Enforcing opacity of regular predicates on modal transition systems

Given a labelled transition system LTS partially observed by an attacker, and a regular predicate Sec over the runs of LTS, enforcing opacity of the secret Sec in LTS means computing a supervisory controller K such that an attacker who observes a run of K/LTS cannot ascertain that the trace of this run belongs to Sec based on the knowledge of LTS and K. We lift the problem from a single labelled transition system LTS to the class of all labelled transition systems specified by a modal transition system MTS. The lifted problem is to compute the maximally permissive controller K such that Sec is opaque in K/LTS for every labelled transition systems LTS which is a model of MTS. The situations of the attacker and of the controller are dissymmetric: at run time, the attacker may fully know LTS and K whereas the controller knows only MTS and the sequence of actions executed so far by the unknown LTS. We address the problem in two cases. Let Σa denote the set of actions that can be observed by the attacker, and let Σc and Σo denote the sets of actions that can be controlled and observed by the controller, respectively. We provide optimal and regular controllers that enforce the opacity of regular secrets when Σc ⊆ Σo ⊆ Σa = Σ. We provide optimal and regular controllers that enforce the opacity of regular upper-closed secrets (Sec = Sec.Σ) when Σa ⊆ Σc ⊆ Σo = Σ.