Stability‐guaranteed dynamic ElGamal cryptosystem for encrypted control systems

IET Control Theory & ApplicationsVolume 14, Issue 16 p. 2242-2252 Research ArticleOpen Access Stability-guaranteed dynamic ElGamal cryptosystem for encrypted control systems Kaoru Teranishi, Corresponding Author Kaoru Teranishi teranishi@uec.ac.jp Department of Mechanical and Intelligent Systems Engineering, The University of Electro-Communications, 1-5-1 Chofugaoka, Chofu, Tokyo, 182-8585 JapanSearch for more papers by this authorNaoki Shimada, Naoki Shimada Department of Electronics and Information Engineering, National Institute of Technology, Ishikawa College, Kitacyujo, Tsubata, Ishikawa, 929-0392 JapanSearch for more papers by this authorKiminao Kogiso, Kiminao Kogiso Department of Mechanical and Intelligent Systems Engineering, The University of Electro-Communications, 1-5-1 Chofugaoka, Chofu, Tokyo, 182-8585 JapanSearch for more papers by this author Kaoru Teranishi, Corresponding Author Kaoru Teranishi teranishi@uec.ac.jp Department of Mechanical and Intelligent Systems Engineering, The University of Electro-Communications, 1-5-1 Chofugaoka, Chofu, Tokyo, 182-8585 JapanSearch for more papers by this authorNaoki Shimada, Naoki Shimada Department of Electronics and Information Engineering, National Institute of Technology, Ishikawa College, Kitacyujo, Tsubata, Ishikawa, 929-0392 JapanSearch for more papers by this authorKiminao Kogiso, Kiminao Kogiso Department of Mechanical and Intelligent Systems Engineering, The University of Electro-Communications, 1-5-1 Chofugaoka, Chofu, Tokyo, 182-8585 JapanSearch for more papers by this author First published: 17 September 2020 https://doi.org/10.1049/iet-cta.2019.0729Citations: 2AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Despite the importance of cyber-security for networked control systems, no suitable cryptosystem exists for networked control systems that guarantees stability and has low computational complexity. This study proposes a novel dynamic ElGamal cryptosystem for encrypted control systems. The proposed cryptosystem is a multiplicative homomorphic cryptosystem, and it updates key pairs and ciphertexts by simple updating rules with modulo operations at every sampling period. Furthermore, the authors modify the proposed cryptosystem by using a dynamic encoder and decoder so that the asymptotic stability of the encrypted control systems is guaranteed. Numerical simulations demonstrate that the encrypted controller with the proposed cryptosystem achieves asymptotic stability while randomly updating key pairs and ciphertexts. The feasibility of the proposed encrypted control system is evaluated through regulation control with a positioning table testbed. The processing time of the proposed encrypted control system is on the order of milliseconds, indicating that the system achieves real-time control. 1 Introduction The cyber-security of networked control systems is crucial, and control systems require special countermeasures considering threats at both the cyber and physical layers [1]. As cyber-attacks for networked control systems, replay attacks [2], zero-dynamics attacks [3], and denial-of-service attacks [4] have been reported. Replay attacks are performed to deceive an anomaly detector or operator of control systems. Adversaries record sensor measurements of a target system under normal conditions for a certain period; then, they alter the sensor measurements to be transmitted to a controller into recorded signals. The adversaries disturb or destroy the target system during this time. In zero-dynamics attacks, adversaries design attack signals based on plant, controller, and anomaly detector dynamics [1]. By injecting the designed signals into control inputs, the adversaries stealthily destabilise a closed-loop system by zero-dynamics. Denial-of-service attacks interfere with the operation of the target system as with the attacks on information and communication systems. The impact of such attacks on control systems is more severe because the plant becomes out of control. The controller encryption method is a security-enhancement method for networked control systems [5]. In this method, controller parameters and signals over communication links (i.e. sensor measurements, references, and control inputs) are encrypted with a multiplicative homomorphic cryptosystem, such as RSA [6] or ElGamal [7]. Furthermore, control inputs are calculated without decryption. As shown in Fig. 1, public-key cryptography requires Bob to share his public key with Alice in advance before sending ciphertexts of messages. In contrast, public keys and