Cloud-based MPC with Encrypted Data

arXiv:1803.09891v1 [math.OC] 27 Mar 2018

Andreea B. Alexandru

Manfred Morari

Abstract— This paper explores the privacy of cloud outsourced Model Predictive Control (MPC) for a linear system
with input constraints. In our cloud-based architecture, a
client sends her private states to the cloud who performs the
MPC computation and returns the control inputs. In order
to guarantee that the cloud can perform this computation
without obtaining anything about the client’s private data, we
employ a partially homomorphic cryptosystem. We propose
protocols for two cloud-MPC architectures motivated by the
current developments in the Internet of Things: a client-server
architecture and a two-server architecture. In the first case, a
control input for the system is privately computed by the cloud
server, with the assistance of the client. In the second case,
the control input is privately computed by two independent,
non-colluding servers, with no additional requirements from
the client. We prove that the proposed protocols preserve the
privacy of the client’s data and of the resulting control input.
Furthermore, we compute bounds on the errors introduced
by encryption. We present numerical simulations for the two
architectures and discuss the trade-off between communication,
MPC performance and privacy.

I. I NTRODUCTION
The increase in the number of connected devices, as well
as their reduction in size and resources, prompted a growth in
the utilization of cloud-based services, in which a centralized
powerful server offers on demand storage, processing and
delivery capabilities to users. With the development of communication efficient algorithms, outsourcing computations to
the cloud becomes very convenient. However, issues regarding the privacy of the shared data arise, as the users have
no control over the actions of the cloud, which can leak or
abuse the data it receives.
Model Predictive Control (MPC) is a powerful scheme that
is successfully deployed in practice [1] for systems of varying dimension and architecture, including cloud platforms. In
competitive scenarios, such as energy generation in the power
grid, domestic scenarios, such as heating control in smart
houses, or time-sensitive scenarios, such as traffic control, the
control scheme should come with privacy guarantees to protect from eavesdroppers or malicious cloud. For instance, in
smart houses, client-server setups can be envisioned, where
a local trusted computer aggregates the measurements from
the sensors, but does not store their model and specifications
and depends on a server to compute the control input or
reference. The server can also posses other information, such
as the weather. In a heating application, the parameters of
This work was supported by NSF CNS-1505799 and the Intel-NSF
Partnership for Cyber-Physical Systems Security and Privacy.
The authors are with the Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA 19104. {aandreea,
morari, pappasg}@seas.upenn.edu.

George J. Pappas

the system can be known by the server, i.e., the energy
consumption model of the house, but the data measurements
and how much the owner wants to consume should be
private. In traffic control, the locations of the drivers, which
should remain private, are collected and processed at the
cloud level, e.g., in a two-server setup, which then sends the
result back to the cars or to traffic lights.
Although much effort has been dedicated in this direction,
a universally secure scheme that is able to perform locally,
at the cloud level, any given functionality on the users’
data has not been developed yet [2]. For a single user and
functionalities that can be described by boolean functions,
fully homomorphic encryption (FHE) [3], [4] guarantees
privacy, but at high storage and complexity requirements [5].
For multiple users, the concept of functional privacy is
required, which can be attained by functional encryption [6],
which was developed only for limited functionalities. More
tractable solutions that involve multiple interactions between
the parties to ensure the confidentiality of the users’ data
have been proposed. In client-server computations, where
the users have a trusted machine, called the client, that
performs computations of smaller intensity than the server,
we mention partially homomorphic encryption (PHE) [7] and
differential privacy (DP) [8]. In two-server computations, in
which the users share their data to two non-colluding servers,
the following solutions are available: secret sharing [9],
[10], garbled circuits [11], [12], Goldreich-Micali-Wigderson
protocol [13], PHE [14].
A. Contributions
In this paper, we discuss the implicit MPC computation
for a linear system with input constraints, where we privately
compute a stabilizing input, while maintaining the privacy of
the state, using a cryptosystem that is partially homomorphic,
i.e., supports additions of encrypted data. In the first case
we consider, the control input is privately computed by a
server, with the help of the client. In the second case, the
computation is performed by two non-colluding servers. The
convergence of the state trajectory to the reference is public
knowledge, so it is crucial to not reveal anything else about
the state and other sensitive quantitites. Therefore, we use a
privacy model that stipulates that no computationally efficient
algorithm run by the cloud can infer anything about the
private data, or, in other words, an adversary doesn’t know
more about the private data than a random guess. Although
this model is very strict, it thoroughly characterizes the loss
of information.
This work explores fundamental issues of privacy in

control: the trade-off between computation, communication,
performance and privacy. We present two main contributions:
proposing two privacy-preserving protocols for MPC and
evaluating the errors induced by the encryption.

matrices H and F in [30, Ch. 8,11]) in the variable
|
U := [u0 u1 . . . uN −1 ] .

B. Related work

Without fear of confusion, we keep the same notation for
the augmented constraint set U. After obtaining the optimal
solution, the first m components of U ∗ (x(t)) are applied
as input to the system (1): u∗ (x(t)) = (U ∗ (x(t)))1:m . This
problem easily extends to the case of following a reference.

In control systems, ensuring the privacy of the measurements and control inputs from eavesdroppers and from
the controller has been so far tackled with differential privacy, homomorphic encryption and transformation methods.
Kalman filtering with DP was addressed in [15], current
trajectory hiding in [16] and distributed MPC in [17]. The
idea of encrypted controllers was introduced in [18] and
expanded in [19], using PHE, and in [20] using FHE.
Kalman filtering with PHE was further explored in [21].
Optimization problems with DP are addressed in [22], [23]
and PHE in [24], [25], [26]. Many works proposed privacy
through transformation methods that use multiplicative masking. While the computational efficiency of such methods is
desirable, their privacy cannot be rigorously quantified, as
required by our privacy model, since the distribution of the
masked values is not uniform [27].
Recent work in [28] has tackled the problem of privately computing the input for a linear system with linear
constraints, in the client-server setup, in an explicit form
of MPC and using PHE. There, the client performs the
computationally and memory intensive trajectory localization
and sends the result to the server, which then evaluates the
corresponding affine control law on the encrypted state.
II. P ROBLEM SETUP
We consider a discrete-time linear time-invariant system:
x(t + 1) = Ax(t) + Bu(t),

(1)

1
U ∗ (x(t)) = argmin U | HU + U | F | x(t)
U ∈U 2

(3)

A. Solution without privacy requirements
The constraint set U is a hyperbox, so the projection step
required for solving (3) is simple and the optimization problem can be efficiently solved with the projected Fast Gradient
Method (FGM) [31], given in Algorithm 1. The objective
function is strongly convex, since H  0, therefore
√ we can
κ(H)−1
,
use the constant step sizes L = λmax (H) and η = √
κ(H)+1

where κ(H) the condition number of H.
A LGORITHM 1: Projected Fast Gradient Descent
Input: H, F, x(t), U, L, κ(H), η, U0 ∈ U , z0 = U0 , K
Output: UK (x(t))
1: for k=0. . . ,K-1 do
|
1
1
2:
tk = (IN
m − L H)zk − L F x(t)
i
i
i

−lu , if tk < −lu
i
3:
Uk+1
= tik ,
if tik ∈ [−lui , hiu ] , i = 1, . . . , N m

 hi ,
if tik > hiu
u
4:
zk+1 = (1 + η)Uk+1 − ηUk
5: end for

Warm starting can be used at subsequent time steps of
the receding horizon problem by using part of the previous
solution UK to construct a feasible initial iterate of the new
optimization problem.

with the state x ∈ X ⊆ Rn and the control input u ∈
U ⊆ Rm . The optimal control receding horizon problem
with constraints on the states and inputs can be written as:
!
N
−1
X
1
|
|
|
∗
xN P xN +
xk Qxk + uk Ruk
JN (x(t)) = min
u0,...,N −1 2
k=0

s.t. xk+1 = Axk + Buk , k = 0, . . . , N − 1

(2)

xk ∈ X , uk ∈ U, k = 0, . . . , N − 1
xN ∈ Xf , x0 = x(t),
where N is the length of the horizon and P, Q, R  0
are cost matrices. For reasons related to error bounding,
explained in Section VI, in this paper, we consider input
constrained systems: X = Rn , 0 ∈ U = {−lu  u  hu },
and impose stability without a terminal state constraint, i.e.
Xf = Rn , but with appropriately chosen costs P, Q, R
and horizon N such that the closed-loop system has robust
performance to bounded errors due to encryption, which will
be described in Section VI. A survey on the conditions for
stability of MPC is given in [29].
Through straightforward manipulations, (2) can be written as a quadratic program (see details on obtaining the

Fig. 1. Unsecure MPC: the system model A, B, horizon N and costs P , Q,
R are public. The state x(t), control input u∗ (t) and input constraints U are
privacy-sensitive. The red lines represent entities that can be eavesdropped.

B. Privacy objectives
The unsecure cloud-MPC problem is depicted in Figure 1.
The system’s constant parameters A, B, P, Q, R, N are public, motivated by the fact the parameters are intrinsic to the
system and hardware, and could be guessed or identified;
however, the measurements, control inputs and constraints
should be private. The purpose of this work is to design private cloud-outsourced versions of Algorithm 1 such that the

client obtains the control input u∗ (t) for system (1) with only
a minimum amount of computation. The cloud (consisting
of either one or two servers) should not infer anything else
than what was not known prior to the computation about
the measurements x(t), the control inputs u∗ (t) and the
constraints U. We tolerate semi-honest servers, meaning that
they correctly follow the steps of the protocol but may store
the transcript of the messages exchanged and process the
data received to try to learn more information than allowed.
To formalize the privacy objectives, we introduce the
privacy definitions that we want our protocols to satisfy,
described in [32, Ch. 3], [33, Ch. 7]. In what follows, {0, 1}∗
defines a sequence of bits of unspecified length. Given a
countable index set I, an ensemble X = {Xi }i∈I , indexed
by I, is a sequence of random variables Xi , for all i ∈ I.
Definition 1: The ensembles X = {Xn }n∈N and Y =
s
{Yn }n∈N are statistically indistinguishable, denoted ≡, if
for every positive polynomial p and all sufficiently large n,
the following holds, where Ω = Supp(X) ∪ Supp(Y ):
1X
|Pr[Xn = α] − Pr[Yn = α]| < 1/p(n).
2
α∈Ω
Two ensembles are called computationally indistinguishable if no efficient algorithm can distinguish between them.
This is a weaker version of statistical indistinguishability.
Definition 2: The ensembles X = {Xn }n∈N and Y =
{Yn }n∈N are computationally indistinguishable, denoted
c
≡, if for every polynomial-time algorithm D, every positive
polynomial p and all sufficiently large n, the following holds:

end, we use the encryption scheme defined in Section III.
Furthermore, we discuss in Section VI how we connect the
domain of the inputs in Definiton 3 with the domain of real
numbers needed for the MPC problem. In Sections IV and V,
we address two private cloud-MPC solutions that present a
trade-off between the computational effort at the client and
the total time required to compute the solution u∗ (t).
The MPC literature has focused on reducing the computational effort through computing a suboptimal solution
to implicit MPC [35], [36]. Such time optimizations, i.e.,
stopping criteria, reveal information about the private data,
such as how far is the initial point from the optimum or the
difference between consecutive iterates. Therefore, in this
work, we consider a given fixed number of iterations K,
and we will address private suboptimal MPC in future work.

|Pr[D(Xn ) = 1] − Pr[D(Yn ) = 1]| < 1/p(n).
The definition of two-party privacy says that a protocol
privately computes the functionality it runs if all information
obtained by a party after the execution of the protocol, while
also keeping a record of the intermediate computations, can
be obtained only from the inputs and outputs of that party.
2
2
Definition 3: Let f : ({0, 1}∗ ) → ({0, 1}∗ ) be a functionality, and fi (x1 , x2 ) be the ith component of f (x1 , x2 ),
i = 1, 2. Let Π be a two-party protocol for computing f . The
view of the ith party during an execution of Π on the inputs
(x1 , x2 ), denoted by ViΠ (x1 , x2 ), is (xi , coins, m1 , . . . , mt ),
where coins represents the outcome of the ith party’s internal
coin tosses, and mj represents the jth message it has
received. For a deterministic functionality f , we say that Π
privately computes f if there exist probabilistic polynomialtime algorithms, called simulators, denoted by Si , such that:

γ = lcm(p−1, q−1), δ = ((g γ mod Nσ2 −1)/Nσ )−1 mod Nσ .

c

{Si (xi , fi (x1 , x2 ))}x1,2 ∈{0,1}∗ ≡ {ViΠ (x1 , x2 )}x1,2 ∈{0,1}∗ .
When the privacy is one-sided, i.e., only the part of the protocol executed by party 2 has to not reveal any information,
the above equation has to be satisfied only for i = 2.
This definition holds under the correctness requirement,
i.e., the probability of the output of the parties not being
equal to the result of the functionality applied to the inputs
is negligible [34].
The purpose of the paper is to design protocols with the
functionality of Algorithm 1 that satisfy Definition 3. To this

