On the (non-)resilience of encrypted controllers to covert attacks
arXiv:2605.14230v1 [cs.CR] 14 May 2026
Philipp Binfet
Janis Adamek
Abstract. The security of networked control systems (NCS) is receiving increasing attention from both cyber-security and system-theoretic perspectives. The former focuses on classical IT security goals such as confidentiality, integrity, and availability of process data, while the latter investigates tailored attacks (and detection schemes), including covert and zero-dynamics attacks. Confidentiality in control systems can, for instance, be achieved by securely outsourcing the evaluation of the controller to third-party platforms, such as cloud services. The underlying technology enabling such secure computation often is homomorphic encryption (HE). Recent works in encrypted control have proposed modifications to underlying HE schemes to achieve not only confidentiality but also resilience to certain types of integrity attacks. While extensions in this direction are desirable in principle, we show that the integrity problem in encrypted control cannot be solved by public-key HE schemes alone due to their inherent malleability. In other words, the same homomorphisms that enable encrypted control in the first place can be leveraged not only constructively but also destructively. More precisely, we demonstrate that NCS are vulnerable to covert attacks, even when encrypted control is employed. Remarkably, this remains possible without knowledge of an unencrypted model. Yet, resilience to such attacks can still be achieved through complementary techniques. We present an approach based on verifiable computation that integrates with modern homomorphic cryptosystems and is asymptotically secure while incurring no communication overhead. 1. I NTRODUCTION AND PROBLEM STATEMENT Within the area of security of cyber-physical systems, homomorphic encryption (HE) has been employed successfully to realize a wide range of control applications in a private way by securely outsourcing computation to one or more servers (see Schulze Darup et al. (2021) and Schlüter et al. (2023) for an overview). While HE is suited to address threats against data confidentiality, it is also well-known to be malleable by construction and, hence, cannot satisfy a stronger notion of security which includes data integrity (Katz and Lindell, 2014, Ch. 11.2.3). © the authors. This is an extended version of our paper accepted for presentation at the IFAC World Congress 2026. This work has been accepted to IFAC for publication under a Creative Commons Licence CC-BY-NC-ND. This work was funded by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – Grants 422262716 and 503491151.
Moritz Schulze Darup
As a subset of potential threats against cyber-physical systems, covert attacks (Teixeira et al., 2012) stand out as being particularly geared towards networked control systems (NCS) by manipulating the I/O data exchanged between the plant and its remote controller in a coordinated manner in order to stay undetected. This is usually done by injecting additive biases into these signals during transmission. More specifically, the control input signal received by the plant is manipulated to disturb the intended system behavior while carefully canceling out the effect on the output measurements visible to the remote controller. In this way, the attack remains perfectly stealthy while, in principle, arbitrary behavior can be forced upon the system under control. Unfortunately, this remains true even in the presence of HE due to its inherent malleability. Recognizing this limitation, attempts have been made to construct HE schemes with built-in resilience to unauthorized modifications of ciphertexts. Fauser and Zhang (2020, 2021, 2024), for example, describe a modified version of a cryptosystem introduced by Dyer et al. (2019). The modified scheme is homomorphic with respect to matrix-vector multiplication and is designed to provide resilience to additive—and, hence, covert—attacks. However, their construction is limited in that its resilience range depends on the value of the plaintext being encrypted and on the particular realization of the noise terms that are injected into the ciphertext during encryption to provide security. As a result, resilience is only guaranteed if the attack values are smaller than some threshold. This essentially limits the scheme’s effectiveness, as a covert attacker is free to choose and apply values outside of the resilience range. A different stream of research is based on the observation that the problems of confidentiality and integrity are essentially orthogonal, allowing for solutions addressing each problem separately. A system-theoretic approach to integrity is to employ anomaly detectors (Giraldo et al., 2018). In this spirit, Alexandru et al. (2022) pair the outsourced controller with a securely evaluated anomaly detector, both placed at the remote side, and transmit an additional alarm signal back to the plant. While this approach is suited to address threats such as sensor faults or simple false data injection, it suffers from the same malleability issue when it comes to covert attacks due to the detection mechanism being placed at the remote side. Another approach from cryptography, which does not fully rely on the remote side to enforce data integrity is to attach a message authentication code (MAC) to each message. MACs ensure that any alteration of an in-flight message by an unauthorized party is detected by the recipient (Katz and Lindell, 2014, Ch. 4). There even exist constructions that combine MACs with HE (Catalano and Fiore, 2013, for example) and which could therefore be applied to encrypted control loops. However, MACs
• We validate our findings in a numerical case study (Section 5). Notation. The identity matrix in Rd is Id . The Kronecker product of two matrices S and T is denoted by kron(S, T ).
