[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] clean up of some maths and equations, other small ch...
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.mit.edu:/home/acquisti/work/freehaven/doc/fc03
Modified Files:
econymics.bib econymics.tex
Log Message:
clean up of some maths and equations, other small changes
Index: econymics.bib
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.bib,v
retrieving revision 1.15
retrieving revision 1.16
diff -u -d -r1.15 -r1.16
--- econymics.bib 5 Mar 2003 07:26:58 -0000 1.15
+++ econymics.bib 22 Mar 2003 19:05:30 -0000 1.16
@@ -1,236 +1,245 @@
-
-@Misc{advogato,
- author = {Raph Levien},
- title = {Advogato's Trust Metric},
- howpublished = {\newline \url{http://www.advogato.org/trust-metric.html}}
-}
-
-@Misc{anonymizer,
- key = {anonymizer},
- title = {{T}he {A}nonymizer},
- howpublished = {\url{http://www.anonymizer.com/}}
-}
-
-
-@InProceedings{back01,
- author = {Adam Back and Ulf M\"oller and Anton Stiglic},
- title = {Traffic Analysis Attacks and Trade-Offs in Anonymity Providing Systems},
- booktitle = {Information Hiding (IH 2001)},
- pages = {245--257},
- year = 2001,
- editor = {Ira S. Moskowitz},
- publisher = {Springer-Verlag, LNCS 2137}
-}
-
-
-@Book{diffiebook,
- author = {Whitfield Diffie and Susan Landau},
- title = {Privacy On the Line: The Politics of Wiretapping and
- Encryption},
- publisher = {MIT Press},
- year = 1998
-}
-
-@InProceedings{Diaz02,
- author = {Claudia D\'{\i}az and Stefaan Seys and Joris Claessens
- and Bart Preneel},
- title = {Towards measuring anonymity},
- booktitle = {Privacy Enhancing Technologies (PET 2002)},
- year = 2002,
- editor = {Roger Dingledine and Paul Syverson},
- publisher = {Springer-Verlag, LNCS 2482}
-}
-
-@Book{fudenberg-tirole-91,
- author = {Drew Fudenberg and Jean Tirole},
- title = {Game Theory},
- publisher = {MIT Press},
- year = 1991
-}
-
-@InProceedings{mix-acc,
- author = {Roger Dingledine and Michael J. Freedman and David
- Hopwood and David Molnar},
- title = {{A Reputation System to Increase MIX-net
- Reliability}},
- booktitle = {Information Hiding (IH 2001)},
- pages = {126--141},
- year = 2001,
- editor = {Ira S. Moskowitz},
- publisher = {Springer-Verlag, LNCS 2137},
- note = {\url{http://www.freehaven.net/papers.html}},
-}
-
-@InProceedings{casc-rep,
- author = {Roger Dingledine and Paul Syverson},
- title = {{Reliable MIX Cascade Networks through Reputation}},
- booktitle = {Financial Cryptography (FC '02)},
- year = 2002,
- editor = {Matt Blaze},
- publisher = {Springer-Verlag, LNCS (forthcoming)},
-}
-
-@Article{fudenberg88,
- author = {Drew Fudenberg and David K. Levine},
- title = {Open-Loop and Closed-Loop Equilibria in Dynamic
- Games with Many Players},
- journal = {Journal of Economic Theory},
- year = 1988,
- volume = 44,
- number = 1,
- pages = {1--18},
- month = {February}
-}
-
-@Article{rubinstein-82,
- author = {Ariel Rubinstein},
- title = {Perfect Equilibrium in a Bargaining Model},
- journal = {Econometrica},
- year = 1982,
- volume = 50,
- pages = {97-110}
-}
-
-@InProceedings{Serj02,
- author = {Andrei Serjantov and George Danezis},
- title = {Towards an Information Theoretic Metric for Anonymity},
- booktitle = {Privacy Enhancing Technologies (PET 2002)},
- year = 2002,
- editor = {Roger Dingledine and Paul Syverson},
- publisher = {Springer-Verlag, LNCS 2482}
-}
-
-@Article{grossman-stiglitz-80,
- author = {Sanford J. Grossman and Joseph E. Stiglitz},
- title = {On the Impossibility of Informationally Efficient Markets},
- journal = {American Economic Review},
- year = 1980,
- volume = 70,
- number = 3,
- pages = {393-408},
- month = {June}
-}
-
-@Article{mackiemason-varian-95,
-author = {Jeffrey K. MacKie-Mason and Hal R. Varian},
-title = {Pricing Congestible Network Resources},
-journal = {IEEE Journal of Selected Areas in Communications},
-year = 1995,
-volume = 13,
-number = 7,
-pages = {1141-1149},
-month = {September}
-}
-
-@InProceedings{nymserver98,
- author = {David Mazi\`{e}res and M. Frans Kaashoek},
- title = {{The Design, Implementation and Operation of an Email
- Pseudonym Server}},
- booktitle = {$5^{th}$ ACM Conference on Computer and
- Communications Security (CCS'98)},
- year = 1998,
- publisher = {ACM Press}
-}
-
-@Misc{palfrey-rosenthal-89,
-author = {Thomas R. Palfrey and Howard Rosenthal},
-title = {Underestimated Probabilities that Others Free Ride: An Experimental Test},
-year = 1989,
-howpublished = {mimeo, California Institute of Technology and Carnegie-Mellon University},
-}
-
-@Misc{acquisti-varian-02,
-author = {Alessandro Acquisti and Hal R. Varian},
-title = {Conditioning Prices on Purchase History},
-year = 2002,
-howpublished = {mimeo, University of California, Berkeley},
- note = {\url{http://www.sims.berkeley.edu/\~{}acquisti/papers/}}
-}
-
-@Article{bergstrom-blume--varian-86,
-author = {Theodore Bergstrom and Lawrence Blume and Hal R. Varian},
-title = {On the Private Provision of Public Goods},
-journal = {Journal of Public Economics},
-year = 1986,
-volume = 29,
-pages = {25-49}
-}
-
-@Book{cornes-sandler-86,
- author = {Richard Cornes and Todd Sandler},
- title = {The Theory of Externalities, Public Goods and Club Goods},
- publisher = {Cambridge University Press},
- year = 1986
-}
-
-@InProceedings{trickle02,
- author = {Andrei Serjantov and Roger Dingledine and Paul Syverson},
- title = {From a Trickle to a Flood: Active Attacks on Several
- Mix Types},
- booktitle = {Information Hiding (IH 2002)},
- year = 2002,
- editor = {Fabien Petitcolas},
- publisher = {Springer-Verlag, LNCS (forthcoming)},
-}
-
-@InProceedings{sybil,
- author = "John Douceur",
