# Optimal Security Hardening over a Probabilistic Attack Graph

A Case Study of an Industrial Control System using CySecTool

Przemysław Buczkowski  Queen Mary University of LondonSchool of Electronic
Engineering and Computer ScienceMile End RoadLondonEnglandE1 4NSUnited Kingdom
<EMAIL_ADDRESS>,  Pasquale Malacaria  Queen Mary University of
LondonSchool of Electronic Engineering and Computer ScienceMile End
RoadLondonEnglandE1 4NSUnited Kingdom<EMAIL_ADDRESS>,  Chris Hankin
Imperial College LondonInstitute for Security Science and Technology180
Queen’s GateLondonEnglandSW7 2AZUnited Kingdom<EMAIL_ADDRESS>and
Andrew Fielder  Imperial College LondonInstitute for Security Science and
Technology180 Queen’s GateLondonEnglandSW7 2AZUnited Kingdom
<EMAIL_ADDRESS>
(2022)

###### Abstract.

CySecTool is a tool that finds a cost-optimal security controls portfolio in a
given budget for a probabilistic attack graph. A portfolio is a set of
counter-measures, or controls, against vulnerabilities adopted for a computer
system, while an attack graph is a type of a threat scenario model. In an
attack graph, nodes are privilege states of the attacker, edges are
vulnerabilities escalating privileges, and controls reduce the probabilities
of some vulnerabilities being exploited. The tool builds on an optimisation
algorithm published by (Khouzani et al., 2019), enabling a user to quickly
create, edit, and incrementally improve models, analyse results for given
portfolios and display the best solutions for all possible budgets in the form
of a Pareto frontier. A case study was performed utilising a system graph and
suspected attack paths prepared by industrial security engineers based on an
industrial source with which they work. The goal of the case study is to model
a supervisory control and data acquisition (SCADA) industrial system which,
due to having a potential to harm people, necessitates strong protection while
not allowing to use typical penetration tools like vulnerability scanners.
Results are analysed to show how a cyber-security analyst would use CySecTool
to store cyber-security intelligence and draw further conclusions.

threat modelling, multi-objective optimisation, probabilistic attack graph,
industrial control system, cybersecurity risk assessment tool

††journalyear: 2022††copyright: rightsretained††conference: Proceedings of the
2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems; April 27,
2022; Baltimore, MD, USA††booktitle: Proceedings of the 2022 ACM Workshop on
Secure and Trustworthy Cyber-Physical Systems (SaT-CPS ’22), April 27, 2022,
Baltimore, MD, USA††doi: 10.1145/3510547.3517919††isbn:
978-1-4503-9229-7/22/04††ccs: Security and privacy Formal security
models††ccs: Applied computing Multi-criterion optimization and decision-
making††ccs: Computer systems organization Embedded and cyber-physical systems

##  1\. Introduction

###  1.1. Background

Cyber security needs to be considered by any organisation that uses any kind
of IT system, especially when a result of such a system malfunctioning can be
tragic – this is true for most industrial control systems, controlling, for
example, power stations and factories. A cyber security _portfolio_ is a set
of counter-measures against _vulnerabilities_ adopted by a company. Such
countermeasures are called _controls_ in the literature (Garvey and Patel,
2014; Oppliger, 2015). Among others, one of the industry-used frameworks lists
these categories of controls: malware defence, controlled use of privileges,
penetration tests, and security training programs. (CIS, 2018)

An IT system can be modelled as an attack graph – in this particular case
study, a _privilege graph_ where each node represents a set of privileges, and
each edge represents the attacker gaining additional privileges by exploiting
a vulnerability.

(Khouzani et al., 2019) described a method to obtain min-max optimisation over
probabilistic attack graphs, enabling to obtain a portfolio giving the best
security (minimised maximum flow to the target) possible for a given budget.
Having produced the mathematical theory, the next step is to build an attack
graph with probabilistic flows (attack success probability) over edges and
controls with defined flow reduction (that is, reduced probability of a
successful attack when we employ a security measure).

A crucial application area for cybersecurity decision support is a ClearSCADA-
based industrial control system. This ICS is software that runs in factories
and controls mechanical devices, so an exploit in the system may pose a danger
to the workers and the general community (e.g. if the system manages essential
services like energy or water supply). Therefore strong cybersecurity
protections are necessitated. A factory system graph and suspected attack
paths were received from industrial security engineers based on their work
with an industry source. This detailed and trusted information proved crucial
to a successful analysis.

###  1.2. Contribution

This work reports on a tool implementing the min-max optimisation from
(Khouzani et al., 2019). Design choices and features of the tool are
explained, and an application of the tool to a real-world SCADA system is
shown. More specifically, the goals are to:

  * •

Build a software package (CySecTool) with the following main features:

    * –

Visualisation of attack graphs;

    * –

Creator and editor of attack graphs;

    * –

Tight integration with the optimisation algorithm.

  * •

Demonstrate the effectiveness of the approach by developing a case study (an
overview of the system analysed is shown in Fig. 1):

    * –

Model an attack graph based on the information received;

    * –

Assume the role of a security analyser and make some sound conclusions from
the model.

Figure 1. The industrial case study analysed, divided into three segments: OT,
IT and field devices. Underlined are the control system and its two main
interfaces: WebX and ViewX.

###  1.3. Paper structure

The paper is split into three main parts: 1) the literature review, discussing
the developments in the area of attack graph modelling and security of
industrial control systems; 2) documentation of the design choices made while
developing CySecTool; 3) modelling a SCADA system and the findings made by
feeding it to the optimisation routine using CySecTool.

##  2\. Literature review

###  2.1. Attack graph modelling

(Lampson, 1974) is credited with the idea of access control modelling. In this
paper, the author models access as an _access matrix_. It was found out that
the safety problem — checking if a subject (i.e. user) can get access to an
object is insoluble under an access matrix model. (Harrison et al., 1976)

One of the models developed for solubility of the safety problem is the take-
grant protection model. Such a graph can be modified at the run-time to model
a user _taking_ advantage of their existing permissions to _grant_ themselves
new ones (Harrison, 1985). Soon after the model’s conception, (Snyder, 1977)
has criticised the ability of the model to accurately represent real-life
systems which led to the development of other DAG-based models.

As extensively surveyed by (Kordy et al., 2014), DAG-based models have been
since then broadly used to model real-life attack and defence situations. They
have identified more than 30 different approaches, most of which can be
broadly categorised as derived from _threat trees_ , used early by (Weiss,
1991), and formal methods based on Bayesian networks, for example,
probabilistic attack graphs, which allow reflecting the probabilistic nature
of security dangers (Poolsappasit et al., 2012).

Choosing between security controls, that is, counter-measures against security
threats has been shown to be a multi-objective decision problem. (Dewri et
al., 2007) (Khouzani et al., 2019) have shown a framework to efficiently solve
a multi-objective optimisation problem presented as a probabilistic attack
graph combined with a set of controls reducing the probabilities.
Incorporating this algorithm into a user-friendly tool is the primary
objective of this paper.

###  2.2. Modelling tools

The next step in the popularisation of computer security models is to
implement tools allowing to analyse of systems using these formal methods. One
of the first programs for this purpose was a C++ attack graph generator for
Unix, written by (Swiler et al., 2001). This tool took as an input _attack
templates_ (descriptions of attacks consisting of privileges and capabilities
necessary and obtained as a result), _configuration profile_ (i.e. network
topology, privilege sets in the system) and _attacker profile_ (description of
attacker’s capabilities). The figures included in the paper bear remarkable
similarity to the drawings generated by CySecTool, excluding the probabilistic
aspect.

Other tools followed, primarily focusing on the problem of generation of
attack graphs from realistic network diagrams and vulnerability databases
exported from already existing tools. One of these is NetSPA, which generates
attack graphs from netViz files, NVD vulnerability databases and exported
firewall rules (Lippmann et al., 2006). TVA (Topological Vulnerability
Analysis), on the other hand, incorporates a network scanner which is used to
generate attack graphs (Noel et al., 2009).

Probably the most similar model to the one implemented in
CySecTool was found in (Ou et al., 2005; Homer et al., 2009). The authors
extended the MulVAL tool to include probabilities of each vulnerability being
exploited, using vulnerability metrics like Common Vulnerability Scoring
System. The author says that the major disadvantage to applying Bayesian
networks to this problem is the very slow calculation and optimisation.

Thanks to the theoretical advantages (Khouzani et al., 2019) and significantly
increased processing power of home computers, it is not as infeasible as it
was back then. Parallelisation, which was implemented as a part of this work,
also greatly helped.

###  2.3. Industrial cybersecurity

_Supervisory control and data acquisition_ (SCADA) systems are used to monitor
and remotely control critical industrial processes, such as gas pipelines,
electric power transmission or other production infrastructures. The term was
invented in the 1980s, but the first systems were created in the 1960s (Shaw,
2006). SCADA systems are a part of wider _Operational Technology_ (OT), which
is defined as technology that interfaces with the physical world and includes
Industrial Control Systems (ICS), SCADA and Distributed Control Systems (DCS)
(NCSC, 2017).

The significant change in the cybersecurity of industrial control systems was
the introduction of Internet Protocol-connected systems in the 1990s. The
systems built or extended as such became vulnerable not only to specialised
attacks but to all the other common Internet threats, for example, automated
crawling of servers in a search for open vulnerabilities. Even if these
networks are not connected to the Internet, they may remain as vulnerable – in
2010, the Stuxnet virus was found to spread using USB drives, and once in, it
would spread further using the local IP network (Macaulay and Singer, 2016).
Stuxnet, allegedly created by the USA and Israel, specifically targeted SCADA
systems and was reported to have caused 20% of centrifuges used in the Iranian
nuclear programme to fail (Broad et al., 2011; Kushner, 2013).

New challenges appear a lot faster than an expected lifespan of an Industrial
Control System, which for each individual component, both software and
hardware, is often over ten years, and occasionally over 20 years. (Hahn,
2016) (Lakhani, 2020) in an industry report quotes data that 64% of OT
organisations struggle with developments in cyber-security; more concerning,
74% of the organisations surveyed report that they were breached in the last
12 months.

Modelling industrial control systems has been demonstrated to have some
interesting caveats absent otherwise. While one may be tempted to run a
vulnerability scanner on a system, one must remember that an industrial system
malfunction can have outcomes in the real world, as opposed to, for example, a
website that can be easily restored from a backup. (Duggan, 2005) reports
several incidents:

  * •

A ping sweep was performed on a SCADA system. Suddenly one robotic arm became
active and swung 180 degrees.

  * •

A penetration test was performed to itemise hosts on a gas company network.
The search ventured into the SCADA part of the network, which was unintended,
and locked the system for 4 hours, cutting off the gas supply.

  * •

A ping sweep caused a system controlling the creation of integrated circuits
to hang, destroying $50,000 worth of wafers.

All three tools mentioned (NetSPA, TVA and MulVAL) depend on a vulnerability
scanner. As demonstrated by the examples above, a different approach is
necessary. In the previous edition of this workshop, a generator of attack
graphs based on the IEC 61850 System Configuration Description Language was
shown. (Rencelj Ling and Ekstedt, 2021) Meta Attack Language is used for
modelling, which was shown to enable users to develop probabilistic models of
attacks against vehicles, for example, passenger cars. (Katsikeas et al.,
2019) The next step we think is worth taking is to simplify creating and
reasoning about graphs of this type — CySecTool is the result.

##  3\. CySecTool design and implementation

CySecTool is a web application developed using Python and the Bokeh
presentation library. It provides a front end for the optimisation engine
implementing the algorithm in (Khouzani et al., 2019), which is further
explained in subsection 3.1.

Attack graphs are saved to a JSON file in a bespoke schema, storing data about
nodes (attackers’ access level), edges (vulnerabilities escalating privileges)
and controls (counter-measures against vulnerabilities). Graphs can be edited
using an included editor, and the application contains several example graphs,
including the Industrial Control System analysis. A JSON schema file is
provided, so the models can be validated, viewed, edited and created using not
only CySecTool but also standard tools with support for JSON documents (Austin
et al., 2020).

A screenshot of CySecTool is shown in Figure 2: on the left-hand side, the
attack graph modelling the security scenario under analysis is drawn. Edges
are coloured according to the probability of a successful attack, using the
logarithmic scale drawn on the right-hand side of the graph. The path drawn in
the thicker line is the critical path — the most likely attack path. The
initial attacker’s status node is drawn in blue, while their targets are drawn
in red. On the right-hand side of the program view, the user can manually
select a portfolio, change the targets, load and save a graph, launch a graph
editor or optimise for a given budget.

