Secure and Private Implementation of Dynamic Controllers Using Semi-Homomorphic Encryption

TL;DR

This paper introduces a method for implementing linear dynamic controllers securely and privately using semi-homomorphic encryption, ensuring system stability and performance while maintaining data privacy.

Contribution

It proposes a novel approach combining Paillier encryption with periodic state resets to securely implement dynamic controllers.

Findings

Secure implementation of controllers with encryption

Ensured stability and performance of encrypted control systems

Demonstrated effectiveness through theoretical analysis

Abstract

This paper presents a secure and private implementation of linear time-invariant dynamic controllers using Paillier's encryption, a semi-homomorphic encryption method. To avoid overflow or underflow within the encryption domain, the state of the controller is reset periodically. A control design approach is presented to ensure stability and optimize performance of the closed-loop system with encrypted controller.

Equations

$$\displaystyle\mathcal{P}:\left\{\begin{array}[]{rlc}x[k+1]&=Ax[k]+Bu[k],&x[0]=x_{0},\\ y[k]&=Cx[k],\end{array}\right.$$

$$\displaystyle\mathcal{C}:\left\{\begin{array}[]{rl}x_{c}[k+1]&=\begin{cases}A_{c}x_{c}[k]+B_{c}y[k],&(k+1)\operatorname{mod}T\neq 0,\\ 0,&(k+1)\operatorname{mod}T=0,\end{cases}\\[15.00002pt] u[k]&=C_{c}x_{c}[k]+D_{c}y[k],\end{array}\right.$$

$$z[k+1]=\{\begin{array}{ll}F(\mathcal{P},\mathcal{C})z[k],& (k+1)\mathrm{mod}T\ne 0,\\ \left[\begin{array}{cc}I& 0\\ 0& 0\end{array}\right]F(\mathcal{P},\mathcal{C})z[k],& (k+1)\mathrm{mod}T=0,\end{array}$$

$$F(\mathcal{P},\mathcal{C}):=\left[\begin{array}{cc}A+B{D}_{c}C& B{C}_c\\ B_{c}C& A_c\end{array}\right].$$

$$P\succ ϵI,$$

$$F(\mathcal{P},\mathcal{C}{)}^{\top }PF(\mathcal{P},\mathcal{C})⪯(1+\mu )P,$$

$$F(\mathcal{P},\mathcal{C}{)}^{\top }\left[\begin{array}{cc}I& 0\\ 0& 0\end{array}\right]P\left[\begin{array}{cc}I& 0\\ 0& 0\end{array}\right]F(\mathcal{P},\mathcal{C})⪯\delta P,$$

$$\delta (1+\mu {)}^{T-1}<\epsilon .$$

$$\displaystyle\min_{T\in\mathbb{N}}\min_{\scriptsize\begin{array}[]{c}\varepsilon\in(0,1)\\ \delta\in[1,\infty)\end{array}}$$

$$s.t.$$

$$F(\mathcal{P},\mathcal{C}{)}^{\top }PF(\mathcal{P},\mathcal{C})⪯(1+{\mu }^{\ast })P,$$

$$F(\mathcal{P},\mathcal{C}{)}^{\top }\left[\begin{array}{cc}I& 0\\ 0& 0\end{array}\right]P\left[\begin{array}{cc}I& 0\\ 0& 0\end{array}\right]F(\mathcal{P},\mathcal{C})⪯\delta P.$$

$$\tilde{F}(\mathcal{P},\mathcal{C}):=\left[\begin{array}{cc}I& 0\\ 0& 0\end{array}\right]F(\mathcal{P},\mathcal{C})=\left[\begin{array}{cc}A+B{D}_{c}C& B{C}_c\\ 0& 0\end{array}\right].$$

$$F^{\top }PF-(1+\mu )P⪯0,{\tilde{F}}^{\top }P\tilde{F}-\delta P⪯0,$$

$$\mathcal{L}:=\left[\begin{array}{cc}(1+\mu )P& F^{\top }P\\ PF& P\end{array}\right]⪰0,\tilde{\mathcal{L}}:=\left[\begin{array}{cc}\delta P& {\tilde{F}}^{\top }P\\ P\tilde{F}& P\end{array}\right]⪰0.$$

$$P:=\left[\begin{array}{cc}X& U\\ U^{\top }& \tilde{X}\end{array}\right],$$

$${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}P}^{-1}=:\begin{bmatrix}Y\hskip 5.69054pt&V\\ V^{\top}&\tilde{Y}\end{bmatrix},\hskip 2.84526pt\mathcal{Y}:=\begin{bmatrix}Y\hskip 5.69054pt&I\\ V^{\top}&0\end{bmatrix},\hskip 2.84526pt\mathcal{Z}:=\begin{bmatrix}I&0\\ X&U\end{bmatrix}.$$

$${\mathcal{Y}}^{\top }P\mathcal{Y}=\mathcal{Z}\mathcal{Y}=\left[\begin{array}{cc}Y& I\\ I& X\end{array}\right]=:\mathbf{P}(\nu ).$$

$${\mathcal{T}}^{\top }\mathcal{L}\mathcal{T}=\left[\begin{array}{cc}(1+\mu )\mathbf{P}(\nu )& {\mathcal{Y}}^{\top }{F}^{\top }{\mathcal{Z}}^{\top }\\ \mathcal{Z}F\mathcal{Y}& \mathbf{P}(\nu )\end{array}\right],$$

$${\mathcal{T}}^{\top }\tilde{\mathcal{L}}\mathcal{T}=\left[\begin{array}{cc}\delta \mathbf{P}(\nu )& {\mathcal{Y}}^{\top }{\tilde{F}}^{\top }{\mathcal{Z}}^{\top }\\ \mathcal{Z}\tilde{F}\mathcal{Y}& \mathbf{P}(\nu )\end{array}\right].$$

$$\left(\begin{array}{cc}{K}_1-XAY& K_2\\ K_3& K_4\end{array}\right):=\left(\begin{array}{cc}U& XB\\ 0& I_{n_u}\end{array}\right)\left(\begin{array}{cc}{A}_c& B_c\\ C_c& D_c\end{array}\right)\left(\begin{array}{cc}{V}^{\top }& 0\\ CY& I_{n_y}\end{array}\right),$$

$$\mathcal{Z}F\mathcal{Y}=\left[\begin{array}{cc}AY+B{K}_3& A+B{K}_{4}C\\ K_1& XA+K_{2}C\end{array}\right]=:\mathbf{F}(\nu ),$$

$$\mathcal{Z}\tilde{F}\mathcal{Y}=\left[\begin{array}{cc}AY+B{K}_3& A+B{K}_{4}C\\ XB{K}_3+XAY& XA+XB{K}_{4}C\end{array}\right]=:\tilde{\mathbf{F}}(\nu ).$$

$${\mathcal{T}}^{\top }\mathcal{L}\mathcal{T}=\left[\begin{array}{cc}(1+\mu )\mathbf{P}(\nu )& \mathbf{F}(\nu {)}^{\top }\\ \mathbf{F}(\nu )& \mathbf{P}(\nu )\end{array}\right]=:\mathbf{L}(\nu ),$$

$${\mathcal{T}}^{\top }\tilde{\mathcal{L}}\mathcal{T}=\left[\begin{array}{cc}\delta \mathbf{P}(\nu )& \tilde{\mathbf{F}}(\nu {)}^{\top }\\ \tilde{\mathbf{F}}(\nu )& \mathbf{P}(\nu )\end{array}\right]=:\mathbf{S}(\nu ),$$

$$\mathbf{R}(\nu )$$

$$\tilde{\mathbf{L}}(\nu )$$

$$\left\{\begin{array}[]{c}(\mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0,\text{ }\mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0,\text{ and }\tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0)\\ \Downarrow\\ (P{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0,\text{ }\mathcal{L}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0,\text{ and }\tilde{\mathcal{L}}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0),\end{array}\right.$$

$${\bar{A}}_c$$

$${\bar{B}}_c$$

$${\bar{C}}_c$$

$${\bar{D}}_c$$

$$\displaystyle\bar{\bar{\mathcal{C}}}:\left\{\begin{array}[]{rl}x_{c}[k+1]&=\begin{cases}\bar{A}_{c}x_{c}[k]+\bar{B}_{c}\bar{y}[k],&(k+1)\operatorname{mod}T\neq 0,\\ 0,&(k+1)\operatorname{mod}T=0,\end{cases}\\[15.00002pt] u[k]&=\bar{C}_{c}x_{c}[k]+\bar{D}_{c}\bar{y}[k],\end{array}\right.$$

$$\bar{y}[k]$$

$$\displaystyle n>\log_{2}\bigg{(}\dfrac{\lambda_{\max}(C^{\top}C)}{\epsilon}x_{0}^{\top}\begin{bmatrix}I&0\\ 0&0\end{bmatrix}P\begin{bmatrix}I&0\\ 0&0\end{bmatrix}x_{0}\bigg{)}+1;$$

$${\tilde{A}}_c$$

$$\displaystyle\tilde{B}_{c}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}[k]}$$