Dec
+
Enc Jau (k)K
Covert Attacker
Juc (k)K
2.1 Specification of covert attacks We consider covert attacks on linear systems as specified by Smith (2011) and as illustrated in Figure 1. The underlying idea is simple: The attacker modifies the desired control input uc (k) via an additive attack signal au (k) resulting in the actual system input u(k) := uc (k) + au (k). (1) To compensate for the effect of the malicious input modification, the attacker also modifies the actual system output y(k) by subtracting an attack signal ay (k) in such a way that the modified output yc (k) := y(k) − ay (k) (2)
+
Jyc (k)K
Figure 1: Covert attack strategy using the homomorphisms of an encrypted NCS. behaves as the actual system output y(k) would in the attack-free case, where u(k) = uc (k). Specifying the attack is straightforward for linear system dynamics of the form x(k + 1) = Ax(k) + Bu(k),
x(0) := x0
y(k) = Cx(k). The unmodified system output at time step k then is ! k−1 X k−i−1 k A Buc (i) . y0 (k) := C A x0 + i=0
Now, assuming the attacker applies the input attack signal au (·), the output of the attacked system becomes y(k) = y0 (k) + C
k−1 X
Ak−i−1 Bau (i).
i=0
Hence, the output attack needs to compensate for the malicious forced motion component. Under the additional assumption that the attacker has access to a model of the system in form of the matrices A, B, and C, this is obviously achieved by choosing ay (k) := C
2. P RELIMINARIES
J−ay (k)K
remote
• We design a verifiable computation scheme that integrates with state-of-the-art homomorphic cryptosystems, incurs no communication overhead, and shifts all computational overhead to the server (Section 4).
y(k)
(A, B, C) x, x(0) = x0
network
• We show that encrypted control loops relying on HE are fundamentally vulnerable to covert attacks. Moreover, we describe two instantiations of the homomorphic covert attack and propose a corresponding attack space for classifying such variants (Section 3).
u(k)
local
generally incur the client-side computational overhead of generating a MAC tag for each message and increase the amount of data that has to be transmitted. Other approaches focus on verifiable computation techniques, which are typically used in the slightly different context of a malicious server but are nevertheless relevant to the topic of covert attacks. As a control-oriented example, Stabile et al. (2024) enable verification by sending additional queries containing “decoy” values to the server that evaluates the controller using some HE scheme. The responses to these queries are then used to decide whether the server’s response to the actual payload query should be trusted or not. The main downside here is the communication overhead incurred by the dummy queries. A more general and cryptographically rigorous approach is taken by Chatel et al. (2024); they propose special plaintext encoders that can be integrated into modern HE schemes to enable verifiable execution of general homomorphic programs. Their replication-based encoder, in particular, is similar to our approach in terms of the combination of replication, insertion of challenge values, and permutation. However, their method incurs linear overhead (in terms of both communication and computation) in the security parameter, which is likely due to its generality. Our contribution presented in this paper is three-fold:
k−1 X
Ak−i−1 Bau (i).
i=0
Remarkably, the same output attack sequence can also be computed recursively using the following dynamics: ∆x(k + 1) = A∆x(k) + Bau (k), ay (k) = C∆x(k).
∆x(0) := 0
(3a) (3b)
Without loss of generality, we assume that the attack starts at k = 0. 2.2 Finite-length covert attacks While the specification of ay (k) is straightforward in principle, an actual attack should consider an additional feature. In fact, even if au (k) is chosen to be non-zero only for k smaller than a finite ku ∈ N, ay (k) may be non-zero for every k ∈ N. In
other words, a perfectly stealthy attack might require the attacker’s “attention” for an indefinite amount of time. Clearly, finite attention is desirable in practice. Two basic approaches to achieving this are discussed in the related literature. The first approach assumes a Schur stable A and exploits the fact that commonly employed anomaly detectors operate on a non-zero detection threshold, below which no alarm will be raised. Consequently, au (k) = 0 for every k ≥ ku will eventually lead to ∥ay (k)∥ < ϵ for all k ≥ ky for some ky ∈ N and some ϵ > 0 corresponding to the detection threshold. Put differently, the active attack phase (k < ku ) here is followed by a passive cooldown phase (ku ≤ k < ky ) after which output compensation via (3b) can be terminated without sacrificing post-attack stealthiness. The second approach (Gheitasi and Lucia, 2020) employs an active strategy to achieve a specified cooldown duration and to provide perfect stealthiness (ay (k) = 0) for every k after the attack. In order to do so, special input attack signals are required during cooldown and the pair (A, B) must be controllable. One can then consider an input attack of length L ≥ n and design the last ∆k ∈ N ∩ [n, L] non-zero input modifications au (·) such that ∆x(L) = 0. Clearly, this implies ∆x(k) = 0 and ay (k) = 0 for every k ≥ L. ∆k here denotes the length of the active cooldown phase. Gheitasi and Lucia (2020) proposed an optimization-based selection of the attack sequence au (L−∆k), . . . , au (L−1), which allows for additional features such as minimal control effort or constraint satisfaction (Gheitasi and Lucia, 2022). Here, we limit the discussion to the basic form of the attack and focus on the special case ∆k := n to avoid the need for explicit optimization, resulting in
space and a corresponding operation ∗ : C × C → C in the ciphertext space, then Dec is a (group) homomorphism from (C, ∗) to (M, ⋆) if Dec(a ∗ b) = Dec(a) ⋆ Dec(b) (5)
au (L − n) .. † n = Cn A ∆x(L − n), .
