Enforcing Opacity of Regular Predicates on Modal Transition Systems

Abstract

Given a labelled transition system G partially observed by an attacker, and a regular predicate Sec over the runs of G, enforcing opacity of the secret Sec in G means computing a supervisory controller K such that an attacker who observes a run of the controlled system K/G cannot ascertain that the trace of this run belongs to Sec based on the knowledge of G and K. We lift the problem from a single labelled transition system G to the class of all labelled transition systems specified by a Modal Transition System M . The lifted problem is to compute the maximally permissive controller K such that Sec is opaque in K/G for every labelled transition system G which is a model of M . The situations of the attacker and of the controller are asymmetric: at run time, the attacker may fully know G and K whereas the controller knows only M and the sequence of actions executed so far by the unknown G. We address the problem in two cases. Let Σ a denote the set of actions that can be observed by the attacker, and let Σ c and Σ o denote the sets of actions that can be controlled and observed by the controller, respectively. We provide optimal and regular controllers that enforce the opacity of regular secrets when Σ c ⊆ Σ o ⊆ Σ a = Σ. We provide optimal and regular controllers that enforce the opacity of regular upper-closed secrets (Sec = Sec.Σ * ) under the following assumptions: (i) Σ a ⊆ Σ c ⊆ Σ o = Σ or (ii) Σ a , Σ c ⊆ Σ o = Σ and wσ ∈ Sec ⇒ w ∈ Sec for all σ ∈ Σ \ Σ c .

A Uniform Approach for Synthesizing Property-Enforcing Supervisors for Partially-Observed Discrete-Event Systems

“…Therefore, Equation (28) is equivalent to Equation (27), which implies that |R G (s, L)| > 1 ⇔ |R G T (s, L)| > 1.…”

“…This problem is also referred to as the active diagnosis problem. Several approaches have also been proposed in the literature for enforcing opacity of a given system that is not opaque at the outset; see, e.g., [16]- [19], [27], [28]. In this context, the control problem is to synthesize a partial-observation supervisor that prevents behaviors that reveal the secret from occurring in the controlled system.…”

Opacity of Discrete Event Systems: models, validation and quantification

“…a given secret language, there exists no controllable and observable sublanguage which can assure weak opacity. In Darondeau et al (2014), the authors lift the opacity enforcing control problem using SCT from a single finite transition systems to families of finite transition systems specified by modal transition systems (Larsen (1990)). The objective is to ensure opacity of a secret predicate on all models of a LTS derived from a given modal transition system.…”

Parameter and Insertion Function Co-synthesis for Opacity Enhancement in Parametric Stochastic Discrete Event Systems

“…On the other hand, there is also much progress in opacity enforcement -synthesizing functions that modify observed system behavior such that the opacity can be enforced or maximized. Supervisory control theory [13] was adopted in opacity-enforcing in [14], [15], [16], [17] where the supervisor dynamically disables certain system behaviors that would reveal the secret. Dynamic observer approach was proposed in [18] where the observability of every system event was dynamically changed.…”