Tobias Distler

Network-based services such as distributed databases, file systems, or blockchains are essential parts of today's computing infrastructures and therefore must be able to withstand a wide spectrum of fault scenarios, including hardware crashes, software failures, and attacks. Although a variety of state-machine replication protocols exist that provide fault and intrusion tolerance, it is inherently difficult to build dependable systems based on their complex and often incomplete specifications. Unfortunately, this commonly leads to systems being vulnerable against correlated failures or attacks, for example, in cases where, to save development and maintenance costs, all replicas in a system share the same homogeneous implementation.

In the Mirador project, we seek to eliminate this gap between theory and practice, proposing a novel paradigm for the specification and implementation of dependable systems: micro replication. In contrast to existing systems, micro-replication architectures do not consist of a few monolithic and complex replicas, but instead are organized as dedicated, loosely coupled micro-replica clusters that are each responsible for a different protocol step or mechanism. As a key benefit of providing only a small subset of the overall protocol functionality, micro replicas make it significantly easier to reason about the completeness and correctness of both specifications as well as implementations. To further reduce complexity, all micro replicas follow a standardized internal work flow, thereby greatly facilitating the task of introducing heterogeneity at the replica, communication, and authentication level.

Starting from this basic concept, in the Mirador project we explore micro replication as a means to build dependable replicated systems and examine its flexibility by developing micro-replication architectures for different fault models (i.e., crashes and Byzantine faults). In particular, our research focuses on two problem areas: First, we aim at increasing the resilience of micro-replicated systems by enabling them to recover from replica failures. Among other things, this requires mechanisms for rejuvenating micro replicas from a clean state and integrating replacement replicas at runtime. Second, our goal is to improve the performance and efficiency of micro-replicated systems and the applications running on top of them. Specifically, this includes the design of techniques to reduce overheads by exploiting optimistic approaches that save processor and network resources in the absence of faults. Furthermore, we investigate ways to restructure the service logic and for example outsource preprocessing steps to upstream micro-replica clusters. To evaluate the concepts, protocols, and mechanisms developed in the Mirador project, we build a heterogeneous micro-replicated platform that allows us to conduct experiments for a wide range of different settings and with a variety of applications.

The Mirador project is funded for 3 years by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – 541017677.

For more information, please visit the project's CRIS page.

Selected Publications

Open-Source Prototype

Future generations of the Internet of Things to a significant degree will consist of battery-free devices that only have a scarce amount of resources and harvest all the energy they consume from their environment. Since such small systems have to perform critical tasks, the affected data and computations need to be protected by means of redundant distribution across several nodes. Byzantine fault-tolerant (BFT) replication protocols are theoretically capable of meeting the demanded requirements in terms of reliability and availability, but unfortunately they are not directly applicable in resource-constrained embedded systems. This drawback is a result of the fact that existing BFT protocols were designed with server-based infrastructures in mind, which especially becomes evident in two aspects: Firstly, existing protocol implementations have a comparably large memory footprint and therefore are not suitable for small computing nodes, even with the protocols' minimal configuration. Secondly, existing approaches assume correct replicas to have a mostly uninterrupted power supply, meaning that their progress guarantees usually cannot be provided in systems in which temporary power failures may happen at any time.

The goal of the BFTeam project is to solve these shortcomings through whole-system runtime support for the operation of BFT protocols on embedded nodes. The special nature of this project lies in the cooperation between two research domains that in the past have largely been pursued independently from each other: (1) the development of resource-efficient protocols for the robust replication of applications and (2) the static analysis of embedded real-time systems to ensure upper bounds on execution time, energy consumption, and the size of a system's memory footprint. The joint BFTeam approach is the first that enables the analysis of critical protocol steps and phases in order to, for example, only execute these steps or phases if enough energy is available to actually complete them.

To achieve these goals, BFTeam first focuses on providing replica-local progress guarantees that affect only individual nodes but already suffice to support asynchronous BFT protocols. In a next step, the approach is then extended to also include system-wide guarantees for the entire replica group, thereby enabling the additional implementation of energy-aware partially synchronous protocols. For the evaluation of both the protocols and analysis techniques, BFTeam develops a hardware platform that is tailored to the specific requirements of the project. With this analyzable platform, BFTeam is able to assess the effectiveness of its solutions based on real-world experiments.

The BFTeam project is funded for 2 years by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – 554710377.

Selected Publications

Open-Source Prototype

The aviation industry has an increasing demand for digitization in both administrative as well as operative areas, thereby maintaining and ideally further improving existing safety standards. The BALu project contributes to these efforts by researching approaches to leverage the potential of distributed ledger systems in general, and blockchain technology in particular. Specifically, the project focuses on two application scenarios: (1) a blockchain-based solution enabling the complete and audit-proof documentation of all components throughout an aircraft's entire life cycle, and (2) a decentralized flight-data recorder for unmanned air vehicles that reliably distributes the collected information among multiple drones and ground stations in order to ensure the availability of recordings even if the original storage device is destroyed.

The BALu project is funded for 2 years by the Bundesministerium für Wirtschaft und Klimaschutz (BMWK).

For more information, please visit the project's CRIS page.

Selected Publications

Open-Source Prototype

Coordination services such as ZooKeeper are essential building blocks of today's data-center infrastructures as they provide processes of distributed applications with means to exchange messages, to perform leader election, to detect machine or process crashes, or to reliably store configuration data. Providing an anchor of trust for their client applications, coordination services have to meet strong requirements regarding stability and performance. Only this way, it is possible to ensure that a coordination service neither is a single point of failure nor becomes the bottleneck of the entire system.

