1. Diversity for Dependability * Jean-Claude Laprie PRDC’99 — December 16-17, 1999 — Hong Kong * Elaboration on «Diversity against Accidental and Deliberate faults», by Yves Deswarte, Karama Kanoun and Jean-Claude Laprie, in Computer Security, Dependability, and Assurance, P. Amman, B.H. Barnes, S. Jajodia, E.H. Sibley, eds, IEEE Computer Society Press, 1999

2.  Diversity: the condition of being different or having differences  Dependability: ability to deliver service that can justifiably be trusted. DEPENDABILITY ATTRIBUTES AVAILABILITY RELIABILITY SAFETY CONFIDENTIALITY INTEGRITY MAINTAINABILITY FAULT PREVENTION FAULT TOLERANCE FAULT REMOVAL FAULT FORECASTING MEANS THREATS FAULTS ERRORS FAILURES SECURITY + + +

7. Levels of implementation of diversity User or operator Human-computer interface Application software Design diversity Execution diversity Hardware or executive software Diversity and fault tolerance

8. Diversity at the user or operator level Accidental faults: common practice (e.g., flight control systems) Malicious faults  Shift in assumption: Trust in a single operator Non-collusion of multiple operators Examples  Separation of duty  Trust distribution: secret sharing, threshold cryptography

9. Human-computer interface diversity Malicious faults: authentication  Authentication based on Something the user knows (e.g., password) Something he/she owns (e.g., a token) Something he/she is (biometric information)  All the corresponding mechanisms have limits Diversity e.g.: smartcard activated by PIN, fingerprint matching with patterns stored on a smartcard

10. Application software diversity Accidental faults Design diversity RB, NVP, NSCP Execution diversity Checkpointing & (some) asynchrony Solid faults Elusive faults 44 4 Malicious design faults

11.  Design diversity Operational realisations Commercial avionics: massive Railway control and signalling: partial  Practical form: NSCP, where SCP = control and monitoring (e.g., safety bag) Effectiveness: experimental and theoretical evaluations positive  Experimental evaluations : improvement slightly > one order of magnitude  Uncovering of specification faults Cost: overhead for 2SCP ~ 70% (theoretical and experimental result)

12. Observation  Execution diversity Formulation?

13. Hardware and executive software diversity  Unreliability of COTS due to residual design faults  Malicious faults Malicious logic faults Intrusions : exploit residual accidental design faults in OS rather than design faults in security-related software  Effectiveness of application software diversity?

16. Diversity and fault removal  Adequate mix of approaches  Diversity within each approach VERIFICATION STATIC DYNAMIC STATIC ANALYSIS (INSPECTION, WALKTHROUGH) PROOF CHECKING MODEL CHECKING TESTING

17. Deterministic vs. Statistical testing

18. Diversity and fault forecasting  Accidental faults Fault Tolerance Coverage Error and Fault Handling Coverage Fault Assumption Coverage Failure Mode Coverage Failure Independence Coverage  Malicious faults: security/usability tradeoffs

19. LAAS network Unix 700 users 100 machines 21 months (June 95 - March 97) insider  root 0,1 1 10 100 1000 06/9508/9510/9512/9502/9604/9606/9608/9610/9612/9602/97 METF-MLMETF-MT Number of pathsShortest path