Cyber-Secure Teleoperation With Encrypted Four-Channel Bilateral Control

TL;DR

This paper presents an encrypted four-channel bilateral control system for teleoperation that ensures secure communication, posture synchronization, and force feedback using homomorphic encryption, validated through experiments with robot arms.

Contribution

It introduces a novel encrypted bilateral control system employing homomorphic encryption for secure teleoperation, maintaining control performance while protecting data.

Findings

Secure encrypted communication and control parameters achieved

Posture synchronization and force feedback demonstrated

Control performance inherited from unencrypted system

Abstract

This study developed an encrypted four-channel bilateral control system that enables posture synchronization and force feedback for leader and follower robot arms. The encrypted bilateral control system communicates encrypted signals and operates with encrypted control parameters using homomorphic encryption. We created two-axis robot arms and identified them to obtain a nonlinear model consisting of a linear system and a nonlinear disturbance. Disturbance and reaction-force observers and a proportional-derivative controller were designed to construct a networked robot-manipulation system. The controllers in the constructed bilateral control system were securely implemented on dedicated computers using a controller encryption technique. The experimental results demonstrate that the developed bilateral control system can facilitate encrypted communication and controller, synchronize the posture, and feed the reaction force back. Through experimental validation, the encrypted four-channel bilateral control system enables the inheritance of control performance from the original (unencrypted) bilateral control system.

Tables

Table 1. TABLE I: Control system specifications.

Yaw axis motor	MITSUBISHI HK-KT-43W
Servo amplifier	MITSUBISHI MR-J5-40A
Rated power	$400W$
Rated torque	$1.3\mathrm{Nm}$
Rated Speed	$3000\mathrm{rpm}$
Rated Current	$2.6A$
Moment of inertia ${\overline{J}}_1$	$0.410\times {10}^{-4}$${\mathrm{kgm}}^2$
Torque coefficient ${\overline{K}}_{t1}$	$0.5\mathrm{Nm}/A$
Pulse per rotation	$\mathrm{131\hspace{0.17em}072}\mathrm{pulses}/\mathrm{rev}$
Pitch axis motor	MITSUBISHI HK-KT-7M3W
Servo amplifier	MITSUBISHI MR-J5-70A
Rated power	$750W$
Rated torque	$2.4\mathrm{Nm}$
Rated Speed	$3000\mathrm{rpm}$
Rated Current	$4.7A$
Moment of inertia ${\overline{J}}_2$	$1.37\times {10}^{-4}$${\mathrm{kgm}}^2$
Torque coefficient ${\overline{K}}_{t2}$	$0.5106\mathrm{Nm}/A$
Pulse per rotation	$\mathrm{131\hspace{0.17em}072}\mathrm{pulses}/\mathrm{rev}$
PC
CPU	Intel Core i7-10700K ($5.1\mathrm{GHz}$)
Memory	$16\mathrm{GB}$
OS	CentOS 8.3
D/A Board	Interface PEX-340216 ($16\mathrm{bit}$)
Counterboard	Interface PEX-632104 ($32\mathrm{bit}$)

Table 2. TABLE II: Parameters of the encrypted four-channel bilateral control.

Yaw axis motor		Pitch axis motor
Plant model
$\overline{J}$	$1.37\times {10}^{-4}$${\mathrm{kgm}}^2$	$\overline{J}$	$4.1\times {10}^{-5}$${\mathrm{kgm}}^2$
$K$	$0.5\mathrm{Nm}/A$	$K$	$0.5106\mathrm{Nm}/A$
Controller parameters
$K_p$	300	$K_p$	120
$K_d$	300	$K_d$	80
$K_f$	1	$K_f$	1
$g_p$	$200\mathrm{rad}/s$	$g_p$	$200\mathrm{rad}/s$
$g_d$	$100\mathrm{rad}/s$	$g_d$	$100\mathrm{rad}/s$
$g_r$	$100\mathrm{rad}/s$	$g_r$	$100\mathrm{rad}/s$
$T_s$	$20\mathrm{ms}$	$T_s$	$20\mathrm{ms}$
Nonlinear terms model
$a_c$	0.0009979	$a_g$	0.4696
$b_c$	0.03152	$b_g$	0.01893
$a_{fy}$	0.05736	$c_g$	1.575
$b_{fy}$	12.98	$a_{fp}$	0.009764
$c_{fy}$	1.275	$b_{fp}$	-1197
$d_{fy}$	0.7802	$c_{fp}$	0
		$d_{fp}$	0.05194
		$e_{fp}$	0.003254
Encryption parameters
$\lambda$	$128\mathrm{bit}$	$\lambda$	$128\mathrm{bit}$
${\gamma }_c$	${10}^{16}$	${\gamma }_c$	${10}^{16}$
${\gamma }_p$	${10}^{16}$	${\gamma }_p$	${10}^{16}$

