Networked Systems under Denial-of-Service: Co-located vs. Remote Control Architectures

TL;DR

This paper compares the robustness of co-located and remote control architectures in networked systems under DoS attacks, analyzing stability and robustness gaps to inform design choices.

Contribution

It introduces a remote control architecture that approximates co-location, analyzing its stability and robustness relative to traditional co-located systems.

Findings

Remote architecture closely approximates co-located robustness.

Quantifies the stability gap between architectures.

Provides insights for flexible, cost-effective control system design.

Abstract

In this paper, we study networked systems in the presence of Denial-of-Service (DoS) attacks, namely attacks that prevent transmissions over the communication network. Previous studies have shown that co-located architectures (control unit co-located with the actuators and networked sensor channel) can ensure a high level of robustness against DoS. However, co-location requires a wired or dedicated actuator channel, which could not meet flexibility and cost requirements. In this paper we consider a control architecture that approximates co-location while enabling remote implementation (networked sensor and actuator channels). We analyze closed-loop stability and quantify the robustness "gap" between this architecture and the co-located one.

Figures

Equations

$$\displaystyle\left\{\begin{array}[]{rl}\dot{x}(t)&=Ax(t)+Bu(t)+d(t)\\ y(t)&=x(t)+n(t)\\ x(0)&=x_{0}\end{array}\right.$$

$$t_{k+1}-t_k=\Delta ,k\in {\mathbb{N}}_0$$

$$\Xi (\tau ,t):=\bigcup _{n\in {\mathbb{N}}_0}{H}_n\bigcap [\tau ,t]$$

$$n(\tau ,t)\le \eta +\frac{t-\tau }{{\tau }_D}$$

$$|\Xi (\tau ,t)|\le \kappa +\frac{t-\tau }{T}$$

$$\displaystyle\left\{\begin{array}[]{l}\xi((q+1)\delta)=A_{\delta}\alpha(q\delta)+B_{\delta}u(q\delta)\\ \alpha(q\delta)=\left\{\begin{array}[]{rl}y(q\delta),&\quad\textrm{if }q\delta=z_{m}\\ \xi(q\delta),&\quad\textrm{otherwise}\end{array}\right.\\ \xi(0)=0\end{array}\right.$$

$$u(t)=K\alpha (q\delta ),t\in [q\delta ,(q+1)\delta [$$

$$\delta \le \frac{1}{{\mu }_A}\log \left[\left(\frac{\sigma }{1+\sigma }\right)\frac{{\mu }_A}{\max \{\Vert \Phi \Vert ,1\}}+1\right]$$

$$\delta \le \left(\frac{\sigma }{1+\sigma }\right)\frac{1}{\max \{\Vert \Phi \Vert ,1\}}$$

$$\frac{1}{T}+\frac{\Delta }{{\tau }_D}<1$$

$$h\delta >\frac{{\omega }_2}{{\omega }_1+{\omega }_2}(Q+\Delta )$$

$$\frac{1}{T}+\frac{\Delta }{{\tau }_D}<1-\frac{{\omega }_2(\kappa +\eta \Delta )}{({\omega }_1+{\omega }_2)h\delta -{\omega }_2\Delta }$$

$$u_p(z_m)=K{\alpha }_p(z_m),p=0,\dots ,h-1$$

$${\alpha }_0(z_m)=y(z_m),$$

$$\displaystyle\alpha_{p+1}(z_{m})=A_{\delta}\alpha_{p}(z_{m})+B_{\delta}u_{p}(z_{m})\$$

$$\displaystyle{}u(t)=\left\{\begin{array}[]{lll}0,&\,\,\,t\in[0,z_{0}[\vskip 3.0pt plus 1.0pt minus 1.0pt\\ u_{p}(z_{m}),&\,\,\,t\in I_{p}(z_{m}),\,\,\,p=0,\ldots,h-2\vskip 3.0pt plus 1.0pt minus 1.0pt\\ u_{h-1}(z_{m}),&\,\,\,t\in I_{h-1}(z_{m})\end{array}\right.$$

$$Q=(\kappa +\eta \Delta ){\left(1-\frac{1}{T}-\frac{\Delta }{{\tau }_D}\right)}^{-1}$$

$$\varphi (t):={\alpha }_p(z_m)-x(t),t\in I_p(z_m)$$

$$\dot{x}(t)=\Phi x(t)+BK\varphi (t)+d(t)$$

$$\dot{V}(x(t))\le$$

$$\Vert \varphi (t)\Vert \le \sigma \Vert x(t)\Vert +\rho {\Vert w_t\Vert }_{\infty }$$

$$\dot{V}(x(t))$$

$$2\Vert x(t)\Vert \Vert w_t{\Vert }_{\infty }\le \frac{1}{\epsilon }\Vert x(t){\Vert }^2+\epsilon \Vert w_t{\Vert }_{\infty }^2$$

