Proximity Based Group Communications for Mobile Ad Hoc Networks

Transcription

1 PAGE 1/31 IST BASIC RESEARCH PROJECT SHARED COST RTD PROJECT THEME: FET DISAPPEARING COMPUTER COMMISSION OF THE EUROPEAN COMMUNITIES DIRECTORATE GENERAL INFSO PROJECT OFFICER: THOMAS SKODAS Global Smart Spaces Proxmty Based Group Communcatons for Moble Ad Hoc Networks D.14 03/10/2003/TCD/WP6/VFINAL ANDRONIKOS NEDOS, KULPREET SINGH, SIOBHÁN CLARKE

2 PAGE 2/31 IST Project Number IST Acronym GLOSS Full ttle EU Project offcer Global Smart Spaces Thomas Skodas Delverable Number D 14 Name Bndng model wth partal falure model Task Number T Name Work Package Number WP 6 Name Theores of Moblty Date of delvery Contractual PM 30 Actual 03/10/2003 Code name <codename> Verson 1.0 draft fnal Nature Prototype Report Specfcaton Tool Other: Dstrbuton Type Publc Restrcted to: <partners> Authors (Partner) Contact Person Trnty College Dubln Dr. Sobhán Clarke Emal Sobhan.Clarke@cs. tcd.e Phone Fax Abstract (for dssemnaton) Ths document descrbes a formal specfcaton for a servce that provdes relable and effcent connectvty to support communcaton amongst groups of devces n a moble settng. Further, we descrbe an mplementaton of Hearsay (one of Gloss s conceptual tools) that supports hearsay based on both locaton and tme. Keywords Group Communcaton, Relable Pervasve Applcatons, Context-based messagng

3 PAGE 3/31 CONTENTS CONTENTS INTRODUCTION PBGC WITHIN CONTEXT OF GLOSS SCENARIO SHARED DEVICES REQUIRING MUTUAL EXCLUSION RELIABLE MESSAGE DISSEMINATION COLLABORATIVE WORK PBGC SPECIFICATION INTRODUCTION PBGC REQUIREMENTS PBGC SYSTEM MODEL AND ASSUMPTIONS Mathematcal Model Stable Components and Falure Detectors Stablty Condtons Partton Antcpator SPECIFYING A PROXIMITY GROUP MEMBERSHIP SERVICE SPECIFYING A PROXIMITY GROUP DELIVERY SERVICE Vrtual Synchrony Orderng Propertes IMPLEMENTING HEARSAY WITH LATTE BASED HEARSAY SERVICE Locaton Tme Identty IMPLEMENTATION Overall Archtecture Sender Model Context Engne Extendng LATTE wth PBGC CONCLUSION REFERENCES...30

4 PAGE 4/31 1 INTRODUCTION One of the central objectves for Gloss s to develop essental mddleware nfrastructures for hybrd moble ad hoc, peer-to-peer and herarchcal systems. The work on proxmty-based group communcatons (PBGC) descrbed n ths document s postoned n the moble ad hoc part of such an nfrastructure. PBGC facltates relable dssemnaton of nformaton to a person on the move, and relable and consstent sharng of nformaton between groups of people who come together n an ad hoc fashon. For example, as llustrated n the Gloss Scenaro [2], Bob receves a personal message as he wanders around Pars; Bob and Jane start to work together n a café n Pars; Bob receves messages from other moble users around hm ndcatng where there are crowds so he can mngle. Important propertes relatng to these parts of the scenaro are moblty, nformaton dssemnaton and ad hoc communcaton. The Group Communcaton paradgm [3, 4, 5, 6] has already proven to be a useful tool for buldng relable dstrbuted systems. In our work, we are augmentng tradtonal group communcaton systems wth the noton of a group s proxmty. Proxmty captures the ntrnsc property of geographc locaton of moble nodes, whch can be exploted to buld several locaton based servces and applcatons for moble adhoc networks. PBGC can be employed n moble ad-hoc networks to support consstent sharng of nformaton between the nodes that are n proxmty of each other. The asynchronous nature of the communcaton n such a scenaro requres state replcaton amongst the relevant nodes, relable message dssemnaton and mutual excluson for shared state. PBGC s sutable for provdng the approprate buldng blocks to support such communcaton as t takes nto consderaton the dynamc nature of membershp due to moblty, and provdes message delvery guarantees wthn a geographc locaton. In Gloss, the network servces that connect people and artefacts may be abstracted nto the core network, whch consttutes the backbone of the communcaton nfrastructure handlng traffc between remote locatons (e.g. Pars-Brussels n the scenaro) and the edge network, whch provdes the nfrastructure for smaller-scale local nteractons. Ths separaton provdes the best balance between scalablty, cost and relablty. Communcaton n the edge network takes place prmarly between moble nodes connectng n an ad hoc fashon, enablng local nteractons to be acheved wth reduced cost and reduced power consumpton, by usng no fxed nfrastructure that requres powerful transcevers or nvestment n nfrastructure. At the same tme performance characterstcs such as latency are mproved, snce no ntermedate enttes are beng used. However the mult-hop nature of the moble ad hoc mode of operaton decreases relablty due to frequent dsconnectons caused by moblty. PBGC provdes guarantees to counteract ths nherent unrelablty wthn a geographc locaton. The man body of work descrbed n ths document s a formal specfcaton for relable and effcent connectvty for groups of devces n a moble settng. Further, we descrbe an mplementaton of Hearsay (one of Gloss s conceptual tools) that supports hearsay based on both locaton and tme. The prototype system, called LATTE (Locaton and Tme Trggered Emal), has an nternal events-based archtecture that llustrates the need for a supportng mddleware that provdes relable messagng wthn a locaton. Ths prototype provdes an deal platform on whch to evaluate the development of PBGC. Frst, though, the next secton dscusses PBGC n the context of the Gloss Scenaro [2].

