A faithful distributed mechanism for sharing the cost of multicast transmissions


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

A faithful distributed mechanism for sharing the cost of multicast transmissions

  1. 1. IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009 1089 A Faithful Distributed Mechanism for Sharing the Cost of Multicast Transmissions Nandan Garg, Student Member, IEEE, and Daniel Grosu, Senior Member, IEEE Abstract—The problem of sharing the cost of multicast transmissions was studied in the past, and two mechanisms, Marginal Cost (MC) and Shapley Value (SH), were proposed to solve it. Although both of them are strategyproof mechanisms, the distributed protocols implementing them are susceptible to manipulation by autonomous nodes. We propose a distributed Shapley Value mechanism in which the participating nodes do not have incentives to deviate from the mechanism specifications. We show that the proposed mechanism is a faithful implementation of the Shapley Value mechanism. We experimentally investigate the performance of the existing and the proposed cost-sharing mechanisms by implementing and deploying them on PlanetLab. We compare the execution time of MC and SH mechanisms for the Tamper-Proof and Autonomous Node models. We also study the convergence and scalability of the mechanisms by varying the number of nodes and the number of users per node. We show that the MC mechanisms generate a smaller revenue compared to the SH mechanisms, and thus, they are not attractive to the content provider. We also show that increasing the number of users per node is beneficial for the systems implementing the SH mechanisms from both computational and economic perspectives. Index Terms—Multicast, cost sharing, faithful implementation, algorithmic mechanism design. Ç1 INTRODUCTIONR ECENTLY, the transmission of multimedia content has become one of the most widely used applications on theInternet. A very common model of multimedia content Providers (ISPs) pay bigger CDNs/ISPs to receive the content, which is then distributed to their subscribers. The subscribers are charged by the smaller content providers fordistribution is the one in which the content provider receiving the content. In our model, we refer to the smallerdistributes the audio/video to the subscribers (e.g., on- CDNs as nodes and to their subscribers as users. This two-tierdemand video) using multicast transmissions [1], [2], [3], [4]. architecture is highly scalable, efficient, and economic. WeMulticast transmissions are efficient as they minimize the describe examples of such architectures in the related worknumber of messages traversing a single link by creating a section. The multicast transmissions used to distributemulticast tree [5], [6], [7], [8]. We consider the overlay content are mostly receiver initiated (e.g., Video on Demand)multicast where pure application-level or hybrid techniques [14]. In such systems, the users who receive the transmissionare used to build overlays on the existing network have the responsibility to pay for the cost incurred by datainfrastructure such as the Internet [9], [10], [11]. Since the flowing over the links [15]. In general, the content providermulticast trees are overlays, they can be efficiently provides the content and charges the receiver for the content.constructed using spatial information [12], [13]. Not only This charge should cover the cost of the links used in thedo approaches such as the Reliability-Oriented Switching multicast transmission. If the content distributors do notTree (ROST) [5] construct multicast trees that are reliable, charge the users, they may not be profitable [16].but the tree construction algorithm also prevents cheating In our model, the nodes are responsible for paying theand manipulation of bandwidth/time information. content provider for the received content. This model is In such multicast trees, the content provider is the root of especially useful in scenarios where smaller CDNs sub-the tree, and the receivers are the other nodes in the tree. A scribe to bigger CDNs and pay them to receive the contentnode in the multicast tree receives the transmission from the that they deliver to their subscribers (called users). Theparent node and forwards the content to its child nodes, if benefit for each user e is quantified by a private single-any. We consider a model in which each node in the multicast valued parameter ue known as the user’s utility. User e willtree has multiple users. The node receives the content from like to receive the transmission if her cost share xe is lessthe content provider and delivers it to the users by using IP than her utility, i.e., if her welfare we ¼ ue À xe is positive.Multicast or other techniques that are efficient in local scopes. Cost-sharing mechanisms