{'fraction_non_alphanumeric': 0.03518608023199613, 'fraction_numerical': 0.006863218946350894, 'mean_word_length': 4.62867247007617, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 2, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Towards Provably Secure Encrypted Control Using Homomorphic Encryption

Encrypted control is a promising method for the secure outsourcing of controller computation to a public cloud. However, a feasible method for security proofs of control has not yet been developed in the field of encrypted control systems. Additionally, cryptography does not consider certain types of attacks on encrypted control systems; therefore, the security of such a system cannot be guaranteed using a secure cryptosystem. This study proposes a novel security definition for encrypted control under attack for control systems using cryptography. It applies the concept of provable security, which is the security of cryptosystems based on mathematical proofs, to encrypted control systems. Furthermore, this study analyzes the relation between the proposed security and the conventional security of cryptosystems. The results of the analysis demonstrated that the security of an encrypted control system can be enhanced by employing secure homomorphic encryption.


I. INTRODUCTION
The encrypted control method is based on the homomorphism of cryptosystems that enables implementation of controller computation in an encrypted manner [1]- [4]. The controller parameters and inputs/outputs of an encrypted controller are encrypted against attackers originating outside the closed-loop system. This control method can be implemented for the secure outsourcing computation of controllers to a public cloud because the control inputs are computed without using a decryption key.
Although encrypted control is a promising method for secure control, research on the security of encrypted control systems remains limited. In most of the previous studies, an encrypted control system was assumed to be secure if the underlying cryptosystem was secure. However, certain attacks against encrypted control systems are not considered in cryptography. Fig. 1(a) depicts a typical situation in standard signal encryption. Alice encrypts a message and transmits the encrypted message to Bob, who decrypts it. Eve, an attacker, intercepts the encrypted data and tries to recover it. Eve eavesdrops on the input and output of the encrypted controller while attacking the encrypted control system, as shown in Fig. 1(b). This is because control systems are typically closed-loop systems. In this case, Eve's objective is not necessary to obtain the original controller input and output. For example, Eve may attempt to recover an encrypted controller parameter from encrypted messages. This objective may be achievable even if Eve fails to decrypt the encrypted input and output. Although this type of attack on encrypted control systems is fairly common, it is not considered in standard cryptosystems, including the ElGamal encryption [5] and Paillier encryption [6], which are widely used for encrypted control. Therefore, using a secure cryptosystem does not necessarily mean that an encrypted control system is secure.
Furthermore, the definition of security for encrypted control systems is ambiguous, and the types of attacks against the systems are not clearly defined. Meanwhile, the security of cryptosystems has been mathematically defined and analyzed in the field of cryptography [7]. One of the security approaches, called provable security, is formulated based on the objectives and capabilities of the attackers. Additionally, it is proved under some assumptions of computational complexity. More precisely, the security is usually demonstrated using proof by contradiction, namely if there exists an algorithm to break a cryptosystem, then a practically difficult computational problem can be efficiently solved by using the algorithm. This proof construction is called the reductionist approach and is fundamental in proving the security of modern cryptosystems. The security of encrypted control systems can be clarified and formally analyzed by applying a similar security definition and proof construction. Consequently, the standard security definition of cryptosystems must be expanded to encompass the specific attacks for encrypted control systems because the attack scenarios considered in cryptography and control systems vary significantly. Some studies have already applied cryptographic security to encrypted control protocols. The privacy of cloud-based optimization, model predictive control, and state estimation is achieved through the computational indistinguishability of two random ensembles [8]- [10], and that of distributed and cooperative controls is achieved based on a cryptographic game [11], [12]. However, the guaranteed privacy of the aforementioned studies is based on the input/output privacy of the systems rather than a controller parameter and is provided for specific protocols.
This study proposes a novel security definition of encrypted control systems under a parameter estimation attack via a game based on a cryptographic security notion. In a parameter estimation attack, an attacker attempts to disclose the original controller parameter of an encrypted controller from multiple data of encrypted input and output. The proposed security is defined as an attacker obtaining no information about a controller parameter by the attack. Additionally, we analyze the relation of the proposed security to the standard security of cryptosystems. Contrary to the existing studies [8]- [12], this study aims to expand the application of security notion in cryptography to encrypted control systems. Moreover, it contributes to the establishment of a methodology of security proofs for general encrypted control. The proposed security definition allows for the analysis of the security of a broader encrypted control system under a parameter estimation attack. The analysis of this study clarifies the strength of the proposed security. It is shown that the proposed security is weaker than or equal to the standard security of cryptosystems. This implies that a secure encrypted control system under the attack can be realized using a secure cryptosystem that satisfies the standard cryptographic security. In addition, this study discusses a condition in which the proposed security is as secure as the standard cryptosystem security. The condition suggests that the proposed security for most controls may be achievable by a simple and lightweight scheme rather than a cryptosystem that satisfies the standard security.
The remainder of this paper is organized as follows. Section II introduces homomorphic encryption and encrypted control employed in this study. In addition, the concept of provable security in cryptography is provided. Section III proposes a novel security definition for encrypted control and presents the analysis results. Section IV presents the scope for further development of the proposed security definition. Section V presents the conclusions and future work.

