Security - Telenor

38
A failure is caused by some type of fault during
the execution of an action. When a failure occurs
no earlier than action a i and prior to action a i+1 ,
the recovery action a' i starts execution.
A simplified and slightly modified version of
NAP (hereafter called NAP') is presented here.
Whereas the NAP protocol tolerates f fail-stops
during a computation, the modified version
should tolerate f fail-stops per action-broadcast
pair.
Since a mobile agent is represented by many
similar agents in the NAP' protocol, write a i,j for
the j th action taken by agent number i for the
f + 1 agents in a single NAP' protocol execution.
Similarly the recovery action for the j th action
taken by agent number i is written a' i,j . In the following,
the head will refer to the primary process,
which is doing the actual agent computation.
The tail consists of the remaining backup
processes.
It is assumed that the agent execution consists
of a series of actions satisfying the following
assumptions.
1. At least one action is executed on any given
platform.
2. An action may consist of a move to a new
platform, possibly entailing movement to
a different host.
3. After each completed action, state information
is propagated to the backup processes using a
reliable broadcast. This state information
should be enough for recovery if the subsequent
action fails.
4. The actions need not be specifically listed, but
are given algorithmic expression.
5. Upon completing an action, reliable broadcast
is immediately initiated.
The preconditions of a NAP' execution is the
following:
1. The degree of fault-tolerance f ≥ 1 is fixed.
2. The sender has a platform within his domain
capable of supporting (part of) a NAP' computation.
3. The 1 + f head and tail processes are initiated
at the sender’s platform, with the initial state
of the head distributed to all tail processes.
By convention, the head is written p 0 , and the
tail processes are written p 1 , ..., p f . The platform
supporting a process pj is written Pj . Note in particular
that it is not necessarily the case that i�= j
⇒ Pi �= Pj . Note also that Pj changes during the
agent execution if the agent ever changes platform.
A broadcast message associated with the
completion of action i is written bi .
The NAP' execution itself is carried out by letting
the head execute action a 1,i , immediately
followed by a reliable broadcast of b i to the tail
processes containing the new state information
of the head. The head is elected to ensure that
the broadcast is delivered to all the tail processes.
The broadcast itself proceeds as the
one given in [6], but with some differences.
The possible outcomes of the broadcast are
essentially unchanged:
1. No platform delivers b i . This happens if either
P 0 failed or if p 0 ’s execution of action a 0,i
somehow failed. One of the tail processes p j
must therefore begin recovery action a' j,i .
Immediately after recovery (including the
new broadcast) is completed, p j takes on p 0 ’s
role and spawns a new process p j to take its
previous role.
2. The platform P 1 delivers b i . This happens only
if all non-faulty platforms supporting the
agent have delivered b i . The head process p 0
may thus begin executing action a 0,i+1 .
3. A platform Pj delivers bi+1 , but P0 does not.
Thus either P0 failed or p0 ’s execution failed
somehow before the broadcast terminated.
The Pj with the lowest j �= 0 such that Pj �=
P0 acts as rearguard, and executes the recovery
action a'j,i+1 . Immediately after recovery
(including the new broadcast) is completed,
pj takes on p0 ’s role and spawns a new process
pj to take its previous role.
The postconditions of a NAP' execution is the
following:
1. The head has completed the last action a 0,n .
2. The last broadcast has terminated.
3. The head and tail processes have terminated.
This description concentrates on the invocation
of the fault-tolerance parts. The broadcast protocol
details and other details necessary for a complete
implementation should not deviate much
from that described in [6].
5 Confidentiality
Confidentiality is about controlling the ability of
any given subject to extract information from an
object. Information here is taken in the widest
known sense, the information-theoretic sense.
There are three basic methods controlling such
information extraction:
Telektronikk 3.2000