secure state-estimation and control of cyber-physical...

Secure State-estimation and Controlof Cyber-Physical Systems

Paulo Tabuada

Cyber-Physical Systems LaboratoryDepartment of Electrical Engineering

University of California at Los Angeles

Paulo Tabuada (CyPhyLab - UCLA) Securing CPS SoSCYPS 04/11/2016 1 / 31

Secure State-estimation and Controlof Cyber-Physical Systems

Yasser Shoukry

Cyber-Physical Systems LaboratoryDepartment of Electrical Engineering

University of California at Los Angeles

Cyber-physical systems’ security in the news

Why security for cyber-physical systems?

Cyber-physical systems are physical processes (chemical plants, power grids,aircraft, etc.) whose functionality requires a tight integration with cybercomponents (computation and communication hardware/software).

Cyber-physical systems are becoming increasingly larger, distributed, and opento the cyber-world (e.g., internet): increased vulnerability to attacks.

Attacks launched in the cyber domain can have physical consequences.

How to detect, identify, and operate in the presence of attacks?

The setup

Physical process modeled as a linear dynamical system:

x(t + 1) = Ax(t) + Bu(t), x(t) ∈ Rn, u(t) ∈ Rm, t ∈ N0.

A total of p sensors monitor state of plant (y(t) ∈ Rp):

y(t) = Cx(t)

+ e(t).︸︷︷︸attackvector

Some sensors are attacked:

ei (t) 6= 0 −→ sensor i is attacked at time t ;

If sensor i is attacked, ei (t) can be arbitrary (no boundedness assumption,no stochastic model, etc.);

Set of attacked sensors (unknown) is denoted by K ⊂ {1, . . . , p}:

supp(e) = {i ∈ {1, . . . , p} | ei 6= 0} = K .

Number of attacked sensors will be denoted by q: q = |K |;

The setup

y(t) = Cx(t)

+ e(t).︸︷︷︸attackvector

supp(e) = {i ∈ {1, . . . , p} | ei 6= 0} = K .

The setup

y(t) = Cx(t) + e(t).︸︷︷︸attackvector

supp(e) = {i ∈ {1, . . . , p} | ei 6= 0} = K .

The setup

ei (t) 6= 0 −→ sensor i is attacked at time t ;If sensor i is attacked, ei (t) can be arbitrary (no boundedness assumption,no stochastic model, etc.);

supp(e) = {i ∈ {1, . . . , p} | ei 6= 0} = K .

The setup

supp(e) = {i ∈ {1, . . . , p} | ei 6= 0} = K .

The setup

supp(e) = {i ∈ {1, . . . , p} | ei 6= 0} = K .

The setup

x(t + 1) = Ax(t) + Bu(t)

y(t) = Cx(t) + e(t)︸︷︷︸attackvector

The objective is to design a controller:

u(t) = φ(t , y(0), . . . , y(t))

rendering the closed-loop system exponentially stable

, notwithstanding anyadversarial attack to q sensors, i.e., for all e(t) ∈ Rp with support K , |K | = q.

The setup

x(t + 1) = Ax(t) + Bu(t)

The objective is to design a controller:

u(t) = φ(t , y(0), . . . , y(t))

rendering the closed-loop system exponentially stable, notwithstanding anyadversarial attack to q sensors, i.e., for all e(t) ∈ Rp with support K , |K | = q.

The setup

x(t + 1) = Ax(t) + Bu(t)

We can see this as a game between the controller and the attacker:

The matrices A, B, and C are known to the controller but x(0) is not. Theattacker is omniscient;The controller chooses an action u(t) ∈ Rm at time t ∈ N0 based on all itspast observations y(0), y(1), . . . , y(t);The attacker chooses K before the game starts and during the game itchooses e(t) ∈ Rp with support in K at time t ∈ N0;The controller seeks to stabilize the plant while the attacker seeks toprevent stabilization.

The setup

x(t + 1) = Ax(t) + Bu(t)

The matrices A, B, and C are known to the controller but x(0) is not. Theattacker is omniscient;

The controller chooses an action u(t) ∈ Rm at time t ∈ N0 based on all itspast observations y(0), y(1), . . . , y(t);The attacker chooses K before the game starts and during the game itchooses e(t) ∈ Rp with support in K at time t ∈ N0;The controller seeks to stabilize the plant while the attacker seeks toprevent stabilization.

