Um serviço de diretórios tolerante a falhas e intrusões

Abstract

Directory services are often used to store sensitive information (e.g., data and user credentials) in many critical systems such as access control and authentication services, DNS servers, e-mail and public key infrastructures. Although they provide a certain degree of security to prevent attacks and failures (e.g., security protocols and self replication mechanisms), the current directory services implementations, based on LDAP, they are not safe in fact, scalable and intrusions free. In this context, this work presents the first architecture for directory services based on the LDAP protocol, capable to tolerate failures and intrusions. For the development of this architecture is employed state machine replication to tolerate failure, and the diversity of systems at different levels to tolerate intrusions. The feasibility and applicability of the proposed solution is shown through several experiments. As a result, it is possible to attest that the system is efficient, with a performance at least three times better than the state of the art, as well as scalable and resilient.