Socio-Technical Systems: Luca Viganò

Socio-Technical Systems
Luca Vigan
Dipartimento di Informatica Universit di Verona
Ingegneria del SW, 04.03.11
Luca Vigan (Universit di Verona)
1 / 54
Objectives
To explain what a socio-technical system is and the distinction between this and a computer-based system. To introduce the concept of emergent system properties such as reliability and security. To explain system engineering and system procurement processes. To explain why the organizational context of a system affects its design and use. To discuss legacy systems and why these are critical to many businesses. See: Ian Sommerville. Software Engineering. Pearson Education Ltd.
Luca Vigan (Universit di Verona) Socio-Technical Systems Ingegneria del SW, 04.03.11 2 / 54
Emergent system properties
Outline
Emergent system properties System engineering Organizations, people and computer systems Legacy systems Conclusions
3 / 54
What is a system?
A purposeful collection of interrelated components working together to achieve some common objective. A system may include software, mechanical, electrical and electronic hardware and be operated by people. System components are dependent on other system components. The system is more than simply the sum of its parts. The properties and behavior of system components are inextricably intermingled.
4 / 54
Categories of systems that include software

Technical computer-based systems: Systems that include hardware and software but where the operators and operational processes are not normally considered to be part of the system. The system is not self-aware. Socio-technical systems: Systems that include technical systems but also operational processes and people who use and interact with the technical system. Socio-technical systems are governed by organizational policies and rules.
5 / 54
Socio-technical system characteristics

Emergent properties: Properties of the system as a whole that depend on the system components and their relationships. Non-deterministic: They do not always produce the same output when presented with the same input because the systemss behavior is partially dependent on human operators. Complex relationships with organizational objectives: The extent to which the system supports organizational objectives does not just depend on the system itself.
6 / 54

Properties of the system as a whole rather than properties that can be derived from the properties of components of a system.
Emergent properties are a consequence of the relationships between system components. They can therefore only be assessed and measured once the components have been integrated into a system.
Types of emergent property

Functional properties: These appear when all the parts of a system work together to achieve some objective. For example, a bicycle has the functional property of being a transportation device once it has been assembled from its components. Non-functional emergent properties: Examples are reliability, performance, safety, and security. These relate to the behavior of the system in its operational environment. They are often critical for computer-based systems as failure to achieve some minimal dened level in these properties may make the system unusable.
Examples of emergent properties

Volume: The volume of a system (the total space occupied) varies depending on how the component assemblies are arranged and connected. Reliability: System reliability depends on component reliability but unexpected interactions can cause new types of failure and hence therefore affect the reliability of the system. Security: The security of the system (its ability to resist attack) is a complex property that cannot be easily measured. Attacks may be devised that were not anticipated by the system designers and so may defeat built-in safeguards. Repairability: This property reects how easy it is to x a problem with the system once it has been discovered. It depends on being able to diagnose the problem, access the components that are faulty and modify or replace them. Usability: This property reects how easy it is to use the system. It depends on the technical system components, its operators and its operating environment.
A simple example from the area of security protocols

Cryptographic Procedures: encryption of messages.
{{M }KB }K 1 = M
B
(Pseudo-)Random Number Generators: to generate nonces, e.g. for challenge/response. Protocols: recipe for exchanging messages. Steps like: A sends B her name together with the message M. The pair {A, M } is encrypted with Bs public key. A B : {A, M }KB
The Needham-Schroeder Public Key Protocol (NSPK)

1. A B : {NA, A}KB 2. B A : {NA, NB }KA 3. A B : {NB }KB Goal: mutual authentication. Translation:
This is Alice and I have chosen a nonce NA. Here is your nonce NA. Since I could read it, I must be Bob. I also have a challenge NB for you. You sent me NB . Since only Alice can read this and I sent it back, you must be Alice. NSPK proposed in 1970s and used for decades, until... Protocols are typically small and convincing... and often wrong!
How to at least tie against a Chess Grandmaster
12 / 54
Man-in-the-middle attack on the NSPK
X Y : {N1, X }KY Y X : {N1, N2 }KX X Y : {N2 }KY
NSPK #1
NSPK #2
{NA,A}KC { NA,NB }K A { NB }KC
{NA,A}KB { NA,NB }K A { NB }KB
B believes he is speaking with A!

