Real-Time Verification of Integrity Policies for Distributed Systems

Abstract

We introduce a mechanism for the verification of real-time integrity policies about the operation of a distributedsystem. Our mechanism is based on Microsoft .NET technologies. Unlike rival competitors, it is not intrusive, as ithardly modifies the source code of any component of the system to be monitored. Our mechanism consists of fourmodules: the specification module, which comes with a security policy specification language, geared towards thecapture of integrity policies; the monitoring module, which includes a code injector, whereby the mechanism observeshow specific methods of the system, referred to by some policy, are invoked; the verifier module, which examines theoperation of the distributed system in order to determine whether is policy compliant or not; and, the reporter module,which notifies the system is policy compliant, or sends an alert upon the occurrence of a contingency, indicating policyviolation. We argue that our mechanism can be framed within the Clark and Wilson security model, and, thus, used torealise information integrity. We illustrate the workings and the power of our mechanism on a simple, but industrialstrength,case study.