Verification Of Opacity Research Articles

Verification of Current-State Opacity in Time Labeled Petri Nets With Its Application to Smart Houses

Verification of Current-State Opacity in Time Labeled Petri Nets With Its Application to Smart Houses

Quantifying opacity of discrete event systems modeled with probabilistic Petri nets

The verification and enforcement problem of opacity that falls into the category of security properties of information flows in a cyber-physical system has been extensively studied from the view of discrete event systems. Recent years have witnessed growing interest in the quantitative analysis of opacity. However, documented results on quantifying opacity in the literature are not formulated within the framework of Petri nets. By introducing a new class of Petri net as a modeling vehicle for opacity quantification, we suggest a novel notion of opacity referred to as worthy opacity, which describes the worth associated with the information that a system might leak during its evolution. Depending on how much system information is captured by an intruder, we propose two types of worthy opacity: stepwise and observational worthy opacity. We provide a necessary and sufficient condition for stepwise worthy opacity and prove its decidability. Observational worthy opacity is established by considering both system and observation aspects, with its verification shown to be undecidable. Compared with the existing works on quantifying opacity, we argue that the worthy opacity is of practical concern, as being aware of the information worth that a system may leak during its evolution is a more realistic guide than the probability that it may reveal a system secret.

STP-based verification and synthesis of state opacity for logical finite state machines

Finite-state machines are among the most important models for studying the logical dynamic behavior of cyber–physical systems, and their security and privacy are urgent problems to be solved at present. This paper explores the state-opacity-based privacy verification and synthesis problems for finite-state machines from an algebraic perspective. First, the dynamics of a finite-state machine can be established as an algebraic expression using the semi-tensor product of matrices. Beginning with this novel representation, we propose an algebraic criterion to verify whether the privacy state is opaque to intruders. Subsequently, we investigate the opacity-enhancement synthesis problem from two perspectives. On one hand, we design a feedback supervisory controller by disabling controllable events such that the closed-loop system is opaque with respect to privacy states; on the other hand, we investigate the editing of an observable function simply by assigning specific events in the observation channel instead of changing the transition behavior of the system. We observe that these synthesis problems can be addressed by calculating a system of algebraic equations, and we further develop two algorithms to obtain the controller or function. Finally, an interesting example is presented to demonstrate the validity of the proposed algebraic method. Taken together, these results are conducive to a systematic understanding of privacy enhancement problems.

Verification of Current-State Opacity in Discrete Event Systems by Using Basis Coverability Graphs

A new approach to the verification of current-state opacity for discrete event systems is proposed in this paper, which is modeled with unbounded Petri nets. The concept of opacity verification is first extended from bounded Petri nets to unbounded Petri nets. In this model, all transitions and partial places are assumed to be unobservable, i.e., only the number of tokens in the observable places can be measured. In this work, a novel basis coverability graph is constructed by using partial markings and quasi-observable transitions. By this graph, this research finds that an unbounded net system is current-state opaque if, for an arbitrary partial marking, there always exists at least one regular marking in the result of current-state estimation with respect to the partial marking not belonging to the given secret. Finally, a sufficient and necessary condition is proposed for the verification of current-state opacity. A manufacturing system example is presented to illustrate that the concept of current-state opacity can be verified for unbounded net systems.

Verification and enforcement of current-state opacity based on a state space approach

In this study, the current-state opacity verification and enforcement problems in the context of partially-observed discrete event systems are investigated based on an algebraic state space approach. Current-state opacity is defined as a measure of whether a system can protect current vital information from exposure. If given systems are not current-state opaque, it is necessary to synthesize a supervisor to restrict systems’ behavior and enforce the property. In this paper, the algebraic-state-space-based approach to these problems provides a novel perspective to the literature. Firstly, an equivalent algebraic structure of a partially-observed finite automaton is established with the help of the semi-tensor product, where the complexity of an observable structure matrix is O(|X|2|Eo|) (X is the set of states and Eo is the set of observable events). And then, using the breadth-first search method, an algorithm to ascertain the state estimate is proposed based on the observable structure matrix, the complexity of which is O(|X|3|Eo|). For the verification of current-state opacity, it is carried out by determining whether or not there exists a leaking state estimate in the set of secret-related state estimates. In the worst case, this process would be done in O(2|X|). For the enforcement of opacity, the algebraic expression of a controlled system is also constructed, under which, the breadth-first search approach can still be applied to ascertain state estimates under each control profile. How to obtain all permissive control profiles is summarized as Algorithm 2, the complexity of which is O(2|E|×|X|3×|Eo|+2|X|).