What went wrong?
Problem in step 2: B A : {NA, NB }KA Agent B should also give his name: {NA, NB , B }KA . The improved version is called NSL protocol. Is the protocol now correct?
14 / 54
The NSL Protocol
X Y : {N1, X }KY Y X : {N1, N2 , Y }KX X Y : {N2 }KY NSL #2
NSL #1
{NA,A}KC { NA,NB,B}K A
{NA,A}KB { NA,NB,B}K A
A aborts the protocol execution! (or ignores the message)
15 / 54
What went wrong?

Problem in step 2: B A : {NA, NB }KA Agent B should also give his name: {NA, NB , B }KA . The improved version is called NSL protocol. Is the protocol now correct?
Yes, it is secure against this attack but what about other kinds of attacks? Use formal methods! Even more problematic: there are provably secure protocols that become insecure when combined with other protocols. Also: automotive/vehicular security protocols.
Automotive/vehicular security protocols
Some attacks:
Bogus information attack.
Disruption of network operation attack. Socio-Technical Systems
Cheating attack. Ingegneria del SW, 04.03.11 17 / 54
System reliability engineering
Because of component interdependencies, faults can be propagated through the system. System failures often occur because of unforeseen interrelationships between components. It is probably impossible to anticipate all possible component relationships. Software reliability measures may give a false picture of the system reliability.
18 / 54
Inuences on reliability
Hardware reliability: What is the probability of a hardware component failing and how long does it take to repair that component? Software reliability: How likely is it that a software component will produce an incorrect output. Software failure is usually distinct from hardware failure in that software does not wear out. Operator reliability: How likely is it that the operator of a system will make an error?
19 / 54
Reliability relationships
Hardware failure can generate spurious signals that are outside the range of inputs expected by the software. Software errors can cause alarms to be activated which cause operator stress and lead to operator errors. The environment in which a system is installed can affect its reliability.
20 / 54
An example: face scanning in airports

Since 9/11, face scanning and matching against databases of known terrorists has been proposed to improve airport security. 1 What are the assets (information or otherwise)?
Air travelers and those on the ground.
2
What are the risks?

Terrorists will board planes and may cause harm.
Effectiveness: very low.

Suppose system positively identies 50% of all known terrorists but has 1% rate of false positives. Suppose there is one terrorist per million. Then for every terrorist recognized, so are 20,000 innocent civilians. At this rate, the security personal will be overwhelmed and stop believing the alarms.
New risks and tradeoffs.

The face database must be secured. If integrity is not protected, faces can be deleted. If condentiality is not protected, terrorists can determine if they are in database and take appropriate actions (e.g., send an accomplice or change appearance). System may instill a false sense of security, lessening overall security. Moreover, it involves high costs and inconvenience.
21 / 54
The shall-not properties
Properties such as performance and reliability can be measured. However, some properties are properties that the system should not exhibit:
Safety: the system should not behave in an unsafe way. Security: the system should not permit unauthorized use.
Measuring or assessing these properties is very hard.
22 / 54
System engineering
Outline
23 / 54
System engineering
System engineering
Specifying, designing, implementing, validating, deploying, and maintaining socio-technical systems. Concerned with
the services provided by the system, constraints on its construction and operation, and the ways in which it is used.
24 / 54
System engineering
The systems engineering process
Usually follows a waterfall model because of the need for parallel development of different parts of the system.
Little scope for iteration between phases because HW changes are expensive. Software may have to compensate for hardware problems.
Requires engineers from different disciplines to work together:

Much scope for misunderstanding here. Different disciplines use a different vocabulary and negotiation is required. Engineers may have personal agendas to full.
System engineering
Inter-disciplinary involvement
Some of the disciplines that may be involved in the system engineering team for an air trafc control (ATC) system that uses radars and other sensors to determine aircraft position:
26 / 54
System engineering
System requirements denition
Three types of requirement dened at this stage: Abstract functional requirements: system functions are dened in an abstract way. System properties: non-functional requirements for the system in general are dened. Undesirable characteristics: unacceptable behavior is specied. Should also dene overall organizational objectives for the system.
System engineering
System requirements: system objectives
Should dene why a system is being procured for a particular environment. Functional objectives: To provide a re and intruder alarm system for the building which will provide internal and external warning of re or unauthorized intrusion. Organizational objectives: To ensure that the normal functioning of work carried out in the building is not seriously disrupted by events such as re and unauthorized intrusion.
System engineering
System requirements problems
Complex systems are usually developed to address wicked problems:

Problems that are not fully understood. Changing as the system is being specied.
Must anticipate hardware/communications developments over the lifetime of the system. Hard to dene non-functional requirements (particularly) without knowing the component structure of the system.
29 / 54
System engineering
The system design process
Partition requirements: organize requirements into related groups. Identify sub-systems: identify a set of sub-systems which collectively can meet the system requirements. Assign requirements to sub-systems: causes particular problems when COTS (Commercial Off-The-Shelf) are integrated. Specify sub-system functionality. Dene sub-system interfaces: critical activity for parallel sub-system development.
System engineering
System design problems
Requirements partitioning to hardware, software, and human components may involve a lot of negotiation. Difcult design problems are often assumed to be readily solved using software. Hardware platforms may be inappropriate for software requirements so software must compensate for this.
31 / 54
System engineering
Requirements and design
Requirements engineering and system design are inextricably linked. Constraints posed by the systems environment and other systems limit design choices so the actual design to be used may be a requirement. Initial design may be necessary to structure the requirements. As you do design, you learn more about the requirements.
System engineering
Spiral model of requirements/design
Reects the reality that requirements affect design decisions and vice versa, and so it makes sense to interleave these processes. Each round of the spiral may add detail to the requirements and the design. Some rounds may focus on requirements, some on design. Sometimes, new knowledge collected during the requirements and design process means that the problem statement itself has to be changed.
System engineering
System modeling
During the system requirements and design activity, systems may be modeled as a set of components and relationships between these components. An architectural model presents an abstract view of the sub-systems making up a system.
May include major information ows between sub-systems. Usually presented as a block diagram. May identify different types of functional component in the model.
Lets look at two examples: a simple burglar alarm system and the ATC.
System engineering
A burglar alarm system

Sub-system description: Movement sensors: detects movement in the rooms monitored by the system. Door sensors: detects door opening in the external doors of the building. Alarm controller: controls the operation of the system. Siren: emits an audible warning when an intruder is suspected. Voice synthesizer: synthesizes a voice message giving the location of the suspected intruder. Telephone caller: makes external calls to notify security, the police, etc.
System engineering
ATC system architecture
Several major sub-systems are themselves large systems. The arrowed lines that link these sub-systems show the information ow.
System engineering
Sub-system development
Typically: parallel projects developing the hardware, software and communications. May involve procurement of some COTS (Commercial Off-The-Shelf) systems. Lack of communication across implementation teams. Bureaucratic and slow mechanism for proposing system changes means that the development schedule may be extended because of the need for rework.
System engineering
System integration
The process of putting hardware, software, and people together to make a system. Should be tackled incrementally so that sub-systems are integrated one at a time. Interface problems between sub-systems are usually found at this stage. May be problems with uncoordinated deliveries of system components.
System engineering
System installation
After completion, the system has to be installed in the customers environment. Environmental assumptions may be incorrect. May be human resistance to the introduction of a new system. System may have to coexist with alternative systems for some time. May be physical installation problems (e.g. cabling problems). Operator training has to be identied.
System engineering
System evolution
Large systems have a long lifetime: they must evolve to meet changing requirements. Evolution is inherently costly:
Changes must be analyzed from technical and business perspective. Sub-systems interact so unanticipated problems can arise. There is rarely a rationale for original design decisions. System structure is corrupted as changes are made to it.
Existing systems which must be maintained are sometimes called legacy systems.
System engineering
System decommissioning
Taking the system out of service after its useful lifetime. May require removal of materials (e.g. dangerous chemicals) which pollute the environment. Should be planned for in the system design by encapsulation. Also the costs should be planned (and sometimes anticipated). May require data to be restructured and converted to be used in some other system.
Organizations, people and computer systems
Outline
42 / 54
Organizations/people/systems
Socio-technical systems are organizational systems intended to help deliver some organizational or business goal. If you do not understand the organizational environment where a system is used, the system is less likely to meet the real needs of the business and its users. Human and organizational factors: Process changes: does the system require changes to the work processes in the environment? Job changes: does the system de-skill the users in an environment or cause them to change the way they work? Organizational changes: does the system change the political power structure in an organization?
43 / 54
Organizational processes
The processes of systems engineering overlap and interact with organizational procurement processes. Operational processes are the processes involved in using the system for its intended purpose. For new systems, these have to be dened as part of the system design. Operational processes should be designed to be exible and should not force operations to be done in a particular way. It is important that human operators can use their initiative if problems arise.
44 / 54
Procurement/development/operational processes
45 / 54
System procurement
Acquiring a system for an organization to meet some need. Some system specication and architectural design is usually necessary before procurement.
You need a specication to let a contract for system development. The specication may allow you to buy a commercial off-the-shelf (COTS) system. Almost always cheaper than developing a system from scratch.
Large complex systems usually consist of a mix of off-the-shelf and specially designed components. The procurement processes for these different types of component are usually different.
46 / 54
The system procurement process
Requirements may have to be modied to match the capabilities of off-the-shelf components. The requirements specication may be part of the contract for the development of the system. There is usually a contract negotiation period to agree changes after the contractor to build a system has been selected.
Contractors and sub-contractors
The procurement of large hardware/software systems is usually based around some principal contractor. Sub-contracts are issued to other suppliers to supply parts of the system. Customer liaises with the principal contractor and does not deal directly with sub-contractors.
Legacy systems
Outline
49 / 54
Legacy systems
Legacy systems
Socio-technical systems that have been developed using old or obsolete technology. Crucial to the operation of a business and it is often too risky to discard these systems.
Bank customer accounting system. Aircraft maintenance system.
Legacy systems constrain new business processes and consume a high proportion of company budgets.
50 / 54
Legacy systems
Legacy system components
Hardware may be obsolete mainframe hardware. Support software may rely on support software from suppliers who are no longer in business. Application software may be written in obsolete programming languages. Application data often incomplete and inconsistent. Business processes may be constrained by software structure and functionality. Business policies and rules may be implicit and embedded in the system software.
Legacy systems
Alternative model of a legacy system
A series of layers, where each layer depends on the layer immediately below it and interfaces with that layer.
If interfaces are maintained, then one should be able to make changes within a layer without affecting either of the adjacent layers. In practice, however, this simple encapsulation rarely works, and changes to one layer of the system may require consequent changes to layers that are both above and below the changed level. For example:
Introduction of new facilities. New software may require new hardware. New hardware may require new interfaces.
Conclusions
Outline
53 / 54
Conclusions
Summary of key points

