[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] cleanup up through section 3
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.seul.org:/home/arma/work/freehaven/doc/fc03
Modified Files:
econymics.tex
Log Message:
cleanup up through section 3
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -d -r1.20 -r1.21
--- econymics.tex 16 Sep 2002 05:13:07 -0000 1.20
+++ econymics.tex 16 Sep 2002 06:24:09 -0000 1.21
@@ -88,11 +88,11 @@
Here we present some new insights about how to align incentives to
create an economically workable system for both users and infrastructure
operators. We explore some reasons why anonymity systems are particularly
-hard to deploy, enumerate the incentives people have to participate either
-as senders or as nodes, and build a general model to take into account
-each of these incentives. We then describe and justify some simplifying
-assumptions to make the model manageable, and compare optimal strategies
-for participants based on a variety of scenarios.
+hard to deploy, enumerate the incentives to participate just as senders
+or also as nodes, and build a general model to take into account these
+incentives. We then describe and justify some simplifying assumptions to
+make the model manageable, and compare optimal strategies for participants
+based on a variety of scenarios.
\end{abstract}
@@ -137,8 +137,8 @@
to incorporate many of them. We then bring to light some simplifying
assumptions in Section \ref{sec:application} and draw conclusions
about certain scenarios. Sections \ref{sec:alternate-incentives} and
-\ref{sec:roadblocks} describe some alternate approaches and problems we
-encounter in designing and deploying strong anonymity systems.
+\ref{sec:roadblocks} describe some alternate approaches to incentives and
+problems we encounter in designing and deploying strong anonymity systems.
\section{An Economics of Anonymity}
\label{sec:overview}
@@ -184,9 +184,9 @@
anonymity sets. Thus better performance attracts users both for its
convenience value and the better potential anonymity protection. But
systems processing the most traffic do not necessarily provide the best
-hiding. If trust is not well distributed, a high volume system is a
-point of vulnerability, both from insiders and from attackers who try
-to bridge the trust bottlenecks.
+hiding. If trust is not well distributed, a high volume system is
+vulnerable both to insiders and to attackers who try to bridge the
+trust bottlenecks.
Anonymity systems must be robust against a surprisingly wide variety
of attacks to break anonymity \cite{back01,raymond00}. Adversaries
@@ -207,7 +207,7 @@
In this section and the following we formalize the economic analysis of why
people might want to send messages through mix-nets. Here we discuss the
-incentives for the agents to participate either as senders or as nodes,
+incentives for the agents to participate just as senders or also as nodes,
and we start proposing a general framework for the analysis. In the next
section we consider various applications of our framework.
@@ -217,7 +217,7 @@
will avoid by not having their messages tracked. Different agents might
value anonymity differently.
-The strategy space $S$ for each agent $i$ $\in I$ (where $I=\left\{
+The strategy space $S$ for each agent $i \in I$ (where $I=\left\{
1 \dots n\right\}$) willing to use the mix-net is the set of strategies
$s$ based on the following feasible actions $a$:
@@ -304,10 +304,10 @@
should prefer a small number of nodes. But if some nodes are dishonest,
users may prefer more honest nodes (to increase the chance that messages
go through honest nodes). Agents that act as nodes may have less desire
-for more nodes than the users who do not act as nodes, because they want
-to maintain high anonymity sets at their particular node. Hence the
-probability of remaining anonymous is inversely related to the number
-of nodes but positively related to the ratio of honest/dishonest nodes.
+for more nodes, because they want to maintain high anonymity sets at
+their particular node. Hence the probability of remaining anonymous is
+inversely related to the number of nodes but positively related to the
+ratio of honest/dishonest nodes.
\end{itemize}
If we assume that honest nodes always deliver messages that go through
@@ -317,7 +317,7 @@
\item Benefits of acting as a node (nodes might be retributed for
forwarding traffic or for creating dummy traffic), $b_{h}$.
-\item Benefits of acting as a dishonest node (dishonest node might
+\item Benefits of acting as a dishonest node (dishonest nodes might
benefit from disrupting service or might make use of the information
that passes through them), $b_{d}$.
\end{enumerate}
@@ -383,7 +383,7 @@
We assume that agents want to maximize their expected utility, which is a
function of expected benefits minus expected costs. We represent the payoff
-function for each agent $i$ in the following compact form:
+function for each agent $i$ in the following form:
\begin{equation*}
u_{i}=u\left(
@@ -417,7 +417,7 @@
the costs and benefits from sending the message might be distinct from the
costs and benefits from keeping the \emph{information} anonymous. For
example, when Alice anonymously contacts a merchant to purchase a book, she
-will gain a profit equal to the difference between her valuation of the good
+will gain a profit equal to the difference between her valuation of the book
and its price. But if her anonymity is compromised during the process, she
will incur losses completely independent from the price of the book or her
valuation of it. The payoff function $u_{i}$ above allows us to represent
@@ -441,7 +441,7 @@
} \\ \hline
{\tiny \
\begin{tabular}{c}
-{\tiny Costs due to loosing anonymity /} \\
+{\tiny Costs due to losing anonymity /} \\
{\tiny \ profits missed because of loss of anonymity}
\end{tabular}
} & {\tiny
@@ -463,19 +463,17 @@
be protected in order to avoid losses, then $v_{r}$ will be positive while $%
v_{a}$ will be negative and $p_{a}$ will enter the payoff function as $%
\left( 1-p_{a}\right) $.\footnote{%
-In such scenario, the certainty of being anonymous would therefore eliminate
-the risk of $v_{a}$, while the certainty of losing anonymity will impose on
+In such scenario, being certain of staying anonymous would therefore eliminate
+the risk of $v_{a}$, while being certain of losing anonymity would impose on
the agent the full cost $v_{a}$.} On the other side, if the agent must send
a certain message to avoid some losses but anonymity ensures her some
benefits, then $v_{r}$ will be negative and $p_{r}$ will enter the payoff
function as $\left( 1-p_{r}\right) $, while $v_{a}$ will be positive.%
-\footnote{%
-In such scenario, the certainty of sending a message that will be received
-will eliminate the risk of losing $v_{r}$, while the certainty of not being
-able to send a deliverable message will impose on the agent the full cost $%
-v_{r}$.}
+\footnote{Similarly, guaranteed delivery will eliminate the risk of
+losing $v_{r}$, while certainty of delivery failure would impose on the
+agent the full cost $v_{r}$.}
-With this framework we are able to compare - for example - the losses due to
+With this framework we are able to compare, for example, the losses due to
compromised anonymity to the costs of protecting it. An agent will decide to
protect herself by spending a certain amount if the amount spent in defense
plus the expected losses for losing anonymity after the investment are less
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/