- title = {{The Sybil Attack}},
- booktitle = "1st International Peer To Peer Systems Workshop (IPTPS 2002)",
- month = Mar,
- year = 2002,
- url = {\url{http://www.cs.rice.edu/Conferences/IPTPS02/}}
-}
-
-@InProceedings{mojo,
- author = "Bryce Wilcox-O'Hearn",
- title = {{Experiences Deploying a Large-Scale Emergent Network}},
- booktitle = "1st International Peer To Peer Systems Workshop (IPTPS 2002)",
- month = Mar,
- year = 2002,
- url = {\url{http://www.cs.rice.edu/Conferences/IPTPS02/}}
-}
-
-@InProceedings{raymond00,
- author = {J. F. Raymond},
- title = {{Traffic Analysis: Protocols, Attacks, Design Issues,
- and Open Problems}},
- booktitle = {Designing Privacy Enhancing Technologies: Workshop
- on Design Issue in Anonymity and Unobservability},
- year = 2000,
- month = {July},
- pages = {10--29},
- editor = {H. Federrath},
- publisher = {Springer-Verlag, LNCS 2009},
-}
-
-@Misc{seti-stats,
- author = {UC Berkeley},
- title = {{SETI@home: Search for Extraterrestrial Intelligence at Home}},
- howpublished = {\url{http://setiathome.ssl.berkeley.edu/}},
-}
-
-@InProceedings{syverson_2000,
- author = {Paul F. Syverson and Gene Tsudik and Michael G. Reed
- and Carl E. Landwehr},
- title = {Towards an Analysis of Onion Routing Security},
- booktitle = {Designing Privacy Enhancing Technologies: Workshop
- on Design Issue in Anonymity and Unobservability},
- year = 2000,
- month = {July},
- pages = {96--114},
- editor = {H. Federrath},
- publisher = {Springer-Verlag, LNCS 2009},
- note = {\url{http://citeseer.nj.nec.com/syverson00towards.html}}
-}
-
-@InProceedings{gup,
- author = {Stuart G. Stubblebine and Paul F. Syverson},
- title = {Authentic Attributes with Fine-Grained Anonymity Protection},
- booktitle = {Financial Cryptography (FC 2000)},
- pages = {276--294},
- year = 2001,
- editor = {Yair Frankel},
- publisher = {Springer-Verlag, LNCS 1962}
-}
-
+
+@Misc{advogato,
+ author = {Raph Levien},
+ title = {Advogato's Trust Metric},
+ howpublished = {\newline \url{http://www.advogato.org/trust-metric.html}}
+}
+
+@Misc{anonymizer,
+ key = {anonymizer},
+ title = {{T}he {A}nonymizer},
+ howpublished = {\url{http://www.anonymizer.com/}}
+}
+
+
+@InProceedings{back01,
+ author = {Adam Back and Ulf M\"oller and Anton Stiglic},
+ title = {Traffic Analysis Attacks and Trade-Offs in Anonymity Providing Systems},
+ booktitle = {Information Hiding (IH 2001)},
+ pages = {245--257},
+ year = 2001,
+ editor = {Ira S. Moskowitz},
+ publisher = {Springer-Verlag, LNCS 2137}
+}
+
+
+@Book{diffiebook,
+ author = {Whitfield Diffie and Susan Landau},
+ title = {Privacy On the Line: The Politics of Wiretapping and
+ Encryption},
+ publisher = {MIT Press},
+ year = 1998
+}
+
+@InProceedings{Diaz02,
+ author = {Claudia D\'{\i}az and Stefaan Seys and Joris Claessens
+ and Bart Preneel},
+ title = {Towards measuring anonymity},
+ booktitle = {Privacy Enhancing Technologies (PET 2002)},
+ year = 2002,
+ editor = {Roger Dingledine and Paul Syverson},
+ publisher = {Springer-Verlag, LNCS 2482}
+}
+
+@Book{fudenberg-tirole-91,
+ author = {Drew Fudenberg and Jean Tirole},
+ title = {Game Theory},
+ publisher = {MIT Press},
+ year = 1991
+}
+
+@InProceedings{mix-acc,
+ author = {Roger Dingledine and Michael J. Freedman and David
+ Hopwood and David Molnar},
+ title = {{A Reputation System to Increase MIX-net
+ Reliability}},
+ booktitle = {Information Hiding (IH 2001)},
+ pages = {126--141},
+ year = 2001,
+ editor = {Ira S. Moskowitz},
+ publisher = {Springer-Verlag, LNCS 2137},
+ note = {\url{http://www.freehaven.net/papers.html}},
+}
+
+@InProceedings{casc-rep,
+ author = {Roger Dingledine and Paul Syverson},
+ title = {{Reliable MIX Cascade Networks through Reputation}},
+ booktitle = {Financial Cryptography (FC '02)},
+ year = 2002,
+ editor = {Matt Blaze},
+ publisher = {Springer-Verlag, LNCS (forthcoming)},
+}
+
+@Article{fudenberg88,
+ author = {Drew Fudenberg and David K. Levine},
+ title = {Open-Loop and Closed-Loop Equilibria in Dynamic
+ Games with Many Players},
+ journal = {Journal of Economic Theory},
+ year = 1988,
+ volume = 44,
+ number = 1,
+ pages = {1--18},
+ month = {February}
+}
+
+@Article{rubinstein-82,
+ author = {Ariel Rubinstein},
+ title = {Perfect Equilibrium in a Bargaining Model},
+ journal = {Econometrica},
+ year = 1982,
+ volume = 50,
+ pages = {97-110}
+}
+
+@InProceedings{Serj02,
+ author = {Andrei Serjantov and George Danezis},
+ title = {Towards an Information Theoretic Metric for Anonymity},
+ booktitle = {Privacy Enhancing Technologies (PET 2002)},
+ year = 2002,
+ editor = {Roger Dingledine and Paul Syverson},
+ publisher = {Springer-Verlag, LNCS 2482}
+}
+
+@Article{grossman-stiglitz-80,
+ author = {Sanford J. Grossman and Joseph E. Stiglitz},
+ title = {On the Impossibility of Informationally Efficient Markets},
+ journal = {American Economic Review},
+ year = 1980,
+ volume = 70,
+ number = 3,
+ pages = {393-408},
+ month = {June}
+}
+
+@Article{mackiemason-varian-95,
+author = {Jeffrey K. MacKie-Mason and Hal R. Varian},
+title = {Pricing Congestible Network Resources},
+journal = {IEEE Journal of Selected Areas in Communications},
+year = 1995,
+volume = 13,
+number = 7,
+pages = {1141-1149},
+month = {September}
+}
+
+@InProceedings{nymserver98,
+ author = {David Mazi\`{e}res and M. Frans Kaashoek},
+ title = {{The Design, Implementation and Operation of an Email
+ Pseudonym Server}},
+ booktitle = {$5^{th}$ ACM Conference on Computer and
+ Communications Security (CCS'98)},
+ year = 1998,
+ publisher = {ACM Press}
+}
+
+@Misc{palfrey-rosenthal-89,
+author = {Thomas R. Palfrey and Howard Rosenthal},
