This paper presents a secure quorum protocol (SQP) which integrates a quorum ... El Abbadi generalized weighted voting in terms of read and write quorums 1].
A SECURE QUORUM PROTOCOL Masaaki Mizunoy
Mitchell L. Neilsen
Department of Computing and Information Sciences Kansas State University Manhattan, Kansas 66506 In a distributed database system, several copies (replicas) of a data object may be maintained at di erent sites to improve fault tolerance (reliability). Maintaining replicas may also a ect the integrity and secrecy of the data object. Thus, it is natural to integrate security issues in a replica control protocol. This paper presents a secure quorum protocol (SQP) which integrates a quorum protocol to attain one-copy equivalence and a cryptographic technique to attain data security. By appropriately choosing certain parameters, SQP does not increase the number of accesses required to perform a read or write operation. We have proposed an algorithm, called the "join algorithm,"which takes sets of quorums as input and returns a new set of quorums [Tech report number]. The join algorithm is very useful for constructing large sets of quorums. In this paper, we also extend the join algorithm to generate quorums which may be used in SQP. Such quorums may be used to improve the overall security.
1 Introduction In a distributed database system, several copies (replicas) of a data object may be maintained at di erent sites to improve fault tolerance (reliability). Maintaining several replicas allows the system to gracefully tolerate node and communication line failures. A replica control protocol is used to ensure that di erent copies of a data object appear to the user as a single nonreplicated object, i.e., objects are one-copy equivalent [1, 3]. One well known protocol is based on weighted voting [6]. Agrawal and El Abbadi generalized weighted voting in terms of read and write quorums [1]. Associated with each data object, (several) read and write quorums are formed, each of which is a subset of copies of the data object. A read operation accesses all of the copies in a read quorum, and a copy with the largest version number is returned. A write operation writes to all of the copies in a write quorum and assigns each copy the version number that is one more than the maximum version number encountered in the write quorum. Let R and W be sets of read and write quorums, respectively. In order to ensure one-copy equivalence, the read and write quorums must satisfy the following two intersection properties: 1. Write-write : G; H 2 W ) G \ H 6= ;. 2. Read-write : G 2 R, H 2 W ) G \ H 6= ;. Maintaining replicas may a ect not only the reliability, but also the security of the system. Security is concerned with the following two principal issues [4]: secrecy (privacy) - to prevent unauthorized disclosure of data, and integrity (authenticity) - to prevent unauthorized modi cation of data. This y This
paper appeared in the Proc. of the 14th National Computer Security Conference. work was supported in part by the National Science Foundation under Grant CCR-8822378.
1
Maintaining replicas may improve the integrity of the data object. As long as an intruder has not modi ed all of the copies and an authorized user can detect which copies have been modi ed by the intruder, the user may still access a correct copy of the data object. However, maintaining replicas may decrease the secrecy of the data. In order to obtain con dential data, an intruder may access any copy of the data object. Since reliability and security are closely related in a replicated database system, it is natural to integrate one-copy equivalence and security issues in a replica control protocol. However, relatively few such attempts have been made. Two such protocols have been proposed by (1) Herlihy and Tygar [7] and (2) Agrawal and El Abbadi [2]. This paper presents a secure quorum protocol (SQP) which integrates a quorum protocol to attain one-copy equivalence and a cryptographic technique to attain data security. By appropriately choosing certain parameters, SQP does not increase the number of accesses required to perform a read or write operation. The secure quorum protocol is best suited for a set of quorums which are all the same size, called symmetric quorums. We present two methods for generating symmetric quorums. We have proposed an algorithm, called the join algorithm, which takes sets of quorums as input and returns a new set of quorums [8]. The join algorithm is very useful for constructing large sets of quorums. In this paper, we extend the join algorithm to generate quorums which may be used in SQP. Such quorums may be used to improve the overall security. The organization of the paper is as follows: Section 2 brie y reviews Herlihy and Tygar's protocol and Agrawal and El Abbadi's protocol. We also present an overview of SQP. Cryptographic systems and Shamir's secret sharing algorithm on which SQP is based are reviewed in Section 3. Section 4 presents the secure quorum protocol (SQP). Section 5 describes two methods for generating symmetric quorums. Section 6 presents the join algorithm applied to SQP and a simple security analysis.