Equations

$${\bar{J}}_j{\ddot{\theta }}_j(t)={\bar{K}}_j{i}_j(t)-{\tau }_j^d(t),\forall j\in \{1,2\},$$

$${\tau }^d(t):=(J-\bar{J})\ddot{\theta }(t)+(\bar{K}-K)i(t)+f(\theta ,\omega )+{\tau }^e(t),$$

$$\dot{x}(t)$$

$$A$$

$$\mathrm{rank}\left[\begin{array}{c}C\\ CA\end{array}\right]$$

$$T$$

$$Tx$$

$$TA{T}^{-1}$$

$$TB$$

$$C{T}^{-1}$$

$${\dot{\tau }}^d(t)=A_{22}{\tau }^d(t)+A_{21}\omega (t)+B_{2}i(t),$$

$$\dot{\omega }(t)-A_{11}\omega (t)-B_{1}i=A_{12}{\tau }^d(t).$$

$${\dot{\hat{\tau }}}^d(t)$$

$$+L(\dot{\omega }(t)-A_{11}\omega (t)-B_{1}i(t)-A_{12}{\hat{\tau }}^d(t)),$$

$$\dot{q}(t)$$

$$+L(\dot{\omega }(t)-A_{11}\omega (t)$$

$$-B_{1}i(t)-A_{12}(q(t)+L\omega (t)))-L\dot{\omega }(t)$$

$$=(A_{22}-L{A}_{12})q(t)+(B_2-L{B}_1)i(t)$$

$$+(A_{21}-L{A}_{11}+L{A}_{22}-L^2{A}_{12})\omega (t)$$

$$=-g_{d}q(t)+\bar{K}{g}_{d}i(t)+\bar{J}{g}_d^2\omega (t)$$

$$\left[\begin{array}{c}\omega (t)\\ {\hat{\tau }}^d(t)\end{array}\right]$$

$$=\left[\begin{array}{c}\omega (t)\\ q(t)-\bar{J}{g}_d\omega (t)\end{array}\right]$$

$$\dot{q}(t)$$

$${\hat{\tau }}^d(t)$$

$${\tau }^e(t)$$

$$\dot{z}(t)$$

$${\hat{\tau }}^e(t)$$

$$f({\theta }_1,{\omega }_1)$$

$$f({\theta }_2,{\omega }_2)$$

$$+d_{f2}{\omega }_2+e_{f2}.$$

$${\theta }_l-{\theta }_f$$

$${\tau }_l^e+{\tau }_f^e$$

$$e_{k+1}$$

$${\dot{e}}_{k+1}$$

$${\ddot{\theta }}_k^{ref}$$

$$+\left(K_p+\frac{2K_d{g}_p}{2+g_p{T}_s}\right)({\theta }_{fk}-{\theta }_{lk})$$

$$q_{k+1}$$

$${\hat{\tau }}_k^d$$

$$z_{k+1}$$

$${\hat{\tau }}_k^e$$

$${\tau }_k^{ref}$$

Full text

I Introduction

BILATERAL control is an important technology for the handling of hazardous materials [1], space and deep-sea exploration [2, 3, 4], and telesurgery [5, 6]. The bilateral control system consists of a human-operated leader and a follower that follows the leader’s posture to present the remote environment of the follower to the leader. Various architectures have been proposed to realize bilateral control, such as [7] and its references. Well-known architectures include the position-position [8, 9], force-position [10, 9, 11], and four-channel [12, 13, 14, 15, 16, 17, 18] controllers. The position-position controller aims to synchronize the positions of the leader and follower, the force-position controller presents the reaction force of the follower to the leader, and the four-channel controller communicates both positions and forces for the leader and follower. Recent developments in communication technology have enabled teleoperation over the Internet, and subsequently, the problems of communication delays, packet losses, and cybersecurity must be overcome. Numerous studies on communication delays and packet loss in teleoperation have been conducted [4, 19, 20, 7, 21, 22, 23], whereas cybersecurity issues have recently emerged because of increased cyber-attacks against industrial control systems, such as Stuxnet and Industroyer [24, 25].

As the threat of cyber-attacks increases, preparing and enhancing the cyber security of bilateral control systems is essential. Several studies have been conducted on the modeling and classification of cyber-attack methods, such as denial-of-service (DoS) attacks and packet drop attacks on force-position-type bilateral control systems [26], specific cyber-attacks on surgical robots and remote rescue robots [27, 28], and false data injection attacks on practical force-position-type bilateral control systems [29, 26]. Moreover, several studies have been conducted on cyber-attack countermeasures for bilateral control systems, which are broadly classified into proactive and reactive countermeasures. Proactive countermeasures include secure communication protocols, such as a protocol that considers both security and quality of service [30], an adaptive information coding scheme to support confidentiality and adaptive reliability simultaneously [31], and an adaptive controller to achieve globally asymptotic stability of the force-position-type bilateral control systems under DoS attacks [32]. For the reactive countermeasures, the authors of [29] proposed a physics-based attack detection scheme with an encoding–decoding structure for general false data injection attacks on force-position-type bilateral control. Another promising technology that achieves both proactive and reactive countermeasures is the integration of cryptography into control systems, called encrypted control [33, 34, 35, 36, 37]. Encrypted control enables the concealment of communication data and control parameters, and makes it easier to detect falsification and injection attacks. For example, [38] applied encrypted control to an experimental pneumatically actuated force-position-type bilateral control system. The authors of [39] demonstrated the feasibility of encrypting the entire motion-control scheme of a teleoperated system in a simulation.

