1. Oct 1999SRDS 991 On Diffusing Updates in a Byzantine Environment Dahlia Malkhi Yishay Mansour Michael K. Reiter

2. Oct 1999SRDS 992 Diffusion Means by which an update, initially known to a portion of the system, is propagated to the system. Fundamental tool, used for driving replicated systems to a consistent, uniform state May be deployed off-line, distributedly, efficiently

3. Oct 1999SRDS 993 Random Propagation System comprises of n replicated servers. Benign failures. Every update is initially received by one replica (e.g., directly from source). This replica is active. Protocol perceived to work in (logical) rounds. In each round, each active replica randomly chooses a target and sends it copy of updates. Replica becomes active upon reception of update

4. Oct 1999SRDS 994 Analogy1: Epidemic Style Diffusion –Well understood mathematical analysis –Logarithmic delay, two “phases” –Reasonable communication and processing load

5. Oct 1999SRDS 995 Analogy 2: News-style diffusion –Large, complex networked system –Multi-stage: source  media  rumour –Components (people) are intermittently unavailable, move, etc. –Untrusted/unreliable participants may spread false rumours –Utmost reliability is not a goal  Suitable analogy for large-scale, highly decentralized computer networks

6. Oct 1999SRDS 996 This work: Diffusion in a Byzantine environment Assumptions: –n replicas, less than t simultaneous failures –Update introduced to initial set of receivers –Diffused update is accepted when t different copies of it are received –Full Byzantine model: no signatures –stronger model –authentication of source directly is easier than signatures

7. Oct 1999SRDS 997 Measures Delay: expected number of rounds from the time update arrives in system until all correct replicas accept it F in : fan-in, expected maximum number of messages received in a round from correct replicas by any replica *F out : number of message sent in round (1).

8. Oct 1999SRDS 998 General Results Lower-bound on delay: – active replicas in round k  at most copies of update sent in round – messages sent up to round k  at most new replicas become active  –by recursion: Delay =

9. Oct 1999SRDS 999 A Tradeoff Compare with: Delay = => Good delay must incur a cost in load!

10. Oct 1999SRDS 9910 Random propagation in a Byzantine environment Each update is initially introduced at replicas (e.g., directly from source). These replicas are active. In each round, each replica randomly chooses a target and sends it copy of updates. Replica becomes active when t distinct copies of update received.

11. Oct 1999SRDS 9911 Delay of random propagation in a Byzantine environment

12. Oct 1999SRDS 9912 Analysis of random propagation Expect roughly rounds to move from to active replicas It takes the same order of time to reach entire system! –neglecting logarithmic factors, this is the expected delay Fan-in: –almost optimal Delay*Fan-in

13. Oct 1999SRDS 9913 Tree-Random Increase fan-in to reduce delay Main idea: Quickly activate the root, then diffuse down the tree Protocol: each node randomly targets the root and two children Family of optimal Fan-in*Delay protocols

14. Oct 1999SRDS 9914 Good or bad news? There are efficient diffusion protocols for Byzantine environment –reasonable communication/processing load Protocols can (almost) meet lower-bounds Delay increases significantly due to full Byzantine failures (lack of signatures)

15. Oct 1999SRDS 9915 Motivating application Fleet: A scalable and survivable data repository Powerful : From semantically weak data objects (shared variables, files) to semantically powerful ones (mutual exclusion, coordination) Survivable : Data objects remain correct and available despite server penetrations and (in some cases) client penetrations Underlying technology: Adaptation of quorum systems, Byzantine quorum systems [Malkhi & Reiter 97] and Probabilistic quorum systems [Malkhi, Reiter & Wright 97] server client server Corrupt server

16. Oct 1999SRDS 9916 Propagation in Fleet Efficient but survivable propagation of updates to entire system –enables better resilience to network partitions –increases consistency of probabilistic quorum systems