© 20XX IEEE. Personal use of this material is permitted. Permission from IEEE
must be obtained for all other uses, in any current or future media, including
reprinting/republishing this material for advertising or promotional purposes,
creating new collective works, for resale or redistribution to servers or
lists, or reuse of any copyrighted component of this work in other works.

# Optimal Controller and Security Parameter for Encrypted Control Systems
Under Least Squares Identification

Kaoru Teranishi  Graduate Student Member, IEEE and Kiminao Kogiso Member, IEEE
This work was supported by JSPS Grant-in-Aid for JSPS Fellows Grant Number
JP21J22442 and JSPS KAKENHI Grant Number JP22H01509.K. Teranishi and K. Kogiso
are with the Department of Mechanical and Intelligent Systems Engineering, The
University of Electro-Communications, 1-5-1 Chofugaoka, Chofu, Tokyo 1828585,
Japan (e-mail<EMAIL_ADDRESS>kogiso@uec.ac.jp).K. Teranishi is also
with Japan Society for the Promotion of Science, Chiyoda-ku, Tokyo 1020083,
Japan.

###### Abstract

Encrypted control is a framework for the secure outsourcing of controller
computation using homomorphic encryption that allows to perform arithmetic
operations on encrypted data without decryption. In a previous study, the
security level of encrypted control systems was quantified based on the
difficulty and computation time of system identification. This study
investigates an optimal design of encrypted control systems when facing an
attack attempting to estimate a system parameter by the least squares method
from the perspective of the security level. This study proposes an optimal
$\mathnormal{H_{2}}$ controller that maximizes the difficulty of estimation
and an equation to determine the minimum security parameter that guarantee the
security of an encrypted control system as a solution to the design problem.
The proposed controller and security parameter are beneficial for reducing the
computation costs of an encrypted control system, while achieving the desired
security level. Furthermore, the proposed design method enables the systematic
design of encrypted control systems.

Networked control systems, optimal control, cybersecurity, encrypted control,
homomorphic encryption

##  1 Introduction

Encrypted control using homomorphic encryption is a major approach for
security enhancement of networked control systems, as a network eavesdropper
and a controller server cannot learn about the control system [1, 2]. Unlike
traditional public-key encryption, homomorphic encryption enables arithmetic
operations on encrypted data, and therefore the server does not require a
secret key for decryption. Hence, encrypted control has been applied to
various controls, as in [3, 4, 5, 6, 7], to realize the secure outsourcing of
controller computation to an untrusted server and implemented to some
practical systems [8, 9, 10]. Moreover, attacks for encrypted control systems
and their countermeasures were studied in [11, 12, 13].

Although most existing encrypted controls rely on the security of used
homomorphic encryption, the controls need other security definitions because,
in control systems, the information to be protected is system parameters
rather than a single sensor or control signal data at a certain point of time.
To solve this problem, recent studies have explored the security of encrypted
control systems. In [14], the authors examined the provable security of the
systems and analyzed the connection between the security and a traditional
cryptographic security definition. The study [15] focused on quantifying the
security level of encrypted control systems using the sample complexity and
computation time of system identification, disclosing the parameters of a
target system. The study also included a design for a controller that
maximizes the sample complexity of the Bayes estimation for a system matrix of
a closed-loop system with an encrypted controller. Then, the study determined
the minimum key length required to ensure that the computation time exceeds
the period in which the target system is replaced. Additionally, for a given
security parameter, the study [16] provided a guideline for choosing
cryptosystem parameters in an encrypted control system.

Here we consider the design of encrypted control systems under the least
squares identification attack for a system matrix of a closed-loop system.
Preventing such attacks is essential to realizing secure control systems
because once the attack is successful, an attacker can implement undetectable
attacks based on the system model [17]. A major challenge in designing the
systems against the attack is the computation costs associated with encryption
algorithms [1]. The use of homomorphic encryption can significantly increase
the computational burden on the system, leading to longer computation times,
potentially affecting the real-time performance of the system. Furthermore, as
the security parameter increases, the computation costs also increase, which
leads to a trade-off between security level and performance.

This study proposes a systematic method for solving the security and
performance trade-off by designing an optimal controller and security
parameter for encrypted control systems based on the security definition in
[15]. To this end, this study derives a novel sample complexity of the
systems. With the novel sample complexity, we reveal that the security level
of the system is connected to the controllability Gramian of the target
system. The optimal controller is designed as an optimal $H_{2}$ controller
that minimizes the trace of the controllability Gramian to maximize the
security level for a given security parameter. Then, the optimal security
parameter is determined as the minimum security parameter to achieve the
desired security level.

The proposed method contributes to the generalization of the design method in
[15]. The previous method chose the minimum key length for a specific
encryption scheme. In contrast, the proposed method determines the minimum
security parameter rather than the key length. A security parameter is a
common quantity for encryption schemes, and thus the proposed method can be
applied to encrypted control systems with any homomorphic encryption.
Moreover, the attack based on the least squares method considered in this
study is easier for attackers to perform compared to the Bayesian estimation
in [15] because the method does not require prior knowledge of a target
system. Therefore, a broader class of encrypted control systems can be
protected by preventing least squares identification attacks.

The rest of this paper is organized as follows. Section 2 defines the syntax
of homomorphic encryption and encrypted control. Section 3 formulates an
attack scenario and introduces the security definition of encrypted control
systems. Section 4 proposes an optimal controller and security parameter.
Section 5 shows a numerical example. Section 6 describes conclusions and
future work.

##  2 Preliminaries

###  2.1 Notation

The sets of natural numbers, integers, and real numbers are denoted by
$\mathbb{N}$, $\mathbb{Z}$, and $\mathbb{R}$, respectively. A key space, a
plaintext space, and a ciphertext space are denoted by $\mathcal{K}$,
$\mathcal{M}$, and $\mathcal{C}$, respectively. Define the set
$\mathbb{Z}^{+}\coloneqq\\{z\in\mathbb{Z}\mid 0\leq z\\}$ and the bounded set
$\mathcal{X}\subset\mathbb{R}$. The sets of $n$-dimensional vectors and
$m$-by-$n$ matrices of which elements and entries belonging to the set
$\mathcal{A}$ are denoted by $\mathcal{A}^{n}$ and $\mathcal{A}^{m\times n}$,
respectively. The $i$th element of vector $v\in\mathcal{A}^{n}$ and the
$(i,j)$ entry of matrix $M\in\mathcal{A}^{m\times n}$ are denoted by $v_{i}$
and $M_{ij}$, respectively. The Frobenius norm of $M\in\mathcal{A}^{m\times
n}$ is denoted by
$\|M\|_{F}\coloneqq\sqrt{\mathop{\mathrm{tr}}\limits(M^{\top}M)}$.

###  2.2 Homomorphic encryption

This section describes the syntax and security level of encryption. In the
following, a security parameter is denoted by $\lambda\in\mathbb{N}$. First,
homomorphic encryption is defined as follows [18].

###### Definition 1

Homomorphic encryption is
$(\mathsf{KeyGen},\allowbreak\mathsf{Enc},\allowbreak\mathsf{Dec},\allowbreak\mathsf{Eval})$
such that:

  * •

$(\mathsf{pk},\mathsf{sk})\leftarrow\mathsf{KeyGen}(1^{\lambda})$: A key
generation algorithm takes $1^{\lambda}$ and outputs a key pair
$(\mathsf{pk},\mathsf{sk})\in\mathcal{K}$, where $1^{\lambda}$ is the unary
representation of a security parameter, $\mathsf{pk}$ is a public key, and
$\mathsf{sk}$ is a secret key.

  * •

$\mathsf{ct}\leftarrow\mathsf{Enc}(\mathsf{pk},m)$: An encryption algorithm
takes a public key $\mathsf{pk}$ and a plaintext $m\in\mathcal{M}$ and outputs
a ciphertext $\mathsf{ct}\in\mathcal{C}$.

  * •

$m\leftarrow\mathsf{Dec}(\mathsf{sk},\mathsf{ct})$: A decryption algorithm
takes a secret key $\mathsf{sk}$ and a ciphertext $\mathsf{ct}\in\mathcal{C}$
and outputs a plaintext $m\in\mathcal{M}$.

  * •

$\mathsf{ct}\leftarrow\mathsf{Eval}(\mathsf{pk},\mathsf{ct}_{1},\mathsf{ct}_{2})$:
A homomorphic evaluation algorithm takes a public key $\mathsf{pk}$ and
ciphertexts $\mathsf{ct}_{1},\mathsf{ct}_{2}\in\mathcal{C}$ and outputs a
ciphertext $\mathsf{ct}\in\mathcal{C}$.

  * •

Correctness: $\mathsf{Dec}(\mathsf{sk},\mathsf{Enc}(\mathsf{pk},m))=m$ holds
for any $(\mathsf{pk},\mathsf{sk})\leftarrow\mathsf{KeyGen}(1^{\lambda})$ and
for any $m\in\mathcal{M}$.

  * •

Homomorphism:
$\mathsf{Dec}(\mathsf{sk},\mathsf{Eval}(\mathsf{pk},\mathsf{ct}_{1},\mathsf{ct}_{2}))=m_{1}\bullet
m_{2}$ holds for any
$(\mathsf{pk},\mathsf{sk})\leftarrow\mathsf{KeyGen}(1^{\lambda})$ and for any
$m_{1},m_{2}\in\mathcal{M}$, where
$\mathsf{ct}_{1}\leftarrow\mathsf{Enc}(\mathsf{pk},m_{1})$,
$\mathsf{ct}_{2}\leftarrow\mathsf{Enc}(\mathsf{pk},m_{2})$, and $\bullet$ is a
binary operation on $\mathcal{M}$.

Homomorphic encryption is called as additive, multiplicative, or (leveled)
fully homomorphic encryption if the binary operation is addition
($\bullet=+$), multiplication ($\bullet=\times$), or both addition and
multiplication, respectively.

Next, we define updatable homomorphic encryption.

###### Definition 2

Let
$\Pi=(\mathsf{KeyGen},\allowbreak\mathsf{Enc},\allowbreak\mathsf{Dec},\allowbreak\mathsf{Eval})$
be homomorphic encryption. Updatable homomorphic encryption is
$(\Pi,\allowbreak\mathsf{KeyUpd},\allowbreak\mathsf{CtUpd})$ such that:

  * •

$(\mathsf{pk}_{t+1},\mathsf{sk}_{t+1},\sigma_{t})\leftarrow\mathsf{KeyUpd}(\mathsf{pk}_{t},\mathsf{sk}_{t})$:
A key update algorithm takes a key pair
$(\mathsf{pk}_{t},\mathsf{sk}_{t})\in\mathcal{K}$ at time $t\in\mathbb{Z}^{+}$
and outputs an updated key pair
$(\mathsf{pk}_{t+1},\mathsf{sk}_{t+1})\in\mathcal{K}$ and an update token
$\sigma_{t}$.

