Abstract

This paper describes novel market-based technologies that uniquely establish quantifiable and adjustable limits on the power of attackers, enable verifiable accountability for malicious attacks, and admit systematic and uniform monitoring and detection of attacks. These technologies, incorporated in the MarketNet system, establish a financial economy to regulate the trade and use of access rights in information systems. Resources are instrumented to use currency for access control and monitoring, establishing accountability in their use. Domains control access to their resources through resource prices and budgets available to clients. Domains control and fine tune their exposure to attacks; adjust this exposure in response to emerging risks; detect intrusion attacks through automated, uniform statistical analysis of currency flows; and tune their exposure to resource unavailability by purchasing protection through financial-like instruments.

Author Keywords: Information systems protection; Access control through currency; Information economy; Quantifiable exposure to attacks; Financial-like instruments

Article Outline

1. Introduction

2. Use of currency for access control

2.1. Resources and clients are organized in currency domains

2.2. Domains control allocation of budget and prices of resources

2.3. A sample transaction

3. The resource access layer (RAL) — a market-based protection kernel

3.1. The architecture and components of the RAL

3.2. The banking infrastructure

4. Prices/budgets establish dynamically tunable access control

5. Domains set quantifiable limits on power of attackers

6. Attacks are detected and isolated by monitoring currency usage

7. Financial instruments provide QoS guarantees

8. Examples of MarketNet's reaction to attacks

9. Conclusions

Acknowledgements

References

Vitae