1. A Critical Analysis of the Transaction Internet Protocol Tim Kempster (tdk@dcs.ed.ac.uk) University of Edinburgh Scotland www.dcs.ed.ac.uk

2. Overview of the Talk What is TIP and what kind of services does it provide. How do Internet applications enlist in Internet transactions. How can we model these transactions. Discussion of problems/features of TIP within this model.

3. What Is TIP? TIP is an IETF standard proposed by Microsoft and Tandem and supported by other vendors. It provides transactional semantics to a group of actions carried out by E-Commerce style Internet applications. TIP provides Atomicity.

4. Changing Style of E-Commerce Traditional E-Commerce Involve a Customer and a single Merchant. Shopping by visiting one Merchant at a time. Multi-Party E-Commerce Involve a customer and two or more Merchants. Merchants come together on an ad hoc basis to provide a package of goods. These may be transient relationships.

5. E-Commerce Example I Browser Travel Agency Hotel Reservation System Airline Reservation System I Only need a flight if I can get a Hotel Room

6. E-Commerce Example II Packaged financial product available from a WWW broker Government Bonds Broker DOW Futures Broker Equities Broker Futures Trader

7. The Participants In a Transaction Application TM Application TM Application TM Application TM Two pipe connection based model.

8. Growing a Transaction R D BC E F H G I PULL PUSH

9. Push Enlistment TM X Application A Application B TM Y tip_open()tip_push() PUSH TID PUSHED TID do_some_work(TID) done

10. Pull Enlistment TM X Application A Application B TM Y PULLED PULL(TID) do_some_work(TID) done tip_open() TID tip_pull(TID)

11. e Terminating Transaction I R e e = Enlisted p = prepared A ee C B D e ee e PREPARE PREPARED p p PREPARE PREPARED pp p pp p

12. p Terminating Transactions II R p p = prepared c= committed A pp C B D p pp p COMMIT COMMITED c c COMMIT COMMITED cc c cc c A

13. p Terminating Transactions III R a p = prepared a= aborted A pp C B D p pp a ABORT ABORTED aa a aa a A

14. e Failure Before Preparation e R e B e B pp CD e a a ee pp a a aa aa

15. Failure After Preparation p R p B p B pp CD e pp QUERY RECONNECT RECONNECTED

16. Failure Tends to Cause Aborts If connections are lost between enlisted TMs this will cause the transaction to abort. TMs connections will often be in the enlisted state. Therefore the unreliability of the Internet will cause many transactions to abort. An enhancement to TIP should allow enlisted TMs to reconnect.

17. Blocking In TIP p R e p p p pp e Prepared transactions cannot terminate and must hold resources.

18. Why is Blocking Such a Problem? Resources (database locks) will need to be held until failure in some part of the Internet is repaired. A application has little control of who or where a transaction is pushed. Its resources therefore are vulnerable. Connection failure is common over the Internet. Commit protocols which are less blocking exist.

19. Jamming a Transaction Pension Fund Gold Futures Government Bonds PREPARE PREPARED PREPARE Government bonds dealer waits for news. If it is favorable she replies PREPARED otherwise she aborts the transaction. Thus gaining a competitive advantage. She could also fake failure to cause the abort.

20. Security in TIP If A with local TM X enlists B with local TM Y, then no other transaction can be mistakenly enlisted. Furthermore A’s identity is authenticated to B and vice versa. No outside parties can detect that the messages exchanged pertain to a TIP transaction. TIP Specification says use TLS but how ?

21. Secure Pull TM X Application A Application B TM Y PULLED PULL(TID) do_some_work(TID) done tip_pull(TID) TID Pull must come from Y Associate TID with TM Y’s public key Secure authenticated pipe TM X Only Replies PULLED if PULL came from TM Y.

22. TM X A tip_pull(TID) TID Pull must come from Y Associate TID with TM Y’s public key Why Must the Application Pipe be Secure? B Bogus TM TM X Man in the Middle MIM replaces TID with a bogus TID to hijack the transaction ABORT

23. Conclusions TIP provides transaction atomicity across Internet applications. Transactions are grown dynamically and terminated using a hierarchical 2PC. TIP behaves badly if connections fail. Security issues arise during transaction enlistment. There are issues when applications are not cooperative.