Opacity In Discrete Event Systems Research Articles

Opacity enforcement in discrete event systems using differential privacy

Opacity is an important information security property that characterizes whether the secret of a system can be inferred by an intruder who can partially observe the behavior of the system. In this paper, we touch upon the enforcement of the current-state opacity and initial-state opacity of discrete event systems modeled by automata. Specifically, given a partially observed discrete event system that is not current-state opaque (resp., initial-state opaque), by observing the system's behavior, the intruder stands a chance to infer that the current state (resp., initial state) is within the secret of the system. To prevent the exposure of secret information, we introduce a differential privacy mechanism to enforce a non-opaque system to be opaque. Particularly, the designed mechanism is settled to receive the observations of the system. Suppose that there are two observations such that one of them can lead to the exposure of the secret and the other is randomly observed. When the two observations are received by the designed mechanism that provides differential privacy, a randomly modified output with an approximate probability is exported, exposing to the intruder. In this way, since the observation from which the secret can be inferred by the intruder, is befuddled with one randomly generated by the system, he/she is not able to deduce which one is truly generated and received by the mechanism, even if the probabilistic generation rule of the mechanism is public.

Quantifying opacity of discrete event systems modeled with probabilistic Petri nets

The verification and enforcement problem of opacity that falls into the category of security properties of information flows in a cyber-physical system has been extensively studied from the view of discrete event systems. Recent years have witnessed growing interest in the quantitative analysis of opacity. However, documented results on quantifying opacity in the literature are not formulated within the framework of Petri nets. By introducing a new class of Petri net as a modeling vehicle for opacity quantification, we suggest a novel notion of opacity referred to as worthy opacity, which describes the worth associated with the information that a system might leak during its evolution. Depending on how much system information is captured by an intruder, we propose two types of worthy opacity: stepwise and observational worthy opacity. We provide a necessary and sufficient condition for stepwise worthy opacity and prove its decidability. Observational worthy opacity is established by considering both system and observation aspects, with its verification shown to be undecidable. Compared with the existing works on quantifying opacity, we argue that the worthy opacity is of practical concern, as being aware of the information worth that a system may leak during its evolution is a more realistic guide than the probability that it may reveal a system secret.

Verifying weak and strong k-step opacity in discrete-event systems

Opacity is an important system-theoretic property expressing whether a system may reveal its secret to a passive observer (an intruder) who knows the structure of the system but has only limited observations of its behavior. Several notions of opacity have been discussed in the literature, including current-state opacity, k-step opacity, and infinite-step opacity. We investigate weak and strong k-step opacity, the notions that generalize both current-state opacity and infinite-step opacity, and ask whether the intruder is not able to decide, at any time instant, when respectively whether the system was in a secret state during the last k observable steps. We design a new algorithm verifying weak k-step opacity, the complexity of which is lower than the complexity of existing algorithms and does not depend on the parameter k, and show how to use it to verify strong k-step opacity by reducing strong k-step opacity to weak k-step opacity. The complexity of the resulting algorithm is again better than the complexity of existing algorithms and does not depend on the parameter k.

Verification of Current-State Opacity in Discrete Event Systems by Using Basis Coverability Graphs

A new approach to the verification of current-state opacity for discrete event systems is proposed in this paper, which is modeled with unbounded Petri nets. The concept of opacity verification is first extended from bounded Petri nets to unbounded Petri nets. In this model, all transitions and partial places are assumed to be unobservable, i.e., only the number of tokens in the observable places can be measured. In this work, a novel basis coverability graph is constructed by using partial markings and quasi-observable transitions. By this graph, this research finds that an unbounded net system is current-state opaque if, for an arbitrary partial marking, there always exists at least one regular marking in the result of current-state estimation with respect to the partial marking not belonging to the given secret. Finally, a sufficient and necessary condition is proposed for the verification of current-state opacity. A manufacturing system example is presented to illustrate that the concept of current-state opacity can be verified for unbounded net systems.

