# Cryptanalysis of a Chaotic Communication Scheme Using Parameter Observer

Authors: Haipeng Peng; Yan Shao; Lixiang Li; Yixian Yang
Journal: Mathematical Problems in Engineering
 (2010)

---

## Abstract

This paper addresses the cryptanalysis of a secure communication scheme proposed by Wu (2006), where the information signal is modulated into a system parameter of a unified chaotic system. It is demonstrated that a parameter observer can be designed to identify the parameter determined by the transmitted information and then the transmitted information can be obtained. Compared with the existing analysis using adaptive observer, the cryptanalysis based on parameter observer is much simpler and needs less structure information of the transmitter system. With numerical simulations, it is shown that the parameter observer has stronger practicality and robustness. Furthermore, it is still possible to obtain the transmitted information, even if the derivative of the transmitted signal is unknown.


---

## Body

## 1. Introduction

Over the past two decades, increasing attentions are drawn on utilizing chaos theory on secure communication based on synchronization technique [1–4]. At the meantime, cryptanalysis of chaotic secure communication scheme is proposed with different methods [5, 6]. Recently, a new secure cryptosystem based on adaptive synchronization has been proposed by Wu [7]. In this paper, we carry out a security analysis of the cryptosystem on the concept of parameter identification. It is demonstrated that a parameter observer can be designed to identify the parameter and then the information can be obtained. Compared with the existing analysis using adaptive observer, the parameter observer is much simpler and needs less structure information of the transmitter system. With numerical simulations, it is shown that the parameter observer has stronger practicality and robustness.Wu proposed a new secure communication scheme in  [7]. The secure communication scheme utilizes adaptive synchronization of a unified chaotic system. The transmitter is designed as follows:(1.1)ẋm=(25β(t)+a)(ym-xm),ẏm=(b-35β(t))xm-xmzm+(29β(t)-c)ym,żm=xmym-β(t)+d3zm,
where the lower scripts m stands for the transmitter system, a, b, c and d are user-specific parameters. The information signal f(t), which satisfies m≤f(t)≤M, is modulated into the function as follows:(1.2)β(t)=f(t)-mM-m.It is obvious thatβ(t) varies from 0 to 1 according to f(t). As it was shown in [7], system (1.1) then exhibits chaotic behavior with different chaotic attractors, such as Lorenz, Lü and Chen attractors.The identical receiver system can be constructed at the receiving end as follows:(1.3)ẋs=(25β1(t)+a)(ys-xs)+u1,ẏs=(b-35β1(t))xs-xszs+(29β1(t)-c)ys+u2,żs=xsys-β1(t)+d3zs+u3,
where the lower scripts s stands for the receiver system. u1, u2 and u3 are the nonlinear controllers and β1(t) is the estimator for β(t) and is updated adaptively. With the assumption that β̇(t) or ḟ(t) is known, it is proved in [7] by the Lyapunov stability theorem that the receiver is synchronous with the transmitter, and the covered message can be obtained with a reverse transformation of (1.2).In [6], Liu and Tang addresses a cryptanalysis of the cryptosystem performed with adaptive control theory. To obtain the transmitted information, an adaptive observer with three state observers (xm, ym and zm) and five parameter estimators (a, b, c, d and β(t)) are designed. Assuming that the dynamical evolution of the information signal is available, it is proved that both state variables and unknown parameters of the adaptive observer will asymptotically converge to their true values, respectively, justified by the Lyapunov stability theory. As the result, the transmitted information can be retrieved.In this paper, we are interested in performing the cryptanalysis of the same cryptosystem in a simpler way, based on two questions as follows.Firstly, since it isβ(t) that we only need to obtain the transmitted information, can we identify β(t) without achieving the true values of the user-specific parameters a, b, c and d?Secondly, if the structure of the system (1.1) is partly available, for instance, only the structure of the third equation is known, is it possible to obtain the transmitted information?Our answer is positive, and it is demonstrated in the following sections that it can be achieved based on the concept of parameters observer.The paper is organized as follows. In Section2, a parameter observer is designed for the cryptanalysis of the secure communication system (1.1) with both theoretical analysis and numerical simulations. In Section 3, a more practical case is considered, for which the derivative of the information signal is kept secret from attackers. Finally, the conclusion of the paper is given in Section 4.


