Hybris: Robust Hybrid Cloud Storage

Dan Dobrework done at NEC Labs Europe

dan@dobre.net

Paolo ViottiEURECOM

paolo.viotti@eurecom.fr

Marko VukolićSystems Group, ETH Zurich and

EURECOMmarko.vukolic@eurecom.fr

AbstractBesides well-known benefits, commodity cloud storage alsoraises concerns that include security, reliability, and consis-tency. We present Hybris key-value store, the first robust hy-brid cloud storage system, aiming at addressing these con-cerns leveraging both private and public cloud resources.

Hybris robustly replicates metadata on trusted privatepremises (private cloud), separately from data which is dis-persed (using replication or erasure coding) across multipleuntrusted public clouds. Hybris maintains metadata storedon private premises at the order of few dozens of bytes perkey, avoiding the scalability bottleneck at the private cloud.In turn, the hybrid design allows Hybris to efficiently androbustly tolerate cloud outages, but also potential malice inclouds without overhead. Namely, to tolerate up to f mali-cious clouds, in the common case of the Hybris variant withdata replication, writes replicate data across f + 1 clouds,whereas reads involve a single cloud. In the worst case, onlyup to f additional clouds are used. This is considerably betterthan earlier multi-cloud storage systems that required costly3 f + 1 clouds to mask f potentially malicious clouds. Fi-nally, Hybris leverages strong metadata consistency to guar-antee to Hybris applications strong data consistency withoutany modifications to the eventually consistent public clouds.

We implemented Hybris in Java and evaluated it using aseries of micro and macrobenchmarks. Our results show thatHybris significantly outperforms comparable multi-cloudstorage systems and approaches the performance of bare-bone commodity public cloud storage.

Categories and Subject Descriptors C.2.4 [Computer andCommunication Networks]: Distributed Systems

Keywords Cloud storage, Hybrid cloud, Reliability

[Copyright notice will appear here once ’preprint’ option is removed.]

1. IntroductionHybrid cloud storage entails storing data on private premisesas well as on one (or more) remote, public cloud storageproviders. To enterprises, such hybrid design brings the bestof both worlds: the benefits of public cloud storage (e.g.,elasticity, flexible payment schemes and disaster-safe dura-bility) as well as the control over enterprise data. For exam-ple, an enterprise can keep the sensitive data on premiseswhile storing less sensitive data at potentially untrusted pub-lic clouds. In a sense, hybrid cloud eliminates to a large ex-tent various security concerns that companies have with en-trusting their data to commercial clouds [31] — as a result,enterprise-class hybrid cloud storage solutions are boomingwith all leading storage providers offering their proprietarysolutions.

Beyond security and trust concerns, storing data to a sin-gle cloud poses issues related to provider reliability, avail-ability, performance, vendor lock-in, as well as consistency,as cloud storage services are notorious for providing onlyeventual consistency [32]. To this end, several researchworks (e.g., [6–8, 10, 33, 35]) considered storing data ro-bustly into public clouds, by leveraging multiple commoditycloud providers. In short, these multi-cloud storage systems,such as DepSky [8], ICStore [6], SPANStore [35] and SCFS[7], leverage multiple public cloud providers to distributethe trust across clouds, increase reliability, availability andconsistency guarantees, and/or optimize the cost of using thecloud. A significant advantage of the multi-cloud approachis that it is based on client libraries that share data accessingcommodity clouds, and as such, demands no big investmentsinto proprietary storage solutions.

However, the existing robust multi-cloud storage systemssuffer from serious limitations. Often, the robustness of thesesystems is limited to tolerating cloud outages, but not arbi-trary or malicious behavior in clouds (e.g., data corruptions)— this is the case with ICStore [6] and SPANStore [35].Other multi-cloud systems that do address malice in systems(e.g., DepSky [8] and SCFS [7]) require prohibitive cost ofrelying on 3 f + 1 clouds to mask f faulty ones. This is amajor overhead with respect to tolerating only cloud out-ages, which makes these systems expensive to use in prac-tice. Moreover, all existing multi-cloud storage systems scat-

2014/10/12

ter storage metadata across public clouds increasing the dif-ficulty of storage management and impacting performance.

In this paper, we unify the hybrid cloud approach withthat of robust multi-cloud storage and present Hybris, thefirst robust hybrid cloud storage system. By unifying the hy-brid cloud with the multi-cloud, Hybris effectively brings to-gether the best of both worlds, increasing security, reliabilityand consistency. At the same time, the novel design of Hy-bris allows for the first time to tolerate potentially maliciousclouds at the price of tolerating only cloud outages.

Hybris exposes the de-facto standard key-value store APIand is designed to seamlessly replace services such as Ama-zon S3 as the storage back-end of modern cloud applica-tions. The key idea behind Hybris is that it keeps all stor-age metadata on private premises, even when those metadatapertain to data outsourced to public clouds. This approachnot only allows more control over the data scattered arounddifferent public clouds, but also allows Hybris to signifi-cantly outperform existing robust public multi-cloud storagesystems, both in terms of system performance (e.g., latency)and storage cost, while providing strong consistency guaran-tees. The salient features of Hybris are as follows:

Tolerating cloud malice at the price of outages: Hybris putsno trust in any given public cloud provider; namely, Hybriscan mask arbitrary (including malicious) faults of up to fpublic clouds. Interestingly, Hybris replicates data on asfew as f + 1 clouds in the common case (when the systemis synchronous and without faults), using up to f additionalclouds in the worst case (e.g., network partitions, cloudinconsistencies and faults). This is in sharp contrast to ex-isting multi-cloud storage systems that involve up to 3 f +1clouds to mask f malicious ones (e.g., [7, 8]).

Efficiency: Hybris is efficient and incurs low cost. In com-mon case, a Hybris write involves as few as f + 1 publicclouds, whereas reads involve only a single cloud, despitethe fact that clouds are untrusted. Hybris achieves this with-out relying on expensive cryptographic primitives; indeed,in masking malicious faults, Hybris relies solely on crypto-graphic hashes. Besides, by storing metadata locally on pri-vate cloud premises, Hybris avoids expensive round-tripsfor metadata operations that plagued previous multi-cloudstorage systems. Finally, to reduce replication overhead Hy-bris optionally supports erasure coding [29], which reducesstorage requirements at public clouds at the expense of in-creasing the number of clouds involved in reads/writes.

Scalability: The potential pitfall of using private cloud incombination with public clouds is in incurring a scalabil-ity bottleneck at a private cloud. Hybris avoids this pitfallby keeping the metadata very small. As an illustration, thereplicated variant of Hybris maintains about 50 bytes ofmetadata per key, which is an order of magnitude less thancomparable systems [8]. As a result, Hybris metadata ser-vice residing on a small commodity private cloud, can eas-

ily support up to 30k write ops/s and nearly 200k read ops/s,despite being fully replicated for metadata fault-tolerance.

Indeed, for Hybris to be truly robust, it has to replicatemetadata reliably. Given inherent trust in private premises,we assume faults within private premises that can affectHybris metadata to be crash-only. To maintain the Hybrisfootprint small and to facilitate its adoption, we chose toreplicate Hybris metadata layering Hybris on top of ApacheZooKeeper coordination service [21]. Hybris clients act sim-ply as ZooKeeper clients — our system does not entail anymodifications to ZooKeeper, hence facilitating Hybris de-ployment. In addition, we designed Hybris metadata serviceto be easily portable from ZooKeeper to SQL-based repli-cated RDBMS as well as NoSQL data stores that export con-ditional update operation (e.g., HBase or MongoDB).

Hybris offers per-key multi-writer multi-reader capabili-ties and guarantees linearizability (atomicity) [20] of readsand writes even in presence of eventually consistent pub-lic clouds [32]. To this end, Hybris relies on strong meta-data consistency within a private cloud to mask potentialinconsistencies at public clouds — in fact, Hybris treatscloud inconsistencies simply as arbitrary cloud faults. Ourimplementation of the Hybris metadata service over ApacheZooKeeper uses wait-free [19] concurrency control, boost-ing further the scalability of Hybris with respect to lock-based systems (e.g., SPANStore [35], DepSky [8] and SCFS[7]).

Finally, Hybris optionally supports caching of data storedat public clouds, as well as symmetric-key encryption fordata confidentiality leveraging trusted Hybris metadata tostore and share cryptographic keys. While different cachingsolutions can be applied to Hybris, we chose to interfaceHybris with Memcached [2] distributed cache, deployed onthe same machines that run ZooKeeper servers.