Full text

I Introduction

Internet of Things (IoT) has brought opportunities for flexibility of deployment and efficiency improvements. However, it threatens security and privacy of individuals and businesses as IoT devices, by design, share their information for processing over the cloud. This information can be secured from adversaries over the network by using encrypted communication channels [1]. This approach, although effective and necessary, does not address vulnerability of the data on servers running cloud-computing services. These services themselves can use the data for targeted advertisement or can be hacked for malicious purposes. Therefore, there is a need for a more secure methodology that addresses the security and privacy of data while being processed.

Thankfully secure cloud computing is possible with the use of homomorphic encryption methods – encryption methods that allow computation over plain data by performing appropriate computations on the encrypted data [2, 3, 4]. The use of homomorphic encryption allows a controller to be remotely realised without needing to openly sharing private and sensitive data (and consenting to its use in an unencrypted manner). This paper specifically discusses secure and private implementation of linear time-invariant dynamic controllers with the aid of the Paillier’s encryption [3], a semi-homomorphic encryption method.

The use of homomorphic encryption for secure control has been studied previously [5, 6, 7, 8, 9, 10, 11, 12]. However, all these studies consider static controllers. This is because, when dealing with dynamical control laws (with an encrypted memory/state that must be maintained remotely), the number of bits required for representing the state of the controller grows linearly with the number of iterations. This renders the memory useless after a few iterations due to an overflow or an underflow (i.e., number of fractional bits required for representing a number becomes larger than the number of fractional bits in the fixed-point number basis). In fact, using rough calculations, it can be seen that for a system with sampling time of 10 milliseconds, 16 bits quantized controller parameters and measurements, and within an encryption space of 2048 bits111Encryption keys with the length of 2048 bits is recommended by National Institute of Standards and Technology (NIST) for data over 2016-2030; see https://www.keylength.com/en/4/. , the state of the controller becomes incorrect after roughly 1.2 seconds due to an overflow or underflow. The unstabilizing effect of restricting the memory of controllers to finite rings is illustrated in Section IV for the key length of 2048 bits using a controller that can easily stabilize a batch chemical reactor in the absence of encryption.

There are multiple ways to deal with this issue:

We should decrypt the state of the encrypted controller, project it into the desired set of fixed-point rational numbers, and encrypt it again. To avoid this issue, the encrypted state can be sent to a trust third-party (e.g., an IoT device) to be decrypted, rounded, encrypted, and transmitted back. This adds unnecessary communication overhead and overburdens the computational units of the IoT device. Furthermore, by decrypting the state, the risk of a privacy or security breach increases. 2. 2.

We should restrict the controller parameters so that the state of the dynamic controller remains within the set of fixed-point rational numbers. This approach was pursued in [13]. This makes the problem of designing the controller into a mixed-integer optimization problem, which can be computationally exhaustive. However, a robust control approach can be taken to ensure that converting non-integer controllers to integer ones does not ruin stability [13]. 3. 3.

We should reset the controller, i.e., the state of the controller is set to a publicly known number (e.g., zero) periodically. In this case, the controller must be redesigned to ensure stability/performance, which this paper shows to remain a tractable optimisation problem. This is the approach chosen by the current paper.

In this paper, we only focus on encrypting the outputs of the system and the state of the controller. This is because the parameters of the controller are often not sensitive in practice. For instance, in autonomous vehicles, the location and velocity are sensitive as they reveal private information about the user, e.g., home/work address and travel habits, while the controller parameters are implicitly related to the dynamics of the vehicle.

Resetting controllers have been previously studied in [14, 15, 16, 17, 18, 19, 20]. However, the synthesis approach in this paper is more general than those studies and further it is designed to accommodate challenges associated with the implementation of dynamical controllers over the cipher space. Particularly, majority of existing work on reset controllers focus on state dependent triggers. Due to the nature of our problem, where the controller cannot access to the unencrypted state, those results are not applicable. Along the same lines, since we always have to reset the controller to the same state regardless of the state of the plant, the existing results for switched systems seem to be not applicable.

The rest of the paper is organized as follows. Preliminary materials on homomorphic encryption are presented in Section II. The design and implementation of the controller is discussed in Section III. Finally, numerical results are presented in Section IV and the paper is concluded in Section V. All proofs are presented in the appendices to improve the overall presentation of the paper.

II Preliminary Material

In this paper, a tuple $(\mathbb{P},\mathbb{C},\mathbb{K},\mathfrak{E},\mathfrak{D})$ denotes a public key encryption scheme, where $\mathbb{P}$ is the set of plaintexts, $\mathbb{C}$ is the set of ciphertexts, $\mathbb{K}$ is the set of keys, $\mathfrak{E}$ is the encryption algorithm, and $\mathfrak{D}$ is the decryption algorithm. Each $\kappa=(\kappa_{p},\kappa_{s})\in\mathbb{K}$ is composed of a public key $\kappa_{p}$ (which is shared with and used by everyone for encrypting plaintexts) and a private key $\kappa_{s}$ (which is maintained only by the trusted parties for decryption). Algorithms $\mathfrak{E}$ and $\mathfrak{D}$ are publicly known while the keys, which set the parameters of these algorithms, are generated and used in each case. The use of the term “algorithm”, instead of mapping or function, is due to the presence of random222These random elements are replaced with pseudo-random ones when implementing encryption and decryption algorithms. elements in the encryption procedure possibly resulting in one plaintext being mapped to multiple ciphertexts. A necessary requirement for the encryption scheme is to be invertible, i.e., $\mathfrak{D}(\mathfrak{E}(x,\kappa_{p}),\kappa_{p},\kappa_{s})=x$ for all $x\in\mathbb{P}$ given $\kappa=(\kappa_{p},\kappa_{s})\in\mathbb{K}$.

Definition 1** (Homomorphic Property).**

*Assume there exist operators $\circ$ and $\diamond$ such that $(\mathbb{P},\circ)$ and $(\mathbb{C},\diamond)$ form groups. A public key encryption $(\mathbb{P},\mathbb{C},\mathbb{K},\mathfrak{E},\mathfrak{D})$ is called called homomorphic if {\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\mathfrak{D}(}\mathfrak{E}(x_{1},\kappa_{p})\diamond\mathfrak{E}(x_{1},\kappa_{p}){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0},\kappa_{p},\kappa_{s})}=x_{1}\circ x_{2} for all $x_{1},x_{2}\in\mathbb{P}$ and $\kappa\in\mathbb{K}$. *

Throughout this paper, $|\mathbb{A}|$ denotes the cardinality of any set $\mathbb{A}$. Further, we define the notation $\mathbb{Z}_{q}:=\{0,\dots,q-1\}=\{n\operatorname{mod}q:\forall n\in\mathbb{Z}\}$ for all positive integers $q\in\mathbb{N}$. In this paper, we assume that $\mathbb{P}=\mathbb{Z}_{n_{p}}$ and $\mathbb{C}=\mathbb{Z}_{n_{c}}$ with $n_{p}=|\mathbb{P}|$ and $n_{c}=|\mathbb{C}|$. A public key encryption $(\mathbb{P},\mathbb{C},\mathbb{K},\mathfrak{E},\mathfrak{D})$ is additively homomorphic if there exists an operator $\diamond$ such that Definition 1 is satisfied when the operator $\circ$ is defined as $x_{1}\circ x_{2}:=(x_{1}+x_{2})\,\operatorname{mod}\,n_{p}$ for all $x_{1},x_{2}\in\mathbb{P}$. For additively homomorphic schemes, in this paper, the notation $\oplus$ is used to denote the equivalent operator in the ciphertext domain ($\diamond$ in the definition above). Similarly, a public key encryption is multiplicatively homomorphic if there exists an operator $\diamond$ such that Definition 1 is satisfied with $\circ$ defined as $x_{1}\circ x_{2}:=(x_{1}x_{2})\,\operatorname{mod}\,n_{p}$ for all $x_{1},x_{2}\in\mathbb{P}$. If a public key encryption is both additively and multiplicatively homomorphic, it is fully homomorphic but, if only one of these conditions is satisfied, it is semi-homomorphic. Homomorphism shows there exist operations over ciphertexts that can generate encrypted versions of sumed or multiplied plaintexts without the need of decrypting their corresponding cuphertexts. An example of additively homomorphic encryption scheme is the Paillier’s encryption method [3]. ElGamal is an example of multiplicatively homomorphic encryption schemes [4]. Recently, several fully homomorphic encryption methods have been also developed, see, e.g., [2].