$$\dot{V}(x(t))$$

$$V(x(t))$$

$$\varphi (t)={\alpha }_{h-1}(z_m)-x(t)$$

$$\Vert \varphi (t)\Vert$$

$$\Vert \varphi (z_m+h\delta )\Vert \le \sigma \Vert x(z_m+h\delta )\Vert +\rho \Vert w_{z_m+h\delta }{\Vert }_{\infty }$$

$$\Vert \varphi (t)\Vert$$

$$\dot{V}(x(t))$$

Full text

1 introduction

The field of cyber-physical systems is becoming more and more important in control engineering and computer science due to its broad spectrum of applications. Especially for safety-critical applications, there is a need for analysis, synthesis and design tools that can guarantee secure and reliable operations despite the presence of malicious attacks (Cheng et al., 2017).

Security of cyber-physical systems involves several research areas, including anomaly detection, verification, and estimation and control in the presence of attacks. Moreover, the problem varies depending on the type of attack one is considering. One usually classifies cyber attacks as either deception attacks, examples being zero-dynamics and bias injection attacks or Denial-of-Service (DoS) attacks. The former affect the data trustworthiness via the manipulation of packets transmitted through the network (Fawzi et al., 2011; Teixeira et al., 2015). DoS attacks are instead intended to affect the timeliness of the information exchange, i.e., to induce packet losses (Xu et al., 2005; Amin et al., 2009). In particular, it is known that DoS attacks are relatively easy to launch (Xu et al., 2005), even without knowledge of the targeted system.

This paper deals with DoS attacks. We consider a control system in which plant-controller communication is networked. An attacker can induce closed-loop instability by denying the communication on sensor and actuator channels. The problem of interest is to design control systems that can tolerate DoS as much as possible. Networked control in the presence of packet losses has been widely investigated (Hespanha et al., 2007). However, it is known that communication failures induced by DoS can exhibit a temporal profile quite different from the one induced by genuine packet losses; in particular, communication failures induced by DoS need not follow a given class of probability distributions (Amin et al., 2009). This raises new theoretical challenges from the perspective of analysis as well as control design.

The literature on networked control under DoS is large and quite diversified. In (Gupta et al., 2010; Amin et al., 2009), the authors address the problem of finding optimal control and DoS attack strategies assuming a maximum number of jamming actions over a prescribed control horizon. A similar problem is considered in (Ugrinovskii and Langbort, 2014), where the authors study zero-sum games between controllers and strategic jammers. In (Zhang et al., 2016), the authors investigate DoS from the attacker’s viewpoint, and characterize optimal DoS attack scheduling strategies. Shisheh Foroush and Martínez (2013) consider periodic DoS attacks. The objective is to identify salient features of the DoS signal such as maximum on/off cycle in order to de-synchronize the transmission times from the occurrence of DoS. In (De Persis and Tesi, 2014b; De Persis and Tesi, 2015), a framework is introduced where no assumption is made regarding the “structure” of the DoS attack. Instead, a model is considered that constrains DoS only in terms of its frequency and duration. The contribution is an explicit characterization of DoS frequency and duration for which stability can be preserved through state-feedback control. Extensions have been considered dealing with co-located robust controller design (Feng and Tesi, 2017), nonlinear (De Persis and Tesi, 2014a) and distributed (Senejohnny et al., 2015) systems, as well as with systems where jamming attacks and genuine packet losses coexist (Cetinkaya et al., 2016).

In a recent paper (Feng and Tesi, 2016), we have investigated networked systems under DoS attacks from the perspective of designing “maximally robust” controllers. There, it is shown that co-located architectures (control unit co-located with the actuators and networked sensor channel) can guarantee the highest possible level of robustness against DoS, in the sense that they can guarantee closed-loop stability for all the DoS signals with frequency and duration below a certain critical threshold beyond which stability can be lost irrespective of the adopted control system. Unfortunately, co-location requires wired or dedicated actuator channels, which could not meet flexibility and cost requirements.

In this paper, we consider a control system that approximates co-location while enabling remote implementation (networked sensor and actuator channels). The proposed architecture relies on packet-based control and actuator buffering. The basic idea is to transmit data packets containing plant input predictions whenever DoS is absent, and use the data stored in the actuator buffer during the periods of DoS. This idea has already proved effective to compensate for network delay (Chaillet and Bicchi, 2008; Bemporad, 1998) as well as packet losses (Quevedo et al., 2011; Quevedo and Nešić, 2011). In this paper, however, the peculiarity of the problem leads to a different analysis and design. We follow a “worst-case” type of analysis, accounting for the situation where the network undergoes periods of DoS much larger than the buffer capacity.

The paper contribution is twofold. First, we provide conditions on the prediction horizon under which closed-loop stability is preserved. The analysis is general enough to account for: (i) process disturbances; (ii) measurement and network noise; (iii) non-zero computation times. As a second contribution, we explicitly quantify the robustness “gap” between this control architecture and the co-located one, showing that the ideal bound obtained with co-location is recovered as the prediction horizon increases.

