Co-design for Security and Performance: LMI Tools
Navid Hashemi Justin Ruths




                                              
                                              
                                              


 
                                                

[footnoteinfo]The authors are with the Departments of Mechanical and Systems Engineering at the University of Texas at Dallas.

Navid]Navid Hasheminxh150030@utdallas.edu,    
Justin]Justin Ruthsjruths@utdallas.edu,               

[Navid]The University of Texas at Dallas, Department of Mechanical Engineering  
[Justin]The University of Texas at Dallas, Departments of Mechanical and Systems Engineering             

          
                           
LMI, reachable set, security, robust control.
                             
                                          
                                          


                    




We present a convex optimization to reduce the impact of sensor falsification attacks in linear time invariant systems controlled by observer-based feedback. We accomplish this by finding optimal observer and controller gain matrices that minimize the size of the reachable set of attack-induced states. To avoid trivial solutions, we integrate a covariance-based H_2 closed-loop performance constraint, for which we develop a novel linearization for this typically nonlinear, non-convex problem. We demonstrate the effectiveness of this linear matrix inequality framework through a numerical case study.






§ INTRODUCTION

A growing awareness of security concerns in automated physical processes has increased interest in our ability to quantify the impact of would-be attackers. Work along these lines imposes a detector to raise alerts when sensor measurements do not fall in line with model-based predictions, thus constraining what an attacker can do without being discovered <cit.>. The tuning of such detectors is a balancing act between increasing the sensitivity to attacks while reducing the number of false alarms (alerts raised during normal operation) <cit.>. The next clear step in this direction of research is to then minimize this impact through careful control system design. Initially work used the distance (norm) that an attacker could drive the state as a proxy for impact <cit.>, however, ultimately the reachable set provides important information about which components of a system are effected more than others and can inform whether the attacked state might reach dangerous regions of state space <cit.>. The quantification, or analysis, studies have often used ellipsoidal bounds on the actual attack-induced reachable set achieved either through iterative methods <cit.> or the satisfaction of linear matrix inequalities (LMIs) <cit.>. The latter extends gracefully to optimization to address the design question, although doing so often requires re-linearizing the inequalities with respect to the new design variables.

In this paper, we leverage past work on quantification of ellipsoidal bounds on the attack-induced reachable set to design the observer and controller gain matrices to minimize the ellipsoidal bound (and thus the reachable set) when a linear time invariant system is controlled with estimate-based feedback. As has been pointed out (see, e.g., <cit.>), it is important to pair a security minimization with a constraint on closed-loop performance, otherwise a trivial solution exists to disconnect the feedback loop and thus cut off the effect of the attack on the system state. Here we specify an output covariance constrained (OCC) H_2 performance <cit.>, which takes into account the covariance of the noise, unlike other distribution-agnostic approaches to robust control <cit.>. Because we are able to know the distribution of the noises in our system, using them in the selection of optimal gains allows us to exploit this known structure for a tighter and more tailored result. The problem of covariance-based H_2 design is, however, in general a non-convex problem. To make it compatible with our LMI framework, along the way we develop a novel convexification of the OCC H_2 design problem, by dividing the problem into two parts: a convex optimization and a generalized algebraic Ricatti equation.

In <cit.> we presented the notion of observer gain design to minimize the ellipsoidal bound on the estimation error. Here we complete the design problem by extending the framework to quantify and minimize the reachable set of attack-induced states, importantly integrating the design of the controller gain matrix as well. The more recent work <cit.> provides a general and expansive framework for using an LMI approach to solve the gain design problem for security. Our work here is distinguished by (a) using estimate feedback as opposed to a dynamic controller, (b) using a covariance-informed H_2 performance metric as opposed to a distributionally insensitive version, and (c) introducing a magnification factor to scale the shape matrices associated with the H_2 and reachable set decision variables. While the dynamic controller - characterized by a linear time invariant dynamical system with matrices A^c, B^c, C^c, and D^c - used in <cit.> is a more general approach, the nonlinearities caused by the estimate-based feedback adds additional complications to the steps to linearize the constraints. In particular, if we define A^c, B^c, C^c, and D^c to encode estimate-based feedback, the resulting inequalities in <cit.> are nonlinear and non-convex. The magnification factor we introduce here is effectively assumed to be unit value in <cit.>; in our numerical studies the value of this parameter tends to be large, indicating that including this factor greatly improves the quality of the optimization solution. A conference paper <cit.> presented the results for the iterative approach we take here, however, due to space the full detail of the proofs were not included. The fully convexified approach is not present in that paper.
































§ BACKGROUND


We consider a discrete-time linear time invariant (LTI) system of the form

    x_k+1   = Fx_k + Gu_k + ν_k,
    
    	y_k    = Cx_k + η_k,

in which the state x_k∈ℝ^n, k∈ℕ, evolves due to the state update provided by the state matrix F∈ℝ^n× n, the control input u_k∈ℝ^m shaped by the input matrix G∈ℝ^n× m, and the i.i.d Gaussian system noise ν_k ∼𝒩(0,R_1), R_1 ∈𝕍^n × n (𝕍 is the set of positive definite matrices). The output y_k∈ℝ^p aggregates a linear combination of the states, given by the observation matrix C∈ℝ^p× n, and the i.i.d Gaussian measurement noise η_k ∼𝒩(0,R_2), R_2 ∈𝕍^p × p. For the simplicity of the exposition, we have considered Gaussian noises, however, the approach we present is applicable for general noise distributions. In addition we assume that F is stable, the pair (F,C) is detectable, (F,G) is stabilizable and system and measurement noises are mutually independent.





In this work, we consider the scenario that the actual measurement y_k can be corrupted by an attack, δ_k ∈ℝ^p. The attack is injected at some point between the measurement and reception of the output by the controller, 

    y̅_k = y_k + δ_k =  Cx_k + η_k + δ_k.

If the attacker has access to the measurements, then it is possible for the attack δ_k to cancel some or all of the original measurement y_k - so an additive attack can achieve arbitrary control over the “effective” output of the system.

Because our system is stochastic, we require an estimator to produce a prediction of the system behavior

    x̂_k+1 = Fx̂_k + Gu_k + L(y̅_k - Cx̂_k),

where x̂_k ∈ℝ^n is the estimated state and the observer gain L is designed to force the estimate to track the system states.

We consider observer-based feedback controllers

    u_k=Kx̂_k,

where K ∈ℝ^m × n is the controller gain matrix. Next, we define the residual sequence

    r_k = y̅_k - Cx̂_k,

as the difference between what we actually receive (y̅_k) and expect to receive (Cx̂_k), which evolves according to

    x_k+1=(F+GK)x_k-GKe_k+ν_k
       e_k+1 = ( F - LC ) e_k - Lη_k + ν_k - L δ_k, 
       r_k = Ce_k + η_k + δ_k,

where e_k= x_k - x̂_k is the estimation error. In the absence of attacks (i.e., δ_k = 0), we can show that the steady-state distribution of r_k is Gaussian with covariance,

    Σ   = 𝐄[r_kr_k^T] = C𝐄[e_ke_k^T]C^T+𝐄[η_kη_k^T],
       =C𝐏_eC^T+R_2,

where the steady state covariance of the estimation error 𝐏_e= lim_k →∞P_k= lim_k →𝐄[e_ke_k^T] is the solution of

    𝐏_e
    	
    	=(F-LC)𝐏_e(F-LC)^T +LR_2L^T+R_1.