We will collect these additional capabilities under the term advanced HE.
(4)
au (L − 1)
where C † denotes the Moore-Penrose inverse of the controllability matrix Cn = B AB . . . An−1 B . 2.3 Cryptographic basics and homomorphic primitives Broadly speaking, a public-key cryptosystem provides two mappings Encpk : M → C and Decsk : C → M between the space of messages or plaintexts, M (typically a finite integer set), and the space of encrypted messages or ciphertexts, C. The encryption procedure is parameterized on a public key pk and, in principle, available to anyone, while decryption requires a secret key sk and, thus, can only be carried out by authorized parties. We will write Enc and Dec in the following without explicitly denoting the corresponding keys unless the context requires disambiguation. A ciphertext which corresponds to the plaintext m ∈ M will be denoted by JmK ∈ C, i.e., it satisfies Dec(JmK) = m. Homomorphic encryption (HE) refers to cryptosystems under which, in addition to the encryption-decryption mechanism, it is possible to manipulate ciphertexts in a systematic way such that the corresponding plaintext, after decryption, reflects the result of a particular (arithmetic) operation performed on it. More specifically, given an operation ⋆ : M×M → M in the plaintext
for every a, b ∈ C. In other words, the plaintext operation ⋆ can be evaluated in an equivalent way using ∗ in the encrypted domain. Common examples for ⋆ are addition and multiplication on M. In this paper, we will refer to their counterparts on C as homomorphic addition (⊕) and homomorphic multiplication (⊙), respectively. By extension, we use Evalh to denote the homomorphic evaluation of a function h such that Dec(Evalh (J·K)) = h(·). Remark 1 (Advanced homomorphic primitives). Some stateof-the-art arithmetic HE schemes support vectorization or single instruction multiple data (SIMD) through ciphertext packing, meaning that a single ciphertext can represent an entire vector in the form of multiple plaintext slots; the homomorphic operations in this case process all slots simultaneously. Furthermore, the palette of supported homomorphic operations typically also includes 1. efficient analogous versions of ⊕ and ⊙ in which one of the operands is a plaintext; 2. additional binary operations such as subtraction; 3. additional unary operations such as negation and circular rotation of the plaintext slots (an analogous unary version of (5) holds in this case).
Besides the mere correctness of their functionality, cryptosystems (homomorphic or otherwise) are only as good as the guarantees they can provide regarding their ability to protect the confidentiality of the handled data. And in fact, it is standard practice in modern cryptography to prove the security of cryptosystems in a mathematically rigorous way. Homomorphic cryptosystems are no different in this regard; many HE schemes exist that are provably secure under standard cryptographic assumptions (typically regarding the hardness of certain mathematical problems). Practically speaking, this means that HE is suited to provide data confidentiality by virtue of Dec being intractable to evaluate when sk is not known. However, HE on its own cannot provide data integrity, since ciphertexts can readily be modified through homomorphic operations, which means that HE is malleable by construction. This malleability of HE is essentially what enables the type of attacks described in Section 2.1 to be launched even when HE is used to keep the transmitted data confidential, which will be discussed in Section 3. Remark 2 (Ciphertext notation for higher-level objects). The notation J·K was previously introduced only for encryptions of individual elements from the message space. For the sake of readability, we will use the same notation to also denote encryptions of vectors and matrices in the following. Hints regarding a possible concrete implementation are given in Section 5.2.