5 PAGE 5/31 2 PBGC WITHIN CONTEXT OF GLOSS SCENARIO In ths secton we dscuss the use of moble group communcatons for Gloss by analysng occurrences n the Gloss scenaro where we have dentfed a strong requrement for buldng blocks such as those provded by PBGC. These use-cases contrbute to the requrements on whch the specfcaton for PBGC s based. 2.1 SHARED DEVICES REQUIRING MUTUAL EXCLUSION As llustrated n Fgure 1, there are stuatons when Bob s travellng from Brussels to Pars where potentally many users may wsh to use the same resource. For example, n Fgure 1(a), Bob s on hs way to Pars, and he uses actve walls stuated nsde the staton. The same usage pattern re-appears n Fgure 1(b) when Bob s sttng nsde the café n Pars attemptng to use the actve wall stuated nsde. The red route s not busy ths mornng. As Bob s walkng close to an actve wall, he s presented a message relevant to hs trp n Pars (a) Bob at the Tran Staton When Bob sts down n the café, the actve surface on the table nforms hm of the local hstory of the café. An actve wall dsplays a selecton of postcards for hs perusal. (b) Bob n a café n Pars Fgure 1: Need for Mutual Excluson Although the actve wall s a shared devce that can be used by any of the people n proxmty, ts actual functonng requres exclusve use by each clent. Ths s then a problem of mutual excluson to a shared resource, whch has receved partcular attenton n classc dstrbuted systems lterature [7], but whch reappears here n the context of moble ad hoc computng. Though any algorthms from the exstng lterature can be used for solvng t, solutons for ths problem requre the underlyng network to have the ablty for relable broadcast. The current specfcaton for Proxmty Groups offers exactly that n the form of broadcastng to the members of a proxmty group that s defned n the vcnty of the actve wall. 2.2 RELIABLE MESSAGE DISSEMINATION Gloss explored the noton of locaton-specfc notfcatons and captured t n a conceptual tool called Hearsay as a form of ambent communcaton. In Fgure 2, we llustrate one Hearsay example from the Gloss scenaro. Whle Bob s n Pars, he

6 PAGE 6/31 receves a notfcaton when he s n the proxmty of a café that hs frend n Denmark recommended. Now knowng the rght drecton, Bob starts to move towards the Pompdou Centre. After Bob has walked a block, hs personal communcatons devce vbrates. Fgure 2: Need for Relable Message Dssemnaton Implementng ths concept n a peer-to-peer way over moble ad hoc networks decreases latency and communcaton costs by keepng all communcaton n the localty of the relevant devces. A proxmty groups framework can help establsh an awareness zone n the vcnty of an area (.e. the café n ths case). Usng ths servce, a trval servce dscovery protocol can provde notfcaton to nterested partes, as well as help expand the awareness zone, by explotng the mult-hop aspects of the network. As a result, a proxmty group composed of devces nsde a desgnated area contanng that regon n ther lst of preferences wll receve a notfcaton, whle other devces reman unaffected. 2.3 COLLABORATIVE WORK An occurrence of collaboratve work between users that gather n an ad hoc fashon appears n the Gloss scenaro, as llustrated n Fgure 3. Whle n the restaurant n Pars, Bob and Jane nteract wth the table n the restaurant, and use shared objects to llustrate deas. When Bob and Jane have eaten, they brng out the work that they had started earler and contnue to work on t. They use shared objects to llustrate ther deas for the layout of the ste they are plannng together. Fgure 3: Need for Collaboratve Work

7 PAGE 7/31 Ths s an example of collaboratve work enabled when moble wreless devces come nto communcaton range. The communcaton pattern n ths nstance s n a oneto-many or many-to-many fashon, whch s the pattern used n group communcatons. A proxmty group servce n ths case can offer a substrate for relable transmsson and orderng of messages sent between group partcpants, whle transparently adaptng the membershp when other nterested devces enter the proxmty of the actve table. In general, collaboratve work between moble partcpants can greatly beneft from such a servce as the necessary functons of broadcast and orderng are abstracted n the mddleware, so applcatons can reuse them accordngly.

8 PAGE 8/31 3 PBGC SPECIFICATION 3.1 INTRODUCTION Ths secton provdes a formal specfcaton for a proxmty based group communcaton servce. Hgh-level concepts and requrements are ntally descrbed, followed by detal of the system model propertes on whch the servce wll resde. We then formally specfy the servce aganst these propertes. Members n a group (each of whch we refer to as a node ) share nformaton, and need a consstent vew of that nformaton. To acheve ths, nodes need a consstent vew of all the other nodes nvolved n the communcaton. All group communcaton servces have a membershp servce part, and the servce for the moble, ad hoc scenaro we are targetng s no dfferent. In ths case, geographcal locaton of nodes determnes f they can become members of a group. We defne later how the proxmty of a group and the locaton of nodes help n establshng the group s membershp. The membershp servce provdes a dynamc vew of the current membershp to all nodes n the group. Fgure 4 Dsjont Coverage Areas We defne a group to have a predefned proxmty assocated wth t. Ths proxmty descrbes the geographcal regon n whch the group can exst. Only the nodes that are present wthn the defned proxmty can partcpate n the group s communcaton. It s not necessary that all nodes n a regon be group members. Nodes have to explctly ssue a request to jon a proxmty group s communcaton. When nodes leave the proxmty, they are removed from the group s membershp. The rado ranges of nodes n a group cover a certan geographcal area, as shown n Fgure 4. Ths geographcal area s called a coverage area. A group s predefned proxmty can be parttoned nto a number of coverage areas, each of whch would then correspond to a partton of a group. Parttons occur when a subset of members move