## 2. Cryptanalysis Using the Parameter Observer

Let us consider the conditions of the secure communication scheme proposed in  [7], where system (1.1) with parameters a, b, c, d and β(t) being unknown, in this section, we will show that a parameter observer can be designed to retrieve the transmitted information.


### 2.1. Design of the Parameter Observer

Assuming all the state variables in system (1.1) and the dynamical evolution of the information signal are available, let(2.1)g(t)=β(t)+d3,
and the third equation of (1.1) can be written as follows:(2.2)g(t)zm=xmym-żm.A parameter observer is proposed as follows:(2.3)dĝ(t)dt=ġ(t)-zml(zm)ĝ(t)+l(zm)(xmym-żm),
where ĝ(t) is the estimators for g(t), and l(zm) is a designed gain function. Let(2.4)eg(t)=g(t)-ĝ(t),
then(2.5)ėg(t)=ġ(t)-dĝ(t)dt=-zml(zm)eg(t).l(zm) is the chosen function verifying that the system(2.6)ėg(t)+zml(zm)eg(t)=0
is exponentially stable. Then ĝ(t) will exponentially converge to g(t) when t→∞. A possible choice for l(zm) is k/zm, then system (2.6) can be written as follows:(2.7)ėg(t)+keg(t)=0,
where k>0 determines the converging speed.However, it is not practical to get the information ofżm, which makes observer (2.3) practically useless. To overcome the defect, we define an instrumental variable as follows:(2.8)δ=ĝ(t)+p(zm),
where p(zm) is a designed function verifying(2.9)l(zm)=dp(zm)dzm.We can obtain(2.10)δ̇=dĝ(t)dt+dp(zm)dzmżm=ġ(t)-zml(zm)(δ-p(zm))+l(zm)xmzm,
that is,(2.11)δ̇=ġ(t)-zml(zm)δ+l(zm)(zmp(zm)+xmym),ĝ(t)=δ-p(zm).Obviously, choose functionp(zm) such that(2.12)ėg(t)+dp(zm)dzmegzm=0
is exponentially stable, then ĝ(t) will exponentially converge to g(t).Summing up the above analysis, we have the following parameter observer.Result 1.
With knownβ̇(t), we can obtain ġ(t)=β̇(t)/3. The parameter observer of g(t) is designed as follows:(2.13)δ̇=ġ(t)-zml(zm)δ+l(zm)(zmp(zm)+xmym),ĝ(t)=δ-p(zm),
where p(zm) is a designed function verifying dp(zm)/dzm=l(zm) and l(zm) determines the converging speed.Based on (1.2) and (2.1), we get(2.14)β̂(t)=3ĝ(t)-d̂,
where the minimum and maximum values of β̂(t) are 0 and 1, respectively. Note that ĝ(t) can be obtained by the observer mentioned before and d is the constant, it is possible to determine d̂ by the minimum and maximum values of β̂(t). Consequently, β̂(t) can be obtained. Then, the information f(t) can be retrieved as follows:(2.15)f̂(t)=(M-m)β̂(t)+m.As the result, the scheme proposed in [7] is considered to be insecure.The parameter observer proposed in this paper gives excellent performances in following aspects.Firstly, the parameter observer is simple and direct. To retrieve the transmitted information, we only need to construct one observer to identify the true value ofβ(t), which is directly determined by the transmitted information. And it is unnecessary to obtain the true value of the user-specific parameters a, b, c and d. The result answers on the first question in Section 1.Secondly, the parameter observer is only related to the structure of the third equation in system (1.1), which means it is possible to construct the parameter observer, even if part of the structure information of the transmitter system is unknown. The result answers on the second question in Section 1. Furthermore, for the reason that the parameter observer is designed based on the third equation, any change of parameters or structures in the first and second equations in system (1.1) has no effect on the result of parameter identification.Thirdly, our cryptanalysis with parameter observer imposes less assumptions than the cryptanalysis proposed in  [6], where, in order to obtain the true value of the parameters, persistently excitation or linearly independent condition are need.As mentioned in the first and second aspects, the questions proposed in Section1 have been resolved. Moreover, it can be concluded that the parameter observer has stronger practicality and robustness.