2.4 Homomorphic algorithms The basic homomorphic operations described above can be used to define more complex algorithms. Two such algorithms, which will be of importance in this paper, are encrypted matrix multiplication JST K := JSK ⊗ JT K and matrix-vector multiplication JSvK := JSK ⊗ JvK for a vector v and matrices S, T of appropriate size. While it is clearly possible to define ⊗ in terms of just ⊕ and ⊙, more efficient realizations using advanced HE exist; the implementation used in this paper is described in Appendix B. Furthermore, it is possible to define an algorithm for finding the Moore-Penrose inverse of an encrypted matrix based on encrypted matrix multiplication. Such an algorithm can be used to solve linear least-squares problems on encrypted data; notably, this class of problems includes the application of system identification on encrypted I/O data. We refer the interested reader to Adamek et al. (2024) for details. 3. H OMOMORPHIC COVERT ATTACKS We shall now introduce and analyze two variants of the covert attacks described in Section 2.1 that operate on encrypted I/O data. The two cases will differ in terms of the system knowledge and the homomorphic capabilities granted to the attacker. 3.1 Plaintext model and additive HE In the first scenario, the attacker is assumed to have access to (A, B, C) in unencrypted form, for example from expert knowledge or because the system under attack is a common appliance for which a suitable model is publicly available. After choosing au (k), the attacker can then readily evaluate (3) and (4) in plaintext for all k. The attack signals are injected into the input and output channel, respectively, via Ju(k)K = Juc (k)K ⊕ Enc(au (k)),
Jyc (k)K = Jy(k)K ⊕ Enc(−ay (k))
according to (1)–(2). Note that ⊕ is the only homomorphic operation the attacker needs to implement the attack. 3.2 Encrypted model and advanced HE In the second scenario, the attacker’s knowledge of the system model is reduced to (JAK, JBK, JCK). A possible way that the encrypted model might have been obtained is through encrypted system identification on intercepted encrypted I/O data (see Section 2.4). While evaluating (1)–(2) still only requires ⊕, this is not the case anymore for (3) or (4). Instead, the fully encrypted equivalents of these expressions, J∆x(k + 1)K = JAK ⊗ J∆x(k)K ⊕ JBK ⊗ Enc(au (k)), and
Jay (k)K = JCK ⊗ J∆x(k)K
Jau (L − n)K .. † n = JCn K ⊗ (JA K ⊗ J∆x(L − n)K) , . Jau (L − 1)K
(6a) (6b)
(7)
must be evaluated, which requires advanced HE capabilities (see Remark 1). Furthermore, due to the recursive nature of (3a) resp. (6a), the depth of the computational circuit increases with the attack duration (which is, however, finite; see Section 2.2). Similarly, a moderately deep circuit is required for computing JCn† K.
3.3 Attack classification The two variants of the homomorphic covert attack described above differ primarily in two aspects: System knowledge and homomorphic capability. System knowledge is the information about the system under attack that is available to the attacker (Teixeira et al., 2012). It may vary in quantity and quality, where quality may refer to the precision, utility, or severity of the data in question. For example, JAK is considered to have lower severity than A, as it contains less immediately usable information. Homomorphic capability refers to the type and amount of homomorphic operations that can be utilized by the attacker. For the purposes of this paper, we define the following characteristic points along this dimension: partially HE (either ⊕ or ⊙ is available), advanced HE (see Remark 1), and fully HE. The latter refers to the ability to evaluate arbitrary-depth computational circuits, which is typically achieved via so-called bootstrapping. Fully HE is not required in this paper and only mentioned to provide a reasonable upper bound of the homomorphic capability axis in the attack space. See Armknecht et al. (2015) or Marcolla et al. (2022) for an overview. We propose an attack space, spanned by these two dimensions, along which homomorphic covert attack variants may be classified. A qualitative illustration is given in Figure 2. In this context, the first attack variant can be placed in the upper-left region of the attack space in Figure 2, because it can be implemented with only very basic homomorphic operations, but only if full system knowledge in terms of an unencrypted model is available. By only ⊕ being required, this attack can be applied for a wide range of homomorphic cryptosystems. The second attack variant, in contrast, constitutes the opposite extreme being located towards the lower-right region of the attack space. The necessary side information is arguably less severe here since the system model only needs to be provided in an encrypted form. While this makes the attack more likely in principle, it also demands considerably more complex homomorphic functionality. In summary, it appears that system knowledge and homomorphic capability are, in a sense, competing dimensions; the tradeoff between the two can be understood from two perspectives: For a fixed set of HE capabilities, system knowledge of a certain quantity and quality must be available to enable the attack. Conversely, for a given amount of system knowledge of given quality, a certain minimum level of HE capability is necessary to successfully launch the attack.
System knowledge
partially
advanced
fully
w
Enc
Evalh
h(w)
Dec
(a)
• Ecd
w̃
Enc
Evalh̃
Dec
z̃
DcdVrfy
♦
w Homomorphic capability
Figure 2: Visualization of the homomorphic covert attack space. The two marked points correspond to the attack variants described in Sects. 3.1 (•) and 3.2 (♦). The dashed line denotes attack variants with comparable tradeoffs between the two dimensions and, hence, similar overall resource requirements. 4. T OWARDS ZERO - OVERHEAD VERIFIABLE ENCRYPTED CONTROL
As has been demonstrated above, control loops featuring remote controller evaluation using HE alone are fundamentally vulnerable to homomorphic covert attacks. To address this problem, we propose a tailored verifiable computation scheme which improves on existing approaches in terms of security, flexibility, and efficiency. 4.1 Motivation As discussed in Remark 1, modern homomorphic cryptosystems support packing multiple plaintext slots into a single ciphertext. Typical parameter choices1 lead to instantiations supporting rather large plaintext slot counts ranging from 212 to 216 . It is hence not uncommon that many of the available slots are not used. One key element of our approach is to populate (a portion of) these unused slots to enable the simultaneous processing of the regular payload data and challenge data, which will then be used for verification against precomputed values. In general, this will require a modification of the function h before uploading it to the server. Before describing our approach in detail, we make the following simplifying assumption: Assumption 1. The function to be outsourced is of the form h : Rd → Rd . Note that, without loss of generality, Assumption 1 can be satisfied by applying suitable zero padding. 4.2 A lightweight verifiable computation scheme Our verification scheme can be formalized as the collection of the client-side algorithms Setup, Ecd, and DcdVrfy, which are 1 For schemes derived from the ring learning with errors problem, the key length is the decisive factor in this regard.