2 Review and Overview
In this section, we review Herlihy and Tygar's protocol and Agrawal and El Abbadi's protocol. Then, we present an overview of the secure quorum protocol (SQP). By reviewing these protocols, we informally introduce some important terminology.
2.1 Herlihy and Tygar's protocol Herlihy and Tygar's protocol uses a quorum protocol to achieve one-copy equivalence and a cryptographic technique to attain security. Each replica is encoded by using a secret key. Shamir's secret sharing algorithm may be used to break the key into n pieces (called shadows), and each shadow is distributed to a di erent site. In Shamir's algorithm, at least t out of n shadows (t n) are needed to recover the key, where t is called the threshold [10]. To read a data object, any t shadows are retrieved to determine the key, and then a read quorum of copies are read and decrypted using the key. The value of a copy with the largest sequence number is the current value of the object. To write a data object, the new value and the new sequence number are encrypted using the key, and then distributed to a write quorum of copies. Herlihy and Tygar also proposed a protocol which uses two keys: one for encoding the data and another one for decoding the data. In this method, n shadows are created and distributed to n sites for each key. The thresholds, called the encryption threshold (tE ) and the decryption threshold (tD ), may be de ned separately. However, compromising a key may be done by obtaining any combination of a threshold number of shadows. Thus, if tE tD , compromising the encryption key also discloses the decryption key. Note that the integrity achieved by the secrecy of the encryption key (or just the secret key in case of a single key system) is only to prevent an intruder from creating false data in the valid data domain. Herlihy and Tygar discuss another type of integrity: preventing an intruder from destroying valid data
by overwriting the data by garbage or an old copy of the data. The system can only guarantee the preservation of this type of integrity against an intruder who can modify less than tI replicas, where tI is called the integrity threshold. If each quorum, after the attack, contains at least one uncompromised replica with the current value of the data, authorized users can still obtain the correct data. This is achieved by requiring that quorum intersections have cardinality at least tI .
2.2 Agrawal and El Abbadi's protocol Agrawal and El Abbadi's protocol integrates weighted voting to attain one-copy equivalence and a secret sharing algorithm to attain security. A secret sharing algorithm, called Rabin's splitting algorithm [9], is used to divide a data object into n pieces and distribute the pieces to n di erent sites. Like Shamir's algorithm, Rabin's splitting algorithm requires at least t out of n pieces to reconstruct the original data. However, unlike Shamir's algorithm, Rabin's algorithm requires a total of only (n=t) jxj space to store data object x, where jxj denotes the size of data object x. The secrecy of the data is attained by requiring an intruder to obtain any t copies of the split data. In order to attain one-copy equivalence, overlap between two quorums must contain at least t replicas. Thus, a larger number of copies must be accessed, when compared with regular quorum protocols. For example, if the size of read quorums is t, the size of the write quorum must be n. Agrawal and El Abbadi proposed a method to reduce the overlap between quorums from t to 1. In this method, at certain points in time, complete information about a data object is held in a log at a site. This may be a security problem.
2.3 A Secure Quorum Protocol (SQP) Our secure quorum protocol (SQP) integrates a quorum protocol to attain one-copy equivalence and a cryptographic technique to attain data security. Like Herlihy and Tygar's protocol, each replica is encoded by using a secret key, and Shamir's secret sharing algorithm is used to divide the key(s) into shadows. Unlike Herlihy and Tygar's protocol, distribution of the shadows is integrated with the quorum protocol. The secure quorum protocol may be used with di erent encryption, decryption, and integrity thresholds. By appropriately choosing the size of quorums and thresholds, SQP does not increase the number of accesses required to perform a read or write operation. This guarantees that the following improved protocol may be implemented without increasing the number of accesses: 1. For better security, the secret key may be erased after each read or write operation has completed; therefore, the key is reconstructed for each operation. 2. Each data object may be encrypted and decrypted using di erent keys to further improve security. The real strength of SQP comes from the join algorithm, which is very useful for constructing a large set of quorums which have the required thresholds. Furthermore, the join algorithm improves the overall security of the key.
