Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Soteria

Sreeja S Nair
March 15, 2019
57

 Soteria

Invite talk at the IRIF verification seminar

Sreeja S Nair

March 15, 2019
Tweet

Transcript

  1. Invariant Safety for Distributed Applications • Applications are distributed due

    to demands of low response time • CAP theorem depicts a tension between Consistency and Availability • Ideal world for developers = high availability + convergence + application safety • A modular and sequential proof to ensure this! 2
  2. Auction application • State • Status • INVALID or ACTIVE

    or CLOSED • Winner • Set of bids, each bid comprising • BidId • Placed • Amount 4 • Invariant • Bids can be placed only when the status is active • When auction is closed, there is a winner • Winner is the highest bid • Operations • Start auction • Place bid • Close auction
  3. Evolution of state 5 Alice/ Australia Bob/ Belgium Charlie/ Canada

    Start auction Place bid Status Winner Bids
  4. Evolution of state 5 100 Alice/ Australia Bob/ Belgium Charlie/

    Canada Start auction Place bid Status Winner Bids
  5. Evolution of state 5 100 Alice/ Australia Bob/ Belgium Charlie/

    Canada Start auction Place bid Place bid Status Winner Bids
  6. Evolution of state 5 100 105 Alice/ Australia Bob/ Belgium

    Charlie/ Canada Start auction Place bid Place bid Status Winner Bids
  7. Evolution of state 5 100 105 Alice/ Australia Bob/ Belgium

    Charlie/ Canada Start auction Place bid Place bid Status Winner Bids
  8. Evolution of state 5 100 105 Alice/ Australia Bob/ Belgium

    Charlie/ Canada Start auction Place bid Place bid Status Winner Bids ???
  9. Evolution of state 5 100 105 Alice/ Australia Bob/ Belgium

    Charlie/ Canada Start auction Place bid Place bid Status Winner Bids
  10. Evolution of state 5 100 105 Alice/ Australia Bob/ Belgium

    Charlie/ Canada Start auction Place bid Place bid Status Winner Bids 100 105 Merge!
  11. Semi-lattice • Set of state should form a monotonic semi-lattice

    • Equipped with a partial order function • Each update should inflate the state • Merge should be the Least Upper Bound 6
  12. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Place bid

    Place bid Status Winner Bids Evolution of state 7
  13. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Place bid

    Place bid Status Winner Bids Evolution of state 7
  14. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Place bid

    Place bid Status Winner Bids Evolution of state 7
  15. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Place bid

    Place bid Status Winner Bids Evolution of state 7
  16. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Place bid

    Place bid Status Winner Bids Evolution of state 7
  17. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Close auction

    Place bid Place bid Status Winner Bids Evolution of state 7
  18. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Close auction

    Place bid Place bid Status Winner Bids Evolution of state 7
  19. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Close auction

    Place bid Place bid Status Winner Bids Evolution of state 7
  20. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Close auction

    Place bid Place bid Status Winner Bids Evolution of state 7
  21. Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Close auction

    Place bid Place bid Status Winner Bids Evolution of state 7
  22. Safety in sequential executions • Each operation and merge must

    satisfy the invariant • Ensured by preconditions 8
  23. Precondition for merge? • It must hold true since merge

    can happen at any time • Can be also called Concurrent Invariant • The weakest precondition to be upheld for the resulting state of merge to uphold the sequential invariant • Ensures all concurrent operations are still safe • Never block any merge!! 9
  24. Safety in concurrent executions • A state in a replica

    evolves with • A local update by operation • Merge • Merge is the only point of observable concurrency 10 Alice/ Australia Bob/ Belgium Charlie/ Canada Start auction Place bid Place bid
  25. Proof Rule for safety of distributed applications • Initial state

    must satisfy the sequential invariant and concurrent invariant • Each update and merge should preserve both the sequential invariant and concurrent invariant 11
  26. Proof Rule • Intuition • Merge is the only point

    of external influence • Merge can happen any time • Properties • Modular • Each operation and merge reasoned in isolation • Sequential • Reasoning as if for a sequential application 12
  27. Revisiting auction • Invariant • Bids can be placed only

    when the status is active • When auction is closed, there is a winner • Winner is the highest bid 13
  28. Safety of Auction 14 Invariant 1. Bids can be placed

    only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid
  29. Safety of Auction • Start auction 14 Invariant 1. Bids

    can be placed only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid
  30. Safety of Auction • Start auction 14 Invariant 1. Bids

    can be placed only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid
  31. Safety of Auction • Start auction 14 Invariant 1. Bids

    can be placed only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid • Place bid • If auction concurrently closed in other replica, precondition of merge violated!
  32. Safety of Auction • Start auction 14 Invariant 1. Bids

    can be placed only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid • Place bid • If auction concurrently closed in other replica, precondition of merge violated!
  33. Safety of Auction • Start auction 14 Invariant 1. Bids

    can be placed only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid • Place bid • If auction concurrently closed in other replica, precondition of merge violated! • Close auction • Similar to place bid
  34. Safety of Auction • Start auction 14 Invariant 1. Bids

    can be placed only when the status is active 2. When auction is closed, there is a winner 3. Winner is the highest bid • Place bid • If auction concurrently closed in other replica, precondition of merge violated! • Close auction • Similar to place bid
  35. Concurrency Control • Option 1: • Strong consistency of place

    bid and close auction operations • Issue: each place bid need synchronisation • Option 2: • Concurrency control similar to readers-write lock • Place bids work without synchronisation • Closing auction needs synchronisation 16
  36. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Status Winner Bids

    Tokens Evolution of state with Concurrency Control
  37. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Status

    Winner Bids Tokens Evolution of state with Concurrency Control
  38. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Status

    Winner Bids Tokens Evolution of state with Concurrency Control
  39. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Evolution of state with Concurrency Control
  40. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Evolution of state with Concurrency Control
  41. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Evolution of state with Concurrency Control
  42. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Evolution of state with Concurrency Control
  43. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Evolution of state with Concurrency Control
  44. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Evolution of state with Concurrency Control
  45. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Evolution of state with Concurrency Control
  46. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Evolution of state with Concurrency Control
  47. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Evolution of state with Concurrency Control
  48. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Evolution of state with Concurrency Control
  49. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  50. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  51. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control No more bids can be placed!!
  52. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  53. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  54. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  55. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Place bid Place

    bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  56. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Close auction Place

    bid Place bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  57. 17 Alice/ Australia Bob/ Belgium Charlie/ Canada Close auction Place

    bid Place bid Status Winner Bids Tokens Release token Release token Release token Evolution of state with Concurrency Control
  58. Tool Support - Soteria • Implemented on top of Boogie

    • Input • Application state • Invariant • Partial Order function • Operations with preconditions • Merge operation with precondition 18
  59. Soteria checks • Sanity checks • Convergence checks • Each

    operation is monotonically non-decreasing • Merge is the least upper bound • Safety checks • Sequential safety -> each operation preserves the invariant • Concurrent safety -> each operation preserves the precondition of merge 19
  60. Conclusion • A new proof rule for verification of distributed

    applications • For applications using state-based CRDTs • A tool for design verification • Available at https://github.com/sreeja/soteria_tool 20