Three Lessons from Aladdin on Dependability Evaluation

1
Three Lessons from Aladdin onDependability
Evaluation
http//research.microsoft.com/ymwang/default.htm
Aladdin
Yi-Min Wang Microsoft Research, Redmond
2
Aladdin connect to your house at any time, from
any place, and on any device
Text-based Interface
Email
Natural Language Parser
MSN
Device control objects
My Home Buddy
Lookup Services
Eventing
Monitoring Daemon
Soft-State Store
3
UbiComp Dependability Issue 1

• If a lamp was physically switched off, the X10
  module and the Aladdin lookup service couldnt
  know about it ? system failure due to
  operator/user error!
• Solution better training, procedure, and
  disciplinary action to eliminate operator errors
• Hide or remove the physical switches
• Kids are easy to train

• Wife refused to be trained your system is
  supposed to make my life better, so dont tell me
  to change my life to make your system better.
• Better solution Aladdin Device Adaptor (ADA)

4
UbiComp Dependability Principle 1
Users Are Always Right

• If a problem has no solution, it may not be a
  problem, but a fact, not to be solved, but to be
  coped with over time Shimon Peres (Peress
  Law)

• Its all about fault model

5
1231AM, Sep. 24, 1999 - House under attack...
UbiComp Dependability Issue 2
003142 - Address M13 gtgtgtgtgt ALERT BOGUS
ADDRESS ltltltltlt ... 003507 - Func C
HailRequest(8) ... 003513 - Func F
AllLightsOn(1) ... 003559 - Func M
ExtendedDataTransfer(12) gtgtgtgtgt ALERT BOGUS
ADDRESS ltltltltlt ... 003609 - Address
M13 gtgtgtgtgt ALERT BOGUS ADDRESS ltltltltlt
... 003612 - Func M Dim(4) Change in
brightness level 0x0e gtgtgtgtgt ALERT BOGUS
ADDRESS ltltltltlt ... 003800 - Func E
HailAcknowledge(9) gtgtgtgtgt ALERT BOGUS ADDRESS
ltltltltlt ... 003850 - Func I On(2) ... 0040
26 - Func N AllLightsOn(1) gtgtgtgtgt ALERT BOGUS
ADDRESS ltltltltlt ... 004514 - Func E
AllLightsOn(1) gtgtgtgtgt ALERT BOGUS ADDRESS
ltltltltlt ... 012431 - Func K AllLightsOn(1)
gtgtgtgtgt ALERT BOGUS ADDRESS ltltltltlt ... 012528 -
Func I AllUnitsOff(0) ... 012624 - Func E
AllLightsOff(6) gtgtgtgtgt ALERT BOGUS ADDRESS
ltltltltlt ... 014452 - Func J StatusRequest(15)
gtgtgtgtgt ALERT BOGUS ADDRESS ltltltltlt
6
0144AM, Sep. 24 -- Attacker identified
A plugged-in X10 interface With a floating
serial-port connector ! Operator error
non-fail-stop failure
7
UbiComp Dependability Principle 2
Panic Button For Stopping The System

• If a problem has no solution, it may not be a
  problem, but a fact, not to be solved, but to be
  coped with over time Shimon Peres (Peress
  Law)

• Its all about fault model

Unimaginable Faults
8
UbiComp Dependability Issue 3

• Affordable redundancy
• Triple garage door sensors with camera
• Uninterruptible Power Supply for home server
• Multi-PC leader election
• There are always single points of failure
• Major outages
• Power outage in the office shut down MyAlertBuddy
• Kids installing game controller shut down
  MyHomeBuddy
• Patch installation shut down MyAlertBuddy

9
UbiComp Dependability Principle 3
Ubiquitous Computing Ubiquitous Pain

• If a problem has no solution, it may not be a
  problem, but a fact, not to be solved, but to be
  coped with over time Shimon Peres (Peress
  Law)

• Its all about fault model

Systems Management Issues
10

• STRIDER Computer Genomics approach to systems
  management
• Black-box specifications derived from behavior
  monitoring modeling http//research.microsoft.co
  m/ymwang/default.htmStrider

105 ?!
105
101
STRIDER
UbiComp
11
Summary
Users Are Always Right
Panic Button For Stopping The System
Ubiquitous Computing Ubiquitous Pain

• UbiComp dependability evaluation needs to adopt a
  modern fault model to cover these three areas
• But its so messy! How can it be done?

That itself is a major challenge for the
research community!