Evaluating the Exploitability of Implicit Interactions in Distributed Systems

Abstract

Implicit interactions refer to those interactions among the components of a system that may be unintended and/or unforeseen by the system designers. As such, they represent cybersecurity vulnerabilities that can be exploited to mount cyber-attacks causing serious and destabilizing system effects. In this paper, we study implicit interactions in distributed systems specified using the algebraic modeling framework known as Communicating Concurrent Kleene Algebra (C 2 KA). To identify and defend against a range of possible attack scenarios, we develop a new measure of exploitability for implicit interactions to aid in evaluating the threat posed by the existence of such vulnerabilities in system designs for launching cyber-attacks. The presented approach is based on the modeling and analysis of the influence and response of the system agents and their C 2 KA specifications. We also demonstrate the applicability of the proposed approach using a prototype tool that supports the automated analysis. The rigorous, practical techniques presented here enable cybersecurity vulnerabilities in the designs of distributed systems to be more easily identified, assessed, and then mitigated, offering significant improvements to overall system resilience, dependability, and security.

Principles and Properties for Reducing the Prevalence of Implicit Interactions in System Designs.

“…Implicit interactions indicate the presence of a cybersecurity vulnerability that can be exploited to mount a cyberattack. By compromising the agent at the beginning of an implicit interaction's communication sequence (the source agent), an attacker can influence the behavior of the agent at the end of the communication sequence (the sink agent) to perform actions other than the functions the system was intended to perform, impacting the system's stability, safety, and security [Jas20a]. The impacts of such an attack are of particular concern in ICS, where agent behaviors may correspond to actions performed by physical components, and so implicit interactions pose a threat not just to software system integrity, but also to the integrity of physical components, the process controlled by the ICS, and the safety of individuals around the system.…”

“…Implicit interactions are exploited through a compromised agent, which refers to an agent that can behave in a way that is not consistent with its original or intended specification. This means that it has the ability to issue any stimulus and/or alter its concrete behavior (e.g., by defining a shared environment) [Jas20a]. The compromised agent then, can exploit the implicit interactions in the system for which it serves as the source agent (e.g., by issuing stimuli or defining shared environments out-of-sequence from the intended system interactions) to cause knock-on affects that adversely impact other agents in the system.…”

“…While severity is concerned with the threat posed by an implicit interaction, exploitability has been proposed to measure how many actions are available to a source agent that are able to influence the sink of an implicit interaction interaction [Jas20a].…”

“…Previous work on implicit interactions has posited that implicit interactions come from the hidden complexity and coupling in system designs [JV17a,Jas20a], so we would like to understand how more general design principles related to ideas such as coupling and cohesion [QFTX10] play a role in the prevalence of implicit interactions in a system design. We are particularly interested in the list of fundamental security design principles described in [SB18], many of which originally appeared in work by Saltzer and Schroeder [SS75] and have endured over the years despite numerous changes in the security landscape [Smi12].…”

“…The idea that complexity relates to a higher prevalence of implicit interactions has been expressed in terms system size [JV17b], interconnectedness [JV17a], and hidden coupling [JV17a,Jas20a]. Therefore, we explore multiple different measurements that represent the concept of system complexity to determine how complexity is relevant to the prevalence of implicit interactions.…”