1.1 Notation

We denote by $\mathbb{R}$ the set of reals. For any $\alpha\in\mathbb{R}$, we denote $\mathbb{R}_{\geq\alpha}:=\{x\in\mathbb{R}:x\geq\alpha\}$. We let $\mathbb{N}_{0}$ denote the set of nonnegative integers, $\mathbb{N}_{0}:=\{0,1,\ldots\}$. For any $\alpha\in\mathbb{N}_{0}$, we denote $\mathbb{N}_{\alpha}:=\{\alpha,\alpha+1,\ldots\}$. The prime denotes transpose. Given a vector $v\in\mathbb{R}^{n}$, $\|v\|$ is its Euclidean norm. Given a matrix $M$, $\|M\|$ is its spectral norm. Given a measurable time function $f:\mathbb{R}_{\geq 0}\mapsto\mathbb{R}^{n}$ and a time interval $[0,t)$ we denote the $\mathcal{L}_{\infty}$ norm of $f(\cdot)$ on $[0,t)$ by $\|f_{t}\|_{\infty}:=\textrm{sup}_{s\in[0,t]}\|f(s)\|$. Given a measurable time function $f:\mathbb{R}_{\geq 0}\mapsto\mathbb{R}^{n}$ we say that $f$ is bounded if its $\mathcal{L}_{\infty}$ norm is finite.

2 Framework and paper outline

2.1 Process dynamics and network

The process to be controlled is given by

[TABLE]

where $t\in\mathbb{R}_{\geq 0}$; $x\in\mathbb{R}^{n}$ is the state, $u\in\mathbb{R}^{m}$ is the control input and $y\in\mathbb{R}^{n}$ is measurement vector; $A$ and $B$ are matrices of appropriate size with $(A,B)$ stabilizable; $d\in\mathbb{R}^{n}$ and $n\in\mathbb{R}^{n}$ are unknown (bounded) disturbance and noise signals, respectively.

We assume that sensor and actuator channels are networked and subject to Denial-of-Service (DoS) status. The former implies that measurements and control commands are sent only at discrete time instants. Let $\{t_{k}\}_{k\in\mathbb{N}_{0}}=\{t_{0},t_{1},\ldots\}$ denote the sequence of transmission attempts. Throughout the paper, we assume for simplicity that the transmission attempts are carried out periodically with period $\Delta$, i.e.,

[TABLE]

with $t_{0}=0$ by convention. We refer to DoS as the phenomenon for which some transmission attempts may fail.

We shall denote by $\{z_{m}\}_{m\in\mathbb{N}_{0}}=\{z_{0},z_{1},\ldots\}$, $z_{0}\geq t_{0}$, the sequence of time instants at which samples of $y$ are successfully transmitted.

2.2 Control objective

The objective is to design a controller $\mathcal{K}$, possibly dynamic, in such a way that the closed-loop stability is maintained despite the occurrence of DoS in measurement and control channels. In this paper, by closed-loop stability we mean that all the signals in the closed-loop system remain bounded for any initial condition $x_{0}$ and bounded noise and disturbance signals, and converge to zero in the event that noise and disturbance signals converge to zero.

2.3 Denial-of-Service: Assumptions

Clearly, the problem in question does not have a solution if the DoS amount is allowed to be arbitrary. Following (De Persis and Tesi, 2015), we consider a general DoS model that constrains the attacker action in time by only posing limitations on the frequency of DoS attacks and their duration. Let $\{h_{n}\}_{n\in\mathbb{N}_{0}}$, $h_{0}\geq 0$, denote the sequence of DoS off/on transitions, i.e., the time instants at which DoS changes from zero (transmissions are possible) to one (transmissions are not possible). Hence, $H_{n}:=\{h_{n}\}\cup[h_{n},h_{n}+\tau_{n}[$ represents the $n$-th DoS interval, of length $\tau_{n}\in\mathbb{R}_{\geq 0}$, over which the network is in DoS status. If $\tau_{n}=0$, then $H_{n}$ takes the form of a single pulse at $h_{n}$. Given $\tau,t\in\mathbb{R}_{\geq 0}$ with $t\geq\tau$, let $n(\tau,t)$ denote the number of DoS off/on transitions over $[\tau,t[$, and let

[TABLE]

denote the subset of $[\tau,t]$ where the network is in DoS status.

We make the following assumptions.

