CSR-DMSS-SM: Skeptical Systems

目前，系统非常信任其底层组件。不幸的是，由于硬件和软件系统的复杂性，这种信任经常被错置。特别是，一个层有时会报告它已经成功，而实际上它已经失败了。这样一个无声的错误，还是一个谎言？正如我们有时所说的那样，这使得构建下一代软件系统成为一个令人望而生畏的前景。在这份提案中，我们描述了威斯康星州测谎(LID)项目，在该项目中，我们计划开发检测谎言的方法和技术，从而支持新一代健壮的软件。我们的基本哲学是怀疑论，即一个系统通常信任一个层来正确地完成操作，但另外还有额外的机制来验证它确实做到了这一点。因此，我们的主要目标是发展一门怀疑性系统设计的科学，包括一套原则和方法，系统可以用来在出现静默故障时保持健壮。LID项目由三个主要部分组成，都是在存储系统领域内进行的，因为我们认为存储是一个重要的问题领域，在其中持怀疑态度将具有很大的价值。首先是更好地理解谎言对当前体系的影响。因此，我们计划开发一个全面的谎言注入框架，并使用它来分析静默故障如何影响系统。其次，我们计划设计、实现和评估一组显式和隐式测谎器。显式测谎器暴露信息以使更高层能够验证S层的操作，而隐式检测器利用隐蔽通道来应对缺乏显式辅助的情况。最后，我们将研究N版本文件系统在测谎和恢复中的使用。LID项目将在三个基本方面改变系统设计和实现的格局。首先，我们对现有系统的研究将为如何构建系统以抵御无声故障提供关键见解。其次，通过开发显式和隐式测谎器，我们将加深我们对如何设计系统来应对谎言的了解，即使没有明确的帮助来这样做。最后，我们将看看N版本编程[7]的承诺是否能在测谎问题领域实现；成功将改变我们构建可靠存储系统的方式。A.1智力价值智力的优点和重要性：我们将通过三个基本方法提高怀疑论系统设计科学中的知识状态。首先，我们将开发一些技术来了解系统如何应对静默故障。其次，我们将设计、实现和评估显式和隐式测谎器，从而为系统如何验证底层的正确操作提供洞察。最后，我们将开发利用多个文件系统的机制，以低成本的方式提高系统可靠性。资格：我们相信，随着我们利用我们在文件和存储系统[10、13、12、20、59、60、62、60、59、58]、复杂系统分析[8、21、32、50、51]以及灰盒和相关技术[2、15、33、46、48]方面的专业知识，我们有能力在这一艰巨的问题上取得进展。我们之前工作的这三个方面都有助于我们怀疑论系统设计科学的发展。组织和获取资源：从组织的角度来看，我们的目标是执行？低成本、高影响？研究。因此，这项提案所要求的大部分资金都是人力成本。从计算的角度来看，我们可以访问数以千计的计算机和多个存储群集。A.2更广泛的影响在促进教学、培训和学习的同时推进发现：总的来说，我们致力于利用尖端系统技术为学生提供实践培训。我们还计划将我们的研究纳入许多高级课程，从而对威斯康星州所有通过系统课程的学生产生影响。扩大代表性不足群体的参与：我们的主要重点一直是增加女性对计算机科学研究的参与。在过去的七年里，我们已经毕业了五名女性。作为这个项目的一部分，我们还计划在秋季再招聘一名女性。加强研究和传播成果的基础设施：在这项提议中，我们计划开发一种新的系统设计怀疑论方法；我们相信这一观点在建设下一代系统中至关重要，因此希望尽可能广泛地传播。我们将通过三种主要方式做到这一点：通过传统的出版媒体，这在过去影响了各种存储系统的设计和实施，包括EMC Centera[32]和NetApp文件管理器[39]；通过开发大量的软件产品，我们与开源社区共享了这些产品，从而改进了各种代码库；最后，通过我们与NetApp的互动，以及由此实现的技术转让。造福社会：我们的生活越来越依赖于计算机系统。怀疑论系统设计的科学对下一代软件系统的开发至关重要。通过采取怀疑的态度，我们建立的系统将更加稳健，从而更好地服务于社会。

Systems currently place a great deal of trust in their underlying components. Unfortunately, due to the complexity of both hardware and software systems, such trust is often misplaced. In particular, a layer will sometimes report that it has succeeded when in fact it has failed. Such a silent fault, or a ?lie? as we will sometimes call it, makes the construction of the next generation of software systems a daunting prospect. In this proposal, we describe the Wisconsin Lie Detection (LID) project, in which we plan to develop methods and techniques to detect lies and thus enable a new generation of robust software. Our basic philosophy is one of skepticism, in which a system generally trusts a layer to correctly complete an operation, but in addition has extra machinery to verify that it indeed has done so. Thus, our major objective is to develop a science of skeptical systems design, including a set of principles and methods systems can employ to be robust to silent faults should they arise. The LID project consists of three major components, all conducted within the domain of storage systems, as we believe storage is an important problem area within which skepticism will be of great value. The first is better understanding the effects of lies on current systems. Thus, we plan to develop a comprehensive lie-injection framework and use it to analyze how silent faults affect systems. Second, we plan to design, implement, and evaluate a set of explicit and implicit lie detectors. Explicit lie detectors expose information to enable higher layers to verify a layer?s operation, whereas implicit detectors utilize covert channels to cope with the lack of explicit assistance. Finally, we will investigate the use of an N-version file system in lie detection and recovery. The LID project will change the landscape of system design and implementation