However, although all these studies are for position-position or force-position-type bilateral control, they are inappropriate for four-channel bilateral control. The four-channel type achieves transparency, that is, the presentation of a sense of the remote environment to the user [12, 13] and can scale the position and force between the leader and follower [40]. It is essential to develop a four-channel bilateral control system that considers cybersecurity.

The purpose of this study is to develop an encrypted four-channel bilateral control system that enables synchronization of position and force feedback using robot arms. The bilateral control system developed in this study, shown in Fig. 1, configures the leader and follower two-axis robot arms, shown in Fig. 2, and the operator manipulates the leader robot arm. The robotic arms were controlled using a computer. The bilateral control system was constructed to achieve the following three objectives:

1. the posture of the leader and follower are synchronized,
2. the reaction force on the follower is fed back to the leader, and 3) the signals on the communication links and parameters inside the controllers are encrypted with a partially (multiplicative) homomorphic encryption. To realize the encrypted four-channel bilateral control system, shown in Fig. 1, the unencrypted four-channel bilateral control system proposed in [14] was constructed using dedicated two-axis robot arms. The model and parameters of the robot arms were identified and applied to a model-based bilateral control system design. A reaction-force observer was used to estimate the reaction force without a force sensor. Next, the leader and follower controllers of the four-channel bilateral control system were described in state-space representation and securely implemented using the controller encryption techniques proposed in [33, 41]. The resulting control system is the first application of four-channel bilateral control in the encrypted control fashion. Moreover, we verified the three requirements of the encrypted bilateral control system by conducting two experiments, namely motion tracking for posture synchronization and force feedback when the follower contacts obstacles such as a sponge and an aluminum prism for an operator to feel the difference in hardness. Moreover, the effects of encryption on the computation time and quantization error were investigated to confirm that the computation time was within the sampling period and the quantization error was negligibly small. Through experimental verification, this study confirmed that an encrypted four-channel bilateral control system can be developed.

The contributions of this study are as follows:

We developed an encrypted four-channel bilateral control system with two-axis robot arms by conducting a secure implementation of the leader and follower controllers. The controller encryption technique enables the communications and controller parameters to be kept hidden, which helps establish a cybersecurity-enhanced bilateral control system. 2. 2.

The developed bilateral control system was experimentally verified to maintain the tracking and force feedback performance before and after encryption. The secure implementation enables us to inherit the control performance from that of the original (unencrypted) bilateral control system.

The remainder of this paper is organized as follows. Section II describes the model of the robot arm, configuration of the networked robot manipulation system, and problem setting of this study. Section III introduces the state-space representation of a four-channel bilateral control system. Section IV presents the encryption of the four-channel bilateral controllers. Section V demonstrates that the developed bilateral control system can be used to conduct the robot teleoperation. Section VI summarizes the study and describes future works.

II robot arm and its model

This section describes the teleoperation system and robot arm model developed in this study. Section II-A describes the configuration and specifications of the teleoperation system, and Section II-B presents a mathematical model of the robot arm and its disturbance.

II-A *Networked robot arms *

In this study, we developed a teleoperation system using two robotic arms, the leader and follower arms, as shown in Fig. 1. A human operator operates the leader. The leader and follower were each connected to a computer. The leader and follower computers were connected via a wired LAN and communicated via UDP/IP socket communication.

The specifications for the robots and computers are listed in TABLE I. In this study, we used the robotic arm shown in Fig. 2. The robot arm is driven by two AC servo motors, a yaw axis motor, and a pitch axis motor, and the input and output of each motor are the current and angle, respectively. The control input calculated by the computer was transmitted to the motor of the robot arm through the D/A board and servo amplifier. The angle of each motor was read by the rotary encoder attached to the motor and transmitted to the computer via a servo amplifier and counter board. CentOS 8.3, compatible with RedHat Enterprise Linux (RHEL), was used as the operating system of the computer. In addition, the Advanced Robot Control System V6 (ARCS6) [42] was used as the framework for real-time computation.