With the click of the “Edit” button, the active model is loaded to the editor.
Once changes are applied, the model can be saved locally or instantly viewed
in the visualiser module of CySecTool. Due to how fast it is to make changes
and observe the results, an analyser can experiment with model parameters very
comfortably.

Figure 2. A screenshot of CySecTool with the industrial control attack graph.
On the right hand side the controls installed.

The portfolio can be chosen manually using the panel closely depicted in
Figure 2. Flows in the graph are momentarily recalculated, and one can see
what influence the choice they made had – they can look at the colours, the
maximum flow and budget costs displayed on the right-hand side of the graph or
hover on the edges in order to see detailed information about the
vulnerability represented by the edge hovered on, controls applied, and
calculated flows. One can click on an edge to go to a page describing the
vulnerability in detail — in the case of this case study, it leads to the
vulnerability description in MITRE ATT&CK for the ICS database.

The application can generate an optimal security controls portfolio in a
specified budget. For a detailed analysis, it lets the user generate a _Pareto
frontier_ – the set of all portfolios for which no more secure solution exists
in the same or lower budget. Such solutions are called _Pareto-optimal_ (Jahan
et al., 2016). Charting them lets the user analyse the way security changes
with an increasing budget. Hovering on the points lets them get additional
data about the portfolio – its exact cost, indirect cost and security damage
(that is, the attack path with maximum probability given the portfolio).
Clicking on a point applies the associated portfolio.

An example of a generated Pareto frontier can be seen in Figure 3. Short
calculation time — approx. 10 s on AMD Ryzen 7 PRO 3700U and approx. 18 s on
Apple M1 — is achieved due to adding parallelisation to the original
optimisation routine. Parallelisation was achieved with the help of the pathos
framework, while PuLP is used to implement the optimisation routine itself
(McKerns et al., 2012; Mitchell and Dunning, 2011).

Figure 3. A Pareto frontier of the “optimal” portfolios applicable to the ICS
model. Note the logarithmic security scale and unbound indirect cost.
Portfolios in green are further analysed in section 5.

Combining automated portfolio optimisation with manual fine-tuning enables
detailed analysis and making informed decisions. Graphical representation of
the results, generated in real-time, helps to quickly establish the
consequences of the choices one can make.

For correctness, a set of tests was prepared using the unittest library and
Selenium browser automation tool. Some were based on the manually verified and
formally proven results from (Khouzani et al., 2019), while others are based
on bespoke scenarios created during the development.

###  3.1. Overview of the optimisation routine

To illustrate the optimisation framework and system modelling implemented in
CySecTool, let us consider the toy example in Figure 4. The initial state of
the attacker is vertex 0, and the target state is vertex 3. An edge in the
graph is an attack step or a vulnerability; for example, the attacker could
take the leftmost edge and reach the target in one step. Security controls are
associated with edges that represent vulnerabilities which they are effective
against. For example, for the leftmost edge, control c3 is effective; for the
edge from 1 to 2, there are two effective controls: c3 and c4. Suppose that
when deploying c1, the attacker probability of success on that edge is $0.5$,
for c2 and c4 it is $0.2$, and for c3 it is $0.1$.

The optimisation is answering questions like: “suppose the defender can only
choose two security controls out of c1, c2, c3, and c4: which combination is
the optimal choice in the sense of making the probability that the attacker
successfully reaches vertex 3 the lowest?” and variations of this question,
where controls have varying “costs” and the defender has a varying “budget”.

For example, if the defender were to choose c3 and c4, then the attacker would
reach 3 with probability 1 by following the path (0,1), (1,3). However, if the
defender were to choose c2 and c3 instead, then the attacker can reach 3 with
a probability 0.2 at most. In fact c2, c3 is the optimal answer to the
question posed above — the optimal “portfolio” of security controls.

10start32c1c2c3,c4c1,c4c2c3 Figure 4. A toy example of an attack graph. Edges
are labelled by the controls which are effective when applied to them.

In mathematical terms, this is a bi-level optimisation: the defender wants to
minimise the attacker’s maximal probability of reaching the target. The
minimisation is the outer problem and the maximisation is the inner problem.
In addition, the defender is subject to budget constraints. The work (Khouzani
et al., 2019), using ILP conversion, exact LP relaxation, and dualisation
introduces an algorithm to efficiently solve this problem, which is
implemented as a backend of CySecTool.

##  4\. Methodology

Our attack graphs are defined as follows:

  1. (1)

vertices (attacker access privileges),

  2. (2)

edges (classes of vulnerabilities),

  3. (3)

default flows over edges (default probability of the unmitigated vulnerability
being exploited),

  4. (4)

controls (mitigations),

  5. (5)

flow reductions (reduction of the probability of the vulnerability being
exploited if control is deployed),

  6. (6)

direct costs (monetary cost for implementing a control) and indirect costs
(inconvenience to stakeholders, i.e. downtime, increased complexity of use).

For this scenario, all the above items (vertices, edges, etc.) are described
in detail in the following along with the decisions made and their
justifications.

###  4.1. Vertices, or the ICS system

The case study is based on the main operating capacity of a medium-sized
utility provider, as described by the national cybersecurity agency. For the
purposes of confidentiality, the exact organisation and sector have been
obfuscated. The example considers a single physical operating environment for
the IT and OT (Operational Technology) systems and several remote sites which
relate to control units.

For the purpose of documentation, the environment is broken up into four
distinct parts, the OT/SCADA system, IT system, Field Devices, and External
Devices and Systems. Each of these parts can be defined by a conceptual
physical or technological separation, although connectivity does exist between
sections — which will prove vital to the system’s security. In this example,
all clients and servers are all running operating systems vendored by
Microsoft. This may not hold true for the devices external to the network,
which may be running other operating systems.

A figure depicting the industrial control system under analysis is shown in
Figure 1. The corresponding attack graph in CySecTool is shown in Figure 2.
Most vertices warrant further explaining:

  * •

_ViewX_ — one of two front-ends of the system, which is used to control the
plant from the site machines and has unlimited capabilities.

  * •

_WebX_ — the Internet-facing front-end, which can be used to control the plant
from the outside of its perimeter.

  * •

_OT Active Directory_ — the part of the directory service which controls
access to the control system. Notably, it is controlled from the IT part of
the system, so the admins can grant rights to the OT while sitting in the IT.

  * •

_Vendor software_ — most of the software, both for IT and OT, gets supplied by
external vendors. It is a node of our graph since an attack can occur against
the vendor in a “supply chain compromise” (MITRE, 2021a).

  * •

_Test system_ — all the updates to the OT software go through the Test system,
which is a miniature of the actual system. Once the software is tested, it
gets released to production.

  * •

_Site machine_ — machines at the site which communicate with the control
system.

  * •

_Corprate thin client_ — machines in the IT area, used for administrative
tasks, including data preparation for the OT.

###  4.2. MITRE ATT&CK for ICS

MITRE ATT&CK framework is a threat intelligence database. (Pennington et al.,
2019; Nickels, 2018) It collects “matrices” consisting of:

  1. (1)

tactics (attacker’s goals);

  2. (2)

techniques and sub-techniques (ways to achieve goals);

  3. (3)

mitigations;

  4. (4)

procedures (real-life examples of techniques’ usage).

MITRE is an organisation that, among others, manages _Common Vulnerabilities
and Exposures_ and _Common Weakness Enumeration_ databases, commonly used in
communication about cybersecurity. ATT&CK is a natural extension of these,
creating an overview of tactics and techniques used. While a general,
“enterprise” matrix is by far the best developed, a review process began in
2017 of a matrix for Industrial Control Systems, named _ATT &CK For ICS_.
(Alexander et al., 2020) The matrix is available online for browsing at
https://collaborate.mitre.org/attackics, but the most interesting feature is
that the whole database can be downloaded in the form of Structured Threat
Information Expression, which is a language and serialisation format based on
JSON used to exchange cyber threat intelligence. MITRE provides recipes and
tips on how to write programs interacting with that content. (Jordan et al.,
2021)

###  4.3. Vulnerabilities

To analyse the vulnerabilities, we used Jupyter notebooks, a built-in Python
JSON processing library and pandas for data processing and display. First of
all, we narrowed techniques down to these applicable to tactics modelling
gaining access to the control system: initial access and lateral movement. To
measure the initial risk, we joined the table with procedures (instances of
hacking groups using the vulnerability) and counted how many procedures exist
for each vulnerability. Refer to Table 1 for the list of analysed procedures.
The initial risk was calculated as $\frac{|procedures|}{10}$, and it ranges
from $10\%$ to $90\%$.

The next step was to add these vulnerabilities to the model, which was done
using the built-in CySecTool editor. Representing multiple attack paths in
terms of ATT&CK allowed us to extract the data about how common they are from
ATT&CK and represent this frequency as the probability of the vulnerability
being exploited.

Table 1. Relevant techniques extracted from ATT&CK for ICS database.

technique | tactic | url | c.11footnotemark: 1
---|---|---|---
Spearphishing Attachment | initial access | T865 | 9
External Remote Services | initial access | T822 | 8
Drive-by Compromise | initial access | T817 | 6
Supply Chain Compromise | initial access | T862 | 3
Engineering Workstation Compromise | initial access | T818 | 2
Replication Through Removable Media | initial access | T847 | 2
Data Historian Compromise | initial access | T810 | 1
Internet Accessible Device | initial access | T883 | 1
External Remote Services | lateral movement | T822 | 8
Valid Accounts | lateral movement | T859 | 8
Exploitation of Remote Services | lateral movement | T866 | 3
Remote File Copy | lateral movement | T867 | 3
Program Organization Units | lateral movement | T844 | 2

11footnotemark: 1

Procedures count.

###  4.4. Controls

Control is a measure against vulnerabilities. In CySecTool it is represented
with its name, direct cost, indirect cost and the flow reduction for the
vulnerabilities it is effective against. Moreover, controls exist in mutually
exclusive levels – for example, one could opt for updating air-gapped devices’
software once a year or once a month.

In order to obtain the controls for each vulnerability, we listed mitigations
that are applicable according to the ATT&CK database and grouped them in the
following control groups. Some mitigations already existed in the system; they
are underlined.

  1. (1)

_Network Segmentation_ : The current network, while segmented in theory into
the Internet, OT, IT and site devices, has multiple points of contact between
the zones, which allow attacks to happen. Most egregiously, the Active
Directory of OT users is in the IT zone, so the admins can easily modify users
without having to go to the site.
Data files are also uploaded from the IT to the OT, effectively controlling
the control system. Levels: 1) No segmentation; 2) ViewX and OT Active
Directory removed from IT zone; 3) Access to OT from IT limited to WebX.

  2. (2)

_IT Network Protection_ : Thin clients are used in the IT zone for
administrative purposes. Since a connection exists between IT and OT, an
infected IT computer could wreak havoc in the ICS. Therefore, we want to
minimise the risk of this happening. All of these protections have been
applied in IT. Levels: 1) No protection; 2) Firewall and antivirus installed
on thin clients.

  3. (3)

_USB Devices_ : Currently, USB devices are used for the manual carrying of
data to and from OT. While it allows us to air-gap devices, the system is
still open to Stuxnet-like lateral movement. Levels: 1) No restrictions; 2)
Company issued and periodically formatted drives only; 3) Single-use CDs only
recorded directly by SCADA software.

  4. (4)

_WebX Access Policy_ : WebX is used to allow limited control from outside of
the site. It reduces the need to go to the site to do some management, but it
opens the system to attacks from the Internet. Levels: 1) Full access; 2)
Limited access; 3) WebX reduced to site monitoring.

  5. (5)

_ViewX Access Policy_ : ViewX is available only from the site but can do
everything, and there are no users. Creating more access levels means that
when access credentials are leaked, it does not always mean that the attacker
gains full control. Levels: 1) Full access; 2) Access levels introduced.

  6. (6)

_Update site machines_ : Machines without an Internet connection are very
rarely updated. While they cannot get infected from the Internet, a virus can
well get there from a USB drive. Distributing updates would require a person
to update all these machines manually. Levels: 1) No updates; 2) Yearly
updates; 3) Monthly updates.

  7. (7)

_Code signing and testing_ : Enforcing that only valid and tested code can run
on the machines can foil many possible attacks but adds a considerable
overhead for deploying new code. Moreover, machines can be too old to support
only signed binaries — it was introduced with Windows 7/2008 R2 (Microsoft
Corporation, 2012). We could update these, but updating PLCs would require
replacing the factory equipment. Levels: 1) No code testing; 2) Testing all
updates; 3) Testing and code signing on PCs; 4) Code signing on PCs and PLCs.