To address drawbacks of state-of-the-art systems, the EDC project develops approaches that enable coordination services to meet the stability and performance demands. Amongst other things, this includes making these services resilient against both benign and malicious faults, integrating mechanisms for extending the service functionality at runtime in order to minimize communication and synchronization overhead, as well as designing system architectures for effectively and efficiently exploiting the potential of multi-core servers. Although focusing on coordination services, the developed concepts and techniques are expected to also be applicable to other domains, for example, replicated data stores.

For more information, please visit the project's CRIS page.

Selected Publications

The processing of large amounts of data on distributed execution platforms such as MapReduce or Heron contributes significantly to the energy consumption of today's data centers. The E³ project aims at minimizing the power consumption of such execution environments without sacrificing performance. For this purpose, the project develops means to make execution environments and data-processing platforms energy aware and to enable them to exploit knowledge about applications to dynamically adapt the power consumption of the underlying hardware. To measure and control the energy consumption of hardware units, E³'s energy-aware platforms rely on hardware features provided by modern processors that allow the system software of a server to regulate the server's power usage at runtime by enforcing configurable upper limits. As a key benefit, this approach makes it possible to build data-processing and execution platforms that, on the one hand, save energy during phases in which only low and medium workloads need to be handled and, on the other hand, are still able to offer full processing power during periods of high workloads.

For more information, please visit the project's CRIS page.

Selected Publications

Internet-based services play a central role in today's society. With such services progressively taking over from traditional infrastructures, their complexity steadily increases. On the downside, this leads to more and more faults occurring. As improving software-engineering techniques alone will not do the job, systems have to be prepared to tolerate faults and intrusions. REFIT investigates how systems can provide fault and intrusion tolerance in a resource-efficient manner. The key technology to achieve this goal is virtualization, as it enables multiple service instances to run in isolation on the same physical host. Server consolidation through virtualization not only saves resources in comparison to traditional replication, but also opens up new possibilities to apply optimizations (e.g., deterministic multi-threading). Resource efficiency and performance of the REFIT prototype are evaluated using a web-based multi-tier architecture, and the results are compared to non-replicated and traditionally-replicated scenarios. Furthermore, REFIT develops an infrastructure that supports the practical integration and operation of fault and intrusion-tolerant services; for example, in the context of cloud computing.

The REFIT project was funded for 6 years by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – 157267460.

For more information, please visit the project's CRIS page.

Selected Publications

Summary (in German)

Open-Source Prototypes

The goal of the TClouds project is to provide a computing and network platform to enable resilient and privacy-enabled deployment of Internet-scale critical information and communication infrastructures. The aim is to achieve this while addressing the challenges of cross-border privacy, end-user usability, and acceptance, which are essential for wide deployment of such an infrastructure. Our contribution to the TClouds project concentrates on the following aspects:

Security-enhanced Cloud Components: Cloud computing services are based on individual components such as storage, networks, and virtual machines. We aid in securing these components to prevent data leakage and improve the resilience of applications and individual machines. In order to achieve these goals, we focus on specialized run-time environments and tailored virtualization support.

Middleware for Adaptive Resilience: Our task is the development of approaches for resource-efficient intrusion-tolerant services and to focus on implementation of reactive behavior to address attacks and faults. This will be realized by defining programming interfaces with specific focus on virtualization and checkpointing of applications. Furthermore, the outcomes of the security-enhanced cloud components will be integrated and tested.

The TClouds project was funded for 3 years by the European Union's Seventh Framework Programme (FP7/2007-2013) under grant agreement no. 257243.

For more information, please visit the project's CRIS page.

Selected Publications

In today's world, computing systems are continuously exposed to the threat of malicious attacks. Large-scale distributed systems nowadays are likely to suffer from vulnerabilities, and the increasing complexity of software makes it unlikely that vulnerabilities will disappear soon. An intrusion-tolerant system is one that continues to function properly in spite of malicious intrusions in some parts of the systems. However, the number of simultaneous intrusions that such a system can tolerate is limited. Given enough time, there is the chance that an attacker compromises more parts of the system than the system can tolerate. Proactive recovery is an important mechanism to remedy this problem. Proactive recovery periodically cleans up replicas of a service. In the recovery operation, the replica is re-initialized to an clean state, removing all potential malicious intrusions. This step is performed independent of whether an intrusion actually happened. This approach guarantees correct system operations as long as nodes are recovered more frequently than an attacker can compromise them. VM-FIT is a novel system that harnesses virtualization technology for building dependable distributed systems with proactive recovery. The virtualization-based approach yields a hybrid system model with low replication costs. It allows minimizing the impact that the proactive recovery has on system operations. Furthermore, it allows an efficient implementation of secure distributed state transfer.

For more information, please visit the project's Web page.

Selected Publications

The goal of the project is to develop a Fault/intrusiOn REmoVal through Evolution & Recovery (FOREVER) service. This service can be used to enhance the resilience of replicated systems, namely those that can be affected by malicious attacks. FOREVER addresses three of the research gaps identified in ReSIST D13 deliverable, namely: evolution of threats, dependability cases, and diversity for security. In order to achieve the project goal, the work will be divided into three main tasks: (1) definition of the FOREVER service architecture, (2) analysis of how diversity can be managed, and (3) evaluation of the FOREVER service and development of a dependability case.

The FOREVER project was funded for 1 year by the European Union through the ReSIST Network of Excellence (IST-4-026764-NOE).

For more information, please visit the project's Web page.

Selected Publications