About Hostile and Selfish Players Game Theory in Distributed - - PowerPoint PPT Presentation

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

About Hostile and Selfish Players

Game Theory in Distributed Computing Esfandiar Mohammadi

Seminar on Advanced Topics in Distributed Computing Research Group on Distributed Computing and Operating Systems Max-Planck Institute for Software Systems Saarland University Advisor: Ph.D. Petr Kuznetsov

24th January 2008

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Multiadministrative Domains

What about Predictable Selfish Domains?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Outline

• The Secret Sharing Game
• Basic Game Theoretic Notions
• Rational Secret Sharing
• Multiparty Computation
• The Terminating Reliable Broadcast Game
• Cooperative Services
• Proofs of Misbehavior

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

k out of n Secret Sharing

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Basic Game Theoretic Notions

• Protocols viewed as games
• Local state L: message history and state
• Actions A in Secret Sharing: “Send” and “Don’t-Send”
• Strategy of player i σi : Li → Ai, S := S1 × · · · × Sn
• Utility ui : S → R

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Basic Game Theoretic Notions (cont’d)

Noone sends 1 and 2 send 2 sends 1 sends

…

) ,u (u

• ut
• ut

4 5 ) 1 , 1 (

2 1 2 1

= = = =

) u (u

• ut
• ut

7 , ) 1 , (

2 1 2 1

= = = = ) u (u

• ut
• ut

, 5 ) , 1 (

2 1 2 1

= = = =

) ,s (s 1 1

2 1

= = ) ,s (s 2 2

2 1

= = ) ,s (s 3 3

2 1

= = ) ,s (s 4 4

2 1

= = ) ,s (s 5 5

2 1

= = ) ,s (s 9 9

2 1

= = ) ,s (s 8 8

2 1

= = ) ,s (s 7 7

2 1

= = ) ,s (s 6 6

2 1

= = sd) sd, (a = =

2 1

α kp) kp, (a = =

2 1

α kp) sd, (a = =

2 1

α sd) kp, (a = =

2 1

α

Game tree of a secret sharing game with two players si : local state, ui = ui(σ) : utility, ai : actions

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Game Theoretic Solution Concepts

• Nash Equilibrium σ = (σ1, . . . , σn) ∈ S:

∀i ∈ {1, . . . , n} ∀τi ∈ Si : ui(σi, σ−i) ≥ ui(τi, σ−i)

• σi ∈ Si weakly dominates τ ∈ Si w.r.t. S−i:

∀ρ−i ∈ S−i : ui(σi, ρ−i) ≥ ui(τi, ρ−i) and ∃ρ′

−i ∈ S−i : ui(σi, ρ′ −i) > ui(τi, ρ′ −i)

• Iterated Deletion of weakly dominated strategies: S0

i := Si,

Sj+1

i

:= {τi ∈ Sj

i | no strategy weakly dominates τi w.r.t. Sj −i}

S∞ :=

j∈N Sj 1 × · · · × Sj n

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Game Theoretic Solution Concepts

• Nash Equilibrium σ = (σ1, . . . , σn) ∈ S:

∀i ∈ {1, . . . , n} ∀τi ∈ Si : ui(σi, σ−i) ≥ ui(τi, σ−i)

• σi ∈ Si weakly dominates τ ∈ Si w.r.t. S−i:

∀ρ−i ∈ S−i : ui(σi, ρ−i) ≥ ui(τi, ρ−i) and ∃ρ′

−i ∈ S−i : ui(σi, ρ′ −i) > ui(τi, ρ′ −i)

• Iterated Deletion of weakly dominated strategies: S0

i := Si,

Sj+1

i

:= {τi ∈ Sj

i | no strategy weakly dominates τi w.r.t. Sj −i}

S∞ :=

j∈N Sj 1 × · · · × Sj n

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Game Theoretic Solution Concepts

• Nash Equilibrium σ = (σ1, . . . , σn) ∈ S:

∀i ∈ {1, . . . , n} ∀τi ∈ Si : ui(σi, σ−i) ≥ ui(τi, σ−i)

• σi ∈ Si weakly dominates τ ∈ Si w.r.t. S−i:

∀ρ−i ∈ S−i : ui(σi, ρ−i) ≥ ui(τi, ρ−i) and ∃ρ′

−i ∈ S−i : ui(σi, ρ′ −i) > ui(τi, ρ′ −i)

• Iterated Deletion of weakly dominated strategies: S0

i := Si,

Sj+1

i

:= {τi ∈ Sj

i | no strategy weakly dominates τi w.r.t. Sj −i}

S∞ :=

j∈N Sj 1 × · · · × Sj n

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Game Theoretic Solution Concepts (cont’d)

• Practical Mechanism σ ∈ S∞ and σ is a Nash Equilibrium
• k-resilient Practical Mechanism σ ∈ S∞ and σ is a

k-resilient Nash Equilibrium

• Coalition of k selfish, but rational players

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Deterministic Practical Mechanisms Are Impossible

• Assumptions

(U1) Rational player want to learn the secret (U2) Utility only depends on learning the secret

⇒ There is no Practical Mechanism for secret sharing, if the runtime is known to the players.

