<abstract xmlns="http://www.w3.org/1999/xhtml">

<p>Borrowing from well known fault tolerant approaches based on redundancy to mask the effect of faults, redundancy-based intrusion tolerance schemes are proposed in this paper, where redundancy of ICT components is exploited as a first defense line against a subset of compromised components within the redundant set, due to cyberattacks. Features to enhance defense and tolerance capabilities are first discussed, covering diversity-based redundancy, confusion techniques, protection mechanisms, locality policies and rejuvenation phases. Then, a set of intrusion tolerance variations of classical fault tolerant schemes (including N Version Programming and Recovery Block, as well as a few hybrid approaches) is proposed, by enriching each original scheme with one or more of the previously introduced defense mechanisms. As a practical support to the system designer in making an appropriate choice among the available solutions, for each developed scheme a schematic summary is provided, in terms of resources and defense facilities needed to tolerate <italic>f</italic> value failures and <italic>k</italic> omission failures, as well as observations regarding time requirements. To provide an example of more detailed analysis, useful to set up an appropriate intrusion tolerance configuration, a trade-off study between cost and additional redundancy employed for confusion purposes is also carried out.</p>
</abstract>

Borrowing from well known fault tolerant approaches based on redundancy to mask the effect of faults, redundancy-based intrusion tolerance schemes are proposed in this paper, where redundancy of ICT components is exploited as a first defense line against a subset of compromised components within the redundant set, due to cyberattacks. Features to enhance defense and tolerance capabilities are first discussed, covering diversity-based redundancy, confusion techniques, protection mechanisms, locality policies and rejuvenation phases. Then, a set of intrusion tolerance variations of classical fault tolerant schemes (including N Version Programming and Recovery Block, as well as a few hybrid approaches) is proposed, by enriching each original scheme with one or more of the previously introduced defense mechanisms. As a practical support to the system designer in making an appropriate choice among the available solutions, for each developed scheme a schematic summary is provided, in terms of resources and defense facilities needed to tolerate f value failures and k omission failures, as well as observations regarding time requirements. To provide an example of more detailed analysis, useful to set up an appropriate intrusion tolerance configuration, a trade-off study between cost and additional redundancy employed for confusion purposes is also carried out.

Redundancy–Based Intrusion Tolerance Approaches Moving from Classical Fault Tolerance Methods

International Journal of Applied Mathematics and Computer Science

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

Borrowing from well known fault tolerant approaches based on redundancy to mask the effect of faults, redundancy-based intrusion tolerance schemes are proposed...

Redundancy–Based Intrusion Tolerance Approaches Moving from Classical Fault Tolerance Methods

Publicado en línea: 30 dic 2022

Páginas: 701 - 719

Recibido: 30 dic 2021

Aceptado: 30 jun 2022

DOI: https://doi.org/10.34768/amcs-2022-0048

Palabras clave
intrusion tolerance, cyberattack, diversity-based redundancy, protection mechanisms

© 2022 Felicita Di Giandomenico et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

Redundancy–Based Intrusion Tolerance Approaches Moving from Classical Fault Tolerance Methods

Publicado en línea: 30 dic 2022

Páginas: 701 - 719

Recibido: 30 dic 2021

Aceptado: 30 jun 2022

DOI: https://doi.org/10.34768/amcs-2022-0048

Palabras claveintrusion tolerance, cyberattack, diversity-based redundancy, protection mechanisms

© 2022 Felicita Di Giandomenico et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

Palabras clave
intrusion tolerance, cyberattack, diversity-based redundancy, protection mechanisms