An encrypted model predictive control strategy for resilience operations

An encrypted model predictive control strategy for resilience operations Giuseppe Franz` eSenior Member, IEEE, Vicenc¸ Puig and Francesco Tedesco Senior Member, IEEE Abstract— In this paper, a resilient model predictive control architecture is proposed for constrained cloud-based networked control systems subject to false data injections on both the controller-to-actuator and sensor-to-controller channels. The basic idea consists in exploiting the capability of the encryption process to hide the data structure, shared between the controller and plant sides, to any third-party. Then, by adequately coupling the latter with the resilient nature of the receding horizon control philosophy, an array of attack countermeasures is determined for the on-line operations. Besides this, in order to secure data packet transmissions, cloud computing operations are performed by adopting an additive homomorphic cryptosystem so that encrypted model predictive control sequences are obtained. Finally, a platoon of vehicles is used to validate the whole architecture in simulation. I. INTRODUCTION In recent years, advancements in Internet of Things (IoT), Cyber-Physical Systems (CPSs), and smart grids have opened doors for deployment flexibility and efficiency improvements across various fields. However, this progress has heightened the demand for sophisticated control architectures to meet new engineering requirements. Networked control systems increasingly rely on cloud and distributed computing, where data vulnerability on cloud servers is a critical concern. Encrypted control, enabled by homomorphic encryption (HE) methods, ensures confidentiality of system states and control actions [1]. This approach is particularly relevant for cloud-based networked control systems, where threats like false data injections and eavesdropping jeopardize normal operations [2]. The concept of using HE for networked control systems’ privacy was introduced in [3], with subsequent research exploring advanced control schemes within encryption frameworks [4]. Notably, model predictive control (MPC) approaches have gained interest [5], addressing challenges such as handling encrypted data for cloud-based systems. This work was in part supported by the research project - ID:20222N4C8E ”Resilient and Secure Networked Multivehicle Systems in Adversary Environments” granted by the Italian Ministry of University and Research (MUR) within the PRIN 2022 program and European Union - Next Generation EU and in part by the research project - ID:PE00000014 “SEcurity and RIghts in the CyberSpace - SERICS” granted by the Italian Ministry of University and Research (MUR), and European Union within the NextGenerationEU program. Giuseppe Franz` e is with DIMEG, Universit` a della Calabria, Via Pietro Bucci, Cubo 42-C, Rende (CS), 87036, ITALY, [email protected] Vicenc¸ Puig is with CS2AC Universitat Polit´ ecnica de Catalunya (UPC), Rambla Sant Nebridi, 22, 08222 Terrassa and also with CSIC-UPC, Carrer Llorens Artigas, 4-6, 08028 Barcelona, Spain, [email protected] Francesco Tedesco is with DIMES, Universit` a della Calabria, Via Pietro Bucci, Cubo 42-C, Rende (CS), 87036, ITALY, [email protected] To deal with these issues, a cloud-based model predictive control architecture is developed by integrating into a novel resilient framework cloud computing technology and homomorphic cryptography. In this context, the introduction of the cloud computing on encrypted data has a twofold aim: protect the transmitted packets in terms of confidentiality and reduce the chance of intruders of altering their integrity. From a control point