Time Synchronization Attack and Countermeasure for Multi-System Scheduling in Remote Estimation

TL;DR

This paper investigates time synchronization attacks on multi-system remote estimation, demonstrating how attackers can cause divergence in estimation error and proposing countermeasures to maintain system stability.

Contribution

It introduces a novel attack strategy that exploits time offsets and develops shift-invariant policies as effective countermeasures.

Findings

Attack can cause unbounded estimation error without system knowledge.

Optimal attack minimizes sensor spoofing while maximizing error.

Countermeasures improve system robustness against synchronization attacks.

Abstract

We consider time synchronization attack against multi-system scheduling in a remote state estimation scenario where a number of sensors monitor different linear dynamical processes and schedule their transmissions through a shared collision channel. We show that by randomly injecting relative time offsets on the sensors, the malicious attacker is able to make the expected estimation error covariance of the overall system diverge without any system knowledge. For the case that the attacker has full system information, we propose an efficient algorithm to calculate the optimal attack, which spoofs the least number of sensors and leads to unbounded average estimation error covariance. To mitigate the attack consequence, we further propose a countermeasure by constructing shift invariant transmission policies and characterize the lower and upper bounds for system estimation performance. Simulation examples are provided to illustrate the obtained results.

Figures

Equations

$${\mathbf{x}}_i(k+1)$$

$${\mathbf{y}}_i(k)$$

$${\hat{\mathbf{x}}}_i^{\ell -}(k)$$

$${\mathbf{P}}_i^{\ell -}(k)$$

$${\mathbf{K}}_i^{\ell }(k)$$

$${\hat{\mathbf{x}}}_i^{\ell }(k)$$

$${\mathbf{P}}_i^{\ell }(k)$$

$$h_i(\mathbf{X})$$

$$g_i(\mathbf{X})$$

$${\mathbf{P}}_i^{\ell }(k)={\overline{\mathbf{P}}}_i,\forall k\in \mathbb{N},$$

$${\hat{\mathbf{x}}}_i(k)$$

$${\mathbf{P}}_i(k)$$

$$h_i^{t_1}({\overline{\mathbf{P}}}_i)⪰h_i^{t_2}({\overline{\mathbf{P}}}_i)$$

$$\mathrm{Tr}\left[h_i^{t_1}({\overline{\mathbf{P}}}_i)\right]\ge \mathrm{Tr}\left[h_i^{t_2}({\overline{\mathbf{P}}}_i)\right].$$

$$\underset{\theta \in \Theta }{\min }$$

$$s.t.$$

$${\mathbf{s}}_i\triangleq {\left[\begin{array}{c}{s}_i(0),s_i(1),\dots ,s_i(T-1)\end{array}\right]}^{\top },$$

$$f_i\triangleq \frac{1}{T}\sum _{k=0}^{T-1}{s}_i(k).$$

$${\mathbf{s}}_i^{({\tau }_i)}$$

$$={\left[\begin{array}{c}{s}_i(0\oplus {\tau }_i),s_i(1\oplus {\tau }_i),\dots ,s_i((T-1)\oplus {\tau }_i)\end{array}\right]}^{\top },$$

$$\displaystyle J(\theta)=\frac{1}{T}\bigg{\{}\sum_{t=0}^{Tf_{2}}a_{t}\operatorname{Tr}\left[h_{1}^{t}\left(\overline{\bm{P}}_{1}\right)\right]+\sum_{t=0}^{Tf_{1}}b_{t}\operatorname{Tr}\left[h_{2}^{t}\left(\overline{\bm{P}}_{2}\right)\right]\bigg{\}},$$

$$\sum _{t=0}^{T{f}_2}{a}_t=\sum _{t=0}^{T{f}_1}{b}_t=T,a_0=T{f}_1,b_0=T{f}_2,$$

$$a_0\ge a_1\ge \cdots \ge a_{T{f}_2},b_0\ge b_1\ge \cdots \ge b_{T{f}_1},$$

$$J({\theta }^{\ast })$$

$$\displaystyle~{}~{}~{}+a_{0}\operatorname{Tr}\big{[}h_{1}^{\lfloor\frac{T}{a_{0}}\rfloor-1}\left(\overline{\bm{P}}_{1}\right)\big{]}$$

$$\displaystyle~{}~{}~{}+\left(T\bmod a_{0}\right)\operatorname{Tr}\big{[}h_{1}^{\lfloor\frac{T}{a_{0}}\rfloor}\left(\overline{\bm{P}}_{1}\right)\big{]}$$

$$\displaystyle~{}~{}~{}+b_{0}\operatorname{Tr}\left[h_{2}^{0}\left(\overline{\bm{P}}_{2}\right)\right]+\left(T-b_{0}\right)\operatorname{Tr}\left[h_{2}^{1}\left(\overline{\bm{P}}_{2}\right)\right]\bigg{\}}.$$

$$\underset{K\to \infty }{\mathrm{limsup}}\frac{1}{K}\sum _{k=0}^{K-1}\sum _{i=1}^N\mathbb{E}\{\mathrm{Tr}\left[{\mathbf{P}}_i(k)\right]\}=\infty .$$

$${\mathbf{S}}_i\triangleq [{\mathbf{s}}_i^{(1)},{\mathbf{s}}_i^{(2)},\dots ,{\mathbf{s}}_i^{(T-1)}]\in \{0,1{\}}^{T\times (T-1)}$$