  8. (8)

_Wireless security_ : Since the communication between site machines and the OT
is going over unencrypted UHF radio waves, our adversary could catch these
communications, modify and replay them to bring the site out of control. A
Polish student did that, using a modified TV remote controller to control a
tram system in Łódź. (RMF FM, 2008) Encrypting network traffic is noted to be
expensive since the radio devices have no ability to handle it. DES could be
used without having to replace the whole radio infrastructure. Levels: 1) No
encryption; 2) DES encryption; 3) AES encryption.

  9. (9)

_WebX authentication_ : Currently WebX can be accessed from any external
device what is inherently insecure. The factory could provide 2FA keys or
separate devices to the employees which give them access only to WebX. Levels:
1) Username/password; 2) 2FA with a personal device; 3) 2FA with a physical
key; 4) Company-provided devices used.

  10. (10)

_ViewX authentication_ : Currently ViewX is protected only by a single
password. There are no accounts.
Levels: 1) Password; 2) 2FA with a personal device; 3) 2FA with a physical
key.

###  4.5. Controls’ cost

In order for the optimiser to find the best solution in a budget, we need to
assign to all controls their associated cost. Moreover, the cost does not have
to be only monetary — if we make it harder for the employees to do their jobs
by, for example, taking away their access rights, there is a loss of
productivity, which can be modelled using _indirect cost_.

Many controls can be divided roughly into “direct cost-intensive” and
“indirect cost-intensive”. For example, installing new radio devices, which
would allow us to encrypt their communication, would be very expensive, but
the employees should not even notice it. On the other hand, restricting the
capabilities of WebX (the Internet-facing front-end to the control system) is
very cheap to do, but the employees will be greatly annoyed by having to go to
the site to do their jobs, especially in 2021 when they are told to work from
home. The system is very flexible, so the analyser can easily adapt the costs
to the ever-changing environment.

We express mitigations in some basic actions, like “Employing extra employee”
or “New infrastructure”. This way, the costs of the basic blocks can be
adjusted, and it is easier to compare the mitigations. The actions used are
listed in Table 2.

Table 2. Basic actions, their direct, indirect costs and rationale behind
them.

Action | D.11footnotemark: 1 | I.22footnotemark: 2 |  Rationale
---|---|---|---
Buying a tool, e.g., USB sticks or a laptop. | 1 | 8 |  Buying 50 pen drives is comparatively cheap. Dealing with employees’ complaints about the new procedures is not.
Extra employee. | 5 | 0 |  Extra person to handle the work due to a new policy. Notably, an extra administrator to work at the site due to the limited external access policy falls into this category.
New PC software. | 2 | 8 |  The cost of a new subscription is more painful than buying some USB sticks. The employees’ have to deal with the change.
New ICS software feature. | 40 | 20 |  A new feature in a bespoke ICS software is going to be more expensive to develop than buying an off-shelf MS Office box.
New PLC infrastructure. | 100 | 0 |  What we want to avoid the most is changing elements of the bespoke PLC infrastructure. Such changes remain transparent to the employees – hence the negligible indirect cost.
Taking away permissions. | 1 | 40 |  Taking away permissions from existing users reduces their productivity.

11footnotemark: 1

(Direct) cost. 22footnotemark: 2Indirect cost.

###  4.6. Controls’ effectiveness

The controls’ effectiveness is the part of the model in which, for each
vulnerability and control, a number in $[0;1]$ is given, specifying the
effectiveness of the control against the vulnerability. This number is named
_flow reduction_ and is the number by which the initial flow on the edge (see
subsection 4.3) is multiplied when the control is active.

Intuitively, flow reduction equal to one means that the control does not
impact the risk; equal to zero means that it eliminates the risk completely;
and equal to, for example, 0.5 halves the risk.

We graded the efficacy of each of the controls on a 4-point scale (low,
medium, high, very high), associated flow reduction with each point (0.7, 0.5,
0.2, 0.1).

To show some examples:

  * •

_DES Encryption_ – medium, _AES Encryption_ – very high. While everything is
better than plain-text, once the attacker finds out DES is used, they can use
an online GPU cluster to break it, while AES encryption is considered secure
(Martin, 2017) – so a compromise would have to occur due to an implementation
error.

  * •

_Yearly updates_ – low, _Monthly updates_ – medium. While updating the systems
protects against common threats, ICS attacks are usually made to order,
decreasing the probability that their signature would be detected. Therefore,
the updates’ protection is on the lower end of the scale.

The effectiveness, in the end, corresponds to the opinions of the analysts. It
is planned to verify the model with the agency specialists to improve the
accuracy of the model further. The proposed way to work with the system is to
continuously refine the model and its probabilities in order to reflect our
improving understanding of the system and verify it using the Pareto frontier.
The continuous improvement approach is shared with the ATT&CK database. (Strom
et al., 2020; Alexander et al., 2020).

Alternatively, once an appropriate data source is obtained, a statistical
approach, similar to the one in subsection 4.3, can be followed.

##  5\. Use cases and results

Given the security modelling described so far, we are going to show some use
cases of CySecTool which are of interest to security analysts and decision-
makers.

The following scenarios could be relevant to a security analyst using
CySecTool to generate portfolios to be shown to the stakeholders — the
protections they are offering and their weak points.

In these scenarios, we consider the Pareto frontier generated by the tool and
will look at some interesting portfolios in the frontier, explaining how
decisions can be made.

###  5.1. General analysis and findings

Let us consider the frontier in Figure 3. Most crucially, it displays how with
the increasing budget, we can decrease the security damage, that is, the
probability of the most probable attack.

There are several intuitive rules an analyser may follow to narrow down the
portfolios to the most interesting ones:

  * •

If points are close on the x-axis (cost) but distant on the y-axis (security),
a small investment improves the security considerably. Therefore, the point
further to the right will be _more_ interesting.

  * •

Conversely, if the points are distant on the x-axis but close on the y-axis, a
significant investment improves the security slightly. Therefore, the point
further to the right will be _less_ interesting.

  * •

Then, if the points are close on both axes, they are similar in both cost and
security. These can also warrant further analysis since the control set used
can be different, and so the indirect cost, and so the final decision on which
portfolio to employ.

Using the first two rules, we can find several portfolios representative for
“low”, “medium”, “high” and “very high” costs. Portfolios, chosen using this
method are marked in green in Figure 3 and detailed in Table 3.

Table 3. Portfolios representative for cost categories generated on a naked
model.

Name |  Controls | D.11footnotemark: 1 | I.22footnotemark: 2 | Damage
---|---|---|---|---
Naked |  No controls | 0 | 0 | 0.27
Low |  Company issued drives only, WebX reduced to site monitoring, ViewX access levels, Wireless DES encryption, ViewX 2FA with a physical key | 269 | 898 | 0.05
Medium |  Code testing, Wireless AES encryption, Company issued drives only, WebX reduced to site monitoring, ViewX access levels, Update site machines monthly, IT network protection, WebX 2FA with a personal device, ViewX 2FA with a physical key | 1124 | 1230 | 0.025
High |  Network segmentation, Single-use CDs only, WebX reduced to site monitoring, ViewX access levels, Code signing on PCs, Wireless AES encryption, IT network protection, WebX 2FA with a physical key, ViewX 2FA with a physical key | 1505 | 1868 | 0.01
Full |  All controls employed at their highest levels | 2042 | 2028 | 0.005

11footnotemark: 1

(Direct) cost. 22footnotemark: 2Indirect cost.

####  5.1.1. Low-cost portfolio

The low-cost portfolio is notable for its high indirect costs. Internet access
to the control system is reduced to monitoring only, access levels are
introduced to ViewX, and ViewX users are required to use physical keys for
two-factor authorisation. All of these impact employees’ productivity — to do
their job, they must be at the site, ask to have appropriate permissions
granted, and pick up a key. If they want to upload data to air-gapped
computers, they cannot use their own USB drives anymore. None of these had to
be done when there were no controls — they opened their laptop from wherever
and logged in with their password. They could have prepared the data at home
to carry it straight to the factory.

Nevertheless, all these controls are very effective– attacks from the Internet
are the most concerning due to how frequent and generic they are, but damage
can be limited to information leakage by severely restricting WebX
capabilities. Even when malware infects the site computers, it can try to
guess users’ passwords, but bypassing 2FA is harder. Moreover, they are very
cheap to implement, so if the company does not want to enact controls
requiring expensive infrastructure changes, it may be a good solution.

####  5.1.2. Medium-cost portfolio

In this portfolio, due to the higher budget, some high-value investments were
made. Notably, AES encryption is added (requiring a replacement of the radio
infrastructure), and a test system needs to be built, so new software can be
tested, limiting an impact of a supply chain compromise.

The direct cost is now at a level similar to the indirect cost, indicating
that these changes require a considerable infrastructure budget and that
controls implementable as policies have been largely exhausted. Note that,
despite roughly five times higher direct cost, the damage is only two times
lower than in the low-cost portfolio.

###  5.2. Analysing similar points

Let us come back to the low-cost portfolio described in subsubsection 5.1.1.
The main problem with this portfolio is the very high indirect cost in the
form of making interacting with the system much more time consuming for the
employees.

One of the ways to solve this problem using CySecTool is to have a look at the
portfolios in a similar price and security range. Such a close-up on three
portfolios is illustrated by a screenshot from CySecTool in Figure 5.

Figure 5. The close-up of the _neighbourhood_ of the low-cost portfolio chosen
in subsubsection 5.1.1. Tooltips give detailed information about the costs and
security damage of individual portfolios.

The initially chosen portfolio is the middle one of the portfolios detailed in
Figure 5. Both other portfolios have a lower indirect cost. Let us list the
differences in the controls used in Table 4.

Table 4. Alternative controls in the neighbourhood of the low-cost portfolio. No. |  Differing controls | D. | I. | Damage
---|---|---|---|---
1. |  Company issued USB devices only, 2FA with a physical key for ViewX. | 269 | 898 | 0.05059
2. |  Company issued USB devices only, 2FA with a personal device for ViewX, IT network protection. | 267 | 762 | 0.05456
3. |  Monthly updates to site machines, 2FA with a physical key for ViewX. | 303 | 834 | 0.05057

From the Pareto frontier, it is clear we can go two ways from the first,
originally selected portfolio. The second portfolio has a considerably lower
indirect cost, similar direct cost and slightly lower security. In contrast,
the third portfolio has a higher direct cost, lower indirect cost and
comparable security to the first one. Similar to the old idea of the project
management triangle, in which one has to choose two from “good, fast, and
cheap” (Van Wyngaard et al., 2012), the three portfolios represent adding
indirect cost, sacrificing security and adding direct cost.

The clusters of points on the Pareto frontier are helpful because they help to
identify which controls, given the model, give similar security. In this
particular example, we can see that the following pairs of sets are considered
comparable in terms of provided security:

  * •

{ViewX physical key 2FA} and {ViewX personal device 2FA, IT network
protection}. This reflects the two points of protection – in the first set,
the control system is strongly protected, while in the second, some of that is
sacrificed to protect the IT network, from which OT can be infected. It is
easier to have the employees use their own devices for 2FA, hence the lower
indirect cost.

  * •

{Monthly updates to site machines} and {Company issued USB devices only}. This
reflects the problem with malware spreading through USB devices. One way is to
restrict USB devices usage, and another is to update even the air-gapped
systems regularly, so they are not vulnerable.

###  5.3. Naked and clothed model

It is possible that there already exist some controls in the analysed system,
while the Pareto frontier assumes there are no controls. In subsection 4.4,
already applied controls are typed in bold.

In the early parts of the analysis, the applied controls were assumed to be in
the system and all controls to be built upon them. We now remove these
protections, creating a so-called _naked model_ , so a comparison can be drawn
between what the optimiser suggests and the protections already in the system.

Figure 6. A portfolio chosen to match the real-life system on which the case
study was done. A vulnerability on the critical path is hovered on. Refer to
subsection 4.4 to see the controls chosen.

In the Figure 6, a portfolio matching controls already applied in the real
system were selected. When compared with portfolios generated in subsection
5.1, it is clear that, in the model, the current controls are neither secure
nor cost-effective.

In the analysis of such cases, it is helpful that CySecTool marks the critical
path, that is, the attack path with the highest probability, with a thicker
line. One vulnerability, Remote File Copy, was hovered on to display detailed
data. When clicked on, we are taken to the source database, where we can learn
that attacks of this kind on Industrial Control Systems were first observed in
2017, under the names WannaCry, Bad Rabbit, NotPetya. (MITRE, 2021b; Slowik,
2019)

Since Industrial Control Systems have lifespans counted in decades, many of
the vulnerabilities and security practices did not exist when the system was
first designed. Indeed, two controls that could help with the vulnerability in
question are listed as a challenge faced by ICS systems: poor network
segmentation and limited access control. These challenges are said to happen
due to an evolution of the cyber threats landscape in Operational Technology
(Lakhani, 2020).

