Architectural issues in fault-tolerant, secure computing systems
Mark K. Joseph · 1988
is perhaps surprising that more attention has not been paid to fault tolerance techniques in order to achieve security in computer-based (Dobs86). To this date, multilevel secure computer systems have not adequately considered fault tolerance as a design goal. In fact, there is a classical bit of wisdom among security analysts, which says that, if the computer system stops, then it is secure since no leakage of sensitive data is possible. However, more than just the concern for leakage of data is becoming important in secure systems, and that is that they provide service in the presence of malicious attacks. This dissertation explores several facets of the applicability of fault tolerance techniques to secure computer design, these being: (1) how fault tolerance techniques can be used on unsolved problems in computer security (e.g., computer viruses, and denial-of-service), (2) how fault tolerance techniques can be used to support classical computer security mechanisms in the presence of accidental and deliberate faults, and (3) the problems involved in designing a fault-tolerant, secure computer system (e.g., how computer security can degrade along with both the computational and fault tolerance capabilities of a computer system). The approach taken in this research is almost as important as its results. It is different from current computer security research in that a design paradigm for fault-tolerant computer design is used (Aviz87a). This led to an extensive fault and error classification of many typical security threats. Throughout this work a fault tolerance perspective is taken (i.e., faults, such as design flaws, are assumed to always exist in a computer system, and that run-time mechanisms are necessary to tolerate them). However, we have not ignored basic computer security technology. For some problems we have investigated how to support and extend basic security mechanisms (e.g., trusted computing base), instead of trying to achieve the same result with purely fault tolerance techniques.