Secure Transmission on the Two-hop Relay Channel with Scaled Compute-and-Forward
\IEEEauthorblockN{ Zhijie~Ren
Jasper~Goseling
Jos~H.~Weber
and Michael~Gastpar% %Author 1
%Author 2
%Author 3
%and Author 4% \thanks{Z. Ren is with the Department of Intelligent Systems at Delft University of Technology
2628CD
Delft
the Netherlands (e-mail: z.ren@tudelft.nl).
....lastname \thanks{...
In this paper, we consider communication on a two-hop channel, in which a source wants to send information reliably and securely to the destination via a relay. We consider both the untrusted relay case and the external eavesdropper case. In the untrusted relay case, the relay behaves as an eavesdropper and there is a cooperative node which sends a jamming signal to confuse the relay when the it is receiving from the source. We propose two secure transmission schemes using the scaled compute-and-forward technique. One of the schemes is based on a random binning code and the other one is based on a lattice chain code. It is proved that in either the high Signal-to-Noise-Ratio (SNR) scenario and/or the restricted relay power scenario, if the destination is used as the jammer, both schemes outperform all existing schemes and achieve the upper bound. In particular, if the SNR is large and the source, the relay, and the cooperative jammer have identical power and channels, both schemes achieve the upper bound for secrecy rate, which is merely $1/2$ bit per channel use lower than the channel capacity without secrecy constraints. We also prove that one of our schemes achieves a positive secrecy rate in the external eavesdropper case in which the relay is trusted and there exists an external eavesdropper. %The problem of secure transmission on a two-hop channel with an untrusted relay has been studied in many researches. In this paper, we consider the situation that a source wants to send information to a destination via an untrusted relay. At the meantime, a cooperative node sends jamming signal to confuse the relay when the relay is receiving the message from the source. The jamming signal is also received by the destination. We propose two secure transmission schemes using scaled compute-and-forward technique. One of the schemes is based on the random binning code, which leads to a better performance if the jammer-destination channel is noisy. The other one is based on the lattice chain code, which has a better performance when the relay power is restricted. If the source, the relay, and the cooperative jammer have symmetric power and channels, both of our schemes achieve a secrecy rate which is merely $1/2$ bit per channel use lower than the capacity in high SNR. It is proved that in either the high SNR scenario or the restricted relay power scenario, our schemes outperform all existing schemes in asymmetric power/channel case and can be proved to be upper bound achieving. Further, we propose a novel two-hop channel model with the existence of an external eavesdropper, which is essentially different from the wire-tap type of problem and untrusted relay problem. Hence, the existing secure transmission schemes cannot be directly applied on this problem. We prove that our random binning code based scheme can be applied in this channel to achieve a positive secrecy rate.
Secure_Transmission_on_the_Two-hop_Relay_Channel_with_Scaled_Compute-and-Forward__Journal_.tex

%% bare_jrnl.tex
%% V1.4
%% 2012/12/27
%% by Michael Shell
%% see http://www.michaelshell.org/
%% for current contact information.
%%
%% This is a skeleton file demonstrating the use of IEEEtran.cls
%% (requires IEEEtran.cls version 1.8 or later) with an IEEE journal paper.
%%
%% Support sites:
%% http://www.michaelshell.org/tex/ieeetran/
%% http://www.ctan.org/tex-archive/macros/latex/contrib/IEEEtran/
%% and
%% http://www.ieee.org/



% *** Authors should verify (and, if needed, correct) their LaTeX system  ***
% *** with the testflow diagnostic prior to trusting their LaTeX platform ***
% *** with production work. IEEE's font choices can trigger bugs that do  ***
% *** not appear when using other class files.                            ***
% The testflow support page is at:
% http://www.michaelshell.org/tex/testflow/


%%*************************************************************************
%% Legal Notice:
%% This code is offered as-is without any warranty either expressed or
%% implied; without even the implied warranty of MERCHANTABILITY or
%% FITNESS FOR A PARTICULAR PURPOSE!
%% User assumes all risk.
%% In no event shall IEEE or any contributor to this code be liable for
%% any damages or losses, including, but not limited to, incidental,
%% consequential, or any other damages, resulting from the use or misuse
%% of any information contained here.
%%
%% All comments are the opinions of their respective authors and are not
%% necessarily endorsed by the IEEE.
%%
%% This work is distributed under the LaTeX Project Public License (LPPL)
%% ( http://www.latex-project.org/ ) version 1.3, and may be freely used,
%% distributed and modified. A copy of the LPPL, version 1.3, is included
%% in the base LaTeX documentation of all distributions of LaTeX released
%% 2003/12/01 or later.
%% Retain all contribution notices and credits.
%% ** Modified files should be clearly indicated as such, including  **
%% ** renaming them and changing author support contact information. **
%%
%% File list of work: IEEEtran.cls, IEEEtran_HOWTO.pdf, bare_adv.tex,
%%                    bare_conf.tex, bare_jrnl.tex, bare_jrnl_compsoc.tex,
%%                    bare_jrnl_transmag.tex
%%*************************************************************************

% Note that the a4paper option is mainly intended so that authors in
% countries using A4 can easily print to A4 and see how their papers will
% look in print - the typesetting of the document will not typically be
% affected with changes in paper size (but the bottom and side margins will).
% Use the testflow package mentioned above to verify correct handling of
% both paper sizes by the user's LaTeX system.
%
% Also note that the "draftcls" or "draftclsnofoot", not "draft", option
% should be used if it is desired that the figures are to be displayed in
% draft mode.
%
\documentclass[onecolumn]{IEEEtran}
%
% If IEEEtran.cls has not been installed into the LaTeX system files,
% manually specify the path to it like:
% \documentclass[journal]{../sty/IEEEtran}





% Some very useful LaTeX packages include:
% (uncomment the ones you want to load)


% *** MISC UTILITY PACKAGES ***
%
%\usepackage{ifpdf}
% Heiko Oberdiek's ifpdf.sty is very useful if you need conditional
% compilation based on whether the output is pdf or dvi.
% usage:
% \ifpdf
%   % pdf code
% \else
%   % dvi code
% \fi
% The latest version of ifpdf.sty can be obtained from:
% http://www.ctan.org/tex-archive/macros/latex/contrib/oberdiek/
% Also, note that IEEEtran.cls V1.7 and later provides a builtin
% \ifCLASSINFOpdf conditional that works the same way.
% When switching from latex to pdflatex and vice-versa, the compiler may
% have to be run twice to clear warning/error messages.






% *** CITATION PACKAGES ***
%
%\usepackage{cite}
% cite.sty was written by Donald Arseneau
% V1.6 and later of IEEEtran pre-defines the format of the cite.sty package
% \cite{} output to follow that of IEEE. Loading the cite package will
% result in citation numbers being automatically sorted and properly
% "compressed/ranged". e.g., [1], [9], [2], [7], [5], [6] without using
% cite.sty will become [1], [2], [5]--[7], [9] using cite.sty. cite.sty's
% \cite will automatically add leading space, if needed. Use cite.sty's
% noadjust option (cite.sty V3.8 and later) if you want to turn this off
% such as if a citation ever needs to be enclosed in parenthesis.
% cite.sty is already installed on most LaTeX systems. Be sure and use
% version 4.0 (2003-05-27) and later if using hyperref.sty. cite.sty does
% not currently provide for hyperlinked citations.
% The latest version can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/cite/
% The documentation is contained in the cite.sty file itself.



\usepackage{subfigure}
\usepackage{amssymb,amsmath}
\usepackage{textcomp}
\usepackage{hyperref}
\usepackage{graphicx}
\usepackage[justification=centering]{caption}
\usepackage{float}
\usepackage{tablefootnote}
\usepackage{setspace}
\usepackage{array}
\usepackage[para,online,flushleft]{threeparttable}

%\usepackage[active,float]{preview}
%\PreviewEnvironment{tikzpicture}


		\usepackage{tikz} % I am using tikz 2.??

		
		\newcounter{N}
		\newcounter{Nm}
		\newcounter{tkzA}
		\newcounter{tkzB}
		\newcounter{C}
		\newcounter{D}
		
		\newcounter{tikzCC}
		
		\newcounter{tikzA}
		\newcounter{tikzB}
		\newcounter{tikzC}
		\newcounter{tikzD}
		\newcounter{tikzE}
		\newcounter{tikzF}


\usetikzlibrary{decorations.pathreplacing}
\usetikzlibrary{positioning}
\usetikzlibrary{calc}
\usetikzlibrary{fit}
\usetikzlibrary{matrix}
\usetikzlibrary{external}

\DeclareMathOperator*{\argmin}{arg\,min}
\newcommand{\Mod}[1]{\ (\text{mod}\ #1)}

\def\beginofnote{\indent {\it Note: }}
\def\beginofproof{\indent {\it Proof: }}
\def\endofproof{\hfill\rule{6pt}{6pt}}
\newtheorem{theorem}{Theorem}
\newtheorem{lemma}{Lemma}
\newtheorem{prop}{Proposition}
\newtheorem{corollary}{Corollary}
\newtheorem{remark}{Remark}
\newtheorem{example}{Example}
\newtheorem{definition}{Definition}
\newtheorem{property}{Property}



% *** GRAPHICS RELATED PACKAGES ***
%
\ifCLASSINFOpdf
  % \usepackage[pdftex]{graphicx}
  % declare the path(s) where your graphic files are
  % \graphicspath{{../pdf/}{../jpeg/}}
  % and their extensions so you won't have to specify these with
  % every instance of \includegraphics
  % \DeclareGraphicsExtensions{.pdf,.jpeg,.png}
\else
  % or other class option (dvipsone, dvipdf, if not using dvips). graphicx
  % will default to the driver specified in the system graphics.cfg if no
  % driver is specified.
  % \usepackage[dvips]{graphicx}
  % declare the path(s) where your graphic files are
  % \graphicspath{{../eps/}}
  % and their extensions so you won't have to specify these with
  % every instance of \includegraphics
  % \DeclareGraphicsExtensions{.eps}
\fi
% graphicx was written by David Carlisle and Sebastian Rahtz. It is
% required if you want graphics, photos, etc. graphicx.sty is already
% installed on most LaTeX systems. The latest version and documentation
% can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/graphics/
% Another good source of documentation is "Using Imported Graphics in
% LaTeX2e" by Keith Reckdahl which can be found at:
% http://www.ctan.org/tex-archive/info/epslatex/
%
% latex, and pdflatex in dvi mode, support graphics in encapsulated
% postscript (.eps) format. pdflatex in pdf mode supports graphics
% in .pdf, .jpeg, .png and .mps (metapost) formats. Users should ensure
% that all non-photo figures use a vector format (.eps, .pdf, .mps) and
% not a bitmapped formats (.jpeg, .png). IEEE frowns on bitmapped formats
% which can result in "jaggedy"/blurry rendering of lines and letters as
% well as large increases in file sizes.
%
% You can find documentation about the pdfTeX application at:
% http://www.tug.org/applications/pdftex





% *** MATH PACKAGES ***
%
%\usepackage[cmex10]{amsmath}
% A popular package from the American Mathematical Society that provides
% many useful and powerful commands for dealing with mathematics. If using
% it, be sure to load this package with the cmex10 option to ensure that
% only type 1 fonts will utilized at all point sizes. Without this option,
% it is possible that some math symbols, particularly those within
% footnotes, will be rendered in bitmap form which will result in a
% document that can not be IEEE Xplore compliant!
%
% Also, note that the amsmath package sets \interdisplaylinepenalty to 10000
% thus preventing page breaks from occurring within multiline equations. Use:
%\interdisplaylinepenalty=2500
% after loading amsmath to restore such page breaks as IEEEtran.cls normally
% does. amsmath.sty is already installed on most LaTeX systems. The latest
% version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/amslatex/math/





% *** SPECIALIZED LIST PACKAGES ***
%
%\usepackage{algorithmic}
% algorithmic.sty was written by Peter Williams and Rogerio Brito.
% This package provides an algorithmic environment fo describing algorithms.
% You can use the algorithmic environment in-text or within a figure
% environment to provide for a floating algorithm. Do NOT use the algorithm
% floating environment provided by algorithm.sty (by the same authors) or
% algorithm2e.sty (by Christophe Fiorio) as IEEE does not use dedicated
% algorithm float types and packages that provide these will not provide
% correct IEEE style captions. The latest version and documentation of
% algorithmic.sty can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/algorithms/
% There is also a support site at:
% http://algorithms.berlios.de/index.html
% Also of interest may be the (relatively newer and more customizable)
% algorithmicx.sty package by Szasz Janos:
% http://www.ctan.org/tex-archive/macros/latex/contrib/algorithmicx/




% *** ALIGNMENT PACKAGES ***
%
%\usepackage{array}
% Frank Mittelbach's and David Carlisle's array.sty patches and improves
% the standard LaTeX2e array and tabular environments to provide better
% appearance and additional user controls. As the default LaTeX2e table
% generation code is lacking to the point of almost being broken with
% respect to the quality of the end results, all users are strongly
% advised to use an enhanced (at the very least that provided by array.sty)
% set of table tools. array.sty is already installed on most systems. The
% latest version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/tools/


% IEEEtran contains the IEEEeqnarray family of commands that can be used to
% generate multiline equations as well as matrices, tables, etc., of high
% quality.




% *** SUBFIGURE PACKAGES ***
%\ifCLASSOPTIONcompsoc
%  \usepackage[caption=false,font=normalsize,labelfont=sf,textfont=sf]{subfig}
%\else
%  \usepackage[caption=false,font=footnotesize]{subfig}
%\fi
% subfig.sty, written by Steven Douglas Cochran, is the modern replacement
% for subfigure.sty, the latter of which is no longer maintained and is
% incompatible with some LaTeX packages including fixltx2e. However,
% subfig.sty requires and automatically loads Axel Sommerfeldt's caption.sty
% which will override IEEEtran.cls' handling of captions and this will result
% in non-IEEE style figure/table captions. To prevent this problem, be sure
% and invoke subfig.sty's "caption=false" package option (available since
% subfig.sty version 1.3, 2005/06/28) as this is will preserve IEEEtran.cls
% handling of captions.
% Note that the Computer Society format requires a larger sans serif font
% than the serif footnote size font used in traditional IEEE formatting
% and thus the need to invoke different subfig.sty package options depending
% on whether compsoc mode has been enabled.
%
% The latest version and documentation of subfig.sty can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/subfig/




% *** FLOAT PACKAGES ***
%
%\usepackage{fixltx2e}
% fixltx2e, the successor to the earlier fix2col.sty, was written by
% Frank Mittelbach and David Carlisle. This package corrects a few problems
% in the LaTeX2e kernel, the most notable of which is that in current
% LaTeX2e releases, the ordering of single and double column floats is not
% guaranteed to be preserved. Thus, an unpatched LaTeX2e can allow a
% single column figure to be placed prior to an earlier double column
% figure. The latest version and documentation can be found at:
% http://www.ctan.org/tex-archive/macros/latex/base/


%\usepackage{stfloats}
% stfloats.sty was written by Sigitas Tolusis. This package gives LaTeX2e
% the ability to do double column floats at the bottom of the page as well
% as the top. (e.g., "\begin{figure*}[!b]" is not normally possible in
% LaTeX2e). It also provides a command:
%\fnbelowfloat
% to enable the placement of footnotes below bottom floats (the standard
% LaTeX2e kernel puts them above bottom floats). This is an invasive package
% which rewrites many portions of the LaTeX2e float routines. It may not work
% with other packages that modify the LaTeX2e float routines. The latest
% version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/sttools/
% Do not use the stfloats baselinefloat ability as IEEE does not allow
% \baselineskip to stretch. Authors submitting work to the IEEE should note
% that IEEE rarely uses double column equations and that authors should try
% to avoid such use. Do not be tempted to use the cuted.sty or midfloat.sty
% packages (also by Sigitas Tolusis) as IEEE does not format its papers in
% such ways.
% Do not attempt to use stfloats with fixltx2e as they are incompatible.
% Instead, use Morten Hogholm'a dblfloatfix which combines the features
% of both fixltx2e and stfloats:
%
% \usepackage{dblfloatfix}
% The latest version can be found at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/dblfloatfix/




%\ifCLASSOPTIONcaptionsoff
%  \usepackage[nomarkers]{endfloat}
% \let\MYoriglatexcaption\caption
% \renewcommand{\caption}[2][\relax]{\MYoriglatexcaption[#2]{#2}}
%\fi
% endfloat.sty was written by James Darrell McCauley, Jeff Goldberg and
% Axel Sommerfeldt. This package may be useful when used in conjunction with
% IEEEtran.cls'  captionsoff option. Some IEEE journals/societies require that
% submissions have lists of figures/tables at the end of the paper and that
% figures/tables without any captions are placed on a page by themselves at
% the end of the document. If needed, the draftcls IEEEtran class option or
% \CLASSINPUTbaselinestretch interface can be used to increase the line
% spacing as well. Be sure and use the nomarkers option of endfloat to
% prevent endfloat from "marking" where the figures would have been placed
% in the text. The two hack lines of code above are a slight modification of
% that suggested by in the endfloat docs (section 8.4.1) to ensure that
% the full captions always appear in the list of figures/tables - even if
% the user used the short optional argument of \caption[]{}.
% IEEE papers do not typically make use of \caption[]'s optional argument,
% so this should not be an issue. A similar trick can be used to disable
% captions of packages such as subfig.sty that lack options to turn off
% the subcaptions:
% For subfig.sty:
% \let\MYorigsubfloat\subfloat
% \renewcommand{\subfloat}[2][\relax]{\MYorigsubfloat[]{#2}}
% However, the above trick will not work if both optional arguments of
% the \subfloat command are used. Furthermore, there needs to be a
% description of each subfigure *somewhere* and endfloat does not add
% subfigure captions to its list of figures. Thus, the best approach is to
% avoid the use of subfigure captions (many IEEE journals avoid them anyway)
% and instead reference/explain all the subfigures within the main caption.
% The latest version of endfloat.sty and its documentation can obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/endfloat/
%
% The IEEEtran \ifCLASSOPTIONcaptionsoff conditional can also be used
% later in the document, say, to conditionally put the References on a
% page by themselves.




% *** PDF, URL AND HYPERLINK PACKAGES ***
%
%\usepackage{url}
% url.sty was written by Donald Arseneau. It provides better support for
% handling and breaking URLs. url.sty is already installed on most LaTeX
% systems. The latest version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/url/
% Basically, \url{my_url_here}.




% *** Do not adjust lengths that control margins, column widths, etc. ***
% *** Do not use packages that alter fonts (such as pslatex).         ***
% There should be no need to do such things with IEEEtran.cls V1.6 and later.
% (Unless specifically asked to do so by the journal or conference you plan
% to submit to, of course. )


% correct bad hyphenation here


\begin{document}
%
% paper title
% can use linebreaks \\ within to get better formatting as desired
% Do not put math or special symbols in the title.
\title{Secure Transmission on the Two-hop Relay Channel with Scaled Compute-and-Forward}
%
%
% author names and IEEE memberships
% note positions of commas and nonbreaking spaces ( ~ ) LaTeX will not break
% a structure at a ~ so this keeps an author's name from being broken across
% two lines.
% use \thanks{} to gain access to the first footnote area
% a separate \thanks must be used for each paragraph as LaTeX2e's \thanks
% was not built to handle multiple paragraphs
%

\author{
\IEEEauthorblockN{
Zhijie~Ren,
Jasper~Goseling,
Jos~H.~Weber,
and Michael~Gastpar%
%Author 1,
%Author 2,
%Author 3,
%and Author 4%
\thanks{Z. Ren is with the Department of Intelligent Systems at Delft University of Technology, 2628CD, Delft, the Netherlands (e-mail: z.ren@tudelft.nl).}%
%\thanks{Author 1 is with Affiliation 1 (e-mail: author1@email1).}%
\thanks{J. Goseling is with the Department of Applied Mathematics at University of Twente, 7522 NH, Enschede, the Netherlands (e-mail: j.goseling@utwente.nl).}%
\thanks{J.H. Weber is with the Department of Intelligent Systems at Delft University of Technology, 2628CD, Delft, the Netherlands (e-mail: j.h.weber@tudelft.nl).}%
%\thanks{Author 2 is with Affiliation 1 (e-mail: author2@email2).}%
%\thanks{Author 3 is with Affiliation 2 and also Affiliation 3 (e-mail: author3@email3).}%
\thanks{M. Gastpar is with the Laboratory of Information and Networked Systems at Ecole polytechnique f\'ed\'erale de Lausanne, CH-1015, Lausanne and also with the Department of Intelligent Systems at Delft University of Technology, 2628CD, Delft, the Netherlands (e-mail: michael.gastpar@epfl.ch).}%
%\thanks{Author 4 is with Affiliation 3 and also Affiliation 1 (e-mail: author4@email4).}%
\thanks{The work in this paper was partially presented at the Information Theory Workshop, Jerusalem, Israel, Apr., 2015.}%
}


}
% note the % following the last \IEEEmembership and also \thanks -
% these prevent an unwanted space from occurring between the last author name
% and the end of the author line. i.e., if you had this:
%
% \author{....lastname \thanks{...} \thanks{...} }
%                     ^------------^------------^----Do not want these spaces!
%
% a space would be appended to the last name and could cause every name on that
% line to be shifted left slightly. This is one of those "LaTeX things". For
% instance, "\textbf{A} \textbf{B}" will typeset as "A B" not "AB". To get
% "AB" then you have to do: "\textbf{A}\textbf{B}"
% \thanks is no different in this regard, so shield the last } of each \thanks
% that ends a line with a % and do not let a space in before the next \thanks.
% Spaces after \IEEEmembership other than the last one are OK (and needed) as
% you are supposed to have spaces between the names. For what it is worth,
% this is a minor point as most people would not even notice if the said evil
% space somehow managed to creep in.



% The paper headers
%\markboth{Journal of \LaTeX\ Class Files,~Vol.~11, No.~4, December~2012}%
%{Shell \MakeLowercase{\textit{{\em et al.}}}: Bare Demo of IEEEtran.cls for Journals}
% The only time the second header will appear is for the odd numbered pages
% after the title page when using the twoside option.
%
% *** Note that you probably will NOT want to include the author's ***
% *** name in the headers of peer review papers.                   ***
% You can use \ifCLASSOPTIONpeerreview for conditional compilation here if
% you desire.




% If you want to put a publisher's ID mark on the page you can do it like
% this:
%\IEEEpubid{0000--0000/00\$00.00~\copyright~2012 IEEE}
% Remember, if you use this you must call \IEEEpubidadjcol in the second
% column for its text to clear the IEEEpubid mark.



% use for special paper notices
%\IEEEspecialpapernotice{(Invited Paper)}




% make the title area
\maketitle

% As a general rule, do not put math, special symbols or citations
% in the abstract or keywords.
\begin{abstract}
In this paper, we consider communication on a two-hop channel, in which a source wants to send information reliably and securely to the destination via a relay. We consider both the untrusted relay case and the external eavesdropper case. In the untrusted relay case, the relay behaves as an eavesdropper and there is a cooperative node which sends a jamming signal to confuse the relay when the it is receiving from the source. We propose two secure transmission schemes using the scaled compute-and-forward technique. One of the schemes is based on a random binning code and the other one is based on a lattice chain code. It is proved that in either the high Signal-to-Noise-Ratio (SNR) scenario and/or the restricted relay power scenario, if the destination is used as the jammer, both schemes outperform all existing schemes and achieve the upper bound. In particular, if the SNR is large and the source, the relay, and the cooperative jammer have identical power and channels, both schemes achieve the upper bound for secrecy rate, which is merely $1/2$ bit per channel use lower than the channel capacity without secrecy constraints. We also prove that one of our schemes achieves a positive secrecy rate in the external eavesdropper case in which the relay is trusted and there exists an external eavesdropper.

