11institutetext: School of Mathematics and Computer Science,
Computational Foundry, Swansea University,
Bay Campus, Fabian Way,
Swansea, SA1 8EN, United Kingdom
11email<EMAIL_ADDRESS><EMAIL_ADDRESS>School of Criminology and Criminal Justice,
Portsmouth University,
St George s Building, 141 High Street,
Portsmouth, PO1 2HY, United Kingdom
22email<EMAIL_ADDRESS>
# On human-centred security: A new systems model based on modes and mode
transitions

Edwin J Beggs 11 John V Tucker 11 Victoria Wang 22

###### Abstract

We propose an abstract conceptual framework for analysing complex security
systems using a new notion of modes and mode transitions. A mode is an
independent component of a system with its own objectives, monitoring data,
algorithms, and scope and limits. The behaviour of a mode, including its
transitions to other modes, is determined by interpretations of the mode’s
monitoring data in the light of its objectives and capabilities – these
interpretations we call beliefs. We formalise the conceptual framework
mathematically and, by quantifying and visualising beliefs in higher-
dimensional geometric spaces, we argue our models may help both design,
analyse and explain systems. The mathematical models are based on simplicial
complexes.

Keywords. security scenarios, critical incidents, explainable systems,
hierarchical systems, modes, mode transitions, belief functions, simplicial
complexes

##  1 Introduction

Security, like safety, is defined by a human context. When studying a software
system with a specification, its security is more than a matter of the
evaluation of its correctness relative to its specification. What it does in
human situations, seen and unforeseen, and the possible consequences matter.
Thus, ultimately, security is judged outside the technical world of the system
and its specification. Developing this point about security further, of
importance for security are critical incidents in which harm to people are
possible, immanent or current. The security of a system is intimately
connected with expectations and assumptions about the wider human-centred
systems it serves: cyber security involves more than cyber.

Here, we address the question:

How can we accommodate some human aspects of security systems? Can we develop
conceptual frameworks and systematic methods for modelling security systems
and their operation in a human context?

In seeking some general theory for security, we turn to general system
theories and emphasise the role of scenarios in which systems and people
relate. General system theory is a loosely defined (huge) portfolio of
conceptual frameworks and models for all sorts of complex systems, whose ideas
try to capture: how systems are made up of components; how components
cooperate; and how systems and components perform in their respective
environments. Common to all complex systems is the role of data about the
behaviour of systems and their environments. Notably, ideas from general
system theory are to be found in our everyday language, as well as in our
technical methodologies for designing systems both physical, virtual and
human.

Specifically, we offer a new general system model whose central ideas are
those of (i) modes of operation, (ii) interpretations of monitoring data and
beliefs about the fitness of modes, (iii) protocols for changing modes, and
(iv) the transparency of these features (i)-(iii). Our new model will be
described informally by means of working definitions and principles so that
the flexibility and scope of its basic concepts can be best appreciated. Then
it will formalised by mathematical models that nail down algebraically the
relations between the modes as they are determined by data about the
environment. In particular, the algebraic models will be quantified and
visualised geometrically.

###  1.1 Tools for thinking about security systems

Our systems are a mix of equipment, software tools, and people – the latter
organised into teams and also acting as individuals. These are bound together
and animated by data and communications. Structurally, complex systems are
made of modular and hierarchical components that are autonomous, yet are
cooperative, adaptable and responsive to situations – especially the
individuals, depending upon their degree of professional discretion. Any of
these components can – and in practice do – fail in some way. The design and
performance of such systems in the real world are not easy to specify,
measure, predict or audit.

In security, threats and risks change both in their nature and perceived
importance. Significant social and economic disruption can have many causes,
such as failures of infrastructures and services, or lack of information.
(Extreme weather conditions exemplify such disruptions.) However, our
societies are held together by data and software. Thus, cyber failures, and
attacks where the objective is to make some software components fail, are
always meaningful threats to many aspects of contemporary everyday life, and
never far away from national security.

In this paper, we will address system design in human contexts, almost from
first principles. We propose an abstract conceptual framework for analysing
systems using a new notion of mode and mode transitions. A mode is an
independent active component of the system with its own objectives, monitoring
data, algorithms, and scope and limits for action. The behaviour of a mode,
including its transitions to other modes, is determined by interpretations of
the mode’s monitoring data and capabilities in the light of its objectives;
these we will term beliefs. Crucially, a mode may no longer be fit for purpose
and need to be changed to another mode. A system can be in several modes at
once.

We formalise the conceptual framework mathematically and, by visualising the
beliefs arising from evaluating a mode’s monitoring data in higher-dimensional
geometric spaces, we argue our theoretical approach and models may help to
explore, design, predict, and explain system behaviour. The various
mathematical models are based on mathematical objects called abstract and
concrete simplicial complexes.

To demonstrate the framework, we apply our models to three security
situations:

(i) triage for a large set of data about individuals in order to classify
‘persons of interest’;

(ii) mapping the potential causes and effects of a cyber security incident;

(iii) examining a multiagency response to a critical incident, using the UK
Gold-Silver-Bronze command structure.

These types of scenario are commonly associated with Tier 1 – high priority –
risks in national security audits in the UK [18].

###  1.2 Structure of this paper

This paper has general theoretical aims whose new contributions, and their
location, are:

1\. To reflect on scenarios and their part in the security systems
specification (Section 2 and 5).

2\. To define general concepts and principles for a conceptual framework to
model systems using ideas about modes and mode transitions (Section 3).

3\. To create geometric structures to visualise changes of beliefs about the
behaviour of systems over time (Section 3).

4\. To turn the conceptual framework into a rigorous mathematical theory that
enables quantification and evaluation of the reasons and beliefs behind
decision making (Section 3 and the Appendix).

5\. To apply these general methods in three security scenarios (Section 4).

6\. To reflect on possible next steps (Section 5).

In the matter of 5, we explain the mathematical ideas through examples; the
general mathematical definitions of simplicial complex and belief function are
given in the Appendix. A general mathematical introduction to modes and their
theory is our [6]; there, our early thinking about modes was shaped by
modelling autonomous physical systems.

###  1.3 Acknowledgments

The authors would like to acknowledge the support by UK’s Accelerated
Capability Environment ACE-C391 National Security Tech Surprise.

##  2 Human-centred security systems

To begin, we observe that human aspects of security are commonly expressed
through scenarios.

###  2.1 Responding to security incidents

Central to security are scenarios for critical incidents against which the
security of the system can be explored. By a security scenario we have in mind
(i) a hypothetical situation that involves potential threats and
vulnerabilities or (ii) a description of a real-life situation, past or
present, that manifested threats and revealed vulnerabilities. Of particular
importance are scenarios containing critical incidents. A critical incident
creates an outcome or consequence that is of significant harm to an
individual, community, or business, or to public confidence, broadly
interpreted. Any critical incident arising from a system’s operation calls for
one or more other systems to respond and contain damage, make repairs and
restore operation.

A security scenario should contain information necessary to identify
parameters that enable a relevant actor to simulate potential threats
effectively, with the aim of being ready to prevent, prepare for, detect and
respond to critical security incidents. These scenarios typically belong to
security professionals, staff and managers of organisations, and policy
makers. Scenario-based research is common in cybersecurity. For example, the
major role scenarios play in cybersecurity testbed development, as well as in
cybersecurity testing for experimental and educational purposes has been
thoroughly discussed in the systematic literature review [20].

Scenarios are themselves classified using ideas about risk, e.g., likelihood,
impact and mitigation. For example, the UK National Security Strategy [7] is
based on the assessment of many security scenarios. In the methodology
section, the document comments the “plausible worst-case scenario of each risk
was then scored in terms of its likelihood and its potential impact. In order
to compare the likelihood of one risk against another and to make relative
judgements, these plausible worst-case scenarios were plotted on a matrix
([7], p. 4).

###  2.2 Critical incidents and the Gold-Silver-Bronze command structure of
the UK

In responding to a critical incident, many types of agencies and
organisations, with their specialist units and systems, may be called upon to
collaborate and cope with an unknown and unfolding situation. Concepts and
working principles, based on experience, are needed for this to work
effectively. Such frameworks must ‘cage the incident’ in order to initialise
and develop a response; they must also be known and understood by the
participating agencies and organisations. In the UK, such frameworks for a
diverse set of government agencies and services have been created, used and
exercised for decades. To pick one example, relevant to a later case study, a
glimpse of these frameworks can be found in the Home Office’s Critical
incident management for staff of Border Force, Immigration Enforcement and UK
Visas and Immigration [12].

In the UK, the Gold-Silver-Bronze (GSB) command structure is used for major
operations by the emergency services [12]. The structure was originally
created by the Metropolitan Police Service, as a direct response to the
Broadwater Farm Riot on the 6 October 1985 [3]. Assessing their responses
during this riot, the Metropolitan Police came to the realisation that their
traditional rank-based command system was inappropriate and inefficient in
dealing with sudden events. (Particularly, on the night of the riot, it was
not clear who was actually in charge of the actual operational procedures of
the police.)

Thus, the GBS is a role-based system that assigns three different level of
command according to skill, expertise, location and competency.111In some
cases, the national government (via the Cabinet Office Briefing Rooms) assume
ultimate control and act as a fourth, platinum level (Home Office, 2021). The
three levels are strategic, tactical and operational command structures.

Briefly, the Gold Commander is responsible for the strategic direction and has
overall control of the resources at the incident. Instead of on site, the Gold
Commander is in a distant control room formulating the strategy for dealing
with the incident.

Silver Commanders are the seniors in charge of their own organisations
resources available at the scene. They are responsible for the tactical
coordination, deciding on how to use their resources to achieve the strategic
aims of the Gold Commander. Like the Gold Commander, they are also not
directly involved in dealing with an incident itself. At the scene of the
incident, they will work closely with the Silver Commanders of other
organisations, operating from a purpose-built command vehicle or makeshift
command room(s), known as the Joint Emergency Services Control Centre (JESCC).

The Bronze Commanders are responsible for the operational implementation,
directly controlling their organisations resources at the incident and working
with colleagues at the scene of the incident. Bronze Commanders may share
responsibilities and tasks in complex incidents and assume responsibility for
different areas, if an incident is widespread geographically.

During the initial stages of an incident, the first member of the first
organisation to arrive at the incident temporarily assumes the role of Silver
or Bronze Commander until relieved by a more senior member of their
organisation. It is noteworthy that these three roles are not restricted to
ranks, though invariably the chain of command will follow the order of rank.

Although the GSB command structure was originally devised to respond to sudden
major incidents, it spread-out in all police forces and emergency services,
and has been frequently used in pre-planned operations (e.g., the policing of
football matches or firearms operations (cf. [12]).

##  3 Modes and their visualisation

Modes decompose and categorise the various objectives and behaviours of a
system. A mode collects relevant data and applies algorithms to govern the
behaviour and external communication.

###  3.1 What is a mode?

Here is a working definition to begin building the conceptual framework:

###### Definition 1

Consider a system $S$ operating in an environment $E$. A mode of the system
$S$ is defined by these characteristics:

1\. A mode is associated to, or determines, a subset of the possible states of
the system.

2\. A mode is designed to deliver on objectives for the system when in these
states.

3\. A mode consists of

(a) methods to input data from the environment $E$ and to output data to $E$.

(b) data types and algorithms for implementing the objectives.

4\. A mode has means to evaluate its performance against its objectives and,
if necessary, choose and transfer to another mode.