9 PAGE 9/31 out of rado range of other members. It s possble due to the moble nature of nodes, that not all of the group s proxmty area wll be covered by the sum of the coverage areas. Informaton about coverage areas can help buld a servce that antcpates parttons and provdes such nformaton to applcatons. Pror knowledge of when a partton s lkely to happen allows an applcaton behave n an orderly manner n other words, n a manner that s approprate for the applcaton s semantcs. In ths document we rgorously specfy a proxmty based group communcaton servce for moble ad-hoc networks. We also formally specfy the behavour of the partton antcpator and elaborate how t helps n provdng a moble group communcaton wth the guarantees specfed. 3.2 PBGC REQUIREMENTS The responsbltes of the PBGC servce for moble ad-hoc networks are lsted below. Later we try and map these hgh level requrements to rgorous specfcatons. 1. If a group exsts, all member nodes have access to the vew of the partton they are n. 2. When a new node enters a coverage area of a group, t s provded wth nformaton about the group and an opportunty to jon. A new node can choose to jon the group ether mmedately or later. The group s nformaton should be avalable as long as there s any member of a group present n the proxmty. 3. If nodes from a certan coverage area leave each other s vcnty, that coverage area s then splt nto parttons. The group contnues wth dsparate parttons. 4. Parttons from the same group merge when ther coverage areas overlap/ntersect. 5. When parttons merge, the applcaton s gven an opportunty to ntate state transfer. 6. If, at start-up, a group has dsjont parttons wthn the same proxmty, the parttons are unaware of each other. 7. A node can be a member of more than one group. 8. Messages are delvered, n an agreed order, to all members of a group that are n the same partton. If a group has parttoned, the members n dfferent parttons contnue to mantan the local total order for that partton. The nodes nvolved n the group communcaton servce are moble devces, requrng correct handlng of frequent topology changes and of a dynamc (not predetermned) set of nteractng processors. 3.3 PBGC SYSTEM MODEL AND ASSUMPTIONS Prevous work on Group Communcaton Servces s prmarly based on fxed nfrastructure networks. However, the dynamc nature of moble ad-hoc networks has a sgnfcant mpact on a group communcaton servce s specfcaton, affectng the system model and the assumptons for the system. Ths secton descrbes the system model and assumptons for the PBGC servce, whch are an extenson to those used by the Chockler survey [6]. The Chockler survey establshes a framework for specfyng the propertes of group communcaton systems and presents the propertes of varous

10 PAGE 10/31 group communcaton systems usng the framework. The survey s the latest such effort and provdes a sold ground to develop, compare and contrast propertes of dfferent group communcaton systems. The assumptons that are dfferent to the Chockler paper are marked wth a ( ), and the assumptons that have no counter-part n the Chockler system model are marked wth ( ). 1. The system conssts of a dynamc set of processors 1. Ths mples that processors can dynamcally jon and leave the system. 2. Processors communcate usng message passng. 3. The underlyng network provdes unrelable node-to-neghbours datagram communcaton faclty. 4. A mult-hop unrelable datagram based communcaton faclty can be bult on top of the node-to-neghbours communcaton faclty. 5. A node s neghbours can dynamcally change. Ths can happen ether because of node moblty or falures of nodes. 6. We assume all nodes wll partcpate n the ad-hoc network, even f they are not part of a group. 7. Nodes can crash and recover. 8. Nodes have stable storage on them. 9. Falures can partton the communcaton network nto dsjont components, as descrbed n Secton Dsjont components can merge. 11. We assume the absence of Byzantne falures. 12. We assume the lack of eventually perfect falure detector. Ths s because the dynamcs of a moble ad-hoc network make t unsutable to mplement an eventually perfect falure detector. Ths s further elaborated n secton MATHEMATICAL MODEL We follow the gudelnes presented n the framework developed n [6] and model the system as an untmed I/O automaton. We present the servce specfcatons by defnng ts external sgnature n ths secton and ts trace propertes n secton ESSENTIAL TYPES The essental types used n the specfcaton are lsted below: P The dynamc set of processors that the system can have at a gven nstance. Ths set s never truly fully determned, and thus should not be used n mplementaton detals. The set s used here only for elucdatng varous propertes. M The set of messages sent by the applcaton. VID The set of vew dentfers. 1 A processor s equvalent to a node

11 PAGE 11/31 V The set of vews delvered to the applcaton. The vew s a par contanng of a vew dentfer and the set of members EXTERNAL ACTIONS Our system utlses a reduced set of external actons (Events) as defned by the Chockler paper 2. The reduced set that we use are lsted below send ( pm, ) p P, m M Processor p sends a message m. recv ( pm, ) p P, m M Processor p receves a message m. crash ( p ) p P Processor p s reported to have crashed. crash encapsulates all types of crash and communcaton falures. recover ( pm, ) p P Processor p s reported to have recovered from a crash. If a processor that has not been partcpatng n a group enters the proxmty of a group and wants to start partcpatng a group, the same event occurs. vew_chng ( p, d, members ) p Pd, VID, members 2 P Processor p nstalls a new vew wth dentty d and members as n the set of processors members. The propertes of the PBGC system use a collecton of trace propertes, where a trace s defned as a sequence of external actons the automaton accepts. For our purposes, we fx a trace t 1, t 2,, and all propertes are stated wth respect to the trace. If an event t occurs n the context of a vew, we say the vewof ( t ) s last nstalled at that processor PROXIMITY AND COVERAGE AREA To be able to defne the proxmty and coverage area of a group, we need to defne the propertes of locaton of a processor and proxmty: 1. Locaton of a node the geographcal pont occuped by the centre of gravty of the node. Ths locaton s captured n terms of abstract coordnates. Now we can defne the proxmty of a group as 2. Proxmty the geographcal area, PXM( G ) assocated wth a group G, from whch moble nodes can partcpate n the group s communcaton. Proxmty of a group can take arbtrary shape. A node p s defned to be nproxmty of a group G as follows 2 We do not nclude the safe_prefx event defned n the survey as we choose the approach of delverng only those messages whch have been determned to be stable. Such an approach allows a faster progress when the network s a dynamc one, as n the case for ad-hoc networks. We also do not nclude the Transton Set as part of the vew_chng event as we do not use the noton of Extended Vrtual Synchrony see Secton for further dscusson on Vrtual Synchrony.