3 Security
In this section, we brie y review cryptographic systems and Shamir's secret sharing algorithm on which SQP is based.
3.1 Cryptographic system
An encryption transformation EK is de ned by an encryption algorithm, E, and an encryption key, K. Similarly, a decryption transformation DK is de ned by a decryption algorithm, D, and a decryption key, K 0 . Transformation DK is an inverse of EK ; that is, DK (EK (M)) = M, for any data object M. There are two types of cryptosystems: symmetric (also called \single-key" or \conventional") and asymmetric (or \two-key"). In symmetric cryptosystems, K = K 0 , and in asymmetric cryptosystems, K 6= K 0 . 0
0
0
3.2 Shamir's secret sharing algorithm
In this section, We review Shamir's algorithm and de ne some terminology which is used for formally describing SQP. In SQP, each secret key K is broken into n pieces (shadows), K1 ; K2; ; Kn such that: 1. with knowledge of any t shadows, computing K is easy, and 2. with knowledge of fewer than t shadows, computing K is impossible. One such scheme was proposed by Shamir [10]. The scheme is based on Lagrange interpolating polynomials. The shadows are derived from a random polynomial h (with integer coecients) of degree t ? 1, where h(0) = K. The shadows are generated by evaluating h(x) at n distinct non-zero integer values x1; ; xn. Thus, Ki = h(xi ) for 1 i n: We assume that each shadow Ki is stored as a pair, Ki = (xi ; h(xi)). We de ne an encryption shadow assignment to be a function sE : U ! N, where U is a set of replicas and N is the set of all non-zero integers. For instance, Ki = (sE (i); h(sE (i))) is the encryption shadow assigned to replica i. Similarly, a decryption shadow assignment is a function sD : U ! N. In a single-key system, sE = sD . The encryption threshold tE is the number of di erent shadows needed to reconstruct KE . Similarly, the decryption threshold tD is the number of di erent shadows needed to reconstruct KD .
4 Secure Quorum Protocol
In this section, we present a secure quorum protocol (SQP). For simplicity, we assume that a single replica is stored at each site. Several variations of SQP may be possible based on 1. whether a secret key is associated with the whole database, a certain set of data objects, or each data object; and 2. whether each secret key is reconstructed for each operation, or is kept in volatile storage for a certain length of time. Here, we present the most secure, but least ecient protocol, i.e., a separate key is associated with each data object, and a secret key is reconstructed for each operation. Three keys are associated with each data object: a pair of asymmetric keys, called an encryption key KE and a decryption key KD , and a conventional key, called a writer key KWW . The data object D is encrypted using KE (the encrypted data is denoted by EKE (D)), i.e., EKE (D) can only be decrypted by using KD . Two encrypted copies of the version number V are associated with each data object. One copy is encrypted using KE (denoted by EKE (V )) and the other copy is encrypted using KWW (denoted by EKWW (V )), i.e., EKE (V ) can only be decrypted by using KD , and EKWW (V ) can only be decrypted by using KWW . Copy EKE (V ) is used for passing the version number from a writer to a reader. Copy EKWW (V ) is used for passing the version number from a writer to another writer. Thus, we assume that associated with each data object, the system maintains areas to store the two encrypted version numbers and the three shadows of the keys. The shadows of the keys are distributed among the replicas so that
1. if a site can read shadows from the replicas in a read quorum, it can reconstruct KD , and 2. if a site can read shadows from the replicas in a write quorum, it can reconstruct KE and KWW . Construction of such quorums is described in Section 5. The secure quorum protocol, which is executed at each site, is described as follows:
1. Data object initialization:
The site creating a data object randomly chooses three keys KE , KD , and KWW . The site uses Shamir's secret sharing algorithm to divide KE and KWW into shadows such that any tE shadows may be used to reconstruct KE and KWW . The shadow assignment for KWW is the same as the shadow assignment for KE . Similarly, KD is divided into shadows such that any tD shadows may be used to reconstruct KD . The data object is encrypted using KE . The version number is encrypted using both KE and KWW . The encrypted data and version numbers are distributed to each site, along with the shadows assigned to the site.
