is of the form H b = diag( h b,i ) for h b C n whose entries h b,i are complex zero-mean Gaussian random variables, so that the non-zero entries of H b are Rayleigh distributed fading coefficients. The quantities in the second equation are the corresponding variables for Eve s channel. The intended signal is x R n. We assume that both Bob and Eve have perfect channel state information, while Alice has none. The security of the fading wiretap channel is based on the assumption that Bob s SNR is sufficiently large compared to Eve s SNR, that is, that σb 2 >> σ2 e. Alice exploits these physical conditions by using a coset coding strategy [16] in order to confuse Eve. Alice s coding strategy begins by

3 Probability Bounds for Two-Dimensional Algebraic Lattice Codes 3 choosing a lattice Λ b containing information symbols intended for Bob, and a sublattice Λ e containing random information intended to confuse Eve. Alice s codebook consists cosets of Λ e in Λ b. To transmit, Alice chooses a codeword c and a random vector r Λ e and then sends the signal x = c + r c + Λ e, (2) where c contains the data bits and r embeds the random bits. Eve s SNR is assumed sufficiently large so that she can decode r perfectly. However, the codewords c belong to a finer lattice, and thus it is much more unlikely that Eve can correctly decode c. By [2] the expression P c,e for the average probability of Eve correctly decoding c over a fast fading channel is approximately ( ) n/2 1 P c,e Vol(Λ b ) 4γ 2 e n x Λ e i=1 x i 0 1 x i 3, (3) where γ e is Eve s average SNR over the n channels. Our goal is to approximate n 1 x Λ e i=1,x i 0 x i for algebraic lattices when n = Number Theoretic Background We assume the reader is familiar with basic algebraic structures such as fields, rings, and ideals. The definitions presented here generalize to arbitrary number fields, but for the purpose of eliminating unnecessary theoretical machinery we have simplified them for real quadratic number fields. We recommend [8] as a blanket reference for all necessary number theoretic results. A real quadratic number field is a field K = Q( d) = {a + b d : a, b Q} for a square-free positive integer d. The ring of integers O K of K is the set {a + bω : a, b Z}, where { (1 + d)/2 if d 1 mod 4 ω = (4) d otherwise. One can easily verify that O K has rank 2 as an abelian group. The discriminant D K of K is { d if d 1 mod 4 D = D K = (5) 4d otherwise. Given an ideal a of O K, it can be factored uniquely into prime ideals p i, in much the same way one factors integers: a = p e1 1 peg g. The ideal (p) of O K may no longer be prime, but it can be factored into prime ideals, and the possibilities for the factorization of (p) in O K are: (p) is prime iff (p, D) = 1, D y 2 (mod p), for any y Z (p) = pq, p q iff (p, D) = 1, D y 2 (mod p), for some y Z (6) iff p D. p 2

4 4 David A. Karpuk, Member, IEEE et al. In the first case we say that p is inert in K, in the second that p splits in K, and in the third that p ramifies in K. If a prime ideal p of O K appears in the factorization of (p), we say that p divides p, which we denote by p p. Example 1 Let K = Q( 10). The discriminant of K Is D = 40, thus the primes that ramify in K are p = 2, 5. In fact, we have the prime factorizations (2) = p 2 2, p 2 = (2, 10), and (7) (5) = p 2 5, p 5 = (5, 10). (8) If p = 13 we have (mod 13), hence the prime 13 splits in O K : (13) = pq, p = (13, ), q = (13, 6 10). (9) We can describe the structure of the group of units O K of the ring O K explicitly as follows. There is a unit ɛ O K such that O K = ±ɛ Z 2 Z, which is called a fundamental unit for K. The fundamental unit can be chosen (up to multiplication by ±1) such that among all u O K with the property that u > 1, ɛ is minimal. The regulator of K is defined to be ρ K = log ɛ. The regulator of K measures the density of the units of O K in R. Let σ : K K be the function σ(a + b d) = a b d. We use σ to define the field norm N : K Q, by N(x) = x σ(x). If x O K, then N(x) Z. One can use the field norm to classify units in O K, in that for x O K, we have N(x) = ±1 if and only if x O K. Example 2 Let us continue with the example of K = Q( 10). If ɛ = a + b 10 is a fundamental unit for K, we see by taking norms that a and b must satisfy ±1 = ɛ σ(ɛ) = (a + b 10)(a b 10) = a 2 b (10) From this equation, one can show that ɛ = is a fundamental unit for K. Therefore ρ K = log ɛ = Suppose that p is a prime ideal of O K such that p p for a prime number p Z. The ideal norm of p is { p N(p) = 2 if p is inert in K p otherwise (11) One can extend this definition to any ideal a of O K by using prime factorization. If a = p e1 1 peg g, then N(a) = N(p 1 ) e1 N(p g ) eg (12) The two definitions of norm coincide for principal ideals, in the sense that if a = (x) is principal, then N(a) = N(x). The Dedekind zeta function of a number field K is defined by ζ K (s) = a O K 1 N(a) s = k 1 a k k s, (13)

