Middleware Doctoral Symposium '22 Paper #2 Reviews and Comments

Paper #2 Secure Replication for Client-centric Data Stores

Submitted: 23 September 2022
Accepted: 27 October 2022

Review A: 3. Weak accept
Review B: 4. Accept
Review C: 4. Accept

Overall merit

3. Weak accept

Reviewer expertise

2. Some familiarity

Paper summary

This work proposes a middleware solution designed to support client-centric distributed computing paradigm. The problem of the work is strong eventual consistency in a Byzantine environment. The author proposes three protocol variants (i) State CRDTs with Merkle-tree to optimize for efficient state replication with update sets; (ii) a new leaderless BFT protocol design over gossip based protocols; and (iii) a cryptographically secure CRDT replication in an untrusted environment. The author has already published their work and implementation in a series of past publications (well done!).

Comments for author

Here are some comments to improve the quality of the draft and work:

• What is the killer application/workload here? Is it enablement of a new class of applications or performance/security improvements? A running example in the introduction would help to set the tone and scope of the work. Though there are some use cases given, but what are the technical requirements for such use cases (collaborative editing, market place)
• How does this work compare to Distributed Ledger Works (DLTs) which are also about consensus in a mixed, trusted-untrusted environment? (see the HyperLedger paper from IBM).
• For the leaderless BFT protocols, can you justify the trade-off made in the loss of performance? For example, in your deployment environment how often a failure/repair happens? If that is the majority of time, then the high overhead paid by your implementation makes sense. Do you have an intuition how the performance of your protocol scales (as the number of gossiping peers increase)
• How is membership management done?
• How is the overhead of 19 calculated for section 2.3?
• In all untrusted scenarios, I would like to see some analysis about attack model, and overhead. How does the performance and/or the availability of the system scale as the adversarial load on the system is increased.

Overall solid work.

Overall merit

4. Accept

Reviewer expertise

2. Some familiarity

Paper summary

The work proposes to build a peer-to-peer network to build a client-centric web. The work mostly focuses on consistency models under different trust environments.

Comments for author

Peer-to-peer was a hot topic in the 2000's, I am surprised not to see work from that time more widely discussed. It fails out of the spotlight and it isn't as discussed. What has changed since? While would the author's proposed approach be more successful now than it was back then?

Another potentially relevant piece of technology is the "databox"-like propositions [1]. It would be interesting to discuss and understand why this doesn't seem to gain much traction (technology? business model? etc.).

In short, there is a bunch of work that has proposed a more decentralized web model. It would be good to contextualize this work within this context and to articulate how this proposal is different and why it could succeed when others have failed.

[1] https://dl.acm.org/doi/abs/10.1145/3010079.3010082

Overall merit

4. Accept

Reviewer expertise

1. No familiarity

Paper summary

The paper proposes three approaches of decentralized computing via client centric data replication that diminishes the dominance of server centric computing. The forum paper summarizes the properties achieved in the protocols for client side data replication that offer eventual consistency in a trusted and an untrusted setting and strong consistency in an untrusted setting.

Comments for author

It is a well written PhD forum paper that makes the problem definition clear and also summarizes the different contributions made towards an overarching goal that is the main goal of the thesis.

Suggested Improvements

1. Some discussion on the results on eventual consistency in a trusted setting will be helpful. The other two approaches contain such discussion, but for this section outcomes of the implementation is missing.