Threat Adaptive Byzantine Fault Tolerant State-Machine Replication

Critical infrastructures have to withstand advanced
and persistent threats, which can be addressed using Byzantine
fault tolerant state-machine replication (BFT-SMR). In practice,
unattended cyberdefense systems rely on threat level detectors
that synchronously inform them of changing threat levels. How-
ever, to have a BFT-SMR protocol operate unattended, the state-
of-the-art is still to configure them to withstand the highest
possible number of faulty replicas f they might encounter, which
limits their performance, or to make the strong assumption that
a trusted external reconfiguration service is available, which
introduces a single point of failure. In this work, we present
ThreatAdaptive the first BFT-SMR protocol that is automatically
strengthened or optimized by its replicas in reaction to threat
level changes. We first determine under which conditions replicas
can safely reconfigure a BFT-SMR system, i.e., adapt the number
of replicas n and the fault threshold f, so as to outpace an
adversary. Since replicas typically communicate with each other
using an asynchronous network they cannot rely on consensus
to decide how the system should be reconfigured. ThreatAdaptive
avoids this pitfall by proactively preparing the reconfiguration
that may be triggered by an increasing threat when it optimizes
its performance. Our evaluation shows that ThreatAdaptive can
meet the latency and throughput of BFT baselines configured
statically for a particular level of threat, and adapt 30%
faster than previous methods, which make stronger assumptions
to provide safety.