Thus, a mode is responsible for specific aspects of the system’s performance.
These may be high-level, primary objectives and purposes of the system, or
lower-level technical services. It may be autonomous or a platform for
accessing other modes. Each mode owns its relationship with the environment.

###  3.2 Principles for designing modes

With the initial intuitions of Definition 1 in mind, we can formulate some
design principles to develop a conceptual framework for thinking about systems
in terms of modes and mode transitions.

Completeness. A set of modes for a system is a classification of the operation
or behaviour of a system. At any time, a system can be in one, or more, modes.

Composition. When a system is in a number of modes then that situation itself
constitutes a mode.

Component. A set of modes for a system consists of (i) a set of basic modes
and (ii) joint modes made by combining other modes.

Localisation. Each mode possesses its own data to monitor its behaviour and
environment. This monitoring data determines a local state space called the
evidence space of the mode that represents what its modes can know.

Thus, knowledge of the system at any time is localised to the modes at that
time.

Globalisation. What the system can know about its environment is a synthesis
of what its modes can know of the environment through their monitoring data.
By combining the evidence spaces, an idealised global state space for the
system is possible for reasoning.

Quantification. If a state of the system is meaningful for a number of modes
then the relevance or suitability of these modes for the state of the system
must be quantified, calibrated and interpreted.

Visualisation. With quantification and calibration comes the possibility of
visualisation via geometric objects drawn to scale and via derived qualitative
diagrams.

Shortly, we will show how to visualise in space the basic modes by vertices,
and the joint modes arising by combining them as lines, triangles, tetrahedra
etc. The geometric objects we build are called simplicial complexes.
Simplicial complexes are made up of geometric pieces called faces.

Modes and faces. In a successful system model using modes, every face of its
simplicial complex is a mode and every mode is represented by a face.

Quantification can take the form of a position in the space representing the
suitability of the mode for the state of the system, in a line or triangle or
tetrahedron, etc. representing the joint mode.

Belief. The position on a face is computed by belief functions that from a
state of the system calculates a measure of the relevance of other modes to
that state.

In the time evolution of the system we need to decide

(i) if, and when, a system should change from one mode to another, and

(ii) which new mode should chosen.

Thresholds. The transition out of one mode into another is governed by the
results of the quantification and calibration. The decision to move to a new
mode may be specified by numerical thresholds. Transition has these stages:

(a) the realisation that the mode is approaching its limitations

(b) the selection of modes that could be more appropriate

(c) triggers to choose and change to a new mode.

The belief functions, in computing relevance, are a means to trigger changes
of mode.

Explanation. The conceptual system of modes, belief functions, mode
evaluation, thresholds and mode transition functions, and their visual
representation in simplicial complexes, can serve as an explanatory framework
for the dynamical behaviour of automatic systems.

In particular, the position and path over time (trajectory) in the simplicial
complex visualises the dynamics of decision making by the system.

###  3.3 Simple security examples

We consider some simple examples to begin to shape our informal ideas of a
system of modes, the evaluation of beliefs and how they might be visualised.

judgement of monitoring
datainterventionincomingcallspoliceambulancefiretriggeringan actiontriage
foremergency services Figure 1: Visualising a mode transition for a trigger
mechanism and triage for emergency services

######  Example 1 (A simple trigger)

In Figure 1, the left diagram represents visually a trigger for action that
has three modes: two vertices and one line. Consider the line between a mode
that makes judgements of some attribute using data from monitoring the
environment (the point at the top of the interval) and the mode that performs
an intervention (the point at the bottom). Unlike a usual state transition
graph, where lines merely represent transitions or jumps, here the line itself
represents a mode where the decision to intervene unfolds according to its
monitoring data. These observations are formed into a numerical quantification
of beliefs about the state of the system and visualised as points along the
line, beginning at the top and moving to the bottom. Threshold points on the
line begin to warn, and then trigger, a change of mode; on reaching the
bottom, the intervention begins.

A witness can note the position along the line to see how things were going,
and perhaps be reassured that the course of action was progressing correctly.
Such a point on a line indicator is quite a common visualisation (e.g., as
with a progress bar that simply estimates time taken for a task to be
completed). Here, however, the line indicator is displaying the an
interpretation of information which the control system is actually using to
make decisions. If the point is near the top, then a witness knows that the
control system has no intention of intervening because they are looking
directly at the system’s own assessment of the situation. ∎

In this example, we see that a key to the transparency of decision making is
continuity. We do not discontinuously move between vertices on a graph, but
have a continuous motion in a geometric visualisation, which allows an
estimate of what the system is about to do and when. We make a general
comparison between visualising system change using complexes versus graphs in
the Appendix, Section 6.5.

Of course, another key to transparency is reliability, that what we see is
really related to the state of the system. This means that the geometry of the
visualisation must be intimately related to how the system actually makes
decisions.

######  Example 2 (A simple emergency)

In the second diagram of Figure 1, we consider a notification that warns of a
possible incident – such as personal attack, social disturbance, or collision
of vehicles. In general, the incident could involve some or all of the primary
first responders of police, fire brigade and ambulance. These are represented
by vertices in the diagram. As more information becomes available over
(hopefully a short) time period, relevant choices of services can be made and
deployed to the scene. In particular, between the separate actions of say
deploying police and ambulance we have a combined action of doing both
simultaneously, and that is represented in the diagram by a line between the
two vertices.

Altogether the 15 faces of the diagram represent 15 modes of the system! The
filled-in tetrahedron between the four vertices is the mode which gathers all
available information and assesses the response. When beliefs about the state
of the system (represented by a point in this tetrahedron or 3-simplex)
reaches the triangle at the end then full deployment is instigated. If the
incident in some way is misrepresented then the point moves, possibly
returning to the warning vertex, and then to the rest of the system (not
shown). The state when an action is actually taken should be one of the three
action vertices two of the lines between them. ∎

###  3.4 Geometric intuitions

Systems frequently have to take account of several factors or carry out
several tasks, and we can take account of this by allowing combinations of
modes to also form modes, the joint modes of Section 3.2. These joint modes
translate into edges, triangles, tetrahedra, etc. In general, we shall
represent beliefs about the state of a system as a point in a face of a
simplicial complex. What exactly is a simplicial complex?

A 0-simplex is just a point, and a 1-simplex is a line between some of the
0-simplices. Thus, a simplicial complex consisting of only 0 and 1-simplicies
is just a graph with edges the 1-simplices and vertices the 0-simplices. We
shall not assume that this graph is directed – if there are arrows they are
either imposed by principles (e.g., not being able to stop an intervention
once triggered) or by the current objectives. Increasing the dimension, a
2-simplex is a filled in triangle and a 3-simplex is a solid tetrahedron, and
so on. Fully general definitions are given in the Appendix.

Consider the visualisation of the simple emergency with its 15 faces: there
are 4 0-simplicies, 6 1-simplicies, 4 2-simplicies, and 1 3-simplex. Each of
these is a mode.

The belief about the state of the system is visualised as a point in the
geometric simplicial object, the position in a face shows which modes the
system is in and which mode is likely to come next. The position is given by
the belief generated by algorithms on the basis of evidence. Technically,
there is mathematical belief theory that is a generalisation of probability
theory and, again, we refer to the Appendix for a more formal discussion.

As the modes are linked to the behaviour of the system, the visualisation of
the modes gives the current behaviour of the system, at least its intentions
and its capabilities.

##  4 Illustrative security scenarios and systems

We now apply these ideas to three examples. We describe the first in some
detail, including its mathematics; the others are less detailed due to their
more open-ended nature and limitations of space.

###  4.1 Triage: Persons of interest

Consider persons coming to the attention of the police as potential security
risks through an initial assessment process or triage.

State space and design. In the modal design process we first start with our
‘state space’, which will be the set of people in a country, together with
their actions and beliefs. To be more exact, we take a cover of the set of
‘people of interest’ in the population. We wish to classify those into the
following subsets:

$PeopleofInterest$ (PoI) – those who have come to the attention of the
security services

$BeginTriage$ – those who are in process of classification by the triage
process

$Opportunity$ – those who are in a position to cause damage by, e.g., access
to public platforms or proximity to high value targets.

$Concern$ – those who have extreme views or contacts which could pose a
security concern.

$SecurityClearance$ – those who have been granted clearance for certain
activities

$FurtherInvestigation$ – those who are under active investigation by the
security services

These and other subsets of the population are assigned as basic modes. It is
clear that a person may be in several of these subsets, whence they belong to
joint modes. For example, an individual who is in both $Opportunity$ and
$Concern$ is a larger threat than a person who is in just one of the subsets.

Now, we consider how to determine whether a person is actually in one of these
subsets - this is done by the oracle calls mentioned earlier. This could
include examining criminal or financial records or interrogation. This process
results in a space of evidence, and using this we calculate the belief
functions which we use choose which subsets we believe a person belongs to.
These beliefs are continually updated as, e.g., an investigation comes to an
end or new evidence is presented. The belief functions can then then trigger a
change of mode, e.g., moving to a security clearance process. Of course, the
computed belief functions are only an approximation to the true state of
affairs, as any process is error prone.

Scenario and its visualisation. Our scenario is sufficiently simple to be
described directly using modes and their geometric representation: consider
Fig. 2. We begin at the ‘begin triage’ vertex of the blue tetrahedral mode
‘triage’. After conducting an initial investigation, ‘triage’ outputs either
(i) a value along the edge from ‘opportunity’ (i.e., there is an opportunity
to carry out an attack, e.g., the subject is in close proximity to potential
targets) to ‘concern’ (i.e., there is evidence that the subject may be a
security risk), or (ii) the vertex ‘neither’ of the above.

securityclearancefurtherinvestigationconcernopportunitybegintriagenormalneithercancelinvestigation
Figure 2: Initial assessment for potential security risks

From ‘neither’ the investigation is cancelled, deleting as much material as
procedures allow. From the vertex ‘opportunity’ on the edge (i.e., there is
minimal concern about a security risk) the purple triangle ‘obtain security
clearance’ mode is started. This will get references from contacts of the
subject etc. From anywhere else on the edge (i.e., there is some concern about
security risk) the red ‘consider further investigation’ mode is entered. It is
possible to move between the ‘obtain security clearance’ and ‘consider further
investigation’ modes if new evidence is uncovered. The end points are either
being granted ‘security clearance’ or being entered for a full ‘further
investigation’. To repeat, there are four outcomes and we can leave the triage
mode at three vertices or at one edge.

Inspecting the diagram, there are 7 0-simplices, 12 1-simplices, 7
2-simplices, and 1 3-simplex. Thus, the model reveals that there are, in
principle, 27 modes in this scenario.

Quantification: Space of evidence and thresholds. The above informal
description is now quantified and modelled mathematically. We will build a
relevant belief function to plot points based on the evidence available; these
points lie in the blue triage tetrahedron.

First, we must mathematically model the space of evidence. This will be based
upon concern and opportunity. We begin with choosing positive numbers

$(x_{\mathrm{begin}},x_{\mathrm{con}},x_{\mathrm{opp}}).$

These numbers are ratios having the general form of

$\frac{\mathrm{individual\ score}}{\mathrm{preset\ score}}.$

In this case the numbers try to measure concern $x_{\mathrm{con}}$ and
opportunity $x_{\mathrm{opp}}$, and they are estimated as follows.