12 PAGE 12/31 nproxmty ( pg, ) f locaton( p) PXM( G) The geographcal area covered by the rado-ranges of the members of a partton s defned as the Coverage Area for that partton. If the group has only one partton at a certan nstance, t wll have one coverage area. The coverage area of a partton of a group s bounded by the proxmty of the group. Any geographcal pont wthn the rado range of a node that les outsde the group s proxmty s not consdered a part of the coverage area. Each partton of a group has ts own coverage area, and thus the defnton 3. Coverage Area the geographcal area CA covered by the rado ranges of the processors n a partton and bounded by the proxmty of the group. All the processors p CA are reachable from each other. The followng two events are used to sgnal when two processors have become reachable or unreachable from each other. reachable ( pq, ) f pq, CA nproxmty( pg, ) nproxmty( qg, ) unreachable ( pq, ) f p CA q CAj CA CAj = f nproxmty( pg, ) = false nproxmty( qg, ) = false The above defnton allows us to use the events reachablty and unreachablty n our system specfcatons. We are targetng a system where an explct falure detector does not generate these events. Each processor reaches a consstent concluson based on the messages sent and receved by t STABLE COMPONENTS AND FAILURE DETECTORS In ths secton we frst present stablty condtons and falure detectors used n specfcatons developed by Chockler et al n [6] and Babaouglu et al n [10]. Both are useful, f not essental, to provde guarantees for message delvery wthn a group. We further descrbe how the models n [6, 10] relate to our system model. And fnally, we present the stablty condtons for our specfcaton STABLE COMPONENT In [10], stablty condtons are provded usng abstract propertes for a falure detector. These propertes are adapted for a parttonable system usng the fundamental falure detector propertes developed n [11]. The framework developed n [6] provdes for stablty condtons usng a stable component and the abstract falure detector propertes developed by [10]. A stable component s acheved when there s a stable network. A network s consdered stable from the pont n tme when no processes crash or recover, communcaton becomes symmetrc and transtve and no changes occur n network connectvty. For systems that do not support the noton of a stable component, the Chockler et al framework provdes for alternatve propertes, even though these alternatve propertes are quoted to be not partcularly useful for applcatons. Our system needs to satsfy the requrements of a stable component. That s, f we look at a partcular partton (or a coverage area) where no processes crash or recover, we can say that the partton satsfes the propertes of the coverage area defnton. But

13 PAGE 13/31 f we take a closer look, when processors move from the neghbourhood of one processor p to that of another processor q, the mmedate reachablty changes contradctng the no changes n network connectvty requrement. Smlarly, p and q would have dfferng observatons about processors that have faled and recovered; conflctng the no processors crash and recover requrement FAILURE DETECTORS The moble and mult-hop network envronment ntroduces dependences from communcaton falure on to moblty of the processors and crash falures. Ths secton dscusses how such dependences affect our ablty to provde a falure detector. We lmt our dscusson to abstract falure detectors and ther completeness and accuracy propertes as ntroduced n [11]. The completeness property of a falure detector pertans to detectng a falure and nformng the processors n the system about ths falure. The accuracy property of a falure detector pertans to detectng a correct process that the processors n the system are not yet aware of. In [11] these propertes are defned as 4. Completeness there s a tme after whch every process that crashes s permanently suspected by some correct process. 5. Accuracy there s a tme after whch some correct process s never suspected by any correct process. [11] presents a classfcaton of falure detectors along the axs of varyng degree of completeness and accuracy propertes supported. There are 2 completeness and 4 accuracy propertes descrbed and thus 8 classfcatons of falure detectors provded. An algorthm T D D s presented whch reduces the study of falure detectors to only consder 4 of the 8 classes of falure detectors. Ths s acheved by reducng one of the two completeness propertes to the other, resultng n 1 completeness and 4 accuracy propertes. We note here that unlke the system model n [11], the processors n our system are not fully connected. We also assume the set Π (P n our case) of processors s not known. Ths lmts the applcaton of the algorthm T D D, as proposed n the aforementoned paper, to reduce Weak Completeness to Strong Completeness of falure detectors. The lmtaton s caused by the use of q Π: send m to q. It s mplct n the algorthm that these sends requre a connecton to all the processors n Π, whch we can only emulate usng a broadcast doman [12]. We argue that f we use a broadcast doman to provde strong completeness guarantees, we can drectly buld a group communcaton servce wthout requrng an explct dstrbuted falure detector runnng on each node. Tradtonal group communcaton servces mplement a falure detector usng a pngng servce. In Relacs [5], each processor pngs each other processor t s aware of and determnes falures based on tme outs for responses to the pngs. A drect port of such a servce to moble ad-hoc networks would requre beng able to png the moble processors n the network, requrng routng paths to exst between these nodes.