### 2.2. Numerical Simulations with Availableβ̇(t)

In the following, several functions off(t) are tested. At the meantime, a possible case, for which the parameter a changes during the parameter identification process, is also simulated. Furthermore, we also take the influence of the noise on the identification performance into consideration. The parameters and initial states of system (1.1) are set the same as  [6]: a=10, b=28,  c=1,  d=8,  xm=1,  ym=1, zm=2. For the parameter observer, the initial state is set as: δ(0)=0. It was shown above that l(zm) is a designed gain function, which determines the converging speed. l(zm) is set as: l(zm)=k/zm, where different k is chosen in different cases, according to the frequency of the information signal.Case 1 (f(t)=3+2sin(0.5t)).
For the first case,M=5 and m=1. According to (1.2), β(t)=[1+sin(0.5t)]/2. The simulation results are given in Figure 1 with k=1000. It is shown in Figure 1(a) that 3ĝ(t)=β̂(t)+d̂ is obtained and found to be varied in the range of [8,9]. Considering that the minimum and maximum values of β(t) are 0 and 1, respectively, it is estimated that d̂=8.00 and β̂(t) is shown in Figure 1(b). Figure 1(d) shows the estimation of the absolute error. After the initial transient time of about 7×10-3 s, information signal can be recovered with a fluctuation of |f(t)-f̂(t)|≤0.5×10-3. A faster convergence rate is achieved, compared with the result given in  [6].Figure 1
Simulation results with Case1 of Section 2: f(t)=3+2sin(0.5t).Case 2 (f(t)=3+2sin(10t)).
In this case, information signal with higher frequency is simulated and a large value is set fork as: k=10000. As it is shown in Figure 2, f̂(t) still closely follows f(t) with a small mismatch |f(t)-f̂(t)|≤1.65×10-3 after a transient time of 6×10-4 s.Simulation results with Case2 of Section 2: f(t)=3+2sin(10t).Case 3 (f(t)=5+sin(t)+sin(4t)+sin(7t)).
In this case, a composite signal is chosen as the information signal. It is assumed thatf(t)=5+sin(t)+sin(4t)+sin(7t). As it is indicated in Figure 3 with k=8000, information signal is identified with a small mismatch of |f(t)-f̂(t)|≤1.1×10-3 after a transient time of 9×10-4 s.Simulation results with Case3 of Section 2:  f(t)=5+sin(t)+sin(4t)+sin(7t).Case 4 (The parametera changes during parameter identification process).
In the above three cases, the success of the proposed algorithm is clearly indicated. In the following two cases, we are going to demonstrate that the parameter observer has strong robustness. In Case4, it is assumed that the parameter a in system (1.1) is not a constant anymore. Instead, a is varied in the range of [9.5,10.5]. Figure 4(a) shows that during the initial five seconds, a=5 and then a=10+0.5sin(0.5t). It is demonstrated in Figure 4 with k=1000 that the information f(t)=3+2sin(0.5t) can still be recovered with the same mismatch as that in Case 