We formulate notions of opacity for cyberphysical systems modeled as discrete-time linear time-invariant systems. A set of secret states is @math -ISO with respect to a set of nonsecret states if, starting from these sets at time @math , the outputs at time @math are indistinguishable to an adversarial observer. Necessary and sufficient conditions to ensure that a secret specification is @math -ISO are established in terms of sets of reachable states. We also show how to adapt techniques for computing under-approximations and over-approximations of the set of reachable states of dynamical systems in order to soundly approximate k-ISO. Further, we provide a condition for output controllability, if @math -ISO holds, and show that the converse holds under an additional assumption. We extend the theory of opacity for single-adversary systems to the case of multiple adversaries and develop several notions of decentralized opacity. We study the following scenarios: i) the presence or lack of a centralized coordinator, and ii) the presence or absence of collusion among adversaries. In the case of colluding adversaries, we derive a condition for nonopacity that depends on the structure of the directed graph representing the communication between adversaries. Finally, we relax the condition that the outputs be indistinguishable and define a notion of @math -opacity, and also provide an extension to the case of nonlinear systems.
Opacity was compared with detectability and diagnosability of DESs, and other privacy properties like secrecy and anonymity in @cite_28 . A subsequent paper @cite_0 defined opacity for DESs in a decentralized framework with multiple adversaries, each carrying out its own observation of the system. The authors of @cite_26 characterized language-based notions of opacity under unions and intersections. They demonstrated the existence of supremal and minimal opaque sublanguages and superlanguages.
@cite_28 @cite_26 @cite_0
2588012692 2144982432 2904010205 2500452216
We formulate several notions of decentralized opacity for cyberphysical systems in the presence of multiple adversarial observers. Broadly speaking, we study the following cases: i) the presence or lack of a centralized coordinator, and ii) the presence or absence of collusion among the adversaries. In the case of colluding adversaries, we derive a condition for non-opacity that depends on the structure of the directed graph representing the communication between adversaries. Finally, we define a notion of opacity where the condition that the outputs be indistinguishable is relaxed. Opacity describes the inability for an external observer to know what happened in a system. Recently, opacity has been investigated in the framework of discrete event systems. In our previous paper, we define two types of opacities: strong opacity and weak opacity. Given a general observation mapping, a language is strongly opaque if all strings in the language are confused with some strings in another language and it is weakly opaque if some strings in the language are confused with some strings in another language. In this paper, we investigate properties of opacities. We show that opacities are closed under union, but may not be closed under intersection. Based on these properties, we discuss how to modify languages to satisfy the strong opacity, weak opacity, and no opacity by investigating the sublanguages and superlanguages that are strongly opaque, weakly opaque, and not opaque respectively. We find the largest sublanguages and smallest superlanguages. Examples are given to illustrate results. With the proliferation of communication networks and mobile devices, the privacy and security concerns on their information flow are raised. Given a critical system that may leak confidential information, the problem consists of verifying and also enforcing opacity by designing supervisors, to conceal confidential information from unauthorized persons. To find out what the intruder sees, it is required to construct an observer of the system. In this paper, we consider incremental observer generation of modular systems, for verification and enforcement of current state opacity. The synchronization of the subsystems generate a large state space. Moreover, the observer generation with exponential complexity adds even larger state space. To tackle the complexity problem, we prove that observer generation can be done locally before synchronizing the subsystems. The incremental local observer generation along with an abstraction method lead to a significant state space reduction compared to traditional monolithic methods. The existence of shared unobservable events is also considered in the incremental approach. Moreover, we present an illustrative example, where the results of verification and enforcement of current state opacity are shown on a modular multiple floor elevator building with an intruder. Furthermore, we extend the current state opacity, current state anonymity, and language based opacity formulations for verification of modular systems. We present a framework for opacity in cyberphysical systems modeled as discrete time linear time invariant systems. A set of secret states is k-ISO with respect to a set of nonsecret states if, starting from these sets at time 0, the outputs at time k are indistinguishable to a passive adversarial observer. Necessary and sufficient conditions for k-ISO are given in terms of reachable sets of the system. Properties of k-ISO under unions and intersections are verified. It is seen that while unions of opaque sets preserve opacity, this is not necessarily true for intersections. We show that under certain conditions, k-ISO is equivalent to output controllability. Finally, we present an algorithm to compute a k-ISO set of states, given candidate secret and nonsecret sets of initial states.