Current-state opacity verification in discrete event systems using an observer net

Due to the proliferation of contemporary computer-integrated systems and communication networks, there is more concern than ever regarding privacy, given the potential for sensitive data exploitation. A recent cyber-security research trend is to focus on security principles and develop the foundations for designing safety-critical systems. In this work, we investigated the problem of verifying current-state opacity in discrete event systems using labeled Petri nets. A system is current-state opaque provided that the current-state estimate cannot be revealed as a subset of secret states. We introduced a new sub-model of the system, named an observer net. The observer net have the same structure as the plant, but it is distinguished by the use of colored markers as well as simultaneous and recursive transition enabling and firing, which offer an efficient state estimation. We considered two settings of the proposed approach: an on-line setting, in which a current-state opacity algorithm is proposed. The algorithm waits for the occurrence of an observable event and determines if the current observation of a plant reveals the secret behaviour, as well as, an off-line setting, where the verification problem is solved based on a state estimator called a colored estimator. In this context, necessary and sufficient conditions for verifying opacity are developed with illustrative examples to demonstrate the presented approach.

Symbolic Verification of Current-State Opacity of Discrete Event Systems Using Petri Nets

Given a discrete event system, it is said to be opaque if an intruder who can partially observe system behavior cannot infer that the system is necessarily in a predefined secret. A discrete event system is current-state opaque if an intruder is never able to verify whether the current state of the system is within the secret states. This article addresses the verification of current-state opacity of a discrete event system modeled with Petri nets, where the secret is defined as a set of states. The existing methods cannot deal with large-sized systems due to the curse of dimensionality. Multi-valued decision diagrams (MDDs) are widely accepted as an efficient and compact data structure for representing the extremely large reachability sets of Petri nets. We show that MDDs can be used in Petri nets with partial observable transitions and propose an approach for the verification of current-state opacity for bounded Petri nets. It is shown by experimental studies that the symbolic approach is practically more efficient than traditional techniques such as basis reachability graphs (BRGs).

Game current-state opacity formulation in probabilistic resource automata

We investigate the quantitative current-state opacity problem with resource constraints in the framework of probabilistic resource automata which is partially observed. Resource information states and event payoffs capture the variations of a resource that can be consumed or replenished during a system evolution. There are a number of ways to quantify opacity in discrete event systems, but these quantification methods have certain limitations. This research mitigates this restriction by extending current-state opacity and step-based almost current-state opacity formulations to probabilistic resource automata under partial observation with payoff constraints. We define game current-state opacity with an aim of offering a quantitative measure for opacity. We also construct a game current-state analyzer for the verification of game current-state opacity and prove the decidability of verifying the game current-state opacity problem.

Opacity of networked discrete event systems

Opacity is an important information-flow property, which is used to characterize whether or not the secrets of system have been leaked to the intruders. Over the past ten years, opacity of discrete event systems (DESs) modeled as automata and Petri nets have been well investigated under the assumption that the communication channels between systems and intruders are perfect. However, in networked discrete event systems (NDESs), the DESs run in a shared network, and the communication delays and losses are inevitable usually. In this paper, we investigate the problems of opacity in the framework of NDESs. We formulate four kinds of opacity for NDESs, including current-state opacity, initial-state opacity, initial-final-state opacity, and K-step opacity. We also present the verification algorithms for these notions. We extend the notions of opacity in classical DESs, that is, if the communication delays and losses disappear, then these new notions would reduce to their classical counterparts. A number of examples are provided to illustrate the results obtained.

Verification of Infinite-step Opacity Using Labeled Petri Nets

Abstract Opacity is an important information secure property. A system is said to be infinite-step opaque if the intruder is never able to ascertain that the system is or has been in a secret state at some time, based on its observation of the system evolution. This work aims to verify infinite-step opacity of discrete event systems modeled with labeled Petri nets. Based on the notion of basis reachability graph, a new structure called basis two-way observer is proposed to check infinite-step opacity of a bounded system, which is shown to be more efficient than the standard method based on the reachability graph.