Symbolic Verification of Current-State Opacity of Discrete Event Systems Using Petri Nets

Given a discrete event system, it is said to be opaque if an intruder who can partially observe system behavior cannot infer that the system is necessarily in a predefined secret. A discrete event system is current-state opaque if an intruder is never able to verify whether the current state of the system is within the secret states. This article addresses the verification of current-state opacity of a discrete event system modeled with Petri nets, where the secret is defined as a set of states. The existing methods cannot deal with large-sized systems due to the curse of dimensionality. Multi-valued decision diagrams (MDDs) are widely accepted as an efficient and compact data structure for representing the extremely large reachability sets of Petri nets. We show that MDDs can be used in Petri nets with partial observable transitions and propose an approach for the verification of current-state opacity for bounded Petri nets. It is shown by experimental studies that the symbolic approach is practically more efficient than traditional techniques such as basis reachability graphs (BRGs).

Modularising Verification Of Durable Opacity

Non-volatile memory (NVM), also known as persistent memory, is an emerging paradigm for memory that preserves its contents even after power loss. NVM is widely expected to become ubiquitous, and hardware architectures are already providing support for NVM programming. This has stimulated interest in the design of novel concepts ensuring correctness of concurrent programming abstractions in the face of persistency and in the development of associated verification approaches. Software transactional memory (STM) is a key programming abstraction that supports concurrent access to shared state. In a fashion similar to linearizability as the correctness condition for concurrent data structures, there is an established notion of correctness for STMs known as opacity. We have recently proposed durable opacity as the natural extension of opacity to a setting with non-volatile memory. Together with this novel correctness condition, we designed a verification technique based on refinement. In this paper, we extend this work in two directions. First, we develop a durably opaque version of NOrec (no ownership records), an existing STM algorithm proven to be opaque. Second, we modularise our existing verification approach by separating the proof of durability of memory accesses from the proof of opacity. For NOrec, this allows us to re-use an existing opacity proof and complement it with a proof of the durability of accesses to shared state.

First Experimental Verification of Opacity for the Lightning Near‐Infrared Spectrum

AbstractUsing the spectral data of a lightning continuing discharge process observed on the 600‐m‐high Canton Tower, experimental verification of the optical thickness of lightning neutral nitrogen (NI) and neutral oxygen (OI) radiation in the near‐infrared spectrum is presented first by comparing the measured relative intensities of two NI multiplets with theoretical values. For the first time, the spectral evolution characteristics of the tall structure lightning continuing discharge process show that visible band singly ionized lines were apparent for approximately 320–400 µs. The ionized lines with higher excitation energies and the neutral lines with lower excitation energies coexist for approximately 240–320 µs, which means that there is a hot region radiating ionized lines in a radial direction from the lightning channel, but at the same time there is also a cold region radiating neutral lines.

A framework for current-state opacity under dynamic information release mechanism

Opacity is an important information-flow security property that characterizes the plausible deniability of a dynamic system for its “secret” against eavesdropping attacks. As an information-flow property, the underlying observation model is the key in the modeling and analysis of opacity. In this paper, we investigate the verification of current-state opacity for discrete-event systems under Orwellian-type observations, i.e., the system is allowed to re-interpret the observation of an event based on its future suffix. First, we propose a new Orwellian-type observation model called the dynamic information release mechanism (DIRM). In the DIRM, when to release previous “hold on” events is state-dependent. Then we propose a new definition of opacity based on the notion of history-equivalence rather than the standard projection-equivalence. This definition is more suitable for observations that are not prefix-closed. Finally, we show that by constructing a new structure called the DIRM-observer, current-state opacity can be effectively verified under the DIRM. Computational complexity analysis as well as illustrative examples for the proposed approach is also provided. Compared with the existing Orwellian-type observation model, the proposed framework is more general in the sense that the information-release-mechanism is state-dependent, information is partially released and the corresponding definition of opacity is more suitable for non-prefix-closed observations.

