[Paper Review] Asynchronous Reconfiguration with Byzantine Failures

П. Н. Кузнецов, Andrei Tonkikh|SPIRE - Sciences Po Institutional REpository|May 27, 2020

Distributed systems and fault tolerance4 citations

TL;DR

This paper presents a Byzantine fault-tolerant reconfiguration mechanism for asynchronous replicated systems using forward-secure digital signatures to ensure consistency and availability despite malicious replicas and clients. By decoupling reconfiguration from consensus and leveraging verifiable proofs, it prevents stale reads and denial-of-service attacks, enabling secure, dynamic reconfiguration without trusted administrators or global ordering of configurations.

ABSTRACT

Replicated services are inherently vulnerable to failures and security breaches. In a long-running system, it is, therefore, indispensable to maintain a reconfiguration mechanism that would replace faulty replicas with correct ones. An important challenge is to enable reconfiguration without affecting the availability and consistency of the replicated data: the clients should be able to get correct service even when the set of service replicas is being updated. In this paper, we address the problem of reconfiguration in the presence of Byzantine failures: faulty replicas or clients may arbitrarily deviate from their expected behavior. We describe a generic technique for building asynchronous and Byzantine fault-tolerant reconfigurable objects: clients can manipulate the object data and issue reconfiguration calls without reaching consensus on the current configuration. With the help of forward-secure digital signatures, our solution makes sure that superseded and possibly compromised configurations are harmless, that slow clients cannot be fooled into reading stale data, and that Byzantine clients cannot cause a denial of service by flooding the system with reconfiguration requests. Our approach is modular and based on dynamic Byzantine lattice agreement abstraction, and we discuss how to extend it to enable Byzantine fault-tolerant implementations of a large class of reconfigurable replicated services.

Motivation & Objective

• To design a reconfiguration mechanism for asynchronous replicated services that remains available and consistent under Byzantine failures.
• To prevent stale reads and denial-of-service attacks from Byzantine clients or compromised replicas.
• To eliminate reliance on global ordering of configurations or trusted administrators.
• To enable secure, dynamic reconfiguration using forward-secure digital signatures and verifiable proofs.
• To provide a modular foundation for Byzantine fault-tolerant implementations of reconfigurable replicated services.

Proposed method

• The system uses a dynamic Byzantine lattice agreement (DBLA) abstraction as the core primitive for reconfiguration coordination.
• Clients issue reconfiguration and data operations without requiring consensus on the current configuration.
• Forward-secure digital signatures are used to bind configuration updates to time-ordered, cryptographically verifiable proofs.
• Each process maintains a local history of configurations and signs updates with forward-secure keys to prevent 'I still work here' and 'slow reader' attacks.
• Verifiable proofs are constructed using quorum-based signatures, ensuring only authentic outputs are accepted by correct processes.
• The protocol chains outputs from lower-level components using VerifyOutputValue functions, with proofs recursively verified to maintain integrity.

Experimental results

Research questions

• RQ1 How can reconfiguration be made available and consistent in an asynchronous system under Byzantine failures?
• RQ2 How can Byzantine clients or replicas be prevented from causing denial-of-service or stale data reads?
• RQ3 Can reconfiguration be achieved without relying on global configuration ordering or trusted administrators?
• RQ4 How can forward-secure signatures be used to ensure long-term consistency after key exposure?
• RQ5 What is the minimal set of abstractions needed to build a modular, Byzantine fault-tolerant reconfigurable service?

Key findings

• The proposed protocol ensures that superseded and compromised configurations are harmless due to forward-secure signatures.
• Slow clients cannot be tricked into reading stale data, as proofs are cryptographically bound to time-ordered configurations.
• Byzantine clients cannot flood the system into denial-of-service, as all reconfiguration requests must be accompanied by verifiable proofs.
• The system achieves reconfiguration without requiring consensus on the current configuration, enabling high availability.
• The use of forward-secure signatures eliminates the need for trusted key management or global ordering of configuration sequences.
• The protocol is modular and can be extended to implement a large class of reconfigurable replicated services under Byzantine faults.