Ti e E ffi cient Server Audit Problem, Deduplicated Re-execution, and the Web Cheng Tan, Lingfan Yu, Joshua B. Leners*, and Michael Wal fj sh NYU Department of Computer Science, Courant Institute *Two Sigma Investments
company Amazon Web Services wiki PHP Alice employee employee
company Amazon Web Services Alice wiki PHP database request PHP runtime employee response web server employee OS hypervisor hardware
company Amazon Web Services Alice wiki PHP database request PHP runtime employee response web server employee OS hypervisor hardware • Alice has con fj dence in the wiki's PHP code
company Amazon Web Services Alice wiki PHP database request PHP runtime employee response web server employee OS hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice kiwi PHP wiki PHP database request PHP runtime employee response web server employee OS hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice wiki PHP database request PHP runtime PCP runtime employee response web server employee OS hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice wiki PHP database request PHP runtime employee response web server employee OS OS OS hypervisor hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice wiki PHP database request PHP runtime employee response web server web server employee OS hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice kiwi PHP wiki PHP database request PHP runtime PCP runtime employee response web server web server employee OS OS OS hypervisor hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice kiwi PHP wiki PHP database request PHP runtime PCP runtime employee response web server web server employee OS OS OS hypervisor hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ...
company Amazon Web Services Alice kiwi PHP wiki PHP database request PHP runtime PCP runtime employee response web server web server employee OS OS OS hypervisor hypervisor hardware • Alice has con fj dence in the wiki's PHP code • Still, lots of things can go wrong ... • Ti us, Alice wants to audit the delivered responses – Are they derived from executing the actual application?
Ti e E ffi cient Server Audit Problem server program
Ti e E ffi cient Server Audit Problem online phase server requests program clients responses
Ti e E ffi cient Server Audit Problem online phase server requests program clients responses 1. server is untrusted; can respond arbitrarily 2. server is concurrent
Ti e E ffi cient Server Audit Problem online phase trace server collector requests program clients responses trace 1. server is untrusted; can respond arbitrarily 2. server is concurrent
company Amazon Web Services wiki PHP Alice kiwi PHP wiki PHP database request PHP runtime PCP runtime employee response web server web server employee OS OS OS trace hypervisor hypervisor collector hardware
Ti e E ffi cient Server Audit Problem online phase audit phase trace server collector verifier requests program clients responses trace 1. server is untrusted; can respond arbitrarily 2. server is concurrent
Ti e E ffi cient Server Audit Problem online phase audit phase trace server collector verifier requests program requests program + clients ? responses = responses trace 1. server is untrusted; can respond arbitrarily 2. server is concurrent
Ti e E ffi cient Server Audit Problem online phase audit phase trace server collector verifier requests program requests program + clients ? responses = responses trace 1. server is untrusted; can respond arbitrarily 2. server is concurrent 3. veri fj er is weaker than server 4. server overhead is low; legacy applications supported
1. server is untrusted… 2. server is concurrent Ti e E ffi cient Server Audit Problem 3. veri fj er is weaker than server 4. server overhead is low... online phase audit phase trace server collector verifier requests program requests program + clients ? responses = responses trace
1. server is untrusted… 1. server is untrusted… 2. server is concurrent 2. server is concurrent Ti e E ffi cient Server Audit Problem 3. veri fj er is weaker than server 3. veri fj er is weaker than server 4. server overhead is low... 4. server overhead is low... online phase audit phase trace server collector verifier requests program requests program + clients ? responses = responses trace • Combination of these four is a new problem. • Execution integrity is complementary to program veri fj cation.
1. server is untrusted… 2. server is concurrent What about naive re-execution? 3. veri fj er is weaker than server 4. server overhead is low... online phase audit phase trace server verifier collector requests program clients responses trace
1. server is untrusted… 2. server is concurrent What about naive re-execution? 3. veri fj er is weaker than server 4. server overhead is low... online phase audit phase trace server verifier collector requests program clients responses delivered responses trace ? = produced responses
✔ 1. server is untrusted… ✔ 2. server is concurrent What about naive re-execution? ❌ 3. v 3. veri eri fj fj er is weaker than server er is weaker than server ✔ 4. server overhead is low... online phase audit phase trace server verifier collector requests program clients responses delivered responses trace ? = produced responses • Ti is does not save the veri fj er work.
✔ ❓ 1. server is untrusted… 1. server is untrusted… 1. server is untrusted… ✔ ❓ 2. server is concurrent 2. server is concurrent 2. server is concurrent What about naive re-execution? ✔ ❌ 3. veri fj er is weaker than server 3. veri 3. veri fj er is weaker than server 3. v eri fj fj er is weaker than server er is weaker than server ❓ ✔ 4. server overhead is low... 4. server overhead is low... 4. server overhead is low... online phase audit phase trace server verifier collector requests program clients responses delivered responses trace ? = produced responses • Ti is does not save the veri fj er work. • Instead, we will accelerate re-execution.
Rest of the talk 1. How does the veri fj er accelerate re-execution? (these two are in tension) 2. Why are shared objects (such as DBs) challenging? 3. Does our implementation for PHP perform well?
Rest of the talk 1. How does the veri fj er accelerate re-execution? 1. How does the veri fj er accelerate re-execution? 2. Why are shared objects (such as DBs) challenging? 3. Does our implementation for PHP perform well?
Accelerating re-execution: a 30,000-foot view server (online) verifier (offline) advice • Deduplicate computation across requests
Poirot’s observation: repeated computation T. Kim, R. Chandra, and N. Zeldovich. Efficient patch-based audi>ng for web applica>ons. OSDI , 2012
Poirot’s observation: repeated computation T. Kim, R. Chandra, and N. Zeldovich. Efficient patch-based audi>ng for web applica>ons. OSDI , 2012
Poirot’s observation: repeated computation req i “My paper” req j “Another paper” T. Kim, R. Chandra, and N. Zeldovich. Efficient patch-based audi>ng for web applica>ons. OSDI , 2012
Poirot’s observation: repeated computation req i “My paper” requires trusting the requires trusting the req j advice advice “Another paper” T. Kim, R. Chandra, and N. Zeldovich. Efficient patch-based audi>ng for web applica>ons. OSDI , 2012
We accelerate re-execution without trusting the server server (online) verifier (offline) C : tag → {set of reqs} for each tag: – execute C (tag) with SIMD-on-demand – conduct unanimity checks
We accelerate re-execution without trusting the server server (online) verifier (offline) C : tag → {set of reqs} for each tag: – execute C (tag) with SIMD-on-demand – conduct unanimity checks SIMD-on-demand re-executes identical instructions once. server verifier req i req i +req j req j
SIMD-on-demand eliminates redundant computation main(a,b): req i: a=1;b=2 c ← a * b req j: a=2;b=1 c ← c + 1
SIMD-on-demand eliminates redundant computation main(a,b): req i: a=1;b=2 c ← a * b req j: a=2;b=1 c ← c + 1 a=[1,2] * b=[2,1] c=[2,2] req i +req j +1 * • Multi-value represents di ff erent values of the same variable.
Recommend
More recommend