$${\Gamma }_i\triangleq [{\gamma }_i^{(1)},{\gamma }_i^{(2)},\dots ,{\gamma }_i^{(T-1)}{]}^{\top }\in \{0,1{\}}^{T-1}$$

$${\mathbf{P}}_1:\underset{{\Gamma }_{-i}}{\min }$$

$$s.t.$$

$${\Gamma }_{-i}{\in }_e\{0,1\},$$

$${\mathbf{P}}_2:\underset{{\Gamma }_{-i}}{\min }$$

$$s.t.$$

$${\Gamma }_j{\in }_e\{0,1\},\forall j\in \mathcal{N}\backslash \{i\}$$

$$\Vert {\Gamma }_j{\Vert }_1{⪯}_{e}1,\forall j\in \mathcal{N}\backslash \{i\}.$$

$$\underset{{\Gamma }_{-i}}{\min }$$

$$s.t.$$

$${\Gamma }_{-i}({\mathcal{N}}_{live}^i){\in }_e[0,1]$$

Full text

I Introduction

Cyber-physical systems (CPS) refer to systems integrating sensing, computation, communication and control techniques with physical processes. With wide applications in different critical infrastructures such as smart grids, intelligent transportation and health monitoring system, CPS have attracted great research interest during the past decade [1]. In such systems, wireless sensors play an indispensable role due to advantages such as low cost, easy installation, self-power and inherent intelligent processing capability [2]. However, new issues arise naturally with the widespread deployment.

Since most wireless sensors in practical applications are battery-powered, and replacing old batteries which run out of energy is usually costly or even impossible in some extreme environments, one critical issue is how to efficiently allocate the transmission power of the sensors. In [3], the authors studied the scheduling problem of whether to send the sensory data to the remote estimator or not under transmission energy constraint and obtained the optimal off-line sensor schedule. In [4], the authors proposed an on-line sensor schedule based on the acknowledgment signal which contains the real-time data-dropout information. It was shown in [5] that the on-line sensor schedule improves the estimation performance significantly compared with the off-line case with only a 1-bit feedback. Besides the above works focusing on single-sensor systems, multi-sensor and multi-system scheduling problems have received more attention recently [6, 7, 8]. Specifically, a sensor scheduling problem was investigated for a multi-sensor system under communication constraints in [6] and the optimal sensor selection schemes were obtained for reliable and packet-dropping channels. The design of a collision-free transmission scheduling for multiple linear dynamical systems was studied in [7] and an asymptotic periodic schedule was proved to be optimal. Moreover, the multi-system scheduling problem was extended to the scenario with packet drop and packet length constraint in [8].

Due to the wireless communication modes and the complex interconnection between cyber information layer and physical components, communication channels are vulnerable to malicious attacks, which may raise security issues in CPS. Availability attacks, also known as Denial-of-Service attacks, which block the communication channels and prevent legitimate access to system components, were investigated for resource-constrained attacker in [9, 10]. Integrity attacks, another main category of cyber attacks, attempt to cripple the system functionality while remaining undetectable by intercepting and modifying the transmitted data packets. Different implementations of integrity attacks were studied, including replay attack [11], false-data injection attack [12, 13], innovation-based deception attack [14, 15], etc.

Note that most of the multi-system scheduling problems considered in the literature [6, 7, 8] assume that all the subsystems are working in a synchronous manner. Since Global Positioning System (GPS) signal is highly accurate, stable and free for timing, GPS-based measuring devices have been vastly deployed in critical infrastructures to guarantee the time synchronization between subsystems and thus achieve desirable performance [16]. However, malicious agents may disturb the time synchronization among sensors by introducing counterfeit GPS signals. Some existing works [17, 18, 19] and real world GPS spoofing attacks [20] have shown the vulnerability of GPS signals and the possibility of spoofing the GPS receivers. Any successful time synchronization attack, which injects relative offsets on sensor clocks and desynchronizes the target system, may lead to a huge performance degradation. Motivated by these observations, we consider such an attack scenario in this work and analyze performance degradations for different attack information sets. To mitigate the attack effect, we further propose a defense strategy using transmission policies with shift invariance property. The main contributions of this paper are summarized as follows:

We consider time synchronization attack against multi-system scheduling and analyze the attack consequences for different scenarios. For the case that the attacker has no system knowledge, we show that it is possible to drive the expected estimation error covariance of the overall system to infinity (Theorem 1 and Corollary 1). For the case that the attacker has full system knowledge, we propose an efficient algorithm to calculate the optimal attack strategy that spoofs the least number of sensors and leads to unbounded estimation error covariance (Theorem 2 and Algorithm 1). 2. 2.

To mitigate the attack consequence, we propose a countermeasure by constructing shift invariant transmission policies and derive the lower and upper bounds for the remote estimation error covariance when using the proposed countermeasure (Theorem 3). Moreover, we provide a procedure to construct the shift invariant transmission policies.

The reminder of the paper is organized as follows. Section II introduces the system architecture and preliminaries about the multi-system scheduling. Section III considers time synchronization attack with or without system knowledge and analyzes the attack consequences. Section IV proposes a countermeasure by constructing shift invariant transmission policies and derives performance bounds of remote estimation error covariance. Simulation examples are provided in Section V. Some concluding remarks are made in the end.

