Building Reliable Secure Computing Systems Out Of Unreliable Insecure Components

Parallels are drawn between the problems and techniques associated with achieving high reliability, and those associated with the provision of security, in distributed computing systems. Some limitations of the concept of a Trusted Computing Base are discussed, end an alternative approach to thedesign of highly secure computing systems is put forward,based on fault tolerance concepts and techniques.