On the Role of Cognizance in Responsibility

Abstract

A novel definition of responsibility analysis based on abstract interpretation has been recently proposed [5, 6]. One of the main distinguishing features of this approach with respect to the existing notions of causality in the literature, is the incorporation of the observer’s viewpoint. Responsibility considers actions as responsible based on what the observer can understand of the behaviors of interest when analyzing the execution traces and concerning the specific capabilities of the observer. While the other existing approaches to causality implicitly refer to an omniscient observer who knows everything that occurred.

In this paper, we are interested in further investigating the observer’s role in identifying the responsible action of a given behavior of interest.

A Appendix

Lemma 1. Assumption A2 implies that $\sigma \in {\llbracket P \rrbracket }^{ Pref }\;\Rightarrow \;\mathbb {C}(\sigma ) \subseteq {\llbracket P \rrbracket }^{ Pref }$.

Proof

A2 states that $\forall \sigma \in \varSigma ^{*\infty }. \sigma \not \in {\llbracket P \rrbracket }^{ Pref }\;\Rightarrow \;\mathbb {C}(\sigma ) \cap {\llbracket P \rrbracket }^{ Pref }= \emptyset$. Note that also the converse holds. Assume that $\mathbb {C}(\sigma ) \cap {\llbracket P \rrbracket }^{ Pref }= \emptyset$, this means that $\forall \sigma ' \in \mathbb {C}(\sigma )$ we have that $\sigma '\not \in {\llbracket P \rrbracket }^{ Pref }$ and this implies that $\sigma \not \in {\llbracket P \rrbracket }^{ Pref }$ which contradicts the hypothesis. Thus, we have that $\sigma \not \in {\llbracket P \rrbracket }^{ Pref }\;\Leftrightarrow \;\mathbb {C}(\sigma ) \cap {\llbracket P \rrbracket }^{ Pref }= \emptyset$. Given $\sigma \in {\llbracket P \rrbracket }^{ Pref }$, assume that $\mathbb {C}(\sigma ) \not \subseteq {\llbracket P \rrbracket }^{ Pref }$. This means that $\exists \sigma ' \in \mathbb {C}(\sigma ): \sigma ' \not \in {\llbracket P \rrbracket }^{ Pref }$. From what we have just proved this means that $\mathbb {C}(\sigma ') \cap {\llbracket P \rrbracket }^{ Pref }= \emptyset$ and since $\sigma \in \mathbb {C}(\sigma ')$ we get to the contradiction that $\sigma \not \in {\llbracket P \rrbracket }^{ Pref }$.

Theorem 1. For the cognizance $\mathbb {C}$ of an attacker, if $\tau _R$ is responsible for a behavior $\mathcal {B}$ in a valid trace $\sigma _H\tau _R\sigma _F$, then:

• 1. $\sigma _H\tau _R$ guarantees the occurrence of the behavior $\mathcal {B}$,

• 2. there exists a valid trace $\sigma ' s \in {\llbracket P \rrbracket }^{ Pref }$ such that $\sigma ' \in \mathbb {C}(\sigma _H)$ and $\sigma 's$ does not guarantee the behavior $\mathcal {B}$.

Proof

• 1. By definition, we have that $\emptyset \subset \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\sigma _H\tau _R) \subseteq \mathcal {B}$. This is true iff ${\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') ~|~ \sigma '\in \mathbb {C}(\sigma _H\tau _R)\} \subseteq \mathcal {B}\}$, namely if $\forall \sigma ' \in \mathbb {C}(\sigma _H\tau _R)$ it holds that $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ')\subseteq \mathcal {B}$. In particular, it holds for $\sigma _H\tau _R$, and this means that $\sigma _H\tau _R \in \alpha _ Pred ({\llbracket P \rrbracket }^{ Max })\mathcal {B}$ and therefore $\sigma _H\tau _R$ guarantees the behavior $\mathcal {B}$.

• 2. By definition, we have that $\mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\sigma _H) \not \subseteq \mathcal {B}$. This means that ${\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') ~|~ \sigma '\in \mathbb {C}(\sigma _H) \not \subseteq \mathcal {B}\}$. This means that $\exists \sigma ' \in \mathbb {C}(\sigma _H)$ such that $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ')\not \subseteq \mathcal {B}$. This $\sigma '$ is such that $\sigma '\in {\llbracket P \rrbracket }^{ Pref }$, since if $\sigma '\not \in {\llbracket P \rrbracket }^{ Pref }$ then $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') = \bot ^{ Max } \subseteq \mathcal {B}$. Thus, $\sigma '$ is valid: $\sigma '\in {\llbracket P \rrbracket }^{ Pref }$. Moreover, (from what observed on the inquiry function and proved in Corollary 4 of [6]) it has to hold that $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') = {\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma 's) ~|~ \sigma 's\in {\llbracket P \rrbracket }^{ Pref }\}\not \subseteq \mathcal {B}$. Namely, $\exists \sigma 's\in {\llbracket P \rrbracket }^{ Pref }$ such that $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma 's) \not \subseteq \mathcal {B}$. Which means that this valid trace $\sigma 's \not \in \alpha _ Pred ({\llbracket P \rrbracket }^{ Max })\mathcal {B}$ and therefore does not guarantee the behavior $\mathcal {B}$.