The setup

x(t + 1) = Ax(t) + Bu(t)

The matrices A, B, and C are known to the controller but x(0) is not. Theattacker is omniscient;The controller chooses an action u(t) ∈ Rm at time t ∈ N0 based on all itspast observations y(0), y(1), . . . , y(t);

The attacker chooses K before the game starts and during the game itchooses e(t) ∈ Rp with support in K at time t ∈ N0;The controller seeks to stabilize the plant while the attacker seeks toprevent stabilization.

The setup

x(t + 1) = Ax(t) + Bu(t)

The matrices A, B, and C are known to the controller but x(0) is not. Theattacker is omniscient;The controller chooses an action u(t) ∈ Rm at time t ∈ N0 based on all itspast observations y(0), y(1), . . . , y(t);The attacker chooses K before the game starts and during the game itchooses e(t) ∈ Rp with support in K at time t ∈ N0;

The controller seeks to stabilize the plant while the attacker seeks toprevent stabilization.

The setup

x(t + 1) = Ax(t) + Bu(t)

The matrices A, B, and C are known to the controller but x(0) is not. Theattacker is omniscient;The controller chooses an action u(t) ∈ Rm at time t ∈ N0 based on all itspast observations y(0), y(1), . . . , y(t);The attacker chooses K before the game starts and during the game itchooses e(t) ∈ Rp with support in K at time t ∈ N0;The controller seeks to stabilize the plant while the attacker seeks toprevent stabilization.

Questioning the setup

Are physical systems really linear?

No! Our first results used ideas from compressed sensing and errorcorrection over the reals, hence linearity. The current understanding allowsfor nonlinear systems, conceptually.

Why is the set K of attacked sensors fixed throughout the game?

Compromising a sensor takes time. While the attacker is working tocompromise one additional sensor we can treat K as fixed.

Is the attacker attacking the sensors or the communication between the sensorsand the controller?

Our results are independent of where and how the attack is conducted.

Can you not protect the sensors or the communication using cyber-securitytechniques?

Attacking sensors

Noninvasive spoofing attacks for Anti-Lock Braking systemsY. Shoukry, P. Martin, P. Tabuada, and M. Srivastava.Workshop on Cryptographic Hardware and Embedded Systems, 2013 (CHES 2013).

Attacking sensors

A separation result

The attacks are arbitrary, in particular they can be nonlinear and time-varying.

Do we need to design a nonlinear and time-varying controller to be resilient toattacks?

Theorem

Consider the linear control system:

x(t + 1) = Ax(t) + Bu(t)

y(t) = Cx(t) + e(t).

If there exists a controller u(t) = φ(t , y(0), . . . , y(t)) rendering the closed-loop systemexponentially stablea despite an adversarial attack to q sensors then there exists adecoder D : Rn×p → Rn that correctly reconstructs the state in n steps:

x(t − n + 1) = D(y(t − n + 1), . . . , y(t)).

afor a rate of decay smaller than the smallest eigenvalue of A.

A separation result

The attacks are arbitrary, in particular they can be nonlinear and time-varying.

Do we need to design a nonlinear and time-varying controller to be resilient toattacks?

Theorem

x(t + 1) = Ax(t) + Bu(t)

y(t) = Cx(t) + e(t).

x(t − n + 1) = D(y(t − n + 1), . . . , y(t)).

A separation result

Theorem

x(t + 1) = Ax(t) + Bu(t)

y(t) = Cx(t) + e(t).

x(t − n + 1) = D(y(t − n + 1), . . . , y(t)).

We can solve our initial problem in two steps:

1 design the decoder (observer) D;

2 design a linear static controller.

Error correction

x(t + 1) = Ax(t) + Bu(t)

y(t) = Cx(t) + e(t)

We assume the input to be known since we design the controller. For simplicitywe will take u(t) = 0 for all t ∈ N0;

A decoder (observer) D processes observations y(0), . . . , y(T − 1) andproduces an estimate of the initial state x(0).

We say that a decoder D : (Rp)T → Rn corrects q errors after T steps if it isresilient against any attack of q sensors, i.e., if for any initial condition x(0) ∈ Rn,and for any attack vectors e(0), . . . , e(T − 1) with support K , |K | = q, we have: