Networks have valuable data and will be attacked. We must build systems that withstand attacks - data and services should tolerate them.
The Internet is a scale-free network. It has high tolerance to random failures and low tolerance to attacks. The most successful attacks target the most connected nodes - when they fail, the network fractures.
| Method | Definition |
|---|---|
| Average Node Degree | Nodes with the largest number of connected nodes |
| Node Persistence | During traffic snapshots, nodes most likely to appear |
| Temporal Closeness | Nodes that interact with the largest number of nodes |
Three layers: Prevent → Detect → Survive. The best way to survive is to tolerate the attack.
Typically, data is stored in one place. Compromise of that server → loss of CIA.
Weaker - attacker has n targets vs 1. More opportunities to get data.
Better - with majority voting, attacker must compromise majority of n servers.
Can we have better confidentiality protection than simple replication? Yes - via secret sharing.
Distribute a secret among participants; each gets a share. Secret is reconstructed only when shares are combined. Individual shares are of no use on their own.
Naïve scheme: split "PASSWORD!" into shares (e.g., PAS, SWO, RD!). Weakness: the more shares an attacker has, the less work to guess the secret. In a secure scheme, having shares should not reduce guesswork.
Divide data D into n pieces D₁, …, Dₙ such that:
If k=n, all participants are required to reconstruct. Using n=2k−1: recover key even if ⌊n/2⌋ pieces destroyed; adversaries need more than ⌊n/2⌋ to reconstruct.
Invented by Adi Shamir (1979). Uses polynomial interpolation over a finite field.
q(x) = a₀ + a₁x + … + aₖ₋₁x^(k−1)
Byzantine fault - components may fail with imperfect information; faulty nodes can exhibit arbitrary behavior. Achieved through redundancy and failure masking.
Commanding general sends order to n−1 lieutenants. Goals: all loyal lieutenants obey same order; if general is loyal, every loyal lieutenant obeys that order. Network may fail, delay, duplicate; faulty nodes behave arbitrarily.
Asynchronous system; Byzantine failure model. Minimum 3f+1 replicas for f faulty - needed because: proceed with n−f responses (f may not respond); of those who responded, up to f may be faulty; need n−2f > f ⇒ n > 3f.
We cannot apply fault tolerance directly to achieve attack tolerance. Redundancy means identical replicas running the same program - the same attack can compromise all replicas.
All replicas run the same program(s). A single attack vector can compromise every replica. Redundancy is not a solution for attacks.
Each instance has a different implementation across all layers:
Take diversification further - dynamically change network and system configuration. Many instances, implemented differently, composed on-the-fly.
Fault tolerance assumes independent failures. Attacks are coordinated and target the same vulnerability. Diversification and moving target address this by ensuring no single vulnerability compromises the whole system.