[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] Lots of little changes. Removed references to c_n in...
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.mit.edu:/tmp/cvs-serv17262/fc03
Modified Files:
econymics.pdf econymics.ps econymics.tex
Log Message:
Lots of little changes. Removed references to c_n in section 4-ff.
Added b_n to full payoff eqn., changes to tables, typos, style, etc.
Index: econymics.pdf
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.pdf,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -d -r1.6 -r1.7
Binary files /tmp/cvsb0F4Xp and /tmp/cvsCr27nG differ
Index: econymics.ps
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.ps,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -d -r1.8 -r1.9
--- econymics.ps 17 Dec 2002 00:39:44 -0000 1.8
+++ econymics.ps 4 Apr 2003 20:24:43 -0000 1.9
@@ -1,3013 +1,5415 @@
%!PS-Adobe-2.0
-%%Creator: dvips(k) 5.86 Copyright 1999 Radical Eye Software
+%%Creator: dvipsk 5.58f Copyright 1986, 1994 Radical Eye Software
%%Title: econymics.dvi
-%%Pages: 18
+%%Pages: 19
%%PageOrder: Ascend
%%BoundingBox: 0 0 612 792
+%%DocumentPaperSizes: Letter
%%EndComments
-%DVIPSWebPage: (www.radicaleye.com)
[...8565 lines suppressed...]
(and)f(P)n(aul)h(Syv)n(erson.)30 b(F)-6 b(rom)22 b(a)i(tric)n(kle)g(to)
-f(a)h(\015o)r(o)r(d:)663 3919 y(Activ)n(e)36 b(attac)n(ks)g(on)h(sev)n
+f(a)h(\015o)r(o)r(d:)663 3736 y(Activ)n(e)36 b(attac)n(ks)g(on)h(sev)n
(eral)g(mix)e(t)n(yp)r(es.)66 b(In)36 b(F)-6 b(abien)36
-b(P)n(etitcolas,)j(editor,)e Fa(Information)663 4010
-y(Hiding)27 b(\(IH)g(2002\))p Fp(.)g(Springer-V)-6 b(erlag,)26
-b(LNCS)g(\(forthcoming\),)g(2002.)523 4101 y(23.)43 b(Stuart)17
+b(P)n(etitcolas,)j(editor,)e Fa(Information)663 3827
+y(Hiding)27 b(\(IH)g(2002\))p Fr(.)g(Springer-V)-6 b(erlag,)26
+b(LNCS)g(2578,)h(2002.)523 3919 y(24.)43 b(Stuart)17
b(G.)h(Stubblebine)f(and)g(P)n(aul)h(F.)g(Syv)n(erson.)j(Authen)n(tic)
-16 b(attributes)i(with)g(\014ne-grained)663 4193 y(anon)n(ymit)n(y)j
+16 b(attributes)i(with)g(\014ne-grained)663 4010 y(anon)n(ymit)n(y)j
(protection.)31 b(In)23 b(Y)-6 b(air)23 b(F)-6 b(rank)n(el,)23
b(editor,)h Fa(Financial)h(Crypto)l(gr)l(aphy)k(\(F)n(C)c(2000\))p
-Fp(,)663 4284 y(pages)h(276{294.)j(Springer-V)-6 b(erlag,)26
+Fr(,)663 4101 y(pages)h(276{294.)j(Springer-V)-6 b(erlag,)26
b(LNCS)f(1962,)j(2001.)p eop
%%Trailer
end
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.52
retrieving revision 1.53
diff -u -d -r1.52 -r1.53
--- econymics.tex 4 Apr 2003 03:07:11 -0000 1.52
+++ econymics.tex 4 Apr 2003 20:24:44 -0000 1.53
@@ -47,7 +47,7 @@
Individuals and organizations need anonymity on the Internet. People
want to surf the Web, purchase online, and send email without exposing
-their identities, interests, and activities to others. Corporate and
+to others their identities, interests, and activities. Corporate and
military organizations must communicate with other organizations
without revealing the existence of such communications to competitors
and enemies. Firewalls, VPNs, and encryption cannot provide this
@@ -70,8 +70,8 @@
an economically workable system for users and infrastructure operators.