We take $x_{\mathrm{con}}\geq 0$ to be a weighted sum of evidence from phone
calls, emails and social media posts etc., divided by a preset ‘level of
concern’ and capped at 1; so $x_{\mathrm{con}}=1$ is taken to be a significant
concern and $x_{\mathrm{con}}=0$ is no concern.

We set $x_{\mathrm{opp}}$ to be a sum of events attended by the person,
weighted by the profile of the event or ease of attack, again divided by a
preset level and capped at 1; so $x_{\mathrm{opt}}=1$ is taken to be a
significant opportunity. For instance, a large number of applications to
certain events would also be treated as a cause for concern, so these numbers
are not independent.

We might assign $x_{\mathrm{begin}}\in[0,1]$ as the fraction of the checks
remaining to be made; so if we had 54 checks in total to perform we would
begin at $54/54=1$ and then count down as checking tasks were completed.
However, we may cut short the process if we already have enough evidence to
escalate the investigation. We now define

$x_{\mathrm{end}}=\max\big{\\{}1-x_{\mathrm{begin}},x_{\mathrm{con}},x_{\mathrm{opp}}\big{\\}}.$

Our space of evidence is this cube of triples:

$(x_{\mathrm{opp}},x_{\mathrm{con}},x_{\mathrm{end}})\in[0,1]^{3}.$

ConcernOpportunityProgress of the investigation111O$\bullet$$\bullet$$\bullet$
Figure 3: The axes for the space of evidence for the investigation

In Figure 3 we show the axes to plot the space of evidence, which is the unit
cube, where the origin $O$ is the most distant vertex from our point of view.
In Figure 4 we highlight the subsets of evidence where we believe that the
four outcomes are true.

Thus, in the second diagram in Figure 4 in the red subset we have points in
the neighbourhood of the region where $x_{\mathrm{con}}=1$, i.e., where we
believe that we should be at the vertex concern.

In the third diagram in Figure 4 in the red subset we have points in the
neighbourhood of the region where $x_{\mathrm{opp}}=1$, i.e., where we believe
that we should be at the vertex opportunity, and similarly for the leftmost
diagram and the vertex opportunity. The vertex begin has a subset on the right
given by a cube $[0,1-\epsilon)^{3}$ for some small $\epsilon>0$.

Quantification: Belief and visualisation. To define the belief/visualisation
function, we now construct a partition of unity for the cube $[0,1]^{3}$ (as
in Definition 9 in the Appendix) for the above subsets. The subsets for
opportunity and concern intersect as we can have an output along the edge
linking those vertices. However, we do not allow the subset for end intersect
subsets for opportunity and concern. as those are not valid outputs on Figure
2. This is because making discrete decisions from continuous data requires
some amount of discontinuity – made easier in our case as our data are
actually rational numbers. Part of the choice of belief function is minimising
the likelihood of discontinuity to make the system as transparent in real time
(i.e., as predictable in the short term) as possible.

$x_{\mathrm{con}}=1$$x_{\mathrm{opp}}=1$$O$$x_{\mathrm{end}}=1$$x_{\mathrm{con}}=1$$x_{\mathrm{opp}}=1$$O$$x_{\mathrm{end}}=1$$x_{\mathrm{con}}=1$$x_{\mathrm{opp}}=1$$O$$x_{\mathrm{end}}=1$$x_{\mathrm{con}}=1$$x_{\mathrm{opp}}=1$$O$$x_{\mathrm{end}}=1$
Figure 4: The subsets for neither, concern, opportunity and begin respectively

###  4.2 Cyber architectures and ecosystems

In responding to a cyber attack on a component of a system concerns arise for
the system architecture and its ecosystem, viz. other components of the
system, the external services the system depends upon, and the external
systems it serves. Commonly, some of these dependencies may be unclear or
unknown. Systems can be viewed at high level (simpler, hopefully transparent)
and low level (complicated, likely opaque, due to lots of code and platform
dependencies).

Scenario. A problem is decisions made at a low level, e.g., using a buffer
overflow to change the status of a block of code from non-executable to
executable. This occurred in EternalBlue, the exploit behind the WannaCry
ransomware cyber attack of 2017, which effected National Health Service (NHS)
hospitals in the UK. One reason why some NHS systems were vulnerable to
WannaCry was the problem of upgrading systems which have to be online
continuously. The WannaCry worm bulk encrypted data on the affected machines,
so systems which had reliable backups were less affected. The WannaCry cyber
attack was effectively halted by the activation of a built in kill-switch by
registering an external web site, a method implemented by an individual about
7 hours after the attack began. Though quick enough to stop much more damage
being caused by WannaCry, such a timescale may not be much use against a more
malicious attack, e.g., data theft, timed disruption of vital services, or
physical damage. Such an attack would possibly use security flaws not used
before. Human intervention takes time, and counter-measures may be difficult
to circulate as some communication systems may have been affected or taken out
by the attack.

The first line of response is the isolation of critical systems as much as
possible. This requires designs with inherent resistance to attack, and
scenarios and exercises to prepare for response.

As with a pandemic, an obvious line to take is compartmentalisation –
isolating things from each other to make spread difficult by not sharing
resources. How do these observations relate to our concept of definition of a
system of modes? We consider four general security features which can be
described using modes.

Implementing updates during runtime – shadow modes. Consider the idea that
modes can be ‘shadowed’ by duplicate modes, whose job is to have the same data
and operations as the original mode. If the original mode needs to be taken
offline (e.g., for upgrade) the shadow mode can be switched into its place. A
shadow mode could also operate under a time delay or different security
options from the original mode, making it less likely to be compromised in an
attack than the original mode, but at the cost of not having quite the same
data.

Symbolically, start with a collection of basic modes
$\mathcal{M}=\\{\alpha,\beta,\gamma,\dots\\}$. We now add a ‘shadow’ mode
$\alpha^{\prime}$ for $\alpha$, giving
$\mathcal{M}^{\prime}=\\{\alpha,\alpha^{\prime},\beta,\gamma,\dots\\}$, as in
Figure 5. When the shadow is activated the effect is to copy all modes
containing $\alpha$ – in Figure 5 we have copies $\\{\alpha^{\prime}\\}$,
$\\{\alpha^{\prime},\beta\\}$, $\\{\alpha^{\prime},\gamma\\}$ of
$\\{\alpha\\}$, $\\{\alpha,\beta\\}$, $\\{\alpha,\gamma\\}$ respectively. We
also have modes $\\{\alpha,\alpha^{\prime}\\}$,
$\\{\alpha,\alpha^{\prime},\beta\\}$, $\\{\alpha,\alpha^{\prime},\gamma\\}$
which link the shadow and original modes.

When the shadow is set up its first task for the linking modes (say for
$\\{\alpha,\alpha^{\prime},\beta\\}$) is to copy the state and data for
$\\{\alpha,\beta\\}$ to $\\{\alpha^{\prime},\beta\\}$. It will continue to
maintain the shadow copy $\\{\alpha^{\prime},\beta\\}$ up to date, but all
actual decisions will be taken by the dominant copy $\\{\alpha,\beta\\}$, the
log for $\\{\alpha^{\prime},\beta\\}$ will be kept for comparison to determine
if there is any significant difference between the copies. (This could be as a
result of a hardware problem or one of the copied being compromised.) At some
point the roles of the shadow and dominant copy can be reversed, and then the
new shadow copy $\alpha$ and can be shut down and updated or repaired.

$\bullet$$\bullet$$\bullet$$\bullet$$\bullet$$\bullet$$\bullet$$\beta$$\alpha$$\gamma$$\beta$$\gamma$$\alpha$$\alpha^{\prime}$
Figure 5: Adding a shadow mode $\alpha^{\prime}$

Compartmentalisation of function. Modes are assigned according to function,
and are given only the tools (file access, external links, etc.) that are
needed to perform that function. Regarding WannaCry, the options to bulk
delete or encrypt data would simply not be available in most modes. It is not
a matter of rewriting their code, the options to do that would not be on their
allowed list of operations or they would not have the codes to access those
options. They would not even know where to go to be able to access those
codes.

A malicious worm would likely have to be able to go through several modes and
their isolation mechanisms before it was in a position to cause harm. But this
movement at the high level of the modes is just what transparency and
visualisation of the mode diagram is designed to detect, whether by a human or
an AI supervisor who could then shut down the system or take other measures.

Isolation of modes. Different modes do not share software with each other. At
the design stage methods or classes may be inherited based on inclusion of
modes – i.e., mode $\\{\alpha,\beta\\}$ may inherit from $\\{\alpha\\}$.
However these will be compiled into distinct copies in memory, so there is no
common memory at runtime. Thus, if one mode is corrupted the other modes will
be unaffected unless a virus manages to propagate from mode to mode or send
corrupted data. This forms a bottleneck in the infection process which can be
examined in more detail. When an alarm is raised communication between modes
may be further restricted.

External monitoring of modes. As operations on any external agency (e.g.,
databases) are performed by oracle calls from the modes, the number of uses of
such calls can be logged by a system not connected to the current operating
mode, and an alarm raised if usage exceeds a prescribed amount.

###  4.3 Critical incidents and the gold-silver-bronze command structures

Various scenarios are involved in preparing plans for responding to critical
incidents, which should be able to generate simulations. In a multi-agency
response to a critical incident streams of decisions need to be made by
different commands drawing on different streams of information about an
unfolding situation. However, this can easily lead to confusion and
information overload as hundreds of pieces of information, many inaccurate,
flood in. Triaging, compiling and interpreting this information to formulate
beliefs about the situation and to suggest a number of options are necessary
tasks; how could these be supported orpartially automated? We examine the
general form of the gold-silver-brone command structure, discussed in Section
2.2, though a toy example of a critical incident. These structures are likely
to be broadly similar in many incidents.

Scenario. Consider an event where a bomb has been detonated in a football
stadium during a game.

Our first point of view is that of taking control of the incident. In general,
after an emergency 999 call, one of the emergency services (police, ambulance,
fire) will attend. But in our case, police will be on site and will radio
their control to declare a ‘major incident’, thus initiating the gold-silver-
bronze command structure.

In our scenario, all three services are on site. Each of the services will set
up their own silver command structures who will be in operational charge of
the incident and will be located on or close to the incident. In our case, it
is likely that a police inspector or superintendent would be at the match and
would take this position. The fire and ambulance services should also have
their silver commander on site, and preferably all the silver commanders would
gather at the same place to allow free communication. A separate
communications channel will likely be cleared for the incident.222If the
military (other than explosive experts) become involved they may take overall
charge.

The bronze commanders for each of the services will be in charge of various
physical locations in the incident, and will report to their silver commander.
The number and deployment of the bronze commanders will vary greatly and
depend on the nature of the incident.

The gold command is the top-level strategic post, which establishes strategy
for the combined operation, gathers and allocates resources and liaises with
government, and other organisations and agencies.

Au AmbulanceAu PoliceAu FirePoliticiansStand downMajor incident
declaredIncomingcallFireAmbulancePoliceAg AmbulanceAg FireAg
PoliceMilitaryAuAuMediaLocal Council Figure 6: The silver (Ag) and gold (Au)
command structures

Modelling belief. Figure 6 shows the modes for setting up the silver command,
building on the triage example in Section 3.3 and Figure 1. The usual command
structure is the police-fire-ambulance triangle, and this changes to silver
command on a declaration of a major incident. We have shown an algebraic
product of a triangle with an interval as a cylinder on the Figure, but in
fact the modes are rather more complicated. This would allow for delays in
setting up some of the silver commands (real incidents are often chaotic).