Overview of Opacity in Discrete Event Systems

In recent years, opacity has received increasing attention in terms of analyzing security and privacy problems. Opacity is a confidentiality property that characterizes a system’s ability to hide its secret information from any external intruders. A systematic overview of opacity in the context of discrete event systems (DESs) was conducted; this paper firstly reviews the verification methods and computational complexity of the opacity in DESs using the formalisms of automata and Petri nets. When the system is verified to be non-opaque, the approaches that synthesize an opaque system are summarized. Finally, the future research directions and open problems of opacity in DES are also reviewed.

On-line verification of initial-state opacity by Petri nets and integer linear programming

This paper deals with a problem related to the observability of discrete event systems: the initial-state opacity. Given a set of system states (the secret), a system observation is called initial-state opaque if an agent (named intruder), who can partially observe the system, cannot determine whether the set of initial states consistent with an event sequence is included in the secret. Such a character can describe security problems in cyber-infrastructures, such as Internet and mobile communication networks or national defense service systems. This work presents a novel on-line methodology to verify the notion of initial-state opacity of discrete event systems that are modeled by labeled Petri nets. By working on-line, the intruder records an event and exploits integer linear programming problem for checking the initial-state opacity of the system’s evolution under the given observation. A set of examples are shown to shed light on the efficiency of the presented methodology.

Privacy Verification and Enforcement via Belief Abstraction

Privacy is a crucial concern in many practical systems. We consider a new notion of privacy based on beliefs of the system states, which is closely related to opacity in discrete event systems. To guarantee the privacy requirement, we propose to abstract the belief space whose dynamics is shown to be mixed monotone where efficient abstraction algorithm exists. Based on the abstraction, we propose two different approaches to preserve privacy with an illustrative example.

On-line verification of current-state opacity by Petri nets and integer linear programming

Opacity is a security and privacy property that evaluates whether an external observer (intruder) can infer a secret of a system by observing its behavior. This paper proposes an on-line approach to address the problem of current-state opacity in discrete event systems (DESs) modeled in a labeled Petri Net (PN) framework and by observing its evolution. An observation of the system is said to be current-state opaque if the intruder is unable to determine whether the current state of the system is within a set of secret states, otherwise it is said to be not current-state opaque. The proposed approach to verify the current-state opacity works on-line: the verification algorithm waits for the occurrence of an observable event and uses Integer Linear Programming problem solutions to verify if the behavior of the system is current-state opaque to the intruder under the given observation. Moreover, the proposed method is applied in two different settings: (i) a centralized approach where the intruder has full knowledge of the system model but can partially observe the system behavior; (ii) a decentralized approach where a set of intruders can observe different event sets and collaborate with a coordinator to disclose the same secret. Finally, experimental results are presented to demonstrate the efficiency of the proposed method.

On the history of diagnosability and opacity in discrete event systems

This paper presents historical remarks on key projects and papers that led to the development of a theory of event diagnosis for discrete event systems modeled by finite-state automata or Petri nets in the 1990s. The goal in event diagnosis is to develop algorithmic procedures for deducing the occurrence of unobservable events, based on a formal model of the system and on-line observations of its behavior. It also presents historical remarks on the early works on the property of opacity, which occurred about ten years later. Opacity can be seen as a strong version of lack of diagnosability and it has been used to capture security and privacy requirements. Finally, diagnosability is connected with the property of observability that arises in supervisory control. This paper is part of set of papers that review the emergence of discrete event systems as an area of research in control engineering.

Probabilistic system opacity in discrete event systems

In many emerging security applications, a system designer frequently needs to ensure that a certain property of a given system (that may reveal important details about the system’s operation) be kept secret (opaque) to outside observers (eavesdroppers). Motivated by such applications, several researchers have formalized, analyzed, and described methods to verify notions of opacity in discrete event systems of interest. This paper introduces and analyzes a notion of opacity in systems that can be modeled as probabilistic finite automata or hidden Markov models. We consider a setting where a user needs to choose a specific hidden Markov model (HMM) out of m possible (different) HMMs, but would like to “hide” the true system from eavesdroppers, by not allowing them to have an arbitrary level of confidence as to which system has been chosen. We describe necessary and sufficient conditions (that can be checked with polynomial complexity), under which the intruder cannot distinguish the true HMM, namely, the intruder cannot achieve a level of certainty about its decision, which is above a certain threshold that we can a priori compute.

