Skip to content
Explanation

CVD Case State Model Introduction

The specification governs

This page explains the design of the Vultron Protocol. It is informative: the normative text is the Vultron Protocol Specification. Where this page and the specification differ, the specification governs.

This section explains the Case State (CS) model of a Coordinated Vulnerability Disclosure (CVD) case. It is for practitioners who want to know what the model tracks, and for developers who will implement it. The pages below develop the model; the normative definition is in the Vultron Protocol Specification §8 Case State (CS) Dimensions.

The CVD Case State (CS) model provides a high-level view of the state of a CVD case. In it we model two main aspects of the case:

  1. A Participant-specific Vendor Fix Path from initial vendor awareness through the deployment of a fix.
  2. A Participant-agnostic Public State summarizing both public and attacker awareness of the vulnerability.

These processes run in parallel, and the CS model captures the interactions between them.

The model comes from the report A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure, which carries its full derivation. The pages in this section present the resulting model of 32 states and their transitions.

Pages in this section

The first page defines the model's states, and the second builds on it with the transitions between them. The research discussion of the model's limits, CS Model Limitations, draws on Measuring CVD and sits in that section.

  • CS States — The six substates a case tracks, the Vendor fix path that constrains them, and the resulting set of case states.
  • CS Transitions — The events that move a case between states, the rules that restrict them, the full state diagram, and the transition grammar.

Where the model is used

The CS model is one of three process models, alongside Report Management and Embargo Management. Model Interactions explains how the CS model constrains the other two. Measuring CVD uses the CS model to reason about the possible histories of a case.