secret keys are not necessary for the controller side in encrypted control systems. The controller encryption method reduces the risk of zero-dynamics attacks due to its prevention of eavesdropping, which aims to identify the dynamics of control systems. By using the dynamic key-switching management method [8], encrypted control systems can detect controller falsification attacks and replay attacks with control input falsification. Additionally, encrypted control systems can achieve resilience against controller/signal falsification using the control-input-switching method [9]. Fig. 1Open in figure viewerPowerPoint Comparison between public-key cryptography and encrypted control system (a) Public-key cryptography, (b) Encrypted control system However, the dynamic key-switching management method must prepare multiple key pairs in advance and continue managing them while encrypted control systems operate. Furthermore, encrypted control systems with the conventional ElGamal cryptosystem cannot achieve asymptotic stability because of quantisation errors caused by encoding signals into plaintexts. Stability is the most critical property for control systems, and asymptotic stability is a typical type of stability where arbitrary initial state converges to zero at some time in linear systems. The conventional ElGamal cryptosystem also has a risk to destabilise closed-loop systems in which the plant is an unstable system (e.g. airplane, quadcopter, and inverted pendulum). The stability is not guaranteed due to the changing properties of the original closed-loop systems by encryption. Besides, the majority of encryption security measures likely cause time delays [10]. Servo control systems for mechanical systems, such as the positioning stage used for factory automation, typically must operate within a sampling period of a few milliseconds to hundreds of microseconds. Meanwhile, it is sufficient for information on control systems to be protected for a couple of decades because the systems are replaced. Furthermore, we do not have to protect all data of signals because adversaries are interested in eavesdropping time series data for system identification or designing attack signals. Therefore, the conventional methodology of cryptography is not suitable for encrypted control systems. The controller encryption method requires a lightweight multiplicative homomorphic cryptosystem that inherits the stability of unencrypted systems. This study proposes a novel ElGamal-based dynamic multiplicative homomorphic cryptosystem and an encrypted control system with the proposed cryptosystem. The characteristics of the proposed encrypted control systems are as follows: Simple updating rules with modulo operations update key pairs and ciphertexts. Thus, adversaries cannot obtain time-series data if they do not keep cracking the code at every sampling period. Adversaries may be not able to decrypt data back towards a past time, even if they succeed in breaking a key pair at present. The proposed dynamic cryptosystem can be expected to achieve a security level equal to those of conventional methods with a smaller key because the hardness of cracking ciphertexts improves by the key pairs and ciphertexts updating. Smaller key length leads to low computational cost of operations in encryption and decryption (i.e. a lightweight cryptosystem). The encrypted control system modified to use a dynamic encoder and decoder inherits the asymptotic stability of unencrypted closed-loop systems. The proposed encrypted control system can detect replay attacks in the same way as that in [8, 9]. Furthermore, it is not necessary to prepare and manage multiple key pairs, unlike the method in [8, 9], because key pairs are updated at every sampling period. Numerical simulations of encrypted state-feedback control are employed to investigate the validity of the proposed cryptosystem. Additionally, the feasibility of the proposed cryptosystem is examined through encrypted regulation control with a positioning table testbed. Control performance and processing time are evaluated. 