h(w) (b)
⊥
Figure 3: Secure computation pipelines for evaluating h, without (a) and with (b) verification. Double-outlined boxes denote server-side operations. specified below. Setup(N, d, h) Choose an even expansion factor λ ∈ 2N such that λd ≤ N/2 and a detection threshold ε > 0. Generate M ∈ N challenge values ci , precompute h(ci ) and store (ci , h(ci )), 1 ≤ i ≤ M , at the client. Transmit the lifted function h̃ : Rλd → Rλd , w̃ = (w1 , . . . , wλ ) 7→ (h(w1 ), . . . , h(wλ )) to the server. Ecd(w) On input w ∈ Rd , generate a uniformly random permutation matrix P ′ ∈ {0, 1}λ×λ and store the blockwise permutation matrix P := kron(P ′ , Id ). Draw integers i1 , i2 , . . . , iλ/2 uniformly at random from [1, M ] and select the challenge values cir , 1 ≤ r ≤ λ/2. Form the augmented input by concatenating λ/2 replicas of the payload and the selected challenge values as w′ := ⊤ ⊤ λd [w⊤ , . . . , w⊤ , c⊤ and output the blocki1 , . . . , ciλ/2 ] ∈ R ′ shuffled version w̃ := P w . DcdVrfy(z̃) On input z̃ ∈ Rλd , parse the blocks of z ′ := P −1 z̃ as (ζ1 , · · · , ζλ/2 , ς1 , . . . , ςλ/2 ). Verify that ∥ςr − h(cir )∥∞ ≤ ε for all 1 ≤ r ≤ λ/2 using the precomputed values. If verification passes, conclude that ζi ≈ h(w) for all 1 ≤ i ≤ λ/2 with high probability and output one of the ζi uniformly at random. Otherwise, output the error symbol ⊥ and terminate the interaction with the server. To make the above verification scheme compatible with an existing HE pipeline for evaluating h (see Figure 3a), Ecd and DcdVrfy are added as pre- and postprocessing steps, respectively (see Figure 3b). Accordingly, the server must be set up to evaluate the lifted function h̃ instead of h. Note that an efficient implementation should avoid explicitly evaluating h on each of the λ blocks of the augmented input separately and instead use SIMD to compute on all blocks simultaneously. An example for how this can be done for linear functions is discussed in Section 5. Remark 3 (Detection threshold). DcdVrfy implements an approximate detection criterion based on the threshold ε to account for small deviations that occur naturally during the evaluation of h̃ due to finite-precision arithmetic.
4.3 Attack model
5.1 System model
In our model, the attacker’s malicious activity is confined to the modification of the measurements Jy(k)K and control actions Juc (k)K according to Figure 1. The attacker’s goal is to alter these values systematically (see Section 3) while staying stealthy. Stealthiness requires that all ςir should be intact upon decoding. To meet this requirement, the attacker must modify all λ/2 blocks carrying the replicas of the payload consistently and simultaneously (and leave the remaining λ/2 blocks untouched). We ascribe instantaneous success to the attack if this is the case in a particular time step. Since the permutation P is unknown to the attacker, we assume the attacker guesses the indices of these blocks uniformly at random. The resulting attack success probability (resp. the scheme’s attack detection rate) is derived next.
4.4 Attack success probability and detection rate The attacker guesses λ/2 out of λ block indices. In a given time step, this guess is successful with probability psucc (1) =
λ λ/2
−1
λ
= 2
!(λ − λ2 )! . λ!
(8)
It can be shown that psucc (1) ≤ 2−λ/2 for λ > 1, i.e., the instantaneous attack success probability is a negligible function in λ (see Appendix A). Consequently, the verification scheme is asymptotically secure with security parameter λ. Remaining stealthy over an attack of length L ≥ 1 time steps is possible only with probability L
psucc (L) = psucc (1) ,
(9)
since the permutation P is resampled in every time step. This results in an improved concrete upper bound for the cumulative attack success probability of psucc (L) ≤ 2−Lλ/2 . Conversely, an attack of length at least L is detected with probability at least 1 − psucc (L) ≥ 1 − 2−Lλ/2 . For example, for L = 10, a rather small expansion factor of λ = 4 already yields 40-bit security or, equivalently, a cumulative attack success probability of less than 10−12 .
