Homomorphic encryption device and method for disclosing only specific information of control system

Abstract

The present invention relates to a homomorphic encryption device for disclosing only specific information of a control system. The homomorphic encryption device comprises: a ciphertext generation unit configured to generate a ciphertext by applying a predetermined encryption scheme to an input signal of the control system; a ciphertext modification unit configured to modify the ciphertext by adding a random vector designed such that a random component of the ciphertext becomes zero; and a disclosure unit configured to calculate a residue signal from the modified ciphertext in an encrypted state and disclose a specific component of the reside signal in plaintext.

Description

Homomorphic encryption device and method for disclosing only specific information of a control system

[0001] The present invention relates to a homomorphic encryption device and method that discloses only specific information of a control system.

[0002] Network control systems are increasingly likely to suffer serious physical damage due to rising cyber attacks, necessitating effective security measures. To address these threats, an encrypted control system has been proposed.

[0003] An encrypted control system utilizes homomorphic encryption to perform control operations on encrypted data without decryption, thereby maintaining security during all processes of transmitting or computing data at the network layer and protecting sensitive information.

[0004] However, there are limitations in detecting and responding to tampering attacks that may occur in encrypted control systems. One existing anomaly detection method is to generate a warning when a residual signal exceeds a threshold. However, since computing devices without secret keys can only use encrypted residual signals, it is difficult to directly detect tampering attacks. Additionally, while bootstrapping can be used to implement comparison operations between residual signals and thresholds on encrypted data, this entails a heavy computational burden and is inefficient, thus imposing limitations on the implementation of automated anomaly detection systems.

[0005] Therefore, to address these issues, a new method is needed to directly and efficiently detect tampering attacks even on computing devices without secret keys, and research is required to enhance the security and practicality of encrypted control systems through this.

[0006] The present invention has been devised to solve the above-mentioned problems, and the objective of the present invention is to provide a homomorphic encryption device and method that discloses only specific information (residual signal) of a control system.

[0007] A homomorphic encryption method for disclosing only specific information of a control system according to an embodiment of the present invention for achieving the above objective comprises: a step of generating a ciphertext by applying a predetermined encryption technique to an input signal of the control system; a step of modifying the ciphertext by adding a random number vector designed so that the random component of the ciphertext becomes 0; and a step of calculating a residual signal in an encrypted state from the modified ciphertext and disclosing a specific component of the residual signal as plaintext.

[0008] A homomorphic encryption device for disclosing only specific information of a control system according to an embodiment of the present invention for achieving the above objective comprises: a ciphertext generation unit that generates a ciphertext by applying a predetermined encryption technique to an input signal of the control system; a ciphertext modification unit that modifies the ciphertext by adding a random number vector designed so that the random component of the ciphertext becomes 0; and a disclosure unit that calculates a residual signal in an encrypted state from the modified ciphertext and discloses a specific component of the residual signal as plaintext.

[0009] According to one aspect of the present invention described above, by disclosing a residual signal of an encrypted control system in plaintext, an apparatus and method are provided for efficiently detecting tampering attacks without the need to implement comparison operations on the ciphertext, and security can be enhanced by minimizing the amount of data disclosed. Furthermore, while the present invention considers a situation in which information about the residual signal is disclosed, it can also be utilized to disclose other information depending on the application.

[0010] Furthermore, since tampering attack detection is possible in both static and dynamic control systems, it can be flexibly applied in various control system environments; and because the signal for anomaly detection is naturally exposed in plaintext without the introduction of additional computational processes, it becomes possible to detect and identify tampering attacks by entities that do not possess the secret key.

[0011] FIG. 1 is a schematic diagram showing a control system that detects tampering attacks through outlier detection based on a homomorphic encryption technique according to an embodiment of the present invention.

[0012] FIG. 2 is a diagram illustrating an internal block of a homomorphic encryption device according to an embodiment of the present invention,

[0013] And, FIG. 3 is a flowchart showing the process of disclosing only specific information of a homomorphic encryption device according to an embodiment of the present invention.

[0014] The following detailed description of the invention refers to the accompanying drawings, which illustrate specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that various embodiments of the invention are different but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in relation to one embodiment. It should also be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the invention is limited only by the appended claims, including all equivalents to those claimed therein, provided appropriately described. Similar reference numerals in the drawings refer to the same or similar functions across various aspects.

[0015] The components according to the present invention are defined by functional distinction rather than physical distinction, and can be defined by the functions each performs. Each component may be implemented as hardware or as program code and processing units that perform each function, and the functions of two or more components may be included and implemented in a single component. Therefore, it should be noted that the names assigned to the components in the following embodiments are not intended to physically distinguish each component but are assigned to imply the representative function performed by each component, and that the technical concept of the present invention is not limited by the names of the components.

[0016] Preferred embodiments of the present invention will be described in more detail below with reference to the drawings.

[0017] FIG. 1 is a schematic diagram showing a control system that detects tampering attacks through outlier detection based on a homomorphic encryption technique according to an embodiment of the present invention.

[0018] The illustrated control system includes an actuator (110), a controller (120), and a sensor (130).

[0019] The sensor (130) measures the system state and generates an output, and the generated output is encrypted and transmitted as the input y(t) of the controller (120). At this time, the generated data is encrypted using a representative encryption system, specifically an LWE (Learning With Errors) based encryption technique, where the LWE based encryption technique refers to a post-quantum cryptography technique that supports both addition and multiplication in the ciphertext.

[0020] That is, a message whose components are elements of the integer modular set Zq:={0,1,...,q-1} It is encrypted as shown in Equation 1 below through an LWE-based encryption technique.

[0021]

[0022] Here is a random number matrix, and is the secret key, and is the injected small error. The length of the secret key is a parameter that determines the security level.

[0023] The ciphertext of mathematical formula 1 is decrypted using a secret key as shown in mathematical formula 2 below.

[0024]

[0025] In this way, when a secret key is given, decrypting the ciphertext yields a value obtained by adding a small error e to the plaintext m.

[0026] The controller (120) calculates the state variable x(t) as a ciphertext, the output u(t), and the anomaly detection signal r(t) for anomaly detection based on the isomorphism, and these can be expressed as Equation 3 and Equation 4, respectively.

[0027]

[0028]

[0029]

[0030] In mathematical equations 3 and 4, matrices F, G, P, Q, H, and J are all assumed to be integer matrices.

[0031] Then, the controller (120) compares the anomaly detection signal r(t) as plaintext with a reference threshold, and if the magnitude of r(t) exceeds the reference threshold, it determines that a modulation attack has occurred and triggers an alarm.

[0032] Meanwhile, when the controller (120) calculates the anomaly detection signal r(t), the ciphertext r(t) can be expressed as in the following mathematical formula 5, and if the random number part Ar(t)·sk + er(t) can be forced to remain 0, the effect of naturally disclosing the anomaly detection signal r(t) as plaintext can be obtained.

[0033]

[0034] Here r(t) is a residual signal, and Ar(t) and er(t) are values ​​determined through Equations 3 and 4 from the initial value of the state variable x(0) as a ciphertext and the random part of the input y(t).

[0035] Below, through Figure 2, we will explain a method for naturally disclosing the residual signal of the anomaly detection signal r(t) as plaintext without a decoding process.

[0036] FIG. 2 is a diagram illustrating the internal blocks of a homomorphic encryption device according to an embodiment of the present invention.

[0037] The illustrated homomorphic encryption device includes a ciphertext generation unit (210), a ciphertext modification unit (220), and a disclosure unit (230).

[0038] The ciphertext generation unit (210) generates a ciphertext by applying a predetermined encryption method to the input signal of the control system. The predetermined encryption method may be, for example, an LWE-based encryption method, and it goes without saying that any other encryption method may be applied depending on the requirements and performance characteristics of the control system.