A. Notation
The set of real numbers is denoted by R. The sets of ndimensional column-vectors and m-by-n matrices of which elements belong to a set X are denoted by X n and X m×n , respectively. An algorithm A is polynomial-time algorithm if there exists a polynomial p such that, for every k-bit length input x, A(x) terminates within at most p(k) steps [7]. We say a function : {1, 2, 3, . . . } → R is negligible if, for every positive integer c > 0, there exists an integer N such that | (n)| < n −c holds for all n > N [7].

B. Homomorphic encryption
This section summarizes the basics of homomorphic encryption. Homomorphic encryption is a cryptosystem that enables the application of arithmetic over a ciphertext space. The definition of a cryptosystem is as follows.
Definition 1 (Cryptosystem [13]): A cryptosystem is defined as a tuple Π = (KeyGen, Enc, Dec), which satisfies the following properties: • KeyGen : S → K is a key-generation function that determines keys (pk, sk) ∈ K from a security parameter λ ∈ S, where K is a key space, and S is a set of security parameters. • Enc pk : M → C is an encryption function that outputs a ciphertext c ∈ C from a plaintext m ∈ M, where M is a plaintext space, and C is a ciphertext space. • Dec sk : C → M is a decryption function that outputs a plaintext m ∈ M from a ciphertext c ∈ C. • For any pk, there exists sk such that Dec sk (Enc pk (m)) = m for all m ∈ M. Further, we often say Π is symmetric-key encryption if pk = sk; otherwise it is public-key encryption.
Homomorphic encryption is defined as follows.
Homomorphic encryption is classified based on the allowed arithmetic, into additive, multiplicative, somewhat, and fully homomorphic encryption. The additive and multiplicative homomorphic encryption satisfy Dec sk (Enc pk (m)⊕ Enc pk (m )) = m + m and Dec sk (Enc pk (m) ⊗ Enc pk (m )) = mm , respectively. Somewhat homomorphic encryption can perform the arithmetic ⊕ and ⊗ only a limited number of times. Fully homomorphic encryption allows the computation of any number of arbitrary arithmetic.

C. Encrypted control
Various encrypted control frameworks have been proposed in conventional works according to the controller type, such as static output feedback [2], cooperative control [12], [14], and model predictive control [15], [16]. However, this study does not assume a specific type of controller to be encrypted. A controller is considered as a map from a plant output to the control input to analyze the cryptographic security for as broad a class of encrypted controllers as possible.
Definition 3 (Encrypted control): Given a control law where u ∈ M q is a control input, y ∈ M is a plant output, and K ∈ M r is a controller parameter. Let Π be homomorphic encryption in Definition 2. We say a map f Π is an encrypted control law of f with Π if Dec sk (f Π (Enc pk (y); Enc pk (K)) = f (y; K) holds, where for a plaintext vector m = [m 1 · · · m k ] ∈ M k and ciphertext vector c = [c 1 · · · c n ] ∈ C n the encryption and decryption functions perform each element of the vectors, namely Enc pk (m) = [Enc pk (m 1 ) · · · Enc pk (m k )] and Dec sk (c) = [Dec sk (c 1 ) · · · Dec sk (c n )] .
Remark 1: In practice, y and K are given by real-valued vectors, and M is not necessarily the same as R. Therefore, the elements of y and K must be encoded into plaintext before encryption [2], [17], [18]. This encoding process is omitted in this study because it is focused on the cryptographic properties of the encrypted controls.

