Realizing S-Reliability for services via recovery-driven intrusion tolerance mechanism

Service-Oriented Architecture (SOA) paradigm facilitates the design of large systems as a set of loosely coupled services interacting with each other. These services, in turn, can be combined to form a more complex service. But, for services to be useful, they must satisfy non-functional requirements, especially security-related quality of service. Unfortunately, software vulnerabilities expose these services to malicious actors, and make them susceptible to attacks. Therefore, security quality of service is critical in order to ensure confidentiality, integrity, and availability for system data and services. Due to the distributed and decentralized nature of services, publishing and guaranteeing security quality of service are crucial so that potential applications and clients can make use of the provided services. In this paper, we will first discuss how Intrusion Tolerance Quality of Service (IT-QoS) can be modeled and specified. Then, we will show how a recovery-driven intrusion tolerance architecture is able to ensure differentiated levels of S-Reliability, an important IT-QoS for a Service.