%The problem of secure transmission on a two-hop channel with an untrusted relay has been studied in many researches. In this paper, we consider the situation that a source wants to send information to a destination via an untrusted relay. At the meantime, a cooperative node sends jamming signal to confuse the relay when the relay is receiving the message from the source. The jamming signal is also received by the destination. We propose two secure transmission schemes using scaled compute-and-forward technique. One of the schemes is based on the random binning code, which leads to a better performance if the jammer-destination channel is noisy. The other one is based on the lattice chain code, which has a better performance when the relay power is restricted. If the source, the relay, and the cooperative jammer have symmetric power and channels, both of our schemes achieve a secrecy rate which is merely $1/2$ bit per channel use lower than the capacity in high SNR. It is proved that in either the high SNR scenario or the restricted relay power scenario, our schemes outperform all existing schemes in asymmetric power/channel case and can be proved to be upper bound achieving. Further, we propose a novel two-hop channel model with the existence of an external eavesdropper, which is essentially different from the wire-tap type of problem and untrusted relay problem. Hence, the existing secure transmission schemes cannot be directly applied on this problem. We prove that our random binning code based scheme can be applied in this channel to achieve a positive secrecy rate.
\end{abstract}

% Note that keywords are not normally used for peerreview papers.
\begin{IEEEkeywords}
Compute-and-Forward, Two-hop Channel, Untrusted Relay, Information Theoretic Security, Weak Secrecy.
\end{IEEEkeywords}






% For peer review papers, you can put extra information on the cover
% page as needed:
% \ifCLASSOPTIONpeerreview
% \begin{center} \bfseries EDICS Category: 3-BBND \end{center}
% \fi
%
% For peerreview papers, this IEEEtran command inserts a page break and
% creates the second title. It will be ignored for other modes.


\IEEEpeerreviewmaketitle

\section{Introduction}


\IEEEPARstart{I}{nformation}
theoretic security is a problem considered by Shannon whereby no message can be retrieved even if an eavesdropper knows the coding scheme and has infinite computation capabilities \cite{shannon}.
This concept has been well studied for many channels, e.g., the wire-tap channel \cite{wyner}. 
The concept ``secrecy rate'' is proposed in \cite{wyner} for the rate of the communication under the constraint that the information leaked to the eavesdropper per channel use tends to zero when the number of channel uses tends to infinity (a constraint also known as weak secrecy).
%It is shown that the communication with non-zero secrecy rate is possible if the source-destination channel has higher capacity than the source-eavesdropper channel.

As many other classic channels, the secure transmission problem on a two-hop channel with an untrusted relay has been well studied. This channel consists of a pair of source and destination using an untrusted relay to forward the message. The relay is considered to be malicious but cooperative, it overhears the message but makes no change on it. This channel was first studied in \cite{oohama}, in which a rather pessimistic conclusion is drawn that no positive secrecy rate can be achieved by the straightforward transmission scheme. However, a later study in \cite{he} proposed a cooperative jamming \cite{tekin} based approach to achieve a positive secrecy rate, in which a cooperative node (sometimes the destination) is introduced to simultaneously transmit a jamming signal to confuse the relay while the source is transmitting. The relay then encodes its reception and transmits it to the destination. With prior knowledge of the jamming signal, the destination is able to decode the source message.

Several secure transmission schemes have been proposed based on cooperative jamming in \cite{he} and \cite{sun}-\cite{vatedka}. In \cite{he}, the source is encoded with a Gaussian code, the cooperative jammer transmits a random Gaussian signal, and the relay forwards the description of its received signal using the compress-and-forward scheme \cite{elgamal}. A similar scheme based on amplify-and-forward \cite{gastpar} is used in \cite{sun}. The amplify-and-forward based scheme is improved in \cite{zhang} by using a lattice code instead of Gaussian code at the source. This scheme is called modulo-and-forward, since the relay can take a modulo operation w.r.t. lattice structure of the code to achieve a higher secrecy rate. A compute-and-forward \cite{nazer} based scheme was introduced in \cite{he2} for a symmetric two-hop channel, in which both of the transmitting and the jamming messages are encoded with lattice codes. The relay decodes a linear combination of these messages and then sends it to the destination. Albeit the achievable secrecy rate of \cite{he2} is lower than \cite{he}, this compute-and-forward based scheme can be used in a line network since it does not suffer from noise accumulation. In \cite{he3}, a similar compute-and-forward based scheme was introduced which achieves strong secrecy with the same secrecy rate as \cite{he2}. In \cite{richter2}, another compute-and-forward based scheme was proposed for the multi-way relay channel which achieves weak secrecy rate. Bi-directional transmission on this channel is studied in \cite{vatedka}, in which a higher level of secrecy, namely perfect secrecy, is achieved by another compute-and-forward based scheme.

%Another interesting problem is the 
%The two-hop channel with an untrusted relay is considered in \cite{he}. In this channel, the message is communicated from the source to the destination through a cooperative but untrusted relay.
%It is shown that the achievable secrecy rate is 0 with the straightforward transmission scheme \cite{oohama}. However, 
%In \cite{he}, a scheme is proposed in which a Gaussian distributed signal is used as the jamming signal by the destination. The encoder exploits a random binning approach to create some randomness so that the relay is prevented from retrieving information from the jammed message. Then, the compress-and-forward based relaying technique \cite{elgamal} is used to guarantee that the message can be reliably decoded at the destination. In \cite{he2}, instead of a Gaussian distributed jamming signal and compress-and-forward, a lattice code \cite{erez} and compute-and-forward \cite{nazer} based scheme is proposed for a two-hop channel with symmetric channel gains. In \cite{he2}, the randomness is created by exploiting random binning on long sequences of lattice codewords.% Another compute-and-forward based scheme is proposed in \cite{richter}, in which the random binning is on lattice codewords.
%On a similar 3-node network, another compute-and-forward based transmission scheme is proposed in \cite{richter} for secure bi-directional transmission.


In this paper, we propose two novel secure and reliable transmission schemes based on a modified version of compute-and-forward \cite{jingge}, which we call scaled compute-and-forward. The main contributions of this paper are the following:

\begin{itemize}
\item Two novel scaled compute-and-forward based secure transmission schemes are proposed for the two-hop channel with an untrusted relay, which use a random binning code and a lattice chain to create randomness at the source, respectively. These are the first secure transmission schemes for this problem that are based on the scaled compute-and-forward technique.
\item In the symmetric case where the power and channel gains for the source, the relay, and the destination are identical, both of our schemes achieve a secrecy rate of $1/2\log_2(1/2+{\rm SNR})-1/2$, in which SNR stands for Signal-to-Noise-Ratio. This is merely $1/2$ bit per channel use away from the transmit rate using compute-and-forward on this channel. This rate is upper bound achieving when the SNR is high and is the best secrecy rate achieved so far on this channel.
\item Our schemes significantly improve the achievable secrecy rate and achieve the upper bound in many asymmetric scenarios. In general, our schemes have better performance than other existing schemes in the high SNR scenario for almost all channel configurations.
\item We consider a novel secure transmission problem on the two-hop channel, in which the relay is trusted and there exist an external eavesdropper. The problem is different from the wire-tap type of problem and the untrusted relay problem, and the existing secure transmission schemes cannot be directly used. We prove that one of our schemes can also be applied on this channel and achieves a positive secrecy rate.
\end{itemize}



%Instead of the classical random binning approached used in , we design lattice chains to create the randomness, which is inspired by an idea of Richter {\em et al.} \cite{richter}. Further, we make uses of the fact that the channel state information is revealed to both the source and the destination. The lattice codebooks used for the encoding of both the source message and the jamming signal are scaled with regard to the two channel gains. % Unlike other lattice code based schemes which are not benefited from the high channel gain of only one of the channels, our approach can make uses of a better relay-destination channel to achieve higher secrecy rate. 
%We compare our achievable secrecy rate with an upper bound derived in \cite{he} and the rates of the schemes discussed in the previous paragraph \cite{he}, \cite{he2}. It is shown that by our scheme, the achievable secrecy rate is improved, except for the very low power region.%In particular, when the relay-destination channel is better and the power of the nodes tends to infinity, our achieved secrecy rate approaches the upper bound and a constant bits per channel use higher than the achievable rate of other existing schemes.% Furthermore, if the channel between the relay and the destination is better, our scheme is upper bound achieving as the transmit power goes to infinity.

The paper is organized as follows. In Section~\ref{s:nm} we build up the model, give the state-of-the-art on the problem, and briefly introduce the scaled compute-and-forward technique as proposed in \cite{jingge}. In Section~\ref{s:ts} we introduce a reliable scaled compute-and-forward based code for transmission, which will be used as the transmission code throughout this paper. In Section~\ref{s:scs} we introduce two secure coding schemes which are built upon our reliable transmission scheme and provide secrecy. In Section~\ref{s:comp} we compare the rates of our schemes with the state-of-the-art. In Section~\ref{s:ee}, we consider another two-hop channel model in which the relay is trusted and there exist an external eavesdropper. We show that one of our schemes can also achieve a positive secrecy rate in this case. In Section~\ref{s:con}, we conclude this paper.
% The very first letter is a 2 line initial drop letter followed
% by the rest of the first word in caps.
%
% form to use if the first word consists of a single letter:
% \IEEEPARstart{A}{demo} file is ....
%
% form to use if you need the single drop letter followed by
% normal text (unknown if ever used by IEEE):
% \IEEEPARstart{A}{}demo file is ....
%
% Some journals put the first two words in caps:
% \IEEEPARstart{T}{his demo} file is ....
%
% Here we have the typical use of a "T" for an initial drop letter
% and "HIS" in caps to complete the first word.
%\IEEEPARstart{T}{his} demo file is intended to serve as a ``starter file''
%for IEEE journal papers produced under \LaTeX\ using
%IEEEtran.cls version 1.8 and later.
% You must have at least 2 lines in the paragraph with the drop letter
% (should never be an issue)
%I wish you the best of success.

%\hfill mds

%\hfill December 27, 2012

\section{Preliminaries}\label{s:nm}

%Broadcast and superposition are two nature embedded in wireless network. A traditional approach to deal with these properties in wireless network is collision avoidance, more specifically, use routing and scheduling scheme for a wireless network to create a interference-free environment for each transmission. Recently
\subsection{Model}\label{s:model}

In this paper, we consider the model used in \cite{he}. The model consists of a two-hop channel, in which node $A$ wants to transmit information to node $C$ using an untrusted relay node $R$ to forward the information. To guarantee secure communication, another node $B$, a {\em Cooperative Jammer}, is added to the network, which transmits a jamming signal to confuse the relay. We assume that the communication takes places over two phases, each including $N$ channel uses. 
We use $X^A, X^B, X^R \in \mathbb{R}^N$ for the transmitted sequences of node $A$, the cooperative jammer $B$, and the relay $R$, respectively. We use $Y^R, Y^C_1, Y^C_2\in \mathbb{R}^N$ for the receptions of the relay and node $C$ in Phase 1 and 2, respectively. In the first phase, node $A$ transmits to the relay and the cooperative jammer $B$ simultaneously transmits a jamming signal to confuse the relay. The jamming signal transmitted by the cooperative jammer $B$ is also received by node $C$. We have
%We use $\tilde{X}^A, \tilde{X}^B, \tilde{X}^R \in \mathbb{R}^N$ for the transmissions of node $A$, cooperative jammer $B$, and the relay, respectively. We use $\tilde{Y}^R, \tilde{Y}^C_1, \hat{Y}^C_2\in \mathbb{R}^N$ for the receptions of the relay and node $C$ in phase 1 and 2, respectively. In the first phase, node $A$ transmits to the relay and the cooperative jammer $B$ simultaneously transmits jamming signal to confuse the relay. Meanwhile, the jamming signal transmitted by the cooperative jammer $B$ is also received by node $C$. We have
\begin{eqnarray}
Y^R&=&X^A+X^B+Z^R_1, \label{eq:yr}\\
Y^C_1&=&X^B+Z^C_1, 
\end{eqnarray}
where $Z^R_1$ and $Z^C_1$ are $N$-dimensional independent Gaussian noise vectors with variance 1 and $\sigma^2$ in each dimension, respectively. Note that when $\sigma=0$, the model is equivalent to the model in which the destination is used as jammer.

In the second phase, the relay transmits to node $C$. We have
\begin{eqnarray}\label{eq:yb}
Y^C_2&=&X^R+Z_2^C,
\end{eqnarray}
where $Z_2^C$ is an $N$-dimensional independent Gaussian noise vector with variance $1$ in each dimension.
The power constraints for the three nodes are defined as
\begin{equation}\label{eq:power}
E[||X^i||^2] \leq NP_i, i \in \{A,B,R\}.
\end{equation}
%where $\hat{P}_i$ is a positive real number. 
%We can normalize the channel gains and consider an equivalent channel
%\begin{eqnarray}
%Y^R&=&X^A+X^B+Z^R_1, \label{eq:yr}\\
%Y^C_1&=&X^B+Z^C_1, \\
%Y^C_2&=&X^R+Z_2^C, \label{eq:yb}
%\end{eqnarray}
%where
%\begin{equation}\label{eq:power}
%\begin{array}{ll}
%E[||X^A||^2] &\leq NP_A =Nh_{AR}^2\hat{P}_A/\hat{\sigma}_R^2,\\
%E[||X^B||^2] &\leq NP_B =Nh_{BR}^2\hat{P}_B/\hat{\sigma}_R^2,\\
%E[||X^R||^2] &\leq NP_R =Nh_{RC}^2\hat{P}_B/\hat{\sigma}_C^2.
%\end{array}
%\end{equation}
%Here, $Z^R_1$ and $Z_2^C$ have unit variances, and $Z^C_1$ has a variance of $\sigma^2$ where $\sigma^2=\frac{h_{BR}^2\hat{\sigma^2}}{h_{BC}^2\hat{\sigma_R^2}}$.

It seems that we lose some generality by assuming the channel coefficients and $Z^R_1, Z^C_2$ to be unit. However, this assumption is actually w.l.o.g. and can be easily extended to any configuration of power constraints, channel coefficients, and noise variances with the same SNR for the receptions $Y^R$, $Y^C_1$, and $Y^C_2$.

We assume that the power constraints as well as $\sigma^2$ are revealed to all nodes. The source message of node $A$ is defined as $W^A\sim {\cal U} (\{1, 2, \ldots, 2^{NR_s}\})$, where the notation $X \sim {\cal U}({\cal S})$ is used for a random variable $X$ that is uniformly chosen at random from the alphabet ${\cal S}$. A secrecy rate $R_s$ is said to be achievable if for any $\delta>0$, there exists a sequence of $(2^{NR_s}, N)$ codes such that the reliability constraint
\begin{equation}\label{eq:reli}
\lim_{N\to \infty} \Pr(\hat{W}^A \ne W^A)=0
\end{equation}
and the (weak) secrecy constraint
\begin{equation}\label{eq:sec}
\lim_{N \to \infty}\frac{1}{N}I(W^A;Y^R)\leq \delta
\end{equation}
hold.
Here, $\hat{W}^A$ is the estimation of $W^A$ based on the reception $Y^C_1$ and $Y^C_2$ at node $C$.
Further, we use the notation $\mathbb{R}^+$ for the set of positive real numbers, $\mathbb{Z}^+$ for the set of positive integers, and $C(x)$ for the capacity of Gaussian channel with SNR equal to $x$, i.e.,
\begin{equation}
C(x)=\frac{1}{2}\log_2(1+x).
\end{equation}



\begin{figure}[t!]
\centering
%
%
\tikzstyle{vertex}=[circle,minimum size=30pt, inner sep=0pt, draw]
\tikzstyle{edge}=[-latex, black, thick]
\tikzstyle{dot}=[edge, dotted]
\tikzstyle{dash}=[edge, densely dashed]
\tikzstyle{loosedo}=[edge, loosely dotted]
%
%
\begin{tikzpicture}[scale=2.8]
\node[vertex] (t1) at (0,2.4)  {$A$} ;
\node[vertex] (r) at (1,2.4) {$R$};
\node[vertex] (t2) at (2,2.4) {$C$} ;
\node[vertex] (j) at (1.5,3.2) {$B$};

\draw[edge, above] (0.2,2.7) to node {Phase 1} (0.8, 2.7);
\draw[dot, above](1.35,2.9) to node {} (1.1, 2.7);
\draw[dot, above](1.65,2.9) to node {} (1.9, 2.7);
\draw[edge, above](1.2, 2.1) to node {Phase 2} (1.8, 2.1);

\node (jammer) at (1.5, 2.65) {Phase 1};

\node (xa) at (0, 2.7) {$X^A$};
\node (yr) at (1, 2.7) {$Y^R$};
\node (xb) at (1.5, 2.9) {$X^B$};
\node (xr) at (1, 2.1) {$X^R$};
\node (yc2) at (2, 2.1) {$Y^C_2$};
\node (yc1) at (2, 2.7) {$Y^C_1$};
\end{tikzpicture}
\caption{Two-hop channel with a cooperative jammer.}\label{fig:thc}
%\vspace{-2mm}
\end{figure}

\subsection{State-of-the-Art}

\subsubsection{An Upper Bound on the Secrecy Rate}
An upper bound on the secrecy rate is derived in \cite{he} by transforming this model to an equivalent multiple access wire-tap channel. The secrecy rate is upper bounded by
\begin{equation}\label{eq:ubsec}
R_b=\frac{1}{2}\log_2\frac{(P_A+1)(P_A+P_B+1)-(P_A+\rho)^2}{(P_A+P_B+1)(1-\rho^2)},
\end{equation}
where
\begin{equation}
%\begin{array}{l}
\rho=\frac{2P_A+P_AP_B+P_B-\sqrt{4P_BP_A^2+4P_BP_A+P_B^2P_A^2+2P_B^2P_A+P_B^2}}{2P_A}.
%\end{array}
\end{equation}

\subsubsection{Amplify-and-Forward Based Scheme}

A straightforward amplify-and-forward based scheme is proposed in \cite{sun} for the case that the destination is used as the jammer, i.e., $\sigma=0$. In this scheme the destination transmits a Gaussian jamming signal and the relay simply amplifies the received signal and transmits it to the destination. This scheme achieves any secrecy rate satisfying
\begin{eqnarray}
%R_s &<& \frac{1}{2}\log_2\left(1+\frac{P_AP_R}{P_A+P_B+P_R+1}\right) \nonumber \\
%&& \hspace{2cm} -\frac{1}{2}\log_2\left(1+\frac{P_A}{P_B+1}\right). \label{eq:sun}
R_s &<& \frac{1}{2}\log_2\left(1+\frac{P_AP_R}{P_A+P_B+P_R+1}\right)  -\frac{1}{2}\log_2\left(1+\frac{P_A}{P_B+1}\right). \label{eq:sun}
\end{eqnarray}

\subsubsection{Modulo-and-Forward Based Scheme}
In \cite{zhang} another scheme is proposed which uses a lattice code based coding scheme to transmit the message with an extra random vector. The destination, which is also the cooperative jammer ($\sigma=0$), transmits a Gaussian signal to confuse the relay. Due to the lattice chain structure, the relay can take a modulo operation to remove the random part of the transmission which is useless in the decoding at the destination. This results in a higher SNR for the actual message vector. In other words, it is an advanced amplify-and-forward scheme which makes uses of the properties of lattice code and lattice chain. Any secrecy rate satisfying
\begin{equation}\label{eq:zhang}
R_s < \frac{1}{2}\log_2\frac{P_A+P_R+P_AP_R+1}{P_A+P_R+2}-\frac{1}{2}\log_2\left(1+\frac{P_A}{P_B+1}\right)
\end{equation}
is achievable.

\subsubsection{Compress-and-Forward Based Scheme}
A compress-and-forward based scheme is given in \cite{he}, where the relay forwards a description of its noisy reception to the destination. Any secrecy rate
\begin{eqnarray}
%\lefteqn{R_s} \nonumber \\
%&\leq&\max_{p_A\leq P_A,p_B \leq P_B}\left(C(\frac{p_A}{(1+\sigma^2+\sigma_c^2)-\sigma^4/(p_B+\sigma^2)})\right. \nonumber \\
%&&\left. \hspace{4cm}-C(\frac{p_A}{1+p_B})\right) \label{eq:he1}
R_s < \max_{p_A\leq P_A,p_B \leq P_B}\left(C(\frac{p_A}{(1+\sigma^2+\sigma_c^2)-\sigma^4/(p_B+\sigma^2)})-C(\frac{p_A}{1+p_B})\right) \label{eq:he1}
\end{eqnarray}
%\begin{equation}\label{eq:he1}
%\begin{array}{l}
%R_s  <  \\
%\max_{p_A\leq P_A,p_B \leq P_B}C\left(\frac{p_A}{(1+\sigma^2+\sigma_c^2)-\sigma^4/(p_B+\sigma^2)}\right)-C\left(\frac{p_A}{1+p_B}\right)
%\end{array}
%\end{equation}
is achievable, where 
\begin{equation}
\sigma_c^2=\frac{p_A+1+p_B\sigma^2/(p_B+\sigma^2)}{P_R}.
\end{equation}


\subsubsection{Compute-and-Forward Based Scheme}

Compute-and-forward is a relaying technique proposed in \cite{nazer} in which the relay uses the superimposed nature of Gaussian additive channel and computes the linear combination of the transmitted messages of multiple users instead of individual messages. A compute-and-forward based scheme is proposed in \cite{he2} for a symmetric two-hop channel with jammer and destination collocated, in which node $A$ transmits the source message encoded with a lattice codebook and node $B$ (node $C$) transmits a random codeword choosing uniformly at random from the same lattice codebook. An algebraic proof is given that the sum of two $N$-dimensional lattice codewords will leak no more than $N$ bits of information to the relay. Then, a random binning based scheme is used to eliminate the information leakage. For $P_A=P_B=P_R$ and $\sigma=0$, any secrecy rate satisfying
\begin{equation}\label{eq:he2}
R_s' < \frac{1}{2}\log_2\left(\frac{1}{2}+P_A\right)-1
\end{equation}
is achievable. It is proved in \cite{he3} that this rate is also achievable if we change the weak secrecy constraint (\ref{eq:sec}) to a {\em strong secrecy} constraint
\begin{equation}\label{eq:ssec}
\lim_{N \to \infty}I(W^A;Y^R)\leq \delta
\end{equation}
by replacing the random binning based scheme to a universal hashing function based scheme.

Another compute-and-forward based scheme is proposed in \cite{vatedka}, which also considers the case of $P_A=P_B=P_R$ and $\sigma=0$. The focus of \cite{vatedka} is on {\em ``perfect secrecy''}, which is defined through
\begin{equation}\label{eq:psec}
\lim_{N \to \infty}I(W^A;Y^R)=0.
\end{equation}
A binning approach within the lattice codebook used for both $A$ and $B$ is used. The bins are selected such that for each source message, $A$ randomly selects from a certain bin of codewords with a certain probability mass function. It is proved that if the bins and the probability mass functions are chosen appropriately, perfect secrecy is achievable with any secrecy rate satisfying
\begin{equation}
R_s'' < \frac{1}{2}\log_2\left(\frac{1}{2}+P_A\right)-1-\log_2e.
\end{equation}

This scheme is extended in \cite{vatedka2}, in which the asymmetric channel/power case is considered. It is proved that perfect secrecy is achievable for some asymmetric configurations.