of view, this is translated into defining a sequence of set-containment conditions, complying with a set-theoretic worst-case approach, that unequivocally identify any admissible attack occurrence and provide a feasible command input at each time instant. A second contribution relies on the characterization of the computations among encrypted data performed on the cloud. To this end, an ad-hoc variant of the traditional MPC algorithm is considered in [5]. Although feasible, both approaches present the following weaknesses: the controller structure must be available on the actuator side; they lead to conservative control actions due to the exploitation of a single Proximal Gradient Method (PGM) iteration [9]. The proposed scheme substantially reduces (or even overcomes) these detrimental effects in virtue of the following reasons: 1) the full controller structure is not mandatory on the actuator, in fact few preliminary information are exploited; 2) control performance losses only occur when encrypted operations are invoked. PRELIMINARIES AND NOTATION Through this paper, we use the following notations. Let v(t+k|t),vk(t) = ˆvkbe the k−steps state ahead prediction of a generic system variable vfrom tonward. Definition 1: Given the sets A,E ⊂ IRn,A ∼E := {a∈ A:a+e∈ A,∀e∈ E} is the Pontryagin-Minkowski Difference.2 Given a symmetric matrix P∈IRn×n, P > 0 (P≥0) means that it is positive definite (semidefinite). Homomorphic Encryption [10] Let IR,ZZ,S,Kp,Ks,Mand Cbe the set of real numbers, integers, security parameters, public keys, security keys, plaintexts (message space), and ciphertexts. Moreover, consider the sets ZZ+:= {z∈ZZ |z≥0}and ZZn:= {z∈ ZZ |0≤z≤n}. Then, a public-key encryption scheme is a triplet (GEN, ENC, DEC)where GEN :S → Kp× Ks:k7→ (pk, sk)is a key generation algorithm, ENC :Kp× M → C: (pk, m)7→ cis an encryption algorithm, DEC : Ks× C → M : (sk, c)7→ mis a decryption algorithm, kis the key length (security parameter) and (pk, sk) = GEN(k) a pair of public and secret keys. The operators ENC and DEC perform component-wise actions on vectors and matrices. Public-key encryption schemes satisfy the following property: Property 1 - DEC(sk, ENC(pk, m)) = m, ∀m∈ M and ∀(pk, sk) = GEN(k) Definition 2: The scheme (GEN, ENC, DEC)is an additive homomorphic encryption if DEC(sk, c ⊕c0) = m+ m0,∀m, m0∈ M and c, c0∈ C such that ENC(pk, m) = m and ENC(pk, m0) = m0,with ⊕:C × C → C a binary operation over C. The Pailler scheme [11] is an additive homomorphic encryption scheme. As most of cryptosystems, it is based on a subset of integers, whose cardinality depends on the chosen key for the encryption. The key generation complies with the following rule: GEN :k7→ (pk, sk)=(a·b, lcm(a−1, b −1)) where aand bare two large prime numbers of the same length, i.e. a, b ∈(2k−1,2k),for some k∈ZZ+,such that gcd(ab, (a−1)(b−1)) = 1.Notice that gcd(·,·) and lcm(·,·)is the greatest common divisor and the least common multiple operators, respectively. For the encryption of any plaintext m∈ZZpk,a random integer r∈ZZ∗ pk := {m∈ZZpk |gcd(m, pk) = 1}is chosen and the ciphertext is obtained as ENC : (r, m)7→ c= ((pk + 1)mrpk mod pk2) Conversely, for any ciphertext c∈ZZpk2,the corresponding plaintext results from the decryption DEC : (sk, c)7→ Lpk(csk mod pk2)µmod pk with Lpk(γ) := (γ−1)/pk and µ:= sk −1mod pk the so-called modular multiplicative inverse. It can be shown that encryption followed by decryption provides an integer equivalent to the plaintext. More formally, for every m∈ZZpk one has that DEC(ENC(m, r)) = m, ∀r∈ZZ∗ pk .Moreover, notice that for every m1, m2∈ZZpk such that m1+m2∈ZZpk,the following property holds ENC(m1, r)⊕ENC(m2, s) = ENC(m1, r)ENC(m2, s)mod