This is where CySecTool may shine. With new threats discovered, the basic
structure of the model can remain the same, but the probabilities of attacks
may change – and new ones can be added. Therefore, cyber security intelligence
can be stored in CySecTool models and updated on demand. This is the goal that
is shared with the ATT&CK database, which is intended to be a living project,
adapting to the changing conditions (Strom et al., 2020; Alexander et al.,
2020).

##  6\. Conclusion

The primary goal of this work was to demonstrate the feasibility of an
optimisation approach to the problem – choosing a security portfolio for a
ClearSCADA system – while suggesting other areas where it may be useful. From
a cyber-security point of view, CySecTool may be useful to answer questions
like – how many network systems of a given type are vulnerable to common
attacks? What is the impact of a newly-discovered vulnerability? What kind of
redundancy would be needed to provide security against it? How has network
security changed over the years, and what are the dangers of the years to
come?

A practical tool based on the optimisation routine was developed. Such a tool
may be used by security professionals to demonstrate to their clients not only
the kind of services they provide but also explain the way vulnerabilities,
both technical and organisational, can be avoided, and if they are not, what
would be their impact. Since the model can be adjusted to a particular type of
service, it would make the decisions and the budget approved seem more
justified to the management, improving overall security awareness.

For researchers and security practitioners, it will allow for a faster
information flow from the ”academic” to the ”practical” side and vice versa.
The academics would be enabled to analyse in detail the newest reports, as we
have done, and pass the results back.

In future research, we hope to see more models applied to the different areas
– both broad, such as general ICS analyses, and narrow, for example, modelling
a newly discovered web browser vulnerability. What needs further attention is
the validation of the results. Decisions made by the system should be compared
against decisions made by practitioners, and the models should be refined in
practice. Overall, our core finding is that CySecTool is ready to be tested in
real conditions and have a positive impact on the security of not only
Industrial Control Systems but also of other networks.

###### Acknowledgements.

This work was partially supported by Sponsor Engineering and Physical Sciences
Research Council https://epsrc.ukri.org/ grants Grant #EP/R002983/1 and Grant
#EP/R004897/1.

## References

  * Khouzani et al. (2019) M. Khouzani, Z. Liu, and P. Malacaria, “Scalable min-max multi-objective cyber-security optimisation over probabilistic attack graphs,” _Eur. J. Oper. Res._ , vol. 278, no. 3, pp. 894 – 903, Apr 2019. [Online]. Available: http://sciencedirect.com/science/article/pii/S0377221719303728
  * Garvey and Patel (2014) P. R. Garvey and S. H. Patel, “Analytical Frameworks to Assess the Effectiveness and Economic-Returns of Cybersecurity Investments,” in _2014 IEEE MILCOM_ , Oct 2014, pp. 136–145.
  * Oppliger (2015) R. Oppliger, “Quantitative Risk Analysis in Information Security Management: A Modern Fairy Tale,” _IEEE Secur. Priv._ , vol. 13, no. 6, pp. 18–21, Nov 2015.
  * CIS (2018) CIS, “Controls,” 2018. [Online]. Available: https://cybernetsecurity.com/industry-papers/CIS-Controls%20Version-7-cc-FINAL.PDF
  * Lampson (1974) B. W. Lampson, “Protection,” _SIGOPS Oper. Syst. Rev._ , vol. 8, no. 1, pp. 18–24, Jan 1974. [Online]. Available: https://doi.org/10.1145/775265.775268
  * Harrison et al. (1976) M. A. Harrison, W. L. Ruzzo, and J. D. Ullman, “Protection in operating systems,” _Commun. ACM_ , vol. 19, no. 8, pp. 461–471, Aug 1976. [Online]. Available: https://doi.org/10.1145/360303.360333
  * Harrison (1985) M. A. Harrison, _Theoretical Issues Concerning Protection In Operating Systems_ , ser. Advances in Computers. Elsevier, 1985, vol. 24, pp. 61 – 100. [Online]. Available: http://sciencedirect.com/science/article/pii/S0065245808603654
  * Snyder (1977) L. Snyder, “On the synthesis and analysis of protection systems,” in _Proceedings of the Sixth ACM Symposium on Operating Systems Principles_ , ser. SOSP ’77. New York: Association for Computing Machinery, 1977, pp. 141–150. [Online]. Available: https://doi.org/10.1145/800214.806557
  * Kordy et al. (2014) B. Kordy, L. Piètre-Cambacédès, and P. Schweitzer, “DAG-based attack and defense modeling: Don’t miss the forest for the attack trees,” _Comp. Sci. Rev._ , vol. 13-14, pp. 1 – 38, 2014. [Online]. Available: http://sciencedirect.com/science/article/pii/S1574013714000100
  * Weiss (1991) J. Weiss, “A system security engineering process,” in _14th National Computer Security Conference_. NCSC, 1991\.
  * Poolsappasit et al. (2012) N. Poolsappasit, R. Dewri, and I. Ray, “Dynamic security risk management using Bayesian attack graphs,” _IEEE Trans. Dependable Secure Comput._ , vol. 9, no. 1, pp. 61–74, 2012.
  * Dewri et al. (2007) R. Dewri, N. Poolsappasit, I. Ray, and D. Whitley, “Optimal security hardening using multi-objective optimization on attack tree models of networks,” in _Proc. of the 14th ACM Conf. on Comp. and Comm. Sec._ , ser. CCS ’07. New York: Association for Computing Machinery, 2007, pp. 204–213. [Online]. Available: https://doi.org/10.1145/1315245.1315272
  * Swiler et al. (2001) L. P. Swiler, C. Phillips, D. Ellis, and S. Chakerian, “Computer-attack graph generation tool,” in _Proc. DARPA Inf. Surv. Conf. and Exp. II. DISCEX’01_ , vol. 2, 2001, pp. 307–321 vol.2.
  * Lippmann et al. (2006) R. Lippmann, K. Ingols, C. Scott, K. Piwowarski, K. Kratkiewicz, M. Artz, and R. Cunningham, “Validating and restoring defense in depth using attack graphs,” in _MILCOM 2006_ , 2006, pp. 1–10.
  * Noel et al. (2009) S. Noel, M. Elder, S. Jajodia, P. Kalapa, S. O’Hare, and K. Prole, “Advances in topological vulnerability analysis,” in _2009 Cybersec. App. Tech. Conf. for HS_ , 2009, pp. 124–129.
  * Ou et al. (2005) X. Ou, S. Govindavajhala, and A. W. Appel, “MulVAL: A logic-based network security analyzer,” in _USENIX Security Symposium_ , 2005.
  * Homer et al. (2009) J. Homer, X. Ou, and D. Schmidt, “A sound and practical approach to quantifying security risk in enterprise networks,” Kansas State University, Tech. Rep., 2009.
  * Shaw (2006) W. T. Shaw, _Cybersecurity for SCADA Systems_. PennWell, 2006.
  * NCSC (2017) NCSC, “Operational technologies,” https://ncsc.gov.uk/guidance/operational-technologies, Feb 2017.
  * Macaulay and Singer (2016) T. Macaulay and B. L. Singer, “Threats to ICS,” in _Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS_. Auerbach, 2016, pp. 110–141.
  * Broad et al. (2011) W. J. Broad, J. Markoff, and D. E. Sanger, “Israeli test on worm called crucial in Iran nuclear delay,” Jan 2011. [Online]. Available: https://nytimes.com/2011/01/16/world/middleeast/16stuxnet.html
  * Kushner (2013) D. Kushner, “The real story of Stuxnet,” Feb 2013. [Online]. Available: https://spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet
  * Hahn (2016) A. Hahn, “Operational Technology and Information Technology in Industrial Control Systems,” in _Cyber-security of SCADA and Other Industrial Control Systems_ , E. J. M. Colbert and A. Kott, Eds. Cham: Springer, 2016, pp. 51–68. [Online]. Available: https://doi.org/10.1007/978-3-319-32125-7_4
  * Lakhani (2020) A. Lakhani, “Evolution of cyber threats in OT environments,” https://fortinet.com/blog/industry-trends/evolution-of-cyber-threats-in-ot-environments, Jun 2020.
  * Duggan (2005) D. P. Duggan, _Penetration Testing of Industrial Control Systems_. Sandia National Laboratories, 2005.
  * Rencelj Ling and Ekstedt (2021) E. Rencelj Ling and M. Ekstedt, “Generating threat models and attack graphs based on the IEC 61850 System Configuration Description Language,” in _Proc. of the 2021 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems_. New York, NY, USA: ACM, 2021, pp. 98–103. [Online]. Available: https://doi.org/10.1145/3445969.3450421
  * Katsikeas et al. (2019) S. Katsikeas, P. Johnson, S. Hacks, and L. Robert, “Probabilistic modeling and simulation of vehicular cyber attacks: An application of the Meta Attack Language,” in _Proc. of the 5th International Conf. on Information Systems Security and Privacy_ , Feb 2019. [Online]. Available: https://doi.org/10.5220/0007247901750182
  * Austin et al. (2020) W. Austin, A. Henry, H. Ben, and D. Greg, “JSON schema: A media type for describing JSON documents,” Dec 2020. [Online]. Available: https://datatracker.ietf.org/doc/draft-bhutton-json-schema/00/
  * Jahan et al. (2016) A. Jahan, K. L. Edwards, and M. Bahraminasab, _Multi-criteria Decision Analysis for Supporting the Selection of Engineering Materials in Product Design_ , 2nd ed., A. Jahan, K. L. Edwards, and M. Bahraminasab, Eds. Butterworth-Heinemann, 2016. [Online]. Available: http://sciencedirect.com/science/article/pii/B9780081005361000047
  * McKerns et al. (2012) M. M. McKerns, L. Strand, T. Sullivan, A. Fang, and M. A. G. Aivazis, “Building a framework for predictive science,” _CoRR_ , 2012. [Online]. Available: http://arxiv.org/abs/1202.1056
  * Mitchell and Dunning (2011) S. Mitchell and I. Dunning, “PuLP: A linear programming toolkit for Python,” 2011.
  * MITRE (2021a) MITRE, “Supply Chain Compromise — ATT&CK for Industrial Control Systems,” https://collaborate.mitre.org/attackics/index.php/Technique/T0862, Apr 2021\.
  * Pennington et al. (2019) A. Pennington, A. Applebaum, K. Nickels, T. Schulz, B. Strom, and J. Wunder, _Getting started with ATT &CK_. MITRE, Oct 2019. [Online]. Available: https://www.mitre.org/sites/default/files/publications/mitre-getting-started-with-attack-october-2019.pdf
  * Nickels (2018) K. Nickels, “Using ATT&CK to advance CTI – part 2,” Nov 2018. [Online]. Available: https://medium.com/mitre-attack/using-att-ck-to-advance-cyber-threat-intelligence-part-2-6f21fdba80c
  * Alexander et al. (2020) O. Alexander, M. Belisle, and J. Steele, _ATT &CK for Industrial Control Systems: Design and Philosophy_. MITRE, Mar 2020.
  * Jordan et al. (2021) B. Jordan, R. Piazza, and T. Darley, _STIX™ Version 2.1_. OASIS Open 2021, 2021.
  * Microsoft Corporation (2012) Microsoft Corporation, “Allowing only signed application to run,” https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008, Sep 2012.
  * RMF FM (2008) RMF FM, “Tramwajowy sabotaż w Łodzi: Chłopiec działał od pół roku,” https://archive.is/08qSk (Polish), Jan 2008.
  * Martin (2017) K. M. Martin, “The DES. The AES,” in _Everyday Cryptography_. Oxford University Press, 2017, pp. 130–143.
  * Strom et al. (2020) B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas, _ATT &CK: Design and Philosophy_. McLean, VA: MITRE, Mar 2020. [Online]. Available: https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf
  * Van Wyngaard et al. (2012) C. J. Van Wyngaard, J. H. C. Pretorius, and L. Pretorius, “Theory of the triple constraint — a conceptual review,” in _2012 IEEE Int. Conf. on Ind. Eng. and Eng. Manag._ , Dec 2012, pp. 1991–1997.
  * MITRE (2021b) MITRE, “Remote File Copy — ATT&CK for Industrial Control Systems,” https://collaborate.mitre.org/attackics/index.php/Technique/T0867, Apr 2021\.
  * Slowik (2019) J. Slowik, “Implications of IT ransomware for ICS environments,” https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/, Apr 2019.