\subsection{Scaled Compute-and-Forward}\label{ss:scf}
Scaled Compute-and-Forward (SCF) as proposed in \cite{jingge} is a generalized version of the traditional compute-and-forward in \cite{nazer}. It allows the senders to scale their lattice codebooks according to their prior knowledge of the channel states to achieve higher computation rates. Here we briefly introduce this technique for a two user Multiple Access Channel (MAC) case.

A lattice $\Lambda$ is a discrete subgroup of $\mathbb{R}^N$ with the property that if $T_1, T_2 \in \Lambda$, then $T_1+T_2 \in \Lambda$. The lattice quantizer $Q_\Lambda$ is defined as $Q_\Lambda(X)=\argmin_{T\in \Lambda}||T- X||$. The fundamental Voronoi region of the lattice is defined as ${\cal V}= \{X \in \mathbb{R}^N| Q_\Lambda(X)=0\}$. The modulo operation is defined as $[X] \Mod{\Lambda}=X-Q_{\Lambda}(X)$. The lattice $\Lambda'$ is said to be nested in $\Lambda$ if $\Lambda' \subseteq \Lambda$. More details of lattices and lattice codes can be found in \cite{erez}.

We consider the two users having power $P_A$ and $P_B$. Firstly, we construct a lattice $\Lambda$. Then we construct two coarse lattices $\Lambda^A, \Lambda^B \subseteq \Lambda$ with second moment $\frac{1}{N {\rm Vol}({\cal V}^i)} \int_{{\cal V}^i} ||X|| dX=\beta_i^2 P_i$, $i \in \{A,B\}$, where ${\cal V}^i$ is the fundamental Voronoi region of $\Lambda^i$ and $\beta_i \in \mathbb{R}^+$ is called the scaling coefficient. Here we assume that $\Lambda, \Lambda^A$ and $\Lambda^B$ are simultaneously good for quantizing and shaping as discussed in \cite{erez}.

For user $i \in\{A, B\}$, we construct the codebook ${\cal L}^i=\Lambda \cap {\cal V}^i$, where ${\cal V}^i$ is the fundamental Voronoi region of $\Lambda^i$. %Hence the rate is
%$R^i = \frac{1}{N} \log_2 |{\cal L}^i|$. 
User $i$ encodes its message into codeword $T^i$ using the codebook ${\cal L}^i$, and the channel input is formed as
$X^i=[T^i/\beta_i+D^i] \Mod{\Lambda^i / \beta_i}$,
where $D^i\sim{\cal U}({\cal V}^i_C/ \beta_i)$ is called {\em dither}. Clearly, $X^i$ is also uniform in ${\cal V}^i / \beta_i$ and thus it has average power $P_i$. 

The receiver uses the fine lattice $\Lambda$ for decoding the linear sum $a_1 T^A+a_2 T^B, a_1, a_2 \in \mathbb{Z}$. It is proved in \cite{jingge} that the destination is able to reliably decode this linear sum as long as the transmit rates are smaller than the computation rates $R_{\rm CF}^i({\bf a}, {\boldsymbol\beta})$ defined as
%\begin{equation}
%R_{\rm CF}^i({\bf a}, {\boldsymbol\beta}) := \frac{1}{2}\log_2\left(\frac{P_i\beta_i^2}{\tilde{N}}\right)
%\end{equation}
%where
%\begin{equation}
%\tilde{N}:=\frac{P_AP_B(a_1\beta_A-a_2\beta_B)^2+(a_1\beta_A)^2P_A+(a_2\beta_B)^2P_B}{P_A+P_B+1}.
%\end{equation}
\begin{equation}\label{eq:comr2}
R_{\rm CF}^i({\bf a}, {\boldsymbol\beta})=\frac{1}{2}\log_2(\frac{\beta_i^2 P_i}{{\cal N}({\bf a}, {\boldsymbol\beta})}),
\end{equation}
where 
\begin{equation}\label{eq:nabeta}
{\cal N}({\bf a}, {\boldsymbol\beta})=\frac{P_AP_B(a_1\beta_A-a_2\beta_B)^2+(a_1\beta_A)^2P_A+(a_2\beta_B)^2P_B}{P_A+P_B+1},
\end{equation}
%\begin{equation}\label{eq:comr2}
%\begin{array}{l}
%R_{\rm CF}^i({\bf a}, {\boldsymbol\beta})=\left[\frac{1}{2}\log_2\left( \frac{1+P_A+P_B}{a_1^2\beta_A^2(1+P_B)+a_2^2\beta_B^2(1+P_A)-2a_1a_2\beta_A\beta_B\sqrt{P_AP_B}} \right) \right.  \\ 
%\left. +\frac{1}{2}\log_2 \beta_i^2 \right]^+ \\
%\end{array}
%\end{equation}
${\bf a}=(a_1, a_2)$, and $\boldsymbol\beta=(\beta_A, \beta_B)$.



\remark{For any ${\bf a}$ and ${\boldsymbol\beta}$ it can be derived from (\ref{eq:comr2}) that the computation rates satisfy
\begin{equation}\label{eq:rab}
R_{\rm CF}^A({\bf a}, {\boldsymbol\beta}) \leq C(P_A), R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) \leq C(P_B).
\end{equation}
}\label{rm:1}


%Then, we consider that case that {\em relay power constraint do not hold}. In this case, the relay becomes the bottleneck for the transmission. By simply reduce the transmitting power of the transmitter and the power, we have the following theorem.

%\theorem{On a two-hop channel with an untrusted relay, if {\em relay power constraint do not hold}, any secrecy rate $R_s$
%\begin{equation}
%R_s < aR_s'
%\end{equation}
%is achievable, where $a=\frac{P_R}{\max(P_A,P_B)}$ and $R_s'$ is the secrecy rate calculated by Theorem~\ref{th:1} as if $P_R \geq \max(P_A,P_B)$.}

\section{A Scaled Compute-and-Forward Based Code for Reliable Transmission}\label{s:ts}

As introduced in Subsection~\ref{ss:scf}, the relay node is able to compute a linear combination with coefficients ${\bf a}$ by using lattice codebooks with average power $P_i, i\in\{A,B\}$ and scaled with coefficients $\boldsymbol\beta$ if the transmit rates are smaller than the computation rates in (\ref{eq:comr2}). In this section, we will propose a reliable code for our channel, namely an $({\bf a}, {\boldsymbol\beta})$ SCF code. For given power $P_i, i\in{A,B,R}$, this code will guarantee a reliable transmission from $A$ to $C$ for a source symbol chosen uniformly at random from $\{1,2,\ldots, 2^{NR_t^A({\bf a}, {\boldsymbol\beta})}\}$ if
\begin{equation}\label{eq:rtascf}
R_t^A({\bf a}, {\boldsymbol\beta}) < \min (C(P_R), R_{\rm CF}^A({\bf a}, {\boldsymbol\beta}))
\end{equation}
and
\begin{equation}\label{eq:1c}
R_{\rm CF}^B({\bf a}, {\boldsymbol\beta})\leq C(P_B/\sigma^2).
\end{equation}

We will firstly introduce the lattice codebook construction in detail, then describe the transmission process. In the end, we will calculate the rate of information leaked to the relay with this scheme during the transmission.


%As introduced in Subsection~\ref{ss:scf}, the relay node is able to compute a linear combination with coefficients ${\bf a}$ with a computation rate tuple smaller than $R_{\rm CF}^i({\bf a}, {\boldsymbol\beta})$ by using lattice codebooks with average power $p_A$ and $p_B$ and scaled with coefficients $\boldsymbol\beta$. In this section, we will propose a scaled compute-and-forward based transmission scheme, namely a $({\bf a}, {\boldsymbol\beta})$ transmission scheme, for any chosen ${\bf a}, {\boldsymbol\beta}$, and ${\bf p}$.

\subsection{Codebook Construction}\label{ss:cc}

Here we describe our codebook constructed with the SCF technique. For an $({\bf a}, {\boldsymbol\beta})$ SCF code and an arbitrarily chosen positive real number $\delta'$, we select a fine lattice $\Lambda$ and a pair of shaping lattices $\Lambda_C^i({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda, i\in\{A,B\}$ which have the following properties: 
\begin{itemize}
\item {\bf Power:}
We have
\begin{equation}\label{eq:lp}
\begin{array}{l}
\frac{1}{N {\rm Vol}({\cal V}_C^i({\bf a}, {\boldsymbol\beta}))}\int_{{\cal V}_C^i({\bf a}, {\boldsymbol\beta})} ||X||^2 dX=\beta_i^2 P_i, i\in\{A, B\},
\end{array}
\end{equation}
where ${\cal V}_C^i$ is the fundamental Voronoi region of $\Lambda_C^i({\bf a}, {\boldsymbol\beta})$.
\item{\bf Nesting:}
The coarser one of $\Lambda_C^i({\bf a}, {\boldsymbol\beta})$ is nested in the finer one.
\item{\bf Rate:}
Denote $\hat{R}_t^i({\bf a}, {\boldsymbol\beta}) = \frac{1}{N} \log_2 |\Lambda \cap {\cal V}_C^i({\bf a}, {\boldsymbol\beta})|$. Then, for the chosen $\delta'$, we have
\begin{equation}\label{eq:rtcf}
R_{\rm CF}^i({\bf a}, {\boldsymbol\beta}) - \delta' < \hat{R}_t^i({\bf a}, {\boldsymbol\beta})<R_{\rm CF}^i({\bf a}, {\boldsymbol\beta}).
\end{equation}
\item{\bf Goodness:}
These lattices are all good in both quantizing and shaping in the sense of \cite{erez}. 
\end{itemize}

By \cite{erez}, we can find lattices satisfying the above-mentioned properties. Then, we construct the lattice codebooks $\Lambda \cap {\cal V}_C^i({\bf a}, {\boldsymbol\beta})$ for transmission. %The encoding is mapping the source from $\{1,2,\ldots, 2^{NR_t^i({\bf a}, {\boldsymbol\beta})}\}$ where $R_t^i({\bf a}, {\boldsymbol\beta}) \in [0, \hat{R}_t^i({\bf a}, {\boldsymbol\beta})]$ to a lattice point in ${\cal L}^i$.

%For node $A$, we construct a $N$-dimensional lattice chain $\Lambda_C^A \subseteq \Lambda_E^A \subseteq \Lambda$. ${\cal V}^A_C$, ${\cal V}_E^A$ and ${\cal V}$ are the fundamental Vonoroi regions of these lattices, respectively (Fig~\ref{fig:lc}). A similar lattice chain is constructed for node $B$, and the notations are similar except the superscript $A$ is substituted by $B$. We let $\frac{1}{N {\rm Vol}({\cal V}_C^i)} \int_{{\cal V}_C^i} ||X||^2 dX=\beta_i^2 P, i\in\{A, B\}$. Here, we let $\Lambda_C^B$ be nested in $\Lambda_C^A$ and $\beta_A \leq \beta_B=1$. The value of $\beta_A$ will be specified later.
%These lattices are all good in the sense of \cite{erez}. 

\subsection{Reliable Transmission Process}\label{ss:rt}

\begin{itemize}
%Here, we only consider the case that $P_R \geq \max(P_A,P_B)$, the other cases with be discussed in latter sessions.

%\subsubsection{The case $h_1 \leq h_2$}
%In this case, we set $\beta_A=\sqrt{\frac{1+h_1^2P}{1+h_2^2P}}$. 
%Thus we have $\beta_A \leq \beta_B$, and $\Lambda_C^B \subseteq \Lambda_C^A$. We will later show that the achievable secrecy rate is maximized when the sum computation rate is maximized.

\item {\bf Phase 1, node $A$.}

Firstly, the message $W^A$ is uniquely mapped to a lattice vector in $\Lambda \cap {\cal V}_C^A({\bf a}, {\boldsymbol\beta})$ by the encoder, Then, a dither $D^A$ is uniformly chosen from the scaled Voronoi region ${\cal V}^A_C({\bf a}, {\boldsymbol\beta})/\beta_A$. Note that dithers are chosen to fulfill the power constraints of lattice codes and are revealed to all nodes. The transmitted lattice vector of node $A$ is 
\begin{equation}\label{eq:xa}
X^A = [T^A/\beta_A+D^A] \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})/\beta_A}.
\end{equation}


\item {\bf Phase 1, node $B$.}

Node $B$ transmits a jamming signal, namely $V^B$, which is uniformly chosen at random from $\Lambda \cap {\cal V}_C^B({\bf a}, {\boldsymbol\beta})$.
The transmitted vector is thus
\begin{equation}\label{eq:xb}
X^B=[V^B/\beta_B+D^B] \Mod{\Lambda_C^B({\bf a}, {\boldsymbol\beta})/\beta_B},
\end{equation}
in which $D^B \sim {\cal U}({\cal V}^B_C({\bf a}, {\boldsymbol\beta})/\beta_B)$. 
It it clear from the definition that the average power of both $X^A$ and $X^B$ does not exceed the power constraint of (\ref{eq:power}).

\item {\bf Phase 1, node $C$}

By our codebook construction, node $C$ can reliably decode $V^B$ if (\ref{eq:1c}) holds.


\item {\bf Phase 1, the relay.}

Upon receiving $Y^R$ in (\ref{eq:yr}), by \cite{jingge}, the relay is able to decode $$U^R=a_1T^A+a_2V^B$$ with the lattice $\Lambda$ with high probability if 
\begin{equation}\label{eq:racf}
\hat{R}^i_t({\bf a}, {\boldsymbol\beta}) < R_{\rm CF}^i({\bf a}, {\boldsymbol\beta}), i\in\{A, B\},
\end{equation}
which has already be guaranteed by the codebook construction in (\ref{eq:rtcf}).
%We set ${\bf a} = (1,1)^T$ and let the relay decode the vector $T^A+V^B$.

\item{\bf Phase 2, the relay}

The relay firstly scales the decoded vector down by computing $U^R/a_1 =T^A+(a_2/a_1)V^B$. Then, similar to the compute-and-forward scheme proposed for the two-way relay channel \cite{nazer2}, a modulo operation is taken on the decoded vector. The lattice for the modulo operation $\Lambda^*$ should be chosen such that $\Lambda^* \subseteq \Lambda_C^A({\bf a}, {\boldsymbol\beta})$ to guarantee that the vector $T^A$ can be retrieved by node $C$. For the sake of power, we let the relay take a modulo operation on the decoded vector w.r.t. $\Lambda_C^A({\bf a}, {\boldsymbol\beta})$. We denote the resulting vector as $\tilde{U}^R$ and 
\begin{equation}
\tilde{U}^R =U^R/a_1 \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})}=(T^A+(a_2/a_1)V^B) \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})}.
\end{equation}
%and then scales the vector down by a factor of $\beta_A$ before transmitting. The transmission of the relay is then $$X^R = [\tilde{U}^R/\beta_A+D^R] \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})/\beta_A},$$ where $\tilde{U}^R =U^R/a_1 \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})}$, and $D^R$ is the dither uniformly chosen from ${\cal V}_C^A({\bf a}, {\boldsymbol\beta})/\beta_A$. Then, by (\ref{eq:lp}), for this transmission scheme we have an extra power constraint of (\ref{eq:prc}).
Then, the relay transmits this vector using any capacity achieving channel code on the Additive White Gaussian Noise (AWGN) channel. By definition, the entropy of this vector has the property of
\begin{equation}\label{eq:hur}
\frac{1}{N} H(\tilde{U}^R) \leq \hat{R}_t^A({\bf a}, {\boldsymbol\beta})\leq R_{\rm CF}^A({\bf a}, {\boldsymbol\beta}) \leq C(P_A).
\end{equation} 
When $P_R \geq P_A$, this vector can be reliably transmitted by the relay straightforwardly.
When $P_R < P_A$, we consider a long term of transmission during which the model is used for $K \in \mathbb{Z}^+$ times. We only use $\lceil K \frac{C(P_R)}{\hat{R}_t^A({\bf a}, {\boldsymbol\beta})}\rceil$ times Phase 1 and fully use all $K$ times Phase 2 of these model uses. By choosing $K$ sufficiently large, the transmit rate can be made arbitrarily close to
\begin{equation}\label{eq:rta0}
R_t^A({\bf a}, {\boldsymbol\beta}) \frac{C(P_R)}{\hat{R}_t^A({\bf a}, {\boldsymbol\beta})}.
\end{equation}
Combining these two cases, in a long term transmission, any rate satisfying (\ref{eq:rtascf}) is achievable.


\item {\bf Phase 2, node $C$.}
%Observe that the transmission $X^R$ is equivalent of transmitting the vector $[T^A+V^A+V^B] \Mod{\Lambda_C^x} \in \Lambda \cap {\cal V}_C^x$ using lattice code. 

%Since $\tilde{U}^R\in \Lambda \cap {\cal V}_C^A({\bf a}, {\boldsymbol\beta})$, by the choice of $\Lambda_C^A$, we have 
%\begin{equation}\label{eq:hur}
%\frac{1}{N} H(\tilde{U}^R) < R_{\rm CF}^A({\bf a}, {\boldsymbol\beta}) \leq C(P_A) \leq C(P_R).
%\end{equation} 
%Then, by the property of good lattice codes, upon receiving $Y^C$ in (\ref{eq:yb}), node $C$ can reliably decode $\tilde{U}^R$. 
%Combining this with (\ref{eq:rab}) and $h_1 \leq h_2$, the inequality
%\begin{equation}\label{eq:relay}
%\frac{1}{N} H(\tilde{U}^R) < \frac{1}{2}\log_2(1+h_2^2P)
%\end{equation}
%holds if (\ref{eq:racf}) holds. 
%Note that ${\bf a}$ and ${\boldsymbol\beta}$ are revealed to all nodes. Assume $\Lambda_C^x, x\in\{A,B\}$ is the coarser one of $\Lambda_C^A$ and $\Lambda_C^B$. 
Since node $C$ can reliably decode $\tilde{U}^R$, it can then decode $T^A$ by computing
\begin{eqnarray}
\lefteqn{[\tilde{U}^R -(a_2/a_1)V^B] \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})}} \nonumber \\
%&=& [(T^A+(a_2/a_1)V^B) \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})} -(a_2/a_1)V^B] \nonumber \\
%&& \hspace{5cm} \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})}  \nonumber \\
&=& [(T^A+(a_2/a_1)V^B) \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})} -(a_2/a_1)V^B]  \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})}  \nonumber \\
&=&[T^A+(a_2/a_1)V^B-(a_2/a_1)V^B] \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})} \nonumber \\
&= & [T^A] \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})} \nonumber \\
&=& T^A.
\end{eqnarray}
%Since $a_1$, $a_2$ and all the codebooks are revealed to node $B$, by decoding the codeword transmitted from the relay, node $B$ is able to recover the linear sum $a_1X^A+a_2X^B$ and the codeword $X^A$ by subtracting its own transmission $X^B$. 
Since $T^A$ is reliably decoded, $W^A$ can then be retrieved.
\end{itemize}

As we have already discussed the reliability of the decoding in each step of the process, by choosing $\delta'$ arbitrarily small we have the following lemma.

\lemma{For any ${\bf a}, {\boldsymbol\beta}$, an $({\bf a}, {\boldsymbol\beta})$ SCF code guarantees power constraint (\ref{eq:power}) and reliability constraint (\ref{eq:reli}) with any rate satisfying (\ref{eq:rtascf}) if (\ref{eq:1c}) holds.}\label{lm:scf}
%\remark{For the transmission of the relay in {\bf Phase 2, the relay}, it uses the same lattice codebook as node $A$ to transmit the vector $\tilde{U}^R$. Actually, as long as the power constraint (\ref{eq:prc}) holds, any capacity achieving channel code can be used here to guarantee the reliable transmission of $\tilde{U}^R$.}\label{rm:3}

\subsection{Information Leakage Rate}

By Lemma~\ref{lm:scf}, we guarantee that the information can be reliably transmitted from the source to the destination with the given power constraint. However, during the process, part of the information is leaked to the relay. Here we define the information leakage rate $R_o({\bf a}, {\boldsymbol\beta})$ (sometimes referred as equivocation rate) as
\begin{equation}
R_o({\bf a}, {\boldsymbol\beta}) = \frac{1}{N}I(W^A;Y^R)
\end{equation}
and bound it by
\begin{eqnarray}
%\lefteqn{R_o({\bf a}, {\boldsymbol\beta})} \nonumber \\
%&=&\frac{1}{N}(H(W^A)-H(X^A,X^B|Y^R) \nonumber \\
%&& -H(W^A|Y^R,X^A,X^B)+H(X^A,X^B|Y^R,W^A)) \nonumber\\
R_o({\bf a}, {\boldsymbol\beta}) &=&\frac{1}{N}(H(W^A)-H(X^A,X^B|Y^R) -H(W^A|Y^R,X^A,X^B)+H(X^A,X^B|Y^R,W^A)) \nonumber \\
&=& \frac{1}{N}(H(W^A)-H(X^A, X^B)+I(X^A,X^B;Y^R)) \nonumber\\
&<& \frac{1}{N}(H(W^A)-H(X^A)-H(X^B)) +C(P_A+P_B) \nonumber \\
&=& R_t^A({\bf a}, {\boldsymbol\beta}) -R_t^A({\bf a}, {\boldsymbol\beta}) -R_t^B({\bf a}, {\boldsymbol\beta}) +C(P_A+P_B) \nonumber \\
&=& -R_t^B({\bf a}, {\boldsymbol\beta})+C(P_A+P_B). \label{eq:il4}
\end{eqnarray} 

The second equality holds since the third term on the RHS of the first equality is 0 since $W^A$ is one-to-one mapped to $X^A$. Further, the fourth term is also 0 for that the relay knows $X^A$ by knowing $W^A$, and it can reliably decode $X^B$ when $X^A$ is known. Then, the inequality follows from the capacity for Gaussian MAC and the third equality follows from the definition of the $({\bf a}, {\boldsymbol\beta})$ SCF code.
In the next section, we will propose two schemes to eliminate the information leakage.

\section{Secure Coding Schemes}\label{s:scs}

In the previous section, we have proposed a reliable code for transmission, namely an $({\bf a}, {\boldsymbol\beta})$ SCF code. For any ${\bf a}, {\boldsymbol\beta}$, a reliable transmission of a source symbol chosen uniformly at random from $\{1,2,$ $\ldots, 2^{NR_t^A({\bf a}, {\boldsymbol\beta})}\}$ is guaranteed if conditions (\ref{eq:rtascf}) and (\ref{eq:1c}) hold. Then, we bounded the information leakage rate during the process $R_o({\bf a}, {\boldsymbol\beta})$ in (\ref{eq:il4}).%This information leakage can be eliminated by adding extra randomness while encoding $W^A$ to $X^A$.

