\documentclass[landscape]{slides}
\usepackage{multicol}
\usepackage[all,poly,ps,dvips,color]{xy}
\input{preamble}
  
\input{SLIDES}
  
%\usepackage[dvips]{graphics}
%\usepackage[all,poly,ps,dvips,color]{xy}
%\UseCrayolaColors

%\DeclareMathOperator{\mathin}{in}
%\DeclareMathOperator{\mathout}{out}

\newcommand{\vindex}[2]{\left[ #1 \right] _ #2}
\newcommand{\eigen}{\mathbf a}
\newcommand{\elem}{\mathbf e}
\newcommand{\state}{\mathbf x}
\newcommand{\maxdeg}{\Delta}
\newcommand{\maxdegC}{d_{max}}

\newcommand{\din}{d_{\mathin}}
\newcommand{\dout}{d_{\mathout}}
\newcommand{\dmax}{d_{\max}}


\newcommand{\nlabel}[2]{\ar@{} @(#1,#1) |<<{#2}}
\newcommand{\gnlabel}[2]{[#1(.25)] {#2}}
\newcommand{\node}{{\bullet}}
\newcommand{\bypass}{{\circ}}

\begin{document}

\begin{titlepage}
\title{CS 591, Lecture 18}

\author {Jared Saia \\
{\red University of New Mexico}}

\date{}
\maketitle

\end{titlepage}




\begin{SLIDE}[Class Outline]

\begin{itemize}
\item Digital Signatures
\item Peer Join
\item Message send under fail-stop fault model
\item Message send under Byzanting fault model
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Digital signatures and ID's]
What we want:
\begin{itemize}
\item unique numerical id for each entity in the network
\item signature that can be easily checked for validity by anyone
\item signature that can be forged by no one
\item We'll consider three ways to get this
\end{itemize}
\end{SLIDE}


\begin{SLIDE}[Scenario 1: IP-addresses]
\begin{itemize}
\item Assume technical advances make it more difficult to spoof IP-addresses
\item Internet II is moving towards this goal
\item Can simply use IP-addresses as the ID and signature
\item The ``certificate'' of this ID is just an acknowledgement by
direct ping.
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Scenario 2: A Neutral, Trusted Party]
\begin{itemize}
\item A trusted party distributes ``black boxes'' (these can be
software byte code or actual hardware) to each entity
\item Each black box contains a unique id $x$ and a secret encryption
function $e$  (which can not be recovered)
\item The public key for $e$, $e^{-1}$, is released to everyone, and
the trusted party ``forgets'' $e$
\item The ``black box'' creates the signature $(x,e (x))$ whenever
called (the secure id is $x$ and the certificate of uniqueness is $e
(x)$)
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Scenario 3: Mass Paranoia]
In this scenario, no entity is trusted
\begin{itemize}
\item When a new peer, $v$, joins the network, it chooses some secret
encryption function $e_{v}$ and publishes $e_{v}^{-1}$ (we need to ensure
that if one good peer receives this message, then all peers receive it)
\item All peers in the network decide on some random ID $x$ for $v$ -
this ID is known to all peers (the alg for doing this is to be shown).
\item $v$ uses the signature $(x,e_{v} (x))$, where $x$ is the ID and
$e_{v} (x)$ is the certificate.
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Digital Signatures]
\begin{itemize}
\item Note that it is easy to add ``time stamps'' to the digital
signatures
\item This ensures that the ``freshness'' of a message can be verified
(i.e. another peer won't resend an old message from $v$ and try to
pass it off as new)
\item Alternatively, for each message, can create a digital signature
for the message by encrypting the entire message.
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Choosing a Random Number]
\begin{itemize}
\item Want to choose a random number which is known by all good peers
\item Assume that each peer has a unique digital signature
\item Assume every peer can communicate with every other peer
\item Assume synchronous communication
\item Assume a majority of good peers
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Choosing a Random Number]
The Algorithm:
\begin{enumerate}
\item Each good peer $u$ chooses a random number $r$ and sends out a
message which consists of $r$ \emph{and} $u$'s digital signature to
everyone.

\item For each peer $u$, each good peer $v$ sends out a message to
everyone which consists of the message that $v$ received from $u$
along with $v$'s digital signature.

\item Each good peer now receives for each fixed peer $u$, a
collection of messages signed by every other peer concerning what they
claim they received from $u$.  If for some fixed peer $u$, two messages
signed by $u$ disagree on $u$'s chosen value, then $u$ is assumed to
be ``bad''.  Otherwise $r_{u}$ is set to be the single unique number
that was provably received by the other peers.