II-B *Modeling *

The yaw and pitch axes of the robot arm were orthogonal; thus, the equations of motion for each motor can be independently established. The equations of motion for each motor are as follows:

[TABLE]

where the subscript $j\in\{1,2\}$ denotes the yaw and pitch motors, respectively, $i_{j}\in\mathbb{R}$ is the current input to the motor, $\theta_{j}\in\mathbb{R}$ is the angle measurable by the encoder, and $\tau_{j}^{d}\in\mathbb{R}$ is the unknown disturbance torque. $\bar{J}_{j}$ and $\bar{K}_{j}$ are the nominal values of the moment of inertia and torque coefficient, respectively, and their values are listed in TABLE I, which are obtained from the specifications. Hereafter, subscript $j$ is omitted for simplicity.

In this study, the torque was assumed to consist of the following components: modeling error, cable tension, gravity, friction, and an external force, that is,

[TABLE]

where $J$ is the moment of inertia; $K$ is the torque coefficient of the motor; $f$ is a nonlinear function of the angle $\theta$ and velocity $w=\dot{\theta}$ that involves the cable tension, gravity, and friction forces, which need to be identified in the experiment; and $\tau^{e}$ is the external force, which is estimated by the reaction force observer [43].

III four-channel bilateral control system

In this section, we derive the state-space representation of the four-channel bilateral control system shown in Fig. 3. The gray dotted line at the center of the figure indicates the network between the leader and follower. In the network, four signals are transmitted and received: the rotation angle $\theta_{l}$ and the estimated reaction force $\hat{\tau}^{e}_{l}$ of the leader, and the rotation angle $\theta_{f}$ and the estimated reaction force $\hat{\tau}^{e}_{f}$ of the follower.

We derived the disturbance observer (DOB) to estimate the disturbance applied to the robot in Section III-A and the reaction force estimation observer to estimate the contact force with the environment in Section III-B. Using the DOB, we estimated a model of the nonlinear terms $f(\theta,\omega)$ in Section III-C and combine them to derive a state-space representation of the controller of the system in Fig. 3.

III-A *Disturbance observer (DOB) *

The DOB [44] compensates for disturbances in the robot arm by estimating and feeding back the disturbance from the input current and velocity. The DOB cancels the modeling error of each motor, allowing each motor to be nominalized. Assuming that the disturbance torque is constant, the motor (1) is given as follows:

[TABLE]

[TABLE]

The rank of the observability matrix of the system, represented by (3), is

[TABLE]

Thus, the system was observable.

In this section, we use the method developed by Gopinath [45] to construct a DOB for the system (3). If $D\coloneqq\begin{bmatrix}0&1\end{bmatrix}$, the transformation matrix $T$ is given as:

[TABLE]

Hence, the state variables and parameters in (3) can be converted into

[TABLE]

Using these matrices, we obtain

[TABLE]

The observer of the systems (11a) and (11b) is as follows:

[TABLE]

where $L$ denotes the observer gain. If $q(t)\coloneqq\hat{\tau}^{d}(t)-L\omega(t)$ and $L=-\bar{J}g_{d}$, then

[TABLE]

are obtained. Thus, the DOB of the system (3) is given as follows:

[TABLE]

The DOB block of the leader and follower controllers shown in Fig. 3 contains the state-space representation of the disturbance observer in (22b). The DOB block has a state variable $q$, inputs current $i$ and angular velocity $\omega$ and outputs a disturbance estimate $\hat{\tau}^{d}$. In this study, the cut-off frequency of the DOB $g_{d}$ was set to $100\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$.

III-B Reaction force observer

The reaction force observer (RFOB) estimates the external force applied to the control target from the input current, velocity, and models of the frictional force and gravity. Assume that the disturbance on the plant is expressed using (2) and is estimated by the DOB. In this case, the external force applied to the motor is

[TABLE]

Assuming that the difference between the nominal and true values of the moment of inertia and torque coefficient is negligibly small, the following equation holds:

[TABLE]

From the literature [43] and Equations (22a) and (24), the RFOB is given as follows:

[TABLE]

The RFOB block of the leader and follower controllers shown in Fig. 3 contains the state-space representation of the RFOB in  (26). The RFOB block has a state variable $z$, inputs the current $i$, angular velocity $\omega$, and nonlinear term $f(\theta,\omega)$, and outputs an estimate of the reaction force $\hat{\tau}^{e}$. In this study, the cut-off frequency of the RFOB $g_{r}$ was set to $100\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$.

III-C Estimation of nonlinear terms

To determine the external forces applied to the robot arm, nonlinear terms $f(\theta,\omega)$ such as cable tension, gravity, and frictional force, must be determined. First, a static test was performed to estimate the tensile and gravitational forces acting on the cable. In this test, each motor was made to stand still at certain angles and the disturbance torque was recorded. The sampling period was $5\text{\,}\mathrm{m}\mathrm{s}$, yaw axis was moved from $-120\text{\,}\mathrm{d}\mathrm{e}\mathrm{g}$ to $120\text{\,}\mathrm{d}\mathrm{e}\mathrm{g}$, and pitch axis was moved from $10\text{\,}\mathrm{d}\mathrm{e}\mathrm{g}$ to $80\text{\,}\mathrm{d}\mathrm{e}\mathrm{g}$ by $10\text{\,}\mathrm{d}\mathrm{e}\mathrm{g}$. The disturbance torque was recorded at each angle by stopping $10\text{\,}\mathrm{s}$.

