The role of accountability in dependable distributed systems

Abstract

This paper promotes accountability as a first-class design principle for dependable network systems. Conventional techniques for dependable systems design are insufficient to defend against an adversary that manipulates the system covertly in order to lie, cheat, or steal. This paper treats subversion as a form of fault, and suggests that designing accountability into the system provides the means to detect, isolate, and tolerate such faults, and even to prevent them by removing incentives for malicious behavior. A key challenge for the future is to extend the repertoire of dependable systems design and analysis with broadly applicable techniques to build systems with target levels of accountability quantified by the probability that an attacker will be exposed.