In this section, we introduce two schemes of adding extra randomness at the source, which can eliminate the information leakage. Both schemes are built upon the $({\bf a}, {\boldsymbol\beta})$ SCF code. The first one uses the classical random binning idea and is constructed in a two-layer structure. We use the $({\bf a}, {\boldsymbol\beta})$ SCF code as inner code and a random binning code as outer code. The second scheme is a lattice chain based scheme using an $({\bf a}, {\boldsymbol\beta})$ SCF lattice chain code, in which a mid-layer lattice is added to the lattice codebook of the $({\bf a}, {\boldsymbol\beta})$ SCF code to create randomness. Since this code is a modified version of $({\bf a}, {\boldsymbol\beta})$ SCF code, we will describe the difference between this code and the $({\bf a}, {\boldsymbol\beta})$ SCF code described in Section~\ref{s:ts}. %In Fig~\ref{fig:str}, we give an illustration for the structures of both of our scheme.

%\begin{figure}[t!]
%\centering
%\begin{tikzpicture}
%\draw (1.6,5.2) node {Random binning based scheme};
%\shadedraw [double, rounded corners] (-2,2.4) rectangle (5,5);
%\node (ic) at (1.5,3) [rectangle, double, rounded corners, draw, inner sep=10pt, minimum size=6mm] {Inner Code: $({\bf a}, {\boldsymbol\beta})$ SCF code};
%\node (oc) [above of=ic] {outer code: random binning code};
%\draw (1.6,1.7) node {Lattice chain based scheme};
%\shadedraw [double, rounded corners] (-2,-1.1) rectangle (5,1.5);
%\node [text width=7cm,text centered] (oc) at (1.55, 0.2) {$({\bf a}, {\boldsymbol\beta})$ SCF lattice chain code};
%\end{tikzpicture}
%\caption{Structures of the two secure coding schemes}\label{fig:str}
%\end{figure}

\subsection{Random Binning Based Scheme}\label{ss:rbbs}

The classical random binning idea is introduced in \cite{wyner} and widely used in many secure transmission scenarios. Here, we borrow the idea of the random binning codes from \cite{csiszar} and the two-layer structure from \cite{he2}. We propose a random binning based scheme (RB scheme), which is constructed by an $({\bf a}, {\boldsymbol\beta})$ SCF code as inner code and a random binning code as outer code. The random binning code is designed to encode the messages into a long sequence of lattice codewords of a chosen $({\bf a}, {\boldsymbol\beta})$ SCF code. Here we introduce our random binning code in detail.

\subsubsection{Random Binning Code}

\begin{itemize}
\item {\bf Codebook Construction} Generate $2^{\lfloor l H(W^A) \rfloor}$ bins, where $l$ should be chosen sufficiently large. Label each bin by a different length-$l$ typical sequence of $W^A$. The size of each bin (the upper bound for the number of the codewords in each bin) is $2^{\lfloor l' N R_o({\bf a}, {\boldsymbol\beta})\rfloor}$, where $l'=  l\frac{H(W^A)}{N(R_t^A({\bf a}, {\boldsymbol\beta})-R_o({\bf a}, {\boldsymbol\beta}))}$.

Generate $2^{NR_t^A({\bf a}, {\boldsymbol\beta})\lceil l'\rceil}$ codewords. The codewords are length $\lceil l' \rceil$ sequences of $N$-dimensional lattice codewords generated with the codebook described in Section~\ref{ss:cc}.
Put the codewords into the bins uniformly at random until all bins are filled.

\item {\bf Encoding} For each length-$l$ sequence of source messages, the encoder chooses the bin with the same label, then chooses a codeword from the bin uniformly at random and transmits it. If the message sequence does not match any label of bins, or there is no codeword in the matching bin, it transmits a random length-$\lceil l' \rceil$ sequence of lattice codewords as its codeword. The code structure of the RB scheme is illustrated in Fig.~\ref{fig:encode}.

\item {\bf Transmission} Here, we consider that we use our model $\lceil l'\rceil$ times. Each time a lattice codeword is reliably transmitted from node $A$ to $B$. Thus, after $\lceil l'\rceil$ times, a random binning codeword is reliably transmitted. For each phase, the channel is used for $N\lceil l'\rceil$ times.

\item {\bf Decoding} By receiving the codeword, it looks that up into the codebook and uses the label of the bin as the estimation.

\begin{figure}
\centering

\begin{tikzpicture}[scale=.35]
\tikzstyle{->}=[-latex];

\node [text width = 20mm] at (-15,2) {Source};

\node [text width = 20mm] at (-15,-1.5) {\singlespace Random binning codewords};

\node [text width = 20mm] at (-15, -6) {\singlespace $({\bf a}, {\boldsymbol\beta})$ SCF codewords};



\begin{scope}[xshift=-6cm,yshift=2cm]
\draw (-4,-.8) rectangle (6,.8);
\foreach \x in {-4,-2,0,4,6}
 {
    \draw (\x,-.8) -- (\x,.8);
}

\node[fill=white,inner sep=0pt] at (-3,0) {$W^A$};
\node[fill=white,inner sep=0pt] at (-1,0) {$W^A$};
\node[fill=white,inner sep=0pt, minimum width=10mm] at (2,0) {$\cdots$};
\node[fill=white,inner sep=0pt] at (5,0) {$W^A$};




\draw[->] (0,1.45) -- (-4,1.45);
\draw[->] (2,1.45) -- (6,1.45);

\node[fill=white,inner sep=0pt] at (1,1.45) {$l$};



%\draw[|<->|] (-4,-1.4) -- (6,-1.4);
%\node[fill=white,inner sep=1pt, minimum width=15mm] at (1,-1.4) {$l_A'$};

%\draw[|<->|] (-4,2.4) -- (24,2.4);
%\node[fill=white,inner sep=1pt, minimum width=25mm] at (10,2.2) {$k_A$};

\end{scope}

\draw[dashed,->] (-10,1.3) -- (-10,-1.3);
\draw[dashed,->] (0,1.3) -- (6,-1.3);

\begin{scope}[xshift=-6cm,yshift=-2cm]
\draw (-4,-.8) rectangle (12,.8);
\foreach \x in {-4,-2,0,8,10,12}
 {
    \draw (\x,-.8) -- (\x,.8);
}
\node[fill=white,inner sep=1pt] at (-3,0) {$X^A$};
\node[fill=white,inner sep=1pt] at (-1,0) {$X^A$};
%\node[fill=white,inner sep=1pt] at (-1,0) {$w_2^A$};
%\node[fill=white,inner sep=2pt, minimum width=60mm] at (4,0) {$X_1^A$};
%\node[fill=white,inner sep=1pt] at (5,0) {$w_{l_A'}^A$};
\node[fill=white,inner sep=1pt] at (4,0) {$\cdots$};
\node[fill=white,inner sep=1pt] at (9,0) {$X^A$};
\node[fill=white,inner sep=1pt] at (11,0) {$X^A$};
%\node[fill=white,inner sep=1pt] at (11,0) {$w_{l_A}^A$};



%\node[fill=white,inner sep=1pt, minimum width=60mm] at (24,0) {$X_{k_A}^A$};
%\node[fill=white,inner sep=1pt] at (19.8,0) {$\cdots$};
%\node[fill=white,inner sep=0pt] at (24.8,0) {$w_{k_Al_A'}^A$};

%\node[fill=white,inner sep=0pt] at (30.8,0) {$w_{k_Al_A}^A$};


%\fill[nearly transparent] (6,-.8) rectangle (12,.8);
%\fill[nearly transparent] (26,-.8) rectangle (32,.8);

\draw[|<->|] (-4,1.4) -- (12,1.4);
\node[fill=white,inner sep=0pt, minimum width=15mm] at (4,1.5) {$\lceil l' \rceil$};

%\draw[|<->|] (-4,2.4) -- (24,2.4);
%\node[fill=white,inner sep=1pt, minimum width=25mm] at (10,2.2) {$k_A$};

\end{scope}

\draw[dashed,->] (-10,-2.8) -- (-10,-5.5);
\draw[dashed, ->] (-8,-2.8) -- (2,-5.5);

\begin{scope}[xshift=-6cm,yshift=-6cm]
\draw (-4,-.5) rectangle (8,.5);
\foreach \x in {-3,-2,-1,5,6,7}
 {
    \draw (\x,-.5) -- (\x,.5);
}
%\draw[ultra thick] (-4,-.5) -- (-4,1.4);
%\draw[ultra thick] (12,-.5) -- (12,1.4);
%\draw[ultra thick] (16,-.5) -- (16,1.4);
%\draw[ultra thick] (32,-.5) -- (32,1.4);
%\node[fill=white,inner sep=1pt] at (-3,0) {$w_1^A$};
%\node[fill=white,inner sep=1pt] at (-1,0) {$w_2^A$};
%\node[fill=white,inner sep=2pt, minimum width=60mm] at (4,0) {$X_1^A$};
%\node[fill=white,inner sep=1pt] at (5,0) {$w_{l_A'}^A$};
\node[fill=white,inner sep=1pt] at (2,0) {$\cdots$};

\draw[|<->|] (-4,-1.2) -- (8,-1.2);
\node[fill=white,inner sep=1pt, minimum width=28mm] at (2,-1.3) {$N$ channel inputs};
%\draw[|<->|] (16,-1.2) -- (32,-1.2);
%\node[fill=white,inner sep=1pt, minimum width=15mm] at (24,-1.3) {$c$};
%\draw[|<->|] (-4,2.4) -- (24,2.4);
%\node[fill=white,inner sep=1pt, minimum width=25mm] at (10,2.2) {$k_A$};

\end{scope}

\end{tikzpicture}
\endpgfgraphicnamed
\caption{Structure of the random binning based scheme.}\label{fig:encode}
\end{figure}

\end{itemize}

\subsubsection{Reliability}\label{sss:re}

Since the reliability of the $({\bf a}, {\boldsymbol\beta})$ SCF code is already shown in Section~\ref{s:ts}, we now show the reliability of the random binning code. 

A length-$l$ sequence of source messages can be reliably retrieved if the length-$\lceil l' \rceil$ sequence of lattice codewords is reliably decoded and is the codeword for the correct messages. The former is guaranteed by Lemma~\ref{lm:scf}. An error in the latter can be caused either by an unlabeled message or an empty bin. There are two situations for the unlabeled messages. 
1, the message is typical but there is no matching label. 2, the message is not typical. By the property of typicality, the probability for both situations to occur are negligible when $N,l \to \infty$. Moreover, since the expected number of codewords in one bin is almost $2^{lNR_o({\bf a}, {\boldsymbol\beta})}$, by the law of large number, the probability of the existence of empty bins is also negligible when $N,l \to \infty$. Hence, the estimation error is vanishing when $N,l \to \infty$.

\subsubsection{Information Leakage Rate}

Here, we show that the RB scheme achieves the information theoretic security. 

\lemma{For any $\delta>0$, there exist a sequence of codes constructed with an $({\bf a}, {\boldsymbol\beta})$ SCF code as inner code and a random binning code as outer code which achieves
\begin{equation}
\frac{1}{N}I(W^A;Y^R)<\delta
\end{equation}
}\label{lm:rb}

The proof of this lemma is given in Appendix~\ref{ap:1}.

\subsubsection{Achievable Secrecy Rate}

Here, we discuss three cases of whether the relay has limited power and whether $\sigma$ is larger than a threshold $\underline{\sigma}$ where
\begin{equation}
\underline{\sigma}=\sqrt{1+\frac{1+P_A+P_B}{P_AP_B-P_A-1}}.
\end{equation}
Note that a chosen $({\bf a}, {\boldsymbol\beta})$ SCF code is associated with a threshold for transmit rate $\hat{R}_t^A({\bf a}, {\boldsymbol\beta})$. The actual transmit rate $R_t^A({\bf a}, {\boldsymbol\beta})$ can be chosen arbitrarily in $[0,\hat{R}_t^A({\bf a}, {\boldsymbol\beta})]$. Hence, for each case, we specify the code and transmit rate, i.e., ${\bf a}$, ${\boldsymbol\beta}$, and $R_t^i({\bf a}, {\boldsymbol\beta})$.

\begin{itemize}
\item $P_R \geq P_A$ and $\sigma \leq \underline{\sigma}$.

Firstly, for any $({\bf a}, {\boldsymbol\beta})$, we can bound the achievable secrecy rate of a RB scheme by 
\begin{eqnarray}
R_s&=&\frac{lH(W^A)}{N\lceil l' \rceil}  \nonumber \\
&\geq & R_t^A({\bf a}, {\boldsymbol\beta})-R_o({\bf a}, {\boldsymbol\beta})-\epsilon \nonumber \\
&>& R_t^A({\bf a}, {\boldsymbol\beta})+R_t^B({\bf a}, {\boldsymbol\beta})-C(P_A+P_B)-\epsilon \label{eq:rsl}
\end{eqnarray}
where $\epsilon$ can be made arbitrarily small by choosing sufficiently large $l$ and small $\delta'$. The first and the second inequality simply follow from the definition of $l'$ and $R_o({\bf a}, {\boldsymbol\beta})$, respectively.

Then, when $P_R \geq P_A$ and $\sigma \leq \underline{\sigma}$, (\ref{eq:rsl}) is maximized when $R_t^i ({\bf a}, {\boldsymbol\beta})=\hat{R}_t^i({\bf a}, {\boldsymbol\beta})$. Note that by (\ref{eq:rtcf}), $\hat{R}_t^i({\bf a}, {\boldsymbol\beta})$ is arbitrarily close to $R_{\rm CF}^i({\bf a}, {\boldsymbol\beta})$ when $\delta'$ is chosen arbitrarily small. Hence, any secrecy rate satisfying 
\begin{equation}\label{eq:rbrs1}
R_s < \max_{{\bf a}, {\boldsymbol\beta}}R_s({\bf a}, {\boldsymbol\beta})
\end{equation}
is achievable, where
\begin{equation}
R_s({\bf a}, {\boldsymbol\beta})=R_{\rm CF}^A({\bf a}, {\boldsymbol\beta})+R_{\rm CF}^B({\bf a}, {\boldsymbol\beta})-C(P_A+P_B).
\end{equation}
It can be easily calculated that the maximum is reached when ${\bf a}=(1,1)$ and $\frac{\beta_A}{\beta_B}=\sqrt{\frac{P_B(1+P_A)}{P_A(1+P_B)}}$. In this case we have
\begin{eqnarray}
%\lefteqn{\max_{{\bf a}, {\boldsymbol\beta}}R_s({\bf a}, {\boldsymbol\beta})} \nonumber \\
%&=&\frac{1}{2}\log_2\frac{1+P_A+P_B}{(\sqrt{(1+P_A)(1+P_B)}-\sqrt{P_AP_B})^2}-1. \nonumber \\ \label{eq:rsmax}
\max_{{\bf a}, {\boldsymbol\beta}}R_s({\bf a}, {\boldsymbol\beta}) &=&\frac{1}{2}\log_2\frac{1+P_A+P_B}{(\sqrt{(1+P_A)(1+P_B)}-\sqrt{P_AP_B})^2}-1.  \label{eq:rsmax}
\end{eqnarray}

\item $P_R \geq P_A$ and $\sigma > \underline{\sigma}$.

In this case, first of all, if we simply apply the code of the previous case, $R_t^B({\bf a}, {\boldsymbol\beta})$ will be larger than $C(P_B/\sigma^2)$ and the transmitted vector $V^B$ will not be decodable at node $C$. Also, it can be calculated that the achievable secrecy rate is not optimal by adjusting ${\bf a}, {\boldsymbol\beta}$ such that $\hat{R}_t^i({\bf a}, {\boldsymbol\beta})<C(P_B/\sigma^2)$.

Actually, the maximum secrecy rate will be given by choosing ${\bf a}$, ${\boldsymbol\beta}$, and $R_t^i({\bf a}, {\boldsymbol\beta})$ such that $R_{\rm CF}^A({\bf a}, {\boldsymbol\beta})=C(P_A)$, $R_t^A({\bf a}, {\boldsymbol\beta})$ very close to $C(P_A)$, and $R_t^B({\bf a}, {\boldsymbol\beta})$ very close to $C(P_B/\sigma^2)$. The choice of $R_t^B({\bf a}, {\boldsymbol\beta})$ is feasible because $\hat{R}_t^B({\bf a}, {\boldsymbol\beta})$ can be chosen arbitrarily close to $R_{\rm CF}^B({\bf a}, {\boldsymbol\beta})$ and when $\sigma > \underline{\sigma}$, $R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) > C(P_B/\sigma^2)$. Thus, by (\ref{eq:rsl}), any secrecy rate satisfying
\begin{equation}\label{eq:rbrs2}
R_s < C(P_A)+C(P_B/\sigma^2)-C(P_A+P_B)
\end{equation}
is achievable.

\item $P_R < P_A$. 

In this case, for $\sigma \leq \underline{\sigma}$ and $\sigma > \underline{\sigma}$, the setting for ${\bf a}$, ${\boldsymbol\beta}$, and $R_t^i({\bf a}, {\boldsymbol\beta})$ are identical to the previous two cases, respectively. The difference is that the relay should apply the transmission scheme for $P_R < P_A$, which has already been stated in Subsection~\ref{ss:rt}. As a result, the achievable secrecy rate is simply the achievable secrecy rate of the previous two cases times $\frac{C(P_R)}{\hat{R}_t^A ({\bf a}, {\boldsymbol\beta})}$.

%In this case, the $({\bf a}, {\boldsymbol\beta})$ SCF code cannot be applied straightforwardly due to constraint (\ref{eq:prc}). Then, we consider a long term of transmission during which the model is used for many times. We skip some of the Phase 1 of the model uses, which will not violate the secrecy constraint. Then, with the receptions in Phase 1, as already stated in Remark~\ref{rm:3}, instead of sending $\tilde{U}^R$ with the same lattice codebook as {\bf Phase 2, the relay} in Segment~\ref{ss:rt}, we can also send it with any capacity achieving channel node. By (\ref{eq:hur}), the achievable secrecy rate for the long term transmission is simply the achievable secrecy rate of the previous two cases times $\frac{C(P_R)}{R_t^A ({\bf a}, {\boldsymbol\beta})}$
\end{itemize}
Combining the three cases, we have the following theorem.

\theorem{For a two-hop channel with an untrusted relay, with the RB scheme, any secrecy rate $R_s$ satisfying
\begin{equation}\label{eq:rsrb11}
R_s < \max_{{\bf a},{\boldsymbol\beta}}[\min(\frac{C(P_R)}{R_{\rm CF}^A ({\bf a}, {\boldsymbol\beta})},1)R_s({\bf a}, {\boldsymbol\beta})]
\end{equation}
is achievable if $\sigma \leq \underline{\sigma}$ and
\begin{equation}\label{eq:rsrb12}
R_s <\min(\frac{C(P_R)}{C(P_A)},1)(C(P_A)+C(P_B/\sigma^2)-C(P_A+P_B))
\end{equation}
is achievable if $\sigma > \underline{\sigma}$.}\label{lm:rb2}


\subsection{Lattice Chain Based Scheme}

%Comparing to adding randomness by a RB scheme, we propose a LC scheme inspired by \cite{richter}. The LC scheme enjoys the benefit of a simpler structure and more efficient decoding schemes. Moreover, similar to \cite{zhang}, the LC scheme allows the relay to remove the randomness added by $A$ which is useless for $B$ to decode the actual message. Hence, it has a better performance

The lattice chain based scheme (LC scheme) is inspired by the lattice chain code used in \cite{richter}. Here, we propose an $({\bf a}, {\boldsymbol\beta})$ SCF lattice chain code, which is an $({\bf a}, {\boldsymbol\beta})$ SCF code with the transmitted lattice vector splitting into two parts, a message vector and a random vector. Now, we describe this code in detail. Since it is modified over an $({\bf a}, {\boldsymbol\beta})$ SCF code, we only focus on the parts that are modified. All the notations and terms have the same meanings as in Section~\ref{s:ts} without further explanation.

\subsubsection{Coding Scheme}

The codebook of an $({\bf a}, {\boldsymbol\beta})$ SCF lattice chain code is also constructed with the lattices $\Lambda$ and $\Lambda_C^i({\bf a}, {\boldsymbol\beta})$ of an $({\bf a}, {\boldsymbol\beta})$ SCF code. Besides, a mid-layer lattice $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ for which $\Lambda_C^A({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda_E^A({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda$ is introduced for the codebook construction. For arbitrarily chosen $\delta'>0$ and $\delta'' \in (0,(\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) - C(P_A+P_B))/2]$, these lattices should satisfy all properties listed in Subsection~\ref{ss:cc}, and three additional properties as follows.
\begin{itemize}
\item{\bf Rate of the Randomness:}
For the given $\delta''$, we have
\begin{equation}\label{eq:macab}
R_o({\bf a}, {\boldsymbol\beta}) - \delta'' < R_e^A({\bf a}, {\boldsymbol\beta})< R_o({\bf a}, {\boldsymbol\beta}),
\end{equation}
where $R_e^A({\bf a}, {\boldsymbol\beta}) = \frac{1}{N} \log_2 |\Lambda_E^A({\bf a}, {\boldsymbol\beta}) \cap {\cal V}_C^A({\bf a}, {\boldsymbol\beta})|$.
\item{\bf Nesting of $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$:}
The coarser one of $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ and $\Lambda_C^B({\bf a}, {\boldsymbol\beta})$ is nested in the finer one. 
\item{\bf Goodness of $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$:}
The lattice $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ is good at both quantizing and shaping.
\end{itemize}

By \cite{erez}, lattices satisfying these properties can be found. We then define 
%The codebook of a LC scheme is also built upon the lattices $\Lambda$ and $\Lambda_C^i({\bf a}, {\boldsymbol\beta})$ of the $({\bf a}, {\boldsymbol\beta})$ SCF code. We find a mid-layer lattice $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$, for which $\Lambda_C^A({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda_E^A({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda$. We denote its fundamental Voronoi region as ${\cal V}_E^A({\bf a}, {\boldsymbol\beta})$. We also let This lattice is also good for quantizing and shaping. We then define the following rates.
$\hat{R}_s^A({\bf a}, {\boldsymbol\beta}) = \frac{1}{N} \log_2 |\Lambda \cap {\cal V}_E^A({\bf a}, {\boldsymbol\beta})|$ as the rate of the lattice codebook for the messages and
$\hat{R}_t^A({\bf a}, {\boldsymbol\beta})= \frac{1}{N} \log_2 |\Lambda \cap {\cal V}_C^A({\bf a}, {\boldsymbol\beta})|$ as rate of the codebook for transmission.

