The article deals with generalization of diversity and version redundancy application to protect security and safety critical systems. The main problem for such systems is the occurrence of common cause failures (CCF). It is shown that as dependable computing is combining of reliable, safe and secure computing a principle of diversity can be applied to minimize risks of CCF and assurance of requirements to all attributes. It is reported about need to respond to new technologies and challenges in this area by improvement exist classifications of diversity. It is given the facet-hierarchical representation of the most representative schemes of diversity. The united classification of types of diversity from different domains is proposed. The classification scheme is based on the NUREG-7007. A possibility to assess and assure security and safety by using the resulting classification is discussed for clouds systems and other technologies.
1.1
Development and implementation of dependable software and hardware components
becomes more and more important for safety and security critical systems. The main
problem for such applications is to reduce the risk of common cause failures (CCF).
CCF is coincidental failure of two or more structures, systems or components is
caused by any latent deficiency from design or manufacturing, from operation or
maintenance errors, and which is triggered by any event induced by natural
phenomenon, plant process operation, or action caused by man or by any internal event in the
instrumentation and control system [
One of the most effective solutions to the CCF problem is diversity, which makes
each version of the system unique, that means the probability of occurrence of CCF is
minimized [
Thus, solving the same problem in different ways, for example using different programming languages or different development teams, you can avoid system failure due to one error. Since in this case the faults will be various in each version, which means that the probability of CCF is significantly reduced.
Given the importance of effective implementation of diversity, there is a need to evaluate and select the most appropriate type of diversity. However, with the development of information technology, such task becomes more and more difficult, as the question arises as to how to use diversity and how to evaluate the security of multiversion systems when using such technologies. In addition, designers are trying to apply new technologies to provide diversity. This leads to a difficult choice of the type of diversity for a particular application.
To make this choice, a clear, ordered structure is needed to narrow the search
circle. There are a large number of different classifications that represent various aspects
of diversity [
Currently, there are many different classifications of diversity, each of which deals with a narrow aspect of the security of a particular system. However, such a deep detail prevents to look at the situation as a whole. Consequently, it have to combine the most well-known classifications, which cover a sufficiently large number of types of diversity.
The most representative on this topic are following works. The technical report of
the diversity of critical systems in the nuclear power industry NUREG-7007 [
There is a number of works, which clarify some aspects of diversity. The
monograph [
Hence, there are a lot of classifications and applications of diversity in safety and security critical domains during last twenty years. However, there is not general classification of diversity and techniques to join different version redundancy types. 1.3
The goal of the paper is to develop the unified classification of diversity. For this, we first consider the basic principles of the construction of classifications and describe the general approach to the representation of diversity in the facet-hierarchical structure (Section 2). Next, a plan for combining classifications is disclosed and the process of building a unified classification of diversity is described (Section 3). Results of the united classification development are presented (Section 4). Last section concludes and presents future steps of research. 2 2.1
The main types of classifications are faceted, hierarchical and facet-hierarchical (FIC)
[
The hierarchical classification method consists in dividing the whole set of terms from the subject domain into groups, which are further divided into subgroups, and these in turn can be further divided. Thus, subordination is established between the classification groups, which has the form of a hierarchy.
FIC consists of taxons and classification attributes. First, a set of objects form taxons, which are divided into groups according to classification features, which in turn are arranged in a certain hierarchy. The taxons themselves are also divided into subgroups, thus forming a subordination between taxons. 2.2
Depending on the type of classification, the approach to its construction is somewhat different, but there is a general principle for constructing any classification.
First of all, the formation of a set of studied objects is occurred. Each element of which must be deterministic and should be given a semantic description. After that, the set is divided into subsets according to certain attributes, which are unique for each subset. At the same time, depending on the type of classification, subordination is established between subgroups or this is not required.
Thus, works on diversity that contain classification schemes can be analyzed. These schemes are presented in the form of FIC. After that, they have been combined into a unified classification to cover the overall picture, taking into account modern technologies.
The example of extending faceted classifications is obtaining NUREG-7007 [
S {A, T, Ψ}, where A — a set of classification attributes A = {Ai}in=1, T — a set of taxons T = {ti}in=1, Ψ — relationship between elements Ai ∈ A and Ti ∈ T: i.e.: A Ψ T.