Notations: All vectors and matrices are named in boldface while scalars are not. $\mathbb{N}$ and $\mathbb{R}$ denote the sets of nonnegative integers and real numbers. $\mathbb{R}^{n}$ is the $n$-dimensional Euclidean space. $\mathbb{S}_{+}^{n}$ ($\mathbb{S}_{++}^{n}$) is the set of $n\times n$ positive semi-definite (definite) matrices. When $X\in\mathbb{S}_{+}^{n}$ ($\mathbb{S}_{++}^{n}$) , we simply write $X\succeq 0$ ($X\succ 0$). $\lfloor\cdot\rfloor$ means the floor function. For functions $f,f_{1},f_{2}$, $f_{1}\circ f_{2}$ is defined as $f_{1}\circ f_{2}(X)\triangleq f_{1}(f_{2}(X))$ and $f^{k}$ is defined as $f^{k}(X)\triangleq\underbrace{f\circ f\circ\cdots\circ f}_{k\ \textup{times}}(X)$ with $f^{0}(X)=X$.

II Preliminaries

II-A System Model

Consider a system consisting of $N$ independent discrete linear time-invariant processes and $N$ sensors as depicted in Fig. 1. The $i$-th sensor monitors the $i$-th process:

[TABLE]

where $i\in\mathcal{N}\triangleq\{1,2,...,N\}$, $k\in\mathbb{N}$ is the time index, $\bm{x}_{i}(k)\in\mathbb{R}^{n_{i}}$ is the state of the $i$-th process, $\bm{y}_{i}(k)\in\mathbb{R}^{m_{i}}$ is the measurement obtained by the $i$-th sensor. The process noise $\bm{w}_{i}(k)$, measurement noise $\bm{v}_{i}(k)$ and the initial state $\bm{x}_{i}(0)$ are mutually independent zero-mean Gaussian random variables with covariance $\bm{Q}_{i}\succeq\bm{0}$, $\bm{R}_{i}\succ\bm{0}$ and $\bm{\Pi}_{i}\succeq\bm{0}$, respectively. To avoid trivial problem, all the processes are assumed to be unstable. The pair $(\bm{A}_{i},\bm{C}_{i})$ is detectable and $(\bm{A}_{i},\sqrt{\bm{Q}_{i}})$ is stabilizable.

II-B Smart Sensor

With the development of manufacturing techniques, many modern sensors are able to provide extra functions beyond those necessary for generating the measured quantity. The functions embedded might be signal processing, decision-making and anomaly alarm, which may promote the system performance [21]. In this work, each sensor is assumed to be smart in the sense that it is able to measure the state of its corresponding process and run the following Kalman filter to generate a local estimate:

[TABLE]

where $\hat{\bm{x}}_{i}^{\ell-}(k)$ and $\hat{\bm{x}}_{i}^{\ell}(k)$ are the a priori and the a posteriori minimum mean squared error (MMSE) estimates of the state $\bm{x}_{i}(k)$ at the $i$-th sensor, $\bm{P}_{i}^{\ell-}(k)$ and $\bm{P}_{i}^{\ell}(k)$ are the corresponding estimation error covariances. The recursion starts from $\hat{\bm{x}}_{i}^{\ell}(0)=\bm{0}$ and $\bm{P}_{i}^{\ell}(0)=\bm{\Pi}_{i}$.

To facilitate the subsequent discussion, we define the Lyapunov and Riccati operators $h_{i}$ and $g_{i}:\mathbb{S}_{+}^{n_{i}}\mapsto\mathbb{S}_{+}^{n_{i}}$ as follows:

[TABLE]

Under the detectability and stabilizability assumptions, the estimation error covariance associated with each local Kalman filter converges exponentially to a steady state from any initial condition [22]. Without loss of generality, we assume that the Kalman filter at sensor side has entered steady state, i.e.,

[TABLE]

where $\overline{\bm{P}}_{i}\succeq\bm{0}$ is a unique positive semi-definite solution of discrete algebraic Riccati equation $\bm{X}=g_{i}\circ h_{i}(\bm{X})$.

II-C Remote Estimator

We consider a time-slotted communication channel which is shared by $N$ sensors. It is assumed that the remote estimator only has the ability to successfully receive one data packet at each time $k$. In other words, when two or more sensors transmit simultaneously, collision occurs and all the transmitted data packets will be dropped. To schedule the transmission, a time-synchronized transmission scheduler embedded in each sensor makes a decision to determine whether to transmit or not. Specifically, we denote $\theta_{i}(k):\mathbb{N}\mapsto\{0,1\}$ be the transmission policy of sensor $i$ at time $k$. If the local estimate $\hat{\bm{x}}_{i}^{\ell}(k)$ is scheduled to transmit, $\theta_{i}(k)=1$; otherwise $\theta_{i}(k)=0$. Let $\theta(k)\triangleq\{\theta_{1}(k),\theta_{2}(k),\ldots,\theta_{N}(k)\}$, $\theta\triangleq\{\theta(1),\theta(2),\ldots\}$, and $\Theta$ be the set of all feasible schedules. Moreover, we denote $\lambda_{i}(k)=\prod_{j\neq i,j\in\mathcal{N}}\theta_{i}(k)[1-\theta_{j}(k)]$ to indicate the transmission result of sensor $i$ at time $k$. If the local estimate $\bm{\hat{x}}_{i}^{\ell}(k)$ is successfully received at the remote estimator, $\lambda_{i}(k)=1$; otherwise $\lambda_{i}(k)=0$.

As a result, the MMSE state estimate $\hat{\bm{x}}_{i}(k)$ and the corresponding estimation error covariance $\bm{P}_{i}(k)$ at the remote estimator can be computed by the following recursions:

[TABLE]

Note that the estimation error covariance satisfies

[TABLE]

for any $t_{1},t_{2}\in\mathbb{N}$ with $t_{1}\geq t_{2}$ [23]. Furthermore,

[TABLE]

This well ordering of the estimation error covariance is helpful for the further analysis.

