Secure Communication in the Low-SNR Regime: A Characterization of the Energy-Secrecy Tradeoff

Secure Communication in the Lo w-SNR Re gime: A Characte rizati on of the Ener gy-Secrec y T radeof f Mustafa Cenk Gursoy Departmen t of E lectrical En gineerin g University of Neb raska-Linco ln, Lincoln, NE 68588 Email: g ursoy@engr .un l.edu Abstract — 1 Secrecy capacity of a multipl e-antenna wi retap chan- nel is studied in the low signal-to-noise ratio ( SNR ) regime. Expres- sions fo r the fi rst and second deriva tiv es of t he secrecy capacity with r espect to S NR at SNR = 0 are d eriv ed. T ra nsmission strategies required to achiev e these deriva tiv es are identified. In particular , it is s hown that it is o ptimal in the low- SNR regime to transmit in the maximum-eigenv alue eigenspace of Φ = H † m H m − N m N e H † e H e where H m and H e denote the channel matrices associated with the legitimate recei ver and ea vesdropper , respectiv ely , and N m and N e are the noise v ariances at the r eceiver and ea vesdropper , r espectiv ely . Energy effi ciency is analyzed by findin g the minimum bit energy required for secur e and reliable communi cations, and the wideband slope. Increased bit energy requirements u nder secrecy constraints are quantified. Finally , the impact of fadin g is inv estigated. I . I N T R O D U C T I O N Secure tran smission of con fidential messages is a cr itical issue in commun ication systems an d especia lly in wir eless systems due to th e b roadcast nature of wir eless transmissions. In [1], W yner addressed the tran smission security fro m an info rmation - theoretic point o f vie w , and identified the rate-equ iv ocation region and established th e secrecy capacity of th e discrete me moryless wiretap ch annel in which the wiretapper receives a degraded version of the signal observed b y the legitimate receiver . The secrecy capacity is defin ed as the maximum communication rate from the transmitter to the legitimate receiver , which ca n be achieved while keepin g the ea vesdropper completely ignorant of the transmitted messages. Later, these results are extende d to Gaussian wiretap ch annel in [2]. In [3], Csisz ´ ar and K ¨ orner con- sidered a mor e general wiretap channel model and established the secrecy capacity when the tr ansmitter has a comm on message for two receivers and a confiden tial message to only on e. Recently , there h as b een a flurry of acti v ity in the area of info rmation- theoretic secur ity , where, f or instance, the imp act of fading, cooper ation, and interferenc e on secrecy are studied (see e.g., [4] and the articles and refere nces therein) . Several recent results also a ddressed the secrecy cap acity when m ultiple-an tennas are employed by the tr ansmitter, receiver , and the eavedropper [5]– [9]. The secre cy cap acity for the mo st gener al c ase in which arbitrary n umber o f antennas ar e presen t at each terminal has been established in [8 ] an d [9]. In additio n to security issues, another piv o tal concern in m ost wireless systems is en ergy-efficient opera tion especially when wireless u nits are powered by batteries. Fr om an info rmation- theoretic perspective, e nergy efficiency can be measured by the energy r equired to send on e informatio n bit reliably . It is we ll- known that for unfaded and fadin g Gau ssian c hannels subject 1 This wo rk w as supported in part by the NSF CAREE R Grant CCF-0546384. to av erage inp ut p ower constraints, energy efficiency imp roves as o ne o perates a t lower SNR lev els, and the minimu m bit energy is achiev ed as SNR