1. Furthermore, information signal with higher frequency and composite signal are also considered. The results with f(t)=3+2sin(10t), k=10000 and f(t)=5+sin(t)+sin(4t)+sin(7t), k=8000 are shown in Figures 5 and 6, respectively. It is clearly demonstrated that the information signal can be recovered successfully, even if the parameter a changes during the identification process. Based on much simulations, we find that any change of parameters in the first and second equations of system (1.1) has nothing to do with the identification results.Figure 4
Simulation results with Case4 of Section 2:  f(t)=3+2sin(0.5t). The parameter a changes during parameter identification.Simulation results with Case4 of Section 2: f(t)=3+2sin(10t). The parameter a changes during parameter identification.Simulation results with Case4 of Section 2: f(t)=5+sin(t)+sin(4t)+sin(7t). The parameter a changes during parameter identification.Case 5 (Simulation results in presence of noise).
In this part, we are going to consider the influence of the noise on the identification performance of the proposed parameter observer in practical applications. We keep the third equation of system (1.1) invariant and add the noise into the other two equations, then the transmitter system can be written as follows:
(2.16)ẋs=(25β1(t)+a)(ys-xs)+η1,ẏs=(b-35β1(t))xs-xszs+(29β1(t)-c)ys+η2,żs=xsys-β1(t)+d3zs.As it is shown in Figure7(a), the mean of the random noise ηi(i=1,2) is zero mean and the sample time is 0.001. In the simulations, we set the amplitudes of the noise as 3 and the information signal as f(t)=3+2sin(0.5t), f(t)=3+2sin(10t), f(t)=5+sin(t)+sin(4t)+sin(7t), respectively. We utilize the proposed parameter observer to recover the information signal. Figures 7, 8, and 9 show the identification results when the information signals are f(t)=3+2sin(0.5t), f(t)=3+2sin(10t), f(t)=5+sin(t)+sin(4t)+sin(7t), respectively. It is indicated that for the transmitter system in presence of noise, the information signal can still be retrieved with the same mismatch as Cases 1, 2, and 3. Based on the simulations, we can conclude that the proposed observer in this paper is robust to noise.Figure 7
Simulation results in presence of noise with Case5 of Section 2: f(t)=3+2sin(0.5t).Simulation results in presence of noise with Case5 of Section 2: f(t)=3+2sin(10t).Simulation results in presence of noise with Case5 of Section 2: f(t)=5+sin(t)+sin(4t)+sin(7t).Compared with the performance of adaptive observer proposed in  [6], it takes less time for the parameter observer to recover the transmitted information. Moreover, the proposed parameter observer is robust to any change of parameters and noise in the first and second equations in system (1.1). However, the information estimation error is larger than  [6], but still tolerable. To identify the information easily and quickly, accuracy is the only sacrifice.