\item Each good peer now computes $r$ to be the bitwise exclusive-or
of every verified $r_{u}$ for each peer $u$.
\end{enumerate}
\end{SLIDE}

\begin{SLIDE}[Analysis]
\begin{itemize}
\item Note: all good peers have the same value set for $r_{u}$
for all peers $u$.  
\item If $u$ sent the same values to all good peers, this is trivially true
\item If $u$ sent different signed values to two good peers, then in
the third step of the algorithm, all good peers invalidate $u$
\item This implies then that all good peers will choose the same
number, $r$, in the last step of the algorithm
\item Since at least one of the peers is good, at least one of the
number chosen will be random, hence $r$ will be a random number
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Cryptography]
\begin{itemize}
\item We still haven't shown how to get $e_{v}$ and $e_{v}^{-1}$
\item This requires cryptographic machinary
\item Depends on the difficulty of factoring large numbers
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[How to get $e_{v}$ and $e_{v}^{-1}$]
\begin{enumerate}
\item Select two large prime numbers $p$ and $q$ at random.  Let
$n=p*q$
\item Select a small odd integer $u$ that is relatively prime to $\phi
(n)= (p-1) (q-1)$
\item Compute $v$ which is the multiplicative inverse of $u$ mod $\phi (n)$
\item $e^{-1} (x)=x^{u} \pmod n$  - public
\item $e (x)=x^{v} \pmod n$ - private
\end{enumerate}
\end{SLIDE}

\begin{SLIDE}[``Analysis'']
\begin{itemize}
\item Number theoretic arguments can show that for any number $m$:
\[
e^{-1} (e (m)) = m^{uv} = m \pmod n
\]
\item Number theoretic arguments further show that computing $v$ given
$u$ and $n$ is as hard as factoring $n$
\item Hence, if factoring is ``hard'' then the function $e$ remains
private even though $e^{-1}$ is known
\end{itemize}
\end{SLIDE}


\begin{SLIDE}[Now what?]
\begin{itemize}
\item So assume that we've got unique id's and digital signatures for
each of the peers
\item Now how do we use these id's to set up an informer network?
\item What we ``want'' is for there to be a mapping from each ID to a
``random'' set of $k \log n$ peers in the network
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Peer Join]
\begin{itemize}
\item An idea: Use consistent hashing (from the Akamai paper)
\item We've got a family of $k\log n$ base hash functions that map an
ID to a point on the unit circle
\item For each circle, let the assigned informer be the peer that is
closest in the clockwise direction to the point the ID hashed to
\item This gives us $k \log n$ ``random'' peers in the network to be
used as informers
\item Let $f$ be the function that maps ID's to sets of ID's on these
$k \log n$ unit circles
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Join Protocol for joining peer $p$]

\begin{itemize}
\item $p$ broadcasts message that $i_{p}$ is joining to all peers in network
\item Let $S$ be the set of peers $p$ receives replies from that claim
to be $p$'s informers.  Let $S'$ be the set of verified informer in
$S$ (i.e. $S' = \{s \in S | i_{s} \in f(i_{p}) \}$ 
\item $p$ sets it's informer set $I(p)$ to be $S'$
\item $p$ establishes connections with all peers in $I(p)$
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Join Protocol for non-joining peer $o$]
\begin{itemize}
\item $o$ receives join message from $p$ and obtains $p$'s id, $i_{p}$
\item If $i_{o} \in f(i_{p})$, $o$ broadcasts a claim that it is an
informer for $p$ to all other peers.  It also adds $p$ to its
informant set, $I^{-1}(o)$
\item $o$ receives messages from all peers which claim to be informers
for $p$.  Let $I(p)$ be the verified set of all such peers
\item Let $I^{-1}(o)$ be the set of peers that $o$ informs on.  For
each $x \in I^{-1}(o)$ such that $(x,p)$ is an edge in the underlying
network, $o$ establishes an informer-to-informer link to each peer in
$I(p)$
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Analysis]
\begin{itemize}
\item Assume we are given some protocol for creating a p2p network
without informers  (e.g. the gnutella protocol or the CRN or DRN protocol)
\item This protocol will define some graph $G_{p}$ over the peers
which would be the topology of the overlay network without informers
\item The join algorithm creates a network which mirrors $G_{p}$
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Analysis]
\begin{itemize}
\item Each peer $x$ has a set $I (x)$ of informers chosen randomly
from all the peers.  $|I (x)| = k*\log (n)$
\item The join algorithm creates a network which mirrors $G_{p}$
\item For each edge $(x,y)$ in $G_{p}$, all peers in $I (x)$ and in $I
(y)$ are connected in a full bipartite graph
\end{itemize}
\end{SLIDE}


