Symmetries and isomorphisms for privacy in control over the cloud

TL;DR

This paper introduces transformation-based methods to enhance data privacy in cloud-controlled feedback systems, analyzing privacy guarantees across different levels of adversary knowledge with minimal impact on control performance.

Contribution

It proposes novel privacy-preserving transformations tailored for cloud control, quantifies privacy levels, and examines privacy loss with side knowledge in various scenarios.

Findings

Methods effectively protect private data during cloud control.

Quantitative analysis of privacy leakage with side knowledge.

Control performance remains minimally affected.

Abstract

Cloud computing platforms are being increasingly used for closing feedback control loops, especially when computationally expensive algorithms, such as model-predictive control, are used to optimize performance. Outsourcing of control algorithms entails an exchange of data between the control system and the cloud, and, naturally, raises concerns about the privacy of the control system's data (e.g., state trajectory, control objective). Moreover, any attempt at enforcing privacy needs to add minimal computational overhead to avoid degrading control performance. In this paper, we propose several transformation-based methods for enforcing data privacy. We also quantify the amount of provided privacy and discuss how much privacy is lost when the adversary has access to side knowledge. We address three different scenarios: a) the cloud has no knowledge about the system being controlled; b) the cloud knows what sensors and actuators the system employs but not the system dynamics; c) the cloud knows the system dynamics, its sensors, and actuators. In all of these three scenarios, the proposed methods allow for the control over the cloud without compromising private information (which information is considered private depends on the considered scenario).

Equations

$$\begin{array}{r}\Sigma :\end{array}\begin{array}{rl}{\bar{x}}_{k+1}& =\bar{A}{\bar{x}}_k+\bar{B}{u}_k+\bar{c}\\ {\bar{y}}_k& =\bar{C}{\bar{x}}_k+\bar{d},\end{array}$$

$$Wx+v\mapsto \left[\begin{array}{cc}W& v\\ 0& 1\end{array}\right]\left[\begin{array}{c}x\\ 1\end{array}\right].$$

$$x_{k+1}$$

$$\triangleq A{x}_k+B{u}_k$$

$$y_k$$

$$J(x,u)=$$

$$D{\eta }_i\le 0,\forall i\in \{0,1,...,N\},$$

$${\psi }_{\ast }\Sigma$$

$$=(P(A-B{G}^{-1}F)P^{-1},PB{G}^{-1},SC{P}^{-1})$$

$$\triangleq (\tilde{A},\tilde{B},\tilde{C})\triangleq \tilde{\Sigma }.$$

$${\tilde{x}}_k$$

$${\tilde{u}}_k$$

$${\tilde{y}}_k$$

$${\tilde{\eta }}_k=\left[\begin{array}{c}{\tilde{x}}_k\\ {\tilde{u}}_k\end{array}\right]=\left[\begin{array}{cc}P& 0\\ F& G\end{array}\right]\left[\begin{array}{c}{x}_k\\ u_k\end{array}\right]\triangleq L{\eta }_k.$$

$$\tilde{J}(\tilde{x},\tilde{u})=$$

$$\tilde{D}{\tilde{\eta }}_i\le 0,\forall i\in \{0,1,...,N\},$$

$$f_S:$$

$$(A,B,C)\mapsto \left(\text{det }\mathcal{C},\text{det }\mathcal{O}\right),$$

$$\Omega {\sim }_{\mathcal{G}}\tilde{\Omega },$$

$$\tilde{\Omega }={\psi }_{\ast }\Omega ;$$

$$[\Omega ]$$

$$=\{{\psi }_{\ast }\Omega |\psi \in {\mathcal{G}}_{n,m,p}\}.$$

$$\underset{\tilde{u}}{\min }$$

$$\hat{D}\widehat{{\eta }_i}\le 0,\forall i\in \{0,...,N\},$$

$$\underset{u}{\min }$$

$$D{\eta }_i\le 0,\forall i\in \{0,...,N\}$$

$${\mathcal{K}}_{n,m,p}(\Omega )=\{\psi \in {\mathcal{G}}_{n,m,p}|{\psi }_{\ast }\Omega =\Omega \}.$$

$${\varphi }_{\ast }(A,B)=(P(A-B{G}^{-1}F)P^{-1},PB{G}^{-1}).$$

$${\mathcal{K}}_{n,m}(A,B)=\{\varphi \in {\mathcal{G}}_{n,m}|{\varphi }_{\ast }(A,B)=(A,B)\}.$$

$$\text{dim }{\mathcal{K}}_{n,m}(A,B)$$

$$=m(n+1)-\sum _{i=2}^m{r}_{i-1}{r}_i,$$

$$r_1$$

$$r_i$$

$$S_j$$

$$\text{dim }{\mathcal{K}}_{n,m,p}(\Sigma )\le \text{dim }{\mathcal{K}}_{n,m,p}(A,B).$$

$$\text{dim }{\mathcal{K}}_{n,m,p}(\Omega )\le \text{dim }{\mathcal{K}}_{n,m,p}(\Sigma )\le \text{dim }{\mathcal{K}}_{n,m,p}(A,B),$$

$$\begin{array}{r}\Sigma :\end{array}\{\begin{array}{l}{x}_{k+1}^{(i,1)}=x_k^{(i,2)},\\ ⋮\\ x_{k+1}^{(i,{\kappa }_i)}=u_k^{(i)},\\ y_k^{(i)}=x_k^{(i,1)},1\le i\le m,\end{array}$$

Full text

*The work of the authors was partially supported by the NSF grants 1740047, 1705135 and by the Army Research Laboratory under Cooperative Agreement W911NF-17-2-0196. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Army Research Laboratory or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation here on.

1. Introduction

1.1. Motivation

The recent advances in reliability and speed of communication have led to an increased use of cloud-based services, which provide computation and data storage capabilities to clients. Control over the cloud [34, 14, 15] has numerous advantages, which include easier installation and maintenance [21], and the availability of global information from all of the cloud’s clients when making control decisions. However, the main advantage of control over the cloud is that it allows control systems to outsource expensive computational tasks to the cloud, thus potentially improving the speed of computation and freeing the local computational capabilities for other tasks.

An illustrative example of the benefits of outsourcing computing can be observed in Model Predictive Control (MPC). MPC is a conceptually simple, yet powerful scheme that was adopted in industry for multivariable control [23]. MPC inherently involves solving complex constrained optimization problems on-line (i.e., within one sampling interval). The work in [34] presents an experimental study that shows feasibility of MPC over the cloud for robot control. Another work (see [14]) considered the practicality and benefits of cloud-based MPC for a large-scale solar plant. The availability of global information provided by control over the cloud can have many practical benefits, as shown in [15]. There, the authors propose a solution to the problem of traffic flow estimation via the cloud.

However, relying on a third-party to perform computation is not without its dangers. Despite the benefits of control over the cloud, a number of studies have shown that exposing existing systems to connectivity may lead to security vulnerabilities in a vast variety of applications [5, 13, 6, 12], including control of process plants, traffic infrastructure, and smart meter systems. Cyber-security attacks vary based on the amount of resources the attacker possesses [31]. One of the most basic attacks that requires little resources is eavesdropping. It can often serve as a stepping stone in the implementation of more complex attacks [24]. In control over the cloud, eavesdropping involves the adversary listening in to the communication channel between sensors, controllers, and actuators to leak valuable information about the model, the controller, and trajectories [10]. The client is expected to disclose all of this sensitive information to the cloud if it intends to receive valid control inputs from it. For example, we would expect drivers to share their locations, final destinations and, perhaps, dynamics to successfully allow traffic control over the cloud.

