© 20XX IEEE. Personal use of this material is permitted. Permission from IEEE
must be obtained for all other uses, in any current or future media, including
reprinting/republishing this material for advertising or promotional purposes,
creating new collective works, for resale or redistribution to servers or
lists, or reuse of any copyrighted component of this work in other works.

# Input-Output History Feedback Controller for Encrypted Control with Leveled
Fully Homomorphic Encryption

Kaoru Teranishi  Student Member, IEEE  Tomonori Sadamoto  Member, IEEE
and Kiminao Kogiso  Member, IEEE This work was supported by JSPS Grant-in-Aid
for JSPS Fellows Grant Number JP21J22442 and JSPS KAKENHI Grant Number
JP22H01509. Kaoru Teranishi, Tomonori Sadamoto, and Kiminao Kogiso are with
the Department of Mechanical and Intelligent Systems Engineering, The
University of Electro-Communications, Chofu, Tokyo, 182-8585, Japan (e-mail:
<EMAIL_ADDRESS><EMAIL_ADDRESS>kogiso@uec.ac.jp). Kaoru Teranishi is
also a Research Fellow of Japan Society for the Promotion of Science.

###### Abstract

Protecting the parameters, states, and input/output signals of a dynamic
controller is essential for securely outsourcing its computation to an
untrusted third party. Although a fully homomorphic encryption scheme allows
the evaluation of controller operations with encrypted data, an encrypted
dynamic controller with the encryption scheme destabilizes a closed-loop
system or degrades the control performance due to overflow. This paper
presents a novel controller representation based on input-output history data
to implement an encrypted dynamic controller that operates without
destabilization and performance degradation. Implementation of this encrypted
dynamic controller representation can be optimized via batching techniques to
reduce the time and space complexities. Furthermore, this study analyzes the
stability and performance degradation of a closed-loop system caused by the
effects of controller encryption. A numerical simulation demonstrates the
feasibility of the proposed encrypted control scheme, which inherits the
control performance of the original controller at a sufficient level.

Cyber-physical system, cyber-security, encrypted control, homomorphic
encryption, controller representation.

##  1 Introduction

The development of cloud computing technologies has promoted outsourcing
computation of resource-limited devices, as well as data storage. Control as a
service (CaaS) is a concept of cloud-based control that outsources decision-
making and monitoring of controlled devices to remote servers, and it is
introduced to several control systems, such as automation [1], robotics [2],
and automobiles [3]. CaaS has the advantages of scalability and efficiency in
terms of energy and costs. However, such control induces security concerns
that confidential information of control recipes and privacy of controlled
devices can be exposed to an untrusted third party.

Homomorphic encryption [4] is the major approach for establishing secure
outsourcing computation while maintaining the confidentiality of a computation
process by allowing the direct evaluation of mathematical arithmetic on
encrypted data without decryption. An encrypted control framework [5] was
introduced in the literature on control engineering to apply homomorphic
encryption for several control operations [6, 7, 8, 9, 10, 11, 12, 13, 14,
15]. Encrypted control can reduce the vulnerabilities induced by CaaS because
the controller parameters and control signals over networks are encrypted
while a controller server does not have a decryption key.

###  1.1 Problem of encrypting dynamic controller

Most of the studies on encrypted control considered the encryption of static
or linear controllers by using additive or multiplicative homomorphic
encryption [5, 6, 7], where the encrypted controller states were decrypted on
the plant side at every sampling period. However, encrypting dynamic
controllers without temporary decryption remains challenging because it causes
an overflow of the states to be encrypted. The majority of homomorphic
encryption schemes operate using integers rather than real numbers, and thus
controller states and other signals should be quantized before encryption. To
deal with this quantization, some studies used a binary representation of
fractional numbers [6, 13] or rounding of real numbers to the nearest element
in a plaintext space after scaling [7, 16]. The former increases the number of
bits for the representation by recursively updating the controller states with
homomorphic operations [17]. It is also inevitable for the latter that a value
of the scaling parameter is accumulated for every homomorphic operation. These
effects induce overflow when a dynamic controller is naively encrypted because
a plaintext space is a finite set. Once overflow occurs, the decrypted state
might be significantly different from the correct value, thereby easily
inducing instability of the encrypted control systems. Note that although some
homomorphic encryption schemes, such as Cheon-Kim-Kim-Song (CKKS) encryption
[18], support floating-point number computation, such schemes include a
quantization process with scaling factors in their encryption algorithms and
rescaling to manage the factors. The rescaling leads to overflow by recursive
computation because it decreases the size of a ciphertext modulus along with
resetting the accumulation of the factors. Hence, quantization effects cannot
be avoided in encrypted control systems.

To overcome this problem, the authors of [17] proposed a controller that
resets its states at a constant period to clear an increase of the number of
bits. However, such reset operation obviously degrades the control
performance. Another approach in [19] employed fully homomorphic encryption
for encrypting dynamic controllers. Fully homomorphic encryption enables to
evaluate any arithmetic operations over a ciphertext space. Thus, encrypted
dynamic controllers can be implemented using fully homomorphic encryption
because the accumulation of scaling parameters can be removed by division over
a ciphertext space. However, fully homomorphic encryption requires
bootstrapping, which is a technique used to manage noise in a ciphertext.
Bootstrapping requires a large amount of computation time and resources to be
performed, and therefore the realization of such encrypted control in real
time is difficult in practice. Note that, in fully homomorphic encryption, a
small noise is injected into a ciphertext to guarantee security. This noise
grows every homomorphic operation, and the decryption result includes a large
error when the noise reaches a certain size. Hence, bootstrapping is essential
for correct computation while ensuring security.

Recent studies [20, 21] reformulated a dynamic controller by pole placement
and similarity transformation so that its system matrix becomes an integer
matrix. This transformation makes quantization of the system matrix
unnecessary, and thus the scaling parameter for the controller states does not
accumulate. Moreover, these studies regarded the effect of injected noises in
Gentry-Sahai-Waters (GSW) encryption [22] as an external disturbance. When the
dynamic controller is stable under the disturbance, bootstrapping for the
encryption scheme was found to be unnecessary for the infinite-time-horizon
operation of the controller. Although this approach is promising for
implementing an encrypted dynamic controller without decrypting the controller
states, it requires many computational resources to store and compute over a
larger number of ciphertexts in the encrypted controller implementation. To
the best of our knowledge, the available fully homomorphic encryption in the
approach is limited to the GSW encryption because the approach depends on the
properties of the encryption scheme to manage the injected noises.
Furthermore, the reformulation of large-dimensional controllers sometimes
fails due to the numerical instability of pole placement.

###  1.2 Threat model and control system architecture

This study considers the cloud-based control system shown in Fig. 1, where
$\mathsf{Enc}$ and $\mathsf{Dec}$ are an encryptor and a decryptor,
respectively. The operator and sensor transmit a reference and plant output to
the encrypted controller, respectively, while the signals are encrypted by the
encryptors. The encrypted controller computes a control input and returns it
to the plant. The decryptor decrypts the control input, and the actuator
drives the plant using the decrypted control input. Note that the plant has a
public and secret key. In contrast, the operator and encrypted controller have
public and relinearization keys, respectively. A relinearization key is a type
of public key; its details are described later. We assume an eavesdropper
exists, and the cloud is honest-but-curious. The eavesdropper aims to steal
confidential information of the system by eavesdropping on signals over
network links. The honest-but-curious cloud tries to disclose some information
from obtained data while following a correct protocol.

We employ a leveled fully homomorphic encryption scheme to protect the control
system against the adversaries. The encryption scheme can conceal both
controller parameters and signals as opposed to additive and multiplicative
homomorphic encryption schemes and does not require bootstrapping different
from fully homomorphic encrytpion. Additionally, some schemes based on ring
learning with errors (RLWE) [23] provide a batching technique, which is
beneficial for efficient computations. Because of the advantages, some recent
studies have used leveled fully homomorphic encryption to realize data-driven
control [24, 25] and reinforcement learning [11]. Furthermore, it is utilized
for computing matrix multiplication to perform secure inference of machine
learning [26, 27, 28, 29, 30].

Figure 1: Cloud-based encrypted control system under adversaries. The blue
arrows are encrypted channels, and the red arrows illustrate eavesdropping
attacks.

###  1.3 Contribution

This study contributes to establishing a general efficient framework for the
secure outsourcing computation of dynamic controllers. The intrinsic
difficulty of encrypting a dynamic controller stems from the hardness of the
recursive update of the encrypted controller states without decryption. To
solve this difficulty, we propose a novel controller representation using
input/output history data of a controller to eliminate the controller states.
Furthermore, we clarify a condition so that an encrypted control system based
on the proposed framework inherits the stability of the original control
system under quantization effects due to encryption. Additionally, the degree
of performance degradation in the worst case is guaranteed as an upper bound
of the output trajectory error between the encrypted and unencrypted control
systems. The feasibility of the proposed framework is demonstrated through a
numerical simulation with a decentralized PI controller for a practical tank
system [31].

In contrast to the methods of [20, 21], our framework can be combined with any
leveled fully homomorphic encryption because the proposed controller
representation can solve the overflow and injected-noise management problems
regardless of an employed encryption scheme. According to this property, the
batching technique of RLWE-based encryption can be easily used to reduce space
and time complexities compared with the methods. Additionally, transformation
to the proposed controller representation is numerically stable even though
the dimension of the original controller is large.

###  1.4 Outline

The remainder of this paper is organized as follows. Section 2 introduces the
notations and leveled fully homomorphic encryption used in this paper. Section
3 presents a novel controller representation using the input-output history
data for encrypted control. Section 4 proposes an encrypted control scheme
that operates for an infinite time horizon without overflow using the novel
controller representation. Section 5 analyzes the effects of quantization by
encrypting the controller for stability and performance degradation of a
closed-loop system. Section 6 shows the results of a numerical simulation.
Section 7 describes the conclusions of this study and future work.

##  2 Preliminaries

###  2.1 Notation

The sets of real numbers, integers, and natural numbers are denoted by
$\mathbb{R}$, $\mathbb{Z}$, and $\mathbb{N}$, respectively. For $n>1$,
$\mathbb{Z}_{n}$ denotes the set of integers $\\{z\in\mathbb{Z}\mid-n/2<z\leq
n/2\\}$. A polynomial ring $R$ is defined as
$R\coloneqq\mathbb{Z}[X]/(X^{N}+1)$, where $N$ is a power of $2$. The set of
polynomials in $R$ with coefficients in $\mathbb{Z}_{n}$ is denoted by
$R_{n}$. For $x\in\mathbb{R}$, the symbol $\lfloor{\cdot}\rceil$ is defined by
$\lfloor{x}\rceil=\lfloor{x+1/2}\rfloor$, where $\lfloor{\cdot}\rfloor$ is the
floor function. The minimal residue of $z\in\mathbb{Z}$ modulo $n$ is denoted
by $[z]_{n}$. Similarly, $[\mathbf{a}]_{n}$ denotes the polynomial in $R_{n}$
given by applying $[\cdot]_{n}$ to all coefficients of $\mathbf{a}\in R$. The
sets of $n$-dimensional real-valued vectors and $m$-by-$n$ real-valued
matrices are denoted by $\mathbb{R}^{n}$ and $\mathbb{R}^{m\times n}$,
respectively. The $n$-dimensional zero row vector and $m$-by-$n$ zero matrix
are denoted by $\mathbf{0}_{n}$ and $O_{m\times n}$, respectively. The $i$th
element of vector $v\in\mathbb{R}^{n}$ is denoted by $v_{i}$. The $(i,j)$
entry of matrix $M\in\mathbb{R}^{m\times n}$ is denoted by $M_{ij}$. The
$\ell_{2}$ norm of $v$ and the induced $2$-norm of $M$ are denoted by $\|v\|$
and $\|M\|$, respectively. The vectorization of $M$ is defined by
$\mathop{\mathrm{vec}}\limits(M)\coloneqq[M_{1}^{\top}\cdots
M_{n}^{\top}]^{\top}$, where $M_{i}$ is the $i$th column vector of $M$, and
$M_{i}^{\top}$ is the transpose matrix of $M_{i}$. The spectral radius of $M$
is denoted by $\rho(M)$.

