Opacity is an important information-flow security property in the analysis of cyber-physical systems. It captures the plausible deniability of the system's secret behavior in the presence of an intruder that may access the information flow. Existing works on opacity only consider non-metric systems by assuming that the intruder can always distinguish two different outputs precisely. In this paper, we extend the concept of opacity to systems whose output sets are equipped with metrics. Such systems are widely used in the modeling of many real-world systems whose measurements are physical signals. A new concept called approximate opacity is proposed in order to quantitatively evaluate the security guarantee level with respect to the measurement precision of the intruder. Then we propose a new simulation-type relation, called approximate opacity preserving simulation relation, which characterizes how close two systems are in terms of the satisfaction of approximate opacity. This allows us to verify approximate opacity for large-scale, or even infinite systems, using their abstractions. We also discuss how to construct approximate opacity preserving symbolic models for a class of discrete-time control systems. Our results extend the definitions and analysis techniques for opacity from non-metric systems to metric systems.
We present a framework for opacity in cyberphysical systems modeled as discrete time linear time invariant systems. A set of secret states is k-ISO with respect to a set of nonsecret states if, starting from these sets at time 0, the outputs at time k are indistinguishable to a passive adversarial observer. Necessary and sufficient conditions for k-ISO are given in terms of reachable sets of the system. Properties of k-ISO under unions and intersections are verified. It is seen that while unions of opaque sets preserve opacity, this is not necessarily true for intersections. We show that under certain conditions, k-ISO is equivalent to output controllability. Finally, we present an algorithm to compute a k-ISO set of states, given candidate secret and nonsecret sets of initial states. We formulate several notions of decentralized opacity for cyberphysical systems in the presence of multiple adversarial observers. Broadly speaking, we study the following cases: i) the presence or lack of a centralized coordinator, and ii) the presence or absence of collusion among the adversaries. In the case of colluding adversaries, we derive a condition for non-opacity that depends on the structure of the directed graph representing the communication between adversaries. Finally, we define a notion of opacity where the condition that the outputs be indistinguishable is relaxed. A switched system consists of a finite number of subsystems and a rule that orchestrates switching among them. We develop notions of opacity for discrete-time switched linear systems. We distinguish between cases when the secret is specified as a set of initial modes, a set of initial states, or a combination of the two. The novelty of our schemes is in the fact that we place restrictions on: i) the allowed transitions between modes (specified by a directed graph), ii) the number of allowed changes of modes (specified by lengths of paths in the directed graph), and iii) the dwell times in each mode. Each notion of opacity is characterized in terms of allowed switching sequences and sets of reachable states and or modes. Finally, we present algorithmic procedures to verify these notions, and provide bounds on their computational complexity.