EAGER: Accountability Through Architecture for Decentralized Systems

点击翻译按钮获取中文摘要

Advancing the ability to create trustworthy computing systems demands fundamental advances in many technologies and at many levels of abstraction. Creating trustworthy applications requires more than a set of excellent building blocks, however. It demands an architectural understanding; one that shows a viable approach to utilizing many contributions in mutually consistent and supportive ways. This project springs from a focus on achieving security through innovative software architecture, wherein novel combinations of technologies are applied and the essential mechanisms of security and accountability are built in. In particular, the security concerns of prevent, detect, isolate, mitigate, and blame demand an architectural solution wherein systemic accountability is an architectural consequence, rather than an option.To this end the proposal offers a novel alternative architectural style, COAST, for constructing secure, large-scale, decentralized systems, coupled with a focus on capability accounting. A capability is an unforgeable reference whose possession confers both authority and rights to a principal. Capability accounting is the practice of producing and maintaining a record or statement of the generation, transfer, or use of capability relating to a particular period or purpose. The approach facilitates the fine-grained use of capability accounting to prevent security problems, isolate them, mitigate consequences of problems, and, if necessary, assign blame for use in subsequent actions. Target applications are typified by SOAs (Service Oriented Architectures), such as those found in e-commerce, where there are multiple interacting parties but no single overarching authority. Our approach is inspired and informed by the daily use of broad accounting principles in other industries, notably Hazard Analysis and Critical Control Points (HACCP), a systematic preventive approach to hazards in production processes, and the generally accepted accounting principles (GAAP) of finance and business. Our immediate focus is assessing the viability of this approach in a notional Internet-of-Things application, where we rely on careful measurement and engineering analysis to guide future larger-scale projects.