###  2.2 Brakerski/Fan-Vercauteren encryption scheme

This section provides an overview of the Brakerski/Fan-Vercauteren (BFV)
leveled fully homomorphic encryption scheme [32] used in this study. The
plaintext space of the BFV scheme is a polynomial ring, which is beneficial
for the effective encryption/decryption of vector data. The details of the
security and algorithms are described in Appendix .1.

The BFV scheme consists of algorithms $\mathsf{KeyGen}$, $\mathsf{Enc}$,
$\mathsf{Dec}$, $\mathsf{Add}$, and $\mathsf{Mult}$. The key generation
algorithm $\mathsf{KeyGen}(\lambda)$ takes a security parameter (i.e., key
length) $\lambda\in\mathbb{N}$ and outputs a public key $\mathsf{pk}\in
R_{Q}^{2}$, secret key $\mathsf{sk}\in R_{2}$, and relinearization key
$\mathsf{rlk}\in R_{Q}^{2}$. The public and secret keys are respectively used
to encrypt a plaintext and decrypt a ciphertext. The relinearization key is to
be published and is required for the process of relinearization. The
encryption algorithm $\mathsf{Enc}(\mathsf{pk},\mathbf{m})$ takes a public key
$\mathsf{pk}$ and a plaintext $\mathbf{m}\in R_{T}$ and outputs a ciphertext
$\mathsf{ct}\in R_{Q}^{2}$. Conversely, the decryption algorithm
$\mathsf{Dec}(\mathsf{sk},\mathsf{ct})$ takes a secret key $\mathsf{sk}$ and a
ciphertext $\mathsf{ct}$ and outputs a plaintext $\mathbf{m}$. The ciphertexts
of the BFV scheme must be correctly decrypted for all plaintexts in $R_{T}$
with valid parameters, namely
$\mathsf{Dec}(\mathsf{sk},\mathsf{Enc}(\mathsf{pk},\mathbf{m}))=\mathbf{m}$,
$\forall\mathbf{m}\in R_{T}$ for some $\lambda$ and for any $\mathsf{pk}$ and
$\mathsf{sk}$ generated by $\mathsf{KeyGen}(\lambda)$.

The BFV scheme enables evaluation of both addition and multiplication over the
ciphertext space. The number of the evaluation depends on a security parameter
$\lambda$. The addition algorithm
$\mathsf{Add}(\mathsf{ct}_{1},\mathsf{ct}_{2})$ takes ciphertexts
$\mathsf{ct}_{1}=\mathsf{Enc}(\mathsf{pk},\mathbf{m}_{1})$ and
$\mathsf{ct}_{2}=\mathsf{Enc}(\mathsf{pk},\mathbf{m}_{2})$ and satisfies
$\mathsf{Dec}(\mathsf{sk},\mathsf{Add}(\mathsf{ct}_{1},\mathsf{ct}_{2}))=[\mathbf{m}_{1}+\mathbf{m}_{2}]_{T}$.
Similarly, the multiplication algorithm
$\mathsf{Mult}(\mathsf{ct}_{1},\mathsf{ct}_{2})$ computes the homomorphic
multiplication. Note that the number of elements in a ciphetext
$\mathsf{ct}_{3}=\mathsf{Mult}(\mathsf{ct}_{1},\mathsf{ct}_{2})$ is three,
namely $\mathsf{ct}_{3}\in R_{Q}^{3}$. Hence, we cannot compute
$\mathsf{Add}(\mathsf{ct}_{1},\mathsf{ct}_{3})$ and
$\mathsf{Add}(\mathsf{ct}_{2},\mathsf{ct}_{3})$ because $\mathsf{ct}_{1}$ and
$\mathsf{ct}_{2}$ are in $R_{Q}^{2}$. The relinearization algorithm
$\mathsf{Relin}(\mathsf{rlk},\mathsf{ct}_{3})$ takes a relinearization key
$\mathsf{rlk}$ and a ciphertext
$\mathsf{ct}_{3}=\mathsf{Mult}(\mathsf{ct}_{1},\mathsf{ct}_{2})$ and outputs a
ciphertext having two elements. We assume that relinearization is performed
after every homomorphic multiplication, and then
$\mathsf{Dec}(\mathsf{sk},\mathsf{Mult}(\mathsf{ct}_{1},\mathsf{ct}_{2}))=[\mathbf{m}_{1}\mathbf{m}_{2}]_{T}$
holds. The security of the BFV scheme is based on the RLWE problem. The
problem is believed to be computationally hard to solve, even when a quantum
computer is used [23]. In the following, we omit the keys of the arguments for
simplicity.

###  2.3 Encoding and batching

Although the controller parameters and signals are real-number matrices and
vectors, respectively, the plaintext space of the BFV scheme is a polynomial
ring with coefficients of integer modulo $T$. Hence, the matrices and vectors
should be converted into a polynomial before encryption. To this end, we first
consider the following encoder and decoder to convert a real number into an
integer modulo $T$, and vice versa:
$\mathsf{Ecd}_{\Delta}:\mathbb{R}\to\mathbb{Z}_{T}:x\mapsto[\lfloor{x/\Delta}\rceil]_{T}$,
$\mathsf{Dcd}_{\Delta}:\mathbb{Z}_{T}\to\mathbb{R}:z\mapsto\Delta z$, where
$\Delta>0$ is a sensitivity for tuning the rounding errors caused by the
encoding process, and the encoder and decoder operate for each element of
vectors and matrices. With proper sensitivity, the elements of the matrices
and vectors can be encoded and decoded with the desired precision. The
quantization effects for stabilty and control performance are analyzed later.

Next, we consider transforming matrices and vectors of integer modulo $T$ to
the corresponding polynomials. One possible way for the transformation is to
regard an element of the matrices and vectors as a polynomial of degree zero.
This trivial transformation does not require additional computation processes.
However, it is not efficient from the perspective of the total computation
cost because an $m$-by-$n$ matrix or an $n$-dimensional vector have the same
number of polynomials to represent the plaintext, namely $mn$ or $n$
polynomials. The encryption and decryption algorithms should perform all
polynomials, and thus a large amount of computation time and resources are
required.

This study employs a batching technique for efficient transformation from
matrices and vectors to polynomials. Batching based on the Chinese remainder
theorem (CRT) is a technique used in RLWE-based encryption to pack multiple
integers into a single polynomial plaintext. The CRT batching is effective for
accelerating the computation of cryptosystems by allowing single
instruction/multiple data (SIMD) operations for homomorphic evaluation [33].
The remainder of this section describes the CRT batching for the BFV scheme.

Suppose $T$ is a prime such that $T=1\bmod 2N$, where $N$ is a power of $2$
used for defining a polynomial ring $R$ in Section 2.1. From the CRT, we have
the ring isomorphism
$R_{T}=\mathbb{Z}_{T}[X]/(X-\zeta)(X-\zeta^{3})\cdots(X-\zeta^{2N-1})\cong\mathbb{Z}_{T}[X]/(X-\zeta)\times\cdots\times\mathbb{Z}_{T}[X]/(X-\zeta^{2N-1})\cong\mathbb{Z}_{T}[\zeta]\times\cdots\times\mathbb{Z}_{T}[\zeta^{2N-1}]\cong\mathbb{Z}_{T}^{N}$
[34], where $\zeta$ is the primitive $2N$th root of unity, that is,
$\zeta^{2N}=1\bmod T$ and $\zeta^{i}\neq 1\bmod T$ for $0<i<2N$. The CRT
batching is constructed based on this isomorphism. A canonical map from
$R_{T}$ to $\mathbb{Z}_{T}^{N}$ is given as

$\mathbf{m}(X)\mapsto[\mathbf{m}(\zeta)\ \ \mathbf{m}(\zeta^{3})\ \ \cdots\ \
\mathbf{m}(\zeta^{2N-1})].$ (1)

The map (1) can be represented by the nega-cyclic number theoretic transform
(NTT) as follows [35]:

$\displaystyle\sigma^{-1}:R_{T}\to\mathbb{Z}_{T}^{N}:\mathbf{m}=\sum_{i=0}^{N-1}m_{i}X^{i}\mapsto[z_{1}\
\cdots\ z_{N}],$ (2) $\displaystyle\\!\\!\\!\\!\\!\begin{bmatrix}z_{1}\\\
z_{2}\\\ \vdots\\\
\\!z_{N}\\!\end{bmatrix}\\!\\!=\\!\\!\left[\\!\begin{bmatrix}1&1&\cdots&1\\\
1&\omega&\cdots&\omega^{N-1}\\\ \vdots&\vdots&\ddots&\vdots\\\
1&\omega^{N-1}&\cdots&\omega^{(N-1)^{2}}\\\
\end{bmatrix}\\!\\!\\!\left(\\!\begin{bmatrix}1\\\ \zeta\\\ \vdots\\\
\\!\zeta^{N-1}\\!\end{bmatrix}\\!\\!\odot\\!\\!\begin{bmatrix}m_{0}\\\
m_{1}\\\ \vdots\\\
\\!m_{N-1}\\!\end{bmatrix}\\!\right)\\!\\!\right]_{\\!T}\\!\\!,$

where $\odot$ denotes the Hadamard product, and $\omega$ is the primitive
$N$th root of unity. Additionally, the inverse transformation of (2) with the
inverse NTT is given as

$\displaystyle\sigma:\mathbb{Z}_{T}^{N}\to R_{T}:[z_{1}\ \cdots\
z_{N}]\mapsto\mathbf{m}=\sum_{i=0}^{N-1}m_{i}X^{i},$ (3)
$\displaystyle\\!\\!\\!\\!\begin{bmatrix}m_{0}\\\ m_{1}\\\ \vdots\\\
\\!m_{N-1}\\!\end{bmatrix}\\!\\!=\\!\\!\left[\\!\begin{bmatrix}1\\\ \xi\\\
\vdots\\\
\\!\xi^{N-1}\\!\end{bmatrix}\\!\\!\odot\\!\\!\left(\\!\\!\cfrac{1}{N}\\!\begin{bmatrix}1&1&\cdots&1\\\
1&\pi&\cdots&\pi^{N-1}\\\ \vdots&\vdots&\ddots&\vdots\\\
1&\pi^{N-1}&\cdots&\pi^{(N-1)^{2}}\\\
\end{bmatrix}\\!\\!\\!\\!\begin{bmatrix}z_{1}\\\ z_{2}\\\ \vdots\\\
\\!z_{N}\\!\end{bmatrix}\\!\right)\\!\\!\right]_{\\!T}\\!\\!,$

where $\xi=[\zeta^{-1}]_{T}$ and $\pi=[\omega^{-1}]_{T}$. Consequently, we
obtain the map (3) for packing multiple integers into a single polynomial and
the map (2) for unpacking the polynomial.

##  3 Input-Output History Feedback Controller

This section proposes a novel controller representation to implement an
encrypted dynamic controller. The proposed scheme represents any linear time-
invariant controller without controller states, instead of using the history
of inputs and outputs of the controller.

Given a discrete-time system

$\left\\{\begin{aligned} x_{t+1}&=A_{p}x_{t}+B_{p}u_{t}+w_{t},\\\
y_{t}&=C_{p}x_{t}+v_{t},\end{aligned}\right.$ (4)

where $t\in\mathbb{N}$ is a time, $x\in\mathbb{R}^{n}$ is a state,
$u\in\mathbb{R}^{m}$ is an input, $y\in\mathbb{R}^{\ell}$ is an output,
$w\in\mathbb{R}^{n}$ is a process noise, and $v\in\mathbb{R}^{\ell}$ is a
measurement noise. $(A_{p},B_{p})$ and $(A_{p},C_{p})$ are controllable and
observable, respectively. This study considers encrypting the following linear
time-invariant controller based on history data to control the plant (4):

$\left\\{\begin{aligned} z_{t+1}&=Az_{t}+By_{t}+Er_{t},\\\
u_{t}&=Cz_{t}+Dy_{t}+Fr_{t},\end{aligned}\right.$ (5)

where $z\in\mathbb{R}^{p}$ is a controller state, and $r\in\mathbb{R}^{q}$ is
a reference input. We assume that the pair $(A,C)$ is observable without loss
of generality. If the pair is not observable, the controller can be
reconstructed as minimal realization. This section presents another
representation of (5) without using its state $z$, called the input-output
history feedback controller (IOHFC) representation, in order to enable an
encrypted controller of (5) to operate for an infinite time horizon without
overflow.