  * •

$\mathsf{ct}_{t+1}\leftarrow\mathsf{CtUpd}(\mathsf{ct}_{t},\sigma_{t})$: A
ciphertext update algorithm takes a ciphertext $\mathsf{ct}_{t}\in\mathcal{C}$
and an update token $\sigma_{t}$ at time $t\in\mathbb{Z}^{+}$ and outputs an
updated ciphertext $\mathsf{ct}_{t+1}\in\mathcal{C}$.

  * •

Correctness:
$\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{ct}_{t})=\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{Enc}(\mathsf{pk}_{t},m))=m$
holds for any
$(\mathsf{pk}_{0},\mathsf{sk}_{0})\leftarrow\mathsf{KeyGen}(1^{\lambda})$, for
any $m\in\mathcal{M}$, and for all $t\in\mathbb{Z}^{+}$, where
$\mathsf{ct}_{0}\leftarrow\mathsf{Enc}(\mathsf{pk}_{0},m)$,
$(\mathsf{pk}_{t+1},\mathsf{sk}_{t+1},\sigma_{t})\leftarrow\mathsf{KeyUpd}(\mathsf{pk}_{t},\mathsf{sk}_{t})$,
and $\mathsf{ct}_{t+1}\leftarrow\mathsf{CtUpd}(\mathsf{ct}_{t},\sigma_{t})$.

  * •

Homomorphism:
$\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{Eval}(\mathsf{pk}_{t},\mathsf{ct}_{1,t},\mathsf{ct}_{2,t}))=\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{Eval}(\mathsf{pk}_{t},\mathsf{Enc}(\mathsf{pk}_{t},m_{1}),\mathsf{Enc}(\mathsf{pk}_{t},m_{2})))=m_{1}\bullet
m_{2}$ holds for any
$(\mathsf{pk}_{0},\mathsf{sk}_{0})\leftarrow\mathsf{KeyGen}(1^{\lambda})$, for
any $m_{i}\in\mathcal{M}$, and for all $t\in\mathbb{Z}^{+}$, where
$\mathsf{ct}_{i,0}\leftarrow\mathsf{Enc}(\mathsf{pk}_{0},m_{i})$,
$(\mathsf{pk}_{t+1},\mathsf{sk}_{t+1},\sigma_{t})\leftarrow\mathsf{KeyUpd}(\mathsf{pk}_{t},\mathsf{sk}_{t})$,
$\mathsf{ct}_{i,t+1}\leftarrow\mathsf{CtUpd}(\mathsf{ct}_{i,t},\sigma_{t})$,
and $i=1,2$.

Updatable homomorphic encryption is a public-key variant of updatable
encryption [19, 20] with a homomorphic evaluation algorithm. The following
property is assumed for the updatable homomorphic encryption used in this
study.

###### Assumption 1

A key pair $(\mathsf{pk}_{k},\mathsf{sk}_{k})$ provides no information about a
key pair $(\mathsf{pk}_{j},\mathsf{sk}_{j})$ for any $k\in\mathbb{Z}^{+}$ and
for any $j\in\mathbb{Z}^{+}\setminus\\{k\\}$, where
$(\mathsf{pk}_{0},\mathsf{sk}_{0})\leftarrow\mathsf{KeyGen}(1^{\lambda})$, and
$(\mathsf{pk}_{t+1},\mathsf{sk}_{t+1},\sigma_{t})\leftarrow\mathsf{KeyUpd}(\mathsf{pk}_{t},\mathsf{sk}_{t})$.

Although one may think that the assumption is significantly stronger than a
single-key case, updatable homomorphic encryption scheme satisfying it can be
realized based on a standard cryptographic assumption [15, Propositions 2 and
3].

Finally, we define the security level of encryption schemes, which is
quantified using the number of bits [21].

###### Definition 3

An encryption scheme satisfies $\lambda$ bit security if at least
$2^{\lambda}$ operations are required to break the scheme.

###### Remark 1

By Definition 3, a security parameter $\lambda$ represents the security level
of an encryption scheme. The optimal key length $k^{\ast}$ of an encryption
scheme satisfying $\lambda$ bit security can be computed as

$k^{\ast}=\mathop{\mathrm{arg~{}min}}\limits{}_{k\in\mathbb{N}}\,\Omega(k)\quad\text{s.t.}\quad\Omega(k)\geq
2^{\lambda},$ (1)

where $\Omega(k)$ is the time complexity of the fastest known algorithm for
breaking the encryption scheme.

###  2.3 Encrypted control

Using (updatable) homomorphic encryption, encrypted control is defined as
follows.

###### Definition 4

Given (updatable) homomorphic encryption and a controller
$f:(\Phi,\xi)\mapsto\psi$, where $\Phi\in\mathcal{X}^{\alpha\times\beta}$ is a
controller parameter, $\xi\in\mathcal{X}^{\beta}$ is a controller input, and
$\psi\in\mathcal{X}^{\alpha}$ is a controller output. Let there exist
$\mathsf{Ecd}$ and $\mathsf{Dcd}$ such that:

  * •

$m\leftarrow\mathsf{Ecd}(x;\Delta)$: An encoder algorithm takes
$x\in\mathcal{X}$ and a scaling factor $\Delta\in\mathbb{R}$ and outputs a
plaintext $m\in\mathcal{M}$.

  * •

$x\leftarrow\mathsf{Dcd}(m;\Delta)$: A decoder algorithm takes a plaintext
$m\in\mathcal{M}$ and a scaling factor $\Delta\in\mathbb{R}$ and outputs
$x\in\mathcal{X}$.

An encrypted controller of $f$ is $\mathsf{EC}$ such that:

  * •

$\mathsf{ct}_{\psi}\leftarrow\mathsf{EC}(\mathsf{pk},\mathsf{ct}_{\Phi},\mathsf{ct}_{\xi})$:
An encrypted control algorithm takes a public key $\mathsf{pk}$ and
ciphertexts
$\mathsf{ct}_{\Phi}\in\mathcal{C}^{\alpha\times\beta},\mathsf{ct}_{\xi}\in\mathcal{C}^{\beta}$
and outputs a ciphertext $\mathsf{ct}_{\psi}\in\mathcal{C}^{\alpha}$.

  * •

$\mathsf{Dcd}(\mathsf{Dec}(\mathsf{sk},\mathsf{EC}(\mathsf{pk},\mathsf{ct}_{\Phi},\mathsf{ct}_{\xi}));\Delta)\simeq
f(\Phi,\xi)$ holds for some $\Delta\in\mathbb{R}$, for any
$(\mathsf{pk},\mathsf{sk})\leftarrow\mathsf{KeyGen}(1^{\lambda})$, for any
$\Phi\in\mathcal{X}^{\alpha\times\beta}$, and for any
$\xi\in\mathcal{X}^{\beta}$, where
$\mathsf{ct}_{\Phi}\leftarrow\mathsf{Enc}(\mathsf{pk},\mathsf{Ecd}(\Phi;\Delta))$,
$\mathsf{ct}_{\xi}\leftarrow\mathsf{Enc}(\mathsf{pk},\mathsf{Ecd}(\xi;\Delta))$,
and the algorithms perform each element of matrices and vectors.

Note that the controller parameter of an encrypted controller with additive
homomorphic encryption is a plaintext rather than a ciphertext [3, 5]. In this
case, Definition 4 can be modified by replacing $\mathsf{ct}_{\Phi}$ with
$\mathsf{Ecd}(\Phi;\Delta)$.

###### Remark 2

Although encoder and decoder algorithms generally induce a quantization error
$e(\Delta)$, i.e., $\mathsf{Dcd}(\mathsf{Ecd}(x;\Delta);\Delta)=x+e(\Delta)$,
this study assumes that the error is negligible because of the appropriately
chosen scaling factor $\Delta$ [1, 15].

##  3 Attack Scenario and Security Definition

This section formulates an attack scenario considered in this study and
defines the security of encrypted control systems under the scenario.

###  3.1 Attack scenario

Given the control system

$\displaystyle x_{t+1}$ $\displaystyle=A_{p}x_{t}+B_{p}u_{t}+w_{t},$ (2a)
$\displaystyle u_{t}$ $\displaystyle=Fx_{t},$ (2b)

where $t\in\mathbb{Z}^{+}$ is a time, $x_{t}\in\mathbb{R}^{n}$ is a state,
$u_{t}\in\mathbb{R}^{m}$ is an input, and $w_{t}\in\mathbb{R}^{n}$ is a noise.
Suppose $x_{0}$ and $w_{t}$ are independent and identically distributed over
the Gaussian distribution with mean $\bm{0}$ and variance $\sigma^{2}I$. The
plant parameters $(A_{p},B_{p})$ are controllable, and $F$ is a feedback gain
designed such that $A_{p}+B_{p}F$ is stable. If $F\in\mathcal{X}^{m\times n}$,
$x_{t}\in\mathcal{X}^{n}$, and $u_{t}\in\mathcal{X}^{m}$ for all
$t\in\mathbb{Z}^{+}$, the encrypted control system of (2) with updatable
multiplicative homomorphic encryption is given as

$\displaystyle x_{t+1}$ $\displaystyle=A_{p}x_{t}+B_{p}u_{t}+w_{t},$ (3)
$\displaystyle u_{t}$
$\displaystyle\leftarrow\mathsf{Dcd}(\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{ct}_{u,t});\Delta),$
$\displaystyle\mathsf{ct}_{u,t}$
$\displaystyle\leftarrow\mathsf{EC}(\mathsf{pk}_{t},\mathsf{ct}_{F,t},\mathsf{ct}_{x,t}),$
$\displaystyle\mathsf{ct}_{x,t}$
$\displaystyle\leftarrow\mathsf{Enc}(\mathsf{pk}_{t},\mathsf{Ecd}(x_{t};\Delta)),$

where
$(\mathsf{pk}_{0},\mathsf{sk}_{0})\leftarrow\mathsf{KeyGen}(1^{\lambda})$,
$\mathsf{ct}_{F,0}\leftarrow\mathsf{Enc}(\mathsf{pk}_{0},\allowbreak\mathsf{Ecd}(F;\allowbreak\Delta))$,
$(\mathsf{pk}_{t+1},\mathsf{sk}_{t+1},\sigma_{t})\leftarrow\mathsf{KeyUpd}(\mathsf{pk}_{t},\mathsf{sk}_{t})$,
$\mathsf{ct}_{F,t+1}\leftarrow\mathsf{CtUpd}(\mathsf{ct}_{F,t},\sigma_{t})$,
$\mathsf{EC}$ is the encrypted controller of (2b) that outputs a ciphertext
matrix $\mathsf{ct}_{u,t}\in\mathcal{C}^{m\times n}$ of which $(i,j)$ entry is
an output of
$\mathsf{Eval}(\mathsf{pk}_{t},\mathsf{ct}_{F_{ij},t},\mathsf{ct}_{x_{j},t})$,
and the decryption algorithm is redefined as
$\mathsf{Dec}\coloneqq\mathsf{Sum}\circ\mathsf{Dec}$ using
$\mathsf{Sum}:\mathcal{M}^{m\times
n}\to\mathcal{M}^{m}:M\mapsto[\,\sum_{i=1}^{n}M_{1i}\ \allowbreak\cdots\
\allowbreak\sum_{i=1}^{n}M_{mi}\,]^{\top}$ [2]. Then, by Definition 4, the
dynamics of the closed-loop system is given as

$\displaystyle x_{t+1}$
$\displaystyle=A_{p}x_{t}+B_{p}\mathsf{Dcd}(\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{ct}_{u,t});\Delta)+w_{t},$
$\displaystyle=Ax_{t}+w_{t},$ (4)

where $A=A_{p}+B_{p}F$. Note that
$\mathsf{Dcd}(\mathsf{Dec}(\mathsf{sk}_{t},\mathsf{ct}_{u,t});\Delta)=Fx_{t}$
holds thanks to the assumption in Remark 2.

