Runtime Stability Definition Document v3.3
v3.3 · March 3, 2026 · Public Edition
§1Conceptual Definitions
§1.1One-Sentence Definition of Runtime Stability
Runtime Stability is a technology framework for structurally maintaining the seven Protection Attributes defined in §1.5 when a computer system faces cyberattacks, failures, or anomalies during execution (runtime).
§1.2Essential Definition of Runtime
"Runtime" as used herein refers to the general state of execution in which a processor executes its instruction set (ISA) and program code and execution data are loaded into RAM (memory). This definition is shared across all three documents (Runtime Stability / Security / Immunity) and is essential, independent of domain or era.
§1.3Inclusive Definition: Integrated Framework of Three Security Layers
Runtime Stability is a comprehensive framework that integrates three protection layers: Traditional Information Security, Runtime Security, and Runtime Immunity.
Layer 1: Traditional Information Security
- Scope: Preventing intrusion from outside the system
- Implementation: Firewalls, VPNs, DMZs, authentication, and authorization
- Limitation: Internal defense is weak once a breach occurs
- Responsible Attribute: Availability (network level)
Layer 2: Runtime Security (Detection- and Control-Based Protection)
- Scope: Dynamic threat response within the runtime environment
- Implementation: Graduated response through detection → control
- Features: Process Memory Monitoring, RASP, CWPP, EDR, etc.
- Evaluation: 3-axis evaluation at SL (Security Level) 0–3
- Strength: High-precision response to known threats
- Limitation: Detection gaps exist for 0-day threats
- Primary Responsibility: Safety, Availability, Controllability
- Secondary Responsibility (in coordination): Reliability (in coordination with Runtime Immunity)
Layer 3: Runtime Immunity (Structural Nullification-Based Protection)
- Scope: Structural Nullification of Attack Outcomes
- Implementation: Memory encryption, Environment Binding, privilege reduction, etc.
- Features: Preventive protection independent of detection
- Evaluation: IL (Immunity Level) 0–3 (multi-dimensional evaluation on NL axes)
- Strength: Structurally addresses even 0-day threats
- Limitation: Implementation across all domains is complex
- Primary Responsibility: Confidentiality, Data Integrity
- Secondary Responsibility (in coordination): Reliability (in coordination with Runtime Security)
Integrated Evaluation: RS (Runtime Stability Level) 0–6
- RS = SL + IL integrates the achievement levels of Layer 2 and Layer 3 (see §4.1)
- Layer 1 functions as an environmental prerequisite
⚠️ NOTICE: Regarding Inexploitability: Inexploitability does not belong to any specific layer; it is an attribute achieved through the coordination of Runtime Security and Runtime Immunity (see §1.5).
§1.4Three Design Philosophies of Runtime Stability
Three Design Philosophies pervade the entire Runtime Stability framework. Runtime Security and Runtime Immunity derive from these philosophies.
Philosophy 1: Non-Halting
The system is not halted even under attack. This is an essential philosophy for protecting Unstoppable Systems such as autonomous vehicles, medical devices, and industrial control systems. Runtime Immunity's "structural protection without system halting" and Runtime Security's "continued operation through dynamic response" derive from this philosophy.
Philosophy 2: Homeostasis Maintenance
The system's Protection Attributes remain unchanged before and after an attack. Analogous to biological homeostasis, the system autonomously maintains a stable state internally. Runtime Immunity's "protection maintenance through Structural Nullification" and Runtime Security's "state management through detection and control" realize this philosophy.
Philosophy 3: Integrated Achievement of 7 Attributes
The goal is not the achievement of a single attribute but the balanced achievement of all seven attributes. Halting a system solely for Safety undermines Availability. This integrated approach enables a realistic and implementable protection framework.
§1.5Seven Protection Attributes (RS Attributes)
Runtime Stability is evaluated by the degree of achievement of the following seven Protection Attributes.
| Abbreviation | Attribute | Definition |
|---|---|---|
| S | Safety | The system remains in a safe state even under attack. Structurally prevents loss of control, unintended behavior, and physical harm. |
| R | Reliability | Protection functions operate reliably and continuously. Protection mechanisms do not fail under attack, or automatically recover upon failure. |
| A | Availability | The system's service delivery is maintained. Critical functions do not halt, or resume within acceptable timeframes. |
| C | Controllability | The system state can be ascertained and guided to a safe state even under attack or failure. Ensures the system does not become uncontrollable. |
| Cf | Confidentiality | The confidentiality of in-process memory, in-transit data, and stored data is maintained even under attack. Structurally prevents readable acquisition of confidential information. |
| D | Data Integrity | The accuracy and completeness of data are maintained even under attack. Prevents unauthorized alteration and destruction of data. |
| Ix | Inexploitability | A state in which vulnerabilities exploitable by attackers are structurally absent in the system's runtime state. Achieved through the coordination of Runtime Security and Runtime Immunity. |
⚠️ NOTICE: Regarding Inexploitability: Inexploitability means the "structural absence of vulnerabilities exploitable by attackers" and is a different concept from "nullification of Attack Outcomes" (a function of Runtime Immunity). Immunity contributes to Ix by nullifying Attack Outcomes, and Security contributes to Ix through dynamic detection and elimination of exploitable conditions. High Ix levels are achieved through the coordination of both. The degree of Ix achievement is evaluated from both the SL axis (the proportion of vulnerabilities dynamically eliminated) and the IL axis (the proportion of attack paths structurally nullified). Specific measurement methodologies are defined in the Conformance and Evaluation volume.
