Intrusion-tolerant middleware