Opacity is an important information-flow security property in the analysis of cyber-physical systems. It captures the plausible deniability of the system's secret behavior in the presence of an intruder that may access the information flow. Existing works on opacity only consider non-metric systems by assuming that the intruder can always distinguish two different outputs precisely. In this paper, we extend the concept of opacity to systems whose output sets are equipped with metrics. Such systems are widely used in the modeling of many real-world systems whose measurements are physical signals. A new concept called approximate opacity is proposed in order to quantitatively evaluate the security guarantee level with respect to the measurement precision of the intruder. Then we propose a new simulation-type relation, called approximate opacity preserving simulation relation, which characterizes how close two systems are in terms of the satisfaction of approximate opacity. This allows us to verify approximate opacity for large-scale, or even infinite systems, using their abstractions. We also discuss how to construct approximate opacity preserving symbolic models for a class of discrete-time control systems. Our results extend the definitions and analysis techniques for opacity from non-metric systems to metric systems.
Abstraction-based techniques have also been investigated in the literature for the verification and synthesis of opacity; see, e.g., @cite_43 @cite_38 @cite_14 @cite_19 @cite_0 . In particular, in our recent work @cite_43 , we propose several notions of opacity preserving (bi)simulation relations. However, these relations only preserve exact opacity for non-metric systems. Our new relations extend the relations in @cite_43 to metric systems by taking into account how close two systems are. Such an extension is motivated by the definition of approximate (bi)simulation relation originally proposed in @cite_30 . However, the original definition of approximate (bi)simulation relation does not necessarily preserves approximate opacity. Constructing symbolic models for control systems is also an active research area; see, e.g., @cite_28 @cite_39 @cite_36 @cite_16 . However, most of the existing works on the construction of symbolic models only consider the dynamics of the systems and are not taking into account the opacity property. In our approach, we need to consider both the dynamic and the secret of the system while constructing the symbolic model and guarantee the preservation of approximate opacity across related systems.
@cite_30 @cite_38 @cite_14 @cite_28 @cite_36 @cite_39 @cite_0 @cite_19 @cite_43 @cite_16
2787221116 2601738991 2500452216 2904010205
In this paper, we propose several opacity-preserving (bi)simulation relations for general nondeterministic transition systems (NTS) in terms of initial-state opacity, current-state opacity, K-step opacity, and infinite-step opacity. We also show how one can leverage quotient construction to compute such relations. In addition, we use a two-way observer method to verify opacity of nondeterministic finite transition systems (NFTSs). As a result, although the verification of opacity for infinite NTSs is generally undecidable, if one can find such an opacity-preserving relation from an infinite NTS to an NFTS, the (lack of) opacity of the NTS can be easily verified over the NFTS which is decidable. Abstract In the context of security analysis for information flow properties, where a potentially malicious observer (intruder) tracks the observed behavior of a given system, infinite-step opacity (respectively, K -step opacity) holds if the intruder can never determine for sure that the system was in a secret state for any instant within infinite steps (respectively, K steps) prior to that particular instant. We present new algorithms for the verification of the properties of infinite-step opacity and K -step opacity for partially-observed discrete event systems modeled as finite-state automata. Our new algorithms are based on a novel separation principle for state estimates that characterizes the information dependence in opacity verification problems, and they have lower computational complexity than previously-proposed ones in the literature. Specifically, we propose a new information structure, called the two-way observer, that is used for the verification of infinite-step and K -step opacity. Based on the two-way observer, a new upper bound for the delay in K -step opacity is derived, which also improves previously-known results. We present a framework for opacity in cyberphysical systems modeled as discrete time linear time invariant systems. A set of secret states is k-ISO with respect to a set of nonsecret states if, starting from these sets at time 0, the outputs at time k are indistinguishable to a passive adversarial observer. Necessary and sufficient conditions for k-ISO are given in terms of reachable sets of the system. Properties of k-ISO under unions and intersections are verified. It is seen that while unions of opaque sets preserve opacity, this is not necessarily true for intersections. We show that under certain conditions, k-ISO is equivalent to output controllability. Finally, we present an algorithm to compute a k-ISO set of states, given candidate secret and nonsecret sets of initial states. With the proliferation of communication networks and mobile devices, the privacy and security concerns on their information flow are raised. Given a critical system that may leak confidential information, the problem consists of verifying and also enforcing opacity by designing supervisors, to conceal confidential information from unauthorized persons. To find out what the intruder sees, it is required to construct an observer of the system. In this paper, we consider incremental observer generation of modular systems, for verification and enforcement of current state opacity. The synchronization of the subsystems generate a large state space. Moreover, the observer generation with exponential complexity adds even larger state space. To tackle the complexity problem, we prove that observer generation can be done locally before synchronizing the subsystems. The incremental local observer generation along with an abstraction method lead to a significant state space reduction compared to traditional monolithic methods. The existence of shared unobservable events is also considered in the incremental approach. Moreover, we present an illustrative example, where the results of verification and enforcement of current state opacity are shown on a modular multiple floor elevator building with an intruder. Furthermore, we extend the current state opacity, current state anonymity, and language based opacity formulations for verification of modular systems.