§2Relationship Between Runtime Stability and Existing Standards
The seven attributes of Runtime Stability connect with the requirements addressed by multiple existing standards.
| Standard | Target Domain | Corresponding RS Attributes |
|---|---|---|
| ISO 26262 | Automotive Functional Safety | S, R, C |
| IEC 62443 | Industrial Control Security | A, S, Cf, D |
| IEC 62304 | Medical Device Software | S, R, Cf |
| DO-178C | Aviation Software | S, R, C |
| ISO/IEC 27001 | Information Security Management | Cf, D, A |
§3Components and Evolution of Runtime Stability
§3.1Three-Layer Defense Model
Runtime Stability structures defense against attacks in the following three layers.
Layer 1: Prevention
Prevents attacks from reaching the system. Perimeter Defense, authentication, access control, etc. The domain primarily addressed by traditional security.
Layer 2: Control Retention [Runtime Security]
Even when attacks reach the system, detection and dynamic control maintain the system's Controllability, Safety, and Availability. S, A, and C directly correspond, while R partially corresponds.
Layer 3: Outcome Nullification [Runtime Immunity]
Even when attacks "succeed," Attack Outcomes are structurally nullified. Cf and D directly correspond, while R partially corresponds.
Integrated Attribute: Inexploitability (Ix)
Ix is not assigned to any specific layer; it is an attribute achieved through the coordination of Layer 2 (dynamic elimination of exploitable conditions) and Layer 3 (structural nullification of attack paths).
§3.2Derivation of Runtime Security and Runtime Immunity
Runtime Security (Detection-Based)
To realize the Design Philosophies of "Non-Halting" and "Homeostasis Maintenance," attacks are handled through "detection → control," maintaining system operation while responding.
- Characteristics: Detection-dependent, dynamic response, real-time priority
- Limitations: Complete detection is impossible; 0-day response is difficult
- Details: See Runtime Security Definition Document v1.1
Runtime Immunity (Structure-Based)
To realize the Design Philosophies of "Non-Halting" and "Homeostasis Maintenance," protection is maintained without detection through "precondition removal" and "outcome nullification."
- Characteristics: Detection-independent, structural protection, high certainty
- Limitations: Implementation across all domains is difficult; environment-dependent
- Details: See Runtime Immunity Definition Document v1.1
Through the coordination of both, the seven attributes of Runtime Stability are achieved at a high level overall.
§4Achievement Evaluation Framework
§4.1Definition of Runtime Stability Level
The overall protection level of a system is evaluated by the RS (Runtime Stability Level), which combines the SL (Security Level) of Runtime Security and the IL (Immunity Level) of Runtime Immunity.
RS = SL + IL
- SL: Runtime Security Level (0–3)
- IL: Runtime Immunity Level (0–3)
- RS: Runtime Stability Level (0–6)
RS Matrix:
| IL-0 | IL-1 | IL-2 | IL-3 | |
|---|---|---|---|---|
| SL-0 | RS-0 | RS-1 | RS-2 | RS-3 |
| SL-1 | RS-1 | RS-2 | RS-3 | RS-4 |
| SL-2 | RS-2 | RS-3 | RS-4 | RS-5 |
| SL-3 | RS-3 | RS-4 | RS-5 | RS-6 |
⚠️ NOTICE: RS Calculation Rule: RS = SL + IL is a simple addition, and multiple SL/IL combinations can yield the same RS value (e.g., RS-4 = SL-1 × IL-3 = SL-2 × IL-2 = SL-3 × IL-1). However, since each combination has different protection characteristics, an appropriate combination must be selected based on the requirements of the application domain. Furthermore, RS is an Ordinal Scale and not an Interval Scale. RS values indicate the relative ordering of protection levels.
§4.2Application Criteria and Recommended Levels
| RS Level | Recommended SL | Recommended IL | Recommended Application Domain |
|---|---|---|---|
| RS-2 | SL-1 | IL-1 | General web applications |
| RS-3 | SL-2 | IL-1 | SaaS, online trading |
| RS-4 | SL-2 | IL-2 | Financial institutions, healthcare systems |
| RS-5 | SL-3 | IL-2 | Autonomous vehicles |
| RS-6 | SL-3 | IL-3 | Defense-related, critical infrastructure |
⚠️ NOTICE: RS-5 can also be calculated as SL-2 × IL-3; however, for Safety-critical domains such as autonomous vehicles, SL-3 (advanced detection capability) is recommended.