Given the above settings and updatable homomorphic encryption satisfying
Assumption 1, this study considers the following attack scenario.

###### Definition 5

The attacker follows the procedure below.

  1. 1.

The attacker eavesdrops the ciphertexts $\mathsf{ct}_{x,t}$ of (3) within
$t\in[t_{s},t_{f}]$, where $0<t_{s}<t_{f}<\infty$.

  2. 2.

The attacker deciphers the ciphertexts to obtain the original data
$\\{x_{t_{s}},\cdots,x_{t_{f}}\\}$.

  3. 3.

The attacker estimates $A$ of (4) by the least squares method,

$\hat{A}=\mathop{\mathrm{arg~{}min}}\limits{}_{A\in\mathbb{R}^{n\times
n}}\|X_{f}-AX_{p}\|_{F}^{2}=X_{f}X_{p}^{+},$ (5)

where $X_{f}=AX_{p}+W_{p}$, $X_{f}=[x_{t_{s}+1}\ \cdots\ x_{t_{f}}]$,
$X_{p}=[x_{t_{s}}\ \cdots\ x_{t_{f}-1}]$, $W_{p}=[w_{t_{s}}\ \cdots\
w_{t_{f}-1}]$, and $X_{p}^{+}$ is the pseudo inverse matrix of $X_{p}$. We
assume that $X_{p}$ is full row rank throughout this paper. Note that the
assumption is met for a sufficiently large sample size $N=t_{f}-t_{s}+1$ in
practice.

Additionally, we define the estimation error as

$\epsilon(N,F)\coloneqq(1/n^{2})\|A-\hat{A}\|_{F}^{2}.$ (6)

It should be noted that the estimation error implicitly depends on $F$ of (2b)
because $A$ of (4) can be tuned by designing $F$. This fact is relevant later
in the controller design.

###### Remark 3

With typical multiplicative or (leveled) fully homomorphic encryption [22,
23], the encrypted control system of (2) is given as (3), replacing
$(\mathsf{pk}_{t},\mathsf{sk}_{t})$ and $\mathsf{ct}_{F,t}$ with
$(\mathsf{pk},\mathsf{sk})=(\mathsf{pk}_{0},\mathsf{sk}_{0})$ and
$\mathsf{ct}_{F}=\mathsf{ct}_{F,0}$, respectively. In addition,
$\mathsf{ct}_{F}$ is modified to $\mathsf{Ecd}(F;\Delta)$ when using typical
additive homomorphic encryption [24, 25]. The attack in Definition 5 can be
applied even to such encrypted control systems because the closed-loop
dynamics of the systems are represented by (4).

###### Remark 4

The required computation time to perform the second step in Definition 5 is
determined by a security parameter, which will be formulated in Definition 7
to define the security of encrypted control systems.

###  3.2 Security of encrypted control system

This study employs the security definition in [15] for encrypted control
systems under the attack in Definition 5. Roughly speaking, in the definition,
an encrypted control system is said to be secure if an attacker cannot
estimate the parameters of a target system with a certain accuracy within a
given period. The security is formulated based on two quantities, sample
identifying complexity and sample deciphering time, defined below.

###### Definition 6

Let $N$ be a sample size. A sample identifying complexity of (4) under the
attack in Definition 5 is a function $\gamma$ satisfying
$\gamma(N,F)\leq\mathop{\mathbb{E}}\limits[\epsilon(N,F)]$, where $F$ and
$\epsilon$ are defined in (2b) and (6), respectively.

###### Definition 7

A sample deciphering time is a computation time $\tau$ required for breaking
$N$ ciphertexts of an updatable homomorphic encryption scheme that satisfies
$\lambda$ bit security and Assumption 1 by a computer of $\Upsilon$ floating
point number operations per second (FLOPS), that is,

$\tau(N,\lambda)\coloneqq 2^{\lambda}N\Upsilon^{-1}.$ (7)

Note that the sample deciphering time for typical homomorphic encryption is
given as $\tau(1,\lambda)$ because the same key pair is used for encrypting
all data.

By these definitions, the sample identifying complexity and deciphering time
quantify the difficulty of estimating $A$ in (4) using data of sample size $N$
and the required computation time for recovering the data from ciphertexts,
respectively. Now we introduce two constants, acceptable estimation error
$\gamma_{c}$ and defense period $\tau_{c}$, to represent an estimation error
acceptable by a defender who is the designer of an encrypted control system
and a period in which the system is desired to be protected. Combining with
$\gamma$, $\tau$, $\gamma_{c}$, and $\tau_{c}$, the security of encrypted
control systems can be defined as follows.

###### Definition 8

Let $\gamma_{c}$ be an acceptable estimation error and let $\tau_{c}$ be a
defense period. The encrypted control system (3) is secure if there does not
exist a sample size $N$ such that $\gamma(N,F)<\gamma_{c}$ and
$\tau(N,\lambda)\leq\tau_{c}$, where $\gamma$ and $\tau$ are defined in
Definition 6 and Definition 7, respectively. Otherwise, (3) is unsecure.

A larger $\gamma_{c}$ and longer $\tau_{c}$ imply a more secure encrypted
control system as long as the system is secure. In other words, a pair
$(\gamma_{c},\tau_{c})$ represents the security level of a secure encrypted
control system. The constants are later used as design parameters for the
optimal security parameter.

###### Remark 5

Let $\delta>0$. $|A_{ij}-\hat{A}_{ij}|\geq\delta$ holds for all
$i,j=1,\dots,n$ only if $\epsilon(N,F)\geq\delta^{2}$, where $A$, $\hat{A}$,
and $\epsilon$ are defined in (4), (5), and (6), respectively. This fact
suggests that $\gamma_{c}=\delta^{2}$ is one of the reasonable choices for an
acceptable estimation error. Note that $\delta$ should be tailored for a given
control system based on its potential risk. Additionally, a defense period
$\tau_{c}$ can be chosen as a life span of (2).

###### Remark 6

For a noiseless case, i.e., $w_{t}=0$, an attacker can exactly identify $A$ of
(4) by decipering $n+1$ samples since $A$ is an $n$-by-$n$ matrix. The
security definition in such a case can be modified so that (3) is secure if
$\tau(n+1,\lambda)>\tau_{c}$.

##  4 Encrypted Control System Design

This section presents a design method for an optimal controller and security
parameter. To this end, we propose a novel sample identifying complexity of
(4) under the attack in Definition 5. We reveal that the optimal controller
can be designed as an $H_{2}$ optimal controller maximizing the sample
identifying complexity. Subsequently, the optimal security parameter is
determined using the controllability Gramian of (4) with the optimal
controller.

###  4.1 Optimal controller

The sample identifying complexity of (4) under the attack in Definition 5 is
obtained as follows.

###### Lemma 1

The function

$\gamma(N,F)\coloneqq n[(N-1)\mathop{\mathrm{tr}}\limits(\Psi)]^{-1}$ (8)

is a sample identifying complexity of (4) under the attack in Definition 5,
where $\Psi=\Psi(F)$ is a solution to the discrete Lyapunov equation $A\Psi
A^{\top}-\Psi+I=0$.

######  Proof 4.1.

It follows from (5) and (6) that
$\mathop{\mathbb{E}}\limits[\epsilon(N,F)]=(1/n^{2})\mathop{\mathbb{E}}\limits[\|W_{p}X_{p}^{+}\|_{F}^{2}]=(1/n^{2})\mathop{\mathbb{E}}\limits[\mathop{\mathrm{tr}}\limits(X_{p}^{+}(X_{p}^{+})^{\top}W_{p}^{\top}W_{p})]$.
Let $\bar{X}=X_{p}^{+}(X_{p}^{+})^{\top}$, and let
$\bar{W}=W_{p}^{\top}W_{p}$. Then, we obtain

$\displaystyle\mathop{\mathbb{E}}\limits\\!\left[\mathop{\mathrm{tr}}\limits\\!\left(\bar{X}\bar{W}\right)\\!\right]$
$\displaystyle\\!=\\!\mathop{\mathbb{E}}\limits\\!\left[\left(\bar{X}_{11}\bar{W}_{11}\\!+\\!\cdots\\!+\\!\bar{X}_{1,T}\bar{W}_{T,1}\right)\right.$
$\displaystyle\quad\quad\left.\\!+\\!\cdots\\!+\\!\left(\bar{X}_{T,1}\bar{W}_{1,T}\\!+\\!\cdots\\!+\\!\bar{X}_{T,T}\bar{W}_{T,T}\right)\right]\\!,$
$\displaystyle\\!=\\!\mathop{\mathbb{E}}\limits\\!\left[\sum_{j=1}^{t_{f}-t_{s}}\sum_{k=1}^{t_{f}-t_{s}}\bar{X}_{jk}w_{t_{s}-1+k}^{\top}w_{t_{s}-1+j}\right]\\!,$
$\displaystyle\\!=\\!\mathop{\mathbb{E}}\limits\\!\left[\sum_{k=1}^{t_{f}-t_{s}}\bar{X}_{kk}w_{t_{s}-1+k}^{\top}w_{t_{s}-1+k}\right]\\!,$
$\displaystyle\\!=\\!\mathop{\mathbb{E}}\limits\\!\left[\mathop{\mathrm{tr}}\limits\\!\left(\bar{X}\mathop{\mathrm{diag}}\limits\\!\left(\\!w_{t_{s}}^{\top}w_{t_{s}},\dots,w_{t_{f}-1}^{\top}w_{t_{f}-1}\\!\right)\\!\right)\\!\right]\\!,$
$\displaystyle\\!=\\!\mathop{\mathrm{tr}}\limits\\!\left(\\!\mathop{\mathbb{E}}\limits\\!\left[\bar{X}\right]\\!\mathop{\mathbb{E}}\limits\\!\left[\mathop{\mathrm{diag}}\limits\\!\left(\\!w_{t_{s}}^{\\!\top}w_{t_{s}},\dots,w_{t_{\\!f}-1}^{\\!\top}w_{t_{\\!f}-1}\\!\right)\\!\right]\\!\right)\\!,$
$\displaystyle\\!=\\!n\sigma^{2}\mathop{\mathrm{tr}}\limits\\!\left(\mathop{\mathbb{E}}\limits\\!\left[X_{p}^{\\!\top}\\!(X_{p}X_{p}^{\\!\top})^{-1}(X_{p}^{\\!\top}\\!(X_{p}X_{p}^{\\!\top})^{-1})^{\\!\top}\right]\right)\\!,$
$\displaystyle\\!=\\!n\sigma^{2}\mathop{\mathrm{tr}}\limits\\!\left(\mathop{\mathbb{E}}\limits\\!\left[(X_{p}X_{p}^{\top})^{-1}\right]\right)\\!,$