Socio-technical systems include computer hardware, software, and people, and are designed to meet some business goal. Emergent properties are properties that are characteristic of the system as a whole and not its component parts. The systems engineering process includes specication, design, development, integration, and testing. System integration is particularly critical. Human and organizational factors have a signicant effect on the operation of socio-technical systems. There are complex interactions between the processes of system procurement, development and operation. A legacy system is an old system that continues to provide essential services. Legacy systems include business processes, application software, support software, and system hardware.

Socio-Technical Systems: Luca Viganò

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Socio-Technical Systems: Luca Viganò

Hochgeladen von

Copyright:

Verfügbare Formate

Socio-Technical Systems

Ingegneria del SW, 04.03.11

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Categories of systems that include software

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Socio-technical system characteristics

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Emergent system properties

Emergent system properties

Types of emergent property

Emergent system properties

Examples of emergent properties

Emergent system properties

A simple example from the area of security protocols

Emergent system properties

The Needham-Schroeder Public Key Protocol (NSPK)

Emergent system properties

How to at least tie against a Chess Grandmaster

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Man-in-the-middle attack on the NSPK

X Y : {N1, X }KY Y X : {N1, N2 }KX X Y : {N2 }KY

{NA,A}KC { NA,NB }K A { NB }KC

{NA,A}KB { NA,NB }K A { NB }KB

B believes he is speaking with A!

Emergent system properties

What went wrong?

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

The NSL Protocol

X Y : {N1, X }KY Y X : {N1, N2 , Y }KX X Y : {N2 }KY NSL #2

A aborts the protocol execution! (or ignores the message)

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

What went wrong?

Emergent system properties

Automotive/vehicular security protocols

Bogus information attack.

Disruption of network operation attack. Socio-Technical Systems

Cheating attack. Ingegneria del SW, 04.03.11 17 / 54

Luca Vigan (Universit di Verona)

Emergent system properties

System reliability engineering

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11

Emergent system properties

Luca Vigan (Universit di Verona)

Ingegneria del SW, 04.03.11