⚡ electrical engineering

Sensor Attack Detection Method for Encrypted State Observers

This paper proposes a homomorphic encryption-based state observer for general multi-input multi-output systems that detects sensor attacks and recovers encrypted states without decryption by generating a residue signal over a finite field of integers.

Original authors: Yeongjun Jang, Sangwon Lee, Junsoo Kim

Published 2026-05-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yeongjun Jang, Sangwon Lee, Junsoo Kim

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Locked Box" Problem

Imagine you have a very sensitive machine (like a power plant or a self-driving car) that needs to be controlled by a smart computer. To keep the machine safe from hackers, you want to send all the data to a "cloud" computer to do the math. But you don't trust the cloud computer, so you lock the data in a special encrypted box.

The problem is: You can't check if the machine is broken if the data is locked.
If a hacker tampers with the sensors (like lying about how fast the car is going), the cloud computer can't see the lie because the data is still locked. Usually, to check for lies, you have to unlock the box, look at the data, and then lock it again. But that defeats the purpose of keeping the data secret.

This paper proposes a new way to build the "cloud computer" so it can spot a liar without ever opening the box.

The Solution: The "Magic Receipt" System

The authors created a special system with three main tricks:

1. The "Modular Math" Playground

Usually, computers deal with infinite numbers. But to keep things locked, this system uses a "finite field," which is like a clock face.

Imagine a clock with numbers 0 to 100. If you add 100 to 50, you don't get 150; you get 50 again (because you wrapped around the clock).
The authors designed their observer (the part that guesses the machine's state) to work entirely on this "clock." This allows them to use a special type of encryption (Homomorphic Encryption) that lets the cloud computer do math on the locked numbers without unlocking them.

2. The "Redundant Witnesses"

Imagine you have 5 security guards watching a vault. If one guard is bribed (attacked) and lies, you might not know who is lying. But if you have 5 guards, and you know that at least 3 of them are honest, you can compare their stories.

The paper assumes the machine has enough sensors (witnesses) that even if a few are hacked, the rest are still telling the truth.
The system calculates the machine's state based on every possible combination of honest sensors. If the stories don't match up, something is wrong.

3. The "Magic Receipt" (The Residue Signal)

This is the most creative part.

Normally, if the cloud computer finds a mismatch between the guards' stories, it would have to unlock the box to tell you, "Hey, there's a problem!"
The authors modified the encryption so that the "mismatch" signal (called the residue signal) is printed on a special receipt that is not locked.
The Analogy: Imagine the cloud computer is a chef cooking a secret recipe. Usually, if the chef burns the food, they have to open the kitchen door to tell you. In this new system, the chef leaves a smoke signal outside the window. You don't need to see the food (the secret) to know it's burning; you just see the smoke.
The "smoke" (the residue signal) is generated automatically by the math. If the smoke is too thick, you know an attack is happening. If the smoke is thin, everything is fine.

How It Works Step-by-Step

Locking the Data: The machine sends its sensor data and control inputs to the cloud, but they are encrypted (locked).
The Cloud Does the Math: The cloud computer runs the "clock math" on the locked data. It tries to guess the machine's state.
The Automatic Alarm: Because of the special math design, the cloud computer automatically calculates the "mismatch" between the different sensor stories.
- If the sensors agree, the mismatch is tiny (just normal noise).
- If a hacker lies, the mismatch becomes huge.
The Result: The cloud sends back two things:
- The State Estimate (Locked): The best guess of what the machine is doing, still in a locked box.
- The Residue Signal (Unlocked): A simple number telling you if the sensors are lying.

Why This Matters

Security: You never have to give the cloud computer the "key" to unlock your data. The data stays secret the whole time.
Safety: You can instantly know if a sensor has been hacked. If the "smoke signal" goes off, you can stop the machine or switch to a backup plan before the hacker causes physical damage.
Versatility: Previous versions of this idea only worked for very simple machines (one input, one output). This paper proves it works for complex machines with many inputs and outputs (like a real industrial plant).

The Simulation Proof

The authors tested this on a simulated "three-inertia system" (a model of a mechanical system with spinning weights).

They locked the data.
They sent a fake attack signal to one of the sensors.
Result: The "smoke signal" (residue) immediately spiked, showing the attack, while the rest of the data remained perfectly encrypted and secure.

Summary

This paper invents a way to build a "smart, locked box" that can shout "INTRUDER!" without ever opening its mouth to reveal its secrets. It uses special clock math and redundant sensors to create an automatic alarm system that works entirely on encrypted data.

