Fault-tolerant replication architecture

• US 8,984,330 B2
• Filed: 03/28/2012
• Issued: 03/17/2015
• Est. Priority Date: 03/28/2011
• Status: Active Grant

• Current Assignee: Siemens Corp. (Siemens AG)
• Original Assignee: Siemens Corp. (Siemens AG)
• Inventors: Goose, Stuart, Kirsch, Jonathan
• Primary Examiner(s): BUTLER, SARAI E
• Application Number:
  US13/432,084
• Publication Number:
  US 20130036323A1
• Time in Patent Office: 1,084 Days
• Field of Search: 714/4.11, 714/10, 714/11
• US Class Current: 714/4.11
• CPC Class Codes: G06F 11/1484 involving virtual machines
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2041 with more than one idle spare processing component
• CPC Class Codes: G06F 11/2048 where the redundant components share neither address space nor persistent storage

Abstract

A fault-tolerant replication system includes a first machine running a first hypervisor. A second machine is failure-independent of the first machine. The second machine runs a second hypervisor. A first plurality of virtual machines runs on the first hypervisor. A second plurality of virtual machines runs on the second hypervisor. Each of the virtual machines of the first and second plurality of virtual machines constitutes either a virtual machine replica server of a fault-tolerant replicated state machine or a backup corresponding to a virtual machine replica server of the fault-tolerant replicated state machine. Every backup is embodied on a different machine, of the first and second machines, from its corresponding virtual machine replica server.

Claims

1. A fault-tolerant replication system, comprising:

a first machine running a first hypervisor;

a second machine that is failure-independent of the first machine, running a second hypervisor;

a first storage device within or in communication with the first machine storing code representing a first plurality of virtual machines;

a second storage device within or in communication with the second machine storing code representing a second plurality of virtual machines;

wherein each of the virtual machines of the first and second plurality of virtual machines constitutes either a virtual machine replica server of a fault-tolerant replicated state machine or a backup corresponding to a virtual machine replica server of the fault-tolerant replicated state machine and every backup is embodied on a different machine, of the first and second machines, from its corresponding virtual machine replica server,

wherein the fault-tolerant replicated state machine is a configuration in which each of the replica servers thereof vote on a single replica server thereof to act as a leader maintaining an order in which client requests sent to the state machine are to be processed.

2. The system of claim 1, wherein the first and second failure-independent machines are or are otherwise implemented on distinct physical machines.

3. The system of claim 1, wherein the first and second failure-independent machines are implemented on failure-independent virtual machines running on a common physical machine.

4. The system of claim 1, wherein the fault-tolerant replication system is a Byzantine fault-tolerant replication system.

5. The system of claim 1, wherein all of the virtual machine replica servers of the fault-tolerant replicated state machine are located on the first machine and are run by the first hypervisor and all of the backups are located on the second machine and are run by the second hypervisor.

6. The method of claim 1, wherein the virtual machine replica servers of the fault-tolerant replicated state machine comprise a first subgroup of one or more virtual machine replica servers and a second subgroup of virtual machine replica servers having a corresponding first subgroup of backups and a second subgroup of backups, wherein:

all of the virtual machine replica servers of the first subgroup are located on the first machine and are run by the first hypervisor and all of the backups of the first subgroup are located on the second machine and are run by the second hypervisor, and all of the virtual machine replica servers of the second subgroup are located on the second machine and are run by the second hypervisor and all of the backups of the second subgroup are located on the first machine and are run by the first hypervisor.

7. The system of claim 1, wherein each backup corresponding to a virtual machine replica server of the fault-tolerant replicated state machine is a failover virtual machine for its corresponding virtual machine replica server.

8. The system of claim 1, wherein the fault-tolerant replicated state machine provides a service which is accessible by one or more clients over an electronic network.

9. The system of claim 8, wherein the electronic network is the Internet.

10. The system of claim 1, wherein the first hypervisor includes a function for permitting one of the virtual machines of the first plurality of virtual machines to determine a unique identifier associated with the first hypervisor and the second hypervisor includes a function for permitting one of the virtual machines of the second plurality of virtual machines to determine a unique identifier associated with the second hypervisor.