[0039] The ciphertext modification unit (220) modifies the ciphertext by adding a random number vector designed so that the random number component of the ciphertext becomes 0. At this time, the ciphertext modification unit (220) modifies the ciphertext in the static control system and the dynamic control system as follows.

[0040] First, in a static control system, the ciphertext modification unit (220) modifies the ciphertext by multiplying the ciphertext generated through the ciphertext generation unit (210) by a plaintext matrix and adding a random number vector belonging to the kernel space of the plaintext matrix. At this time, the random number vector is characterized by satisfying a vertical relationship with the plaintext matrix.

[0041] To explain this in more detail through a formula, the ciphertext modification unit (220) modifies the plaintext matrix Enc(m) generated through mathematical formula 1. Multiply by the following mathematical formula 6. At this time, the random number part A·sk + e, which corresponds to the random component in the ciphertext Enc(m), will be replaced with B for the explanation.

[0042]

[0043] Then, the ciphertext modification unit (220) modifies the ciphertext K·Enc(m) as in Equation 7 below so that Km is naturally revealed in the ciphertext K·Enc(m).

[0044]

[0045] Here is an element of vector B belonging to the kernel space of plaintext matrix K It can be expressed as follows, where the kernel space of K refers to the set of all vectors that become zero when multiplied by K. That is If it belongs to kernel space This always holds, and therefore can be considered as a vector perpendicular to K.

[0046] Meanwhile, Enc'(m), Enc(m), and Km are due to the equivalence of information Even if specific information such as [the text] is disclosed, it is impossible to reverse calculate the plaintext m or the secret key based on it, and through this, it can be seen that disclosing specific information does not affect security.

[0047] Next, in the dynamic control system, the ciphertext generation unit (210) generates a ciphertext by encrypting an initial state value and an input signal, and the ciphertext modification unit (220) modifies the ciphertext based on Zero-Dynamics. Before describing in detail the operation of the ciphertext generation unit (210) and the ciphertext modification unit (220), Zero-Dynamics will be briefly explained.

[0048] Zero-dynamics refers to the movement of the internal state z(t) when the output of the control system is maintained at zero, and is derived from the relationship between matrices F, G, H, and J in a linear dynamic system expressed as Equation 3. Additionally, when the output is maintained at zero, the state variable z(t) is described as movement in kernel space, which can be expressed as Equation 8 below.

[0049]

[0050] In this way, the control system separates the state x(t) into state variables z(t) and v(t) using the coordinate transformation matrix T according to the Byrnes-Isidori Normal Form, where z(t) is the state variable governing the zero-dynamics and v(t) is the state variable directly affecting the output. Finally, the dynamics in which the output r(t) of the control system maintains 0 are verified, and in this case, the zero-dynamics condition can be expressed as Equation 9 below.

[0051]

[0052] That is, in the dynamic control system, the ciphertext generation unit (210) separates the initial state value of the dynamic control system into a first state variable z (0) and a second state variable v (0), and applies a predetermined encryption technique, for example, an LWE-based encryption technique, to the first and second state variables and the input signal y (t) to derive an encrypted state variable and an input signal as shown in Equation 10 below.

[0053]

[0054] Then, the ciphertext generation unit (210) generates a ciphertext such as the following mathematical formula 11 using the encrypted state variable and input signal.

[0055]

[0056] Here, the message r(t) is determined by z(0), v(0), and y(t), and the random component Br(t) is determined by Bz(0), Bv(0), and By(t).

[0057] The ciphertext modification unit (220) modifies the random component Br(t) in the ciphertext to be zero by adjusting the random component to a value calculated based on the encrypted state variable and input signal so that the random component Br(t) in the ciphertext satisfies the zero-dynamic condition shown in Equation 12 below. At this time, the modified ciphertext for each of the encrypted state variable and input signal can be represented as Equation 13 below, and in this case, the output ciphertext can be represented as Equation 14 below.

