Source-linked AI summary
Encrypted control for networked systems -- An illustrative introduction and current challenges
M. Schulze Darup, A. B. Alexandru, D. E. Quevedo, G. J. Pappas
TL;DR
Cloud-based control offers resource pooling and scalability but processes sensitive data over public networks and third-party platforms. The paper discusses encrypted control techniques, including homomorphic encryption and multi-cloud MPC; these approaches involve trade-offs in performance, computation, and communication.
Problem
Encrypted linear controllers have limited utility for real-world applications, while cloud services are more useful for numerically demanding optimization-based control.
Source: §3 · p. 12Method
The paper discusses homomorphic-encryption controllers and encrypted model predictive control, including projected-gradient iterations using two non-colluding clouds.
Source: §1 · p. 6, §3 · p. 12, §3.3 · p. 16Results
Encrypted real-time iterations can perform well for MPC, while multiple encrypted solver iterations generally improve approximation accuracy but increase cloud computation and communication demands.
Source: §3.2 · p. 15, §3.3 · pp. 16–17Takeaways & Limitations
Encrypted MPC can place solver work in the clouds while the sensor and actuator handle only the necessary encryption and decryption.
Source: §3.3 · p. 16High additional computation and communication are the main bottlenecks, and more realistic lossy, latency-affected networks remain a research need.
Source: §6 · p. 23
Abstract
from arXiv · showhide
Cloud computing and distributed computing are becoming ubiquitous in many modern control systems such as smart grids, building automation, robot swarms or intelligent transportation systems. Compared to "isolated" control systems, the advantages of cloud-based and distributed control systems are, in particular, resource pooling and outsourcing, rapid scalability, and high performance. However, these capabilities do not come without risks. In fact, the involved communication and processing of sensitive data via public networks and on third-party platforms promote, among other cyberthreats, eavesdropping and manipulation of data. Encrypted control addresses this security gap and provides confidentiality of the processed data in the entire control loop. This paper presents a tutorial-style introduction to this young but emerging field in the framework of secure control for networked dynamical systems.
1 Basics on homomorphic encryption, secret sharing, and multi-party computation
The section introduces cryptographic tools for computing on protected data and distributing secrets across parties. It explains how homomorphic operations, secret sharing, and secure multi-party protocols support encrypted computation.
Homomorphic encryption
- Homomorphic encryption allows mathematical operations on encrypted data, with additive schemes supporting encrypted addition and some schemes also supporting multiplication.Fully homomorphic schemes support both, while the section notes their high computational demands and limited suitability for power- or memory-constrained devices.Source: §1 · p. 5
Secret sharing
- Secret sharing splits data into shares that individually reveal no information about the secret, which can be reconstructed when enough shares are combined.An (L,S)-threshold scheme uses S shares and requires at least L to reconstruct the secret; the two-share example requires both shares.Source: §1 · pp. 5–6
Secure multi-party computation
- Secure multi-party computation lets mutually distrustful parties jointly compute an agreed function on private data divided among them.The section illustrates oblivious transfer, where a party obtains one selected value without learning the other value or revealing its selection bit.Source: §1 · pp. 6–7
Paillier encryption
- Paillier encryption supports encrypted addition and multiplication of an encrypted value by a plaintext integer, enabling partially encrypted multiplication.The section also describes its integer message space and key setup.Source: §1 · p. 6
Implementation tools
- Encrypted-computation software includes libraries for partially and fully homomorphic encryption and tools for secure multi-party computation; specialized hardware can accelerate some computations.Fully homomorphic libraries offer broad capabilities but require expert users, and the paper notes FPGA implementations for encrypted control.Source: §1 · pp. 7–8
2 Encrypted linear control
The section compares encrypted implementations of linear control using ElGamal, Paillier, and secret sharing with two-party computation. Their privacy and efficiency depend on what is concealed and how computation is distributed.
2 Encrypted linear control
- Dynamic encrypted controllers are harder to implement than static linear feedback because their controller state must be iterated in encrypted form.The section also notes that encrypted linear control laws are typically applied to linear discrete-time systems.Source: §2 · p. 8
2.1 First implementation using ElGamal encryption
- Quantization maps real-valued states and parameters to finite integer messages, with resolution and message-space size requiring a design trade-off.Increasing quantization parameters can reduce error but increases the set's cardinality and thus affects computation cost.Source: §2.1 · p. 9
- ElGamal computes encrypted products of controller parameters and states, but its lack of additive homomorphism leaves row summation to the actuator.The resulting encrypted matrix requires mn ciphertexts to be transmitted and decrypted, while the control gain remains private.Source: §2.1 · pp. 8–10
2.2 Alternative implementation using Paillier encryption
- Concealing both control gains and states with ElGamal incurs more communication than concealing only states with Paillier, which can compute encrypted inputs in the cloud.Paillier avoids sending the intermediate matrix of mn ciphertexts for actuator-side decryption; the trade-off applies when encrypting the gains is not required.Source: §2.2 · p. 10
2.3 Efficient implementation using secret sharing
- A two-cloud secret-sharing implementation sends randomized state shares to non-colluding clouds, whose separate control outputs are recombined at the actuator.The fresh random manipulation makes each share uninformative about the state, subject to additional technicalities; the implementation uses public gains and avoids asymmetric encryption and encrypted operations.Source: §2.3 · p. 11, Figure 2 · p. 11
3 Encrypted model predictive control
MPC can make cloud-based control useful for numerically demanding optimization, but its per-step quadratic program can be costly to solve. The section presents encrypted MPC through offline precomputation, single real-time iterations, and multi-party computation.