We implemented Hybris in Java1 and evaluated it us-ing both microbenchmarks and the YCSB [13] macrobench-mark. Our evaluation shows that Hybris significantly out-performs state-of-the-art robust multi-cloud storage systems,with a fraction of the cost and stronger consistency.

The rest of the paper is organized as follows. In Section 2,we present the Hybris architecture and system model. Then,in Section 3, we give the algorithmic aspects of the Hybrisprotocol. In Section 4 we discuss Hybris implementation andoptimizations. In Section 5 we present Hybris performanceevaluation. We overview related work in Section 6, and con-clude in Section 7. Correctness arguments are postponed toAppendix A.

2. Hybris overviewHybris architecture. High-level design of Hybris is givenin Figure 1. Hybris mixes two types of resources: 1) private,trusted resources that consist of computation and (limited)

1 Hybris code is available at http://hybris.eurecom.fr/code.

2014/10/12

http://hybris.eurecom.fr/code

storage resources and 2) (virtually unlimited) untrusted stor-age resources in public clouds. Hybris is designed to lever-age commodity public cloud storage with API that does notoffer computation, i.e., key-value stores (e.g., Amazon S3).

Zookeeper (ZK)

HybrisReliable MetaData Service

(RMDS)

Hybris client

ZK client

Distributed cache(e.g., memcached)

Hybris client

ZK client

Hybris client

ZK client

trustboundary

private premises (private cloud) untrusted public clouds

data

data

metadata

Figure 1. Hybris architecture. Reused (open-source) com-ponents are depicted in grey.

Hybris stores metadata separately from public cloud data.Metadata is stored within the key component of Hybriscalled Reliable MetaData Service (RMDS). RMDS has nosingle point of failure and, in our implementation, resides onprivate premises.

On the other hand, Hybris stores data (mainly) in un-trusted public clouds. Data is replicated across multiplecloud storage providers for robustness, i.e., to mask cloudoutages and even malicious faults. In addition to storing datain public clouds, Hybris architecture supports data cachingon private premises. While different caching solutions exist,our Hybris implementation reuses Memcached [2], an opensource distributed caching system.

Finally, at the heart of the system is the Hybris client,whose library is responsible for interactions with publicclouds, RMDS and the caching service. Hybris clients arealso responsible for encrypting and decrypting data in casedata confidentiality is enabled — in this case, clients lever-age RMDS for sharing encryption keys (see Sec. 3.6).

In the following, we first specify our system model andassumptions. Then we define Hybris data model and specifyits consistency and liveness semantics.System model. We assume an unreliable distributed systemwhere any of the components might fail. In particular, weconsider dual fault model, where: (i) the processes on privatepremises (i.e., in the private cloud) can fail by crashing, and(ii) we model public clouds as potentially malicious (i.e.,arbitrary-fault prone [27]) processes. Processes that do notfail are called correct.

Processes on private premises are clients and metadataservers. We assume that any number of clients and anyminority of metadata servers can be (crash) faulty. Moreover,we allow up to f public clouds to be (arbitrary) faulty;to guarantee Hybris availability, we require at least 2 f +1 public clouds in total. However, Hybris consistency ismaintained regardless of the number of public clouds.

Similarly to our fault model, our communication modelis dual, with the model boundary coinciding with our trustboundary (see Fig. 1).2 Namely, we assume that the com-munication among processes located in the private portionof the cloud is partially synchronous [16] (i.e., with arbi-trary but finite periods of asynchrony), whereas the commu-nication among clients and public clouds is entirely asyn-chronous (i.e., does not rely on any timing assumption) yetreliable, with messages between correct clients and cloudsbeing eventually delivered.

Our consistency model is also dual. We model processeson private premises as classical state machines, with theircomputation proceeding in indivisible, atomic steps. On theother hand, we model clouds as eventually consistent [32];roughly speaking, eventual consistency guarantees that, if nonew updates are made to a given data item, eventually allaccesses to that item will return the last updated value.

Finally, for simplicity, we assume an adversary that cancoordinate malicious processes as well as process crashes.However, we assume that the adversary cannot subvert cryp-tographic hash functions we use (SHA-1), and that it cannotspoof the communication among non-malicious processes.

Hybris data model and semantics. Similarly to com-modity public cloud storage services, Hybris exports akey-value store (KVS) API; in particular, Hybris addressspace consists of flat containers, each holding multiplekeys. The KVS API features four main operations: (i)PUT(cont,key,value), to put value under key in containercont; (ii) GET(cont,key,value), to retrieve the value; (iii)DELETE(cont,key) to remove the respective entry and (iv)LIST(cont) to list the keys present in container cont. We col-lectively refer to operations that modify storage state (e.g.,PUT and DELETE) as write operations, whereas the otheroperations (e.g., GET and LIST) are called read operations.

Hybris implements a multi-writer multi-reader key-valuestorage. Hybris is strongly consistent, i.e., it implementsatomic (or linearizable [20]) semantics. In distributed stor-age context, atomicity provides an illusion that a completeoperation op is executed instantly at some point in time be-tween its invocation and response, whereas the operationsinvoked by faulty clients appear either as complete or notinvoked at all.

Despite providing strong consistency, Hybris is highlyavailable. Hybris writes are wait-free, i.e., writes by a correctclient are guaranteed to eventually complete [19]. On theother hand, Hybris guarantees a read operation by a correctclient to complete always, except in the corner case where aninfinite number of writes to the same key is concurrent withthe read operation (this is called finite-write termination [3]).

2 We believe that our dual fault and communication models reasonablymodel the typical hybrid cloud deployment scenarios.

2014/10/12

RMDS

wk put(k|tsnew,v) ack k,tsnew,H(v),[c1,c2]ts ok

c1

c2

c3ack

(a) PUT (k,v)

RMDS

rk

c1

c2

c3

get(k|ts)ts, hash, [c1,c2] v

H(v) == hash

vv

(b) GET (k)

Figure 2. Hybris PUT and GET protocol illustration ( f = 1). Common-case communication is depicted in solid lines.

3. Hybris ProtocolThe key component of Hybris is its RMDS componentwhich maintains metadata (logical timestamp, pointers toclouds storing data, cryptographic hash of data, and datasize). Such Hybris metadata, despite being lightweight, ispowerful enough to enable tolerating arbitrary cloud fail-ures. Intuitively, the cryptographic hash within a trusted andconsistent RMDS enables end-to-end integrity protection: itensures that neither corrupted values produced by maliciousclouds, nor stale values retrieved from inconsistent clouds,are ever returned to the application. Complementarily, datasize helps prevent certain denial-of-service attack vectors bya malicious cloud (see Sec. 4.2).

Furthermore, Hybris metadata acts as a directory pointingto f +1 clouds that have been previously updated, enablinga client to retrieve the correct value despite f of them beingarbitrary faulty. In fact, with Hybris, as few as f + 1 cloudsare sufficient to ensure both consistency and availability ofread operations (namely GET) — indeed, Hybris GET neverinvolves more than f +1 clouds (see Sec. 3.2). Additional fclouds (totaling 2 f +1 clouds) are only needed to guaranteethat PUT is available as well (see Sec. 3.1).

Finally, besides cryptographic hash and pointers to clouds,metadata includes a timestamp that induces a partial orderof operations which captures the real-time precedence or-dering among operations (atomic consistency). The subtletyof Hybris (see Sec. 3.4 for details) is in the way it combinestimestamp-based lock-free multi-writer concurrency controlwithin RMDS with garbage collection (Sec. 3.3) of stalevalues from public clouds to save on storage costs.

In the following we detail each Hybris operation. Notethat a given Hybris client never invokes concurrent opera-tions on the same key; operations on the same key by thesame client are invoked sequentially.

3.1 PUT ProtocolHybris PUT protocol entails a sequence of consecutive stepsillustrated in Figure 2(a). To write a value v under key k,a client first fetches from RMDS the latest authoritativetimestamp ts by requesting the metadata associated with keyk. Timestamp ts is a tuple consisting of a sequence numbersn and a client id cid. Based on timestamp ts, the client

computes a new timestamp tsnew, whose value is (sn + 1,cid). Next, the client combines the key k and timestamp tsnewto a new key knew = k|tsnew and invokes put (knew, v) onf + 1 clouds in parallel. Concurrently, the clients starts atimer whose expiration is set to typically observed uploadlatencies (for a given value size). In the common case, thef +1 clouds reply to the the client in a timely fashion, beforethe timer expires. Otherwise, the client invokes put (knew, v)on up to f secondary clouds (see dashed arrows in Fig. 2(a)).Once the client has received acks from f +1 different clouds,it is assured that the PUT is durable and proceeds to the finalstage of the operation.