 In this work, we consider the chi-squared detector, although similar analysis can be done with other detector choices <cit.>. The chi-squared detector constructs a quadratic distance measure z_k to be sensitive to changes in the variance of the distribution as well as the expected value, 

    z_k = r_k^TΣ^-1r_k.

The chi-squared detector generates alarms when the distance measure exceeds a threshold α∈ℝ_>0

    {
    	z_k ≤α     ⟶  no alarm, 
    
    	z_k > α     ⟶  alarm: k' = k,
    .

such that alarm time(s) k' are produced. The Σ^-1 factor in the definition of z_k re-scales the distribution (𝐄[z_k]=p, 𝐄[z_kz_k^T]=2p) so that the threshold α can be designed independent of the specific statistics (mean and covariance) of the noises ν_k and η_k; instead, it can be selected simply based on the number of sensors, p <cit.>.




 §.§ Definition of Attack

Detectors are designed to identify anomalies in system behavior. If an attacker aims to remain undetected, the choice of detector and its parameters limit what the attacker is able to accomplish. The type of attacks we consider here require strong knowledge of and access to system dynamics, statistics of the noises, current estimate (x̂_k), and the detector configuration. The goal of this powerful stealthy attack is to construct the worst case scenario to aid the design of more robust systems.

Zero-alarm attacks employ attack sequences that maintain the distance measure at or below the threshold of detection, i.e., z_k ≤α. Hence, these attacks generate no alarms. To satisfy this condition we define the attack as

    δ_k =ϕ_k-(y_k-Cx̂_k)= - Ce_k-η_k+ϕ_k,

where ϕ_k∈ℝ^p is any vector such that ϕ_k^TΣ^-1ϕ_k ≤α (recall the attacker has access to the sensor, y_k, and knowledge of the estimator, x̂_k). Based on this attack strategy,

    z_k    = r_k^TΣ^-1r_k, 
       = (Ce_k+η_k+δ_k)^TΣ^-1(Ce_k+η_k+δ_k), 
       = ϕ_k^TΣ^-1ϕ_k ≤α.

Thus z_k≤α and no alarms are raised.




 §.§ Reachable Set

Under a stealthy zero-alarm attack (<ref>), the attacked system dynamics become

    x_k+1   =Fx_k+GKx̂_k+ν_k,
    x̂_k+1   =LCx_k+(F+GK-LC)x̂_k-LCe_k+Lϕ_k,
    
    	e_k+1   =  Fe_k - Lϕ_k + ν_k.

We stack these into a combined state ξ_k=[x_k^T, x̂_k^T,  e_k^T]^T and combined input μ_k=[ν_k^T, ϕ_k^T]^T,

    ξ_k+1=Aξ_k+B μ_k,

with

    A=[       F      GK       0;      LC F+GK-LC     -LC;       0       0       F ],    B=[  I  0;  0  L;  I -L ].


The choice of including x_k, x̂_k, and e_k seems redundant at this point since e_k=x_k-x̂_k, however, this choice is crucial as we layer additional constraints into the design optimization.
 
Throughout the rest of the paper we will use a selection matrix E_x=[I_n,  0_n× n,   0_n × n] to pull out quantities relevant to the state x_k=E_xξ_k.

The reachable set of attack-induced states is then,

    ℛ = {  x_k=E_xξ_k  |   ξ_k+1=Aξ_k+B μ_k, 
       ξ_1=0, ϕ_k^TΣ^-1ϕ_k ≤α,
       ν_k^TR_1^-1ν_k ≤ν̅, ∀ k∈ℕ. 
        },

where the ellipsoidal bound on the attack ϕ_k is imposed by the attacker's desire to remain stealthy (<ref>), and the ellipsoidal bound on the noise is created by truncating the Gaussian system noise to a desired probability, i.e., Pr[ν_k^TR_1^-1ν_k ≤ν̅] = p_ν, where p_ν is some desired (typically high) probability. In principle, the noise has unbounded support, and hence the reachable set is unbounded. To ensure bounded reachable sets, we apply this truncation at the desired confidence level.




§ LMI APPROACH TO DESIGN K AND L

In the first section, we reframe an existing result more concisely, which identifies a minimal outer ellipsoidal bound on the set of states reachable by a stealthy (zero-alarm) attacker. We then move to consider minimizing this set further through the design of the feedback and estimator gains K and L. As has been discussed in previous studies, a trivial solution exists to this design problem - to make either GK=0 or L=0. Doing so cuts the feedback loop and guarantees that corrupted measurements do not impact the system state. Simultaneously, this destroys the purpose - more specifically the performance - of the feedback loop. While many performance metrics could be used, in Section <ref> we impose a H_2 constraint to avoid these trivial solutions. Unlike prior work where the performance criteria ignored the distribution of the noise, this H_2 constraint is specific to the covariance of the noise, thereby allowing our design optimization to leverage this important knowledge. This output covariance constrained (OCC) H_2 constraint is non-convex; to our knowledge, this paper offers the first convexification of the OCC H_2 criteria into an LMI framework.












 §.§ Bounding Ellipsoid LMI (given K and L)

Before we move on to the synthesis problem of designing the gain matrices, we first provide a solution to the analysis problem of finding a tight outer ellipsoidal bound of the reachable set given K and L, when the system is driven by the system noise and attack. A similar analysis result appears in <cit.>, however, there the problem is split into two optimizations - one to find a bound on the estimation error reachable set, the result of which is used in the second optimization to bound the state reachable set. Here, in Lemma <ref>, we solve these simultaneously through the stacked states ξ_k and inputs μ_k. The following lemma provides a bound on a Lyapunov-inspired function given an elliptically bounded input.

<cit.>
Let V_k be a positive definite function with V_1 = 0 and μ_ik^T W_i μ_ik≤ 1, i=1, …, N, where W_i is positive definite. If there exists a constant a ∈ (0,1) and a_i ∈ (0,1)  such that ∑_i=1^N a_i ≥ a and

    V_k+1 - aV_k -∑_i=1^N (1-a_i) μ_ik^T W_iμ_ik≤ 0,

then V_k ≤N-a/1-a.


When we select the positive definite V_k to be a quadratic function of the state, the result above provides an outer ellipsoidal bound on the reachable states. We will use the notation ℰ(𝒬)={x | x^T𝒬^-1x≤ 1}.

 
Given the stacked system matrices A and B in (<ref>), gain matrices K, L, detector threshold α with steady state residual covariance Σ, system noise truncation threshold ν̅ with covariance R_1, if there exists constants a∈ [0,1), the solution of 

    {min_a_1,a_2, 𝒬   𝐭𝐫(E_x^T 𝒬 E_x)
    s.t.     0≤ a_1,a_2 < 1,    a_1+a_2 ≥ a, 
         [      a 𝒬     𝒬A^T        0;      A 𝒬        𝒬        B;        0      B^T 1-a/2-aW ]≥ 0,
    .

provides the shape matrix 𝒬 of the ellipsoidal bound on the reachable set of states, i.e., ℛ⊆ℰ(E_x^T 𝒬 E_x), where

    W=[ 1-a_1/ν̅R_1^-1              0;              0       (1-a_2)Π ],   Π=Σ^-1/α.