Eavesdropping attacks are usually prevented with encryption - the plant and the cloud establish a shared key with which they encrypt transmitted messages and decrypt the received ones. However, if the adversary manages to undermine the security of the cloud (e.g., gain unauthorized access to its memory), this technique can no longer protect the system since the cloud accesses the decrypted data. As stated in [26], traditional IT security provides only a partial solution. Therefore, there is a pressing need for development of control-over-the-cloud methods that do not rely on decryption of the incoming data. Although much effort has been directed to this problem, a universally secure scheme for control over the cloud that could support any client functionality has not yet been created [32, 2]. When solving the problem of private control over the cloud, two other important concerns need to be accounted for: efficiency and safety. Privacy cannot come at the cost of degradation of control performance either due to delays in the feedback loop or inaccurate control inputs.

1.2. Related work

The body of work on privacy in control over the cloud can be categorized into methods based on homomorphic encryption, differential privacy, and algebraic transformations.

When using homomorphic encryption techniques, the cloud is able to perform the computations on encrypted data without the need to decrypt it [3]. As a result, the cloud can implement optimization algorithms using fully homomorphic encryption (FHE), as done in [17, 11]. However, FHE is inefficient in terms of execution time [3], which makes it impractical for online optimization. Therefore, partially homomorphic encryption (PHE), a simpler form of FHE only allowing for a subset of operations to be performed on encrypted data, has become more popular in connection to privacy in control over the cloud. While PHE methods are shown to be feasible and are able to provide privacy guarantees [9, 10, 21, 27, 2, 1], execution time, which grows disproportionally with an increase in key length [10, 2], remains a valid concern in these methods. A consequence of this is that using homomorphic encrypion may potentially lead to instability in the controlled system due to processing delays. To address this problem, some works (see [10]) have shown that encryption parameters can be chosen to ensure stability of the closed-loop performance, thus providing a natural trade-off between security and control performance. The practical feasibility of encrypted control systems has been validated in [16] by considering control of a DC motor in real time.

Inspired by studies in privacy of databases, the problem of privacy in control over the cloud has also been approached from the standpoint of differential privacy (see [7, 18]). This technique ensures that the risk of losing privacy of a single user's data by means of data queries is low. The main idea of these methods is to perturb the response to a data query with appropriate noise [8]. However, to achieve more privacy, the user must sacrifice accuracy (i.e., add more noise), which, in the context of control, degrades the control performance.

The ideas behind algebraic transformation methods have initially stemed from works on privacy in optimization. The idea is to use algebraic transformations to produce a different, but equivalent optimization problem. In other words, although the cloud does not know the original optimization problem, it can provide the client with an optimal solution to an equivalent optimization problem from which the client is able to recover the optimal solution to the original problem. Although initially these methods found application exclusively in linear programs [22, 35], several efforts have been directed to providing a unified framework and generalizing them to convex optimization problems (see [37, 36]). The work in [37] also shows one of the first attempls to define and quantify privacy of transformation-based methods. Algebraic transformation methods found applications in control due to their efficiency and guaranteed optimality of the solution [36]. For example, in [39] the authors propose a hybrid transformation-based method to preserve privacy of an MPC controller in networked control systems. In [38], transformation-based methods are used to provide privacy in a specific problem AC Optimal Power Flow.

1.3. Contributions

This paper focuses on the use of transformation-based methods to preserve privacy of the system dynamics, control objective and constraints, and system trajectories. The contributions of this paper are fourfold:

1. (1)

we propose using isomorphisms and symmetries of control systems as a source of transformations so as to keep data private; 2. (2)

we quantify the privacy guaranteed by these methods via the dimension of the set that describes the uncertainty experienced by the adversary; 3. (3)

we quantify how much privacy is lost when the adversary is assumed to have access to side knowledge; 4. (4)

we show that the proposed method is computationally light as it only requires matrix multiplications.

The method proposed in this paper was initially introduced in [29]. In [28], it was extended to networked control systems with several agents requesting control input from a single cloud. In [30], the dimension of the set describing the uncertainty experienced by the adversary was proposed as a measure of privacy for this method and was evaluated for the special case of free group actions. This paper provides a unified presentation of the results in [29, 30] with simpler proofs and several new results, such as the bounds on privacy when the group action is not free and an exact quantification of privacy for prime systems.

While privacy quantification in optimization has been studied in [36], this work considers how much privacy is preserved in the more challenging context of control. Moreover, the measure of privacy proposed in this work has been chosen to be suitable for problems of optimization in control systems and, therefore, is different from any of those proposed in [36]. Although the application of transformation-based methods in control has been previously discussed in [39], the scheme proposed there only considers a special case, where the cloud optimizes the weighted sum of the norms of the input and state, and the state is taken to be the output of the system. Our algorithm can be applied to a wider class of problems as we allow for arbitrary quadratic costs, linear constraints and outputs different from the state.

2. Problem Definition

2.1. Plant dynamics and control objective

We consider discrete-time affine plants, denoted by $\Sigma$, and described by:

[TABLE]

where $\bar{A}\in\mathbb{R}^{n\times n}$, $\bar{B}\in\mathbb{R}^{n\times m}$, $\bar{C}\in\mathbb{R}^{p\times n}$, $\bar{c}\in\mathbb{R}^{n}$, and $\bar{d}\in\mathbb{R}^{p}$ describe the dynamics of the system, and $\bar{x}_{k}\in\mathbb{R}^{n}$, $u_{k}\in\mathbb{R}^{m}$ and $\bar{y}_{k}\in\mathbb{R}^{p}$ denote the state, input and output of the system at time $k$, respectively. We assume that system $\Sigma$ is controllable and observable. We also assume, without loss of generality, that $\text{ker }\bar{B}=\{0\}$ and $\text{Im }\bar{C}={\mathbb{R}}^{p}$, since we can always eliminate linearly dependent columns (resp. rows) from $\bar{B}$ (resp. $\bar{C})$.

To simplify notation, we lift every affine map $Wx+v$ to a linear map through the following construction:

[TABLE]

Applying (2.2) to (2.1):

[TABLE]

In the remainder of the paper we suppress the inner structure for simplicity and represent all the systems in the linear form (2.3). However, the reader is advised to remember that we are dealing with affine maps. This is also true for the affine maps we will use to define isomorphisms.

We refer to system (2.3) as the triple $\Sigma=(A,B,C)$. We call a triple $\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}}$ a trajectory of $\Sigma$ if it satisfies (2.1) for all $k\in\mathbb{N}$.

Additionally, we define a cost function $J:\mathbb{R}^{n}\times(\mathbb{R}^{m})^{N+1}\rightarrow\mathbb{R}$ for $N\in\mathbb{N}\cup\{+\infty\}$ that allows to compare trajectories and, thus, to formulate different control objectives. In alignment with the linear framework, we consider quadratic cost functions given by:

[TABLE]

where $\Delta\eta_{i}=\begin{bmatrix}x_{i}-x^{*}_{i}&u_{i}-u^{*}_{i}\end{bmatrix}^{T}$, $x=\{x_{0},...,x_{N}\}$ and $u=\{u_{0},...,u_{N}\}$. The sequences $x^{*}=\{x_{0}^{*},...,x^{*}_{N}\}$ and $u^{*}=\{u_{0}^{*},...,u^{*}_{N}\}$ denote the reference trajectories to be tracked. We define $M\in{\mathbb{R}}^{(n+m+1)\times(n+m+1)}$ to be a positive-definite matrix. Due to the lift (2.2), this cost includes not only quadratic, but also linear terms.