Subsequently, a constant-velocity test was conducted to estimate the frictional force. In this test, each motor was moved at a constant angular velocity and the disturbance torque was recorded. The sampling period was $5\text{\,}\mathrm{m}\mathrm{s}$ and the angular velocity was set from $0.05\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$ to $0.5\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$ by $0.05\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$ and from $0.5\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$ to $1.0\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$ by $0.1\text{\,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$. Ten experiments were conducted for each axis and angular velocity.

Figs. 4 shows the results of the static and constant-velocity tests using the model obtained in the static test. The black and red lines represent the mean and standard deviation of the estimated disturbance torque, and its approximate curve, respectively.

From the results of the static and constant-velocity tests, the cable tension, gravity, and friction forces on the yaw and pitch axises are expressed as follows:

[TABLE]

The coefficient values obtained in the test are listed in TABLE II.

III-D Unencrypted four-channel bilateral control system

This section derives the state-space representation of the four-channel bilateral control with a DOB and RFOB. Fig. 5 shows a conceptual diagram of four-channel bilateral control. Note that the subscripts $l$, $f$, and $e$ denote the leader, follower, and environment, respectively. The control object for four-channel bilateral control is denoted as follows:

[TABLE]

where $\tau^{e}_{l}$ is the torque applied by the human operator to the leader and $\tau^{e}_{f}$ is the torque applied by the environment to the follower. When the control objects (30a) and (30b) are satisfied, the leader and follower behave as if they are connected by a rigid rod, as shown in the right-hand figure of Fig. 5.

In this study, PD control was used for position control, and P control was used for force control. The discrete-time position controller of the leader is

[TABLE]

where $e$ and $\dot{e}$ are the state variables, $K_{p}$ and $K_{d}$ are the P and D gains, respectively, and $g_{p}$ is the cut-off frequency of the low-pass filter of the position controller.

The discrete-time DOB and RFOB are given by bi-linear transformations (22a) and (24).

[TABLE]

In addition, the leader force controller is

[TABLE]

where $K_{f}$ denotes the P gain of the force controller. Hence, control input $i$ of the leader is

[TABLE]

Based on the above, the state-space representation of the leader controller is given as follows:

[TABLE]

[TABLE]

The state-space representation of the follower controller is the replacement of $\theta_{l},~{}\theta_{f}$ and $\hat{\tau}^{e}_{l},~{}\hat{\tau}^{e}_{f}$ in the state-space representation of the leader controller.

[TABLE]

[TABLE]

which correspond to the red and blue dotted lines in Fig. 3, respectively.

IV Encrypted four-channel bilateral control system

This section discusses the encryption of the leader and follower controllers of the four-channel bilateral control system shown in Fig. 3 by using the ElGamal encryption[46]. Section IV-A introduces encrypted control using the ElGamal encryption, and Section IV-B describes the secure implementation of controllers to obtain an encrypted four-channel bilateral control system.

IV-A Preliminary for encrypted control

The ElGamal encryption $\mathcal{E}=(\mathsf{Gen},\mathsf{Enc},\mathsf{Dec})$ consists of three algorithms: key generation $\mathsf{Gen}$, encryption $\mathsf{Enc}$, and decryption $\mathsf{Dec}$ [46]. $\mathsf{Gen}$ generates a public key $k_{p}$ and private key $k_{s}$ on input with a key length of ${\lambda}\$\mathrm{b}\mathrm{i}\mathrm{t}$$: $\mathsf{Gen}(1^{\lambda})=(k_{p},k_{s}).$ $\mathsf{Enc}$ encrypts the plaintext $m$ using public key $k_{p}$: $\mathsf{Enc}(k_{p},m)=c$, where $c$ is the ciphertext. $\mathsf{Dec}$ decrypts the ciphertext $c$ using the public key $k_{p}$ and the secret key $k_{s}$: $\mathsf{Dec}(k_{s},c)=m^{\prime}$. Note that $\mathsf{Dec}(k_{s},\mathsf{Enc}(k_{p},m))=m$ holds. ElGamal encryption is a multiplicative homomorphic encryption scheme that allows ciphertext multiplication. Let $c_{1}=\mathsf{Enc}(k_{p},m_{1})$, $c_{2}=\mathsf{Enc}(k_{p},m_{2})$. The ciphertext of product $m_{1}$ $m_{2}$ is $\mathsf{Enc}(k_{p},m_{1}m_{2})=c_{1}\times_{e}c_{2}$, where $\times_{e}$ denotes the element-wise product. This property is called multiplicative homomorphism.

