Citadel: Defensive Architectures for Computer Systems and Networks

Abstract We describe Citadel, our vision of multi-layered defensivearchitectures that will augment existing computer systems and networks, enhancing their survivability in face offailures or attacks. The core of our defensive architecture is the Backdoor, a trusted programmable network interfaceplaced on the I/O bus of a computer system that can access local resources (memory, I/O devices) and can initiatesecure remote operations on other remote backdoors. The main function of a backdoor is to provide a last line ofdefense for its host system, even when the host OS is not available or cannot be trusted. Depending on theparticular architecture, backdoors can be programmed to execute defensive activities alone or in cooperation withother backdoors on the same network or over wide-area. 1 Motivation and Goals Despite decades of work on verification techniques, faulttolerance and security, computers and networks continue to remain vulnerable to failures and attacks. Increasing systemcomplexity certainly does not help, even worse, it makes human-assisted monitoring, maintenance and interventionnot only prohibitively costly but, more dramatically, unacceptably slow and sometimes ineffective. This problem isonly going to become worse in the future, as the number of computing devices per person will increase while thevision of pervasive computing approaches its realization. In response to these trends, research focus has recently startedto shift from eliminating failures towards designing systems that can withstand them and recover fast [14]. What makes computers ultimately and persistently vulner-able? We believe that the ultimate cause of compute