vanishes [11]. Hence, requireme nts on energy efficiency necessitate o peration in the low- SNR regime. Additionally , operating at low SNR levels has its ben efits in terms of lim iting th e interferen ce in wireless system s. In th is paper , in order to address the two critical issues of security and energy-efficiency jointly , we study the secre cy capacity in the lo w- SNR regime. W e consider a g eneral multiple- input and mu ltiple-outp ut (MIMO) ch annel model and identify the op timal tran smission strategies in this r egime under secr ecy constraints. Since secrecy capacity is in genera l smaller th an the capacity a ttained in the absen ce of confiden tiality concern s, energy p er bit requirements in crease due to secrecy con straints. In this work, we q uantify these incr eased energy costs an d a ddress the en ergy-secrecy tradeoff. I I . C H A N N E L M O D E L W e co nsider a MIMO channel model and assume that the transmitter, legitimate receiv e r , and eavesdropper are equipped with n T , n R , a nd n E antennas, resp ectiv ely . W e furth er assume that the chann el input-o utput relations b etween th e tran smitter and legitimate receiver , and th e transmitter and ea vesdro pper ar e giv en by y m = H m x + n m and y e = H e x + n e , (1) respectively . Above, x denotes th e n T × 1 –dimen sional tran smit- ted signa l vector . T his chan nel input is subje ct to the f ollowing av erage power co nstraint: E {k x k 2 } = tr ( K x ) ≤ P (2) where tr denotes th e tr ace operation and K x = E { xx † } is the covariance matrix of the input. In (1), n R × 1 –dimensional y m and n E × 1 –dimensional y e represent the receiv ed signa l vectors at the legitimate r eceiv er and eavesdropper, resp ectiv ely . Moreover , n m with dimension n R × 1 and n e with dimension n E × 1 ar e independe nt, zero-mean Gaussian random vectors with E { n m n † m } = N m I and E { n e n † e } = N e I , where I is the identity matrix. Th e signal-to-n oise ratio is d efined as SNR = E {k x k 2 } E {k n m k 2 } = P n R N m . (3) Finally , in the chann el models, H m is the n R × n T –dimension al channel m atrix between the tran smitter an d legitimate receiver , and H e is the n E × n T –dimension al chan nel m atrix between the tra nsmitter and eavesdropper . While being fixed d eterministic matrices in unfaded cha nnels, H m and H e in fading channels are ra ndom m atrices wh ose co mponen ts denote the fading coef- ficients between the corresp onding an tennas at the transmitting and receiving ends. I I I . S E C R E C Y I N T H E L O W - S N R R E G I M E Recently , in [8] and [9], it ha s be en shown that when the channel matrices H m and H e are fixed for th e entire transmission period and are known to all three termin als, th en the secrecy capacity in n ats p er d imension is giv en by 2 C s = 1 n R max K x  0 tr ( K x ) ≤ P log det  I + 1 N m H m K x H † m  − log det  I + 1 N e H e K x H † e  (4) where th e maxim ization is over all p ossible inpu t c ovariance matrices K x  0 3 subject to a trac e con straint. W e note that since log de t  I + 1 / N m H m K x H † m  is a concave f unction of K x , the objective function in (4) is in general neither concave nor conv ex in K x , making the iden tification the o ptimal inpu t covariance matrix a difficult task. In this paper, we con centrate on the low- SNR regime. In this regime, th e be havior of the secrecy capacity can be accu rately predicted by its first and seco nd der iv atives with respect to SNR at SNR = 0 : C s ( SNR ) = ˙ C s (0) SNR + ¨ C s (0) 2 SNR 2 + o ( SNR 2 ) . (5) Moreover , ˙ C s (0) and ¨ C s (0) als o enable us to an alyze the energy efficiency in the low- SNR regime th rough [1 1] E b N 0 s, min = log 2 ˙ C s (0) and S 0 = 2 h ˙ C s (0) i 2 − ¨ C s (0) (6) where E b N 0 s, min denotes th e m inimum bit energy req uired for reliable communicatio n un der secrecy con straints, and S 0 denotes the wideband slope which is the slope of the secrecy ca pacity in bits/dimension/( 3 d B) at the poin t E b N 0 s, min . Th ese qua ntities pro - vide a linear approxim ation of the secr ecy cap acity in the lo w- SNR regime. While E b N 0 s, min is a perfo rmance mea sure for vanishing SNR , S 0 together with E b N 0 s, min characterize the perf ormance at low but nonzero SNR s. W e note that the formu la for the minimum bit energy is v alid if C s is a concave f unction of SNR , which we show later in the p aper . The following result id entifies the fir st an d second der iv atives of th e secrecy capacity at SNR = 0 . Theor em 1: Th e first derivati ve of the secr ecy capacity in (4 ) with respect to SNR a t SN R = 0 is ˙ C s (0) = [ λ max ( Φ )] + =  λ max ( Φ ) if λ max ( Φ ) > 0 0 else (7) where Φ = H † m H m − N m N e H † e H e . Moreover, the secon d de riv a- 2 Unless s tated otherwise, a ll logarit hms t hroughout the paper are to the base e . 3  and ≻ den ote positi ve semidefin ite and posit i ve definit e partial orderings, respect i vel y , for Hermitian matrices. If A  B , then A − B is a positiv e semidefinit e mat rix. Similarly , A ≻ B implies that A − B i s positi ve de finite. ti ve of the secrecy ca pacity at SNR = 0 is given by ¨ C s (0) = − n R min { α i } α i ∈ [0 , 1] ∀ i P l i =1 α i =1 l X i,j =1 α i α j  | u † j H † m H m u i | 2 − N 2 m N 2 e | u † j H † e H e u i | 2  1 { λ max ( Φ > 0) } (8) where l is th e multip licity of λ max ( Φ ) > 0 , { u i } are th e eigenv ectors that span the m aximum- eigenv alue e igenspace, and 1 { λ max ( Φ ) > 0 } =  1 if λ max ( Φ ) > 0 0 else is the indicator function . Pr oof : W e fir st note th at the input covariance m atrix K x = E { xx † } is by definition a positive semide finite Hermitian matrix. As a Hermitian m atrix, K x can be written as [13, Theor em 4.1.5] K x = UΛU † (9) where U is a unitar y ma trix an d Λ is a real diag onal matr ix. Using ( 9), we can also expr ess K x as K x = n T X i =1 d i u i u † i (10) where { d i } are the diagonal componen ts o f Λ , and { u i } are the column vectors of U and form a n ortho normal set. Assuming that the inp ut uses all th e available power , we have tr ( K x ) = P n T i =1 d i = P . Noting th at K x is p ositiv e semidefinite an d hence d i ≥ 0 , we can write d i = α i P wh ere α i ∈ [0 , 1] ∀ i and P n T i =1 α i = 1 . Now , the secrecy rate achieved with a p articular covariance matrix K x can b e expressed as I s ( SNR ) = 1 n R log det I + n R SNR n T X i =1 α i H m u i u † i H † m ! − log det I + n R N m N e SNR n T X i =1 α i H e u i u † i H † e ! ! . (11) where SNR is defined in (3). As also noted in [ 11], we can easily show that d dv log det( I + v A ) | v =0 = tr ( A ) , (12) d 2 dv 2 log det( I + v A ) | v =0 = − tr ( A 2 ) . (13) Now , using (12), we o btain the f ollowing expr ession fo r the first deriv a ti ve o f the secrecy rate I s with resp ect to SNR at SNR = 0 : ˙ I s (0) = n T X i =1 α i  tr ( H m u i u † i H † m ) − N m N e tr ( H e u i u † i H † e )  (14) = n T X i =1 α i  u † i H † m H m u i − N m N e u † i H † e H e u i  (15) = n T X i =1 α i u † i  H † m H m − N m N e H † e H e  u i = n T X i =1 α i u † i Φu i (16) where (15) follows fro m the p roperty tha t tr ( AB ) = tr ( BA ) . Also, in (16), we ha ve d efined Φ = H † m H m − N m N e H † e H e . Since Φ is a Hermitian matr ix and { u i } are unit v ectors, we have [13 , 2 Theorem 4.2.2] u † i Φu i ≤ λ max ( Φ ) ∀ i (17) where λ max ( Φ ) de notes th e maxim um eigenv alue o f the matrix Φ . Recall that α i ∈ [0 , 1] and P i α i = 1 . Then, f rom (17), we obtain ˙ I s (0) = n T X i =1 α i u † i Φu i ≤ λ max ( Φ ) . (18) Note that this upper bou nd can be ach iev ed if, for instance, α 1 = 1 and α i = 0 ∀ i 6 = 1 , a nd u 1 is ch osen as the eigenv ector that cor respond s to the max imum e igenv alue of Φ . Heretofor e, we h av e im plicitly assumed that λ max ( Φ ) > 0 an d all the av ailable power is u sed to transmit the info rmation in the d irection of the maximu m eigenv alue. If λ max ( Φ ) ≤ 0 , then all eigenv alues of Φ are less than or eq ual to zero , and h ence Φ is a negati ve semidefinite matrix . In this situation, none of the chan nels of the legitimate recei ver is stron ger than tho se correspo nding ones o f the e av esdroppe r . In such a case, secr ecy capacity is zero. Theref ore, if λ max ( Φ ) ≤ 0 , we have ˙ C s (0) = 0 . Finally , we conclude fro m (18) and the above discussion that the first deriv ativ e of the secre cy capacity with respect to SNR at SNR = 0 is giv en by ˙ C s (0) = [ λ max ( Φ )] + =  λ max ( Φ ) if λ max ( Φ ) > 0 0 else . (19) If λ max ( Φ ) > 0 is distinct, ˙ C s (0) is achieved when we cho ose K x = P u 1 u † 1 where u 1 is the eig en vector that correspond s to λ max ( Φ ) . Therefo re, b eamform ing in the direc tion in wh ich the eigenv alue of Φ is maxim ized is optimal in th e sense o f achieving the first deriv ative of the secrecy capacity in the low- SNR regime. More generally , if λ max ( Φ ) > 0 has a m ultiplicity , any covariance ma trix in the following fo rm achieves the first deriv a ti ve: K x = P l X i =1 α i u i u † i (20) where l is the multiplicity of the max imum eigenv alu e, { u i } l i =1 are th e eigenv ectors that span the m aximum- eigenv alue eigenspace, an d { α i } l i =1 are con stants, taking values in [0 , 1] and ha vin g the sum P l i =1 α i = 1 . Therefore, transmission in the maximum -eigenv alu e eigen space is necessary to achieve ˙ C s (0) . Next, we con sider the s econd deri vati ve of the secrecy capac ity . Again, when λ max ( Φ ) ≤ 0 , th e secrecy c apacity is zero and therefor e ¨ C s (0) = 0 . He nce, in th e following, we consider the case in wh ich λ max ( Φ ) > 0 . Sup pose that the input cov ariance matrix is chosen as in (20) with a particular set of { α i } . Th en, using (13), we ca n o btain ¨ I s (0) = − n R tr   l X i =1 α i H m u i u † i H † m ! 2   + n R N 2 m N 2 e tr   l X i =1 α i H e u i u † i H † e ! 2   (21) = − n R X i,j α i α j  | u † j H † m H m u i | 2 − N 2 m N 2 e | u † j H † e H e u i | 2  (22) where (22) is obtained by using the fact that tr ( AB ) = tr ( BA ) and perfor ming some straigh tforward manipu lations. Note again that { u i } are the eigenv ectors spanning the maxim um-eigenvalue eigenspace of Φ . Being necessary to achieve th e first deriv ative, the covariance structure given in (20) is also ne cessary to ach iev e the second deriv ati ve. Therefore , th e second derivati ve of the secrecy ca pacity at SNR = 0 is the max imum of the expression in (2 2) over all po ssible values of { α i } . Hen ce, ¨ C s (0) = − n R min { α i } α i ∈ [0 , 1] ∀ i P l i =1 α i =1 X i,j α i α j  | u † j H † m H m u i | 2 − N 2 m N 2 e | u † j H † e H e u i | 2  (23) Since ¨ C s (0) is equal to the e x pression in (23) wh en λ max ( Φ ) > 0 and is zero other wise, the final expression in (8) is o btained by multiplying the formu la in (23) with the indicato r func tion 1 { λ max ( Φ ) > 0 } .  