Safe Serializable Secure Scheduling: Transactions and the Trade-off Between Security and Consistency

TL;DR

This paper addresses the challenge of securely scheduling federated transactions by introducing the staged commit protocol, which prevents information leaks while maintaining atomicity and efficiency.

Contribution

The paper introduces the staged commit protocol and a static code checker, enabling secure, atomic, and efficient transaction scheduling in federated settings.

Findings

Secure scheduling is achievable under certain conditions.

Staged commit prevents information leaks during transactions.

Implementation demonstrates practical, secure, and efficient federated transactions.

Abstract

Modern applications often operate on data in multiple administrative domains. In this federated setting, participants may not fully trust each other. These distributed applications use transactions as a core mechanism for ensuring reliability and consistency with persistent data. However, the coordination mechanisms needed for transactions can both leak confidential information and allow unauthorized influence. By implementing a simple attack, we show these side channels can be exploited. However, our focus is on preventing such attacks. We explore secure scheduling of atomic, serializable transactions in a federated setting. While we prove that no protocol can guarantee security and liveness in all settings, we establish conditions for sets of transactions that can safely complete under secure scheduling. Based on these conditions, we introduce staged commit, a secure scheduling protocol for federated transactions. This protocol avoids insecure information channels by dividing transactions into distinct stages. We implement a compiler that statically checks code to ensure it meets our conditions, and a system that schedules these transactions using the staged commit protocol. Experiments on this implementation demonstrate that realistic federated transactions can be scheduled securely, atomically, and efficiently.