Now, we define semantic security, borrowed from [21]. A key $\kappa=(\kappa_{p},\kappa_{s})\in\mathbb{K}$ is randomly generated. A probabilistic polynomial time-bounded adversary proposes $x_{1},x_{2}\in\mathbb{P}$. The agent chooses $x$ at random from $\{x_{1},x_{2}\}$ with equal probability, encrypts $x$ according to $y=\mathfrak{E}(x,\kappa_{p})$, and sends $y$ to the adversary (along with the public key $\kappa_{p}$). The adversary produces $x^{\prime}$, which is an estimate of $x$ based on all the avialable information (everything except $\kappa_{s}$, i.e., $x_{1}$, $x_{2}$, $y$, $\mathfrak{E}$, $\mathfrak{D}$, $\kappa_{p}$). The adversary’s advantage (in comparison to that of a pure random number generator) is given by $\mathrm{Adv}(|\mathbb{K}|):=|\mathbb{P}\{x=x^{\prime}\}-1/2|$. The public key encryption $(\mathbb{P},\mathbb{C},\mathbb{K},\mathfrak{E},\mathfrak{D})$ is semantically secure (alternatively known as indistinguishability under chosen plaintext attack) if $\mathrm{Adv}$ is negligible333A function $f:\mathbb{N}\rightarrow\mathbb{R}_{\geq 0}$ is called negligible if, for any $c\in\mathbb{N}$, there exists $n_{c}\in\mathbb{N}$ such that $f(n)\leq 1/n^{c}$ for all $n\geq n_{c}$..

In this paper, the results are presented for the Paillier’s encryption method. It is noteworthy that the Paillier’s encryption method is semantically secure under the Decisional Composite Residuosity Assumption, i.e., it is “hard” to decide whether there exists $y\in\mathbb{Z}_{N^{2}}$ such that $x=y^{N}\operatorname{mod}N$ for $N\in\mathbb{Z}$ and $x\in\mathbb{Z}_{N^{2}}$. More information regarding the assumption can be found in [3, 22]. This can be used to establish the security of the proposed framework.

The Paillier’s encryption scheme is as follows. First the public and private keys are generated. To do so, large prime numbers $p$ and $q$ are selected randomly and independently of each other such that $\gcd(pq,(1-p)(1-q))=1$, where $\gcd(a,b)$ refers to the greatest common divisor of integers $a$ and $b$. The public key (which is shared with all the parties and is used for encryption) is $\kappa_{p}=pq$. The private key (which is only available to the entity that needs to decrypt the data) is $\kappa_{s}=(\lambda,\mu)$ with $\lambda=\operatorname{lcm}(p-1,q-1)$ and $\mu=\lambda^{-1}\operatorname{mod}\kappa_{p}$, where $\operatorname{lcm}(a,b)$ is the least common multiple of integers $a$ and $b$. The ciphertext of plain message $x\in\mathbb{P}=\mathbb{Z}_{\kappa_{p}}$ is $\mathfrak{E}(x,\kappa_{p})=(\kappa_{p}+1)^{x}r^{\kappa_{p}}\operatorname{mod}\kappa_{p}^{2},$ where $r$ is randomly selected with uniform probability from $\mathbb{Z}^{*}_{\kappa_{p}}:=\{x\in\mathbb{Z}_{\kappa_{p}}|\gcd(x,\kappa_{p})=1\}$. Finally, to decrypt any ciphertext $c\in\mathbb{C}=\mathbb{Z}_{\kappa_{p}^{2}}$, $\mathfrak{D}(c,\kappa_{p},\kappa_{s})=(L(c^{\lambda}\operatorname{mod}\kappa_{p}^{2})\mu)\operatorname{mod}\kappa_{p},$ where $L(z)=(z-1)/\kappa_{p}$.

Proposition 1**.**

[3]* 1) For $r,r^{\prime}\in\mathbb{Z}^{*}_{\kappa_{p}}$ and $t,t^{\prime}\in\mathbb{P}$ such that $t+t^{\prime}\in\mathbb{P}$, $\mathfrak{E}(t,\kappa_{p})\mathfrak{E}(t^{\prime},\kappa_{p})\operatorname{mod}\kappa_{p}^{2}=\mathfrak{E}(t+t^{\prime},\kappa_{p})$; 2) For $r\in\mathbb{Z}^{*}_{\kappa_{p}}$ and $t,t^{\prime}\in\mathbb{P}$ such that $tt^{\prime}\in\mathbb{P}$, $\mathfrak{E}(t,\kappa_{p})^{t^{\prime}}\operatorname{mod}\kappa_{p}^{2}=\mathfrak{E}(t^{\prime}t,\kappa_{p})$.

Proposition 1 shows that the Paillier’s encryption is a semi-homomorphic encryption scheme, i.e., algebraic manipulation of the plain data is possible without decryption using appropriate operations over the encrypted data. The Paillier’s encryption is additively homomorphic with operator $\oplus$ being defined as $x_{1}\oplus x_{2}=(x_{1}x_{2})\operatorname{mod}\kappa_{p}^{2}$ for all $x_{1},x_{2}\in\mathbb{C}$. Note that the Paillier’s method is not multiplicatively homomorphic as $t^{\prime}$ in the identity $\mathfrak{E}(t,\kappa_{p})^{t^{\prime}}\operatorname{mod}\kappa_{p}^{2}=\mathfrak{E}(t^{\prime}t,\kappa_{p})$ in Proposition 1 is not encrypted. Define $\triangle$ such that $x_{1}\triangle x_{2}=x_{1}^{x_{2}}\operatorname{mod}N^{2}$ for all $x_{1}\in\mathbb{C}$ and $x_{2}\in\mathbb{P}$. Note that $\triangle$ is not an operator (in the mathematical sense) as its operands belong to two difference sets; it is just a mapping.

III Dynamic Controller Implementation

Consider the discrete-time linear time invariant system

[TABLE]

with $k\in\mathbb{N}$, state $x[k]\in\mathbb{R}^{n_{x}}$, control input $u[k]\in\mathbb{R}^{n_{u}}$, and output $y[k]\in\mathbb{R}^{n_{y}}$. Many linear time-invariant systems cannot be stabilized by static output feedback controllers [23, 24, 25]. Therefore, dynamic output feedback controllers have been used for decades to stabilize system using only output measurements, e.g., standard Kalman-filter (or Luenberger observer) based linear regulators [26], and general dynamic output feedback controllers for quadratic performance [27]. System (3) is controlled by a dynamic output feedback controller of the form

[TABLE]

with controller state $x_{c}[k]\in\mathbb{R}^{n_{c}}$. It is assumed that the state of the controller resets every $T$ time steps, i.e., $x_{c}[\ell T]=0$ for all $\ell\in\mathbb{N}$. This is because implementing encrypted controllers over an infinite horizon is impossible due to memory issues (by multiplication of fractional numbers, the number of bits required for representing fractional and integer parts grow). Combining the dynamics in (3) and (6) results in the augmented system:

[TABLE]

where $z[k]:=\begin{bmatrix}x[k]^{\top}&x_{c}[k]^{\top}\end{bmatrix}^{\top}$ and

[TABLE]

The following theorem provides a sufficient condition for the asymptotic stability of the origin of (3) in feedback with the resetting controller (6).