In addition to a cost, we also consider control objectives that require certain constraints to be satisfied at all times. These constraints are defined as:

[TABLE]

where $\eta_{i}=\begin{bmatrix}x_{i}&u_{i}\end{bmatrix}^{T}$ and $D\in{\mathbb{R}}^{h\times(n+m+1)}$. Note that, despite appearing to be linear constraints, the constraints above are in fact affine, in view of the construction (2.2).

2.2. Attack model and privacy objectives

The cloud is treated as a curious but honest adversary: the cloud adheres to the computations prescribed by an agreed-upon protocol, but may seek to extract and leak confidential information by keeping record of all computations and communicated messages.

The interaction between the plant and the cloud is performed in two steps. During the first step, called the handshaking, the plant provides the cloud with a suitably modified version of the plant model, cost, and constraints. In exchange, the cloud agrees to compute the input minimizing the provided cost, subject to the constraints and plant dynamics. During the second step, called plant execution, the plant repeatedly sends a suitably modified version of its measurements to the cloud. The cloud computes a new input based on the received measurements and sends it to the plant, where it is suitably modified before being applied to the plant.

In the previous paragraph we purposely used the vague expression “suitably modified”. Making this expression more concrete requires that we first define the knowledge available to the plant. We consider the following three scenarios.

Problem 2.1** (Scenario 1).**

Assuming the cloud has no knowledge about the plant:

1. (1)

how to modify the plant $(A,B,C)$, cost $J$, and constraint matrix $D$ before sending them during the handshaking step, 2. (2)

how to modify the measurements sent to the plant, and 3. (3)

how to modify the inputs received from the plant,

so that the plant’s trajectory minimizes cost $J$ in (2.4), while preventing the cloud from learning the plant $(A,B,C)$, the cost $J$, the constraint matrix $D$, and the plant’s trajectory $\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}}$?

Problem 2.2** (Scenario 2).**

Assuming the cloud has no knowledge about the plant except for knowing what are its sensors and actuators:

1. (1)

how to modify the plant $(A,B,C)$, cost $J$, and constraint matrix $D$ before sending them during the handshaking step; 2. (2)

how to modify the measurements sent to the plant, and 3. (3)

how to modify the inputs received from the plant,

so that the plant’s trajectory minimizes cost $J$ in (2.4), while preventing the cloud from learning the plant $(A,B,C)$, the cost $J$, the constraint matrix $D$, and the plant’s trajectory $\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}}$?

Problem 2.3** (Scenario 3).**

Assuming the cloud has complete knowledge about the plant dynamics, including its sensors and actuators:

1. (1)

how to modify cost $J$, and constraint matrix $D$ before sending them alongside the plant $(A,B,C)$ during the handshaking step; 2. (2)

how to modify the measurements sent to the plant, and 3. (3)

how to modify the inputs received from the plant,

so that the plant’s trajectory minimizes cost $J$ in (2.4), while preventing the cloud from learning the cost $J$, the constraint matrix $D$, and the plant’s trajectory $\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}}$?

These problems are solved in Section 4 by utilizing isomorphisms and symmetries of control systems we define next in Section 3.

3. Isomorphisms and

symmetries of control systems

In this section, we introduce the notions of isomorphism and symmetry of control systems along with several technical results used in Section 4 to provide a solution to the problems described in Section 2.

Let us denote by $\mathcal{S}_{n,m,p}$ the set of all controllable and observable linear control systems with state, input and output dimensions $n$, $m$, and $p$, respectively.

Definition 3.1**.**

An isomorphism of control systems in $\mathcal{S}_{n,m,p}$ is a quadruple $\psi=(P,F,G,S)$ consisting of a change of state coordinates $P:{\mathbb{R}}^{n}\to{\mathbb{R}}^{n}$, state feedback $F:{\mathbb{R}}^{n}\to{\mathbb{R}}^{m}$, a change of coordinates in the input space $G:{\mathbb{R}}^{m}\to{\mathbb{R}}^{m}$, and a change of coordinates in the output space $S:{\mathbb{R}}^{p}\to{\mathbb{R}}^{p}$. Transformations $P$ and $S$ are affine invertible maps, $F$ is an affine map and $G$ is a linear invertible map.

Recall that, to simplify notation, we lift the affine maps to linear maps using the transformation (2.2).

Let us also denote the set of isomorphisms of $\mathcal{S}_{n,m,p}$ described in Definition 3.1 as $\mathcal{G}_{n,m,p}$. The set $\mathcal{G}_{n,m,p}$ forms a group under function composition as the group operation111A composition of two isomorphisms is given by $\psi_{2}\circ\psi_{1}=(P_{2}P_{1},G_{2}F_{1}+F_{2}P_{1},G_{2}G_{1},S_{2}S_{1})$, the identity is $\psi_{e}=(I,0,I,I)$ and the inverse is given by $\psi^{-1}=(P^{-1},-G^{-1}FP,G^{-1},S^{-1}).$. This allows us to define a group action of $\mathcal{G}_{n,m,p}$ on the set of linear control systems $\mathcal{S}_{n,m,p}$.

Definition 3.2**.**

Each element $\psi\in\mathcal{G}_{n,m,p}$ acts on $\Sigma\in\mathcal{S}_{n,m,p}$ to produce $\psi_{*}\Sigma$ given by:

[TABLE]

The map $\psi_{*}$ is called an isomorphism action. We also say that systems $\Sigma$ and $\tilde{\Sigma}$ are equivalent.

An isomorphism maps the state $x_{k}$, input $u_{k}$, and output $y_{k}$ of system $\Sigma$ to the state $\tilde{x}_{k}$, input $\tilde{u}_{k}$, and output $\tilde{y}_{k}$ of system $\tilde{\Sigma}$ as follows:

[TABLE]

Similarly, an isomorphism induces transformation on the control objectives — i.e., the cost and constraints. The effect of $\psi$ on $\eta_{k}$ can be represented by:

[TABLE]

Therefore, the cost function $J$ can be expressed as a function of the sequence of modified states $\tilde{x}=\{\tilde{x}_{0},...,\tilde{x}_{N}\}$ and the sequence of modified inputs $\tilde{u}=\{u_{0},...,\tilde{u}_{N}\}$ as follows:

[TABLE]

where $\tilde{M}=L^{-T}ML^{-1}$. Applying the isomorphism action to the constraints in (2.5) yields:

[TABLE]

where $\tilde{D}=\psi_{*}D=DL^{-1}$.

The effect of an isomorphism on the system, trajectory, cost and constraints will be used in Section 4 to prevent the cloud from learning them.

For a given system $\Sigma$, there is a special subgroup of $\mathcal{G}_{n,m,p}$ called the symmetry group of $\Sigma$, which is defined by the following property.

Definition 3.3**.**

Let $\Sigma\in\mathcal{S}_{n,m,p}$. An isomorphism $\psi\in\mathcal{G}_{n,m,p}$ is said to be a symmetry of $\Sigma$ if $\psi_{*}\Sigma=\Sigma$. The subgroup of symmetries of $\Sigma$ is denoted here as $\mathcal{K}_{n,m,p}(\Sigma)$.

The notion of isomorphism was crafted to preserve properties of control systems. Among these, trajectories have a special significance. A simple induction argument can be used to establish the following result.

Lemma 3.4**.**

Let $\Sigma\in\mathcal{S}_{n,m,p}$ and $\psi\in\mathcal{G}_{n,m,p}$. If $\tilde{\Sigma}=\psi_{*}{\Sigma}$ and $\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}}$ is a trajectory of $\Sigma$, then $\{\tilde{x}_{k},\tilde{u}_{k},\tilde{y}_{k}\}_{k\in{\mathbb{N}}}$, as given by (3.2) - (3.4), is a valid trajectory of $\tilde{\Sigma}$.