Remark 1 : In the ab sence of secr ecy constraints, the first a nd second de riv atives of the MIMO capacity at SNR = 0 are [11] ˙ C (0) = λ max ( H † m H m ) an d ¨ C (0) = − n R l λ 2 max ( H † m H m ) (2 4) where l is the mu ltiplicity of λ max ( H † m H m ) . Hence, the first and second derivati ves are ach ieved by tr ansmitting in the maximum- eigenv alue eigenspa ce of H † m H m , th e su bspace in wh ich the transmitter-receiv er channel is the strongest. Due to the optimality of the water-filling power a llocation meth od, power sho uld be equally d istributed in ea ch o rthogo nal direction in this subspace in or der for the seco nd d eriv ative to be achieved. Remark 2 : W e see fro m Theo rem 1 th at when there are se- crecy constrain ts, we sho uld at low SN R s tran smit in th e direction in which th e transmitter-receiver chann el is strongest with respect to the transmitter -eavesdr op per channel n ormalized by the ratio of the noise variances. For instance, ˙ C s (0) can be achieved by beamfor ming in th e dir ection in wh ich th e eigenv alue of Φ is maximized. On the other h and, if λ max ( Φ ) has a mu ltiplicity , the o ptimization pro blem in (8) should be solved to id entify h ow the po wer should be allocated to different orthogonal directio ns in the maximum-eige n value eigen space s o that the seco nd-der iv ative ¨ C s (0) is attained. In g eneral, the optimal power allocation strategy is neither water-filling nor beamfo rming . For in stance, consider parallel Gaussian ch annels for bo th transmitter-receiv e r and tran smitter-ea vesdro pper links, an d assume that H † m H m = diag (5 , 4 , 2) and H † e H e = diag (2 , 1 , 1) whe re diag( ) is used to denote a diag onal matrix with compon ents provided in between the parenth eses. Assume further that the noise variances are equal, i.e., N m = N e . Then, it can be easily seen that λ max ( Φ ) = 3 and has a multiplicity o f 2 . Solving the optimization prob lem in (8) p rovides α 1 = 5 / 12 and α 2 = 7 / 12 . Hen ce, ap proxim ately , 42% of the p ower is allocated to the ch annel for which the transmitter-receiv er link h as a strength of 5 , an d 5 8% is allocated for the ch annel with stren gth 4 . Remark 3 : When λ max ( Φ ) > 0 is distinct, then beamfo rming in the direction in which λ ( Φ ) is m aximized is o ptimal in the sense of achieving b oth ˙ C s (0) and ¨ C s (0) . Moreover, in this case, 3 we have ¨ C s (0) = − n R  k H m u 1 k 4 − N 2 m N 2 e k H e u 1 k 4  (25) where u 1 is the e igenv ector that correspo nds to λ max ( Φ ) . Remark 4 : From [13, Theor em 4.3.1 ], we know that for two Hermitian matrices A an d B with the same dimen sions, we have λ max ( A + B ) ≤ λ max ( A ) + λ max ( B ) . (26) Applying this result to o ur setting yield s λ max ( Φ ) ≤ λ max ( H † m H m ) − λ min  N m N e H † e H e  . (27) Therefo re, we conclud e fr om Remark 1 that secrecy constrain ts diminish the first d eriv ative ˙ C s (0) at least b y a factor of λ min  N m N e H † e H e  when compared to the case in which there are n o such constraints. Remark 5 : In the c ase in wh ich each term inal has a single antenna, the results of Theorem 1 specialize to ˙ C s (0) =  | h m | 2 − N m N e | h e | 2  + (28) ¨ C s (0) = −  | h m | 4 − N 2 m N 2 e | h e | 4  + . (29) In the n ext result, we show that the secrecy capacity is concave in SNR . Pr oposition 1: The secrecy capacity C s achieved und er the av erage po wer constraint E { k x k 2 } ≤ P is a