• Not sending the own share weakly dominates the sending

the secret.

• But what about randomized protocols?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Deterministic Practical Mechanisms Are Impossible

• Assumptions

(U1) Rational player want to learn the secret (U2) Utility only depends on learning the secret

⇒ There is no Practical Mechanism for secret sharing, if the runtime is known to the players.

• Not sending the own share weakly dominates the sending

the secret.

• But what about randomized protocols?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Rational Secret Sharing

A Randomized Protocol

• Assume secure private channels between each participant
• Mediator controls sent shares and punishes misbehavior
• Expected Runtime 1/α (α depends the players utility)

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Rational Secret Sharing

A Randomized Protocol

• Initially: The issuer send signed shares to the players
• At each round t (ct ← {0, 1}, Pr[ct = 1] = α):
• Phase 1: Player i sends acki (and share in round 0) to the

mediator

• Phase 2: Mediator sends shares of ht = gt + ct · f

(gt(0) = 0) to the players, ckecks the initial shares, if one acki misses aborts

• Phase 3: Players send share of ht to every other player,

check if ht(0) = 0

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Why Should a Rational Player Follow the Protocol?

• What if a player sends the wrong initial share?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Rational Secret Sharing

A Randomized Protocol

• Initially: The issuer send signed shares to the players
• At each round t (ct ← {0, 1}, Pr[ct = 1] = α):
• Phase 1: Player i sends acki (and share in round 0) to the

mediator

• Phase 2: Mediator sends shares of ht = gt + ct · f

(gt(0) = 0) to the players, ckecks the initial shares, if one acki misses aborts

• Phase 3: Players send share of ht to every other player,

check if ht(0) = 0

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Why Should a Rational Player Follow the Protocol?

• What if a player sends the wrong initial share?
• What if a player sends a wrong share of ht in phase 3?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Rational Secret Sharing

A Randomized Protocol

• Initially: The issuer send signed shares to the players
• At each round t (ct ← {0, 1}, Pr[ct = 1] = α):
• Phase 1: Player i sends acki (and share in round 0) to the

mediator

• Phase 2: Mediator sends shares of ht = gt + ct · f

(gt(0) = 0) to the players, ckecks the initial shares, if one acki misses aborts

• Phase 3: Players send share of ht to every other player,

check if ht(0) = 0

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Why Should a Rational Player Follow the Protocol?

• What if a player sends the wrong initial share?
• What if a player sends a wrong share of ht in phase 3?
• What if a player doesn’t send his share of ht in phase 3?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Rational Secret Sharing

A Randomized Protocol

• Initially: The issuer send signed shares to the players
• At each round t (ct ← {0, 1}, Pr[ct = 1] = α):
• Phase 1: Player i sends acki (and share in round 0) to the

mediator

• Phase 2: Mediator sends shares of ht = gt + ct · f

(gt(0) = 0) to the players, ckecks the initial shares, if one acki misses aborts

• Phase 3: Players send share of ht to every other player,

check if ht(0) = 0

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Why Should a Rational Player Follow the Protocol?

• What if a player sends the wrong initial share?
• What if a player sends a wrong share of ht in phase 3?
• What if a player doesn’t send his share of ht in phase 3?
• Can a player gain profit from just guessing ct?
• No, α is appropriately small

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Without Initial Signatures

• Issuer sends (bj, cj) to mediator
• cj = fj · bj
• Mediator checks if cj = fj · bj

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Getting Rid of the Mediator

Computing the Mediator Cooperatively

• Instead of α two parameter a, b such that a/2b ∼ α
• Player i gets bi

$

← {0, 1}⌈log(|F|)⌉ in addition to initial share fi

• Each player i draws at each round t:

ct

i $

← {0, 1}b, gt

i $

← F[X] s.t. gt

i (0) = 0

• Compute: gt := gt

1 + · · · + gt n and ct := ( i ct i ≤ a)

• Output: (ht(1) ⊕ b1, . . . , ht(n) ⊕ bn)
• Rational player won’t deviate: “passive adversaries”