This means that if the cloud receives $\tilde{\Sigma}$ during the handshaking step, then the received sequence of measurements $\tilde{y}$ and the produced sequence of control inputs $\tilde{u}$ in the subsequent execution step are compatible with the plant $\tilde{\Sigma}$. To elaborate, both the modified measurements $\tilde{y}$ and modified control inputs $\tilde{u}$ would be compatible with modified dynamics $\tilde{\Sigma}$.

Let us now define $\bar{\mathcal{S}}_{n,m,p}$ to be a set of quadruples $\Omega\triangleq\left\{\Sigma,J,D,\left\{x_{k},y_{k},u_{k}\right\}\right\}_{k\in{\mathbb{N}}}$ such that $\left\{x_{k},y_{k},u_{k}\right\}$ is a trajectory of a linear system $\Sigma\in\mathcal{S}_{n,m,p}$ minimizing cost function $J$ under constraints $D$.

Lemma 3.5**.**

The set $\bar{\mathcal{S}}_{n,m,p}$ is a smooth manifold.

Proof.

We can see that $\bar{\mathcal{S}}_{n,m,p}$ is, in fact, the Cartesian product of $\mathcal{S}_{n,m,p}$ with the set of cost functions $\mathcal{M}^{++}(m+n+1,{\mathbb{R}})$, defined by positive-definite matrices, with the set of constraints $\mathcal{M}_{d}(h\times(m+n+1),{\mathbb{R}})$, defined by the set of full-rank matrices, where $d=\text{min}\{h,m+n+1\}$. It is known that the product space is a smooth manifold if its constituents are smooth manifolds [20, p. 21]. It remains to show that these constinuents are indeed smooth manifolds.

Let us construct the map:

[TABLE]

where $\mathcal{C}$ and $\mathcal{O}$ are the controllability and observability matrices of the dynamics $(A,B,C)$. It can be seen that $\mathcal{S}_{n,m,p}=f_{S}^{-1}({\mathbb{R}}^{2}\setminus\left(0,0\right))$. The function $f_{S}$ is continuous since each of its elements is defined by a polynomial function of the elements of $(A,B,C)$. Given that for continuous functions the preimage of every open set is an open set, we have that $\mathcal{S}_{n,m,p}$ is an open subset of the domain of $f_{S}$. Seeing that the domain of $f_{S}$ is a smooth manifold, $\mathcal{S}_{n,m,p}$ is a smooth manifold of dimension $n(n+1)+nm+p(n+1)$.

The set of positive-definite matrices $\mathcal{M}^{++}(m+n+1,{\mathbb{R}})$ is shown to be a smooth embedded submanifold of ${\mathbb{R}}^{(m+n+1)\times(m+n+1)}$ of dimension $(m+n+1)(m+n+2)/2$ in [33].

The set of full-rank matrices $\mathcal{M}_{d}(h\times(m+n+1),{\mathbb{R}})$ is a smooth manifold of dimension $h(m+n+1)$ [20, p. 19]. ∎

Similarly to $\mathcal{S}_{n,m,p}$, we can define a group action of $\mathcal{G}_{n,m,p}$ on $\bar{\mathcal{S}}_{n,m,p}$ in view of the previous discussion.

Therefore, we can use the isomorphism action of $\mathcal{G}_{n,m,p}$ to define an equivalence relation on $\bar{\mathcal{S}}_{n,m,p}$.

Definition 3.6**.**

Let $\Omega=(\Sigma,J,D,\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}})$ and $\tilde{\Omega}=(\tilde{\Sigma},\tilde{J},\tilde{D},\{\tilde{x}_{k},\tilde{u}_{k},\tilde{y}_{k}\}_{k\in{\mathbb{N}}})$ be elements of $\bar{\mathcal{S}}_{n,m,p}$. The equivalence relation $\sim_{\mathcal{G}}$ on $\bar{\mathcal{S}}_{n,m,p}$ denoted by:

[TABLE]

is defined by the existence of $\psi\in\mathcal{G}_{n,m,p}$ such that:

[TABLE]

i.e., $\tilde{\Sigma}=\psi_{*}\Sigma$, $\tilde{J}=\psi_{*}J$, $\tilde{D}=\psi_{*}D$, and $\{\tilde{x}_{k},\tilde{u}_{k},\tilde{y}_{k}\}_{k\in{\mathbb{N}}}$ is given in terms of $\{x_{k},u_{k},y_{k}\}_{k\in{\mathbb{N}}}$ as in (3.2) - (3.4).

The equivalence relation $\sim_{\mathcal{G}}$, in turn, defines equivalence classes in $\bar{\mathcal{S}}_{n,m,p}$. The equivalence class of $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ defined by the action of $\mathcal{G}_{n,m,p}$ is the set:

[TABLE]

This equivalence class is also called the orbit of $\Omega$ under action of $\mathcal{G}_{n,m,p}$.

To facilitate further results, let us show that $\mathcal{G}_{n,m,p}$ is a Lie group acting on $\bar{\mathcal{S}}_{n,m,p}$.

Lemma 3.7**.**

The group $\mathcal{G}_{n,m,p}$ is a Lie group of dimension $n(n+1)+m(n+1)+m^{2}+p(p+1)$ acting smoothly on $\bar{\mathcal{S}}_{n,m,p}$.

Proof.

It was previously established that $\mathcal{G}_{n,m,p}$ is a group. It is a Lie group because it is a Cartesian product of smooth manifolds (i.e., general linear groups and vector spaces of various dimensions) and its multiplication and inversion maps are smooth. Moreover, since the dimension of a product of smooth manifolds is equal to the sum of the factors’ dimensions, the dimension of $\mathcal{G}_{n,m,p}$ is $n(n+1)+m(n+1)+m^{2}+p(p+1)$ [20, p. 21]. The group $\mathcal{G}_{n,m,p}$ acts smoothly on $\bar{\mathcal{S}}_{n,m,p}$ since its action involves matrix multiplication and matrix inversion: the former results in every element of the product being a polynomial function of the elements of the factors, while the latter is smooth by Cramer’s rule [20]. ∎

The next result shows that when the cloud optimizes $\tilde{J}$ and the plant replaces each $y_{k}$ with output $\tilde{y}_{k}$, the resulting sequence of inputs ${\tilde{u}}$ can be used to reconstruct a sequence of inputs ${u}$ that optimizes $J$. Its proof amounts to using the change of variables (3.2)-(3.4).

Lemma 3.8**.**

Let $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ and $\psi\in\mathcal{G}_{n,m,p}$. Suppose the cloud solves the optimization problem:

[TABLE]

for the plant $\tilde{\Sigma}=\psi_{*}\Sigma$ and the sequence $\tilde{u}^{*}$ is a unique solution of this optimization problem. Then, the unique solution of the optimization problem:

[TABLE]

for the plant $\Sigma$ is the sequence $u^{*}$ such that $u^{*}_{i}=G^{-1}(\tilde{u}_{i}^{*}-Fx_{i})$ for all $i\in\{0,...,N\}$.

4. Solving the control-over-the-cloud

privacy problem

4.1. Enforcing privacy

The main reason for using isomorphisms is to preclude the cloud from distinguishing between isomorphic systems. We now formalize the notion of indistinguishability.