1.1 Related works The encrypted control method with the Paillier cryptosystem [11], additive homomorphic cryptosystem, was proposed in [12]. This method achieves practical stability [12] if the key length is sufficiently large. However, asymptotic stability cannot be guaranteed due to the effect of quantisation errors. Whereas, Kishida [13] considered an encrypted state-feedback controller with a dynamic quantiser proposed in [14] to achieve asymptotic stability of encrypted control systems. Encrypted control systems with an additive homomorphic cryptosystem are vulnerable against eavesdropping attacks on the controller because they cannot conceal controller parameters. Thus, encrypted control systems with a multiplicative homomorphic cryptosystem are more secure than those with an additive homomorphic cryptosystem. Another encrypted control method with Gentry's fully homomorphic encryption [15] was proposed in [16]. Although, in this method, the controller can calculate encrypted control input by using encrypted controller parameters and encrypted sensor measurements, it requires vast computational resources compared to encrypted controllers with a partially homomorphic cryptosystem [17]. Hence, the encrypted control method with fully homomorphic encryption is not practical for real-time computation. In the field of cryptography for information and communication, the one-time pad technique is well known. This technique has a similar methodology to the proposed method from the viewpoint that a new key is used for each communication; further, encryption schemes based on one-time pad provide perfect security as long as the schemes are correctly operated [18]. However, the conventional one-time pad schemes do not guarantee real-time computation and stability of control systems. In contrast, the proposed cryptosystem guarantees asymptotic stability of a closed-loop system with real-time updated key pairs. The proxy re-encryption scheme [19] and bidirectional ElGamal encryption scheme [20] can translate a ciphertext for Alice into another ciphertext corresponding to Bob by using a proxy key. Although these methods are similar to the proposed method, a proxy server, which is a trustworthy third party, and proxy key are necessary. Thus, in these methods, we have to manage a proxy server and an additional key to the translation of ciphertexts throughout control system operation. Furthermore, Dodis et al. [21] proposed the key-insulated encryption scheme, which updates a secret key periodically; however, the updating period is more extended than in the proposed cryptosystem (one week). 1.2 Outline The remainder of this paper is organised as follows. Section 2 introduces preliminary information of the ElGamal cryptosystem and encrypted control systems. Section 3 describes the proposed ElGamal-based dynamic multiplicative homomorphic cryptosystem. Section 4 describes an encrypted state-feedback controller with the proposed cryptosystem and a dynamic encoder and decoder. Section 5 provides numerical examples for comparison between the conventional ElGamal cryptosystem and the proposed cryptosystem. Section 6 presents several experimental results using a testbed with a regulator. Section 7 presents conclusions and discusses future works. 2 Preliminaries 2.1 Notation The sets of real numbers, rational numbers, integers, prime numbers, public keys, secret keys, plaintexts, and ciphertexts are denoted by , , , , , , , and , respectively. The set of key pairs is denoted by . We define the sets of integers , , and . The set of vectors whose sizes are n is denoted by , and the set of matrices whose sizes are is denoted by . The i th element of a vector is denoted by , and the (i,j) entry of a matrix is denoted by . The norm of v and the induced 2-norm of M are denoted by and , respectively. The minimum eigenvalue of M is denoted by . The cardinality of a set A is denoted by . Definition 1.Let A be a finite set and X be a random variable. If then we say that X follows the discrete uniform distribution and is denoted as . 2.2 ElGamal cryptosystem Definition 2.An ElGamal cryptosystem [7] is a tuple where is a key generation algorithm, is an encryption algorithm, and is a decryption algorithm is a safe prime, is a public key, is a secret key, g is a generator of a cyclic group such that , , , and . Proposition 1. holds multiplicative homomorphism where is the Hadamard product (i.e. element-wise multiplication). Proposition 2.The security level of is indistinguishability against chosen-plaintext attacks under the decisional Diffie-Hellman assumption. 