Assumptions For The DTM. In order for the concept of a Trust Domain to work, we must assume that it can be started with an uncompromised host. We assume that a system administrator starts the S.A.F.E. software on a host that is known to be uncompromised. We also assume that the system administrator starts the S.A.F.E. software on two additional uncompromised hosts and has them join the Trust Domain. These first 3 computers form the foundation of the Trust Domain. We also assume that compromised hosts cannot return the correct probability corresponding to signatures sent to them by uncompromised DTMs, except in extremely rare instances. The existence of a scheme to keep the data used to test if computers are uncompromised is assumed. Such schemes are discussed in the future work section. We also assume that a majority of hosts in a Trust Domain are not compromised. We define a simple majority of hosts in a Trust Domain to be 1 + Floor(n/2), if there are n hosts in a Trust Domain. This is a critical assumption. If the number of compromised hosts in a Trust Domain exceeds the number of uncompromised hosts, then the compromised hosts have taken over the Trust Domain. In this case, the compromised hosts can prevent the uncompromised computers from being able to restore the Trust Domain to a state where the majority of the computers are uncompromised. We provide a mechanism to attempt to prevent the number of compromised systems from growing too large, by trying to detect and remove compromised hosts from the Trust Domain.