Definition 4.1**.**

A protocol renders two quadruples $\Omega$ and $\tilde{\Omega}$ indistinguishable by the cloud if the exchanged messages, when using the protocol between the cloud and the plant $\Omega$, and the exchanged messages, when using the protocol between the cloud and the plant $\tilde{\Omega}$, can be made the same.

The results from Section 3 allow us to construct a communication protocol between the plant and the cloud that, as will be further shown, solves Problems 2.1-2.3. We start by detailing this protocol.

From Lemma 3.8, we see that Algorithm 1 provides the plant with the inputs $u_{k}$ that satisfy the original control objective — i.e., the plant’s trajectory minimizes cost $J$ under affine constraints $D$.

Let us note how all the required computations in this algorithm are matrix multiplications, which means that both handshaking and execution can be performed in $O(k^{3})$ time, where $k=\max\{n,m,p\}$. However, performing matrix multiplications of constant matrices (e.g., $G^{-1}F$) in advance would reduce the complexity of the execution to $O(k^{2})$. Both of these complexities were calculated only for the client side (i.e., Plant) of the algorithm.

Let us now show that applying this protocol indeed makes any two systems in the same equivalence class indistinguishable from each other.

Theorem 4.2**.**

Algorithm 1 renders isomorphic systems $\Omega=(\Sigma,J,D,\left\{x_{k},u_{k},y_{k}\right\}_{k\in{\mathbb{N}}})$ and $\tilde{\Omega}=(\tilde{\Sigma},\tilde{J},\tilde{D},\left\{\tilde{x}_{k},\tilde{u}_{k},\tilde{y}_{k}\right\}_{k\in{\mathbb{N}}})$ indistinguishable by the cloud.

Proof.

Since $\Omega$ and $\tilde{\Omega}$ are isomorphic, there exists an isomorphism $\psi$ such that $\psi_{*}\Sigma=\tilde{\Sigma}$, $\psi_{*}J=\tilde{J}$, and $\psi_{*}D=\tilde{D}$. Indistinguishibility of $\Omega$ and $\tilde{\Omega}$ will be shown by running two instances of Algorithm 1: one with $\Omega$ and $\psi$ as inputs, the other - with $\tilde{\Omega}$ and the identity isomorphism $\psi_{e}$. Let us denote the communication algorithm described in Algorithm 1 applied to $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ with the selected isomorphism $\psi\in\mathcal{G}_{n,m,p}$ by $\text{Alg}(\Omega,\psi)$. During handshaking:

• •

when $\text{Alg}(\Omega,\psi)$ is executed, the plant sends $\psi_{*}\Sigma$, $\psi_{*}J$, and $\psi_{*}D$;

• •

when $\text{Alg}(\tilde{\Omega},\psi_{e})$ is executed ($\psi_{e}$ is the identity of $\mathcal{G}_{n,m,p}$), the plant sends $\tilde{\Sigma}$, $\tilde{J}$, and matrix $\tilde{D}$ unprotected.

Thus, the communicated dynamics and optimization problems are the same. During execution:

• •

when $\text{Alg}(\Omega,\psi)$ is executed, $\psi$ takes trajectories $\left\{x_{k},u_{k},y_{k}\right\}_{k\in{\mathbb{N}}}$ of $\Sigma$ to trajectories $\left\{\tilde{x}_{k},\tilde{u}_{k},\tilde{y}_{k}\right\}_{k\in{\mathbb{N}}}$ of $\psi_{*}\Sigma$;

• •

when $\text{Alg}(\tilde{\Omega},\psi_{e})$ is executed, the trajectories are $\left\{\tilde{x}_{k},\tilde{u}_{k},\tilde{y}_{k}\right\}_{k\in{\mathbb{N}}}$.

Therefore, the cloud receives the same measurements from both plants. In response, since both plants communicated the same optimization problem, the cloud sends the same control inputs to both plant $\Omega$ and $\tilde{\Omega}$. ∎

The result described in Theorem 4.2 states that the cloud cannot differentiate between any two plants, costs, constraints or trajectories contained in the same equivalence class of the $\sim_{\mathcal{G}}$-equivalence relation, thereby protecting the privacy of the system. In the next section, we quantify the amount of privacy provided by Algorithm 1.

4.2. Quantifying privacy

Privacy is created by preventing the cloud from knowing which quadruple $\Omega$ in its equivalence class $[\Omega]$ it is interacting with. Clearly, the larger the equivalence class, the more privacy is ensured. Since each equivalence class has infinitely many elements, cardinality cannot be used as a measure of privacy. In this section, we show that each equivalence class is a smooth manifold and we quantify privacy using the dimension of this manifold.

4.2.1. Preliminaries: stabilizer subgroups and their dimensions

The stabilizer subgroup of $\mathcal{G}_{n,m,p}$ for any $\Omega\in\bar{S}_{n,m,p}$, denoted by $\mathcal{K}_{n,m,p}(\Omega)$, is defined by:

[TABLE]

The subgroup $\mathcal{K}_{n,m,p}(\Omega)$ must be a subset of the symmetry subgroup $\mathcal{K}_{n,m,p}(\Sigma)$ since it must preserve the dynamics.

In [25], Respondek gives a characterization of the symmetries of controllable pairs $(A,B)$. Since when considering pairs $(A,B)$ the output is not relevant, the isomorphisms of $(A,B)$ degenerate into the form $\phi=(P,F,G)$, where the matrices $P$, $F$ and $G$ are defined to be the same as their counterparts in Definition 3.1. We denote the group of these isomorphisms by $\mathcal{G}_{n,m}$. The group action of $\mathcal{G}_{n,m}$ is given by:

[TABLE]

Let us define the symmetry subgroup of controllable systems $(A,B)$ as:

[TABLE]

The next proposition summarizes the results of [25] that are relevant to this paper and complements them with the results from [4]:

Proposition 4.3**.**

Let (A,B) be a controllable pair. Then:

[TABLE]

where:

[TABLE]

and $\{\kappa_{i}\}_{i=1}^{m}$ are controllability indices of $(A,B)$.

This result can be used to estimate the dimension of $\mathcal{K}_{n,m,p}(\Sigma)$. If $\Sigma=(A,B,C)$, then, from Proposition 4.3, we know the dimension of $\mathcal{K}_{n,m}(A,B)$ and that any $\phi\in\mathcal{K}_{n,m}(A,B)$ satisfies $\phi_{*}(A,B)=(A,B)$. Given $\phi=(P,F,G)\in\mathcal{K}_{n,m}(A,B)$, finding a corresponding $\psi=(P,F,G,S)\in\mathcal{K}_{n,m,p}(\Sigma)$ requires finding $S$ such that $C=SCP^{-1}$. Since we assume $C$ has linearly independent rows, for a given $P$, this equation has at most one solution. A solution exists if and only if $\text{Im }C^{T}\subset\text{Im }P^{-T}C^{T}$ [19]. Let $\mathcal{Q}(A,B,C)$ be the subset of $\mathcal{K}_{n,m}(A,B)$ defined by the elements $(P,F,G)$ for which a unique solution to $C=SCP^{-1}$ exists. It can be seen that there is a one-to-one correspondence between $\mathcal{Q}(A,B,C)$ and $\mathcal{K}_{n,m,p}(\Sigma)$. Since $\mathcal{Q}(A,B,C)\subset\mathcal{K}_{n,m}(A,B)$, this gives an upper bound on the dimension of the symmetry subgroup:

[TABLE]

Lemma 4.4**.**

For any $\Omega=(\Sigma,J,D,\left\{x_{k},u_{k},y_{k}\right\}_{k\in{\mathbb{N}}})\in\bar{\mathcal{S}}_{n,m,p}$,

[TABLE]

where $\text{dim }\mathcal{K}_{n,m,p}(A,B)$ is given by Proposition 4.3.