2. Operation execution: Read operation: In the rst step, the site reads the encrypted replica, the encrypted version
number (for readers), and the shadow of KD from each of the sites in a read quorum. Then, the site reconstructs KD from the shadows. The site decrypts all of the version numbers using KD and determines which replica has the largest version number. Then, the site decrypts this replica using KD and returns it. Finally, the site discards KD . Write operation: In the rst step, the site reads the version number encripted by KWW and the shadows of KE and KWW from each of the sites in a write quorum. Then, the site reconstructs KE and KWW from the shadows, and determines the maximum version number by using KWW . The copy to be written is assigned a new version number that is one more than the maximum version number. The site encrypts the new version number using both KE and KWW and the data using KE . Then, the site writes the encrypted data and both of the encrypted version numbers to all of the sites in a write quorum. Finally, the site discards KE and KWW .
5 Secure Quorum Generation First, we formally de ne the integrity threshold tI as follows: Let W1 and W2 be write quorums and R1 be a read quorum. If j W1 \ W2 j tI and j W1 \ R1 j tI , then the quorums have integrity threshold tI . If an intruder destroys fewer than tI copies, then each quorum will still contain at least one uncompromised copy. Let tE and tD denote the encryption and decryption thresholds, respectively. Assuming an integrity threshold of tI , in order to obtain at least tD and tE di erent shadows, read and write quorums must contain at least tD + tI ? 1 and tE + tI ? 1 di erent shadows, respectively. Such sets of read and write quorums are said to have decryption threshold tD and encryption threshold tE , respectively. Read and write quorums which have a prede ned integrity threshold tI , encryption threshold tE , and decryption threshold tD are called secure quorums. The highest level of security is obtained if the sizes of all secure write and read quorums are equal to tE + tI ? 1 and tD + tI ? 1, respectively, and each replica contains a di erent shadow. This is why symmetric sets of quorums are well suited for SQP. Note that if tD tE , shadow assignments may be de ned such that any write quorum will contain at least tD di erent read shadows. Then, a separate writer key KWW is not necessary because a writer may obtain KD from any write quorum and decrypt the version number using KD .
In this section, we present two methods for constructing symmetric secure quorums. These methods may be easily modi ed to be used with Herlihy and Tygar's protocol and Agrawal and El Abbadi's protocol.
5.1 Weighted voting One well-known method for generating read and write quorums is to use weighted voting [1, 5, 6]. In this section, we show how weighted voting may be modi ed to generate sets of read and write quorums with given thresholds. Suppose that each replica is assigned a single vote. Let U = f0; 1; 2; ; N ? 1g be a set of N replicas. Each replica is assigned a di erent shadow. For example, we could let sE (i) = sD (i) = i + 1. Given a write threshold qW max(d(N +tI )=2e; tE +tI ? 1), the corresponding set of write quorums is given by W = fG j G U; jGj = qW g . Given a read threshold qR max((N +tI ) ? qW ; tD +tI ? 1), the corresponding set of read quorums is given by R = fG j G U; jGj = qRg . For example, let N = 13, tD = tE = 4, and U = f0; 1; ; 12g. Possible read and write thresholds, for di erent values of tI , are given in Table 1.