Let $[d_{k}]_{t_{2}}^{t_{1}}\coloneqq[d_{t_{1}}^{\top}\ \cdots\
d_{t_{2}}^{\top}]^{\top}$ be a stacked vector of time-series data $d_{k}$ for
$t_{1}\leq k\leq t_{2}$. With this notation, the following equations are
obtained from (5):

$\displaystyle z_{t}$
$\displaystyle=A^{L}z_{t-L}+R_{L}[y_{k}]_{t-1}^{t-L}+S_{L}[r_{k}]_{t-1}^{t-L},$
(6) $\displaystyle[u_{k}]_{t-1}^{t-L}$
$\displaystyle=V_{L}z_{t-L}+H_{L}[y_{k}]_{t-1}^{t-L}+J_{L}[r_{k}]_{t-1}^{t-L},$
(7)

where $L>0$ is a data length, $V_{L}\coloneqq[C^{\top}\ \cdots\
(CA^{L-1})^{\\!\top}]^{\\!\top}$ $\in\mathbb{R}^{Lm\times p}$,
$R_{L}\coloneqq[A^{L-1}B\ \cdots\ B]\in\mathbb{R}^{p\times L\ell}$,
$S_{L}\coloneqq[A^{L-1}E\ \cdots\ E]\in\mathbb{R}^{p\times Lq}$, and

$\displaystyle H_{L}$ $\displaystyle\coloneqq\begin{bmatrix}D&O&\cdots&O&O\\\
CB&D&\cdots&O&O\\\ \vdots&\vdots&\ddots&\vdots&\vdots\\\
CA^{L-2}B&CA^{L-1}B&\cdots&CB&D\end{bmatrix}\in\mathbb{R}^{Lm\times L\ell},$
$\displaystyle J_{L}$ $\displaystyle\coloneqq\begin{bmatrix}F&O&\cdots&O&O\\\
CE&F&\cdots&O&O\\\ \vdots&\vdots&\ddots&\vdots&\vdots\\\
CA^{L-2}E&CA^{L-1}E&\cdots&CE&F\end{bmatrix}\in\mathbb{R}^{Lm\times Lq}.$

Assume that $L\geq p$ is chosen to satisfy $\mathop{\rm rank}\limits V_{L}=p$.
Then, there exists the Moore-Penrose inverse $V_{L}^{+}$ of $V_{L}$ such that
$V_{L}^{+}V_{L}=I$ because $V_{L}$ is full column rank. Thus, it follows from
(7) that

$z_{t-L}=V_{L}^{+}[u_{k}]_{t-1}^{t-L}-V_{L}^{+}H_{L}[y_{k}]_{t-1}^{t-L}-V_{L}^{+}J_{L}[r_{k}]_{t-1}^{t-L}.$
(8)

By substituting (8) into (6), the controller state $z$ at time $t$ can be
represented as

$\displaystyle z_{t}$
$\displaystyle\\!=\\!(S_{L}-A^{L}V_{L}^{+}J_{L})[r_{k}]_{t-1}^{t-L}+(R_{L}-A^{L}V_{L}^{+}H_{L})[y_{k}]_{t-1}^{t-L}$
$\displaystyle\quad+A^{L}V_{L}^{+}[u_{k}]_{t-1}^{t-L}.$

Hence, the input $u$ can be computed as follows.

$u_{t}=Kd_{t},$ (9)

where

$\displaystyle K$ $\displaystyle\coloneqq\Bigl{[}C(S_{L}-A^{L}V_{L}^{+}J_{L})\
\ F\ \ C(R_{L}-A^{L}V_{L}^{+}H_{L})$ $\displaystyle\quad\quad D\ \
CA^{L}V_{L}^{+}\Bigr{]},$ $\displaystyle d_{t}$
$\displaystyle\coloneqq\begin{bmatrix}([r_{k}]_{t}^{t-L})^{\top}&([y_{k}]_{t}^{t-L})^{\top}&([u_{k}]_{t-1}^{t-L})^{\top}\end{bmatrix}^{\top}.$

The controller (9) is another representation of the controller (5) based on
the history data and current output/reference, and their control inputs
$u_{t}$ are the same after $L$ samples. Consequently, we obtain the following
theorem.

###### Theorem 1

For the linear time-invariant controller (5), there exists an IOHFC (9) such
that its control input exactly matches that of (5) for all $t\geq L$.
Furthermore, if $z_{t}=0$ for all $t\leq 0$, the control inputs of (5) and (9)
are identical for all $t\geq 0$.

A schematic picture of the IOHFC is illustrated in Fig. 2. The controller has
three queues of lengths $L+1$ and $L$ to store history data. A reference input
$r$ and output $y$ are respectively transmitted to the controller from an
operator and a plant at time $t$ and added to the back end of the queues.
Then, the control input $u$ of the controller (9) is simply computed by the
product between a controller gain $K$ and a data vector $d$ constructed from
the history data. The control input is returned to the plant and appended to
the back end of the queue simultaneously.

###### Remark 1

The proposed controller representation is a form of a vector autoregressive
model with exogenous variables. Some studies have used the model to represent
dynamical systems [36, 37]. However, to the best of our knowledge, few studies
have applied the model to dynamic feedback controllers. Theorem 1 reveals that
a dynamic controller can be represented by history data instead of the
controller state without performance degradation.

###### Remark 2

The IOHFC representation can be applied to not only controllers but also any
linear time-invariant systems. For example, the Kalman filter for (4),
$\hat{x}_{t+1}=(A_{p}-GC_{p})\hat{x}_{t}+B_{p}u_{t}+Gy_{t}$,
$\hat{y}_{t}=C_{p}\hat{x}_{t}$, can be representated as
$\hat{y}_{t}=\Sigma[([y_{k}]_{t}^{t-L})^{\top}\
([u_{k}]_{t-1}^{t-L})^{\top}]^{\top}$, where $\hat{x}$ is an estimated state,
$\hat{y}$ is an estimated output, $G$ is a Kalman gain, and $\Sigma$ is an
appropriate matrix obtained by the IOHFC representation. Hence, secure
outsourcing computation of forecasting, filtering, and sensor fusion
associated with dynamics can also be realized by using the proposed
representation.

Figure 2: Schematic picture of the IOHFC ($L=7$).

##  4 Encrypting IOHFC

This section provides an efficient matrix-vector multiplication algorithm over
encrypted data using the encoding and batching technique in Section 2.
Furthermore, an algorithm for the implementation of an encrypted IOHFC is
proposed based on the matrix-vector multiplication algorithm to allow the
controller to operate for an infinite time horizon without overflow.

###  4.1 Matrix-vector multiplication by SIMD operations

We present a method for secure matrix-vector multiplication by SIMD operations
[26, 38]. With the CRT batching, element-wise addition and multiplication
between two vectors $v_{1},v_{2}\in\mathbb{Z}_{T}^{N}$ can be evaluated by the
SIMD operations over the ciphertext space as follows:

$\displaystyle\sigma^{-1}\circ\mathsf{Dec}\circ\mathsf{Add}(\mathsf{Enc}\circ\sigma(v_{1}),\mathsf{Enc}\circ\sigma(v_{2}))$
$\displaystyle=[v_{1}+v_{2}]_{T},$
$\displaystyle\sigma^{-1}\circ\mathsf{Dec}\circ\mathsf{Mult}(\mathsf{Enc}\circ\sigma(v_{1}),\mathsf{Enc}\circ\sigma(v_{2}))$
$\displaystyle=[v_{1}\odot v_{2}]_{T}.$

Moreover, the BFV scheme with the CRT batching allows permutations of
plaintext slots, that is, the positions of the elements of an integer vector,
by using the Galois automorphism sending a polynomial $\mathbf{m}(X)\in R_{T}$
to $\mathbf{m}(X^{2i-1})$ [34]. We define this permutation of shifting one
slot to the left as $\mathsf{Rotate}:R_{Q}^{2}\to
R_{Q}^{2}:\mathsf{ct}\mapsto\mathsf{ct}^{\prime}$, and it satisfies
$\sigma^{-1}\circ\mathsf{Dec}\circ\mathsf{Rotate}\circ\mathsf{Enc}\circ\sigma([z_{1}\
z_{2}\ \cdots\ z_{N}])=[z_{2}\ \cdots\ z_{N}\ z_{1}]$, where
$z_{i}\in\mathbb{Z}_{T}$ for $1\leq i\leq N$.

Algorithm 1 is the method combined with $\mathsf{Add}$, $\mathsf{Mult}$, and
$\mathsf{Rotate}$ to compute multiplication between a matrix and vector, and
Fig. 3 is the illustration of the algorithm. The matrix $M$ is embedded in the
first $mn$ elements of the temporary row vector $z_{1}$ such that each row of
the matrix lines up (line $2$). Similarly, the vector $v$ is copied $m$ times,
and then the vectors are also embedded in $z_{2}$. These processes are shown
in Fig. 3(b). The temporary vectors are packed into single polynomials and
encrypted (line $4$). Using the SIMD operations, each element of the vectors
is multiplied over the ciphertext space, and then the resultant vector is
added with the rotation of itself $n-1$ times (lines $6$–$9$). The computed
ciphertext is decrypted and unpacked to $z_{3}$, and the $(i+1)$th elements of
$z_{3}$ for $0\leq i\leq(m-1)n$ are extracted to construct the target vector
$[Mv]_{T}$ (lines $11$–$12$). The SIMD operations of the vectors and the
construction of the target vector are shown in Fig. 3(c).

We employ
$\mathsf{Enc}_{\Delta}\coloneqq\mathsf{Enc}\circ\sigma\circ\mathsf{Ecd}_{\Delta}$
and
$\mathsf{Dec}_{\Delta}\coloneqq\mathsf{Dcd}_{\Delta}\circ\sigma^{-1}\circ\mathsf{Dec}$
for the encryption and decryption of a real-valued vector in the following.

Algorithm 1 Secure matrix-vector multiplication by SIMD operations.

1:$M\in\mathbb{Z}_{T}^{m\times n}$, $v\in\mathbb{Z}_{T}^{n}$

2:$[Mv]_{T}$

3:Let $z_{1}$, $z_{2}$, and $z_{3}$ be row vectors in $\mathbb{Z}_{T}^{N}$

4:$z_{1}\leftarrow[\mathop{\mathrm{vec}}\limits(M^{\top})^{\top}\
\mathbf{0}_{N-mn}]$, $z_{2}\leftarrow[v^{\top}\ \cdots\ v^{\top}\
\mathbf{0}_{N-mn}]$

5:# Encryption

6:$\mathsf{ct}_{1}\leftarrow\mathsf{Enc}\circ\sigma(z_{1})$,
$\mathsf{ct}_{2}\leftarrow\mathsf{Enc}\circ\sigma(z_{2})$

7:# Multiplication over the ciphertext space

8:$\mathsf{ct}_{3}\leftarrow\mathsf{Mult}(\mathsf{ct}_{1},\mathsf{ct}_{2})$

9:while $n-1$ times do

10:
$\mathsf{ct}_{3}\leftarrow\mathsf{Add}(\mathsf{ct}_{3},\mathsf{Rotate}(\mathsf{ct}_{3}))$

11:end while

12:# Decryption

13:$z_{3}\leftarrow\sigma^{-1}\circ\mathsf{Dec}(\mathsf{ct}_{3})$

14:return $[z_{3,1}\ z_{3,n+1}\ \cdots\ z_{3,(m-1)n+1}]^{\top}$

Figure 3: Illustration of secure matrix-vector multiplication over the
ciphertext space. (a) Matrix $M\in\mathbb{Z}_{T}^{2\times 3}$, vector
$v\in\mathbb{Z}_{T}^{3}$, and target vector $[Mv]_{T}\in\mathbb{Z}_{T}^{2}$.
(b) The elements of $M$ and $v$ are embedded in corresponding $N$-dimensional
vectors $z_{1}$ and $z_{2}$, respectively. The white boxes of the vectors
contain zero. Element-wise multiplication $z_{1}\odot z_{2}$ between the
vectors is computed. (c) The computed vector is added with the rotation of
itself three times to obtain $z_{3}$. The gray boxes of $z_{3}$ are wasted
data. The target vector is constructed from the first and forth elements of
$z_{3}$.

