Tolerating Disasters with Hierarchical Consensus

TL;DR

Orion addresses scalable geo-distributed Byzantine fault-tolerant consensus by composing three building blocks: HotStuff for intra-cluster consensus, a consistent broadcast for inter-cluster dissemination, and a Damysus-like global consensus for finalizing superblocks. A novel cluster-confirmation mechanism and a global rotation scheme ensure safety and liveness even when the entire global group is Byzantine or when multiple clusters fail, enabling durability across locations. The paper proves a compositional safety and liveness theorem and demonstrates through experiments that Orion delivers roughly $20 ext{%}$ higher throughput than GeoBFT, with a modest latency increase, and maintains strong performance as local cluster size grows. These results show that modular, hierarchy-aware protocol construction can substantially improve throughput for geo-replicated blockchains while preserving disaster resiliency and correctness.

Abstract

Geo-replication provides disaster recovery after catastrophic accidental failures or attacks, such as fires, blackouts or denial-of-service attacks to a data center or region. Naturally distributed data structures, such as Blockchains, when well designed, are immune against such disruptions, but they also benefit from leveraging locality. In this work, we consolidate the performance of geo-replicated consensus by leveraging novel insights about hierarchical consensus and a construction methodology that allows creating novel protocols from existing building blocks. In particular we show that cluster confirmation, paired with subgroup rotation, allows protocols to safely operate through situations where all members of the global consensus group are Byzantine. We demonstrate our compositional construction by combining the recent HotStuff and Damysus protocols into a hierarchical geo-replicated blockchain with global durability guarantees. We present a compositionality proof and demonstrate the correctness of our protocol, including its ability to tolerate cluster crashes. Our protocol -ORION 1 -achieves a 20% higher throughput than GeoBFT, the latest hierarchical Byzantine Fault-Tolerant (BFT) protocol.

Figures (8)

• Figure 1: Structure of our blockchain.
• Figure 2: Overview of Orion and the interplay of its subcomponents
• Figure 3: Communication phases in HotStuff
• Figure 4: Phases of the Damysus-based global consensus protocol
• Figure 5: Throughput depending on the number $N$ of clusters (each cluster contains 10 replicas, and tolerates $f=3$ Byzantine replicas).

Theorems & Definitions (10)

• Definition 1: Local safety/liveness
• Definition 2: $t$-live
• Definition 3: ($t$-)rotation safe
• Definition 4: Cluster-confirmed state transition
• Lemma 1: Cluster confirmation retains correct states
• proof
• Theorem 1: Compositional liveness
• proof
• Theorem 2: Compositional safety
• proof