Let us consider a special case, in which the dimension of $\mathcal{K}_{n,m,p}(\Sigma)$ can be computed exactly.

Definition 4.5**.**

A system $\Sigma\in\mathcal{S}_{n,m,p}$ is said to be a prime system if it is $\sim_{\mathcal{G}}$-equivalent to the system of the form:

[TABLE]

where $x_{k}=\begin{bmatrix}x^{(1,1)}_{k},...,x^{(1,\kappa_{1})}_{k},...,x^{(m,1)}_{k},...,x^{(m,\kappa_{m})}_{k}\end{bmatrix}^{T}\in{\mathbb{R}}^{n}$ and $\{\kappa_{i}\}_{i=1}^{m}$ are controllability indices of $(A,B)$.

For prime systems we have the following characterization of the dimension of $\mathcal{K}_{n,m,p}(\Sigma)$.

Lemma 4.6**.**

Let $\Sigma\in\mathcal{S}_{n,m,p}$ be a prime system. Then,

[TABLE]

where

[TABLE]

and $\{\kappa_{i}\}_{i=1}^{m}$ are controllability indices of $(A,B)$.

Proof.

Without loss of generality, let us consider a prime system of the form (4.5). From Proposition 2 in [25], we can see that if a system is prime, a symmetry $\psi=(P,F,G,S)$ is uniquely defined by a transformation on its outputs (i.e., by transformation $S$).

We want to show that, in order to define a symmetry, transformation $S$ needs to be constructed in such a way that each transformed output $\tilde{y}^{(i)}_{k}$ is an affine function of outputs $y^{(j)}_{k}$ with relative degrees greater or equal than that of $y^{(i)}_{k}$. To simplify notation, we prove this claim for the example with controllability indices $\kappa_{1}=\kappa_{2}=2$, $\kappa_{3}=1$, although the employed arguments apply to any prime system:

[TABLE]

We will show, by contradiction, that if $S$ produces a transformed output based on outputs of a smaller relative degree, then $S$ cannot be part of a symmetry. In other words, there exist no matrices $P$, $F$, and $G$ such that the quadruple $(P,F,G,S)$ satisfies the equations:

[TABLE]

Assume that (4.8)-(4.10) are satisfied and that $S$ contains non-zero elements $S_{ij}$ if $\kappa_{i}>\kappa_{j}$ (i.e., the transformed output uses outputs of a smaller relative degree). From (4.10), we have that:

[TABLE]

By using (4.8) and (4.9), the following relation can be shown:

[TABLE]

Recursively substituting (4.12) into (4.11) results in:

[TABLE]

Equation (4.9) implies that $PB=BG$ and, thus, leads to:

[TABLE]

Note that $CA^{l}B$ is a diagonal matrix such that:

[TABLE]

In other words, this diagonal matrix marks the indices corresponding to the outputs of equal relative degree. In addition, the expression $FA^{q-l-1}B$ is an $m\times m$ matrix composed out of elements of $F$ (recall that $A$ and $B$ are in the form (4.5)).

The left-hand side of (4.13) selects the columns of $S$ corresponding to the outputs of relative degree $\kappa_{i}=q+1$. For the example in (4.7), taking $q=0$ gives:

[TABLE]

The right-hand side of (4.13) fills the rows corresponding to the outputs of relative degree smaller or equal than $\kappa_{i}=q+1$ with values from $G$. In case of example in (4.7), the right-hand side, given $q=0$, is:

[TABLE]

Thus, the equality in (4.13), which was derived using the definition of symmetry, forces $S_{ij}$ to zero if $\kappa_{i}>\kappa_{j}$. In the example in (4.7), this leads to $S_{13}=S_{23}=0$. This contradicts the assumption that $S$ produces a transformed output based on outputs of a smaller relative degree.

This idea can be generalized to any prime system and, therefore, each transformed output $\tilde{y}^{(i)}_{k}$ can only be an affine function of outputs $y^{(j)}_{k}$ with relative degrees greater or equal than that of $y^{(i)}_{k}$.

The number of outputs $y^{(j)}_{k}$ with a relative degree greater or equal to that of $y^{(i)}_{k}$ (i.e., greater or equal than $k_{i}$) is equal to $r_{k_{i}}$ [4]. Therefore, each modified output $y^{(i)}_{k}$ is an affine function with $r_{k_{i}}$ arguments and a non-zero constant term, thus leading to the equality:

[TABLE]

∎

4.2.2. Main results

Consider the scenario from Problem 2.1, in which the cloud does not know anything about the system. In this scenario, the plant encodes $\Omega$ using an isomorphism $\psi=(P,F,G,S)$ that can be regarded as a private key used to encode and decode the information exchanged with the cloud. This isomorphism $\psi$ is chosen from $\mathcal{G}_{n,m,p}$, the group of all isomorphisms.

Proposition 4.7**.**

Let $\Omega\in\bar{\mathcal{S}}_{n,m,p}$. Then, under the scenario described in Problem 2.1, the cloud cannot distinguish between $\Omega$ and any other system in the uncertainty set $[\Omega]_{\mathcal{G}}$ (i.e., the equivalence class of $\Omega$ defined by the action of $\mathcal{G}_{n,m,p}$) of dimension:

[TABLE]

if Algorithm 1 is used.

This implies that the dimension of $[\Omega]_{\mathcal{G}}$ is greater or equal than:

[TABLE]

where $r_{i}$ is given in Lemma 4.3.

For $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ such that its corresponding $\Sigma\in\mathcal{S}_{n,m,p}$ is prime, this implies that the dimension of $[\Omega]_{\mathcal{G}}$ is greater or equal to:

[TABLE]

*where $r_{\kappa_{i}}$ is given in Lemma 4.6. *

Proof.

From Theorem 4.2, we know that Algorithm 1 renders isomorphic systems indistinguishable by the cloud. Therefore, the uncertainty set is the set of systems isomorphic to $[\Omega]_{\mathcal{G}}$ - namely, the equivalence class of $\Omega$ defined by the action of $\mathcal{G}_{n,m,p}$.

Let us define a map:

[TABLE]

Here, $\theta_{\Omega}$ is smooth because, as shown in Lemma 3.7, $\mathcal{G}_{n,m,p}$ acts smoothly on $\bar{\mathcal{S}}_{n,m,p}$. The stabilizer set can be defined by:

[TABLE]

Since $\theta_{\Omega}$ and its inverse are smooth and, therefore, continuous, the subgroup $\mathcal{K}_{n,m,p}(\Omega)$ is closed.

By Theorem 21.17 in [20], the quotient space $\mathcal{G}_{n,m,p}/\mathcal{K}_{n,m,p}(\Omega)$ is a smooth manifold of dimension $\text{dim }\mathcal{G}_{n,m,p}-\text{dim }\mathcal{K}_{n,m,p}(\Omega)$ such that the quotient map $\pi:\mathcal{G}_{n,m,p}\rightarrow\mathcal{G}_{n,m,p}/\mathcal{K}_{n,m,p}(\Omega)$ is a smooth submersion.

Now, let us define a map:

[TABLE]

where $\psi\mathcal{K}_{n,m,p}(\Omega)$ is a left coset of $\mathcal{K}_{n,m,p}(\Omega)$. It can be shown that $\Theta_{\Omega}$ is well-defined.

By Theorem 4.29 in [20], $\Theta_{\Omega}$ is smooth because $\theta_{\Omega}=\Theta_{\Omega}\circ\pi$ is smooth and $\pi$ is a smooth submersion.