II-D Optimal Sensor Scheduling

For the considered collision channel, an efficient sensor scheduling scheme plays a crucial role to system estimation performance, which motivates us to consider the following optimization problem:

[TABLE]

The above problem was already studied in [7] and we summarize the main results in the following lemma.

Lemma 1**.**

The optimal transmission policy $\theta^{\ast}$ for the optimization problem in (7) has the following properties:

Exclusivity: there must be one and only one sensor which transmits at each time $k$; 2. 2.

Periodicity: there exists a period $T\in\mathbb{N}$ such that $\theta_{i}^{\ast}(k)=\theta_{i}^{\ast}(k+T),\forall i\in\mathcal{N}$; 3. 3.

Uniformity: each sensor must schedule its transmission as uniformly as possible within one period.

Proof:

See Theorem 2 and Theorem 3 in [7].

II-E Problem of Interest

There is no doubt that the minimum average estimation error covariance over an infinite time horizon can be achieved when applying the optimal sensor schedules. However, if there exists a malicious attacker who aims at damaging the estimation quality, i.e., maximizing the objective function $J(\theta)$ by choosing an appropriate attack strategy, the situation will become more involved, which motivates our current work. In this case, the defense strategies that help the system maintain acceptable performance even in the presence of attacks are worth exploring. We will introduce the detailed attack model and propose countermeasures in the following two sections.

III Attack Strategy and Performance Analysis

In this section, we consider the scenario where there exists a malicious attacker who is able to generate random delays on the clocks of the sensors to increase collision, consequently packet dropout, during the transmission. The mathematical formulation and practical implementation of such an attack are discussed. Moreover, the remote estimation performances when the malicious attacker has different system information are investigated and an efficient algorithm is proposed to calculate the optimal attack strategy.

III-A Time Synchronization Attack

To achieve the optimal transmission policy obtained in [7], GPS timing is applied such that each sensor in the system transmits data packet in a synchronous manner without any collision. We consider a malicious attacker who intentionally disturbs the time synchronization among sensors by injecting arbitrary time delays on sensor clocks. Practically, this can be achieved by introducing a forged GPS signal, as shown in Fig. 1. Note that such an attacker does not need to hack into the underlying system or have physical contact to the sensors. It is also difficult to locate the attacker since it can transmit the GPS spoofing signal while moving around the target sensors. These injected time delays may lead to transmission collision, packet dropout and performance degradation. Consequently, it is necessary to analyze attack consequences under different information sets and propose efficient countermeasures, before which some definitions are introduced first.

According to Lemma 1, the optimal transmission policy for each sensor is a periodic [math]-$1$ sequence. Thus, it suffices to investigate the attack effect on sensor’s transmission within one period instead of an infinite horizon. To simplify the subsequent discussion, we denote the optimal transmission policy $\bm{s}_{i}$ for sensor $i$ within period $T$ as a column vector:

[TABLE]

where $s_{i}(k)\in\{0,1\}$ for all $i\in\mathcal{N}$ and $k\in\{0,1,\ldots,T-1\}$. Let $\bm{s}\triangleq\{\bm{s}_{1},\bm{s}_{2},\ldots,\bm{s}_{N}\}$ be the optimal transmission policy of all sensors. The Hamming weight of sensor $i$ is the number of ones in $\bm{s}_{i}$ within a period. The duty factor of sensor $i$ is the fraction of time in which sensor $i$ is transmitting, which equals the Hamming weight divided by the period, i.e.,

[TABLE]

When a random time delay $\tau_{i}$ is injected on the clock of the $i$-th sensor by the GPS spoofer, the transmission policy of sensor $i$ becomes

[TABLE]

where $\oplus$ represents addition modulo $T$.

III-B Attack without System Knowledge

In this subsection, we focus on the scenario where the malicious attacker does not have any system knowledge and randomly launches attacks on an arbitrary subset of the sensors. In this regard, we can show that the expected average estimation error covariance of the overall system over an infinite time horizon goes to infinity. This result can be obtained directly from the following theorem.

Theorem 1**.**

*For any optimal transmission policy $\bm{s}$ with period $T$, there exists an attack strategy under which all the transmitted data packets of sensor $i$ will be dropped if $f_{i}\leq\frac{1}{2}$. *

Proof:

The proof is divided into two parts. The two-sensor scenario is considered first, and as an extension, the proof of the scenario with $N$ sensors is completed.

First, without loss of generality, we assume that $f_{1}\leq f_{2}$ in the two-sensor scenario, which means that the sensor $1$ transmits $Tf_{1}$ times and the sensor $2$ transmits $Tf_{2}$ times in one period $T$. For each transmission policy $\theta$, the resulting average cost $J(\theta)$ in the Problem $1$ can be computed:

[TABLE]

where $a_{t}$ and $b_{t}$ are nonnegative integers satisfying

[TABLE]

$a_{0}=Tf_{1}$ represents the total number of time slots in a period $T$ when sensor $1$ is scheduled to transmit, and $a_{t},t\geq 1$ stands for the total number of time slots that sensor $1$ has continuously idled for $t$ slots after a transmission. Sensor $1$ needs to transmit for exactly $Tf_{1}$ times in a period $T$, and thus the longest waiting time duration during which it cannot transmit is $T-Tf_{1}=Tf_{2}$. The counting number summation for sensor $1$, denoted as $\sum_{t=0}^{Tf_{2}}a_{t}$, must be $T$. Sensor $2$ has similar situations represented by $b_{t}$. The case that the sensor $i$ has not been scheduled to transmit for $t+1$ time slots can happen only if it has not been scheduled for $t$ time slots. Therefore, the inequality (12) holds. To illustrate the meanings of $a_{t}$ and $b_{t}$, we provide a simple example in Fig. 2. A transmission policy in the two-sensor scenario with $T=7,f_{1}=\frac{2}{7}$ and $f_{2}=\frac{5}{7}$ is considered. The corresponding $a_{0}=2,a_{1}=2,a_{2}=2,a_{3}=1,a_{4}=a_{5}=0$ and $b_{0}=5,b_{1}=2,b_{2}=0$.