determine who receives theThis model characterizes well the scenarios where smaller multicast and how much they have to pay for the service.Content Distribution Networks (CDNs) or Internet Service However, the calculation of cost shares is not a trivial task, as the users may cheat by lying about their utility.. The authors are with the Department of Computer Science, Wayne State The users are assumed to be rational (i.e., they want to University, 5143 Cass Avenue, Detroit, MI 48202. maximize their profit). They have strong motivation to lie E-mail: nandang@wayne.edu, dgrosu@cs.wayne.edu. about their private values in order to get extra benefits. TheManuscript received 14 Oct. 2007; revised 12 Apr. 2008; accepted 29 Sept. task of the system designer is to design mechanisms that2008; published online 2 Oct. 2008. achieve systemwide goals. These goals may be hampered ifRecommended for acceptance by B. Parhami. the users lie about their private values. To preventFor information on obtaining reprints of this article, please send e-mail to:tpds@computer.org, and reference IEEECS Log Number TPDS-2007-10-0377. manipulation and motivate users to participate honestly,Digital Object Identifier no. 10.1109/TPDS.2008.221. Mechanism Design (a subfield of Microeconomics) is used 1045-9219/09/$25.00 ß 2009 IEEE Published by the IEEE Computer Society
  2. 2. 1090 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009to model the behavior of the users. The standard Algo- The MC and SH mechanisms proposed in [20] assumerithmic Mechanism Design (AMD) [17] and Distributed that the participants may lie about their private values, butAMD (DAMD) [18] study the mechanisms where the they may not deviate from the specified distributedoutcome and the payment depend on the input provided algorithm. This model of distributed implementation isby the participants. Of importance are the strategyproof known as the Tamper-Proof Model (TPM). Thus, we usemechanisms [19], in which the users obtain maximum profit MC-TPM and SH-TPM to denote the mechanisms pro-when they declare their private values truthfully. In the posed in [20]. However, the TPM assumption is weakstandard AMD [17], a centralized trusted entity implements because the participants can easily manipulate the dis-the mechanism, i.e., collects the input from the participants, tributed mechanism in their favor, since they control it.calculates the outcome, and distributes the payment. When The more general model in which the participants maythe mechanism is implemented in a distributed fashion [20], deviate from the specified distributed mechanism is calledthe participants themselves execute the mechanism and the Autonomous Node Model (ANM). When the distributedcollectively calculate the outcome and the payments. mechanisms are implemented by the participants them- Feigenbaum et al. [20] proposed two distributed mechan- selves, they may deviate from the specified algorithm if it is beneficial to do so. These deviations are categorized intoisms to calculate the cost shares of the participants in a three groups: information revelation, message passing, andmulticast transmission: the Marginal Cost (MC) mechanism computation. A faithful implementation [25] is an imple-and the Shapley Value (SH) mechanism. MC is a two-phase mentation of a mechanism where the participants cannotmechanism, whereas SH is an iterative mechanism. gain any benefit by deviating from the mechanism The MC mechanism is strategyproof and efficient (i.e., specification. Different techniques to achieve faithfulness,maximizes the overall welfare) but not budget balanced. In such as redundancy, catch and punish, and problemfact, it is known that it generally runs a budget deficit and, in partitioning, have been suggested in [25]. In this paper,many cases, does not generate any revenue at all [21]. No we employ the catch-and-punish technique, which as-strategyproof mechanism can be both efficient and budget sumes the existence of a trusted party who audits thebalanced at the same time [22]. The MC mechanism is participants randomly and punishes the ones who deviaterecommended when the multicast delivery may be sub- from the protocol specification. Our goal in this paper is tosidized if the mechanism runs a budget deficit [18]. Since the design a faithful implementation of the SH mechanism andMC mechanism does not generate sufficient revenue, it is not to investigate its properties.a suitable mechanism from the content provider’s point ofview. The content provider will quickly go out of business, 1.1 Related Workespecially when there exist competing content providers. In We briefly review the existing research on multicastaddition, the MC mechanism is susceptible to collusion [23]. architectures and show how they relate to the multicast The SH mechanism is a better choice from these con- model we use in this paper. One example of a two-tiersiderations because it is budget balanced and group strategy- architecture is the Two-tier Overlay Multicast Architectureproof. Mechanisms are characterized by standard properties (TOMA), presented in [26]. In TOMA, the ISPs create alike No-Positive Transfers, Voluntary Participation, and Multicast Service Overlay Network (MSON) as the backboneConsumer Sovereignty. No-Positive Transfers means that service domain. End users subscribe to the proxies advertisedthe cost shares are nonnegative ðxe ! 