## 2.1. Design of the Parameter Observer

Assuming all the state variables in system (1.1) and the dynamical evolution of the information signal are available, let(2.1)g(t)=β(t)+d3,
and the third equation of (1.1) can be written as follows:(2.2)g(t)zm=xmym-żm.A parameter observer is proposed as follows:(2.3)dĝ(t)dt=ġ(t)-zml(zm)ĝ(t)+l(zm)(xmym-żm),
where ĝ(t) is the estimators for g(t), and l(zm) is a designed gain function. Let(2.4)eg(t)=g(t)-ĝ(t),
then(2.5)ėg(t)=ġ(t)-dĝ(t)dt=-zml(zm)eg(t).l(zm) is the chosen function verifying that the system(2.6)ėg(t)+zml(zm)eg(t)=0
is exponentially stable. Then ĝ(t) will exponentially converge to g(t) when t→∞. A possible choice for l(zm) is k/zm, then system (2.6) can be written as follows:(2.7)ėg(t)+keg(t)=0,
where k>0 determines the converging speed.However, it is not practical to get the information ofżm, which makes observer (2.3) practically useless. To overcome the defect, we define an instrumental variable as follows:(2.8)δ=ĝ(t)+p(zm),
where p(zm) is a designed function verifying(2.9)l(zm)=dp(zm)dzm.We can obtain(2.10)δ̇=dĝ(t)dt+dp(zm)dzmżm=ġ(t)-zml(zm)(δ-p(zm))+l(zm)xmzm,
that is,(2.11)δ̇=ġ(t)-zml(zm)δ+l(zm)(zmp(zm)+xmym),ĝ(t)=δ-p(zm).Obviously, choose functionp(zm) such that(2.12)ėg(t)+dp(zm)dzmegzm=0
is exponentially stable, then ĝ(t) will exponentially converge to g(t).Summing up the above analysis, we have the following parameter observer.Result 1.
With knownβ̇(t), we can obtain ġ(t)=β̇(t)/3. The parameter observer of g(t) is designed as follows:(2.13)δ̇=ġ(t)-zml(zm)δ+l(zm)(zmp(zm)+xmym),ĝ(t)=δ-p(zm),
where p(zm) is a designed function verifying dp(zm)/dzm=l(zm) and l(zm) determines the converging speed.Based on (1.2) and (2.1), we get(2.14)β̂(t)=3ĝ(t)-d̂,
where the minimum and maximum values of β̂(t) are 0 and 1, respectively. Note that ĝ(t) can be obtained by the observer mentioned before and d is the constant, it is possible to determine d̂ by the minimum and maximum values of β̂(t). Consequently, β̂(t) can be obtained. Then, the information f(t) can be retrieved as follows:(2.15)f̂(t)=(M-m)β̂(t)+m.As the result, the scheme proposed in [7] is considered to be insecure.The parameter observer proposed in this paper gives excellent performances in following aspects.Firstly, the parameter observer is simple and direct. To retrieve the transmitted information, we only need to construct one observer to identify the true value ofβ(t), which is directly determined by the transmitted information. And it is unnecessary to obtain the true value of the user-specific parameters a, b, c and d. The result answers on the first question in Section 1.Secondly, the parameter observer is only related to the structure of the third equation in system (1.1), which means it is possible to construct the parameter observer, even if part of the structure information of the transmitter system is unknown. The result answers on the second question in Section 1. Furthermore, for the reason that the parameter observer is designed based on the third equation, any change of parameters or structures in the first and second equations in system (1.1) has no effect on the result of parameter identification.Thirdly, our cryptanalysis with parameter observer imposes less assumptions than the cryptanalysis proposed in  [6], where, in order to obtain the true value of the parameters, persistently excitation or linearly independent condition are need.As mentioned in the first and second aspects, the questions proposed in Section1 have been resolved. Moreover, it can be concluded that the parameter observer has stronger practicality and robustness.