Proof: The stacked dynamics (<ref>) is driven by two inputs which are both ellipsoidally bounded. Letting W_1=R_1^-1 and W_2=Σ^-1, (<ref>) becomes

    V_k+1 - aV_k - 1-b/αϕ_k^T Σ^-1ϕ_k -1-a_1/ν̅ν_k^TR_1^-1ν_k ≤ 0.

Substituting the choice V_k=ξ_k^T (2-a/1-a𝒫) ξ_k ≤2-a/1-a, 𝒫>0, into this equation and expanding using the dynamics (<ref>) results in the LMI,

    ℋ=[       a𝒫     A^T𝒫        0;       𝒫A        𝒫       𝒫B;        0     B^T𝒫 1-a/2-aW ]≥ 0,

where 𝒫 is the inverse of the shape matrix of the ellipsoidal bound for the ξ reachable set (𝒫^-1=𝒬), such that the first block E_x^T𝒬E_x is the shape matrix of the ellipsoidal bound of the reachable set of system states. To make this ellipsoidal bound tight (as small as possible), the cost is selected to minimize the trace of the shape matrix E_x^T𝒬E_x. To use 𝒬 as the variable of the optimization instead of 𝒫 we apply the transformation T=diag[𝒬, 𝒬,  I_n ], to (<ref>), i.e., T^T ℋ T, which results in the LMI in (<ref>).
 ▪

 
For any convex shape (i.e., reachable set) there are an infinite number of tight outer ellipsoidal bounds. These different ellipsoids can be visualized as being tangent to the reachable set at different points. The minimum trace objective minimizes the sum of the squared principal axes, which tends to avoid solutions with, for example, low volume but one large principal axis. 



Note that the parameter a is not a decision variable of the optimization in (<ref>). It appears nonlinearly (multiplying 𝒬). Since a belongs to a compact interval, the conventional choice is to solve (<ref>) across a grid search in a and select the minimal, feasible solution.





 §.§ Output Covariance Constrained H_2 Constraint
 
The introduction of this section and past related work has identified that trivial solutions exist for the synthesis problem unless a performance criteria is imposed in the optimization <cit.>. One of the distinguishing features of this work is that we consider an output covariance constrained H_2 constraint, which involves the covariances of the system and sensor noises. The challenge, tackled in the next subsection, is to convexify and linearlize this inherently nonlinear constraint. Most optimizations in the literature either use a distributionally robust constraint that is already convex <cit.> or solve the OCC H_2 using iterative algorithms <cit.>.  

To specify the performance, Robust Control, in general, studies the gain observed in the signal h_k=H_1x_k+H_2η_k+H_3ν_k. Here, for the system without attack, we consider the system driven by system and measurement noise and enforce an H_2 constraint between the output h_k=y_k and excitation ω_k= [ν_k^T, η_k^T ]^T, making H_1=C, H_2=I_p× p, and H_3=0_p × n.

When there is no attack the system evolves according to
 
    x_k+1   =Fx_k+GK x̂_k+ν_k,
    x̂_k+1   =LCx_k+(F+GK-LC)x̂_k+Lη_k, 
    
    	y_k    = Cx_k + η_k,

which can be combined using the stacked state ζ_k=E_xx̂ξ_k=[x_k^T, x̂_k^T]^T,

    ζ_k+1=Âζ_k+B̂ω_k,

with E_xx̂=[I_2n,  0_2n × n] making Â=E_xx̂AE_xx̂^T and B̂=E_xx̂B E_xx̂^T.


It is here that we can start to appreciate the value of the seemingly redundant definition of ξ_k (see Remark <ref>). By doing so, the state matrix without attack Â can be expressed as a sub-block of the state matrix under attack A. Establishing this parallel structure is key towards being able to integrate the H_2 constraint (without attack) with the reachable set calculation (under attack).


The OCC ||H||_2 criteria specifies the gain from the noise to the output should be less than a desired value γ̅,

    lim_N →∞√(1/N∑_k=1^N y_k^Ty_k/1/N∑_k=1^Nω_k^Tω_k) = √(𝐄[y_k^Ty_k]/𝐄[ω_k^Tω_k])≤γ̅.


Given the dynamics in (<ref>), the OCC H_2 constraint in (<ref>) is satisfied if the steady state covariance 

    𝐏=[     𝐏_x   𝐏_xx̂; 𝐏_xx̂^T    𝐏_x̂ ] = lim_k→∞𝐏_k = lim_k→∞𝐄[ζ_kζ_k^T],

satisfies the Lyapunov equation

    𝐏=Â𝐏Â^T+R̂,    𝐏≥ 0,

and the following convex inequality holds,

    𝒞_h=𝐭𝐫( Ê_x^TC^TCÊ_x    𝐏) + 𝐭𝐫 (R_2) 
       - γ̅^2 (𝐭𝐫(R_1)+𝐭𝐫(R_2) ) ≤ 0,

where Ê_x=[I_n,  0_n × n].


Proof:
From (<ref>) and the definition of ω_k, we can calculate the quadratic terms in (<ref>),

    y_k^T y_k    =  x_k^TC^T  C x_k +  2 x_k^TC^T η_k + η_k^T η_k,
    ω_k^Tω_k   =ν_k^T ν_k+η_k^Tη_k.

Taking the expectation (x_k and η_k are independent), 

    𝐄[y_k^T y_k]    =  𝐄[x_k^T C^T  C x_k] +𝐄[η_k^T η_k]
       =  𝐭𝐫( C^TC  𝐄[x_kx_k^T] )  + 𝐭𝐫(R_2),

 and similarly,

    𝐄[ω_k^Tω_k]=𝐄[ν_k^T ν_k] +𝐄[η_k^Tη_k]=𝐭𝐫(R_1)+𝐭𝐫(R_2).

The unknown quantity is then the covariance of the state, 𝐄[x_kx_k^T], which is the first block of the stacked state ζ_k covariance 𝐏_k=𝐄[ζ_kζ_k^T]. This covariance follows the update, evaluating 𝐄[ζ_k+1ζ_k+1^T] with (<ref>),

    𝐏_k+1=Â𝐏_kÂ^T+R̂,    R̂=[     R_1       0;       0 LR_2L^T ].

Because the matrix Â is stable the covariance converges to a steady value lim_k→∞𝐏_k = 𝐏 which satisfies the Lyapunov equation (<ref>).



Combining this 𝐏 with (<ref>)-(<ref>) the H_2 constraint becomes

    γ=√(𝐭𝐫( C 𝐏_x C^T ) + 𝐭𝐫(R_2) /𝐭𝐫(R_2)+𝐭𝐫(R_1))≤γ̅,

where γ is the actual performance and γ̅ is the worst allowable performance. Rearranging this leads to the condition (<ref>).
 ▪

In order to use this H_2 constraint in a convex optimization we need to linearize the Lyapunov equation constraint. We state this result as part of a complete convex optimization problem to design the gains K and L to achieve the optimal (smallest) H_2 gain.