Because the ElGamal encryption can encrypt only the member in plaintext space $\mathcal{M}$, a conversion from real numbers to plaintext space $\mathbb{R}\rightarrow\mathcal{M}$ is necessary. The conversion $\mathbb{R}\rightarrow\mathcal{M}$ from real numbers to plaintext space is as follows:

[TABLE]

Note that $\gamma$ is the appropriate scaling parameter and $\lceil\cdot\rfloor$ is the rounding to the nearest member in the plaintext space $\mathcal{M}$. This transformation results in a quantization error.

IV-B Secure implementation of controllers

This section describes an encrypted four-channel bilateral control system that uses a controller encryption technique [33]. Fig. 6(a) shows an entire block diagram of the unencrypted four-channel bilateral control system, where the leader and follower controllers are described in red and blue blocks, respectively.

The procedure for implementing the encrypted leader and follower controllers is as follows. First, the leader and follower controllers (45) and (55) are transformed as follows:

[TABLE]

where $f_{l}$ and $f_{f}$ are the leader and follower controllers, respectively, and $\Phi_{l}$ and $\Phi_{f}$ are the controller parameters of the leader and follower, respectively. Let $f_{l}=f_{l}^{+}\circ f_{l}^{\times}$, where $f_{l}^{+}$ and $f_{l}^{\times}$ denote addition and multiplication on the leader, respectively, and similarly, $f_{f}=f_{f}^{+}\circ f_{f}^{\times}$ is defined on the follower. If the quantization error is negligibly small, the leader and follower encrypted controllers $f^{\times}_{l\mathcal{E}^{+}}$ and $f^{\times}_{f\mathcal{E}^{+}}$ are represented as follows:

[TABLE]

where $\Psi_{lk}\coloneqq f_{l}^{\times}(\Phi_{l},\xi_{lk})$ and $\Psi_{fk}\coloneqq f_{l}^{\times}(\Phi_{f},\xi_{fk})$, which are computed using the multiplicative homomorphism. The bar indicates quantization. Define $\mathsf{Dec}^{+}\coloneqq f^{+}\circ\mathsf{Dec}$. Then, $\bar{\psi}_{lk}$ and $\bar{\psi}_{fk}$ are obtained as follows:

[TABLE]

Let $\mathcal{E}^{+}\coloneqq(\mathsf{Gen},\mathsf{Enc},\mathsf{Dec}^{+})$ be a modified ElGamal encryption scheme.

Next, to realize $f^{\times}_{l\mathcal{E}^{+}}$, we provide the details of the encrypted leader controller (65a) and highlight it on the leader side in Fig. 6(b). The arguments of $f^{\times}_{l\mathcal{E}^{+}}$ are realized as follows:

1. $\mathsf{Enc}(\bar{\Phi}_{l})$: Quantized and encrypted parameters of the leader controller.
2. $\mathsf{Enc}(\bar{\xi}_{lk})$: Quantized and encrypted leader controller inputs $\xi_{l}$. From the definition of $\xi_{l}$ in (62), it contains the controller state variable $x_{l}$ and the plant output $v_{l}$. $v_{l}$ must be encrypted because $x_{l}$ is kept in the ciphertext of the controller. The definition of $v_{l}$ in the leader controller (45) contains signals $\theta_{f}$, $\theta_{l}$, $\omega$, $\hat{\tau}^{e}_{f}$, $\hat{\tau}^{e}_{l}$, and $f(\theta,\omega)$. Because the ciphertexts of $\theta_{f}$ and $\hat{\tau}^{e}_{f}$ are sent from the follower, the other signals, i.e., $\theta_{l}$, $\omega$, $\hat{\tau}^{e}_{l}$, and $f(\theta,\,\omega)$, must be encrypted before inputting them to the leader controller. Moreover, (65a) returns $\mathsf{Enc}(\bar{\Psi}_{lk})$, which includes the ciphertexts of the estimated reaction force $\hat{\tau}^{e}_{l}$ and input current $i$. $\mathsf{Enc}(\Psi_{l})_{7}$ and $\mathsf{Enc}(\Psi_{l})_{5}$ correspond to $\hat{\tau}^{e}_{l}$ and $i$, respectively, where $\mathsf{Enc}(\Psi_{l})_{j}$ denotes the $j$th element of the control input ciphertext $\mathsf{Enc}(\Psi_{l})$. $\mathsf{Enc}(\Psi_{l})_{7}$ is sent to the follower controller with $\mathsf{Enc}(\theta_{l})$, and $\mathsf{Enc}(\Psi_{l})_{5}$ is sent to $\mathsf{Dec}^{+}$ to obtain the input current $i$. At the leader side of the block diagram in Fig. 6(b), the inputs and outputs of (65a) correspond to those of the “Leader controller” block. Similarly, $f^{\times}_{f\mathcal{E}^{+}}$ of (65b) can be realized via clarifying its arguments and output, which correspond to those of “Follower controller” in Fig. 6(b), respectively.

