Polygraphing Processes: N-Variant System Structures for Secretless Security

We describe a technique for hardening services that may contain unknown security vulnerabilities. We employ artificial diversity techniques, but in contrast to previous approaches that rely on keeping secrets to provide probabilistic security properties, we develop an architectural framework that provides a high degree of assurance without needing any secrets. The framework requires an attacker to compromise one of the system variants without producing detectable behavior on another system variant processing the same input. By constructing variants with disjoint exploitation sets, we can make it impossible to successfully carry out large classes of important attacks. In this paper, we present the N-variant systems framework, introduce a model for analyzing security properties of N-variant systems, identify two useful variations and their security properties, and describe an implementation and report on its performance.