pk2= ENC(m1+m2, r ·s),∀r, s ∈ZZ∗ pk (1) According to (1), a semi-encrypted product can be also computed. In fact, for every m1, m2∈ZZpk such that m1·m2∈ZZpk,one has m2ENC(m1, s) =ENC(m1, r)m2mod pk2 =ENC(m1·m2, rm1 ),∀r∈ZZ∗ pk (2) II. PROBLEM FORMULATION Consider the class of Cloud-based Networked Control Systems (Cb-NCS) depicted in Fig. 1 whose physical plants are described by the following discrete-time linear invariant state space models: x(t+ 1) = Ax(t) + Bu(t) + Bdd(t)(3) P Actuator Sensor Controller u(t) x(t) z(t) u(t) c u(t) a CLOUD Fig. 1. Cloud-based networked control system subject to adversary attacks where x(t)∈IRnxdenotes the state, u(t)∈IRnuthe command input and d(t)∈ D ⊂ IRnx,∀t∈ZZ+:= {0,1, . . .},an exogenous disturbance. Moreover, the following constraints are prescribed: u(t)∈ U, x(t)∈ X (4) with Uand Xconvex and compact subsets of IRnuand IRnx, respectively, and 0nu∈ U,0nx∈ X. In the sequel, it is hypothesized that plant/controller operations may be compromised because of the following reasons: •exchanged data - malicious external agents modify command input and sensor measurements when sent/receive operations are performed through a communication medium: - controller-to-actuator link: u(t) := uc(t) + ua(t) - sensor-to-controller link: z(t) := x(t) + xa(t) where ua(t)∈IRnuand xa(t)∈IRnxare unknown and unbounded malicious signals, while u(t)∈IRnuand z(t)∈IRnxaccount for the resulting corrupted control signals and state measurements, respectively. •cloud layer - stealthy malwares (see [12] and references therein), intentionally designed to cause disruption to server capabilities, operate on the controller unit by a twofold action: 1) eavesdropping on the computed control inputs; 2) record and replay operations on the transmitted data. Then, the problem to be solved is stated as follows: Given the Cb-NCS of Fig. 1 described by (3)-(4) and subject to •FDI attacks on both command and measurement communication channels, •malware threats on the remote side, develop a control architecture enjoying attack detection capabilities and data confidentiality properties, such that the resulting controller, based on the fully availability of the state vector u(·) = g(z(·)),regulates the state trajectory in a Uniformly Ultimate Bounded (UUB) sense [13] despite any admissible disturbance realization and attack occurrence. III. THE PROPOSED SOLUTION:AN OVERVIEW In the sequel, two methodologies are exploited: model predictive control philosophy and cryptosystems. In particular, two MPC strategies, namely Nominal-MPC and ResilientMPC are designed to comply with resilient tasks, while encryption/decryption actions are performed to make safe the data transmission between plant and controller sides. the proposed solution is summarized in the scheme of Fig. 2 and hereafter discussed. The starting point consists in characterizing the remote side according to encryption/decryption arguments. Specifically, the required computations usually performed on the so-called Physical Layer are split as follows: •the Nominal-MPC controller is used during attackfree conditions but put aside as soon as the attack is recognized, the Detector and a Controller Buffer (used to store the last admissible attack-free state measurement, hereafter denoted as z−1) in charge to reveal the presence of attacks; •a second controller Resilient-MPC, activated under attack scenarios, is computed on the cloud where high computational resources are available. Notice that z−1is constantly updated during the attack-free operations, while, under an attack scenario, the last stored data is used to initialize the support controller ResilientMPC. According to this