# Almost synchronous correlations and Tomita-Takesaki theory

Amine Marrakchi  Université de Lyon, ENSL, CNRS, France  amine.marrakchi@ens-
lyon.fr and  Mikael De La Salle  Université de Lyon, Université Lyon 1, CNRS,
France<EMAIL_ADDRESS>
###### Abstract.

The aim of this note is to present a “type III” generalization of a
distribution lemma of Connes. We then derive, following Vidick, consequences
on infinite-dimensional quantum strategies for non-local games.

MdlS was funded by the ANR grant Noncommutative analysis on groups and quantum
groups ANR-19-CE40-0002-01

Non-local games are the central objects in the recent solution to Connes’
embedding problem [JNV+20]. In fact, all the games considered there have the
additional property of being synchronous. Let us recall the vocabulary.

A synchronous game [HMPS19] is a tuple $\mathcal{G}=(X,\nu,A,D)$ where $X$ and
$A$ are finite sets, $\nu$ is a symmetric probability measure on $X\times X$
and $D\colon X\times X\times A\times A\to\\{0,1\\}$ is a symmetric function
satisfying $D(x,x,a,b)=1_{a=b}$ for every $x\in X$ and $a,b\in A$. If
$\alpha\in(0,1)$, we say that the synchronous game $\mathcal{G}$ is
$\alpha$-synchronous if $\nu(x,x)\geq\alpha\sum_{y}\nu(x,y)$ for every $x\in
X$.

A commuting strategy for $\mathcal{G}$ is a family of probability
distributions on $A\times A$ of the form $\mathcal{P}_{x,y}(a,b)=\langle
p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle$ where $\xi$ is a unit vector in a
Hilbert space $\mathcal{H}$, $(p^{x}_{a})_{a\in A}$ and
$(\tilde{p}^{y}_{b})_{b\in A}$ are partitions of unity (PVM) on $\mathcal{H}$
such that $[p^{x}_{a},\tilde{p}^{y}_{b}]=0$ for every $x,y,a,b$. A synchronous
strategy [PSS+16] for $\mathcal{G}$ is a commuting strategy such that
$\mathcal{P}_{x,x}(a,b)=0$ for every $x\in X$ and $a\neq b$. The value of the
strategy $\mathcal{P}$ at the game $\mathcal{G}$ is

$\operatorname{val}(\mathcal{G},\mathcal{P})=\int\sum_{a,b}D(x,y,a,b)\mathcal{P}_{x,y}(a,b)d\nu(x,y).$

So, given a synchronous game, synchronous strategies are those strategies that
maximize

$\int_{X}\sum_{a,b}D(x,y,a,b)\mathcal{P}_{x,y}(a,b)d\nu(x,x)=\int_{X}\sum_{a}\mathcal{P}_{x,y}(a,a)d\nu(x,x).$

It is therefore natural to expect that synchronous games that have a value
close to $1$ have a synchronous value close to $1$. The next result confirms
this expectation.

######  Theorem 0.1.

Let $\varepsilon,\alpha\in(0,1)$ and $\mathcal{G}$ be an $\alpha$-synchronous
game admitting a commuting strategy with value $\geq 1-\varepsilon$. Then
$\mathcal{G}$ admits a synchronous strategy with value $\geq
1-c(\varepsilon/\alpha)^{\frac{1}{4}}$.

When only finite-dimensionnal Hilbert spaces are allowed, Theorem 0.1 was
proved by Vidick [Vid22]. The generalization to infinite dimensions has also
independently been obtained by Lin [Lin23] by a different route.

Observe (see [PSS+16, Theorem 5.5]) that synchronous strategies are exactly
the strategies of the form $\mathcal{P}_{x,y}(a,b)=\tau(p^{x}_{a}p^{y}_{b})$
for a family of partitions of unity $(p^{x}_{a})_{a\in A}$ in a von Neumann
algebra $\mathcal{N}$ with a tracial state $\tau$. Therefore, the elementary
statement of Theorem 0.1 can be equivalently stated in von Neumann algebraic
language as follows.

######  Theorem 0.2.

Let $\varepsilon,\alpha\in(0,1)$ and $\mathcal{G}$ be an $\alpha$-synchronous
game. Assume that there is a von Neumann algebra $\mathcal{M}\subset
B(\mathcal{H})$, a unit vector $\xi\in\mathcal{H}$ a two families of
partitions of the unity $(p^{x}_{a})_{a\in A}\subset\mathcal{M}$ and
$(\tilde{p}^{x}_{a})_{a\in A}\subset\mathcal{M}^{\prime}$ such that

$\int\sum_{a,b}D(x,y,a,b)\langle p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle
d\nu(x,y)\geq 1-\varepsilon.$

Then there is a von Neumann algebra $\mathcal{N}$ with a tracial state $\tau$
and a family of partitions of unity $(r^{x}_{a})_{a\in A}\subset\mathcal{N}$
such that

$\int\sum_{a,b}D(x,y,a,b)\tau(r^{x}_{a}r^{y}_{b})d\nu(x,y)\geq
1-c(\varepsilon/\alpha)^{\frac{1}{4}}.$

What is amusing to notice is that Theorem 0.1 is very elementary to state, but
we do not see any elementary proof of it. Both Lin’s and our proofs rely on
quite advanced von Neumann algebra techniques (the Connes-Tomita-Takesaki
theory). More precisely our proof relies on a new “type III” generalization of
a distribution lemma of Connes [Con76]. We believe that this result
(Proposition 1.3) is of independent interest. Lin does not rely on our type
III generalization of Connes’ Lemma, but shows that arbitrary commuting
correlations can be approximated by correlations coming from finite von
Neumann algebras, and then runs Vidick’s proof in the tracial setting. Our
proof has the feature that the von Neumann algebra $\mathcal{M}$ is completely
explicit : $\mathcal{M}$ can be taken as a finite corner of the _core_ of
$\mathcal{M}$ appearing in the Connes-Tomita-Takesaki theory (as the crossed
product of $\mathcal{M}$ by its modular flow), see Corollary 3.1. In the
particular case when $\mathcal{M}$ is semi-finite, $\mathcal{N}$ can even be
taken as a finite corner of $\mathcal{M}$, see Corollary 3.2.

##  1\. Connes’ lemma

Let $\mathcal{M}$ be a von Neumann algebra. There is a unique (up to unique
isomorphism) tuple $(c(\mathcal{M}),\tau,\theta,\iota)$ of a von Neumann
algebra $c(\mathcal{M})$ with a faithful semifinite trace $\tau$, and
continuous group homomorphism
$\theta\colon\mathbf{R}\to\operatorname{Aut}(\mathcal{M})$ and an embedding
$\iota\colon\mathcal{M}\to c(\mathcal{M})$ satisfying the conditions
$\iota(\mathcal{M})=\\{x\in c(\mathcal{M})\mid\theta_{s}(x)=x\forall
s\in\mathbf{R}\\}$ and

(1.1) $\tau\circ\theta_{s}=e^{-s}\tau\forall s\in\mathbf{R}.$

It is called the core of $\mathcal{M}$. See [FT01, Theorem 3.3, 3.4 and 3.5]
or [Tak03, Theorem 6.11].

######  Example 1.1.

If $\mathcal{M}=\mathbf{C}$, $c(\mathcal{M})$ can be realized as
$L_{\infty}(\mathbf{R})$ with translation action
$\theta^{\mathbf{C}}_{s}f=f(\cdot-s)$ and the trace $\tau^{\mathbf{C}}(f)=\int
f(s)e^{-s}ds$. If $\mathcal{M}$ carries a semifinite trace $\tau_{0}$, then
$c(\mathcal{M})=c(\mathbf{C})\otimes\mathcal{M}$ with the natural action
$\theta^{\mathbf{C}}_{s}\otimes 1$ and trace
$\tau^{\mathbf{C}}\otimes\tau_{0}$. If $\mathcal{M}$ is not semifinite, the
construction is much more difficult, it is the accomplishment of the Tomita-
Takesaki theory.

Haagerup’s non-commutative $L_{p}$ space $L_{p}(\mathcal{M})$ [Haa79] is the
space of $\tau$-measurable operators affiliated with $c(\mathcal{M})$ and
satisfying $\theta_{s}(x)=e^{-\frac{s}{p}}x$ for all $s$. Then for $1\leq
p<\infty$, $\|x\|_{p}:=\tau(\chi_{(1,\infty)}(|x|))^{\frac{1}{p}}$ is a
complete norm on $L_{p}(\mathcal{M})$, and
$(L_{2}(\mathcal{M}),\|\cdot\|_{2})$ is a Hilbert space.

The fundamental fact due to Haagerup that we will use is that the non-
commutative $L_{1}$ space $L_{1}(\mathcal{M})$ is naturally identified with
$\mathcal{M}_{*}$. Explicitely, the set of positive elements
$\varphi\in\mathcal{M}_{*}$ is in bijection with the positive elements $x\in
L_{1}(\mathcal{M})$, the bijection being characterized by

$\varphi\Big{(}\int_{\mathbf{R}}\theta_{s}(z)ds\Big{)}=\tau(zx)$

for every positive $z\in c(\mathcal{M})$. We write
$\varphi(1)=\operatorname{tr}(x)$, and the linear map $\operatorname{tr}$
extends to a linear map $L_{1}(\mathcal{M})\to\mathbf{R}$ that satisfies
$\operatorname{tr}(xy)=\operatorname{tr}(yx)$ for every $1\leq p\leq\infty$
and $x\in L_{p}(\mathcal{M})$, $y\in L_{p^{\prime}}(\mathcal{M})$. We will
make several uses of the following lemma.

######  Lemma 1.2.

Let $1\leq p<\infty$. If $x\in L_{p}(\mathcal{M})$ and $y\in
L_{p^{\prime}}(\mathcal{M})$ are positive, then

$\operatorname{tr}(xy)=\tau(x^{1-p}\chi_{(1,\infty)}(x)y).$

###### Proof.

Define $z=x^{-p}\chi_{(1,\infty)}(x)$ with the convention
$0^{-p}\chi_{(1,\infty)}(0)=0$. Then we have
$\int_{\mathbf{R}}\theta_{s}(z)=\operatorname{supp}(x)$ (see the proof of
[Ter81, Lemma 5] for the details). By the definition of $\operatorname{tr}$,
we deduce

$\tau(zx^{\frac{1}{2}}yx^{\frac{1}{2}})=\operatorname{tr}(x^{\frac{1}{2}}yx^{\frac{1}{2}}).$

The lemma follows by the trace property. ∎

A particular case of this lemma is that for $x\in L_{p}(\mathcal{M})$,
$\|x\|_{p}=(\operatorname{tr}(|x|^{p}))^{\frac{1}{p}}$.

We warn the reader that they are two different non-commutative $L_{p}$ spaces
involved: Haagerup’s $L_{p}(\mathcal{M})$ that we have just defined, and the
tracial space $L_{p}(c(\mathcal{M}),\tau)$, which is the space of operators
affiliated with $c(\mathcal{M})$ and satisfying
$\tau(|x|^{p})^{\frac{1}{p}}<\infty$. They are both made of operators
affiliated with $c(\mathcal{M})$ (but we have $L_{p}(c(\mathcal{M}),\tau)\cap
L_{p}(\mathcal{M})=\\{0\\}$). To avoid confusion, we will write
$\|x\|_{L_{p}(\mathcal{M})}$ for the first, and $\|x\|_{L_{p}(\tau)}$ for the
second.

Our goal is precisely to compare these two non-commutative $L_{p}$ spaces for
$p=2$ (this can be combined with results from [Ric15] to obtain similar
inequalities for other values of $p$). This generalizes [Con76, Lemma 1.2.6]
to non-semifinite von Neumann algebras.

######  Proposition 1.3.

For every $x,y\in L_{2}(\mathcal{M})^{+}$,

$\|x-y\|_{L_{2}(\mathcal{M})}^{2}\leq\|\chi_{(1,\infty)}(x)-\chi_{(1,\infty)}(y)\|_{L_{2}(\tau)}^{2}\leq\|x-y\|_{L_{2}(\mathcal{M})}\|x+y\|_{L_{2}(\mathcal{M})}$

A moment of thoughts and a look at Example 1.1 reveals for, for $\mathcal{M}$
semi-finite, Proposition 1.3 is indeed an equivalent form of [Con76, Lemma
1.2.6].

For the proof, we start with the following key observation of Connes [Con76,
Proposition 1.1] that gives the existence of a joint spectral measure for two
positive operators in a tracial von Neumann algebra.