Theorem 1**.**

The closed-loop dynamics (3)-(6) is globally asymptotically stable if there exist $P\in\mathbb{R}^{(n_{c}+n_{x})\times(n_{c}+n_{x})}$, $\varepsilon\in(0,1)$, $\mu\in[-1,0)$, $\delta\in[1,\infty)$, and $\epsilon\in(0,\infty)$ satisfying:

[TABLE]

Proof:

See Appendix A.

The following result provides a sufficient condition for the stabilizability of the system using the resetting controller.

Proposition 2**.**

*If $n_{c}\geq n_{x}$, $(A,B)$ is stabilizable, and $(A,C)$ is detectable, there exist $\mu=\mu^{*}\in[-1,0)$ and $\epsilon=\epsilon^{*}\in(0,\infty)$ such that (9a) and (9b) are satisfied. *

Proof:

See Appendix B.

For $\mu^{*}\in[-1,0)$ and $\epsilon^{*}\in(0,\infty)$ in Proposition 2, the following problem can be solved to find the smallest resetting horizon $T$ for the dynamical controller:

[TABLE]

Note that the conditions in Theorem 1, or optimization problem (10), are sufficient but not necessary. This is always the case when working with Lyapunov-based techniques for stability of dynamical systems [27, 28]. In the next subsection, we provide change of variables to cast these conditions as linear matrix inequalities that can be solved off-line only once and passed to the cloud for real-time control.

III-A Synthesis of Resetting Controllers

In this subsection, we use appropriate change of variables to linearize the matrix inequalities in Theorem 1 without generating conservatism. We provide tools for designing full order ($n_{c}=n_{x}$) resetting controllers of the form (6) satisfying (9). That is, we look for matrices $(A_{c},B_{c},C_{c},D_{c})$ satisfying the inequalities in (9) for some positive definite $P\in{\mathbb{R}}^{2n_{x}\times 2n_{x}}$, $\mu\in[-1,0)$, $\delta\in(0,\infty)$, $\varepsilon\in(0,1)$, and $T\in\mathbb{N}$. Let $n_{c}=n_{x}$ and $P$ be positive definite. Consider $F(\mathcal{P},\mathcal{C})$ in (8) and define:

[TABLE]

For simplicity of notation, in this subsection, $F(\mathcal{P},\mathcal{C})$ and $\tilde{F}(\mathcal{P},\mathcal{C})$ are denoted by $F$ and $\tilde{F}$, respectively. Then, (9b) and (9c) can be written as

[TABLE]

where [math] denotes the zero matrix of appropriate dimensions. Using properties of the Schur complement, inequalities (12) are fulfilled if and only if the following is satisfied:

[TABLE]

Note that the blocks $PF$ and $P\tilde{F}$ are nonlinear functions of $(P,A_{c},B_{c},C_{c},D_{c})$. In what follows, we propose a change of variables: $\left(P,A_{c},B_{c},C_{c},D_{c}\right)\rightarrow\nu,$ so that, in the new variables $\nu$, we can obtain affine matrix inequalities equivalent to (13). In particular, for positive definite $P$ and nonlinear matrix inequalities $\mathcal{L}\geq 0$ and $\tilde{\mathcal{L}}\geq 0$, we aim at finding two invertible matrices $\mathcal{Y}$ and $\mathcal{T}$, and variables $\nu$ such that the congruence transformations $P\rightarrow\mathcal{Y}^{\top}P\mathcal{Y}$, $\mathcal{L}\rightarrow\mathcal{T}^{\top}\mathcal{L}\mathcal{T}$, and $\tilde{\mathcal{L}}\rightarrow\mathcal{T}^{\top}\tilde{\mathcal{L}}\mathcal{T}$ lead to new Linear Matrix Inequalities (LMIs) $\mathcal{Y}^{\top}P\mathcal{Y}>0$, $\mathcal{T}^{\top}\mathcal{L}\mathcal{T}\geq 0$, and $\mathcal{T}^{\top}\tilde{\mathcal{L}}\mathcal{T}\geq 0$ in the variables $\nu$. Let $P$ be positive definite and partitioned as follows:

[TABLE]

with $X,U,\tilde{X}\in{\mathbb{R}}^{n_{x}\times n_{x}}$ and positive definite $X,\tilde{X}$. Define

[TABLE]

Using block matrix inversion formulas, it can be verified that $YX+VU^{\top}=I$ and $YU+V\tilde{X}=0$, which yields $\mathcal{Y}^{\top}P=\mathcal{Z}$. Then, $P\rightarrow\mathcal{Y}^{\top}P\mathcal{Y}$ takes the form:

[TABLE]

Define $\mathcal{T}:=\text{diag}[\mathcal{Y},\mathcal{Y}]$ with $\mathcal{Y}$ as introduced in (15). Then, the transformations $\mathcal{L}\rightarrow\mathcal{T}^{\top}\mathcal{L}\mathcal{T}$ and $\tilde{\mathcal{L}}\rightarrow\mathcal{T}^{\top}\tilde{\mathcal{L}}\mathcal{T}$ can be written as

[TABLE]

Using the structure of $F$ and $\tilde{F}$ and the change of variables:

[TABLE]

the blocks $\mathcal{Z}F\mathcal{Y}$ and $\mathcal{Z}\tilde{F}\mathcal{Y}$ can be written as

[TABLE]

Therefore, under $\mathcal{T}$ and the change of variables in (19), we can write $\mathcal{T}^{\top}\mathcal{L}\mathcal{T}$ and $\mathcal{T}^{\top}\tilde{\mathcal{L}}\mathcal{T}$ as follows:

[TABLE]

with $\mathbf{P}(\nu),\mathbf{F}(\nu)$, and $\tilde{\mathbf{F}}(\nu)$ as defined in (16), (20), and (21), respectively. Therefore, the original matrix inequality, $\mathcal{L}\succeq 0$ defined in (13), that depends non-linearly on the decision variables $(P,A_{c},B_{c},C_{c},D_{c})$ is transformed into a new inequality, $\mathbf{L}(\nu)\succeq 0$, that is an affine function of the variables $\nu$. Note, however, that $\mathbf{S}(\nu)\succeq 0$ (the block $\tilde{\mathbf{F}}(\nu)$) is still nonlinear in the new variables $\nu$. In the following lemma, we give a sufficient condition, in terms of an affine inequality $\tilde{\mathbf{L}}(\nu)\succeq 0$, for $\mathbf{S}(\nu)$ to be positive semidefinite.

Lemma 1**.**

Consider $\mathbf{P}(\nu)$ and $\mathbf{S}(\nu)$ defined in (16) and (23), respectively. Define the matrices:

[TABLE]

*Then, $\tilde{\mathbf{L}}(\nu)\succeq 0\Rightarrow\mathbf{S}(\nu)\succeq 0$. *

Proof:

See Appendix C.

Lemma 1 provides a sufficient condition, $\tilde{\mathbf{L}}(\nu)\succeq 0$, for the nonlinear matrix $\mathbf{S}(\nu)$ to be positive semidefinite. This $\tilde{\mathbf{L}}(\nu)$ is an affine function of $\nu$. Note, however, that finding $\nu$ satisfying $(\mathbf{P}(\nu)\succ 0,\hskip 1.42262pt\mathbf{L}(\nu)\succeq 0,\hskip 1.42262pt\tilde{\mathbf{L}}(\nu)\succeq 0)$ might not be sufficient to guarantee the existence of $(P,A_{c},B_{c},C_{c},D_{c})$ satisfying $(P\succ 0,\hskip 1.42262pt\mathcal{L}\succeq 0,\hskip 1.42262pt\tilde{\mathcal{L}}\succeq 0)$. For this to be true, matrices $\mathcal{Y}$ and $\mathcal{T}$ must be invertible so that the transformations $P\rightarrow\mathcal{Y}^{\top}P\mathcal{Y}=\mathbf{P}(\nu)$, $\mathcal{L}\rightarrow\mathcal{T}^{\top}\mathcal{L}\mathcal{T}=\mathbf{L}(\nu)$, and $\tilde{\mathcal{L}}\rightarrow\mathcal{T}^{\top}\tilde{\mathcal{L}}\mathcal{T}=\mathbf{S}(\nu)$ are congruence transformations; and $\nu$ must render the change of variables in (19) invertible.

