  We propose a new defense mechanism against undetected infiltration into
controllers in cyber-physical systems. To this end, we cautiously design the
outputs of the sensors that monitor the state of the system. Different from the
defense mechanisms that seek to detect infiltration, the proposed approach
seeks to minimize the damage of possible attacks before they have been
detected. Controller of a cyber-physical system could have been infiltrated
into by an undetected attacker at any time of the operation. Disregarding such
a possibility and disclosing system's state without caution benefits the
attacker in his/her malicious objective. Therefore, secure sensor design can
improve the security of cyber-physical systems further when incorporated along
with other defense mechanisms. We, specifically, consider a controlled
Gauss-Markov process, where the controller could have been infiltrated into at
any time within the system's operation. In the sense of game-theoretic
hierarchical equilibrium, we provide a semi-definite programming based
algorithm to compute the optimal linear secure sensor outputs and analyze the
performance for various scenarios numerically.