In the final step, the client attempts to store in RMDS themetadata associated with key k, consisting of the timestamptsnew, the cryptographic hash H(v), size of value v size(v),and the list (cloudList) of pointers to those f +1 clouds thathave acknowledged storage of value v. As this final step isthe linearization point of PUT, it has to be performed in a spe-cific way. Namely, if the client performs a straightforwardupdate of metadata in RMDS, then it may occur that storedmetadata is overwritten by metadata with a lower timestamp(old-new inversion), breaking the timestamp ordering of op-erations and Hybris consistency. To solve the old-new inver-sion problem, we require RMDS to export an atomic con-ditional update operation. Then, in the final step of HybrisPUT, the client issues conditional update to RMDS whichupdates the metadata for key k only if the written timestamptsnew is greater than the timestamp for key k that RMDS al-ready stores. In Section 4 we describe how we implementthis functionality over Apache ZooKeeper API; alternativelyother NoSQL and SQL DBMSs that support conditional up-dates can be used.

3.2 GET in the common caseHybris GET protocol is illustrated in Figure 2(b). To reada value stored under key k, the client first obtains fromRMDS the latest metadata, comprised of timestamp ts, cryp-tographic hash h, value size s, as well a list cloudList ofpointers to f + 1 clouds that store the corresponding value.Next, the client selects the first cloud c1 from cloudList andinvokes get (k|ts) on c1, where k|ts denotes the key underwhich the value is stored. Besides requesting the value, the

2014/10/12

client starts a timer set to the typically observed downloadlatency from c1 (given the value size s and for that particularcloud). In the common case, the client is able to downloadthe correct value from the first cloud c1 before expiration ofits timer. Once it receives value v, the client checks that vhashes to hash h comprised in metadata (i.e., if H(v) = h). Ifthe value passes the check, then the client returns the valueto the application and the GET completes.

In case the timer expires, or if the value downloaded fromthe first cloud does not pass the hash check, the client se-quentially proceeds to downloading the data from the secondcloud from cloudList (see dashed arrows in Fig. 2(b)) and soon, until the client exhausts all f +1 clouds from cloudList.3

In specific corner cases, caused by concurrent garbagecollection (described in Sec. 3.3), failures, repeated timeouts(asynchrony), or clouds’ inconsistency, the client has to takeadditional actions in GET (described in Sec. 3.4).

3.3 Garbage CollectionThe purpose of garbage collection is to reclaim storage spaceby deleting obsolete versions of keys from clouds whileallowing read and write operations to execute concurrently.Garbage collection in Hybris is performed by the writingclient asynchronously in the background. As such, the PUToperation can give back control to the application withoutwaiting for completion of garbage collection.

To perform garbage collection for key k, the client re-trieves the list of keys prefixed by k from each cloud as wellas the latest authoritative timestamp ts. This involves invok-ing list(k|∗) on every cloud and fetching metadata associ-ated with key k from RMDS. Then for each key kold , wherekold < k|ts, the client invokes delete (kold) on every cloud.

3.4 GET in the worst-caseIn the context of cloud storage, there are known issues withweak, e.g., eventual [32] consistency. With eventual con-sistency, even a correct, non-malicious cloud might deviatefrom atomic semantics (strong consistency) and return anunexpected value, typically a stale one. In this case, sequen-tial common-case reading from f +1 clouds as described inSection 3.2 might not return a value since a hash verifica-tion might fail at all f + 1 clouds. In addition to the caseof inconsistent clouds, this anomaly may also occur if: (i)timers set by the client for a otherwise non-faulty cloud ex-pire prematurely (i.e., in case of asynchrony or network out-ages), and/or (ii) values read by the client were concurrentlygarbage collected (Sec. 3.3).

To cope with these issues and eventual consistency inparticular, Hybris leverages metadata service consistency tomask data inconsistencies in the clouds effectively allowingavailability to be traded off for consistency. To this end,

3 As we discuss in details in Section 4, in our implementation, clouds incloudList are ranked by the client by their typical latency in the ascendingorder, i.e., when reading the client will first read from the “fastest” cloudfrom cloudList and then proceed to slower clouds.

Hybris client indulgently reiterates the GET by reissuinga get to all clouds in parallel, and waiting to receive atleast one value matching the desired hash. However, dueto possible concurrent garbage collection (Sec. 3.3), a clientneeds to make sure it always compares the values receivedfrom clouds to the most recent key metadata. This can beachieved in two ways: (i) by simply looping the entire GETincluding metadata retrieval from RMDS, or (ii) by loopingonly get operations at f +1 clouds while fetching metadatafrom RMDS only when metadata actually changes.

In Hybris, we use the second approach. Notice that thissuggests that RMDS must be able to inform the client proac-tively about metadata changes. This can be achieved by hav-ing a RMDS that supports subscriptions to metadata updates,which is possible to achieve in, e.g.., Apache ZooKeeper(using the concepts of watches, see Sec. 4 for details). Theentire protocol executed only if common-case GET fails(Sec. 3.2) proceeds as follows:

1. A client first reads key k metadata from RMDS (i.e.,timestamp ts, hash h, size s and cloud list cloudList) andsubscribes for updates for key k metadata with RMDS.

2. Then, a client issues a parallel get (k|ts) at all f + 1clouds from cloudList.

3. When a cloud c ∈cloudList responds with value vc, theclient verifies H(vc) against h4.

(a) If the hash verification succeeds, the GET returns vc.

(b) Otherwise, the client discards vc and reissues get(k|ts) at cloud c.

4. At any point in time, if the client receives a metadata up-date notification for key k from RMDS, the client cancelsall pending downloads, and repeats the procedure by go-ing to step 1.

The complete Hybris GET, as described above, ensuresfinite-write termination [3] in presence of eventually con-sistent clouds. Namely, a GET may fail to return a valueonly theoretically, in case of infinite number of concurrentwrites to the same key, in which case the garbage collectionat clouds (Sec. 3.3) might systematically and indefinitely of-ten remove the written values before the client manages toretrieve them.5

3.5 DELETE and LISTBesides PUT and GET, Hybris exports the additional func-tions: DELETE and LIST— here, we only briefly sketch howthese functions are implemented.

Both DELETE and LIST are local to RMDS and do notaccess public clouds. To delete a value, the client performs

4 For simplicity, we model the absence of a value as a special NULL valuethat can be hashed.5 Notice that it is straightforward to modify Hybris to guarantee read avail-ability even in case of an infinite number of concurrent writes, by switchingoff the garbage collection.

2014/10/12

the PUT protocol with a special cloudList value ⊥ denotingthe lack of a value. Deleting a value creates metadata tomb-stones in RMDS, i.e. metadata that lacks a correspondingvalue in cloud storage. On the other hand, Hybris LIST sim-ply retrieves from RMDS all keys associated with a givencontainer cont and filters out deleted (tombstone) keys.

3.6 ConfidentialityAdding confidentiality to Hybris is straightforward.To thisend, during a PUT, just before uploading data to f +1 publicclouds, the client encrypts the data with a symmetric crypto-graphic key kenc. Then, in the final step of the PUT protocol(see Sec. 3.1), when the client writes metadata to RMDS us-ing conditional update, the client simply adds kenc to meta-data and computes the hash on ciphertext (rather than oncleartext). The rest of the PUT protocol remains unchanged.The client may generate a new key with each new encryp-tion, or fetch the last used key from the metadata service, atthe same time it fetches the last used timestamp.

To decrypt data, a client first obtains the most recentlyused encryption key kenc from metadata retrieved fromRMDS during a GET. Then, upon the retrieved ciphertextfrom some cloud successfully passes the hash test, the clientdecrypts data using kenc.

3.7 Erasure codingIn order to minimize bandwidth and storage capability re-quirements, Hybris supports erasure coding. Erasure codesentail partitioning data into k > 1 blocks with m additionalparity blocks, each of the k+m blocks taking about 1/k ofthe original storage space. When using an optimal erasurecode, the data can be reconstructed from any k blocks de-spite up to m erasures. In Hybris, we fix m to equal f .

Deriving an erasure coding variant of Hybris from itsreplicated counterpart is relatively straightforward. Namely,in a PUT, the client encodes original data into f + k erasurecoded blocks and places one block per cloud. Hence, witherasure coding, PUT involves f + k clouds in the commoncase (instead of f +1 with replication). Then, the client com-putes f +k hashes (instead of a single hash with replication)that are stored in the RMDS as the part of metadata. Finally,erasure coded GET fetches blocks from k clouds in com-mon case, with block hashes verified against those stored inRMDS. In the worst case, Hybris with erasure coding usesup to 2 f + k (resp., f + k) clouds in PUT (resp., GET).