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Getting Rid of the Mediator

Computing the Mediator Cooperatively

• Instead of α two parameter a, b such that a/2b ∼ α
• Player i gets bi

$

← {0, 1}⌈log(|F|)⌉ in addition to initial share fi

• Each player i draws at each round t:

ct

i $

← {0, 1}b, gt

i $

← F[X] s.t. gt

i (0) = 0

• Compute: gt := gt

1 + · · · + gt n and ct := ( i ct i ≤ a)

• Output: (ht(1) ⊕ b1, . . . , ht(n) ⊕ bn)
• Rational player won’t deviate: “passive adversaries”

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Result

• Let α = A(u1, . . . , un) be sufficiently small, and k < m
• There is a k-resilient practical mechanism (l, m) secret

sharing without a mediator that has expected running time 1/α,

(i) if k < m ≤ n/2 and the utilities (u1, . . . , un) are known. (ii) if k < m ≤ n, the utilities (u1, . . . , un) are known and assuming cryptography.

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Multiparty Computation

An Application of Rational Secret Sharing

• Multiparty computation of the circuit of a function as in

Goldreich et al.(’87)

• In the last step secret sharing is replaced by rational secret

sharing

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Drawbacks

• Secure private channels are hard to implement
• Doesn’t take message sending costs into account
• Deny of Service attacks not considered

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Communication Games

Costly Games

• A variety of protocols fulfill the following properties.
• In every strategy σ ∈ S at least one player neither sends

nor receives a message.

• Sending messages incurs non-zero costs.
• In every stategy σ ∈ S at least one message is sent.
• Utility u′

i(σ) = benefiti(σ) + costi(σ)

• For example: Terminating Reliable Broadcast

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Communication Games

Costly Games

• A variety of protocols fulfill the following properties.
• In every strategy σ ∈ S at least one player neither sends

nor receives a message.

• Sending messages incurs non-zero costs.
• In every stategy σ ∈ S at least one message is sent.
• Utility u′

i(σ) = benefiti(σ) + costi(σ)

• For example: Terminating Reliable Broadcast

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Terminating Reliable Broadcast

T1 If the leader is non-malicious, every non-malicious players delivers the correct value. T2 Each non-malicious player delivers at most one value and if it delivers v, the leader broadcast v. T3 If a non-malicious player delivers v, all non-malicious player deliver v. T4 Each non-malicious player eventually delivers a value.

• Leader’s benefit: T1-4 benefitl(σ) = β + ω
• All players’ benefit: T2-4 benefitl(σ) = ω
• Risk averse ui := minx∈[0,..,t] ◦ minT :|T |=x ◦ minτT ∈ST u′

i (σN −T , τT )

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB

• Infinite horizon game: unbounded instances
• Leader rotated each instance
• Number of malicious players is bounded by f
• f + 1 rounds each instance k
• Messages signed by the sender
• Relations between players: friends, ex-friends, enemies

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB (cont’d)

• Each player receives at most two different values
• Each player sends exactly two messages
• Penance messages as a self-punishment while leader is

hostile

• Three kinds of messages:
• value (costs: γ), dummy (costs: γ), penance (costs: κ)

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB (cont’d)

• Round i = 1 for p = leader k:
• If the leader is not an enemy accept
• If the leader does not send, he becomes an enemy
• Round i ∈ {2, . . . , f}:
• Send messages accepted in round i − 1 to all friends
• Receive messages initially sent by the leader
• Round i = f + 1 :
• Send as above and dummy and penance messages if necessary
• Receive as above and receive penance messages
• If a message sequences was unexpected quit friendship
• Deliver v if only one value was received, else SF

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

A Tighter Look

• Why to forward the right message?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB (cont’d)

• Round i = 1 for p = leader k:
• If the leader is not an enemy accept
• If the leader does not send, he becomes an enemy
• Round i ∈ {2, . . . , f}:
• Send messages accepted in round i − 1 to all friends
• Receive messages initially sent by the leader
• Round i = f + 1 :
• Send as above and dummy and penance messages if necessary
• Receive as above and receive penance messages
• If a message sequences was unexpected quit friendship
• Deliver v if only one value was received, else SF

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

A Tighter Look

• Why to forward the right message?
• Why f + 1 rounds?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB (cont’d)

• Round i = 1 for p = leader k:
• If the leader is not an enemy accept
• If the leader does not send, he becomes an enemy
• Round i ∈ {2, . . . , f}:
• Send messages accepted in round i − 1 to all friends
• Receive messages initially sent by the leader
• Round i = f + 1 :
• Send as above and dummy and penance messages if necessary
• Receive as above and receive penance messages
• If a message sequences was unexpected quit friendship
• Deliver v if only one value was received, else SF