It can be shown that the map $\Theta_{\Omega}$ is equivariant (see [20, p. 164]) and, therefore, by the equivariant rank theorem [20, p. 165], we have that $\Theta_{\Omega}$ has a constant rank.

Let us show that $\Theta_{\Omega}$ is injective. If $\Theta_{\Omega}(\psi_{1}\mathcal{K}_{n,m,p}(\Omega))=\Theta_{\Omega}(\psi_{2}\mathcal{K}_{n,m,p}(\Omega))$, then $(\psi_{1})_{*}\Omega=(\psi_{2})_{*}\Omega$. This implies that $(\psi_{1})^{-1}\psi_{2}\in\mathcal{K}_{n,m,p}(\Omega)$ and, therefore, $\psi_{1}\mathcal{K}_{n,m,p}(\Omega)=\psi_{2}\mathcal{K}_{n,m,p}(\Omega)$. Therefore, $\Theta_{\Omega}$ is a smooth immersion.

By Proposition 5.18 in [20], the image of $\Theta_{\Omega}$ (i.e., the equivalence class $[\Omega]_{\mathcal{G}}$) is an immersed submanifold such that $\Theta_{\Omega}:\mathcal{G}_{n,m,p}/\mathcal{K}_{n,m,p}(\Omega)\rightarrow[\Omega]_{\mathcal{G}}$ is a diffeomorphism and, therefore, the dimension of $[\Omega]_{\mathcal{G}}$ is equal to the dimension of $\mathcal{G}_{n,m,p}/\mathcal{K}_{n,m,p}(\Omega)$.

A more concrete quantification of privacy can be given for various special cases. Using the results of Proposition 4.3 and Lemma 4.4, we have that, for any $\Omega\in\bar{\mathcal{S}}_{n,m,p}$, the uncertainty sets under the scenario described in Problem 2.1 are smooth manifolds of dimension greater or equal to the value in (4.19)

The dimension of the uncertainty sets can be shown to be greater or equal to the value in (4.20) using Lemma 4.6. ∎

Proposition 4.7 can be used to quantify privacy of other scenarios presented in Section 2.

Consider the scenario in Problem 2.2, where the cloud does not know the dynamics but knows which sensors and actuators will be used. An arbitrary isomorphism can no longer be used for encoding since it could lead to inputs and outputs that are inconsistent with existing sensors and actuators. This inconsistency would signal the cloud that the plant is being dishonest about its measurements and provide the cloud with an opportunity to exploit this fact to gather additional knowledge. Therefore, we need to restrict the group of isomorphisms used for encoding. These isomorphisms are given by any composition of $\psi_{1}=(P,0,I,I)$ for any $P\in GL(n,{\mathbb{R}})$ and $\psi_{2}\in\mathcal{K}_{n,m,p}(\Sigma)$. It can be shown that this set of isomorphisms forms a subgroup that we denote by $\mathcal{H}_{n,m,p}(\Sigma)\subset\mathcal{G}_{n,m,p}$.

Corollary 4.8**.**

Let $\Omega\in\bar{\mathcal{S}}_{n,m,p}$. Then, under the scenario described in Problem 2.2, the cloud cannot distinguish between $\Omega$ and any other system in the uncertainty set $[\Omega]_{\mathcal{H}}$ (i.e., the equivalence class of $\Omega$ defined by the action of $\mathcal{H}_{n,m,p}$) of dimension:

[TABLE]

if Algorithm 1 is used. This implies that the dimension of $[\Omega]_{\mathcal{H}}$ is greater or equal to $n(n+1)$.

Proof.

From Theorem 4.2, we know that Algorithm 1 renders isomorphic systems indistinguishable by the cloud. However, the uncertainty set is no longer the equivalence class under the entire group of isomorphisms $\mathcal{G}_{n,m,p}$, but the equivalence class under a smaller group $\mathcal{H}_{n,m,p}(\Sigma)$ denoted by $[\Omega]_{\mathcal{H}}$.

It can be shown that $\mathcal{H}_{n,m,p}(\Sigma)$ is a Lie subgroup of $\mathcal{G}_{n,m,p}$. This subgroup $\mathcal{H}_{n,m,p}(\Sigma)$ can be thought of as a product manifold of $\mathcal{K}_{n,m,p}(\Sigma)$ and a space of invertible affine maps. Since the dimension of a product manifold is a sum of its factors’ dimensions, we have:

[TABLE]

The result follows by applying Proposition 4.7 to $\mathcal{H}_{n,m,p}(\Sigma)$. Using the result from Lemma 4.4, we can see that the dimension of the uncertainty set for any $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ is greater or equal to $n(n+1)$. ∎

Finally, in the scenario described in Problem 2.3, where the cloud possesses the complete knowledge of dynamics, only the isomorphisms from the symmetry subgroup $\psi\in\mathcal{K}_{n,m,p}(\Sigma)$ can be used. To provide privacy guarantees for this scenario, let us assume that we have $n+1$ linearly independent constraints on the state $x_{k}$ expressed by the constraint matrix $D$. This is a reasonable assumption because systems often have an operational envelope bounding the states. Therefore, any $\psi\in\mathcal{K}_{n,m,p}(\Omega)$ must satisfy:

[TABLE]

Given that $D_{11}\in{\mathbb{R}}^{h_{1}\times(n+1)}$ is injective, the last equality is satisfied if and only if $P=I$. Since $P$ uniquely defines $F$, $G$ and $S$, we also have that the only isomorphism that keeps $(A,B,C,D_{11})$ invariant is $\psi=\psi_{e}=(I,0,I,I)$ . Therefore, the only element of $\mathcal{K}_{n,m,p}(\Omega)$ is $\phi_{e}=(I,0,I,I)$ and $\text{dim }\mathcal{K}_{n,m,p}(\Omega)=0$.

Corollary 4.9**.**

Let $\Omega\in\bar{\mathcal{S}}_{n,m,p}$. Then, under the scenario described in Problem 2.3, the cloud cannot distinguish between $\Omega$ and any other system in the uncertainty set $[\Omega]_{\mathcal{K}}$ (i.e., the equivalence class of $\Omega$ defined by the action of $\mathcal{K}_{n,m,p}$) of dimension:

[TABLE]

if Algorithm 1 is used.

When the constraint matrix $D$ contains $n+1$ linearly independent constraints on the state, the dimension of the uncertainty set is equal to $\text{dim }\mathcal{K}_{n,m,p}(\Sigma)$, which is greater or equal to:

[TABLE]

.

Moreover, for any $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ such that its corresponding $\Sigma\in\mathcal{S}_{n,m,p}$ is prime, the dimension of $[\Omega]_{\mathcal{K}}$ is equal to

[TABLE]

.

Proof.

The proof of this statement is similar to that of Corollary 4.8. The dimensions of equivalence classes for prime and general systems were evaluated using results of Proposition 4.3 and Lemma 4.6. ∎

5. Side knowledge

The privacy guarantees derived in Section 4 are compromised when the adversary has partial information about the encoding isomorphism. In our problem formulation, we assume that the cloud may have learned those through some external channels or through some prior knowledge about the system.

Recall that by Lemma 3.7, $\mathcal{G}_{n,m,p}$ is a Lie group of dimension $n(n+1)+m(n+1)+m^{2}+p(p+1)$. In this section, we assume that the constraint matrix $D$ has $n+1$ linearly independent constraints on the state and, therefore, as shown in the previous section, $\mathcal{K}_{n,m,p}(\Omega)=\{\psi_{e}\}$, where $\psi_{e}$ is the identity element of $\mathcal{G}_{n,m,p}$.