Assumption 1

(DoS frequency). There exist constants $\eta\in\mathbb{R}_{\geq 0}$ and $\tau_{D}\in\mathbb{R}_{>0}$ such that

[TABLE]

for all $\tau,t\in\mathbb{R}_{\geq 0}$ with $t\geq\tau$.  $\blacksquare$

Assumption 2

(DoS duration). There exist constants $\kappa\in\mathbb{R}_{\geq 0}$ and $T\in\mathbb{R}_{>1}$ such that

[TABLE]

for all $\tau,t\in\mathbb{R}_{\geq 0}$ with $t\geq\tau$.  $\blacksquare$

Remark 2.1

Assumptions 1 and 2 do only constrain a given DoS signal in terms of its average frequency and duration. In practice, $\tau_{D}$ can be defined as the average dwell-time between consecutive DoS off/on transitions, while $\eta$ is the chattering bound. Assumption 2 expresses a similar requirement with respect to the duration of DoS. It expresses the property that, on the average, the total duration over which communication is interrupted does not exceed a certain fraction of time, as specified by $1/T$. Like $\eta$, the constant $\kappa$ plays the role of a regularization term. It is needed because during a DoS interval, one has $|\Xi(h_{n},h_{n}+\tau_{n})|=\tau_{n}>\tau_{n}/T$. Thus $\kappa$ serves to make (8) consistent. Conditions $\tau_{D}>0$ and $T>1$ imply that DoS cannot occur at an infinitely fast rate or be always active.  $\blacksquare$

2.4 Previous work and paper outline:

co-located and remote control architectures

In Feng and Tesi (2016), we have investigated the problem of designing control architectures that achieve maximal robustness against DoS. We briefly summarize the main result of that paper. Consider the control architecture depicted in Figure 1. The control system is co-located with the process actuators and is equipped with prediction capabilities so as to reconstruct the missing measurements during DoS periods. Let $\delta:={\Delta}/{b}$ be the sampling rate of the control system, where $b\in\mathbb{N}_{1}$. Notice that choosing $\delta=\Delta/b$ allows to differentiate between controller sampling rate and transmission rate, maintaining $\Delta$ possibly large. Finally, let $A_{\delta}:=e^{A\delta}$ and $B_{\delta}:=\int_{0}^{\delta}e^{A\tau}Bd\tau$. The predictor equations are given by

[TABLE]

where $q\in\mathbb{N}_{0}$, and the control action is given by

[TABLE]

Here $K$ is a state-feedback matrix such that all the eigenvalues of $\Phi=A+BK$ have negative real part. The control system consists of a predictor and a state-feedback matrix. The former emulates the process dynamics during the DoS period, and is “reset” whenever new measurements become available.

Theorem 2.2** **(Feng and Tesi (2016))

Consider a process as in (4) under a co-located control system as in (14) and (15). Given any positive definite symmetric matrix $M$, let $P$ denote the solution of the Lyapunov equation $\Phi^{\prime}P+P\,\Phi+M=0$. Let the controller sampling rate $\delta$ be such that

[TABLE]

when $\mu_{A}>0$, and

[TABLE]

when $\mu_{A}\leq 0$, where $\mu_{A}$ is the logarithmic norm of $A$ and $\sigma$ is a positive constant satisfying $\gamma_{1}-\sigma\gamma_{2}>0$, where $\gamma_{1}$ is equal to the smallest eigenvalue of $M$ and $\gamma_{2}:=\|2PBK\|$. Then, the closed-loop system is stable for any DoS sequence satisfying Assumptions 1 and 2 with arbitrary $\eta$ and $\kappa$, and with $\tau_{D}$ and $T$ such that

[TABLE]

$\blacksquare$

The bound (18) is the best bound that one can achieve for the class of DoS signals satisfying Assumptions 1 and 2 in the sense that at or above the threshold “1” (when $1/T+\Delta/\tau_{D}\geq 1$) one can preserve stability only for some DoS signals, not for all. In fact, as soon as we reach the threshold “1”, $\tau_{D}$ and $T$ can give rise to DoS signals that disrupt all the transmission attempts. Consider, for example, the DoS signal given by $(h_{n},\tau_{n})=(n\Delta,0)$. This signal yields $1/T+\Delta/\tau_{D}=1$ and satisfies Assumption 1 and 2 with $\eta=1$, $\kappa=0$, $T=\infty$ and $\tau_{D}=\Delta$. By construction, this DoS signal disrupts all the transmission attempts since it is synchronized with the transmission times. Note that condition $1/T+\Delta/\tau_{D}<1$ requires $\tau_{D}>\Delta$. This means that, on the average, DoS cannot occur at the same rate as (or faster than) $\Delta$.

Despite its robustness, the control architecture in (14)-(15) has a number of practical shortcomings: co-location requires a wired or dedicated control channel, which could not meet flexibility and cost requirements. In order to mitigate these shortcomings, we consider an architecture that allows for remote control. As shown in Figure 2, we consider a “packetized-and-buffered” architecture in which the controller transmits a sequence of control values containing process input predictions. Whenever communication is available, these values are stored in a buffer and used during the DoS periods. In the remainder of this paper, we formally investigate stability and robustness properties of this architecture. We show that under (18) closed-loop stability is preserved as long as the prediction horizon $h\delta$ satisfies

[TABLE]

where $h$ is the buffer size, $\delta$ is the actuator sampling interval, $\omega_{1}$ and $\omega_{2}$ are process-dependent constants, and $Q$ is a DoS-dependent constant. The above stability condition can can be equivalently rewritten as

[TABLE]

This inequality explicitly quantifies the gap between co-located and remote architectures, showing that the latter approaches the ideal bound as $h\rightarrow\infty$.

