Dealing with server corruption in weakly consistent replicated data systems

Providing high availability and the ability to share data despite the weak connectivity of mobile computing raises the problem of trusting replicated data servers that may be corrupt. This is because servers must be run on portable computers, and these machines are less secure and thus less trustworthy than those traditionally used to run servers. We describe the kinds of problems one must be prepared to deal with, noting that even users of secured, non-portable computers are at risk if servers trust all authorized peers. We show that high availability through data replication on portable computers need not be mutually exclusive with various levels of data security one might want. We give three solutions to this trust problem for a simple example architecture, achieving progressively higher levels of security with progressively higher costs. We then show how to solve this trust problem for the more complex architecture of Bayou, a weakly consistent replicated data system we built at Xerox PARC.