+title = {Underestimated Probabilities that Others Free Ride: An Experimental Test},
+year = 1989,
+howpublished = {mimeo, California Institute of Technology and Carnegie-Mellon University},
+}
+
+@Misc{acquisti-varian-02,
+author = {Alessandro Acquisti and Hal R. Varian},
+title = {Conditioning Prices on Purchase History},
+year = 2002,
+howpublished = {mimeo, University of California, Berkeley},
+ note = {\url{http://www.sims.berkeley.edu/\~{}acquisti/papers/}}
+}
+
+@Article{bergstrom-blume--varian-86,
+author = {Theodore Bergstrom and Lawrence Blume and Hal R. Varian},
+title = {On the Private Provision of Public Goods},
+journal = {Journal of Public Economics},
+year = 1986,
+volume = 29,
+pages = {25-49}
+}
+
+@Book{cornes-sandler-86,
+ author = {Richard Cornes and Todd Sandler},
+ title = {The Theory of Externalities, Public Goods and Club Goods},
+ publisher = {Cambridge University Press},
+ year = 1986
+}
+
+@InProceedings{trickle02,
+ author = {Andrei Serjantov and Roger Dingledine and Paul Syverson},
+ title = {From a Trickle to a Flood: Active Attacks on Several
+ Mix Types},
+ booktitle = {Information Hiding (IH 2002)},
+ year = 2002,
+ editor = {Fabien Petitcolas},
+ publisher = {Springer-Verlag, LNCS (forthcoming)},
+}
+
+@InProceedings{sybil,
+ author = "John Douceur",
+ title = {{The Sybil Attack}},
+ booktitle = "1st International Peer To Peer Systems Workshop (IPTPS 2002)",
+ month = Mar,
+ year = 2002,
+ url = {\url{http://www.cs.rice.edu/Conferences/IPTPS02/}}
+}
+
+@InProceedings{mojo,
+ author = "Bryce Wilcox-O'Hearn",
+ title = {{Experiences Deploying a Large-Scale Emergent Network}},
+ booktitle = "1st International Peer To Peer Systems Workshop (IPTPS 2002)",
+ month = Mar,
+ year = 2002,
+ url = {\url{http://www.cs.rice.edu/Conferences/IPTPS02/}}
+}
+
+@InProceedings{raymond00,
+ author = {J. F. Raymond},
+ title = {{Traffic Analysis: Protocols, Attacks, Design Issues,
+ and Open Problems}},
+ booktitle = {Designing Privacy Enhancing Technologies: Workshop
+ on Design Issue in Anonymity and Unobservability},
+ year = 2000,
+ month = {July},
+ pages = {10--29},
+ editor = {H. Federrath},
+ publisher = {Springer-Verlag, LNCS 2009},
+}
+
+@Misc{seti-stats,
+ author = {UC Berkeley},
+ title = {{SETI@home: Search for Extraterrestrial Intelligence at Home}},
+ howpublished = {\url{http://setiathome.ssl.berkeley.edu/}},
+}
+
+@InProceedings{syverson_2000,
+ author = {Paul F. Syverson and Gene Tsudik and Michael G. Reed
+ and Carl E. Landwehr},
+ title = {Towards an Analysis of Onion Routing Security},
+ booktitle = {Designing Privacy Enhancing Technologies: Workshop
+ on Design Issue in Anonymity and Unobservability},
+ year = 2000,
+ month = {July},
+ pages = {96--114},
+ editor = {H. Federrath},
+ publisher = {Springer-Verlag, LNCS 2009},
+ note = {\url{http://citeseer.nj.nec.com/syverson00towards.html}}
+}
+
+@InProceedings{gup,
+ author = {Stuart G. Stubblebine and Paul F. Syverson},
+ title = {Authentic Attributes with Fine-Grained Anonymity Protection},
+ booktitle = {Financial Cryptography (FC 2000)},
+ pages = {276--294},
+ year = 2001,
+ editor = {Yair Frankel},
+ publisher = {Springer-Verlag, LNCS 1962}
+}
+
+@Article{chaum81,
+ author = {David Chaum},
+ title = {Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms},
+ journal = {Communications of the ACM},
+ year = 1981,
+ volume = 24,
+ number = 2,
+ pages = "84-88"
+}
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.50
retrieving revision 1.51
diff -u -d -r1.50 -r1.51
--- econymics.tex 7 Mar 2003 22:41:51 -0000 1.50
+++ econymics.tex 22 Mar 2003 19:05:30 -0000 1.51
@@ -94,7 +94,7 @@
hesitant to use an anonymity infrastructure they do not control. However,
on an open network such as the Internet, running one's own system won't work:
a system that carries traffic for only one organization will not hide the
-traffic entering and leaving that organization.
+traffic entering and leaving that organization.
Nodes must carry traffic from others to provide cover.
%Yet those others don't want to trust their
%traffic to a single entity either.
@@ -152,23 +152,24 @@
In this section and those that follow, we formalize the economic
analysis of why people might choose to send messages through
-mix-nets.\footnote{Mixes were introduced by David Chaum. A mix takes in
-a batch of messages, changes their appearance, and sends them out in a
-new order, thus obscuring the relation of incoming to outgoing messages.}
-Here we
-discuss the incentives for the agents to participate either as senders
-or also as nodes, and we propose a general framework for their
-analysis. In the next section we consider various applications of our
-framework, and then in Section \ref{sec:alternate-incentives} we
-examine alternate incentive mechanisms.
+mix-nets.\footnote{Mixes were introduced by David Chaum (see
+\cite{chaum81}). A mix takes in a batch of messages, changes their
+appearance, and sends them out in a new order, thus obscuring the
+relation of incoming to outgoing messages.} Here we discuss the
+incentives for some ``agents'' to participate either as senders or
+also as nodes, and we propose a general framework for their
+analysis. In the next section we consider various applications of
+our framework, and then in Section \ref{sec:alternate-incentives}
+we examine alternate incentive mechanisms.
-We begin with the assumption that agents value
-their privacy. This value might be related to profits they will make
-by keeping their messages anonymous, or to losses they will avoid by
-not having their messages tracked. Different agents might value
-anonymity differently.