Section \ref{sec:overview} gives an overview of the ideas behind our
-model, and Section \ref{sec:model} goes on to describe the variety of
-(often conflicting) incentives and build a general model to incorporate
+model. Section \ref{sec:model} goes on to describe the variety of
+(often conflicting) incentives and to build a general model that incorporates
many of them. In Section \ref{sec:application} we give some simplifying
assumptions and draw conclusions about certain scenarios. Sections
\ref{sec:alternate-incentives} and \ref{sec:roadblocks} describe some
@@ -160,11 +160,8 @@
\ref{sec:alternate-incentives} we examine alternate incentive mechanisms.
We begin with two assumptions: the agents want to send messages to
-other parties, and the agents value their privacy. This value
-might be related to profits they will make by keeping their
-messages anonymous, or to losses they will avoid by not having
-their messages tracked. Different agents might value anonymity
-differently.
+other parties, and the agents value their anonymity.
+How various agents might value their anonymity will be discussed below.
An agent $i$ (where $i=(1,...,n)$ and $n$ is the number of
potential participants in the mix-net) bases her strategy on the
@@ -174,6 +171,8 @@
\item Act as a user of the system, specifically by sending (and
receiving) her own traffic over the system, $a_{i}^s$, and/or
agreeing to receive dummy traffic through the system, $a_{i}^r$.
+(\emph{Dummy traffic} is traffic whose only purpose is to obscure
+actual traffic patterns.)
\item Act as an honest node, $a_{i}^{h}$, by receiving and
forwarding traffic (and possibly acting as an exit node), keeping
@@ -304,7 +303,7 @@
thought to act as a dishonest node.
Some of these reputation costs and benefits could be modelled
-endogenously (for example, being perceived as an honest node
+endogenously (e.g., being perceived as an honest node
brings that node more traffic, and therefore more possibilities to
hide that node's messages; similarly, being perceived as a
dishonest node might bring traffic away from that node). In this
@@ -324,7 +323,7 @@
based on the the
actions $a_{i}$ discussed above. The combination of strategies $%
(s_{1},...,s_{n})$, one for each agent who participates to the
-mix-net, determines the outcome of the game and the associated
+mix-net, determines the outcome of a game as well as the associated
payoff for each agent. Hence, for each complete strategy profile
$s=(s_{1},...,s_{n})$ each agent receives the expected payoff
$u_{i}\left(s\right)$ through the payoff function $u(.)$. We
@@ -338,11 +337,11 @@
n_{h},n_{d},a_{h}^{s}\right) \right) ,\partial \left(
v_{a_{i}},p_{a_{i}}\left( n_{s},n_{h},n_{d},a_{h}^{s}\right)
\right) ,a_{i}^{s}\right] \, + \,
-b_{h}a_{i}^{h}+\\
-b_{d}a_{i}^{d} - c_{s}\left( n_{s},n_{h}\right)
+b_{h}a_{i}^{h}+b_{d}a_{i}^{d}\\
+- c_{s}\left( n_{s},n_{h}\right)
a_{i}^{s}-c_{h}\left( n_{s},n_{h},n_{d}\right)
a_{i}^{h}-c_{d}\left( ..\right) a_{i}^{d}-c_{r}\left( ..\right)
-a_{i}^{r}-c_{n}a_{i}^{n}
+a_{i}^{r}+(b_n-c_{n})a_{i}^{n}
\end{array}
\right)
\end{equation*}
@@ -375,36 +374,62 @@
\begin{center}
\begin{tabular}{|c|cl|}
-\hline \multicolumn{3}{|c|}{Variables used in both full and simple
-payoff equations} \\ \hline \hline &$u_i$ & payoff for agent $i$ \\
-\cline{2-3} &$v_{a_i}$ & disutility $i$ attaches to message
-exposure \\ \cline{2-3} &$p_a$ & prob.\ that a sent message
-loses anonymity \\ \hline number of nodes&$n_s$ & sending
-agents (sending nodes) \\ \cline{2-3} (other than $i$)&$n_h$ &
-honest nodes \\ \cline{2-3} in mix-net&$n_d$ & dishonest
