[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] more cleanups; tighter equations
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.seul.org:/home/arma/work/freehaven/doc/fc03
Modified Files:
econymics.tex
Log Message:
more cleanups; tighter equations
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.28
retrieving revision 1.29
diff -u -d -r1.28 -r1.29
--- econymics.tex 16 Sep 2002 23:07:59 -0000 1.28
+++ econymics.tex 16 Sep 2002 23:32:00 -0000 1.29
@@ -210,15 +210,15 @@
discuss the incentives for the agents to participate either as senders
or also as nodes, and we propose a general framework for their
analysis. In the next section we consider various applications of our
-framework.
+framework. After that we will examine alternate incentive mechanisms.
-We begin with the assumption that agents value their privacy. This value
-might be related to profits they will make by keeping their messages
-anonymous, or to losses they will avoid by not having their messages
-tracked. Different agents might value anonymity differently.
+We begin with the assumption that individuals, or \it{agents}, value
+their privacy. This value might be related to profits they will make
+by keeping their messages anonymous, or to losses they will avoid by
+not having their messages tracked. Different agents might value
+anonymity differently.
-Each agent $i$ (where $i \in \left\{1 \dots n\right\}$) has a strategy
-$s$ based on the following possible actions:
+Each agent $i$ bases her strategy on the following possible actions:
\begin{enumerate}
\item Act as a user of the system, specifically by sending (and
@@ -557,12 +557,10 @@
issues.
These assumptions let us reduce the utility function to:
-
\begin{equation*}
u_{i}=-v_{i}\left( 1-p_{a}\left( n_{s},n_{h},n_{d},a_{i}^{h}\right) \right)
-c_{s}a_{i}^{s}-c_{h}\left( n_{s},n_{h},n_{d}\right) a_{i}^{h}-c_{n}
\end{equation*}
-
Thus each agent $i$ tries to \textit{minimize} the costs of sending
messages and the risk of being tracked. The first component is the
probability that anonymity will be lost given the number of agents sending
@@ -574,18 +572,16 @@
and $n_{d}$ nodes, and sending messages through a non-anonymous system,
respectively. Each period, a rational agent can compare the utility
coming from each of these three one-period strategies.
-
\begin{equation*}
\begin{tabular}{cc}
-Action & Payoff \\
-$a_{s}$ & $-v_{i}\left( 1-p_{a}\left( n_{s},n_{h},n_{d}\right) \right)
--c_{s} $ \\
+Action & Payoff \\
+$a_{s}$ & $-v_{i}\left( 1-p_{a}\left( n_{s},n_{h},n_{d}\right) \right) -c_{s}
+$ \\
$a_{h}$ & $-v_{i}\left( 1-p_{a}\left( n_{s},n_{h},n_{d},a_{i}^{h}\right)
-\right) -c_{s}-c_{h}\left( n_{s},n_{h},n_{d}\right) $ \\
+\right) -c_{s}-c_{h}\left( n_{s},n_{h},n_{d}\right) $ \\
$a_{n}$ & $-v_{i}-c_{n}$%
\end{tabular}
\end{equation*}
-
We do not explicitly allow the agent to choose \textit{not} to send a
message at all, which would of course minimize the risk of anonymity
compromise.
@@ -616,38 +612,34 @@
that a new agent with a privacy sensitivity $v_{i}$ is considering using
a mix-net with $\bar{n}_{s}$ users and $\bar{n}_{h}$ nodes.
-Then if
-\begin{gather*}
--v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
+Then if
+\begin{equation*}
+\begin{tabular}{c}
+$-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
-\\
-<-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
--c_{s}
-\end{gather*}
-and
-\begin{gather*}
--v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
+$ \\
+$<-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
+-c_{s},$ and \\
+$-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
-\\
-<-v_{i}-c_{n}
-\end{gather*}
-agent $i$ will choose to become a node in the mix-net.
-
-If
-\begin{gather*}
--v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
+$ \\
+$<-v_{i}-c_{n}$%
+\end{tabular}
+\end{equation*}
+agent $i$ will choose to become a node in the mix-net. If
+\begin{equation*}
+\begin{tabular}{c}
+$-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
-\\
->-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
--c_{s}
-\end{gather*}
-and
-\begin{gather*}
--v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
--c_{s} \\
-<-v_{i}-c_{n}
-\end{gather*}
-then agent $i$ will choose to be a user of the system. Otherwise, $i$ will
+$ \\
+$>-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
+-c_{s},$ and \\
+$-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
+-c_{s}$ \\
+$<-v_{i}-c_{n}$%
+\end{tabular}
+\end{equation*}
+then agent $i$ will choose to be an user of the system. Otherwise, $i$ will
simply not use the system.
