Edmund L. Wong

Zyzzyva: speculative byzantine fault tolerance

We present Zyzzyva, a protocol that uses speculation to reduce the cost and simplify the design of Byzantine fault tolerant state machine replication. In Zyzzyva, replicas respond to a clients request without first running an expensive three-phase commit protocol to reach agreement on the order in which the request must be processed. Instead, they optimistically adopt the order proposed by the primary and respond immediately to the client. Replicas can thus become temporarily inconsistent with one another, but clients detect inconsistencies, help correct replicas converge on a single total ordering of requests, and only rely on responses that are consistent with this total order. This approach allows Zyzzyva to reduce replication overheads to near their theoretical minimal.

Zyzzyva: Speculative Byzantine fault tolerance

A longstanding vision in distributed systems is to build reliable systems from unreliable components. An enticing formulation of this vision is Byzantine Fault-Tolerant (BFT) state machine replication, in which a group of servers collectively act as a correct server even if some of the servers misbehave or malfunction in arbitrary (“Byzantine”) ways. Despite this promise, practitioners hesitate to deploy BFT systems, at least partly because of the perception that BFT must impose high overheads. In this article, we present Zyzzyva, a protocol that uses speculation to reduce the cost of BFT replication. In Zyzzyva, replicas reply to a clients request without first running an expensive three-phase commit protocol to agree on the order to process requests. Instead, they optimistically adopt the order proposed by a primary server, process the request, and reply immediately to the client. If the primary is faulty, replicas can become temporarily inconsistent with one another, but clients detect inconsistencies, help correct replicas converge on a single total ordering of requests, and only rely on responses that are consistent with this total order. This approach allows Zyzzyva to reduce replication overheads to near their theoretical minima and to achieve throughputs of tens of thousands of requests per second, making BFT replication practical for a broad range of demanding services.

Truth in advertising: lightweight verification of route integrity

We design and evaluate a lightweight route verification mechanism that enables a router to discover route failures and inconsistencies between advertised Internet routes and actual paths taken by the data packets. Our mechanism is accurate, incrementally deployable, and secure against malicious intermediary routers. By carefully avoiding any cryptographic operations in the data path, our prototype implementation achieves the overhead of less than 1% on a 1 Gbps link, demonstrating that our method is suitable even for high-performance networks.

BFT: the time is now

Data centers strive to provide reliable access to the data and services that they host. This reliable access requires the hosted data and services hosted by the data center to be both consistent and available. Byzantine fault tolerance (BFT) replication offers the promise of services that are consistent and available despite arbitrary failures by a bounded number of servers and an unbounded number of clients.

It's on me! the benefit of altruism in BAR environment

Cooperation, a necessity for any peer-to-peer (P2P) cooperative service, is often achieved by rewarding good behavior now with the promise of future benefits. However, in most cases, interactions with a particular peer or the service itself eventually end, resulting in some last exchange in which departing participants have no incentive to contribute. Without cooperation in the last round, cooperation in any prior round may be unachievable. In this paper, we propose leveraging altruistic participants that simply follow the protocol as given. We show that altruism is a simple, necessary, and sufficient way to incentivize cooperation in a realistic model of a cooperative services last exchange, in which participants may be Byzantine, altruistic, or rational and network loss is explicitly considered. By focusing on network-level incentives in the last exchange, we believe our approach can be used as the cornerstone for incentivizing cooperation in any cooperative service.

Regret freedom isn't free

Cooperative, peer-to-peer (P2P) services--distributed systems consisting of participants from multiple administrative domains (MAD)--must deal with the threat of arbitrary (Byzantine) failures while incentivizing the cooperation of potentially selfish (rational) nodes that such services rely on to function. This paper investigates how to specify conditions (i.e., a solution concept) for rational cooperation in an environment that also contains Byzantine and obedient peers. We find that regret-free approaches--which, inspired by traditional Byzantine fault tolerance, condition rational cooperation on identifying a strategy that proves a best response regardless of how Byzantine failures occur--are unattainable in many fault-tolerant distributed systems. We suggest an alternative regret-braving approach, in which rational nodes aim to best respond to their expectations regarding Byzantine failures: the chosen strategy guarantees no regret only to the extent that such expectations prove correct. While work on regret-braving solution concepts is just beginning, our preliminary results show that these solution concepts are not subject to the fundamental limitations inherent to regret freedom.

What's a little collusion between friends?

This paper proposes a fundamentally different approach to addressing the challenge posed by colluding nodes to the sustainability of cooperative services. Departing from previous work that tries to address the threat by disincentivizing collusion or by modeling colluding nodes as faulty, this paper describes two new notions of equilibrium, k-indistinguishability and k-stability, that allow coalitions to leverage their associations without harming the stability of the service.

Reasoning with MAD distributed systems

While the setting of this question may appear implausible, this is precisely the environment in which services that span multiple administrative domains (MAD) must function. In such services--which include applications such as content dissemination (e.g.., [2]), file backup (e.g., [6]), volunteer computing (e.g., [5]),multihop wireless networking (e.g., [4]), and Internet routing--resources are not under the control of a single administrative domain, so the necessary cooperation cannot simply be achieved by fiat. Instead, it is imperative that the service be structured so that nodes--which are administered by different, potentially selfish entities--have an incentive to help sustain it. Indeed, such issues are not imaginary: ample evidence suggests that a large number of peers will free-ride or deviate from the assigned protocol if it is in their interest to do so (e.g., [3,9,16,21]).

Get off my prefix! the need for dynamic, gerontocratic policies in inter-domain routing

Inter-domain routing in todays Internet is plagued by security and reliability issues (e.g., prefix hijacking), which are often caused by malicious or Byzantine misbehavior. We argue that route selection policies must move beyond static preferences that select routes on the basis of static attributes such as route length or which neighboring AS is advertising the route. We prove that route convergence in the presence of Byzantine misbehavior requires that the route selection metric include the dynamics of route updates as a primary component. We then describe a class of simple dynamic policies which consider the observed “ages” of routes. These gerontocratic policies can be combined with static preferences and implemented without major infrastructural changes. They guarantee convergence when adopted universally, without sacrificing most of the flexibility that autonomous systems enjoy in route selection. We empirically demonstrate that even if adopted unilaterally by a single autonomous system, gerontocratic policies yield significantly more stable routes, are more effective at avoiding prefix hijacks, and are as responsive to legitimate route changes as other policies.

Have your cake and eat it too!: enabling frequency diversity through opportunism

The broadcast nature of wireless networks is both a boon and a bane. On the one hand, multiple receivers may overhear a single transmission on the same channel at no additional cost above a point-to-point transmission; this property has been exploited in many opportunistic applications (e.g., [2]). On the other hand, the shared nature of the medium effectively forces wireless nodes to leverage frequency diversity and channelization for efficiency. Unfortunately, coordinating communication between nodes that may switch channels at any time is difficult and may in fact offset any performance gains from leveraging frequency diversity.