in three fundamental ways. First, our study of existing systems will lend key insights into how systems should be built to withstand silent faults. Second, by developing explicit and implicit lie detectors, we will deepen our knowledge of how to design systems to cope with lies even when no explicit aid to do so exists. Finally, we will see whether the promise of N-version programming [7] can be realized in the problem domain of lie detection; success will alter how we build reliable storage systems.A.1 Intellectual MeritIntellectual merit and importance: We will advance the state of knowledge in the science of skeptical systems design in three fundamental ways. First, we will develop techniques to understand how systems react to silent failures. Second, we will design, implement, and evaluate both explicit and implicit lie detectors, thus providing insight on how systems can verify the correct operation of underlying layers. Finally, we will develop mechanisms to utilize multiple file systems to improve system reliability in a low-cost manner. Qualifications: We believe we are well positioned to make progress on this demanding problem, as we draw on our expertise in file and storage systems [10, 13, 12, 20, 59, 60, 62, 60, 59, 58], analysis of complex systems [8, 21, 32, 50, 51], and gray-box and related techniques [2, 15, 33, 46, 48]. All three aspects of our previous work feed into our development of the science of skeptical systems design.Organization and access to resources: From an organizational viewpoint, our goal is to perform ?low-cost, highimpact? research. Hence, the bulk of funding requested within this proposal is found in human costs. From a computational standpoint, we have access to thousands of machines and multiple storage clusters.A.2 Broader ImpactsAdvancing discovery while promoting teaching, training, and learning: In general, we work to give students hands-on training with cutting-edge systems technology. We also plan to incorporate our research into numerous upper-level courses, thus having an impact on all students who pass through the systems courses at Wisconsin. Broadening the participation of underrepresented groups: Our main focus has been to increase female participation in computer science research. In the past seven years, we have graduated five females. We also plan to recruit an additional female in the fall as a part of this project. Enhancing the infrastructure for research and disseminating results: In this proposal, we plan to develop a new skeptical approach to systems design; we believe this viewpoint is critical in the construction of the next generation of systems and thus hope to disseminate as widely as possible. We will do so in three primary ways: through the classic medium of publication, which in the past has impacted the design and implementation of various storage systems including the EMC Centera [32] and NetApp filers [39]; through the development of numerous software artifacts, which we have shared with the open source community and thus improved various code bases; and finally, through our interaction with NetApp, and the technology transfer that this enables. Benefits to society: Our lives are increasingly dependent on computing systems. The science of skeptical systems design is crucial to the development of the next generation of software systems. By embracing a skeptical approach, the systems we build will be more robust, and thus of better service to society.