###  4.2 Encrypted IOHFC with input re-encryption

Encrypting the IOHFC (9) may appear to be straightforward because leveled
fully homomorphic encryption enables the evaluation of both multiplication and
addition over a ciphertext space. However, the IOHFC cannot be directly
implemented in an encrypted fashion, even though Algorithm 1 is used. This is
because the history data $d$ cannot be updated recursively when the vector is
encrypted to a single ciphertext. One may think that history data can be
updated by multiplying a masking vector to the ciphertext of $d$ and rotating
the masked ciphertext. Unfortunately, this approach causes overflow due to the
increase of ciphertext noise because the masking vector must be multiplied
every sampling time. Moreover, the ciphertext cannot be altered into another
one corresponding to an updated plaintext vector without decryption.

To overcome this problem, this study splits the controller gain of the IOHFC
(9) into block matrices for each time step as follows:

$\displaystyle u_{t}$
$\displaystyle=\sum_{i=0}^{L}K_{r,i}r_{t-i}+\sum_{i=0}^{L}K_{y,i}y_{t-i}+\sum_{i=0}^{L-1}K_{u,i}u_{t-(i+1)},$
$\displaystyle=\sum_{i=0}^{L}\hat{K}_{i}\hat{d}_{i},$ (10)

where

$\displaystyle\hat{K}_{i}$ $\displaystyle=\left\\{\begin{aligned}
&\begin{bmatrix}K_{r,i}&K_{y,i}&K_{u,i}\end{bmatrix},&\quad&i=0,\dots,L-1,\\\
&\begin{bmatrix}K_{r,i}&K_{y,i}&O_{m\times
m}\end{bmatrix},&\quad&i=L,\end{aligned}\right.$ $\displaystyle\hat{d}_{i}$
$\displaystyle=\left\\{\begin{aligned}
&\begin{bmatrix}r_{t-i}^{\top}&y_{t-i}^{\top}&u_{t-i}^{\top}\end{bmatrix}^{\top},&\quad&i=0,\dots,L-1,\\\
&\begin{bmatrix}r_{t-i}^{\top}&y_{t-i}^{\top}&\mathbf{0}_{m}\end{bmatrix}^{\top},&\quad&i=L,\end{aligned}\right.$
$\displaystyle K_{r,i}$ $\displaystyle=K_{1:m,qi+1:q(i+1)},$ $\displaystyle
K_{y,i}$ $\displaystyle=K_{1:m,q(L+1)+\ell i+1:q(L+1)+\ell(i+1)},$
$\displaystyle K_{u,i}$
$\displaystyle=K_{1:m,(q+\ell)(L+1)+mi+1:(q+\ell)(L+1)+m(i+1)},$

and $K_{a:b,c:d}$ is a block matrix obtained by slicing the $a$th to $b$th
rows and the $c$th to $d$th columns of $K$. Fig. 4 depicts a schematic picture
of the modified IOHFC (10) that has a queue of length $L$. The current
reference $r_{t}$ and output $y_{t}$ are appended to the back end of the
queue. Then, the data $\hat{d}_{i}$ in each slot of the queue is multiplied by
the gain $\hat{K}_{i}$ and aggregated to obtain a control input $u_{t}$. The
obtained control input is used to update the data $\hat{d}_{L-1}$ stored in
the second slot from the back of the queue. Note that the products between
$\hat{K}_{i}$ and $\hat{d}_{i}$ and their aggregation can be computed over a
ciphertext space by applying Algorithm 1.

Figure 4: Schematic picture of the modified IOHFC ($L=7$).

Here, we need to address another problem due to accumulation of sensitivities
and an increase of noise in a ciphertext stored in the controller. A control
input $u_{t}$ in Fig. 4 is added to the queue and recursively used to the next
$L-1$ times the control input computations. This operation accumulates the
sensitivity $\Delta_{K}$, which is used for encoding the controller gain, and
increases the noise of the ciphertext in the second slot from the back end of
the queue. In such a case, the encrypted controller cannot operate for an
infinite time horizon due to overflow, as discussed in Section 1.1.

This study considers input re-encryption, as shown in Fig. 5, to solve the
problem of accumulation of the sensitivity. In the figure, the sensitivities
in $\mathsf{Enc},\mathsf{Dec}$ are omitted for simplicity. The overall
processes of the encrypted control system are described in Algorithm 2. Before
operating the encrypted controller, a designer creates and distributes keys to
the plant, operator, and controller (line $2$). Additionally, he/she
initializes the ciphertexts of the controller gain matrices $\mathsf{ct}_{K}$
and queue $\mathsf{ct}_{d}$, which stores ciphertexts of history data (lines
$3$–$6$). The operator and plant respectively pack and encrypt the current
reference input $r_{t}$ and output $y_{t}$ into single ciphertexts and
transmit them to the controller, and then controller adds the ciphertexts to
the back end of the queue. (lines $8$–$13$). The controller evaluates (10)
over the ciphertext space with encrypted controller gains and encrypted
history data using the same methodology as Algorithm 1 (lines $14$–$21$). The
controller updates the queue and returns the computed ciphertext to the plant,
and then the plant recovers input $u_{t}$ by decrypting the ciphertext (lines
$22$–$28$). Subsequently, the input is re-encrypted and transmitted to the
controller, and then the controller adds the ciphertext to the second slot
from the back end of the queue (lines $29$–$31$).

Figure 5: Encrypted control system with IOHFC. Algorithm 2 Implementation of
the encrypted IOHFC with input re-encryption.

1:$\lambda$, $K$, $r_{t}$, $y_{t}$, $\Delta_{K}$, $\Delta_{d}$, $L$, $q$,
$\ell$, $m$, $h=q+\ell+m$

2:$u_{t}$

3:# Preprocessing of designer

4:$(\mathsf{pk},\mathsf{sk},\mathsf{rlk})\leftarrow\mathsf{KeyGen}(\lambda)$,
and transmit $(\mathsf{pk},\mathsf{sk})$, $\mathsf{pk}$, and $\mathsf{rlk}$ to
the plant, operator, and controller, respectively

5:for $i=0,\dots,L$ do

6:
$\mathsf{ct}_{K}[i]\leftarrow\mathsf{Enc}_{\Delta_{K}}([\mathop{\mathrm{vec}}\limits(\hat{K}_{i}^{\top})^{\top}\
\mathbf{0}_{N-mh}])$

7: $\mathsf{ct}_{d}[i]\leftarrow\mathsf{Enc}_{\Delta_{d}}(\mathbf{0}_{N})$

8:end for

9:loop

10: # Operator transmits reference input to controller

11: $\mathsf{ct}_{r}\leftarrow\mathsf{Enc}_{\Delta_{d}}([r_{t}^{\top}\
\mathbf{0}_{\ell}\ \mathbf{0}_{m}\ \cdots\ r_{t}^{\top}\ \mathbf{0}_{\ell}\
\mathbf{0}_{m}\ \mathbf{0}_{N-mh}])$

12:
$\mathsf{ct}_{d}[L]\leftarrow\mathsf{Add}(\mathsf{ct}_{d}[L],\mathsf{ct}_{r})$

13: # Plant transmits output to controller

14: $\mathsf{ct}_{y}\leftarrow\mathsf{Enc}_{\Delta_{d}}([\mathbf{0}_{q}\
y_{t}^{\top}\ \mathbf{0}_{m}\ \cdots\ \mathbf{0}_{q}\ y_{t}^{\top}\
\mathbf{0}_{m}\ \mathbf{0}_{N-mh}])$

15:
$\mathsf{ct}_{d}[L]\leftarrow\mathsf{Add}(\mathsf{ct}_{d}[L],\mathsf{ct}_{y})$

16: # Controller returns input ciphertext $\mathsf{ct}$ to plant

17:
$\mathsf{ct}\leftarrow\mathsf{Mult}(\mathsf{ct}_{K}[0],\mathsf{ct}_{d}[0])$

18: for $i=1,\dots,L$ do

19:
$\mathsf{ct}\leftarrow\mathsf{Add}(\mathsf{ct},\mathsf{Mult}(\mathsf{ct}_{K}[i],\mathsf{ct}_{d}[i]))$

20: end for

21: while $h-1$ times do

22:
$\mathsf{ct}\leftarrow\mathsf{Add}(\mathsf{ct},\mathsf{Rotate}(\mathsf{ct}))$

23: end while

24: # Controller updates history data

25: for $i=0,\dots,L-1$ do

26: $\mathsf{ct}_{d}[i]\leftarrow\mathsf{ct}_{d}[i+1]$

27: end for

28: # Plant recovers input

29: $w\leftarrow\mathsf{Dec}_{\Delta_{K}\Delta_{d}}(\mathsf{ct})$

30: $u_{t}\leftarrow[w_{1}\ w_{h+1}\ \cdots\ w_{(m-1)h+1}]^{\top}$

31: # Plant transmits re-encrypted input to controller

32: $\mathsf{ct}_{u}\leftarrow\mathsf{Enc}_{\Delta_{d}}([\mathbf{0}_{q}\
\mathbf{0}_{\ell}\ u_{t}^{\top}\ \cdots\ \mathbf{0}_{q}\ \mathbf{0}_{\ell}\
u_{t}^{\top}\ \mathbf{0}_{N-mh}])$

33:
$\mathsf{ct}_{d}[L-1]\leftarrow\mathsf{Add}(\mathsf{ct}_{d}[L-1],\mathsf{ct}_{u})$

34:end loop

Owing to input re-encryption, the sensitivity of each element in the queue
$\mathsf{ct}_{d}$ is $\Delta_{d}$, which is used for encoding the history
data, even though the sensitivity of $\mathsf{ct}$ is $\Delta_{K}\Delta_{d}$.
Moreover, ciphertexts appended to the back end of the queue are always fresh
ciphertexts. Thus, the sensitivity and noise in each ciphertext stored in the
queue do not accumulate and increase, and the encrypted control system with
the IOHFC can operate for an infinite time horizon without overflow.

###### Remark 3

The number of executed algorithms of the BFV scheme within a sampling period
is listed in Table 1, where $h=q+\ell+m$. Despite the fact that the reference
input $r$, output $y$, and input $u$ are vectors, the operator and the plant
respectively execute encryption only once and twice before sending them to the
controller, and the plant also performs decryption once after receiving the
ciphertext from the controller. Furthermore, the number of homomorphic
multiplications computed by the controller does not depend on the dimensions
of the vectors. This is because the vectors are packed into single ciphertexts
by the CRT batching.

