Remote State Estimation in the Presence of an Eavesdropper · Remote State Estimation in the...

Remote State Estimation in the Presence of anEavesdropper

Alex Leong

Paderborn University

Workshop on Information and Communication Theoryin Control Systems, TUM, May 2017

Alex Leong (Paderborn University) State Estimation with an Eavesdropper TUM, May 2017 1 / 28

A lot of data is transmitted wirelessly nowadaysIn wireless transmission, other people in the vicinity can oftenoverhear youThe need to protect data from eavesdroppers has becomeincreasingly important

Alice Bob

Eve


Introduction

Outline

1 Introduction

2 System Model

3 Optimal Transmission Scheduling

4 Infinite Horizon

5 An Alternative Measure of Security

6 Numerical Studies

7 Conclusion


Introduction

Introduction

Information security traditionally studied in the context ofcryptographyHowever:

I Wireless devices have limited computational power, may not beable to implement strong encryption

I Malicious agents have increasingly powerful computationalcapabilities

I Security on some devices poorly implemented

Recent interest in alternative and complementary ways toimplement security using information theoretic and physical layertechniques1

1“Special Issue on Secure Communications via Physical-Layer andInformation-Theoretic Techniques”, Proc. IEEE, Oct. 2015


Introduction

Introduction

Information theoretic security – dates back to the work of ClaudeShannon in the 1940sA communication system is regarded as secure in informationtheoretic sense if the mutual information between originalmessage and what eavesdropper receives is either zero or goesto zero as the coding blocklength increasesPhysical layer security – ways to implement information theoreticsecurity using physical layer characteristics of the wirelesschannel,2 e.g. fading, interference, noiseHere interested in security in estimation and control

2Zhou, Song, Zhang, “Physical Layer Security in Wireless Communications”, 2014Alex Leong (Paderborn University) State Estimation with an Eavesdropper TUM, May 2017 5 / 28

Introduction

Introduction (Related Work)

Some previous work on estimation problems with eavesdroppersMinimize average mean squared error (MSE) at receiver whilekeeping MSE at eavesdropper above a certain level3 4 5

These works deal with estimation of either constants or i.i.d.sourcesCurrent work – State estimation of dynamical systems in thepresence of an eavesdropper

3Aysal, Barner, IEEE Trans. Inf. Forensics Security, 20084Reboredo, Xavier, Rodrigues, IEEE Trans. Signal Process., 20135Guo, Leong, Dey, IEEE Trans. Aerosp. Electron. Syst., 2017


Introduction

Introduction (Related Work)

Our work deals with passive attacks from eavesdroppersEstimation and control problems in the presence of active attacksalso studied6 7 8 9

6Fawzi, Tabuada, Diggavi, IEEE Trans. Autom. Control, 20147Teixeira, Shames, Sandberg, Johansson, Automatica, 20158Mo, Sinopoli, IEEE Trans. Autom. Control, 20159Li, Quevedo, Dey, Shi, IEEE Trans. Control Netw. Syst., 2017


System Model

Outline

1 Introduction

2 System Model


4 Infinite Horizon


6 Numerical Studies

7 Conclusion


System Model

System Model

RemoteEstimator

SensorSystem

Eavesdropper

Feedback

Process: xk+1 = Axk + wk

Sensor measurements: yk = Cxk + vk

Sensor runs local Kalman filter to compute local estimates x̂sk |k

Local estimates sent to remote estimatorTransmit decisions: νk = 1 if x̂s

k |k is to be transmitted to remoteestimator at time k , νk = 0 otherwiseνk computed at the remote estimator and fed back to the sensor


System Model

System Model

RemoteEstimator

SensorSystem

Eavesdropper

Feedback

Transmissions occur over random packet dropping linksPacket drops modelled by i.i.d. Bernoulli process {γk}, withpacket reception probability P(γk = 1) = λ.Sensor transmissions can be overheard by eavesdropper overanother packet dropping link: γe,k = 1 if sensor transmissionoverheard by eavesdropper, γe,k = 0 otherwiseAssume {γe,k} is i.i.d. Bernoulli process with eavesdroppingprobability P(γe,k = 1) = λe.


System Model

System ModelAt remote estimator:

x̂k |k =

{Ax̂k−1|k−1 , νkγk = 0

x̂sk |k , νkγk = 1

Pk |k =

{f (Pk−1|k−1) , νkγk = 0

P̄ , νkγk = 1

where f (X ) , AXAT + QAt eavesdropper:

x̂e,k |k =

{Ax̂e,k−1|k−1 , νkγe,k = 0

x̂sk |k , νkγe,k = 1

Pe,k |k =

{f (Pe,k−1|k−1) , νkγe,k = 0

P̄ , νkγe,k = 1


Optimal Transmission Scheduling

Outline

1 Introduction

2 System Model


4 Infinite Horizon


6 Numerical Studies

7 Conclusion




Approach to security - keep expected error covariance ateavesdropper above a certain levelFormulate a finite horizon problem that minimizes a linearcombination of expected estimation error covariance and negativeof expected eavesdropper error covariance

min{νk}

K∑k=1

E[βtrPk |k − (1− β)trPe,k |k ]

β ∈ (0,1) controls the trade-off between estimation performanceat remote estimator and eavesdropperCan consider cases where transmission decisions νk depend on(Pk−1|k−1,Pe,k−1|k−1), or only on Pk−1|k−1



Structural Properties of Optimal Schedule

Theorem (νk depends on (Pk−1|k−1,Pe,k−1|k−1))

(i) For fixed Pe,k−1|k−1, the optimal ν∗k is a threshold policy on Pk−1|k−1of the form

ν∗k (Pk−1|k−1,Pe,k−1|k−1) =

{0 , if Pk−1|k−1 ≤ P∗k1 , otherwise

where the threshold P∗k depends on k and Pe,k−1|k−1.(ii) For fixed Pk−1|k−1, the optimal ν∗k is a threshold policy on Pe,k−1|k−1of the form

ν∗k (Pk−1|k−1,Pe,k−1|k−1) =

{0 , if Pe,k−1|k−1 ≥ P∗e,k1 , otherwise

where the threshold P∗e,k depends on k and Pk−1|k−1.



