On a Security vs Privacy Trade-off in Interconnected Dynamical Systems

TL;DR

This paper explores the balance between security and privacy in interconnected dynamical systems, proposing a framework for attack detection that considers privacy constraints and reveals counter-intuitive benefits of increased privacy.

Contribution

It introduces a novel local attack detection scheme that does not require global knowledge and quantifies the security-privacy trade-off in interconnected systems.

Findings

More privacy can sometimes improve attack detection performance.

A new framework compares privacy mechanisms based on estimation error.

Numerical examples illustrate the security-privacy trade-off.

Abstract

We study a security problem for interconnected systems, where each subsystem aims to detect local attacks using local measurements and information exchanged with neighboring subsystems. The subsystems also wish to maintain the privacy of their states and, therefore, use privacy mechanisms that share limited or noisy information with other subsystems. We quantify the privacy level based on the estimation error of a subsystem's state and propose a novel framework to compare different mechanisms based on their privacy guarantees. We develop a local attack detection scheme without assuming the knowledge of the global dynamics, which uses local and shared information to detect attacks with provable guarantees. Additionally, we quantify a trade-off between security and privacy of the local subsystems. Interestingly, we show that, for some instances of the attack, the subsystems can achieve a better detection performance by being more private. We provide an explanation for this counter-intuitive behavior and illustrate our results through numerical examples.