Table 1: Number of Algorithms Executed Within a Sampling Period | $\mathsf{Enc}$ | $\mathsf{Dec}$ | $\mathsf{Add}$ | $\mathsf{Mult}$ | $\mathsf{Rotate}$
---|---|---|---|---|---
Operator | $1$ | – | – | – | –
Plant | $2$ | $1$ | – | – | –
Controller | – | – | $L+h+2$ | $L+1$ | $h-1$

###### Remark 4

In [20, 21], the dynamic controller (5) was transformed to the form

$\left\\{\begin{aligned}
z^{\prime}_{t+1}&=M(A-GC)M^{-1}z^{\prime}_{t}+M(B-GD)y_{t}\\\
&\quad+M(E-GF)r_{t}+MGu_{t},\\\
u_{t}&=CM^{-1}z^{\prime}_{t}+Dy_{t}+Fr_{t},\quad
z^{\prime}_{0}=Mz_{0}\end{aligned}\right.$

by appropriately choosing $G\in\mathbb{R}^{p\times m}$ and
$M\in\mathbb{R}^{p\times p}$ so that $M(A-GC)M^{-1}\in\mathbb{Z}^{p\times p}$
and encrypted by using the GSW encryption. Thus,
$[(p+q+\ell+m)(N+1)+\\{p(p+q+\ell+m)+m(p+q+\ell)\\}b(N+1)^{2}]\log_{2}Q$ bits
memory is required to naively implement the encrypted controller because each
element of the signals and controller parameters are respectively encrypted to
an element in $\mathbb{Z}_{Q}^{N+1}$ and $\mathbb{Z}_{Q}^{(N+1)\times
b(N+1)}$, where $b\in\mathbb{N}$. In contrast, the encrypted IOHFC requires
$4(p+1)N\log_{2}Q$ bits memory because $\hat{K}_{i}$ and $\hat{d}_{i}$ for
$i=0,\dots,L$ are encrypted to elements in $R_{Q}^{2}$, and $L=p$ is the
smallest choice of data length. Note that, in a naive implementation, an
element in $R_{Q}^{2}$ can be represented by two $N$-dimensional vectors of
which coefficients are in $\mathbb{Z}_{Q}$. As an example, if the parameters
are set to $p=q=\ell=m=2$, $N=4096$, $\log_{2}Q=109$, and $b=3$, then the
memory sizes of the conventional and our methods are almost $17.89$ GB and
$654$ KB, respectively. Moreover, although the conventional method takes
$p(p+q+\ell+m)+m(p+q+\ell)$ multiplications and
$p(p+q+\ell+m)+m(p+q+\ell)-(4p+3m)$ additions for each time step, our method
takes $p+1$ multiplications, $p+q+\ell+m+2$ additions, and $q+\ell+m-1$
rotations. The computation time of multiplication is much longer than addition
and rotation. Therefore, our method can improve the time and space
complexities of the conventional method.

##  5 Analysis of Quantization Effects

This section analyzes the stability and performance degradation caused by
quantization in encrypted control systems when $w_{t}=v_{t}=0$ for simplicity.
Let $\mathcal{Q}_{\Delta}$ be the composite mapping of $\mathsf{Enc}_{\Delta}$
and $\mathsf{Dec}_{\Delta}$, then
$\mathcal{Q}_{\Delta}=\mathsf{Dec}_{\Delta}\circ\mathsf{Enc}_{\Delta}=\mathsf{Dcd}_{\Delta}\circ\sigma^{-1}\circ\mathsf{Dec}\circ\mathsf{Enc}\circ\sigma\circ\mathsf{Ecd}_{\Delta}=\mathsf{Dcd}_{\Delta}\circ\mathsf{Ecd}_{\Delta}$.
Thus, the map $\mathcal{Q}_{\Delta}$ behaves as a quantizer. With the
quantizer, the decrypted input of the encrypted IOHFC is equivalent to

$u_{t}\\!=\\!\sum_{i=0}^{L}\\!\mathcal{Q}_{\Delta_{K}}\\!(\hat{K}_{i})\mathcal{Q}_{\Delta_{d}}\\!(\hat{d}_{i})\\!=\\!\mathcal{Q}_{\Delta_{K}}\\!(K)\mathcal{Q}_{\Delta_{d}}\\!(d_{t})\\!=\\!\bar{K}\bar{d}_{t},$
(11)

where $\bar{K}\coloneqq\mathcal{Q}_{\Delta_{K}}(K)$ and
$\bar{d}\coloneqq\mathcal{Q}_{\Delta_{d}}(d)$. Quantization errors caused by
the quantization are respectively bounded from above by

$\displaystyle\|\tilde{d}\|$
$\displaystyle\leq\sqrt{(L+1)(q+\ell)+Lm}\Delta_{d}/2\eqqcolon\eta_{d},$ (12)
$\displaystyle\|\tilde{K}\|$
$\displaystyle\leq\sqrt{(L+1)(q+\ell)m+Lm^{2}}\Delta_{K}/2\eqqcolon\eta_{K},$
(13)

where $\tilde{d}\coloneqq\bar{d}-d$ and $\tilde{K}\coloneqq\bar{K}-K$. The
quantized controller (11) induces destabilization and performance degradation
of the control system when the sensitivities are not sufficiently small. We
show a condition for maintaining stability even after quantization and
estimating the degree of performance degradation in the following. To this
end, rewrite the system (4) as

$\left\\{\begin{aligned}
\mathsf{x}_{t+1}&=\mathsf{A}\mathsf{x}_{t}+\mathsf{B}u_{t}+\mathsf{E}r_{t},\\\
d_{t}&=\mathsf{C}_{1}\mathsf{x}_{t}+\mathsf{F}r_{t},\quad
y_{t}=\mathsf{C}_{2}\mathsf{x}_{t},\end{aligned}\right.$ (14)

where $\mathsf{x}_{t}=[([r_{k}]_{t-1}^{t-L})^{\top}\ \mathbf{0}_{q}\
([x_{k}]_{t}^{t-L})^{\top}\ ([u_{k}]_{t-1}^{t-L})^{\top}]^{\top}$,

$\displaystyle\mathsf{A}$
$\displaystyle\\!=\\!\mathop{\mathrm{diag}}\limits\left(\mathsf{A}_{1},\mathsf{A}_{2},\mathsf{A}_{3}\right),$
$\displaystyle\mathsf{A}_{1}$
$\displaystyle\\!=\\!\begin{bmatrix}O_{(L-1)q\times
q}&I_{(L-1)q}&O_{(L-1)q\times q}\\\ O_{2q\times
q}&O_{2q\times(L-1)q}&O_{2q\times q}\end{bmatrix}\\!,$
$\displaystyle\mathsf{A}_{2}$ $\displaystyle\\!=\\!\begin{bmatrix}O_{Ln\times
n}&I_{Ln}\\\ O_{n\times Ln}&A_{p}\end{bmatrix}\\!,\
\mathsf{A}_{3}\\!=\\!\begin{bmatrix}O_{(L-1)m\times m}&I_{(L-1)m}\\\
O_{m\times m}&O_{m\times(L-1)m}\end{bmatrix}\\!,$ $\displaystyle\mathsf{B}$
$\displaystyle\\!=\\!\begin{bmatrix}O_{((L+1)q+Ln)\times
m}^{\top}&B_{p}^{\top}&O_{(L-1)m\times
m}^{\top}&I_{m}\end{bmatrix}^{\top}\\!,$ $\displaystyle\mathsf{C}_{1}$
$\displaystyle\\!=\\!\mathop{\mathrm{diag}}\limits\left(I_{(L+1)q},I_{L+1}\otimes
C_{p},I_{Lm}\right),$ $\displaystyle\mathsf{C}_{2}$
$\displaystyle\\!=\\!\begin{bmatrix}O_{\ell\times((L+1)q+Ln)}&C_{p}&O_{\ell\times
Lm}\end{bmatrix}\\!,$ $\displaystyle\mathsf{E}$
$\displaystyle\\!=\\!\begin{bmatrix}O_{(L-1)q\times
q}^{\top}&I_{q}&O_{(q+(L+1)n+Lm)\times q}^{\top}\end{bmatrix}^{\top}\\!,$
$\displaystyle\mathsf{F}$ $\displaystyle\\!=\\!\begin{bmatrix}O_{Lq\times
q}^{\top}&I_{q}&O_{((L+1)\ell+Lm)\times q}^{\top}\end{bmatrix}^{\top}\\!.$

The following lemma shows that the stability of the original closed-loop
system is invariant even if its plant is rewritten and the IOHFC is utilized.

###### Lemma 1

Suppose $r_{t}=0$ for all $t\in\mathbb{N}$ and $z_{t}=0$ for all $t\leq 0$.
The closed-loop system with (14) and (9) is stable if and only if that with
(4) and (5) is stable.

######  Proof 5.2.

See Appendix .2.

Next, the stability condition for $\Delta_{K}$ is derived as follows.

######  Theorem 5.3.

Given the controller (5) stabilizing the plant (4) with $r_{t}=0$ for
$t\in\mathbb{N}$ and $z_{t}=0$ for $t\leq 0$. If the sensitivity $\Delta_{K}$
is chosen such that

$\Delta_{K}<\beta_{1}\left(-\beta_{2}+\sqrt{\beta_{3}}\right)$ (15)

with

$\displaystyle\beta_{1}$
$\displaystyle=2\left(\sqrt{(L+1)(q+\ell)m+Lm^{2}}\|\mathsf{B}^{\top}P\mathsf{B}\|\|\mathsf{C}_{1}\|\right)^{-1},$
$\displaystyle\beta_{2}$
$\displaystyle=\|(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P\mathsf{B}\|,$
$\displaystyle\beta_{3}$
$\displaystyle=\|(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P\mathsf{B}\|^{2}+\lambda_{\min}(Q)\|\mathsf{B}^{\top}P\mathsf{B}\|,$

then the closed-loop system with the system (14) and the controller

$u_{t}=\bar{K}d_{t}$ (16)

is stable, where $P$ and $Q$ are positive definite matrices satisfying
$(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})-P+Q=O$.

######  Proof 5.4.

See Appendix .3.

It should be noted that if $\Delta_{K}$ satisfies the condition (15), then the
control system is bounded-input bounded-output stable regardless of the choice
of $\Delta_{d}$. This is because the closed-loop system with (14) and (11) is
given as
$\mathsf{x}_{t+1}=\mathsf{A}\mathsf{x}_{t}+\mathsf{B}\bar{K}\bar{d}_{t}+\mathsf{E}r_{t}=(\mathsf{A}+\mathsf{B}\bar{K}\mathsf{C}_{1})\mathsf{x}_{t}+(\mathsf{E}+\mathsf{B}\bar{K}\mathsf{F})r_{t}+\mathsf{B}\bar{K}\tilde{d}_{t}$,
and $\tilde{d}$ is bounded by (12). Meanwhile, the output trajectory of the
closed-loop system differs from the original trajectory. Moreover, a
quantization error of $d$ would further degrade the control performance. The
following theorem estimates the degree of performance degradation induced by
quantization of $K$ and $d$.

######  Theorem 5.5.

Given the initial state $x_{0}$ and $\mathsf{x}_{0}=[\mathbf{0}_{(L+1)q}\
\mathbf{0}_{Ln}\ x_{0}^{\top}\ \mathbf{0}_{Lm}]^{\top}$. Suppose that
$\mathsf{A}+\mathsf{B}K\mathsf{C}_{1}$ is stable, and $\Delta_{K}$ satisfies
the condition (15). Let $y^{\prime}$ be the output of the system (14) with the
controller (11). The supremum of the error between $y(K,\mathsf{x}_{0})$ and
$y^{\prime}(\bar{K},\mathsf{x}_{0})$ is bounded by

$\sup_{t>0}\left\|y_{t}(K,\mathsf{x}_{0})\\!-\\!y^{\prime}_{t}(\bar{K},\mathsf{x}_{0})\right\|\\!\leq\\!\theta_{1}c^{2}\tau\gamma^{\tau-1}+\cfrac{\theta_{2}c^{2}}{(1-\gamma)^{2}}+\cfrac{\theta_{3}c}{1-\gamma},$

where
$\theta_{1}=\|\mathsf{C}_{2}\mathsf{B}\tilde{K}\mathsf{C}_{1}\|\|x_{0}\|$,
$\theta_{2}=\|\mathsf{C}_{2}\mathsf{B}\tilde{K}\mathsf{C}_{1}\|\|\mathsf{E}+\mathsf{B}K\mathsf{F}\|B_{r}$,
$\theta_{3}=\|\mathsf{C}_{2}\mathsf{B}\|(\|\tilde{K}\mathsf{F}\|B_{r}+\|\bar{K}\|\eta_{d})$,
and $B_{r}=\sup_{t>0}\|r_{t}\|$. The parameters $\gamma$, $c$, and $\tau$ are
determined by

$\displaystyle\max\\{\rho(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1}),\rho(\mathsf{A}+\mathsf{B}\bar{K}\mathsf{C}_{1})\\}<\gamma<1,$
$\displaystyle c$ $\displaystyle\\!=\\!\max_{1\leq k\leq
M}\\{1,\gamma^{-k}\|(\mathsf{A}\\!+\\!\mathsf{B}K\mathsf{C}_{1})^{k}\|,\gamma^{-k}\|(\mathsf{A}\\!+\\!\mathsf{B}\bar{K}\mathsf{C}_{1})^{k}\|\\},$
$\displaystyle\tau$ $\displaystyle\\!=\\!\lfloor{-(\log\gamma)^{-1}}\rceil,$

where $M$ is a nonnegative integer such that
$\|(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{k}\|<\gamma^{k}$ and
$\|(\mathsf{A}+\mathsf{B}\bar{K}\mathsf{C}_{1})^{k}\|<\gamma^{k}$ for all
$k\geq M$.