D. Provable Security
The security of modern cryptosystems is demonstrated through mathematical proofs using the model of an attacker, and the security proved by such formal procedures is called provable security. A popular method to define the security is a game between an attacker and a challenger. The game simulates a situation in which an attacker attempts to break a cryptosystem using an oracle, which is a black box that outputs an ideal response for an input. The oracle represents the capabilities of the attacker. It should be noted that specific attack methodologies for cryptosystems, such as brute-force and side-channel attacks, are not considered in provable security. In the framework of provable security, attackers are considered as probabilistic polynomial-time algorithms.
This section introduces indistinguishability under chosen plaintext attack (IND-CPA), which is a traditional security concept for public-key encryption, as an example of provable security.
• Setup: The challenger computes keys pk and sk from a security parameter λ using the key-generation function KeyGen and gives pk to the attacker (Line 1). Remark 2: Public-key encryption must at least satisfy the IND-CPA security to be used for secure communication. If the advantage of the attacker is not negligible, he/she can guess the encrypted message with a significant probability.

III. PROVABLE SECURITY FOR ENCRYPTED CONTROL
This section proposes a novel security notion of encrypted control based on the traditional provable-security notion in cryptography and reveals the relationship between the notions.

A. Indistinguishability against parameter estimation attack
This study considers an attack scenario in which an attacker attempts to estimate the controller parameters from the ciphertexts of the controller inputs and outputs. The indistinguishability for encrypted control against the attack can be defined as follows.
Definition 5 (IND-PEA): Let Π = (KeyGen, Enc, Dec) be homomorphic encryption, and let f Π be an encrypted control law of (1) with Π. Define a game between an attacker B = (B 1 , B 2 ) and a challenger as follows.
The challenger computes keys pk and sk from a security parameter λ using the key-generation function KeyGen and gives pk to the attacker (Line 1). • Challenge: The attacker computes two different parameters K 0 , K 1 ∈ M r , which are of identical size, and an intermediate state σ using the polynomial-time algorithm B 1 (Line 2). The attacker gives K 0 and K 1 to the challenger. The challenger randomly selects a bit b ∈ {0, 1} and computes a ciphertext c K of K b using the encryption function Enc with pk (Lines 3-4). The challenger sets c K to the encrypted controller.  It should be noted that the oracle to be used by an attacker indicates that encrypted control is provided as a cloud service. Most studies conducted on encrypted control consider cloud-based control systems [8], [15], [16], [19]- [21], and in such cases, an attacker can freely use an encrypted control algorithm. Therefore, the use of the oracle in the IND-PEA game is reasonable when considering the security for the encrypted control.