0Þ. A mechanism by MSONs to receive the content. TOMA is shown to besatisfies the Voluntary Participation property when it ensures profitable for ISPs implementing it. The authors showthat users are not charged if they do not receive the through simulations that such two-tiered approach is verytransmission. Consumer Sovereignty property guarantees beneficial to reduce the cost of the multicast using overlay provisioning methods. Another example of overlay architec-that if a user is willing to pay a high enough amount, he or she ture, presented in [27], consists of Multicast Service Nodeswill definitely get the transmission (i.e., users cannot be (MSNs), which are connected with the source of the content toexcluded arbitrarily). form the multicast backbone. When an MSN receives the The SH mechanism satisfies the Consumer Sovereignty content, it delivers it to the users who have subscribed to it.property, in addition to No-Positive Transfers and Voluntary The architecture is scalable and self-organizing. It adapts wellParticipation. The MC mechanism satisfies No-Positive to the dynamic nature of the content delivery where users joinTransfers and Voluntary Participation properties but does and leave regularly. Scattercast [28] is another architecturenot satisfy Consumer Sovereignty [21]. Although the SH where ScatterCast proXies (SCXs) are strategically placedmechanism is not efficient, for large user populations, it nodes that create source-rooted distribution trees to deliverapproaches perfect efficiency. From the class of group- content originating at the source (a user connected to thestrategyproof mechanisms that are budget balanced, the source) to the other SCXs. This approach is useful in scenariosSH mechanism minimizes the worst case welfare loss [21]. The where the content provider is not a fixed node. The nodes inonly drawback of the SH mechanism is that it has a higher our model can represent the MSONs in TOMA [26] or SCXs innetwork complexity [24]. However, we believe that the cost- Scattercast [28], which pay the content provider according toshare calculation will induce a relatively small overhead to the the number of users receiving the content. To track theoverall multicast transmission. Thus, it is justifiable to prefer number of copies of the multimedia content made by thethe SH mechanism, given its good properties. The conver- smaller CDNs, the content providers can use one of thegence and scalability of these mechanisms have been studied techniques surveyed in [29] and [30]. Considering specifica-theoretically, but no experimental evaluation was performed. tions such as Protocol Independent Multicast (Sparse Mode),
  3. 3. GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1091PIM-SM [31], our model can be extended to include any implement the MC mechanisms (both ANM and TPM)Rendezvous Point (RP) as the root, as long as there is a valid and SH-TPM and deploy them on PlanetLab. We comparetree. The multicast tree does not have to be a binary tree to the performance of our proposed mechanism to that ofprovide efficient transmission. This model is also very useful the other existing mechanisms (MC-TPM, MC-ANM, andwhen the nodes are organizations that pay for the content and SH-TPM). We also study the convergence of the SH-ANMdeliver it to multiple users within their organization. In some mechanism. In addition, we investigate the effect ofcases, the nodes may not even charge their users for the varying the number of users per node and the effect ofcontent. If they do, they can use our proposed mechanism for varying the number of nodes in the multicast tree on thecalculating the cost share of each user within their local scope. number of users that receive the transmission and on the Distributed implementations of mechanisms have been payment the content provider receives in the proposedproposed for various problems such as multicast cost sharing mechanism.