framework, encryption/decryption operations take place only when attacks are underway. Specifically the following actions are performed on the remote side. During the attack-free operations (Label No), the plant Pis exclusively regulated by means of the command input uc(t)that is never encrypted. Once the Detector reveals the attack occurrence (Label Yes), the communication medium is no longer reliable and the plant proceeds in an open-loop fashion by using first uc(t)(consecutively usable for a finite number of steps) then the Nlength resilient sequence uMP C (t)as soon as it has been received. Since the attack duration is not a-priori known, at each Ntime steps uMP C (·)is updated in order to enjoy resilient capabilities. Here, this is addressed by mainly operating on the cloud and by preserving the confidentiality of the data sent along the communication network. The latter is achieved thanks to encryption/decryption operations of the stored measurement z−1that allows to avoid from one hand eavesdropping phenomena and from the other hand, when the encrypted data [[uMP C (t)]] is transmitted, the opportunity to the intruder to properly infer the shared information. On the plant side, one has the following reasoning. Under attack-free scenarios, the Smart Decryption recognizes that a single vector, namely uc(t),has been received and therefore no decryption operations are required. Then, the Smart Actuator selects ufeas(t) = u(t−1) (that is admissible because it has been designed to be usable for several consecutive time instants): such an action is mandatory since it is unknown if the current received input u(t)has been instantaneously modified (u(t) = uc(t) + ua(t)). Hence, the command u(t) is first checked by using the twin model Σand then applied at the next time instant. Conversely, the Smart Decryption activates the decryption phase when a sequence of control moves is received, while the Smart Actuator applies the same k−th move of uMP C (t)both to Pand Σ,i.e., u(t) = ufeas(t)=(uM P C (t))k. Note that, within this framework, at each time instant the Detector receives the pair (z(t), zΣ(t)) in order to identify the current operating condition of the plant P, and eventually to recover the attack-free mode. Σ Smart Actuator Sensor Actuator P u(t) u (t) feas u(t-1) Smart Decryption a u (t) Nominal-MPC Controller z -1 Detector Encryption Resilient-MPC Encrypted operations a x (t) c u (t) [ | [ | z -1 z(t) No Yes u(t) x(t), x (t) ( ) Σ z(t), z (t) ( ) Σ [ | [ | MPC u (t) Fig. 2. Resilient encrypted-based control architecture IV. DETECTION,COUNTERMEASURES AND ON-LINE OPERATIONS According to the discussion on the architecture of Fig. 2, the design of the Nominal-MPC and Resilient-MPC must be jointly performed in order to ensure the feasibility retention. In the sequel, a set-theoretic approach will be pursued by exploiting the arguments of [7], [6] and [8] properly adapted to the proposed framework. First, an admissible robust positively invariant (RPI) region E0for the closed-loop state evolutions (6) is derived by considering the following state-feedback control law uc(t) = K x(t−τ(t)) (5) which satisfies the prescribed constraints (4) and ensures that the regulated state trajectory x(t+ 1) = Ax(t) + B K x(t−τ(t)) + Bdd(t)(6) is UUB irrespective of any delay occurrence τ(t)≤ τmax, τmax ≥1.Then, the upper bound ¯ Non the control horizon length pertaining to the Resilient-MPC controller is given by: ¯ N:= max k{k∈ZZ+|E0∼ k−1 X i=0 AiBdS 6=∅},(7) As a consequence, let N≤¯ Nbe given, the RPI region Ξ0for the closed-loop state evolutions is determined along the same lines exploited for E0with N−1 X r=0 ArBdD.Hence, the sequence of robust one-step