concav e function o f SNR . Pr oof: Concavity ca n be easily shown u sing the time-sharin g argument. Assume that at p ower level P 1 and signal-to-no ise ratio SNR 1 , the optimal inpu t is x 1 , whic h satisfies E {k x 1 k 2 } ≤ P 1 , and the secrecy ca pacity is C s ( SNR 1 ) . Similarly , for P 2 and SNR 2 , the optimal inpu t is x 2 , whic h satisfies E {k x 2 k 2 } ≤ P 2 , and the secrecy capacity is C s ( SNR 2 ) . Now , we assum e that the transmitter pe rforms time-shar ing by transmitting at two different power levels using x 1 and x 2 . More specifically , in θ fraction of the time, the tra nsmitter uses the input x 1 , transmits at m ost at P 1 , and achieves the secrecy rate C s ( SNR 1 ) . In the remaining (1 − θ ) frac tion o f th e time, the transmitter employs x 2 , transmits at most a t P 2 , and ach ieves the secrecy ra te C s ( SNR 2 ) . Henc e, this scheme overall ach iev es the av erage secrecy rate of θC s ( SNR 1 ) + (1 − θ ) C s ( SNR 2 ) (30) by transmitting at the le vel θ E {k x 1 k 2 } + (1 − θ ) E {k x 2 k 2 } ≤ P θ = θ P 1 +(1 − θ ) P 2 . The a verag e signal-to-noise ratio is SNR θ = θ S NR 1 + (1 − θ ) SNR 2 . Th erefore , th e secre cy rate in (3 0) is an achiev ab le secrecy rate at SNR θ . Since the secrecy cap acity is th e maximum a chiev ab le secrecy r ate, the secrecy capacity at SNR θ is larger than that in (30), i.e., C s ( SNR θ ) = C s ( θ SNR 1 + (1 − θ ) SNR 2 ) (31) ≥ θ C s ( SNR 1 ) + (1 − θ ) C s ( SNR 2 ) , (32) showing the concavity .  W e further note that the co ncavity can a lso be shown using the fo llowing facts. As also discussed in [10], M IMO secrecy capacity is o btained by provin g in th e converse argum ent th at the co nsidered u pper b ound is tigh t and C s = max p ( x ) min p ( y ′ r , y ′ e | x ) ∈D I ( x ; y ′ r | y ′ e ) (33) where D is th e set of join t cond itional density fu nctions p ( y ′ r , y ′ e | x ) that satisfy p ( y ′ r | x ) = p ( y r | x ) and p ( y ′ e | x ) = p ( y e | x ) . Note that for fixed channel distributions, the m utual in- formation I ( x ; y ′ r | y ′ e ) is a concave function of the inpu t distribu- tion p ( x ) . Since the poin twise infimu m of a set of conca ve f unc- tions is co ncave [14], f ( p ( x )) = min p ( y ′ r , y ′ e | x ) ∈D I ( x ; y ′ r | y ′ e ) is also a concave func tion o f p ( x ) . Concavity of the fun ctional f and the fact that maxim ization is over input distributions satisfying E {k x k 2 } ≤ P lead to the c oncavity of the secrecy capacity with re spect to SNR . W e can n ow write th e following corollar y to Proposition 1 and Theorem 1. Cor ollary 1: The minim um bit energy attained un der secrecy constraints is E b N 0 s, min = log 2 [ λ max ( Φ )] + . (34) Remark 6 : From Remark 4, we ca n write E b N 0 s, min = log 2 [ λ max ( Φ )] + ≥ log 2 λ max ( H † m H m ) − λ min  N m N e H † e H e  ≥ log 2 λ max ( H † m H m ) = E b N 0 min (35) where E b N 0 min in (35) de notes the min imum bit energy in the absence of secrecy con straints. Hence, in general, secr ecy re- quiremen ts increase the en ergy expen diture. When secur e com- munication is n ot p ossible, [ λ max ( Φ )] + = 0 and E b N 0 s, min = ∞ . The expression for the wideban d slope S 0 can be readily obtained by pluggin g in the expr essions in (7) and ( 8) into that in (6 ). Remark 7 : Energy costs of secrecy can easily be identified in the single- antenna case. Clearly , the minimum b it energy in th e presence of secrecy is strictly greater than that in the absence of such co nstraints: E b N 0 s, min = log 2 h | h m | 2 − N m N e | h e | 2 i + > log 2 | h m | 2 = E b N 0 min (36) when N m N e | h e | 2 > 0 . Furthermo re, the energy requiremen t in - creases mo noton ically as th e value of N m N e | h e | 2 increases. Ind eed, when N m N e | h e | 2 = | h m | 2 , secure commu nication is not possible and E b N 0 s, min = ∞ . I V . T H E I M PAC T O F F A D I N G In th is section, we assume that the chann el matric es H m and H e are rand om matrices whose co mpon ents are ergodic random variables, mod eling fading in wireless tra nsmissions. W e again assume that realization s of the se m atrices are perf ectly known by all the ter minals. As discu ssed in [12], fading ch annel can be regard ed as a set of p arallel subchanne ls each of which correspo nds to a particular fading realization. Hen ce, in each subchann el, the chann el matrices are fixed similarly as in the channel model con sidered in the previous section. In [ 12], Liang et al. hav e shown that ha v ing independ ent inp uts for each subchann el is optimal and the secrecy capa city of the set of 4 parallel subchan nels is equal to the sum of the capacities of subchann els. Th erefore, the secrecy c apacity of fading chan nels can be be found by averaging the secrecy capacities attained for different fading realizatio ns. W e assume that the tran smitter is sub ject to a sho rt-term power constraint. Hence, for each channel realiza tion, the same amount of power is used and we have tr ( K x ) ≤ P . W ith this assumption, the tran smitter is allowed to perfo rm p ower ada ptation in space across the antennas, b ut not across time . Under such constraints, it ca n easily b e seen fr om the above discussion that the av e rage secrecy capac ity in fading ch annels is given by C s = 1 n R E H m , H e ( max K x  0 tr ( K x ) ≤ P log det  I + 1 N m H m K x H † m  − log det  I + 1 N e H e K x H † e  ) (37) where the expectation is with respe ct to the jo int distribution of ( H m , H e ) . Note that the o nly difference b etween (4) an d (37) is the pr esence of expec tation in (37). Due to this similarity , the following result c an be obtained imm ediately as a corollary to Theorem 1. Cor ollary 2: The first deri vativ e of the average secr ecy c apac- ity in (3 7) with resp ect to SNR at SNR = 0 is ˙ C s (0) = E H m , H e { [ λ max ( Φ )] + } (38 ) where aga in Φ = H † m H m − N m N e H † e H e . The second d eriv ative of th e av erage secrecy capacity at SNR = 0 is given by ¨ C s (0) = − n R E H m , H e ( min { α i } α i ∈ [0 , 1] ∀ i P l i =1 α i =1 l X i,j =1 α i α j  | u † j H † m H m u i | 2 − N 2 m N 2 e | u † j H † e H e u i | 2  1 { λ max ( Φ ) > 0 } ) (39) where 1 {·} again deno tes the indicator functio n, l is th e multi- plicity of λ max ( Φ ) > 0 , and { u i } are the eigenv ectors tha t span the m aximum- eigenv alue eigenspace for particu lar realization s of H m and H e . Remark 8 : Similarly as in th e un faded case, ˙ C s (0) is achieved by always transmittin g in the maximum -eigenv alu e eigen space of the re alizations o f th e chan nel matrice s H m and H e . In ord er to achiev e the seco nd deriv ative, o ptimal v alu es of { α i } (or equiv a lently th e op timal power allocation a cross the antennas) should be identified ag ain for each possible realization of the channel m atrices. Remark 9 : In the single-an tenna case in wh ich n T = n R = n E = 1 , the first and second derivati ves of the average secrecy capacity become ˙ C s (0) = E h m ,h e (  | h m | 2 − N m N e | h e | 2  + ) (40) ¨ C s (0) = E h m ,h e (  | h m | 4 − N m N e | h e | 4  + ) . (41) Cor ollary 3: The minimu m bit energy achie ved in fading channels