+We begin with two assumptions: the agents want to send messages to
+other parties, and the agents value their privacy. This value
+might be related to profits they will make by keeping their
+messages anonymous, or to losses they will avoid by not having
+their messages tracked. Different agents might value anonymity
+differently.
-An agent $i$ (where $i=(1,...,N)$ and $N$ is the number of
+An agent $i$ (where $i=(1,...,n)$ and $n$ is the number of
potential participants in the mix-net) bases her strategy on the
following possible actions $a_{i}$:
@@ -192,27 +193,28 @@
\end{enumerate}
Various benefits and costs are associated with each agent's action
-and the simultaneous actions of the other agents. The benefits
-include:
+and the simultaneous actions of the other agents. The expected
+benefits include:
\begin{enumerate}
-\item Benefits from sending messages anonymously. We model them
+\item Expected benefits from sending messages anonymously. We model them
as a function of the subjective value each agent $i$ places on the
information successfully arriving at its destination, $v_{r_{i}}$;
the subjective value of keeping her identity anonymous,
$v_{a_{i}}$; the perceived level of anonymity in the system,
-$p_{a}$ (the probability that the sender and message will remain
-anonymous); and the perceived level of reliability in the system,
-$p_{r}$ (the probability that the message will be delivered). The
-subjective value of maintaining anonymity could be related to the
-profits the agent expects to make by keeping that information
-anonymous, or the losses the agents expects to avoid by keeping
-that information anonymous. We represent the level of anonymity in
-the system as a function of the traffic (number of agents sending
-messages in the system, $n_{s}$), the number of nodes (number of
-agents acting as honest nodes, $n_{h}$, and as dishonest nodes,
-$n_{d}$), and the decisions of the agent. We assume that this
-function maps these factors into a probability
+$p_{a_{i}}$ (the subjective probability that the sender and
+message will remain anonymous); and the perceived level of
+reliability in the system, $p_{r_{i}}$ (the subjective probability
+that the message will be delivered). The subjective value of
+maintaining anonymity could be related to the profits the agent
+expects to make by keeping that information anonymous, or the
+losses the agents expects to avoid by keeping that information
+anonymous. We represent the level of anonymity in the system as a
+function of the traffic (number of agents sending messages in the
+system, $n_{s}$), the number of nodes (number of agents acting as
+honest nodes, $n_{h}$, and as dishonest nodes, $n_{d}$), and the
+decisions of the agent. We assume the existence of a function that
+maps these factors into a probability
measure $p\in \left[0,1\right]$.\footnote{%
Information theoretic anonymity metrics \cite{Diaz02,Serj02}
probably provide better measures of anonymity: such work shows how
@@ -223,16 +225,15 @@
particular:
\begin{itemize}
-\item The number of users of the system is positively correlated to the
-level of anonymity of the system.
+\item The level of anonymity of the system is positively correlated to the number of users of the system.
\item Acting as an honest node improves anonymity. Senders who do not
-run a node may accidentally choose a dishonest node as their first hop,
-significantly decreasing their anonymity (especially in low-latency
-anonymity systems where end-to-end timing attacks are very hard to
-prevent \cite{back01}). Further, agents who run a
-node can undetectably blend their message into their node's traffic,
-so an observer cannot know even when the message is sent.
+run a node may accidentally choose a dishonest node as their first
+hop, significantly decreasing their anonymity (especially in
+low-latency anonymity systems where end-to-end timing attacks are
+very hard to prevent \cite{back01}). Further, agents who run a
+node can undetectably blend their message into their node's
+traffic, so an observer cannot know when the message is sent.
\item The relation between the number of nodes and the
probability of remaining anonymous might not be monotonic. For a
@@ -260,7 +261,7 @@
or by using the information that passes through them), $b_{d}$.
\end{enumerate}
-The possible costs include:
+The possible expected costs include:
\begin{enumerate}
\item Costs of sending messages through the anonymous system, $c_s$,
@@ -310,33 +311,36 @@
brings that node more traffic, and therefore more possibilities to
hide that node's messages; similarly, being perceived as a
dishonest node might bring traffic away from that node). In this
-case, they would enter the utility functions only indirectly
-through the changes they provoke in the behavior of the agents. In
-other cases, reputation costs and benefits might be valued
-\textit{per se}. While we do not consider this option in the
-simplified model below, Sections \ref{sec:alternate-incentives} and
-\ref{sec:roadblocks} discuss the impact of reputation on the model.
+case, they would enter the payoff functions only indirectly
+through other parameters (such as the probability of remaining
+anonymous) and the changes they provoke in the behavior of the
+agents. In other cases, reputation costs and benefits might be
+valued \textit{per se}. While we do not consider either of these
+options in the simplified model below, Sections
+\ref{sec:alternate-incentives} and \ref{sec:roadblocks} discuss
+the impact of reputation on the model.
-We assume that agents want to maximize their expected utility,
+We assume that agents want to maximize their expected payoff,
which is a function of expected benefits minus expected costs. Let
-$S_{i}$ denote the set of strategies available to player $i$, and
+$S_{i}$ denote the set of strategies available to agent $i$, and
$s_{i}$ a certain member of that set. Each strategy $s_{i}$ is
based on the the
actions $a_{i}$ discussed above. The combination of strategies $%
-(s_{1},...,s_{N})$, one for each player, determines the outcome of
-the game and the associated payoff for each agent. Hence, for each
-complete strategy profile $s=(s_{1},...,s_{N})$ each agent
-receives a von Neumann-Morgenstern utility $u_{i}\left(s\right)$.