III. PARTIALLY HOMOMORPHIC CRYPTOSYSTEM
Partially homomorphic encryption schemes can support
additions between encrypted data, such as Paillier [7] and
Goldwasser-Micali [37], DGK [38], or multiplications between encrypted data, such as El Gamal [39] and unpadded
RSA [40].
In this paper, we use the Paillier cryptosystem [7], which is
an asymmetric additively homomorphic encryption scheme.
The message space for the Paillier scheme is ZNσ , where Nσ
is a large integer that is the product of two prime numbers
p, q. The pair of keys corresponding to this cryptosystem
is (pk, sk), where the public key is pk = (Nσ , g), with g a
generator of the group ZNσ and the secret key is sk = (γ, δ):

For a message, called plaintext, a ∈ ZNσ , the Pailler
encryption primitive is defined as:
[[a]] := g a rNσ mod Nσ2 , with r random value in ZNσ .
The additively homomorphic property is that there exists an
operator ⊕ defined on the space of encrypted messages, with:
[[a]] ⊕ [[b]] = [[a + b]], ∀a, b ∈ ZNσ ,
where the equality holds in modular arithmetic, w.r.t. Nσ2 .
The decryption primitive is a homomorphism between the
group of encrypted messages, called ciphertexts, with the
operator ⊕ and the group of plaintext with addition +. The
scheme also supports subtraction between ciphertexts, and
multiplication between a plaintext and an encrypted message,
obtained by adding the encrypted messages for the corresponding (integer) number of times: b ⊗ [[a]] = [[ba]]. We
will use the same notation to denote encryptions, additions
and multiplication by vectors and matrices. A probabilistic
encryption scheme (that takes random numbers in the encryption primitive) does not preserve the order from the plaintext
space to the ciphertext space.
Proving privacy in the semi-honest model of a protocol
that makes use of cryptosystems involves the concept of
semantic security. Under the assumption of decisional composite residuosity [7], the Paillier cryptosystem is semantically secure and has indistinguishable encryptions, which,

in essence, means that an adversary cannot distinguish between the ciphertext [[a]] and a ciphertext [[b]] based on the
messages a and b [33, Ch. 5].
Definition 4: An encryption scheme with encryption
primitive E(·) is semantically secure if for every probabilistic polynomial-time algorithm, A, there exists a probabilistic
polynomial-time algorithm A0 such that for every two polynomially bounded functions f, h : {0, 1}∗ → {0, 1}∗ and for
any probability ensemble {Xn }n∈N , |Xn | ≤ poly(n), for
any positive polynomial p and sufficiently large n:
Pr [A(E(Xn ), h(Xn )) = f (Xn )] <
Pr [A0 (h(Xn )) = f (Xn )] + 1/p(n).
Cloud-based Linear Quadratic Regulator: We provide a
simple example of how the Paillier encryption can be used in
a private control application. If the problem is unconstrained,
i.e., U = Rm , a stabilizing controller can be computed as a
linear quadratic regulator [30, Ch. 8]. Such a controller can
be computed thoroughly by one server, with no extra communication. The client only sends the encrypted state [[x(t)]] to
the server, which recursively computes the plaintext control
gain and solution to the Discrete Riccati Equations, with
PN = P :

Notation: Given a floating-point quantity x ∈ R, we use
the notation x̄ for the corresponding quantity in fixed-point
representation on 1 sign bit, li integer and lf fractional bits.
We introduce a client-server model, depicted in Figure 2.
We present an interactive protocol that privately computes the
control input for the client, while maintaining the privacy of
the state in Protocol 2. The Paillier encryption is not order
preserving, so the projection operation cannot be performed
locally by the server. Hence, the server sends the encrypted
iterate [[tk ]] for the client to project it. Then, the client
encrypts the feasible iterate and sends it back to the cloud.
Here, the fixed-point representation of the coefficients
is used and we postpone the discussion on how they are
obtained to Section VI. Since only integer values can be
¯ from the iterates in order to not
encrypted, we drop the (·)
burden the notation.

Fk = −(B | Pk+1 B)−1 B | Pk+1 A, k = N − 1, . . . , 0
Pk = A| Pk+1 A + Q + A| Pk+1 BFk ,

Fig. 2.

Private client-server MPC setup for a plant.

∗

[[u (t)]] = F0 ⊗ [[x(t)]].
The server obtains the encrypted control input and returns it
to the client, which decrypts and inputs it to the system.
To summarize, PHE allows a party that does not have the
private key to perform linear operations on encrypted integer
data. For instance, a cloud-based Linear Quadratic Controller
can be computed entirely by one server, because the control
action is linear in the state. Nonlinear operations are not
supported within this cryptosystem, but can be achieved with
communication between the party that has the encrypted
data and the party that has the private key, and we will
use this in Sections IV and V. When the party that has the
private key is not the owner of the data, a statistically secure
symmetric encryption that also supports linear operations on
the encrypted data is used, achieved by adding a sufficiently
large random noise to the private data.
IV. C LIENT-S ERVER ARCHITECTURE
To be able to use the Paillier encryption, we need to represent the messages on a finite set of integers, parametrized
by Nσ , i.e., each message is an element in ZNσ . Usually,
the values less than Nσ /3 are interpreted to be positive, the
numbers between 2Nσ /3 and Nσ to be negative, and the rest
of the range allows for overflow detection. In this section and
Section V, we consider a fixed-point representation of the
values and perform implicit multiplication steps to obtain
integers and division steps to retrieve the true values. We
analyze the implications of the fixed-point representation
over the MPC solution in Section VI.

P ROTOCOL 2: Encrypted projected Fast Gradient Descent
in a client-server architecture
Input: C: x(t), Kc , Kw , li , lf , Ū, pk, sk; S: H̄f , F̄ , η̄, Kc , Kw , li ,
lf , pk, cold-start, [[Uw ]]
Output: C: u = (UK (x(t)))1:m
1: C: Encrypt and send [[x(t)]] to S
2: if cold-start then
3:
S: [[U0 ]] = [[0N m ]]; C, S: K ← Kc
4: else
5:
S: [[U0 ]] = {[[(Uw )m+1:N m ]], [[0m ]]}; C, S: K ← Kw
6: end if
7: S: [[z0 ]] = [[U0 ]]
8: for k=0. . . ,K-1 do
9:
S: [[tk ]] = (IN m − H̄f ) ⊗ [[zk ]] ⊕ (−F̄f| ) ⊗ [[x(t)]] and
send it to C
10:
C: Decrypt tk and truncate to lf fractional bits
11:
C: Uk+1 = ΠŪ (tk )
. Projection on Ū
12:
C: Encrypt and send [[Uk+1 ]] to S
13:
S: [[zk+1 ]] = (1 + η̄) ⊗ [[Uk+1 ]] ⊕ (−η̄)[[Uk ]]
14: end for
15: C: Decrypt and output u = (UK )1:m