Figure 6 also shows the gold structure, based on coordination of the three
services, and their links to the media, politicians (for resources) and local
councils (for facilities such as shelter).

$\bullet$security 1$\bullet$Fire 1Ambulance 2$\bullet$Police 3$\bullet$Police
1Ambulance 1$\bullet$Police 2$\bullet$StandExit 1FieldExit 2Muster 1Muster 2
Figure 7: Bronze command and the geographical layout of teams

In principle, one bronze commander is assigned to each physical area of the
site and is in personal command of the teams there. Figure 7 depicts the
geographical layout of the areas in the stadium scenario, with the positions
of teams indicated (the local stadium security coming under police command).
Each area should have a bronze commander, who reports to the appropriate
silver commander, and then communicates with the teams in the area.

##  5 Concluding remarks

###  5.1 Reflections and next steps

Given the questions posed in the Introduction, a general aim is to develop
mathematical tools for thinking about current and new systems in complex human
contexts, described by security scenarios. Our modelling methods for systems,
based on notions of mode and mode transition, seem to have some advantages in
terms of security and resilience, e.g.,

Concurrency: Several modes can be designed to work collaboratively on the same
problems.

Independence: The independent modes are designed so as to avoid, or at least
contain, potential damage, and to facilitate auditing.

Continuity: Changes can be made to modes separately allowing updates without
system downtime. If a mode is behaving suspiciously, this should be recognised
by the other modes, and the errant mode could be suspended. If one mode is
down, others need not be compromised.

Transparency: The geometric visualisation supports analysis, transparency and
explication.

As automation expands into new areas of life through AI, transparency is
particularly important and timely.

In terms of next steps, there is much to explore in the types of examples
discussed in this paper; for example, triage is a hugely important topic, one
associated with machine learning. Only though case studies, including
realistic applications and past events, can we establish the evidence and
extent the prima facie advantages – such as concurrency, independence,
continuity, and transparency – actually obtain. By drilling down into the
internals of the modes, and the mathematics of their geometries and belief
functions, we can develop a general theory of modes and mode transitions. In
due course, we will need to develop specifications for software tools to
explore and strengthen the methods.

###  5.2 Theorising scenarios

Setting aside dictionary definitions, the term scenario suggests an
idealisation that postulates a context and dynamic events that are abstracted
from the real world.333Interestingly, the 1982 Supplement to the Oxford
English Dictionary remarked “The over-use of this word in various loose senses
has attracted frequent hostile comment”. The term security scenario suggests
an account or synopsis of a possible unfolding of events and courses of
reaction in which local or national security is implicated. Such idealisations
are needed for planning responses to security problems; they also shape
evaluations, feedback and investigations of historical incidents. Indeed, our
understanding of past security problems play an essential role in preparations
for future security problems. The same is true of history in military planning
and training, of course.

It is plausible to argue that, ultimately, scenarios are both the raison
d’être for systems as well as formidable tests for their evaluation - their
nemesis in security terms. So we might ask:

What is the essential structure of a scenario? Can we develop a rigorous
framework within which systems and scenarios can be compared? Can such a
framework be formalised?

Over the past two decades, scenarios have also been used as a tool to deal
with the complexities and uncertainties associated with global issues, such as
climate change, food security, and land use. This allows the simulation of
different environments, approaches and outcomes, as well as delivering a
multitude of perspectives on potential future developments. Thus, scenario-
based research has been frequently conducted by all sorts of professionals. To
give a sample of fields: economics and business studies (e.g., [15]);
political science and international relations (e.g., [17]); environmental
science and climate studies (e.g., [11]); public health and epidemiology
(e.g., [1]); urban planning and architecture (e.g., [10]); psychology and
sociology (e.g., [4]); military war-gaming (e.g., [2]); and disaster
management and emergency planning (e.g., [14]). One commonly mentioned general
description is: ‘plausible and often simplified descriptions of how the future
may develop based on a coherent and internally consistent set of assumptions
on key driving forces and relationships’ ([8]). The set of assumptions are key
to the construction of scenarios and their varied application.

Looking ahead at what may count as threats and risks (say, over a decade)
suggest to us that new tools and methodologies for thinking about security
scenarios, idealised and actual, should be useful and are, in fact, needed.
Scenarios play an essential role in creating and judging security systems and
in assessing risk more broadly.

Making a stocktake of technologies that we know currently and which may come
to some sort of maturity in the coming decade is an interesting exercise
(e.g., [9]). Every new technology can generate new surprises for security,
broadly conceived. Security surprises can also come from ill-understood
functional interdependencies of: current systems, or mutual dependent sets of
users, or underlying, shared computing infrastructures. Most importantly, we
note that our surprise may be proportional to our ignorance of these factors
and their effects. If the critical technologies of the next decade are unknown
then security surprises are classic ‘unknown unknowns’. Thus, to avoid, or at
least partially prepare, for surprises we may turn to scenarios.

We believe it sensible to seek new theories about security scenarios that
abstract from lived and imagined experiences and, specifically, seek rigorous,
systematic and useable methodologies, some mathematical models, and software
tools. In particular, they must make explicit the various roles of data and
automation play in decisions by the systems involved.

## References

  * [1] G.B. Anderson, E.A. Barnes, M.L. Bell, F. Dominici (2019). The future of climate epidemiology: Opportunities for advancing health research in the context of climate change, American Journal of Epidemiology, 188 (5), 866-872. https://doi.org/10.1093/aje/kwz034
  * [2] M. Augier, N. Dew, T. Knudsen, N. Stieglitz (2018). Organizational persistence in the use of war gaming and scenario planning, Long Range Planning, 51 (4), 511-525.  https://doi.org/10.1016/j.lrp.2017.12.005
  * [3] BBC News, Broadwater Farm riots: PC Keith Blakelock’s 1985 murder recalled, https://www.bbc.co.uk/news/uk-england-london-34433752
  * [4] R. Bekkers (2010). Who gives what and when? A scenario study of intentions to give time and money, Social Science Research, 39 (3), 369-381. https://doi.org/10.1016/j.ssresearch.2009.08.008
  * [5] E.J. Beggs, J. V. Tucker (2023). The dynamics of belief. https://arxiv.org/abs/2208.05764
  * [6] E.J. Beggs, J. V. Tucker. A model of systems with modes and mode transitions, Journal of Logical and Algebraic Methods in Programming, 127 (2022), 100774.
  * [7] Cabinet Office. A Strong Britain in an Age of Uncertainty: The National Security Strategy 2010.
  * [8] S.R. Carpenter, P.L. Pingali, E.M. Bennett, M. Zurek (Eds.). Ecosystems and Human Well-being: Scenarios, Vol 2, Island Press, Washington, DC (2005)
  * [9] F. Diana, Our emerging future, 2016. https://frankdiana.net/2016/04/21/our-emerging-future
  * [10] B. Eilouti (2018). Scenario-based design: New applications in metamorphic architecture, Frontiers of Architectural Research, 7 (4), 530-543. https://doi.org/10.1016/j.foar.2018.07.003
  * [11] M. Flynn, J.D. Ford, T. Pearce, S.L. Harper, IHACC Research Team (2018). Participatory scenario planning and climate change impacts, adaptation and vulnerability research in the Arctic, Environmental Science and Policy, 79, 45-53. https://doi.org/10.1016/j.envsci.2017.10.012
  * [12] UK Home Office. Critical incident management, Border Force, Immigration Enforcement and UK Visas and Immigration, Version 13.0, 2021.
  * [13] J.M. Lee. Manifolds and differential geometry, Graduate Texts in Mathematics 107, A.M.S., Providence RI, 2009.
  * [14] X. Li, Y. Wang (2022). Construction of Urban Flood Disaster Emergency Management System Using Scenario Construction Technology, Computational Intelligence and Neuroscience, 2022, Article ID 8048327, 10 pp.  https://doi.org/10.1155/2022/8048327
  * [15] A. Ozoran, B. Cigdemoglu, C. S. Ilgar (2023). Economic, Socio-cultural and existential engagement strategies during COVID-19 Pandemic: A scenario-based experiment, International Journal of Management Studies, 30 (2), 203-234. https://doi.org/10.32890/ijms2023.30.2.2
  * [16] G. Shafer, Perspectives on the theory and practice of belief functions, Int. Journal of Approximate Reasoning, 4 (5-6), (1990), 323-362.
  * [17] M. Sus, M. Hadeed (2020). Theory-infused and policy-relevant: On the usefulness of scenario analysis for international relations, Contemporary Security Policy, 41(3), 432-455.
  * [18] UK Government. (2022) Fact Sheet 2: National Security Risk Assessment.
  * [19] R.R. Yager, L. Liu (eds.).Classic Works of the Dempster-Shafer Theory of Belief Functions, Studies in Fuzziness and Soft Computing, Springer 2008.
  * [20] M. M. Yamin, B. Katt, V. Gkioulos, Cyber ranges and security testbeds: Scenarios, functions, tools and architecture, Computers and Security, 88 (2020), 101636.  https://doi.org/10.1016/j.cose.2019.101636

##  6 Appendix: The mathematics

###  6.1 Logical and geometric methods

In Definition 1 a mode is described in terms of subsets of the states and
objectives of a system. The mathematics of how to deal with a set built as a
union of subsets has been known for a long time – a simplicial complex [13].

$U_{\alpha}$$U_{\beta}$$U_{\gamma}$$U_{\delta}$$v_{\alpha}$$v_{\beta}$$v_{\gamma}$$v_{\delta}$$\phi_{\alpha}$$\phi_{\beta}$$\phi_{\gamma}$$\phi_{\delta}$
Figure 8: A simplicial complex and a partition of unity for a cover by four
sets

###### Definition 3

An abstract simplicial complex $(\mathcal{M},\mathcal{C})$ is a collection
$\mathcal{C}$ of finite subsets of a set $\mathcal{M}$ such that if $Y\subset
X$ and $X\in\mathcal{C}$ then $Y\in\mathcal{C}$.

###### Definition 4

A collection of subsets $U_{\alpha}\subset S$ (for $\alpha$ in some index set
$\mathcal{M}$) is called a cover if the union of all the $U_{\alpha}$ for
$\alpha\in\mathcal{M}$ is equal to $S$. From such a cover we form an abstract
simplicial complex, called the nerve of the cover, by

$\mathcal{C}=\big{\\{}X\subset\mathcal{M}:\cap_{\alpha\in
X}U_{\alpha}\neq\emptyset\big{\\}}\ .$

Thus $\\{\alpha,\beta,\gamma\\}\subset\mathcal{M}$ is in $\mathcal{C}$
precisely when $U_{\alpha}\cap U_{\beta}\cap U_{\gamma}$ is not empty. To see
that $\mathcal{C}$ is an abstract simplicial complex we note that if
$\\{\alpha,\beta,\gamma\\}$ is in $\mathcal{C}$ then we also must have
$\\{\alpha,\beta\\}$ in $\mathcal{C}$ because if $U_{\alpha}\cap U_{\beta}\cap
U_{\gamma}$ is not empty then also $U_{\alpha}\cap U_{\beta}$ is not empty.