14 PAGE 14/31 Mantanng routes between processors n a moble ad-hoc network tself requres the routng servce to somehow broadcast route requests and responses, over the mult-hop network. Ensurng all your processors are able to png all other processors n the network would requre all these routes to be mantaned at all tmes, lmtng the benefts of on-demand routng protocols and addng redundancy. We argue that we can replace such a png servce by a perodc beacon broadcasted to mmedate neghbours only. For the system model under examnaton, an alternatve to mplementng a falure detector, s to have all processors perodcally geocast an I am Alve beacon to the proxmty of the groups t s partcpatng n. Ths s dfferent from the algorthms suggested by [11] and [10], as those algorthms requre an explct connecton from each processor n P to every other processor n P ; whch requres an mplct knowledge of all processors n P and routes to all of them, whch cannot be assumed for our system model. The geocastng of I am Alve messages as suggested above can be used to provde completeness and accuracy condtons for detectng faled and new processes as dscussed n secton We propose that such a geocast can help us mplement a membershp servce wthout requrng an explct falure detector module runnng on each of the processors. But t s mportant to remember that our servce does provde the semantcs and guarantees as requred by a falure detector defned n secton 3.4. If no regular communcaton messages are beng exchanged, null messages can be exchanged to keep the protocol from makng progress and adhere to the lveness propertes; ths s motvated by solutons proposed by [9, 13, 4]. Another alternatve to falure detectors for ths system model s to provde a stateful local falure detector module at each node that keeps track of ts neghbours. Ths can be done by smple neghbour dscovery servces that have been proposed n the lterature [25]. Usng a neghbour dscovery servce would help scale the system and would work wthout the need of the knowledge of the set Π of all processors n the system. The problem faced wth such a soluton s that when a processor r moves from p s neghbourhood to q s neghbourhood, p would detect ths as a falure and try to let the other processors n the system know of ths falure. At the same tme q would detect a new processor and would try to make such nformaton avalable to the rest of the processors. FAILURE DETECTORS AND PARTITIONS Another problem n usng the neghbourhood servce to mplement a falure detector occurs n the case of parttons. Let us assume two dsjont subsets L and M of processors connected va a hop through processor p. Let us further look at the stuaton where processors r L and q M are n the neghbourhood of processor p. If p fals, r and q would detect p to have faled and nform the processors n ther correspondng parttons, L and M. The problem s that none of the local falure detector components runnng n L and M would be able to detect the falure of the rest of the processors n the other partton. Such a system s possble to mplement as noted n [8]. After dscussng and provng the mpossblty of a group membershp servce for a prmary component servce, [8] argue that usng falure detectors or probablstc algorthms can help mplement a prmary component membershp servce. They also state that a parttonable group membershp servces bypasses the mpossblty presented n the paper. We wll focus

15 PAGE 15/31 our future work on not usng a falure detector for mplementng the membershp servce, but nstead depend on the fact that our servce s parttonable STABILITY CONDITIONS PBGC wll provde a group communcaton servce where a tradtonal vew of a stable component s not present. The system model also lmts the possblty of mplementng a separate falure detector. We enforce our reachable and unreachable events to satsfy the accuracy and completeness propertes of the falure detectors as developed n [10]. In [10], propertes are provded that allow applcatons meanngful means of relable group communcaton even wthout explct requrement of a stable component. Snce our system cannot confrm wth the requrements of a stable component as descrbed above, we adapt some of the propertes developed n [10] for our purposes. The adaptatons made n [10] for Strong Completeness and Eventual strong Accuracy lead to a very dfferent falure detector from the P falure detector presented n [11]. Babaoglu et. al. [10] use the noton of ther P to argue about the correctness of ther algorthms. We evaluate our falure detector to be W as follows Accuracy when a processor enters a coverage area of a partton, ts mmedate neghbours mmedately detect the presence of a new processor. These mmedate neghbours then facltate sharng the nformaton about ths new correct process wth all other processors. Snce our system s not guaranteed to mantan a certan topology for a long enough perod, we assume nformaton about a new processor may not reach every processor n the coverage area before the consttuents of the coverage area change. Ths was llustrated by the example n Secton where processors p and q make conflctng observatons about processor r. Thus we assume, that some correct process s never suspected by any correct process from [11] mplyng Eventual Weak Accuracy. Completeness agan followng the stuaton nvolvng processors pq, and r we can see that only the mmedate neghbours of a falng processor are guaranteed to detect the falures. How ths falure report s propagated and whether there are conflctng reports about the same processor allow us to only guarantee that every process crash s permanently suspected by some correct process from [11], mplyng Weak Completeness. Wth the known guarantees for reachable and unreachable events, we can provde arguments for correctness of our specfcatons, along the lnes of arguments presented n [11]. It s mportant to observe we use the noton of a W falure detector for the purposes of argung about correctness, and we do not ncorporate an explct falure detector n our system PARTITION ANTICIPATOR A partton antcpator (PA) s a dstrbuted oracle smlar to a dstrbuted falure detector. Ths means that each processor runs an nstance of the PA, and each nstance contans no global knowledge. Each processor receves events from the nstance of the PA runnng on the same processor. Ths secton formalses the type of nput that the

16 PAGE 16/31 membershp servce expects from a partton antcpator and how the servce reacts to ncomng events from the partton antcpator servce. The PA generates a antcpated_chng ( V ) event, whch mples that the processors current vew s antcpated to change to V. Formally ( t ) = antcpated_chng ( V) vewof( t ) = V V V We should menton here that the PA s beng treated as a black box wth ts functon and characterstcs beng orthogonal to those of the membershp servce. Here we assume that whenever the PA generates events, t guaranteesv V. The group communcaton servce s response to the events generated by the PA s lnked tghtly wth the property Optmstc Vrtual Synchrony, descrbed n Secton SPECIFYING A PROXIMITY GROUP MEMBERSHIP SERVICE In the secton we specfy the group membershp servce for moble ad-hoc networks. We do not explctly dfferentate between safety and lveness propertes, but nstead provde specfcatons to capture the hgher level requrements lsted n the secton 3.2. The property names here are smlar wth those devsed by Chockler et. al. n [6]. Before gong nto ndvdual propertes we repeat some shortcut predcates from [6] whch wll be used n presentng the propertes that follow (see Table 1). Table 1: Shortcut predcates used by Chockler delvers( qm, ) t = recv ( qm, ) delvers_n( qmv,, ) t = recv ( qm, ) vewof( t ) = V nstalls( pv, ) t = vew_chng ( pv, ) nstalls_n( pvv,, ) t = vew_chng ( pv, ) vewof( t ) = V recv_before( pmm,, ) j( t = recv( pm, ) t = recv ( pm, ) < j recv_before_n( pmmv,,, ) j( t = recv( pm, ) t = recv( pm, ) vewof( t ) = vewof( t ) = V < j j j j Self Incluson If a process p nstalls vew V, then p s a member of V. Formally t = vew_chng ( pv, ) Local Monotoncty If a process p nstalls vew V after nstallng vew V then the dentfer of V s greater than that of V. Formally t = vew_chng ( pv, ) t = vew_chng ( pv, ) > j j