######  Proof 5.6.

See Appendix .4.

The theorem estimates the worst-case perturbation of the output trajectory due
to the encryption. It should be noted that the upper bound can be reduced by
decreasing the sensitivities because $\theta_{1}$, $\theta_{2}$, and
$\theta_{3}$ decrease as $\Delta_{K}$ and $\Delta_{d}$ decrease. Moreover, the
smaller $\gamma$ is, the smaller the upper bound becomes. This implies that
the error caused by the encryption can be decreased by making the closed-loop
system more stable. Note that it is difficult to cancel the quantization
errors completely because the sensitivities cannot become zero. This is an
open problem, and thus we need further development of encoding in encrypted
control.

##  6 Numerical Simulation

This section demonstrates the feasibility of the proposed scheme using the
quadruple-tank process in [31] modified to add process and measurement noises.
The model of the form (4) of the process, which is linearized around the
points $h_{1}^{0}=12.4$ cm, $h_{2}^{0}=12.7$ cm, $h_{3}^{0}=1.8$ cm,
$h_{4}^{0}=1.4$ cm, $v_{1}^{0}=3$ V, $v_{2}^{0}=3$ V, $\gamma_{1}=0.7$,
$\gamma_{2}=0.6$ and discretized with the sampling period of $1$ s, is given
as

$\displaystyle A_{p}$ $\displaystyle=\begin{bmatrix}0.9842&0&0.0407&0\\\
0&0.9890&0&0.0326\\\ 0&0&0.9590&0\\\ 0&0&0&0.9672\end{bmatrix},$
$\displaystyle B_{p}$ $\displaystyle=\begin{bmatrix}0.0826&0.0010\\\
0.0005&0.0625\\\ 0&0.0469\\\ 0.0307&0\end{bmatrix},\
C_{p}=\begin{bmatrix}0.5&0&0&0\\\ 0&0.5&0&0\end{bmatrix},$

where $x_{i}=h_{i}-h_{i}^{0}$, $u_{i}=v_{i}-v_{i}^{0}$, $h_{i}$ is a water
level of the tank $i$, $v_{i}$ is a voltage applied to the pump $i$, and the
model parameters are as follows. The cross sections of the tanks are
$A_{1}=A_{3}=28$ cm2 and $A_{2}=A_{4}=32$ cm2. The cross sections of the
outlet holes are $a_{1}=a_{3}=0.071$ cm2 and $a_{2}=a_{4}=0.057$ cm2. The
output gain is $k_{c}=0.5$ V/cm, and the input gains are $k_{1}=3.33$ cm3/Vs
and $k_{2}=3.35$ cm3/Vs. The gravitational acceleration is $981$ cm/s2. The
process noise $w$ and measurement noise $v$ follow the Gaussian distribution
with mean zero and variance $10^{-3}$.

The parameters in (5) of the decentralized PI controller [31] used to control
the process are given as

$\displaystyle A$ $\displaystyle=\begin{bmatrix}1&0\\\ 0&1\end{bmatrix},\
B=\begin{bmatrix}-1&0\\\ 0&-1\end{bmatrix},\ C=\begin{bmatrix}0.1&0\\\
0&0.0675\end{bmatrix},$ $\displaystyle D$
$\displaystyle=\begin{bmatrix}-3.0&0\\\ 0&-2.7\end{bmatrix},\
E=\begin{bmatrix}1&0\\\ 0&1\end{bmatrix},\ F=\begin{bmatrix}3.0&0\\\
0&2.7\end{bmatrix},$

where the proportional gains are $K_{1}=3.0$ and $K_{2}=2.7$, the integral
times are $T_{i1}=30$ and $T_{i2}=40$, and the controller is also discretized
with the sampling period. The gain of the corresponding IOHFC is obtained as

$\displaystyle K=$
$\displaystyle\left[\begin{matrix}-1.45\\!&\\!0\\!&\\!-1.4\\!&\\!0\\!&\\!3.0\\!&\\!0\\!&\\!1.45\\\
0\\!&\\!-1.3163\\!&\\!0\\!&\\!-1.2825\\!&\\!0\\!&\\!2.7\\!&\\!0\end{matrix}\right.$
$\displaystyle\left.\begin{matrix}0\\!&\\!1.4\\!&\\!0\\!&\\!-3.0\\!&\\!0\\!&\\!0.5\\!&\\!0\\!&\\!0.5\\!&\\!0\\\
1.3163\\!&\\!0\\!&\\!1.2825\\!&\\!0\\!&\\!-2.7\\!&\\!0\\!&\\!0.5\\!&\\!0\\!&\\!0.5\end{matrix}\right],$

where the data length is $L=2$.

The parameters of the BFV encryption are chosen according to the
recommendation of Homomorphic Encryption
Standardization111https://homomorphicencryption.org/standard/ to satisfy
$\lambda=128$ bit security; specifically, the degree of the polynomical ring
is $N=4096$, the plaintext modulus $T$ is a $25$ bit prime, and the ciphertext
modulus $Q$ is a $109$ bit integer. Additionally, the right-hand side of (15)
is calculated as $5.0740\times 10^{-4}$, and thus we choose
$\Delta_{K}=2\times 10^{-4}$ and $\Delta_{d}=1\times 10^{-3}$. From Theorem
5.5, the worst-case output error caused by the encryption with $x_{0}=[1\ 1\
1\ 1]^{\top}$ and $B_{r}=0.7071$ is bounded by $9.7985$, where
$\gamma=0.9797$, $c=16.2783$, and $\tau=49$.

Fig. 6 depicts the results of the unencrypted and encrypted decentralized PI
controls with the IOHFC representation. The dashed black lines are reference
inputs. The blue and red lines are outputs of unencrypted and encrypted
controls, respectively. The initial state of the process is $x_{0}=[1\ 1\ 1\
1]^{\top}$. The reference inputs are set to $[0\ 0]^{\top}$ from $0$ s to
$600$ s and switched between $[0.5\ 0.5]^{\top}$ and $[-0.5\ -0.5]^{\top}$
every $200$ s from $600$ s to $1400$ s. It should be noted that the
corresponding water levels $(h_{1},h_{2})$ are $(12.4,12.7)$, $(13.4,13.7)$,
and $(11.4,11.7)$. The results show that the encrypted control inherits the
stability of unencrypted control, and the outputs of encrypted control as well
as those of unencrypted control track the reference inputs. In addition, Fig.
7 shows the $\ell_{2}$ norm of the output error between the unencrypted and
encrypted controls with $v_{t}=w_{t}=0$. The same reference inputs as Fig. 6
are used in this simulation. The maximum error of this result is $0.007$ cm,
and the result demonstrates that the performance degradation due to controller
encrypion is sufficiently small.

Finally, the computation times of the BFV encryption are shown in Table 2. The
minimum, average, and maximum times were calculated with $100000$ times of
measurements. All the experiments are conducted using MacBook Pro (macOS
Monterey, $2.3$ GHz quad-core Intel Core i7, $32$ GB $3733$ MHz LPDDR4X). It
should be noted that the computation times of $\mathsf{Mult}$ include those of
$\mathsf{Relin}$. From Table 1 and Table 2, the total average times in each
time step for the operator, plant, and controller are about $1.28$, $2.87$,
$16.45$ ms, respectively. Thus, the total computation time is within the
sampling time. This result suggests that the proposed method can be applied to
practical real-time systems.

(a) Water level in tank $1$.

(b) Water level in tank $2$.

Figure 6: Comparison between the unencrypted and encrypted controls with the IOHFC. Figure 7: Performance degradation due to encryption. Table 2: Computation Times | $\sigma$ | $\sigma^{-1}$ | $\mathsf{Enc}$ | $\mathsf{Dec}$ | $\mathsf{Mult}$ | $\mathsf{Add}$ | $\mathsf{Rotate}$
---|---|---|---|---|---|---|---
Min (ms) | $0.03$ | $0.04$ | $1.17$ | $0.26$ | $4.09$ | $0.01$ | $0.63$
Ave (ms) | $0.03$ | $0.04$ | $1.25$ | $0.27$ | $4.35$ | $0.01$ | $0.66$
Max (ms) | $0.38$ | $0.44$ | $4.99$ | $0.78$ | $10.4$ | $0.09$ | $1.41$
Std ($\mu$s) | $5.47$ | $6.99$ | $72.6$ | $22.7$ | $208$ | $2.40$ | $42.9$

##  7 Conclusion

This paper presented a novel controller representation based on input-output
history data of a dynamic controller to implement an encrypted controller with
leveled fully homomorphic encryption. The proposed encrypted control scheme
and algorithm enable the controller to operate for an infinite time horizon
without temporary decryption of the encrypted controller states. The BFV
homomorphic encryption scheme with the CRT batching improves the efficiency of
matrix-vector multiplication, which is included in the proposed algorithm.

We also estimated the worst-case performance degradation caused by the
quantization effects due to encryption. The numerical simulation demonstrates
the feasibility of the proposed encrypted control with a small performance
degradation by choosing the appropriate parameters. Furthermore, the
simulation results disclose that the derived theoretical estimate is slightly
conservative, and so we will further analyze the effects of encryption on
control performance.

Future work includes the consideration of an IOHFC representation for more
complex controllers, such as nonlinear controllers. One possible way to
realize a nonlinear IOHFC is use of the Koopman operator [39], which lifts a
finite-dimensional nonlinear system to an infinite-dimensional linear system.
The approach with appropriate truncation of a system dimension would enable
application of the proposed scheme to nonlinear controllers.

###  .1 BFV encryption scheme

The RLWE problem is defined as follows [23].

######  Definition .7 (RLWE).

Given a security parameter $\lambda$. Let $Q=Q(\lambda)\geq 2$ be an integer,
$M=M(\lambda)$ be a power of $2$, and $\chi=\chi(\lambda)$ be a distribution
over $R=\mathbb{Z}[X]/(\Phi_{M(\lambda)}(X))$, where $\Phi_{M}(X)$ is the
$M$th cyclotomic polynomial. Sample $\mathbf{s}\leftarrow R_{Q}$ randomly, and
define the distribution $D(\mathbf{s},Q,\chi)$ obtained by outputting
$([\mathbf{a}\mathbf{s}+\mathbf{e}]_{Q},\mathbf{a})$ with random sampling
$\mathbf{a}\leftarrow R_{Q}$ and $\mathbf{e}\leftarrow\chi$. The RLWE problem
is to distinguish between $D(Q,\mathbf{s},\chi)$ and the uniform distribution
over $R_{Q}^{2}$. The RLWE assumption is the assumption that the distributions
are computationally indistinguishable.

The BFV leveled fully homomorphic encryption [32] is constructed based on the
RLWE assumption as follows:

  * •

$\mathsf{KeyGen}(\lambda)$: Choose $N(\lambda)$, $Q(\lambda)$, $T(\lambda)$,
$W(\lambda)$, and $\chi(\lambda)$. Randomly sample $\mathbf{s}\leftarrow
R_{2}$, $\mathbf{a}\leftarrow R_{Q}$, $\mathbf{e}\leftarrow\chi$,
$\mathbf{a}^{\prime}_{i}\leftarrow R_{Q}$ and
$\mathbf{e}^{\prime}_{i}\leftarrow\chi$ for $0\leq
i\leq\ell=\lfloor{\log_{W}(Q)}\rfloor$. Set

$\displaystyle\mathsf{sk}$
$\displaystyle=\mathbf{s},\quad\mathsf{pk}=([-(\mathbf{a}\mathbf{s}+\mathbf{e})]_{Q},\mathbf{a}),$
$\displaystyle\mathsf{rlk}$
$\displaystyle=\left[([-(\mathbf{a}^{\prime}_{i}\mathbf{s}+\mathbf{e}^{\prime}_{i})+W^{i}\mathbf{s}^{2}]_{Q},\mathbf{a}^{\prime}_{i})\mid
0\leq i\leq\ell\right].$

Output $(\mathsf{sk},\mathsf{pk},\mathsf{rlk})$.