state ahead controllable sets {Ξi}is computed according to the following recursions: Ξi={x∈IRn:∃u∈ U | Ax +Bu ∈˜ Ξi−1}(8) with ˜ Ξi:=Ξi∼ N−i−1 X r=0 ArBdD, i = 1, . . . , N −1,(9) Conversely, the sequence {Ei}is computed as follows: Ei:= {x:∃u∈ U|Ax +Bu +Bdd∈ Ei−1,∀d∈ D Aτmax x+ τmax−1 X i=0 Aτmax−1−iBu ∈˜ Ξi−1} (10) Notice that the further requirement in (10) imposes that the consecutive application of the command input ufor τmax time instants drives the regulated state trajectory within L [ i=0 Ξi.Then, the following results holds true. Proposition 1: Let x(0) ∈ L [ i=0 Ξibe an initial state condition for the regulated system (3) under the action of the Nominal MPC. If at a certain time instant ˆ t > 0an attack is detected, the controller switching Nominal MPC → Resilient MPC is always viable. Proof - Omitted for space reasons. 2 Finally, during the on-line phase the Nominal MPC and Resilient MPC command inputs are obtained as follows. Given a generic state x∈ Ei(t), the Nominal MPC computes the admissible control action by solving the following optimization problem: uc(t) := arg min Fj(t)(x, uc)s.t. (11) Ax +Buc∈ Ei(t)−1(12) where Fj(t)(x, uc)∈F:= {Fh(x, uc)}r h=1 a set of penalizing functions that are randomly chosen at each time instant by the real-valued function j(t) : ZZ+→ {1, . . . , r}. Conversely, by assuming that x∈Ξiprec ⊆ΞLthe Resilient MPC sequence of Ncontrol moves is obtained by solving the following convex optimization problem: min {˜uk}max ˜xk N−1 X k=0 k˜xkk2 Rx+k˜ukk2 Ru(13) ˜xk+1 =A˜xk+B˜uk;(14) ˜x0=x; ˜xN∈Ξ0;(15) ˜uk∈ U,˜xk∈ΞL;k= 0, . . . , N −1(16) where ˜xkis the k−state ahead disturbance-free prediction, Rx=RT x≥0and Ru=RT u>0state and input shaping matrices, respectively. A. Anomaly detector This unit has the aim to check the admissibility of transmitted data z(t), zΣ(t).and z+ Σ(t).Recall that Σdenotes the twin model of the plant P, z(t)the received state measurement resulting from the application of the current feasible command ufeas(t)while zΣ(t)accounts for the output of the application of the input u(t)to Σ.Finally z−1is the attackfree measurement stored in the Controller Buffer which is possibly updated at each time instant t. By using similar arguments as in [6], the following two-steps detector comes out. Starting from the so-called feasible measurement z(t),one has that on the controller side the following logical setmembership conditions must be verified: z∈Ξi⇒∃uc∈U such that ∀d∈ D, Az+Buc∈˜ Ξi−1 therefore if z−1∈Ξiand z(t)∈Ξj, j > i, (17) then an attack is underway. The FDI occurrence can be revealed by exploiting the concept of expected one-step prediction set Z+.Specifically, Z+(z−1,u(t−1)):= {z+∈IRn:z+=Az−1+Bu(t−1)+Bdd, ∀d∈D} ⊂ Ξi−1 (18) where z−1∈Ξiis the available information at the previous time instant and u(t−1) is the feasible, though not optimal, command. Then, the following logics comes out: D+(z(t)) := attack,if z(t)/∈Z+(z−1, u(t−1)) no attack, otherwise (19) As the measurement zΣ(t)is concerned, the FDI attack detection exactly follows the same lines above described, i.e. zΣ(t)in place of z(t)in (17). Conversely, the detection of FDI occurrences needs a further condition in addition to (19). Since zΣ(t)represents the one-step state prediction under the action of u(t)and it is required to check if u(t)is admissible for the plant Pat the next time instant t+ 1,then one has to verify its set-membership to Z++(z−1,{u(t−1), u(t−1)}) := AZ+(z−1,u(t−1))+Bu(t−1)+BdD ⊂ Ξi−2(20) and, as a consequence, the detection logics is D++(zΣ(t)) := attack, if zΣ(t)/∈Z++(z−1,{u(t−1), u(t−1)}) no attack, otherwise (21) Conversely once the attack is revealed, the set-membership tests (17) and (19) will be