[0058]

[0059]

[0060]

[0061]

[0062] The disclosure unit (230) calculates the residual signal in the modified ciphertext in an encrypted state and discloses a specific component r(t) of the residual signal as plaintext.

[0063] Additionally, although not illustrated, the illustrated homomorphic encryption device may further include a modulation attack detection unit, and the modulation attack detection unit detects a modulation attack by determining whether a modulation attack has occurred by comparing a specific component disclosed through the disclosure unit (230) with a reference threshold. At this time, if the magnitude of the specific component of the residual signal exceeds the threshold, the modulation attack detection unit determines that a modulation attack has occurred and triggers an alarm.

[0064] FIG. 3 is a flowchart illustrating the process of disclosing only specific information of a homomorphic encryption device according to an embodiment of the present invention.

[0065] The homomorphic encryption device generates a ciphertext by applying a predetermined encryption technique to the input signal of the control system. (S301)

[0066] Then, the homomorphic encryption device modifies the ciphertext by adding a random number vector designed such that the random component of the ciphertext generated in S301 becomes 0 (S303), calculates a residual signal in the modified ciphertext in an encrypted state, and discloses a specific component of the residual signal as plaintext (S305).

[0067] The homomorphic encryption method of the present invention, which discloses only specific information, can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., either individually or in combination.

[0068] The program instructions recorded on the above-mentioned computer-readable recording medium may be those specifically designed and configured for the present invention, or they may be those known and available to those skilled in the art of computer software.

[0069] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, and flash memory.

[0070] Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

[0071] Although various embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above. It is understood that various modifications can be made by those skilled in the art without departing from the essence of the invention as claimed in the claims, and such modifications should not be understood individually from the technical spirit or perspective of the present invention.

[0072] [Explanation of the symbol]

[0073] 110: Actuator

[0074] 120: Controller

[0075] 130: Sensor

[0076] 210: Ciphertext generation section

[0077] 220: Ciphertext Modifier

[0078] 230: Public section

Claims

1. A homomorphic encryption method that discloses only specific information of a control system, A step of generating a ciphertext by applying a predetermined encryption technique to the input signal of the above-mentioned control system; A step of modifying the ciphertext by adding a random number vector designed such that the random component of the ciphertext becomes 0; and A homomorphic encryption method comprising the step of calculating a residue signal in an encrypted state from the modified ciphertext and disclosing a specific component of the residue signal as plaintext.

2. In Paragraph 1, If the above control system is a static control system, The step of modifying the above ciphertext is, A homomorphic encryption method characterized by modifying the ciphertext by multiplying the ciphertext by a plaintext matrix and adding a random number vector belonging to the kernel space of the plaintext matrix, wherein the random number vector satisfies a vertical relationship with the plaintext matrix.

3. In Paragraph 1, If the above control system is a dynamic control system, The step of generating the above ciphertext is, A homomorphic encryption method comprising separating the initial state value of the dynamic control system into a first state variable and a second state variable, applying a predetermined encryption technique to the first and second state variables and an input signal, and generating a ciphertext using the first and second state variables and the input signal to which the encryption technique has been applied.

4. In Paragraph 3, The step of modifying the above ciphertext is, A homomorphic encryption method that modifies the random component to become zero by adjusting the random component to a value calculated based on the first and second state variables and input signals to which the encryption technique is applied, so that the random component within the ciphertext satisfies the Zero-Dynamics condition.

5. A homomorphic encryption device that discloses only specific information of a control system, A ciphertext generation unit that generates a ciphertext by applying a predetermined encryption technique to an input signal of the above-mentioned control system; A ciphertext modification unit that modifies the ciphertext by adding a random number vector designed so that the random component of the ciphertext becomes 0; and A homomorphic encryption device comprising: a disclosure unit that calculates a residue signal in the modified ciphertext in an encrypted state and discloses a specific component of the residue signal as plaintext.

Images