-nodes\\ \hline dummy variables:&$a^h_i$ & $i$ is an honest node
-and sending agent \\ \cline{2-3} $1$ if true, $0$
-otherwise&$a^s_i$ & $i$ sends through the mix-net \\ \hline
-&$c_s$ & of sending a message through the mix-net\\
-\cline{2-3} costs &$c_h$ & of running an honest node \\
+\hline
+\multicolumn{3}{|c|}{Variables used in both full and simple payoff equations}\\
+\hline
+\hline
+&$u_i$ & payoff for agent $i$ \\
\cline{2-3}
-&$c_n$ & of sending a message around the mix-net\\
+&$v_{a_i}$ & disutility $i$ attaches to message exposure \\
+\cline{2-3}
+&$p_a$ & simple case: $p_{a_i} = p_a$ for all $i$. See next table.\\
+\hline
+number of nodes&$n_s$ & sending agents (sending nodes) \\
+\cline{2-3}
+(other than $i$)&$n_h$ & honest nodes \\
+\cline{2-3}
+in mix-net&$n_d$ & dishonest nodes\\
+\hline
+dummy variables:&$a^h_i$ & $i$ is an honest node and sending agent \\
+\cline{2-3}
+$1$ if true, $0$ otherwise&$a^s_i$ & $i$ sends through the mix-net \\
+\hline
+&$c_h$ & of running an honest node\\
+\cline{2-3}
+\raisebox{1.5ex}{costs}&$c_s$ & of sending a message through the mix-net \\
\hline
\end{tabular}
\end{center}
\begin{center}
\begin{tabular}{|c|cl|}
\hline
-\multicolumn{3}{|c|}{Variables used only in full payoff equation} \\ \hline
+\multicolumn{3}{|c|}{Variables used only in full payoff equation} \\
+\hline
+\hline
+&$v_{r_i}$ & value $i$ attaches to sent message being received \\
+\cline{2-3}
+&$p_{a_i}$ & prob.\ for $i$ that a sent message loses anonymity \\
+\cline{2-3}
+&$p_r$ & prob.\ that message sent through mix-net is received \\
+\hline
+&$b_h$ & of running an honest node \\
+\cline{2-3}
+benefits &$b_d$ & of running a dishonest node \\
+\cline{2-3}
+&$b_n$ & of sending a message around the mix-net \\
+\hline
+&$a^d_i$ & $i$ runs a dishonest node \\
+\cline{2-3}
+dummy variables&$a^n_i$ & $i$ sends message around the mix-net \\
+\cline{2-3}
+&$a^r_i$ & $i$ receives dummy traffic \\
+\hline
+&$c_d$ & of running a dishonest node \\
+\cline{2-3}
+costs & $c_r$ & of receiving dummy traffic \\
+\cline{2-3}
+&$c_n$ & of sending a message around the mix-net\\
\hline
-&$v_{r_i}$ & value $i$ attaches to sent message being received \\ \cline{2-3}
-&$p_r$ & prob.\ that message sent through mix-net is received \\ \hline
-&$b_h$ & of running an honest node \\ \cline{2-3}
-{\raisebox{1.5ex}{benefits}} &$b_d$ & of running a dishonest node \\ \hline
-&$a^d_i$ & $i$ runs a dishonest node \\ \cline{2-3}
-dummy variables&$a^n_i$ & $i$ sends message around the mix-net \\ \cline{2-3}
-&$a^r_i$ & $1$ $i$ receives dummy traffic \\ \hline
-cost &$c_r$ & of receiving dummy traffic \\ \hline
\end{tabular}
\end{center}
@@ -428,26 +453,26 @@
\begin{tabular}{|c|c|}
\hline
\textit{Anonymity} & \textit{Reliability} \\ \hline
-{\tiny \
+{\scriptsize \
\begin{tabular}{c}
-Benefits from remaining anonymous / \\
-costs avoided remaining anonymous, or
+Benefit from remaining anonymous / \\
+cost avoided by remaining anonymous, or
\end{tabular}
-} & {\tiny
+} & {\scriptsize
\begin{tabular}{c}
-Benefits from sending a message which will be received / \\
-costs avoided sending a message, or
+Benefit in sending message that will be received / \\
+cost avoided by sending such a message, or
\end{tabular}
} \\ \hline
-{\tiny \
+{\scriptsize \
\begin{tabular}{c}
-Costs due to losing anonymity / \\
+Cost from losing anonymity / \\
\ profits missed because of loss of anonymity
\end{tabular}
-} & {\tiny
+} & {\scriptsize
\begin{tabular}{c}
-Costs due to not having sent a message / \\
-\ profits missed because of not having sent a message
+Cost from a message not being received / \\
