Enforcing current-state opacity through shuffle and deletions of event observations

Abstract

In this paper, we deal with current-state opacity, and propose an Opacity-Enforcer that is able to change, in an appropriate way, the order of observation of event occurrences in the system, and also to delete event observations, so as to mislead the Intruder to never be sure if the current state of the system is a secret state. We then present two necessary and sufficient conditions for the feasibility of current-state opacity enforceability (CSOE), i.e., if a current-state opacity enforcer that shuffles and deletes events can be synthesized for the system, and present an automaton-based verification test for CSOE and an algorithm to build the automaton that realizes the proposed opacity enforcement. We also present a protocol to mitigate the negative effect of opacity enforcement on the capability of a legitimate recipient to accurately estimate the current state of the system in the case when the information is also intended to be sent to some receiver that needs to be aware of the system evolution.