Given the dynamics in (<ref>), the smallest output covariance constrained H_2 gain defined by (<ref>) is  

    γ^*=√(𝐭𝐫( C 𝐏_x^* C^T ) + 𝐭𝐫(R_2) /𝐭𝐫(R_2)+𝐭𝐫(R_1)),

where 𝐏_x^* is the solution of

    {min_𝐏_x,𝐐_1,X,Y,Z   𝐭𝐫(C𝐏_xC^T)
    s.t.     𝒞_L ≥ 0,
    
    
    
    
    
    
    .

with

    𝒞_L = 0.75![     𝐐_1       I 𝐐_1F+XC       Z 𝐐_1 R_1    XR_2;             𝐏_x       F F𝐏_x+GY     R_1       0;               *     𝐐_1       I       0       0;               *       *     𝐏_x       0       0;               *       *       *     R_1       0;               *       *       *       *     R_2 ].

There exists at most 2n  n distinct real-valued, control gains L=𝐐_12^-1X, K=Y𝐏_xx̂^-T satisfying γ=γ^*, where 𝐏_xx̂=(I-𝐏_x 𝐐_1)𝐐_12^-T and 𝐐_12 is the solution of following generalized algebraic Ricatti equation,

    𝐐_12Γ_1𝐐_12+𝐐_12Γ_2+Γ_3𝐐_12+Γ_4=0,

with known matrices

    Γ_1=GY(I-𝐐_1𝐏_x)^-1,
       Γ_2=F,
       Γ_3=(𝐐_1GY+XC𝐏_x+𝐐_1F𝐏_x-Z)(I-𝐐_1𝐏_x)^-1,
       Γ_4=-XC.









Proof:
The formula for the optimal gain γ^*, (<ref>), comes naturally from the H_2 bound derived in (<ref>). Since all other terms are constant, minimizing 𝐭𝐫(C𝐏_xC^T) is equivalent to minimizing the gain. This covariance is constrained by the Lyapunov equation in (<ref>). Here, which is a standard technique for incorporating Lyapunov equations into convex optimizations, we replace this equality constraint with the very similar inequality, 

    𝐏-Â𝐏Â^T-R̂≥ 0,    𝐏≥0.

We can now combine these two inequality constraints into one using the Schur complement <cit.>,

    𝒞= [ 𝐏-R̂   Â𝐏; 𝐏Â^T    𝐏 ]≥ 0.

This relaxation is justified because the objective function 𝐭𝐫(C𝐏_xC^T) minimizes the decision variable 𝐏 and drives the optimization to the bound of the inequality, which would yield equality - hence driving the relaxed form (<ref>) to the equality (<ref>) (see Appendix <ref>).

We use the following transformation to linearize 𝒞,

    𝒞_L=[ T_1; T_1 ]^T𝒞[ T_1; T_1 ]=[ 𝐏_L-R_L     Â_L;   Â_L^T     𝐏_L ],

with

    T_1=[    𝐐_1      I; 𝐐_12^T      0 ],    𝐏^-1=𝐐=[    𝐐_1   𝐐_12; 𝐐_12^T    𝐐_2 ],

and

    𝐏_L=T_1^T 𝐏 T_1=[ 𝐐_1   I;   I 𝐏_x ], 
       R_L=T_1^TRT_1=[ 𝐐_1R_1𝐐_1 + 𝐐_12LR_2L^T𝐐_12^T                        𝐐_1R_1;                        R_1𝐐_1                           R_1 ],
       Â_L=T_1^TÂ𝐏 T_1=[ 𝐐_1F+XC       Z;       F F𝐏_x+GY ],

where X, Y, and Z are defined as 

    X   =𝐐_12L, 
    
        Y   =K𝐏_xx̂^T, 
    
        Z   =𝐐_1F𝐏_x+XC𝐏_x+𝐐_1GY+𝐐_12F𝐏_xx̂^T 
               +𝐐_12GY-XC𝐏_xx̂^T.

The term 𝐏_L-R_L can be linearized by applying a Schur complement to recover 𝒞_L in (<ref>). This transformation changes the set of decision variables from (𝐏_x, 𝐏_x̂, 𝐏_xx̂, L, K) to (𝐏_x, 𝐐_1, X, Z, Y). The solution in these new decision variables is then used to calculate 𝐏_xx̂ and 𝐐_12 using (<ref>) and the identity 

    𝐏_x𝐐_1+𝐏_xx̂𝐐_12^T=I,

which comes from the first block of the definition 𝐏𝐐=I. The definition of Z in (<ref>) and (<ref>) combine to form the general algebraic Ricatti equation  (<ref>), which, in general, has 2n  n different answers. Finally, the gain matrices can be found by, L=𝐐_12^-1X and K=Y𝐏_xx̂^-T. Note that the solutions to the original Lyapunov equality (<ref>) are a subset of the solutions of the relaxed inequality (<ref>); so Theorem <ref> characterizes all OCC H_2 optimal solutions.
 ▪

At the other end of the performance spectrum, security increases (size of the reachable set decreases) as either L or GK approach zero. This represents worst-case performance (without closed loop control) and the corresponding value of γ=γ_0 can be found using Lemma <ref>. 
 
Given the system dynamics,in the absence of attack, the open loop (i.e., L=0 or GK=0) OCC H_2 gain γ_0 is given by

    γ_0=√(tr(C 𝐏_x  C^T ) + tr(R_2) /tr(R_2)+tr(R_1)),

where the steady state covariance of state 𝐏_x is the solution of

    F𝐏_xF^T-𝐏_x+R_1=0.


Proof.
For both L=0 or GK=0, the state dynamics (<ref>) are in open loop and thus the evolution of the system is the same. When L=0, the state estimate x̂_k converges to zero because the system is open loop stable and the open loop state dynamic becomes

    x_k+1=Fx_k+ν_k.
 
Similarly, when GK=0, equation (<ref>) becomes (<ref>) directly. With this state equation, the steady state covariance of the state, 𝐏_x, is given by (<ref>) and consequently the desired performance  γ_0 should be the same in both cases.
 ▪

Therefore, now entering into the design process, for all choices of γ̅∈ [γ^*, ∞], the solution for performance γ<γ̅ always lies within the trade-off interval, 

    γ^* ≤γ≤γ_0.









 §.§ Bounding ellipsoid LMI (designing K and L)

The goal of this paper is to construct an optimization to design K and L such that the impact of an attacker on the reachable states is minimized. However, when K and L are considered variables of the Lemma <ref> optimization, (<ref>), and therefore, (<ref>) contains nonlinear terms. In the sections that follow, we impose some structure on the solution so that we can linearize the overall design problem. Each choice will be motivated individually, but it is also the combined effect of the these structures taken together that yield the final linear matrix inequality. The first three (out of four) represent a choice of how to select an outer ellipsoidal bound. While they do impose some structure on the solution, they are best seen as one choice out of infinitely many equally good options, so they are not very limiting.


