Supervisor Obfuscation Against Actuator Enablement Attack

Abstract

In this paper, we propose and address the problem of supervisor obfuscation against actuator enablement attack, in a common setting where the actuator attacker can eavesdrop the control commands issued by the supervisor. We propose a method to obfuscate an (insecure) supervisor to make it resilient against actuator enablement attack in such a way that the behavior of the original closed-loop system is preserved. An additional feature of the obfuscated supervisor, if it exists, is that it has exactly the minimum number of states among the set of all the resilient and behavior-preserving supervisors. Our approach involves a simple combination of two basic ideas: 1) a formulation of the problem of computing behavior-preserving supervisors as the problem of computing separating finite state automata under controllability and observability constraints, which can be efficiently tackled by using modern SAT solvers, and 2) the use of a recently proposed technique for the verification of attackability in our setting, with a normality assumption imposed on both the actuator attackers and supervisors.

Towards Bounded Synthesis of Resilient Supervisors

“…In this subsection, we recall two problems, i.e., the supervisor obfuscation problem [12] and a formulation of the resilient supervisor synthesis problem [11]. C , if it exists, such that 1) L(G 1 ) ⊆ L(S G) ⊆ L(G 2 ) and 2) there is no successful attacker on (G, S) w.r.t.…”

“…Based on Constraints (12), (13) and (14), Constraints (15) are used to ensure L(G 1 ) ⊆ L(S G). Let φ S T le f t denote the resultant formula after combining Constraints (11), (12), (13), (14) and (15).…”

“…The safety of cyber-physical systems (CPS) against adversarial attacks has recently drawn much research interest from both the discrete-event systems and formal methods community [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12]. For a recent survey and position paper on the discrete-event systems based approach, the reader is referred to [13].…”

“…• We provide a generalized formulation of actuator attack. Compared with [11], [12], we allow general control constraints on the supervisors and general attack constraints on the attackers. • We model each actuator attacker as a Moore automaton and propose a new composition operator to construct the attacked closed-loop system, for any given plant, supervisor and actuator attacker.…”

Towards resilient supervisors against sensor deception attacks

“…Exceptions to that are the works in [16], [13]. It is also relevant to mention the work in actuation deception attacks in [8], [18], even though a different deception attack class is investigated in these works.…”