With a working environment that consists of
one desktop computer (host A) connected to a network via a hi-speed connection at work,
one desktop computer (host B) connected to a network via a hi-speed connection at home,
one notebook computer (host C) that uses a modem to be connected to a network,
and a PDA (host D).

There is an object that is replicated on the above four hosts (A, B, C, and D) and you have frequent read and write access to this object. How would you set the voting configuration for the object?

• Weighted voting configuration: [a, b, c, d]
• read quorum: r
• write quorum: w

1. (5 points) GVT needs to be estimated by the system regularly. What is the trade-off on the frequency of GVT estimation?

2. (5 points) By definition, GVT never decreases, but what would be the implications if GVT decreases?

3. (10 points) What kind of behavior in Time Warp system would be analogous to thrashing in virtual memory system?

When a web browser retrieves a web page the browser checks its local cache to see if the data is available locally. If not available in the browser's web cache, then depending on configuration, the browser either retrieves the page from the the web server indicated in the URL or contacts a local proxy server which in turn retrieves the page and returns the page to the browser. Even when data is present in the browsers local cache, the browser will usually contact the web server listed in the URL to make sure the page hasn't changed.

Compare web caching, as just described, with caching in the domain name system. What are the differences? What are the similarities? What resources or loading is reduced by caching in each system and what are the benefits of each approach (note that even where there are similarities, the benefits may be slightly different)?

You have been hired by the Liberty Alliance who is designing a network authentication and authorization system to rival Microsoft Passport. Your system should support authentication using password typed by the user and optionally by the use of a smartcard. Your system must provide single sign on for users registered with one ISP or web service using services registered with other providers. Interoperability with Microsoft Passport is not required, but should not be completely ruled out either.

The service you are designing will maintain information about users such as age (or age range), address and account numbers (possibly credit card numbers, or possibly some other identifier) that will be made available to merchants when specifically approved by the user.

1. (25 points) Consider users registered with America Online, Yahoo, and Verisign. What information would you need to maintain about each of these users and where would you store this information? When and how would this information be provided to merchants or other service providers to whom users wish to authenticate? Describe the alternatives and justify your choice. Be sure to consider security, privacy, and availability issues when making you choice.

2. (10 points) Where are the vulnerabilities in your system for security, privacy, and availability - what are the likely points of attack, or common modes of failure? What steps can you take to address these limitations, limit the affects of compromise, improve availability, or ensure quick recovery from failure?

   Note: all these issues are and were important in the design of Microsoft Passport too - you chose to accept the job offer from the Liberty Alliance project over your Microsoft job offer because the Liberty Alliance project is in a much earlier stage of development giving you a greater influence on the development team.