Lemma 2**.**

*Consider matrices $\mathcal{Y}$ and $\mathbf{P}(\nu)$ defined in (15) and (16), respectively. Let $(X,Y)$ be such that $\mathbf{P}(\nu)\succ 0$. Then, $\mathcal{Y}$ and $\mathcal{T}=\text{diag}(\mathcal{Y},\mathcal{Y})$ are nonsingular and the change of variables in (19) is invertible. *

Proof:

See Appendix D.

Therefore, by Lemma 2, if $\mathbf{P}(\nu)\succ 0$, the transformations $P\rightarrow\mathbf{P}(\nu)$, $\mathcal{L}\rightarrow\mathbf{L}(\nu)$, and $\tilde{\mathcal{L}}\rightarrow\mathbf{S}(\nu)$ are congruence transformations. The latter and the fact that (by Lemma 1) \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0\Rightarrow\mathbf{S}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0 imply that

[TABLE]

for $P=\mathcal{Y}^{-\top}\mathbf{P}(\nu)\mathcal{Y}^{-1}$ and the controller matrices in (55) obtained by inverting (19). In the following lemma, we summarize the discussion presented above.

Lemma 3**.**

*For given system matrices $(A,B,C)$. If there exist matrices $\nu=(X,Y,K_{1},K_{2},K_{3},K_{4})$, $K_{2}\in{\mathbb{R}}^{n_{x}\times n_{u}}$, $K_{3}\in{\mathbb{R}}^{n_{y}\times n_{x}}$, $K_{4}\in{\mathbb{R}}^{n_{u}\times n_{y}}$, $X,Y,K_{1}\in{\mathbb{R}}^{n_{x}\times n_{x}}$ satisfying \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0 with $\mathbf{P}(\nu)$, $\mathbf{L}(\nu)$, and $\tilde{\mathbf{L}}(\nu)$ as defined in (16), (22), and (25), respectively; then, there exist $(P,A_{c},B_{c},C_{c},D_{c})$ satisfying P{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathcal{L}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathcal{L}}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0 with $P$, $\mathcal{L}$, and $\tilde{\mathcal{L}}$ as defined in (13) and (14), respectively. Moreover, for every $\nu$ such that \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, the change of variables in (19) and matrix $\mathcal{Y}$ in (15) are invertible and the $(P,A_{c},B_{c},C_{c},D_{c})$ obtained by inverting (16) and (19) are unique and satisfy the analysis inequalities (12). *

Proof:

See Appendix E.

By Lemma 3, the matrices $(P,A_{c},B_{c},C_{c},D_{c})$ obtained by inverting (16) and (19) satisfy inequalities (12) (and thus also (9b) and (9c)). Moreover, because the reconstructed $P$ is positive definite, inequality (9a) is satisfied with $\epsilon=\lambda_{\min}(P)$, where $\lambda_{\min}(P)\in{\mathbb{R}}_{>0}$ denotes the smallest eigenvalue of $P$. Next, we give the synthesis result corresponding to Theorem 1.

Theorem 2**.**

*For given system matrices $(A,B,C)$ and constants $\varepsilon\in(0,1)$, $\mu\in[-1,0)$, $\delta\in[1,\infty)$, and $T\in{\mathbb{N}}$ satisfying (9d), if there exist matrices $\nu=(X,Y,K_{1},K_{2},K_{3},K_{4})$ satisfying \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0; then, $P=\mathcal{Y}^{-\top}\mathbf{P(\nu)}\mathcal{Y}$ and the controller matrices in (55) satisfy the analysis inequalities (9a)-(9c) and thus render the closed-loop dynamics (3)-(6) asymptotically stable. *

Proof:

See Appendix F.

Controller Reconstruction. For given $\nu$ satisfying the synthesis inequalities (\mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0,\mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0):

For given $X$ and $Y$, compute via singular value decomposition a full rank factorization $VU^{\top}=I-YX$ with square and nonsingular $V$ and $U$. 2. 2.

For given $\nu$ and invertible $V$ and $U$, solve the system of equations $\mathcal{Y}^{\top}P\mathcal{T}=\mathbf{P}(\nu)$ and (19) to obtain the matrices $(P,A_{c},B_{c},C_{c},D_{c})$.

Remark 1**.**

*Note that $\varepsilon,\mu,\delta$, and $T$, in Theorem 2 must be fixed before looking for feasible solutions $\nu$ satisfying the synthesis LMIs: \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0. However, for any $\mu\in[-1,0)$ and $\delta\in[1,\infty)$, there always exist $\varepsilon\in(0,1)$ and $T\in{\mathbb{N}}$ satisfying (9d). Moreover, the synthesis LMIs depend on $\nu$, $\delta$, and $\mu$ but not on $\varepsilon$ and $T$. Therefore, to find feasible controllers, we only have to fix $(\mu,\delta)$ and look for $\nu$ satisfying the synthesis LMIs. The constants $(\mu,\delta)$ are, in fact, variables of the synthesis problem; however, to linearize some of the constraints, we fix their value and search over $\mu\in[-1,0)$ and $\delta\in[1,\infty)$ to find feasible $\nu$. The latter increases the computations needed to find controllers; however, we can perform a bisection search over $\delta\in[1,\infty)$ and, because $\mu\in[-1,0)$ (a bounded set), a grid search over $\mu$ to decrease the required computations. *

Finally, note that the characteristics (e.g., unstable poles) of the system in (3) make the feasibility of the design LMIs \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0 “easier or harder” for fixed resetting horizon $T$ and constants $\varepsilon,\mu,\delta$. Exploring this dependence, in general, is an avenue for future research.

III-B Dynamic Controller Implementation

In this subsection, we present the necessary transformations required for implementing encrypted dynamic control laws. Before stating the next result, we introduce some notation. Define $\|A\|_{\max}:=\max_{i,j}|a_{ij}|$, where $a_{ij}$ denotes the entry in $i$-th row and $j$-th column of matrix $A$, and $\mathbb{Q}(n,m):=\{b\,|\,b=-b_{n}2^{n-m-1}+\sum_{i=1}^{n-1}2^{i-m-1}b_{i},b_{i}\in\{0,1\}\,\forall i\in\{1,\dots,n\}\}.$ For any $x\in\mathbb{R}^{q}$ and $\mathbb{A}\subseteq\mathbb{R}^{q}$, let $\operatorname{proj}(x,\mathbb{A})\in\mathop{\text{arg\,min}}_{x^{\prime}\in\mathbb{A}}\|x^{\prime}-x\|_{\infty}$ and $\operatorname{dist}(x,\mathbb{A}):=\min_{x^{\prime}\in\mathbb{A}}\|x^{\prime}-x\|_{\infty}$. The quantization of $x\in\mathbb{R}^{q}$ is $\operatorname{proj}(x,\mathbb{Q}(n,m)^{q})$ and the quantization error is $\|\operatorname{proj}(x,\mathbb{Q}(n,m)^{q})-x\|_{\infty}=\operatorname{dist}(x,\mathbb{Q}(n,m)^{q})$. The quantization of $X\in\mathbb{R}^{p\times q}$ is defined as $\operatorname{proj}(x,\mathbb{Q}(n,m)^{p\times q})\in\mathop{\text{arg\,min}}_{x^{\prime}\in\mathbb{A}}\|x^{\prime}-x\|_{\max}$ and the quantization error as $\|\operatorname{proj}(x,\mathbb{Q}(n,m)^{p\times q})-x\|_{\max}$. Please refer to [6] for details about the quantization scheme.

Theorem 3**.**

Let

[TABLE]

Then, there exists $\bar{n}\geq\bar{m}>0$ such that $F(\mathcal{P},\mathcal{C})$ satisfies (9) if and only if $F(\mathcal{P},\bar{\mathcal{C}})$, where $\bar{\mathcal{C}}$ denotes the controller in (6) with quantized parameters $\bar{A}_{c}$, $\bar{B}_{c}$, $\bar{C}_{c}$, and $\bar{D}_{c}$ in (27), satisfies (9) with the same $P$ for all $n\geq\bar{n}$ and $m\geq\bar{m}$.

