End-to-End Arguments in System Design¶
Saltzer, J. H., Reed, D. P., & Clark, D. D. (1984). End-to-End Arguments in System Design. ACM Transactions on Computer Systems, 2(4), 277-288.
Cited by¶
5 citations across 5 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Communication Repair
- The four-cell conversation-analytic repair taxonomy maps onto retry/recovery semantics in distributed protocols: self-initiated self-repair is client-side retry, other-initiated self-repair is NAK-and-retransmit, other-initiated other-repair is server-side correction, and self-initiated other-repair is a unilateral protocol upgrade — with the preference for self-initiation mapping onto the end-to-end principle.
This sourceArgues that reliability functions belong at the endpoints, mapping onto the conversation-analytic preference for self-initiated self-repair.
Supported in partVerified against the publisher's abstract
States the end-to-end argument (reliability functions belong at the endpoints), backing the preference-for-self-initiation clause but not the protocol mapping.
“The principle, called the end-to-end argument, suggests that functions placed at low levels of a system may be redundant or of little value when compared with the cost of providing them at that low level.”
- The four-cell conversation-analytic repair taxonomy maps onto retry/recovery semantics in distributed protocols: self-initiated self-repair is client-side retry, other-initiated self-repair is NAK-and-retransmit, other-initiated other-repair is server-side correction, and self-initiated other-repair is a unilateral protocol upgrade — with the preference for self-initiation mapping onto the end-to-end principle.
- Idempotence
- Cryptographic and security protocols use idempotence to defend against replay attacks — nonce-based protocols mark messages so that a re-presented message is detected and discarded; the property dual to idempotence (rejecting duplicates) and the property itself (tolerating duplicates) are two strategies against the same threat, an end-to-end-argument framing in the sense of Saltzer, Reed, and Clark (1984).
This sourceArgues that correctness and performance properties are best implemented and measured at communication endpoints rather than intermediate layers; analogue for evaluating escalation effectiveness end-to-end across tiers.
Supported in partVerified against the publisher's abstract
The abstract states the end-to-end argument and names duplicate message suppression as one discussed example, but not the duplicate-rejection versus duplicate-tolerance duality or any message-marking mechanism.
“The principle, called the end-to-end argument, suggests that functions placed at low levels of a system may be redundant or of little value when compared with the cost of providing them at that low level. Examples discussed in the paper include bit-error recovery, security using encryption, duplicate message suppression, recovery from system crashes, and delivery acknowl-edgment.”
- Cryptographic and security protocols use idempotence to defend against replay attacks — nonce-based protocols mark messages so that a re-presented message is detected and discarded; the property dual to idempotence (rejecting duplicates) and the property itself (tolerating duplicates) are two strategies against the same threat, an end-to-end-argument framing in the sense of Saltzer, Reed, and Clark (1984).
- Local Autonomy & Tiered Escalation
- Tier-3 loop-back (issues escalated back to lower tiers without final resolution) should be <5%.
This sourceArgues that correctness and performance properties are best implemented and measured at communication endpoints rather than intermediate layers; analogue for evaluating escalation effectiveness end-to-end across tiers.
- Tier-3 loop-back (issues escalated back to lower tiers without final resolution) should be <5%.
Domain-specific¶
Mechanisms¶
- Protocol Stack
- The design principle that guards the boundary is the end-to-end argument: functions like reliability are often best placed at the endpoints (the transport and application layers) rather than smeared into every lower layer, keeping the network's core simple.
This sourcePlaces complete reliability at application endpoints while limiting lower-layer mechanisms to justified performance enhancements.
- The design principle that guards the boundary is the end-to-end argument: functions like reliability are often best placed at the endpoints (the transport and application layers) rather than smeared into every lower layer, keeping the network's core simple.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 2 of 5 citations: 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:d8fc79aaa90e · see in the full table