  * •

$\mathsf{Enc}(\mathsf{pk},\mathbf{m})$: A plaintext space is $R_{T}$. Let
$\Delta=\lfloor{Q/T}\rfloor$, $\mathbf{p}_{0}=\mathsf{pk}[0]$, and
$\mathbf{p}_{1}=\mathsf{pk}[1]$. Randomly sample $\mathbf{u}\leftarrow R_{2}$,
and $\mathbf{e}_{0},\mathbf{e}_{1}\leftarrow\chi$. Output

$\mathsf{ct}=([\mathbf{p}_{0}\mathbf{u}+\mathbf{e}_{0}+\Delta\mathbf{m}]_{Q},[\mathbf{p}_{1}\mathbf{u}+\mathbf{e}_{1}]_{Q}).$

  * •

$\mathsf{Dec}(\mathsf{sk},\mathsf{ct})$: A ciphertext space is $R_{Q}^{2}$.
Let $\mathbf{c}_{0}=\mathsf{ct}[0]$, $\mathbf{c}_{1}=\mathsf{ct}[1]$, and
$\mathbf{s}=\mathsf{sk}$. Output

$\mathbf{m}=[\lfloor{(T/Q)[\mathbf{c}_{0}+\mathbf{c}_{1}\mathbf{s}]_{Q}}\rceil]_{T}.$

  * •

$\mathsf{Add}(\mathsf{ct}_{1},\mathsf{ct}_{2})$: Let
$\mathbf{c}_{10}=\mathsf{ct}_{1}[0]$, $\mathbf{c}_{11}=\mathsf{ct}_{1}[1]$,
$\mathbf{c}_{20}=\mathsf{ct}_{2}[0]$, and
$\mathbf{c}_{21}=\mathsf{ct}_{2}[1]$. Output

$\mathsf{ct}_{\mathsf{Add}}=([\mathbf{c}_{10}+\mathbf{c}_{20}]_{Q},[\mathbf{c}_{11}+\mathbf{c}_{21}]_{Q}).$

  * •

$\mathsf{Mult}(\mathsf{ct}_{1},\mathsf{ct}_{2})$: Let
$\mathbf{c}_{10}=\mathsf{ct}_{1}[0]$, $\mathbf{c}_{11}=\mathsf{ct}_{1}[1]$,
$\mathbf{c}_{20}=\mathsf{ct}_{2}[0]$, and
$\mathbf{c}_{21}=\mathsf{ct}_{2}[1]$. Compute

$\displaystyle\mathbf{c}_{0}$
$\displaystyle=[\lfloor{(T/Q)(\mathbf{c}_{10}\mathbf{c}_{20})}\rceil]_{Q},$
$\displaystyle\mathbf{c}_{1}$
$\displaystyle=[\lfloor{(T/Q)(\mathbf{c}_{10}\mathbf{c}_{21}+\mathbf{c}_{11}\mathbf{c}_{20})}\rceil]_{Q},$
$\displaystyle\mathbf{c}_{2}$
$\displaystyle=[\lfloor{(T/Q)(\mathbf{c}_{11}\mathbf{c}_{21})}\rceil]_{Q}.$

Output
$\mathsf{ct}_{\mathsf{Mult}}=(\mathbf{c}_{0},\mathbf{c}_{1},\mathbf{c}_{2})$.

  * •

$\mathsf{Relin}(\mathsf{rlk},\mathsf{ct}_{\mathsf{Mult}})$: Let
$\mathbf{c}_{0}=\mathsf{ct}_{\mathsf{Mult}}[0]$,
$\mathbf{c}_{1}=\mathsf{ct}_{\mathsf{Mult}}[1]$, and
$\mathbf{c}_{2}=\mathsf{ct}_{\mathsf{Mult}}[2]$. Let
$\mathbf{r}_{i0}=\mathsf{rlk}[i][0]$ and $\mathbf{r}_{i1}=\mathsf{rlk}[i][1]$
for $0\leq i\leq\ell$. Write
$\mathbf{c}_{2}=\sum_{i=0}^{\ell}\mathbf{c}_{2}^{(i)}W^{i}$ with
$\mathbf{c}_{2}^{(i)}\in R_{W}$, where $W$ is totally independent of $T$.
Output

$\mathsf{ct}=\left(\left[\mathbf{c}_{0}+\sum_{i=0}^{\ell}\mathbf{r}_{i0}\mathbf{c}_{2}^{(i)}\right]_{Q},\left[\mathbf{c}_{1}+\sum_{i=0}^{\ell}\mathbf{r}_{i1}\mathbf{c}_{2}^{(i)}\right]_{Q}\right).$

###  .2 Proof of Lemma 1

######  Proof .8.

We prove only the sufficient condition because the proof for the necessary
condition is trivial. Given the controller (5) that stabilizes (4), then
$x_{t}\to 0$ and $u_{t}\to 0$ as $t\to\infty$. Theorem 1 implies that the
IOHFC (9) is equivalent to (5) for all $t\geq 0$. Thus, the sequences
$\\{x_{t}\\}_{t=0}^{\infty}$ and $\\{u_{t}\\}_{t=0}^{\infty}$ generated by
(14) with (9) are the same as those in (4) with (5). This concludes state
$\mathsf{x}$ of (14) with (9) converges to zero as $t\to\infty$.

###  .3 Proof of Theorem 5.3

######  Proof .9.

The closed-loop system with (14) and (16) is expressed as follows:

$\mathsf{x}_{t+1}=\mathsf{A}\mathsf{x}_{t}+\mathsf{B}\bar{K}\mathsf{C}_{1}\mathsf{x}_{t}=(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})\mathsf{x}_{t}+\mathsf{B}\tilde{K}\mathsf{C}_{1}\mathsf{x}_{t},$

where $\tilde{K}=\bar{K}-K$. From Lemma 1, there always exist positive
definite matrices $P$ and $Q$ such that
$(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})-P+Q=O$.
Let $V(\mathsf{x}_{t})=\mathsf{x}_{t}^{\top}P\mathsf{x}_{t}$ be a Lyapunov
function candidate, then

$\displaystyle V(\mathsf{x}_{t+1})-V(\mathsf{x}_{t})$
$\displaystyle=\mathsf{x}^{\top}(\mathsf{B}\tilde{K}\mathsf{C}_{1})^{\top}P\mathsf{B}\tilde{K}\mathsf{C}_{1}\mathsf{x}+2\mathsf{x}^{\top}(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P\mathsf{B}K\mathsf{C}_{1}\mathsf{x}$
$\displaystyle\quad-\mathsf{x}^{\top}Q\mathsf{x},$
$\displaystyle\\!\leq\\!\Big{(}\|\mathsf{B}^{\\!\top}P\mathsf{B}\|\|\mathsf{C}_{1}\|^{2}\|\tilde{K}\|^{2}\\!+\\!2\|(\mathsf{A}\\!+\\!\mathsf{B}K\mathsf{C}_{1})^{\\!\top}P\mathsf{B}\|\|\mathsf{C}_{1}\|\|\tilde{K}\|$
$\displaystyle\quad\quad-\lambda_{\min}(Q)\Big{)}\|\mathsf{x}\|^{2}\eqqcolon
g(\|\tilde{K}\|).$

The solution to the quadratic equation $g(\|\tilde{K}\|)=0$ is

$\displaystyle\|\tilde{K}\|$
$\displaystyle=\cfrac{1}{\|\mathsf{B}^{\top}P\mathsf{B}\|\|\mathsf{C}_{1}\|}\Bigg{(}-\|(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P\mathsf{B}\|$
$\displaystyle\quad+\sqrt{\|(\mathsf{A}+\mathsf{B}K\mathsf{C}_{1})^{\top}P\mathsf{B}\|^{2}+\lambda_{\min}(Q)\|\mathsf{B}^{\top}P\mathsf{B}\|}\Bigg{)}.$

Moreover, it follows from (13) that

$\cfrac{2}{\sqrt{(L+1)(q+\ell)m+Lm^{2}}}\|\tilde{K}\|\leq\Delta_{K}.$

Therefore, $g(\|\tilde{K}\|)<0$ if $\Delta_{K}$ satisfies (15). This implies
that $V(\mathsf{x}_{t+1})-V(\mathsf{x}_{t})$ is negative.

###  .4 Proof of Theorem 5.5

######  Proof .10.

Let $\mathsf{A}_{\mathrm{cl}}=\mathsf{A}+\mathsf{B}K\mathsf{C}_{1}$ and
$\bar{\mathsf{A}}_{\mathrm{cl}}=\mathsf{A}+\mathsf{B}\bar{K}\mathsf{C}_{1}$.
Because $\mathsf{A}_{\mathrm{cl}}$ and $\bar{\mathsf{A}}_{\mathrm{cl}}$ are
assumed to be stable, there exists $M\geq 0$ such that
$\|\mathsf{A}_{\mathrm{cl}}^{k}\|<\gamma^{k}$ and
$\|\bar{\mathsf{A}}_{\mathrm{cl}}^{k}\|<\gamma^{k}$ for all $k\geq M$ [40].
Thus, $\|\mathsf{A}_{\mathrm{cl}}^{k}\|\leq c\gamma^{k}$ and
$\|\bar{\mathsf{A}}_{\mathrm{cl}}^{k}\|\leq c\gamma^{k}$ for any $k$.

It follows from (14), (9), and (11) that

$\displaystyle y_{t}(K,\mathsf{x}_{0})$
$\displaystyle=\mathsf{C}_{2}\mathsf{A}_{\mathrm{cl}}^{t}\mathsf{x}_{0}+\sum_{k=0}^{t-1}\mathsf{C}_{2}\mathsf{A}_{\mathrm{cl}}^{k}(\mathsf{E}+\mathsf{B}K\mathsf{F})r_{t-1-k},$
$\displaystyle y^{\prime}_{t}(\bar{K},\mathsf{x}_{0})$
$\displaystyle=\mathsf{C}_{2}\bar{\mathsf{A}}_{\mathrm{cl}}^{t}\mathsf{x}_{0}+\sum_{k=0}^{t-1}\mathsf{C}_{2}\bar{\mathsf{A}}_{\mathrm{cl}}^{k}(\mathsf{E}+\mathsf{B}\bar{K}\mathsf{F})r_{t-1-k}$
$\displaystyle\quad+\sum_{k=0}^{t-1}\mathsf{C}_{2}\bar{\mathsf{A}}_{\mathrm{cl}}^{k}\mathsf{B}\bar{K}\tilde{d}_{t-1-k}.$

Hence, the supremum of the error is bounded by

$\displaystyle\sup_{t>0}\|y_{t}(K,\mathsf{x}_{0})-y^{\prime}_{t}(\bar{K},\mathsf{x}_{0})\|$
$\displaystyle\leq\sup_{t>0}\left\|\sum_{k=0}^{t-1}\mathsf{A}_{\mathrm{cl}}^{t-1-k}\bar{\mathsf{A}}_{\mathrm{cl}}^{k}\right\|\theta_{1}+\sup_{t>0}\left\|\sum_{k=1}^{t-1}\sum_{j=0}^{k-1}\mathsf{A}_{\mathrm{cl}}^{k-1-j}\bar{\mathsf{A}}_{\mathrm{cl}}^{j}\right\|\theta_{2}$
$\displaystyle\quad+\sup_{t>0}\left\|\sum_{k=0}^{t-1}\bar{\mathsf{A}}_{\mathrm{cl}}^{k}\right\|\theta_{3},$
$\displaystyle\leq\sup_{t>0}\theta_{1}c^{2}t\gamma^{t-1}+\sup_{t>0}\theta_{2}c^{2}\sum_{k=1}^{t-1}k\gamma^{k-1}+\sup_{t>0}\theta_{3}c\sum_{k=0}^{t-1}\gamma^{k}.$

For the first term of the above inequality, it follows that

$\cfrac{\partial}{\partial t}\,t\gamma^{t-1}=\gamma^{t-1}(1+t\log\gamma)=0\iff
t=-(\log\gamma)^{-1},$

where $t\neq 0$. Furthermore, the second and third terms are respectively
calculated as

$\displaystyle\sup_{t>0}\theta_{2}c^{2}\sum_{k=1}^{t-1}k\gamma^{k-1}$
$\displaystyle=\theta_{2}c^{2}\sum_{k=0}^{\infty}k\gamma^{k-1}=\cfrac{\theta_{2}c^{2}}{(1-\gamma)^{2}},$
$\displaystyle\sup_{t>0}\theta_{3}c\sum_{k=0}^{t-1}\gamma^{k}$
$\displaystyle=\theta_{3}c\sum_{k=0}^{\infty}\gamma^{k}=\cfrac{\theta_{3}c}{1-\gamma},$

as $\gamma<1$. Therefore, we obtain

$\displaystyle\sup_{t>0}\theta_{1}c^{2}t\gamma^{t-1}+\sup_{t>0}\theta_{2}c^{2}\sum_{k=1}^{t-1}k\gamma^{k-1}+\sup_{t>0}\theta_{3}c\sum_{k=0}^{t-1}\gamma^{k}$
$\displaystyle\leq\theta_{1}c^{2}\tau\gamma^{\tau-1}+\cfrac{\theta_{2}c^{2}}{(1-\gamma)^{2}}+\cfrac{\theta_{3}c}{1-\gamma}.$

This completes the proof.

