Flexible Intrusion Tolerant Group Membership Protocol ; CU-CS-967-04
Narasimha Prasad Subraveti, Soontaree Tanaraksiritavorn, Shivakant Mishra · CU Scholar (University of Colorado Boulder) · 2003
Intrusion-tolerant group membership protocols constitute an important part of intrusiontolerant group communication systems.These protocols maintain a consistent systemwide view of correct group members in the presence of malicious failures.This paper presents a new intrusion-tolerant group membership protocol.This protocol provides two unique features.First, it introduces a new membership state called a suspended membership state.A suspended group membership state provides a good balance between the amount of time a malicious/compromised group member gets to launch attacks before being removed from the group and the increased vulnerability to denial-ofservice attacks if a suspected member is removed too early from the group.Second, it introduces a clean, logical separation between the functionality of detecting malicious processes and removing malicious group members from the group.This logical separation aids in simplifying the group membership protocol design and efficiently detecting suspicious process behaviors.The protocol has been implemented and the paper provides a detailed performance analysis. Related WorkGroup Membership Protocols are a common paradigm in providing process group level consistency.To build highly available and correct services, there was a need to replicate servers.This led to development of fault tolerant group communication systems.Several group communication systems were built to handle different kinds of faults.The earlier efforts to build fault tolerant reliable group communication systems were equipped to only handle crash failures.Some of the earlier systems that handled crash failures are Isis [3], Consul [17], Totem [1], Ensemble [28], Horus [33], Spread [2], Pinwheel [10] and Timewheel [20].Related projects aiming to provide intrusion tolerance at the middleware level using a group communication service include Rampart [29,30,31], ITUA [25,26,27], and SecureRing [15,