2.3 Encrypted control system A plant P is given as follows: where is a state, is an input, is an output, and A, B, and C are plant parameters. A controller f is given as follows: where is a controller state, is a controller input, which consists of sensor measurements and a reference, and , , , and are controller parameters. f can be rewritten as a product of a controller parameter matrix and a signal vector The ElGamal cryptosystem allows multiplication to be the only calculation in the ciphertext. Thus, summation cannot be conducted in the ciphertext. f cannot be executed in ciphertext because a product of a matrix and a vector contains multiplication and summation. To avoid this problem, we divide f into and as follows [5]: performs only element-wise multiplication of a matrix and vector, not adding up each row. Thus, we can execute in the ciphertext. Definition 3.Let , , and be ciphertexts of , , and at time , respectively. Suppose a controller f is given as [5], and is modified to , where and are an encoder and decoder, respectively [22]. Then, is a scaling parameter, is a function, which rounds to the nearest element in , and Then, an encrypted controller is defined as follows: where and for a vector or matrix, , , , and perform element-wise operations. Remark 1.In encrypted control systems, the following homomorphism holds: Remark 2.An encoder and decoder are essential for controller encryption because control systems address real numbers, while the ElGamal cryptosystem can be applied to only a subset of integers. Note that is not equal to x, and where is the quantisation error. Quantisation errors are critical for control systems because these errors may destabilise control systems or degrade the control performance [14]. In this regard, the following result was revealed [23]. Proposition 3.Let e and k be quantisation errors caused by encryption and key length, respectively. Then, as . This proposition claims that quantisation errors can be ignored when the key length is sufficiently large, while the conventional encrypted control systems cannot achieve asymptotic stability as long as the key length is finite. After this, we denote quantisation error of x as for convenience. 3 Dynamic ElGamal cryptosystem Definition 4.Dynamic ElGamal cryptosystem at time t is a tuple where and are transition maps and . Corollary 1.The codomains of and are and , respectively. Proof.From the definition, . Therefore, and . Additionally, because is a group with respect to addition modulo q. □ Theorem 1.Let and be a public key and secret key at time t, respectively. If with a safe prime p and , then (1) Proof.We prove the proposition through mathematical induction. When Assume that . Then Therefore, (1) holds for all . □ Corollary 2.If for all , then follows a discrete uniform distribution (2) Proof. is a group with respect to addition modulo q. Define . For , if , then Thus, is bijective. Therefore, if , then . □ Theorem 2.Let be a ciphertext at time t. Suppose , , , and . Then (3) Proof.From Theorem 1, if for all , then the proposition is true □ Lemma 1. is isomorphic to . Proof.We prove that there exists an isomorphism from to . From Lagrange's theorem, . Define the map . Then, is bijective. Additionally, for , Therefore, is an isomorphism. □ Corollary 3.If for all , then follows a discrete uniform distribution (4) Proof.From Lemma 1, can be a bijection from to . Therefore, if , then . □ Corollary 4. holds multiplicative homomorphism Proof.From Theorem 1, Proposition 1 holds for all . □ Remark 3.We use the same random number to update key pairs and ciphertexts of controller parameters. Thus, in practice, we have to share securely or use an identical random number generator with the same seed. In this paper, we focus on the proposed cryptosystem's properties from the control-theoretic viewpoint under the assumption that is appropriately shared. 4 Encrypted control system with dynamic ElGamal cryptosystem This section describes the main result of this study. The proposed encrypted controller with the dynamic ElGamal cryptosystem achieves asymptotic stability. Furthermore, key pairs and ciphertexts of controller parameters are updated at every sampling period. Thus, the security level of the proposed encrypted control system may be higher than that of the conventional one. A state-feedback controller is one of the basic controllers and determines control inputs as . In this case, we can interpret that , , and . Two lemmas on a quantised state-feedback controller, which were discussed in our previous conference paper [22], should be introduced before we present the main result. The lemmas give the method of choosing a scaling parameter for the encoder/decoder to achieve asymptotic stability. Note that in encrypted control systems, a state-feedback gain is quantised as well as a plant state because the cryptosystem can handle only an element of . A closed-loop system with a quantised state-feedback gain is not necessarily stable even if an original state-feedback gain stabilises a plant. Therefore, we must choose proper encoder/decoder scaling parameters for the state-feedback gain and state, respectively. Lemma 2.Let be the maximum width of . Let be a quantised state-feedback