3 Remote control architecture

The actuator implements a sample-and-hold control strategy with sampling period $\delta:=\Delta/b$, $b\in\mathbb{N}_{1}$. The control unit operates at the time instants $z_{m}$ at which process measurements are available, returning $h\in\mathbb{N}_{1}$ controls

[TABLE]

where the variable $\alpha_{p}(z_{m})$ defines the prediction of $x(z_{m}+p\delta)$ at time $z_{m}$. In particular, $\alpha_{p}(z_{m})$ satisfies

[TABLE]

where $p\in\{0,\ldots,h-2\}$ and where $A_{\delta}$ and $B_{\delta}$ are as in (14). In practice, the control unit implements a sampled-data version of the process dynamics, which are “reset” whenever a new process measurement becomes available.

Let $I_{p}(z_{m}):=[z_{m}+p\delta,\min\{z_{m}+(p+1)\delta,z_{m+1}\}[$, where $p\in\{0,\ldots,h-2\}$, and $I_{h-1}(z_{m}):=[z_{m}+(h-1)\delta,z_{m+1}[$. The control input applied to the process is

[TABLE]

In words, the control action is kept to zero until the first process measurement is received. Thereafter, as shown in Figure 3, over each interval $[z_{m},z_{m+1}[$ the actuator applies the values in the buffer until the buffer is empty and the last value in the buffer $u(z_{m}+(h-1)\delta)$ is kept until $z_{m+1}$. On the other hand, if $z_{m+1}<z_{m}+h\delta$ then all the samples in the buffer are discarded and a new sequence of controls is stored. This renders (27) a “receding horizon” control policy.

Notice that (27) assumes that there is no noise in the actuator channel. This is because, if the actuator receives $u_{p}+n_{u}$, where $n_{u}$ is a noise, the contribution of $n_{u}$ can be absorbed in the process disturbance $d$. Also notice that (27) assumes that the time needed to compute all the samples in (21) is zero. This assumption can be relaxed as discussed in Section 4.

4 Main result

We first present a lemma which is key to our developments. Then, we analyze the closed-loop behavior within and outside the prediction horizon and provide stability conditions.

4.1 Key lemma

The lemma relates DoS parameters and time elapsing between successful transmissions.

Lemma 4.3** **(Feng and Tesi (2016))

Consider a transmission policy as in (5), along with a DoS signal satisfying Assumptions 1 and 2. If (18) holds true, then the sequence of successful transmissions satisfies $z_{0}\leq Q$ and $z_{m+1}-z_{m}\leq Q+\Delta$ for all $m\in\mathbb{N}_{0}$, where

[TABLE]

$\blacksquare$

4.2 Closed-loop behavior within the prediction horizon

Lemma 1 guarantees that the time elapsing between successful transmissions is always bounded under (18). In particular, $z_{0}$ is finite. This makes it possible to focus the attention on the closed-loop behavior from $z_{0}$ onwards. Consider a generic interval $I_{p}(z_{m})$ and let

[TABLE]

Notice that $I_{p}(z_{m})$ might be empty, which happens whenever $z_{m+1}\leq z_{m}+p\delta$. Thus, in the sequel, we implicitly consider only the intervals $I_{p}(z_{m})$ which are nonempty. Exploiting (30), we can rewrite the process dynamics as

[TABLE]

where $\Phi=A+BK$. Given any symmetric positive definite matrix $M$, let $P$ be the unique solution of the Lyapunov equation $\Phi^{\prime}P+P\Phi+M=0$. Let $V(x)=x^{\prime}Px$. Its derivative along the solutions to (31), satisfies

[TABLE]

where $\gamma_{1}$ is the smallest eigenvalue of $M$, $\gamma_{2}:=\|2PBK\|$ and $\gamma_{3}:=\|2P\|$. One sees that closed-loop stability depends on $\phi$, which, in turn, depends on the actuator sampling period $\delta$. In general, it is not possible to get a dissipation inequality in (32) for an arbitrary $\delta$. Nonetheless, this is possible provided that $\delta$ is suitably chosen.

Lemma 4.4

Consider a dynamical system as in (4) under the control action (27). Let the actuator sampling period $\delta$ be chosen as in Theorem 1. Then, there exists a positive constant $\rho$ such that

[TABLE]

for all $t\in[z_{m},\min\{z_{m}+h\delta,z_{m+1}\}[$, where $w=[d^{\prime}\,\,n^{\prime}]^{\prime}$.