-We represent the payoff function for each agent $i$ in the
-following form:
+(s_{1},...,s_{n})$, one for each agent who participates to the
+mix-net, determines the outcome of the game and the associated
+payoff for each agent. Hence, for each complete strategy profile
+$s=(s_{1},...,s_{n})$ each agent receives the expected payoff
+$u_{i}\left(s\right)$ through the payoff function $u(.)$. We
+represent the payoff function for each agent $i$ in the following
+form:
\begin{equation*}
u_{i}=u\left(
\begin{array}{c}
-\theta \left[ \gamma \left( v_{r_{i}},p_{r}\left(
-n_{h},n_{d}\right) \right) ,\partial \left( v_{a_{i}},p_{a}\left(
-n_{s},n_{h},n_{d},a_{i}^{s}\right) \right) ,a_{i}^{s}\right] \, +
-\,
+\theta \left[ \gamma \left( v_{r_{i}},p_{r_{i}}\left(
+n_{h},n_{d},a_{h}^{s}\right) \right) ,\partial \left(
+v_{a_{i}},p_{a_{i}}\left( n_{s},n_{h},n_{d},a_{h}^{s}\right)
+\right) ,a_{i}^{s}\right] \, + \,
b_{h}a_{i}^{h}+\\
b_{d}a_{i}^{d} - c_{s}\left( n_{s},n_{h}\right)
a_{i}^{s}-c_{h}\left( n_{s},n_{h},n_{d}\right)
@@ -346,45 +350,47 @@
\right)
\end{equation*}
-\noindent where $\theta, \gamma$, and $\partial$ are unspecified
-functional forms. The payoff function $u$ includes the costs and
-benefits for all the possible actions of the agents, including
-\textit{not} using the mix-net and instead sending the messages
-through a non-anonymous channel. We can represent the various
+\noindent where $\theta(.), \gamma(.)$, and $\partial(.)$ are
+unspecified functional forms. The payoff function $u(.)$ includes
+the costs and benefits for all the possible actions of the agents,
+including \textit{not} using the mix-net and instead sending the
+messages through a non-anonymous channel. We can represent the
+various
strategies by using dummy variables for the various $a_{i}$.\footnote{%
For example, if the agent chooses not to send the message anonymously, the
-probability of remaining anonymous $p_{a}$ will be equal to zero, $%
+probability of remaining anonymous $p_{a_{i}}$ will be equal to zero, $%
a^{s,d,r,h}$ will be zero too, and the only cost in the function will be $%
-c_{n}$.} Note that $\gamma $ and $\partial$ describe the
-probability of a message being delivered and a message remaining
-anonymous, respectively. We weight these probabilities with the
-values $v_{r_{i},a_{i}}$ because different agents might value
-anonymity and reliability differently, and because in different
-scenarios anonymity and reliability for the same agent might have
-different impacts on her payoff.
-In Section~\ref{sec:application}, we will make a number of assumptions
-that will allow us to simplify this equation.
-We present here for the reader's convenience a table summarizing those
-variables that will appear in both the complete and simplified
-equations, as well as one that describes the variables used only in
-the more complete equation above.
+c_{n}$.} We note that the probabilities of a message being
+delivered and a message remaining anonymous are weighted with the
+values $v_{r_{i}},v_{a_{i}}$, respectively. This is because
+different agents might value anonymity and reliability
+differently, and because in different scenarios anonymity and
+reliability for the same agent might have different impacts on her
+payoff.
+
+In Section~\ref{sec:application}, we will make a number of
+assumptions that will allow us to simplify this equation and model
+certain scenarios. We present here for the reader's convenience a
+table summarizing those variables that will appear in both the
+complete and simplified equations, as well as one that describes
+the variables used only in the more complete equation above.
\begin{center}
\begin{tabular}{|c|cl|}
-\hline
-\multicolumn{3}{|c|}{Variables used in both full and simple payoff equations} \\ \hline
-\hline
-&$u_i$ & utility for agent $i$ \\ \cline{2-3}
-&$v_{a_i}$ & disutility $i$ attaches to message exposure \\ \cline{2-3}
-&$p_a$ & prob.\ that a sent message loses anonymity \\ \hline
-number of nodes&$n_s$ & sending agents (sending nodes) \\ \cline{2-3}
-(other than $i$)&$n_h$ & honest nodes \\ \cline{2-3}
-in mix-net&$n_d$ & dishonest nodes\\ \hline
-dummy variables:&$a^h_i$ & $i$ is an honest node and sending agent \\ \cline{2-3}
-$1$ if true, $0$ otherwise&$a^s_i$ & $i$ sends through the mix-net \\ \hline
-&$c_s$ & of sending a message through the mix-net\\ \cline{2-3}
-costs &$c_h$ & of running an honest node \\ \cline{2-3}
+\hline \multicolumn{3}{|c|}{Variables used in both full and simple
+payoff equations} \\ \hline \hline &$u_i$ & payoff for agent $i$ \\
+\cline{2-3} &$v_{a_i}$ & disutility $i$ attaches to message
+exposure \\ \cline{2-3} &$p_a$ & prob.\ that a sent message
+loses anonymity \\ \hline number of nodes&$n_s$ & sending
+agents (sending nodes) \\ \cline{2-3} (other than $i$)&$n_h$ &
+honest nodes \\ \cline{2-3} in mix-net&$n_d$ & dishonest
+nodes\\ \hline dummy variables:&$a^h_i$ & $i$ is an honest node
+and sending agent \\ \cline{2-3} $1$ if true, $0$
+otherwise&$a^s_i$ & $i$ sends through the mix-net \\ \hline
+&$c_s$ & of sending a message through the mix-net\\
+\cline{2-3} costs &$c_h$ & of running an honest node \\
+\cline{2-3}
&$c_n$ & of sending a message around the mix-net\\
\hline
\end{tabular}
@@ -405,15 +411,18 @@
\end{tabular}
\end{center}
+%Paul, is the ``1'' right before ``$i$ receives dummy traffic'' correct?
+%Also - these tables are a great addition! I have changed the prob values in the full version, to show that we believe that the more accurate version would include sub. prob, but, given that we do not have enough info to model them that way, we keep ``normal'' probabilities in the simplified version. Should we update these two tables accordingly?
+
Note also that the costs and benefits from sending the message
-might be distinct from the costs and benefits from keeping the
+could be distinct from the costs and benefits from keeping the
\emph{information} anonymous. For example, when Alice anonymously
purchases a book, she gains a profit equal to the difference
between her valuation of the book and its price. But if her
anonymity is compromised during the process, she could incur
losses (or miss profits) completely independent from the price of
-the book or her valuation of it. The payoff function $u$ above
+the book or her valuation of it. The payoff function $u(.)$ above
allows us to represent the duality implicit in all privacy issues,
as well as the distinction between the value of sending a message
and the value of keeping it anonymous:
@@ -447,23 +456,21 @@
\end{tabular}
\end{equation*}
-Henceforth, we always assume that the agent has an incentive to
-send a message as well as to keep it anonymous. We also always
-consider the direct benefits or losses rather than their dual
-opportunity costs or avoided costs. Nevertheless, the above
-representation allows us to formalize the various possible
-combinations. For example, if a certain message is sent to gain
-some benefit, but anonymity must be protected in order to avoid
-losses, then $v_{r_{i}}$ will be positive while $v_{a_{i}}$ will
-be negative and $p_{a}$ will enter the payoff
-function as $\left( 1-p_{a}\right) $.\footnote{%
+Henceforth, we will consider the direct benefits or losses rather
+than their dual opportunity costs or avoided costs. Nevertheless,
+the above representation allows us to formalize the various
+possible combinations. For example, if a certain message is sent
+to gain some benefit, but anonymity must be protected in order to
+avoid losses, then $v_{r_{i}}$ will be positive while $v_{a_{i}}$
+will be negative and $p_{a_{i}}$ will enter the payoff
+function as $\left( 1-p_{a_{i}}\right) $.\footnote{%
Being certain of staying anonymous would therefore eliminate the
risk of $v_{a_{i}}$, while being certain of losing anonymity would
impose on the agent the full cost $v_{a_{i}}$.} On the other side,
if the agent must send a certain message to avoid some losses but
anonymity ensures her some benefits, then $v_{r_{i}}$ will be
-negative and $p_{r}$ will enter the
-payoff function as $\left( 1-p_{r}\right) $, while $v_{a_{i}}$ will be positive.%
+negative and $p_{r_{i}}$ will enter the
+payoff function as $\left( 1-p_{r_{i}}\right) $, while $v_{a_{i}}$ will be positive.%
\footnote{Similarly, guaranteed delivery will eliminate the risk
of losing $v_{r_{i}}$, while delivery failure will impose the full
cost $v_{r_{i}}$.}
@@ -478,33 +485,35 @@
\label{sec:application}
-In this section we apply the above framework to simple scenarios. We make a
-number of assumptions to let us model the behavior of the participants as
-players in a repeated-game, simultaneous-move game theoretical framework.
