Tolérance aux pannes | EPFL Graph Search

vignette|Fichier GIF animé de 8 algorithmes ECT dans un réseau 802.1aq. La source est surlignée en violet, la destination en jaune. Les lignes violettes sont des chemins entre la source et la destination et l'épaisseur indique combien de chemins traversent un lien donné. La tolérance aux pannes (ou « insensibilité aux pannes ») désigne une méthode de conception permettant à un système de continuer à fonctionner, éventuellement de manière réduite (on dit aussi en « mode dégradé »), au lieu de tomber complètement en panne, lorsque l'un de ses composants ne fonctionne plus correctement. L'expression est employée couramment pour les systèmes informatiques étudiés de façon à rester plus ou moins opérationnels en cas de panne partielle, c'est-à-dire éventuellement avec une réduction du débit ou une augmentation du temps de réponse. En d'autres termes, le système ne s'arrête pas de fonctionner, qu'il y ait défaillance matérielle ou défaillance logicielle. Un exemple en dehors de l'informati

SafetyPin: Encrypted Backups with Human-Memorable Secrets

Henry Nathaniel Corrigan-Gibbs

We present the design and implementation of SafetyPin, a system for encrypted mobile-device backups. Like existing cloud-based mobile-backup systems, including those of Apple and Google, SafetyPin requires users to remember only a short PIN and defends against brute-force PIN-guessing attacks using hardware security protections. Unlike today's systems, SafetyPin splits trust over a cluster of hardware security modules (HSMs) in order to provide security guarantees that scale with the number of HSMs. In this way, SafetyPin protects backed-up user data even against an attacker that can adaptively compromise many of the system's constituent HSMs. SafetyPin provides this protection without sacrificing scalability or fault tolerance. Decentralizing trust while respecting the resource limits of today's HSMs requires a synthesis of systems-design principles and cryptographic tools. We evaluate SafetyPin on a cluster of 100 low-cost HSMs and show that a SafetyPin-protected recovery takes 1.01 seconds. To process 1B recoveries a year, we estimate that a SafetyPin deployment would need 3,100 low-cost HSMs.

USENIX ASSOC2020

SafetyPin: Encrypted Backups with Human-Memorable Secrets

Henry Nathaniel Corrigan-Gibbs

USENIX Association2020

Solving consensus

Distributed systems are the basis of widespread computing facilities enabling many of our daily life activities. Telebanking, electronic commerce, online booking-reservation, and telecommunication are examples of common services that rely on distributed systems in order to achieve their desirable ubiquity. The success of these services increasingly depends on fault-tolerant systems to preserve their availability and reliability despite partial failures. Fault tolerance can be achieved by introducing redundancy into the system. This leads to the need of coordinating replicated components which has been one of the biggest trends in software technologies. This thesis is about process coordination in fault-tolerant distributed systems. In particular, it focuses on the problem of reaching agreement among processes considering the well-known Consensus problem. Consensus is regarded as an abstract problem whose solutions embody the complexity inherent to most agreement problems. This thesis studies the solvability of consensus in asynchronous network systems augmented with a failure detector oracle. Both, the processes and the network, are subject to benign failures. The thesis' overall contribution is a consensus algorithm that tolerates process crash and network omission failures, and exploits the recovery of crashed process. A contribution of this thesis is the definition of a novel type of weakly reliable communication channels, called Stubborn. The semantics of Stubborn channels reflect the reliability on communication required to solve consensus. Furthermore, it is shown that an algorithm designed with Stubborn in-stead of reliable channels can offer the same number of messages exchanged in favorable runs and avoid communication steps in disadvantageous runs. Stubborn channels can be easily implemented on top of existing network layers and make reasonable requirements on message buffering space. To handle the crash and recovery of processes it is proposed a model which encompasses the different patterns of crashes and recoveries that can be exhibited by the processes. The approach considers two different problems concerning crash and recovery: (1) processes that can be disruptive because they are always crashing and recovering, and (2) amnesia failures caused by crashes. The solution for the first problem consists in the use of a new class of failure detectors distinguished by its recurrent strong completeness property. To cope with the crash and recovery of any process involved, process amnesia cannot be arbitrary and thus processes are equipped with a stable storage device. The proposed algorithm judiciously specifies accesses to stable storage, and by exploiting the recovery of processes it can solve consensus in scenarios where other algorithms would otherwise block.

EPFL2000

Solving consensus

EPFL2000