Proof:

The proof follows from continuity of the eigenvalues. Note that, by increasing $n$ and $m$, the quantization error decreases (actually, it tends to zero).

In what follows, we discuss the implementation of quantized resetting controllers using homomorphic encryption schemes and quantized sensor measurements. The controller, in this case, is given by

[TABLE]

where $\bar{A}_{c}$, $\bar{B}_{c}$, $\bar{C}_{c}$, and $\bar{D}_{c}$ are defined in (27) and

[TABLE]

The difference between $\bar{\bar{\mathcal{C}}}$ in (30) and $\bar{\mathcal{C}}$ in Theorem 3 is the quantization of the output measurements $y[k]$. The following standing assumption is made in this paper to ensure the stability of the closed-loop system.

Assumption 1**.**

$n\geq\bar{n}$* and $m\geq\bar{m}$ where $\bar{n}$ and $\bar{m}$ are given in Theorem 3. *

The following theorem proves the stability of the system $\mathcal{P}$ with the quantized resetting controller $\bar{\bar{\mathcal{C}}}$. Note that, for any $r\in\mathbb{R}_{\geq 0}$, $\mathbb{B}(r):=\{x\,|\,\|x\|_{2}^{2}\leq r\}$.

Theorem 4**.**

Under Assumption 1, if there exist $\varepsilon\in(0,1)$, $\mu\in[-1,0)$, $\delta\in[1,\infty)$, $T\in{\mathbb{N}}$, and $\epsilon\in(0,\infty)$ such that inequalities in (9) are satisfied and

[TABLE]

*then, the system dynamics (3) with the quantized resetting controller in (30) is stable and, for some constant444See Appendix G for a description of this constant. $\varrho>0$, $\lim_{k\rightarrow\infty}\operatorname{dist}(x[k],\mathbb{B}(\varrho 2^{-m}))=0$. *

Proof:

See Appendix G

Theorem 4 implies that the state of the system converges to a vicinity of the origin (instead of the origin itself) due to quantization effects. The volume of the this area can be arbitrarily reduced by increasing $m$ and thus the performance of the system can be arbitrarily improved.

Lemma 4**.**

*For the resetting quantized controller in (30), $x_{c}[k]\in\mathbb{Q}((n_{c}+1)(k\operatorname{mod}T-1)+n_{y}+n(k\operatorname{mod}T+1),m(k\operatorname{mod}T+1))^{n_{c}}$ and $u_{c}[k]\in\mathbb{Q}((n_{c}+1)(k\operatorname{mod}T)+n_{y}+n(k\operatorname{mod}T+2),m(k\operatorname{mod}T+2))^{n_{u}}$. *

Proof:

See Appendix H.

Using the change of variables:

[TABLE]

with $\tilde{n}>(n_{c}+1)T+n_{u}+n(T+2)$, the resetting quantized controller in (30) can be rewritten as

[TABLE]

Note that, by Lemma 4, $\tilde{A}_{c},\tilde{B}_{c},\tilde{C}_{c},\tilde{D}_{c},\tilde{x}_{c},\tilde{y},\tilde{u}$ are positive integers. This is useful because the Paillier’s scheme can only work with finite ring of positive integers. Therefore, the update equation can now be implemented using Paillier’s encryption scheme. The correctness of this implementation follows from the results of [6] on fixed-point rational numbers.

First, the public and private keys must be generated such that $\kappa_{p}\geq 2^{\tilde{n}+1}$ to ensure that no unintended overflow occurs when using the encrypted numbers. The sensors measure, quantize, and encrypt the output to obtain

[TABLE]

The controller follows the encrypted version of (36) to update its state and compute the actuation signal as

[TABLE]

[TABLE]

Finally, the actuator extract the control signal by $\tilde{u}_{i}[k]=\mathfrak{D}(\check{u}_{i}[k],\kappa_{p},\kappa_{s})\operatorname{mod}2^{\tilde{n}},$ and implements $u_{i}[k]=2^{-m(k\operatorname{mod}T+2)}(\tilde{u}_{i}[k]-2^{\tilde{n}}\mathds{1}_{\tilde{u}_{i}[k]\geq 2^{\tilde{n}-1}}).$

Remark 2**.**

*National Institute of Standards and Technology (NIST) recommends the use of key length of 2048 bits for factoring-based asymmetric encryption to guarantee that brute-force attacks are not physically possible during the life-time of the services based on projections of computing technologies. This high standard might not be necessary for some applications, such as remote control of autonomous vehicles. To demonstrate this, consider RSA, which is a similar encryption methodology and also a semi-homomorphic encryption relying on hardness of prime number factorization. RSA encryption has been attacked repeatedly using a brute-force methodology; see RSA Challenge555https://en.wikipedia.org/wiki/RSA_Factoring_Challenge. Factorization of 663 bit numbers has been shown to take approximately 55 CPU-Years666A CPU-Year is the amuont of computing work done by a 1 Giga Floating Point Operations Per Second (FLOP) reference machine in a year of dedicated service (8760 hours). [29]. Using IBM Watson (used recently for natural language processing to win quiz show Jeopardy), factorization of 663 bit numbers takes approximately 2.5 years. These numbers are certainly not safe for use in finance or military. However, for remote control of autonomous vehicles, these keys may provide strong-enough guarantees as, by the time that an adversary breaks the code, the autonomous vehicle is in an entirely different location. *

IV Case Study of a Chemical Batch Reactor

We illustrate the performance of our results through a case study of a batch chemical reactor. This case study has been developed over the years as a benchmark example for networked control systems, see, e.g., [30, 31, 32]. The reactor considered here is open-loop unstable, has one input, and two outputs (please refer to [30, 31, 32] for details about the system dynamics). We exactly discretize the reactor dynamics introduced in [31] with sampling period $h=0.1$. The resulting discrete-time linear system is of the form (3) with matrices $A,B,C$ as follows:

[TABLE]

Note that $\text{ eig}[A]=\{1.22,1.01,.60,.42\}$; thus the system is open-loop unstable. Moreover, it can be verified (e.g., using the tools in [25, Theorem 3.3]) that there does not exist a static output feedback controllers of the form $u[k]=Ly[k]$, $L\in\mathbb{R}^{1\times 2}$, stabilizing system (3) with matrices $(A,B,C)$ as in (IV). First, using the synthesis results in Section III, we design switching dynamic output feedback controllers of the form (6). Using Theorem 2, and conducting a bisection in $\delta\in[1,\infty)$, and a line search in $\mu\in[-1,0)$, we look for the smallest $\delta$ for which there exist $\mu\in[-1,0)$ and $\nu$ satisfying the synthesis LMIs in Theorem 2. The obtained $\delta$ is given by $\delta=\delta^{*}=55.0$, the corresponding $\mu$ is $\mu=\mu^{*}=-0.15$, the resetting horizon is $T^{*}=\text{argmin}_{T\in{\mathbb{N}}}\hskip 2.84526pt\delta^{*}(1+\mu^{*})^{T}=25$, and the reconstructed $A_{c},B_{c},C_{c},D_{c}$ (see Section III) are given in

[TABLE]

This controller satisfies the original inequalities in (9) with $\epsilon=0.0026$ and any $\varepsilon\in(0.9459,1)$. For comparison, let $\mu=\mu^{*}=-0.65$ and search for the smallest $\delta$ for which there exists $\nu$ satisfying the synthesis LMIs in Theorem 2. In this case, $\delta^{*}=3000$, the smallest resetting horizon is $T^{*}=\text{argmin}_{T\in{\mathbb{N}}}\hskip 2.84526pt\delta^{*}(1+\mu^{*})^{T}=8$, the reconstructed $A_{c},B_{c},C_{c},D_{c}$ are in

[TABLE]

This controller satisfies the original inequalities in (9) with $\epsilon=2.8\times 10^{-5}$, and $\varepsilon\in(0.6756,1)$.

