Combining abstraction with Byzantine fault-tolerance

This thesis describes a technique to build replicated services that combines Byzantine fault tolerance with work on abstract data types. Tolerating Byzantine faults is important because software errors are a major cause of outages and they can make faulty replicas behave arbitrarily. Abstraction hides implementation details to enable the reuse of existing service implementations and to improve the ability to mask software errors. We improve resilience to software errors by enabling the recovery of faulty replicas using state stored in replicas with distinct implementations; using an opportunistic N-version programming technique that runs distinct, off-the-shelf implementations at each replica to reduce the probability of common mode failures; and periodically repairing each replica using an abstract view of the state stored by the correct replicas in the group, which improves tolerance to faults due to software aging. We have built two replicated services that demonstrate the use of this technique. The first is an NFS service where each replica runs a different off-the-shelf file system implementation. The second is a replicated version of the Thor object-oriented database. In this case, the methodology enabled reuse of the existing database code, which is non-deterministic. These examples suggest that our technique can be used in practice: Our performance results show that the replicated systems perform comparably to their original, non-replicated versions. Furthermore, both implementations required only a modest amount of new code, which reduces the likelihood of introducing more errors and keeps the monetary cost of using our technique low. Thesis Supervisor: Barbara Liskov Title: Ford Professor of Engineering Para o meu av6 VItor Hugo o poeta J um fingidor Finge tdo completamente Que chega afingir que e dor A dor que deveras sente. Fernando Pessoa, Autopsicografia To my grandfather Vitor Hugo The poet is a pretender He pretends so absolutely He manages to pretend a pain From the real pain he feels. Fernando Pessoa, Self-Psychography