Security in State Machines
Overview
State machines orchestrate control flow, protocol sequencing, and decision logic across digital systems. Because they define how the system reacts to events, they are a prime target for attackers attempting to:
- force illegal transitions
- desynchronize communication
- bypass authentication or integrity checks
- corrupt internal state bits
- manipulate timing or metadata
Security analysis focuses on ensuring that FSMs remain deterministic, robust, and resilient even under adversarial conditions.
Why State Machines Are a Security Target
FSMs often sit at the boundary between:
- protocol parsing
- control logic
- safety mechanisms
- configuration registers
- communication interfaces
If an attacker can influence the FSM, they can:
- skip authentication
- force privileged modes
- freeze or stall the system
- trigger unintended actions
- bypass replay protection
- corrupt session state
FSMs must therefore be treated as security‑critical assets, not just control logic.
Main Security Threats
Protocol Abuse
Malformed, unexpected, or out‑of‑order messages attempt to push the FSM into unintended states.
State Corruption
Fault injection, glitching, or SEU‑like attacks flip state bits to bypass checks.
Illegal Transitions
Weak guards allow transitions that should be unreachable.
Desynchronization
Breaking alignment between communicating FSMs by manipulating timing or counters.
Timeout Manipulation
Delaying or accelerating events to force premature transitions or stalls.
Replay and Freshness Attacks
Reusing valid messages to drive the FSM into a previous or unsafe state.
Metadata Tampering
Altering length, type, or control fields to confuse transition logic.
Denial of Service
Overwhelming the FSM with events, retries, or malformed traffic to cause lockup or livelock.
Figures
Figure 1 — FSM Under Attack
Malformed or adversarial inputs attempt to push the FSM into illegal states. The FSM detects invalid transitions and triggers recovery.
Mitigation Techniques
1. Strict Transition Validation
Every transition must have explicit guards. Reject anything malformed, unexpected, or out of sequence.
2. Illegal‑State Detection
Detect undefined encodings and force recovery or safe fallback.
3. Redundant FSMs
Lockstep or dual‑path FSMs with comparison for high‑integrity systems.
4. Input Sanitization
Filter, debounce, and validate all external or protocol‑driven inputs.
5. Timeout Supervision
Detect stalls, excessive delays, or abnormal timing patterns.
6. Freshness and Replay Protection
Use counters, nonces, or timestamps to ensure message validity.
7. Glitch and Fault Injection Resistance
Synchronizers, hardened flip‑flops, and timing monitors prevent state corruption.
8. Secure Configuration
Lock FSM parameters, mode bits, and control registers after initialization.
9. Built‑In Self‑Test
Validate FSM logic, transitions, and outputs at startup.
Figure 2 — Illegal‑State Detection and Recovery
The FSM monitors its own encoding and transitions to a safe state if an undefined or corrupted state is detected.
Relationship with Safety
Safety
- Focuses on random faults causing illegal states or transitions
- Uses redundancy, encoding, and monitoring to detect failures
Security
- Focuses on intentional manipulation of FSM behavior
- Protects against malformed inputs, timing abuse, and state corruption
Overlap
- Fault injection attacks resemble timing or voltage faults
- Illegal‑state detection helps both domains
- Redundant FSMs improve resilience to both failures and attacks