Theorem 1: Protocol 2 achieves privacy as in Definition 3
with respect to a semi-honest server.
Proof: The initial value of the iterate does not give
any information to the server about the result, as the final
result is encrypted and the number of iterations is a priori
fixed. The view of the server, as in Definition 3, is composed
of the server’s inputs, the messages exchanged, which are
all encrypted, and no output. We construct a simulator
which replaces the messages with random encryptions of
corresponding length. The proof follows from the semantic

security (see Definition 4) of the Paillier cryptosystem, which
was proved in [7], and is equivalent to having computationally indistinguishable encryptions. Thus, the server cannot
learn anything from the messages it receives, and the view
of the simulator is computationally indistinguishable from
the view of the server.
Although the client needs to store and process substantially
less data than the server, the computational requirements
might be too stringent, as the encryption and decryptions can
become expensive for large values of K and Nσ . In such a
case, we outsource the problem to two servers, and the only
requirement from the client is to encrypt x(t) and send it to
one server and decrypt the received the result [[u∗ ]].
V. T WO - SERVER ARCHITECTURE
In this setup, depicted in Figure 3, the client is exempt from all the computations, and the existence of two
non-colluding servers is assumed. The communication delay
between the two servers can be made arbitrarily small.

The reason we use two pairs of keys is so the client and
support server do not have the same private key.
P ROTOCOL 3: Encrypted projected Fast Gradient Descent
in a two-server architecture
Input: C : x(t), pk1,2 , sk2 ; S1 : H̄f , F̄ , η̄, Kc , Kw , li , lf , pk1,2 ,
cold-start, [[Uw ]]; S2 : Kc , Kw , li , lf , pk1,2 , sk1 , cold-start
Output: C: u = (UK (x(t)))1:m
1: C: Encrypt and send [[x(t)]], [[hu ]], [[−lu ]] to S1
2: if cold-start then
3:
S1 : [[U0 ]] ← [[0N m ]]; S1 , S2 :K ← Kc
4: else


5:
S1 : [[U0 ]] ← [[(Uw )m+1:N m ]], [[0m ]] ; S1 , S2 :K ← Kw
6: end if
7: S1 : [[z0 ]] ← [[U0 ]]
8: for k=0. . . ,K-1 do
9:
S1 : [[tk ]] ← (IN m − H̄f ) ⊗ [[zk ]] ⊕ (−F̄f| ) ⊗ [[x(t)]]
10:
S1 : [[tk ]] ← truncate [[tk ]]
11:
S1 : ak , bk ← randomize [[tk ]], [[hu ]]
12:
S1 , S2 : DGK s.t. S2 obtains (βk = 1) ≡ (ak ≤ bk )
13:
S1 : Pick rk , sk and send [[ak ]] ⊕ [[rk ]], [[bk ]] ⊕ [[sk ]] to S2
14:
S2 : Send back [[βk ]] and [[vk ]] ← [[ak + rk ]] + [[0]] if
15:
16:
17:
18:
19:
20:
21:
22:

Fig. 3.

βk = 1 or [[vk ]] ← [[bk + sk ]] + [[0]] if βk = 0
S1 : [[Uk+1 ]] ← [[vk ]] ⊕ sk ⊗ ([[βk ]] ⊕ [[−1]]) ⊕ rk ⊗ [[βk ]]
. Uk+1 ← min(tk , hu )
S1 , S2 : Redo 11–15 to get [[Uk+1 ]] ← max(Uk+1 , −lu )
S1 : [[zk+1 ]] ← (1 + η̄) ⊗ [[Uk+1 ]] ⊕ (−η̄)[[Uk ]]
end for
S1 : Pick ρ and send [[(UK )1:m ]] ⊕ [[ρ]] to S2
S2 : Decrypt, encrypt with pk2 and send to S1 : [{u + ρ}]
S1 : [{u}] ← [{u + ρ}] ⊕ [{−ρ}] and send it to C
C: Decrypt and output u

Private two-server MPC setup for a plant.

As before, we need an interactive protocol to achieve the
projection. We use the DGK comparison protocol, proposed
in [38], [41], such that, given two encrypted values of l bits
[[a]], [[b]] to S1 , after the protocol, S2 , who has the private
key, obtains a bit (β = 1) ≡ (a ≤ b), without finding
anything about the inputs. Moreover, S1 finds nothing about
β. We augment this protocol by introducing a step before
the comparison in which S1 randomizes the order of the
two values to be compared, such that S2 does not know the
significance of β with respect to the inputs. Furthermore,
by performing a blinded exchange, S1 obtains the maximum
(and minimum) value of the two inputs, without any of the
two servers knowing what the result is. The above procedure
is performed in lines 11–16 in Protocol 3. More details can
be found in [26].
The comparison protocol works with inputs that are represented on l bits. The variables we compare are results of
additions and multiplications, which can increase the number
of bits, thus, we need to ensure that they are represented on
l bits before inputting them to the comparison protocol. This
introduces an extra step in line 10 in which S1 communicates
with S2 in order to obtain the truncation of the comparison
inputs: S1 adds noise to tk and sends it to S2 which decrypts
it, truncates the result to l bits and sends it back. S1 then
subtracts the truncated noise.
In what follows, we will denote by [[·]] a message encrypted with pk1 and by [{·}] a message encrypted by pk2 .

The random numbers in lines 13 and 19 are chosen from
(0, 2l+λσ ) ∩ ZNσ , which ensures statistical indistinguishability of the sum of the random number and the private value
and a random number of equivalent length [42].
Theorem 2: Protocol 3 achieves privacy as in Definition 3,
under the assumption that the two semi-honest servers do not
collude.
Proof: The view of S1 is composed by its inputs and
exchanged messages, and no output. All the messages the
first server receives are encrypted (the same holds for the
subprotocol DGK). Furthermore, in line 14, an encryption
of zero is added to the quantity S1 receives such that the
encryption is re-randomized and S1 cannot recognize it.
Due to the semantic security of the cryptosystems, the view
of S1 is computationally indistinguishable from the view
of a simulator which follows the same steps as S1 , but
replaces the incoming messages by random encryptions of
corresponding length.
The view of S2 is composed by its inputs and exchanged
messages, and no output. Apart from the comparison bits,
the latter are always blinded by noise that has at least λσ
bits more than the private data being sent. For λσ chosen
appropriately large (e.g. 100 bits [42]), the following is true:
s
a + r ≡ r0 , where a is a value of p bits, r is the noise chosen
uniformly at random from (0, 2p+λσ )∩ZNσ and r0 is a value
chosen uniformly at random from (0, 2p+λσ +1 )∩ZNσ . In the
DGK subprotocol, a similar blinding is performed, see [43].
Crucially, the noise selected by S1 is different at each