Finally, it is worth noting that in Hybris, there is no ex-plicit relation between parameters f and k which are inde-pendent. This offers more flexibility with respect to prior so-lutions that mandated k ≥ f +1.

4. ImplementationWe implemented Hybris in Java. The implementation per-tains solely to the Hybris client side since the entire func-tionality of the metadata service (RMDS) is layered on top

of Apache ZooKeeper client. Namely, Hybris does not entailany modification to the ZooKeeper server side. Our Hybrisclient is lightweight and consists of about 3400 lines of Javacode. Hybris client interactions with public clouds are im-plemented by wrapping individual native Java SDK clients(drivers) for each particular cloud storage provider into acommon lightweight interface that masks the small differ-ences across native client libraries.

In the following, we first discuss in details our RMDSimplementation with ZooKeeper API. Then, we describeseveral Hybris optimizations that we implemented.

4.1 ZooKeeper-based RMDSWe layered Hybris implementation over Apache ZooKeeper[21]. In particular, we durably store Hybris metadata asZooKeeper znodes; in ZooKeeper znodes are data objectsaddressed by paths in a hierarchical namespace. In particu-lar, for each instance of Hybris, we generate a root znode.Then, the metadata pertaining to Hybris container cont isstored under ZooKeeper path 〈root〉/cont. In principle, foreach Hybris key k in container cont, we store a znode withpath pathk = 〈root〉/cont/k.

ZooKeeper exports a fairly modest API. The ZooKeeperAPI calls relevant to us here are: (i) create/setData(p,data),which creates/updates znode with path p containing data,(ii) getData(p) to retrieve data stores under znode with p,and (iii) sync(), which synchronizes a ZooKeeper replicathat maintains the client’s session with ZooKeeper leader.Only reads that follow after sync() are atomic.

Besides data, znodes have some specific Zookepeer meta-data (not be confused with Hybris metadata which we storein znodes). In particular, our implementation uses znode ver-sion number vn, that can be supplied as an additional param-eter to setData operation which then becomes a conditionalupdate operation which updates znode only if its versionnumber exactly matches vn.

Hybris PUT. At the beginning of PUT (k,v), when clientfetches the latest timestamp ts for k, the Hybris client issuesa sync() followed by getData(pathk) to ensure an atomicread of ts. This getData call returns, besides Hybris times-tamp ts, the internal version number vn of the znode pathkwhich the client uses when writing metadata md to RMDSin the final step of PUT.

In the final step of PUT, the client issues setData(pathk,md,vn)which succeeds only if the znode pathk version is still vn. Ifthe ZooKeeper version of pathk changed, the client retrievesthe new authoritative Hybris timestamp tslast and comparesit to ts. If tslast > ts, the client simply completes a PUT(which appears as immediately overwritten by a later PUTwith tslast ). In case tslast < ts, the client retries the last stepof PUT with ZooKeeper version number vnlast that corre-sponds to tslast . This scheme (inspired by [11]) is wait-free[19] and terminates as only a finite number of concurrentPUT operations use a timestamp smaller than ts.

2014/10/12

Hybris GET. In interacting with RMDS during GET, Hy-bris client simply needs to make sure its metadata is readatomically. To this end, a client always issues a sync() fol-lowed by getData(pathk), just like in our PUT protocol.In addition, for subscriptions for metadata updates in GET(Sec. 3.4) we use the concept of ZooKeeper watches (setby e.g., getData) which are subscriptions on znode updatenotifications. We use these notifications in Step 4 of the al-gorithm described in Section 3.4.

4.2 OptimizationsCloud latency ranks. In our Hybris implementation, clientsrank clouds by latency and prioritize clouds with lower la-tency. Hybris client then uses these cloud latency ranks incommon case to: (i) write to f +1 clouds with the lowest la-tency in PUT, and (ii) to select from cloudList the cloud withthe lowest latency as preferred cloud in GET. Initially, weimplemented the cloud latency ranks by reading once (i.e.,upon initialization of the Hybris client) a default, fixed-size(100kB) object from each of the public clouds. Interestingly,during our experiments, we observed that the cloud latencyrank significantly varies with object size as well as the typeof the operation (PUT vs. GET). Hence, our implementationestablishes several cloud latency ranks depending on the filesize and the type of operation. In addition, Hybris client canbe instructed to refresh these latency ranks when necessary.

Erasure coding. Hybris integrates an optimally efficientReed-Solomon codes implementation, using the Jerasure li-brary [28], by means of its JNI bindings. The cloud latencyrank optimizations remains in place with erasure coding.When performing a PUT, f + k erasure coded blocks arestores in f +k clouds with lowest latency, whereas with GET,k > 1 clouds with lowest latency are selected (out of f + kclouds storing data chunks).

Preventing “Big File” DoS attacks. A malicious preferredcloud may mount a DoS attack against Hybris client during aread by sending, instead of the correct file, a file of arbitrarylength. In this way, a client would not detect a malicious faultuntil computing a hash of the received file. To cope with thisattack, Hybris client uses value size s that Hybris stores andcancels the downloads whose payload size extends over s.

Caching. Our Hybris implementation enables data cachingon private portion of the system. We implemented sim-ple write-through cache and caching-on-read policies. Withwrite-through caching enabled, Hybris client simply writesto cache in parallel to writing to clouds. On the other hand,with caching-on-read enabled, Hybris client upon returninga GET value to the application, writes lazily the GET valueto the cache. In our implementation, we use Memcacheddistributed cache that exports a key-value interface just likepublic clouds. Hence, all Hybris writes to the cache use ex-actly the same addressing as writes to public clouds (i.e.,using put(k|ts,v)). To leverage cache within a GET, Hybris

client upon fetching metadata always tries first to read datafrom the cache (i.e., by issuing get (k|ts) to Memcached),before proceeding normally with a GET.

5. EvaluationFor evaluation purposes, we deployed Hybris “private” com-ponents (namely, Hybris client, metadata service (RMDS)and cache) as virtual machines (VMs) within an OpenStack6

cluster that acts as our private cloud located in Sophia An-tipolis, France. Our OpenStack cluster consists of: two mas-ter nodes running on a dual quad-core Xeon L5320 serverclocked at 1.86GHz, with 16GB of RAM, two 1TB hard-ware RAID5 volumes, and two 1Gb/s network interfaces;and worker nodes that execute on six dual exa-core XeonE5-2650L servers clocked at 1.8GHz, with 128GB of RAM,ten 1TB disks and four 1Gb/s network cards.7 We use theKVM hypervisor, and each machine in the physical clusterruns the Grizzly release of OpenStack on top of a Ubuntu14.04 Linux distribution.

We collocate ZooKeeper and Memcached (in their de-fault configurations) using three VMs of the aforementionedprivate cloud. Each VM has one quad-core virtual proces-sor clocked at 2.40GHz, 4GB of RAM, one PATA virtualhard drive and it is connected to the others through a giga-bit Ethernet network. All VMs run the Ubuntu Linux 13.10distribution images, updated with the most recent patches.In addition, several OpenStack VMs with same character-istics are used for running clients. Each VM has 100Mb/sinternet connectivity for both upload and download band-widths. Clients interact with four cloud providers: AmazonS3, Rackspace CloudFiles, Microsoft Azure (all located inEurope) and Google Cloud Storage (in US).

We evaluated Hybris performance in several experimentsthat focus on the arguably most interesting case where f = 1[14], i.e., where at most one public cloud can exhibit arbi-trary faults. Additionally, we fix the erasure coding recon-struction threshold k to 2.

Experiment 1: Common-case latency. In this experiment,we benchmark the common-case latency of Hybris andHybris-EC (i.e. Hybris using erasure coding instead of repli-cation) with respect to those of DepSky-A [8],8 DepSky-EC(i.e. a version of DepSky featuring erasure codes support),and the four individual clouds underlying Hybris and Dep-Sky, namely Amazon, Azure, Rackspace and Google. Forthis microbenchmark we perform a set of independent PUTand GET operations for sizes ranging from 100kB to 10MBand output the median latencies together with 95% confi-dence intervals on boxplot graphs.

6 http://www.openstack.org/.7 Our hardware and network configuration closely resembles the one sug-gested by commercial private cloud providers, such as Rackspace.8 We used open-source DepSky implementation available at https://code.google.com/p/depsky/.