######  Proposition 1.4 (Connes).

Let $\mathcal{M}$ be a von Neumann algebra with a normal semifinite trace
$\tau$. Let $x$ and $y$ be two unbounded positive operators affilitated with
$\mathcal{M}$. Let $\nu_{x}:A\mapsto\tau(\chi_{A}(x))$ and
$\nu_{y}:B\mapsto\tau(\chi_{B}(y))$ be the spectral measures of $x$ and $y$
respectively. Suppose that $\nu_{x}|_{A_{0}}$ and $\nu_{y}|_{B_{0}}$ are
$\sigma$-finite for some Borel subsets $A_{0},B_{0}\subset\mathbf{R}_{+}$.
Then there exists a unique $\sigma$-finite measure $\nu$ on
$(A_{0}\times\mathbf{R}_{+})\cup(\mathbf{R}_{+}\times B_{0})$ such that

$\tau(\chi_{A}(x)\chi_{B}(y))=\nu(A\times B)$

for all Borel sets $A,B\subset\mathbf{R}_{+}$ such that $A\subset A_{0}$ or
$B\subset B_{0}$.

Then for every pair of Borel functions
$f,g:\mathbf{R}_{+}\rightarrow\mathbf{R}_{+}$ such that $f$ is supported on
$A_{0}$ or $g$ is supported on $B_{0}$, we have

$\tau(f(x)g(y))=\int_{\mathbf{R}_{+}^{2}}f(u)g(v)d\nu(u,v).$

######  Proposition 1.5.

Let $x,y$ be a pair of positive elements of $L_{2}(\mathcal{M})$. There exists
a unique finite measure $\mu=\mu_{x,y}$ on $[0,1]$ such that for every pair of
Borel functions $f,g:\mathbf{R}_{+}\rightarrow\mathbf{R}_{+}$ satisfying
$f(0)g(0)=0$, we have

$\tau(f(x)g(y))=\int_{0}^{1}\int_{0}^{\infty}f\left(\frac{\lambda}{\sqrt{r}}\right)g\left(\frac{1-\lambda}{\sqrt{r}}\right)drd\mu(\lambda).$

Moreover, we have

(1.2) $\displaystyle\|x\|_{L_{2}(\mathcal{M})}^{2}$
$\displaystyle=\int\lambda^{2}d\mu(\lambda),$ (1.3)
$\displaystyle\|y\|_{L_{2}(\mathcal{M})}^{2}$
$\displaystyle=\int(1-\lambda)^{2}d\mu(\lambda),$ (1.4)
$\displaystyle\|\chi_{(1,\infty)}(x)-\chi_{(1,\infty)}(y)\|_{L_{2}(\tau)}^{2}$
$\displaystyle=\int|2\lambda-1|d\mu(\lambda)$ (1.5) $\displaystyle\langle
x,y\rangle_{L_{2}(\mathcal{M})}$
$\displaystyle=\int\lambda(1-\lambda)d\mu(\lambda).$

###### Proof.

We apply Proposition 1.4. Note that the spectral measures $\nu_{x}$ and
$\nu_{y}$ are finite on $[\varepsilon,+\infty)$ for every $\varepsilon>0$. In
particular, there are $\sigma$-finite on $\mathbf{R}_{+}^{*}$ (but not
necessarily on $\mathbf{R}_{+}$ since we have $\nu_{x}(\\{0\\})=\infty$ if
$\operatorname{supp}(x)\neq 1$). Therefore, by Proposition 1.4, there is a
unique $\sigma$-finite measure $\nu$ on
$\mathbf{R}_{+}^{2}\setminus\\{(0,0)\\}$ such that

(1.6) $\tau(f(x)g(y))=\int f(u)g(v)d\nu(u,v)$

for every pair of Borel functions
$f,g:\mathbf{R}_{+}\rightarrow\mathbf{R}_{+}$ such that $f(0)g(0)=0$. In fact
$\nu$ is even a Radon measure on the locally compact space
$\mathbf{R}^{2}_{+}\setminus\\{(0,0)\\}$ since it is finite on
$([\varepsilon,+\infty)\times\mathbf{R}_{+})\cup(\mathbf{R}_{+}\times[\varepsilon,+\infty))$
for every $\varepsilon>0$.

By (1.1), we have

$e^{-2s}\tau(f(x)g(y))=\tau(\theta_{2s}(f(x)g(y)))=\tau(f(e^{-s}x)g(e^{-s}y)$

Since $\nu$ is uniquely characterized by 1.6, we get
$d\nu(e^{s}u,e^{s}v)=e^{-2s}d\nu(u,v)$ for all $s\in\mathbf{R}$. Let $\rho$ be
the Radon measure on $[0,1]\times\mathbf{R}^{*}_{+}$ obtained as the pull-back
of $\nu$ by the homeomorphism

$[0,1]\times\mathbf{R}^{*}_{+}\ni(\lambda,r)\mapsto\left(\frac{\lambda}{\sqrt{r}},\frac{1-\lambda}{\sqrt{r}}\right)\in\mathbf{R}^{2}_{+}\setminus\\{(0,0)\\}.$

Then we have $d\rho(\lambda,e^{s}r)=e^{s}d\rho(\lambda,r)$. Therefore, $\rho$
must be of the form $\rho=\mu\otimes dr$ for some finite measure $\mu$ on
$[0,1]$. Then a change of variable in equation 1.6 allows us to conclude that

$\tau(f(x)g(y))=\int_{0}^{1}\int_{0}^{\infty}f\left(\frac{\lambda}{\sqrt{r}}\right)g\left(\frac{1-\lambda}{\sqrt{r}}\right)drd\mu(\lambda)$

for every pair of Borel functions
$f,g:\mathbf{R}_{+}\rightarrow\mathbf{R}_{+}$ satisfying $f(0)g(0)=0$.

Now, we have to prove the second part. The equations (1.2), (1.3) and (1.4)
are immediate. For example, taking $f=\chi_{(1,\infty)}$ and $g=1$, we obtain

$\|x\|_{L_{2}(\mathcal{M})}^{2}=\tau(\chi_{(1,\infty)}(x))=\int_{0}^{1}\int_{0}^{\infty}1_{r<\lambda^{2}}drd\mu(\lambda)=\int_{0}^{1}\lambda^{2}d\mu(\lambda).$

This proves (1.2). The equality (1.3) is proved in the same way. For (1.4),
take $f=g=\chi_{(1,\infty)}$:

$\displaystyle\|\chi_{(1,\infty)}(x)-\chi_{(1,\infty)}(y)\|_{L_{2}(\tau)}^{2}$
$\displaystyle=\int\int_{0}^{\infty}|1_{r<\lambda^{2}}-1_{r<(1-\lambda)^{2}}|^{2}drd\mu(\lambda)$
$\displaystyle=\int_{0}^{1}|\lambda^{2}-(1-\lambda)^{2}|d\mu(\lambda)$
$\displaystyle=\int_{0}^{1}|2\lambda-1|d\mu(\lambda).$

The last equality (1.5) is slightly more involved. By Lemma 1.2, if
$f(t)=t^{-1}\chi_{(1,\infty)}(t)$, we obtain

$\langle x,y\rangle_{L_{2}(\mathcal{M})}=\operatorname{tr}(xy)=\tau(f(x)y).$

This is equal to

$\displaystyle\int_{0}^{1}\int_{0}^{\infty}f\left(\frac{\lambda}{\sqrt{r}}\right)\frac{1-\lambda}{\sqrt{r}}d\mu(\lambda)$
$\displaystyle=\int_{0}^{1}\int_{0}^{\lambda^{2}}\frac{\sqrt{r}}{\lambda}\frac{1-\lambda}{\sqrt{r}}drd\mu(\lambda)$
$\displaystyle=\int_{0}^{1}\lambda(1-\lambda)d\mu(\lambda).\qed$

###### Proof of Proposition 1.3.

By Proposition 1.5,

$\displaystyle\|x-y\|_{L_{2}(\mathcal{M})}^{2}$
$\displaystyle=\|x\|_{L_{2}(\mathcal{M})}^{2}+\|y\|_{L_{2}(\mathcal{M})}^{2}-2\langle
x,y\rangle_{L_{2}(\mathcal{M})}$
$\displaystyle=\int(\lambda^{2}+(1-\lambda)^{2}-2\lambda(1-\lambda))d\mu(\lambda)=\int(1-2\lambda)^{2}d\mu(\lambda).$

In the same way,

$\|x+y\|_{L_{2}(\mathcal{M})}^{2}=\int 1d\mu(\lambda).$

So the claimed inequality is equivalent to

$\int(1-2\lambda)^{2}d\mu(\lambda)\leq\int|2\lambda-1|d\mu(\lambda)\leq\sqrt{\int(1-2\lambda)^{2}d\mu(\lambda)\int
1d\mu(\lambda)}.$

This first inequality is clear because $|1-2\lambda|\leq 1$ on $[0,1]$. The
second inequality is the Cauchy-Schwarz inequality. ∎

A particular case of Proposition 1.3 is the following. Here and in the whole
note, we write $[x,y]$ for the commutator $xy-yx$. Also, a partition of the
unity or PVM in $\mathcal{M}$ is a finite family $(p_{1},\dots,p_{n})$ of
self-adjoint projections that sum to $1$. A finite family
$(p_{1},\dots,p_{n})$ of positive operators that sum to $1$ is called a POVM.

######  Corollary 1.6.

Let $x\in L_{2}(\mathcal{M})^{+}$ of norm $1$, and
$(p_{1},\dots,p_{n})\subset\mathcal{M}$ be a partition of the unity. Let
$q=\chi_{(1,\infty)}(x)$. We have

$\sum_{k}\|[p_{k},x]\|_{L_{2}(\mathcal{M})}^{2}\leq\sum_{k}\|[p_{k},q]\|_{L_{2}(\tau)}^{2}\leq
2\|x\|_{L_{2}(\mathcal{M})}\Big{(}\sum_{k}\|[p_{k},x]\|_{L_{2}(\mathcal{M})}^{2}\Big{)}^{\frac{1}{2}}.$

###### Proof.

Let $U=\sum_{k}e^{\frac{2i\pi k}{n}}p_{k}\in U(\mathcal{M})$. Then by the
orthogonality of the characters of $\mathbf{Z}/n\mathbf{Z}$, we have

$\frac{1}{n}\sum_{k=1}^{n}\|U^{k}xU^{-k}-x\|_{L_{2}(\mathcal{M})}^{2}=\frac{1}{n}\sum_{k=1}^{n}\|[U^{k},x]\|_{L_{2}(\mathcal{M})}^{2}=\sum_{k}\|[p_{k},x]\|_{L_{2}(\mathcal{M})}^{2}.$

and similarly

$\frac{1}{n}\sum_{k=1}^{n}\|U^{k}qU^{-k}-q\|_{L_{2}(\tau)}^{2}=\sum_{k}\|[p_{k},q]\|_{L_{2}(\tau)}^{2}.$

So the corollary follows from Proposition 1.3 and the Cauchy-Schwarz
inequality, because

$\left(\frac{1}{n}\sum_{k=1}^{n}\|U^{k}xU^{-k}+x\|_{L_{2}(\mathcal{M})}^{2}\right)^{\frac{1}{2}}\leq
2\|x\|_{L_{2}(\mathcal{M})}.$

∎

##  2\. Applications to correlations

Let us introduce some notation. If $\mathcal{M}\subset B(\mathcal{H})$ is a
von Neumann algebra and $\xi\in\mathcal{H}$ is a unit vector, define
$q_{\xi}\in c(\mathcal{M})$ by $q_{\xi}=\chi_{(1,\infty)}(h_{\xi})$, where
$h_{\xi}\in L_{1}(\mathcal{M})$ is the element corresponding to the the vector
state $\langle\cdot\xi,\xi\rangle$ on $\mathcal{M}$ through the isomorphism
between $\mathcal{M}_{*}$ and $L_{1}(\mathcal{M})$ described previously. It is
a trace $1$ projection, because
$\tau(q_{\xi})=\operatorname{tr}(h_{\xi})=\langle 1\xi,\xi\rangle=1$.

######  Theorem 2.1.

Let $\mathcal{M}\subset B(\mathcal{H})$ be a von Neumann algebra,
$\xi\in\mathcal{H}$ be a unit vector.

Let $X,A$ be finite sets, $\nu$ be a symmetric probability measure on $X\times
X$ with marginal $\mu$. For every $x\in X$, let $(p^{x}_{a})_{a\in
A}\subset\mathcal{M}$ and $(\tilde{p}^{x}_{a})_{a\in
A}\subset\mathcal{M}^{\prime}$ be partitions of the unity.

