Damage Quarantine and Recovery in Data Processing Systems - Database Security: Applications and Trends - page 384

Fourth, classic redo operations cannot repair damage because they do not
reexecute affected transactions.
3.2 Replication-based Recovery
The crux of the replication based recovery is using redundancy to mask/tolerate
failures. Replication-based recovery does not undo erroneous operations. In
data-oriented applications, the replication idea is embodied through the
widely adopted practice of data replication [60, 3] and standby databases [53].
In such replicated systems, each request (or transaction) will be processed by
all the replicas in which each data object is replicated. When a failure happens
to the primary database, the responses (or outputs) generated by a standby
(or replicated) database can be returned to the client as if the failure had
never happened. (In distributed computing, the replication idea is embod-
ied through such techniques as RAPS (reliable array-structured partitioned
service), the state-machine approach [61], and virtual synchrony [62].)
Limitations in Solving the DQR Problem: Both data replication
and standy databases will not only replicate good work, but also replicate
infection!
3.3 Storage Media Backup-Restore
The idea of storage media backup-restore is proven very practical and valuable.
It is fully embraced by the IT industry: Computer Associates large enterprise
backup solutions [63], Symantec LiveState recovery products [64], the Sonasoft
Solution [65], just to name a few. This idea is complementary to the recovery
idea and the replication idea, but in many cases it cannot achieve fine-grained
data consistency, while the two other ideas can.
Limitations in Solving the DQR Problem: Among the data
objects included in a backup , storage media backup-restore techniques cannot
distinguish clean data objects from dirty, corrupted ones.
4 Solving the DQR Problem
In this section, we present a systematic review on how the DQR problem is be-
ing solved in the literature. Although self repairable file systems are proposed
[66, 67], most DQR mechanisms proposed in the literature are transaction-
level solutions. So here we concentrate on transaction-level DQR solutions.
4.1 The Model
In our model, a transaction is a set of read and write operations that either
commits or aborts . For clarity, we assume there are no blind writes, although