The features in Fig. 6(b) are as follows. Encrypted communication lines and blocks are shown in green. The leader and follower controller parameters, $\Phi_{l}$ and $\Phi_{f}$, respectively, are both encrypted. Communication signals over the network, i.e., the leader rotation angle $\mathsf{Enc}(\theta_{l})$, estimated reaction force $\mathsf{Enc}(\Psi_{l})_{7}$, follower rotation angle $\mathsf{Enc}(\theta_{f})$, and estimated reaction force $\mathsf{Enc}(\Psi_{f})_{7}$, are all encrypted. Thus, the leader and follower controllers, shown in Fig. 6a, were implemented securely to realize an encrypted four-channel bilateral control system.

In the next section, teleoperation experiments are presented to validate the proposed encrypted four-channel bilateral control system.

V Demonstration of Encrypted four-channel Bilateral Control System

This section demonstrates the developed bilateral control system with the leader and follower robot arms and its cyber-secure motion-tracking teleoperation with force feedback. After the experimental settings are introduced in Section V-A, the three features of motion-tracking teleoperation, force feedback, and effects of the encryption, are examined in Sections V-B, V-C, and V-D, respectively.

V-A Experimental setting

Fig. 7 shows the setup used for the demonstration. First, motion-tracking teleoperation experiments were conducted to confirm that the follower followed the posture of the leader. Next, to confirm that the reaction force on the follower side returns to the leader side, an experiment was conducted in which the follower was placed in contact with an object. In both experiments, the sampling period was $20\text{\,}\mathrm{m}\mathrm{s}$ and the cut-off frequency of the pseudo-differentiator was $g_{p}=$200\text{,}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{/}\mathrm{s}$$. TABLE II lists the controller parameters and the plant models for each motor.

For reference, the results of the teleoperation experiment of the four-channel bilateral control system (45) using the parameters listed in TABLE II are shown in Figs. 8. Figs. 8(a) and (b) show the time responses of the rotation angles of the yaw and pitch axis motors of each of the arm, respectively. Figs. 8(c) and (d) show the difference between the leader and follower rotation angles during teleoperation. The figures show the achievement of errors within $\pm$3.0\text{,}\mathrm{d}\mathrm{e}\mathrm{g} for the yaw axis and $\pm$4.0\text{\,}\mathrm{d}\mathrm{e}\mathrm{g} for the pitch axis, confirming that the follower arm follows the behaviors of the leader arm manipulated by the operator. The time responses of the estimated reaction torque for each motor are shown in Figs. 8(e) and (f), where the red and blue lines represent the leader and follower arms, respectively, and $\hat{\tau}^{e}_{f}$ is within $\pm$0.2\text{,}\mathrm{N}\mathrm{m}$$. Therefore, the experimental results confirm that the conventional four-channel bilateral control system achieves motion-tracking teleoperation.

V-B Motion tracking teleoperation

This section shows that the angles of each motor of the leader and follower match during teleoperation when an operator operates the leader arm, such that no contact occurs between the follower arm and the environment. The resulting motion of the robotic arm is shown in Fig. 9.

Figs. 9(a) and (b) show the time responses of the rotation angles regarding the yaw and pitch axis motors of each arm, respectively. Figs. 9(c) and (d) show the difference between the leader and follower rotation angles during teleoperation. The figures show the achievement of errors within $\pm$1.0\text{,}\mathrm{d}\mathrm{e}\mathrm{g} for the yaw axis and $\pm$2.0\text{\,}\mathrm{d}\mathrm{e}\mathrm{g} for the pitch axis, confirming that the follower arm follows the behaviors of the leader arm manipulated by the operator. The time responses of the estimated reaction torque for each motor are shown in Figs. 9(e) and (f), where the red and blue lines represent the leader and follower arms, respectively, and $\hat{\tau}^{e}_{f}$ is within $\pm$0.2\text{,}\mathrm{N}\mathrm{m}$$. This range is relatively small compared to the case of contact with the environment, which is discussed in V-C. Therefore, the experimental results confirm that the developed control system achieves motion-tracking teleoperation.

V-C Effects of the force feedback

This section demonstrates that the reaction force applied to the follower returns to the leader when the follower contacts the environment. The types of environments prepared in this experiment were hard (aluminum block) and soft (sponge). Figs. 10(a) and 11(a) show the robot arm in contact with aluminum and sponge, respectively. Figs. 10(b) and 11(b) show the time responses of the rotation angles of the yaw axis motor. Figs. 10(c) and 11(c) show the time responses of the estimated reaction torque for the yaw axis motor. In these figures, the red and blue lines represent the leader and follower arms, respectively and the black dotted line represents the starting point of contact with the environment.