evaluated by considering the control moves of uMP C (t)in place of uc(t),i.e., u(t)←uMP C (t)k with zΣ(t) = Ax(t) + BuMP C (t)k+Bdd(t)(22) Then, according to the above analysis, the following result summarizes that FDIs cannot remain indefinitely stealthy. Proposition 2: Given the Cb-NCS architecture of Fig. 2, a set of penalizing functions Fand a real-valued function j(t).Let uc(t)be the nominal command input solution of the optimization (11)-(12) and uMP C (t)the resilient sequence computed by solving the SDP (13)-(16). Then, the setmembership logics (17), (19) and (21) always detect in a finite time FDI attacks. Proof - Omitted for space reasons. As the recovery from the attack is concerned, similar arguments can be exploited downline of the application of uMP C (t).Let tdetect be the detection time instant, one has that if x(¯ t)∈ Er,¯ t>tdetect, r < idetect,(23) with idetect the set-level complying with (17), then the plant Pis no longer under attack. Then, the following result holds true. Corollary 1: If there exists a time instant ¯ t > tdetect satisfying (23) such that z(¯ t)∈Z+(z−1, u(t−1)) with z(¯ t) as in (22), then the NCS of Fig. 2 is attack-free. Proof - It straightforwardly follows by construction and collecting the above developments. 2 B. On-line operations and countermeasures The developments of the previous sections are here collected to describe the modus operandi of the resilient architecture of Fig. 2. Without loss of generality, it is assumed that initially the plant Pis attack-free. During this phase, hereafter denoted as the nominal mode, the plant is regulated by exploiting uc(t),i.e., the admissibility of the received command u(t) is first checked by (19) and (21), then it is applied at the next time instant t+ 1.This reasoning applies until one of the logics (17), (19), (21) reveals an attack occurrence, namely at tdetect >0.As a consequence, the Nominal-MPC cannot be longer updated and the following countermeasure takes place according to an open-loop fashion. First, the command u(t−1) is consecutively re-used for the τmax −1 time instants so that the resulting state condition x(tdetect + τmax −1) ∈SiΞi,as prescribed in (10). Hence, the Resilient-MPC can be activated and the encrypted sequence [[uMP C (tdetect+τmax )]] computed on the basis of the last stored measurement [[z−1]].This switching is viable in virtue of the following result. Proposition 3: Let z=Aτmax x+ τmax−1 X i=0 Aτmax−1−iBuc+ Bdd(t),with d(t)∈ D,be the τmax−th state ahead evolution on the plant side of Fig. 2. Then, the disturbance-free evolution ˜zcomputed on the controller side ˜z:= Aτmax z−1+ τmax−1 X i=0 Aτmax−1−iBuc(24) is an admissible initial condition for the Resilient-MPC scheme. Proof - Omitted for space reasons. C. Stability issue The next proposition states the stability property of the proposed resilient scheme. Theorem 1: Let {Ei}L i=0 and {Ξi}L i=0 be non-empty onestep state ahead controllable set families and x(0) ∈ EL. Then, the Cb-NCS architecture of Fig. 2 ensures constraints satisfaction and UUB for any admissible attack occurrence and disturbance realization. Proof - Omitted for space reasons. V. ENCRYPTED CLOUD COMPUTING This section is devoted to describe the encrypted operations within the Pallier HE cryptosystem to solve the optimization (13)-(16). To this end, the first step consists in rewriting (13)-(16) as the following Quadratic Programming (QP) problem: q?(x) := arg min q∈Q(x)f(x, q)(25) where q:= {˜uk}N−1 k=0 ∈IRNm Q(x) :=    q∈IRNm |∃{˜xk}N−1 k=0 ∈IR(N+1)n s.t.