Due to the nondecreasing property of $\operatorname{Tr}\left[h_{i}^{t}\left(\overline{\bm{P}}_{i}\right)\right]$ in $t$ and Lemma 1, the average estimation error covariance under the optimal transmission policy $\theta^{\ast}$ can be obtained as:

[TABLE]

In consistency with the Uniformity in Lemma 1, the sensor $2$ with the larger duty factor $f_{2}$ is only allowed to wait for at most one time slot under the optimal scheduling policy. In other words, all the “[math]” elements in $\bm{s}_{2}$ are isolated by other “$1$” elements. According to the Exclusivity in Lemma 1, all the “$1$” elements in $\bm{s}_{1}$ are isolated by other “[math]” elements. Consequently, the attacker can always set $\tau_{2}=1$ and construct $\bm{s}_{2}^{(1)}$ such that all the “$1$” elements in $\bm{s}_{1}$ collide with those “$1$” elements in $\bm{s}_{2}^{(1)}$.

For the general scenario with $N$ sensors, any sensor $i$ with $f_{i}\leq\frac{1}{2}$ satisfies that “$1$” elements in $\bm{s}_{i}$ isolated by other “[math]” elements according to the Uniformity, which can be viewed as sensor 1 in the two-sensor scenario. Then, all the other sensors can be viewed together as sensor 2 in the two-sensor scenario. Similar to the previous case, there always exist a delayed version of sequences $\bm{s}_{1}^{(\tau_{1})},\bm{s}_{2}^{(\tau_{2})},\ldots,\bm{s}_{i-1}^{(\tau_{i-1})},\bm{s}_{i+1}^{(\tau_{i+1})},\ldots,\bm{s}_{N}^{(\tau_{N})}$ with $\tau_{j}=1,\forall j\in\mathcal{N}\backslash\{i\}$ such that all the transmitted data packets of sensor $i$ are dropped in collisions.

Corollary 1**.**

Consider system (1)–(2) under optimal transmission policy $\bm{s}$ with period $T$. When a randomly generated time synchronization attack is launched on the system, the expected average estimation error covariance of the overall system over an infinite time horizon goes to infinity, i.e.,

[TABLE]

Proof:

Theorem 1 shows that for any system under the optimal transmission policy $\bm{s}$, there always exists an attack strategy such that at least one sensor, e.g., sensor $i$, will never have a chance to successfully transmit its data packet. Correspondingly, the trace of estimation error covariance $\operatorname{Tr}\left[\bm{P}_{i}(k)\right]$ diverges to infinity for this unstable process. Note that the attack strategy is randomly chosen from all the finite types of time synchronization attacks. Hence, the equation (14) holds, taking expectation with respect to random attack strategies.

III-C Attack with full System Knowledge

When the malicious attacker has knowledge of all system parameters $\bm{A}_{i}$, $\bm{C}_{i}$, $\bm{Q}_{i}$ and $\bm{R}_{i}$, $\forall i\in\mathcal{N}$, it is able to calculate the optimal sensor schedules and launch an attack such that the average estimation error covariance of the overall system goes to infinity, i.e., $\limsup_{K\rightarrow\infty}\frac{1}{K}\sum_{k=0}^{K-1}\sum_{i=1}^{N}\operatorname{Tr}\left[\bm{P}_{i}(k)\right]=\infty$. Note that the attacks leading to unbounded estimation error covariance are not unique. Hence, the optimal attack strategy that spoofs the least number of sensors to achieve this goal is worth investigating. In this subsection, we first show that the optimal attack strategy can be solved by the optimization problem summarized in the following theorem and then provide an efficient algorithm to solve this problem. For notation brevity, we denote

[TABLE]

as all possible attacked version of $\bm{s}_{i}$,

[TABLE]

as an indicator vector corresponds to $\bm{S}_{i}$, and $\bm{e}_{i}$ being $(T-1)(N-1)$ dimensional vector with $N-1$ partitions and all the elements in the $i$-th partition are ones. Moreover, we define $\bm{S}_{-i}\triangleq[\bm{S}_{1},\ldots,\bm{S}_{i-1},\bm{S}_{i+1},\ldots,\bm{S}_{N}]\in\{0,1\}^{T\times(T-1)(N-1)}$, $\bm{\varGamma}_{-i}\triangleq[\bm{\varGamma}_{1}^{\top},\ldots,\bm{\varGamma}_{i-1}^{\top},\bm{\varGamma}_{i+1}^{\top},\ldots,\bm{\varGamma}_{N}^{\top}]^{\top}\in\{0,1\}^{(T-1)(N-1)}$, and $\bm{E}=[\bm{e}_{1}^{\top},\bm{e}_{2}^{\top},\ldots,\bm{e}_{N-1}^{\top}]^{\top}\in\{0,1\}^{(N-1)\times(T-1)(N-1)}$.