In Figure 8 we have a space covered by four subsets
$\\{U_{\alpha},U_{\beta},U_{\gamma},U_{\delta}\\}$ and the corresponding
abstract simplicial complex is

$\mathcal{C}=\big{\\{}\\{\alpha\\},\\{\beta\\},\\{\gamma\\},\\{\delta\\},\\{\alpha,\beta\\},\\{\alpha,\gamma\\},\\{\beta,\gamma\\},\\{\alpha,\beta,\gamma\\},\\{\gamma,\delta\\}\big{\\}}$

###### Definition 5

A map of abstract simplicial complexes
$\Psi:(\mathcal{M},\mathcal{C})\to(\mathcal{M}^{\prime},\mathcal{C}^{\prime})$
is a function $\Psi:\mathcal{M}\to\mathcal{M}^{\prime}$ so that on subsets if
$X\in\mathcal{C}$ then $\Psi X\in\mathcal{C}^{\prime}$.

For example we can take $\mathcal{M}^{\prime}=\\{\delta,\zeta\\}$ and

$\mathcal{C}^{\prime}=\big{\\{}\\{\delta,\zeta\\},\\{\delta\\},\\{\zeta\\}\big{\\}}$

and a simplicial map $\Psi:\mathcal{M}\to\mathcal{M}^{\prime}$ could be given
by $\Psi(\alpha)=\Psi(\beta)=\Psi(\gamma)=\zeta$ and $\Psi(\delta)=\delta$.

We can use maps of abstract simplicial complexes to implement hierarchies for
information hiding or classification.

###### Definition 6

A cover $\\{W_{k}:k\in\mathcal{M}^{\prime}\\}$ of $S$ is a refinement of the
cover $\\{U_{\alpha}:\alpha\in\mathcal{M}\\}$ if there is a map
$\Psi:\mathcal{M}^{\prime}\to\mathcal{M}$ so that $W_{k}\subset U_{\Psi(k)}$.
It then follows that $\Psi$ is a map of abstract simplicial complexes from the
nerve of the cover $\\{W_{k}:k\in\mathcal{M}^{\prime}\\}$ to the nerve of
$\\{U_{\alpha}:\alpha\in\mathcal{M}\\}$.

###  6.2 Realisation of abstract simplicial complexes in $\mathbb{R}^{n}$

The familiar $xy$ plane for 2-dimensional geometry is called $\mathbb{R}^{2}$
as it uses two copies of the real numbers $\mathbb{R}$. Its elements are
ordered pairs $(x,y)$ for $x$ and $y$ real numbers. We have a basis
$e_{1}=(1,0)$ and $e_{2}=(0,1)$ and can write any point in the plane as
$(x,y)=x\,e_{1}+y\,e_{2}$. Similarly for 3-dimensional space $\mathbb{R}^{3}$
we have points $(x,y,z)$, and if we use new basis elements $e_{1}=(1,0,0)$,
$e_{2}=(0,1,0)$ and $e_{3}=(0,0,1)$ we can write
$(x,y,z)=x\,e_{1}+y\,e_{2}+z\,e_{3}$.

In (for example) $\mathbb{R}^{3}$ we have points which we call $0$-simplices,
e.g., $e_{1}$ and $e_{2}$. The 1-simplices are lines connecting the
0-simplices, e.g., $x\,e_{1}+y\,e_{2}$ for real $x,y\geq 0$ with $x+y=1$. The
2-simplices are triangles spanned by three vertices, e.g.,
$x\,e_{1}+y\,e_{2}+z\,e_{3}$ for real $x,y,z\geq 0$ with $x+y+z=1$. We extend
this to be 3-simplices being tetrahedra, etc. A 3-simplex is visualised in
Figure 8 where the vertices are labelled $\\{\alpha,\beta,\gamma\\}$.

An $n$-simplex will have faces which are simplices bounded by subsets of its
vertices. Thus a 3-simplex will have one 3-face (itself), four 2-faces which
are 2-simplices, six 1-faces which are 1-simplices and four 0-faces which are
0-simplices (vertices). In Figure 8 we the 2-simplex
$\\{\alpha,\beta,\gamma\\}$ has a 1-face labelled by $\\{\alpha,\gamma\\}$ and
a 0-face labelled by $\\{\alpha\\}$.

We can use this to define a higher dimensional analogue of a planar graph
called a simplicial complex – a graph is an example of a simplicial complex
which only contains 0-simplices and 1-simplices:

###### Definition 7

A simplicial complex is a collection of simplices in some space so that the
face of any simplex in the collection is also in the collection, and the
intersection of any two simplices is a face of both of them.

Figure 8 gives an example of a simplicial complex which is a union of a
2-simplex and a 1-simplex. These simplices intersect at the common 1-face
$e_{\gamma}$.

There is a construction which will give a simplicial complex for every
abstract simplicial complex in a functorial manner. In general, this
construction uses very high dimensional spaces, which is usually not necessary
in practice, but it simplifies the theory. Just as many (but not all) graphs
can be drawn in 2-dimensional space we can often draw a simplicial complex in
a dimension much smaller than that used in Proposition 8. The large space
$\mathbb{R}^{\mathcal{M}}$ is a vector space with basis $e_{\alpha}$ for all
$\alpha\in\mathcal{M}$.

###### Proposition 8

To every abstract simplicial complex $(\mathcal{M},\mathcal{C})$ (as in
Definition 3) is associated its standard realisation
$\Delta_{\mathcal{C}}\subset\mathbb{R}^{\mathcal{M}}$, as a simplicial
complex. The simplex spanned by $X\in\mathcal{C}$ is

$\Delta_{X}=\Big{\\{}\sum_{\alpha\in
X}\lambda_{\alpha}\,e_{\alpha}:\lambda_{\alpha}\in[0,1],\ \sum_{\alpha\in
X}\lambda_{\alpha}=1\Big{\\}}.$

Further, a map of abstract simplicial complexes
$\Psi:(\mathcal{M},\mathcal{C})\to(\mathcal{M}^{\prime},\mathcal{C}^{\prime})$
can be extended to a map of their realisations as
$\Delta_{\Psi}:\Delta_{\mathcal{C}}\to\Delta_{\mathcal{C^{\prime}}}$ by
defining

$\Delta_{\Psi}\Big{(}\sum_{\alpha\in
X}\lambda_{\alpha}\,e_{\alpha}\Big{)}=\sum_{\alpha\in
X}\lambda_{\alpha}\,e_{\Psi(\alpha)}.$

Proof: The simplex $\Delta_{X}$ is a $(|X|-1)$-simplex where $|X|$ is the size
of $X$, and if $Y\subset X$ then $\Delta_{Y}$ is a face of $\Delta_{X}$. Then
$\Delta_{X}\cap\Delta_{Z}=\Delta_{X\cap Z}$ and Definition 7 is seen to be
satisfied. $\square$

###  6.3 Covers and partitions of unity

Having created the geometric realisation of the simplex we are now able to use
the categorisation of the data in the state space $S$ according to a cover
$\\{U_{\alpha}:\alpha\in\mathcal{M}\\}$ and its associated abstract simplicial
complex $\mathcal{C}$, to create a geometric visualisation in
$\Delta_{\mathcal{C}}$. To do this we need an appropriate map from $S$ to
$\mathcal{C}$ that contains the information $\phi_{\alpha}(s)$ which tells us
how much we need to be concerned about $\alpha$ when in state $s\in S$ on a
scale from 0 to 1.

###### Definition 9

A partition of unity for the cover $\\{U_{\alpha}\subset
S\,|\,\alpha\in\mathcal{M}\\}$ is a function $\phi_{\alpha}:S\to[0,1]$ for
every $\alpha\in\mathcal{M}$ such that

(1) if $\phi_{\alpha}(s)\neq 0$ then $s\in U_{\alpha}$;

(2) $\sum_{\alpha\in\mathcal{M}}\phi_{\alpha}(s)=1$ for all $s\in S$.

We then have a function $\phi:S\to\Delta_{\mathcal{C}}$ given by

$\phi(s)=\sum_{\alpha\in\mathcal{M}}\phi_{\alpha}(s)\,e_{\alpha}.$

Figure 8 visualises a simplicial complex and partition of unity for a cover by
four sets. Note that the triangle in Figure 8 is shaded to form a 2-simplex
precisely because $U_{\alpha}\cap U_{\beta}\cap U_{\gamma}$ is not empty. In
specific circumstances we can impose extra conditions on $\phi$, e.g.,
continuity or computability.

###  6.4 Belief

It is important to distinguish between belief in something and a probability
that that thing occurs [16, 19]. On being told by a completely reliable source
that a person has a car which has a single colour, we could form two
statements,

$B=$‘the car is blue’ and $NB=$‘the car is not blue’.

The combination $B$ or $NB$ we would consider to have a belief of 1, but in
the absence of any other information we would have no basis to assign a non-
zero belief value to the separate statement $B$ or to the statement $NB$. We
could randomly assign belief values to each which added up to 1, but this
would only undermine the idea that belief ought be assigned according to
evidence. Sensibly our belief $\mathrm{Bel}(\\{B,NB\\})$ in ($B$ or $NB$) is
strictly greater than the sum of $\mathrm{Bel}(\\{B\\})$ and
$\mathrm{Bel}(\\{NB\\})$. Such a conclusion means that we are not dealing with
a probability distribution.

###### Definition 2

We consider beliefs in a finite set $X$ of statements. A generalised belief
function on $X$ is a function

$\mathrm{Bel}:P(X)\to[0,1],$

where $P(X)$ is the set of subsets of $X$. Furthermore, for the empty set
$\mathrm{Bel}(\emptyset)=0$ and the sets satisfy the ‘super-additivity’
property

$\displaystyle\mathrm{Bel}(Y\cup Z)+\mathrm{Bel}(Y\cap
Z)\geq\mathrm{Bel}(Y)+\mathrm{Bel}(Z)\quad\mathrm{for\ all}\ Y,Z\subset X.$
(1)

We denote by $\mathcal{B}(X)$ the set of belief functions on $X$.

We shall say that a belief function is normalised if $\mathrm{Bel}(X)=1$. It
is important to note that we do not impose this normalisation condition –
hence our word generalised above. Thus, we reserve the right to believe that
the set of presented alternatives $X$ may be incomplete.

The ‘super-additivity’ property is simply justified in that, in addition to
those people who believe in $Y$ and those who believe in $Z$, there may be
people who just believe that at least one is true.

###  6.5 Simplicial complexes and graphs

Graphs are a standard data structure in computer science. We claim that for
certain purposes simplicial complexes are preferable. These purposes are
related to the reasons why simplicial complexes were invented by topologists:
In describing covers of spaces by subsets, these subsets can model multiple
objectives or circumstances which can occur simultaneously. This intrinsically
higher dimensional picture does not easily reduce to a graph. To see this,
first consider this straightforward construction.

In transforming a simplicial complex to a graph,

(i) each mode/face $f$ of the complex becomes a vertex $v$; and

(ii) each pair of nested mode/faces $f_{1}\subset f_{2}$ of the complex
becomes an edge $v_{1}\to v_{2}$.

In summary:

###### Lemma 1

An $n$-simplex contains $2^{n+1}-1$ faces. To make a representation in a
graph, the resulting graph would have $2^{n+1}-1$ vertices.

$\alpha\beta\gamma$$\alpha\beta$$\alpha\gamma$$\beta\gamma$$\alpha$$\beta$$\gamma$$\alpha$$\beta$$\gamma$
Figure 9: Comparing a single 2-simplex (right) and its graph (left)

In Figure 9 we compare a simple 2-simplex $\alpha\beta\gamma$ to its graph,
where we take the sub-simplices of $\alpha\beta\gamma$ and connect the
intersections (= possible mode transitions) by a line in the graph. This shows
the considerable increase in complexity on constructing the graph, even for
one of the simplest simplicial complexes. The graphical representation of the
simplicial complex in Figure 2 would be much more complicated.