iteration. Hence, S2 cannot extract any information by combining messages from multiple iterations, as they are always
blinded by a different large enough noise. Moreover, the
randomization step in line 11 ensures that S2 cannot infer
anything from the values of βk , as the order of the inputs
is unknown. Thus, we construct a simulator that follows the
same steps as S2 , but instead of the received messages, it randomly generates values of appropriate length, corresponding
to the blinded private values, and random bits corresponding
to the comparison bits. The view of such a simulator will be
computationally indistinguishable from the view of S2 .
Through communication, encryption and statistical blinding, the two servers can privately compute nonlinear operations. However, the increase in time is substantial due to
the extra encryptions and decryptions and communication
exchanges, as will be pointed out in Section VII.
Remark 1: One can expand Protocols 2 and 3 over multiple time steps, such that Uw is obtained from the previous
iteration and not given as input, and formally prove their
privacy. The fact that the state will converge to a neighborhood of the origin is public knowledge, and is not revealed
by the execution of the protocol. Protocols for following a
private set point can be derived. In this case, the value the
state converges to will be hidden; however, the difference
between the measurement and corresponding reference will
again converge to a neighborhood of zero.
VI. F IXED - POINT ARITHMETICS MPC
The values that are encrypted or added to or multiplied
with encrypted values have to be integers. We consider
fixed-point representations with li integer bits and lf fractional bits and multiply them by 2lf to obtain integers.
Working with fixed-point representations can lead to overflow, quantization and arithmetic round-off errors. Thus,
we want to compute the deviation between the fixed-point
solution and optimal solution of Algorithm 1. The bounds
on this deviation can then be used in an offline step prior to
the online computation to choose an appropriate fixed-point
precision for the performance of the system.
We need to preserve the feasibility of the fixed-point
precision solution and to ensure that the strong convexity
of the fixed-point objective function will still hold and the
fixed-point step size will be such that the FGM converges.
Assumption 1: The number of fractional bits lf and constant c ≥ 1 are chosen large enough such that:
(i) Ū ⊆ U: the fixed-point precision solution is still feasible.
(ii) The eigenvalues of the fixed-point representation H̄f are
contained in the set (0, 1], where
Hf := H̄/(cL̄) and L̄ := λmax (H̄).
The constant c is required in order to overcome the
possibility that (1/L̄)H̄ has the maximum eigenvalue
larger than 1 due to fixed-point arithmetic errors.
(iii) The fixed-point representation of the step size satisfies:
q
 . q

0≤
κ(H̄) − 1
κ(H̄) + 1 ≤ η̄ < 1.

Overflow errors: Bounds on the infinity-norm on the
fixed-point dynamic quantities of interest in Algorithm 1
were derived in [44] for each iteration k, and depend on
a bounded set X0 such that x(t) ∈ X0 and x̄(t) ∈ X¯0 :
||Ūk+1 ||∞ ≤ max{||¯lu ||∞ , ||h̄u ||∞ } = RŪ
||z̄k+1 ||∞ ≤ (1 + 2η̄)RŪ := ζ,
||t̄k ||∞ ≤ ||IN m − H̄f ||∞ ζ + ||F̄f ||∞ RX¯0 ,
where Ff = F̄ /(cL̄) and RS represents the radius of a set
S w.r.t. the infinity norm. We select from these bounds the
number of integer bits li such that there is no overflow.
A. Difference between floating-point and fixed-point solution
We want to determine a bound on the error between the
fixed-point precision solution and the floating-point nominal
solution. The total error is composed of the error induced
by having fixed-point coefficients and variables in the optimization problem, and by the round-off errors. Specifically,
denote by UK the solution in exact arithmetic of the MPC
problem (3) obtained after K iterations of Algorithm 1.
Furthermore, denote by ŨK the solution obtained after
K iterations but with H, F, x(t), U, L, η replaced by their
fixed-point representations. Finally, denote by ŪK the solution of Protocols 2 and 3 after K iterations, where some of
the variables have fixed-point representation, i.e, truncations
are performed. We obtain the following upper bound on the
solution obtained on the encrypted data and the nominal
solution of the implicit MPC problem (3) after K iterations:
||ŪK − UK ||2 ≤ ||ŨK − UK ||2 + ||ŪK − ŨK ||2 .
1) Quantization errors: Consider problem (3) where the
coefficients are replaced by the fixed-point representations of
the matrices H/(cL), F/(cL), of the vector x(t) and of the
set U, but otherwise the iterates Ũk , t̃k , z̃k are real values.
We will use the following observation to investigate the
quantization error bounds. Define a = ā − a and b = b̄ − b.
Then, āb̄ − ab = āb̄ − āb + āb − ab = a b + āb .
Consider iteration k of the projected FGM. The errors
induced by quantization of the coefficients between the
original iterates and the approximation iterates will be:
t̃k − tk = − Hf zk + (IN m − H̄f )z,k − F x
q
ξk+1
:=Ũk+1 − Uk+1 = Dkq (t̃k − tk )

z̃k+1 − zk+1 =η ∆Uk + (1 +

q
η̄)ξk+1

−

(4)

η̄ξkq ,

where we used the notation: ∆Uk = Uk+1 −Uk ; η = η̄ − η;
Hf = H̄f − H/(cL); F x = F̄f| x̄(t) − F | x(t)/(cL) =
|Ff x(t) + F̄f x ; x = x̄(t) − x(t); Ff = F̄f − F/(cL).
The error between Ũk+1 and Uk+1 is reduced from t̃k −tk
due to the projection on the hyperbox. Hence, in order to
q
obtain ξk+1
, we multiply t̃k − tk by the diagonal matrix Dkq
that has positive elements at most one.
q
We set ξ−1
= ξ0q . From (4), we can derive a recursive
iteration that characterizes the error of the primal iterate, for
k = 0, . . . , K, which we can write as a linear system:


(1 + η̄)Dkq (IN m − H̄f ) −η̄Dkq (IN m − H̄f )
Ã(Dkq ) :=
IN m
0N m



−Hf Dkq η Dkq (IN m − H̄f )
:=
0N m
0N m
 q 

 q 

ξk
ξk+1
zk
q
q
=
Ã(D
)
+
B̃(D
)
− F x .
q
k
k
ξk−1
∆Uk−1
ξkq

B̃(Dkq )

(5)