5 Probability Bounds for Two-Dimensional Algebraic Lattice Codes 5 where a runs over the nonzero ideals of O K, and a k denotes the number of ideals of O K of norm k. We will only be interested in values of ζ K (s) for s R, s > 1, where classical results guarantee convergence. The partial Dedekind zeta function of a number field K is defined by ζ 1 K(s) = 1 N(a ) s = a 1 k k s (14) a O K k 1 where a runs over the nonzero principal ideals of O K, and a 1 k denotes the number of principal ideals of O K of norm k. Again, classical results guarantee that this series converges for s R, s > 1. 4 Algebraic Lattice Codes Let K = Q( d) be a real quadratic field. The canonical embedding ψ : K R 2 is defined by ψ(x) = (x, σ(x)). The set ψ(o K ) is a lattice in R 2, which we call an algebraic lattice. We apply algebraic lattices to wiretap channels by setting Eve s lattice to be Λ = Λ e = ψ(o K ). We will carve a square constellation centered at the origin of R 2 from the lattice Λ, by using a bounding box B of side length 2R for some R > 0. In order to classify algebraic integers in B, we define the height of x O K to be H(x) = max{ x, σ(x) }. (15) Our constellation is then the set {ψ(x) Λ : H(x) R}. When using an algebraic lattice, one sees by (3) that the corresponding probability of Eve s correct decision is proportional to the inverse norm sum S K,R (s) = 0<H(x) R 1 N(x) s = k 1 b k,r k s (16) when s = 3, where we have truncated the inverse norm sum to reflect the fact that we are using a finite constellation. In the above expression b k,r denotes the number of algebraic integers with norm ±k and height bounded above by R. Note that for k > R 2, we have b k,r = 0 as N(x) = x σ(x) (max{ x, σ(x) }) 2 = H(x) 2. 5 Lower and Upper Bounds for S K,R (s) We present bounds for S K,R (s) when s > 1. These apply to the wiretap channel when s = 3, and to the pairwise error probability when s = 2 [11]. To obtain a lower bound for the value of S K,R (s), we truncate it after the first term. From (16) we see that S K,R (s) b 1,R, where b 1,R is the number of units of O K with height bounded above by R. As the main contribution to S K,R (s) comes from the units, it is beneficial to have a closed-form expression for b 1,R.

6 6 David A. Karpuk, Member, IEEE et al. Fig. 1 On the left, the points of the lattice ψ(o K ) for K = Q( 5) with a bounding box of side length 10, lying on the hyperbolas xy = ±k. On the right, the same lattice points after applying the transformation X = log x, Y = log y, lying on the lines X + Y = log k. To establish an explicit formula for b 1,R, we apply the 2-to-1 mapping X = log x, Y = log y to our lattice Λ. The image of O K is a 1-dimensional lattice in R 2 living on the line X + Y = 0, which we will call Λ log (see Fig. 1). The volume of the lattice Λ log is 2ρ K. We will denote by log B = (, log(r)] 2 the image of the bounding box under the log transformation. Proposition 1 For all s we have the lower bound log(r) b 1,R = S K,R (s). (17) ρ K Proof First, note that b 1,R /2 is the number of points of Λ log inside log B. By projecting Λ log onto the horizontal axis, one can see that b 1,R /2 is the number of multiples of ρ K in the interval [ log(r), log(r)]. Including the origin, this is equal to 2 log(r)/ρ K + 1, and the result follows. Proposition 2 For all s we have the upper bound b 1,R ζ 1 K(s) > S K,R (s). (18) Proof We have the trivial bound b k,r a 1 k b 1,R, hence S K,R (s) = k 1 b k,r k s b 1,R k 1 a 1 k k s = b 1,Rζ 1 K(s). (19) Note that the only term in b 1,R and b 1,R ζ 1 K (s) that depends on R is log(r), thus it is easy to measure how these bounds vary as the size of the constellation changes. In [7], bounds on S K,R (s) were presented in terms of bounded-height Dedekind zeta functions for number fields whose rings of integers are PIDs. However, the above bounds apply to all real quadratic number fields.