+\ profits missed by message not being received
\end{tabular}
} \\ \hline
\end{tabular}
@@ -460,17 +485,18 @@
to gain some benefit, but anonymity must be protected in order to
avoid losses, then $v_{r_{i}}$ will be positive while $v_{a_{i}}$
will be negative and $p_{a_{i}}$ will enter the payoff
-function as $\left( 1-p_{a_{i}}\right) $.\footnote{%
-Being certain of staying anonymous would therefore eliminate the
-risk of $v_{a_{i}}$, while being certain of losing anonymity would
-impose on the agent the full cost $v_{a_{i}}$.} On the other side,
+function as $\left( 1-p_{a_{i}}\right) $. On the other side,
if the agent must send a certain message to avoid some losses but
anonymity ensures her some benefits, then $v_{r_{i}}$ will be
negative and $p_{r_{i}}$ will enter the
-payoff function as $\left( 1-p_{r_{i}}\right) $, while $v_{a_{i}}$ will be positive.%
-\footnote{Similarly, guaranteed delivery will eliminate the risk
-of losing $v_{r_{i}}$, while delivery failure will impose the full
-cost $v_{r_{i}}$.}
+payoff function as $\left( 1-p_{r_{i}}\right) $,
+while $v_{a_{i}}$ will be positive.%
+\footnote{ Being certain of staying anonymous would therefore
+ eliminate the risk of $v_{a_{i}}$, while being certain of losing
+ anonymity would impose on the agent the full cost $v_{a_{i}}$.
+ Similarly, guaranteed delivery will eliminate the risk of losing
+ $v_{r_{i}}$, while delivery failure will impose the full cost
+ $v_{r_{i}}$.}
With this framework we can compare, for example, the losses due to
compromised anonymity to the costs of protecting it. An agent will decide to
@@ -485,7 +511,7 @@
In this section we apply the above framework to simple scenarios.
We make a number of assumptions to let us model the behavior of
mix-net participants as players in a repeated-game,
-simultaneous-move game theoretical framework. Thus we can analyze
+simultaneous-move game-theoretic framework. Thus we can analyze
the economic justifications for the various choices of the
participants, and compare design approaches to mix-net systems.
@@ -508,8 +534,8 @@
limited commitment produced by earlier actions allows us to
consider a repeated-game
scenario.\footnote{%
-In Section \ref{sec:model} we have highlighted that for both nodes
-and simpler users variable costs are more significant than fixed
+In Section \ref{sec:model} we have highlighted that, for both nodes
+and simpler users, variable costs are more significant than fixed
costs.}
%Roger, is this the case or not? ie are traffic related costs the highest ones? -AA
% I think variable costs are higher than fixed costs, but variable costs
@@ -535,7 +561,7 @@
compromised. This factor influences their assessment of the
anonymity of messages they send. A purely passive adversary is
unrealistic in most settings, e.g., it assumes that hostile users
-never selectively send messages at certain times or routes, and
+never selectively send messages at certain times or over certain routes, and
nodes and links never selectively trickle or flood messages
\cite{trickle02}. Nonetheless, a \emph{global} passive adversary
is still quite strong, and thus a typical starting point of
@@ -569,7 +595,9 @@
a certain distribution across all agents; see below). In other
words, we initially focus on the goal of remaining anonymous given
an adversary that can control some nodes and observe all
-communications. We later comment on the additional reliability
+communications. Other than anonymity, we do not consider any potential
+benefit or cost, e.g., possible greater reliability, from sending
+around the mix-net. We later comment on the additional reliability
issues.