We choose this representation in order to have a relevant
error bound in Theorem 3 that shrinks to zero as the number
of fractional bits grows. In the following, we find an upper
bound of the error using Ã := Ã(IN m ) and B̃ := B̃(IN m ).
Theorem 3: Under Assumption 1, the system defined
by (5) is bounded. Furthermore, the norm of the error
between the primal iterates of the original problem and of
the problem with quantized coefficients is bounded by:
||ξkq ||2 ≤ E Ãk
+ζ

k−1
X

ξ0q
q
ξ−1


2

E Ãk−1−l
2

l=0


+γ

k−1
X

2

E Ãk−1−l B̃

l=0

+
2

√
=: 1 ; γ = (3 + 2η̄) N mRŪ ,

√
ζ = ||Ff ||2 RX0 + 2−lf n||F̄f ||2 ,
where E = [IN m 0N m ], RX0 is the radius of the compact
set X0 w.r.t. the 2-norm and RU = max{||lu ||∞ , ||hu ||∞ }.
Proof: The inner stability of the system is given by the
fact that Ã has spectral radius ρ(Ã) < 1 which is proven in
Lemma 1 in [44]. The same holds for Ã(Dkq ). Since we want
to give a bound of the error in terms of computable values,
we use the fact that ||Ã(Dkq )||2 ≤ ||Ã||2 (resp., ||B̃(Dkq )||2 ≤
||B̃||2 ) and express the bounds in terms of the latter.
From (5), one can obtain the following expression for the
errors at time k and k − 1, for k = 0, . . . , K − 1:


ξkq

q
ξk−1


≤ Ã

k

 k−1
 


X
zl
ξ0q
k−1−l
B̃
+
Ã
− F x ,
r
ξ−1
∆Ul−1



l=0

and the first term goes to zero as k → ∞. We multiply this
by E = [IN m 0N m ] to obtain the expression of ||ξkq ||.
Subsequently, for any 0 ≤ k ≤ K − 1:
 |
| |
zk ∆Uk−1
= ||zk ||2 + ||∆Uk−1 ||2 ,
2

2) Arithmetic round-off errors: Let us now investigate
the error between the solution of the previous problem
and the solution of the fixed-point FGM corresponding to
Protocols 2 and 3. The encrypted values do not necessarily
maintain the same number of bits after operations, so we will
consider round-off errors where we perform truncations. This
happens in line 10 in both protocols. In this case, we obtain
similar results to [44], where the quantization errors were not
analyzed, i.e., as if the nominal coefficients of the problem
were represented with lf fractional bits. Consider iteration k
of the projected FGM. The errors due to round-off between
the primal iterates of the two solutions will be:
t̄k − t̃k =(IN m − H̄f )(z̄k − z̃k ) + 0t,k
r
ξk+1
:=Ūk+1 − Ũk+1 = Dkr (t̄k − tk )

z̄k+1 − z̃k+1 =(1 +

r
η̄)ξk+1

−

(6)

η̄ξkr .

Again, the projection on the hyperbox reduces the error, so Dkr has positive diagonal elements less than one.
For Protocol 2, the round-off error due to truncation is
(0t,k )i ∈ [−N m2−lf , 0], i = 1, . . . , N m. The encrypted
truncation step in Protocol 3 introduces an extra term,
making (0t,k )i ∈ [−(1 + N m)2−lf , 2−lf ].
r
We set set ξ−1
= ξ0r . From (6), we can derive a recursive
iteration that characterizes the error of the primal iterate,
which we can write as a linear system, with Ã(·) as before:
 r 
 r 
ξk+1
ξk
r
+ Dkr 0t,k
(7)
=
Ã(D
)
r
k
ξk−1
ξkr
Theorem 4: Under Assumption 1, the system defined
by (7) is bounded. Furthermore, the norm of the error of
the primal iterate is bounded by:
 r
k−1
X
ξ0
0
||ξkr ||2 ≤ E Ãk
+
γ
E Ãk−1−l =: 2 ,
r
ξ−1 2
2
2
l=0
√
3
0
0
= 2−lf N m(1 + N m).
γCS
=2−lf (N m) 2 ; γSS

||F x ||2 ≤ ||Ff ||2 ||x(t)||2 + ||F̄f ||2 ||x ||2
√
≤ ||Ff ||2 RX0 + 2−lf n||F̄f ||2 := ζ.

The proof is straightforward.
As before, one can eliminate the initial error ξ0r and its
effect by choosing the same initial iterate represented on lf
fractional bits for both problems.
Remark 3: As lf → ∞, 1 → 0 and 2 → 0. The persistent noise in (5) and (7), which is composed by quantization
errors and round-off errors, becomes zero when the number
of fractional bits mimics a floating-point representation. This
makes systems (5) and (7) input-to-state stable.

One can eliminate the initial error ξ0q and its effect by
choosing in both exact and fixed-point coefficient-FGM
algorithms the initial iterate to be represented on lf fractional
bits. Therefore, only the persistent noise counts.
Remark 2: In primal-dual algorithms, the maximum values of the dual variables corresponding to the complicating
constraints cannot be bounded a priori, i.e., we cannot
give overflow or coefficient quantization error bounds. This
justifies our focus on a problem with only simple input
constraints. The work in [45] considers the bound on the
dual variables as a parameter that can be tuned by the user.

B. Choice of error level
For every instance of problem (2), the error bound can be
computed as a function of the number of fractional bits lf .
We can incorporate these errors as bounded disturbances
d(·) in system (1): d(t) = Bξ(t), where ξ(t) = u∗ (t) −
ū(t). Then, we can design the terminal cost as described
in [35], such that the controller achieves inherent robust
stability to process perturbations ||d(t)||2 ≤ δ, and choose:
δ
. Alternatively, we can assume that we
 = 1 + 2 ≤ ||B||
∗
obtain a cost J¯N (x(t), ŪK ) ≤ JN
(x(t)) + 0 , and compute
 such that asymptotic stability is achieved as in [46].

≤ ||Uk + η̄∆Uk−1 ||2 + ||∆Uk ||2 ≤ RU + 2(1 + η̄)RU
q
≤ (3 + 2η̄) N m(max{lui , hiu })2 := γ
i

Therefore, in the offline phase, the fixed-point precision of
the variables and parameters (the number of integer bits li
and the number of fractional bits lf ) is chosen such that there
is no overflow and one of the conditions on  is satisfied.
Note that these conditions can be overly-conservative.
Remark 4: Instead of the FGM, we can use the simple
gradient descent method, where fewer errors accumulate, and
less memory is needed, but more iterations are necessary to
reach to the optimal solution.
Once li and lf have been chosen, we can pick Nσ such
that the there is no overflow in Protocol 2 and Protocol 3,
respectively. In Protocol 2, truncation cannot be done on
encrypted data by the server, thus, the multiplications by
2lf are accumulated between zk and tk , which means that
tk is multiplied by 23lf . Hence, we choose Nσ such that
li + 3lf + 2 < log2 (Nσ /3) holds. For Protocol 3 we pick
Nσ such that li +3lf +3+λσ < log2 (Nσ /3) holds, where λσ
is the statistical security parameter. If the Nσ that satisfies
these requirements is too large, one should use the simple
gradient method, which will have multiplications up to 22lf .