-Thus we can analyze the economic justifications for the various
-choices of the participants, and compare design approaches to mix-net
-systems.
+In this section we apply the above framework to simple scenarios.
+We make a number of assumptions to let us model the behavior of
+mix-net participants as players in a repeated-game,
+simultaneous-move game theoretical framework. Thus we can analyze
+the economic justifications for the various choices of the
+participants, and compare design approaches to mix-net systems.
Consider a set of $n_{s}$ agents interested in sending anonymous
communications. Imagine that there is only one system which can be
used to send anonymous messages, and one other system to send
-non-anonymous messages. Each user has three options: only send her
-own messages through the mix-net; send her messages but also act
-as a node forwarding messages from other users; or don't use the
-system at all (by sending a message without anonymity, or by not
-sending the message at all). Thus initially we do not consider the
+non-anonymous messages. Each agent has three options: only send
+her own messages through the mix-net; send her messages but also
+act as a node forwarding messages from other users; or don't use
+the system at all (by sending a message without anonymity, or by
+not sending the message). Thus initially we do not consider the
strategy of choosing to be a bad node, or additional honest
-strategies like creating and receiving dummy traffic. We represent
-the game as a simultaneous-move, repeated game because of the
-large number of participants and because of the impact of earlier
-actions on future strategies. A large group will have no
-discernable or agreeable order for the actions of all
+strategies like creating and receiving dummy traffic.
+
+We represent the game as a simultaneous-move, repeated game
+because of the large number of participants and because of the
+impact of earlier actions on future strategies. A large group will
+have no discernable or agreeable order for the actions of all
participants, so actions can be considered simultaneous. The
limited commitment produced by earlier actions allows us to
consider a repeated-game
scenario.\footnote{%
-In Section \ref{sec:model} we have highlighted that for both nodes and
-simpler users variable costs are more significant than fixed costs.}
+In Section \ref{sec:model} we have highlighted that for both nodes
+and simpler users variable costs are more significant than fixed
+costs.}
%Roger, is this the case or not? ie are traffic related costs the highest ones? -AA
% I think variable costs are higher than fixed costs, but variable costs
% are not solely due to bandwidth prices. see comment above -RD
@@ -516,22 +525,24 @@
\subsection{Adversary}
-Although strategic agents cannot choose to be bad nodes in this simplified
-scenario, we still assume there is a percentage of bad nodes and that
-agents respond
-to this possibility. Specifically we assume a global passive adversary (GPA)
-that can observe all traffic on all links (between users and nodes, between
-nodes, and between nodes or users and recipients). Additionally, we also
-study the case when the adversary includes some percentage of mix nodes. In
-choosing strategies agents will attach a subjective probability to arbitrary
-nodes being compromised --- all nodes not run by the agent are assigned the
-same probability of being compromised. This factor influences their
-assessment of the anonymity of messages they send. A purely passive
-adversary is unrealistic in most settings, e.g., it assumes that hostile
-users never selectively send messages at certain times or routes, and nodes
-and links never selectively trickle or flood messages \cite{trickle02}.
-Nonetheless, a \emph{global} passive adversary is still quite strong, and
-thus a typical starting point of anonymity analyses.
+Although strategic agents cannot choose to be bad nodes in this
+simplified scenario, we still assume there is a percentage of bad
+nodes and that agents respond to this possibility. Specifically we
+assume a global passive adversary (GPA) that can observe all
+traffic on all links (between users and nodes, between nodes, and
+between nodes or users and recipients). Additionally, we also
+study the case when the adversary includes some percentage of mix
+nodes. In choosing strategies agents will attach a subjective
+probability to arbitrary nodes being compromised --- all nodes not
+run by the agent are assigned the same probability of being
+compromised. This factor influences their assessment of the
+anonymity of messages they send. A purely passive adversary is
+unrealistic in most settings, e.g., it assumes that hostile users
+never selectively send messages at certain times or routes, and
+nodes and links never selectively trickle or flood messages
+\cite{trickle02}. Nonetheless, a \emph{global} passive adversary
+is still quite strong, and thus a typical starting point of
+anonymity analyses.
% FIXME say more
\subsection{Honest Agents}
@@ -552,16 +563,16 @@
also assume that all agents know the number of agents using the
system and which of them are acting as nodes. We also assume that
all agents perceive the same level of anonymity in the system
-based on traffic and number of nodes. Finally, we imagine that
-agents use the system because they want to avoid potential losses
-from not being anonymous. This subjective sensitivity to anonymity
+based on traffic and number of nodes, hence $p_{a_{i}}=p_{a}$ for
+all $i$. Finally, we imagine that agents use the system because
+they want to avoid potential losses from not being anonymous. This
+subjective sensitivity to anonymity
is represented by $v_{a_{i}}$ (%see Section \ref{sec:model};
-we can
-initially imagine $v_{a_{i}}$ as a continuous variable with a
-certain distribution across all agents; see below). In other
+we can initially imagine $v_{a_{i}}$ as a continuous variable with
+a certain distribution across all agents; see below). In other
words, we initially focus on the goal of remaining anonymous given
an adversary that can control some nodes and observe all
-communications. We later comment on the addition reliability
+communications. We later comment on the additional reliability
issues.
%These assumptions let us re-write the payoff function presented in
@@ -579,12 +590,11 @@
honest and dishonest nodes, and the action $a$ of agent $i$
itself. This chance is weighted by $v_{a_{i}}$, the disutility
agent $i$ derives from its message being exposed. We also include
-the costs of sending a message through the mix-net, acting
-as a node when there are $n_{s}$ agents sending messages over
-$n_{h}$ and $n_{d}$ nodes, and sending messages through a
-non-anonymous system, respectively. Each period, a rational agent
-can compare the utility coming from each of these three one-period
-strategies.