17 PAGE 17/31 Vd. > V. d Ths property makes sure that a process does not nstall the same vew twce and f two processes nstall the same vews they nstall them n the same (partal) order. Intal Vew Event Every send or receve event occurs wthn some vew. t = send ( pm, ) t = recv ( pm, ) vewof( t ) Membershp Accuracy If there s a tme after whch processes p and q are alve and are wthn the same coverage area, then p eventually nstalls a vew that ncludes q, and every vew that p nstalls afterwards also ncludes q. Formally l > t crash ( p) l k < t = reachable ( pq, ) k m > t unreachable ( pq, ) m j Vst.. t = vew_chng ( pv, ) q Vmembers. j k > j Vt = vew_chng ( pv, ) q V. members k Ths property elmnates solutons to the group membershp where processors p and q are reachable from each other (drectly or ndrectly) and nether of them nstall a vew wth both as members of the vew. On the other hand, ths property does not requre processors that are connected to each other to nstall the same vew, t only requres them to nclude each other n ther vew. Ths requres us to provde a property not consdered n the framework [6]. The relevant property s later presented as Vew Coherency. Termnaton of Delvery 3 If a process p sends a message m n a vew V, then for each member q of V, ether q delvers m, or p nstalls a next vew V n V. Formally lt = send ( pm, ) vewof( t ) = V l q members( V) l 3 Ths property also mples Self Delvery property. Whch states that a correct process delvers messages sent by tself.

18 PAGE 18/31 delvers( qm, ) V nstalls_n( pv,, V) Ths property captures the lveness of the membershp servce by requrng that f a message s not delvered at some member of a vew (mplyng that the other member s no longer reachable), then the sender of the message nstalls a new vew wth the faled process elmnated from the vew. Thus our servce s forced to make progress one way or the other and hence elmnates use of algorthms that do not make progress. Vew Coherency 4 The property can be presented as follows 1. If a correct process p nstalls a vew V, then ether all members of V nstall V or p eventually nstalls an mmedate successor to V. Formally t = nstalls( pv, ) q Vmembersnstalls. ( qv, ) t 1 = nstalls( pv, ) + 2. If two processors p and q ntally nstall the same vew V and p later nstalls an mmedate successor to V, then eventually ether q also nstalls an mmedate successor to V, or q crashes. Formally t = nstalls( pv, ) j < t = nstalls( pv, ) j k < t = nstalls( qv, ) k l > t = nstalls( qv, ) tl = crash ( q) l It can be argued that the stuaton handled by ths property s already handled by Membershp Accuracy, but Membershp Accuracy leaves the nstallaton of the new vew totally dependent on a falure detector 5. On the other hand, ths property forces all members of any new vew to nstall the same vew. In the face of frequent topology changes and dsconnectons, provdng such a property would lead to a hghly unstable membershp servce, but supportng ths property wll help n reflectng a true vew of the system. If there s a need to hde the frequent changes, a hgher layer can hde ths nstablty for the applcaton. A thrd and equally mportant aspect of vew nstallaton s presented as the property Agreement on Successors. That property enforces all processors gong through the same successon of vews to nstall all of those vews. 4 Frst presented by [10]. We do not nclude all three tems presented there. 5 Whch we do not nclude n our system model as elaborated earler

19 PAGE 19/31 To handle the dynamc nature of the processors that can be a part of our system, we propose a property Group Awareness as: Group Awareness If a processor that s not a member of a group s present n any of the coverage area 6 of a group, t can eventually obtan nformaton about the group. 3.5 SPECIFYING A PROXIMITY GROUP DELIVERY SERVICE In ths secton we provde a specfcaton for a delvery servce that accompanes the membershp servce n PBGC. The nteracton between membershp and delvery servce s two-way. The delvery servce provdes the communcaton prmtves for mantanng consstent membershp vews across every partcpant, whle the membershp servce provdes the lst of partcpants to whom messages are propagated. Delvery Integrty For every recv event, there s a correspondng send event. Formally t = recv( pm, ) q j( j < t = send ( qm, )) j No Duplcaton Two dfferent recv events wth the same content cannot occur at the same process. t = recv( pm, ) t = recv ( pm, ) = j j The above two propertes together elmnate spurous recv events. Lmtng recv events to only those that have been orgnated by some processor and have not already been delvered. Self Delvery Process p delvers every message t sent n any vew, unless t crashes after sendng t. Formally t = send( pm, ) j > t = crash ( p) receves( pm, ) j VIRTUAL SYNCHRONY In a vew-orented group communcaton servce, send and recv events occur n the context of some vew. Some applcatons may requre that a message be delvered n the same vew as the vew n whch t was sent. Other applcatons may requre a message be delvered n the same vew for all the members. In ths secton we present our approach to provdng guarantees that address such delvery ssues. Our approach utlses the partton antcpator to help an applcaton make meanngful progress wthout runnng nto some of the problems posed by other tradtonal servces, as we descrbe below. Some group communcaton servce specfcatons requre that all members delver a message n the same vew as the one n whch t was sent. Such a requrement s called Sendng Vew Delvery. A problem wth such a requrement s that applcatons need to block whle sendng messages whle a new vew s beng nstalled. In [14] t s proved that wthout requrng the applcatons to block the group communcaton servce would volate propertes of Vrtual Synchrony and Self Delvery. 6 That s to say ths node s reachable from any of the present group members