The larger the number of fractional bits, the larger is
the execution time, because the computations involve larger
numbers and more bits have to be sent from one party to
another. Communication is the reason for the significant
slow-down observed in the two-server architecture compared
to the client-server architecture. Performing the projection
with PHE requires l communication rounds, where l is the
number of bits of the messages compared. Privately updating
the iterates also requires another communication round.
However, the assumption is that the servers are powerful
computers, and the execution time can be greatly improved
using parallelization and more efficient data structures.

VII. N UMERICAL RESULTS

Therefore, privacy comes at the price of complexity:
hiding the private data requires working with large encrypted
numbers, and the computations on private data require communication. Furthermore, the more parties that need to be
oblivious to the private data (two servers in the second
architecture compared to one server in the first architecture),
the more complex the private protocols become.

The number of bits in the representation is crucial for
the performance of the MPC scheme. At the same time, a
more accurate representation slows down the private MPC
computation. In Figure 4, for a toy two-by-two unstable
system, we show the comparison between the predicted
theoretical error bounds from Theorems 3 and 4 and the
norm of the actual errors between the control input obtained
with the client-server protocol and the control input of the
unencrypted MPC, for a time step of MPC with 33 iterations.
The results are similar for the two-server protocol.
10 4

Errors

10 2

10 0

10 -2
Predicted l f=8
Actual l f=8

10 -4

Predicted l f=16
Actual l f=16

10 -6

0

5

10

15

20

25

30

Iterations

Fig. 4. Difference between predicted and actual errors for the control input
computed in Protocol 2 over one time step.

We implemented the above two protocols for various
problem sizes. Table I shows the computation times for
Protocols 2 and 3 for li = 16 integer bits and lf ∈ {16, 32}
fractional bits. We fix the number of iterations to 50. The
times obtained vary linearly with the number of iterations,
so one can approximate how long it would take to run a
different number of iterations. The size of the Nσ for the
encryption is chosen to be 512 bits. The computations have
been effectuated on a 2.2 GHz Intel Core i7.

lf
CS 16
CS 32
SS 16
SS 32

n=2
m=2
1.21
1.33
23.27
31.21

n=5
m=5
4.08
5.20
59.81
91.74

n = 10
m = 10
13.38
15.46
123.19
170.62

n = 20
m = 20
39.56
53.48
261.75
372.42

n = 50
m = 30
84.28
105.84
457.87
579.38

TABLE I
T IME IN SECONDS FOR THE EXECUTION OF P ROTOCOLS 2, 3.

VIII. C ONCLUSION
In this paper, we have presented two methods to achieve
the private computation of the solution to cloud-outsourced
implicit MPC, through additively homomorphic encryption.
The client, which is the owner of a linear-time discrete
system with input constraints, desires to keep the measurements, the constraints and the control inputs private.
The cloud can be composed by one or two servers. It
knows the parameters of the system and has to relieve the
computation, i.e., solving the optimization problems, from
the client in a private manner. The first method proposes
an architecture where the computation is split between the
client and one server. The client encrypts the current state
with a PHE scheme, and performs the nonlinear operations
(the projection on the constraints), while the server performs
the rest of the computations needed to solve the optimization
problem via the fast gradient method. Secondly, we propose
a two-server architecture, in which the client is exempt
from any computations apart from encrypting the state and
decrypting the input. The two servers engage in a protocol
to solve the optimization problem and use communication
to perform the nonlinear operations on encrypted data. We
prove that both protocols are private for semi-honest servers.
In order to use encryptions, we map the real values to
rational fixed-point values. We analyze the errors introduced
by the associated quantization and round-off errors and give
upper bounds which can be used to choose an appropriate
precision that corresponds to performance requirements on

the MPC. Furthermore, we implement the two proposed
protocols and perform numerical tests.
The two architectures proposed in this paper offer insights
for a more common architecture met in practice of multiple
clients and one server, which we will consider in future work.
R EFERENCES
[1] D. Q. Mayne, “Model predictive control: Recent developments and
future promise,” Automatica, vol. 50, no. 12, pp. 2967–2986, 2014.
[2] M. Van Dijk and A. Juels, “On the impossibility of cryptography alone
for privacy-preserving cloud computing.” HotSec, vol. 10, pp. 1–8,
2010.
[3] C. Gentry, “A fully homomorphic encryption scheme,” Ph.D. dissertation, Department of Computer Science, Stanford University, 2009.
[4] Z. Brakerski and V. Vaikuntanathan, “Fully homomorphic encryption
from ring-lwe and security for key dependent messages,” in Annual
International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2011, pp. 505–524.
[5] T. Pöppelmann, M. Naehrig, A. Putnam, and A. Macias, “Accelerating
homomorphic evaluation on reconfigurable hardware,” in International Workshop on Cryptographic Hardware and Embedded Systems.
Springer, 2015, pp. 143–163.
[6] D. Boneh, A. Sahai, and B. Waters, “Functional encryption: Definitions and challenges,” in Theory of Cryptography Conference.
Springer, 2011, pp. 253–273.
[7] P. Paillier, “Public-key cryptosystems based on composite degree
residuosity classes,” in Annual International Conference on the Theory
and Applications of Cryptographic Techniques. Springer, 1999, pp.
223–238.
[8] C. Dwork, “Differential privacy: A survey of results,” in International
Conference on Theory and Applications of Models of Computation.
Springer, 2008, pp. 1–19.
[9] A. Shamir, “How to share a secret,” Communications of the ACM,
vol. 22, no. 11, pp. 612–613, 1979.
[10] J. Algesheimer, J. Camenisch, and V. Shoup, “Efficient computation
modulo a shared secret with application to the generation of shared
safe-prime products,” Advances in Cryptology, pp. 417–432, 2002.
[11] A. C. Yao, “Protocols for secure computations,” in 23rd Annual
Symposium on Foundations of Computer Science. IEEE, 1982, pp.
160–164.
[12] M. Bellare, V. T. Hoang, and P. Rogaway, “Foundations of garbled
circuits,” in Conference on Computer and Communications Security.
ACM, 2012, pp. 784–796.
[13] O. Goldreich, S. Micali, and A. Wigderson, “How to play any mental
game,” in Proceedings of the19th annual ACM symposium on Theory
of computing. ACM, 1987, pp. 218–229.
[14] Z. Erkin, T. Veugen, T. Toft, and R. L. Lagendijk, “Generating private
recommendations efficiently using homomorphic encryption and data
packing,” IEEE Transactions on Information Forensics and Security,
vol. 7, no. 3, pp. 1053–1066, 2012.
[15] J. Le Ny and G. J. Pappas, “Differentially private filtering,” IEEE
Transactions on Automatic Control, vol. 59, no. 2, pp. 341–354, 2014.
[16] F. Koufogiannis and G. J. Pappas, “Differential privacy for dynamical
sensitive data,” in 56th Annual Conference on Decision and Control.
IEEE, 2017, pp. 1118–1125.
[17] M. Zellner, T. T. De Rubira, G. Hug, and M. Zeilinger, “Distributed
differentially private model predictive control for energy storage,”
IFAC-PapersOnLine, vol. 50, no. 1, pp. 12 464–12 470, 2017.
[18] K. Kogiso and T. Fujita, “Cyber-security enhancement of networked
control systems using homomorphic encryption,” in 54th Annual
Conference on Decision and Control. IEEE, 2015, pp. 6836–6843.
[19] F. Farokhi, I. Shames, and N. Batterham, “Secure and private control
using semi-homomorphic encryption,” Control Engineering Practice,
vol. 67, pp. 13–20, 2017.
[20] J. Kim, C. Lee, H. Shim, J. H. Cheon, A. Kim, M. Kim, and
Y. Song, “Encrypting controller using fully homomorphic encryption
for security of cyber-physical systems,” IFAC-PapersOnLine, vol. 49,
no. 22, pp. 175–180, 2016.
[21] Z. Xu and Q. Zhu, “A secure data assimilation for large-scale sensor
networks using an untrusted cloud,” IFAC-PapersOnLine, vol. 50,
no. 1, pp. 2609–2614, 2017.
[22] E. Nozari, P. Tallapragada, and J. Cortes, “Differentially private
distributed convex optimization via functional perturbation,” IEEE
Transactions on Control of Network Systems, 2016.