## 2.2. Numerical Simulations with Availableβ̇(t)

In the following, several functions off(t) are tested. At the meantime, a possible case, for which the parameter a changes during the parameter identification process, is also simulated. Furthermore, we also take the influence of the noise on the identification performance into consideration. The parameters and initial states of system (1.1) are set the same as  [6]: a=10, b=28,  c=1,  d=8,  xm=1,  ym=1, zm=2. For the parameter observer, the initial state is set as: δ(0)=0. It was shown above that l(zm) is a designed gain function, which determines the converging speed. l(zm) is set as: l(zm)=k/zm, where different k is chosen in different cases, according to the frequency of the information signal.Case 1 (f(t)=3+2sin(0.5t)).
For the first case,M=5 and m=1. According to (1.2), β(t)=[1+sin(0.5t)]/2. The simulation results are given in Figure 1 with k=1000. It is shown in Figure 1(a) that 3ĝ(t)=β̂(t)+d̂ is obtained and found to be varied in the range of [8,9]. Considering that the minimum and maximum values of β(t) are 0 and 1, respectively, it is estimated that d̂=8.00 and β̂(t) is shown in Figure 1(b). Figure 1(d) shows the estimation of the absolute error. After the initial transient time of about 7×10-3 s, information signal can be recovered with a fluctuation of |f(t)-f̂(t)|≤0.5×10-3. A faster convergence rate is achieved, compared with the result given in  [6].Figure 1
Simulation results with Case1 of Section 2: f(t)=3+2sin(0.5t).Case 2 (f(t)=3+2sin(10t)).
In this case, information signal with higher frequency is simulated and a large value is set fork as: k=10000. As it is shown in Figure 2, f̂(t) still closely follows f(t) with a small mismatch |f(t)-f̂(t)|≤1.65×10-3 after a transient time of 6×10-4 s.Simulation results with Case2 of Section 2: f(t)=3+2sin(10t).Case 3 (f(t)=5+sin(t)+sin(4t)+sin(7t)).
In this case, a composite signal is chosen as the information signal. It is assumed thatf(t)=5+sin(t)+sin(4t)+sin(7t). As it is indicated in Figure 3 with k=8000, information signal is identified with a small mismatch of |f(t)-f̂(t)|≤1.1×10-3 after a transient time of 9×10-4 s.Simulation results with Case3 of Section 2:  f(t)=5+sin(t)+sin(4t)+sin(7t).Case 4 (The parametera changes during parameter identification process).
In the above three cases, the success of the proposed algorithm is clearly indicated. In the following two cases, we are going to demonstrate that the parameter observer has strong robustness. In Case4, it is assumed that the parameter a in system (1.1) is not a constant anymore. Instead, a is varied in the range of [9.5,10.5]. Figure 4(a) shows that during the initial five seconds, a=5 and then a=10+0.5sin(0.5t). It is demonstrated in Figure 4 with k=1000 that the information f(t)=3+2sin(0.5t) can still be recovered with the same mismatch as that in Case 1. Furthermore, information signal with higher frequency and composite signal are also considered. The results with f(t)=3+2sin(10t), k=10000 and f(t)=5+sin(t)+sin(4t)+sin(7t), k=8000 are shown in Figures 5 and 6, respectively. It is clearly demonstrated that the information signal can be recovered successfully, even if the parameter a changes during the identification process. Based on much simulations, we find that any change of parameters in the first and second equations of system (1.1) has nothing to do with the identification results.Figure 4
Simulation results with Case4 of Section 2:  f(t)=3+2sin(0.5t). The parameter a changes during parameter identification.Simulation results with Case4 of Section 2: f(t)=3+2sin(10t). The parameter a changes during parameter identification.Simulation results with Case4 of Section 2: f(t)=5+sin(t)+sin(4t)+sin(7t). The parameter a changes during parameter identification.Case 5 (Simulation results in presence of noise).
In this part, we are going to consider the influence of the noise on the identification performance of the proposed parameter observer in practical applications. We keep the third equation of system (1.1) invariant and add the noise into the other two equations, then the transmitter system can be written as follows:
(2.16)ẋs=(25β1(t)+a)(ys-xs)+η1,ẏs=(b-35β1(t))xs-xszs+(29β1(t)-c)ys+η2,żs=xsys-β1(t)+d3zs.As it is shown in Figure7(a), the mean of the random noise ηi(i=1,2) is zero mean and the sample time is 0.001. In the simulations, we set the amplitudes of the noise as 3 and the information signal as f(t)=3+2sin(0.5t), f(t)=3+2sin(10t), f(t)=5+sin(t)+sin(4t)+sin(7t), respectively. We utilize the proposed parameter observer to recover the information signal. Figures 7, 8, and 9 show the identification results when the information signals are f(t)=3+2sin(0.5t), f(t)=3+2sin(10t), f(t)=5+sin(t)+sin(4t)+sin(7t), respectively. It is indicated that for the transmitter system in presence of noise, the information signal can still be retrieved with the same mismatch as Cases 1, 2, and 3. Based on the simulations, we can conclude that the proposed observer in this paper is robust to noise.Figure 7
Simulation results in presence of noise with Case5 of Section 2: f(t)=3+2sin(0.5t).Simulation results in presence of noise with Case5 of Section 2: f(t)=3+2sin(10t).Simulation results in presence of noise with Case5 of Section 2: f(t)=5+sin(t)+sin(4t)+sin(7t).Compared with the performance of adaptive observer proposed in  [6], it takes less time for the parameter observer to recover the transmitted information. Moreover, the proposed parameter observer is robust to any change of parameters and noise in the first and second equations in system (1.1). However, the information estimation error is larger than  [6], but still tolerable. To identify the information easily and quickly, accuracy is the only sacrifice.