un der secrecy constraints is E b N 0 s, min = log 2 E H m , H e { [ λ max ( Φ )] + } . (42) Remark 1 0: Fading has a poten tial to im prove the low- SNR perfor mance and h ence the energy efficiency . T o illustrate this, we con sider th e fo llowing examp le. Con sider first th e un faded Gaussian channel in which the deterministic ch annel coef ficien ts are h m = h e = 1 . For this case, we have ˙ C s (0) =  1 − N m N e  + and E b N 0 s, min = log 2 h 1 − N m N e i + . (43) Now , consider a Rayleig h fadin g environmen t an d assume that h m and h e are indep endent, z ero-mean , Gau ssian r andom vari- ables with variances E {| h m | 2 } = E {| h e | 2 } = 1 . Then , we ca n easily find th at ˙ C s (0) = E h m ,h e (  | h m | 2 − N m N e | h e | 2  + ) = N e N m + N e (44) leading to E b N 0 s, min = log 2 N e N m + N e . Note that if N e > 0 , N e N m + N e > h 1 − N m N e i + . Hence, fading strictly improves the low- SNR per- forman ce by incr easing ˙ C s (0) and d ecreasing the minimu m bit energy even without perfo rming power contr ol over time. Further gains are possible with p ower adap tation. Anoth er inter esting observation is the fo llowing. In unfaded chan nels, if N m ≥ N e , the minimum bit energy is infinite and secure communicatio n is n ot possible. On the other hand, in fading c hannels, the bit energy is finite as lon g as N m is finite an d N e > 0 . Clear ly , ev en if N m ≥ N e , fav or able fading condition s en able secure transmission in fading chan nels. R E F E R E N C E S [1] A. D. W yner , “The wire-tap channel, ” Bel l Syst. T ech. J . , vol. 54, pp. 1355- 1367, Oct. 1975 [2] S. K. Leung-Y an-C heong and M. E. Hellman , “The Gaussian wire-tap channe l, ” IEEE Tr ans. Inform. Theory , vol. 24, pp. 451-456, Jul. 1978. [3] I. Csisz ´ ar an d J. K ¨ orner , “B roadca st cha nnels with confidentia l messages, ” IEEE T rans. Inform. Theory , vol. 3, pp. 339-348, May 1978. [4] Special issue on information-t heoreti c security , IEEE T rans. Inform. The ory , vol. 54, no. 6, June 2008. [5] A. O. Hero, “Secure s pace-t ime communication, ” IEEE T rans. Inform. Theory , vol. 49, pp. 3235-3249, Dec. 2003. [6] Z. Li, W . Tra ppe, and R. D. Y ates, “Se cret communication via mult i-ante nna transmission, ” 41st Confe rence on Information Science s and Systems (CISS), Balti more, March 2007 . [7] S. Shafiee, N. Liu, and S. Ulu kus, “T o wards the secrec y capacit y of the Gaussian MIMO wire-tap channel: The 2-2-1 Channel, ” submitted for publica tion. Also av ailable at htt p://a rxi v . org/a bs/0709.3541 . [8] A. Khisti a nd G. W . W ornell, “The MIMOME channel, ” Proc. of the 45th Annual Allerton Conferenc e on Communicat ion, Control, and Computing, October 2007. Also av ailable a t http:// arxi v .org/abs/0710.1325 . [9] F . Oggier and B. Hassibi, “The secrecy capaci ty of the MIMO W iretap channe l, ” a vail able a t http:// arxi v .org/abs/0710.1920 . [10] T . Liu and S. Shamai (Shitz), “ A note on the secrecy capacity of the multi-an tenna wiretap channe l, ” submitted for publicatio n. Also av ailab le at http:/ /arxi v .org/abs/071 0.4105 . [11] S . V erd ´ u, “Spectral ef ficienc y in the wideband regime, ” IEEE T rans. Inform. Theory , vol. 48, pp. 1319-1343, June 2002. [12] Y . Liang, H. V . Poor , and S. Shamai (Shitz),“Secure communication ov er fadi ng channe ls, ” IEEE T rans. Inform. Theory , vol . 54, pp. 2470 - 2492, June 2008. [13] R. A. Horn and C. R. Johnson, Matrix Analysis , Cambridge Univ ersity Press, 1999. [14] S . Boyd and L. V andenber ghe, Con vex Optimization , Cambridge Univ ersity Press, 2004. 5