Of course, for a formal solution we need an explicit functional form of the
@@ -680,52 +672,35 @@
Suppose that each of agent $i$ and agent $j$ considers the other agent's
reaction function in her decision process. Let:
-
-\begin{equation*}
-A_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+2,n_{d},a_{w}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n}_{h}+2,n_{d}\right)
-\end{equation*}
-
-\begin{equation*}
-B_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d}\right)
-\right) -c_{s}
-\end{equation*}
-
-\begin{equation*}
-C_{w}=-v_{w}-c_{n}
-\end{equation*}
-
-\begin{equation*}
-D_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d},a_{w}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d}\right)
-\end{equation*}
-
\begin{equation*}
-E_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{w}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
-\end{equation*}
-
-\begin{equation*}
-F_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h},n_{d}\right)
-\right) -c_{s}
-\end{equation*}
-
-\begin{equation*}
-G_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right)
-\right) -c_{s}
+\begin{tabular}{c}
+$A_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}%
+_{h}+2,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n%
+}_{h}+2,n_{d}\right) $ \\
+$B_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d}\right)
+\right) -c_{s}$ \\
+$C_{w}=-v_{w}-c_{n}$ \\
+$D_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}%
+_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n%
+}_{h}+1,n_{d}\right) $ \\
+$E_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}%
+_{h}+1,n_{d},a_{w}^{h}\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n%
+}_{h}+1,n_{d}\right) $ \\
+$F_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h},n_{d}\right)
+\right) -c_{s}$ \\
+$G_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right)
+\right) -c_{s}$%
+\end{tabular}
\end{equation*}
-
Then we can represent the payoff matrix as:
-
\begin{equation*}
\begin{tabular}{cccc}
-{\tiny Player i / Player j} & $a_{j}^{h}$ & $a_{j}^{s}$ & $a_{j}^{n}$ \\
-$a_{i}^{h}$ & $A_{i},A_{j}$ & $D_{i},B_{j}$ & $E_{i},C_{j}$ \\
-$a_{i}^{s}$ & $B_{i},D_{j}$ & $F_{i},F_{j}$ & $G_{i},C_{j}$ \\
+{\tiny Player i / Player j} & $a_{j}^{h}$ & $a_{j}^{s}$ & $a_{j}^{n}$ \\
+$a_{i}^{h}$ & $A_{i},A_{j}$ & $D_{i},B_{j}$ & $E_{i},C_{j}$ \\
+$a_{i}^{s}$ & $B_{i},D_{j}$ & $F_{i},F_{j}$ & $G_{i},C_{j}$ \\
$a_{i}^{n}$ & $C_{i},E_{j}$ & $C_{i},G_{j}$ & $C_{i},C_{j}$%
\end{tabular}
\end{equation*}
-
As before, each agent has a trade-off between the cost of traffic and the
benefit of traffic when being a node, and a trade-off between having more
nodes and less nodes. In addition to the previous analysis, now the final
@@ -839,43 +814,48 @@
alternative mechanisms.
\begin{enumerate}
-\item Usage fee. Imagine a scenario where each participant in the system
-has to pay. The public good with free-riding problem discussed above turns
-into a ``clubs'' scenario. Participating agents can elaborate a pricing
+\item \emph{Usage fee}. Imagine a scenario where each participant pays to use the system.
+The ``public good with free-riding'' problem above turns
+into a ``clubs'' scenario. Participating agents can choose a pricing
mechanism related to how much they expect to use the system or how sensitive
-they are (which involves mechanism design and revelation mechanism).%
-\footnote{%
-A ``mechanism'' is a game where agents send messages and a certain
-allocation that depends on the realized messages (for a textbook
-introduction, see \cite{fudenberg-tirole-91}). The mechanism is designed to
-maximize the expected utility - for example of a ``principal'' agent.
