Critical Observability Enforcement in Discrete-event Systems Using Differential Privacy

In the context of discrete-event systems (DESs), critical states usually refer to a system configuration of interest, describing certain important system properties, e.g., fault diagnosability, state/language opacity, and state/event concealment. Technically, a DES is critically observable if an intruder can always unambiguously infer, by observing the system output, whether the plant is currently in a predefined set of critical states or the current state set is disjoint with the critical states. In this paper, given a partially observable DES modeled with a finite-state automaton that is not critically observable, we focus on how to make it critically observable, which is achieved by proposing a novel enforcement mechanism based on differential privacy (DP). Specifically, we consider two observations, where one cannot determine whether a system is currently in the predefined critical states (i.e., the observation violating the critical observability), while the other is randomly generated by the system. When these two observations are processed separately by the differential privacy mechanism (DPM), the system generates an output, exposed to the intruder, that is randomly modified such that its probability approximates the two observations. In other words, the intruder cannot determine the original input of a system by observing its output. In this way, even if the utilized DPM is published to the intruder, he/she is unable to identify whether critical observability is violated.