5. C ASE STUDY AND IMPLEMENTATION DETAILS We will now validate both the feasibility of homomorphic covert attacks and the effectiveness of our verifiable computation approach on two instances of the aforementioned attack space in a numerical case study.
We demonstrate the viability of the homomorphic covert attacks from Section 3 on the model 0.984 0.000 0.041 0.000 0.083 0.001 0.000 0.989 0.000 0.033 , B = 0.001 0.063 , A= 0.000 0.000 0.959 0.000 0.000 0.047 0.000 0.000 0.000 0.967 0.031 0.000 0.500 0.000 0.000 0.000 C= , 0.000 0.500 0.000 0.000 which is a linearized version of the quadruple-tank process (Johansson, 2000). For simplicity and since our focus in this paper is on linear systems, we use this linearized dynamics not only for the design of the controller and the attacks but also to simulate the actual process behavior. As stated in Section 2.1, we define k = 0 as the starting point of the attack. Hence, the system is initialized with x(−20) = [ 1 1 0 0 ]⊤ and is driven to the setpoint xref = [ 1.15 1.20 0.17 0.13 ]⊤ using the static output feedback controller 11.545 0.061 uc (k) = − y (k) + u0 , 1.609 11.131 c where u0 = [ 6.80
7.76 ]⊤ .
5.2 Cryptosystem We choose the CKKS (Cheon et al., 2017), a lattice-based homomorphic cryptosystem that is especially suitable for encrypted control. This is due to its ability to handle arithmetic calculations over real numbers with high accuracy, its support for advanced homomorphic primitives (see Remark 1), the natural SIMD support, and the state-of-the-art performance measures. We instantiate the cryptosystem with a ring dimension (i.e., the key length) of N = 217 and a scaling value of 260 , which are typical values in encrypted control systems. Encrypted vectors and matrices. We leverage ciphertext packing to represent a plaintext vector v by the single ciphertext JvK. If the encryption of a matrix S, JSK, is accordingly defined as a collection of its encrypted diagonals, the matrix-vector multiplication algorithm of Halevi and Shoup (2014) can be readily used. Their ideas can then be extended to matrix-matrix multiplications in a straightforward fashion. See Appendix B for further implementation details. 5.3 Homomorphic covert attacks ⊤ We show an attack with au (k) = 2 2 for k ∈ [0, 4], which is subsequently terminated with proper cooldown at k = 9 such that L = 10. The two scenarios from Section 3.1 (plaintext model) and Section 3.2 (encrypted model) are both visualized in Figure 4, since they share nearly identical trajectories. The figure shows the input and output sequences at both the system and the remote controller before, during, and after the attack. The attack phase is entirely stealthy, as the controller receives the expected input and output sequence and can therefore not identify malicious activity with anomaly detectors over HE. Once the
Table I: Experimental detection rates. Each row reports the percentage of cases (sample size: 100,000) detected in the k ∗ -th step of the attack. ‘/’ denotes cases in which the attack was not detected within 10 steps.
Input trajectories
10
0
−10
u1 uc,1 au,1
u2 uc,2 au,2
y1 yc,1 yref,1 ay,1
y2 yc,2 yref,2 ay,2
Output trajectories
1 0.5 0 −0.5 −1 -20
-10
0
10
20
k∗
λ=2
λ=4
λ=8
λ = 16
1 2 3 4 5 6 7 8 9 10
49.98% 24.84% 12.53% 6.43% 3.08% 1.59% 0.80% 0.39% 0.18% 0.08%
83.43% 13.80% 2.27% 0.42% 0.07% 0.01% 0.00% 0.00% 0.00% 0.00%
98.58% 1.40% 0.02% 0.00% 0.00% 0.00% 0.00% 0.00% 0.00% 0.00%
99.99% 0.01% 0.00% 0.00% 0.00% 0.00% 0.00% 0.00% 0.00% 0.00%
/
0.09%
0.00%
0.00%
0.00%
30
t in s
Figure 4: Experimentally obtained I/O trajectories in both homomorphic covert attack variants.
cooldown phase is concluded, all deviations between uc (k) and u(k) as well as yc (k) and y(k) have been eliminated, which preserves stealthiness even after the attack. Therefore, the covert attack and cooldown can be successfully implemented with both stages of model knowledge. However, the configuration from Section 3.2 is more computationally demanding.