Theorem 2**.**

Consider system (1)–(2) under optimal transmission policy $\bm{s}$ with period $T$. The optimal attack strategy can be obtained by solving the following optimization problem for all $i\in\mathcal{N}$:

[TABLE]

*where $\bm{b}_{i}\triangleq\begin{bmatrix}\bm{s}_{i}\\ \bm{1}\end{bmatrix}\in\{0,1\}^{T+N-1}$, $\bm{D}_{i}\triangleq\begin{bmatrix}-\bm{S}_{-i}\\ \bm{E}\end{bmatrix}\in\{0,1\}^{(T+N-1)\times(T-1)(N-1)}$, $\|\bm{x}\|_{1}$ stands for $l_{1}$ norm of $\bm{x}$, $\preceq_{e}$ is element-wise inequality, $\bm{x}\in_{e}\{0,1\}$ means that each element of $\bm{x}$ belongs to $\{0,1\}$. *

Proof:

According to the definition, an attack strategy is optimal with respect to sensor $i$ if it spoofs the least number of sensors except sensor $i$ such that all the transmitted data packets of sensor $i$ are dropped. Consequently, to obtain the optimal attack strategy with respect to sensor $i$, we need to solve the following optimization problem:

[TABLE]

Since injecting a time delay $\tau_{j}$ on sensor $j$, can be represented as the multiplication of $\bm{S}_{j}$, the matrix of all possible attacked version of $\bm{s}_{j}$, and its corresponding indicator $\bm{\varGamma}_{j}$, any attack strategy satisfying the first two constraints guarantees that at least one sensor $j\in\mathcal{N}\backslash\{i\}$ is also transmitting its data packet at the time slot when sensor $i$ is transmitting. Note that only one time delay can be injected on each sensor $j\in\mathcal{N}\backslash\{i\}$, which leads to the third constraint. It can be observed that all the transmitted data packets of sensor $i$ will be dropped under any attack strategy satisfying above three constraints. To obtain the optimal attack, one has to minimize the number of sensors needed to be spoofed, which corresponds to the $l_{1}$ norm in the objective function.

Combining the first and the third constraints of problem $\mathbf{P_{2}}$, one can obtain problem $\mathbf{P_{1}}$, which completes the proof.

Due to the binary constraint on $\bm{\varGamma}_{-i}$, problem $\mathbf{P_{1}}$ is a mixed integer programming problem, which cannot be solved by standard convex optimization techniques. Noticing that $\bm{\varGamma}_{-i}\in_{e}\{0,1\}$ has $2^{(T-1)(N-1)}$ possible values, a brute-force enumeration for the optimal attack strategy is computationally intractable when the network scale $N$ or the communication period $T$ is large.

Among various algorithms in the literature [24], Branch-and-Bound (B&B) algorithm is the most popular one to solve large scale NP-hard combinatorial optimization problems [25]. Although the algorithm may need to search the entire solution space in the worst case, the use of bounds for the function to be optimized combined with the value of the current best solution enables the algorithm to search a smaller solution space in general. To be specific, we denote $\mathcal{N}_{live}^{i},\mathcal{N}_{del}^{i}\subseteq\mathcal{N}_{-i}\triangleq\mathcal{N}\backslash\{i\}$ as two sub-index sets of $\mathcal{N}_{-i}$ for sensor $i$, and $\bm{\varGamma}_{-i}(\mathcal{N}_{live}^{i}),\bm{\varGamma}_{-i}(\mathcal{N}_{del}^{i})$ as the corresponding collections of elements from $\bm{\varGamma_{-i}}$, respectively. We summarize the B&B algorithm for optimal attack strategy in Algorithm 1.

Remark 1**.**

*Note that the optimal attack strategy that spoofs the least number of sensors and leads to unbounded estimation error covariance may not be unique. The method summarized in Algorithm 1 only returns one of the optimal attack strategies. If all the optimal attack strategies are needed, one can easily achieve this goal by modifying “$<$” in lines 11 and 19 to “$\leq$” and storing all the returned solutions. *

IV Countermeasure against Time Synchronization Attack

According to the previous discussion, the optimal transmission policy for each sensor is periodic and synchronized. When a malicious attacker intentionally destroys time synchronization between sensors, nonzero relative offsets are injected and the collided data packets are dropped, which results in degradation of remote estimation performance. To ensure the estimation quality in the presence of time synchronization attacks, we propose a countermeasure based on shift invariant property of the transmission policy in this section. Moreover, we derive the lower and upper bounds of remote estimation error covariance when the proposed defense method is used.

IV-A Shift Invariance

Before proceeding the analysis, we first introduce the definition of shift invariant transmission policy in this subsection.

Let $\mathcal{U}_{N}$ be the collection of all ordered tuples of length $1,2,\ldots,N$, whose components are distinct elements in sensor set $\mathcal{N}$ and sorted in ascending order. It consists of $n$-tuples in the form $(i_{1},i_{2},\ldots,i_{n})$ for some $n$ between $1$ and $N$, and $i_{1}<i_{2}<\cdots<i_{n}$. An element in $\mathcal{U}_{N}$ corresponds to an ordered tuple of sensors. For $U=(i_{1},i_{2},\ldots,i_{n})\in\mathcal{U}_{N}$ with $i_{1}<i_{2}<\cdots<i_{n}$, the Hamming cross correlation associated with $U$ is defined as

[TABLE]

In other words, it counts the number of time slots in a period where all sensors in $U$ transmit simultaneously. When $U$ consists of only one sensor, Hamming cross correlation reduces to Hamming weight.

