Tolerating corrupted communication

Abstract

Consensus encalpsulates the inherent problems of building fault tolerant distributed systems. In this context, the classic model of Byzantine faulty processes can be restated such that messages from a subset of processes can be arbitrarily corrupted (including addition and omission of messages).We consider the case of dynamic and transient faults, that may affect all processes and that are not permanent, and we model them via corrupted communication. For corrupted communication it is natural to distinguish between the safety of communication, which is concerned with the number of altered messages, and the liveness of communication, which restricts message loss.We present two consensus algorithms, together with sufficient conditions on the system to ensure correctness. Our first algorithm needs strong conditions on safety but requires weak conditions on liveness in order to terminate. Our second algorithm tolerates a lower degree of communication safety at the price of stronger liveness conditions.Our algorithms allow us to circumvent the resilience lower bounds from Santoro/Widmayer and Martin/Alvisi.

Formal Verification of Consensus Algorithms Tolerating Malicious Faults

“…As an example of an HO algorithm, a specification of the U T ,E ,α algorithm introduced in [2], appears as Algorithm 1. We consider a nonempty set V , with a specific element v 0 ∈ V ; the two values ?…”

“…Biely et al [2] introduce two non-synchronous Consensus algorithms tolerating malicious faults: the U T ,E ,α algorithm introduced in Section 2.1, and a one-round algorithm called A T ,E ,α . We instantiate the generic Isabelle locale SHOAlgorithm for these algorithms and verify their correctness.…”

“…The communication predicate for the U T ,E ,α algorithm, as specified in [2], is defined as the conjunction of the two following predicates: …”

“…The proof is based on the informal proof given in [2], which we have split into a sequence of lemmas. Our main contribution is that we have been able to carry out a formal proof of a non-synchronous algorithm tolerating malicious faults with reasonable effort (the overall size of the verbose Isar proof script is under 900 lines, including comments).…”

“…The A T ,E ,α algorithm, introduced together with U T ,E ,α in [2], is represented in Isabelle in an analogous way. It is a one-round HO algorithm in which a decision is taken immediately if a sufficient number of identical messages is received.…”