where $T\\!=\\!t_{f}\\!-\\!t_{s}$,
$\bar{W}_{ij}\\!=\\!w_{t_{s}-1+i}^{\top}w_{t_{s}-1+j}$, and the third equality
follows from that $w_{t_{s}-1+k}$ and $w_{t_{s}-1+j}$ are independent for
$j\\!\neq\\!k$. From Jensen’s inequality,
$\mathop{\mathrm{tr}}\limits\left((X_{p}X_{p}^{\top})^{-1}\right)=\sum_{i=1}^{n}\lambda_{i}\left((X_{p}X_{p}^{\top})^{-1}\right)=\sum_{i=1}^{n}\lambda_{i}(X_{p}X_{p}^{\top})^{-1}=n\sum_{i=1}^{n}(1/n)\lambda_{i}(X_{p}X_{p}^{\top})^{-1}\geq
n\left(\sum_{i=1}^{n}(1/n)\lambda_{i}(X_{p}X_{p}^{\top})\right)^{-1}=n^{2}\left(\sum_{i=1}^{n}\lambda_{i}(X_{p}X_{p}^{\top})\right)^{-1}=n^{2}\mathop{\mathrm{tr}}\limits\left(X_{p}X_{p}^{\top}\right)^{-1}$
and $\mathop{\mathbb{E}}\limits[X^{-1}]\geq\mathop{\mathbb{E}}\limits[X]^{-1}$
hold, where $\lambda_{i}(M)$ denotes the $i$th eigenvalue of
$M\in\mathbb{R}^{n\times n}$, and $X$ is a random variable. Hence, the trace
of the expectation of the inverse matrix is bounded from below by
$\mathop{\mathrm{tr}}\limits\left(\mathop{\mathbb{E}}\limits\left[(X_{p}X_{p}^{\top})^{-1}\right]\right)\geq
n^{2}\mathop{\mathbb{E}}\limits\left[\mathop{\mathrm{tr}}\limits\left(X_{p}X_{p}^{\top}\right)^{-1}\right]\geq
n^{2}\mathop{\mathbb{E}}\limits\left[\mathop{\mathrm{tr}}\limits\left(X_{p}X_{p}^{\top}\right)\right]^{-1}$.
Furthermore, it follows from (4) that

$\displaystyle\mathop{\mathbb{E}}\limits\left[\mathop{\mathrm{tr}}\limits\left(X_{p}X_{p}^{\top}\right)\right]=\mathop{\mathbb{E}}\limits\left[\mathop{\mathrm{tr}}\limits\left(\sum_{t=t_{s}}^{t_{f}-1}x_{t}x_{t}^{\top}\right)\right]\\!,$
$\displaystyle=\mathop{\mathbb{E}}\limits\\!\\!\left[\sum_{t=t_{s}}^{t_{f}-1}\\!\mathop{\mathrm{tr}}\limits\\!\left(\\!\\!A^{t}x_{0}x_{0}^{\top}\\!(A^{t})\\!^{\top}\\!\\!+\\!\sum_{k=0}^{t-1}\\!A^{t-1-k}w_{k}w_{k}^{\top}\\!(A^{t-1-k})\\!^{\top}\\!\\!\right)\\!\\!\right]\\!,$
$\displaystyle=\sigma^{2}\left[\sum_{t=t_{s}}^{t_{f}-1}\mathop{\mathrm{tr}}\limits\left(A^{t}(A^{t})^{\top}+\sum_{k=0}^{t-1}A^{t-1-k}(A^{t-1-k})^{\top}\right)\right]\\!,$
$\displaystyle=\sigma^{2}\left[\sum_{t=t_{s}}^{t_{f}-1}\mathop{\mathrm{tr}}\limits\left(\sum_{k=0}^{t}A^{k}(A^{k})^{\top}\right)\right]\\!,$
$\displaystyle\leq\sigma^{2}\left[\sum_{t=t_{s}}^{t_{f}-1}\mathop{\mathrm{tr}}\limits(\Psi)\right]=\sigma^{2}(N-1)\mathop{\mathrm{tr}}\limits(\Psi),$

where
$A^{t}(A^{t})^{\top}+\sum_{k=0}^{t-1}A^{t-1-k}(A^{t-1-k})^{\top}=A^{t}(A^{t})^{\top}+\sum_{k=0}^{t-1}A^{k}(A^{k})^{\top}=\sum_{k=0}^{t}A^{k}(A^{k})^{\top}\leq\sum_{k=0}^{\infty}A^{k}(A^{k})^{\top}=\Psi$.
Consequently, we obtain
$\mathop{\mathbb{E}}\limits[\epsilon(N,F)]\geq(1/n^{2})\cdot n\sigma^{2}\cdot
n^{2}\cdot[\sigma^{2}(N-1)\mathop{\mathrm{tr}}\limits(\Psi)]^{-1}=\gamma(N,F)$.
By Definition 6, $\gamma(N,F)$ is a sample identifying complexity of (4) under
the attack in Definition 5.

The sample identifying complexity (8) is computed from the sample size $N$ and
the controllability Gramian $\Psi$ of (4), which is a function of the feedback
gain of (2b). By Definition 8, for some feedback gain $F$, the encrypted
control system (3) is secure if $\tau(N^{\prime},\lambda)>\tau_{c}$ holds for
the minimum sample size $N^{\prime}$ satisfying
$\gamma(N^{\prime},F)<\gamma_{c}$ because the sample identifying complexity
$\gamma(N,F)$ is monotonically decreasing on $N$. By Definition 7, for some
security parameter $\lambda$, the sample deciphering time
$\tau(N^{\prime},\lambda)$ increases as $N^{\prime}$ increases. Hence,
increasing $N^{\prime}$, the defense period $\tau_{c}$ can be extended while
maintaining the security. A feedback gain $F$ that maximizes $N^{\prime}$ can
be designed by maximizing $\gamma(N^{\prime},F)$, i.e., minimizing the trace
of $\Psi$. The following theorem reveals that such a controller is the optimal
$H_{2}$ controller when $\gamma$ is given as (8).

######  Theorem 4.2.

The feedback gain of (2b) maximizing (8) is

$F^{\ast}=Q^{\ast}(P^{\ast})^{-1},$ (9)

where $(\eta^{\ast},P^{\ast},Q^{\ast})\in\mathbb{R}\times\mathbb{R}^{n\times
n}\times\mathbb{R}^{m\times n}$ is a solution to the problem

$\min_{(\eta,P,Q)}\eta\ \text{s.t.}\ \mathop{\mathrm{tr}}\limits(P)\,<\,\eta,\
P=P^{\top}>0,\ \begin{bmatrix}P\\!&\\!R\\!&\\!I\\\ R^{\top}\\!&\\!P\\!&\\!O\\\
I\\!&\\!O\\!&\\!I\end{bmatrix}>0,$

$R=A_{p}P+B_{p}Q$, $(A_{p},B_{p})$ are defined in (2a), and
$I\in\mathbb{R}^{n\times n}$ and $O\in\mathbb{R}^{n\times n}$ are the identity
and zero matrices, respectively.

######  Proof 4.3.

The parameter in (8) depending on a feedback gain $F$ is only the Gramian
$\Psi=\Psi(F)$. Hence, the feedback gain $F^{\ast}$ maximizing (8) satisfies
$F^{\ast}=\mathop{\mathrm{arg~{}min}}\limits{}_{F}\mathop{\mathrm{tr}}\limits(\Psi)$.
Now we consider the fictitious system $G:z_{t+1}=Az_{t}+v_{t},\ y_{t}=z_{t}$,
where $z_{t}\in\mathbb{R}^{n}$, $v_{t}\in\mathbb{R}^{n}$, and
$y_{t}\in\mathbb{R}^{n}$. Then,
$\mathop{\mathrm{tr}}\limits(\Psi)=\|G\|_{H_{2}}^{2}$ holds, where
$\|\cdot\|_{H_{2}}$ is the $H_{2}$ norm, because $\Psi$ is the output
controllability Gramian of $G$. Therefore, the feedback gain is designed as
$F^{\ast}=\mathop{\mathrm{arg~{}min}}\limits{}_{F}\|G\|_{H_{2}}=Q^{\ast}(P^{\ast})^{-1}$,
where the second equality follows from [26, Proposition II.1], a discrete-time
version of [27, Proposition 3.13].

The controller (2b) with the feedback gain (9) is the optimal $H_{2}$
controller for the fictitious system generated by (4). The controller is also
optimal for security in the sense of Definition 8 when choosing $\gamma$ as
(8) because the controller maximizes the configurable range of an acceptable
estimation error or defense period while maintaining security. Meanwhile, the
optimal controller can reduce the security parameter satisfying the security
for some defense period. This fact is used for designing a security parameter
in the next section.

###  4.2 Optimal security parameter

A large security parameter not only improves the security level of encrypted
control systems but also generally increases the computation costs of
encryption, decryption, and homomorphic evaluation algorithms. Hence, the
minimum security parameter achieving the security is optimal in terms of the
implementation costs of encrypted control systems. Similarly to the optimal
controller design, the optimal security parameter can be designed by
maximizing the minimum sample size $N^{\prime}$ satisfying
$\gamma(N^{\prime},F)<\gamma_{c}$ for some $F$ because, by Definition 7,
$\lambda$ decreases as $N$ increases for some $\tau(N,\lambda)$. The
maximization is achieved by the optimal controller (9) as already discussed.
The following lemma shows the minimum sample size with the optimal controller.