2014/10/12

http://www.openstack.org/https://code.google.com/p/depsky/https://code.google.com/p/depsky/

We repeated each experiment 30 times, and each set ofGET and PUT operations has been performed one after theother in order to minimize side effects due to internet routingand traffic fluctuations.

In Figures 3 and 4 we show latency boxplots of the clientsas we vary the size of the object to be written or read.9

We observe that Hybris GET latency (Fig. 3) closely followsthose of the fastest cloud provider, as in fact it downloads theobject from that specific cloud, according to Hybris cloud la-tency ranks (see Sec. 4). We further observe (Fig. 4) that Hy-bris roughly performs as fast as the second fastest cloud stor-age provider. This is expected since Hybris uploads to cloudsare carried out in parallel to the first two cloud providers pre-viously ranked by their latency.

Hybris-EC PUT roughly performs as the third fastestcloud as it uploads 3 chunks in parallel, after having cre-ated the coding information. Similarly Hybris-EC GET per-forms slightly worse than the second fastest cloud becauseit retrieves chunks from 2 clouds in parallel before recon-structing the original data.

Notice that Hybris outperforms DepSky-A and DepSky-EC in both PUT and GET operations. The difference is signif-icant particularly for smaller to medium object sizes (100kBand 1MB). This is explained by the fact that Hybris storesmetadata locally, whereas DepSky needs to fetch metadataacross clouds. With increased file sizes (10MB) network la-tency takes over and the difference is less pronounced.

Throughout the tests, we observed a significant variancein cloud performance and in particular for downloading largeobjects at Amazon and Rackspace.

Experiment 2: Latency under faults. In order to assessthe impact of faulty clouds on Hybris GET performance,we repeat Experiment 1 with one cloud serving tamperedobjects. This experiment aims at stress testing the commoncase optimization of Hybris to download objects from asingle cloud. In particular, we focused on the worst casefor Hybris, by injecting a fault on the closest cloud, i.e. theone likely to be chosen for the download because of its lowlatency. We injected faults by manually tampering the data.

Figure 5 shows the download times of Hybris, DepSky-A and DepSky-EC for objects of different sizes, as wellas those of individual clouds, for reference. Hybris perfor-mance is nearly the sum of the download times by the twofastest clouds, as the GET downloads in this case sequen-tially. However, despite its single cloud read optimization,Hybris performance under faults remains comparable to thatof DepSky variants that download objects in parallel.

Experiment 3: RMDS performance. In this experimentwe stress our ZooKeeper-based RMDS implementation inorder to assess its performance when the links to clouds arenot the bottleneck. For this purpose, we short-circuit public

9 In the boxplots the central line is showing the median, the box correspondsto 1st and 3rd quartiles while whiskers are drawn at the most extreme datapoints within 1.5 times the interquartile range from 1st and 3rd quartiles.

clouds and simulate upload by writing a 100 byte payload toan in-memory hash map. To mitigate possible performanceimpact of the shared OpenStack cloud we perform (only) thisexperiment deploying RMDS on a dedicated cluster of three8-core Xeon E3-1230 V2 machines (3.30GHz, 20 GB ECCRAM, 1GB Ethernet, 128GB SATA SSD, 250 GB SATAHDD 10000rpm). The obtained results concerning metadatareads and writes performance are shown in Figure 6.

Figure 6(a) shows GET latency as we increase through-put. The observed peak throughput of roughly 180 kops/sachieved with latencies below 4 ms is due to the fact thatsyncing reads in ZooKeeper comes with a modest overheadand we take advantage of read locality in ZooKeeper to bal-ance requests across ZooKeeper nodes. Furthermore, sinceRMDS has a small footprint, all read requests are serviceddirectly from memory without incurring the cost of stablestorage access.

On the other hand, PUT operations incur the expense ofatomic broadcast within ZooKeeper and stable storage ac-cesses in the critical path. Figure 6(b) shows the latency-throughput curve for three different classes of stable storagebacking ZooKeeper, namely conventional HDD, SSD andRAMDISK, which would be replaced by non-volatile RAMin a production-ready system. The observed differences sug-gest that the choice of stable storage for RMDS is crucialfor overall system performance, with HDD-based RMDS in-curring latencies nearly one order of magnitude higher thanRAMDISK-based at peak throughput of 28 kops/s (resp. 35kops/s). As expected, SSD-based RMDS is in the middle ofthe latency spectrum spanned by the other two storage types.

To understand the impact of concurrency on RMDS per-formance, we evaluated the latency of PUT under heavy con-tention to a single key. Figure 6(c) shows that despite 128clients writing concurrently to the same key, the latencyoverhead is only 30% over clients writing to separate keys.

Finally, Figures 6(d) and 6(e) depict throughput curves asmore clients performing operations in closed-loop are addedto the system. Specifically, 6(d) suggests that ZooKeeper-based RMDS is able to service read requests coming from2K clients near peak throughput. On the other hand, Fig-ure 6(e) shows again the performance discrepancy when us-ing different stable storage types, with RAMDISK and HDDat opposite ends of the spectrum. Observe that HDD peakthroughput, despite being below that of RAMDISK, slightlyovertakes SSD throughput with 5K clients.

Experiment 4: Caching. In this experiment we test Hy-bris caching which is configured to implement both write-through and caching-on-read policies. We configured Mem-cached with 128 MB cache limit and with 10MB single ob-ject limit. We varied blob sizes from 1kB to 10 MB and mea-sured average latency. The experiment workload is YCSBworkload B (95% reads, 5% writes). The results for GETwith and without caching are depicted in Figure 7.

2014/10/12

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

500

1000

1500

2000

2500Ti

me

(ms)

(a) 100kB GET

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

2000

4000

6000

8000

10000

12000

14000

16000

Tim

e (m

s)

(b) 1MB GET

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

20000

40000

60000

80000

100000

Tim

e (m

s)

(c) 10MB GET

Figure 3. Latencies of GET operations.

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

500

1000

1500

2000

2500

3000

3500

4000

Tim

e (m

s)

(a) 100kB PUT

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

500

1000

1500

2000

2500

3000

3500

4000

4500

Tim

e (m

s)

(b) 1MB PUT

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

2000

4000

6000

8000

10000

12000

Tim

e (m

s)

(c) 10MB PUT

Figure 4. Latencies of PUT operations.

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

500

1000

1500

2000

2500

Tim

e (m

s)

(a) 100kB GET

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

5000

10000

15000

20000

Tim

e (m

s)

(b) 1MB GET

Hybri

s

Hybri

s-EC

DepS

ky-A

DepS

ky-EC

Amaz

onAz

ure

Rack

spac

e

Goog

le0

20000

40000

60000

80000

100000

120000

140000

160000

Tim

e (m

s)

(c) 10MB GET

Figure 5. Latencies of GET operations with one faulty cloud.

We can observe that caching decreases Hybris latency byan order of magnitude when cache is large enough comparedto object size. As expected, the benefits of cache diminishwith increase in cache misses. This experiment shows thatHybris can very simply benefit from caching, unlike othermulti-cloud storage protocols (see also Table 2).

Cost comparison. Table 1 summarizes the monetary costsincurred by several cloud storage systems in the commoncase (i.e. synchrony, no failures, no concurrency), includingAmazon S3 as the baseline. For the purpose of calculatingcosts, given in USD, we set f = 1 and assume a symmetric

System PUT GET Storage Cost / Month TotalICStore [6] 60 376 144 580

DepSky-A [8] 30 376 72 478DepSky-EC [8] 30 136 36 202

Hybris 10 120 48 178Hybris-EC 15 120 36 171Amazon S3 5 120 24 149

Table 1. Cost of cloud storage systems in USD for 2 x106 transactions, and 106 files of 1MB, totaling to 1TB ofstorage.