+the costs of sending a message through the mix-net, acting as a
+node when there are $n_{s}$ agents sending messages over $n_{h}$
+and $n_{d}$ nodes, and sending messages through a non-anonymous
+system, respectively. Each period, a rational agent can compare
+the payoff coming from each of these three one-period strategies.
\begin{equation*}
\begin{tabular}{cc}
Action & Payoff \\
@@ -597,19 +607,18 @@
$a_{n}$ & $-v_{a_{i}}-c_{n}$%
\end{tabular}
\end{equation*}
-We do not explicitly allow the agent to choose \textit{not} to send a
-message at all, which would of course minimize the risk of anonymity
-compromise.
-Also, we do not explicitly report the value of sending a successful message.
-Both are simplifications that do not alter the rest of the analysis.
-\footnote{We could insert an action $a^{0}$ with a certain
-disutility from not sending any message, and then solve the
-problem of minimizing the expected
+We do not explicitly allow the agent to choose \textit{not} to
+send a message at all, which would of course minimize the risk of
+anonymity compromise. Also, we do not explicitly report the value
+of sending a successful message. Both are simplifications that do
+not alter the rest of the analysis. \footnote{We could insert an
+action $a^{0}$ with a certain disutility or cost from not sending
+any message, and then solve the problem of minimizing the expected
losses. Or, we could insert in the payoff function for actions $%
-a^{s,h,n}$ also the utility of successfully sending a message
+a^{s,h,n}$ also the payoff from successfully sending a message
compared to not sending it (which could be interpreted also as an
opportunity cost), and solve the dual problem of maximizing the
-expected utility. Either way, the ``exit'' strategy for each agent
+expected payoff. Either way, the ``exit'' strategy for each agent
will either be sending a message non-anonymously, or not sending
it at all, depending on which option maximizes the expected
benefits or minimizes the expected losses. Thereafter, we can
@@ -626,20 +635,20 @@
actions. They simply consider the status of the network and,
depending on the payoffs of the one-period game, adopt a certain
strategy. Suppose that a new agent with a privacy sensitivity
-$v_{a_{i}}$ is considering using a mix-net with $\bar{n}_{s}$
-users and $\bar{n}_{h}$ honest nodes.
+$v_{a_{i}}$ is considering using a mix-net with (\emph{currently})
+$n_{s}$ users and $n_{h}$ honest nodes.
Then if
\begin{equation*}
\begin{tabular}{c}
-$-v_{a_{i}}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
+$-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h}+1,n_{d},a_{i}^{h}%
+\right) \right) -c_{s}-c_{h}\left( n_{s}+1,n_{h}+1,n_{d}\right)
$ \\
-$<-v_{a_{i}}\left( 1-p_{a}\left(
-\bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
+$<-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h},n_{d}\right)
+\right)
-c_{s},$ and \\
-$-v_{a_{i}}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
+$-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h}+1,n_{d},a_{i}^{h}%
+\right) \right) -c_{s}-c_{h}\left( n_{s}+1,n_{h}+1,n_{d}\right)
$ \\
$<-v_{a_{i}}-c_{n}$%
\end{tabular}
@@ -647,19 +656,18 @@
agent $i$ will choose to become a node in the mix-net. If
\begin{equation*}
\begin{tabular}{c}
-$-v_{a_{i}}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
+$-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h}+1,n_{d},a_{i}^{h}%
+\right) \right) -c_{s}-c_{h}\left( n_{s}+1,n_{h}+1,n_{d}\right)
$ \\
-$>-v_{a_{i}}\left( 1-p_{a}\left(
-\bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
+$>-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h},n_{d}\right)
+\right)
-c_{s},$ and \\
-$-v_{a_{i}}\left( 1-p_{a}\left(
-\bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
+$-v_{a_{i}}\left( 1-p_{a}\left( n_{s}+1,n_{h},n_{d}\right) \right)
-c_{s}<-v_{a_{i}}-c_{n}$%
\end{tabular}
\end{equation*}
-then agent $i$ will choose to be a user of the system. Otherwise, $i$ will
-simply not use the system.
+then agent $i$ will choose to be a user of the mix-net. Otherwise,
+$i$ will simply not use the mix-net.
Our goal is to highlight the economic rationale implicit in the
above inequalities. In the first case agent $i$ is comparing the
@@ -686,29 +694,31 @@
other agent's type, but we then discuss what happens when
there is uncertainty about the other agents' types.
-Suppose that each of agent $i$ and agent $j$ considers the other agent's
-reaction function in her decision process. Let:
+Suppose that each of agent $i$ and agent $j$ considers the other
+agent's reaction function in her decision process. Then we can
+summarize the payoff matrix in the following way:\footnote{We use
+parameters to succinctly represent the following expected payoffs:
\begin{equation*}
\begin{tabular}{c}
-$A_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}%
-_{h}+2,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n%
-}_{h}+2,n_{d}\right) $ \\
-$B_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d}\right)
+$A_{w}=-v_{w}\left( 1-p_{a}\left(
+n_{s}+2,n_{h}+2,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left(
+n_{s}+2,n_{h}+2,n_{d}\right) $ \\
+$B_{w}=-v_{w}\left( 1-p_{a}\left( n_{s}+2,n_{h}+1,n_{d}\right)
\right) -c_{s}$ \\
$C_{w}=-v_{w}-c_{n}$ \\
-$D_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}%
-_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n%
-}_{h}+1,n_{d}\right) $ \\
-$E_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}%
-_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n%
-}_{h}+1,n_{d}\right) $ \\
-$F_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h},n_{d}\right)
+$D_{w}=-v_{w}\left( 1-p_{a}\left(
+n_{s}+2,n_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left(
+n_{s}+2,n_{h}+1,n_{d}\right) $ \\
+$E_{w}=-v_{w}\left( 1-p_{a}\left(
+n_{s}+1,n_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left(
+n_{s}+1,n_{h}+1,n_{d}\right) $ \\
+$F_{w}=-v_{w}\left( 1-p_{a}\left( n_{s}+2,n_{h},n_{d}\right)
\right) -c_{s}$ \\
-$G_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right)
+$G_{w}=-v_{w}\left( 1-p_{a}\left( n_{s}+1,n_{h},n_{d}\right)
\right) -c_{s}$%
\end{tabular}
\end{equation*}
-Then we can represent the payoff matrix as:
+}
\begin{equation*}
\begin{tabular}{cccc}
{\tiny Agent i / Agent j} & $a_{j}^{h}$ & $a_{j}^{s}$ & $a_{j}^{n}$ \\
@@ -717,22 +727,24 @@
$a_{i}^{n}$ & $C_{i},E_{j}$ & $C_{i},G_{j}$ & $C_{i},C_{j}$%
\end{tabular}
\end{equation*}
-As before, each agent has a trade-off between the cost of traffic and the
-benefit of traffic when being a node, and a trade-off between having more
-nodes and fewer nodes. In addition to the previous analysis, now the final
-outcome also depends on how much each agent knows about whether the
-other is honest, and how much she knows about the other agent's
-sensitivity to privacy.
