Privacy-Preserving Supervisory Control of Discrete-Event Systems via Co-Synthesis of Edit Function and Supervisor for Opacity Enforcement and Requirement Satisfaction

Abstract

This paper investigates the problem of co-synthesis of edit function and supervisor for opacity enforcement in the supervisory control of discrete-event systems (DES), assuming the presence of an external (passive) intruder, where the following goals need to be achieved: 1) the external intruder should never infer the system secret, i.e., the system is opaque, and never be sure about the existence of the edit function, i.e., the edit function remains covert; 2) the controlled plant behaviors should satisfy some safety and nonblockingness requirements, in the presence of the edit function. We focus on the class of edit functions that satisfy the following properties: 1) the observation capability of the edit function in general can be different from those of the supervisor and the intruder; 2) the edit function can implement insertion, deletion, and replacement operations; 3) the edit function performs bounded edit operations, i.e., the length of each string output of the edit function is upper bounded by a given constant. We propose an approach to solve this cosynthesis problem by modeling it as a distributed supervisor synthesis problem in the Ramadge-Wonham supervisory control framework. By taking the special structure of this distributed supervisor synthesis problem into consideration and to improve the possibility of finding a non-empty distributed supervisor, we propose two novel synthesis heuristics that incrementally synthesize the supervisor and the edit function. The effectiveness of our approach is illustrated on an example in the enforcement of the location privacy.

Privacy-Preserving Co-synthesis Against Sensor-Actuator Eavesdropping Intruder

“…Then, the edit constraints EC is modeled as a finite state automaton, shown in Fig. 3, similar to the construction in [39].…”

“…To the best of our knowledge, the only work that has studied this closed-loop privacy-preserving control problem is the recent work [39], where an edit function is used. In [39], the intruder is assumed to observe some sensor events, and an edit function and a supervisor are co-synthesized to enforce the opacity, the covertness 1 and the requirement satisfaction.…”

“…To the best of our knowledge, the only work that has studied this closed-loop privacy-preserving control problem is the recent work [39], where an edit function is used. In [39], the intruder is assumed to observe some sensor events, and an edit function and a supervisor are co-synthesized to enforce the opacity, the covertness 1 and the requirement satisfaction. Nevertheless, there exist some limitations in the setup of [39]: 1) the intruder can only observe sensor information but cannot eavesdrop control commands issued by the supervisor; 2) only an edit function is deployed to confuse the intruder to ensure the opacity, which might not work in some scenarios where the capability of the edit function is not powerful enough.…”

“…In [39], the intruder is assumed to observe some sensor events, and an edit function and a supervisor are co-synthesized to enforce the opacity, the covertness 1 and the requirement satisfaction. Nevertheless, there exist some limitations in the setup of [39]: 1) the intruder can only observe sensor information but cannot eavesdrop control commands issued by the supervisor; 2) only an edit function is deployed to confuse the intruder to ensure the opacity, which might not work in some scenarios where the capability of the edit function is not powerful enough. In this work, by employing a dynamic mask together with an edit function and a supervisor against the more powerful sensoractuator eavesdropping intruder for opacity enforcement and requirement satisfaction, we solve a new and more challenging privacy-preserving supervisory control problem, The challenges are as follows: 1) The reinforcement of the intruder's observation capability not only increases the difficulty for the dynamic mask and the edit function to enforce the opacity and remain covert, but also reduces the feasible solution space for the supervisor since the eavesdropped control commands could help the intruder on state estimation and identify the events that should not have been fired based on the prior knowledge of plant G. 2) The dynamic mask and the edit function should cooperate with each other to make up for each other's insufficient capability on observing and altering sensing information to enforce the opacity.…”