If $\int\sum_{a\in A}\langle p^{x}_{a}\tilde{p}^{x}_{a}\xi,\xi\rangle
d\mu(x)\geq 1-\delta$, then

$\int\sum_{a,b\in A}\Big{|}\langle
p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle-\tau(q_{\xi}p^{x}_{a}q_{\xi}p^{y}_{b}q_{\xi})\Big{|}d\nu(x,y)\lesssim\delta^{\frac{1}{4}}.$

Moreover, for every $x\in X$ there is a partition of the unity
$(r^{x}_{a})_{a\in A}\subset q_{\xi}c(\mathcal{M})q_{\xi}$ such that

$\int\sum_{a,b\in
A}\Big{|}\operatorname{tr}(p^{x}_{a}h^{\frac{1}{2}}p^{y}_{b}h^{\frac{1}{2}})-\tau(r^{x}_{a}r^{y}_{b})\Big{|}d\nu(x,y)\lesssim\delta^{\frac{1}{4}}.$

Given Theorem 1.3, the proof is essentially the same as the proof of [Vid22,
Theorem 3.1], but we write the proof for completeness.

We shall use the following elementary Hilbert space lemma.

######  Lemma 2.2.

Let $\mathcal{K}$ be a Hilbert space, $(\Omega,m)$ be a measure space and
$\xi,\eta\in L_{2}(\Omega,m;\mathcal{K})$. Then

$\int\big{|}\|\xi(\omega)\|^{2}-\|\eta(\omega)\|^{2}\big{|}dm(\omega)\leq\|\xi-\eta\|\|\xi+\eta\|.$

###### Proof.

For any vectors in a Hilbert space, the inequality

$\big{|}\|u\|^{2}-\|v\|^{2}\big{|}\leq\|u-v\|\|u+v\|$

is easy: squaring both sides, it is equivalent to

$\|u\|^{4}+\|v\|^{4}-2\|u\|^{2}\|v\|^{2}\leq\|u\|^{4}+\|v\|^{4}+2\|u\|^{2}\|v\|^{2}-4|\Re\langle
u,v\rangle|^{2},$

which is just the Cauchy-Schwarz inequality. Taking $u=\xi(\omega)$ and
$v=\eta(\omega)$, integrating and using the Cauchy-Schwarz inequality in
$L_{2}(\Omega,m)$, we deduce the lemma. ∎

The next lemma is the particular case of Theorem 2.1 for strategies that are
symmetric.

######  Lemma 2.3.

Let $\mathcal{M}\subset B(\mathcal{H})$ be a von Neumann algebra, $h\in
L_{1}(\mathcal{M})_{+}$ of norm $1$, and $q=\chi_{(1,\infty)}(h)\in
L_{2}(c(\mathcal{M}))$.

Let $X,A,\nu,\mu$ be as in Theorem 2.1 and, for every $x\in X$, let
$(p^{x}_{a})_{a\in A}\subset\mathcal{M}$ be a partition of the unity.

If $\int\sum_{a\in
A}\|[p^{x}_{a},h^{\frac{1}{2}}]\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)\leq\delta$,
then

$\int\sum_{a,b\in
A}\Big{|}\operatorname{tr}(p^{x}_{a}h^{\frac{1}{2}}p^{y}_{b}h^{\frac{1}{2}})-\tau(qp^{x}_{a}qp^{y}_{b}q)\Big{|}d\nu(x,y)\leq
4\delta^{\frac{1}{4}}.$

Moreover, for every $x\in X$ there is a partition of the unity
$(r^{x}_{a})_{a\in A}\subset qc(\mathcal{M})q$ such that

$\int\sum_{a,b\in
A}\Big{|}\operatorname{tr}(p^{x}_{a}h^{\frac{1}{2}}p^{y}_{b}h^{\frac{1}{2}})-\tau(r^{x}_{a}r^{y}_{b})\Big{|}d\nu(x,y)\leq
38\delta^{\frac{1}{4}}.$

###### Proof.

Let $\Omega=X\times X\times A\times A$ and $m$ the product of the measure
$\nu$ and the counting measure on $A\times A$. Consider the norm $1$ elements
$C_{1},C_{2},C_{3},C_{4}$ of $L_{1}(\Omega,m)$ defined by

$\displaystyle C_{1}(x,y,a,b)$
$\displaystyle=\operatorname{tr}(h^{\frac{1}{2}}p^{y}_{b}h^{\frac{1}{2}}p^{x}_{a})=\|p^{x}_{a}h^{\frac{1}{2}}p^{y}_{b}\|_{L_{2}(\mathcal{M})}^{2},$
$\displaystyle C_{2}(x,y,a,b)$
$\displaystyle=\operatorname{tr}(hp^{x}_{a}p^{y}_{b}p^{x}_{a})=\|h^{\frac{1}{2}}p^{x}_{a}p^{y}_{b}\|_{L_{2}(\mathcal{M})}^{2},$
$\displaystyle C_{3}(x,y,a,b)$
$\displaystyle=\tau(qp^{x}_{a}p^{y}_{b}p^{x}_{a})=\|qp^{x}_{a}p^{y}_{b}\|_{L_{2}(\tau)}^{2},$
$\displaystyle C_{4}(x,y,a,b)$
$\displaystyle=\tau(qp^{y}_{b}qp^{x}_{a}q)=\|p^{x}_{a}qp^{y}_{b}\|_{L_{2}(\tau)}^{2}.$

We have $C_{2}=C_{3}$ by Lemma 1.2. Moreover, by Lemma 2.2, we can bound

$\displaystyle\|C_{1}-C_{2}\|_{1}^{2}$
$\displaystyle\leq{4\int\sum_{a,b}\|[p^{x}_{a},h^{\frac{1}{2}}]p^{y}_{b}\|_{L_{2}(\mathcal{M})}^{2}d\nu(x,y)}$
$\displaystyle={4\int\sum_{a}\|[p^{x}_{a},h^{\frac{1}{2}}]\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)}\leq{4\delta}.$

In the same way, by Lemma 2.2 and Corollary 1.6, we obtain

(2.1) $\|C_{3}-C_{4}\|_{1}^{2}\leq
4\int\sum_{a}\|[p^{x}_{a},q]\|_{L_{2}(\tau)}^{2}d\mu(x)\leq 8\sqrt{\delta}.$

We deduce

$\|C_{1}-C_{4}\|_{1}=\|C_{1}-C_{2}+C_{3}-C_{4}\|_{1}\leq
2\sqrt{\delta}+2\sqrt{2}\delta^{\frac{1}{4}}.$

We obtain

$\|C_{1}-C_{4}\|_{1}\leq\min(2,2\sqrt{\delta}+2\sqrt{\sqrt{2\delta}})\leq
4\delta^{\frac{1}{4}},$

which is precisely the first conclusion of the lemma.

For the second conclusion, we use an orthogonalization result for POVMs that
originates from the work of Kempe and Vidick [KV11]. We use a form that
applies to infinite dimensional space and with the right dependance from
[dlS22]. We can rewrite the second inequality in (2.1) as

$\int\sum_{a}\tau((qp^{x}_{a}q)^{2})d\mu(x)\geq 1-8\sqrt{\delta},$

so by [dlS22, Theorem 1.2] for every $x\in X$, there is a partition of the
unity $(r^{x}_{a})_{a\in A}$ in $qc(\mathcal{M})q$ such that

$\sum_{a}\tau(|qp^{x}_{a}q-r^{x}_{a}|^{2})\leq 9(1-\tau((qp^{x}_{a}q)^{2})).$

As a consequence,

$\int\sum_{a}\tau(|qp^{x}_{a}q-r^{x}_{a}|^{2})d\mu(x)\leq 72\sqrt{\delta}.$

Using twice Lemma 2.2 gives

$\int\sum_{a,b}|\tau(qp^{y}_{b}qp^{x}_{a}q)-\tau(r^{y}_{b}r^{x}_{a})|d\nu(x,y)\leq
4\sqrt{72\sqrt{\delta}}\leq 34\delta^{\frac{1}{4}}.\qed$

###### Proof of Theorem 2.1.

The idea is simple: the assumption of the theorem implies that the correlation
$\langle p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle$ is close to the symmetric
correlation
$\operatorname{tr}(p^{x}_{a}h_{\xi}^{\frac{1}{2}}p^{y}_{b}h_{\xi}^{\frac{1}{2}})$,
so we can apply Lemma 2.3. We proceed in several steps.

We first observe that for every $y$ there is a POVM $(p^{\prime y}_{b})_{b\in
A}\subset\mathcal{M}$ such that for every $x,a,b$,

(2.2) $\langle
p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle=\operatorname{tr}(p^{x}_{a}h_{\xi}^{\frac{1}{2}}p^{\prime
y}_{b}h_{\xi}^{\frac{1}{2}}\rangle.$

This is a standard fact from von Neumann algebras, that we recall for
completeness. The map $\langle\cdot\tilde{p}^{y}_{b}\xi,\xi\rangle$ on
$\mathcal{M}$ is a positive element of $\mathcal{M}_{*}$, so there is a unique
positive $h(\xi,y,b)\in L_{1}(\mathcal{M})_{*}$ such that
$\langle\cdot\tilde{p}^{y}_{b}\xi,\xi\rangle=\operatorname{tr}(\cdot
h(\xi,y,b))$. The fact that $\tilde{p}^{y}_{b}\leq 1$ implies that $0\leq
h(\xi,y,b)\leq h_{\xi}$, that is there is a unique $p^{\prime y}_{b}\in
c(\mathcal{M})$ such that $0\leq p^{\prime
y}_{b}\leq\operatorname{supp}(h_{\xi})$ and
$h(\xi,y,b)=h_{\xi}^{\frac{1}{2}}p^{\prime y}_{b}h_{\xi}^{\frac{1}{2}}$. We
have $\theta_{s}(p^{\prime y}_{b})=p^{\prime y}_{b}$, so $p^{\prime
y}_{b}\in\mathcal{M}$. By uniqueness, we have
$h_{\xi}^{\frac{1}{2}}\sum_{b}p^{\prime y}_{b}h_{\xi}^{\frac{1}{2}}=h_{\xi}$,
that is $\sum_{b}p^{\prime y}_{b}=\operatorname{supp}(h_{\xi})$. Replacing
$p^{\prime y}_{b}$ by $p^{\prime y}_{b}+(1-\operatorname{supp}(h_{\xi}))$ for
some $b$ turns $p^{\prime y}$ to a POVM still satisfying (2.2).

We now claim that

(2.3)
$\int\sum_{a}\|[p^{x}_{a},h_{\xi}^{\frac{1}{2}}]\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)\leq
4\delta.$

Before we justify this, observe that by Lemma 2.3, this implies

(2.4) $\int\sum_{a,b\in
A}\Big{|}\operatorname{tr}(p^{x}_{a}h^{\frac{1}{2}}p^{y}_{b}h^{\frac{1}{2}})-\tau(q_{\xi}p^{x}_{a}q_{\xi}p^{y}_{b}q_{\xi})\Big{|}d\nu(x,y)\leq
4\sqrt{2}\delta^{\frac{1}{4}}.$

To prove (2.3), we expand

$\int\sum_{a}\|[p^{x}_{a},h_{\xi}^{\frac{1}{2}}]\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)=2-2\int\sum_{a}\|h_{\xi}^{\frac{1}{4}}p^{x}_{a}h_{\xi}^{\frac{1}{4}}\|_{L_{2}(\mathcal{M})}^{2}d\mu(x).$

By (2.2), $\int\sum_{a\in A}\langle p^{x}_{a}\tilde{p}^{x}_{a}\xi,\xi\rangle
d\mu(x)$ is the scalar product in $L_{2}(\mu;\ell_{2}(A;L_{2}(\mathcal{M}))$
of $(x,a)\mapsto h_{\xi}^{\frac{1}{4}}p^{x}_{a}h_{\xi}^{\frac{1}{4}}$ with
$(x,a)\mapsto h_{\xi}^{\frac{1}{4}}p^{\prime x}_{a}h_{\xi}^{\frac{1}{4}}$.
These two vectors clearly have norm at most $1$, so by the Cauchy-Schwarz
inequality and our assumption, they both have norm at least $1-\delta$. In
particular,

$\int\sum_{a}\|h_{\xi}^{\frac{1}{4}}p^{x}_{a}h_{\xi}^{\frac{1}{4}}\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)\geq(1-\delta)^{2}\geq
1-2\delta$

and (2.3) follows.