\begin{SLIDE}[Fail-stop faults]
\begin{itemize}
\item First consider the situation where bad peers suffer
``fail-stop'' faults
\item Recall ``fail-stop'' means that bad informers simply stop communicating
\item We give a light-weight scheme for informing and
communicating through the network in this case
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Communication: Peer to Informer]
\begin{itemize}
\item Peer protocol: When a peer $p$ requests a data item or serves a
data item, it sends out a message to a random informer in $I(p)$
\item Informer protocol: When an informer receives a message from its
peer, it does the following
\begin{itemize}
\item If the message is a data item requested by a previously logged
request, it logs this response and broadcasts information on the
response to all other informers in $I(p)$
\item Otherwise, with probability $p_{i}$, it logs information on the
message sent out and broadcasts this information to all other peers in $I(p)$
\item Finally, it sends the message to the next appropriate informer
cloud using the protocol described under \emph{Informer to Neighboring
Informer Cloud}
\end{itemize}
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Informer to Peer]
\begin{itemize}
\item When an informer receives a message to its peer, it does the
following:
\item If the message is a request for data, with probability $p_{i}$,
it logs information on the request and broadcasts this information to
all other informers in the informer cloud.
\item Next, it sends the message to the peer
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Informer to Neighboring Informer Cloud]
\begin{itemize}
\item When an informer has a message which is to be sent to a
neighboring informer cloud, it does the following:
\item Until it gets a response, it chooses a random informer in the
neighboring informer cloud and pings that informer
\item Once a live informer is found, the message is sent to that live informer
\end{itemize}
\end{SLIDE}


\begin{SLIDE}[Analysis]
\begin{itemize}
\item Let $p_{f}$ be the ratio of the number of failed peers to the
total number of peers
\item Assume we want to communicate a message from some peer $a$ to
some peer $b$ in the original network
\item Let $p_{i}$ be any number in the range $0$ to $1$ 
\item Let $m$ be the number of informers in each informer cloud ($m$
is polylog in $n$)
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Analysis]
Theorem: The above protocol allows for communication along the path
from $a$ to $b$ such that
\begin{itemize}
\item The message sent from $a$ is known by all peers in $I(a)$ with
probability $p_{i}$, and is known to all peers in $I(b)$ with
probability $p_{i}$
\item The expected time to send the message is $(1/p_{f})l + 2*p_{i}$
\item The expected number of messages sent is $(1/p_{f})l + 2*p_{i}*m$
\item The time to send and number of messages to send are sharply
concentrated around their expected values
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Byzantine Faults]
\begin{itemize}
\item Now we'll consider the case of Byzantine faults
\item Recall that these Byzantine are strictly worse than fail-stop faults
\item We'll assume that at any time no more than a $p_{f}$ fraction
of the peers are bad for some $p_{f}<1/2$
\item To handle Byzantine faults, we'll first consider the probability that
any informer cloud contains a majority of bad peers.
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Analysis]
\begin{itemize}
\item Let $p_{f}$ be worst case ratio of bad peers in the network to
good peers
\item Q1: What is the probability that there is some peer $x$, such
that $I (x)$ does not have a majority of good peers?
\item Q2 (Easier): What is the probability that for some \emph{fixed}
peer $x$,  $I (x)$ does not have a majority of good peers?
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Analysis]
\begin{itemize}
\item A2: Let $x$ be some fixed peer.  Note that $I(x)$ is formed by
making $log^{k} (n)$ independent random choices from the $n$ peers in
the network
\item Let $X_{i}$ be $1$ if this choice is a bad peer and $0$ otherwise
\item Note that $E (X_{i}) = p_{f}$.
\item Let $X = \sum_{i=1}^{k*\log n} X_{i}$.  Note by linearity of
expectation that $E (X) = k*\log n * p_{f}$
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Chernoff Bounds]
\begin{itemize}
\item Assume $p_f$ is a fixed constant less than $1/2$
\item Then we want to find: $$P (X \geq (1/2)* k*\log n) = P (|X-E
(X)| \geq \delta E(X))$$ where $\delta = (1/2-p_f)/p_f$
\item By Chernoff Bounds, 
\[
P (|X-E (X))| \geq \delta E (X) leq 2e^{\frac{-E (X) \delta^{2}}{4}}
\]
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Chernoff Bounds]
\begin{itemize}
\item In this case, that means that for $\delta =
(1/2-p_f)/p_f$,
\[
P (|X-E (X))| \geq \delta E (X) leq 2e^{\frac{-E (X) \delta^{2}}{4}}
\]
\item This probability is $2e^{-C k*\log n}$ where $C = (p_f * \delta^{2})/4$
(note that $C$ depends only on $p_{f}$)
\item Thus for any $k'>0$, $k$ can be chosen as a function of $k'$ and $p_f$
so that this probability is no more than $n^{-k'}$
\end{itemize}
\end{SLIDE}

\begin{SLIDE}[Union Bounds]
\begin{itemize}
\item Now we can answer the more difficult Q1:
\item Q1: What is the probability that there is some peer $x$, such
that $I (x)$ does not have a majority of good peers?
\item We know the probability that for a \emph{fixed} peer $x$, the
probability of failure is no more than $n^{-k'}$
\item By Union Bound, we can say that the probability of failure for
any of the peers is no more than $n^{-k+1}$
\end{itemize}
\end{SLIDE}




\end{document}