Proof. See Appendix A.  $\blacksquare$

In view of Lemma 2, it is immediate to verify that if actuator sampling period is properly chosen then closed-loop stability is guaranteed since (33) induces an ISS-type of property to the Lyapunov function. In fact, (33) yields

[TABLE]

where $\gamma_{4}:=\gamma_{1}-\sigma\gamma_{2}$ and $\gamma_{5}:=\gamma_{2}\rho+\gamma_{3}$.

Observe now that for any positive real $\varepsilon$, the Young’s inequality (Hardy et al., 1952) yields

[TABLE]

Using this inequality with $\varepsilon:=\gamma_{5}/\gamma_{4}$, we obtain

[TABLE]

where $\omega_{1}:=\gamma_{4}/(2\alpha_{2})$ and $\gamma_{6}:=\gamma_{5}^{2}/(2\gamma_{4})$, where $\alpha_{2}$ denotes the largest eigenvalue of $P$.

Accordingly,

[TABLE]

for all $t\in[z_{m},\min\{z_{m}+h\delta,z_{m+1}\}[$, where $\zeta_{1}:=\gamma_{6}/\omega_{1}$.

4.3 Closed-loop behavior outside the prediction horizon

Lemma 1 guarantees that the time elapsing between successful transmissions is always bounded under (18). Specifically, it ensures that $z_{m+1}-z_{m}\leq Q+\Delta$ for all $m\in\mathbb{N}_{0}$, where $Q$ is a DoS-dependent constant. Consider now a transmission instant $z_{m}$. At this time, the buffer is full. If $h\delta\geq\Delta$ and there is no DoS at $z_{m}+\Delta$ then the buffer is filled again at $z_{m}+\Delta$ and the analysis of Section 4.2 applies. This scenario can be viewed as a co-located one. Thus, there are two critical cases: (i) when $h\delta<\Delta$ meaning that the prediction horizon does not cover one transmission period; and (ii) when $\Delta\leq h\delta<\Delta+Q$, which means that the network is subject to DoS periods that exceed the prediction horizon (cf. Figure 3). We now discuss this scenario in detail.

Let $D_{m}:=[z_{m}+h\delta,z_{m+1}[$ with $D_{m}\neq\emptyset$. Recall that the prediction error satisfies

[TABLE]

for all $I_{h-1}(z_{m})$. By hypothesis, $D_{m}\neq\emptyset$ which means that $z_{m+1}>z_{m}+h\delta$. This implies that (38) is valid for $t=z_{m}+h\delta$. Hence, the triangular inequality yields

[TABLE]

for all $t\in D_{m}$. We first look at $\phi(z_{m}+h\delta)$. Note that $\phi$ is continuous on $I_{h-1}(z_{m})$. This, along with Lemma 2, implies that

[TABLE]

Combining this inequality with (39), we get

[TABLE]

for all $t\in D_{m}$. Then, combining (4.3) and (32) yields

[TABLE]

By applying again the Young’s inequality with $\varepsilon:=\frac{\gamma_{3}+\rho\gamma_{2}}{\gamma_{1}-\sigma\gamma_{2}}$, we obtain

[TABLE]

where $\gamma_{7}:=\frac{(\gamma_{3}+\rho\gamma_{2})^{2}}{2(\gamma_{1}-\sigma\gamma_{2})}$.

Hence, for every $t\in D_{m}$ such that $\|x(t)\|\geq\|x(z_{m}+h\delta)\|$ we have

[TABLE]

where $\omega_{2}:=\gamma_{2}(2+\sigma)/\alpha_{1}$. On the other hand, for every $t\in D_{m}$ such that $\|x(t)\|\leq\|x(z_{m}+h\delta)\|$ we have

[TABLE]

From these expressions, we conclude that during each interval $D_{m}$ exceeding the prediction horizon the Lyapunov function satisfies

[TABLE]

where $\zeta_{2}:=\gamma_{7}/\omega_{2}$.

4.4 Stability analysis

The foregoing analysis indicates that the overall behevior of the system can be regarded as the one of a switched system that behaves stably over the intervals $[z_{m},z_{m}+h\delta[$ and unstably over the intervals $D_{m}$. We have the following result.

Theorem 4.5

Consider a dynamical system as in (4) under the control action (27). Given any positive definite symmetric matrix $Q$, let $P$ denote the solution of the Lyapunov equation $\Phi^{\prime}P+P\,\Phi+Q=0$ with $\Phi=A+BK$ stable. Let the actuator sampling period $\delta$ be as in Theorem 1. Consider any DoS pattern satisfying (18). Then, the closed-loop system is stable if the prediction horizon $h\delta$ satisfies

[TABLE]

where $Q$ is as in Lemma 1, $\omega_{1}=\frac{\gamma_{1}-\sigma\gamma_{2}}{2\alpha_{2}}$ and $\omega_{2}=\frac{\gamma_{2}(2+\sigma)}{\alpha_{1}}$ where $\gamma_{1}$, $\gamma_{2}$ and $\sigma$ are as in Theorem 1 and where $\alpha_{1}$ and $\alpha_{2}$ are the smallest and largest eigenvalues of $P$, respectively.