11. The system of claim 1, wherein the first and second hypervisors each include a function for permitting one of the virtual machine replica servers to inform the respective hypervisor of a current leader among the virtual machine replica servers of the fault-tolerant replicated state machine.

12. The system of claim 1, wherein the first and second hypervisors each include a function for permitting one of the virtual machine replica servers to inform the respective hypervisor of a virtual machine among the virtual machine replica servers of the fault-tolerant replicated state machine that is to be restarted first after recovery from a failure of either the first or second machines.

13. A method for providing a fault-tolerant replication system, comprising:

installing a first hypervisor on a first machine;

installing a second hypervisor on a second machine, that is failure-independent of the first machine;

running a first plurality of virtual machine replica servers on the first hypervisor of the first machine and running a second plurality of virtual machine replica servers on the second hypervisor of the second machine,

wherein the plurality of virtual machine replica servers comprise a fault-tolerant replicated state machine;

establishing a first plurality of backup virtual machines, corresponding to the first plurality of virtual machine replica servers of the first machine, on the second machine, and establishing a second plurality of backup virtual machines, corresponding to the second plurality of virtual machine replica servers of the second machine, on the first machine.

14. The method of claim 13, wherein the first and second failure-independent machines are or are otherwise implemented on distinct physical machines.

15. The method of claim 13, wherein the first and second failure-independent machines are implemented on failure-independent virtual machines running on a common physical machine.

16. The method of claim 13, wherein the fault-tolerant replication system is a Byzantine fault-tolerant replication system.

17. The method of claim 13, wherein each backup corresponding to a virtual machine replica server is a failover virtual machine for its corresponding virtual machine replica server.

18. The method of claim 13, wherein when one of the first and second machines fails, all of the backups established on the surviving machine assume the function of their corresponding virtual machine replica servers that were running on the failed machine.

19. The method of claim 13, wherein a particular virtual machine replica server of the plurality of virtual machine replica servers determines an identity of the hypervisor it is running on.

20. The method of claim 19, wherein after the identified machine fails and a particular backup corresponding to the particular virtual machine replica server assumes a function of the particular virtual machine replica server, the particular backup:

determines an identity of the hypervisor it is running on;

determines that the identified machine has failed based on a mismatch between the identity of the hypervisor determined by the particular virtual machine replica server and the identity of the hypervisor determined by the backup; and

extends criteria for determining a failure of a virtual machine replica server based on the determination that the identified machine has failed.

21. The method of claim 13, wherein one or more of the virtual machine replica servers of the first and second plurality of virtual machine replica servers informs their respective hypervisors of an identity of a current leader among the plurality of virtual machine replica servers.

22. The method of claim 21, wherein after a machine of the first and second machines fails and backups corresponding to the virtual machine replica servers that were running on the failed machine assume operation of their respective virtual machine replica servers, a backup of the backups corresponding to the virtual machine replica servers that were running on the failed machine corresponding with a virtual machine replica server that was identified as the current leader is started before the remainder of backups.

23. A Byzantine fault-tolerant replication system, comprising:

a first physical machine running a first hypervisor;

a second physical machine, distinct from the first physical machine, running a second hypervisor;

a first plurality of virtual machine replica servers of a Byzantine fault-tolerant replicated state machine running on the first hypervisor;

a first plurality of virtual machine backups running on the second hypervisor, each of the first plurality of virtual machine backups corresponding to one of the virtual machine replica servers of the first plurality of virtual machine replica servers running on the first hypervisor;

a second plurality of virtual machine replica servers of the Byzantine fault-tolerant replicated state machine running on the second hypervisor; and

a second plurality of virtual machine backups running on the first hypervisor, each of the second plurality of virtual machine backups corresponding to one of the virtual machine replica servers of the second plurality of virtual machine replica servers running on the second hypervisor.