Building diverse computer systems

TLDR

Biological systems rely on diversity for robustness, whereas computers are largely homogeneous, and this lack of diversity has been largely ignored in computing security. The authors propose software diversity techniques that randomize program behavior while preserving functional correctness. Randomization can enhance software robustness with little cost, and, for example, varying stack frame memory allocation can thwart simple buffer overflow attacks.

Abstract

Diversity is an important source of robustness in biological systems. Computers, by contrast, are notable for their lack of diversity. Although homogeneous systems have many advantages, the beneficial effects of diversity in computing systems have been overlooked, specifically in the area of computer security. Several methods of achieving software diversity are discussed based on randomizations that respect the specified behavior of the program. Such randomization could potentially increase the robustness of software systems with minimal impact on convenience, usability, and efficiency. Randomization of the amount of memory allocated on a stack frame is shown to disrupt a simple buffer overflow attack.