[23] S. Han, U. Topcu, and G. J. Pappas, “Differentially private distributed
constrained optimization,” IEEE Transactions on Automatic Control,
vol. 62, no. 1, pp. 50–64, 2017.
[24] Y. Shoukry, K. Gatsis, A. Alanwar, G. J. Pappas, S. A. Seshia,
M. Srivastava, and P. Tabuada, “Privacy-aware quadratic optimization
using partially homomorphic encryption,” in 55th Conference on
Decision and Control. IEEE, 2016, pp. 5053–5058.
[25] N. M. Freris and P. Patrinos, “Distributed computing over encrypted
data,” in 54th Annual Allerton Conference on Communication, Control,
and Computing. IEEE, 2016, pp. 1116–1122.
[26] A. B. Alexandru, K. Gatsis, and G. J. Pappas, “Privacy preserving
cloud-based quadratic optimization,” in 55th Annual Allerton Conference on Communication, Control, and Computing. IEEE, 2017, pp.
1168–1175.
[27] S. de Hoogh, “Design of large scale applications of secure multiparty
computation: secure linear programming,” Ph.D. dissertation, Eindhoven University of Technology, 2012.
[28] M. S. Darup, A. Redder, I. Shames, F. Farokhi, and D. Quevedo,
“Towards encrypted mpc for linear constrained systems,” IEEE Control
Systems Letters, vol. 2, no. 2, pp. 195–200, 2018.
[29] D. Q. Mayne, J. B. Rawlings, C. V. Rao, and P. O. Scokaert,
“Constrained model predictive control: Stability and optimality,” Automatica, vol. 36, no. 6, pp. 789–814, 2000.
[30] F. Borrelli, A. Bemporad, and M. Morari, Predictive control for linear
and hybrid systems. Cambridge University Press, 2017.
[31] Y. Nesterov, Introductory lectures on convex optimization: A basic
course. Springer Science & Business Media, 2013, vol. 87.
[32] O. Goldreich, Foundations of Cryptography: Volume 1, Basic Tools.
Cambridge University Press, 2003.
[33] ——, Foundations of Cryptography: Volume 2, Basic Applications.
Cambridge University Press, 2004.
[34] Y. Lindell, “How to simulate it–a tutorial on the simulation proof
technique,” in Tutorials on the Foundations of Cryptography. Springer
International Publishing, 2017, pp. 277–346.
[35] G. Pannocchia, J. B. Rawlings, and S. J. Wright, “Inherently robust
suboptimal nonlinear MPC: theory and application,” in 50th Conference on Decision and Control and European Control. IEEE, 2011,
pp. 3398–3403.
[36] S. Richter, C. N. Jones, and M. Morari, “Computational complexity
certification for real-time mpc with input constraints based on the fast
gradient method,” IEEE Transactions on Automatic Control, vol. 57,
no. 6, pp. 1391–1403, 2012.
[37] S. Goldwasser and S. Micali, “Probabilistic encryption & how to play
mental poker keeping secret all partial information,” in Proceedings of
the 14th annual Symposium on Theory of Computing. ACM, 1982,
pp. 365–377.
[38] I. Damgård, M. Geisler, and M. Krøigaard, “Efficient and secure
comparison for on-line auctions,” in Australasian Conference on
Information Security and Privacy. Springer, 2007, pp. 416–430.
[39] T. El Gamal, “A public key cryptosystem and a signature scheme based
on discrete logarithms,” in Workshop on the Theory and Application
of Cryptographic Techniques. Springer, 1984, pp. 10–18.
[40] R. L. Rivest, L. Adleman, and M. L. Dertouzos, “On data banks and
privacy homomorphisms,” Foundations of secure computation, vol. 4,
no. 11, pp. 169–180, 1978.
[41] I. Damgård, M. Geisler, and M. Krøigaard, “A correction to “Efficient
and secure comparison for on-line auctions”,” International Journal
of Applied Cryptography, vol. 1, no. 4, pp. 323–324, 2009.
[42] R. Bost, R. A. Popa, S. Tu, and S. Goldwasser, “Machine learning
classification over encrypted data,” in NDSS, 2015.
[43] T. Veugen, “Improving the DGK comparison protocol,” in International Workshop on Information Forensics and Security. IEEE, 2012,
pp. 49–54.
[44] J. L. Jerez, P. J. Goulart, S. Richter, G. A. Constantinides, E. C.
Kerrigan, and M. Morari, “Embedded online optimization for model
predictive control at megahertz rates,” IEEE Transactions on Automatic
Control, vol. 59, no. 12, pp. 3238–3251, 2014.
[45] P. Patrinos, A. Guiggiani, and A. Bemporad, “Fixed-point dual gradient projection for embedded model predictive control,” in European
Control Conference (ECC). IEEE, 2013, pp. 3602–3607.
[46] L. K. McGovern and E. Feron, “Closed-loop stability of systems driven
by real-time, dynamic optimization algorithms,” in 38th Conference on
Decision and Control, vol. 4. IEEE, 1999, pp. 3690–3696.

