[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] some more patches
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.mit.edu:/home/arma/work/freehaven/doc/fc03
Modified Files:
econymics.tex
Log Message:
some more patches
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.44
retrieving revision 1.45
diff -u -d -r1.44 -r1.45
--- econymics.tex 16 Dec 2002 02:54:37 -0000 1.44
+++ econymics.tex 16 Dec 2002 04:35:42 -0000 1.45
@@ -229,7 +229,7 @@
anonymity differently.
Each agent $i$ (where $i=(1,...,N)$ and $N$ is the number of
-potential participants to the mix-net) bases her strategy on the
+potential participants in the mix-net) bases her strategy on the
following possible actions $a_{i}$:
\begin{enumerate}
@@ -241,7 +241,7 @@
forwarding traffic (and possibly acting as an exit node), keeping
messages secret, and possibly creating dummy traffic.
-\item Act as dishonest node, $a_{i}^{d}$, by pretending to
+\item Act as a dishonest node, $a_{i}^{d}$, by pretending to
forward traffic but not doing so, by pretending to create dummy
traffic but not doing so (or sending dummy traffic easily
recognizable as such), or by eavesdropping traffic to compromise
@@ -251,7 +251,7 @@
$a_{i}^{n}$, or send no messages at all.
\end{enumerate}
-Various benefits and costs are associated to each agent's action
+Various benefits and costs are associated with each agent's action
and the simultaneous actions of the other agents. The benefits
include:
@@ -273,7 +273,7 @@
agents acting as honest nodes, $n_{h}$, and as dishonest nodes,
$n_{d}$), and the decisions of the agent. We assume that this
function maps these factors into a probability
-measure $p\in \left[ 0,1\right] $.\footnote{%
+measure $p\in \left[0,1\right]$.\footnote{%
Information theoretic anonymity metrics \cite{Diaz02,Serj02}
probably provide better measures of anonymity: such work shows how
the level of anonymity achieved by an agent in a mix-net system is
@@ -303,7 +303,10 @@
nodes may prefer fewer nodes, to maintain larger anonymity sets at
their particular node. Hence the probability of remaining
anonymous is inversely related to the number of nodes but
-positively related to the ratio of honest/dishonest nodes.
+positively related to the ratio of honest/dishonest nodes. (On the other
+hand, improving anonymity by reducing the number of nodes can be taken
+too far --- a system with only one node may be easier to monitor and
+attack. See Section \ref{sec:alternate-incentives} for more discussion.)
\end{itemize}
If we assume that honest nodes always deliver messages that go through them,
@@ -342,11 +345,16 @@
\item Costs of acting as an honest node, $c_{h}$, by receiving
and forwarding traffic, creating dummy traffic, or being an exit
node (which involves potential exposure to liability from abuses).
-There costs can be variable or fixed. The fixed costs, for
+These costs can be variable or fixed. The fixed costs, for
example, are related to the investments necessary to setup the
software. The variable costs are often more significant, and are
dominated by the costs of traffic passing through the node.
-%Is this true that they are often more significant?
+%Is this true that they are often more significant? -AA
+%Not necessarily. If it were just bandwidth I think we'd have more
+% nodes. I think a major part of the costs is dealing with abuse and
+% potential abuse. (To complicate things further, I think the actual
+% costs of dealing with abuse isn't so high for many people -- it's
+% the perceived cost, how much they expect they'll have to pay.) -RD
\item Costs of acting as dishonest node, $c_{d}$ (again carrying traffic;
and being exposed as a dishonest node may carry a monetary penalty).
@@ -366,19 +374,19 @@
through the changes they provoke in the behavior of the agents. In
other cases, reputation costs and benefits might be valued
\textit{per se}. While we do not consider this option in the
-simplified model below, we later comment on the impact that
-reputation effects can have on the model.
+simplified model below, Sections \ref{sec:alternate-incentives} and
+\ref{sec:roadblocks} discuss the impact of reputation on the model.
We assume that agents want to maximize their expected utility,
which is a function of expected benefits minus expected costs. Let
$S_{i}$ denote the set of strategies available to player $i$, and
-$s_{i}$ a certain member of that set.\ Each strategy $s_{i}$ is
+$s_{i}$ a certain member of that set. Each strategy $s_{i}$ is
based on the the
actions $a_{i}$ discussed above. The combination of strategies $%
(s_{1},...,s_{N})$, one for each player, determines the outcome of
the game and the associated payoff for each agent. Hence, for each
complete strategy profile $s=(s_{1},...,s_{N})$ each agent
-receives a von Neumann-Morgenstern utility $u_{i}\left( s\right)$.
+receives a von Neumann-Morgenstern utility $u_{i}\left(s\right)$.
We represent the payoff function for each agent $i$ in the
following form:
@@ -509,12 +517,14 @@
actions on future strategies. A large group will have no
discernable or agreeable order for the actions of all
participants, so actions can be considered simultaneous. The
-limited commitment produced by earlier actions allow us to
+limited commitment produced by earlier actions allows us to
consider a repeated-game
scenario.\footnote{%
In Section \ref{sec:model} we have highlighted that for both nodes and
simpler users variable costs are more significant than fixed costs.}
-%Roger, is this the case or not? ie are traffic related costs the highest ones?
+%Roger, is this the case or not? ie are traffic related costs the highest ones? -AA
+% I think variable costs are higher than fixed costs, but variable costs
+% are not solely due to bandwidth prices. see comment above -RD
These two considerations suggest against using a sequential approach
of the Stackelberg type \cite[Ch. 3]{fudenberg-tirole-91}. For similar
reasons we also avoid a ``war of attrition/bargaining model'' framework
@@ -562,7 +572,8 @@
based on traffic and number of nodes. Finally, we imagine that
agents use the system because they want to avoid potential losses
from not being anonymous. This subjective sensitivity to anonymity
-is represented by $v_{a_{i}}$ (see Section \ref{sec:model}; we can
+is represented by $v_{a_{i}}$ (%see Section \ref{sec:model};
+we can
initially imagine $v_{a_{i}}$ as a continuous variable with a
certain distribution across all agents; see below). In other
words, we initially focus on the goal of remaining anonymous given
@@ -585,7 +596,7 @@
honest and dishonest nodes, and the action $a$ of agent $i$
itself. This chance is weighted by $v_{a_{i}}$, the disutility
agent $i$ derives from its message being exposed. We also include
-the costs of sending a message through the mix-net system, acting
+the costs of sending a message through the mix-net, acting
as a node when there are $n_{s}$ agents sending messages over
$n_{h}$ and $n_{d}$ nodes, and sending messages through a
non-anonymous system, respectively. Each period, a rational agent
@@ -608,7 +619,6 @@
compromise.
Also, we do not explicitly report the value of sending a successful message.
Both are simplifications that do not alter the rest of the analysis.
-%FIXME following sentence is huge
\footnote{We could insert an action $a^{0}$ with a certain
disutility from not sending any message, and then solve the
problem of minimizing the expected
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/