######  Lemma 4.4.

Consider the attack in Definition 5. Given the controller (2b) with the
feedback gain (9). The minimum sample size $N^{\ast}$ satisfying
$\gamma(N^{\ast},F^{\ast})<\gamma_{c}$ is

$N^{\ast}=N(\gamma_{c},\Psi^{\ast})\coloneqq\left\lfloor
n[\gamma_{c}\mathop{\mathrm{tr}}\limits(\Psi^{\ast})]^{-1}\right\rfloor+2,$
(10)

where $\gamma_{c}$ is definined in Definition 8, and
$\Psi^{\ast}=\Psi(F^{\ast})$ is the Gramian in Lemma 1 with the feedback gain
$F^{\ast}$.

######  Proof 4.5.

It follows from (8) that
$\gamma(N,F^{\ast})<\gamma_{c}\\!\\!\\!\iff\\!\\!\\!N>n[\gamma_{c}\mathop{\mathrm{tr}}\limits(\Psi^{\ast})]^{-1}+1$.
Therefore, the minimum sample size $N^{\ast}$ satisfying
$\gamma(N^{\ast},F^{\ast})<\gamma_{c}$ is given as (10).

Using the minimum sample size, the optimal security parameter is determined as
follows.

######  Theorem 4.6.

Consider the attack in Definition 5. Given the controller (2b) with the
feedback gain (9). The minimum security parameter $\lambda^{\ast}$ making the
encrypted control system (3) secure, in the sense of Definition 8, is

$\lambda^{\ast}=\lambda(\tau_{c},\Upsilon,N^{\ast})\coloneqq\left\lfloor\log_{2}\Upsilon\tau_{c}(N^{\ast})^{-1}\right\rfloor+1,$
(11)

where $\Upsilon$, $\tau_{c}$, and $N^{\ast}$ are defined in Definition 7,
Definition 8, and Lemma 4.4, respectively.

######  Proof 4.7.

It follows from (7) that
$\tau(N^{\ast},\lambda)>\tau_{c}\\!\\!\\!\iff\\!\\!\\!\lambda\\!>\\!\log_{2}\\!\Upsilon\tau_{c}(N^{\ast})^{-1}$.
Therefore, the minimum security parameter $\lambda^{\ast}$ satisfying
$\tau(N^{\ast},\lambda^{\ast})>\tau_{c}$ is given as (11).

Consequently, the optimal encrypted control system with updatable homomorphic
encryption under the attack in Definition 5 can be systematically designed as
follows: 1) Set the desired security level $(\gamma_{c},\tau_{c})$. 2) Suppose
an attacker’s computer performance $\Upsilon$. 3) Compute the optimal
controller $F^{\ast}$ of (9). 4) Compute the Gramian
$\Psi^{\ast}=\Psi(F^{\ast})$ in Lemma 1. 5) Compute the sample size
$N^{\ast}=N(\gamma_{c},\Psi^{\ast})$ of (10). 6) Compute the optimal security
parameter $\lambda^{\ast}=\lambda(\tau_{c},\Upsilon,N^{\ast})$ of (11). From
Theorem 4.6, the designed encrypted control system is secure, in the sense of
Definition 8. Note that the design procedure can be applied to other attacks
by changing the sample identifying complexity (8) and controller (9).
Moreover, the optimal design of encrypted control systems with typical
homomorphic encryption can be achieved by computing only the optimal security
parameter $\lambda^{\ast}_{0}=\lambda(\tau_{c},\Upsilon,1)$.

##  5 Numerical Example

Given the parameters of (2a) as

$A_{p}=\begin{bmatrix}0.2&0.6&0&0\\\ 0.5&-0.5&-0.1&0.2\\\ 0&0&0.5&0\\\
0&0&0&0.3\end{bmatrix},\ B_{p}=\begin{bmatrix}0&1\\\ 0&0\\\ 0.5&0.5\\\
1&0\end{bmatrix}.$

The optimal feedback gain (9) is given as

$F^{\ast}=\begin{bmatrix}0.06&0.08&-0.17&-0.24\\\
-0.06&-0.63&-0.15&0.08\end{bmatrix},$

where CVXPY [28] is used for solving the optimization problem in Theorem 4.2.
Fig. 1 depicts the estimation error (6) (gray dots), its expectation (blue
solid line), and the sample identifying complexity (8) (orange dashed line)
for $N=500,\,\dots,\,5000$, where the attack of Definition 5 is performed $50$
times for each sample size with $\sigma^{2}=0.01$. The result shows that (8)
is an appropriate choice of a sample identifying complexity. Moreover, with
$\gamma_{c}=10^{-6}$, $\tau_{c}=31536\times 10^{4}$ s ($10$ years), and
$\Upsilon=4.42\times 10^{17}$ FLOPS111Supercomputer Fugaku.
https://www.top500.org/system/179807/, the minimum sample size (10) and
security parameter (11) are obtained as $N^{\ast}=785569$ and
$\lambda^{\ast}=68$ bit, respectively. Note that the minimum security
parameter making the encrypted control system in Remark 3 secure is
$\lambda^{\ast}_{0}=\lambda(\tau_{c},\Upsilon,1)=87$ bit. When using the
updatable homomorphic encryption in [15] and the ElGamal encryption [22], the
minimum key lengths (1) achieving $\lambda^{\ast}$ and $\lambda^{\ast}_{0}$
bit security are respectively given as $k^{\ast}=589$ and $1031$ bit, where
the time complexity of the fastest known algorithm for breaking the encryption
schemes is $\Omega(k)=\exp\\{(64/9)^{1/3}(\ln 2^{k})^{1/3}(\ln\ln
2^{k})^{2/3}\\}$ [29].

Figure 1: Estimation error and sample identifying complexity.

##  6 Conclusions

This study proposed an optimal controller and security parameter for encrypted
control systems under the least squares identification, disclosing the
parameters of a closed-loop system. We revealed that the optimal controller is
an $H_{2}$ optimal controller, and the optimal security parameter was computed
for an encrypted control system with the controller and updatable homomorphic
encryption.

Updatable homomorphic encryption plays a crucial role in the proposed design
method. In future work, we will construct updatable (leveled) fully
homomorphic encryption. Furthermore, the proposed design method can be applied
to other attacks, such as subspace identification.

## References

  * [1] M. S. Darup, A. B. Alexandru, D. E. Quevedo, and G. J. Pappas, “Encrypted control for networked systems – An illustrative introduction and current challenges,” _IEEE Control Syst. Mag._ , vol. 41, no. 3, pp. 58–78, 2021\.
  * [2] K. Kogiso and T. Fujita, “Cyber-security enhancement of networked control systems using homomorphic encryption,” in _IEEE Conf. Decis. Control_ , 2015, pp. 6836–6843.
  * [3] F. Farokhi, I. Shames, and N. Batterham, “Secure and private control using semi-homomorphic encryption,” _Control Eng. Pract._ , vol. 67, pp. 13–20, 2017.
  * [4] J. Kim, H. Shim, and K. Han, “Dynamic controller that operates over homomorphically encrypted data for infinite time horizon,” _IEEE Trans. Autom. Control_ , vol. 68, no. 2, pp. 660–672, 2023.
  * [5] M. S. Darup, A. Redder, I. Shames, F. Farokhi, and D. E. Quevedo, “Towards encrypted MPC for linear constrained systems,” _IEEE Control Syst. Lett._ , vol. 2, no. 2, pp. 195–200, 2018.
  * [6] A. B. Alexandru, A. Tsiamis, and G. J. Pappas, “Towards private data-driven control,” in _IEEE Conf. Decis. Control_ , 2020, pp. 5449–5456.
  * [7] J. Suh and T. Tanaka, “Encrypted value iteration and temporal difference learning over leveled homomorphic encryption,” in _Am. Control Conf._ , 2021, pp. 2555–2561.
  * [8] J. H. Cheon, K. Han, S. M. Hong, H. J. Kim, J. Kim, S. Kim, H. Seo, H. Shim, and Y. Song, “Toward a secure drone system: Flying with real-time homomorphic authenticated encryption,” _IEEE Access_ , vol. 6, pp. 24 325–24 339, 2018.
  * [9] K. Teranishi, N. Shimada, and K. Kogiso, “Development and examination of fog computing-based encrypted control system,” _IEEE Rob. Autom. Lett._ , vol. 5, no. 3, pp. 4642–4648, 2020.
  * [10] N. Shono, T. Miyazaki, K. Teranishi, T. Kanno, T. Kawase, K. Kogiso, and K. Kawashima, “Implementation of encrypted control of pneumatic bilateral control system using wave variables,” in _AROB-ISBC-SWARM_ , 2022, pp. 1169–1174.
  * [11] M. Fauser and P. Zhang, “Detection of cyber attacks in encrypted control systems,” _IEEE Control Syst. Lett._ , vol. 6, pp. 2365–2370, 2022.
  * [12] A. M. Naseri, W. Lucia, and A. Youssef, “Confidentiality attacks against encrypted control systems,” _Cyber-Phys. Syst._ , pp. 1–20, 2022.
  * [13] R. Alisic, J. Kim, and H. Sandberg, “Model-free undetectable attacks on linear systems using LWE-based encryption,” _IEEE Control Syst. Lett._ , vol. 7, pp. 1249–1254, 2023.
  * [14] K. Teranishi and K. Kogiso, “Towards provably secure encrypted control using homomorphic encryption,” in _IEEE Conf. Decis. Control_ , 2022, pp. 7740–7745.
  * [15] K. Teranishi, T. Sadamoto, A. Chakrabortty, and K. Kogiso, “Designing optimal key lengths and control laws for encrypted control systems based on sample identifying complexity and deciphering time,” _IEEE Trans. Autom. Control_ , vol. 68, no. 4, pp. 2183–2198, 2023.
  * [16] J. Kim, H. Shim, and K. Han, “Design procedure for dynamic controllers based on LWE-based homomorphic encryption to operate for infinite time horizon,” in _IEEE Conf. Decis. Control_ , 2020, pp. 5463–5468.
  * [17] M. S. Chong, H. Sandberg, and A. M. H. Teixeira, “A tutorial introduction to security and privacy for cyber-physical systems,” in _Eur. Control Conf._ , 2019, pp. 968–978.
  * [18] A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on homomorphic encryption schemes: Theory and implementation,” _ACM Comput. Surv._ , vol. 51, no. 4, 2018.
  * [19] D. Boneh, K. Lewi, H. Montgomery, and A. Raghunathan, “Key homomorphic PRFs and their applications,” in _Advances in cryptology – CRYPTO 2013_ , R. Canetti and J. A. Garay, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013, pp. 410–428.
  * [20] A. Lehmann and B. Tackmann, “Updatable encryption with post-compromise security,” in _Advances in cryptology – EUROCRYPT 2018_ , J. B. Nielsen and V. Rijmen, Eds. Cham: Springer International Publishing, 2018, pp. 685–716.
  * [21] J. Katz and Y. Lindell, _Introduction to Modern Cryptography_ , D. R. Stinson, Ed. Boca Raton: CRC Press, 2021\.
  * [22] T. Elgamal, “A public key cryptosystem and a signature scheme based on discrete logarithms,” _IEEE Trans. Inf. Theory_ , vol. 31, no. 4, pp. 469–472, 1985.
  * [23] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in _Advances in cryptology – ASIACRYPT 2017_ , T. Takagi and T. Peyrin, Eds. Cham: Springer International Publishing, 2017, pp. 409–437.
  * [24] P. Paillier, “Public-key cryptosystems based on composite degree residuosity classes,” in _Advances in cryptology — EUROCRYPT ’99_ , J. Stern, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 1999, pp. 223–238.
  * [25] O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” in _Annu. ACM Symp. Theory Comput._ , 2005, p. 84–93.
  * [26] T. R. V. Steentjes, M. Lazar, and P. M. J. Van den Hof, “Scalable distributed and decentralized $\mathscr{{H}}_{2}$ controller synthesis for interconnected linear discrete-time systems,” arXiv, Jan. 2020.
  * [27] C. Scherer and S. Weiland, “Linear matrix inequalities in control,” Lecture Notes, Dutch Institute for Systems and Control, Delft, The Netherlands, 2000.
  * [28] S. Diamond and S. Boyd, “CVXPY: A Python-embedded modeling language for convex optimization,” _J. Mach. Learn. Res._ , vol. 17, no. 83, pp. 1–5, 2016.
  * [29] D. J. Bernstein and A. K. Lenstra, “A general number field sieve implementation,” in _The development of the number field sieve_ , A. K. Lenstra and H. W. Lenstra, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 1993, pp. 103–126.