3.1 First implementation using offline optimization
- Offline MPC exploits a piecewise-affine optimizer: precomputed regions and affine segments let the cloud evaluate control without online optimization.The sensor identifies the active region; this approach is applicable only for moderate m, N, and ϑ and requires high sensor computation.Source: §3.1 · pp. 13–14
3.2 Online optimization using real-time iterations
- Real-time encrypted MPC evaluates one solver iteration per time step, encrypting the affine update while leaving projection computationally demanding.For the presented projected-gradient scheme, convergence requires a suitable step size; efficient projection is available, for example, with box-shaped input constraints.Source: §3.2 · pp. 14–15
- Coupling solver iterations to sampling instances can perform well for consecutive, similar MPC problems; good performance and stability certificates are proven analytically [96, Sect. IV].The scheme is computationally viable, though the paper questions it from an optimal-control perspective.Source: §3.2 · p. 15
3.3 Online optimization using multi-party computation
- Two non-colluding clouds enable multiple encrypted projected-gradient iterations per time step, increasing cloud computation while generally improving approximation accuracy.The sensor and actuator handle only the necessary encryption and decryption; the scheme’s inter-cloud communication is substantial.Source: §3.3 · pp. 16–17
- Private comparison between the clouds supports encrypted box projection, with communication rounds of order l per solver iteration for l-bit values.The comparison protocol is identified as a major contributor to the substantial communication load.Source: §3.3 · pp. 16–17
4 Encrypted distributed control
Distributed control coordinates local subsystems through communication among agents, while sparse cooperative feedback can expose neighboring states. Encrypted cooperative control replaces those state exchanges with encrypted control shares, and aggregated shares can further complicate state reconstruction at a computational and communication cost.
4 Encrypted distributed control
- The distributed setting comprises locally sensed and actuated subsystems with physical couplings, communicating over an assumed undirected, connected, simple graph.Agents need not communicate with every other agent.Source: §4 · p. 17
4.1 Cooperative control using sparse feedback
- Sparse linear feedback makes each local control action depend on the agent’s own state and the states of its communicating neighbors, which can expose sensitive state information.The feedback matrices are zero for agents without a communication link.Source: §4.1 · p. 18
4.2 Encrypted cooperative control
- Encrypted cooperative control has each agent send encrypted control shares, computed from its local state, to a neighbor that decrypts them to calculate its local control action.The shares use the receiving agent’s public key.Source: §4.2 · pp. 18–19
- Encrypting each control share hides neighboring states from the receiving agent, while homomorphic encryption also prevents the sending agent from learning the neighboring controller’s strategy.The share-only modification could otherwise reveal controller parameters and shares to the sender.Source: §4.2 · p. 18
4.3 Improving security
- Aggregating neighboring control shares can make individual neighboring states significantly harder to reconstruct when the receiving agent has at least two neighbors.For dynamically independent subsystems, the relevant pair can be unobservable even when each individual pair is observable.Source: §4.3 · p. 20
- The aggregate-share approach requires fresh zero-sum random shares each time step, whose generation can be costly in computation and storage as network size grows.Decentralized generation requires two communication rounds for neighboring agents to agree on shares.Source: §4.3 · p. 20
5 Quantization effects, stability guarantees, and continuous operation
Encrypted implementations require quantization, which introduces errors that can be analyzed as disturbances in a robust-control framework. Suitable quantization usually preserves robust stability for an originally stabilizing law, but accumulated errors in dynamic encrypted controllers can complicate continuous operation.
5 Quantization effects, stability guarantees, and continuous operation
- Quantization is required to encode states and controller parameters for encryption or secret sharing, but its irreversible errors can destabilize an originally stable control loop.The paper treats quantization deviations as disturbances and analyzes the resulting closed-loop dynamics using robust-control techniques.Source: §5 · p. 21
- When the original linear control law is Schur stable and quantization disturbances are bounded, input-to-state stability and robust positively invariant sets can be analyzed.The disturbance bounds can be made arbitrarily small through quantization design for states within the specified restricted set.Source: §5 · p. 21
- Quantization is usually not the bottleneck: for an originally stabilizing control law, a suitable quantization generally preserves robust stability.More sophisticated quantized-control techniques are identified as a possible direction for future research.Source: §5 · p. 22
- In dynamic encrypted controllers, quantization errors and cryptosystem noise can accumulate and impede seamless operation over unbounded runtime.Periodic client-side refreshment can restore operation, but may be costly or inconvenient; other proposed approaches include bootstrapping and transformations that limit accumulated errors.Source: §5 · p. 22
6 Current challenges and future research directions
This section identifies computational and communication overhead as the main bottleneck for encrypted control and outlines technical and deployment priorities. It also flags current schemes’ simplified setups and online-only privacy guarantees.
6 Current challenges and future research directions
- Privacy increases computation and communication costs; Paillier ciphertexts are 4096 bits for a 2048-bit public key, and multi-party computation typically adds communicating parties.Source: §6 · p. 22
- Current controllers often use partial homomorphic encryption or simple multi-party computation, simplified setups, and unencrypted offline design with privacy only online.Source: §6 · pp. 22–23
- High additional computational effort and communication load are the main bottleneck for encrypted control.Source: §6 · p. 23
- Future work should encrypt more complex and nonlinear control schemes, including controller designs or parameters.Source: §6 · p. 23
- Reducing overhead through hardware acceleration and homomorphic-encryption compilers is a stated research direction.Source: §6 · p. 23
- Research should examine non-fixed-point quantization, investigate quantization errors, and provide robust stability certificates.Source: §6 · p. 23
- Future work should pair encrypted control with integrity and availability defenses and test it in smart grids or vehicular networks under loss and latency.Source: §6 · p. 23
- Safety remains challenging because most known techniques for safe control are highly nonlinear and require access to substantial process data.Source: §6 · p. 23