Finite-State Modeling, Analysis and Testing of System Vulnerabilities

Man-machine systems have several desirable properties, as to user friendliness, reliability, safety, security or other global system attributes. The potential for the lack, or breaches, of any such property constitutes a system vulnerability, which can lead to a situation that is undesirable from user’s point of view. This undesired situation could be triggered by special events in the form of intended, or unintended, attacks from the system’s environment. We view the undesirable system features as the sum of the situations, which are, mathematically speaking, complementary to the desirable ones that must be taken into account from the very beginning of the system development to achieve a stable system behavior and a robust operation. This work is about the modeling, analysis and testing of both desirable and undesirable system features which can be viewed as relations between the system and its operation. 1. Critical Features and Vulnerabilities of Embedded Systems In terms of behavioral patterns, the relationships between the system and its environment, i.e., the user, the natural environment, etc., can be described as proactive, reactive or interactive. In the case of proactivity, the system generates the stimuli, which evoke the activity of its environment. In the case of reactivity, the system behavior evolves through its responses to stimuli generated by its environment. Most computerhuman interfaces are nowadays interactive in the sense that the user and the system can be both proand reactive. In this particular kind of system, the user interface (UI) can have another environment, that is, the plant, the device or the equipment, which the UI is intended for and embedded in, controlling technical processes. When categorizing behavioral aspects of the human-computer systems, it is a good principle to start with the ergonomic aspects which concern the extent of comfort, or discomfort, experienced by the system and its environment at each other’s company. Any vulnerability is always accompanied by threats. In the case of safety, the threat originates from within the system due to potential failures and its spill-over effects causing potentially extensive damage to its environment. In the face of such failures, the environment could be a helpless, passive victim. The goal of the system design in this case is to prevent faults that could potentially lead to such failures or, in worst cases, to mitigate the consequences at run-time should such failures ever occur. In the case of security, the system is exposed to external threats originating from the environment, causing losses to the proprietor of the system. In this case, the environment, typically the user, maybe unauthorized, can be malicious or deliberately aggressive. The goal of the system design is then to ensure that it can protect itself against such malicious attacks. In contrast to safety and security, the lack of user friendliness of a UI is a milder form of system vulnerability. A failure to be user-friendly is still a failure to fulfill a system attribute, though it may typically cause an annoyance or an irritant to the user, possibly leading to confusion and complaints. However, disastrous consequences cannot be entirely ruled out under stressed conditions of the user if the UI is intended to mediate between a safety critical application and its operator. Since safety is being considered here as a system vulnerability in its own right, we limit ourselves here to the UIs of modest applications designed to guide and help the user to navigate through, and explore, the system functionality. Having identified several differences and distinctions between certain system vulnerabilities, let us abstract away from these peculiarities and threat them all in a generic manner in the following section. Further sections will illustrate our approach through a case study considering user interactions as a special case. An earlier version of the approach was introduced in [BE01]. The present study generalizes the approach and extends its scope of application. 2. Finite State Modeling of System Vulnerabilities 2.1 Modeling the System and Its Environment The functionality f of an application is described here as a deterministic finite-state automaton (FSA)