2014/10/12

0

2

4

6

8

10

12

14

0 20 40 60 80 100 120 140 160 180 200

Late

ncy

(ms)

Throughput (kops/s)

GET

(a) GET latency

0

50

100

150

200

250

300

350

0 5 10 15 20 25 30 35

Late

ncy

(ms)

Throughput (kops/s)

RAMDISKSSDHDD

(b) PUT latency

0

1

2

3

4

5

6

2 4 8 16 32 64 128

Late

ncy

(ms)

No. of clients

Parallel PUTConcurrent PUT

(c) PUT latency under concurrency

0

20

40

60

80

100

120

140

160

180

200

0 500 1000 1500 2000 2500

Thro

ughp

ut (k

ops/

s)

No. of clients

GET

(d) GET throughput

0

5

10

15

20

25

30

35

40

0 500 1000 1500 2000 2500 3000 3500 4000 4500 5000

Thro

ughp

ut (k

ops/

s)

No. of clients

RAMDISKSSDHDD

(e) PUT throughput

Figure 6. Performance of metadata read and write operations.

workload that involves 106 PUT (i.e. modify) and 106 GEToperations accessing 1MB files totaling to 1T B of storageover the period of 1 month. This corresponds to a modestworkload of roughly 40 hourly operations. The cost pertransaction, storage, and outbound traffic are taken fromAmazon S3 as of 07/18/2014. The basis for costs calculationis Table 2. Our figures exclude the cost of private cloudinfrastructure in Hybris, which we assume to be part ofalready existing IT infrastructure.

We observe that Hybris overhead is twice the baselineboth for PUT and storage because Hybris stores data in 2clouds in the common case. Since Hybris touches a singlecloud once for each GET operation, the cost of GET equalsthat of the baseline, and hence is optimal. On the other handHybris-EC incurs for k = 2 a reduced storage overhead of1.5x the baseline at the cost of increased overhead for PUT,because data needs to be dispersed onto 3 clouds.

2014/10/12

0 1kB 10kB 100kB 1MB 10MBSize

0

100

101

102

103

104

Late

ncy

(ms)

cachingno caching

Figure 7. Hybris GET latency with YCSB workload B.

6. Related Work

Protocol Semantics Common case performanceCloud faults Consistency No. of Cloud operations Blow-up

ICStore [6] crash-only atomic1(4 f +2)(D+m) (writes) 4 f +2(2 f +1)(D+m) (reads)

DepSky [8] arbitrary regular1 (2 f +1)(D+m) (writes) 2 f +1

2

(2 f +1)(D+m) (reads)

Hybris arbitrary atomic (f+1)D (writes) f+13

1D (reads)

1 Unlike Hybris, to achieve atomic (resp., regular) semantics,ICStore (resp., DepSky) require public clouds to be atomic (resp., regular).2 The erasure coded variant of DepSky features 2 f+1f+1 storage blowup.3 The erasure coded variant of Hybris features f+kk storage blowup, for any k > 1.

Table 2. Comparison of existing robust multi-writer cloudstorage protocols. We distinguish cloud data operations (D)from cloud metadata operations (m).

Multi-cloud storage systems. Several storage systems (e.g.,[4, 6, 8, 9, 24, 26, 35]) have used multiple clouds in boost-ing data robustness, notably reliability and availability.SafeStore [24] erasure codes data across multiple storageproviders (clouds) providing data integrity, confidentialityand auditing, while using a centralized local proxy for con-currency control, caching and storing metadata. SPANStore[35] is another recent multi-cloud storage system that seeksto minimize the cost of use of multi-cloud storage, leverag-ing a centralized cloud placement manager. However, Safe-Store and SPANStore are not robust in the Hybris sense,as their centralized components (local proxy and placementmanager, respectively) are single point of failure. RACS [4]and HAIL [9] assume immutable data, hence not addressingany concurrency aspects. Depot [26] key-value store tol-erates any number of untrusted clouds, yet does not offerstrong consistency and requires computation on clouds.

Multi-cloud storage systems closest to Hybris are Dep-Sky [8] and ICStore [6]. For clarity, we overview main as-pects of these three systems in Table 2. ICStore modelscloud faults as outages and implements robust access toshared data. Hybris advantages over ICStore include toler-

ating malicious clouds and smaller storage blowup10. On theother hand, DepSky considers malicious clouds, yet requires3 f + 1 clouds, unlike Hybris. Furthermore, DepSky consis-tency guarantees are weaker than those of Hybris, even whenclouds behave as strongly consistent. Finally, Hybris guar-antees atomicity even in presence of eventually consistentclouds, which may harm the consistency guarantees of bothICStore and DepSky. Recently, and concurrently with thiswork, SCFS [7] augmented DepSky to a full fledged filesystem by applying a similar idea of turning eventual con-sistency to strong consistency by separating cloud file sys-tem metadata from payload data that is stored using DepSky.Nevertheless, SCFS still requires 3 f +1 clouds to tolerate fmalicious ones (the overhead SCFS inherits from DepSky).

Separating data from metadata. Separating metadata fromdata is not a novel idea in distributed systems. For example,Farsite [5] is an early protocol that tolerates malicious faultsby replicating metadata (e.g., cryptographic hashes and di-rectory) separately from data. Hybris builds upon thesetechniques yet, unlike Farsite, Hybris implements multi-writer/multi-reader semantics and is robust against timingfailures as it relies on lock-free concurrency control ratherthan locks (or leases). Furthermore, unlike Farsite, Hybrissupports ephemeral clients and has no server code, targetingcommodity cloud APIs.

Separation of data from metadata is intensively used incrash-tolerant protocols. For example, in the Hadoop Dis-tributed File System (HDFS), modeled after the Google FileSystem [18], HDFS NameNode is responsible for maintain-ing metadata, while data is stored on HDFS DataNodes.Other notable crash-tolerant storage systems that separatemetadata from data include LDR [17] and BookKeeper [22].LDR [17] implements asynchronous multi-writer multi-reader read/write storage and, like Hybris, uses pointers todata storage nodes within its metadata and requires 2 f + 1data storage nodes. However, unlike Hybris, LDR consid-ers full-fledged servers as data storage nodes and toleratesonly their crash faults. BookKeeper [22] implements reliablesingle-writer multi-reader shared storage for logs. Book-Keeper stores metadata on servers (bookies) and data (i.e.,log entries) in log files (ledgers). Like in Hybris RMDS,bookies point to ledgers, facilitating writes to f + 1 ledgersand reads from a single ledger in common-case. UnlikeBookKeeper, Hybris supports multiple writers and toleratesmalicious faults of data repositories.Interestingly, all robustcrash-tolerant protocols that separate metadata from data(e.g., [17, 22], but also Gnothi [34]), need 2 f +1 data repos-itories in the worst case, just like our Hybris which toleratesarbitrary faults.

Finally, the idea of separating control and data planes insystems tolerating arbitrary faults was used also in [36] in

10 Blowup of a given redundancy scheme is defined as the ratio between thetotal storage size needed to store redundant copies of a file, over the originalunreplicated file size.

2014/10/12

the context of replicated state machines (RSM). While theRSM approach of [36] could obviously be used for imple-menting storage as well, Hybris proposes a far more scalableand practical solution, while also tolerating pure asynchronyacross data communication links, unlike [36].Systems based on trusted components. Several systemshave used trusted hardware to reduce the overhead of repli-cation despite malicious faults from 3 f + 1 to 2 f + 1 repli-cas, typically in the context of RSM (e.g., [12, 15, 23, 30]).Some of these systems, like CheapBFT [23], employ onlyf +1 replicas in the common case.

Conceptually, Hybris is similar to these systems in that ituses 2 f +1 trusted metadata replicas (needed for ZooKeeper)and 2 f + 1 (untrusted) clouds. However, compared to thesesystems, Hybris is novel in several ways. Most importantly,existing systems entail placing trusted hardware within anuntrusted process, which raises concerns over practicalityof such an approach. In contrast, Hybris trusted hardware(private cloud) exists separately from untrusted processes(public clouds), with this hybrid cloud model being in factinspired by practical system deployments.

7. Conclusion and Future WorkIn this paper we presented Hybris, the first robust hybridstorage system. Hybris disperses data (using replication orerasure coding) across multiple untrusted and possibly in-consistent public clouds, while it replicates metadata withintrusted premises of a private cloud. Hybris tolerates up tof arbitrary public cloud faults and is very efficient: in thecommon-case (with replicated variant of Hybris), writes ac-cesses only f + 1 clouds, while a reads accesses a single,“closest” cloud. In a sense, Hybris is the first multi-cloudstorage protocol that makes it possible to tolerate potentiallymalicious clouds at the price of tolerating simple cloud out-ages. To complement this, Hybris offers strong consistencyas it leverages strong consistency of metadata stored off-clouds to mask the weak consistency of data stored in clouds.

Hybris is designed to seamlessly replace commodity key-value cloud storage (e.g., Amazon S3) in existing applica-tions. Hybris could be used for archival (“cold”) data, butalso for mutable data due to its strong multi-writer consis-tency. For example, in future work and in the scope of theCloudSpaces EU project [1], we plan to integrate Hybriswith a Dropbox-like personal cloud frontend [25].