State-Labeled Safety Analysis of Modular Observers for Opacity Verification

Verification of opacity and anonymity for modular systems is in this paper formulated as safety analysis of local observers with state labels. A unified modeling strategy is presented based on a generalized synchronous composition, including both shared and non-shared state labels. The proposed modeling approach is shown to be flexible and general, making it possible to solve both local, global, and arbitrarily joint secret state problems simultaneously. A scalable modular n-floor, m-elevator security benchmark problem is also formulated and evaluated by two powerful safety analysis methods. It is shown that current-state opacity for non-trivial complex systems involving more than 1025 observer states can be verified in about one second.

Modular Verification of Opacity for Interconnected Control Systems via Barrier Certificates

In this letter, we consider the problem of verifying initial-state opacity for networks of discrete-time control systems. We formulate the opacity property as a safety one over an appropriately constructed augmented system, and aim to verify this latter property by finding suitable barrier certificates. To reduce the computational complexity associated with computing barrier certificates for large networks, we propose a compositional approach to construct such barrier certificates for large-scale interconnected systems. This is achieved by introducing local barrier certificates for subsystems in the network and imposing some small-gain type conditions on the gains of those local barrier certificates. We also provide sufficient conditions for verifying the lack of opacity in large-scale networks by constructing barrier certificates ensuring some reachability properties over the augmented systems. To illustrate the effectiveness of our results, we consider the problem of tracking a target using a team of vehicles and verify if its initial position is secret from possible outside intruders.

Verification of Approximate Opacity via Barrier Certificates

This paper is motivated by the increasing security concerns of cyber-physical systems. Here, we develop a discretization-free verification scheme targeting an information-flow security property, called approximate initial-state opacity, for the class of discrete-time control systems. We propose notions of so-called augmented control barrier certificates in conjunction with specified regions of interest capturing the initial and secret sets of the system. Sufficient conditions for (the lack of) approximate initial-state opacity of discrete-time control systems are proposed based on the existence of the proposed barrier certificates. We further present an efficient computation method by casting the conditions for barrier certificates as sum-of-squares programming problems. The effectiveness of the proposed results is illustrated through two numerical examples.

Verification of approximate opacity for switched systems: A compositional approach

The security in information-flow has become a major concern for cyber–physical systems (CPSs). In this work, we focus on the analysis of an information-flow security property, called opacity. Opacity characterizes the plausible deniability of a system’s secret in the presence of a malicious outside intruder. We propose a methodology of checking a notion of opacity, called approximate opacity, for networks of discrete-time switched systems. Our framework relies on compositional constructions of finite abstractions for networks of switched systems and their approximate opacity-preserving simulation functions. Those functions characterize how close concrete networks and their finite abstractions are in terms of the satisfaction of approximate opacity. We show that such simulation functions can be obtained compositionally by assuming some small-gain type conditions and composing local simulation functions constructed for each switched subsystem separately. Additionally, assuming certain stability property of switched systems, we also provide a technique on constructing their finite abstractions together with the corresponding local simulation functions. Finally, we illustrate the effectiveness of our results through an example.

Security and privacy with opacity‐based state observation for finite state machine

AbstractTopics on security and privacy are very fundamental and important in the Internet of Things (IoT). In this paper, we explore the impact of state observation on the opacity of IoT, which is modeled by Moore‐type finite state machine. Firstly, to characterize the intrusion estimator under the event‐state observation, a multi‐linear algebraic expression is proposed through the Boolean semi‐tensor product (STP), and on the basis of the novel representation, the validation criterion is given by some matrix manipulations. Subsequently, considering that the input information may not be measured due to the physical shielding of the system against external intruders, we continue to discuss the opacity with state observation by a permutation structure matrix. Meanwhile, the verification of opacity with event‐state observation is generalized to the one with only state observation. Finally, we offer an example to illustrate the effectiveness of the newly proposed method. Taken together, the current results are helpful to provide a novel theoretical approach for investigating the privacy‐preserving problem in the area of IoT and complex cyber‐physical networks.