+As before, each agent has a trade-off between the cost of traffic
+and the benefit of traffic when being a node, and a trade-off
+between having more nodes and fewer nodes. In addition to the
+previous analysis, now the final outcome also depends on how much
+each agent knows about whether the other agent is honest, and how
+much she knows about the other agent's sensitivity to privacy.
-Of course, for an explicit solution we need a specific functional form for the
-probability function.\footnote{We have seen above, however, that privacy metrics
-like \cite{Diaz02,Serj02} do not directly translate into monotonic
-probability functions of the type traditionally used in game theory.
-Furthermore, the actual level of anonymity will depend on the mix-net
-protocol and topology (synchronous networks will provide
-larger anonymity sets than asynchronous networks for the same traffic divided
-among the nodes).} Nevertheless, this framework can be mapped into the
-model analyzed in \cite{palfrey-rosenthal-89} where two players decide
+Of course, for an explicit solution we need a specific functional
+form for the probability function.\footnote{We have seen above,
+however, that privacy metrics like \cite{Diaz02,Serj02} do not
+directly translate into monotonic probability functions of the
+type traditionally used in game theory. Furthermore, the actual
+level of anonymity will depend on the mix-net protocol and
+topology (synchronous networks will provide larger anonymity sets
+than asynchronous networks for the same traffic divided among the
+nodes).} Nevertheless, even at this abstract level of description
+this framework can be mapped into the model analyzed in
+\cite{palfrey-rosenthal-89} where two players decide
simultaneously whether to contribute to a public good.
In our model, when for example $v_{a_{i}} \gg v_{a_{j}}$ and
@@ -826,36 +838,38 @@
compared to \cite{grossman-stiglitz-80}, where the paradox of
informationally efficient
markets is described.\footnote{%
-The equilibrium in \cite{grossman-stiglitz-80} relies on the ``marginal''
-agent who is indifferent between getting more information about the market
-and not getting it. We are grateful to Hal Varian for highlighting this for
-us.}
+The equilibrium in \cite{grossman-stiglitz-80} relies on the
+``marginal'' agent who is indifferent between getting more
+information about the market and not getting it.}
The problems start if we consider now a different situation.
Rather than having a continuous distribution of valuations
$v_{a_{i}}$, we consider two types of agents: the agent with a
-high valuation, $v_{H}$, and the agent with a low valuation,
-$v_{L}$. We assume that the $v_{L}$ agents will simply participate
-sending traffic if the system is cheap enough for them to use (but
-see Section \ref{sec:bootstrapping}), and we also assume this will
-not pose any problem to the $v_{H}$ type, which in fact has an
-interest in having more traffic. Thus we can focus on the
-interaction between a subset of users: the identical high-types.
+high valuation, $v_{a_{i}}=v_{H}$, and the agent with a low
+valuation, $v_{a_{i}}=v_{L}$. We assume that the $v_{L}$ agents
+will simply participate sending traffic if the system is cheap
+enough for them to use (but see Section \ref{sec:bootstrapping}),
+and we also assume this will not pose any problem to the $v_{H}$
+type, which in fact has an interest in having more traffic. Thus
+we can focus on the interaction between a subset of users: the
+identical high-types.
-Here the marginal argument discussed above might not work, and coordination
-might be costly. In order to have a scenario where the system is
-self-sustaining and free and the agents
-are of high and low types, the actions of the agents must be visible and the
-agents themselves must agree to react together to any
-deviation of a marginal player. In realistic scenarios, however, this will involve very high
-transaction/coordination costs, and will require an extreme (and possibly
-unlikely) level of rationality for the agents. This equilibrium will also
-tend to collapse when the benefits from being a node are not very high
-compared to the costs. Paradoxically, it also breaks down when an
-agent trusts another so much that she prefers to delegate away the task
-of being a node. The above considerations however also hint at other
-possible solutions to reduce coordination costs. We now consider some
-other mechanisms that can make these systems economically viable.
+Here the ``marginal'' argument discussed above might not work, and
+coordination might be costly. In order to have a scenario where
+the system is self-sustaining and free and the agents are of high
+and low types, the actions of the agents must be visible and the
+agents themselves must agree to react together to any deviation of
+a marginal player. In realistic scenarios, however, this will
+involve very high transaction/coordination costs, and will require
+an extreme (and possibly unlikely) level of rationality for the
+agents. This equilibrium will also tend to collapse when the
+benefits from being a node are not very high compared to the
+costs. Paradoxically, it also breaks down when an agent trusts
+another so much that she prefers to delegate away the task of
+being a node. The above considerations however also hint at other
+possible solutions to reduce coordination costs. We now consider
+some other mechanisms that can make these systems economically
+viable.
\section{Alternate Incentive Mechanisms}
@@ -879,7 +893,7 @@
%A ``mechanism'' is a game where agents send messages and a certain
%allocation that depends on the realized messages (for a textbook
%introduction, see \cite{fudenberg-tirole-91}). The mechanism is designed to
-%maximize the expected utility --- for example of a ``principal'' agent.
+%maximize the expected payoff --- for example of a ``principal'' agent.
%According to the revelation principle the principal can concentrate on
%mechanisms where all the agents truthfully reveal their types.}).
The Anonymizer offers basic service at low costs to low-sensitivity agents
@@ -898,7 +912,7 @@
%agents can lead them to agree on cooperation, and on penalties for breaching
%cooperation.
-\item \emph{``Special'' agents}. Such agents have a utility function
+\item \emph{``Special'' agents}. Such agents have a payoff function
that considers the social value of having an anonymous system or are
otherwise paid or supported to provide such service. %The support might
%also come in form of reputation, as discussed below, or in financial
@@ -917,7 +931,7 @@
incentives of public recognition and public good don't fit in our
model very well, we emphasize them because they explain most
actual current node operators. As discussed above, reputation can
-enter the utility function indirectly or directly (when agents
+enter the payoff function indirectly or directly (when agents
value their reputation as a good itself).
If we publish a list of nodes ordered by safety (based on number of messages
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/