§4.3Definition and Limitations of RS-6 (Highest Level)
RS-6 = SL-3 (Integrated Detection) + IL-3 (Practical Nullification)
What RS-6 achieves:
- High-precision response to known threats (SL-3 detection and control capability)
- Structural protection: full memory encryption + Environment Binding (IL-3 nullification capability)
- Economic Nullification: Attacker's ROI < 0 is established
- Non-Halting operation: continued operation even under attack
What RS-6 cannot achieve (legally important):
- ❌ 100% detection of 0-day attacks — 0-day = by definition "unknown threats." However, through Runtime Immunity's structural protection, Attack Outcomes are nullified even for attacks that cannot be detected.
- ❌ Protection from physical access — RS-6 targets the protection of the "runtime environment." Direct physical tampering with CPU/memory boards is outside the scope of this definition.
- ❌ Complete countermeasures against side-channel attacks — RS-6 is optimized for response to "logical attacks." Attacks utilizing physical information such as timing, power, and electromagnetic emissions belong to a separate domain.
⚠️ NOTICE: Regarding Cryptographic Assumptions: The NL evaluation in this definition document is based on current cryptographic knowledge. Should the assumptions underlying cryptographic strength change due to the practical realization of quantum computing, the Post-Quantum Nullification (PQN) extension shall be applied. The PQN extension is designed not as an invalidation of this definition but as an extension of the NL axis (see Runtime Immunity Definition Document v1.1 §4.3).
Conclusive positioning of RS-6:
- ✅ RS-6 = "the most practical and strongest defense under current cryptographic assumptions"
- ❌ RS-6 ≠ "complete protection" (in cybersecurity, "complete" does not exist)
§5Glossary
- Runtime: The general state of execution in which a processor executes its instruction set (ISA) and program code and execution data are loaded into RAM
- Protection Attribute: The seven elements that Runtime Stability must protect (S, R, A, C, Cf, D, Ix)
- Runtime Security: Detection-based runtime protection (dynamic response type)
- Runtime Immunity: Structure-based runtime protection (preventive type)
- SL (Security Level): The achievement level of Runtime Security (0–3)
- IL (Immunity Level): The achievement level of Runtime Immunity (0–3)
- RS (Runtime Stability Level): The overall protection level. RS = SL + IL (0–6)
- NL (Nullification Level): The degree of nullification of Attack Outcomes (NL-1–3)
- Inexploitability: A state in which vulnerabilities exploitable by attackers are structurally absent in the system's runtime state
§6Revision History
- v1.0 (2026-02-25): Initial release. 7-attribute definition.
- v2.0 (2026-02-27): Confidentiality added. CDER metrics.
- v2.4 (2026-02-28): Inexploitability added. Three-layer defense. EONR metrics.
- v3.0 (2026-03-03): Design Philosophies made explicit. Logic for Security/Immunity derivation clarified.
- v3.1 (2026-03-03): Inclusive definition added. Relationship with Traditional Information Security made explicit.
- v3.2 (2026-03-03): Explicit definition of RS = SL + IL. Refinement of Inexploitability definition. Integration of RS-6 definition. Symmetrization of derived structures.
- v3.3 (2026-03-03): Added Ordinal Scale notation to §4.1. Added Ix evaluation direction to §1.5.
§7About This Document
§7.1Purpose
This definition document aims to establish the concepts, definitions, and framework of Runtime Stability and to clarify the relationship with existing security and safety standards.
§7.2Scope
This definition document constitutes the Concepts and Definitions volume of Runtime Stability. Specific conformance criteria, evaluation methods, and certification criteria are defined in the subsequent "Conformance and Evaluation (Document 2)" volume.
§7.3Cross-References
- Runtime Security Definition Document v1.1: Detailed definition of the detection-based protection system (3-axis SL evaluation)
- Runtime Immunity Definition Document v1.1: Detailed definition of the structure-based protection system (2-axis NL definition, PQN extension framework)
§7.4Positioning as an Inclusive Framework
Runtime Stability v3.3 is a comprehensive framework that systematizes the following relationships:
- Traditional Information Security (Layer 1: Prevention)
- + Runtime Security (Layer 2: Control Retention)
- + Runtime Immunity (Layer 3: Outcome Nullification)
- = Runtime Stability Framework (Integrated Achievement of 7 Attributes)
§7.5Improvements from v3.2 to v3.3
- §1.5: Added Ix achievement evaluation direction (dual evaluation from SL axis and IL axis) to the Inexploitability notation
- §4.1: Explicitly noted in the annotation that RS = SL + IL is an Ordinal Scale