Beyond 1-Safety and 2-Safety for Replicated Databases: Group-Safety

Abstract

In this paper, we study the safety guarantees of group communicationbased database replication techniques. We show that there is a model mismatch between group communication and database, and because of this, classical group communication systems cannot be used to build 2-safe database replication. We propose a new group communication primitive called end-to-end atomic broadcast that solves the problem, i.e., can be used to implement 2-safe database replication. We also introduce a new safety criterion, called group-safety, that has advantages both over 1-safety and 2-safety. Experimental results show the gain of efficiency of group-safety over lazy replication, which ensures only 1-safety. IntroductionDatabase systems represent an important aspect of any IT infrastructure and as such require high availability. Software-based database replication is an interesting option because it promises increased availability at low cost. Traditional database replication is usually presented as a trade-off between performance and consistency [1], i.e., between eager and lazy replication. Eager replication, based on an atomic commitment protocol, is slow and deadlock prone. Lazy replication, which foregoes the atomic commitment protocol, can introduce inconsistencies, even in the absence of failures.However, eager replication does not need to be based on atomic commitment. A different approach, which relies on group communication primitives to abstract the network functionality, has been proposed in [2, 3], These techniques typically use an atomic broadcast primitive (also called total order broadcast) to deliver and order transactions in the same serial order on all replicas, and offer an answer to many problems of eager replication without the drawbacks of lazy replication: they offer good performance [4], use the network more efficiently [5] and also reduce the number of deadlocks [6].Conceptually, group communication-based data replication systems are built by combining two modules: (1) a database module, which handles transactions and (2) a group communication module, which handles communication. When combined, these two module result in a replicated database. However, the two modules assume different failure models, which means that the failure semantics of the resulting system are unclear. Group Communication Component Database ComponentReplicated Database Component (Application) Model and DefinitionsWe assume that the overall system is built from three components (Fig. 1): the database component, the group communication component and the replicated database component. The first two components offer the infrastructure needed to build the application -in our case a replicated database. These two infrastructure components are accessed by the application, but they have no direct interaction with each other. The replicated database component implements the actual replicated database and is described in Sect. 2.1. The database component contains all the facilities to store the data and execute transactions locally, and is de...

Reviewing Amnesia Support in Database Recovery Protocols

“…At this level, it implies that the replica does not remember which messages have been received. Actually, the amnesia implies that received messages non-persistently stored are lost when the node crashes, generating a problem when they belong to transactions that the replicated system has committed but which have not been already committed in the crashed node, because message delivery does not really imply correctly processed as demonstrated in [29].…”

“…Then ∀ V i → V i+1 triggered by a node crash, it will be at least one node n l : n l ∈ V i \ V i+1 . Considering that T i = {T i,1 , T i,2 , ..., T i,m } is the transactions set delivered and committed in the replicated system during V i , it can be assumed that ∀ n k ∈ V i ∩ V i+1 : [29] it might happen the following:…”

“…In this case, the problem resides in the fact that this recovery protocol assumes that any delivered message is correctly processed, but this assumption, as demonstrated in [29], is not correct. So, all generated recovery information does not contain all the information that would be needed for supporting amnesia.…”

“…• The second one consists in applying our proposed generic solution, that in fact is the solution already applied in [29,5]. In [29], authors proposed the "successful delivery" approach.…”

“…In [29], authors proposed the "successful delivery" approach. A successfully delivered message implies that it has been correctly processed.…”