# Valence Band Electronic Structure of Pd Based Ternary Chalcogenide
Superconductors

H. Lohani  P. Mishra  R. Goyal  V. P. S. Awana  B. R. Sekhar
<EMAIL_ADDRESS>Institute of Physics, Sachivalaya Marg, Bhubaneswar 751005,
India.  Homi Bhabha National Institute, Training School Complex, Anushakti
Nagar, Mumbai 400085, India  National Physical Laboratory(CSIR), Dr. K. S.
Krishnan Road, New Delhi 110012, India.

# Valence Band Electronic Structure of Pd Based Ternary Chalcogenide
Superconductors

H. Lohani  P. Mishra  R. Goyal  V. P. S. Awana  B. R. Sekhar
<EMAIL_ADDRESS>Institute of Physics, Sachivalaya Marg, Bhubaneswar 751005,
India.  Homi Bhabha National Institute, Training School Complex, Anushakti
Nagar, Mumbai 400085, India  National Physical Laboratory(CSIR), Dr. K. S.
Krishnan Road, New Delhi 110012, India.

###### Abstract

We present a comparative study of the valence band electronic structure of Pd
based ternary chalcogenide superconductors Nb2Pd0.95S5, Ta2Pd0.97S6 and
Ta2Pd0.97Te6 using experimental photoemission spectroscopy and density
functional based theoretical calculations. We observe a qualitatively
similarity between valence band (VB) spectra of Nb2Pd0.95S5 and Ta2Pd0.97S6.
Further, we find a pseudogap feature in Nb2Pd0.95S5 at low temperature, unlike
other two compounds. We have correlated the structural geometry with the
differences in VB spectra of these compounds. The different atomic packing in
these compounds could vary the strength of inter-orbital hybridization among
various atoms which leads to difference in their electronic structure as
clearly observed in our DOS calculations.

###### keywords:

, UV Photoelectron spectroscopy , Ternary chalcogenide superconductors ,
Electronic structure calculation

###### PACS:

74.25.Jb, 74.70.Dd, 71.20.Be

##  1 Introduction

Recently discovered superconductors (SC) like Fe-pnictides[1], Fe-
chalcogenides[2], SrRuO4[3] and organic SC[4, 5], driven by unconventional
pairing have given a new impetus to the research in the field of
superconductivity. Discovery of Pd based ternary chalcogenides, like
Nb2Pd0.95S5[6, 7], Nb2PdSe5[8], Ta2PdS5[9], Ta2Pd0.97S6[10], Ta2Pd0.97Te6[11]
and Ta4Pd3Te16[12] is another advancement in this direction. These layered
compounds provide a fertile ground for the existence of unconventional SC
state owing to their Quasi-2-dimensional (Q2D) character[13, 12].

One of the most interesting compounds in this low dimensional family, is
Nb2Pd0.95S5. It exhibits a SC transition temperature (Tc) around 6 K and a
high value of Sommerfeld constant ($\gamma$ = 32 mJ/mol-K2) which signifies
its strongly coupled SC nature. Resitivity of this compound shows a Fermi-
liquid type behavior at low temperatures. Further, the heat capacity data is
best fitted by using a two band model which is a signature of multiband
superconductivity[6]. Many unusual characters of these SCs have been analyzed
from the point of view of spin-orbit scattering[9, 8, 16], multiband
effects[17, 18] and unconventional pairing due to the presence of non
centrosymmetric (NCS) structure[9, 19, 20] etc. On the other hand, ternary
compounds such as Ta2Pd0.97S6 and Ta2Pd0.97Te6 belonging to the same
monoclinic structure (C2/m) like Nb2Pd0.95S5, show different behavior. The
telluride compound Ta2Pd0.97Te6, which crystallizes in Ta4Pd3Te16 phase, has a
much lower residual resistivity than normal state resistivity in comparison to
the Nb2Pd0.95S5. These compounds share a common structure composed of chains
of Pd and Nb/Ta centred polyhedra with S/Te atoms. Changes in the structural
geometry is a key factor determining the different physical behavior of these
ternary SC.

Theoretical studies of the electronic structure of some of these materials,
like Nb2PdSe5[8], Nb2PdS5[7], Ta2PdS5[16], Ta4Pd3Te16[21] have been reported
recently and established the multiband nature of these compounds. The Fermi
surface (FS) of Nb2PdS/Se5, Ta2PdS5 compounds are composed of sheets of
electron-hole character of different dimensions[16, 7, 21], which could favor
the existence of various density wave instabilities, like charge density wave
(CDW) and spin density wave (SDW) due to the nesting between the 1-D like
sheets of FS in these systems[21]. So far, there have been no reports on the
experimental studies of the electronic structure of these compounds. In this
paper, we discuss our photoemission results on Nb2Pd0.95S5, Ta2Pd0.97S6 and
Ta2Pd0.97Te6. We find that valence band(VB) spectra of Nb2Pd0.95S5 and
Ta2Pd0.97S6 are qualitatively similar whereas it is quite different in case of
Ta2Pd0.97Te6. Further, we observe a pseudogap feature in Nb2Pd0.95S5 at low
temperature, unlike other two compounds. In these compounds the different
atomic packing could change the strength of inter-orbital hybridization among
various atoms which leads to difference in their electronic structure as
clearly seen in our DOS calculations. Our study highlights the role of
structural geometry to the different VB spectra of these compounds.

##  2 Details of calculation

Polycrystalline samples of Nb2Pd0.95S5, Ta2Pd0.97S6 and Ta2Pd0.97Te6 were
synthesized via solid state reaction route. Stoichiometry was confirmed by XRD
measurements. Structural and other physical properties were studied and
reported earlier[6, 10, 11]. Photoemission spectra were collected in angle
integrated mode using a hemispherical SCENTA-R3000 analyzer and a
monochromatized He source (SCENTA-VUV5040). The photon flux was of the order
of 1016 photons/s/steradian with a beam spot of 2 mm in diameter. Fermi energy
for all measurements were calibrated by using a freshly evaporated Ag film on
to the sample holder. The total energy resolution, estimated from the width of
the Fermi edge, was about 27 meV for the He I excitation. The measurements
were performed at a base pressure better than $\sim$ 3.0 $\times$ 10-10 mbar.
Samples were scrapped in a preparation chamber with a diamond file at base
pressure 5.0 $\times$ 10-10 mbar and the spectra were taken within an hour, so
as to avoid any surface degradation. All the measurements were repeated 4-5
times and observed almost identical spectra at each measurement. For the
temperature dependent measurements, the samples were cooled by pumping liquid
nitrogen through the sample manipulator fitted with a cryostat. Sample
temperatures were measured using a silicon diode sensor touching the bottom of
the stainless steel sample plate. The low temperature photoemission
measurements at 77 K were performed immediately after cleaning the sample
surfaces followed by the room temperature measurements.

First-principles calculation were performed by using plain wave basis set
inherent in Quantum Espresso (QE)[22]. Many electron exchange-correlation
energy was approximated by Perdew-Burke-Ernzerhof (PBE) functional[23, 24,
25]. It was implemented in a scalar relativistic, ultrasoft
pseudopotential[26]. Fine mesh of k-points with Gaussian smearing of the order
0.0001 Ry was used for sampling the Brillouin zone integration and kinetic
energy and charge density cut-off were set to 180 Ry and 900 Ry respectively.
Experimental lattice parameters and atomic coordinates of Nb2Pd0.95S5[6],
Ta2PdS6[27] and Ta4Pd3S16[28], after relaxed under damped (Beeman) dynamics
with respect to both ionic coordinates and the lattice vector, were employed
in the calculations. All parameters were optimized under several convergence
tests.

##  3 Results and discussion

Fig.1(a), (b) and (c) display the crystal structures of Nb2PdS5, Ta2PdS6 and
Ta4Pd3Te16 respectively. These layered compounds have a monoclinic structure,
with space group symmetry C2/m. The further details of crystal structures
regarding lattice parameters, Wyckoff positions, site symmetry and fractional
occupancies can be seen in Ref.[6], [27] and [28] for Nb2PdS5, Ta2PdS6 and
Ta4Pd3S16 respectively. These compounds exhibit complex structure consisting
of chains of Nb/Ta and Pd centered polyhedra of S/Te atoms. In Ta2PdS6, Pd
centered octahedra bridges two Ta centered trigonal prismatic polyhedra[27].
Similarly, Pd atoms have an edge sharing regular (Pd1) and edge sharing
distorted (Pd2) octahedral coordination environment in Ta4Pd3Te16[28]. On the
other hand, in Nb2PdS5, Pd atom has an octahedral coordination at Pd1 site and
a distorted rhombohedral prismatic coordination at Pd2 site, which lies
between the two adjacent layers[29]. The coordination environment of Pd
(Nb/Ta) atoms and their bond lengths between the various near neighbor (nn)
S/Te vary in the three crystal structures which leads to different strengths
of inter-orbital hybridization.

Figure 1: ’Color online’ (a), (b) and (c) are crystal structure of Nb2PdS5,
Ta2PdS6 and Ta4Pd3Te16 respectively. Different nearest neighbours of Pd atom
at inequivalent sites and bond lengths are marked in each structure.