Opaque Superlanguages and Sublanguages in Discrete Event Systems

ABSTRACTIn this article, we further investigate opacity of discrete event systems. In our previous work, we defined three types of opacity: strong opacity, weak opacity, and no opacity. Strong opacity can be used to study security-related problems whereas no opacity can be used to study fault detection and diagnosis problems. In this study, we investigate the properties of (strong, weak, and no) opacity. We show that opacity is often closed under union, but may not be closed under the intersection. We also investigate the largest opaque sublanguages and the smallest opaque superlanguages of a language if the language is not opaque. We derive formulas for these sublanguages and superlanguages. We then extend these results from centralized opacity to decentralized opacity, when more than one observer or controller is observing the system. Finally, we apply the results to the Dining Cryptographers Problem. We show that the protocol proposed in the literature satisfies both no opacity (the cryptographers know if the boss is paying) and strong opacity (the cryptographers do not know who is paying if the boss is not paying). We also use the formulas derived in this article to synthesize the protocol, which is much more difficult to do than verifying the protocol.

Overview of discrete event systems opacity: Models, validation, and quantification

Over the last decade, opacity of discrete event systems (DES) has become a very fertile field of research. Driven by safety and privacy concerns in network communications and online services, much theoretical work has been conducted in order to design opaque systems. A system is opaque if an external observer in unable to infer a “secret” about the system behavior. This paper aims to review the most commonly used techniques of opacity validation for deterministic models and opacity quantification for probabilistic ones. Available complexity results are also provided. Finally, we review existing tools for opacity validation and current applications.

Maximum Information Release While Ensuring Opacity in Discrete Event Systems

Opacity is important in investigating secrecy, privacy, and other properties in general systems that can be modeled as discrete event systems. To ensure opacity, a controller may be used to control information released to the public. For transparency and other reasons, it is often desired that the information released to the public be maximum, as long as opacity is not violated. In this paper, we investigate how to release the maximum information while ensuring opacity. We find a necessary and sufficient condition for an information release policy to ensure opacity. We also develop methods and algorithms to design a controller that releases maximum information. We consider both strong opacity and weak opacity. We apply the results to the dining cryptographers problem.

Opacity of Discrete Event Systems: models, validation and quantification

Abstract: Over the last decade, opacity of discrete event systems (DES) has become a very fertile field of research. Driven by safety and privacy concerns in network communications and online services, much theoretical work has been conducted in order to design opaque systems. A system is opaque if an external observer in unable to infer a secret about the system behavior. This paper aims to review the most commonly used techniques of opacity validation for deterministic models and opacity quantification for probabilistic ones. Available complexity results are also provided. Finally, we review existing tools for opacity validation and current applications.

Ensuring Privacy in Location-Based Services: An Approach Based on Opacity Enforcement

With the proliferation of mobile devices, Location-Based Services (LBS) that provide networked services based on users' locations have become increasingly popular. Such services, providing personalized and timely information, have raised privacy concerns such as unwanted revelation of users' current locations to potential stalkers. Many prior studies have proposed to address LBS privacy by sending “cloaking queries” that contain coarser location information. However, this method has been shown to be insufficient and no formal methodology exists for enforcing LBS privacy in mobile environments. In this work, we show that this problem can be formally addressed using the notion of opacity in discrete event systems. We use non-deterministic finite-state automata to capture the mobility patterns of users and label the transitions by the location information in the queries. Using opacity verification techniques, we show that the technique of sending cloaking queries to the server can still reveal the exact location of the user. To enforce location privacy, we apply the opacity enforcement technique by event insertion proposed in our prior work. Specifically, we synthesize suitable insertion functions that insert fake queries into the cloaking query sequences. The generated fake queries are always consistent with the mobility model of the user and provably ensure privacy of the user's current location. Finally, to minimize the overhead from fake queries, we design an optimal insertion function that introduces minimum average number of fake queries.