20 PAGE 20/31 A weaker alternatve to Sendng Vew Delvery s suggested as Same Vew Delvery. In Same Vew Delvery all members delver a message n the same vew, whch may or may not be the vew the message was sent n. The property suffces for applcatons that do not care whch vew the message was sent n, but are satsfed by the knowledge that all members receve the message n the same vew. Usng Same Vew Delvery, applcatons do not need to block whle the vew changes; the servce guarantees messages sent durng a change of vew are delvered n ether of the two vews (the orgnal or the changed vew). All group communcaton servces satsfy Same Vew Delvery for messages sent/receved n the context of some vew. Thus, ths property s weaker than Sendng Vew Delvery. As an alternatve to the above two propertes, [14] suggests Weak Vrtual Synchrony, as a model stronger than Same Vew Delvery yet weaker than Sendng Vew Delvery. It s weak enough for applcatons to not block whle a vew s changng, yet strong enough to provde some noton of support for vew-aware applcatons. Weak Vrtual Synchrony (WVS) requres each vew change to be preceded by a suggested vew, a vew the system beleves has the hghest probablty of beng the next vew. A further requrement placed on every message sent n the suggested vew (whch s a superset of the current vew) s that they should be delvered n the next vew nstalled by the members. Thus vew-aware applcatons know each message they receve was ether sent n the current vew, or the precedng suggested vew. Even though the WVS model does not requre applcatons to block sendng messages, t does not allow new processors to jon the next regular group once a suggested vew has been nstalled. If a new processor wanted to jon the group after a suggested vew has been nstalled, the servce would ntate a new vew nstall rght after the next regular vew has been nstalled. Ths causes the system to never stablse n the face of frequent changes, as predcted n our system model. Another lmtaton of the model s that t mplctly works for applcatons that are satsfed to know of a superset of the exstng vew. Yet another model was recently proposed by [15] n The model, called Optmstc Vrtual Synchrony requres each vew nstallaton to be preceded by an optmstc vew event, whch provdes the applcaton wth a guess about what the next vew would be. After ths event, applcatons can optmstcally send messages assumng they wll be delvered n a vew dentcal to the optmstc vew. If the next vew that s nstalled s not dentcal to the optmstc vew, the applcaton could ether choose to use the messages receved or roll back the optmstc message. Optmstc Vrtual Synchrony we propose usng an enhanced verson of the Optmstc Vrtual Synchrony model n our system. The enhanced model takes an educated guess on the next vew, based on nput from the Partton Antcpator. Ths model retans the benefts of provdng a non-blockng vewbased group communcaton servce, but uses a mechansm to provde a meanngful predcton for the next vew. When the partton antcpator generates an antcpated_chng ( V ) event, our servce delvers an optmstc vew ( V ) event to the applcaton. The applcaton may choose to

21 PAGE 21/31 use ths nformaton and send messages n an optmstc vew. If the applcaton chooses to do so, t may or may not choose to roll-back f the next vew nstallaton s dfferent from the optmstc vew. Such support for delverng messages n the context of a vew allows applcatons to have the flexblty on how to deal wth changng vews. We beleve usng such a model should also allow smooth handlng of the frequent topology changes n a moble ad-hoc network. The above propertes do not yet allow applcatons to reason about when groups become parttoned. To elaborate, we repeat a classc example from [6, 10]. Consder the case where three nodes p, q and r, are n a common vew called v 1, and two events occur. In the frst event r crashes whle subsequently p and q become temporarly dsconnected. Let us consder the scenaro where p reacts to both the events and nstalls a vew v 2 wth only tself as a member. Process q on the other hand reacts only to r s falure and nstalls a vew v 3 wth p and q as members. Now assume p and q share the same state at v 1 but p undergoes changes whle dsconnected from q. Followng ths q and p reconnect and then nstall a vew v 3 whch has both p and q as members. In such a stuaton, due to p s state changes whle t was dsconnected from q, ths would result n nconsstent behavour on the part of q (gven only the above propertes are beng satsfed). Such stuatons requre an addtonal property to handle merges of parttons, and thus ensure reasonable behavour from our system. Ths scenaro can be generalsed to any trace where overlappng parttons vews merge. The followng propertes elmnate traces that allow such nconsstences. Agreement on Successors 7 If a process p nstalls vew V n vew V, and f some process q also nstalls V and q s a member of V then q also nstalls V n V. nstalls_n( pvv,, ) nstalls( qv, ) q V. members nstalls_n( qvv,, ) Agreement on Successors guarantees that all processors from p s current vew and p s prevous vew are comng from the same vew and thus the Vrtual Synchrony hypothess holds. The property also nvaldates traces where two overlappng vews are allowed to merge, as brought out above. 7 Extended Vrtual Synchrony and Transtonal Sets provde an alternatve property that can help determne f the proposton of Vrtual Synchrony holds or a state transfer s requred.

22 PAGE 22/ ORDERING PROPERTIES The next mportant ssue to consder for completng the specfcatons for the group communcaton servce s message orderng. In the frst case we support the Weak Total Order property for messages exchanged wthn a sngle group. Before we defne Weak Total Order, we repeat the noton of a Tmestamp (TS) functon as defned n [6]. A tmestamp (TS) functon s a one-to-one functon from M to the set of natural numbers: TS_functon( f) f : M N f( m) = f( m ) m= m Weak Total Order Can be stated n two parts 1. For every par of vews V and V there s a tmestamp functon f so that every process that nstalls V n V receves messages n V n an order consstent wth f. V V f( TS_functon( f) p m m ( nstalls_n( pvv,, ) recv_before_n( pmmv,,, ) f( m) < f( m )). 2. For every vew V there s a tmestamp functon f so that every process that has V as ts last vew receves messages n V n an order consstent wth f. Formally V f ( TS_functon( f) p m m ( last_vew( pv, ) recv_before_n( pmmv,,, ) f( m) < f( m ))) By supportng the Weak Total Order property we mply that all messages wll be Causally Ordered and the Relable Causal property wll apply. Relable Causal If message m causally precedes a message m, and both are sent n the same vew, then any process q that receves m receves m before m. Formally t = send( pm, ) t = send ( p, m ) t t vewof( t )) = vewof( t ) j j recv ( qm, ) recv_before( qmm,, ) j Weak Total Order allows processors to dsagree on the order of messages n case they dsconnect from each other. But at the same Weak Total Order requres processors that reman connected wth each other to receve messages n the same order. When a number of processes belong to two or more of the same groups, we say that the groups overlap. In ths case, there s a ssue relatng to the orderng of messages to be delvered at all processes that are members of more than one overlappng groups. Atomc Multcast specfes that all members of multple groups delver messages to all the groups n the same order. Implementng Atomc Multcast s expensve and s not drectly crucal for the stuatons group communcatons for moble ad-hoc networks wll be used n. Thus we do not requre our servce to support Atomc Multcast; but at the same tme dependng on the mplementaton algorthms we mght be able to support the same.