In future work, we also plan to address the limitationof our current deployment of Hybris that restricts metadataservers to a single geographical location. We aim at geo-replicating Hybris metadata service, thereby accommodat-ing geographically distributed clients.

AcknowledgmentsWe thank Phil Gibbons and anonymous SoCC reviewersfor their useful comments and suggestions. We also thankChristian Cachin for his comments on earlier drafts of the

paper. This work is partially supported by the EU projectsCloudSpaces (FP7-317555) and SECCRIT (FP7-312758).

A. CorrectnessHere, we provide the correctness arguments and pseudocode(Alg. 1) for the core part of the protocol (PUT, Sec. 3.1 andworst-case GET, Sec. 3.4). For space limitations, we omit thecorrectness proofs pertaining to the RMDS implementationand DELETE and LIST operations.11 The atomic functional-ity of RMDS is however specified in Algorithm 2.

Algorithm 1 Algorithm of client cid.1: operation PUT (k,v)2: (ts,−,−,−)← RMDS.READ(k, f alse)3: if ts =⊥ then ts← (0,cid)4: ts← (ts.sn+1,cid)5: cloudList← /0; trigger(timer)6: forall f +1 selected clouds Ci do7: put 〈k|ts,v〉 to Ci8: wait until |cloudList|= f +1 or timer expires9: if |cloudList|< f +1 then

10: forall f secondary clouds Ci do11: put 〈k|ts,v〉 to Ci12: wait until |cloudList|= f +113: RMDS.CONDUPDATE(k, ts,cloudList,H(v),size(v))14: trigger garbage collection // see Section 3.315: return OK

16: upon put 〈k|ts,v〉 completes at cloud Ci17: cloudList← cloudList ∪{i}18: operation GET (k) //worst-case, Section 3.4 code only19: (ts,cloudList,hash,size)← RMDS.READ(k, true)20: if ts =⊥ then return ⊥21: forall Ci ∈ cloudList do22: get (k|ts) from Ci23: upon get (k|ts) returns data from cloud Ci24: if H(data) = hash then return data25: else get (k|ts) from Ci26: upon received notify(k, ts′) from RMDS such that ts′ > ts27: cancel all pending gets28: return GET (k)

Algorithm 2 RMDS functionality (atomic).29: operation READ(k,noti f y) by cid30: if noti f y then subscribed← subscribed∪{cid}31: return (ts(k),cList(k),hash(k),size(k))

32: operation CONDUPDATE(k, ts,cList,hash,size)33: if ts(k) =⊥ or ts > ts(k) then34: (ts(k),cList(k),hash(k),size(k))← (ts,cList,hash,size)35: send notify(k, ts) to every c ∈ subscribed(k)36: subscribed(k)← /037: return OK

11 Moreover, we ignore possible DELETE operations — the proof is easy tomodify to account for impact of DELETE.

2014/10/12

We define the timestamp of operation o, denoted ts(o),as follows. If o is a PUT, then ts(o) is the value of client’svariable ts when its assignment completes in line 4, Alg. 1.Else, if o is a GET, then ts(o) equals the value of ts whenclient executes line 24, Alg. 1 (i.e., when GET returns). Wefurther say that an operation o precedes operation o′, if ocompletes before o′ is invoked. Without loss of generality,we assume that all operations access the same key k.LEMMA A.1 (Partial Order). Let o and o′ be two GET orPUT operations with timestamps ts(o) and ts(o′), respec-tively, such that o precedes o′. Then ts(o) ≤ ts(o′) and if o′is a PUT then ts(o)< ts(o′).Proof: In the following, prefix o. denotes calls to RMDSwithin operation o (and similarly for o′). Let o′ be a GET(resp. PUT) operation.Case 1 (o is a PUT): then o.RMDS.CONDUPDATE(o.md) inline 13, Alg. 1, precedes (all possible calls to) o′.RMDS.READ()in line 19, Alg. 1 (resp., line 2, Alg. 1). By atomicity ofRMDS (and RMDS functionality in Alg. 2) and definition ofoperation timestamps, it follows that ts(o′) ≥ ts(o). More-over, if o′ is a PUT, then ts(o′) > ts(o) because ts(o′) isobtained from incrementing the timestamp ts returned byo′.RMDS.READ() in line 2, Alg. 1, where ts≥ ts(o).Case 2 (o is a GET): then since (all possible calls to)o′.RMDS.READ() in line 19 (resp. 2) follows after (the lastcall to) o.RMDS.READ() in line 19, by Alg. 2 and atomicityof RMDS, it follows that ts(o′) ≥ ts(o). If o′ is a PUT, thents(o′)> ts(o), similarly as in Case 1. �

LEMMA A.2 (Unique PUTs). If o and o′ are two PUT oper-ations, then ts(o) 6= ts(o′).Proof: By lines 2- 4, Alg. 1, RMDS functionality (Alg. 2)and the fact that a given client does not invoke concurrentoperations on the same key. �

LEMMA A.3 (Integrity). Let rd be a GET(k) operation re-turning value v 6= ⊥. Then there is a single PUT operationwr of the form PUT(k,v) such that ts(rd) = ts(wr).Proof: Since rd returns v and has a timestamp ts(rd), rdreceives v in response to get(k|ts(rd)) from some cloud Ci.Suppose for the purpose of contradiction that v is neverwritten by a PUT. Then, by the collision resistance of H(),the check in line 24 does not pass and rd does not return v.Therefore, we conclude that some operation wr issues put(k|ts(rd)) to Ci in line 7. Hence, ts(wr) = ts(rd). Finally, byLemma A.2 no other PUT has the same timestamp. �

THEOREM A.4 (Atomicity). Every execution ex of Algo-rithm 1 satisfies atomicity.Proof: Let ex be an execution of the algorithm. By Lemma A.3the timestamp of a GET either has been written by some PUTor the GET returns⊥. With this in mind, we first construct ex′from ex by completing all PUT operations of the form PUT(k,v), where v has been returned by some complete GET op-eration. Then we construct a sequential permutation π by

ordering all operations in ex′, except GET operations that re-turn⊥, according to their timestamps and by placing all GEToperations that did not return ⊥ immediately after the PUToperation with the same timestamp. The GET operations thatdid return ⊥ are placed in the beginning of π .

Towards atomicity, we show that a GET rd in π alwaysreturns the value v written by the latest preceding PUT whichappears before it in π , or the initial value of the register ⊥if there is no such PUT. In the latter case, by constructionrd is ordered before any PUT in π . Otherwise, v 6=⊥ and byLemma A.3 there is a PUT (k,v) operation, with the sametimestamp, ts(rd). In this case, PUT (k,v) appears before rdin π , by construction. By Lemma A.2, other PUT operationsin π have a different timestamp and hence appear in π eitherbefore PUT (k,v) or after rd.

It remains to show that π preserves real-time order. Con-sider two complete operations o and o′ in ex′ such that o pre-cedes o′. By Lemma A.1, ts(o′)≥ ts(o). If ts(o′)> ts(o) theno′ appears after o in π by construction. Otherwise ts(o′) =ts(o) and by Lemma A.1 it follows that o′ is a GET. If o is aPUT, then o′ appears after o since we placed each read afterthe PUT with the same timestamp. Otherwise, if o is a GET,then it appears before o′ as in ex′. �

THEOREM A.5 (Availability). Hybris PUT calls are wait-free, whereas Hybris GET calls are finite-write terminating.Proof: The wait freedom of Hybris PUT follows from: a)the assumption of 2 f +1 clouds out of which at most f maybe faulty (and hence the wait statement in line 12, Alg. 1is non-blocking), and b) wait-freedom of calls to RMDS(hence, calls to RMDS in lines 2 and 13, Alg. 1 return).

We prove finite-write termination of GET by contradic-tion. Assume there is a finite number of writes to key k inexecution ex, yet that there is a GET(k) operation rd by acorrect client that never completes. Let W be the set of allPUT operations in ex, and let wr be the PUT operation withmaximum timestamp tsmax in W that completes the call toRMDS in line 13, Alg. 1. We distinguish two cases: (i) rdinvokes an infinite number of recursive GET calls (in line 28,Alg 1), and (ii) rd never passes the check in line 24, Alg. 1.

In case (i), there is a recursive GET call in rd, invokedafter wr completes conditional update to RMDS. In this GETcall, the client does not execute line 28, Alg 1, by definitionof wr and specification of RMDS.CONDUPDATE in Alg. 2(as there is no notify for a ts > tsmax). A contradiction.