(q,{˜xk}N−1 k=0 ∈IRNn) satisfies (14) −(16) with ˜x0=x    and f(x, q) := 1 2qTHq+xTFTq.In what follows, the method introduced in [4], which exploits a projected gradient scheme (PGS) belonging to the class of proximal algorithms [15], will be used for addressing the optimization (25). In particular, a PGS is carried out by the following recursions qj+1 =projQ(x)(qj−α∆qf(x, qj)) projQ(x)(qj−α(Hqj+Fx)) (26) with projQ(·)being the projection operator into a set Q. Since the Pallier cryptosystem is not order-preserving, the projection cannot be performed in the encryption domain as well as the optimal solution of (13)-(16). This numerical drawback can be overcome by considering a single iteration of (26): ˜ q1=q0−α(Hq0+Fx) = (I−αH)q0−αFx (27) with ˜ q1computed on the cloud as [[˜ q1]] = (Ecd∆(I−αH)[[q0]])⊕(Ecd∆(αF)[[x]]) (28) Finally, the resilient MPC action, computed on the actuator side, is: uMP C (t) = projQ(x)(Dcd∆(˜ q1) := arg min q∈Q(x)kq−˜ q1k (29) VI. SIMULATIONS Consider a platoon of two vehicles with pi(t),vi(t)and ai(t)denoting position, velocity and acceleration of vehicle Vi(t), respectively, and d2(t)being their inter-distance. The control objective is to ensure that the platoon dynamics converge to an asymptotically stable equilibrium: all intervehicle distance errors ei(t) := d2,r −d2(t)converge to zero with d2,r = 2[m]the target distance between the vehicles. To this end the following control-oriented model has been derived ˙x(t)=       0 1 0 0 0 0−1/τ 0 0 0 100−1 0 0 0 0 0 −1 0 0 0 0 −1/τ       x(t)+       0 0 1/τ 0 0 0 0 0 0 1/τ       u(t) where τ= 0.18s, x(t) = [v1(t), a1(t), d2(t), v2(t), a2(t)]T and u(t) = [u1(t), u2(t)],with ui∈ U := [−2,2]m s2, the command input in charge to actuate the engine. In turn, this model can be recast as (3) by a forward Euler discretization under the sampling time Ts= 0.1s. In the sequel, the following operating scenario is considered: Starting from the initial conditions x(0) = [5.93,14.60,3.20,9.47,1.43]Tit is required that the regulated state trajectory is driven to the target xf= [10,0,2,10,0]Twhile keeping the prescribed constraints. The Nominal-MPC is initialized following guidelines from Sections III-IV, generating a sequence of 150 controllable sets centered at xfwith a maximum duration of 14 steps. For the cloud infrastructure, a Resilient-MPC scheme is implemented based on Sections IV and VI, with a control horizon of 46 steps using PGS with step size α= 0.01. Encrypted controller operations are executed using the Python library eclib with key sizes of 1024 bits. Simulation results are presented in Figures 3-6. In an attack-free scenario, Figure 3 demonstrates the convergence of the platoon under NominalMPC, reaching the terminal set Ξ0at t= 13.5sas expected. In a covert attack scenario ranging from t= 4 sto t= 9s,the resilient architecture promptly detects the attack at t= 4.4swhen z(4.4) ∈Ξ96 using the D++ detector unit (Figure 4). Initially, the safe command sequence from the actuator buffer is applied for the next 1.4s, while the cloud computes a new Resilient-MPC sequence to be conveyed in an encrypted form. Once available, the encrypted sequence is applied for the successive 4.6s. Despite a slight performance loss, with the target set Ξ0reached at t= 15 s, the attacker’s actions are rendered ineffective due to the use of encrypted data. At t= 9.2s, when z(9.2) ∈Z+(z(4.4), uMP C (7.6)16), the recovery phase is triggered according to Proposition 3, switching the Detector’s status to ”no attack” and reactivating the Nominal-MPC. 0 50 100 150 i(t) 0 5 10 15 20 Time [s] Fig. 3. No attack scenario: set-membership level of the quantity x(t)−xr. D+ D++ 0 5 10 15 20 Time [s] no attack attack no attack attack Fig. 4. Detectors signals -3 -2 -1 0 1 ua (1) (t) 0 5 10 15 20 Time [s] -3 -2 -1 0 ua (2) (t) Fig. 5. Applied input: resilient