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

A Tighter Look

• Why to forward the right message?
• Why f + 1 rounds?
• Why exactly two messages?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB (cont’d)

• Round i = 1 for p = leader k:
• If the leader is not an enemy accept
• If the leader does not send, he becomes an enemy
• Round i ∈ {2, . . . , f}:
• Send messages accepted in round i − 1 to all friends
• Receive messages initially sent by the leader
• Round i = f + 1 :
• Send as above and dummy and penance messages if necessary
• Receive as above and receive penance messages
• If a message sequences was unexpected quit friendship
• Deliver v if only one value was received, else SF

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

A Tighter Look

• Why to forward the right message?
• Why f + 1 rounds?
• Why exactly two messages?
• Why should a player punish himself?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Byzantine Aware Nash TRB (cont’d)

• Round i = 1 for p = leader k:
• If the leader is not an enemy accept
• If the leader does not send, he becomes an enemy
• Round i ∈ {2, . . . , f}:
• Send messages accepted in round i − 1 to all friends
• Receive messages initially sent by the leader
• Round i = f + 1 :
• Send as above and dummy and penance messages if necessary
• Receive as above and receive penance messages
• If a message sequences was unexpected quit friendship
• Deliver v if only one value was received, else SF

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Result

• Let f < n − 1 be the bound on malicious players. In the

risk-averse model, the protocol BaN TRB is a Nash equilibrium if β + (n − 1)ω > C(n − f − 1, f).

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Cooperative Services

BAR Fault-Tolerance

• Architecture shall ease design of MAD applications
• Provides Proofs of Misbehavior (POMs)
• Provides Periodic Services
• Authorative Time (time-stamped, signed messages)

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Third Layer: Application

• Assigns work to separate nodes
• Assign maintenance work (Periodic Work protocol)
• Checks the proofs obtained by the second layer
• Requests justification proofs for not responded requests
• Second layer responds with POMs in case of unexpected

behavior

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

An Application: Backup Service

• Participants store chunks and retrieve them with the

receipt (Retrieve)

• Participants divide data in to chunks and request chunks to

be stored (StoreRequest) obtaining a receipt

• Synchronize (Audit)
• POMs and inconsistencies in Audits punished

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Three Types of Messages

• StoreRequest (contains lease time of chunk)
• Accept: Expects the time-stamped and signed receipt
• StoreReject: Return a list of non-expired StoreRequests
• Retrieve (contains signed and stamped receipt)
• RetrieveConfirm: Return stamped and signed chunk
• RetrieveDeny: Return receipt and show it to be expired or

superseded

• Audit: Assigned by the Periodic Work Protocol

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Second Layer: Partitioning Work

• Guaranteed Response: generates POMs (witness node)
• Periodic Work: Assigns maintenance work
• Authorative Time: provides synchronized time for

time-stamps

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Guaranteed Response

• Every request through the witness node
• Witness node is computed cooperatively

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Witness Node

Guaranteed Response

• Each node receives messages sent to be witness node
• For sending the "time out" message, a collects "time out"

message from f + 1 other nodes

• POM contains signatures of f + 1 other nodes

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Periodic Work

• Witness node checks if periodic work has been done
• Generates POM otherwise

⇒ Rational nodes will perform the work

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

First Layer: Replicated State Machine

Terminating Reliable Broadcast

• Main Idea: One machine, many replica
• Every command is decided through consensus (TRB)
• Passed through to everyone via TRB
• Relaxed model: Some work is specific to nodes

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Summary

• Secret Sharing and Multiparty Computation
• Deterministic Practical Mechanisms are impossible
• Remedy: Rational Secret Sharing (Randomized)
• Multiparty Computation
• Terminating Reliable Broadcast (message sending costs)
• On top: A three-level architecture for application design

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Thank you for your attention!

Any Questions?

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Without Initial Signatures

Without the mediator

• Issuer sends to every player ((b1,j, c1,j), . . . , (bn,j, cn,j))
• ci,j = bi,j · fi,j
• fi,j is the jth share of the player i’s share fi

Introduction Secret Sharing and Multiparty Computation Terminating Reliable Broadcast Cooperative Services

Computing the Mediator Cooperatively

Why Shouldn’t Player Cheat?

• Deviation results in:

(a) Being caught (wrong share, not sending a share) (b) All players learning the wrong secret (wrong value during the circuit evaluation)