-According to the revelation principle the principal can concentrate on
-mechanisms where all the agents truthfully reveal their types.} The
-Anonymizer offers basic service at low costs to low sensitivity types (there
+they are. (The revelation principle \cite{fudenberg-tirole-91} indicates
+that the agent can concentrate on mechanisms where all the agents
+truthfully reveal their sensitivities.)
+% (which involves mechanism design and revelation mechanism%
+%\footnote{%
+%A ``mechanism'' is a game where agents send messages and a certain
+%allocation that depends on the realized messages (for a textbook
+%introduction, see \cite{fudenberg-tirole-91}). The mechanism is designed to
+%maximize the expected utility --- for example of a ``principal'' agent.
+%According to the revelation principle the principal can concentrate on
+%mechanisms where all the agents truthfully reveal their types.}).
+The Anonymizer offers basic service at low costs to low-sensitivity agents
+(there
is a cost in the delay and the hassles of using the free service), and
offers better service for money. With usage fees, the cost of being a node
is externalized, and then paid to some entity. A hybrid solution involves
distributed trusted mixes, supported through entry-fees paid to a central
authority and redistributed to the nodes.
-\item Bilateral contracts. Bilateral or multilateral contracts between
-agents can lead them to agree on cooperation and punishments for breaching
+\item \emph{Bilateral contracts}. Bilateral or multilateral contracts between
+agents can lead them to agree on cooperation, and on penalties for breaching
cooperation.
-\item ``Special'' agents. Imagine having a ``special agent'' whose utility
-function has been modified to consider the social value of having an
-anonymous system, or which is being paid for or supported to provide such
+\item \emph{``Special'' agents}. Imagine having a ``special agent'' whose utility
+function considers the social value of having an
+anonymous system, or who is paid or supported to provide such
service. The risks here are congestion and non-optimal use of the resources
\cite{mackiemason-varian-95}.
+%FIXME why? how?
-\item Public rankings and reputation. The incentives regarding reputation
+\item \emph{Public rankings and reputation}. The incentives regarding reputation
can come in the form of wanting a higher reputation to get more cover
traffic, but also as one of the rewards for the ``special agents'' above.
-Just as the statistics pages for seti@home \cite{seti-stats} encourage more
+Just as the statistics pages for seti@home \cite{seti-stats} encourage
participation, publically quantifying and ranking generosity creates an
-incentive to participate. The incentives of public recognition and wanting
-to donate service for the public good are very important to consider, even
-if they don't fit in our model very well, because to date that's where most
+incentive to participate. Although incentives of public recognition and
+public good don't fit in our model very well, they are important because
+to date
node operators come from. As discussed above, reputation can enter the
utility function indirectly or directly (when agents value their reputation
as a good itself). If we modify the function presented above to consider
@@ -883,17 +863,16 @@
as nodes.
If we publish a list of mixes ordered by safety (based on number of messages
-each message is expected to be mixed with), the high sensitivity users will
+each message is expected to be mixed with), the high-sensitivity users will
gravitate to safe mixes, causing more traffic, and improving their safety
further (and lowering the safety of other nodes). Based on our model the
system will stabilize with one or a few remailers. One reason it won't
stabilize in reality is because $p_a$ is influenced not just by $n_h$ but
-also by jurisdictional diversity --- a given high sensitivity sender is
+also by jurisdictional diversity --- a given high-sensitivity sender is
happier with a diverse set of mostly safe nodes than with a set of very safe
nodes run in the same zone. Another reason it may not stabilize is that at
-some point latency will begin to suffer, and the low sensitivity users will
-go elsewhere, taking away the nice anonymity sets. (On the other hand,
-current Mixmaster use levels are nowhere near that point.)
+some threshold latency will begin to suffer, and the low sensitivity users will
+go elsewhere, taking away the nice anonymity sets.
More generally, a mix that chooses a frequent batching time may get lots of
messages from the low sensitivity people, and thus end up providing \emph{%
@@ -902,7 +881,7 @@
sender? Certainly a dummy message which ends at a mix is ''worse'' than a
message that ends at an actual recipient.
-\item Micropayments for service. Mojo Nation \cite{mojo} was a peer-to-peer
+\item \emph{Micropayments for service}. Mojo Nation \cite{mojo} was a peer-to-peer
design for robustly distributing resources (e.g. file sharing). It employed
a digital cash system, called \emph{mojo}, to help protect against abuse of
the system. In addition to the usual operations of publish and retrieve,
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/