A function $F:\{0,1,\ldots,T-1\}^{n}\mapsto\mathbb{N}$ is said to be shift invariant if $F(\tau_{1},\tau_{2},\ldots,\tau_{n})$ equals identically to a constant for any choice of $\tau_{1},\tau_{2},\ldots,\tau_{n}$. We say a transmission policy set $\{\bm{s}_{1},\bm{s}_{2},\ldots,\bm{s}_{N}\}$ is shift invariant if the Hamming cross correlation in (15) is shift invariant as a function of $\tau_{1},\tau_{2},\ldots,\tau_{n}$ for all $U\in\mathcal{U}_{N}$.

When the sensors in the ordered tuple $U=(i_{1},i_{2},\ldots,i_{n})\in\mathcal{U}_{N}$ are active and the time delay injected by the attacker of sensor $i_{j}$ is $\tau_{j}$ for $j=1,2\ldots,n$, the throughput of sensor $i_{j}$ is defined as

[TABLE]

where the product is over all $t=1,2,\ldots,n$ except $t=j$. This is the fraction of time slots in which sensor $i_{j}$ transmits and sensors $i_{1},\ldots,i_{j-1},i_{j+1},\ldots,i_{n}$ keep silent. When $U$ consists of only one sensor, the throughput $\theta(\tau;(i))$ is equivalent to the duty factor $f_{i}$. A transmission policy set $\{\bm{s}_{1},\bm{s}_{2},\ldots,\bm{s}_{N}\}$ is throughput invariant if the throughput in (16) is shift invariant as a function for all $U\in\mathcal{U}_{N}$ and $j=1,2\ldots,n$. According to Theorem 8 and Theorem 12 in [26], the shift invariance and throughput invariance are equivalent for the transmission channel considered in our work.

Example 1**.**

The following is a set of three shift invariant transmission policies with duty factors $f_{1}=\frac{1}{2}$, $f_{2}=\frac{1}{2}$, $f_{3}=\frac{1}{3}$ and period $T=12$:

[TABLE]

*Then, we have $H(\tau_{1},\tau_{2};(1,2))=3$, $H(\tau_{1},\tau_{3};(1,3))=2$, $H(\tau_{2},\tau_{3};(2,3))=2$ and $H(\tau_{1},\tau_{2},\tau_{3};(1,2,3))=1$ for all $\tau_{1},\tau_{2},\tau_{3}\in\mathbb{N}$. *

IV-B Performance Bounds

Note that the shift invariance property introduced in the previous subsection can be used to design countermeasures against time synchronization attack. When shift invariant transmission policies are adopted, each sensor will receive at least one data packet within a period no matter what time delays are injected on the system, which leads to bounded estimation error covariance and improves system robustness. In this subsection, we provide the lower and upper bounds for the remote estimation error covariance when using shift invariant transmission policies, before which we first revisit some useful results obtained in [27].

Lemma 2**.**

Let $\bm{s}_{1},\bm{s}_{2},\ldots,\bm{s}_{N}$ be shift invariant transmission policies for $N$ sensors with duty factors $f_{1}=\frac{n_{1}}{d_{1}},f_{2}=\frac{n_{2}}{d_{2}},\ldots,f_{N}=\frac{n_{N}}{d_{N}}$, respectively, and $\gcd(n_{i},d_{i})=1,\forall i\in\mathcal{N}$. Then, the following statements hold:

The throughput of sensor $i$ is equal to $f_{i}\prod_{j\neq i}(1-f_{j})$; 2. 2.

The period is divisible by and no less than $d_{1}d_{2}\cdots d_{N}$.

Proof:

See Theorem 3 and Theorem 6 in [27].

Theorem 3**.**

Consider system (1)–(2) under shift invariant transmission policies $\bm{s}_{1},\bm{s}_{2},\ldots,\bm{s}_{N}$ with duty factors $f_{1}=\frac{n_{1}}{d_{1}},f_{2}=\frac{n_{2}}{d_{2}},\ldots,f_{N}=\frac{n_{N}}{d_{N}}$, $\gcd(n_{i},d_{i})=1,\forall i\in\mathcal{N}$, and period $D=d_{1}d_{2}\cdots d_{N}$. When an arbitrary time synchronization attack is launched on the system, the average estimation error covariance of the overall system over an infinite time horizon is lower bounded by

[TABLE]

and upper bounded by

[TABLE]

*where $N_{i}=n_{i}\prod_{j\neq i}(d_{j}-n_{j})$ for all $i\in\mathcal{N}$. *

Proof:

According to Lemma 2, when sensor $i$ adopts shift invariant transmission policy $\bm{s}_{i}$ with duty factor $f_{i}=\frac{n_{i}}{d_{i}}$ and period $D=d_{1}d_{2}\cdots d_{N}$, it will receive $N_{i}=Df_{i}\prod_{j\neq i}(1-f_{j})=n_{i}\prod_{j\neq i}(d_{j}-n_{j})$ data packets within one period under arbitrary time synchronization attack.

Consequently, the lower bound of the average estimation error covariance over an infinite time horizon of the overall system is achieved when all the data packets are uniformly received, which corresponds to (3). The upper bound is achieved when all the data packets are consecutively received, which is consistent with (3).