gain. Assume that is a Schur matrix [22], and . If satisfies for a given matrix and the corresponding matrix satisfying , then is a Schur matrix. Proof.From the assumption, the closed-loop system with the quantised state-feedback gain is given as follows: and there exists for any such that Let be a Lyapunov function candidate. Then By using the notations the solution for the quadratic equation is given as follows: Therefore, is negative when satisfies the abovementioned condition because is bounded from above as follows [22]: A system matrix is a Schur matrix if the difference value of a Lyapunov function is negative for all . □ Lemma 3.Let be the maximum width of . Let and be a quantised state-feedback gain and quantised state, respectively. Assume that is a Schur matrix, and . If satisfies Lemma 2 and satisfies for a given matrix and the corresponding matrix satisfying , then the closed-loop system achieves asymptotic stability [22]. Proof.From Lemma 2, we can choose such that becomes a Schur matrix. Then, the closed-loop system with the quantised state-feedback gain and quantised state is given as follows: and there exists for any such that Let be a Lyapunov function candidate. Then By using the notations the solution for the quadratic equation is given as follows: Therefore, is negative outside the ball Furthermore, the closed-loop system is Lyapunov stable when satisfies the abovementioned condition. Define . Then, because the closed-loop system is Lyapunov stable. Therefore, and as . □ Theorem 3.Let , , and be ciphertexts of F, , and at time , respectively. Suppose a state-feedback controller f is given as such that a closed-loop system is asymptotically stable, and is modified to . Then, there exists the following encrypted state-feedback controller that achieves asymptotic stability while concealing a state-feedback gain F, plant state , and control input with dynamic key pairs : where is the maximum width of , Q, and are any positive definite matrices, P and are the corresponding matrices for Q and , respectively, and and are design parameters. Proof.An encrypted state-feedback controller with can be transformed as follows: Then, the closed-loop system with the encrypted state-feedback controller is given as follows: This closed-loop system is the same as the system discussed in Lemma 3. Therefore, the closed-loop system with the encrypted state-feedback controller achieves asymptotic stability when and satisfy Lemmas 2 and 3, respectively. □ Remark 4.In encrypted state-feedback control systems, the following homomorphism holds: Remark 5. is a finite set. Therefore, and should be chosen such that encoded values do not overflow or underflow [22]. Remark 6.In general, not all elements of are directly observable. Thus, we should use an observer [24]. Theorem 3 should be extended to consider an observer state when we use an observer unless a plant state can be approximated sufficiently to the observer state. Fig. 2 shows a flow of the proposed encrypted state-feedback control system with . Fig. 2Open in figure viewerPowerPoint Flow of encrypted state-feedback control with dynamic ElGamal cryptosystem 5 Numerical simulation Consider the following continuous-time plant: where is continuous time. This plant is discretised as follows: where the sampling period is set to be 10 ms. The following state-feedback gain is employed: We select , and then the key pair at initial time is given as follows: Furthermore, the scaling parameters are given as follows: where , , and . Fig. 3 shows the results of encrypted state-feedback control with the conventional ElGamal cryptosystem and the proposed dynamic ElGamal cryptosystem . Fig. 4 is the enlarged graph of Fig. 3. Figs. 5 and 6 show sequences of keypair and ciphertext of controller gain. Fig. 3Open in figure viewerPowerPoint Comparison of signals between an encrypted control system with the conventional cryptosystem and that with the proposed one (a) Control input, (b) First element of state, (c) Second element of state Fig. 4Open in figure viewerPowerPoint Enlarged graphs of Fig. 3 (a) Control input, (b) First element of state, (c) Second element of state Fig. 5Open in figure viewerPowerPoint Comparison of key pairs between an encrypted control system with the conventional cryptosystem and that with the proposed one (a) Public key, (b) Secret key Fig. 6Open in figure viewerPowerPoint Comparison of ciphertexts of the state-feedback gain between an encrypted control system with the conventional cryptosystem and that with the proposed one (a) First element of controller gain in ciphertext, (b) Second element of controller gain in ciphertext