There are an infinite number of tight outer ellipsoidal bounds of the stacked state ξ. Of these we select one that satisfies the following structure for the inverse of the shape matrix,

    𝒫=[    𝒫_1   𝒫_12; 𝒫_12^T    𝒫_2       ;    𝒫_3 ],

which assumes the independence of the ellipsoidal bound on the estimation error e_k from the ellipsoidal bound on the combined state x_k and estimate x̂_k. This is inspired by a similar assumption made in <cit.>. This selection enables us to utilize the parallel dynamics with and without attack (see Remarks <ref> and <ref>) and linearize the original LMI with respect to K and L.


This selection also permits inverting each block separately, such that 𝒫_3^-1=𝒬_e and

    [    𝒫_1   𝒫_12; 𝒫_12^T    𝒫_2 ]^-1=
       [     𝒬_x   𝒬_xx̂; 𝒬_xx̂^T    𝒬_x̂ ].

Consider the linearizing change of coordinates used in <cit.>,

    T_2=[ T_3; T_3; I_n ],    
    T_3= [     𝒬_x       I       0; 𝒬_xx̂^T       0       0;       0       0       I ].

Although (<ref>) is not entirely linearized with this transformation, due to the presence of term Σ which depends on L, we will introduce an iterative approach later to avoid this nonlinearity. The LMI ℋ, (<ref>), becomes

    ℋ_L=T_2^TℋT_2=[     a𝒫_L    A_L^T        0;      A_L      𝒫_L      B_L;        0    B_L^T 1-a/2-aW ],

where

    𝒫_L=T_3^T𝒫 T_3=[ 𝒬_x   I   0;   I 𝒫_1   0;   0   0 𝒫_3 ],
       B_L=T_3^T𝒫 B=[     I     0;   𝒫_1   Y_1;   𝒫_3 -𝒫_3L ], 
       A_L=T_3^T𝒫 AT_3=[ F𝒬_x+GX_1         F         0;       Z_1 𝒫_1F+Y_1C     -Y_1C;         0         0      𝒫_3F ], 
       Y_1=𝒫_12L,    X_1=K𝒬_xx̂^T,
       Z_1=𝒫_1F𝒬_x+𝒫_12LC𝒬_x+𝒫_1GK𝒬_xx̂^T+𝒫_12F𝒬_xx̂^T
           +𝒫_12GK𝒬_xx̂^T-𝒫_12LC𝒬_xx̂^T.

One of the useful features of this transformation is that 𝒬_x=E_x^T 𝒬 E_x, the quantify used in the objective function of Lemma <ref>, appears as a variable of the LMI. This section provides the linearization necessary to separate the gains K and L as variables in Lemma <ref> (and could then be used as the starting point if a different performance criteria was used, as opposed to the H_2 constraint considered in this paper). 






 §.§ Combining Performance and Security

In this work, we design the controller and estimator gains to minimize the impact of attacks on the system state, which is measured by an outer ellipsoidal bound on the reachable states when the system is driven by the attack and system noise. As Remark <ref> states, there are an infinite number of potential outer bounding - and tight - ellipsoids. In order to combine the LMI constraints from the reachable set and H_2 calculations, we make a specific choice about the outer ellipsoidal bound we select.

 
We select the shape matrix of the ellipsoidal bound of the states x_k and estimate x̂_k under attack E_xx̂^T 𝒬 E_xx̂ - see (<ref>) - to have the same orientation as the covariance of the states and estimate without attack (ζ_k), 

    σ𝐏=E_xx̂^T 𝒬 E_xx̂,

where σ is a scaling factor that becomes a new variable of the method and is a function of gains (L, K).  Since 𝐐 = 𝐏^-1, this sets up a common set of variables to link the H_2 (left) and ellipsoidal bound (right) constraints,

    σ[     𝐏_x   𝐏_xx̂; 𝐏_xx̂^T    𝐏_x̂ ]   = [     𝒬_x   𝒬_xx̂; 𝒬_xx̂^T    𝒬_x̂ ],
    1/σ[    𝐐_1   𝐐_12; 𝐐_12^T    𝐐_2 ]_H_2   = [    𝒫_1   𝒫_12; 𝒫_12^T    𝒫_2 ]._ℰ(𝒬)

The structure above allows us to replace variables in the ellipsoidal bound optimization 𝒬 and 𝒫 with quantities from the performance criteria, 𝐏 and 𝐐, respectively.


Based on (<ref>) we can link the variables of the bounding ellipsoid LMI with the H_2 constraint,

    X   =σ Y_1=𝐐_12L,    Y=X_1/σ=K𝐏_xx̂^T,
    
    Z   =Z_1=𝐐_1F𝐏_x+XC𝐏_x+𝐐_1GY+𝐐_12F𝐏_xx̂^T 
               +𝐐_12GY-XC𝐏_xx̂^T.




Now we can rewrite A_L, B_L , 𝒫_L based on 𝐏_x, 𝐐_1, 𝒫_3, X, Y, Z,

    A_L=[  σ (F𝐏_x+GY)            F            0;            Z 1/σ(𝐐_1F+XC)       -1/σXC;            0            0         𝒫_3F ],
       B_L=[      I      0; 1/σ𝐐_1   1/σX;    𝒫_3  -𝒫_3L ],   𝒫_L=[   σ𝐏_x      I      0;      I 1/σ𝐐_1      0;      0      0    𝒫_3 ].

Thus the choice in (<ref>) has facilitated integrating these optimizations.

[t]
K,L = Theorem <ref>(F,G,C,R_1,R_2) 
L ← such that 𝒞_L≥ 0 is feasible 
σ←∞ 
true 
	    (<ref>) is infeasible 𝐛𝐫𝐞𝐚𝐤
        𝐏_x, 𝐐_1, X, Y, Z ← (<ref>)  
        𝒦, ℒ← real solutions of Ricatti eqn (<ref>) 
        (K̃,L̃) ← select pair (K,L)∈(𝒦,ℒ) by smallest  Lemma <ref> objective value 
        L-L̃≤ϵσ←σ-ε
        K,L ←K̃,L̃




Consider a LTI system (<ref>) with maximum allowable output covariance constrained H_2 gain γ̅ (<ref>), chi-squared detector threshold α (<ref>) and zero-alarm stealthy attacker (<ref>). Algorithm <ref> returns (approximately) optimal controller K^* and observer L^* gains to minimize the reachable set of states possible by the attacker, while maintaining an OCC H_2 gain no bigger than γ̅. Algorithm <ref> uses the Ricatti equation (<ref>) to update L based on the solution of the combined convex optimization problem which has a solution if for some a ∈ [0,1),

    {   min_a_1,a_2,𝐏_x,𝐐_1,X,Y,Z,𝒫_3𝐭𝐫(σ𝐏_x)
           s.t.   0≤ a_1,a_2 < 1,    a_1+a_2 ≥ a,
               ℋ_L≥0,
               𝒞_h≤ 0, 𝒞_L ≥ 0.
    .



Proof:
In the past sections we have linearized the LMIs associated with the ellipsoidal outer bound on the reachable set (ℋ_L) and with the H_2 constraint (𝒞_h and 𝒞_L) and finally made a structural connection between these two optimizations (<ref>) to use a common set of decision variables. Because the controller gain K appears within the decision variables of the optimization, we implicitly optimize K.