Proof. Recall that $z_{0}$ exists finite in view of Lemma 1. Hence, we can restrict ourselves to study the closed-loop behavior from $z_{0}$ onwards. We also assume without loss of generality that $h\delta<Q+\Delta$ otherwise the result follows immediately from the analysis of Section 4.2. We show that

[TABLE]

where $\beta$ is defines as

[TABLE]

and where

[TABLE]

Note that $\beta>0$ in view of (47).

We prove this claim through an induction argument. The claim trivially holds for $m=0$ since $\lambda\geq 1$. Assume next that the claim is true up to $z_{m}$ with $m\in\mathbb{N}_{1}$. First recall that (37) implies

[TABLE]

for all $t\in[z_{m},\min\{z_{m}+h\delta,z_{m+1}\}[$, where the second inequality follows from $\omega_{1}>\beta$. Then, we have two cases. Assume $D_{m}=\emptyset$, which implies that $z_{m+1}\leq z_{m}+h\delta$. Note that $z_{m+1}-z_{m}\geq\Delta$ by construction. Hence, at time $z_{m+1}$ we have $e^{-\beta(z_{m+1}-z_{m})}\leq e^{-\beta\Delta}=L$. This shows that (4.4) holds true at $z_{m+1}$. Assume next $D_{m}\neq\emptyset$. In view of (37) and since $V$ is continuous, we get

[TABLE]

Combining this inequality with (46) yields

[TABLE]

for all $t\in D_{m}$, where the third inequality follows from the fact that $t\leq z_{m}+Q+\Delta$ and the definition of $\beta$, while the last inequality follows from the fact that $e^{-\beta(Q+\Delta)}\leq L$ and the fact that $Q+\Delta+z_{m}\geq z_{m+1}\geq t$ for all $t\in D_{m}$. Thus, (4.4) holds true at $z_{m+1}$.

Using this property, the proof can be easily finalized. In fact, (4.4) and (55) yield

[TABLE]

for all $[z_{m},z_{m+1}[$, and the sum term is bounded for any $m$ since $L<1$. This concludes the proof.  $\blacksquare$

Remark 4.6

One sees from (47) that in order to get stability it is not necessary that the prediction horizon covers the maximum period of DoS. In fact, also large DoS periods can be tolerated. In particular, one sees that robustness increases with: (i) small values of $\omega_{2}$, which corresponds to mild open-loop unstable dynamics; and (ii) large values of $\omega_{1}$, which corresponds to a large decay rate of the DoS-free closed-loop dynamics. The latter should be therefore taken into account when designing the state-feedback matrix $K$.  $\blacksquare$

Remark 4.7

Taking into account the expression of $Q$ from Lemma 1, it is immediate to see that (47) can be equivalently rewritten as (20). This shows that the considered architecture approaches the ideal bound (18) as $h\rightarrow\infty$. Inequality (20) does also quantify the “gap” between remote and co-located architectures for given any finite $h$.  $\blacksquare$

Remark 4.8

In this paper, we have assumed that the time needed to compute $h$ control values is zero. This assumption can be restrictive if $h$ is large. As discussed in Feng and Tesi (2016), Lemma 1 follows from the fact that every time interval of duration $Q+\Delta$ contains at least a DoS-free interval of duration $\Delta$. This result can be generalized. In fact, one can show that if we replace (18) with

[TABLE]

then every time interval of duration

[TABLE]

contains at least a DoS-free interval of duration $\mu\Delta$. This property is very useful to account for non-zero computation times $T_{c}$. In fact, this property makes it possible to regard $T_{c}$ as an extended DoS interval. The only modification is that the sequence of control values should start from $\alpha_{\left\lceil{T_{c}/\Delta}\right\rceil\Delta}$.  $\blacksquare$

5 A Numerical Example

The numerical example is taken from (Forni et al., 2010). The system to be controlled is open-loop unstable and is characterized by the matrices

[TABLE]

The state-feedback matrix is given by

[TABLE]

The control system parameters are $\gamma_{1}=1$, $\gamma_{2}=2.1080$, $\alpha_{1}=0.2779$, $\alpha_{2}=0.4497$, $\|\Phi\|=1.9021$, $\omega_{1}=0.5025$, $\omega_{2}=15.1709$ and $\mu_{A}=1.5$. Disturbance $d$ and noise $n$ are random signals with uniform distribution in $[-0.01,0.01]$.

The network transmission rate is given by $\Delta=0.1$s. As for the actuator sampling period, Theorem 1 yields $\delta<0.1508$. We select $\delta=0.1$s in order to synchronize the controller sampling rate with $\Delta$.