Suppose the cloud has partial knowledge about the encoding isomorphism. We shall represent the partial knowledge available to the cloud as a projection from $\mathcal{G}_{n,m,p}$ onto a $k$-dimensional vector space. Let us define $\rho:\mathcal{G}_{n,m,p}\rightarrow{\mathbb{R}}^{k}$ to be a surjective map of constant rank $k$, providing side knowledge about the encoding isomorphism. Then, we can say that the cloud knows some vector $l\in{\mathbb{R}}^{k}$, where:

[TABLE]

Note that this map is not known to us, and the results that follow do not require the knowledge of this map.

Side knowledge does not change the result of Theorem 4.2, however the privacy guaranteed by the scheme changes. It is obvious that the size of the uncertainty set defined by isomorphisms that satisfy (5.1) is no greater and, in general, smaller thanif no side knowledge is available. Moreover, the uncertainty set is no longer neither an orbit nor an equivalence class because the preimage of $\rho$ does not necessarily have a group structure.

Let us show that the object defined by (5.1) on $\mathcal{G}_{n,m,p}$ is still a manifold.

Lemma 5.1**.**

Let $\mathcal{G}_{n,m,p}$ be the group of all isomorphisms, $\rho:\mathcal{G}_{n,m,p}\rightarrow{\mathbb{R}}^{k}$ be a surjective map of constant rank $k$ and assume the cloud knows that $l=\rho(P,F,G,S)$. Then, $\rho^{-1}(l)$, representing the possible encoding isomorphisms used by the client, is a properly embedded submanifold of $\mathcal{G}_{n,m,p}$. Its dimension is $\text{dim }\mathcal{G}_{n,m,p}-k$.

Proof.

By the global rank theorem [20, p. 83], since $\rho$ is a surjective map of constant rank $k$, it is a smooth submersion. From the submersion level set theorem [20, p. 105], since both $\mathcal{G}_{n,m,p}$ and ${\mathbb{R}}^{k}$ are smooth manifolds and $\rho$ is a smooth submersion, we have that $\rho^{-1}(l)$ is a properly embedded submanifold of dimension $\text{dim }\mathcal{G}_{n,m,p}-\text{dim }{\mathbb{R}}^{k}=n(n+1)+m(n+1)+m^{2}+p(p+1)-k$. ∎

Let us now consider the map $\Theta_{\Omega}$ defined earlier in Proposition 4.7. Since $\mathcal{K}_{n,m,p}(\Omega)=\psi_{e}$, we have that $\mathcal{G}_{n,m,p}/\mathcal{K}_{n,m,p}(\Omega)$ is equivalent to $\mathcal{G}_{n,m,p}$. Therefore, the map $\Theta_{\Omega}$ is equivalent to the orbit map $\theta_{\Omega}$. It was shown in Proposition 4.7 that $\Theta_{\Omega}$ is injective. The image of $\Theta_{\Omega}(\rho^{-1}(l))$ constitutes the uncertainty set, between the elements of which the cloud is not be able to distinguish. Therefore, the main result of this section requires finding the dimension of $\Theta_{\Omega}(\rho^{-1}(l))$.

Proposition 5.2**.**

Assume $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ is such that the constraint matrix $D$ has $n+1$ linearly independent constraints on the state. Suppose that Algorithm 1 is used and the cloud has the following side knowledge about the selected isomorphism $\psi$:

[TABLE]

where $\rho:\mathcal{G}_{n,m,p}\rightarrow{\mathbb{R}}^{k}$ is a surjective map of constant rank $k$. Then, under the scenario described in Problem 2.1, the cloud cannot distinguish between $\Omega$ and any other system in the uncertainty set $\mathcal{U}=\Theta_{\Omega}(\rho^{-1}(l))$ of dimension:

[TABLE]

Proof.

By Theorem 4.2, Algorithm 1 renders isomorphic systems indistinguishable by the cloud. However, the cloud knows that we use an isomorphism $\psi\in\rho^{-1}(l)$ and, therefore, the uncertainty set is no longer the equivalence class under the entire group of isomorphisms $\mathcal{G}_{n,m,p}$, but the subset of this equivalence class $\mathcal{U}=\Theta_{\Omega}(\rho^{-1}(l))$.

By the property of the orbit map [20, p. 166], for each $\Omega$, the orbit map $\Theta_{\Omega}$ is smooth and has constant rank. Since $\Theta_{\Omega}$ is also injective, we have, by the Global Rank Theorem, that it is a smooth immersion [20, p. 83]. As it was shown in Lemma 5.1, the set $\rho^{-1}(l)$ is an embedded submanifold of $\mathcal{G}_{n,m,p}$ and, therefore, the inclusion map $i:\rho^{-1}(l)\rightarrow\mathcal{G}_{n,m,p}$ is a smooth embedding.

The map $\Theta_{\Omega}\circ i$ is a smooth immersion because it is a composition of smooth immersions. Since images of smooth immersions are smooth immersed submanifolds (by Proposition 5.18 from [20]), the uncertainty set $\mathcal{U}=\Theta_{\Omega}(\rho^{-1}(l))$ is a smooth immersed submanifold of $\bar{\mathcal{S}}_{n,m,p}$ diffeomorphic to $\rho^{-1}(l)$ and, hence, has the same dimension (refer to Lemma 5.1).

Using Lemma 3.7, the dimension of the uncertainty set is evaluated to be:

[TABLE]

∎

Remark: although Proposition 5.2 was proved under the assumption that $D$ has $n+1$ linearly independent constraints on the state, this assumption can be dropped if we assume the intersection of $\rho^{-1}(l)$ and the left cosets of $\mathcal{K}_{n,m,p}(\Omega)$ in $\mathcal{G}$ is well-behaved.

This result shows that the proposed scheme degrades gracefully with side knowledge — i.e., side knowledge allows the cloud to reduce the dimension of the uncertainty set only by the amount of side knowledge and not more. Moreover, this result can be generalized for other scenarios considered in Section 4.2.2 using similar proofs.

Corollary 5.3**.**

Assume $\Omega\in\bar{\mathcal{S}}_{n,m,p}$ is such that the constraint matrix $D$ has $n+1$ linearly independent constraints on the state. Suppose that Algorithm 1 is used and the cloud has the following side knowledge $l\in{\mathbb{R}}^{k}$ about the selected isomorphism $\psi$:

[TABLE]

where $\rho:\mathcal{G}_{n,m,p}\rightarrow{\mathbb{R}}^{k}$ is a surjective map of constant rank $k$. Then, under the scenario described in Problem 2.2, the cloud cannot distinguish between $\Omega$ and any other system in the uncertainty set $\mathcal{U}=\Theta_{\Omega}(\rho^{-1}(l))$ of dimension:

[TABLE]

Under the scenario described in Problem 2.3, the dimension of the uncertainty set is:

[TABLE]

6. Conclusion

In this paper, we proposed a transformation-based method to preserve privacy in control over the cloud. In addition to its low computational overhead, we have formally shown that this method precludes the adversary from inferring the private data by eavesdopping on the messages exchanged between the plant and the cloud. We quantified the guaranteed privacy via the dimension of the set that describes the uncertainty experienced by the adversary. The problem of computing the dimension of the stabilizer set $\mathcal{K}_{n,m,p}(\Omega)$ remains open, and its solution requires a detailed analysis of system-theoretic properties. The authors are currently investigating other measures of privacy that may lead to a deeper insight into the proposed method.