%These assumptions let us re-write the payoff function presented in
@@ -578,7 +606,7 @@
u_{i}=-v_{a_{i}}\left( 1-p_{a}\left(
n_{s},n_{h},n_{d},a_{i}^{h}\right) \right)
-c_{s}a_{i}^{s}-c_{h}\left( n_{s},n_{h},n_{d}\right)
-a_{i}^{h}-c_{n}
+a_{i}^{h}-v_{a_i}a_i^n
\end{equation*}
Thus each agent $i$ tries to \textit{minimize} the costs of
sending messages and the risk of being tracked. The first
@@ -601,7 +629,7 @@
$a_{h}$ & $-v_{a_{i}}\left( 1-p_{a}\left(
n_{s},n_{h},n_{d},a_{i}^{h}\right)
\right) -c_{s}-c_{h}\left( n_{s},n_{h},n_{d}\right) $ \\
-$a_{n}$ & $-v_{a_{i}}-c_{n}$%
+$a_{n}$ & $-v_{a_{i}}$%
\end{tabular}
\end{equation*}
We do not explicitly allow the agent to choose \textit{not} to
@@ -647,7 +675,7 @@
$-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h}+1,n_{d},a_{i}^{h}%
\right) \right) -c_{s}-c_{h}\left( n_{s}+1,n_{h}+1,n_{d}\right)
$ \\
-$<-v_{a_{i}}-c_{n}$%
+$<-v_{a_{i}}$%
\end{tabular}
\end{equation*}
agent $i$ will choose to become a node in the mix-net. If
@@ -660,7 +688,7 @@
\right)
-c_{s},$ and \\
$-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h},n_{d}\right) \right)
--c_{s}<-v_{a_{i}}-c_{n}$%
+-c_{s}<-v_{a_{i}}$%
\end{tabular}
\end{equation*}
then agent $i$ will choose to be a user of the mix-net. Otherwise,
@@ -689,7 +717,7 @@
We start by considering only one-on-one
interactions. First we present the case where each agent knows the
other agent's type, but we then discuss what happens when
-there is uncertainty about the other agents' types.
+there is uncertainty about the other agent's types.
Suppose that each of agent $i$ and agent $j$ considers the other
agent's reaction function in her decision process. Then we can
@@ -702,7 +730,7 @@
n_{s}+2,n_{h}+2,n_{d}\right) $ \\
$B_{w}=-v_{w}\left( 1-p_{a}\left( n_{s}+2,n_{h}+1,n_{d}\right)
\right) -c_{s}$ \\
-$C_{w}=-v_{w}-c_{n}$ \\
+$C_{w}=-v_{w}$ \\
$D_{w}=-v_{w}\left( 1-p_{a}\left(
n_{s}+2,n_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left(
n_{s}+2,n_{h}+1,n_{d}\right) $ \\
@@ -809,10 +837,10 @@
prohibitive. This is not a viable strategy.
Second, we must remember that highly sensitive agents, for a given
-amount of traffic, prefer to be nodes (because anonymity and
-reliability will increase) and prefer to work in systems with
+amount of traffic, prefer to be nodes (because anonymity
+will increase) and prefer to work in systems with
fewer nodes (else traffic gets too dispersed and the anonymity
-sets get too small). So, if $-v_{a_{i}}-c_{n}$ is particularly
+sets get too small). So, if $v_{a_{i}}$ is particularly
high, i.e. if the cost of not having anonymity is very high for
the most sensitive agents, then they will decide to act as
nodes regardless of what the others do. Also, if there are enough
@@ -853,7 +881,7 @@
Here the ``marginal'' argument discussed above might not work, and
coordination might be costly. In order to have a scenario where
-the system is self-sustaining and free and the agents are of high
+the system is self-sustaining and free, and the agents are of high
and low types, the actions of the agents must be visible and the
agents themselves must agree to react together to any deviation of
a marginal player. In realistic scenarios, however, this will
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/