An example of the taxonomic structure is the facet classification discussed above. The main feature of which is the independent of all facets.
Since the types of diversity are not equivalent, but are subordinate to each other, it is advisable to use faceted hierarchical structure. In which the classification attributes and taxons have a hierarchical form. Thus, a hierarchical component is added to equation (1).
Facet-hierarchical structure is set, consisting of three elements [
SH = {AH, TH, ΨH}, where AH = {AHi}in=1 — a set of classification attributes in hierarchical structure, TH = {... {tij...k} ...} — a set of taxons in hierarchical structure, ΔT = {ti} — subset of taxons in hierarchical structure, which appropriate to classification attribute, Ψ: ∀AIi ↔ ΔTIi ⊂ TI —relation between taxonomic classification attributes and a variety of taxons in a hierarchical structure.
The example of applying facet-hierarchical classification is construction the main
part of software diversity from NUREG-7007 [
Classification attributes 1. Software diversity 1.1 Software life-cycle 1.1.1 Stages of implementation 1.2 Implementation and Installation techniques 1.2.1 Types of N-Version programming
Taxon 1 Postdistribution Installation Requirements development In-place diversification Different algorithms, logic
Taxon 2 Predistribution Loading Design N-self checking programming Different timing and/or order of execution
Executing Codding and debugging Recovery Blocks Different runtime environment
Implementation Integration N-Version programming Different functional representation
Compilation and Linking
Updating
To develop a generalized classification, the schemes described in [
The above classifications have been combined into a unified semantic facethierarchical structure (2). Since the process of combining classifications is not fully formalized in terms of the semantic component, expert support was used. To build a unified classification, the following procedure can be used: Presenting the selected classifications in the form of FIS; Preparing the initial data for the united (classification attributes and taxons); Establishing the equivalences between attributes; Establishing the taxon equivalences for each attributes; Clarifying the hierarchies between attributes and between taxons; Developing the final version of the classification. 4.2
Integrated diversity classification scheme presented in the figure 6. The scheme demonstrates a facet-hierarchical representation of diversity, where the top level contains such systems as software, hardware, information management. It also includes human diversity, which can be used for any type of system.
The general principle of construction of the scheme is the life cycle of diversified
systems .This is special clearly shown for software, where the techniques providing
diversity have been assigned to the stage of the life cycle to which they correspond.
Since the implementation stage is the most sought-after to provide protection, it was
described in more detail. Then attention was paid to fundamentally different
approaches to the diversity of software, such as automated and managed diversity. The
main difference of them is the origin of the diversity. This use of naturally established
features of software, or artificial [
The diversity of hardware has been structured according to the features of its operation and the most important components such as equipment, design, functioning and signal. In particular, the diversity of equipment is divided into two groups: equipment manufacturer and equipment processing logic. The possibility of using the principle of diversity at the network level has also been described. 4.3
One of the areas in which this classification can be used is the development of
applications hosted in the cloud [
Further, the decision is made on what type of application will be monolithic or consisting of micro-services. In accordance with this, it is necessary to use techniques of either managed diversity or automated one. This decision will also affect whether different teams of developers, testers and others will be used.
Since the cloud provider ensures the hardware, its diversity does not apply. However, it is possible instead diversify the providers themselves or the geographical location of their servers.
Fig. 6. United classification scheme.
Currently, web-services are actively developing. Their main components are
application layer, web server, apps server, operating system and database management
system. Web-services can be developed using cloud computing. In this case, the
application will consist of components-off-the-shelf [
The main feature of this classification scheme is that it combines types of diversity from different domains, takes into account new technologies that can be used in safety critical systems. In addition, it is possible to choose ways to solve the security problem by using the resulting classification. For this is necessary to select and apply diversity taking into account the characteristics of domains. An example of using classification for cloud computing was considered.
Further, the diversity classification for IoT, cloud computing, AI, web-services and other modern technologies will be detailed. To do this, it is necessary to design certain filters that will allow moving from a general classification to an individual case of diversity applied to a particular system.