## 3. Cryptanalysis in Case of Unavailableβ̇(t)

In the design process of parameter observer mentioned in Section2, the value of β̇(t) is assumed to be available. However, from the view of real communication, it is sometimes impractical to get the information of β̇(t) [8]. Hence, in this section, we are going to consider the case with unknown β̇(t).


### 3.1. Design of Parameter Observer

Withβ̇(t) being unknown, it is impossible to get the information of ġ(t). The parameter observer of g(t) is designed as follows:(3.1)δ̇=-zml(zm)δ+l(zm)(zmp(zm)+xmym),ĝ(t)=δ-p(zm),
where the designed function l(zm) determines the converging speed. The observer identifies g(t) at an exponential velocity. Consequently, when the frequency of g(t) is low and a large gain function l(zm) is used, g(t) can be coarsely identified. Consequently, the transmitted information is coarsely achieved.


### 3.2. Numerical Simulation

In this part, information functions used in Section2.2 as well as a chaotic information signal are simulated. All the parameters settings are the same as that of Section 2.2 except that a larger k is set to improve the identification performance.Case 1 (f(t)=3+2sin(0.5t)).
The simulation results are shown in Figure10 with k=1500, which indicates the success of the information recovering. As the estimation of the absolute error shown in Figure 10, f̂(t) closely matches with f(t), and after the initial transient time of about 0.5×10-3 s, information signal can be recovered with a fluctuation of |f(t)-f̂(t)|≤0.5×10-3. Although the performance is slightly worse than that shown in Case 1 of Section 2, the estimation of the absolute error is still small.Figure 10
Simulation results with Case1 of Section 3: f(t)=3+2sin(0.5t).Case 2 (f(t)=3+2sin(10t)).
The proposed parameter observer is also used to recover transmitted signal with higher frequency. A larger gaink=15000 is set to achieve a small error. As shown in Figure 11, f̂(t) still closely follows f(t) with a small mismatch of |f(t)-f̂(t)|≤2.5×10-3 after a transient time of 4×10-4 s. Compared with the case when β̇(t) is known, a larger fluctuation is experienced.Simulation results with Case2 of Section 3: f(t)=3+2sin(10t).Case 3 (f(t)=5+sin(t)+sin(4t)+sin(7t)).
Figure12 gives the simulation results when a composite signal is used and a large constant k=12000 is set. Figure 12 shows the proposed parameter observer can still coarsely retrieve the transmitted information with a small mismatch of |f(t)-f̂(t)|≤2×10-3 after 5×10-4 s. The performance is inferior to that with a low frequency signal in Case 1, but superior to that with a high frequency signal in Case 2.Simulation results with Case3 of Section 3: f(t)=5+sin(t)+sin(4t)+sin(7t).Case 4 (f(t) is a chaotic signal).
In this example, the information signal is assumed to be a chaotic signal, which is one state of a Lorenz system. We suppose that the maximum and minimum values of the signal are known, and based on (1.2), β(t) is obtained from (1.2). Figure 13 shows the simulation results with k=20000. As displayed in Figure 13, 3ĝ(t)=β̂(t)+d̂ is varied in the range of [8,9], so it is estimated that d̂=8. It is noticed that f̂(t) closely follows f(t) with a small mismatch after a transient time of 3.5×10-4 s, implying the success of the information signal recovering.Figure 13
Simulation results with Case4 of Section 3:  f(t) is a chaotic signal.