Next, we quantize the controller matrices according to (27) to obtain $(\bar{A}_{c},\bar{B}_{c},\bar{C}_{c},\bar{D}_{c})$ with quantizer resolution $(n,m)=(24,14)$. It can be verified that for $A_{c},B_{c},C_{c},D_{c}$ in (41) and (42), the corresponding $\bar{A}_{c},\bar{B}_{c},\bar{C}_{c},\bar{D}_{c}$ satisfy the conditions of Theorem 4 with $(n,m)=(24,14)$. We quantize sensor measurements $y[k]$ according to (31) with the same resolution $(n,m)=(24,14)$, and close the system dynamics with the quantized controller in (30). By Theorem 4, the quantizer resolution must satisfy inequality (32) to ensure practical stability of (3) in feedback with (30) in the sense of Theorem 4. Inequality (32), with initial condition $[x(0)^{T},x_{c}(0)^{T}]=[-6.83,-5.18,-4.05,-3.12,0,0,0,0]$, amounts to $n>17$ for the controller in (41) and to $n>23$ for the controller in (42). Therefore, $(n,m)=(24,14)$ is enough for practical stabilization using the controllers in (41) and (42). Figures 1 and 2 show $\|x(k)\|_{2}$ and $\|x_{c}(k)\|_{2}$ of the closed-loop dynamics for quantized controllers corresponding to the controllers in (41) and (42) with $(n,m)=(24,14)$.

To illustrate the need for the proposed resetting controller, we naively implement a standard quantized dynamic controller of the form:

[TABLE]

We use the same quantizer resolution $(n,m)=(24,14)$, and compute the matrices $(\bar{A}_{c},\bar{B}_{c},\bar{C}_{c},\bar{D}_{c})$ using (27) with $(A_{c},B_{c},C_{c},D_{c})$ from (42). This controller is stabilizing even without resets. Note that the Paillier’s encryption only works over the ring of positive integers $\mathbb{Z}_{\kappa_{p}}$, and thus the controller needs to be transformed so that its states and parameters always belong to this ring. Therefore, as also required for the resetting controller, we must transform $\bar{y}[k]$ and $(\bar{A}_{c},\bar{B}_{c},\bar{C}_{c},\bar{D}_{c})$ into positive integers, which can be done using the change of variables in (33) replacing $k\operatorname{mod}T$ with $k$ (as there is no resetting after $T$ steps in this case). Let the integer representations of $\bar{y}[k]$ and $(\bar{A}_{c},\bar{B}_{c},\bar{C}_{c},\bar{D}_{c})$ be similarly denoted by $\tilde{y}[k]$ and $(\tilde{A}_{c},\tilde{B}_{c},\tilde{C}_{c},\tilde{D}_{c})$. The equivalent controller in the integer domain is then given by

[TABLE]

Finally, given $\tilde{u}[k]$, the actuators implement the control action:

[TABLE]

Because we must ensure that $2^{\tilde{n}}\leq\kappa_{p}$, we need to select a large, yet finite $\tilde{n}$. Here, for illustration purposes, we selected a key length of 2048 bits and $\tilde{n}=2014$. Figure 3 and 4 illustrate the norm of the state of the closed-loop system, $\|x[k]\|_{2}$, with controller (42)-(49), and the state of the controller in the quantized domain, $\|x_{c}[k]\|$, respectively. Note that, even though (42)-(45) is a stabilizing controller (if no under/over flow occur), when implementing (42)-(49), the closed-loop system is unstable due to under/over flows.

V Conclusions and Future Work

A secure and private implementation of linear time-invariant dynamic controllers using the Paillier’s encryption was presented. The state is reset to zero periodically to avoid data overflow or underflow within the encryption space. A control design approach was presented to ensure the stability and performance of the closed-loop system with encrypted controller. Future work can focus on nonlinear dynamical systems and controllers.

Appendix A Proof of Theorem 1

For the sake brevity $F(\mathcal{P},\mathcal{C})$ is denoted by $F$. Consider the quadratic Lyapunov function $V(z[k])=z[k]^{\top}Pz[k]$, where $P$ is a positive semi-definite matrix. For all $k\in\{\ell T,\dots,(\ell+1)T-2\}$ with $\ell\in\mathbb{N}$ the Lyapunov function evolves as

[TABLE]

Therefore,

[TABLE]

Now, note that

[TABLE]

Combining (51) and (52) results in $V(z[(\ell+1)T])\leq\delta(1+\mu)^{T-1}V(z[\ell T]).$ This shows that $\lim_{\ell\rightarrow\infty}V(z[\ell T])=0$. Following (50), it can be seen that $\lim_{k\rightarrow\infty}V(z[k])=0$. This proves the stability of the system.

Appendix B Proof of Proposition 2

We state the proof for two cases where $n_{c}=n_{x}$ and $n_{c}>n_{x}$. Case I ($n_{c}=n_{x}$): Since $(A,B)$ is stabilizable and $(A,C)$ is detectable, a Luenberger observer exists such that conditions (9a) and (9b) are satisfied. Case II ($n_{c}>n_{x}$): Unobservable and uncontrollable states can be incorporated into the controller in addition to the Luenberger observer so that (9a) and (9b) are satisfied.

Appendix C Proof of Lemma 1

The block $\tilde{\mathbf{F}}(\nu)$ can be factored as $\tilde{\mathbf{F}}(\nu)=\mathbf{P}(\nu)\begin{pmatrix}0&I_{n}\end{pmatrix}^{\top}\mathbf{R}(\nu).$ Then, by properties of the Schur complement, $\mathbf{S}(\nu)\succeq 0$ if and only if

[TABLE]

therefore, using the Schur complement again, $\mathbf{S}(\nu)\succeq 0$ if and only if

[TABLE]

Because $(X^{-1/2}-X^{1/2})^{\top}(X^{-1/2}-X^{1/2})\succeq 0$ for any $X$, we have that $X^{-1}\succeq 2I_{n}-X$. It follows that

[TABLE]

therefore, $\tilde{\mathbf{L}}(\nu)\succeq 0\Rightarrow\mathbf{S}(\nu)\succeq 0$.

Appendix D Proof of Lemma 2

Let $\mathbf{P}(\nu)$ be positive definite; then, by properties of the Schur complement, Y{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0 and X-Y^{-1}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, and because $YX+VU^{\top}=I$ by construction (see (15)), VU^{\top}=I-YX{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\prec\,}0, i.e., the matrix $VU^{\top}$ is nonsingular. Therefore, if \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, it is always possible to find nonsingular $U$ and $V$ satisfying $YX+VU^{\top}=I$. The existence of a nonsingular $V$ implies that $\mathcal{Y}$, introduced in (15), and \mathcal{T}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}:=\text{diag}[\mathcal{Y},\mathcal{Y}]} are invertible. Moreover, nonsingular $U$ and $V$ imply that the matrices:

[TABLE]

are invertible. Therefore, the controller matrices:

[TABLE]

are the unique solution of the matrix equation (19).

Appendix E Proof of Lemma 3

Assume that $\nu$ is such that \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0,\text{ }\mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0. Then, by Lemma 2, $\mathcal{Y}$ and $\mathcal{T}$ are square and nonsingular and thus the transformations $P\rightarrow\mathcal{Y}^{\top}P\mathcal{Y}=\mathbf{P}(\nu)$, $\mathcal{L}\rightarrow\mathcal{T}^{\top}\mathcal{L}\mathcal{T}=\mathbf{L}(\nu)$, and $\tilde{\mathcal{L}}\rightarrow\mathcal{T}^{\top}\tilde{\mathcal{L}}\mathcal{T}=\mathbf{S}(\nu)$ are congruent. By Lemma 1, \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0\Rightarrow\mathbf{S}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0. It follows that (\mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0,\mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0) implies (P{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0,\mathcal{L}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0,\tilde{\mathcal{L}}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0) because $(\mathbf{P}(\nu),\mathbf{L}(\nu),\mathbf{S}(\nu))$ have the same signature as ($P,\mathcal{L},\tilde{\mathcal{L}}$), respectively, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0\Rightarrow\mathbf{S}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0. Because \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, the matrices $U$ and $V$ are nonsingular. This implies that the change of variables in (19) and $\mathcal{T}$ are invertible and lead to unique $(P,A_{c},B_{c},C_{c},D_{c})$ by inverting (16) and (19).