Fig.2(a) and (b) show the valence band (VB) spectra of Nb2Pd0.95S5,
Ta2Pd0.97S6 and Ta2Pd0.97Te6 obtained by using HeI and HeII excitation
energies at 300 K respectively. The spectra of Nb2Pd0.95S5 show five features
which include a hump at binding energy (BE) Eb = -0.33 eV (A) and features at
Eb = -2.05 (B), -2.73 (C), -4.27 (D) and -5.29 (E) eV. In Ta2Pd0.97S6, these
features appear at higher BE. The hump structure A occurs at Eb = -0.40 eV
while feature B, C, D and E are observed at Eb = -2.39, -2.84, -4.56 and -5.40
BE respectively. The VB spectra of Ta2Pd0.97Te6 is markedly different from
those of the other two compounds. The hump structure A and feature B are
completely absent and a clear metallic edge is present at the Fermi Level
(Ef). Furthermore, feature C, occurring at Eb = -2.49 eV BE, appears as an
intense peak structure while features D and E are faint. By tuning the photon
energy from HeI (21.2 eV) to HeII (40.8 eV), a significant increase is
observed in the spectral weight of the feature C in all the compounds as can
be seen in Fig.2 (b). While, the hump structure A becomes broader in
Nb2Pd0.95S5 and Ta2Pd0.97S6, the metallic edge at EF in Ta2Pd0.97Te6 appears
smeared out slightly. These changes could be related to the different matrix
elements involved in the photoemission process which depend on the ionization
cross sections of atoms ($\sigma$). The $\sigma$[30] multiplied by the number
of valence electrons, for Pd4d to S3p($\sigma_{Pd_{4d}}/\sigma_{S_{3p}}$) is
15 and 134 for HeI and HeII respectively. The
$\sigma_{Nb_{4d}}/\sigma_{S_{3p}}$, $\sigma_{Ta_{5d}}/\sigma_{S_{3p}}$ and
$\sigma_{Ta_{5d}}/\sigma_{Te_{5}p}$ increase by a factor of $\sim$ 2 for HeII
with respect to HeI photon energy. A comparison of the spectra taken with HeI
and HeII indicate that the enhanced feature C and hump A are mainly composed
of Pd4d states. The relatively large intensification of feature C in
Ta2Pd0.97Te6 compared to the other two compounds could be due to the
additional increment in $\sigma_{Pd_{4d}}/\sigma_{Te_{5p}}$ value by 20%
compared to $\sigma_{Pd_{4d}}/\sigma_{S_{3p}}$ for HeII. Similarly,
composition of the metallic edge in Ta2Pd0.97Te6 can be identified as mostly
Te5p states. These changes are clearer in Fig.2(c) and (d) which displays an
enlarged view of the near Ef region for HeI and HeII respectively. The DOS at
Ef decreases in the order Ta2Pd0.97Te6, Nb2Pd0.95S5 and Ta2Pd0.97S6 which
agrees well with the trend in electrical resistivity shown by these
compounds[6, 10, 11]. Interestingly, observation of the sharp metallic edge in
Ta2Pd0.97Te6, unlike Nb2Pd0.95S5, could also be the reason for the drastic
reduction (65%) in the ratio of normal state resistivity to the residual
resistivity($\rho_{300K}/\rho_{(0)}$) of Ta2Pd0.97Te6 in comparison to
Nb2Pd0.95S5.

Figure 2: ’Color online’ (a), (b) and (c) valence band spectra of
Nb2Pd0.95S5(Black), Ta2Pd0.97S6(Red) and Ta2Pd0.97Te6(Blue) obtained by using
HeI and HeII excitation energy at 300 K respectively. (c) and (d) are an
enlarge view of near Ef region of the (a) and the (b) respectively. Figure 3:
’Color online’ (a), (b) and (c) show total calculated DOS with different
atomic contributions of Nb2PdS5, Ta2PdS6 and Ta4Pd3Te16 respectively.

In order to understand the origin of the VB features, we have performed
electronic band structure calculations for similar but stoichiometric
compositions; Nb2PdS5 and Ta2PdS6. We have used Ta4Pd3Te16 composition to
identify the VB features of Ta2Pd0.97Te6 because it crystallizes in Ta4Pd3Te16
phase as observed in the XRD measurements[11]. In Fig.3(a), (b) and (c)
calculated total DOS with various atomic contributions in cases of Nb2PdS5,
Ta2PdS6 and Ta4Pd3Te16 are shown respectively. In Nb2PdS5(Ta2PdS6) the
conduction band (CB) states are dominated by S3p-Nb4d(Ta5d) hybridized states
while the VB (Eb = -7.0 to -1.0 eV) comprises mainly of S3p-Pd4d hybridized
states in both the Nb2PdS5 and Ta2PdS6 compounds. In the near Ef region
sufficient states of S3p-Nb4d hybridization are observed in Nb2PdS5 contrary
to the situation in Ta2PdS6 where a dip can be seen in the DOS at the Ef. The
gap like feature in Ta2PdS6 suggests that hybridization of Pd4d and Ta5d
orbitals with their near neighbor (nn) S3p orbitals is stronger resulting in a
clear separation between the bonding and antibonding states. Possibly this
could be the reason for the occurrence of the features at higher BE in the
experimental data of Ta2Pd0.97S6 in comparison to the Nb2Pd0.95S5 (Fig.2). On
the other hand, in Ta4Pd3Te16 the presence of Te atoms modifies the electronic
structure to a great extent. These atoms are more distant from the Pd and Ta
atoms which eventually reduces the strength of the inter-orbital hybridization
of Pd4d and Ta5d with their nn Te5p orbitals. Therefore, Ta5d and Pd4d states
are more localized than the same states in Nb2PdS5 and Ta2PdS6. Moreover, the
large size of Te atom distorts the chain of Pd and Ta centered polyhedra and
results in several Te-Te bonds[21]. The hybridized states of these different
Te-Te-5p orbitals diffuse within the VB and CB and the states crossing the Ef
acquire mostly the Te5p character. However, some small contribution from the
Ta5d states are also observed in the vicinity of Ef due to the weak Ta-Pd bond
similar to the Nb-Pd bond at Pd2 site in Nb2PdS5(Fig.1). The calculated DOS
shows less intensity in the region between Ef and Eb = -2.0 eV in Ta4Pd3Te16,
unlike the other two compounds where many states (peak A and B) are observed
in this region. This result qualitatively agrees with the absence of the hump
A and feature B in the VB spectra of Ta2Pd0.97Te6(Fig.2). Furthermore, various
peaks are found in the calculated DOS which are not very clearly resolved in
the VB spectra of all the compounds. However, the calculated peaks, which are
closer to the experimentally observed VB features are marked
accordingly(Fig.2). These results indicate that the VB features (B, C, and D)
are mainly composed of S3p-Pd4d hybridized states in Nb2Pd0.95S5, and
Ta2Pd0.97S6 while in the case of Ta2Pd0.97Te6 Pd-4d states are dominant in the
higher BE region (feature C, and D) and the near Ef states are dominated by
Te5p (Fig.2). The identification of Pd4d character of the experimental feature
C on the basis of the intensity enhancement of this feature in HeII
spectra(Fig.2) is consistent with the calculated DOS. The variation in the
calculated DOS of these compounds supported by our experimental findings
highlights the role of the different structural geometry which leads to
different strengths in the inter-orbital hybridization of Pd and Nb/Ta with
their nn S/Te atoms and thereby the electronic structure.

Figure 4: ’Color online’ DOS originated from different orbitals of Pd4d at
site Pd1 and Pd2 are shown in (a) and (b) respectively in Nb2PdS5. (c) Pd4d
DOS in Ta2PdS6. (d) and (e) show same DOS at Pd1 and Pd2 site respectively in
Ta4Pd3Te16. Inset of each plot shows coordination environment of each Pd atom
in respective compound where Cartesian axis are set in same orientation as
shown in the crystal structure images(Fig.1). Red, blue, green, magenta and
yellow colour balls represent Pd, Nb, S, Ta and Te atoms respectively.

As discussed above, the VB of these ternary SCs are intimately linked to their
complicated structural geometry. In order to investigate this issue in more
detail, Pd4d m-projected DOS at differently coordinated sites are plotted in
Fig.4. Fig.4(a) and (b) show the DOS of Pd4d at Pd1 and Pd2 site in Nb2PdS5
respectively. Fig.4(c) shows DOS of Pd4d in Ta2PdS6. Fig.4(d) and (e) show DOS
of Pd4d at Pd1 and Pd2 site in Ta4Pd3Te16 respectively. Effects of the strong
inter-orbital hybridization with nn S3p orbitals are reflected as a large
bandwidth of the Pd4d states. In Nb2PdS5, at the Pd1 site,
4d${}_{x^{2}-y^{2}}$ and 4dxy orbitals lie in the plane of square planarly
coordinated S atoms. Thus, these orbitals have the largest inter-orbital
hybridization which leads to a clear separation between the bonding (-5.12 eV)
and antibonding (2.00 eV) states originating from these orbitals. Similarly,
the states derived from 4d${}_{3z^{2}-r^{2}}$ and 4dzx orbitals which are
directed towards nn Pd and Nb atoms, split into the bonding (-3.42 eV) and
antibonding (-0.54 eV) states. However, in this case separation between the
bonding and antibonding states is lesser due to the larger Pd-Pd (3.277Å) and
Pd-Nb(3.07Å) inter-atomic distances in comparison to the smaller Pd-S(2.324Å).
Besides this, 4dzy states show a weakly hybridized nature. In contrast, at the
Pd2 site, square planar coordination of the nn S atoms aligns in the YZ plane.
Therefore, distinct bonding (-4.86 eV) and antibonding (0.64 eV) peaks are
observed in 4dzy states. Similarly, 4d${}_{3z^{2}-r^{2}}$, 4dxy and
4d${}_{x^{2}-y^{2}}$ orbitals are weakly hybridized while the states
constituted by 4dzx orbital show an atomic like character, localized at Eb =
-2.09 eV. The antibonding states of Pd2 (4dzy) is closer to Ef compared to
those of the Pd1 (4d${}_{x^{2}-y^{2}}$ and 4dxy) states and contribute mainly
to the DOS at Ef. These differences could be linked to the relatively larger
distance of nn S atoms at the Pd2 site (2.436Å) than the Pd1 site (2.324Å)
which reduces the strength of inter-orbital hybridization. In Ta2PdS6, square
planar coordination of Pd aligns in a plane identical to the Pd1 in Nb2PdS5
with a different orientation. Hence, the nature of DOS originating from
different orbitals of Pd4d have similar character, like Pd1-4d DOS in Nb2PdS5.
On the other hand, in Ta4Pd3Te16, for both Pd atoms (Pd1 and Pd2), the 4dzy
and 4dzx states are almost degenerate and the energy difference among
different 4d states is negligible, unlike the Nb2PdS5. These calculations show
that the antibonding states originated from Pd2 (4dzy) and Pd1
(4d${}_{x^{2}-y^{2}}$ and 4dxy) orbitals significantly contribute to the DOS
at Ef in Nb2PdS5, unlike the scenario in Ta2PdS6 and Ta4Pd3Te16 where the Pd4d
states are negligible at Ef. However, large number of Te-Te-5p hybridized
states cross the Ef in Ta4Pd3Te16(Fig.3). Hence, the considerable states
derived mainly from different Pd4d/Nb3d and Te5p orbitals which are involved
in crossing the Ef, is a signature for multiband effects in Nb2PdS5 and
Ta4Pd3Te16 respectively. This nature of multiband effects of different orbital
character is consistent with previous reports[7, 16, 21]. Experimental
realization of the multiband effects have also been claimed from the heat
capacity behavior around Tc in Nb2Pd0.95S5[6, 7]. This behaviour of orbital
specific changes in the DOS of the Pd4d with different coordination
environment, is reminiscent of the electronic behavior of Fe-based
superconductors like FeSe and FeTe[32]. In addition, the high contribution of
Pd1 (4d${}_{x^{2}-y^{2}}$ and 4dxy) and Pd2 (4dzy) DOS at Eb = -5.12 eV and
-2.09 eV in Nb2PdS5 are nearly close to the energy position of experimental VB
features E and C in Nb2Pd0.95S5(Fig.2) respectively. This could be a signature
for the presence of two differently coordinated Pd atoms in Nb2Pd0.95S5.