5.4 Verifiable computation approach We conduct an empirical study comprised of multiple experiments to validate the concrete effectiveness of our verifiable computation scheme from Section 4.2. In each experiment, we first fix a particular λ ∈ [2, 16] and instantiate the scheme. (setting N = 217 as before). With these choices, we could accommodate a payload dimension d of up to N/(2λ) = 212 even for the highest value of λ, which is far beyond what is required in typical control applications. Then, we simulate an attacker launching a finite-length covert attack of length L = 10 who is further assumed to follow the strategy outlined in Section 4.3. We then repeat this simulation 100,000 times, recording for each run the number of time steps passed since the beginning of the attack until the attack is detected. The experimental results reported in Table I show that for all λ > 2 the attack was successfully detected before it could be completed. Even for λ = 2 (the lowest possible value), the chance of not detecting the attack was lower than 0.1%. Note also that λ = 4 was sufficient to detect the attack in virtually all cases by the 6-th time step. For λ = 16, 99.99% of the time the attack was detected immediately. These findings also nicely align with the analytical expression for psucc (L) in (9).
6. C ONCLUSION AND OUTLOOK In this paper, we demonstrated that encrypted controllers are vulnerable to covert attacks by the inherent malleability of HE and therefore require verifiable computation schemes. We introduced an attack space for homomorphic covert attacks to aid in classifying possible attack scenarios by the tradeoff they make between the two dimensions ‘system knowledge’ and ‘homomorphic capability’. As a countermeasure to homomorphic covert attacks, we designed a verifiable computation scheme with zero communication overhead and asymptotic security, exploiting the SIMD feature of state-of-the-art HE schemes. Furthermore, we described two extreme cases in the attack space and used them to test our verifiable computation method in a numerical case study. Future research will be geared towards exploring possible extensions of the verification scheme in two main directions: First, we will investigate the possibility of recovering the payload even when an attack is detected. Second, we strive to improve the efficiency of the scheme and, thus, reduce the server-side computational overhead for certain classes of functions h. R EFERENCES Adamek, J., Binfet, P., Schlüter, N., and Schulze Darup, M. (2024). Encrypted system identification as-a-service via reliable encrypted matrix inversion. In 2024 IEEE 63rd Conf. Decis. Control (CDC), 4582–4588. Alexandru, A.B., Burbano, L., Çeliktuğ, M.F., Gomez, J., Cardenas, A.A., Kantarcioglu, M., and Katz, J. (2022). Private anomaly detection in linear controllers: Garbled circuits vs. homomorphic encryption. In 2022 IEEE 61st Conf. Decis. Control (CDC), 7746–7753. Armknecht, F., Boyd, C., Carr, C., Gjøsteen, K., Jäschke, A., Reuter, C.A., and Strand, M. (2015). A guide to fully homomorphic encryption. Cryptology ePrint Archive, Paper 2015/1192.
Catalano, D. and Fiore, D. (2013). Practical homomorphic MACs for arithmetic circuits. In T. Johansson and P.Q. Nguyen (eds.), Adv. Cryptol. – EUROCRYPT 2013, 336–352. Springer Berlin Heidelberg, Berlin, Heidelberg. Chatel, S., Knabenhans, C., Pyrgelis, A., Troncoso, C., and Hubaux, J.P. (2024). Veritas: Plaintext encoders for practical verifiable homomorphic encryption. In Proc. 2024 ACM SIGSAC Conf. Comput. Commun. Secur., CCS ’24, 2520–2534. Association for Computing Machinery, New York, NY, USA. Cheon, J.H., Kim, A., Kim, M., and Song, Y. (2017). Homomorphic encryption for arithmetic of approximate numbers. In T. Takagi and T. Peyrin (eds.), Adv. Cryptol. – ASIACRYPT 2017, 409–437. Springer International Publishing, Cham. Dyer, J., Dyer, M., and Xu, J. (2019). Practical homomorphic encryption over the integers for secure computation in the cloud. Int. J. Inf. Secur., 18(5), 549–579. Fauser, M. and Zhang, P. (2020). Resilience of cyber-physical systems to covert attacks by exploiting an improved encryption scheme. In 2020 59th IEEE Conf. Decis. Control (CDC), 5489–5494. Fauser, M. and Zhang, P. (2021). Resilient homomorphic encryption scheme for cyber-physical systems. In 2021 60th IEEE Conf. Decis. Control (CDC), 5634–5639. Fauser, M. and Zhang, P. (2024). A secure resilient homomorphic encryption scheme for control systems. IEEE Trans. Autom. Control, 1–16. Gheitasi, K. and Lucia, W. (2020). A finite-time stealthy covert attack against cyber-physical systems. In 2020 7th Int. Conf. Control Decis. Inf. Technol. (CoDIT), volume 1, 347–352. Gheitasi, K. and Lucia, W. (2022). Undetectable finite-time covert attack on constrained cyber-physical systems. IEEE Trans. Contr. Netw. Syst., 9(2), 1040–1048. Giraldo, J., Urbina, D., Cardenas, A., Valente, J., Faisal, M., Ruths, J., Tippenhauer, N.O., Sandberg, H., and Candell, R. (2018). A survey of physics-based attack detection in cyberphysical systems. ACM Comput. Surv. (CSUR), 51(4), 1–36. Halevi, S. and Shoup, V. (2014). Algorithms in HElib. In J.A. Garay and R. Gennaro (eds.), Adv. Cryptol. – CRYPTO 2014, 554–571. Springer Berlin Heidelberg, Berlin, Heidelberg. Johansson, K. (2000). The quadruple-tank process: a multivariable laboratory process with an adjustable zero. IEEE Trans. Control Syst. Technol., 8(3), 456–465. Katz, J. and Lindell, Y. (2014). Introduction to modern cryptography, second edition. Chapman & Hall/CRC Cryptography and Network Security Series. Chapman & Hall/CRC, Philadelphia, PA, 2 edition. Marcolla, C., Sucasas, V., Manzano, M., Bassoli, R., Fitzek, F.H.P., and Aaraj, N. (2022). Survey on fully homomorphic encryption, theory, and applications. Proc. IEEE, 110(10), 1572–1609. Schlüter, N., Binfet, P., and Schulze Darup, M. (2023). A brief survey on encrypted control: From the first to the second generation and beyond. Annu. Rev. Control, 56, 100913.