Lemma 2. If $\mathbb {C}\, \sqsubseteq \, \equiv _\mathbb {I}\,$ then $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max }, \sigma ) = \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\sigma )$

Proof

By def, $\mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\sigma ) = {\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max }, \sigma ') ~|~ \sigma ' \in \mathbb {C}(\sigma )\}$. Thus, it is enough to show that if $\mathbb {C}\, \sqsubseteq \, \equiv _\mathbb {I}\,$ then $\forall \sigma ' \in \mathbb {C}(\sigma )$ it holds that $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ) = \mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ')$. If $\mathbb {C}\, \sqsubseteq \, \equiv _\mathbb {I}\,$ then $\forall \sigma \in {\llbracket P \rrbracket }^{ Pref }: [\sigma ]_\mathbb {C}\subseteq [\sigma ]_\mathbb {I}$. Therefore, if $\mathbb {C}(\sigma ) = \mathbb {C}(\sigma ')$ then $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ) = \mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ')$ and this implies that $\forall \sigma ' \in \mathbb {C}(\sigma )$, then $\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ) = \mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ')$, therefore ${\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') ~|~ \sigma ' \in \mathbb {C}(\sigma )\} = \mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma )$.

Corollary 1. If $\mathbb {C}\, \sqsubseteq \, \equiv _\mathbb {I}\,$ then

$$\alpha _R({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\mathcal {B},\mathcal {T}) = \alpha _R({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_o,\mathcal {B},\mathcal {T})$$

Proof

$$\begin{aligned} \alpha _R({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\mathcal {B},\mathcal {T}) & = \left\{ \langle \sigma _H,\tau _R,\sigma _F \rangle \left| \begin{array}{l}\sigma _H\tau _R\sigma _F \in {\llbracket P \rrbracket }^{ Pref }\\ \emptyset \subset \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\sigma _H\tau _R) \subseteq \mathcal {B}\\ \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C},\sigma _H) \not \subseteq \mathcal {B}\end{array} \right. \right\} \\ & \text{[From } \text{ Lemma }~2]\\ & = \left\{ \langle \sigma _H,\tau _R,\sigma _F \rangle \left| \begin{array}{l}\sigma _H\tau _R\sigma _F \in {\llbracket P \rrbracket }^{ Pref }\\ \emptyset \subset \mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma _H\tau _R) \subseteq \mathcal {B}\\ \mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma _H) \not \subseteq \mathcal {B}\end{array} \right. \right\} \\ & \text{[From } \text{ Definition } \text{ of } \mathbb {C}_o]\\ & = \left\{ \langle \sigma _H,\tau _R,\sigma _F \rangle \left| \begin{array}{l}\sigma _H\tau _R\sigma _F \in {\llbracket P \rrbracket }^{ Pref }\\ \emptyset \subset \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_o,\sigma _H\tau _R) \subseteq \mathcal {B}\\ \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_o,\sigma _H) \not \subseteq \mathcal {B}\end{array} \right. \right\} \\ & = \alpha _R({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_o,\mathcal {B},\mathcal {T})\\ \end{aligned}$$

Lemma 3. If $\mathbb {C}_1 \, \sqsubseteq \, \mathbb {C}_2 \,$ then $\mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_1,\sigma ) \subseteq \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_2,\sigma )$

Proof

The hypothesis $\mathbb {C}_1 \, \sqsubseteq \, \mathbb {C}_2$ means that $\forall \sigma \in \varSigma ^{*\infty }: \mathbb {C}_1(\sigma ) \subseteq \mathbb {C}_2(\sigma )$. Hence:

$$\begin{aligned} \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_1,\sigma ) & = {\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') ~|~ \sigma ' \in \mathbb {C}_1(\sigma )\}\\ & [\text{ Since } \mathbb {C}_1(\sigma ) \subseteq \mathbb {C}_2(\sigma )]\\ & \subseteq {\mathop {\cup }\limits ^{\diamond }}\{\mathbb {I}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\sigma ') ~|~ \sigma ' \in \mathbb {C}_2(\sigma )\}\\ & = \mathbb {O}({\llbracket P \rrbracket }^{ Max },\mathcal {L}^{ Max },\mathbb {C}_2,\sigma ) \end{aligned}$$