B. Relationship between the security notions
The security of encrypted control can be demonstrated using mathematical proofs based on the definition of IND-PEA security. Furthermore, it gives the other benefit of discussing how much security strength is required to achieve secure encrypted control. The following theorems disclose the relation between the IND-PEA security and IND-CPA security and clarify the security strength of the IND-PEA security.
Theorem 1: Let Π be homomorphic encryption and let f Π be an encrypted control law of (1) with Π.
Proof: It is proved that if f Π is not IND-PEA secure, Π is not IND-CPA secure. Define polynomial-time algorithms A 1 and A 2 as follows. in Definition 4, we obtain the following game.
Game Π,f,B : • Setup: This phase is identical to the setup phase in Definition 4. The theorem demonstrates that the IND-PEA security is weaker than or equal to the IND-CPA security. This implies that secure encrypted control against the parameter estimation attack is achievable by using secure homomorphic encryption. The following theorem presents one of the conditions so that the IND-PEA security is equivalent to the IND-CPA security.
Theorem 2: Let Π be homomorphic encryption and let f Π be an encrypted control law of (1) with Π. Suppose f in (1) is bijective for a fixed y ∈ M . If f Π is IND-PEA secure and if the attacker can compute an encrypted control law of f −1 with Π, then Π is IND-CPA secure.
Proof: Under the assumptions, we prove that if Π is not IND-CPA secure, f Π is not IND-PEA secure. Let f −1 Π be an encrypted control law of f −1 with Π. Since f in (1) is bijective for some fixed y ∈ M , it follows that f −1 (y; f (y; K)) = K for all K ∈ M r . Moreover, holds for c y = Enc pk (y) and c K = Enc pk (K). Define polynomial-time algorithms B 1 and B 2 as follows.
in Definition 5, we obtain the following game.
• Setup: This phase is identical to the setup phase in Definition 5. • Challenge: The attacker computes two different plaintexts K 0 , K 1 ∈ M, which are of identical size, and an intermediate state σ using the polynomial-time algorithm A 1 (Line 2). Subsequently, the attacker constructs vectors K 0 , K 1 ∈ M r from K 0 , K 1 and gives them to the challenger (Line 3). Additionally, the attacker fixes y ∈ M to satisfy (2) and updates σ to (σ, y) (Lines 4-5). The challenger randomly selects a bit b ∈ {0, 1} and computes a ciphertext c K of K b using the encryption function Enc with pk (Lines 6-7). The challenger sets c K to the encrypted controller. • Guess: The attacker takes out the intermediate state and y from σ and computes the ciphertext c y of y (Lines 8-9). Subsequently, the attacker queries the encrypted control oracle O to obtain a controller output c u and computes a ciphertextĉ K by using the encrypted controller of f −1 with Π (Line 10-11). The attacker guesses the parameter that has been encrypted from the first element c K of the ciphertext vectorĉ K using the polynomial-time algorithm A 2 and outputs a bit b ∈ {0, 1} (Line 11-12). Ifb = b, the attacker wins the game; otherwise, the challenger wins. Define the advantage of the attacker in the game Game 1 Π,f,A as Adv 1 Π,f,A := Pr b = b | Game 1 Π,f,A − 1/2 . Furthermore, we modify lines 3-5 and 7-11 of Game 1 Π,f,A to obtain the following game. is not negligible, and so f Π is not IND-PEA secure.
Note that few controllers can satisfy the assumption in Theorem 2 in practice. For example, in a static output feedback controller u = F y, where F ∈ M q× is a feedback gain, the existence of inverse mapping f −1 in Theorem 2 is equivalent to the condition that q = r, namely = 1. Such a controller is a particular case of this control, and hence, it seems that the IND-PEA security is weaker than the IND-CPA security for most of the controllers formulated by (1). Although one may think that this is a negative result, it suggests that homomorphic encryption satisfying IND-CPA security may not necessarily be required to prevent the parameter estimation attack. In other words, the IND-PEA security might be achieved using more lightweight homomorphic encryption schemes than the conventional schemes to reduce the computation costs. This implication is significant because encrypted control generally increases computational costs, and control systems require real-time computation.

IV. FURTHER DEVELOPMENT
The security definition and analysis presented in this study were based on the assumption that the control law (1) was employed. Although the control law represents all static controllers with a controller parameter K, there is scope for further expansion. The results of this study can be expanded upon using a dynamical controller x t+1 = f (x t , y t ; K), u t = g(x t , y t ; K), a time-varying controller u t = f (y t ; K t ) instead of (1), where x is a controller state, and t is a time step. According to this change, the encrypted control oracle must be modified.
For example, the modified oracle for the dynamical controller must include a state updated by each query of an attacker and return an output based on the current state and input. Note that the oracle state is hidden against the attacker. The security of dynamical controllers under a parameter estimation attack requires to be analyzed while considering the state trajectory of the controller because the controller output depends on both the controller state and the parameter. Such analysis is challenging because it needs to consider the effect of fundamental properties of dynamical systems, such as stability, controllability, and observability, on the provable security for encrypted control. Moreover, an attacker may aim to disclose the (initial) state of an encrypted dynamical controller. In this case, the security is defined through a game that differs from the IND-PEA game.
Furthermore, the security of controllers formulated by stochastic processes such as a Markov decision process can also be considered. An example of this type of controller is reinforcement learning, which is an application of encrypted control [21]. In this case, the state of the environment randomly moves in each time step, and an action, which is an input for the environment, is determined by a policy that maximizes the expected cumulative reward. An attacker for an agent of reinforcement learning may be interested in the policy rather than the controller parameter. Further research on provably secure encrypted control involves considering such stochastic controllers.

V. CONCLUSIONS
This study defined a novel security for encrypted control under a parameter estimation attack in terms of provable security in cryptography and analyzed its security strength.
The definition enables us to prove the security for encrypted control by mathematical procedures. The analysis revealed that encrypted control is secure if homomorphic encryption used for the control is secure. This result means that most existing encrypted controls are secure under a parameter estimation attack. The proposed security can be extended in the future to encrypted control using dynamical controllers.