We formulate notions of opacity for cyberphysical systems modeled as discrete-time linear time-invariant systems. A set of secret states is @math -ISO with respect to a set of nonsecret states if, starting from these sets at time @math , the outputs at time @math are indistinguishable to an adversarial observer. Necessary and sufficient conditions to ensure that a secret specification is @math -ISO are established in terms of sets of reachable states. We also show how to adapt techniques for computing under-approximations and over-approximations of the set of reachable states of dynamical systems in order to soundly approximate k-ISO. Further, we provide a condition for output controllability, if @math -ISO holds, and show that the converse holds under an additional assumption. We extend the theory of opacity for single-adversary systems to the case of multiple adversaries and develop several notions of decentralized opacity. We study the following scenarios: i) the presence or lack of a centralized coordinator, and ii) the presence or absence of collusion among adversaries. In the case of colluding adversaries, we derive a condition for nonopacity that depends on the structure of the directed graph representing the communication between adversaries. Finally, we relax the condition that the outputs be indistinguishable and define a notion of @math -opacity, and also provide an extension to the case of nonlinear systems.
Enforcement of opacity using techniques from supervisory control was studied in @cite_3 @cite_15 . The authors of @cite_14 formulated an alternate method of opacity enforcement using insertion functions, which are entities that modify the output behavior of the system in order to keep a secret. The model-checking and verification of notions of opacity at run time in online setups was presented in @cite_37 . A scheme for the verification of opacity in DESs using two-way observers was proposed in @cite_22 . This enabled a unified framework to verify multiple notions of opacity. There is a large body of literature focused on developing techniques to compute overapproximations and underapproximations of sets of reachable states. These will usually depend on how the initial set of states is specified, including support functions @cite_23 , zonotopes @cite_11 , and ellipsoids @cite_12 . A method to compute overapproximations of reachable sets of states for linear systems with uncertain, time-varying parameters and inputs was presented in @cite_31 . The reader is referred to @cite_16 for a succinct presentation of some of the techniques used in computing reachable sets.
@cite_37 @cite_14 @cite_31 @cite_22 @cite_3 @cite_23 @cite_15 @cite_16 @cite_12 @cite_11
2904010205 2040603575 2601738991 2500452216
With the proliferation of communication networks and mobile devices, the privacy and security concerns on their information flow are raised. Given a critical system that may leak confidential information, the problem consists of verifying and also enforcing opacity by designing supervisors, to conceal confidential information from unauthorized persons. To find out what the intruder sees, it is required to construct an observer of the system. In this paper, we consider incremental observer generation of modular systems, for verification and enforcement of current state opacity. The synchronization of the subsystems generate a large state space. Moreover, the observer generation with exponential complexity adds even larger state space. To tackle the complexity problem, we prove that observer generation can be done locally before synchronizing the subsystems. The incremental local observer generation along with an abstraction method lead to a significant state space reduction compared to traditional monolithic methods. The existence of shared unobservable events is also considered in the incremental approach. Moreover, we present an illustrative example, where the results of verification and enforcement of current state opacity are shown on a modular multiple floor elevator building with an intruder. Furthermore, we extend the current state opacity, current state anonymity, and language based opacity formulations for verification of modular systems. Abstract Opacity is a confidentiality property that characterizes whether a “secret” of a system can be inferred by an outside observer called an “intruder”. In this paper, we consider the problem of enforcing opacity in systems modeled as partially-observed finite-state automata. We propose a novel enforcement mechanism based on the use of insertion functions. An insertion function is a monitoring interface at the output of the system that changes the system’s output behavior by inserting additional observable events. We define the property of “i-enforceability” that an insertion function needs to satisfy in order to enforce opacity. I-enforceability captures an insertion function’s ability to respond to every system’s observed behavior and to output only modified behaviors that look like existing non-secret behaviors. Given an insertion function, we provide an algorithm that verifies whether it is i-enforcing. More generally, given an opacity notion, we determine whether it is i-enforceable or not by constructing a structure called the “All Insertion Structure” (AIS). The AIS enumerates all i-enforcing insertion functions in a compact state transition structure. If a given opacity notion has been verified to be i-enforceable, we show how to use the AIS to synthesize an i-enforcing insertion function. Abstract In the context of security analysis for information flow properties, where a potentially malicious observer (intruder) tracks the observed behavior of a given system, infinite-step opacity (respectively, K -step opacity) holds if the intruder can never determine for sure that the system was in a secret state for any instant within infinite steps (respectively, K steps) prior to that particular instant. We present new algorithms for the verification of the properties of infinite-step opacity and K -step opacity for partially-observed discrete event systems modeled as finite-state automata. Our new algorithms are based on a novel separation principle for state estimates that characterizes the information dependence in opacity verification problems, and they have lower computational complexity than previously-proposed ones in the literature. Specifically, we propose a new information structure, called the two-way observer, that is used for the verification of infinite-step and K -step opacity. Based on the two-way observer, a new upper bound for the delay in K -step opacity is derived, which also improves previously-known results. We present a framework for opacity in cyberphysical systems modeled as discrete time linear time invariant systems. A set of secret states is k-ISO with respect to a set of nonsecret states if, starting from these sets at time 0, the outputs at time k are indistinguishable to a passive adversarial observer. Necessary and sufficient conditions for k-ISO are given in terms of reachable sets of the system. Properties of k-ISO under unions and intersections are verified. It is seen that while unions of opaque sets preserve opacity, this is not necessarily true for intersections. We show that under certain conditions, k-ISO is equivalent to output controllability. Finally, we present an algorithm to compute a k-ISO set of states, given candidate secret and nonsecret sets of initial states.