This subsection is devoted to providing a numerical algorithm for the adversary to derive \(\mathcal{G}(z)\) when \(\mathcal{K}(z)\) is full normal row rank, which is based on spectral factorization.
Since the feedback system is asymptotic stable, \(\Phi_{y,u}(z)\) has no poles on the unit circle. Consider a Mobius transform \(z=\frac{1+s}{1-s}\) and let \(\Psi_{y,u}(s)=\Phi_{y,u}\left(\frac{1+s}{1-s}\right)\), then for \(\Psi_{y,u}(s)\) there exists a positive real matrix \(\mathcal{S}(s)\) \cite{Keith}, such that
\begin{equation} \label{Zdef} \label{Zdef}\mathcal{S}(s)+\mathcal{S}^{T}(-s)=\Psi(s)=\mathcal{W}(s)\mathcal{W}^{T}(-s).\\ \end{equation}For a given spectral density \(\Psi(s)\), the globally-minimal degree is the smallest degree of all its spectral factors \(\mathcal{W}(s)\).
Any system of globally-minimal degree is said to be globally minimal. Anderson \cite{Anderson_1982} provides an algebraic characterization of all realizations of all spectral factors as follows. Minimal realizations of \(\mathcal{S}\) are related to globally-minimal realizations of spectral factors of \(\Psi\) by the following lemma.
Let \((A,B_{s},C,D_{s})\) be a minimal realization of the positive-real matrix \(\mathcal{S}(s)\) of (\ref{Zdef}), then the system \((A,B,C,D)\) is a globally-minimal realization of a spectral factor of \(\Psi(s)\), i.e., \(\mathcal{W}(s)\) if and only if the following equations hold:
for some positive-definite and symmetric matrix \({R\in\mathbb{R}^{n\times n}}\).
For a properly chosen \(R\), \(\mathcal{W}(s)\) can be computed from its realization. Since \(\mathcal{W}\left(\frac{z-1}{z+1}\right)=\mathcal{C}(z)D^{1/2}J\triangleq\mathcal{C}(z)\hat{D}\), for some signed identity matrix \(J\) \cite{Hayden_2014}
\begin{equation} \lim_{z\rightarrow\infty}\mathcal{W}\left(\frac{z-1}{z+1}\right)=\begin{bmatrix}0&I\\ 0&0\end{bmatrix}\hat{D}.\\ \end{equation}We partition \(\mathcal{W}\) and \(\hat{D}\) to four blocks with corresponding dimensions as \(\mathcal{C}\) in (\ref{eq:Cz}). Then it follows that
\begin{equation} \label{eq:D22} \label{eq:D22}\hat{D}_{22}=\lim_{z\rightarrow\infty}\mathcal{W}_{12}\left(\frac{z-1}{z+1}\right).\\ \end{equation}Finally, once \(\hat{D}_{22}\) is obtained, we can obtain an estimate closed-loop transfer function
\begin{align} \label{eq:estC} \label{eq:estC}\hat{\mathcal{C}}(z)=\begin{bmatrix}I&0\\ 0&\hat{D}_{22}^{-1}\end{bmatrix}\mathcal{W}\left(\frac{z-1}{z+1}\right),\\ \end{align}and the transfer functions for plant and controller, \(\mathcal{G}(z)\), \(\mathcal{K}(z)\) using (\ref{eq:khg}).
We summarize the identification procedure to the following Algorithm \ref{alg:main}.
Since the main theme of this paper is to bring up the potential security issue in the classic feedback systems and propose a new control architecture which is robust to such attacks, the following numerical issues in spectral factorization are out of the scope of this paper, i..e., how the estimate of \(\Phi_{y,u}(z)\) depends on the number of samples and how this error would propagate into the identification of \(\mathcal{G}(z)\) and \(\mathcal{K}(z)\).