Optimal Synthesis of Opacity-Enforcing Supervisors for Qualitative and Quantitative Specifications

Abstract

In this paper, we investigate both qualitative and quantitative synthesis of optimal privacy-enforcing supervisors for partially-observed discrete-event systems. We consider a dynamic system whose information-flow is partially available to an intruder, which is modeled as a passive observer. We assume that the system has a "secret" that does not want to be revealed to the intruder. Our goal is to synthesize a supervisor that controls the system in a least-restrictive manner such that the closed-loop system meets the privacy requirement. For the qualitative case, we adopt the notion of infinite-step opacity as the privacy specification by requiring that the intruder can never determine for sure that the system is/was at a secret state for any specific instant. If the qualitative synthesis problem is not solvable or the synthesized solution is too restrictive, then we further investigate the quantitative synthesis problem so that the secret is revealed (if unavoidable) as late as possible. Effective algorithms are provided to solve both the qualitative and quantitative synthesis problems. Specifically, by building suitable information structures that involve information delays, we show that the optimal qualitative synthesis problem can be solved as a safety-game. The optimal quantitative synthesis problem can also be solved as an optimal total-cost control problem over an augmented information structure. Our work provides a complete solution to the standard infinite-step opacity control problem, which has not been solved without assumption on the relationship between controllable events and observable events. Furthermore, we generalize the opacity enforcement problem to the numerical setting by introducing the secret-revelation-time as a new quantitative measure.

Verification of Approximate Initial-State Opacity for Control Systems via Neural Augmented Barrier Certificates

“…In [8], approximate opacity was introduced and verified by approximate opacity preserving the simulation relation. In [24,25], the authors synthesized a supervisor such that the closed-loop system was opaque.…”

“…However, there may exist nonlinear terms in transition function f involved in the condition in Equation (25). To handle the nonlinearity, a piecewise linear approximation method is utilized.…”

“…If ρEvol ≥ 0 while the maximum relative error ξ Evol < 1, then the globally optimum ρ * Evol ≥ 0, and the condition in Equation ( 25) is verified to be satisfied. Otherwise, we randomly sample a set of points in a neighborhood of the optimal solution xEvol and add those data points that violate the condition in Equation (25) to the training dataset D 3 in the next iteration to refine the networks.…”

“…We find the current optimal solutions ρInit , ρUnsa f e , ρEvol and the corresponding inputs xInit , xUnsa f e , xEvol respectively. If the current optimal solutions ρInit , ρUnsa f e , ρEvol have the expected signs, and ξInit , ξUnsa f e , ξEvol < 1, then the candidates B, p, and q are globally consistent with the constraints in the conditions in Equations ( 23)- (25). Then, we return success and B, p, and q (Line 14).…”

Current-state opacity verification in discrete event systems using an observer net

“…It should be noted that when a system is evaluated to be non-opaque, opacity enforcement becomes crucial. In this context, opacity enforcement has been considered either by restricting the system behavior using supervisory control 18,19 or by changing the information flow using insertion function 20,21 .This paper aims to verify the property of current-state-based opacity (CSO) for DESs that can be described by bounded PNs. It is assumed that an intruder completely knows the system structure, but can partially observe the occurrence of some events only.…”