CAREER: A Robust Fully Decentralized Read/Write File System

该提案的核心是Ivy的设计和实现，Ivy是一个完全分散的读/写文件系统，由不受信任的网络存储构建。Ivy将作为一个案例研究，探索如何从不可靠和相互不信任的组件中构建健壮和值得信赖的系统。Ivy项目将通过为DHT和覆盖网络提供具有挑战性的测试案例来进一步推进网络研究。Ivy本身将展示新的可用性和安全性水平，并将提供一个强大的新平台来支持分布式协作。Ivy的激励应用程序是分布式用户组之间的协作。用户可能在编写文档、维护网站或开发软件方面进行合作。这种协作对于当前的技术来说通常是笨拙的，特别是如果不同的用户在不同的组织中，或者如果他们的组织没有足够的财政或技术资源。例如，不同公司或不同政府机构的合作人员经常不得不借助电子邮件来交换对共享文档的更新。发生这种情况的原因是，一个更复杂的解决方案通常需要所有参与者对彼此或某个中央实体给予不适当的信任。例如，如果一组分布式协作者决定共享一个NFS文件服务器，那么他们都必须信任运行它的人，以保持它的可靠性和安全性，并且他们可能还必须有正式的财务安排，以支付服务器的费用。组成员必须相互信任，以负责任的方式更新共享文件，并（等效地）保持其主机的安全，防止外人闯入和修改共享文件。如果参与者有任何程度的相互不信任，传统的文件服务器就不合适了。这样的一个群体希望享受一个可靠的中央文件服务器的幻想，可以信任任何成员来控制更新，而不必信任或依赖任何单个系统组件或用户。Ivy将以一种极端的形式探索这一主题，将互联网视为一个位置透明的数据存储，而不是一个通信系统。实现这一愿景的主要障碍是互联网节点的不可靠性和不可信赖性。因此，Ivy的设计有两个主要关注点：避免关键组件或关键数据结构形式的单点故障;以及与不受信任的参与者实现完整性。Ivy设计的核心是将所有信息保存在每个参与者的日志中。参与者将更新操作附加到自己的日志中，并扫描其他参与者的日志以确定文件系统的当前状态。Ivy将日志记录存储并复制到DHash对等块存储系统中，这样即使参与者的日志不可用，参与者的日志也可以使用。日志的这种使用极大地帮助消除单点故障和处理不受信任的参与者。每个日志都有一个writer，这使得日志数据易于验证。这也意味着Ivy不需要在内部使用锁，因为它没有直接共享的可变数据结构;这消除了在锁保持器没有响应的情况下的可靠性和信任问题。通过忽略可疑日志或日志条目，日志的存在提供了从意外或恶意损坏中恢复的可能性。这一建议具有系统和算法研究的智力价值。Ivy系统将提供标准读/写文件系统语义、完全去中心化、高可用性和参与者之间的公平信任关系的独特组合。这项工作还将推动对算法的研究，将不可信和不可靠的组件转化为具有明确定义的可靠性和安全性的系统。这是分布式系统的一个方面，随着Internet范围系统的出现，它正面临着新的和令人兴奋的挑战。这项建议将通过涉及麻省理工学院的本科生和研究生产生广泛的影响。这项工作包含了一些适合学生在这两个层次的子项目，因此，这些学生将学习如何设计和构建实用的分布式系统的不受信任的组件。PI目前正在开发分布式系统的研究生课程。常春藤的初步工作已经影响了课程结构的修订，并形成了新的实验作业的基础。

The core of this proposal is the design and implementation of Ivy, a fully decentralized read/write file system built from untrusted network storage. Ivy will act as a case study in a larger effort to explore how to build robust and trustworthy systems from unreliable and mutually-distrustful components. The Ivy project will further network research by providing a challenging test case for DHTs and overlay networks.Ivy will itself demonstrate new levels of availability and security, and will provide a powerful new platform to support distributed collaboration. The motivating application for Ivy is collaboration among distributed groups of users. The users might be cooperating in writing a document, maintaining a web site, or developing software. Such collaboration is often awkward with current technology, especially if the different users are in different organizations, or if their organization has insufficient financial or technical resources. For example, cooperating people in different companies, or in different government agencies, often have to resort to e-mail to exchange updates to shared documents. The reason that this happens is that a more sophisticated solution would typically require all participants to place undue trust in each other or in some central entity. For example, if a distributed group of collaborators decide to share a single NFS file server, then they must all trust whoever runs it to keep it reliable and secure, and they may also have to have a formal financial arrangement in order to pay for the server. The group members would have to trust each other to update shared files in a responsible way, and (equivalently) to keep their hosts secure against outsiders breaking in and modifying shared files. If the participants have any degree of mutual distrust, a conventional file server won't be appropriate. Such a group would like to enjoy the illusion of a reliable central file server, trustable to control updates by any member, without having to trust or rely on any single system component or user. Ivy will explore this theme in an extreme form, viewing the Internet as a location-transparent data store rather than as a communication system. The main obstacles to realization of this vision are the unreliability and untrustworthiness of Internet nodes. Thus Ivy's design has two main concerns: avoidance of single points of failure, in the form of either critical components or critical data structures; and achieving integrity with untrusted participants. The core of Ivy's design is that it keeps all information in per-participant logs. Participants append update operations to their own logs, and scan the other participants' logs to determine the current state of the file system. Ivy stores and replicates the log records in the DHash peer-to-peer block storage system, so that a participant's log is available even when the participant is not. This use of logs greatly aids both elimination of single points of failure and dealing with untrusted participants. The fact that each log has a single writer makes log data easy to authenticate. It also means that Ivy need not use locks internally, since it has no directly shared mutable data structures; this eliminates both reliability and trust problems in the case of an unresponsive lock holder. The presence of the logs offers the potential of recovering from accidental or malicious damage, by ignoring suspect logs or log entries. This proposal has intellectual merit as both systems and algorithmic research. The Ivy system will provide a unique combination of standard read/write file system semantics, complete decentralization, high availability, and arms-length trust relationship among participants. The work will also drive research into algorithms that turn untrusted and unreliable components into systems with well-defined reliability and security properties. This is an aspect of distributed systems that is facing new and exciting challenges with the advent of Internet-wide systems. This proposal will have broad impact by involving both undergraduates and graduate students at MIT. The work contains a number of sub-projects suitable for students at both levels; as a result these students will learn how to design and build practical distributed systems out of untrusted components. The PI is currently developing a graduate-level course in distributed systems. Initial work on Ivy has already influenced revisions in the course structure and formedthe basis for new lab assignments.