Not only is the graph more complicated, but it is much more difficult to
interpret. A point on the 2-simplex (the filled in triangle) carries a large
amount of information about the state of the system in how close to an edge or
vertex it is. All points in the interior of the triangle correspond to the
single vertex $\alpha\beta\gamma$ in the graph, so a position in a vertex of
the graph loses this information. The discontinuous motion from vertex to
vertex in the graph lacks any explainability or predictive value. This is in
contrast to the continuous motion of a point around the 2-simplex, where at
least a guess may be made about the likely future behaviour of the system.


Linear Temporal Logic () is one of the most popular temporal
logics and comes into play in a variety of branches of computer

Among the various reasons of its widespread use there are its strong foundational properties:
is equivalent to counter-free $\omega$-automata, to star-free
$\omega$-regular expressions, and (by Kamp's theorem) to the
First-Order Theory of Linear Orders ().

Safety and co-safety languages, where a finite prefix suffices to
establish whether a word does not belong or belongs to the language,
respectively, play a crucial role in lowering the complexity of problems
like model checking and reactive synthesis for .

(resp., ) is a fragment of where only the
tomorrow, the weak tomorrow and the until temporal
modalities (resp., the tomorrow, the weak tomorrow and the
release temporal modalities) are allowed, that recognises safety
(resp., co-safety) languages only.

The main contribution of this paper is the introduction of a fragment of
, called , and of its dual , which are
expressively complete with respect to the -definable safety
and co-safety languages.

We prove that they exactly characterize
and , respectively, a result that joins Kamp's theorem, and
provides a clearer view of the characterization of (fragments of) in
terms of first-order languages.

In addition, it gives a direct, compact, and self-contained proof that
any safety language definable in is definable in as well.

As a by-product, we obtain some interesting results on the expressive
power of the weak tomorrow operator of , interpreted over
finite and infinite words. Moreover, we prove that, when interpreted
over finite words, (resp. ) devoid of the tomorrow (resp., weak
tomorrow) operator captures the safety (resp., co-safety) fragment of
over finite words.

We then investigate some formal properties of and :

* we study their succinctness with respect to their modal
counterparts, namely, and ;

* we illustrate an important practical application of them in the
context of reactive synthesis;

* we compare them with expressively equivalent first-order

Last but not least, we provide different characterizations of the
(co-)safety fragment of in terms of temporal logics, automata, and
regular expressions.

§ ACKNOWLEDGEMENTS

Alessandro Cimatti, Angelo Montanari, and Stefano Tonetta acknowledge the
support of the MUR PNRR project FAIR - Future AI Research (PE00000013)
funded by the NextGenerationEU.
Luca Geatti, Nicola Gigante, and Angelo Montanari acknowledge the support
from the 2022 Italian INdAM-GNCS project “Elaborazione del
Linguaggio Naturale e Logica Temporale per la Formalizzazione di Testi”,
ref. no. .
Nicola Gigante acknowledges the support of the PURPLE project, in the
context of the AIPlan4EU project's First Open Call for Innovators.


# Tunable Localization of Light Using Nested Invisible Metasurface Cavities

F.S. Cuesta<EMAIL_ADDRESS>S. Kosulnikov  V.S. Asadchy
Department of Electronics and Nanoengineering, Aalto University,
P.O. Box 15500, Aalto FI-00076, Finland

###### Abstract

An invisible cavity is an open resonant device that confines a localized field
without producing any scattering outside of the device volume. By exploiting
the scatter-less property of such device, it is possible to nest two invisible
cavities, as the outer cavity would simply not notice the presence of the
inner one, regardless of their relative position. As a result, the position of
the inner cavity becomes a means to easily control the field localized inside
the cavity and its quality factor. In this paper, we discuss the properties of
nested invisible cavities as a simple method to achieve stronger localized
fields and high tunable quality factor. Furthermore, we show that in optics,
these cavities can be implemented using nanodisk-based dielectric metasurfaces
that are slightly shifted from their dipolar Mie resonances.

cavity, metasurface, tunable, field localization, quality factor, Mie
resonances

††preprint: APS/123-QED

##  I Introduction

Figure 1: (a) Illustrations of a single invisible cavity formed by two
parallel metasurfaces. Each metasurface consists of a uniform array of high-
index tablets. Tablets shown with light blue color possess electric-dipole Mie
resonance slightly above the resonant frequency of the cavity (capacitive
metasurface), while dark blue elements have the same Mie resonance below the
resonant frequency (inductive metasurface). Complex magnitude of the electric
field is shown across the cavity, being constant outside the cavity and
standing-wave-like within it. (b) Illustration of nested invisible cavities
formed by four metasurfaces.

Light localization plays an important role in modern physics and applications,
particularly, in nanophotonics. It is the basis for creating nonlinear
devices, sensors, waveguides, resonators, photonic crystals, interferometers,
optical fibers, lasers, etc. With the advent of new nanofabrication
technologies, optical systems enabling efficient and controllable light
concentration at the nanoscale are on demand [1, 2, 3]. Foreseeable
applications of such systems include integrated circuitry for silicon
photonics, optical computing, solar technologies, and bio-sensing.

Recently, a possibility for light localization in a given volume with
simultaneous partial or complete light scattering suppression from that volume
was discussed in multiple contexts, such as bound states in the continuum
(BICs) [4, 5, 6, 7, 8, 9], anapole modes [10, 11, 12, 13], and virtual
absorption [14, 15, 16]. Such nonradiating light concentration enables non-
obstructive detection, enhancement and suppression of radiation, and energy
storing. Probably, the most pronounced synergy between light localization and
scattering suppression is achieved in the so-called invisible metasurface-
based cavities [17, 18]. These cavities allow to generate strong field maxima
and deep minima inside them when illuminated by incident light, while they
remain invisible for observers, both in the backward and forward directions.
Such a regime is achieved due to the full suppression of light scattering from
the cavity into outside space. It is in sharp contrast to conventional Fabry-
Perot resonators made of symmetric combinations of two partially transparent
mirrors where strong forward scattering is produced (resulting in a non-zero
phase shift of the transmitted wave) [19]. The invisible metasurface cavities
have an antisymmetric configuration of semi-transparent mirrors: one with weak
inductive and one with weak capacitive response. An illustration of such an
invisible cavity is shown in Fig. 1(a). Due to the antisymmetric (dual) and
balanced electromagnetic response of the two sheets, the cavity remains
invisible, being to some extent related to parity-time symmetric systems [20,
21, 22, 23, 24].

Due to this non-scattering nature, it was suggested that the invisible
cavities can be “nested” [Fig. 1(b)], allowing further enhancing the field
localization, still preserving the overall invisibility [17, 18]. However,
implementation for such structures was conceptualized only for the microwave
frequency range using metallic patterns. Simple scaling-down of this design to
the optical frequency range is not possible since dissipation in metal
appearing at high frequencies would strongly degrade the performance of the
cavity (see Supplementary Section S1).

In this paper, we discuss the aspects of nesting invisible cavities and
propose a low-loss optical implementation using metasurfaces with a high-
permittivity cylindrical unit cells that operate near the dipolar Mie-type
resonant electric mode [25, 26, 27, 28, 29]. In order to provide required
capacitive and inductive responses of the two metasurfaces, we slightly detune
the dimensions of their unit-cell elements away from the electric-dipole
resonance condition. Furthermore, we design a nested configuration of two
cavities that provides quadratic improvement of the quality factor as compared
to that of a single cavity. Finally, we demonstrate that due to the
invisibility property, the nested cavity enables a simple mechanism for tuning
its quality factor (alternatively, the strength of field localization) in a
wide and continuous range of values.

##  II Nested Invisible Cavities

Figure 2: A nested invisible cavity can control the properties of standing
waves by simply moving the inner resonator within the outer one. With the
proper alignment, the maximum field localized in the inner cavity can be
controlled in the range between $A_{\rm max,nest}^{2}=1$ (no standing wave)
and a maximum of $A_{\rm max,nest}^{2}=A_{\rm max,out}^{4}$. The reactances
were chosen following an alternating pattern $X_{\rm in}=-X_{\rm out}$, with
values that guarantee a field amplification of the outer cavity in the range
between $A_{\rm max,out}^{2}\approx 3.16$ and $A_{\rm max,out}^{2}\approx
1000$.

The simplest nested invisible cavity consists of two open cavity resonators,
where one of the cavities is placed inside the other one, as portrayed in Fig.
1(b). In this setup, since the inner cavity does not produce any scattering
outside of it, its placement inside the outer cavity does not modify the
standing wave inside the inner cavity. The invisibility of the inner cavity
implies the following [17]: the complex grid impedances of the walls are
complement in the form $Z_{\rm e3}=-Z_{\rm e4}=Z_{\rm in}$, and they are
separated by a distance $d_{\rm in}=n\lambda_{0}/2$ [see Fig. 1(b)], where $n$
is an integer and $\lambda_{0}$ is the operational free-space wavelength. The
grid (or sheet) impedance of a metasurface is the ratio between the averaged
tangential electric field at the metasurface and the induced electric surface
current density [30, 31]. Likewise, invisibility of the outer cavity occurs
when $Z_{\rm e1}=-Z_{\rm e2}=Z_{\rm out}$ and $d_{\rm out}$ is proportional to
half-wavelength at the operational frequency. By assuming that the
metasurfaces have a uniaxial symmetry, with $z$ as the propagation direction
of the incident wave, the standing wave of the outer cavity can be decomposed
into its “forward” and “backward” components:

${\bf E}_{\rm F,out}=E_{\rm I}\left(1-\dfrac{\eta_{0}}{2Z_{\rm
out}}\right)e^{-jk_{0}z}{\bf a}_{\rm x},$ (1a) ${\bf E}_{\rm B,out}=E_{\rm
I}\left(\dfrac{\eta_{0}}{2Z_{\rm out}}\right)e^{jk_{0}z}{\bf a}_{\rm x},$ (1b)

where $k_{0}$ and $\eta_{0}$ are the free-space wavenumber and wave impedance,
and $E_{\rm I}$ is the amplitude of the incident electric field. Here, we
assume the time harmonic convention in the form of $\exp(+j\omega t)$. The
field maximum of the standing wave $E_{\rm max,out}$ corresponds to the
constructive combination of the forward and backward waves. The normalized
field maximum $A_{\rm max,out}$ is then given by

$A_{\rm max,out}=\dfrac{E_{\rm max,out}}{|E_{\rm
I}|}=\dfrac{\eta_{0}+\left|\eta_{0}-2Z_{\rm out}\right|}{\left|2Z_{\rm
out}\right|}.$ (2)

The standing wave at the inner cavity is the result of the coherent
illumination by the outer forward and backward waves (see Supplementary
Sections S2 and S3). Therefore, the inner fields read

${\bf E}_{\rm F,nest}=\dfrac{E_{\rm I}\eta_{0}}{2Z_{\rm
in}}\left[2\dfrac{Z_{\rm
in}}{\eta_{0}}-\left(1+\dfrac{\eta_{0}e^{2jk_{0}\delta}}{2Z_{\rm
out}-\eta_{0}}\right)\right]e^{-jk_{0}(z-\delta)}{\bf a}_{\rm x},$ (3a) ${\bf
E}_{\rm B,nest}=\dfrac{E_{\rm I}\eta_{0}}{2Z_{\rm
in}}\left[1+\dfrac{\left(2Z_{\rm in}+\eta_{0}\right)e^{2jk_{0}\delta}}{2Z_{\rm
out}-\eta_{0}}\right]e^{jk_{0}(z-\delta)}{\bf a}_{\rm x}.$ (3b)

It can be appreciated that both inner fields in Eqs. (3) are periodic
functions that depend on the inner cavity position $\delta$. As a result, the
amplitude of the inner standing wave can be tuned by moving the inner cavity
within the outer one.