7 Probability Bounds for Two-Dimensional Algebraic Lattice Codes 7 6 Approximating the Inverse Norm Power Sum In this section we recall the method of [7] for approximating the sum S K,R (s). Two elements of O K generate the same principal ideal if and only if they differ multiplicatively by a unit. It follows that the intersection of log ψ(o K ) and the line X + Y = log k is the union of a 1 k translates of Λ log. We also have vol (log B (X + Y = log k)) = 2 log(r 2 /k) (20) Following [7], we arrive at the approximation of b k,r by a quantity n k,r obtained by dividing this volume by the volume of Λ log (and multiplying by 2a 1 k ), as well as an approximation of the inverse norm sum by a quantity N K,R (s): b k,r n k,r := 2a 1 log(r 2 /k) k, S K,R (s) N K,R (s) := ρ K R 2 n k,r k s. (21) The main difficulty in computing n k,r lies in calculating a 1 k. Here we present an algorithm for listing all ideals of O K which have norm k, from which one can compute a 1 k by using a known algorithm to check whether these ideals are principal (such algorithms are implemented in SAGE [1]). Fix an integer k > 1 and factor it into primes as k = p e1 1 pen n. Suppose that a O K is an ideal such that N(a) = k, with unique factorization a = p f1 1 pfm m into prime ideals. Taking norms, we have p e1 1 pen n = k = N(p 1 ) f1 N(p m ) fm. (22) By unique factorization of integers, we see that every p appearing in the factorization of a divides some p appearing in the factorization of k. Suppose that p k and that p is inert in K, so that for p p we have N(p) = p 2. For a to exist, we must then have that p divides k an even number of times. If this condition holds, then p = (p) is obviously principal, hence it can be ignored in determining whether or not a is principal. Let us assume that all inert primes dividing k do so an even number of times. We now make a list of all possible ideals of O K which have norm k, by selecting from each split prime p si (counting multiplicities) one of the two prime ideals p si dividing it, and for each ramified prime p rj (counting multiplicities), the unique prime ideal p rj dividing it. We then compute whether or not the ideal p s1 p sn p r1 p rm is principal. The total number of principal ideals we obtain this way is a 1 k. Example 3 Let K = Q( 229), and let k = 225 = In K the ideals (3) and (5) both split, and we have factorizations ( ) ( ) (3) = p 3 q 3, p 3 = 3, (1 229)/2, q 3 = ( (5) = p 5 q 5, p 5 = 5, (7 ) 229)/2, q 5 = 3, ( )/2 ( 5, (7 + ) 229)/2 (23) (24)

8 8 David A. Karpuk, Member, IEEE et al. thus the list of all ideals of norm k is p 2 3p 2 5, p 3 q 3 p 2 5, q 2 3p 2 5, p 2 3p 5 q 5, p 3 q 3 p 5 q 5, q 2 3p 5 q 5, p 2 3q 2 5, p 3 q 3 q 2 5, q 2 3q 2 5. (25) Exactly three of these ideals are principal, so that a = 3. Specifically, p 2 3q 2 5 = (2 229), p 3 q 3 q 2 5 = ( ), p 3 q 3 p 5 q 5 = (15). (26) 7 Bounding the Error and Asymptotic Behavior In this section, we bound the absolute error of the estimate of the previous section, by providing a bound b k,r n k,r for all k. We then combine these estimates to provide a bound on S K,R (s) N K,R (s) independent of R. Proposition 3 We have the bound b k,r n k,r < 2a 1 k for all k and all R. Proof Let L k be the intersection of the line X + Y = log k and the image of the bounding box under the log transformation. Then we can find ε such that 0 < ε < vol(λ log ) and vol(l k ) (b k,r /2 a 1 k)vol(λ log ) + 2a 1 kε. (27) That is, L k can be written of a union of at most (b k,r a 1 k ) translates of the fundamental region of Λ log, and 2a 1 k smaller regions which appear at the boundary. Therefore n k,r = 2a 1 vol(l k ) k vol(λ log ) 2(b k,r/2 a 1 k )vol(λ log) + 2a 1 k ε vol(λ log ) (28) = b k,r 2a 1 k + 4a 1 kε/vol(λ log ) < b k,r + 2a 1 k (29) which implies that n k,r b k,r < 2a 1 k. Now, note that ( ) b k,r a 1 vol(lk ) k 2 vol(λ log ) + 1 = n k,r + a 1 2 k, (30) which one can see by counting how many lattice points can fit inside L k. Therefore b k,r n k,r < 2a 1 k, which implies that b k,r n k,r < 2a 1 k. Proposition 4 We have S K,R (s) N K,R (s) < 2ζ 1 K (s). Proof Using the previous proposition, we have R 2 R S K,R (s) N K,R (s) = b 2 k,r n k,r k s k s < 2 R 2 a 1 k k s < 2 R 2 b k,r n k,r k s (31) a 1 k k s = 2ζ1 K(s). (32)