There are two remaining challenges to be addressed by this algorithm. First, L appears, as K does, implicitly in the decision variables, but also explicitly in the nonlinear term 𝒫_3L in matrix B_L and in the dependence of covariance Σ in matrix W on L (<ref>), both of which are in ℋ_L. Second, the magnification factor σ multiplies most of the decision variables of the optimization. Thus neither L nor σ can be taken as variable in the optimization. We solve this by applying an iterative algorithm over both L and σ that leverages the structure presented in Figure <ref>. If we select a large enough value for the magnification parameter σ, any choice of L easily satisfies ℋ_L by creating a very large ellipsoidal outer bound. We satisfy the other constraints of the optimization (the H_2 constraints) by selecting the initial value for L as the H_2 optimal L (from Theorem <ref>), hence satisfying 𝒞_h and 𝒞_L. For these fixed values of σ, L, and Σ, the optimization (<ref>) is solved. The solution then provides a new value of L - solved from the Ricatti equation in (<ref>) - that minimizes the ellipsoidal bound while satisfying all constraints. Using the same value for σ but the updated L (and hence updated Σ), optimization (<ref>) is again solved, yielding another value for L. This iteration is repeated until L has sufficiently converged. Once convergence is achieved, σ is reduced and the process is repeated with the existing L as the initial value for the L iteration. At some point, the magnification factor σ will be too small for any choice of L to permit the ellipsoidal bound to contain the reachable set, hence the optimization (<ref>) will become infeasible. This is the stopping condition for the algorithm.  


Note that the convergence criteria for L and the decrement amount for σ are selected by the user. In principle, these should be small, but making them larger will allow the algorithm to require fewer iterations. The number of iterations for L to converge tends to be quite small (typically 2-3). In practice, the decrement of σ can also be accomplished through a bisection algorithm which looks for the smallest value of σ that makes the optimization (<ref>) feasible.

Recall that, in general, solving the Ricatti equation (<ref>) yields up to 2n  n solutions. We assert that there will always exist at least one real solution due to matrices 𝐏_L, 𝐏, 𝒞_L, and 𝒞 being positive definite. To chose between the real solutions, we choose the one that yields the smallest ellipsoidal outer bound, as determined by Lemma <ref> (which provides a tighter approximation of the reachable set, since it does not require the additional linearization steps).

Finally, the stability of the closed loop system is implicitly guaranteed if ℋ_L>0 and 𝒞_L>0 (see Appendix <ref>).
 ▪

In practice, the quality of the solution is related to the initial guess for L. For the cases where γ̅ is close to γ^* we use L from Theorem <ref> as the initial guess. Otherwise when γ̅ is far from γ^* we solve the problem in multiple steps increasing γ̅ gradually from γ^* at each step solving Theorem <ref> and using its solution as the initial values for the next step where γ̅ is increased. 






































§ RESOLVING THE NONLINEARITY

The approach offered in Theorem <ref> relies on an iterative scheme to avoid the nonlinearities surrounding the observer gain matrix L. In each iteration, the solution of the convex optimization in (<ref>) is used to find L using the Ricatti equation in (<ref>) and the corresponding residual covariance Σ using the Lyapunov equation in (<ref>). To eliminate the iterative approach, both of these nonlinearities must be linearized and absorbed into the convex optimization. A final nonlinearity is the existance of the  -𝒫_3L term within ℋ_L - specifically B_L in (<ref>). We accomplish this linearization through the careful selection of additional structure, which we will show only marginally reduces the quality of the solutions found.

 
Here 𝒬_e=𝒫_3^-1 is the shape matrix of the estimation error bounding ellipsoid. Again there are an infinite number of choices for its orientation and, following the same approach taken in Imposed Structure <ref>, here we choose the orientation that matches that of the estimation error covariance in the absence of attack 𝒫_3=1/σ𝐏_e^-1.


 
The final linearization assumption is to search for solutions on the manifold that satisfies 𝐏_x̂=𝐏_xx̂. This is the most restrictive of the four structures that have been imposed to linearize the problem, however, we will see it does not greatly impact the conservatism of the optimization. One of the direct effects of this structure is that the generalized algebraic Ricatti equation (<ref>), one of the key nonlinearities, is directly linearized. However, it is this final structure that ultimately removes all three nonlinearities present in Theorem <ref>.


From Imposed Structure <ref> and the identity 𝐏𝐐=I - see (<ref>) - we can show that 𝐏_e^-1=𝐐_1=-𝐐_12 (see Appendix <ref>). The relationship between 𝐐_1 and 𝐐_12 is primarily what linearizes the Ricatti equation in (<ref>). The relationship between 𝐏_e and 𝐐_1, combined with Imposed structure <ref>, enables us to replace the -𝒫_3L nonlinearity with 1/σX. Therefore we can re-write matrices A_L, B_L, 𝒫_L as,

    A_L=[  σ (F𝐏_x+GY)            F            0;            Z 1/σ(𝐐_1F+XC)       -1/σXC;            0            0      1/σ𝐐_1F ],
       B_L=[r]I     0  
    1/σ𝐐_1   1/σX
    1/σ𝐐_1   1/σX,   𝒫_L=[   σ𝐏_x      I      0;      I 1/σ𝐐_1      0;      0      0 1/σ𝐐_1 ].







Finally, the relationship between 𝐏_e and 𝐐_1 also help to integrate the Lyapunov equation in (<ref>) into the convex optimization. Lemma <ref> relates the matrix Π=Σ^-1/α with the existing decision variables. This requires us, like the system and sensor noises, to truncate the estimation error distribution at some confidence level, measured by e̅.

Consider the truncated Gaussian system noise and measurement noise with ν_k^TR_1^-1ν_k≤ν̅ and η_k^TR_2^-1η_k≤η̅ and their corresponding Gaussian estimation error and residual with e_k^T𝐏_e^-1e_k≤e̅ and r_k^T Π r_k≤ 1. The positive definite matrix Π, can be expressed as Π=Σ^-1/α where Σ comes from (<ref>) and (<ref>), if,

    𝒳_L=[ 𝐐_1-(e̅+η̅)C^T Π C      -(e̅+η̅)C^T Π;        -(e̅+η̅)Π C    R_2^-1-(e̅+η̅)Π ]≥ 0. 
       𝒮_L=0.75![         𝐐_1     𝐐_1F+XC      𝐐_1R_1        XR_2; (𝐐_1F+XC)^T         𝐐_1           0           0;      R_1𝐐_1           0         R_1           0;      R_2X^T           0           0         R_2 ]≥ 0.

where e̅ is computed from the lower incomplete Gamma function such that Pr[e_k^T𝐏_e^-1e_k ≤e̅] = p_e, and p_e is the desired trucation probability.

Proof:



The inequality ℋ_L already provides a lower bound on Π. We now add an additional upper constraint to sandwich and fully constrain Π. We exploit the fact that r_k^T Π r_k≤1, and r_k=Ce_k+η_k, therefore we conclude,

    Φ_1 = [ e_k^T η_k^T ][ C^TΠ C  C^T Π;    Π C      Π ][ e_k; η_k ]≤ 1.