Fig.5(a), (b) and (c) represent the near Ef VB spectra at 300 K (Black) and 77
K (Red) of Nb2Pd0.95S5, Ta2Pd0.97S6 and Ta2Pd0.97Te6 respectively taken using
the HeI source. Fig5(d), (e) and (f) depict the same spectra at 300 K and 77 K
for the HeII excitation energy. Here, we have adopted the scheme of
symmetrization[33] to the spectra with respect to the Ef in order to remove
contribution arising from the Fermi-Dirac distribution function. In order to
highlight the temperature dependent changes, differences between the
normalized spectra collected at 300 K and 77 K are also plotted in each graph.
In case of Nb2Pd0.95S5, states in the vicinity of Ef are suppressed at 77 K in
comparison to those at 300 K. This indicates the opening of a small($\Delta$ =
95 meV ) pseudogap which is more clear in the spectra taken with HeII. In this
sample a crossover has been observed from electron to hole dominated transport
carriers below 100 K in the Hall measurements[6, 34]. This observation along
with the presence of a pseudogap is again consistent with the pseudogap driven
sign reversal in Hall coefficient predicted by Evtushinskyet al.[35]. The
coupling strength(2$\Delta$/kBT) estimated at this crossover temperature (100
K) from the gap value ($\Delta$) is anomalously large ($\sim$ 20) which
indicates little possibility for any density wave instabilities, like charge
density wave (CDW) and spin density wave (SDW) in the system to form the
pseudogap. In addition, importance of electronic correlations have also not
been found in earlier studies on this compound[6, 8, 7]. On the other hand,
the near Ef states remain unchanged with the lowering of temperature to 77 K
in Ta2Pd0.97S6 and Ta2Pd0.97Te6. Therefore, the origin of the observed
pseudogap in Nb2Pd0.95S5 could be associated to its complex structural
geometry.

Figure 5:  ’Color online’ Near Ef VB spectra, at 300 K(Black) and 77 K(Red),
of Nb2Pd0.95S5, Ta2Pd0.97S6 and Ta2Pd0.97Te6 collected with HeI energy are
shown in (a), (b) and (c) respectively. Same spectra collected at HeII energy
are shown in (d), (e) and (f) respectively. Blue dots represent difference
between the normalized spectra collected at 300 K and 77 K. Here, we have
adopted the scheme of symmetrization to the spectra with respect to EF in
order to remove contribution arising from Fermi-Dirac distribution function.

##  4 Conclusion

We have investigated the valence band electronic structure of Pd based ternary
chalcogenide superconductors Nb2Pd0.95S5, Ta2Pd0.97S6 and Ta2Pd0.97Te6 using
experimental valence band photoemission and theoretical band structure
calculations. We observe that the VB spectra of Ta2Pd0.97S6 is qualitatively
similar to Nb2Pd0.95S5 except slight differences in the energy position of
various features. On the other hand, the VB spectra of Ta2Pd0.97Te6 differs
remarkably from the other two compounds, particularly in the near Ef region
where a clear metallic edge is observed, unlike the other compounds. Our study
also shows the existence of a temperature dependent pseudogap in Nb2Pd0.95S5.
whereas, the near Ef states remain unchanged with the lowering of temperature
to 77 K in Ta2Pd0.97S6 and Ta2Pd0.97Te6. These changes seen the VB spectra
could be due to their different structural geometry which provides different
strengths to the inter-orbital hybridization of Pd and Nb/Ta with their nn
S/Te atoms. This modifies the electronic structure significantly as clear from
the plots of the calculated DOS of these compounds. The calculated DOS shows
that the VB features of Nb2PdS5 and Ta2PdS6 are mainly comprised of the
S3p-Pd4d hybridized states while the metallic edge in Ta2Pd0.97Te6 is
predominant with Te-5p character. Our comprehensive study provides a deeper
insight into the VB states of these Pd based ternary compounds in correlation
with their different structural geometry.

## References

  * [1] G. R. Stewart Rev. Mod. Phys. 83 (2011) 1589.
  * [2] Y. Mizuguchi and Y. Takano J. Phys. Soc. Jpn. 79 (2010) 102001.
  * [3] A. P. Mackenzie, Y. Maeno Rev. Mod. Phys. 75 (2000) 657.
  * [4] M. R. Norman Science 332 (2011) 196.
  * [5] K. Bechgaard, K. Carneiro, M. Olsen, F. B. Rasmussen, C. S. Jacobsen Phys. Rev. Lett. 46 (1981) 852.
  * [6] R. Jha, B. Tiwari, P. Rani, H. Kishan and V. P. S. Awana J. Appl. Phys. 115 (2014) 213903.
  * [7] Q. Zhang, G. Li, D. Rhodes, A. Kiswandhi, T. Besara, B. Zeng, J. Sun, Siegrist, M. D. Johannes and L. Balicas Scientific Reports 3 (2013) 1446.
  * [8] Seunghyun Khim, Bumsung Lee, Ki-Young Choi1, Byung-Gu Jeon, Dong Hyun Jang, Deepak Patil, Seema Patil, Rokyeon Kim, Eun Sang Choi, Seongsu Lee, Jaejun Yu and Kee Hoon Kim New J. Phys. 15 (2013) 123031.
  * [9] Y. F. Lu, T. Takayama, A. F. Bangura, Y. katsura, D. Hashizume and H. Takag J. Phys. Soc. Japan 83 (2014) 023702.
  * [10] B. Tiwari, B. B. Prasad, R. Jha, D. K. Singh and V. P.S. Awana J. of Super. Nov. Magn. 27 (2014) 2181.
  * [11] R. Goyal, B. Tiwari, R. Jha, and V. P.S. Awana J. of Super. Novel. Magn. 28 (2015) 1195.
  * [12] Wen-Hu Jiao, Zhang-T Tang, Yun-Lei Sun, Y. Liu, Q. Tao, Chun-Mu Feng, Yue-Wu Zeng, Zhu-An Xu and Guang-Han Cao J. of Am. Chem. Soc. 136 (2014) 1284.
  * [13] J. Pan, W. H. Jiao, X. C. Hong, Z. Zhnag, L. P. He, P. L. Cai, G. H. Cao and S. Y. Li Phys. Rev. B 13 (1976) 3284.
  * [14] B. S. Chandrasekhar Appl. Phys. Lett. 1 (1962) 7.
  * [15] A.M. Clogston Phys. Rev. Lett. 9 (1962) 266.
  * [16] David J. Singh Phys. Rev. B 88 (2013) 174508.
  * [17] Masahiro Takahashi, Takeshi Mizushima and Kazushige Machida Phys. Rev. B 89 (2014) 064505.
  * [18] D.A. Zocco, K. Grube, F. Eilers, T. Wolf and H.v. Lohneysen Phys. Rev. Lett. 111 (2013) 057007.
  * [19] Suk Joo Youn, Mark H. Fischer, S. H. Rhim, Manfred Sigrist, and Daniel F. Agterberg Phys. Rev. B 85 (2012) 220505(R)
  * [20] Jun Goryo, Mark H. Fischer and Manfred Sigrist Phys. Rev. B 86 (2012) 100507(R)
  * [21] David J. Singh Phys. Rev. B 90 (2014) 144501.
  * [22] Giannozzi P. et al. http:/www.quantum-espresso.org.
  * [23] Perdew J P,Burke K and Ernzerhof M Phys. Rev. Lett. 77 (1996) 3865.
  * [24] Perdew J P and Wang y Phys.Rev.B 45 (1992) 13244.
  * [25] Perdew J P, Chevary J A, Vosko S H, Jackson K A, Pederson M R, Singh D J and Fiolhais C Phys.Rev. B 46 (1992) 6671.
  * [26] Vanderbilt D Soft self-consistent pseudopotential in a generalized eigenvalue formalism Phys.Rev.B 41 (1990) 7892.
  * [27] D. A. Keszler, P. J. Squattrito, N. E. Brese, J. A. Ibers, S. Maoyu and L. Jiaxi Inorg. Chem. 24 (1985) 3063.
  * [28] A. Mar and J. A. Ibers J. Chem. Soc. Dalton Trans. 1 (1991) 639.
  * [29] D. A. Keszler, J. A. Ibers, S. Maoyu and L. Jiaxi J. of Solid State Chem. 57 (1985) 68.
  * [30] J.J. Yeh and I.Lindau Atomic Data and Nuclear Data Tables 32 (1985) 1-155.
  * [31] P. Larson, V. A. Greanya, W. C. Tonjes, R. Liu, S. D. Mahanti and C. G. Olson Phys. Rev. B 65 (2002) 085108.
  * [32] H. Lohani, P. Mishra and B. R. Sekhar Physica C 512 (2015) 54.
  * [33] S. V. Borisenko, A. A. Kordyuk, A. N. Yaresko, V. B. Zabolotnyy, D. S. Inososv, R. Schuster, B. Buchner, R. Weber, R. Follath, L. Patthey and H. Berger Phys. Rev. Lett. 100 (2008) 196402.
  * [34] X. Ding, Y. Pan, H. Yang and Hai-Hu Wen Phys. Rev. B 89 (2014) 224515.
  * [35] D. V. Evtushinsky, A. A. Kordyuk, V. B. Zabolotnyy, D. S. Inosov, B. Buchner, H. Berger, L. Patthey, R. Follath and V. Borisenko Phys. Rev. Lett. 100 (2008) 236402.
  * [36] Alexander Gabovich, A I Voitenko and Toshikazu Ekino J. Phys. Condens Matter 16 (2004) 3681.