The nested cavity concept offers a flexible design framework, depending on the
combination of cavities with different $Z_{\rm in}$ and $Z_{\rm out}$,
relative position of the inner cavity $\delta$, and the order of the sheets.
This work will focus on a quite simple but attractive setup where both
cavities have negligible losses ($Z_{\rm in}=jX_{\rm in}$ and $Z_{\rm
out}=jX_{\rm out}$), and their individual sheets have the same reactance
values, but alternating between inductive and capacitive layers ($X_{\rm
out}=-X_{\rm in}$). The first sheet of the system (the first one to be
illuminated by the incident wave) was chosen arbitrarily to be inductive
($X_{\rm out}>0$), as it can be either inductive or capacitive without
affecting the overall performance of the nested cavity. Thanks to the use of
resonant cavities with the same field localization $A_{\rm max,out}=A_{\rm
max,in}$, the combined field localization can reach a peak value of

$A_{\rm max,nest}=A_{\rm max,out}^{2}.$ (4)

More interestingly, the alignment for such maximum field localization is
independent of the used reactance $X_{\rm out}$, taking the form $\delta_{\rm
max}=\lambda_{0}/4+n\lambda_{0}/2$. On the other hand, due to the nature of
the standing wave, the field localized inside the inner cavity is minimized by
displacing it towards $\delta_{\rm min}$, a quarter-wave away from
$\delta_{\rm max}$. In that case, there is no localized field, as the overall
setup can be seen as two cascaded invisible cavities, and only a travelling
wave can be seen throughout the inner region.

##  III Quality Factor

In terms of frequency bandwidth, the combination of two nested invisible
cavities can increase the quality factor of the combined structure, compared
to the quality factor of each individual cavity. For the purpose of analyzing
the quality factor, the transmitted wave amplitude was calculated analytically
by satisfying the boundary conditions for each sheet at an arbitrary frequency
(see Supplementary Section S4). The quality factor, for this study, is defined
as the ratio $Q=f_{0}/{\rm BW}$ between the resonant frequency $f_{0}$ and the
bandpass bandwidth ${\rm BW}$, the region where the power of the transmitted
wave is at least half of the power coming from the incident wave. Due to the
complexity of the analytical expression for the transmitted wave, the half-
power passband was estimated numerically using an inner cavity with $d_{\rm
in}=\lambda_{0}/2$, while the outer cavity measures $d_{\rm
out}=3\lambda_{0}/2$. The resonant frequency was arbitrarily defined as
$f_{0}=1$ [GHz]. Both cavities use the same pair of grid impedances, with
reactances fluctuating between $X_{\rm out}=11.925$ [$\Omega$] ($A_{\rm
max,out}^{2}\approx 1002$) and $X_{\rm out}=291.617$ [$\Omega$] ($A_{\rm
max,out}^{2}\approx 3.37$).

Figure 3: Quality factor of a nested cavity behaves similarly to its electric
field maximum, being more resonant for lower values of the grid impedance,
while the locations for maximum and minimum values are the same for the
electric field maximum. Compared to the individual quality factor of the outer
and the inner cavities, a nested cavity can offer a variable quality factor
that can be similar to the individual cavities, or become more narrowband. The
drop of $Q_{\rm min}$ for high $X_{\rm out}$ values is the result of neighbour
four-layer resonant modes that extend the band-pass region.

Figure 3 provides comparison of the quality factor of the nested cavity and
the values achieved by the inner and outer cavities individually. For
simplicity in numerical calculations, we consider non-dispersive sheets. Due
to the resonant nature of the standing wave located at the inner cavity, it is
expected that the alignment that produces strong field localization will also
offer a high quality factor. Therefore, by placing the inner cavity at
$\delta_{\rm max}$, the nested cavity becomes highly resonant, achieving its
peak quality factor. Then, the quality factor can be controlled at will,
decreasing down to its minimum value located at $\delta_{\rm min}$. In general
terms, the lower boundary for the nested cavity quality factor is the one
achieved for the inner cavity only. One exception is found for high reactance
values of $X_{\rm out}$, where neighbour four-layer resonant modes combine
with the main resonant mode, creating a broader band-pass region.

##  IV Implementation with dielectric nanodisks

Figure 4: (a) After reducing the nanodisk dimensions to their two most significant digits, the nested cavity suffers a general drift of the operational frequency. (b) However, the nested cavity remains invisible as the zero-phase difference between the incident and transmitted waves also shifts towards the operational frequency. (c) The nested cavity is able to control the field localized inside the inner cavity as a function of its relative position with the outer one $\delta$. Peak localization is achieved at $\delta_{\rm max}=1.68\lambda_{0}$ with the peak electric field around ten times stronger than the incident one. (d) The nested cavity was designed from dielectric nanodisk unit cells, with periodicity $a$, radius $r$, and height $h$. The optimized dimensions for the inductive and capacitive sheets are presented in Table 1. (e) A cross-section view of the total electric field distribution across the cavity reveals that the localized field in the inner cavity is not affected by the nanodisks near fields as long as the proper distance between metasurfaces is chosen. | Inductive | Capacitive
---|---|---
$r$ [nm] | 302.25 ($0.195\lambda_{0}$) | 286.75 ($0.185\lambda_{0}$)
$h$ [nm] | 542.5 ($0.35\lambda_{0}$) | 573.5 ($0.37\lambda_{0}$)
$a$ [nm] | 775 ($0.5\lambda_{0}$) | 775 ($0.5\lambda_{0}$)
$\tilde{\Gamma}$ | $0.8205\angle 144.9^{\circ}$ | $0.4963\angle 125.1^{\circ}$
$\tilde{\tau}$ | $0.5691\angle 55.95^{\circ}$ | $0.868\angle-21.98^{\circ}$
Table 1: Nanodisks dimensions of the inductive and capacitive metasurfaces
with the two most significant digits with respect to the design wavelength
$\lambda_{0}=1550$ nm.

As a proof of concept, a nested cavity is designed to operate in the near-IR
range (with the design wavelength $\lambda_{0}=1550$ nm and frequency
$f_{0}=193.41$ THz). The target field enhancement in the inner cavity, when it
is aligned at $\delta_{\rm max}$, is chosen as nine times of the incident
field amplitude ($A_{\rm max,nest}=9$). According to Eq. (4), this enhancement
can be achieved by nesting two individual cavities each of which provides
maximum standing field amplifude of $A_{\rm max,out}=3$. It can be found that
these individual cavities can be formed from inductive and capacitive
metasurfaces with grid impedances $Z_{\rm e}=\pm j0.375\eta_{0}$. In optics,
it is more convenient to describe metasurfaces by their individual
transmission ($\tilde{\tau}$) and reflection ($\tilde{\Gamma}$) coefficients,
which are related to the grid impedance $Z_{\rm e}$ as [30, 17]

$\begin{matrix}\tilde{\tau}=\dfrac{2Z_{\rm e}}{2Z_{\rm
e}+\eta_{0}},&\tilde{\Gamma}=-\dfrac{\eta_{0}}{2Z_{\rm
e}+\eta_{0}}.\end{matrix}$ (5)

For the inductive metasurfaces ($Z_{\rm e}=j0.375\eta_{0}$), the scattering
coefficients are written as $\tilde{\tau}=0.6\angle 53.13^{\circ}$ and
$\tilde{\Gamma}=0.8\angle 143.13^{\circ}$. Likewise, the required capacitive
metasurfaces ($Z_{\rm e}=-j0.375\eta_{0}$) should have equivalent transmission
$\tilde{\tau}=0.6\angle-53.13^{\circ}$ and reflection
$\tilde{\Gamma}=0.8\angle 216.87^{\circ}$ coefficients.

Implementation of such nested cavities in optics can be conveniently done
using dielectric nanodisks [32], as depicted in Fig. 1. The meta-atom of Fig.
4(d) represents a nanodisk made of silicon (refractive index $n=3.46$ near the
design wavelength), surrounded by free space. The nanodisk has radius $r$ and
height $h$. Its axis is oriented orthogonally to the metasurface plane. Here,
for clarity of the analysis, we omit dielectric spacers between the individual
metasurfaces that does not qualitatively affects the presented results. In
order to reduce computational complexity during design, both metasurfaces have
meta-atoms with the same square lattice with period $a=\lambda_{0}/2$. This
particular value allows the excitation of electric dipole moments in the
nanodisks, while preventing generation of diffraction orders for normally
incident waves. To design metasurfaces with small impedances $Z_{\rm e}=\pm
j0.375\eta_{0}$, we first implement a resonant metasurface that emulates a
perfect electric conductor sheet with $Z_{\rm e}=0$. This can be done by
choosing a combination of $r$ and $h$ that produces an electric dipole
resonance at the design frequency [30]. Next, we slightly scale up (scale
down) the radius in order to depart from its dipole resonance and reach the
desired response for the inductive (and capacitive) nanodisk layers. Next,
each kind of metasurfaces was optimized separately using the built-in methods
in CST, with the required $\tilde{\tau}$ and $\tilde{\Gamma}$ as the
optimization targets. While the inductive nanodisk optimization was relatively
easy (as its Mie resonance frequency was far from the design frequency at
$189.43$ THz), the capacitive nanodisk (with the Mie resonance frequency of
$193.65$ THz) required additional optimization steps. For instance, the
capacitive nanodisk was optimized using first the outer cavity setup, with
invisibility (unitary transmission with zero phase shift) at the design
frequency as the optimization target. Then, the capacitive layers were tuned
in the nested configuration by placing the inner cavity at $\delta_{\rm
max}=1937.5$ nm (about 1.25 wavelengths), also with invisibility as the
optimization target. During the single cavity and nested cavity optimizations,
the inductive layers remained unchanged, as their individual transmission and
reflection coefficients were close to the optimization target from the
beginning. Simultaneous optimization of both inductive and capacitive
nanodisks was avoided to prevent other possible scenarios with different field
localization strengths. The separation between the metasurfaces was chosen
sufficiently large to prevent near-field coupling between contiguous layers.
In that regards, the inner cavity was designed with $d_{\rm in}=2\lambda_{0}$,
while the outer cavity had $d_{\rm out}=5\lambda_{0}$.

After the optimization, the geometry of the nested cavity was slightly
modified, considering fabrication constrains and limiting the nanodisk
dimensions to its two most significant digits, as summarized in Table 1. The
performance of this modified cavity is shown in Fig. 4 for different values of
the separation distance $\delta$ between the inner and outer cavities. The
most significant effect is a shift of the operational frequency (where the
nested cavity remains invisible) towards $f=193.695$ THz (a 0.2% variation
with respect to the design wavelength), as shown in Fig. 4(a). Invisibility is
verified by the results shown in Fig. 4(b), where the phase difference between
the incident and transmitted fields is close to zero around the operational
frequency range. In terms of field localization, Fig. 4(c) reveals that this
cavity produces field maxima at $\delta_{\rm max}=1.68\lambda_{0}$ close to
$E_{\rm max}=9.9839E_{\rm I}$, which is an increment of 10.93% with respect to
the target amplification. The strong field located in the right side of Fig.
4(c) is the near field excited at one of the nanodisk interfaces. The
frequency response in Figs. 4(a)-(c) also demonstrates that the quality factor
can be tuned by simply shifting the position of the inner cavity, as locating
the inner cavity at the position of the maximum field localization also grants
a high quality factor with a narrow pass-band region. A cross-section of the
field distribution along the nested cavity, as portrayed in Fig. 4(e), shows
the presence of both standing waves (inner and outer). The additional space
between metasurfaces has been proven effective, as the strong near fields
around the nanodisks remains localized close to the metasurfaces.