## 3.1. Design of Parameter Observer

Withβ̇(t) being unknown, it is impossible to get the information of ġ(t). The parameter observer of g(t) is designed as follows:(3.1)δ̇=-zml(zm)δ+l(zm)(zmp(zm)+xmym),ĝ(t)=δ-p(zm),
where the designed function l(zm) determines the converging speed. The observer identifies g(t) at an exponential velocity. Consequently, when the frequency of g(t) is low and a large gain function l(zm) is used, g(t) can be coarsely identified. Consequently, the transmitted information is coarsely achieved.


## 3.2. Numerical Simulation

In this part, information functions used in Section2.2 as well as a chaotic information signal are simulated. All the parameters settings are the same as that of Section 2.2 except that a larger k is set to improve the identification performance.Case 1 (f(t)=3+2sin(0.5t)).
The simulation results are shown in Figure10 with k=1500, which indicates the success of the information recovering. As the estimation of the absolute error shown in Figure 10, f̂(t) closely matches with f(t), and after the initial transient time of about 0.5×10-3 s, information signal can be recovered with a fluctuation of |f(t)-f̂(t)|≤0.5×10-3. Although the performance is slightly worse than that shown in Case 1 of Section 2, the estimation of the absolute error is still small.Figure 10
Simulation results with Case1 of Section 3: f(t)=3+2sin(0.5t).Case 2 (f(t)=3+2sin(10t)).
The proposed parameter observer is also used to recover transmitted signal with higher frequency. A larger gaink=15000 is set to achieve a small error. As shown in Figure 11, f̂(t) still closely follows f(t) with a small mismatch of |f(t)-f̂(t)|≤2.5×10-3 after a transient time of 4×10-4 s. Compared with the case when β̇(t) is known, a larger fluctuation is experienced.Simulation results with Case2 of Section 3: f(t)=3+2sin(10t).Case 3 (f(t)=5+sin(t)+sin(4t)+sin(7t)).
Figure12 gives the simulation results when a composite signal is used and a large constant k=12000 is set. Figure 12 shows the proposed parameter observer can still coarsely retrieve the transmitted information with a small mismatch of |f(t)-f̂(t)|≤2×10-3 after 5×10-4 s. The performance is inferior to that with a low frequency signal in Case 1, but superior to that with a high frequency signal in Case 2.Simulation results with Case3 of Section 3: f(t)=5+sin(t)+sin(4t)+sin(7t).Case 4 (f(t) is a chaotic signal).
In this example, the information signal is assumed to be a chaotic signal, which is one state of a Lorenz system. We suppose that the maximum and minimum values of the signal are known, and based on (1.2), β(t) is obtained from (1.2). Figure 13 shows the simulation results with k=20000. As displayed in Figure 13, 3ĝ(t)=β̂(t)+d̂ is varied in the range of [8,9], so it is estimated that d̂=8. It is noticed that f̂(t) closely follows f(t) with a small mismatch after a transient time of 3.5×10-4 s, implying the success of the information signal recovering.Figure 13
Simulation results with Case4 of Section 3:  f(t) is a chaotic signal.


## 4. Conclusions

This paper provided the cryptanalysis of a chaotic communication scheme based on parameter identification. The approach was to design a parameter observer to identify the true value of the system parameter, which was directly determined by the information signal. Supported by rigorous proof and illustrated with numerical simulation, it was clearly demonstrated that the transmitted information can be obtained with the proposed parameter observer. The results of numerical simulation showed that estimation of the absolute error was about10-3 after less than 7×10-3 s for the presented cases with different frequencies. Furthermore, it was shown with simulations that the parameter observer was robust to parameter change and noise in the transmitter system. Therefore, the security of the analyzed communication scheme was rather weak under the observer attack, which discouraged its further applications in practical communications.



---

*Source: 361860-2010-03-07.xml*