Schulze Darup, M., Alexandru, A.B., Quevedo, D.E., and Pappas, G.J. (2021). Encrypted control for networked systems: An illustrative introduction and current challenges. IEEE Control Syst. Mag., 41(3), 58–78. Smith, R.S. (2011). A decoupled feedback structure for covertly appropriating networked control systems. IFAC Proc. Vol., 44(1), 90–95. 18th IFAC World Congress. Stabile, F., Lucia, W., Youssef, A., and Franzè, G. (2024). A verifiable computing scheme for encrypted control systems. IEEE Control Syst. Lett., 8, 1096–1101. Teixeira, A., Pérez, D., Sandberg, H., and Johansson, K.H. (2012). Attack models and scenarios for networked control systems. In Proc. 1st Int. Conf. High Confid. Netw. Syst., HiCoNS ’12, 55–64. Association for Computing Machinery, New York, NY, USA.
A PPENDIX A. U PPER BOUND FOR INSTANTANEOUS ATTACK SUCCESS PROBABILITY
We want to show that psucc ≤ 2−λ/2 for λ > 1. From (8) we have −1 λ λ ! ! λ psucc (1) = = 2 2 λ/2 λ! λ −1 λ−2i λ−(λ−2) 2 λ λ−2 Y · · · · · · 2 2 2 2 = = λ−i λ · (λ − 1) · · · · · (λ − ( λ2 + 1)) i=0 λ 2 −1
−λ 2
=2
Y λ − 2i
i=0
λ−i
.
Since λ − 2i ≤ λ − i for all 0 ≤ i < λ2 , the product in the last line is at most 1, which concludes the proof. A PPENDIX B. E SSENTIAL ENCRYPTED MATRIX AND VECTOR OPERATIONS
To simplify the discussion, we make the following assumption (w.l.o.g.) about the shapes of vectors and matrices that need to be handled. Assumption 2. All matrices and vectors subject to encryption are of size n × n and n-dimensional, respectively, where n is a power of two. Assumption 2 reflects the fact that CKKS is typically implemented over rings of a power-of-two dimension N . Consequently, when ciphertext packing is used, the subring dimension (sometimes also called batch size) must be a power of two as well (see Cheon et al., 2017). Practically speaking, this requirement can always be met by proper zero-padding. We represent a vector v = [vi ]0≤i<n ∈ Rn by the single ciphertext JvK. Using the diagonal method (Halevi and Shoup, 2014), a matrix S = [si,j ]0≤i,j<n ∈ Rn×n can be split into (at most) n vectors (S0 , S1 , . . . , Sn−1 ), where Si := [sj,i+j ]0≤j<n ∈ Rn refers to the i-th wrapping diagonal of S and
is represented by the ciphertext JSi K. We define JSK := (JSi K)i . The k-th diagonal (0 ≤ k < n) of the result of a matrix multiplication can then be written as J(ST )k K = (JSK ⊗ JT K)k :=
n−1 M i=0
JSi K ⊗ roti (JT Kk−i )
(10)
and, similarly, matrix-vector multiplication as JSvK = JSK ⊗ JvK :=
n−1 M i=0
JSi K ⊗ roti (JvK),
(11)
where rot refers to ciphertext rotation; the conceptual definition of this operation from Remark 1 is specified here as follows: The circular rotation of JvK by i places yields roti (JvK) = Jv ′ K, where v ′ = [vj+i ]0≤j<n−1 . Note that indices into the entries of vectors, the entries of matrices, or matrix diagonals are implicitly understood modulo n here. This implies, for example, that sn−1,n+2 = sn−1,2 and S−i = Sn−i .