Table 1. Read and Write Thresholds
tI qW qR 1 7 7 8 6 9 5 10 4 11 4
tI qW qR tI qW qR 2 8 7 3 8 8 9 6 9 7 10 5 10 6 11 5 11 6 12 5 12 6
5.2 Cyclic read and write quorums We have developed a new method for generating symmetric sets of read and write quorums using modular arithmetic. Let U = f0; 1; ; N ? 1g denote a set of N replicas. Each replica is assigned a di erent shadow. Suppose the read quorums are to have size k, where max(tD + tI ? 1; tI ) k N. Let GR = fa1 ; a2; ; akg, where ai = i ? 1. The set GR is called a read generator. The corresponding set of read quorums is given by R = ffxj1; xj2; ; xjk g j xji = (ai + j) mod N; 1 i k; 0 j < N g Let s = k ? tI and let GW = GR [ ([ii==1m ([jj ==0tI ?1 f(ik +s+j) mod N g)), where m = d(N +tI ? 2k)=ke. Suppose GW = fa1; a2; ; aM g. The set GW is called a write generator. If tE + tI ? 1 > M, then we can add arbitrary elements to GW so that M = tE +tI ? 1. The corresponding set of write quorums is given by W = ffxj1; xj2; ; xjM g j xji = (ai + j) mod N; 1 i M; 0 j < N g Since jGR j = k, we obtain jGW j = max(k +mtI ? [(m + 1)k ? N]+ ; tE +tI ? 1), where x+ = x if x > 0 and 0 otherwise. For example, let N = 13, tD = tE = 4, and U = f0; 1; ; 12g. Generators for di erent values of k and tI are given in Table 2. k 4 5 5
Table 2. Generators
tI GR GW 1 f0,1,2,3g f0,1,2,3,7,11g 1 f0,1,2,3,4g f0,1,2,3,4,9g 2 f0,1,2,3,4g f0,1,2,3,4,8,9g
For example, let k = 5 and tI = 2. Then, GR = f0; 1; 2; 3; 4g and GW = f0; 1; 2; 3; 4; 8;9g. The corresponding set of read quorums is given by R = f f0,1,2,3,4g, f1,2,3,4,5g, f2,3,4,5,6g, f3,4,5,6,7g, f4,5,6,7,8g, f5,6,7,8,9g, f6,7,8,9,10g, f7,8,9,10,11g, f8,9,10,11,12g, f9,10,11,12,0g, f10,11,12,0,1g, f11,12,0,1,2g, f12,0,1,2,3g g The corresponding set of write quorums is given by W = f f0,1,2,3,4,8,9g, f1,2,3,4,5,9,10g, f2,3,4,5,6,10,11g, f3,4,5,6,7,11,12g, f4,5,6,7,8,12,0g, f5,6,7,8,9,0,1g, f6,7,8,9,10,1,2g, f7,8,9,10,11,2,3g, f8,9,10,11,12,3,4g, f9,10,11,12,0,4,5g, f10,11,12,0,1,5,6g, f11,12,0,1,2,6,7g, f12,0,1,2,3,7,8g g
6 Join Algorithm The join algorithm provides a simple and inexpensive way of combining nonempty sets of read and write quorums to form new, larger sets of read and write quorums [8]. In this section, we rst review the join algorithm. Then, we extend the join algorithm to generate secure quorums. The extended join algorithm preserves all three thresholds: tE , tD , and tI . Finally, we show that application of the join algorithm to SQP may improve the overall security of the keys.
6.1 Algorithm Let U be a nonempty set of replicas and let x 2 U. Let V be a nonempty set of replicas such that U \ V = ;. Let CU denote the collection of all nonempty sets of read or write quorums under U. De ne a function, Tx : CU CV ! C(U ?fxg)[V , by if x 2 G1 1 ? fxg) [ G2 Tx (C1; C2) = fG3 j G1 2 C1; G2 2 C2; G3 = (G G1 otherwise g The join algorithm is to apply the above functions to generate sets of read and write quorums. By using the join algorithm, a set of write quorums and the corresponding set of read quorums may be obtained eciently, even for large N. We extend the join algorithm to generate secure quorums. Let C3 = Tx (C1; C2). The shadow assignments of C3 are de ned in the following manner: Let s1 denote a decryption or encryption shadow assignment for C1 . Then, de ne a function, s3 : (U ? fxg) [ V ! N, by (y) if y 2 U ? fxg s3 (y) = ss11 (x) if y 2 V Then, s3 denotes a decryption or encryption shadow assignment for C3 . The following theorem proves that the join algorithm, along with the above shadow assignments, generates secure quorums that preserve the thresholds.
Theorem 1: Let U be a nonempty set of replicas and let x 2 U. Let V be a nonempty set of replicas such that U \ V = ;. Let W be a nonempty set of secure write quorums under U and let W be 1
2
a nonempty set of secure write quorums under V . Let R1 and R2 denote the corresponding sets of secure read quorums. Then, W3 = Tx (W1 ; W2) is a set of write quorums under (U ? fxg) [ V and R3 = Tx (R1; R2) is a set of read quorums under (U ? fxg) [ V . If W1 and R1 have integrity threshold tI , then W3 and R3 also have integrity threshold tI . Let tE be the encryption threshold of W1 and tD be the decryption threshold of R1 . Let s3 be de ned as above. Then, the encryption threshold of W3 and the decryption threshold of R3 are tE and tD , respectively.