Figs. 4b and c demonstrate the encrypted controller with the dynamic encoder and decoder achieves asymptotic stability. Figs. 5 and 6 demonstrate that the key pair and ciphertext of controller gain in the conventional ElGamal cryptosystem each keep their initial values. In contrast, those in the proposed dynamic ElGamal cryptosystem are randomly updated at every time step. Furthermore, Fig. 7 shows histograms of the secret key and ciphertext in the proposed encrypted control system for 500 s. It can be said that the secret key and ciphertext in the proposed cryptosystem follow a discrete uniform distribution because the distributions of the histograms are almost flat. Fig. 7Open in figure viewerPowerPoint Histograms of secret key and ciphertext in the proposed cryptosystem within 0 to 500 s ( ) (a) Histogram of secret key, (b) Histogram of first element of controller gain in ciphertext 6 Experimental verification 6.1 Experimental testbed The testbed shown in Fig. 8 consists of a DC motor, a table operated by the DC motor through a belt with a pulley, a rotary encoder to measure the position of the table, and two Raspberry Pi3s that are connected via an ethernet cable. The DC motor is driven by a motor driver with its input and output as voltages. The operating system of the Raspberry Pi3s is Raspbian with Xenomai. One of the Raspberry Pi3s is for processing on the encrypted controller, and the other is for encrypting, decrypting, reading sensors, and inputting control commands to the DC motor. The Raspberry Pi3s communicate with TCP/IP. See [25] for specifications of the testbed. Fig. 8Open in figure viewerPowerPoint Experimental testbed [25] A model of the testbed is obtained by system identification as follows: where the input is a voltage to the motor driver, the output is a position of the table, and the sampling period is set to be 10 ms. 6.2 Controller design In this study, we use a regulator that is a basic controller in the field of control engineering. An observer for P is given as follows: where is an estimated state, is an estimated output, and is an observer gain. Then, a regulator is given as follows: where F is state-feedback gain. In this case, the elements of and are given as follows: For simplicity of regulator design, we use the discrete-time linear quadratic regulator problem [26] with the cost function where Q is a state weight, and R is an input weight. The state weights for the observer and controller are, respectively, set to be and the input weights are set to be Then, L and F are designed as follows: The controller parameter of the regulator is given as follows: Then, an encrypted parameter with a 33-bit key at initial time is given as follows: where the elements of are displayed as hexadecimal numbers. 6.3 Signals, controller parameters, and key pairs Figs. 9a and b demonstrate the results of regulation control, and Figs. 10a and b are the second element of ciphertexts of control input and output, respectively. Fig. 9c shows the transition of at this time. These results confirm that the encrypted controller conceals the signals over network links, and the scaling parameter is tuned with the signals. Fig. 10c demonstrates the transition of a second element of the entry of controller parameter in the ciphertext. Figs. 11a and b show the transitions of the public key and secret key, respectively. These results confirm that key pairs and ciphertexts are updated randomly. From the above, adversaries cannot obtain a time series of input/output data and controller parameters if they do not solve a discrete logarithm problem at every sampling period. Fig. 9Open in figure viewerPowerPoint Signals and scaling parameter (a) Control input, (b) Output, (c) Scaling parameter for signals Fig. 10Open in figure viewerPowerPoint Signals and controller parameter in ciphertext (a) Control input in ciphertext, (b) Output in ciphertext, (c) Controller parameter in ciphertext Fig. 11Open in figure viewerPowerPoint Key pairs (a) Public key, (b) Secret key 6.4 Static and dynamic encoder/decoder An encrypted controller with a static encoder and decoder cannot achieve asymptotic stability, while that with a dynamic one can achieve asymptotic stability. In this subsection, the effect of dynamic encoder and decoder is examined. Figs. 12a and b show the control input and output of encrypted control systems with a static or dynamic encoder/decoder in the same control of Section 6.3, respectively. Figs. 12c and d are enlarged graphs of Figs. 12a and b, respectively. These results show that a steady-state error of an encrypted control system with a dynamic encoder/decoder is small