Figs. 10(b) and 11(b) confirm that the angle of the follower matches that of the leader. In addition, Figs. 10(c) and 11(c) confirm that the reaction force applied to the follower returns to that of the leader. The reaction forces on the leader and follower are opposite in sign and equal in absolute terms. This is evident from the control strategy of the four-channel bilateral control (30b), which means that the sum of the reaction forces applied to the leader and follower is zero. Moreover, it confirms that in encrypted four-channel bilateral control, differences in the hardness of objects in contact with the follower are transmitted to the leader. Figs. 10(b) and (c) show that the angles of the leader and follower do not change significantly from the point of contact with aluminum, even when a human applies force to the leader. The applied force did not deform the rigid object significantly. This indicates that the hardness of aluminum, which the follower is in contact with, is transmitted to the leader. Figs. 11(b) and (c) show that when a human applies a force to the leader, the angle between the leader and follower sinks at most $5\text{\,}\mathrm{d}\mathrm{e}\mathrm{g}$ from the point of contact with the sponge. Soft objects deform when force is applied. This indicates that the softness of the sponge, which the follower is in contact with, is transmitted to the leader. Therefore, the experimental results confirm that the developed bilateral control system transmits the reaction force on the follower side back to the leader and the difference in the hardness of the environment in which the follower is in contact.

V-D Effects of the controller encryption

This section examines the effects of controller encryption on the real-time property and quantization error compared with unencrypted four-channel bilateral controls. The resulting computation times and quantization errors are shown in Figs. 12 and 13, respectively.

Figs. 12(a) and (b) show the computation times of the leader and follower when the remote control is performed with and without encryption, where the red and blue lines represent the leader and follower arms, respectively. Comparing Figs. 12 (a) and (b), it is confirmed that the computation time in the encrypted case is on average $1.9\text{\,}\mathrm{m}\mathrm{s}$ longer than that in the unencrypted case, while it is shorter than the sampling period $20\text{\,}\mathrm{m}\mathrm{s}$, which implies that the developed control system ensures real-time properties.

Quantization errors are computed with respect to the control input for each motor of the leader and follower. The quantization error, denoted as $\delta$, is defined as the difference between the output of the unencrypted controller $i$ and the output of the encrypted controller $\tilde{i}$ for the common input variables $\xi$ to the controller, that is,

[TABLE]

The quantization errors for each motor are presented in Fig. 13, where the red and blue lines represent the leader and follower arms, respectively. Figs. 13(a) and (b) show the quantization error of the input current on the yaw and pitch axes, respectively. The figures show that the errors are on the order of $1\text{\times}{10}^{-14}\text{\,}\mathrm{A}$ for both the yaw and pitch axes. The resolution of the DA board is $16\text{\,}\mathrm{b}\mathrm{i}\mathrm{t}$ and the full-scale voltage is $10\text{\,}\mathrm{V}$, as shown in TABLE I. In this case, the resolution of the voltage is ${10}/{2^{16}}\approx 1.53\times 10^{-4}\,$\mathrm{V}, the output voltage of the DA board per current $1\text{\,}\mathrm{A}$ is $8/9\$V, and the current resolution is $1.53\times 10^{-4}\times 8/9=1.36\times 10^{-4}\,$\mathrm{A}. Because $\delta$ is $10^{-10}$ smaller than the resolution of the DA board, the quantization error is negligible. Thus, the real-time property is guaranteed by controller encryption, and the effect of quantization errors on the control input current is negligible.

VI Conclusion

In this study, an encrypted four-channel bilateral control system with two-axis robotic arms was developed. A model-based four-channel bilateral control system was designed using the model parameters of the two-axis robot arm and disturbance and reaction force observers. The model parameters were identified through static and constant-speed tests. The leader and follower controllers in the bilateral control system were represented in a state-space representation, and secure implementation of the controllers was performed using a multiplicative homomorphic encryption scheme. The advantage of the developed control system is that it can operate using encrypted communication data and control parameters. Moreover, we experimentally evaluated the developed control system in terms of posture synchronization and force feedback. Motion-tracking experiments confirmed that the postures of the leader and the follower were synchronized. Obstacle contact experiments confirmed a difference in hardness between aluminum prism and sponge. We also confirmed that the quantization error was negligibly small and that the developed bilateral control system ran in real-time. Through experimental verification, the encrypted four-channel bilateral control system enables inheriting control performance from the original (unencrypted) bilateral control system.

In the future, we will develop a bilateral control system using dynamic key encryption [47] to further enhance cybersecurity. This development expects us to protect the bilateral control system from cyber-attacks aimed at destabilizing and compromising a plant. We will conduct a secure implementation of different bilateral control methods considering time-varying delays and losses over communication links [48] to expand the applied situations. Moreover, we will work on the implementation of the developed control system for industrial robotic control systems to investigate its practicability.