Proof: First, we will show that W3 and R3 have integrity threshold tI . Since W1 and R1 have integrity threshold tI , jG1 \ H1j tI for all G1 2 R1 [ W1 and all H1 2 W1 . Let G3 2 R3 [ W3 and H3 2 W3 . There are four cases to consider: 1. Suppose G3 = G1 for some G1 2 R1 [ W1 and H3 = H1 for some H1 2 W1 . Then, jG3 \ H3 j tI because W1 and R1 have integrity threshold tI . 2. Suppose G3 = G1 for some G1 2 R1 [ W1 and H3 = (H1 ?fxg) [ H2 for some H1 2 W1 and some H2 2 W2 . Then, jG1 \ (H1 ? fxg)j tI because x 62 G1. Thus, jG3 \ H3j tI . 3. Suppose G3 = (G1 ? fxg) [ G2 for some G1 2 R1 and some G2 2 R2 or for some G1 2 W1 and some G2 2 W2 and H3 = H1 for some H1 2 W1 . This case is essentially the same as the above case. 4. Suppose G3 = (G1 ? fxg) [ G2 for some G1 2 R1 and some G2 2 R2 or for some G1 2 W1 and G2 2 W2 , and H3 = (H1 ? fxg) [ H2 for some H1 2 W1 and some H2 2 W2. Then, j(G1 ? fxg) \ (H1 ? fxg)j (tI ? 1). Also, jG2 \ H2j 1. Therefore, jG3 \ H3j tI . Therefore, W3 and R3 have integrity threshold tI . Next, we will show that W3 has encryption threshold tE . Let G3 2 W3 . There are two cases to consider: 1. Suppose that G3 = G1 for some G1 2 W1 . Then, jsE (G3)j tE +tI ? 1 because W1 has encryption threshold tE . 2. Suppose that G3 = (G1 ? fxg) [ G2 for some G1 2 W1 and some G2 2 W2 . Then, sE (y) = sE (x) for all y 2 G2 and G2 6= ;. Thus, sE (G3 ) = sE (G1 ? fxg) [ sE (G2) = sE (G1). Therefore, jsE (G3 )j = jsE (G1)j tE + tI ? 1. A similar argument shows that R3 has decryption threshold tD .2
6.2 Example Consider the following example, where A, B, C, and D are sets of write, as well as read, quorums. A = f f1,2g, f2,3g, f3,1g g B = f f4,5g, f5,6g, f6,4g g C = f f7,8g, f8,9g, f9,7g g D = f fa,bg, fb,cg, fc,ag g Suppose that the initial sets of both write and read quorums are D and that tD = tE = 2 and tI = 1. Since three di erent sites appear in D, n = 3. Assume that the encryption shadow assignment for D is de ned by sE (a) = 1, sE (b) = 2, and sE (c) = 3. Further assume that the decryption shadow assignment for D is the same; that is, sD = sE . Note that any quorum in D will contain exactly two di erent shadows. We may construct a new set of quorums by combining two of the above sets of quorums as follows: Let E = Ta (D; A). Then E is given by: E = f f1,2,bg, f2,3,bg, f3,1,bg, fb,cg, fc,1,2g, fc,2,3g, fc,3,1g g In this case, since node a is assigned shadow (1; h(1)), all nodes appearing in set A are also assigned shadow (1; h(1)). Let F = Tb (E; B). Then F is given by: F = f f1,2,4,5g, f1,2,5,6g, f1,2,6,4g, f2,3,4,5g, f2,3,5,6g, f2,3,6,4g, f3,1,4,5g, f3,1,5,6g, f3,1,6,4g, f4,5,cg, f5,6,cg, f6,4,cg, fc,1,2g, fc,2,3g, fc,3,1g g In this case, since node b is assigned shadow (2; h(2)), all nodes appearing in set B are also assigned shadow (2; h(2)).