Appendix F Proof of Theorem 2

If $\nu$ satisfies \mathbf{P}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succ\,}0, \mathbf{L}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, and \tilde{\mathbf{L}}(\nu){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\succeq\,}0, by Lemma 3, the change of variables in (19) and matrix $\mathcal{Y}$ in (15) are invertible and the controller matrices (55) and $P$ obtained by inverting (16) and (19) are unique and satisfy inequalities (9a)-(9c) with $\epsilon=\lambda_{\min}(P)$. Hence, because (9d) is satisfied by assumption, by Theorem 1, the controller matrices in (55) render the closed-loop dynamics (3)-(6) asymptotically stable.

Appendix G Proof of Theorem 4

For the sake of brevity $F(\mathcal{P},\bar{\mathcal{C}})$ is denoted by $\bar{F}$. First, note that

[TABLE]

for all $i\in\{1,\dots,T-1\}$, where \theta_{k}{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}:=}\bar{y}[k]-y[k] and

[TABLE]

For $i=T$, it can be seen that

[TABLE]

Combining these update rules shows that

[TABLE]

where

[TABLE]

Note that

[TABLE]

where the inequalities follow from $\bar{F}^{\top}H^{\top}PH\bar{F}\leq\delta P$ and $\bar{F}^{\top}P\bar{F}\leq(1+\mu)P$. Thus,

[TABLE]

where

[TABLE]

where the last equality follows from that the quantization error is bounded by \|\theta_{\ell T+j}\|_{2}\leq{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}n_{y}}2^{-m} if $n$ is selected large enough, i.e., $n$ is selected such that $\|y[k]\|_{\infty}<2^{n-1}$ (see the last paragraph of this proof for ensuring this). Let $s_{1}$ denote the largest real root of the polynomial equation $s\mapsto[(\delta(1+\mu)^{T-1}-1)\lambda_{\max}(P)]s^{2}+[2\|P^{-1/2}\bar{F}^{\top T}H^{\top}P\|_{2}W]s+[\lambda_{\max}(P)W^{2}]$. Define $\mathbb{M}_{1}:=\{z\,|\,z^{\top}Pz\leq s_{1}^{2}\}$. Notice that if $z[\ell T]\notin\mathbb{M}_{1}$, $z[(\ell+1)T]^{\top}Pz[(\ell+1)T]-z[\ell T]^{\top}Pz[\ell T]<0$ (and thus $z[(\ell+1)T]\in\mathbb{M}_{1}$) since (\delta(1+\mu)^{T-1}-1{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0})}<0. However, if $z[\ell T]\in\mathbb{M}_{1}$, it can be deduce that $z[(\ell+1)T]^{\top}Pz[(\ell+1)T]\leq s_{2}:=\delta(1+\mu)^{T-1}s_{1}^{2}+\lambda_{\max}(P)W^{2}+2\|P^{-1/2}\bar{F}^{\top T}H^{\top}P\|_{2}Ws_{1}.$ Define $\mathbb{M}_{2}:=\{z\,|\,z^{\top}Pz\leq s_{2}^{2}\}$. Evidently, if $z[\ell T]\in\mathbb{M}_{1}$, then $z[(\ell+1)T]\in\mathbb{M}_{2}$. Combining these results, it can be seen that $\mathbb{M}_{1}\cup\mathbb{M}_{2}$ is an invariant set for (56). This is because two distinct cases can happen if z[\ell T]{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}\,\in\,}\mathbb{M}_{1}\cup\mathbb{M}_{2}; either $z[\ell T]\in\mathbb{M}_{2}\setminus\mathbb{M}_{1}$ or $z[\ell T]\in\mathbb{M}_{1}$ must happen. If $z[\ell T]\in\mathbb{M}_{2}\setminus\mathbb{M}_{1}$, it means that $z[\ell T]\notin\mathbb{M}_{1}$, thus $z[(\ell+1)T]\in\mathbb{M}_{1}\subseteq\mathbb{M}_{1}\cup\mathbb{M}_{2}$. On the other hand, if $z[\ell T]\in\mathbb{M}_{1}$, then $z[(\ell+1)T]\in\mathbb{M}_{2}\subseteq\mathbb{M}_{1}\cup\mathbb{M}_{2}$. Furthermore, $\mathbb{M}_{1}\cup\mathbb{M}_{2}$ is an invariant set for the dynamical system in feedback loop with (30). This is because, for all $k\in\{\ell T,\dots,(\ell+1)T-2\}$, $z[k+1]^{\top}Pz[k+1]-z[k]^{\top}Pz[k]=V(z[k+1])-V(z[k])\leq\mu z[k]^{\top}Pz[k]<0$. It can be seen that the set $\mathbb{M}_{1}\cup\mathbb{M}_{2}$ is attractive for (56). This because if $z[\ell T]\notin\mathbb{M}_{1}\cup\mathbb{M}_{2}$, it must also $z[\ell T]\notin\mathbb{M}_{1}$. Therefore, $z[(\ell+1)T]^{\top}Pz[(\ell+1)T]-z[\ell T]^{\top}Pz[\ell T]<0$. All these results in the fact that $\lim_{k\rightarrow\infty}\operatorname{dist}(z[k],\mathbb{M}_{1}\cup\mathbb{M}_{2})=0$. Now, note that $\max(s_{1},s_{2})=\mathcal{O}(2^{-m})$. Therefore, there exists $\varrho>0$ such that $\lim_{k\rightarrow\infty}\operatorname{dist}(z[k],\mathcal{B}(\varrho 2^{-m}))=0$.

It only remains to find the bound on $n$. Note that the largest value of the Lyapunov function is

[TABLE]

This implies that $z[k]^{\top}Pz[k]\leq c$. Therefore, $x[k]^{\top}x[k]+x_{c}[k]^{\top}x_{c}[k]=z[k]^{\top}z[k]\leq c/\lambda_{\min}(P):=c/\epsilon$. As a result, $x[k]^{\top}x[k]\leq c/\epsilon$. Noting that $y[k]=Cx[k]$, it can be deduced that $y[k]^{\top}y[k]\leq\lambda_{\max}(C^{\top}C)c/\epsilon$. Finally, because of the relationship between norms, it can be seen that $\|y[k]\|_{\infty}\leq\lambda_{\max}(C^{\top}C)c/\epsilon$. This implies that $2^{n-1}>\lambda_{\max}(C^{\top}C)c/\epsilon$ and thus $n>\log_{2}(\lambda_{\max}(C^{\top}C)c/\epsilon)+1$.

Appendix H Proof of Lemma 4

Noting that the controller resets every $T$ steps, we only need to prove this result for $k\in\{0,\dots,T-1\}$. At $k=0$, $x_{c}[k]=0$ and thus $x_{c}[1]\in\mathbb{Q}(n_{y}+2n,2m)$ because the entries of $\bar{B}_{c}\bar{y}[k]$ belong to $\mathbb{Q}(n_{y}+2n,2m)$. For all $k\in\{1,\dots,T-1\}$, if the entries of $x_{c}[k]$ belong to $\mathbb{Q}(n^{\prime},m^{\prime})$, the entries of $\bar{A}_{c}x_{c}[k]$ (at worst case) belong to $\mathbb{Q}(n_{c}+n+n^{\prime},m+m^{\prime})$ and the entries of $\bar{B}_{c}\bar{y}[k]$ belong to $\mathbb{Q}(n_{y}+2n,2m)$, therefore the entries of $x[k+1]=\bar{A}_{c}x_{c}[k]+\bar{B}_{c}\bar{y}[k]$ must belong to $\mathbb{Q}(n_{c}+n+n^{\prime}+1,m+m^{\prime})$ because $n_{y}\leq n_{c}$, $n\leq n^{\prime}$, and $m\leq m^{\prime}$. Furthermore, $u[k]$ must belong to $\mathbb{Q}(n_{c}+n+n^{\prime}+1,m+m^{\prime})$. This proves that the entries of $x_{c}[k]$ and $u[k]$ must, respectively, belong to $\mathbb{Q}((n_{c}+n+1)(k\operatorname{mod}T-1)+n_{y}+2n,m(k\operatorname{mod}T-1)+2m)$ and $\mathbb{Q}((n_{c}+n+1)(k\operatorname{mod}T)+n_{y}+2n,m(k\operatorname{mod}T)+2m)$.