Co-Design of Cryptographic Parameters and Delay-Aware Feedback Gain for Encrypted Control Systems

1. Problem Statement

Context: Networked Control Systems (NCS) often outsource computation to remote servers, creating privacy risks where sensitive state data or control laws could be intercepted or inferred by semi-honest servers. Homomorphic Encryption (HE) is a promising solution, allowing computations on encrypted data without decryption.

The Challenge: Existing approaches typically design a controller in the plaintext domain first and then implement it using HE. This "post-design" approach is flawed because HE introduces non-negligible delays due to:

1. Communication: Ciphertexts are significantly larger than plaintexts, increasing transmission time.
2. Computation: Encryption, decryption, and homomorphic evaluation are computationally intensive.

These delays are functions of the cryptographic parameters (e.g., key size, modulus). If the delay is too large, it can degrade control performance or destabilize the closed-loop system. Current methods often ignore the coupling between security parameters and control stability.

Objective: To propose a co-design framework that jointly determines the cryptographic parameters ($\theta$) and the feedback gain ($K$) to satisfy three simultaneous requirements:

• Security: Meet a desired security level ($\lambda^*$).
• Delay Constraint: Ensure total delay ($\tau_\theta$) is less than the sampling time ($T_s$).
• Stability: Guarantee the stability of the closed-loop system under the induced delay.

---

2. Methodology

The paper utilizes an LWE-based (Learning With Errors) cryptosystem (specifically the BGV variant) and follows a structured mathematical approach:

A. Delay Quantification

The authors model the total delay $\tau_\theta$ as a function of cryptographic parameters $\theta = (N, q, \sigma)$, where $N$ is the key dimension, $q$ is the modulus, and $\sigma$ is the error standard deviation.
The total delay is decomposed into:
$$\tau_\theta = \tau_{Comm} + \tau_{Enc} + \tau_{Dec} + \tau_{\otimes}$$

• Communication Delay: Derived based on message size (ciphertext dimensions) and transmission rate $R$.
• Computation Delay: Derived from the asymptotic complexity of encryption, decryption, and homomorphic multiplication operations (summarized in Table 1 of the paper).

This yields an explicit upper bound $\bar{\tau}_\theta$ (Equation 11) dependent on $N$ and $q$.

B. System Modeling with Delay

The continuous-time plant $\dot{x} = Ax + Bu$ is controlled via a discrete-time static state feedback $u[k] = Kx[k]$.
Due to the delay $\tau_\theta$, the Zero-Order Hold (ZOH) input is updated with a lag. The system is discretized at sampling instants, resulting in an augmented state-space model:
$$\xi[k+1] = \bar{A}(\tau_\theta, K)\xi[k]$$
where $\xi[k] = [x[k]^\top, x[k-1]^\top]^\top$. The matrix $\bar{A}$ depends on the delay $\tau_\theta$.

C. Stability Analysis via LMIs

To ensure stability for any delay within the bound $[0, \bar{\tau}_\theta]$, the authors:

1. Express the delay-dependent matrix $\bar{A}(\tau_\theta, K)$ as a convex combination of vertex matrices using the Jordan form of $A$.
2. Derive a sufficient condition for Schur stability using a common quadratic Lyapunov function.
3. Formulate this condition as a finite set of Linear Matrix Inequalities (LMIs) (Equation 19). If a positive definite matrix $P$ exists satisfying these LMIs for the vertex matrices, the system is stable for all delays in the range.

D. Co-Design Algorithm (Outer-Inner Loop)

The solution is found via a tractable search procedure (Algorithm 1):

1. Outer Loop (Cryptographic Parameters): Iterate through a discrete set of candidate parameters $\Theta$ that satisfy the security requirement ($\lambda(\theta) \ge \lambda^*$).
2. Filtering: Discard any $\theta$ where the calculated delay bound $\bar{\tau}_\theta \ge T_s$.
3. Inner Loop (Feedback Gain): For valid $\theta$, check the feasibility of the LMIs for a finite set of candidate gains $\mathcal{K}$ (e.g., gains designed for the delay-free case).
4. Output: Return the first pair $(\theta, K)$ that satisfies all conditions.

---

3. Key Contributions

1. Delay Characterization: The paper provides a rigorous mathematical characterization of encryption-induced delays as an explicit function of cryptographic parameters ($N, q, \sigma$), bridging the gap between cryptography and control theory.
2. Delay-Aware Stability Condition: It derives a sufficient condition for stability in the form of a finite set of LMIs, accounting for the uncertainty of the exact delay within a known bound.
3. Co-Design Framework: Unlike previous works that treat security and control separately, this framework jointly optimizes security parameters and control gains. It acknowledges that higher security (larger $N, q$) increases delay, potentially requiring a different controller gain to maintain stability.
4. Tractability: By converting the infinite-dimensional stability problem (due to continuous delay) into a finite set of LMIs, the method becomes computationally tractable for practical implementation.

---

4. Simulation Results

The authors validated the method using a numerical example with a double-integrator plant ($A = [[0,1],[0,0]]$, $B = [0,1]^\top$) and a sampling time $T_s = 25$ ms.

• Setup: Target security level $\lambda^* = 128$ bits. Three candidate parameter sets ($\theta_1, \theta_2, \theta_3$) were tested.
• Delay Analysis:
  • $\theta_1$: $\bar{\tau} \approx 19.15$ ms (Satisfies $\tau < T_s$).
  • $\theta_2, \theta_3$: $\bar{\tau} > 80$ ms (Violates $\tau < T_s$).
• Controller Design:
  • Two gains ($K_1, K_2$) were designed for the delay-free case using pole placement.
  • Result for $K_1$: The LMIs were infeasible. Simulation showed the system became unstable when the actual delay reached $3/4$ of the bound.
  • Result for $K_2$: The LMIs were feasible. Simulation confirmed that $K_2$ stabilized the system for all delays up to the bound.
• Conclusion: The simulation demonstrated that a gain designed without considering encryption delays ($K_1$) fails, while a gain verified via the proposed co-design framework ($K_2$) ensures stability.

---

5. Significance and Impact

• Practical Viability: This work moves encrypted control from theoretical concepts to practical implementation by addressing the critical bottleneck of latency. It provides a concrete methodology for engineers to select encryption parameters that do not compromise system stability.
• Security-Stability Trade-off: It explicitly quantifies the trade-off: higher security levels require larger parameters, which increase delay, potentially forcing the controller to be more conservative or requiring a re-design of the gain.
• Future Direction: The paper lays the groundwork for "security-aware control," suggesting that future control system design must inherently include cryptographic constraints rather than treating them as an afterthought. The authors note that extending this to time-varying delays or optimizing the gain $K$ simultaneously with $P$ (non-convex problem) are areas for future research.