Structural Properties of Optimal Schedule

0 1 2 3 4 5 6 7 8 9

Pk-1|k-1

0

1

2

3

4

5

6

7

8

9P

e,k

-1|k

-1ν

k

*=1


Infinite Horizon

Outline

1 Introduction

2 System Model


4 Infinite Horizon


6 Numerical Studies

7 Conclusion


Infinite Horizon

Infinite Horizon

For unstable systems, we can drive the expected eavesdroppererror covariance unbounded, while keeping expected estimationerror covariance bounded

Theorem

Suppose that A is unstable, and that λ > 1− 1|σmax(A)|2 . Then for any

λe < 1, there exist transmission policies in the infinite horizon situationsuch that lim supK→∞

1K∑K

k=1 trE[Pk |k ] is bounded andlim infK→∞

1K∑K

k=1 trE[Pe,k |k ] is unbounded.

Similar results obtained:I for sufficiently large coding blocklength10

I for no feedback,11 but need λe < λ

10Wiese, Johansson et al. Proc. CDC, 201611Tsiamis, Gatsis, Pappas, Proc. IFAC World Congress, 2017


Infinite Horizon

Infinite Horizon

Idea of proof: Construct a policy with the required properties.Turns out that a threshold policy on P, when the threshold issufficiently large, will work. Specifically, transmit if and only ifPk−1|k−1 ≥ f t (P̄), with t large enough that

λe < 1− 1λ|σmax(A)|2(t+1)

is satisfied, has the required propertiesConstructed policy does not require knowledge of Pe


An Alternative Measure of Security

Outline

1 Introduction

2 System Model


4 Infinite Horizon


6 Numerical Studies

7 Conclusion




So far, security considered from viewpoint of trying to keepeavesdropper error covariance above a certain levelAn alternative of measure of security – restrict the amount ofinformation revealed to the eavesdropper, in particular the sum ofconditional mutual informations or directed informationConditional mutual information Ie,k , I(xk ; ze,k |ze,0, . . . , ze,k−1) canbe expressed as

Ie,k =12

log det Pe,k |k−1 −12

log det Pe,k |k

=12

log det f (Pe,k−1|k−1)− 12

log det Pe,k |k




Transmission scheduling problem

min{νk}

K∑k=1

E[βtrPk |k + (1− β)Ie,k ]

Minimize combination of expected estimation error covariance andexpected information revealed to eavesdropperSimilar structural results on optimal transmission schedule can bederived



An Alternative Measure of SecurityFor infinite horizon and unstable systems, expected informationrevealed to eavesdropper cannot be driven to zero

Theorem

Let A be an unstable matrix, and assume that λe > 0. Then, for anytransmission policy satisfying

lim supK→∞

1K

K∑k=1

E[Pk |k ] <∞,

one must have

lim infK→∞

1K

K∑k=1

E[Ie,k ] > ε

for some ε > 0 dependent only on λe,A,Q, P̄.


Numerical Studies

Outline

1 Introduction

2 System Model


4 Infinite Horizon


6 Numerical Studies

7 Conclusion


Numerical Studies

Numerical Studies

Parameters A =

[1.2 0.20.3 0.8

], C =

[1 1

], Q = I, R = 1

Finite horizon, λ = 0.6, λe = 0.6, K = 10, different values of β

4 6 8 10 12 14 16 18 20 22

tr E[Pk|k

]

0

5

10

15

20

25

30

35

40

45

50

tr E

[Pe,k

|k]

eavesdropper covariance known

eavesdropper covariance unknown


Numerical Studies

Numerical Studies

Infinite horizon, λ = 0.6, λe = 0.8, simulation over 100000 time steps

1 1.5 2 2.5 3 3.5 4 4.5 5 5.5 6

t

100

101

102

103

104

105

106

107

tr E[Pe,k|k

]

tr E[Pk|k

]


Numerical Studies

Numerical Studies

Infinite horizon. Alternative measure of security

0 20 40 60 80 100 120 140 160 180 200

tr E[Pk|k

]

0

0.1

0.2

0.3

0.4

0.5

0.6

E[I

e,k]

eavesdropper covariance knowneavesdropper covariance unknown


Conclusion

Conclusion

We have studied remote state estimation problems in thepresence of an eavesdropperDerived structural results on optimal transmission schedulingIn infinite horizon

I Can make eavesdropper error covariance unbounded whileestimation error covariance remains bounded

I Non-zero amount of information revealed to eavesdropper in orderto keep estimation error covariance bounded


Conclusion

Open Questions

Infinite horizon – find optimal transmission policy which minimizesexpected error covariance s.t. expected eavesdropper covariancebeing unboundedAlternative notions of security, e.g. secrecy outage probabilityControl in the presence of an eavesdropperPerformance improvements using coding and physical layersecurity techniques


Remote State Estimation in the Presence of an Eavesdropper · Remote State Estimation in the...

Documents

Transcript of Remote State Estimation in the Presence of an Eavesdropper · Remote State Estimation in the...