In Fig.~\ref{fig:lc} we show the structure of a codebook of node $A$.
%We generate a fine lattice $\Lambda \subseteq \mathbb{R}^N$.
%For a chosen $({\bf a},{\boldsymbol\beta})$ and each node $i\in\{A,B\}$, we construct a lattice chain $\Lambda_C^i({\bf a},{\boldsymbol\beta}) \subseteq \Lambda_E^i({\bf a},{\boldsymbol\beta}) \subseteq \Lambda$. ${\cal V}^i_C({\bf a},{\boldsymbol\beta})$, ${\cal V}_E^i({\bf a},{\boldsymbol\beta})$ and ${\cal V}$ are the fundamental Vonoroi regions of these lattices, respectively. In Fig.~\ref{fig:lc}, we sketch such a lattice chain for node A. The lattice chains should satisfy the properties that
%\begin{equation}\label{eq:sm}
%\frac{1}{N {\rm Vol}({\cal V}_C^i({\bf a},{\boldsymbol\beta}))} \int_{{\cal V}_C^i({\bf a},{\boldsymbol\beta})} ||X|| dX=\beta_i^2 P_i.
%\end{equation}
%and that the coarser one of $\Lambda_C^i({\bf a},{\boldsymbol\beta}), i \in\{A,B\}$ is nested in the finer one.
%These lattices should all be good in quantizing and shaping in the sense of \cite{erez}.

\begin{figure}[!ht]
\centering
\begin{tikzpicture}[scale=0.6]
\tikzstyle{finelattice}=[rectangle,draw=blue!30,inner sep=0pt,minimum size=6mm]
\tikzstyle{finelatticesamp}=[rectangle,draw=blue!30,inner sep=0pt,minimum size=4mm]
\tikzstyle{midlattice}=[rectangle,draw=red,inner sep=0pt,minimum size=18mm]
\tikzstyle{midlatticesamp}=[rectangle,draw=red,inner sep=0pt,minimum size=4mm]
\tikzstyle{coarselattice}=[rectangle,draw=black, thick, inner sep=0pt,minimum size=54mm]
\tikzstyle{coarselatticesamp}=[rectangle,draw=black, thick, inner sep=0pt,minimum size=4mm]

\node at (0,1) {};

\foreach \x in {2,3,...,10}
\foreach \y in {1,...,9}
{
\node at (\x,\y) [finelattice] {};
\draw (\x,\y) plot [mark=*, mark options={color=blue},mark size=0.5mm] coordinates{(\x,\y)} node{};
}
\foreach \x in {3,6,9}
\foreach \y in {2,5,8}
{
\node at (\x,\y) [midlattice] {};
\draw (\x,\y) plot [mark=x, mark options={color=red}, mark size=2mm] coordinates{(\x,\y)} node{};
}
\node at (6,5) [coarselattice] {};
\draw (6,5) plot [mark=+, mark size=3mm] coordinates{(6,5)} node{};

\node at (11.2,8.5) [finelatticesamp] {};
\draw (11.2,8.5) plot [mark=*, mark options={color=blue},mark size=0.5mm] coordinates{(11.2,8.5)} node{};
\draw (11.6,8.5) node[anchor=west] {: $\Lambda$};
%\draw (9.6,8.2) node[anchor=north west] {\small $\Lambda$ and its Voronoi region.};

\node at (11.2,7.5) [midlatticesamp] {};
\draw (11.2,7.5) plot [mark=x, mark options={color=red}, mark size=1.7mm] coordinates{(11.2,7.5)} node{};
\draw (11.6,7.5)  node[anchor=west] {: $\Lambda_E^A({\bf a},{\boldsymbol\beta})$};
%\draw (9.5,6.2) node[anchor=north west]{\small $\Lambda_E^A$ and its Voronoi region.};

\node at (11.2,6.5) [coarselatticesamp] {};
\draw (11.2,6.5) plot [mark=+, mark size=2.3mm] coordinates{(11.2,6.5)} node{};
\draw (11.6,6.5)  node[anchor=west] {: $\Lambda_C^A({\bf a},{\boldsymbol\beta})$};
%\draw (9.5, 4.2) node[anchor=north west]{\small $\Lambda_C^A$ and its Voronoi region.};

%\node at (10.2, 5.5) [cosetsamp] {};
%\draw (10.6,5.5)  node[anchor=west] {: \small A coset of ${\cal L}_s^A$.};
%\draw (9.6, 2.2) node[anchor=north west] {};

\end{tikzpicture}
\caption{A codebook of node $A$ for an $({\bf a}, {\boldsymbol\beta})$ SCF lattice chain code.}\label{fig:lc}
\end{figure}

%Here, we use $\Lambda \cap {\cal V}_E^A({\bf a},{\boldsymbol\beta})$ for the codebook from which the lattice vector representing the message $W^A$ is chosen. Further, we use $\Lambda_E^i({\bf a},{\boldsymbol\beta}) \cap {\cal V}_C^i({\bf a},{\boldsymbol\beta})$ to generate random vectors to confuse the relay. For node $B$, since no message is transmitted, we set $\Lambda_E^B({\bf a},{\boldsymbol\beta})=\Lambda$. We then define the following rates:
%\begin{itemize}
%\item $R_s^i({\bf a},{\boldsymbol\beta}) = \frac{1}{N} \log_2 |\Lambda \cap {\cal V}_E^i({\bf a},{\boldsymbol\beta})|$ is the rate of the lattice code that carries the messages.

%\item $R_e^i({\bf a},{\boldsymbol\beta}) = \frac{1}{N} \log_2 |\Lambda_E^i({\bf a},{\boldsymbol\beta}) \cap {\cal V}_C^i({\bf a},{\boldsymbol\beta})|$ is the rate of the lattice code used to confuse the relay.

%\item $R_t^i({\bf a},{\boldsymbol\beta}) = \frac{1}{N} \log_2 |\Lambda \cap {\cal V}_C^i({\bf a},{\boldsymbol\beta})|$ is the transmit rate of node $i$.

%\end{itemize}

%\small
%\begin{table}\caption{Notations}\label{tb:not}
%\begin{center}
%\begin{tabular}{lll}
%\hline
%variable & distribution & comment \\
%\hline
%$W^A$ & $\sim {\cal U} (\{1, 2, \ldots, 2^{NR_s^A})$ & source message from $A$\\
%$X^A$ & $\sim {\cal U} (\Lambda^A \cap {\cal V}^A_C)$ & transmit lattice vector for $A$\\
%$V^A$ & $\sim {\cal U} (\Lambda_{B}^A \cap {\cal V}^A_C)$ & defines the coset of ${\cal L}_s^A$ \\
%$T^A$ & $\sim {\cal U} (\Lambda^A \cap {\cal V}^A_B)$ & encoded message in ${\cal L}_s^A$ \\
%$D^A$ & $\sim {\cal U} ({\cal V}^A_C)$ & dither for $A$ \\
%$Z$ & $\sim {\cal N} (0, I_N)$ & AWGN at the relay\\
%$Y^R$ &  continuous & received vector at the relay\\
%\hline
%\end{tabular}
%\end{center}
%\end{table}
%\normalsize

Clearly, we have
\begin{equation}\label{eq:rta2}
\hat{R}_t^A({\bf a}, {\boldsymbol\beta}) = \hat{R}_s^A({\bf a}, {\boldsymbol\beta}) + R_e^A({\bf a}, {\boldsymbol\beta}).
\end{equation}
The source symbol chosen uniformly at random from $\{1,2,\ldots,2^{NR_s^A({\bf a}, {\boldsymbol\beta})}\}, R_s^A({\bf a}, {\boldsymbol\beta}) \in [0, \hat{R}_s^A({\bf a}, {\boldsymbol\beta})]$ is mapped to a codeword in the lattice codebook $\Lambda \cap {\cal V}_E^A({\bf a}, {\boldsymbol\beta})$. Further, we denote
\begin{equation}\label{eq:rta}
R_t^A({\bf a}, {\boldsymbol\beta}) = R_s^A({\bf a}, {\boldsymbol\beta}) + R_e^A({\bf a}, {\boldsymbol\beta}).
\end{equation}

%and 
%\begin{equation}\label{eq:rsb}
%R_s^B({\bf a},{\boldsymbol\beta})=0.
%\end{equation} 
We assume all the lattices and codebooks are revealed to all four nodes.

%Now, we fix the lattice $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ by setting the rate $R_e^A({\bf a}, {\boldsymbol\beta})$. We choose an arbitrary $\delta'' \in (0,(\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) - C(p_A+p_B))/2]$. Note that our scheme only valid for the case $\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) > C(p_A+p_B)$. Then we choose $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ such that
%\begin{equation}\label{eq:macab}
%R_o({\bf a}, {\boldsymbol\beta}) - \delta'' \leq R_e^A({\bf a}, {\boldsymbol\beta})< R_o({\bf a}, {\boldsymbol\beta}).
%\end{equation}
%Now, we fix the lattices $\Lambda_C^i({\bf a}, {\boldsymbol\beta})$ and $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ by setting the rate $R_t^A({\bf a}, {\boldsymbol\beta})$, $R_t^B({\bf a}, {\boldsymbol\beta})$ and $R_e^A({\bf a}, {\boldsymbol\beta})$. Firstly, we choose an arbitrary $\delta'$ that
%\begin{equation}\label{eq:sumc}
%\delta' < C(P_A+P_B)-C(P_B).
%\end{equation}
%Then, if ${\bf a}, {\boldsymbol\beta}$ satisfying
%\begin{equation}
%\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) > C(P_A+P_B),
%\end{equation}
%we select an arbitrary $\delta''$ satisfying
%\begin{equation}\label{eq:delta}
%0<\delta''\leq (\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) - C(P_A+P_B))/2
%\end{equation}
%and choose $\Lambda_C^i({\bf a}, {\boldsymbol\beta}) $ such that the resulting rate $R_t^i({\bf a}, {\boldsymbol\beta}) $ satisfies
%\begin{equation}\label{eq:racf2}
%R_{\rm CF}^i({\bf a}, {\boldsymbol\beta})-\delta'' \leq R^i_t({\bf a}, {\boldsymbol\beta})  < R_{\rm CF}^i({\bf a}, {\boldsymbol\beta}), i\in\{A, B\}.
%\end{equation}

%As last, we choose $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$ such that
%\begin{equation}\label{eq:macab}
%\begin{array}{l}
%C(P_A+P_B) -R_t^B({\bf a}, {\boldsymbol\beta})  - \delta' \\
% \leq R_e^A({\bf a}, {\boldsymbol\beta})< C(P_A+P_B)-R_t^B({\bf a}, {\boldsymbol\beta}) .
%\end{array}
%\end{equation}
%This selection is feasible since any rate $R_e^A({\bf a}, {\boldsymbol\beta})$ satisfying (\ref{eq:macab}) is always in between 0 and $R_s^A({\bf a}, {\boldsymbol\beta})$. This is because that we have
%\begin{eqnarray}
%R_e^A({\bf a}, {\boldsymbol\beta}) &\geq& C(P_A+P_B) - R_t^B({\bf a}, {\boldsymbol\beta}) -\delta' \nonumber \\
%& >& C(P_A+P_B) - C(P_B)-\delta' \nonumber \\
%&>&0, \nonumber
%\end{eqnarray}
%where the first inequality follows from (\ref{eq:macab}), the second inequality follows from (\ref{eq:rab}) and (\ref{eq:racf2}), and the third inequality follows from (\ref{eq:sumc}),
%Meanwhile, by (\ref{eq:delta}), (\ref{eq:racf2}), and (\ref{eq:macab}), we have 
%\begin{eqnarray}
%&&R_e^A({\bf a}, {\boldsymbol\beta})  \nonumber \\
%&<&C(P_A+P_B) - R_t^B({\bf a}, {\boldsymbol\beta})   \nonumber \\
%&\leq&C(P_A+P_B)-R^B_{\rm CF}({\bf a}, {\boldsymbol\beta})+\delta'' \nonumber \\
%&=&C(P_A+P_B)-\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta})+R^A_{\rm CF}({\bf a}, {\boldsymbol\beta})+\delta'' \nonumber \\
%&\leq&C(P_A+P_B)-\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta})+R_t^A({\bf a}, {\boldsymbol\beta})+2\delta'' \nonumber \\
%&\leq&R_t^A. \nonumber
%\end{eqnarray}

%Note that by (\ref{eq:rta}), we have $R_s^A({\bf a}, {\boldsymbol\beta})$ satisfying
%\begin{equation}\label{eq:rsa1}
%\begin{array}{l}
%\sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) - C(P_A+P_B)  - 2\delta'' \\
% \leq R_s^A({\bf a}, {\boldsymbol\beta})< \sum_{i \in \{A, B\}}R^i_{\rm CF}({\bf a}, {\boldsymbol\beta}) - C(P_A+P_B)+\delta'.
%\end{array}
%\end{equation}

\subsubsection{Transmission Process}

The transmission process is similar to the transmission process described in Subsection~\ref{ss:rt}. Here, we only focus on the steps which are different, which are {\bf (Phase 1, node $A$)}, {\bf (Phase 1, the relay)}, {\bf (Phase 2, the relay)}, and {\bf (Phase 2, node $C$)}.

%The transmission scheme is similar to the transmission scheme proposed in Section~\ref{ss:rt}, the difference is the step of Phase 2 at the relay. Similar to the scheme in \cite{zhang}, the lattice chain approach allows the relay to remove the random vector transmitted by the $A$ which is useless for $B$ to decode the real message.

\begin{itemize}
\item {\bf Phase 1, node $A$.}
Firstly, the message $W^A$ is uniquely mapped to a lattice vector in $\Lambda \cap {\cal V}_E^A({\bf a}, {\boldsymbol\beta})$ by the encoder, Then the encoder adds a vector $V^A$ which is chosen uniformly at random from $\Lambda_E^A({\bf a}, {\boldsymbol\beta}) \cap {\cal V}^A_C({\bf a}, {\boldsymbol\beta})$. Then, a dither $D^A \sim {\cal U}({\cal V}^A_C({\bf a}, {\boldsymbol\beta})/\beta_A)$ is chosen. The transmitted lattice vector of node $A$ is 
\begin{equation}\label{eq:xa}
X^A = [(T^A+V^A)/\beta_A+D^A] \Mod{\Lambda_C^A({\bf a}, {\boldsymbol\beta})/\beta_A}.
\end{equation}

%Firstly, the message $W^A$ is one-to-one mapped to a lattice vector in $\Lambda \cap {\cal V}_E^A({\bf a},{\boldsymbol\beta})$ by the encoder, denoted as $T^A$. Then the encoder adds a vector $V^A\sim {\cal U}(\Lambda_E^A({\bf a},{\boldsymbol\beta}) \cap {\cal V}^A_C({\bf a},{\boldsymbol\beta}))$. The transmitted lattice vector of node $A$ is 
%\begin{equation}\label{eq:xa}
%X^A = [(V^A + T^A)/\beta_A+D^A] \Mod{\Lambda_C^A({\bf a},{\boldsymbol\beta})/\beta_A},
%\end{equation}
%where $D^A \sim {\cal U}({\cal V}^A_C({\bf a},{\boldsymbol\beta})/\beta_A)$. Note that dithers are chosen to fulfill the power constraints and are revealed to all nodes. 

\item {\bf Phase 1, the relay.}
Upon receiving $Y^R$ in (\ref{eq:yr}), by \cite{jingge}, the relay can reliably decode $$U^R=a_1(T^A+V^A)+a_2V^B$$ with the lattice $\Lambda$.

%Upon receiving $Y^R$ in (\ref{eq:yr}), the relay decodes the vector $a_1(T^A+V^A)+a_2V^B$.

\item{\bf Phase 2, the relay}
The relay firstly scales the decoded vector down by computing $U^R/a_1 =(T^A+V^A)+(a_2/a_1)V^B$. Then, instead of $\Lambda_C^A({\bf a}, {\boldsymbol\beta})$, the relay takes a modulo operation on the decoded vector w.r.t. $\Lambda_E^A({\bf a}, {\boldsymbol\beta})$. We denote the resulting vector as $\tilde{U}^{R}_*$ and
\begin{equation}
\tilde{U}^{R}_*=U^R/a_1 \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})}=(T^A+(a_2/a_1)V^B)\Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})}.
\end{equation}
The relay then transmits this vector using any capacity achieving channel code on the AWGN channel. Since by definition we have $\frac{1}{N}H(\tilde{U}^{R}_*) \leq \hat{R}_s^A({\bf a}, {\boldsymbol\beta})$, the transmission is reliable when $C(P_R) \geq \hat{R}_s^A({\bf a}, {\boldsymbol\beta})$. Thus we have the power constraint
\begin{equation}\label{eq:hatpa}
P_R > 2^{2\hat{R}_s^A({\bf a}, {\boldsymbol\beta})}-1.
\end{equation}
Note that if $P_R$ is smaller than the requirement in the constraint, a similar approach as the one stated in Section~\ref{s:ts} can be used. However, it can be calculated that the optimal solution is that we adjust ${\bf a}, {\boldsymbol\beta}$ as well as the codebook to $P_R$. The details and the achievable rate of this solution will be given later in this subsection.

%Note that here $X^R$ is a vector in a finer shaping lattice than in Subsection~\ref{ss:rt}. By our codebook construction, the codebook $\Lambda \cap {\cal V}_E^A({\bf a}, {\boldsymbol\beta})$ is also a capacity achieving code for transmission. Thus, instead of (\ref{eq:prc}), $P_R$ only needs to satisfy $C(P_R) \geq \hat{R}_s^A({\bf a}, {\boldsymbol\beta})$. The new power constraint can be written as

% and scales the vector down by a factor of $\beta_A$. The transmission of the relay is thus $$X^R = [\tilde{U}^R /\beta_A+D^R] \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})/\beta_A},$$ where $\tilde{U}^R =U^R/a_1 \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})}=T^A+(a_2/a_1)V^B\Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})}$, and $D^R$ is the dither uniformly chosen from ${\cal V}_E^A({\bf a}, {\boldsymbol\beta})/\beta_A$. Note that here $X^R$ is a vector in a finer shaping lattice than in Subsection~\ref{ss:rt}. By our codebook construction, the codebook $\Lambda \cap {\cal V}_E^A({\bf a}, {\boldsymbol\beta})$ is also a capacity achieving code for transmission. Thus, instead of (\ref{eq:prc}), $P_R$ only needs to satisfy $C(P_R) \geq \hat{R}_s^A({\bf a}, {\boldsymbol\beta})$. The new power constraint can be written as
%\begin{equation}\label{eq:hatpa}
%P_R > 2^{2\hat{R}_s^A({\bf a}, {\boldsymbol\beta})}-1.
%\end{equation}

\item {\bf Phase 2, Node $C$.}
%Observe that the transmission $X^R$ is equivalent of transmitting the vector $[T^A+V^A+V^B] \Mod{\Lambda_C^x} \in \Lambda \cap {\cal V}_C^x$ using lattice code. 
%By (\ref{eq:hatpa}), since $\tilde{U}^R\in \Lambda \cap {\cal V}_E^A({\bf a}, {\boldsymbol\beta})$ and $\hat{R}_s^A({\bf a}, {\boldsymbol\beta})<C(P_R)$, by the property of good lattice codes, node $C$ can decode $\tilde{U}^{R'}$ with high probability.
%Combining this with (\ref{eq:rab}) and $h_1 \leq h_2$, the inequality
%\begin{equation}\label{eq:relay}
%\frac{1}{N} H(\tilde{U}^R) < \frac{1}{2}\log_2(1+h_2^2P)
%\end{equation}
%holds if (\ref{eq:racf}) holds. 
%Note that ${\bf a}$ and ${\boldsymbol\beta}$ are revealed to all nodes. Assume $\Lambda_C^x, x\in\{A,B\}$ is the coarser one of $\Lambda_C^A$ and $\Lambda_C^B$. 
Since the vector $\tilde{U}^{R}_*$ is reliably decoded, node $C$ can then decode $T^A$ by computing
\begin{eqnarray}
\lefteqn{[\tilde{U}^{R}_* -(a_2/a_1)V^B] \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})}} \nonumber \\
&=& [(T^A+(a_2/a_1)V^B) \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})} -(a_2/a_1)V^B] \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})} \nonumber \\
&=&[T^A+(a_2/a_1)V^B-(a_2/a_1)V^B] \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})}  \nonumber \\
&= & [T^A] \Mod{\Lambda_E^A({\bf a}, {\boldsymbol\beta})} \nonumber \\
&=& T^A.
\end{eqnarray}
%Since $a_1$, $a_2$ and all the codebooks are revealed to node $B$, by decoding the codeword transmitted from the relay, node $B$ is able to recover the linear sum $a_1X^A+a_2X^B$ and the codeword $X^A$ by subtracting its own transmission $X^B$. 
Since $T^A$ is reliably decoded, $W^A$ can then be retrieved.

\end{itemize}


\subsubsection{Information Leakage Rate}
Here, we proof that the LC scheme is information theoretically secure.

\lemma{For any $\delta>0$, if 
\begin{equation}\label{eq:conrsa}
R_t^B({\bf a}, {\boldsymbol\beta})=\hat{R}_t^B({\bf a}, {\boldsymbol\beta}),
\end{equation}
 there exist a sequence of $({\bf a}, {\boldsymbol\beta})$ SCF lattice chain codes which achieves
\begin{equation}
\frac{1}{N}I(W^A;Y^R)<\delta.
\end{equation}}\label{lm:2}

The proof of this lemma is in Appendix~\ref{ap:2}.

\subsubsection{Achievable Secrecy Rate}

Similar as the previous section, we also distinct three cases w.r.t. $P_R$ and $\sigma$. For each case, we specify the settings of ${\bf a}$, ${\boldsymbol\beta}$, and $R_t^i({\bf a}, {\boldsymbol\beta})$.
\begin{itemize}

\item $P_R \geq P_A$ and $\sigma \leq \underline{\sigma}$.

In this case, similar to the RB scheme, we can set $R_t^i({\bf a}, {\boldsymbol\beta})$ equals to $\hat{R}_t^i({\bf a}, {\boldsymbol\beta})$ and set $\hat{R}_t^i({\bf a}, {\boldsymbol\beta})$ accordingly to (\ref{eq:rtcf}). Combining with (\ref{eq:il4}), (\ref{eq:macab}), and (\ref{eq:rta}), we achieve any secrecy rate satisfying (\ref{eq:rbrs1}) by choosing sufficiently large $N$ and sufficiently small $\delta'$.

\item $P_R \geq P_A$ and $\sigma > \underline{\sigma}$.

In this case, if we use the same settings as the previous case, (\ref{eq:1c}) will be violated. Moreover, unlike the RB scheme, due to the constraint of the $({\bf a}, {\boldsymbol\beta})$ SCF lattice chain code, using the same lattice codebook with a simple decreasing of the transmit rate will violate (\ref{eq:conrsa}). Hence a new lattice codebook with different ${\bf a}, {\boldsymbol\beta}$ should be generated w.r.t. the constraint
\begin{equation}\label{eq:conrcfb}
R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) \leq C(P_B/\sigma^2)
\end{equation}
and $\hat{R}_t^i({\bf a}, {\boldsymbol\beta})$ should be set accordingly to (\ref{eq:rtcf}). Then, we set $R_t^i({\bf a}, {\boldsymbol\beta})$ equal to $\hat{R}_t^i({\bf a}, {\boldsymbol\beta})$.
Thus, any secrecy rate satisfying
\begin{equation}\label{eq:lcrs}
R_s < \max_{{\bf a},{\boldsymbol\beta}:R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) \leq C(P_B/\sigma^2)}R_s({\bf a}, {\boldsymbol\beta})
\end{equation}
is achievable.

\item $P_R < P_A$.

In this case, unlike the RB scheme, the LC scheme guarantees a reliable transmission of $T^A$ as long as (\ref{eq:hatpa}) holds. Note that our scheme holds for any pair of ${\bf a}, {\boldsymbol\beta}$. Moreover, as long as $P_R < P_A$, by \cite{jingge}, for any secrecy rate $\hat{R}_s^A({\bf a}, {\boldsymbol\beta})$ satisfying (\ref{eq:hatpa}), there exists a pair of ${\bf a}, {\boldsymbol\beta}$ which achieves that rate. Hence, by choosing ${\bf a}, {\boldsymbol\beta}$, and the codebook accordingly to (\ref{eq:hatpa}), we can straightforwardly achieve any secrecy rate smaller than $C(P_R)$.