Matrix Approach for Verification of Opacity of Partially Observed Discrete Event Systems

Opacity is a confidential property characterizing whether the secret of a system can be inferred or not by an outside observer (also called an intruder). This paper focuses on presenting a matrix-based approach for verification of opacity of nondeterministic discrete event systems (DESs). Firstly, the given system is modeled as a finite-state automaton. Further, based on Boolean semi-tensor product (BSTP) of matrices, the algebraic expression of the observable dynamic of the system can be obtained. We, respectively, investigate current-state opacity and K-step opacity owing to the equivalence between a few opacity properties. Finally, necessary and sufficient conditions are presented to verify whether the secret is opaque for a given system, and the proposed methodology is tested effectively by examples. The matrix-based characterization of opacity proposed in this paper may provide a helpful angel for understanding the structure of this property.

On Opacity Verification for Discrete-Event Systems

Abstract Opacity is an information flow property characterizing whether a system reveals its secret to an intruder. Verification of opacity for discrete-event systems modeled by automata is in general a hard problem. We discuss the question whether there are structural restrictions on the system models for which the opacity verification is tractable. We consider two kinds of automata models: (i) acyclic automata, and (ii) automata where all cycles are only in the form of self-loops. In some sense, these models are the simplest models of (deadlock-free) systems. Although the expressivity of such systems is weaker than the expressivity of linear temporal logic, we show that the opacity verification for these systems is still hard.

Opacity of Nondeterministic Transition Systems: A (Bi)Simulation Relation Approach

In this paper, we propose several opacity-preserving (bi)simulation relations for general nondeterministic transition systems (NTS) in terms of initial-state opacity, current-state opacity, K-step opacity, and infinite-step opacity. We also show how one can leverage quotient construction to compute such relations. In addition, we use a two-way observer method to verify opacity of nondeterministic finite transition systems (NFTSs). As a result, although the verification of opacity for infinite NTSs is generally undecidable, if one can find such an opacity-preserving relation from an infinite NTS to an NFTS, the (lack of) opacity of the NTS can be easily verified over the NFTS which is decidable.

On-line verification of initial-state opacity by Petri nets and integer linear programming

This paper deals with a problem related to the observability of discrete event systems: the initial-state opacity. Given a set of system states (the secret), a system observation is called initial-state opaque if an agent (named intruder), who can partially observe the system, cannot determine whether the set of initial states consistent with an event sequence is included in the secret. Such a character can describe security problems in cyber-infrastructures, such as Internet and mobile communication networks or national defense service systems. This work presents a novel on-line methodology to verify the notion of initial-state opacity of discrete event systems that are modeled by labeled Petri nets. By working on-line, the intruder records an event and exploits integer linear programming problem for checking the initial-state opacity of the system’s evolution under the given observation. A set of examples are shown to shed light on the efficiency of the presented methodology.

Infinite-step opacity and [formula omitted]-step opacity of stochastic discrete-event systems

Opacity is an important information-flow property that arises in security and privacy analysis of cyber–physical systems. Among many different notions of opacity, K-step opacity requires that the intruder can never determine unambiguously that the system was at a secret state for any specific instant within K steps prior to that particular instant. This notion becomes infinity-step opacity when K goes to infinity. Existing works on the analysis of infinite-step opacity and K-step opacity only provide a binary characterization, i.e., a system is either opaque or non-opaque. To analyze infinite-step and K-step opacity more quantitatively, in this paper, we investigate the verification of infinite-step and K-step opacity in the context of stochastic discrete-event systems. A new notion of opacity, called almost infinite-step opacity (respectively, almost K-step opacity), is proposed to capture whether or not the probability of violating infinite-step opacity (respectively, K-step opacity) is smaller than a given threshold. We also provide effective algorithms for the verification of almost infinite-step opacity and almost K-step opacity.

The Complexity of Diagnosability and Opacity Verification for Petri Nets

Diagnosability and opacity are two well-studied problems in discrete-event systems. We revisit these two problems with respect to expressiveness and complexity issues. We first relate different notions of diagnosability and opacity. We consider in particular fairness issues and extend the definition of Germanos et al. [ACM TECS, 2015] of weakly fair diagnosability for safe Petri nets to general Petri nets and to opacity questions. Second, we provide a global picture of complexity results for the verification of diagnosability and opacity. We show that diagnosability is NL-complete for finite state systems, PSPACE-complete for safe Petri nets (even with fairness), and EXPSPACE-complete for general Petri nets without fairness, while non diagnosability is inter-reducible with reachability when fault events are not weakly fair. Opacity is ESPACE-complete for safe Petri nets (even with fairness) and undecidable for general Petri nets already without fairness.