controller VII. CONCLUSIONS In this paper, a novel model predictive control strategy for constrained cyber-physical systems subject to different classes of attacks has been conceived. In order to take advantage of encryption/decryption features and cloud computing, the proposed controller is developed on two layers: a 0 50 100 150 i(t) 0 5 10 15 20 Time [s] conveyed actual 3.5 4 4.5 88 90 92 94 96 Fig. 6. Set-membership level of the quantities x(t)−xr(actual) and z(t)−xr(conveyed): resilient controller controller devoted to address attack-free scenario and an encrypted unit derived on the cloud and in charge to be resilient versus critical events. In addition the cloud-based controller has been designed by exploiting a real time PGS whose encryption has been achieved through a semi-homomorphic cryptosystem. Finally, a platoon of vehicles has been used to validate the whole architecture in simulation. REFERENCES [1] P. Paillier,“Public-key cryptosystems based on composite degree residuosity classes,” In Proc. Advances Cryptology—EUROCRYPT ’99: Int. Conf. Theory Appl. Cryptogr. Tech., pp. 223-23, 1999. [2] W. Lucia, B. Sinopoli and G. Franz` e, “A set-theoretic approach for secure and resilient control of cyber-physical systems subject to false data injection attacks”, IEEE SOSCYPS, pp. 1-5, 2016. [3] K. Kogiso and T. Fujita, “Cyber-security enhancement of networked control systems using homomorphic encryption”, In Proc. IEEE Conf. Decis. Control (CDC), 2015, pp. 6836-6843, 2015. [4] M. Schulze Darup, A. Redder, I. Shames, F. Farokhi and D. Quevedo, “Towards encrypted MPC for linear constrained systems”, IEEE Control Systems Letters, Vol. 2, No. 2, pp. 195-200, 2018. [5] A. M. Naseri, W. Lucia and A. Youssef, “Encrypted Cloud-Based SetTheoretic Model Predictive Control”, IEEE Control Systems Letters, Vol. 6, pp. 3032-3037, 2022. [6] G. Franz` e, W. Lucia and F. Tedesco,“Resilient model predictive control for constrained cyber-physical systems subject to severe attacks on the communication channels”, IEEE Trans. on Auto. Contr., Vol. 67, No. 4, pp. 1822-1836, 2022. [7] G. Franz` e, F. Tedesco and D. Famularo, “Model predictive control for constrained networked systems subject to data losses,” Automatica, Vol. 54, pp. 272–278, 2015. [8] G. Franz` e., D. Famularo, W. Lucia, and F.Tedesco, “Cyber–physical systems subject to false data injections: A model predictive control framework for resilience operations”, Automatica, Vol. 152, pp.110957, 2023. [9] R. Van Parys and G. Pipeleers,“Real-time proximal gradient method for linear MPC,” In Proc. ECC 2018, pp. 1142-1147, 2018. [10] A. Acar, H. Aksu, A. S. Uluagac and M. Conti,“A survey on homomorphic encryption schemes: Theory and implementation”, IACM Computing Surveys , Vol. 51, No. 4, pp. 1-35, 2018. [11] P. Paillier,“Public-key cryptosystems based on composite degree residuosity classes”, In Advances in Cryptology - Eurocrypt ’99, Vol. 1592 of Lecture Notes in Computer S., pp. 223-238, Springer, 1999. [12] E. M. Rudd, A. Rozsa, M. G¨unther, and T. E. Boult,“A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions,” IEEE Trans. on Internet of Things, Vol. 19, No. 2, pp. 1145-1172, 2017. [13] F. Blanchini and S. Miani,“Set-Theoretic Methods in Control”, Birk¨ auser, Boston, 2008. [14] W. Feller, “An introduction to probability theory and its applications”, Vol 2, John Wiley &Sons, 2008. [15] N. Parikh and S. Boyd,“Proximal algorithms”, Foundations and Trends in Optimization, Vol. 1, No. 3, pp. 123-231, 2014. [16] J. Ploeg, B. T. Scheepers, E. Van Nunen, N. Van de Wouw, and H. Nijmeijer. “Design and experimental evaluation of cooperative adaptive cruise control”, 14th IEEE ITSC, pp 260-265, 2011.