in comparison with that of static ones. Thus, it is confirmed that a dynamic encoder/decoder improves the control performance of encrypted control systems, while the output of the encrypted control system with a dynamic encoder/decoder does not perfectly converge to zero. This result may be caused by a non-linearity such as friction. Fig. 12Open in figure viewerPowerPoint Comparison between an encrypted control system with a static encoder/decoder and that with a dynamic one (a) Control input, (b) Output, (c) Enlarged graph of (a), (d) Enlarged graph of (b) 6.5 Processing time Control operation must be completed within a sampling period because behaviour and stability are not guaranteed if processing time is more than the sampling period. In this subsection, the processing time of the proposed encrypted control system is investigated. Table 1 shows the maximum, mean, and minimum processing times of the proposed encrypted control system in the experiment of Section 6.3. The results confirm that the processes of the proposed encrypted control system finished within the sampling period, and the system operates in real-time. However, the processing time of the encrypted control system is exponentially increased with key length [27]. Therefore, we conjecture that the selection of key length is a critical issue for the proposed cryptosystem as well as for conventional ones. Table 1. Processing time Max Mean Min 4.4931 ms 3.9674 ms 3.3684 ms 7 Conclusion This study proposed a novel ElGamal-based dynamic multiplicative homomorphic cryptosystem with a dynamic encoder and decoder for encrypted control systems. Key pairs and ciphertexts are updated randomly at every sampling period, and an encrypted state-feedback controller with the proposed cryptosystem achieves asymptotic stability. The feasibility of the proposed encrypted control system was examined through several experiments with the positioning table testbed. The experimental results confirmed that key pairs, controller parameters, and signals are concealed against adversaries. Furthermore, it was shown to improve the control performance of encrypted control systems by using a dynamic encoder and decoder. In this paper, we did not discuss the decision problem of proper or optimal key length. The key length should be chosen by considering the trade-off between security level and computational latency; however, the security index of encrypted control systems has not yet been established. We considered the dynamic cryptosystem methodology and its properties from the control-theoretic perspective rather than information security, and thus, the proposed cryptosystem requires security proof so that the security level of it is evaluated quantitatively. Moreover, the proposed method may be secure for information leakage, such as leakage of a secret key at a certain time, and adversaries may not be able to estimate a secret key from the previous/following one. We plan to address these issues in future work. Encrypted control under network constraints, such as transmission channel noises [28, 29] and packet dropouts [30], is also an open issue. We must give a theoretical foundation for implementing encrypted control systems using actual networks. The network constraints in encrypted control systems may be addressed as with those in unencrypted control systems because a closed-loop system with an encrypted controller is the same as an unencrypted closed-loop system. Encrypted model predictive control is one of the schemes expected to be effective for encrypted control under constraints [31, 32]. Additionally, we will modify the proposed cryptosystem not to use the same random number for updating key pairs and ciphertexts of controller parameters. We will also analyse the resilience of the proposed cryptosystem against major cyber-attacks and consider the proposed cryptosystem in terms of information security. 8 Acknowledgments The authors express their gratitude to Mr. Masahiro Kusaka, a PhD student at the University of Electro-Communications, who conducted practical verification of the proposed method. 