9 Probability Bounds for Two-Dimensional Algebraic Lattice Codes 9 As the quantity ζk 1 (s) is independent of R, we see that S K,R (s) N K,R (s) S K,R (s) < 2ζ1 K (s) S K,R (s) 0 (33) as R. That is, the relative error of the approximation of [7] goes to zero as the size of the bounding box (i.e. constellation) increases. From the bounds b 1,R S K,R (s) b 1,R ζk 1 (s) one can conclude that S K,R (s) C ρ K log(r) + O(1) (34) as R, where C is an absolute constant, and the O(1) term depends only on K and s. In [14], it is shown that inverse determinant sums exhibit similar behavior, in that they are bounded above and below by terms of the form C log(r). However, we have made our constants explicit. 8 Experimental Results We now present examples to demonstrate the accuracy of the bounds b 1,R and b 1,R ζ 1 K (s), and the approximation N K,R(s) for s = 3 (the wiretap case), for the fields Q( 5), Q( 10), and Q( 229). As we have seen, the second and third fields both have the property that their rings of integers are not PIDs. K = Q( 5) : K = Q( 10) : K = Q( 229) : log(r) b 1,R S K,R (3) b 1,R ζk 1 (3) N K,R(3) log(r) b 1,R S K,R (3) b 1,R ζk 1 (3) N K,R(3) log(r) b 1,R S K,R (3) b 1,R ζk 1 (3) N K,R(3)

10 10 David A. Karpuk, Member, IEEE et al. If u O K and u ±1, then the four distinct elements ±u, ±σ(u) all have the same height. As the main contribution to the sum S K,R (s) comes from the group O K, this explains why the value of S K,R(s) jumps by approximately 4 as R increases. 9 Conclusions and Future Work We have provided probability bounds for the correct decision of an eavesdropper over a fast fading channel, when two-dimensional number field lattice codes are used. We have shown via experiment that these bounds outperform the previous estimate of [7]. Furthermore, we have generalized this approximation to arbitrary two-dimensional algebraic lattice codes, by providing an algorithm for calculating the number of principal ideals of a fixed norm. Lastly, we have provided asymptotic analysis of the estimate of the inverse norm sum presented in [7]. Future work will involve generalizing the calculation of a 1 k and providing analogous estimates for higher-dimensional totally real number fields. We also hope to generalize these results to fading MIMO wiretap channels, where a similar analysis of the group of units in a central simple algebra will be necessary. References 1. Sage open source mathematics software system. URL 2. Belfiore, J.C., Oggier, F.: Lattice code design for the rayleigh fading wiretap channel. In: ICC 2011 (2011). Arxiv.org/pdf/ Belfiore, J.C., Oggier, F.E.: Secrecy gain: A wiretap lattice code design. In: ISITA, pp (2010) 4. Belfiore, J.C., Solé, P.: Unimodular lattices for the gaussian wiretap channel. CoRR, abs/ , Everest, G., Loxton, J.: Counting algebraic units with bounded height. J. Number Theory 44, (1993) 6. Everest, G.R.: On the solution of the norm-form equation. Amer. J. Math. 114(3), (1992) 7. Hollanti, C., Viterbo, E., Karpuk, D.: Nonasymptotic Probability Bounds for Fading Channels Exploiting Dedekind Zeta Functions (2012). Submitted 8. Lang, S.: Algebraic number theory. Springer-Verlag New York Inc. (1986) 9. Leung-Yan-Cheong, S., Hellman, M.: The gaussian wire-tap channel. Information Theory, IEEE Transactions on 24(4), (1978). DOI /TIT Oggier, F., Solé, P., Belfiore, J.C.: Lattice codes for the wiretap gaussian channel: Construction and analysis Submitted to IEEE Trans. Inf. Theory, 2011, arxiv.org/abs/ Oggier, F., Viterbo, E.: Algebraic number theory and code design for rayleigh fading channels. Commun. Inf. Theory 1(3), (2004). DOI Vehkalahti, R., Lu, H.F.F.: An algebraic look into MAC-DMT of lattice space-time codes. In: Proc. IEEE ISIT Vehkalahti, R., Lu, H.F.F.: Diversity-multiplexing gain tradeoff: a tool in algebra? In: IEEE ITW (2011) 14. Vehkalahti, R., Lu, H.F.F.: Inverse determinant sums and connections between fading channel information theory and algebra. IEEE Trans. Inf. Theory (2011). Submitted

11 Probability Bounds for Two-Dimensional Algebraic Lattice Codes Vehkalahti, R., Luzzi, L.: Connecting dmt of division algebra space-time codes and point counting in lie groups. In: Proc. IEEE ISIT 2011 (2012) 16. Wyner, A.: The wire-tap channel. Bell. Syst. Tech. Journal 54 (1975)