Let G = Tc (F; C). Then G is given by: G = f f1,2,4,5g, f1,2,5,6g, f1,2,6,4g, f2,3,4,5g, f2,3,5,6g, f2,3,6,4g, f3,1,4,5g, f3,1,5,6g, f3,1,6,4g, f4,5,7,8g, f4,5,8,9g, f4,5,9,7g, f5,6,7,8g, f5,6,8,9g, f5,6,9,7g, f6,4,7,8g, f6,4,8,9g, f6,4,9,7g, f7,8,1,2g, f8,9,1,2g, f9,7,1,2g, f7,8,2,3g, f8,9,2,3g, f9,7,2,3g, f7,8,3,1g, f8,9,3,1g, f9,7,3,1g g In this case, since node c is assigned shadow (3; h(3)), all nodes appearing in set C are also assigned shadow (3; h(3)). By Theorem 1, the resulting quorums in G all contain at least two di erent shadows, and the integrity threshold tI = 1 is maintained.
6.3 Analysis In this section, we will give a brief analysis to prove that SQP applied with the join algorithm (called SQPJ) yields a higher level of security than other protocols in which each replica is assigned a di erent shadow, such as SQP or Herlihy and Tygar's protocol. For example, suppose tD = tE = 2 and the total number of replicas N = 9. In the other protocols, there are 9 distinct shadows, each of which is assigned to a di erent replica. If any two replicas are compromised, the key is compromised. However, in SQPJ using the example in Section 6.2, even if two replicas are compromised, the key may not be compromised. Thus, SQPJ is more secure than the other protocols. Table 4 compares the number of ways in which the key may be compromised if m replicas are compromised.
Table 4. Example
m Other (C1(m)) SQPJ (C2(m)) 1 0 0 2 36 27 3 84 81 4 126 126 5 126 126 6 84 84 7 36 36 8 9 9 9 1 1 Let c denote the probability that a single replica is compromised. Then, the probability that the key is compromised by the other protocols is given by: 9 X P1(c) = (C1 (m)(c)m (1 ? c)9?m ) m=1
Similarly, the probability that the key is compromised by SQPJ is given by: 9 X P2(c) = (C2 (m)(c)m (1 ? c)9?m ) m=1
Some values for P1 (c) and P2 (c) are shown below in Table 5.
Table 5. Example
c Other (P1 (c)) SQPJ (P2(c)) 0.02 0.0131149 0.0099684 0.04 0.0477658 0.0367946 0.06 0.0978380 0.0763803 0.08 0.1583211 0.1252577 0.10 0.2251590 0.1805180 In all cases, SQPJ provides a higher level of security.
7 Conclusion
In this paper, we presented a secure quorum protocol (SQP) and two methods for generating symmetric quorums which may be used by SQP. The rst method uses weighted voting and the second method uses modular arithmetic. Then, we presented an extension of the join algorithm for combining existing quorums and shadows. Application of the join algorithm to SQP may improve the overall security.
References [1] D. Agrawal and A. El Abbadi. Exploiting logical structures in replicated databases. Information Processing Letters, 33:255{260, 1990. [2] D. Agrawal and A. El Abbadi. Integrating security with fault-tolerant distributed databases. The Computer Journal, 33(1):71{78, 1990. [3] P. A. Bernstein, V. Hadzilacos, and N. Goodman. Concurrency Control and Recovery in Database Systems. Addison-Wesley Publishing Co., 1987. [4] D. E. Denning. Cryptography and Data Security. Addison-Wesley Publishing Co., 1982. [5] H. Garcia-Molina and D. Barbara. How to assign votes in a distributed system. Journal of the ACM, 32(4):841{860, 1985. [6] D. K. Gi ord. Weighted voting for replicated data. In Proc. 7th ACM Symposium on Operating Systems Principles, pages 150{162, 1979. [7] M. Herlihy and J. D. Tygar. How to make replicated data secure. Lecture Notes in Computer Science, 293:379{391, 1987. [8] M.L. Neilsen and M. Mizuno. Coterie join algorithm. IEEE Transactions on Parallel and Distributed Systems, to appear. [9] M. O. Rabin. Ecient dispersal of information for security, load balancing, and fault tolerance. Journal of the ACM, 36(2):335{348, 1989. [10] A. Shamir. How to share a secret. Communications of the ACM, 22(11):612{614, 1979.