In addition, for the estimation error in the absence of attack we have, e_k^T 𝐏_e^-1 e_k ≤e̅, where e̅ is chosen to contain most of the Gaussian estimation error distribution (this quadratic form follows a chi-squared distribution, therefore, e̅ can be chosen by the lower incomplete Gamma function). For the measurement noise we have, η_k^T R_2^-1η_k ≤η̅, therefore, together we have

    Φ_2 = [ e_k^T η_k^T ][ 𝐏_e^-1      0;      0 R_2^-1 ][ e_k; η_k ]≤e̅+η̅.

Hence, we can provide a upper bound for Π since Φ_1≤ 1, then (e̅+η̅)Φ_1 ≤Φ_2. Thus,

    [ 𝐏_e^-1-(e̅+η̅)C^T Π C         -(e̅+η̅)C^T Π;           -(e̅+η̅)Π C       R_2^-1-(e̅+η̅)Π ]≥ 0

which can be written as (<ref>). We now have a upper bound on Π in terms of 𝐐_1, however, 𝐐_1 is not itself constrained. To do this, we relax the Lyapunov equation (<ref>) equality to inequality,

    𝐏_e-(F-LC)𝐏_e(F-LC)^T-R_1-LR_2L^T ≥0.

We apply the Schur Complement to receive

    𝒮=[ 𝐏_e-LR_2L^T-R_1       (F-LC)𝐏_e;     𝐏_e(F-LC)^T             𝐏_e ]≥ 0.

Using the transformation T_4=diag[ 𝐏_e^-1 𝐏_e^-1 ] gives

    𝒮_L=T_4 𝒮 T_4^T=[ 𝐏_eL-R_eL      A_eL;    A_eL^T      𝐏_eL ]≥ 0,

where,

    𝐏_eL=𝐏_e^-1=𝐐_1,
        R_eL=𝐏_e^-1(R_1+LR_2L^T)𝐏_e^-1= 𝐐_1R_1𝐐_1+XR_2X^T,
       A_eL=𝐏_e^-1(F-LC)=𝐐_1F+XC.

Applying the Schur Complement again yields the expression in (<ref>).

 ▪

With these combined linearization steps, we can provide Theorem <ref>.













Consider a LTI system (<ref>) with desired output covariance constrained H_2 gain γ̅ (<ref>), chi-squared detector threshold α (<ref>) and zero-alarm stealthy attacker (<ref>). If there exist a, a_2 ∈ [0,1) then the solution of the following convex optimization provides the optimal observer L and controller K gain matrices that minimize the set of states reachable by an attacker while maintaining an OCC H_2 gain no bigger than γ̅,


    {   min_a_1,𝐏_x,𝐐_1,ΠX,Y,Z𝐭𝐫(σ𝐏_x)
           s.t.   0≤ a_1< 1,    a_1+a_2 ≥ a,
               ℋ_L≥0, 𝒞_h≤ 0, 𝒞_L ≥ 0,
               𝒮_L≥0, 𝒳_L≥0.
    .

This optimization is solved for a specific value of σ, which is optimized through a bisection algorithm.







































§ CASE STUDY
 
We consider a LTI system (with matrices given below) for this study with the chi-squared detector tuned to a false alarm rate 𝒜=0.05 (5%), system noise truncated with p̅=95%, and a worst acceptable OCC H_2 gain of γ̅=8.75. We use CVX to solve the convex optimizations <cit.>.

    F= [r]
        1.0444      -0.1409
    
        0.3001       0.6327
         , 
    G=[ 2 3; 1 1 ], 
    C= [ 2 2; 1 2 ], 
       R_1= [r]
           0.0183      -0.0218
    
           -0.0218       0.0261
         ,  
    R_2=[ 0.0018 0.0031; 0.0031 0.0096 ]

We start by computing the optimal OCC H_2 gain γ^* using Theorem <ref>,

    γ^*=√(tr( C  𝐏_x  C^T) + tr(R_2) /tr(R_2)+tr(R_1))=1.5673.

The solution for gain matrices L and K based on the generalized algebraic Ricatti equation (<ref>), returns 4 2=6 different answers of which two are real valued. Of the real solutions,

    L=[r]1.0085     -0.9780 
     -0.0139     0.2664,     K=[r]0.1273      -2.0544 
     -0.4303      1.4190,

provides the smallest reachable set according to Lemma <ref>. To examine the accuracy of Theorem <ref>, we compare the state covariance that is the solution of the Lyapunov equation (<ref>) with the designed gains in (<ref>), with the decision variable 𝐏_x of the optimization. In this case, the (entry-wise) mean absolute error (MAE) between these matrices is less than 0.00001, justifying that the relaxed inequality in Theorem <ref> recovers an exact Lyapunov equation solution.





The open loop OCC H_2 gain is found using Lemma <ref> to be,

    γ_0=√(tr( C^TC  𝐏_x  ) + tr(R_2) /tr(R_2)+tr(R_1))=10.1899.







Next we use the iterative approach from Theorem <ref> with convergence criteria ϵ=0.03 for the gain matrix L. We use bisection to find the smallest feasible σ (stopping tolerance of 0.01), starting with σ_min=0.1 and σ_max=10^6. In addition we increase γ̅ gradually from γ^*=1.57 until γ̅=8.75 by steps of 0.1 (see Remark <ref>). The optimal gains are,

    L=[  0.0956 -0.1248; -0.1010  0.1321 ],     K=[  0.1440 -2.0390; -0.4441  1.4063 ],

with corresponding magnification factor σ=400.91.
Given these gains the actual performance is computed as γ=6.91, which is computed by substituting the optimal gains into and then solving the Lyapunov equation (<ref>) and then computing γ from (<ref>). This discrepancy between the input γ̅ and the outcome γ is the price of the linearization, caused by the competing LMI constraints (see Appendix <ref>).

Finally we optimize the gains L and K using the fully convexified method in Theorem <ref>, which results in,

    L=[  0.1274 -0.1737; -0.2019  0.2872 ],     K=[  0.1902 -1.9945; -0.4757  1.3759 ].

The actual performance is γ=6.81 (as above). The bisection is configured as above and returns σ=2471.42 as the smallest feasible value of the magnification factor. 

To examine the accuracy of these linearization method we compare the state covariance of the system which is the solution of the Lyapunov equation (as discussed above) with the designed gains in (<ref>), with the decision variable 𝐏_x of the optimization. The mean absolute error between these two matrices is 0.04. As before, this discrepancy is the result of the linearization (see Appendix <ref>)






Figure <ref> compares the ellipsoidal bounds provided by the solutions above including Theorem <ref> (red) and Theorem <ref> (blue) for the worst allowable performance γ̅=8.75, as well as Theorem <ref> (black) for optimal performance γ=γ^*. In this figure the ellipsoidal bounds are from Lemma <ref> with optimal gains provided from Theorem <ref>, Theorem <ref>, and Theorem <ref>. This figure demonstrates that despite the similarities between Robust Contol and Resilient Control design, the H_2 optimal solution is not the optimal security solution. It also shows that the fully convexified solution evidences only marginally degraded solution quality, despite the linearization steps.













In Figure <ref> we compute the optimal gains for a wide range of worst allowable OCC H_2 gains using Theorem <ref> and Theorem <ref>. Given the optimal gains, L and K for each, we plot the objective function of Lemma <ref> with respect to the actual performance, γ. We use the objective function of Lemma <ref> as a proxy for security where, smaller values imply better security. This plot demonstrates that there is, indeed, a trade off between  security and performance. The nonlinearity and steep slope near γ^* indicates that dramatic improvements in security can be gained by marginal concessions in performance. The relationship between these two properties, captured by this plot, should be used in resilient control system design. 