Figure 4 shows simulation results comparing the co-located architecture in (Feng and Tesi, 2016) with the one proposed in this paper. We consider a sustained DoS attack with variable period and duty cycle, generated randomly. Over a simulation horizon of $50$s, the DoS signal yields $|\Xi(0,50)|=34.65$s and $n(0,50)=39$. This corresponds to values (averaged over $50$s) of $\eta\leq 3.1$, $\kappa\leq 0.8442$, $\tau_{D}\approx 1.2821$ and $T\approx 1.4430$, and $\sim 70\%$ of transmission failures. Moreover,

[TABLE]

For the co-located architecture, the requirement for closed-loop stability is clearly satisfied.

Consider next the remote architecture. In agreement with (47), to get stability one needs a prediction horizon $h\delta\geq 4.9153$, which corresponds to $h\geq 50$. One sees from Figure 4 that without buffering, namely when $h=1$, the closed-loop system is unstable. On the other hand, $h=5$ is sufficient to obtain a satisfactory closed-loop response. The results indicate that in some cases, like the one discussed here, small values of $h$ can approximate well the co-located architecture without actually requiring large $h$ or co-location. In this sense, the proposed control architecture provides an effective solution to trade-off ease of implementation and robustness against DoS.

The conservativeness of the theoretical bound on $h$ is somewhat implicit to the “worst-case” type of analysis pursued here.

6 Concluding remarks

In this paper, we have investigated networked systems in the presence of Denial-of-Service attacks, comparing co-located and remote control architectures. While the former achieves the highest level of robustness for a very large class of DoS signals, it need not be always feasible from a practical point of view. We introduced a control architecture that approximates co-location while enabling remote implementation. This architecture relies on “packet-based” control: the control unit transmits a sequence of controls containing process input predictions. Whenever communication is allowed, the controls are stored in a buffer and used during the DoS periods. We studied closed-loop stability, quantifying the robustness “gap” between this architecture and the co-located one. As it emerges from both the analysis and the numerical simulations, the proposed architecture provides an effective solution for trading-off ease of implementation and robustness against DoS.

The present results can be extended in many directions. The case of partial state measurements represents an interesting research venue, where the results in (Feng and Tesi, 2017) may prove relevant in this regard. Another interesting research line pertains the study of remote control architecture when sensor and actuator channels are independent. In this case, it is interesting to study closed-loop stability in connection with asynchronous DoS.

Appendix A Proof of Lemma 2

Consider any interval $[z_{m},\min\{z_{m}+h\delta,z_{m+1}\}[$, $m\in\mathbb{N}_{0}$. The proof is divided into two steps. First, we provide an upper bound on the error dynamics $\phi$ at the sampling times $z_{m}+p\delta$. Second, we provide an upper bound on the error dynamics $\phi$ between inter-samplings. This provides an upper bound on $\phi$ over the whole interval $[z_{m},\min\{z_{m}+h\delta,z_{m+1}\}[$.

We start by deriving an upper bound on $\|\phi(z_{m}+p\delta)\|$. It is simple to verify that the dynamics of the variable $\alpha$ related to the predictor equation satisfies

[TABLE]

for all $p\in\{0,1,\ldots,h-1\}$ such that $z_{m}+p\delta<z_{m+1}$. Moreover, the process dynamics satisfies

[TABLE]

for all $t\in\mathbb{R}_{\geq z_{m}}$. Combining these two expressions, we get

[TABLE]

for all $p\in\{0,1,\ldots,h-1\}$ such that $z_{m}+p\delta<z_{m+1}$. Here, we exploited the relation $A_{\delta}^{p}=e^{Ap\delta}$ and the fact that

[TABLE]

where the second equality is obtained using the change of variable $s=z_{m}+(k+1)\delta-\tau$. We then have

[TABLE]

where $\rho_{1}:=(1+\frac{1}{\mu_{A}})e^{\mu_{A}(h-1)\delta}$.

We can now provide an upper bound on the prediction error $\phi$ between inter-sampling instants. To this end, observe that the dynamics of $\phi$ satisfies

[TABLE]

where $\phi(z_{m})=n(z_{m})$. Let now

[TABLE]

where $t\in\mathbb{R}_{z_{m}+p\delta}$. Then, the solution of (73) satisfies

[TABLE]

for all $t\in I_{p}(z_{m})$, where we defined $\rho_{2}:=\max\{e^{\mu_{A}\delta},1\}$ and $\kappa_{1}:=\max\{\|\Phi\|,1\}$.

Observe that $f(0)=0$ and that $f(t-z_{m}-p\delta)$ is monotonically increasing with $t$. Thus, any positive real $\delta$ such that

[TABLE]

ensures (33) with $\rho:=\sigma+\rho_{1}\rho_{2}(1+\sigma)$.

The explicit expression for $\delta$ follows from Theorem 1.  $\blacksquare$