The next observation is that

(2.5) $\int\sum_{a}\|h_{\xi}^{\frac{1}{2}}(p^{x}_{a}-(p^{\prime
x}_{a})^{\frac{1}{2}})\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)\leq 6\sqrt{\delta}.$

Expanding the square, we can write the left-hand side of (2.5) as

$\int\big{(}2-2\sum_{a}\operatorname{tr}(h_{\xi}^{\frac{1}{2}}p^{x}_{a}h_{\xi}^{\frac{1}{2}}(p^{\prime
x}_{a})^{\frac{1}{2}})+2\Re\sum_{a}\operatorname{tr}(h_{\xi}^{\frac{1}{2}}[p^{x}_{a},h_{\xi}^{\frac{1}{2}}](p^{\prime
x}_{a})^{\frac{1}{2}})\big{)}d\mu(x).$

Using our assumption and the Cauchy-Schwarz inequality, we obtain that the
left-hand side of (2.5) is less than

$2\delta+2\Big{(}\int\sum_{a}\|[p^{x}_{a},h_{\xi}^{\frac{1}{2}}]\|_{L_{2}(\mathcal{M})}^{2}d\mu(x)\Big{)}^{\frac{1}{2}}\leq
2\delta+4\sqrt{\delta}.$

The last inequality is by (2.3). This proves (2.5).

Now observe that
$\operatorname{tr}(p^{x}_{a}h_{\xi}^{\frac{1}{2}}p^{y}_{b}h_{\xi}^{\frac{1}{2}})$
is the norm of $p^{x}_{a}h_{\xi}^{\frac{1}{2}}p^{y}_{b}$ in
$L_{2}(\mathcal{M})$. Similarly, by (2.2), $\langle
p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle$ is the norm of
$p^{x}_{a}h_{\xi}^{\frac{1}{2}}(p^{\prime y}_{b})^{\frac{1}{2}}$. We can
therefore apply Lemma 2.2 and obtain

$\int\sum_{a,b}\Big{|}\langle
p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle-\operatorname{tr}(p^{x}_{a}h_{\xi}^{\frac{1}{2}}p^{y}_{b}h_{\xi}^{\frac{1}{2}})|d\nu(x,y)\leq
2\Big{(}\int\sum_{a,b}\|p^{x}_{a}h_{\xi}^{\frac{1}{2}}(p^{y}_{b}-(p^{\prime
y}_{b})^{\frac{1}{2}})\|_{L_{2}(\mathcal{M})}^{2}d\nu(x,y)\Big{)}^{\frac{1}{2}},$

which is less than $3\delta^{\frac{1}{4}}$ by (2.5). Together with (2.4), this
concludes the proof of the first half of the theorem. The second half is
immediate from the moreover part of Lemma 2.3. ∎

##  3\. Application for strategies and games

We now prove the main results of the introduction, Theorem 0.1 and 0.2. As
announced, we prove a more precise form of them in Corollary 3.1. Before, we
introduce some notation. Given a von Neumann algebra $\mathcal{M}\subset
B(\mathcal{H})$, we denote by $\operatorname{val}_{\mathcal{M}}(\mathcal{G})$
the supremum of $\operatorname{val}(\mathcal{G},\mathcal{P})$ over all
commuting strategies with $p^{x}_{a}\in\mathcal{M}$ and
$\tilde{p}^{y}_{b}\in\mathcal{M}^{\prime}$.

If $(\mathcal{M},\tau)$ is a von Neumann algebra with a normal tracial state
$\tau$, the tracial (or synchronous) value
$\operatorname{val}_{\mathcal{M},\tau}^{tr}(\mathcal{G})$ is the supremum of

$\int\sum_{a,b}D(x,y,a,b)\tau(p^{x}_{a}p^{y}_{b}),$

over all partitions of unity $(p^{x}_{a})_{a\in A}\subset\mathcal{M}$.

Finally, if $(\mathcal{M},\tau)$ is a von Neumann algebra with a semifinite
normal trace, we denote by
$\operatorname{val}_{\leq\mathcal{M},\tau}^{tr}(\mathcal{G})$ the supremum of
$\operatorname{val}_{q\mathcal{M}q,\frac{1}{\tau(q)}\tau}^{tr}(\mathcal{G})$
over all nonzero projections $q\in\mathcal{M}$ with finite trace.

######  Corollary 3.1.

Let $\mathcal{G}$ be an $\alpha$-synchronous game and $\mathcal{M}\subset
B(\mathcal{H})$ be a von Neumann algebra. If
$\operatorname{val}_{\mathcal{M}}(\mathcal{G})\geq 1-\delta$, then there is a
trace one projection $q\in c(\mathcal{M})$ such that
$\operatorname{val}_{qc(\mathcal{M})q,\tau}^{tr}(\mathcal{G})\geq
1-c(\delta/\alpha)^{\frac{1}{4}}$ for a universal constant $c$.

###### Proof.

Assume that $\operatorname{val}_{\mathcal{M}}(\mathcal{G})>1-\delta$. This
means that there is a commuting strategy
$\mathcal{P}=(\mathcal{H},\xi,p,\tilde{p})$ with $p\subset\mathcal{M}$ and
$\tilde{p}\subset\mathcal{M}^{\prime}$ such that
$\operatorname{val}(\mathcal{G},\mathcal{P})\geq 1-\delta$, that is

$\int\sum_{a,b}(1-D(x,y,a,b))\langle p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle
d\nu(x,y)\leq\delta.$

In particular, restricting the integral to the diagonal $\\{(x,x)\mid x\in
X\\}$ and using that $\mathcal{G}$ is $\alpha$-synchronous, we obtain

$\alpha\int\sum_{a\neq b}\langle p^{x}_{a}\tilde{p}^{x}_{b}\xi,\xi\rangle
d\mu(x)\leq\delta,$

where $\mu$ is the first marginal of $\nu$. Equivalently,

$\int\sum_{a}\langle p^{x}_{a}\tilde{p}^{x}_{a}\xi,\xi\rangle d\mu(x)\geq
1-\frac{\delta}{\alpha}.$

So it follows from Theorem 2.1 that the correlation $\langle
p^{x}_{a}\tilde{p}^{y}_{b}\xi,\xi\rangle$ is
$O((\delta/\alpha)^{\frac{1}{4}})$ close in $L_{1}$-norm to the correlation
$\tau(r^{x}_{a}r^{y}_{b})$. In particular, the value of the game $\mathcal{G}$
at these strategies are $O((\delta/\alpha)^{\frac{1}{4}})$-close, and the
corollary follows. ∎

In the particular case when $\mathcal{M}$ is semifinite, we obtain.

######  Corollary 3.2.

Let $\mathcal{G}$ be an $\alpha$-synchronous game and $\mathcal{M}\subset
B(\mathcal{H})$ be a von Neumann algebra with a normal faithful tracial state
$\tau_{0}$. If $\operatorname{val}_{\mathcal{M}}(\mathcal{G})\geq 1-\delta$,
then
$\operatorname{val}_{\leq\mathcal{M},\tau_{0}}^{\operatorname{tr}}(\mathcal{G})\geq
1-c(\delta/\alpha)^{\frac{1}{4}}$.

This corollary is the combination of Corollary 3.1 with the following lemma.

######  Lemma 3.3.

Let $\mathcal{G}$ be any symmetric game and $(\mathcal{M},\tau_{0})$ be von
Neumann with a normal faithful semifinite trace. Then
$\operatorname{val}_{\leq\mathcal{M},\tau_{0}}^{\operatorname{tr}}(\mathcal{G})=\operatorname{val}_{\leq
c(\mathcal{M}),\tau}^{\operatorname{tr}}(\mathcal{G})$.

###### Proof.

By Example 1.1, $(c(\mathcal{M}),\tau)$ is isomorphic to
$(L_{\infty}(\mathbf{R})\overline{\otimes}\mathcal{M},e^{-s}ds\otimes\tau_{0})$,
so a finite projection $q\in c(\mathcal{M})$ corresponds to a measurable
family $(q_{s})_{s\in\mathbf{R}}$ of finite projections satisfying
$\int\tau_{0}(q_{s})e^{-s}ds=\tau(q)$. Moreover, if $(r^{x}_{a})_{a\in
A}\subset qc(\mathcal{M})q$ is a family of PVMs, the correlation
$\big{(}\frac{1}{\tau(q)}\tau(r^{x}_{a}r^{y}_{b})\big{)}_{x,y,a,b}$ is a
convex combinations of the correlations
$\big{(}\frac{1}{\tau_{0}(q_{s})}\tau_{0}(r^{x}_{a}(s)r^{y}_{b}(s))\big{)}_{x,y,a,b}$.
The lemma follows. ∎

When $\mathcal{M}=M_{d}(\mathbf{C})$, we recover Vidick’s theorem.

######  Corollary 3.4.

[Vid22] If an $\alpha$-synchronous game $\mathcal{G}$ admits a commuting
strategy with value $\geq 1-\delta$ on a Hilbert space of finite dimension
$\leq d^{2}$, then $\operatorname{val}_{\leq
M_{d}(\mathbf{C}),Tr}^{\operatorname{tr}}(\mathcal{G})\geq
1-c(\delta/\alpha)^{\frac{1}{4}}$.

###### Proof.

Let $\mathcal{P}$ be a strategy on $\mathcal{H}$ of dimension $\leq d^{2}$
with valued $\geq 1-\delta$. Consider the algebras $\mathcal{M}$ and
$\widetilde{\mathcal{M}}$ generated by $\\{p^{x}_{a}\mid x\in X,a\in A\\}$ and
$\\{\tilde{p}^{x}_{a}\mid x\in X,a\in A\\}$. Without loss of generality we can
assume that $\dim\mathcal{M}\leq\dim\widetilde{\mathcal{M}}$. They are
commuting sub-algebras of $B(\mathcal{H})$, so
$\mathcal{M}\otimes\widetilde{\mathcal{M}}$ embeds into $B(\mathcal{H})$.
Taking dimensions, we obtain
$(\dim\mathcal{M})^{2}\leq\dim\mathcal{M}\dim{\widetilde{\mathcal{M}}}\leq
d^{4}$. Therefore, $\dim\mathcal{M}\leq d^{2}$ and $\dim\mathcal{M}$ is
isomorphic to a direct sum of algebras $M_{k}(\mathbf{C})$ with $k\leq d$ and
we deduce that $\operatorname{val}_{M_{k}(\mathbf{C})}(\mathcal{G})\geq
1-\delta$ for some $k\leq d$. We conclude by Corollary 3.2. ∎

## References

  * [Con76] A. Connes.  Classification of injective factors. Cases $II_{1},$ $II_{\infty},$ $III_{\lambda},$ $\lambda\not=1$.  Ann. of Math. (2), 104(1):73–115, 1976.
  * [dlS22] Mikael de la Salle.  Orthogonalization of positive operator valued measures.  C. R., Math., Acad. Sci. Paris, 360:549–560, 2022.
  * [FT01] Tony Falcone and Masamichi Takesaki.  The non-commutative flow of weights on a von Neumann algebra.  J. Funct. Anal., 182(1):170–206, 2001.
  * [Haa79] Uffe Haagerup.  $L^{p}$-spaces associated with an arbitrary von Neumann algebra.  In Algèbres d’opérateurs et leurs applications en physique mathématique (Proc. Colloq., Marseille, 1977), volume 274 of Colloq. Internat. CNRS, pages 175–184. CNRS, Paris, 1979.
  * [HMPS19] J. William Helton, Kyle P. Meyer, Vern I. Paulsen, and Matthew Satriano.  Algebras, synchronous games, and chromatic numbers of graphs.  New York J. Math., 25:328–361, 2019.
  * [JNV+20] Z. Ji, A. Natarajan, T. Vidick, J. Wright, and H. Yuen.  MIP*=RE.  arXiv:2001.04383, 2020.
  * [KV11] Julia Kempe and Thomas Vidick.  Parallel repetition of entangled games.  In Proceedings of the 43rd annual ACM symposium on theory of computing, STOC ’11. San Jose, CA, USA, June 6–8, 2011., pages 353–362. New York, NY: Association for Computing Machinery (ACM), 2011.
  * [Lin23] Junqiao Lin.  Almost synchronous correlations in the commuting operator model, 2023\.
  * [PSS+16] Vern I. Paulsen, Simone Severini, Daniel Stahlke, Ivan G. Todorov, and Andreas Winter.  Estimating quantum chromatic numbers.  J. Funct. Anal., 270(6):2188–2222, 2016.
  * [Ric15] Éric Ricard.  Hölder estimates for the noncommutative Mazur maps.  Arch. Math. (Basel), 104(1):37–45, 2015.
  * [Tak03] M. Takesaki.  Theory of operator algebras. II, volume 125 of Encyclopaedia of Mathematical Sciences.  Springer-Verlag, Berlin, 2003.  Operator Algebras and Non-commutative Geometry, 6.
  * [Ter81] Marianne Terp.  ${L}^{p}$ spaces associated with von Neumann algebras.  lic.scient. thesis, 1981.
  * [Vid22] Thomas Vidick.  Almost synchronous quantum correlations.  J. Math. Phys., 63(2):Paper No. 022201, 17, 2022.