Technical Summary: Sensor Attack Detection Method for Encrypted State Observers

Problem Statement
In networked control systems, encrypted control utilizing homomorphic encryption (HE) allows computations to be performed on encrypted data, preserving confidentiality. However, a critical challenge arises in ensuring data integrity: encryption hides the effects of data corruption attacks, such as sensor attacks. Existing approaches to attack detection in encrypted systems typically require sending encrypted residue signals to an external detector holding the decryption key, which introduces communication overhead and potential security risks. Furthermore, previous work by the authors was limited to single-input single-output (SISO) systems. This paper addresses the need for an encrypted state observer capable of detecting sensor attacks directly without decryption, applicable to general multi-input multi-output (MIMO) systems.

Methodology
The proposed method integrates a state observer designed over a finite field of integers ( $\mathbb{Z}_q$ ) with a modified Learning With Errors (LWE) based homomorphic encryption scheme.

Observer Design over $\mathbb{Z}_q$ :
The authors first design a state observer operating over $\mathbb{Z}_q$ using modular arithmetic. The observer utilizes sensing redundancy and the assumption of sparse attacks (where at most $k$ out of $p$ sensors are compromised). By constructing partial observers for each sensor output and combining them, a full observer is formed. A specific residue signal, $\bar{r}(t)$ , is defined as the difference between state estimates derived from different subsets of sensors. Under the assumption that at least $p-k$ sensors are uncorrupted, a small residue signal indicates a valid state estimate, while a large residue signal indicates an attack. The observer matrices are scaled and quantized to ensure they remain integer-valued for encryption.
Modified Homomorphic Encryption Scheme:
To enable attack detection without decryption, the authors modify the standard LWE encryption scheme. The core innovation leverages the zero-dynamics of the MISO (Multi-Input Single-Output) system representation over $\mathbb{Z}_q$ .
- The system is decomposed into a normal form where the output (the residue) is driven by specific internal states.
- The encryption algorithm is altered to explicitly cancel out the "masking term" (the noise component that conceals the message) for the specific output channel corresponding to the residue signal.
- By enforcing the masking term of the encrypted residue to remain identically zero, the system automatically discloses the residue signal in a specific column of the ciphertext.
- This approach extends the authors' previous SISO work to general MIMO systems by applying the scheme repeatedly to each output channel.
Detection and Recovery:
The encrypted observer operates on encrypted inputs and states. The residue signal is recovered directly from the first column of the resulting ciphertexts by scaling, without requiring the secret key. If the magnitude of this recovered residue exceeds a prescribed threshold, a sensor attack is detected. Simultaneously, the full state can be recovered as an encrypted message by decrypting the observer's state.

Key Contributions

Direct Attack Detection without Decryption: The paper proposes a scheme where the residue signal, essential for anomaly detection, is automatically disclosed in the encrypted domain. This eliminates the need to transmit encrypted residues to a trusted third party for decryption.
Extension to MIMO Systems: Unlike previous work restricted to SISO systems, this method is applicable to general multi-input multi-output systems by handling arbitrary sparse sensor attacks through repeated application of the MISO-based scheme.
Zero-Dynamics Exploitation: The authors introduce a mechanism to modify standard LWE ciphertexts by leveraging the zero-dynamics of the observer, ensuring the masking term for the residue signal is nullified while maintaining the security of the underlying scheme.
Theoretical Guarantees: The paper provides conditions on scaling factors and the modulus $q$ to ensure that the residue signal accurately reflects the presence of attacks and that the state estimate error remains bounded when no attack is present.

Simulation Results
The method was validated through simulations on a three-inertia system (discretized from a model in Ogata (1995)).

Setup: The system had 6 states, 1 input, and 5 sensors. The encryption parameters were chosen to ensure 128-bit security.
Scenario: A sparse attack was injected into the third sensor at $t=2.5$ seconds.
Outcome: The simulation demonstrated that the encrypted observer successfully detected the attack. The recovered residue signal and the state estimation error both exceeded the theoretical thresholds defined in the paper immediately following the attack injection, confirming that attacks can be detected without accessing the secret key.

Significance and Claims
The paper claims that the proposed method achieves a balance between confidentiality and integrity in encrypted control systems. By disclosing only the residue signal (which represents the difference between state estimates and does not directly reveal the plant state), the method detects attacks without compromising the security of the standard LWE scheme beyond this intentional disclosure. The authors note that the residue signal is typically dominated by noise and model uncertainties, making it difficult for an adversary to extract meaningful private information solely from the disclosed signal. The work represents a step toward secure, resilient control where anomaly detection is integrated directly into the encrypted computation layer.