## References

  * [1] T. Hegazy and M. Hefeeda, “Industrial automation as a cloud service,” _IEEE Transactions on Parallel and Distributed Systems_ , vol. 26, no. 10, pp. 2750–2763, 2015.
  * [2] A. Vick, V. Vonásek, R. Pěnička, and J. Krüger, “Robot control as a service – towards cloud-based motion planning and control for industrial robots,” in _International Workshop on Robot Motion and Control_ , 2015, pp. 33–39.
  * [3] H. Esen, M. Adachi, D. Bernardini, A. Bemporad, D. Rost, and J. Knodel, “Control as a Service (CaaS): Cloud-based software architecture for automotive control applications,” in _International Workshop on the Swarm at the Edge of the Cloud_ , 2015, p. 13–18.
  * [4] A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on homomorphic encryption schemes: Theory and implementation,” _ACM Computing Surveys_ , vol. 51, no. 4, 2018.
  * [5] M. S. Darup, A. B. Alexandru, D. E. Quevedo, and G. J. Pappas, “Encrypted control for networked systems: An illustrative introduction and current challenges,” _IEEE Control Systems Magazine_ , vol. 41, no. 3, pp. 58–78, 2021.
  * [6] F. Farokhi, I. Shames, and N. Batterham, “Secure and private control using semi-homomorphic encryption,” _Control Engineering Practice_ , vol. 67, pp. 13–20, 2017.
  * [7] K. Kogiso and T. Fujita, “Cyber-security enhancement of networked control systems using homomorphic encryption,” in _IEEE Conference on Decision and Control_ , 2015, pp. 6836–6843.
  * [8] K. Teranishi, M. Kusaka, N. Shimada, J. Ueda, and K. Kogiso, “Secure observer-based motion control based on controller encryption,” in _American Control Conference_ , 2019, pp. 2978–2983.
  * [9] J. Kim and H. Shim, “Encrypted state estimation in networked control systems,” in _IEEE Conference on Decision and Control_ , 2019, pp. 7190–7195.
  * [10] R. Fritz, M. Fauser, and P. Zhang, “Controller encryption for discrete event systems,” in _American Control Conference_ , 2019, pp. 5633–5638.
  * [11] J. Suh and T. Tanaka, “Encrypted value iteration and temporal difference learning over leveled homomorphic encryption,” in _American Control Conference_ , 2021, pp. 2555–2561.
  * [12] M. S. Darup, A. Redder, I. Shames, F. Farokhi, and D. E. Quevedo, “Towards encrypted MPC for linear constrained systems,” _IEEE Control Systems Letters_ , vol. 2, no. 2, pp. 195–200, 2018.
  * [13] M. S. Darup, A. Redder, and D. E. Quevedo, “Encrypted cooperative control based on structured feedback,” _IEEE Control Systems Letters_ , vol. 3, no. 1, pp. 37–42, 2019.
  * [14] A. B. Alexandru, K. Gatsis, Y. Shoukry, S. A. Seshia, P. Tabuada, and G. J. Pappas, “Cloud-based quadratic optimization with partially homomorphic encryption,” _IEEE Transactions on Automatic Control_ , vol. 66, no. 5, pp. 2357–2364, 2021.
  * [15] Z. Zhang, P. Cheng, J. Wu, and J. Chen, “Secure state estimation using hybrid homomorphic encryption scheme,” _IEEE Transactions on Control Systems Technology_ , vol. 29, no. 4, pp. 1704–1720, 2021.
  * [16] K. Teranishi, N. Shimada, and K. Kogiso, “Stability analysis and dynamic quantizer for controller encryption,” in _IEEE Conference on Decision and Control_ , 2019, pp. 7184–7189.
  * [17] C. Murguia, F. Farokhi, and I. Shames, “Secure and private implementation of dynamic controllers using semi-homomorphic encryption,” _IEEE Transactions on Automatic Control_ , vol. 65, no. 9, pp. 3950–3957, 2020.
  * [18] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in _Advances in Cryptology – ASIACRYPT 2017_ , T. Takagi and T. Peyrin, Eds. Springer International Publishing, pp. 409–437.
  * [19] J. Kim, C. Lee, H. Shim, J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Encrypting controller using fully homomorphic encryption for security of cyber-physical systems,” _IFAC-PapersOnLine_ , vol. 49, no. 22, pp. 175–180, 2016.
  * [20] J. Kim, H. Shim, and K. Han, “Dynamic controller that operates over homomorphically encrypted data for infinite time horizon,” _IEEE Transactions on Automatic Control_ , 2022, (Early Access).
  * [21] ——, “Design procedure for dynamic controllers based on LWE-based homomorphic encryption to operate for infinite time horizon,” in _IEEE Conference on Decision and Control_ , 2020, pp. 5463–5468.
  * [22] C. Gentry, A. Sahai, and B. Waters, “Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based,” in _Advances in Cryptology – CRYPTO 2013_ , 2013, pp. 75–92.
  * [23] V. Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” in _EUROCRYPT_ , 2010, p. 1–23.
  * [24] A. B. Alexandru, A. Tsiamis, and G. J. Pappas, “Towards private data-driven control,” in _IEEE Conference on Decision and Control_ , 2020, pp. 5449–5456.
  * [25] ——, “Data-driven control on encrypted data,” arXiv:2008.12671, Aug 2020.
  * [26] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy,” in _International Conference on Machine Learning_ , vol. 48, 2016, pp. 201–210.
  * [27] E. Hesamifard, H. Takabi, and M. Ghasemi, “CryptoDL: Deep neural networks over encrypted data,” arXiv:1711.05189, Nov 2017.
  * [28] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, “GAZELLE: A low latency framework for secure neural network inference,” in _USENIX Security Symposium_ , 2018, pp. 1651–1669.
  * [29] F. Bourse, M. Minelli, M. Minihold, and P. Paillier, “Fast homomorphic evaluation of deep discretized neural networks,” in _Advances in Cryptology – CRYPTO 2018_ , H. Shacham and A. Boldyreva, Eds. Cham: Springer International Publishing, 2018, vol. 10993, pp. 483–512.
  * [30] X. Jiang, M. Kim, K. Lauter, and Y. Song, “Secure outsourced matrix computation and application to neural networks,” in _ACM SIGSAC Conference on Computer and Communications Security_ , 2018, pp. 1209–1222.
  * [31] K. H. Johansson, “The quadruple-tank process: A multivariable laboratory process with an adjustable zero,” _IEEE Transactions on Control Systems Technology_ , vol. 8, no. 3, pp. 456–465, 2000.
  * [32] J. Fan and F. Vercauteren, “Somewhat practical fully homomorphic encryption,” Cryptology ePrint Archive, Report 2012/144, 2012.
  * [33] N. P. Smart and F. Vercauteren, “Fully homomorphic SIMD operations,” _Designs, Codes and Cryptography_ , vol. 71, no. 1, pp. 57–81, 2014.
  * [34] H. Chen, K. Laine, and R. Player, “Simple encrypted arithmetic library – SEAL v2.1,” in _Financial Cryptography and Data Security_ , 2017, pp. 3–18.
  * [35] P. Longa and M. Naehrig, “Speeding up the number theoretic transform for faster ideal lattice-based cryptography,” Cryptology ePrint Archive, Report 2016/504, 2016.
  * [36] M. Jansson, “Subspace identification and ARX modeling,” _IFAC Proceedings Volumes_ , vol. 36, no. 16, pp. 1585–1590, 2003.
  * [37] A. Chiuso, “The role of vector autoregressive modeling in predictor-based subspace identification,” _Automatica_ , vol. 43, no. 6, pp. 1034–1048, 2007\.
  * [38] A. Kim, Y. Song, M. Kim, K. Lee, and J. H. Cheon, “Logistic regression model training based on the approximate homomorphic encryption,” _BMC Medical Genomics_ , vol. 11, no. 4, pp. 23–31, 2018.
  * [39] B. O. Koopman, “Hamiltonian systems and transformation in Hilbert space,” _Proceedings of the National Academy of Sciences_ , vol. 17, no. 5, pp. 315–318, 1931.
  * [40] D. A. Dowler, “Bounding the norm of matrix powers,” Master’s thesis, Brigham Young University, Provo, UT, 2013.

[] Kaoru Teranishi received the B.S. degree in electromechanical engineering
from National Institute of Technology, Ishikawa College, Ishikawa, Japan, in
2019. He also obtained the M.S. degree in Mechanical and Intelligent Systems
Engineering from The University of Electro-Communications, Tokyo, Japan, in
2021. He is currently a Ph.D. student at The University of Electro-
Communications. From October 2019 to September 2020, he was a visiting scholar
of the Georgia Institute of Technology, GA, USA. Since April 2021, he has been
a Research Fellow of Japan Society for the Promotion of Science. His research
interests include control theory and cryptography for cyber-security of
control systems.

[] Tomonori Sadamoto received the Ph.D. degree from the Tokyo Institute of
Technology, Tokyo, Japan in 2015. From June in 2015 to March in 2016, he was a
Visiting Researcher at School of Electrical Engineering, Royal Institute of
Technology, Stockholm, Sweden. From April 2016 to August 2016, he was a
researcher with the Department of Systems and Control Engineering, Graduate
School of Engineering, Tokyo Institute of Technology. From August 2016 to
November 2018, he was a specially appointed Assistant Professor with the same
department. Since November 2018, he has been assistant professor with
Department of Mechanical and Intelligent Systems Engineering in the University
of Electro-Communications. He was named as a finalist of the European Control
Conference Best Student-Paper Award in 2014. He received Research
encouragement award from The Funai Foundation for Informaiton Technology in
2019, and received IEEE Control Systems Magazine Outstanding Paper Award in
2020.

[] Kiminao Kogiso received the B.E., M.E., and Ph.D. degrees in mechanical
engineering from Osaka University, Japan, in 1999, 2001, and 2004,
respectively. He was appointed as a postdoctoral fellow in the 21st Century
COE Program and as an Assistant Professor in the Graduate School of
Information Science, Nara Institute of Science and Technology, Nara, Japan, in
April 2004 and July 2005, respectively. From November 2010 to December 2011,
he was a visiting scholar at Georgia Institute of Technology, Atlanta, GA,
USA. In March 2014, he was promoted to the position of Associate Professor in
the Department of Mechanical and Intelligent Systems Engineering at The
University of Electro-Communications, Tokyo, Japan. And since April 2023, he
has been serving as a full Professor in the same department. His research
interests include cybersecurity of control systems, constrained control,
control of decision-makers, and their applications.