Figure <ref> shows that the solution of Theorem <ref> does not cover the entire trade off interval and the problem is infeasible on the interval γ∈ [γ^*, γ_c], where γ_c=5.66 for this scenario. The manifold 𝐏_x̂=𝐏_xx̂ imposed by Imposed Structure <ref> is not able to provide a feasible solution for entire trade off interval, satisfying both the stability constraint in both attacked system LMI (ℋ_L) and attack free LMI (𝒞_L). There exists an infimum for the optimal threshold on this manifold, which is computed in Appendix <ref>. 

































































§ CONCLUSION

This paper presents a set of tools to design the feedback controller and observer gains for observer-based feedback control with the aim to minimize the effect sensor falsification attacks. As past work has observed, there is a necessary trade-off between ensuring performance and minimizing the effect of the attacker. Here the attacker impact is quantified as the set of states reachable through the action of the attacker and the nominal closed-loop performance is specified by an output covariance constrained H_2 gain. We frame this problem as an LMI wrapped in an iterative algorithm as well as a fully convexified optimization and a large part of the effort here is to linearize the constraints involved. Along the way, we also contribute a convex optimization to design optimal OCC H_2 gains.








plain        
           
                                 
                                 
                                 


                                 
                                 
                                 
                                 



























§ VALIDITY OF RELAXING THE LYAPUNOV EQUATION

Here we show more precisely the objective function 𝐭𝐫(C𝐏_xC^T) forces the relaxed inequality constraint (<ref>) to its boundary (equality), hence the optimization finds a solution that satisfies the original Lyapunov equation (<ref>). To see this, consider the function, 

    f(𝐏)=𝐏-Â𝐏Â^T-R̂.

and assume there exists matrices 𝐏≥ 0 a solution to the optimization (<ref>) and 𝐏̅≥ 0 a solution of the Lyapunov equation (<ref>) such that,

    f(𝐏)   =𝐏-Â𝐏Â^T-R̂≥ 0,
    
    f(𝐏̅)   =𝐏̅-Â𝐏̅Â^T-R̂ = 0.

The difference f(𝐏)-f(𝐏̅)≥ 0 is positive semi-definite, so it also satisfies a Lyapunov equation with stable Â which means,

    (𝐏 - 𝐏̅)-Â(𝐏-𝐏̅)Â^T - R̅ = 0,

for some R̅≥ 0. As the solution of a Lyapunov equation the difference 𝐏-𝐏̅≥ 0 is positive semi-definite, and so the first block corresponding to the states 𝐏_x - 𝐏̅_x ≥ 0 is positive semi-definite. Thus,

    C𝐏_x C^T    ≥ C𝐏̅_xC^T, 
    𝐭𝐫(C𝐏_xC^T)    ≥𝐭𝐫(C𝐏̅_xC^T).

In the absence of no constraints other than 𝒞_L, this inequality demonstrates that if the objective function 𝐭𝐫(C𝐏_xC^T) is minimized, that the solution satisfies the Lyapunov equation (<ref>), i.e., that the optimization forces the inequality in (<ref>) to equality. 








§ PROOF OF STABILITY
   
We show that the LMI constraints ℋ_L>0 and 𝒞_L>0 imply that the attacked system and nominal system are stable.

For ℋ_L, ℋ_L>0 implies ℋ>0 which implies 𝒫>0 and a𝒫-A^T𝒫A>0. Since a∈ [0,1), (1-a)𝒫+a𝒫-A^T𝒫A = 𝒫-A^T𝒫A>0. Thus, A^T, and hence, A is stable.

Similarly, for 𝒞_L, 𝒞_L>0 implies 𝒞>0 which implies 𝐏>0 and 𝐏-Â𝐏Â^T-R̂>0. Therefore, 𝐏-Â𝐏Â^T >0, which makes Â stable as well.



§ MANIFOLD OF 𝐏_X̂=𝐏_XX̂
 
We know that 𝐏𝐐=I which means,

    𝐏_x𝐐_1+𝐏_xx̂𝐐_12^T=I
       𝐏_x𝐐_12+𝐏_xx̂𝐐_2=0
       𝐏_xx̂^T𝐐_1+𝐏_x̂𝐐_12^T=0
       𝐏_xx̂^T𝐐_12+𝐏_x̂𝐐_2=I.

if we assume the points located on manifold (𝐏_x̂=𝐏_xx̂), Based on (<ref>) we can conclude, 𝐐_1=-𝐐_12 and based on (<ref>) we have

    𝐏_x̂ = 𝐏_x-𝐐_1^-1.

Based on e_k=x_k-x̂_k,

    𝐏_e=𝐏_x+𝐏_x̂-𝐏_xx̂-𝐏_xx̂^T,

where on the mentioned manifold,

    𝐏_e=𝐏_x-𝐏_x̂.

Comparing (<ref>) and (<ref>) we can conclude, 𝐏_e^-1=𝐐_1.



§ INFIMUM VALUE OF DESIRED PERFORMANCE ON THE MANIFOLD P_X̂=P_XX̂ 

To compute this infimum value, it suffices to introduce τ=γ̅^2, and obtain an optimal solution of τ from the convex optimization,

    {   min_a_1,𝐏_x,𝐐_1,ΠX,Y,Z, ττ
           s.t.   0≤ a_1< 1,    a_1+a_2 ≥ a,
               ℋ_L≥0, 𝒞_h≤ 0, 𝒞_L ≥ 0,
               𝒮_L≥0, 𝒳_L≥0,
    .

where a,a_2 ∈ [0, 1] are introduced as a grid search variables. Here we have replaced the objective function that minimizes the reachable set with an objective that minimizes γ̅ without penalty for increasing the reachable set size (either through the direct decision variables or through σ). The scaling factor σ for this optimization is fixed as a large value (to make the optimization feasible, but there is no need to solve for the smallest value of σ here).

For this case, the optimal γ̅=γ̅_c=7.75 and then based on the optimal gains L and K the actual performance is γ_c=5.66. The jump at γ_c in Figure <ref> is because the system becomes marginally stability.



§ EVALUATION OF OPTIMAL PERFORMANCE FROM THEOREM <REF> AND <REF> 


The cost we pay for linearization in this work is that the optimizations in Theorems <ref> and <ref>, unlike Theorem <ref>, cannot guarantee that constraints 𝒞_h and 𝒞_L meet their boundary perfectly due to the addition of other competing inequalities. Therefore, the solution of the decision variable 𝐏_x is slightly different from what would be computed from the Lyapunov equation (<ref>) using the solution gains K and L. Consequently the performance γ is different from γ̅. 

The 𝒞_h constraint, however, ensures that the actual performance, γ, will be smaller than the specified performance, γ̅.

Figure <ref> and Figure <ref> depict the difference between γ and γ̅ in the iterative and fully convexified optimizations, respectively. In addition, these figures can be used as a tool to determine what desired performance should be imposed on the linearized problem in order to receive expected performance in original nonlinear problem. 





