In case (ii), notice that key k|tsmax is never garbage col-lected at f + 1 clouds that constitute cloudList in line 13,Alg. 1 in wr. Since rd does not terminate, it receives a notifi-cation in line 26, Alg. 1 with timestamp tsmax and reiteratesGET. In this iteration of GET, the timestamp of rd is tsmax.As cloudList contains f + 1 clouds, including at least onecorrect cloud Ci, and as Ci is eventually consistent, Ci even-tually returns value v written by wr to a get call. This valuev passes the hash check in line 24, Alg. 1 and rd completes.A contradiction. �

2014/10/12

References[1] CloudSpaces EU FP7 project. http://cloudspaces.

eu/.

[2] Memcached. http://memcached.org/.

[3] I. Abraham, G. Chockler, I. Keidar, and D. Malkhi. Byzan-tine Disk Paxos: Optimal Resilience with Byzantine SharedMemory. Distributed Computing, 18(5):387–408, 2006.

[4] H. Abu-Libdeh, L. Princehouse, and H. Weatherspoon.RACS: a case for cloud storage diversity. In SoCC, pages229–240, 2010.

[5] A. Adya, W. J. Bolosky, M. Castro, G. Cermak, R. Chaiken,J. R. Douceur, J. Howell, J. R. Lorch, M. Theimer, and R. P.Wattenhofer. Farsite: Federated, available, and reliable stor-age for an incompletely trusted environment. SIGOPS Oper.Syst. Rev., 36(SI), Dec. 2002.

[6] C. Basescu, C. Cachin, I. Eyal, R. Haas, A. Sorniotti,M. Vukolić, and I. Zachevsky. Robust data sharing with key-value stores. In Proceedings of DSN, pages 1–12, 2012.

[7] A. Bessani, R. Mendes, T. Oliveira, N. Neves, M. Correia,M. Pasin, and P. Verissimo. SCFS: A shared cloud-backedfile system. In Usenix ATC, 2014.

[8] A. N. Bessani, M. Correia, B. Quaresma, F. André, andP. Sousa. DepSky: Dependable and secure storage in a cloud-of-clouds. ACM Transactions on Storage, 9(4):12, 2013.

[9] K. D. Bowers, A. Juels, and A. Oprea. HAIL: a high-availability and integrity layer for cloud storage. In ACM CCS,pages 187–198, 2009.

[10] C. Cachin, R. Haas, and M. Vukolić. Dependable storagein the intercloud. Technical Report RZ3783, IBM Research,2010.

[11] G. Chockler, D. Dobre, and A. Shraer. Brief announcement:Consistency and complexity tradeoffs for highly-availablemulti-cloud store. In The International Symposium on Dis-tributed Computing (DISC), 2013.

[12] B.-G. Chun, P. Maniatis, S. Shenker, and J. Kubiatowicz.Attested append-only memory: making adversaries stick totheir word. In SOSP, pages 189–204, 2007.

[13] B. F. Cooper, A. Silberstein, E. Tam, R. Ramakrishnan, andR. Sears. Benchmarking cloud serving systems with ycsb. InSoCC, pages 143–154, 2010.

[14] J. C. Corbett, J. Dean, M. Epstein, A. Fikes, C. Frost, J. J.Furman, S. Ghemawat, A. Gubarev, C. Heiser, P. Hochschild,W. C. Hsieh, S. Kanthak, E. Kogan, H. Li, A. Lloyd, S. Mel-nik, D. Mwaura, D. Nagle, S. Quinlan, R. Rao, L. Rolig,Y. Saito, M. Szymaniak, C. Taylor, R. Wang, and D. Wood-ford. Spanner: Google’s globally distributed database. ACMTrans. Comput. Syst., 31(3):8, 2013.

[15] M. Correia, N. F. Neves, and P. Verı́ssimo. How to toleratehalf less one Byzantine nodes in practical distributed systems.In SRDS, pages 174–183, 2004.

[16] C. Dwork, N. Lynch, and L. Stockmeyer. Consensus in thepresence of partial synchrony. J. ACM, 35(2):288–323, Apr.1988. ISSN 0004-5411. .

[17] R. Fan and N. Lynch. Efficient Replication of Large DataObjects. In Proceedings of DISC, pages 75–91, 2003.

[18] S. Ghemawat, H. Gobioff, and S.-T. Leung. The google filesystem. In SOSP, pages 29–43, 2003.

[19] M. Herlihy. Wait-Free Synchronization. ACM Trans. Pro-gram. Lang. Syst., 13(1), 1991.

[20] M. P. Herlihy and J. M. Wing. Linearizability: A CorrectnessCondition for Concurrent Objects. ACM Trans. Program.Lang. Syst., 12(3), 1990.

[21] P. Hunt, M. Konar, F. P. Junqueira, and B. Reed. Zookeeper:wait-free coordination for internet-scale systems. In USENIXATC’10, pages 11–11, 2010.

[22] F. P. Junqueira, I. Kelly, and B. Reed. Durability with book-keeper. Operating Systems Review, 47(1):9–15, 2013.

[23] R. Kapitza, J. Behl, C. Cachin, T. Distler, S. Kuhnle, S. V.Mohammadi, W. Schröder-Preikschat, and K. Stengel. Cheap-BFT: resource-efficient Byzantine fault tolerance. In EuroSys,pages 295–308, 2012.

[24] R. Kotla, L. Alvisi, and M. Dahlin. Safestore: A durable andpractical storage system. In USENIX ATC, pages 129–142,2007.

[25] P. G. Lopez, S. Toda, C. Cotes, M. Sanchez-Artigas, andJ. Lenton. Stacksync: Bringing elasticity to dropbox-like filesynchronization. In ACM/IFIP/USENIX Middleware, 2014.

[26] P. Mahajan, S. T. V. Setty, S. Lee, A. Clement, L. Alvisi,M. Dahlin, and M. Walfish. Depot: Cloud storage with mini-mal trust. ACM Trans. Comput. Syst., 29(4):12, 2011.

[27] M. Pease, R. Shostak, and L. Lamport. Reaching Agreementin the Presence of Faults. J. ACM, 27(2), 1980.

[28] J. S. Plank, S. Simmerman, and C. D. Schuman. Jerasure:A library in C/C++ facilitating erasure coding for storageapplications - Version 1.2. Technical Report CS-08-627,University of Tennessee, August 2008.

[29] R. Rodrigues and B. Liskov. High availability in dhts: Erasurecoding vs. replication. In IPTPS, pages 226–239, 2005.

[30] G. S. Veronese, M. Correia, A. N. Bessani, L. C. Lung, andP. Verı́ssimo. Efficient byzantine fault-tolerance. IEEE Trans.Computers, 62(1):16–30, 2013.

[31] VMware Professional Services. The SnowdenLeak: A Windfall for Hybrid Cloud? http://blogs.vmware.com/consulting/2013/09/the-snowden-leak-a-windfall-for-hybrid-cloud.html.

[32] W. Vogels. Eventually consistent. Commun. ACM, 52(1):40–44, 2009.

[33] M. Vukolić. The Byzantine empire in the intercloud. SIGACTNews, 41(3):105–111, 2010.

[34] Y. Wang, L. Alvisi, and M. Dahlin. Gnothi: separating dataand metadata for efficient and available storage replication. InUSENIX ATC’12, pages 38–38, 2012.

[35] Z. Wu, M. Butkiewicz, D. Perkins, E. Katz-Bassett, and H. V.Madhyastha. Spanstore: cost-effective geo-replicated storagespanning multiple cloud services. In SOSP, 2013.

[36] J. Yin, J.-P. Martin, A. Venkataramani, L. Alvisi, andM. Dahlin. Separating agreement from execution for byzan-tine fault tolerant services. In SOSP, pages 253–267, 2003.

2014/10/12

http://cloudspaces.eu/http://cloudspaces.eu/http://memcached.org/http://blogs.vmware.com/consulting/2013/09/the-snowden-leak-a-windfall-for-hybrid-cloud.htmlhttp://blogs.vmware.com/consulting/2013/09/the-snowden-leak-a-windfall-for-hybrid-cloud.htmlhttp://blogs.vmware.com/consulting/2013/09/the-snowden-leak-a-windfall-for-hybrid-cloud.htmlhttp://blogs.vmware.com/consulting/2013/09/the-snowden-leak-a-windfall-for-hybrid-cloud.html

IntroductionHybris overviewHybris Protocolput Protocolget in the common caseGarbage Collectionget in the worst-casedelete and listConfidentialityErasure coding

ImplementationZooKeeper-based RMDSOptimizations

EvaluationRelated WorkConclusion and Future WorkCorrectness