IV-C Construction Method

In this subsection, we describe how to construct the shift invariant transmission policies with duty factor $0<f_{i}=\frac{n_{i}}{d_{i}}<1$ and $\gcd(n_{i},d_{i})=1,\forall i\in\mathcal{N}$.

In our construction, the $i$-th transmission policy has period $D_{i}\triangleq\prod_{j=1}^{i}d_{i}$ and $D_{N}=d_{1}d_{2}\cdots d_{N}=D$ is the common period for the whole transmission policy set. For convenience, $D_{0}$ is defined to be $1$. Then, the shift invariant transmission policy for sensor $i$, $i\in\mathcal{N}$, is constructed as follows. Select $D_{i-1}$ vectors of length $d_{i}$, say $\bm{\sigma}_{i1},\bm{\sigma}_{i2},\ldots,\bm{\sigma}_{iD_{i-1}}$, such that the Hamming weights of them are all equal to $n_{i}$, and interleave these $D_{i-1}$ vectors in the following manner:

[TABLE]

Example 2**.**

For $N=2$ with duty factors $f_{1}=\frac{1}{4}$ and $f_{2}=\frac{1}{3}$, we pick $\bm{\sigma}_{11}=[0,0,0,1]^{\top}$, $\bm{\sigma}_{21}=[0,0,1]^{\top}$, $\bm{\sigma}_{22}=[0,1,0]^{\top}$ and $\bm{\sigma}_{23}=\bm{\sigma}_{24}=[1,0,0]^{\top}$. The two constructed shift invariant transmission policies are

[TABLE]

with period $T=12$. The first policy is obtained by repeating $[0,0,0,1]^{\top}$ periodically. The second policy is obtained by reading out the rows from top to bottom of matrix

[TABLE]

Observed from Example 2, different shift invariant transmission policies can be obtained by choosing different duty factors and $\bm{\sigma}_{ij}$, where $i\in\mathcal{N},j=1,2,\ldots,D_{i-1}$. Two heuristic construction methods are considered in this work: one is to construct shift invariant transmission policies that preserve the same duty factors of the optimal transmission policies without attacks; the other is to construct shift invariant transmission policies that achieve the shortest period. Note that the shortest period $2^{N}$ is achieved when the duty factor is $f_{i}=\frac{1}{2}$ for all $i\in\mathcal{N}$. Particularly, in this case, each sensor receives exactly one packet within a period, and thus the lower bound $\underline{J}(\theta)$ coincides with the upper bound $\overline{J}(\theta)$. These two construction methods will be compared through simulation examples in the next section.

V Simulation Example

In this section, we provide some numerical examples to illustrate the main theoretical results. We consider a scenario where three sensors monitor three different dynamic processes. The system parameters are given as follows:

[TABLE]

By solving the optimization problem in (7), the optimal transmission policy for each sensor is obtained as

[TABLE]

with duty factor $f_{1}=\frac{1}{3}$, $f_{2}=\frac{1}{3}$, $f_{3}=\frac{1}{3}$, respectively, and period $T=3$. Then, by solving problem $\mathbf{P_{1}}$ using the proposed B&B algorithm, the optimal attack strategy is obtained as $\tau_{1}=0,\tau_{2}=0,\tau_{3}=2$.

The infinite-horizon average estimation error covariance of the overall system under different scenarios are shown in Fig. 3. The blue solid line represents the estimation error covariance under the optimal transmission policy without attack. The red circle line and the yellow plus line correspond to the estimation performances under the optimal and randomly generated time synchronization attacks, respectively. The blue dash-dot line stands for the expected estimation error covariance when using shift invariant transmission policy that preserves the same duty factors of optimal one under random attack, i.e., $f_{1}=\frac{1}{3}$, $f_{2}=\frac{1}{3}$, $f_{3}=\frac{1}{3}$, $T=27$. Here the expectation is taken with respect to the different choices of $\bm{\sigma}_{ij},i\in\mathcal{N},j=1,2,\ldots,D_{i-1}$ and the randomly generated attacks. The purple dotted line and the green dotted line are the corresponding performance bounds derived in Theorem 3. The red dashed line stands for the estimation error covariance when using shift invariant transmission policy that achieves the shortest period, i.e., $f_{1}=\frac{1}{2}$, $f_{2}=\frac{1}{2}$, $f_{3}=\frac{1}{2}$, $T=8$. It can be observed that the remote estimation error covariance diverges exponentially fast when the system is under the optimal or the randomly generated time synchronization attack, which is consistent with the results obtained in Section III. On the other hand, the remote estimation error covariance is bounded when shift invariant transmission policies are adopted, which demonstrates the effectiveness of the proposed countermeasure. Moreover, the shift invariant transmission policy with the shortest period achieves a better performance compared to that with the same duty factor.

VI Conclusion

In this paper, we studied time synchronization attack against multi-system scheduling in a remote state estimation scenario. For the case that the attacker does not have any system knowledge, we showed that it is able to make the expected average estimation error covariance of the overall system go to infinity. For the case that the attacker has full system knowledge, we proposed an efficient algorithm to solve the optimal attack that spoofs the least number of sensors and leads to unbounded average estimation error covariance of the overall system. To mitigate the attack consequence, we further proposed countermeasures and characterized the lower and upper bounds for system estimation performance when using shift invariant transmission policies. Simulation and comparison were provided to demonstrate the analytical results.

For the future work, one possible direction is to investigate optimal sensor schedule, optimal time synchronization attack and countermeasures when multiple packet reception is allowed. Additionally, it would be interesting to analyze the explicit estimation performance when different shift invariant transmission policies are adopted.