Effective and efficient compromise recovery for weakly consistent replication

Mahajan, Prince; Kotla, Ramakrishna; Marshall, Catherine C.; Ramasubramanian, Venugopalan; Rodeheffer, Thomas L.; Terry, Douglas B.; Wobber, Ted

doi:10.1145/1519065.1519080

Cited by 12 publications

(6 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…After a compromise, Polygraph [19] recovers the noncorrupted state in a weakly consistent replication system by rolling back corrupted state. However, unlike Aire, it does not attempt to preserve the effects of legitimate actions, which can lead to significant data loss.…”

Section: Related Workmentioning

confidence: 99%

Asynchronous intrusion recovery for interconnected web services

Chandra¹,

Kim²,

Zeldovich³

2013

Proceedings of the Twenty-Fourth ACM Symposium on Operating Systems Principles

View full text Add to dashboard Cite

Recovering from attacks in an interconnected system is difficult, because an adversary that gains access to one part of the system may propagate to many others, and tracking down and recovering from such an attack requires significant manual effort. Web services are an important example of an interconnected system, as they are increasingly using protocols such as OAuth and REST APIs to integrate with one another. This paper presents Aire, an intrusion recovery system for such web services. Aire addresses several challenges, such as propagating repair across services when some servers may be unavailable, and providing appropriate consistency guarantees when not all servers have been repaired yet. Experimental results show that Aire can recover from four realistic attacks, including one modeled after a recent Facebook OAuth vulnerability; that porting existing applications to Aire requires little effort; and that Aire imposes a 19-30% CPU overhead and 6-9 KB/request storage cost for Askbot, an existing web application.

show abstract

Section: Related Workmentioning

confidence: 99%

Asynchronous intrusion recovery for interconnected web services

Chandra¹,

Kim²,

Zeldovich³

2013

Proceedings of the Twenty-Fourth ACM Symposium on Operating Systems Principles

View full text Add to dashboard Cite

show abstract

“…We note that the need to undo the effects of executed operations occurs pervasively throughout computer systems, from classical database transaction processing systems [21] to systems that recover from security breaches [20,28,39,46]. In addition to the specific motivating use described above, the verified inverse operations may therefore find broader applicability in a variety of contexts in which it is desirable to efficiently undo data structure state changes.…”

Section: Inverse Operationsmentioning

confidence: 99%

Verification of semantic commutativity conditions and inverse operations on linked data structures

Kim

Rinard

2012

SIGPLAN Not.

View full text Add to dashboard Cite

We present a new technique for verifying commutativity conditions, which are logical formulas that characterize when operations commute. Because our technique reasons with the abstract state of verified linked data structure implementations, it can verify commuting operations that produce semantically equivalent (but not necessarily identical) data structure states in different execution orders. We have used this technique to verify sound and complete commutativity conditions for all pairs of operations on a collection of linked data structure implementations, including data structures that export a set interface (ListSet and HashSet) as well as data structures that export a map interface (AssociationList, HashTable, and ArrayList). This effort involved the specification and verification of 765 commutativity conditions.Many speculative parallel systems need to undo the effects of speculatively executed operations. Inverse operations, which undo these effects, are often more efficient than alternate approaches (such as saving and restoring data structure state). We present a new technique for verifying such inverse operations. We have specified and verified, for all of our linked data structure implementations, an inverse operation for every operation that changes the data structure state.Together, the commutativity conditions and inverse operations provide a key resource that language designers, developers of program analysis systems, and implementors of software systems can draw on to build languages, program analyses, and systems with strong correctness guarantees.

show abstract

“…Polygraph [19] recovers from compromises in a weakly consistent replication system. Unlike WARP, Polygraph does not attempt to preserve legitimate changes to affected files, and does not attempt to automate detection of compromises.…”

Section: Related Workmentioning

confidence: 99%

Intrusion recovery for database-backed web applications

Chandra¹,

Kim²,

Shah³

et al. 2011

Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles

View full text Add to dashboard Cite

WARP is a system that helps users and administrators of web applications recover from intrusions such as SQL injection, cross-site scripting, and clickjacking attacks, while preserving legitimate user changes. WARP repairs from an intrusion by rolling back parts of the database to a version before the attack, and replaying subsequent legitimate actions. WARP allows administrators to retroactively patch security vulnerabilities-i.e., apply new security patches to past executions-to recover from intrusions without requiring the administrator to track down or even detect attacks. WARP's timetravel database allows fine-grained rollback of database rows, and enables repair to proceed concurrently with normal operation of a web application. Finally, WARP captures and replays user input at the level of a browser's DOM, to recover from attacks that involve a user's browser. For a web server running MediaWiki, WARP requires no application source code changes to recover from a range of common web application vulnerabilities with minimal user input at a cost of 24-27% in throughput and 2-3.2 GB/day in storage.

show abstract

Effective and efficient compromise recovery for weakly consistent replication

Cited by 12 publications

References 15 publications

Asynchronous intrusion recovery for interconnected web services

Asynchronous intrusion recovery for interconnected web services

Verification of semantic commutativity conditions and inverse operations on linked data structures

Intrusion recovery for database-backed web applications

Contact Info

Product

Resources

About