##  V Conclusions

In this work we presented and discussed the properties of a nested invisible
cavities and their implementations in the near infrared region. Each invisible
cavity was formed by inductive and capacitive metasurfaces. Both metasurfaces
were designed from nanodisk meta-atoms with an electric-dipole resonance. The
desired inductive and capacitive response was achieved by detuning the
nanodisk dimensions to shift the dipole resonance. The resulting nested cavity
offered a quadratic improvement of the quality factor achievable by the
individual cavities. Similar property was observed in the field localization
inside the nested cavity: With the proper alignment, the inner field intensity
increases by a power of two. Finally, we demonstrated that using an inner
invisible cavity, which does not perturb the outer cavity, the resulting
nested combination enables a simple means for tuning the quality factor and
the field localized strength in a wide and continuous range of values. We note
that it is possible to increase the number of nested cavities allowing further
increase of localized field strength.

In practice, if the cascaded metasurfaces are fabricated as four independent
layers, the distance between the inner and outer cavities can be controlled
using microelectromechanical systems (MEMS) nanopositioners [33, 34].
Alternatively, the optical distance $k_{0}\delta$ can be tuned through thermal
modulation [35], or using laser pulses [36, 37, 38, 39]. The proposed cavities
can be used for cloaking sensors and obstacles, enhancement of emission, and
creating exotic waveguides which are invisible in the direction orthogonal to
their walls [17].

Supplementary Material: See Supplement Material for for supporting content.

Acknowledgements: The authors would like to thank Prof. Sergei A. Tretyakov
and Dr. Mohammad S. Mirmoosa for their useful comments and discussions related
to this work.

Funding: This work was supported in part by the Academy of Finland under grant
330260 and by Nokia Foundation under scholarship 20200224.

## References

  * John [1991] S. John, Localization of light, Physics Today 44, 32 (1991).
  * Soref [2006] R. Soref, The past, present, and future of silicon photonics, IEEE Journal of Selected Topics in Quantum Electronics 12, 1678 (2006).
  * Koenderink  _et al._ [2015] A. F. Koenderink, A. Alù, and A. Polman, Nanophotonics: Shrinking light-based technology, Science 348, 516 (2015).
  * Marinica  _et al._ [2008] D. C. Marinica, A. G. Borisov, and S. V. Shabanov, Bound states in the continuum in photonics, Phys. Rev. Lett. 100, 183902 (2008).
  * Silveirinha [2014] M. G. Silveirinha, Trapping light in open plasmonic nanostructures, Phys. Rev. A 89, 023813 (2014).
  * Hsu  _et al._ [2016] C. W. Hsu, B. Zhen, A. D. Stone, J. D. Joannopoulos, and M. Soljačić, Bound states in the continuum, Nature Reviews Materials 1, 16048 (2016).
  * Azzam and Kildishev [2021] S. I. Azzam and A. V. Kildishev, Photonic bound states in the continuum: From basics to applications, Advanced Optical Materials 9, 2001469 (2021).
  * Plotnik  _et al._ [2011] Y. Plotnik, O. Peleg, F. Dreisow, M. Heinrich, S. Nolte, A. Szameit, and M. Segev, Experimental observation of optical bound states in the continuum, Phys. Rev. Lett. 107, 183901 (2011).
  * Zhen  _et al._ [2014] B. Zhen, C. W. Hsu, L. Lu, A. D. Stone, and M. Soljačić, Topological nature of optical bound states in the continuum, Phys. Rev. Lett. 113, 257401 (2014).
  * Miroshnichenko  _et al._ [2015] A. E. Miroshnichenko, A. B. Evlyukhin, Y. F. Yu, R. M. Bakker, A. Chipouline, A. I. Kuznetsov, B. Luk’yanchuk, B. N. Chichkov, and Y. S. Kivshar, Nonradiating anapole modes in dielectric nanoparticles, Nature Communications 6, 8069 (2015).
  * Wei  _et al._ [2016] L. Wei, Z. Xi, N. Bhattacharya, and H. P. Urbach, Excitation of the radiationless anapole mode, Optica 3, 799 (2016).
  * Wu  _et al._ [2018] P. C. Wu, C. Y. Liao, V. Savinov, T. L. Chung, W. T. Chen, Y.-W. Huang, P. R. Wu, Y.-H. Chen, A.-Q. Liu, N. I. Zheludev, and D. P. Tsai, Optical anapole metamaterial, ACS Nano 12, 1920 (2018).
  * Yang and Bozhevolnyi [2019] Y. Yang and S. I. Bozhevolnyi, Nonradiating anapole states in nanophotonics: from fundamentals to applications, Nanotechnology 30, 204001 (2019).
  * Baranov  _et al._ [2017] D. G. Baranov, A. Krasnok, and A. Alù, Coherent virtual absorption based on complex zero excitation for ideal light capturing, Optica 4, 1457 (2017).
  * Longhi [2018] S. Longhi, Coherent virtual absorption for discretized light, Opt. Lett. 43, 2122 (2018).
  * Marini  _et al._ [2020] A. Marini, D. Ramaccia, A. Toscano, and F. Bilotti, Metasurface-bounded open cavities supporting virtual absorption: free-space energy accumulation in lossless systems, Opt. Lett. 45, 3147 (2020).
  * Cuesta  _et al._ [2020] F. S. Cuesta, V. S. Asadchy, A. D. Sayanskiy, V. A. Lenets, M. S. Mirmoosa, X. Ma, S. B. Glybovski, and S. A. Tretyakov, Nonscattering metasurface-bound cavities for field localization, enhancement, and suppression, IEEE Transactions on Antennas and Propagation 68, 1689 (2020).
  * Cuesta  _et al._ [2019] F. Cuesta, J. Li, A. Díaz-Rubio, V. Asadchy, S. Cummer, and S. Tretyakov, Advanced control of invisible cavity resonators with bianisotropic metasurfaces, in  _2019 Thirteenth International Congress on Artificial Materials for Novel Wave Phenomena (Metamaterials)_ (2019) pp. X–098–X–100.
  * Sauleau [2005] R. Sauleau, Fabry–Perot resonators, in  _Encyclopedia of RF and Microwave Engineering_, edited by K. Chang (John Wiley & Sons, Ltd, Hoboken, N.J., 2005).
  * Fleury  _et al._ [2014] R. Fleury, D. L. Sounas, and A. Alù, Negative refraction and planar focusing based on parity-time symmetric metasurfaces, Phys. Rev. Lett. 113, 023903 (2014).
  * Ra’di  _et al._ [2016] Y. Ra’di, D. L. Sounas, A. Alù, and S. A. Tretyakov, Parity-time-symmetric teleportation, Phys. Rev. B 93, 235427 (2016).
  * Monticone  _et al._ [2016] F. Monticone, C. A. Valagiannopoulos, and A. Alù, Parity-time symmetric nonlocal metasurfaces: All-angle negative refraction and volumetric imaging, Phys. Rev. X 6, 041018 (2016).
  * Feng  _et al._ [2017] L. Feng, R. El-Ganainy, and L. Ge, Non-Hermitian photonics based on parity–time symmetry, Nature Photonics 11, 752–762 (2017).
  * Zhao and Feng [2018] H. Zhao and L. Feng, Parity–time symmetric photonics, National Science Review 5, 183 (2018).
  * Bohren and Huffman [1983] C. F. Bohren and D. R. Huffman,  _Absorption and scattering of light by small particles_ (Wiley, New York, 1983).
  * Mishchenko  _et al._ [2002] M. I. Mishchenko, L. D. Travis, and A. A. Lacis,  _Scattering, absorption, and emission of light by small particles_ (Cambridge University Press, Cambridge, New York, 2002).
  * Decker  _et al._ [2015a] M. Decker, I. Staude, M. Falkner, J. Dominguez, D. N. Neshev, I. Brener, T. Pertsch, and Y. S. Kivshar, High-efficiency dielectric huygens’ surfaces, Advanced Optical Materials 3, 813 (2015a).
  * Kruk and Kivshar [2017] S. Kruk and Y. Kivshar, Functional meta-optics and nanophotonics governed by Mie resonances, ACS Photonics 4, 2638 (2017).
  * Tzarouchis and Sihvola [2018] D. Tzarouchis and A. Sihvola, Light scattering by a dielectric sphere: Perspectives on the Mie resonances, Applied Sciences 8, 10.3390/app8020184 (2018).
  * Tretyakov [2003] S. Tretyakov,  _Analytical Modeling in Applied Electromagnetics_ (Artech House, Boston, 2003).
  * Simovski and Tretyakov [2020] C. Simovski and S. Tretyakov,  _An Introduction to Metamaterials and Nanophotonics_ (Cambridge University Press, New York, 2020).
  * Decker  _et al._ [2015b] M. Decker, I. Staude, M. Falkner, J. Dominguez, D. N. Neshev, I. Brener, T. Pertsch, and Y. S. Kivshar, High-efficiency dielectric huygens’ surfaces, Advanced Optical Materials 3, 813 (2015b).
  * Wang  _et al._ [2015] G. Wang, G. Chen, and F. Bai, High-speed and precision control of a piezoelectric positioner with hysteresis, resonance and disturbance compensation, Microsystem Technologies 22, 2499 (2015).
  * Maroufi  _et al._ [2017] M. Maroufi, A. G. Fowler, and S. O. R. Moheimani, Mems for nanopositioning: Design and applications, Journal of Microelectromechanical Systems 26, 469 (2017).
  * Weiss  _et al._ [2005] S. M. Weiss, H. Ouyang, J. Zhang, and P. M. Fauchet, Electrical and thermal modulation of silicon photonic bandgap microcavities containing liquid crystals, Opt. Express 13, 1090 (2005).
  * Guo  _et al._ [2004] H. Guo, H. Jiang, Y. Fang, C. Peng, H. Yang, Y. Li, and Q. Gong, The pulse duration dependence of femtosecond laser induced refractive index modulation in fused silica, Journal of Optics A: Pure and Applied Optics 6, 787 (2004).
  * Ortyl  _et al._ [2005] E. Ortyl, S. Kucharski, and T. Gotszalk, Refractive index modulation in the polyurethane films containing diazo sulfonamide chromophores, Thin Solid Films 479, 288 (2005).
  * Höfler  _et al._ [2006] T. Höfler, M. Weinberger, W. Kern, S. Rentenberger, and A. Pogantsch, Modifying the output characteristics of an organic light-emitting device by refractive-index modulation, Advanced Functional Materials 16, 2369 (2006).
  * Lei  _et al._ [2016] K. Lei, Y. Wang, M. Jiang, and Y. Wu, Refractive index modulation of Sb70Te30 phase-change thin films by multiple femtosecond laser pulses, Journal of Applied Physics 119, 173105 (2016).