9 References 1Teixeira A. Shames I. Sandberg H. et al.: ‘A secure control framework for resource-limited adversaries’, Automatica, 2015, 51, pp. 135– 148 2Mo Y. Sinopoli B.: ‘ Secure control against replay attacks’. Annual Allerton Conf. on Communication, Control, and Computing, Monticello, IL, 2009, pp. 911– 918 3Pasqualetti F. Dörfler F. Bullo F.: ‘Attack detection and identification in cyber-physical systems’, IEEE Trans. Autom. Control, 2013, 58, (11), pp. 2715– 2729 4Yuan Y. Yuan H. Guo L. et al.: ‘Resilient control of networked control system under DoS attacks: a unified game approach’, IEEE Trans. Ind. Inf., 2016, 12, (5), pp. 1786– 1794 5Kogiso K. Fujita T.: ‘ Cyber-security enhancement of networked control systems using homomorphic encryption’. IEEE Conf. on Decision and Control, Osaka, 2015, pp. 6836– 6843 6Rivest R.L. Shamir A. Adleman L.: ‘A method for obtaining digital signatures and public-key cryptosystems’, Commun. ACM, 1978, 21, (2), pp. 120– 126 7Elgamal T.: ‘A public key cryptosystem and a signature scheme based on discrete logarithms’, IEEE Trans. Inf. Theory, 1985, 31, (4), pp. 469– 472 8Kogiso K.: ‘ Attack detection and prevention for encrypted control systems by application of switching-key management’. IEEE Conf. on Decision and Control, Miami Beach, FL, 2018, pp. 5032– 5037 9Baba R. Kogiso K. Kishida M.: ‘ Detection method of controller falsification attacks against encrypted control system’. SICE Annual Conf., Nara, 2018, pp. 244– 248 10Sandberg H. Amin S. Johansson K.H.: ‘Cyberphysical security in networked control systems: an introduction to the issue’, IEEE Control Syst. Mag., 2015, 35, (1), pp. 20– 23 11Paillier P.: ‘ Public-key cryptosystems based on composite degree residuosity classes’. Advances in Cryptology (EUROCRYPT' 99), Berlin, Heidelberg, 1999, pp. 223– 238 12Farokhi F. Shames I. Batterham N.: ‘Secure and private control using semi-homomorphic encryption’, Control Eng. Pract., 2017, 67, pp. 13– 20 13Kishida M.: ‘Encrypted control system with quantiser’, IET Control Theory Applic., 2019, 13, (1), pp. 146– 151 14Brockett R.W. Liberzon D.: ‘Quantized feedback stabilization of linear systems’, IEEE Trans. Autom. Control, 2000, 45, (7), pp. 1279– 1289 15Gentry C. (2009). ‘A fully homomorphic encryption scheme’. PhD thesis, Stanford University. Stanford, CA, USA 16Kim J. Lee C. Shim H. et al.: ‘Encrypting controller using fully homomorphic encryption for security of cyber-physical systems’, IFAC-PapersOnLine, 2016, 49, (22), pp. 175– 180 17Cheon J.H. Han K. Kim H. et al.: ‘ Need for controllers having integer coefficients in homomorphically encrypted dynamic system’. IEEE Conf. on Decision and Control, Miami Beach, FL, 2018, pp. 5020– 5025 18Shannon C.E.: ‘Communication theory of secrecy systems’, Bell Syst. Techn. J., 1949, 28, (4), pp. 656– 715 19Blaze M. Bleumer G. Strauss M.: ‘ Divertible protocols and atomic proxy cryptography’. Advances in Cryptology (EUROCRYPT '98), Berlin, Heidelberg, 1998, pp. 127– 144 20Ivan A. Dodis Y.: ‘ Proxy cryptography revisited’. Network and Distributed System Security Symp., San Diego, CA, 2003 21Dodis Y. Katz J. Xu S. et al.: ‘ Key-insulated public key cryptosystems’. Advances in Cryptology (EUROCRYPT 2002), Berlin, Heidelberg, 2002, pp. 65– 82 22Teranishi K. Shimada N. Kogiso K.: ‘ Stability analysis and dynamic quantizer for controller encryption’. IEEE Conf. on Decision and Control, Nice, 2019, pp. 7184– 7189 23Kogiso K.: ‘ Upper-bound analysis of performance degradation in encrypted control system’. Annual American Control Conf., Milwaukee, WI, 2018, pp. 1250– 1255 24Luenberger D.: ‘An introduction to observers’, IEEE Trans. Autom. Control, 1971, 16, (6), pp. 596– 602 25Kogiso K. Baba R. Kusaka M.: ‘ Development and examination of encrypted control systems’. IEEE/ASME Int. Conf. on Advanced Intelligent Mechatronics, Auckland, 2018, pp. 1338– 1343 26Dorato P. Levis A.: ‘Optimal linear regulators: the discrete-time case’, IEEE Trans. Autom. Control, 1971, 16, (6), pp. 613– 620 27Teranishi K. Kusaka M. Shimada N. et al.: ‘ Secure observer-based motion control based on controller encryption’. Annual American Control Conf., Philadelphia, PA, 2019, pp. 2978– 2983 28Zhu Y. Zheng W.X. Zhou D.: ‘Quasi-synchronization of discrete-time Lur'e-type switched systems with parameter mismatches and relaxed PDT constraints’, IEEE Trans. Cybern., 2020, 50, (5), pp. 2026– 2037 29Zhang L. Zhuang S. Shi P. et al.: ‘Uniform tube based stabilization of switched linear systems with mode-dependent persistent dwell-time’, IEEE Trans. Autom. Control, 2015, 60, (11), pp. 2994– 2999 30Zhu Y. Zhong Z. Zheng W.X. et al.: ‘HMM-based filtering for discrete-time markov jump LPV systems over unreliable communication channels’, IEEE Trans. Syst., 2018, 48, (12), pp. 2035– 2046 31Darup M.S. Redder A. Quevedo D.E.: ‘Encrypted cloud-based MPC for linear systems with input constraints’, IFAC-PapersOnLine, 2018, 51, (20), pp. 535– 542 32Darup M.S. Redder A. Shames I. et al.: ‘Towards encrypted MPC for linear constrained systems’, IEEE Control Syst. Lett., 2018, 2, (2), pp. 195– 200 Citing Literature Volume14, Issue16November 2020Pages 2242-2252 FiguresReferencesRelatedInformation