\end{itemize}

Combining the three cases we have the following lemma.
\theorem{For a two-hop channel with an untrusted relay, with the LC scheme, any secrecy rate $R_s$ satisfying
\begin{equation}\label{eq:lcrs3}
R_s < \min (\max_{{\bf a}, {\boldsymbol\beta}}R_s({\bf a}, {\boldsymbol\beta}),C(P_R))
\end{equation}
is achievable if $\sigma \leq \underline{\sigma}$ and
\begin{equation}\label{eq:lcrs4}
R_s < \min ( \max_{{\bf a},{\boldsymbol\beta}:R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) \leq C(P_B/\sigma^2)}R_s({\bf a}, {\boldsymbol\beta}), C(P_R) )
\end{equation}
is achievable if $\sigma > \underline{\sigma}$.}\label{lm:lc}

\subsection{Achievable Secrecy Rates for Special Channel Configurations}


Here, we consider two special channel configurations. Firstly, if $P_R \geq P_A$ and the jammer is collocated with the destination, i.e., $\sigma=0$, we can maximize the first term in (\ref{eq:scr1}) by choosing ${\bf a}=(1,1)$ and ${\boldsymbol\beta}=(\sqrt{\frac{P_B(1+P_A)}{P_A(1+P_B)}},1)$, which gives us the following corollary.

\corollary{On a two-hop channel with an untrusted relay, if $P_R \geq P_A$ and $\sigma=0$, any secrecy rate $R_s$ satisfying 
\begin{equation}
R_s < \frac{1}{2}\log_2\frac{1+P_A+P_B}{(\sqrt{(1+P_A)(1+P_B)}-\sqrt{P_AP_B})^2}-1
\end{equation}
is achievable.}\label{co:1}

Then, if $P_A=P_B=P_R$ and $\sigma=0$, by Corollary~\ref{co:1} we straightforwardly have the following corollary.

\corollary{On a two-hop channel with an untrusted relay, if $\sigma=0$ and $P_A=P_B=P_R$, any secrecy rate $R_s$ satisfying
\begin{equation}\label{eq:co2}
R_s < \frac{1}{2}\log_2(\frac{1}{2}+P_A)-\frac{1}{2}
\end{equation}
is achievable.}\label{co:2}


%However, the the drawback of the LC scheme is that the lattice used to create randomness, $\Lambda_E^A$ is scaled with the same coefficient as $\Lambda_C^A$. Thus, the amount of randomness that can be created is limited. When $\sigma$ is large, $R_t^B$ should be kept small for its reliable decoding at $B$, then the scaling coefficients needs to be adjust to eliminate the information leakage. This will leads to a lower secrecy rate since the scaling coefficient is not chosen to maximize the compute-and-forward rate.

\subsection{Comparison Between the Two Schemes}

Firstly, we compare the two schemes in terms of simplicity in deployment, the LC scheme surely enjoys the benefit of a simpler structure and decoding. Also, the RB scheme requires a very long sequence of lattice codewords to achieve secrecy, i.e. $N$ and length $l$ should be sufficiently large, which is not the case for the LC scheme in which only $N$ needs to be chosen sufficiently large.

\begin{figure*}[!ht]
  \subfigure[The comparison under the limited relay power condition (destination functions as the jammer).]{ 
    \label{fig:sac1} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{secappcomp1}}
  \subfigure[The comparison under the non-collocated jammer and destination condition.]{ 
    \label{fig:sac2} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{secappcomp2}}

  \subfigure[The comparison under both conditions]{ 
    \label{fig:sac3} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{secappcomp3}}
\caption{Comparison between the achievable secrecy rate of the RB scheme and the LC Scheme}
\end{figure*}

Then, we compare the achievable secrecy rates of the two schemes. In the case of $P_R \geq P_A$ and $\sigma \leq \underline{\sigma}$, both of the two schemes achieve the same secrecy rate of (\ref{eq:rbrs1}). Then, when $P_R < P_A$, thanks to the chain structure, the LC scheme allows the relay to save the part of the energy of transmitting the random vector $V^A$. This feature allows the LC scheme to achieve a secrecy rate that equals the capacity when the relay has limited power, while the RB scheme underperforms. In other word, when $\sigma \leq \underline{\sigma}$, the rate of the LC scheme (\ref{eq:lcrs3}) is always no lower than the rate of the RB scheme (\ref{eq:rsrb11}). In Fig.~\ref{fig:sac1} where $P_A=P_B=30{\rm dB}$ and the destination is used as the jammer, it is clear that the curve of the LC scheme is higher than the RB scheme and coincides with the upper bound. Note that in this paper all the powers are shown in dB, since they are actually the SNR with unit noise.


In the case of $P_R \geq P_A$ and $\sigma > \underline{\sigma}$, for the sake of reliable decoding of $V^B$ at node $C$, the transmit rate should be reduced. For the LC scheme, due to the constraint of (\ref{eq:conrsa}), node $B$ cannot simply use the same lattice codebook and reduce its transmit rate. Hence, in this case, the RB scheme could achieve a higher rate than the LC scheme. In Fig.~\ref{fig:sac2}, the rate of the RB scheme is always higher than the LC scheme. However, they are both far away from the upper bound when $\sigma$ is large. The shape of the curve of the LC scheme is due to the fact that sometimes the achievable secrecy rate is maximized by choosing a different $a_1$ for the different $\sigma$, which is a positive integer.


In the case of $P_R < P_A$ and $\sigma> \underline{\sigma}$, it will be a trade-off between these two issues. As observed in Fig.~\ref{fig:sac3}, when $\sigma^2=3$dB, the LC scheme performs better when $P_R$ is low, but is overtaken by the RB scheme when $P_R$ is larger than some threshold.

%Firstly, a new lower bound on the secrecy rate on this model is given by the higher rate of Theorem~\ref{lm:rb2} and \ref{lm:lc}. It can be calculated that, when $\sigma \leq \underline{\sigma}$, the rate of the LC scheme (\ref{eq:lcrs3}) is always no lower than the rate of the RB scheme (\ref{eq:rsrb11}). In particular, it equals the capacity of the relay if the relay power is restricted. When $\sigma > \underline{\sigma}$, with the LC scheme, the maximization of $R_s({\bf a}, {\boldsymbol\beta})$ should take (\ref{eq:conrcfb}) into account. Thus the secrecy rate of the LC scheme (\ref{eq:lcrs4}) is sometimes smaller than the achievable secrecy rate of the RB scheme (\ref{eq:rsrb12}). Hence, we have the following corollary.

Summarizing the three cases discussed above, a new lower bound on the achievable secrecy rate on this channel is derived.
\corollary{On a two-hop channel with an untrusted relay, any secrecy rate $R_s$ satisfying
\begin{equation}\label{eq:scr1}
R_s < \min\left(\max_{{\bf a}, {\boldsymbol\beta}}R_s({\bf a}, {\boldsymbol\beta}), C(P_R)\right)
\end{equation}
is achievable if $\sigma \leq \underline{\sigma}$, and 
\begin{eqnarray}
%\lefteqn{R_s} \nonumber \\
 %&< &\max \left[ \min\left( \max_{{\bf a}, {\boldsymbol\beta},R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) \leq C(P_B/\sigma^2)}R_s({\bf a}, {\boldsymbol\beta}), C(P_R)\right),\right. \nonumber \\
%&& \hspace{1cm} \left. \left(C(P_A)+ C(P_B/\sigma^2)-C(P_A+P_B)\right)\frac{C(P_R)}{C(P_A)}\right] \nonumber \\ \label{eq:scr2}
R_s &< &\max \left[ \min\left( \max_{{\bf a}, {\boldsymbol\beta}:R_{\rm CF}^B({\bf a}, {\boldsymbol\beta}) \leq C(P_B/\sigma^2)}R_s({\bf a}, {\boldsymbol\beta}), C(P_R)\right) \right., \nonumber \\
&&\hspace{2cm} \left. \left(C(P_A)+ C(P_B/\sigma^2)-C(P_A+P_B)\right)\frac{C(P_R)}{C(P_A)}\right]  \label{eq:scr2}
\end{eqnarray}
is achievable if $\sigma > \underline{\sigma}$.}\label{th:1}


\section{Performance Analysis and Comparison}\label{s:comp}


In this section we compare the achievable secrecy rate of our schemes and other schemes under various scenarios.


\subsection{Symmetric Two-hop Channel with Destination as Jammer}

We first discuss the very well studied symmetric two-hop channel with the destination functioning as a cooperative jammer, which is a special case of our model when $P_A=P_R=P_B$ and $\sigma^2=0$. Here, both our schemes achieve the sames secrecy rate of (\ref{eq:co2}). We compare it to the achievable secrecy rate with an amplify-and-forward based scheme proposed by Sun {\em et al.} in \cite{sun} and a modulo-and-forward based scheme propose by Zhang {\em et al.} in \cite{zhang}. Their achievable secrecy rates are in (\ref{eq:sun}) and (\ref{eq:zhang}), respectively. In particular, (\ref{eq:zhang}) can be simplified to
\begin{equation}
R_s < C(P_A)-\frac{1}{2}-\frac{1}{2}\log_2\left(1+\frac{P_A}{1+P_A}\right).
\end{equation}

We also compare our schemes with the compress-and-forward based scheme proposed by He {\em et al.} in \cite{he}.The achievable secrecy rate is in (\ref{eq:he1}) and can be simplified to
\begin{equation}
R_s < \frac{1}{2}\log_2\left(2+\frac{1}{P_A}+P_A\right)-1.
\end{equation}



In Fig.~\ref{fig:symcom}, we set $P_A=P_B=P_R=20$dB and compare these schemes with the upper bound (\ref{eq:ubsec}). Moreover, we show the rate of He {\em et al.} in \cite{he3} and Vatedka {\em et al.} in \cite{vatedka} in the same figure, although these are the rates for strong secrecy and perfect secrecy, respectively. We also show the capacity without the consideration of secrecy as a reference. It is clear that our scheme outperforms all other existing secure transmission scheme in the high SNR region and is upper bound achieving when $P_A\to \infty$. Also, it is interesting to observe that, in the high SNR region, to achieve strong secrecy and perfect secrecy, a rate of $0.5$ and $0.5+\log_2e$ bits/channel use is lost, respectively.

\begin{figure}[H]
\centering
\includegraphics[width=0.5\textwidth]{symcom}
\caption{Comparison between the achievable secrecy rates of variant schemes in a symmetric two-hop channel using the destination as jammer.}
\label{fig:symcom}
\end{figure}


\subsection{Asymmetric Two-hop Channel with Destination as Jammer}


\begin{figure*}[!ht]
\centering
  \subfigure[$P_A\leq P_B=P_R=20$dB.]{ 
    \label{fig:asymcom1} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{asymcom1}}
  \subfigure[$P_B\leq P_A=P_R=20$dB.]{ 
    \label{fig:asymcom2} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{asymcom2}}
  
\subfigure[$P_R\leq P_A=P_B=20$dB.]{
    \label{fig:asymcom3} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{asymcom3}}
\subfigure[$P_B=10P_A,P_R=P_A$.]{ 
    \label{fig:asymcom4} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{asymcom4}}
\caption{Comparison between the achievable secrecy rates of various schemes in asymmetric two-hop channels using the destination as jammer.}
\end{figure*}
\begin{figure*}[!ht]
\centering
\subfigure[$P_B=0.1P_A,P_R=P_A.$]{ 
    \label{fig:asymcom5} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{asymcom5}}
\subfigure[$P_B=0.1P_A, P_R=20$dB.]{ 
    \label{fig:asymcom6} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{asymcom6}}
\caption{Comparison between the achievable secrecy rates of various schemes in asymmetric two-hop channels using destination as jammer (Continued).}
\end{figure*}
In case of $\sigma=0$, we compare our schemes to the capacity without secrecy constraint, the upper bound (\ref{eq:ubsec}), as well as the schemes by Sun {\em et al.} in \cite{sun}, Zhang {\em et al.} in \cite{zhang}, and He {\em et al.} in \cite{he}, the rates of which are in (\ref{eq:sun}), (\ref{eq:zhang}), and (\ref{eq:he1}), respectively. It can be observed from Fig~\ref{fig:asymcom1}-\ref{fig:asymcom3} that if we fix two of $P_i, i\in \{A,B,R\}$ and change one of them, our schemes outperform all other schemes except for the low source and/or jammer power case. Moreover, the LC scheme achieves the upper bound for the low relay power cases (the curve coincides with the upper bound). To the best of our knowledge, this is the first upper bound achieving scheme for the limited relay power and non-infinity source power case. 

Furthermore, we compare the achievable secrecy rate of various schemes with the upper bound in the case of $P_B=\alpha P_A, \alpha >0$, and $P_A\to \infty$. In this case, we define the gap between the upper bound of the secrecy rate derived in \cite{he} and the channel capacity without secrecy consideration as
\begin{eqnarray}
G_0 &=&\lim_{P_A \to \infty} [\min (C(P_A),C(P_R))-\min (R_b,C(P_R))],
\end{eqnarray}
where $R_b$ is the upper bound given in (\ref{eq:ubsec}). Note that this upper bound is only for the secrecy rate in Phase 1. In Phase 2, the secrecy rate is upper bounded by $C(P_R)$.
Similarly, for each secure transmission scheme, we define the gap between the achievable secrecy rate and the capacity without secrecy consideration as
\begin{eqnarray}
G &=&\lim_{P_A \to \infty} [\min (C(P_A),C(P_R)) -\limsup_{N\to\infty} R_s],
\end{eqnarray}
where $R_s$ is the achievable secrecy rate of the scheme.

When $P_R \geq P_A$, both our schemes achieve any rate satisfying (\ref{eq:rbrs1}), in which the RHS equals the RHS of (\ref{eq:rsmax}). It can be calculated that we have $G=G_0=C(1/\alpha)$, which reflects that our schemes are upper bound achieving in this case. Then, when $P_R < P_A$, the LC scheme still achieves the upper bound, which in this case is the channel capacity without secrecy consideration, i.e., $G=G_0=0$.

The $G_0$ value as well as the $G$ values of various secure transmission schemes are shown in Table~\ref{tb:app} for some channel configurations. Here, $\gamma$ is defined as a positive real number. Is is shown that the LC scheme is the only upper bound achieving scheme in all the three cases considered in the table. For all other existing schemes, there are always gaps of at least a constant between the achievable secrecy rate and the upper bound in one or more cases.

\begin{table}[!ht]
\centering
\begin{threeparttable}
\begin{tabular}{|l|l|l|l|@{}m{0pt}@{}}
\hline \hline
& \multicolumn{2}{c|}{$P_R = \gamma P_A$}& \multicolumn{1}{c|}{$P_R$ fixed} \\ \cline{2-3}
& $\gamma<1$ & $\gamma \geq 1$ & \\ \hline
$G_0$ (Upper bound \cite{he}) & 0 &$C(\frac{1}{\alpha})$ & 0 & \\[5pt] \hline
$G$ (RB scheme) & $\frac{C(P_R)}{C(P_A)}C(\frac{1}{\alpha})$ &$C(\frac{1}{\alpha})$ & 0 & \\[5pt] \hline
$G$ (LC scheme) & 0 &$C(\frac{1}{\alpha})$ & 0 & \\[5pt] \hline
$G$ (He's scheme \cite{he})& $C(\frac{1}{\alpha})+C(\gamma)$ & $[C(\frac{1}{\alpha}), C(\frac{1}{\alpha})+C(\frac{1}{\gamma})] $ \tnote{a} & 0 &\\[5pt] \hline
$G$ (Zhang's scheme \cite{zhang})& $C(\frac{1}{\alpha})+C(\gamma)$ &$C(\frac{1}{\alpha} )+C(\frac{1}{\gamma})$  & $C(\frac{1}{\alpha})$  &\\[5pt] \hline
$G$ (Sun's scheme \cite{sun})& $C(\frac{1}{\alpha})+C(\gamma+\alpha)$ &$C(\frac{1}{\alpha} )+C(\frac{\alpha+1}{\gamma})$ & $C(\frac{1}{\alpha} )+C(\frac{\alpha P_R}{P_R+\alpha+1})$  &\\[5pt] \hline \hline
\end{tabular}
\begin{tablenotes}
\item[a] {\small If $\alpha\geq 1$, the $G$ value is $C(\frac{1}{\alpha} )+C(\frac{1}{\gamma})$. However, if $\alpha <1$, the $G$ value can be smaller than $C(\frac{1}{\alpha} )+C(\frac{1}{\gamma})$ depending on $\alpha$. Hence, we only show the interval for the rate here.}
\end{tablenotes}
\end{threeparttable}
\caption{The $G_0$ and $G$ values for various schemes when $P_B=\alpha P_A$ and $P_A \to \infty$.}\label{tb:app}
\end{table}


%Furthermore, we consider the case that $P_B=\alpha P_A, \alpha >0$ and $P_A$ is large. If $P_R\geq P_A$, both of our schemes achieve any rate satisfying (\ref{eq:rbrs1}), which can be approximated by $C(P_A)-C(1/\alpha )$. It can be calculated that the upper bound is also approximated by $C(P_A)-C(1/\alpha )$. Moreover, if $P_R < P_A$, the LC scheme guarantees that a rate of the smaller one of (\ref{eq:rbrs1}) and $C(P_R)$ is achievable, which is still upper bound achieving.

%On the other hand, we can calculate the rate of the other schemes (\ref{eq:sun}), (\ref{eq:zhang}), and (\ref{eq:he1}) in this scenario. In the limited relay power case $P_R < P_A$, if we consider a fixed value for $P_R$, then (\ref{eq:he1}) can be approximated by $C(P_R)$, (\ref{eq:zhang}) can be approximated by $C(P_R)-C(1/\alpha)$, and (\ref{eq:sun})  can be approximated by $C(P_R/(\alpha+1))-C(1/\alpha)$. Then, in case of $P_R =\gamma P_A$,  if $\alpha \geq 1$, both of (\ref{eq:zhang}) and (\ref{eq:he1}) approximate to $C(P_A)-C(1/\alpha)-C(1/\gamma)$ and (\ref{eq:sun}) approximates to $C(P_A)-C(1/\alpha)-C(\alpha/\gamma)$. Then, if $\alpha <1$, (\ref{eq:he1}) can be approximate to $C(P_A)-C(1/\alpha)-\min(C(1/\gamma),C(\alpha/2))$. The approximation of the achievable secrecy rates for various schemes are shown in Table~\ref{tb:app}. Here, we use the notation $\eta=\min(1,\frac{C(P_R)}{C(P_A)})$.
%\begin{table}[!ht]
%\centering
%\begin{tabular}{|l|l|l|l|@{}m{0pt}@{}}
%\hline \hline
% &  $\alpha\geq 1, P_R=\gamma P_A$& $\alpha<1, P_R=\gamma P_A$& $ P_R $ fixed &\\ \hline
%Upper bound \cite{he} & $\min (C(P_A)-C(\frac{1}{\alpha} ),C(P_R)) $&$\min(C(P_A)-C(\frac{1}{\alpha} ),C(P_R)) $ & $ C(P_R)$ & \\[5pt] \hline
%RB scheme & $\eta (C(P_A)-C(\frac{1}{\alpha}))$ &$\eta(C(P_A)-C(\frac{1}{\alpha} ))$  & $C(P_R)$  &\\[5pt] \hline
%LC scheme & $\min (C(P_A)-C(\frac{1}{\alpha} ),C(P_R))$ &$\min (C(P_A)-C(\frac{1}{\alpha} ),C(P_R))$  & $C(P_R)$ &\\[5pt] \hline
%He's scheme \cite{he}& $C(P_A)-C(\frac{1}{\alpha})-C(\frac{1}{\gamma})$ &$C(P_A)-C(\frac{1}{\alpha})-\min(C(\frac{1}{\gamma}),C(\frac{\alpha}{2}))$  & $C(P_R)$ &\\[5pt] \hline
%Zhang's scheme \cite{zhang}& $C(P_A)-C(\frac{1}{\alpha} )-C(\frac{1}{\gamma})$ &$C(P_A)-C(\frac{1}{\alpha})-C(\frac{1}{\gamma})$  & $C(P_R)-C(\frac{1}{\alpha})$  &\\[5pt] \hline
%Sun's scheme \cite{sun}& $C(P_A)-C(\frac{1}{\alpha} )-C(\frac{\alpha}{\gamma})$ &$C(P_A)-C(\frac{1}{\alpha})-C(\frac{\alpha}{\gamma})$  & $C(\frac{P_R}{1+\alpha})-C(\frac{1}{\alpha} )$  &\\[5pt] \hline \hline
%\end{tabular}
%\caption{Approximation of the achievable secrecy rates in case of $P_B=\alpha P_A$ and $P_A$ is large.}\label{tb:app}
%\end{table}

In Fig.~\ref{fig:asymcom4} and \ref{fig:asymcom5} we show the cases of $\gamma=1, \alpha=10$ and $\gamma=1, \alpha=0.1$, respectively. In Fig.~\ref{fig:asymcom6}, we fix $P_R=20{\rm dB}, P_B=0.1P_A$ and show the performance of various schemes when $P_R$ is limited.

%can be approximated to $C(P_A)-C(\alpha )-\min(C(1/\sqrt{P_R}),1/2)$ and (\ref{eq:zhang}) can be approximated to $C(P_A)-C(\alpha )-1/2$. Both of the rates are a constant gap below the upper bound for a fixed $P_R$. In Fig.~\ref{fig:asymcom4} and \ref{fig:asymcom5} we show the case $P_R=30$dB, $P_A=10P_B$ and $P_A=0.1P_B$, respectively. In Fig.~\ref{fig:asymcom6}, we show the case that $P_A=10P_B=30$dB and $P_R$ is limited. The figures also conform with our analysis that our schemes (the LC scheme in particular for limited relay power scenario) are upper bound approaching in the case $P_A=\alpha P_B, P_B >0$ for any $\alpha$ and $P_R$.

%Furthermore, it can be proved that our scheme is upper bound achieving when either of the transmit power or jammer power goes to infinity. Note that unlike the other schemes, our upper bound achievement does not necessarily require the jammer to have infinite power. Moreover, with the best of our knowledge, this is the only upper bound achieving secrecy transmit scheme for a relay with limited power.


\subsection{External Jammer}


Since the external jammer case is only considered by He {\em et al.} in \cite{he}, we compare our schemes to their scheme in Fig.~\ref{fig:exjcom1} and Fig.~\ref{fig:exjcom2} for different $\sigma^2$ and $P_R$. In Fig.~\ref{fig:exjcom1} it can be observed that our schemes perform better when $\sigma$ is small. When the channel between $B$ and $C$ is too noisy, the scheme of He {\em et al.} achieves a better rate. In Fig.~\ref{fig:exjcom2}, it is shown that our schemes have better performance in the limited relay power case. In particular, if the relay power is very low, the LC scheme is upper bound achieving even for large $\sigma$.

\begin{figure*}[!ht]
\centering
\subfigure[$\sigma\geq -5 {\rm dB}, P_A=P_B=P_R=30$dB.]{ 
    \label{fig:exjcom1} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{exjcom1}}
\subfigure[$\sigma^2=3{\rm dB}$ and $P_R\leq P_A=P_B=20$dB.]{ 
    \label{fig:exjcom2} %% label for first subfigure 
     \includegraphics[width=0.45\textwidth]{exjcom2}}
\caption{Comparison between the achievable secrecy rates of various schemes in two-hop channels with an external jammer.}
\end{figure*}


\section{Two-Hop Channel with an Eavesdropper}\label{s:ee}
In this section, we propose another channel model, in which we consider the case that the relay is honest and cooperative, but there is an external eavesdropper. 

\subsection{Model}

We firstly consider a two-hop channel in which node $A$ wants to transmit information to node $B$ using a relay node $R$ to forward the information. During the process an eavesdropper is trying to obtain the information transmitted by node $A$. In this model we assume that the destination $B$ also functions as a cooperative jammer. We also assume that the communication takes places over two phases, each including $N$ channel uses. We use $X^A, X^B, X^R \in \mathbb{R}^N$ for the transmissions of node $A$, the destination $B$, and the relay $R$, respectively. We use $Y^R, Y^E_1, Y^E_2, Y^B\in \mathbb{R}^N$ for the receptions of the relay, the eavesdropper in the two phases, and node $B$, respectively. In the first phase, node $A$ transmits to the relay $R$ and this transmission is eavesdropped by the eavesdropper $E$. The destination $B$ simultaneously transmits a jamming signal to confuse the eavesdropper, which is also superimposed with the transmission of node $A$ at the relay $R$. Hence, we have
\begin{eqnarray}
Y^R&=&h_1X^A+h_2X^B+Z^R, \label{eq:yrx}\\
Y^E_1&=&h_1'X^A+h_2'X^B+Z^E_1,
\end{eqnarray}
where $Z^R$ and $Z^E_1$ are $N$-dimensional independent Gaussian noise vectors and $h_1,h_2,h_1',h_2' \in \mathbb{R}^+$ are the channel coefficients. We further denote ${\bf h}=(h_1,h_2)$ and ${\bf h}'=(h_1', h_2')$.

In the second phase, the relay transmits to node $B$, which is also overheard by the eavesdropper.
\begin{eqnarray}\label{eq:ybx}
Y^B &=&h_2X^R+Z^B, \\
Y^E_2&=&h_3X^R+Z_2^E,
\end{eqnarray}
where channel coefficient $h_3 \in \mathbb{R}^+$ and $Z^B, Z_2^E$ are also $N$-dimensional independent Gaussian noise vectors. The model is illustrated in Fig.~\ref{fig:exte}.

\begin{figure}[!ht]
\centering
%
%
\tikzstyle{vertex}=[circle,minimum size=30pt, inner sep=0pt, draw]
\tikzstyle{edge}=[-latex, black, thick]
\tikzstyle{dot}=[edge, dotted]
\tikzstyle{dash}=[edge, densely dashed]
\tikzstyle{loosedo}=[edge, loosely dotted]
%
%
\subfigure[Phase 1]{ 
\begin{tikzpicture}[scale=2.8]
\node[vertex] (t1) at (0,2.4)  {$A$} ;
\node[vertex] (r) at (1,2.4) {$R$};
\node[vertex] (t2) at (2,2.4) {$B$} ;
\node[vertex] (j) at (1,3) {$E$};


\draw[edge, above] (0.2,2.7) to node {$h_1$} (0.8, 2.7);
\draw[dot, above](0.2,2.7) to node {$h_1'$} (0.8, 3.2);
\draw[dot, above](1.8,2.7) to node {$h_2'$} (1.2, 3.2);
\draw[edge, above](1.8, 2.7) to node {$h_2$} (1.2, 2.7);

%\node (jammer) at (1.5, 2.65) {Phase 1};

\node (xa) at (0, 2.7) {$X^A$};
\node (yr) at (1, 2.7) {$Y^R$};
\node (xb) at (1, 3.3) {$Y^E_1$};
\node (yc1) at (2, 2.7) {$X^B$};
\end{tikzpicture}}

\subfigure[Phase 2]{ 
\begin{tikzpicture}[scale=2.8]
\node[vertex] (t1) at (0,2.4)  {$A$} ;
\node[vertex] (r) at (1,2.4) {$R$};
\node[vertex] (t2) at (2,2.4) {$B$} ;
\node[vertex] (j) at (1,3) {$E$};


\draw[edge, right](1, 2.6) to node {$h_3$} (1, 2.8);
\draw[edge, above](1.2, 2.5) to node {$h_2$} (1.8, 2.5);

%\node (jammer) at (1.5, 2.65) {Phase 1};

\node (yr) at (0.8, 2.7) {$X^R$};
\node (xb) at (1, 3.3) {$Y^E_2$};
\node (yc1) at (2, 2.7) {$Y^B$};
\end{tikzpicture}}
\caption{Two-hop channel with an eavesdropper.}\label{fig:exte}
%\vspace{-2mm}
\end{figure}


The power constraints for the transmission of node $A,B$, and $R$ are given in (\ref{eq:power}).
W.l.o.g., we let all noise vectors have unit variance in each dimension. We assume the power constraints as well as all channel coefficients are revealed to all nodes. In this model, the reliability constraint is still (\ref{eq:reli}). However, the secrecy constraint becomes
\begin{equation}\label{eq:sec2}
\lim_{N \to \infty}\frac{1}{N}I(W^A;Y^E_1, Y^E_2)\leq \delta
\end{equation}
for any chosen $\delta>0$.

\remark{This problem is essentially different from the normal wire-tap type of problems or the problem we introduced in Subsection~\ref{s:model}. The main difference is that the information is leaked to the eavesdropper twice from the source and the relay, respectively. Most of the existing secure transmission problems only focus on preventing the eavesdropper from getting information from one source.}

\subsection{Coding Scheme}

Here, we show that the RB scheme can be straightforwardly applied to achieve a positive secrecy rate if the transmit rate of the $({\bf a}, {\boldsymbol\beta})$ SCF code is set appropriately. The key for the deployment of the RB scheme is that the transmit rate should be chosen such that the eavesdropper can decode the same linear combination that the relay decodes. Then, the reception of the eavesdropper in the second phase will be a degraded version of the first phase, i.e., $H(Y^E_2|Y^E_1)=0$.

%Here, we propose a transmission scheme which reduces this problem to a similar two-hop untrusted relay problem as proposed in Subsection~\ref{s:model}. This scheme guarantees that the reception in the second phase is a degraded version of the first phase, i.e., $H(Y^E_2|Y^E_1)=0$.

Before setting the transmit rate, we first give the definition of the computation rate in this model. Note that the expression of the computation rate is different from (\ref{eq:comr2}), which is due to the non-unit channel coefficients. The code and the transmit process are essentially the same. We define the computation rate in this model for $i \in \{A, B\}$ as
\begin{equation}\label{eq:comr3}
\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}^*)=\frac{1}{2}\log_2(\frac{\beta_i^2 h_i^2 P_i}{{\cal N}({\bf a}, {\boldsymbol\beta},{\bf h}^*)}),
\end{equation}
where 
\begin{equation}
{\cal N}({\bf a}, {\boldsymbol\beta},{\bf h}^*)=\frac{h_A^2h_B^2P_AP_B(a_1\beta_A-a_2\beta_B)^2+(a_1h_A\beta_A)^2P_A+(a_2h_B\beta_B)^2P_B}{h_A^2P_A+h_B^2P_B+1}.
\end{equation}
 Here, ${\bf h}^*=(h_A, h_B) \in \mathbb{R}^+$. Note that ${\cal N}({\bf a}, {\boldsymbol\beta},{\bf h}^*)$ is simply ${\cal N}({\bf a}, {\boldsymbol\beta})$ in (\ref{eq:nabeta}) with all $P_i$ substituted by $h_i^2P_i$.

Now we set the value for the transmit rate $R_t^i({\bf a}, {\boldsymbol\beta}), i\in\{A, B\}$. Firstly, to guarantee $H(Y^E_2|Y^E_1)=0$, we let the relay decode a linear combination $a_1X^A+a_2X^B$ which the eavesdropper can also decode. In this case, the transmission of the relay at Phase 2 will not leak more information since we have a Markov chain $Y_E^1 \to a_1X^A+a_2X^B \to X^R \to Y^E_2$. By the data processing inequality we have $H(Y^E_2|Y^E_1)=0$ and
\begin{equation}\label{eq:sec3}
I(W^A;Y^E_1, Y^E_2) = I(W^A;Y^E_1).
\end{equation}
By \cite{jingge}, there exists a sequence of lattice codes with which the relay and the eavesdropper are both able to decode $a_1X^A+a_2X^B$ if the transmit rate of node $i \in\{A, B\}$ satisfies
\begin{equation}\label{eq:rtee}
R_t^i({\bf a}, {\boldsymbol\beta}) < \min (\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}')).
\end{equation}
%With these lattice codes we can construct an $({\bf a}, {\boldsymbol\beta})$ SCF code for reliable transmission. 
Similarly to (\ref{eq:il4}), the information leakage rate of this code can be bounded by
\begin{equation}\label{eq:ro2}
R_o({\bf a}, {\boldsymbol\beta}) < C({h_1'}^2P_A+{h_2'}^2P_B)-R_t^B({\bf a}, {\boldsymbol\beta}).
\end{equation}
%Similar to the RB scheme used for the previous model, we can the use the random binning code to eliminate this information leakage in this model. With the same arguments that we used in Subsection~\ref{ss:rbbs}, combining (\ref{eq:rsl}), (\ref{eq:rtee}), and (\ref{eq:ro2}) we have the following theorem.

Now, using the RB scheme with the transmit rate of the $({\bf a}, {\boldsymbol\beta})$ SCF code set accordingly to (\ref{eq:rtee}) and the random binning code generated w.r.t. (\ref{eq:ro2}), the reliable and secure transmission is guaranteed. The proof for the reliability and security are identical to the proof we given in Subsection~\ref{ss:rbbs}. We thus have the following theorem for the achievable secrecy rate.

%Here, we consider the case in which our RB scheme can be straightforwardly applied to achieve a positive secrecy rate. In this case, $Y^E_2$ is a degraded version of $Y^E_1$, i.e., $H(Y^E_2|Y^E_1)=0$. %In the second case, we consider the case that $Y_E^1$ is a degraded version of $Y^E_2$, i.e., $H(Y^E_2|Y^E_1)=0$.

%\subsubsection{$H(Y^E_2|Y^E_1)=0$}

%Firstly, we consider that in the first phase, the relay has a degraded channel of the channel of the eavesdropper, i.e., we have $h_1/h_2=h_1'/h_2'$ and $h_1' \leq h_1$. In this case, since $Y^E_1 \to Y^R \to X^R \to Y^E_2$ is a Markov chain, by the data processing inequality we have
%\begin{equation}\label{eq:sec3}
%I(W^A;Y^E_1, Y^E_2) \leq I(W^A;Y^E_1).
%\end{equation}
%Hence, we only need to guarantee that no information is leaked in phase 1, which can be achieved by our RB scheme in a straightforward fashion. Note that in this model the channel coefficients are not unified, thus we have the following computation rate
%\begin{equation}\label{eq:comr3}
%\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}^*)=\frac{1}{2}\log_2(\frac{\beta_i^2 h_i^2 P_i}{{\cal N}({\bf a}, {\boldsymbol\beta},{\bf h}^*)}),
%\end{equation}
%where ${\cal N}({\bf a}, {\boldsymbol\beta},{\bf h}^*)$ is (\ref{eq:nabeta}) with all $P_i$ substituted by $h_i^2P_i$. Here, ${\bf h}^*=(h_A, h_B) \in \mathbb{R}^+$.

%With an $({\bf a}, {\boldsymbol\beta})$ SCF code used as inner code, by (\ref{eq:il4}), we can compute that the information leakage rate has the inequality
%\begin{equation}\label{eq:ro2}
%R_o({\bf a}, {\boldsymbol\beta}) < C({h_1'}^2P_A+{h_2'}^2P_B)-R_t^B({\bf a}, {\boldsymbol\beta}).
%\end{equation}
%We then use a random binning outer code to eliminate this information leakage. The information security can be proved with an almost identical proof as Lemma~\ref{lm:rb}, which is omitted. We can then calculate the achievable secrecy rate. Any secrecy rate satisfying
%\begin{eqnarray}
%\lefteqn{R_s} \nonumber \\
%&<&\max_{{\bf a}, {\boldsymbol\beta}} \sum_{i \in \{A,B\}}\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h})-C({h_1'}^2P_A+{h_2'}^2P_B) \nonumber \\
%&=& \log_2\frac{1+h_1^2P_A+h_2^2P_A}{\sqrt{(1+h_1^2P_A)(1+h_2^2P_B)}-h_1h_2\sqrt{P_AP_B}}-1 \nonumber \\
%&&\hspace{3cm}-C({h_1'}^2P_A+{h_2'}^2P_B)
%\end{eqnarray}
%is achievable.

%Then, if the relay does not have a degraded channel of the eavesdropper, we can still make $Y^E_1 \to X^R \to Y^E_2$ a Markov chain by letting the relay decode a linear combination that the eavesdropper can decode as well. By \cite{jingge}, there exists a sequence of lattice codes with which the relay and the eavesdropper are both able to decode $a_1X^A+a_2X^B$ if the transmit rate of node $i$ satisfies
%\begin{equation}
%R_t^i({\bf a}, {\boldsymbol\beta}) < \min (\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}')).
%\end{equation}
%Then, by using an $({\bf a}, {\boldsymbol\beta})$ SCF code constructed with these lattice codes as inner code, it is clear that $H(Y^E_2|Y^E_1)=0$ since the linear combination transmitted in $X^R$ is already known to the eavesdropper.
%Further, by using a random binning outer code constructed w.r.t. (\ref{eq:ro2}), we have the following theorem for the achievable secrecy rate in this model.

\theorem{In a two-hop channel with an eavesdropper, any secrecy rate satisfying
\begin{eqnarray}
%\lefteqn{R_s} \nonumber \\
%&<&\max_{{\bf a}, {\boldsymbol\beta}} \sum_{i \in \{A,B\}} (\min (\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}')) \nonumber \\
%&& \hspace{3cm}-C({h_1'}^2P_A+{h_2'}^2P_B)
R_s &<&\max_{{\bf a}, {\boldsymbol\beta}} \sum_{i \in \{A,B\}} \left(\min (\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}'))\right) -C({h_1'}^2P_A+{h_2'}^2P_B)
\end{eqnarray}
is achievable if $P_R \geq \frac{h_1^2}{h_2^2}P_A$ and any secrecy rate satisfying
\begin{eqnarray}
%\lefteqn{R_s} \nonumber \\
%&<&\max_{{\bf a}, {\boldsymbol\beta}} [\sum_{i \in \{A,B\}} (\min (\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}'))\nonumber \\
%&& -C({h_1'}^2P_A+{h_2'}^2P_B)] \frac{C(h_2^2P_R)}{\min (\tilde{R}_{\rm CF}^A({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^A({\bf a}, {\boldsymbol\beta},{\bf h}'))} \nonumber \\
R_s&<&\max_{{\bf a}, {\boldsymbol\beta}}\left\{ \left[\sum_{i \in \{A,B\}} \left(\min (\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^i({\bf a}, {\boldsymbol\beta},{\bf h}'))\right)-C({h_1'}^2P_A+{h_2'}^2P_B)\right] \right. \nonumber\\ 
&& \hspace{7cm} \left.\vphantom{\sum_{i \in \{A,B\}}}\frac{C(h_2^2P_R)}{\min (\tilde{R}_{\rm CF}^A({\bf a}, {\boldsymbol\beta},{\bf h}),\tilde{R}_{\rm CF}^A({\bf a}, {\boldsymbol\beta},{\bf h}'))} \right\} \nonumber \\
\end{eqnarray}
is achievable if $P_R <\frac{h_1^2}{h_2^2}P_A$.
}\label{th:ee}

\remark{When $h_1' = h_1$, $h_2' = h_2$, and $P_R \geq \frac{h_1^2}{h_2^2}P_A$, Theorem~\ref{th:ee} mimics our result in Corollary~\ref{co:1}. However, when the eavesdropper has a bad channel, e.g., $h_1' \to 0$ and $h_2' \to 0$, the achievable rate in Theorem~\ref{th:ee} tends to zero, which reflect the sub-optimality of this scheme.}

In Fig.~\ref{fig:exe} we show an example in which the RB scheme achieves a positive rate on a two-hop channel with an eavesdropper. The achievable secrecy rate is identical to the untrusted relay case when $h_1=h_2=h_1'=h_2'=1$ and decreases if the $h_2'$ increases. With our scheme, a large $h_1'$ or a large $h_2$ will both result in small or even no secrecy rate at all.

\begin{figure}[!ht]
\centering
\includegraphics[width=0.5\textwidth]{exeave}
\caption{Achievable secrecy rate in a two-hop channel with an eavesdropper when $h_1=h_2=h_1'=1$ as a function of $h_2'$.}
\label{fig:exe}
\end{figure}


\section{Conclusion}\label{s:con}

In this paper, we proposed two novel reliable and secure transmission schemes for the two-hop channel with an untrusted relay. These are the first secure transmission schemes that use the scaled compute-and-forward technique. We have shown that when the cooperative jammer and the destination are collocated, both of our schemes achieve relatively good secrecy rates in the high SNR region. Especially, for $P_B= \alpha P_A, P_R= \gamma P_A, \alpha, \gamma \in \mathbb{R}^+$, and $P_A \to \infty$, our schemes are the first upper bound achieving schemes for any $\alpha$ and $\gamma$. Moreover, the LC scheme is the first upper bound achieving scheme if $P_R$ is limited and $P_A$ is not unbounded. In summary, our schemes significantly improve the achievable secrecy rate lower bound and achieve the upper bound in two cases:
1, $P_R$ is limited and $P_A$ does not go to infinity.
2, $P_A, P_B, P_R$ are linearly related and go to infinity.

Also, we proposed another two-hop channel model in which the relay is trusted but there exists an external eavesdropper. We showed that our RB scheme can also be exploited in this model and achieves a positive secrecy rate.



%In the scheme we applied scaled compute-and-forward as the relay technique, instead of compress-and-forward and normal compute-and-forward as proposed in other studies \cite{he, he2, richter}. We proved that our scheme is reliable and achieves (weak) information theoretic secrecy. Further, we compared our scheme with some existing secure transmission schemes. The result shows that our scheme outperforms all other secure transmission schemes by at least 0.5 {\em bit/channel use} in terms of secrecy rate when $P \to \infty$. Moreover, it is upper bound achieving when $h_1 \leq h_2$ and $P \to \infty$.

% if have a single appendix:
%\appendix[Proof of the Zonklar Equations]
% or
%\appendix  % for no appendix heading
% do not use \section anymore after \appendix, only \section*
% is possibly needed

% use appendices with more than one appendix
% then use \section to start each appendix
% you must declare a \section before using any
% \subsection or using \label (\appendices by itself
% starts a section numbered zero.)
%


%\appendices
%\section{Proof of the First Zonklar Equation}
%Appendix one text goes here.

% you can choose not to have a title for an appendix
% if you want by leaving the argument blank
%\section{}
%Appendix two text goes here.
\appendices
%\section{Proof of the First Zonklar Equation}
%Appendix one text goes here.

% you can choose not to have a title for an appendix
% if you want by leaving the argument blank
%\section{}
%Appendix two text goes here.
%\section{List of Symbols and Notations}
%\begin{table*}[h]
%\centering
%\begin{tabular}{||c|c||}
%\hline 
%\multicolumn{2}{ |c| }{List of the Symbols and Notations} \\ \hline
%Symbol (Notation) & Description \\ \hline \hline
%$A, B, C, R$ & Name of the source, destination, cooperative jammer and the relay. \\ \hline
%${\bf a}=(a_1,a_2)$ & The coefficients of the decoded vector at the relay. \\ \hline
%$h_{ij}$ & Channel coefficient of the channel from node $i$ to $j$. \\ \hline 
%$N$ & The number of the channel uses of each phase.\\ \hline
%$P_i$ & The power constraint of node $i$ for each channel use on average. \\ \hline
%$R_s$ & The secrecy rate of $A$. \\ \hline
%$R_{\rm CF}^i, i \in \{\A,B\}$ & Computation rate. \\ \hline
%$W^A$ & The source message. \\ \hline
%$\tilde{W}^A$ & The estimation of the source message at node $C$ \\ \hline
%$X_i^j$ and $Y_i^j$ & The transmission and reception of node $j$ at phase $i$ for the normalized channel.\\ \hline
%$\hat{X}_i^j$ and $\hat{Y}_i^j$ & The transmission and reception of node $j$ at phase $i$. \\ \hline
%$Z_i^j$ & The Gaussian noise of node $j$ at phase $i$ for the normalized channel. \\ \hline
%$\hat{Z}_i^j$ & The Gaussian noise of node $j$ at phase $i$. \\ \hline
%${\boldsymbol\beta}=(\beta_A, \beta_B)$ & The scaling coefficients. \\ \hline
%$\sigma^2$ & The noise variance at node $C$ at phase 1 for the normalized channel. \\ \hline
%$\hat{\sigma}^2$ and $\hat{\sigma_C}^2$ & The noise variances at node $C$ at phase 1 and phase 2. \\ \hline
%$\hat{\sigma_R}^2$ & The noise variance at node $R$ at phase 1. \\ \hline
%$\Lambda$ & The fine lattice. \\ \hline
%$\Lambda_C^i({\bf a}, {\boldsymbol\beta}), i\in\{A,B\}$ & The shaping lattices. \\ \hline
%$\Lambda_E^i({\bf a}, {\boldsymbol\beta}), i\in \{A,B\}$ &$\Lambda_C^i({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda_E^i({\bf a}, {\boldsymbol\beta}) \subseteq \Lambda.$ \\ \hline
%\end{tabular}
%\end{table*}

\section{Proof of Lemma~\ref{lm:rb}}\label{ap:1}
\beginofproof
By analyzing the information leakage rate, we will have
\begin{eqnarray}
%\lefteqn{\frac{1}{lN}I({\cal W}^A;{\cal Y}^R)} \nonumber \\
%&=&\frac{1}{lN}(H({\cal W}^A)-H({\cal X}^A,{\cal X}^B|{\cal Y}^R) \nonumber \\
%&& -H({\cal W}^A|{\cal Y}^R,{\cal X}^A,{\cal X}^B)+H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)) \label{eq:il11}\\
\lefteqn{\frac{1}{lN}I({\cal W}^A;{\cal Y}^R)} \nonumber \\
 &=&\frac{1}{lN}(H({\cal W}^A)-H({\cal X}^A,{\cal X}^B|{\cal Y}^R) -H({\cal W}^A|{\cal Y}^R,{\cal X}^A,{\cal X}^B)+H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)) \label{eq:il11}\\
%&=& \frac{1}{lN}(H({\cal W}^A)-H({\cal X}^A, {\cal X}^B) \nonumber \\
%&& +I({\cal X}^A,{\cal X}^B;{\cal Y}^R)+H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)), \label{eq:il12}
&=& \frac{1}{lN}(H({\cal W}^A)-H({\cal X}^A, {\cal X}^B) +I({\cal X}^A,{\cal X}^B;{\cal Y}^R)+H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)), \label{eq:il12}
\end{eqnarray} 
where ${\cal W}^A$ is length-$l$ sequence of source messages and ${\cal X}^A$, ${\cal X}^B$, and ${\cal Y}^R$ are length-$\lceil l' \rceil$ sequences of the transmissions of the source, the transmissions of the jammer, and the receptions at the relay, respectively.
The third term in (\ref{eq:il11}) is 0 since the mapping error from the codewords to the source messages is almost zero as we stated in Segment~\ref{sss:re}. Then we focus on the last term $H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)$. This term can be upper bounded by Fano's inequality since the relay can determine the transmitted codeword almost surely. The reason is that the size of the bin is chosen accordingly to the information leakage rate.

More precisely, for any transmitted message, by the leaked information, the relay is able to list almost $2^{\lfloor lH(W^A) \rfloor}$ possible ${\cal X}^A$ as candidates from a total of $2^{\lfloor lH(W^A) \rfloor+\lfloor l' N R_o({\bf a}, {\boldsymbol\beta})\rfloor}$ codewords. Then, since the random binning process is independent and uniform, the relay can determine the transmitted codeword almost surely if it also knows the label of the bin when $N,l \to \infty$.

Then, by Fano's inequality, we have
\begin{eqnarray}
\lefteqn{H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)}\nonumber \\
&\leq &\frac{1}{lN}+\frac{1}{lN}P_e\log_2 2^{\lfloor lH(W^A) \rfloor+\lfloor l' N R_o({\bf a}, {\boldsymbol\beta})\rfloor} \nonumber \\
&\leq& \epsilon',
\end{eqnarray}
where $P_e,\epsilon' \to 0$ when $N \to \infty$.

Hence, we have
\begin{eqnarray}
\lefteqn{\frac{1}{lN}I({\cal W}^A;{\cal Y}^R)} \nonumber \\
&=& \frac{1}{lN}(H({\cal W}^A)-H({\cal X}^A)-H( {\cal X}^B) +I({\cal X}^A,{\cal X}^B;{\cal Y}^R)+H({\cal X}^A,{\cal X}^B|{\cal Y}^R,{\cal W}^A)) \label{eq:il12} \nonumber \\
&=& \frac{1}{lN}(lH(W^A)-\lfloor lH(W^A)\rfloor -\lfloor l'NR_o({\bf a}, {\boldsymbol\beta})\rfloor -\lceil l' \rceil NR_t^B({\bf a}, {\boldsymbol\beta})+\lceil l' \rceil I(X^A,X^B;Y^R)+\epsilon' \nonumber \\
&<& \frac{1}{lN}(lH(W^A)-\lfloor lH(W^A)\rfloor -\lfloor l'NR_o({\bf a}, {\boldsymbol\beta})\rfloor -\lceil l' \rceil NR_t^B({\bf a}, {\boldsymbol\beta})+\lceil l' \rceil NC(P_A+P_B))+\epsilon' \nonumber \\
&\leq& \frac{1}{lN}(1-\lfloor l' NC(P_A+ P_B)-l'NR_t^B({\bf a}, {\boldsymbol\beta})\rfloor  -\lceil l' \rceil  NR_t^B({\bf a}, {\boldsymbol\beta})+\lceil l' \rceil NC(P_A+P_B))+\epsilon' \nonumber \\
&\leq& \frac{1}{lN}(2-l' N(C(P_A+ P_B)-R_t^B({\bf a}, {\boldsymbol\beta}))  +\lceil l' \rceil  N(C(P_A+P_B)-R_t^B({\bf a}, {\boldsymbol\beta}) ))+\epsilon' \nonumber \\
&\leq& \frac{2}{lN}+\frac{-R_t^B({\bf a}, {\boldsymbol\beta})+C(P_A+P_B)}{l}+\epsilon',
\end{eqnarray} 
which can be made arbitrarily small by choosing sufficiently large $l,N$. Here, the second equality follows from our codebook construction, where $H({\cal X}^A) = \lfloor lH(W^A)\rfloor +\lfloor l'NR_o({\bf a}, {\boldsymbol\beta})\rfloor$ and $H( {\cal X}^B) = \lceil l' \rceil NR_t^B({\bf a}, {\boldsymbol\beta})$. The first inequality follows from the capacity of the Gaussian MAC. The second inequality follows from (\ref{eq:il4}).

%We can then calculate the secrecy rate
%\begin{eqnarray}
%&&R_s \nonumber \\
%&=& \frac{l}{\lceil l' \rceil}R_s^A \nonumber \\
%&<&R_t^A({\bf a}, {\boldsymbol\beta})+R_t^B({\bf a}, {\boldsymbol\beta})-C(p_A,p_B) +\epsilon
%\end{eqnarray}
%where $\epsilon \to 0$ when $l \to \infty$.

\endofproof


\section{Proof of Lemma~\ref{lm:2}}\label{ap:2}
\beginofproof
Firstly, since $X^B$ is independent of $X^A$ and the dithers are known, by  (\ref{eq:rta}) we have 
\begin{eqnarray}
\lefteqn{\frac{1}{N}(H(W^A)-H(X^A)-H(X^B))} \nonumber \\
&=&R_s^A({\bf a}, {\boldsymbol\beta})-R_t^A({\bf a}, {\boldsymbol\beta})-R_t^B({\bf a}, {\boldsymbol\beta})\nonumber \\
&=&-R_e^A({\bf a}, {\boldsymbol\beta})-R_t^B({\bf a}, {\boldsymbol\beta}). \label{eq:il21}
\end{eqnarray}
We can then upper bound the information leakage rate at the relay by
\begin{eqnarray}
\lefteqn{\frac{1}{N} I(W^A; Y^R)}  \nonumber \\
&=& \frac{1}{N}(H(W^A)-H(X^A,X^B|Y^R) -H(W^A|Y^R,X^A,X^B)+H(X^A,X^B|Y^R,W^A)) \nonumber\\
&=& \frac{1}{N}(H(W^A)-H(X^A)-H(X^B) +I(X^A,X^B;Y^R)) +\frac{1}{N}H(X^A,X^B|Y^R,W^A). \nonumber \\
&<& -R_e^A({\bf a}, {\boldsymbol\beta})-R_t^B({\bf a}, {\boldsymbol\beta})+C(P_A+P_B) +\frac{1}{N}H(X^A,X^B|Y^R,W^A).  \label{eq:apinle}
\end{eqnarray}
Here, the second equality follows a similar argument as (\ref{eq:il12}). The inequality follows from (\ref{eq:il21}) and the Gaussian MAC capacity.

By \cite[Theorem 2, 3]{jingge2}, the decoder can reliably decode $X^A$ and $X^B$ from $Y^R$ and $W^A$ with all the dithers, lattices and coefficients by a regular lattice decoding scheme if (\ref{eq:conrsa}) holds. Here, we briefly explain the decoding process.

Firstly, we let the relay decode $a_1(V^A+T^A)+a_2V^B$. By \cite{jingge}, the decoding is successful if (\ref{eq:racf}) holds, which is guaranteed by (\ref{eq:rtcf}). Then, since the relay already knows $W^A$ and the codebook, it knows $T^A$ as well. We let it subtract $a_1T^A$ and decode $V^A$ by treating $a_1(V^A+T^A)+a_2V^B$ as noise. It is proved that the decoding is reliable if
\begin{equation}\label{eq:conrea}
R_e^A({\bf a}, {\boldsymbol\beta})<C(P_A+P_B)-\hat{R}_t^B({\bf a}, {\boldsymbol\beta}),
\end{equation}
which is guaranteed by (\ref{eq:il4}), (\ref{eq:macab}), and (\ref{eq:conrsa}). Then, it can also decode $V^B$ by subtracting $a_1(V^A+T^A)$ from $a_1(V^A+T^A)+a_2V^B$. Hence, both $V^A$ and $V^B$ are decoded and then $X^A$ and $X^B$ are reliably decoded as well.


As a result, by Fano's inequality we have
\begin{eqnarray}
\lefteqn{\frac{1}{N}H(X^A,X^B|Y^R,W^A)} \nonumber \\
&\leq& \frac{1}{N}+\frac{1}{N}P_e\log_2 2^{N(R_e^A({\bf a}, {\boldsymbol\beta})+R_t^B({\bf a}, {\boldsymbol\beta}))} \nonumber \\
&=& \frac{1}{N} + P_e(R_e^A({\bf a}, {\boldsymbol\beta})+R_t^B({\bf a}, {\boldsymbol\beta})),\label{eq:part2}
\end{eqnarray}
where $P_e$ is the probability of decoding errors which tends to 0 when $N \to \infty$. Then, bringing back the expression of information leakage rate in (\ref{eq:apinle}), combining (\ref{eq:il4}), (\ref{eq:macab}), and (\ref{eq:part2}), the information leakage rate can be made arbitrarily small by choosing sufficiently large $N$ and sufficiently small $\delta''$. Hence, we finish the proof.
\endofproof

% use section* for acknowledgement
\section*{Acknowledgment}

This work was supported by ERC Starting Grant 259530-ComCom and by NWO Grant 612.001.107.

The authors would also like to thank Jingge Zhu from Ecole Polytechnique F\'ed\'erale de Lausanne for the valuable discussion.


%The authors would like to thank...


% Can use something like this to put references on a page
% by themselves when using endfloat and the captionsoff option.
%\ifCLASSOPTIONcaptionsoff
%  \newpage
%\fi



% trigger a \newpage just before the given reference
% number - used to balance the columns on the last page
% adjust value as needed - may need to be readjusted if
% the document is modified later
%\IEEEtriggeratref{8}
% The "triggered" command can be changed if desired:
%\IEEEtriggercmd{\enlargethispage{-5in}}

% references section

% can use a bibliography generated by BibTeX as a .bbl file
% BibTeX documentation can be easily obtained at:
% http://www.ctan.org/tex-archive/biblio/bibtex/contrib/doc/
% The IEEEtran BibTeX style support page is at:
% http://www.michaelshell.org/tex/ieeetran/bibtex/
%\bibliographystyle{IEEEtran}
% argument is your BibTeX string definitions and bibliography database(s)
%\bibliography{IEEEabrv,../bib/paper}
%
% <OR> manually copy in the resultant .bbl file
% set second argument of \begin to the number of references
% (used to reserve space for the reference number labels box)
\begin{thebibliography}{1}
\bibitem{shannon}
C.~E.~Shannon, ``Communication theory of secrecy systems." {\em Bell Syst. Tech. J.}, pp. 656-715, vol. 28, 1949.
\bibitem{wyner}
A.~Wyner, ``The wire-tap channel, {\em Bell Syst. Tech. J.}, pp. 1355-87, vol. 54, 1975.
\bibitem{oohama}
Y.~Oohama, ``Relay channels with confidential messages," in {\em Inf. Theory Workshop}, 2001.
\bibitem{he}
X. He and A. Yener, ``Two-hop secure communication using and untrusted relay,'' {\em EURASIP Journal on Wireless Comm. and Netw.}, Article ID: 305146, 2009.
\bibitem{tekin}
E. Tekin and A. Yener, ``The general Gaussian multiple access and two-hop wire-tap channels: achievable rates and cooperative jamming,'' {\em IEEE Trans. on Inf. Theory}, pp. 2735-51, vol. 54, 2008.
\bibitem{elgamal}
A. El Gamal and Y.-H. Kim, ``Network Information Theory,'' {\em Cambridge}, 2011.
%\bibitem{laneman}
%J.N. Laneman, D.N.C. Tse, G.W. Wornell, ``Cooperative diversity in wireless networks: Efficient protocols and outage behavior,'' {\em IEEE Trans. on Inf. Theory}, pp. 3062-80, vol. 50, 2004.
\bibitem{gastpar}
M. Gastpar and M. Vetterli, ``On the capacity of wireless networks: The relay case'' {\em Proc. IEEE INFOCOM}, New York, NY, June 2002.
\bibitem{sun}
L. Sun, T. Zhang, Y. Li, and N. Hao, ``Performance study of two-hop amplify-and-forward systems with untrustworthy relay nodes,'' {\em IEEE Trans. Veh. Tech.}, pp. 2801-07, vol. 61, 2012.
\bibitem{zhang}
S. Zhang, L. Fan, M. Peng, and H. V. Poor, ``Near optimal modulo-and-forward scheme for the untrusted relay channel,'' available on \url{http://arxiv.org/pdf/1503.08928v1.pdf}, 2015.
\bibitem{nazer}
B.~Nazer and M.~Gastpar, ``Compute-and-Forward: harnessing interference through structured codes," {\em IEEE Trans. Inf. Theory}, pp. 6463-86, vol. 57, 2011.
\bibitem{he2}
X.~He and A.~Yener, ``End-to-end secure multi-hop communication with untrusted relays," {\em IEEE. Trans. on Wireless Comm.}, pp. 1-11, vol. 12, 2013.
\bibitem{he3}
X. He and A. Yener, ``Strong secrecy and reliable Byzantine detection in the presence of an untrusted relay,'' {\em IEEE Trans. on Inf. Theory}, pp. 177-92, vol. 59, 2013.
\bibitem{richter2}
J. Richter, C. Scheunert, S. Engelmann, and E.A. Jorswieck, ``Weal secrecy in the multiway untrusted relay channel with compute-and-forward,''{\em IEEE Trans. on Inform. Foren. and Sec.}, pp. 1262-73, vol. 10, 2015.
\bibitem{vatedka}
S. Vatedka, N. Kashyap, and A. Thangaraj, ``Secure compute-and-forward in a bidirectional relay,'' available on \url{http://arxiv.org/pdf/1206.3392v3.pdf}, 2014.
\bibitem{jingge}
J. Zhu and M.~Gastpar, ``Asymmetric compute-and-forward with CSIT,'' {\em International Zurich Seminar on Comm.}, Zurich, Switzerland, Feb. 2014.
\bibitem{erez}
U.~Erez and R.~Zamir, ``Achieving 1/2 log (1 + SNR) on the AWGN channel with lattice encoding and decoding," {\em IEEE Trans. Inf. Theory}, pp. 2293-2314, vol. 50, 2004.
\bibitem{vatedka2}
S. Vatedka and N. Kashyap, ``Nested lattice codes for secure bidirectional relaying with asymmetric channel gains,'' {\em Proc. Inf. Theory Workshop}, Jerusalem, Israel, Apr., 2015.
\bibitem{nazer2}
B.~Nazer and M.~Gastpar, ``Reliable physical layer network coding{\em Proc. IEEE}, pp. 438-60, vol. 99, 2011.
\bibitem{csiszar}
I. Csisz\'{a}r and J. K\"{o}rner, ``Broadcast channels with confidential messages,'' {\em IEEE Trans. Inf. Theory}, pp. 339-48, vol. 24, 1978.
\bibitem{richter}
J.~Richter, C.~Scheunert, S.~Engelmann and E.~A.~Jorswieck, ``Weak secrecy in the multi-way relay channel with compute-and-forward,'' {\em European School of Information Theory}, Tallinn, Estonia, Apr. 2014.
\bibitem{jingge2}
%J.~Zhu and M.~Gastpar, ``Multiple access via compute-and-forward,'' available on http:\textbackslash \textbackslash arxiv.org\textbackslash pdf\textbackslash1407.8463v1.pdf, 2014.
J.~Zhu and M.~Gastpar, ``Multiple access via compute-and-forward,'' available on \url{http://arxiv.org/pdf/1407.8463v1.pdf}, 2014.
%\bibitem{ren}
%Z.~Ren, J.~Goseling, J.~H.~Weber and M.~Gastpar, ``Secure transmission using an untrusted relay with scaled compute-and-forward,'' {\em Proc. Inf. Theory Workshop}, Jerusalem, Israel, Apr., 2015.
%\bibitem{xiang3}
%X.~He and A.~Yener, `` Providing secrecy with structured codes: tools and applications to Gaussian two user channels," submitted to {\em IEEE Trans. Inf. Theory}, Available: \url{http://arxiv.org/abs/0907.5388}.
%\bibitem{jafar}
%S.~A.~Jafar, ``Capacity with causal and non-causal side information: a unified view," {\em IEEE Trans. Inf. Theory}, pp. 5468-75, vol. 52, 2006.
\end{thebibliography}

% biography section
%
% If you have an EPS/PDF photo (graphicx package needed) extra braces are
% needed around the contents of the optional argument to biography to prevent
% the LaTeX parser from getting confused when it sees the complicated
% \includegraphics command within an optional argument. (You could create
% your own custom macro containing the \includegraphics command to make things
% simpler here.)
%\begin{IEEEbiography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{mshell}}]{Michael Shell}
% or if you just want to reserve a space for a photo:

%\begin{IEEEbiography}{Michael Shell}
%Biography text here.
%\end{IEEEbiography}

% if you will not have a photo at all:
%\begin{IEEEbiographynophoto}{John Doe}
%Biography text here.
%\end{IEEEbiographynophoto}

% insert where needed to balance the two columns on the last page with
% biographies
%\newpage

%\begin{IEEEbiographynophoto}{Jane Doe}
%Biography text here.
%\end{IEEEbiographynophoto}

% You can push biographies down or up by placing
% a \vfill before or after them. The appropriate
% use of \vfill depends on what kind of text is
% on the last page and whether or not the columns
% are being equalized.

%\vfill

% Can be used to pull up biographies so that the bottom of the last one
% is flush with the other column.
%\enlargethispage{-5in}



% that's all folks
\end{document}



1509.04075.extracted_bib
{shannon C.~E.~Shannon, ``Communication theory of secrecy systems." {\em Bell Syst. Tech. J., pp. 656-715, vol. 28, 1949.
1509.04075.extracted_bib
{wyner A.~Wyner, ``The wire-tap channel, {\em Bell Syst. Tech. J., pp. 1355-87, vol. 54, 1975.
1509.04075.extracted_bib
{oohama Y.~Oohama, ``Relay channels with confidential messages," in {\em Inf. Theory Workshop, 2001.
1509.04075.extracted_bib
{he X. He and A. Yener, ``Two-hop secure communication using and untrusted relay,'' {\em EURASIP Journal on Wireless Comm. and Netw., Article ID: 305146, 2009.
1509.04075.extracted_bib
{tekin E. Tekin and A. Yener, ``The general Gaussian multiple access and two-hop wire-tap channels: achievable rates and cooperative jamming,'' {\em IEEE Trans. on Inf. Theory, pp. 2735-51, vol. 54, 2008.
1509.04075.extracted_bib
{elgamal A. El Gamal and Y.-H. Kim, ``Network Information Theory,'' {\em Cambridge, 2011. %
1509.04075.extracted_bib
{laneman %J.N. Laneman, D.N.C. Tse, G.W. Wornell, ``Cooperative diversity in wireless networks: Efficient protocols and outage behavior,'' {\em IEEE Trans. on Inf. Theory, pp. 3062-80, vol. 50, 2004.
1509.04075.extracted_bib
{gastpar M. Gastpar and M. Vetterli, ``On the capacity of wireless networks: The relay case'' {\em Proc. IEEE INFOCOM, New York, NY, June 2002.
1509.04075.extracted_bib
{sun L. Sun, T. Zhang, Y. Li, and N. Hao, ``Performance study of two-hop amplify-and-forward systems with untrustworthy relay nodes,'' {\em IEEE Trans. Veh. Tech., pp. 2801-07, vol. 61, 2012.
1509.04075.extracted_bib
{zhang S. Zhang, L. Fan, M. Peng, and H. V. Poor, ``Near optimal modulo-and-forward scheme for the untrusted relay channel,'' available on \url{http://arxiv.org/pdf/1503.08928v1.pdf, 2015.
1509.04075.extracted_bib
{nazer B.~Nazer and M.~Gastpar, ``Compute-and-Forward: harnessing interference through structured codes," {\em IEEE Trans. Inf. Theory, pp. 6463-86, vol. 57, 2011.
1509.04075.extracted_bib
{he2 X.~He and A.~Yener, ``End-to-end secure multi-hop communication with untrusted relays," {\em IEEE. Trans. on Wireless Comm., pp. 1-11, vol. 12, 2013.
1509.04075.extracted_bib
{he3 X. He and A. Yener, ``Strong secrecy and reliable Byzantine detection in the presence of an untrusted relay,'' {\em IEEE Trans. on Inf. Theory, pp. 177-92, vol. 59, 2013.
1509.04075.extracted_bib
{richter2 J. Richter, C. Scheunert, S. Engelmann, and E.A. Jorswieck, ``Weal secrecy in the multiway untrusted relay channel with compute-and-forward,''{\em IEEE Trans. on Inform. Foren. and Sec., pp. 1262-73, vol. 10, 2015.
1509.04075.extracted_bib
{vatedka S. Vatedka, N. Kashyap, and A. Thangaraj, ``Secure compute-and-forward in a bidirectional relay,'' available on \url{http://arxiv.org/pdf/1206.3392v3.pdf, 2014.
1509.04075.extracted_bib
{jingge J. Zhu and M.~Gastpar, ``Asymmetric compute-and-forward with CSIT,'' {\em International Zurich Seminar on Comm., Zurich, Switzerland, Feb. 2014.
1509.04075.extracted_bib
{erez U.~Erez and R.~Zamir, ``Achieving 1/2 log (1 + SNR) on the AWGN channel with lattice encoding and decoding," {\em IEEE Trans. Inf. Theory, pp. 2293-2314, vol. 50, 2004.
1509.04075.extracted_bib
{vatedka2 S. Vatedka and N. Kashyap, ``Nested lattice codes for secure bidirectional relaying with asymmetric channel gains,'' {\em Proc. Inf. Theory Workshop, Jerusalem, Israel, Apr., 2015.
1509.04075.extracted_bib
{nazer2 B.~Nazer and M.~Gastpar, ``Reliable physical layer network coding{\em Proc. IEEE, pp. 438-60, vol. 99, 2011.
1509.04075.extracted_bib
{csiszar I. Csisz\'{ar and J. K\"{orner, ``Broadcast channels with confidential messages,'' {\em IEEE Trans. Inf. Theory, pp. 339-48, vol. 24, 1978.
1509.04075.extracted_bib
{richter J.~Richter, C.~Scheunert, S.~Engelmann and E.~A.~Jorswieck, ``Weak secrecy in the multi-way relay channel with compute-and-forward,'' {\em European School of Information Theory, Tallinn, Estonia, Apr. 2014.
1509.04075.extracted_bib
{jingge2 %J.~Zhu and M.~Gastpar, ``Multiple access via compute-and-forward,'' available on http:\textbackslash \textbackslash arxiv.org\textbackslash pdf\textbackslash1407.8463v1.pdf, 2014. J.~Zhu and M.~Gastpar, ``Multiple access via compute-and-forward,'' available on \url{http://arxiv.org/pdf/1407.8463v1.pdf, 2014. %
1509.04075.extracted_bib
{ren %Z.~Ren, J.~Goseling, J.~H.~Weber and M.~Gastpar, ``Secure transmission using an untrusted relay with scaled compute-and-forward,'' {\em Proc. Inf. Theory Workshop, Jerusalem, Israel, Apr., 2015. %
1509.04075.extracted_bib
{xiang3 %X.~He and A.~Yener, `` Providing secrecy with structured codes: tools and applications to Gaussian two user channels," submitted to {\em IEEE Trans. Inf. Theory, Available: \url{http://arxiv.org/abs/0907.5388. %
1509.04075.extracted_bib
{jafar %S.~A.~Jafar, ``Capacity with causal and non-causal side information: a unified view," {\em IEEE Trans. Inf. Theory, pp. 5468-75, vol. 52, 2006.