23 PAGE 23/31 4 IMPLEMENTING HEARSAY WITH LATTE One of the core conceptual tools defned n Gloss s Hearsay [24]. Hearsay s a form of communcaton where a message s dscovered n the envronment. A hearsay tool matches the profle and context of the recever wth the profle and context of the message to be delvered. Ths secton descrbes the desgn and mplementaton of a hearsay system that uses emal as the base nfrastructure. The system, called LATTE (Locaton And Tme Trggered Emal), adds locaton and tme to the standard emal model as the hearsay contextual elements for sendng and recevng emal. LATTE s archtecture provdes a natural ft for demonstratng the work on proxmty-based group communcaton. LATTE s based on the dea that for the current emal user, especally the moble one, a sgnfcant proporton of emal receved s not relevant for a varety of reasons. Conversely, moble users often do not receve messages that may be of nterest to them because these messages relate to the locaton the users are currently vstng. Addng a level of context awareness to messagng servces s lkely to amelorate these problems, and sgnfcantly enhance the relevancy of a user s emal. Requrements for such a servce nclude offerng relevant nformaton to recpents under specfc spatotemporal constrants. It should be possble to augment messages wth a varety of contexts (for example, any combnaton of locaton, tme and dentty) and delver them when ther contextual condtons are satsfed. LATTE s therefore based on the emal paradgm, and extends t to nclude dynamc consderaton of locaton and tme to determne the approprate recpents for a message BASED HEARSAY SERVICE As an ntal step, we generalsed the hearsay usage scenaros from the Gloss s Bob goes to Pars. These can generally be categorsed as: 1. Alerts: In ths category, messages are attached to a locaton to ndcate some warnng. For example, well-wshng ndvduals or companes who undertake traffc montorng as a commercal servce may provde a traffc alert. Another example s a perodc form of alert message that s delvered to users n partcular locatons for example, ths museum closes n ffteen mnutes s a message that should be delvered to people n the museum at the approprate tme every day the museum s open. 2. Dgtal sgnposts: Ths category provdes smlar functonalty as the dgtal grafft model [17; 18; 19] where a message s sent to a specfc locaton wth any user n the proxmty recevng t. There s lkely to be no nformaton of any secrecy n ths knd of message. 3. Intended Delvery: In ths category, recpents are dentfed by some combnaton of dentty, locaton and some tmng constrants. In general, context aware messagng can help reduce the amount of rrelevant nformaton delvered to emal users by usng dfferent knds of context as a flter. In addton, t can help ensure that emal users receve nformaton relevant to them because of a change to ther context. From scenaros wthn the categores lsted above, we dentfed three context attrbutes that should be used as such a flter: locaton, tme

24 PAGE 24/31 and dentty. The goal of the context-aware emal system s to delver contextually vald messages to the rght enttes at the approprate tme. Where any combnaton of the three context attrbutes have been specfed, valdty s a functon of testng the actual context of recpents aganst the one defned by the sender of the message. It s not necessary to specfy values for all of the context attrbutes as long as there s a recpent specfed (ether a named emal user/group or a locaton), the other contextual attrbutes take sensble default values that try to emulate the famlar emal behavour as much as possble. We dscuss each of the context attrbutes n the followng sectons LOCATION Locaton s defned as the spatal regon a recpent must occupy n order to receve a message. Locaton s modelled as a seres of dscrete herarchcal regons wth defned boundares. Each regon may be subdvded nto smaller ones, whch are arranged n a herarchcal manner. Ths approach was adopted from the Intentonal Namng System (INS) [26] for ts expressveness and smplcty. Each level of the herarchcal tree has a logcal name. In essence, the whole tree represents a mappng between logcal names and geographcal coordnates. There are many approaches to determnng geographcal coordnates, both ndoor and outdoor for example GPS or RADAR [20]. Our contextaware emal servce s desgned n an open manner to support nput relatng to coordnates from any source. In the current verson, we have mplemented GPS and an ndoor verson usng nfrared transcevers s also beng desgned. Another mportant feature n LATTE s the ablty to support overlappng regons by allowng chld nodes n the locaton herarchy to have multple parents. Essentally, locaton n ths model s represented more as graph rather than a tree as n Fgure 5. Ths feature allows multple admnstratve domans to share physcal locatons and makes possble a more decentralsed delvery model where LATTE servers are responsble for dfferent (possble overlappng) geographcal areas. Sendng a LATTE message then, requres the knowledge of the ndvdual server that s responsble for the wder geographcal area the message s destned for. Drectory servces can be bult to ad ndvdual users composng LATTE messages but ths s outsde the scope of the current work. The fnal LATTE component that enables ths type of dstrbuton s a basc servce dscovery protocol that was bult to enable automatc regstraton when LATTE clents are found n the vcnty of LATTE servers. From the perspectve of the emal sender, locaton may be ether explctly specfed, or left anonymous. Where the locaton s specfed, emals (wthout any further flterng based on dentty/tme) are vald to all users n that locaton. Messages can therefore be left at a locaton wthout requrng the sender to physcally be there to tag t wth a message. Where the locaton s anonymous, locaton s not consdered n the flterng process for the emal message. As derved from the Intentonal Namng System model, a locaton s named n an abstract, herarchcal plantext format wth the followng syntax: [locaton=value [dvson=value [subdvson=value]]..] Ths gves a partal tree resemblng Fgure 5. For example, the front square n Trnty College mght be descrbed by [Country=e [Cty=Dubln [Area=TrntyCollege [Place=FrontSquare]]]]