[20] and scheduling [32], [33]. Incentives have been employedin distributed systems such as BitTorrent [34] to motivate 1.3 Organizationparticipants to follow the specified protocol. Game theory has The organization of the rest of the paper is given as follows:also been used to analyze the interactions of ISPs and to In Section 2, we present the network model we use, the MCdesign equilibrium strategies for network pricing [35]. and SH mechanisms for TPM, and the MC mechanism forPricing the resources [36] provides the added advantage of ANM. Section 3 begins with the description of how nodesefficient and just use of available resources, which otherwise can cheat in the original implementation of the SHhave to face issues such as “free riding.” An axiomatic mechanism for TPM. We then present our proposedapproach to allocate the costs to the receiving users and the mechanism, implementing the SH mechanism for ANM.mechanism that implements it were proposed in [37]. In Section 4, we show that our mechanism is a faithful An MC mechanism for sharing the cost of multicast implementation of the SH mechanism. Section 5 describestransmissions assuming the ANM was proposed in [38]. the experimental setup and the results we obtained from theThe mechanism was designed by augmenting the original experiments. Section 6 concludes the paper with a summaryMC-TPM mechanism proposed in [20] with asymmetric key and future research directions.cryptographic primitives to prevent cheating. Specifically,the authors used digital signatures to authenticate the senderof the messages and auditing to verify that the agents 2 COST-SHARING MECHANISMSexecuted the mechanism correctly. The limitation of the MC In this section, we describe the network model we usemechanism for ANM, proposed in [38], is that it assumes that and present the MC and the SH mechanisms assumingthere is only one user per node. The paper was strictly limited the TPM [20]. We describe the MC mechanism for theto the design of the mechanism, and no performance ANM [38].evaluation was provided. Cryptographic methods like groupkey distribution have also been used for designing protocols 2.1 Modelthat are robust against inflated subscriptions when content We assume the following network model. The user popula-distribution uses IP Multicast [39]. tion Q resides at N nodes. Each user e 2 Q resides at some node i 2 N. The nodes are connected by bidirectional links.1.2 Contributions R Q is the set of users who receive the multicastIn this paper, we propose a distributed SH mechanism for transmission. The transmission starts from a node root 2 Nsharing the cost of multicast transmissions for the ANM, and flows through a static multicast tree T ðRÞ T ðQÞ, wherecalled SH-ANM. To design our mechanism, we rely on the T ðRÞ and T ðQÞ denote the multicast tree connecting the nodescatch-and-punish technique to achieve faithfulness. This in R and Q, respectively. The techniques used to create thesetechnique assumes the existence of a trusted node (in our trees are described in [20], [41], and [42]. We denote thecase, the root of the multicast tree) that audits the nodes subtree rooted at node i as Ti . Each link connecting node i torandomly and punishes the nodes that deviate from the its parent node p has a cost ci associated with it. Ci denotes thespecified mechanism. We use digital signatures to authen- set of all t children k1 ; . . . ; kt of node i, and ri denotes the set ofticate the messages sent by the nodes and perform auditing all the users at node i. The payment sent by node i to root isand verification to detect cheating by the nodes. Our denoted by paymenti .mechanism has provisions that prevent deviations in any In the description of the mechanism in Fig. 1 (and the restof the multiple iterations of the SH mechanism. We show of paper), we use the primitive sendðM; RÞ to denote thatthat our proposed distributed mechanism is a faithful the node executing the mechanism sends message M to aimplementation of the SH mechanism. node R and recvðM; RÞ to denote that the node executing The time overhead induced by our proposed faithful the mechanism receives message M from a node R.mechanism to calculate cost shares is negligible comparedto the transmission time of the actual content. We show 2.2 Marginal Cost Mechanism for the Tamper-Proofthis by implementing the mechanism and deploying it Model (MC-TPM)on a distributed real-world environment provided by Let us assume that Ui denotes the sum of utilities of all PPlanetLab [40]. Our experiments provide interesting in- the users at node i ðUi ¼ e2ri ue Þ. The vector of utilitiessights into the behavior of the SH mechanism from the of all users e 2 Q is denoted by u. If a user e receives theeconomic and computational perspectives. To compare transmission, then e ¼ 1; otherwise, e ¼ 0. Tiþ denotesthe performance of the proposed SH mechanism, we also the union of Ti and the link from i to p. W ðuÞ represents
  4. 4. 1092 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009 Fig. 2. SH-TPM: Distributed SH mechanism for TPM. users at node i who receive the transmission, i.e., xe ¼
  5. 5. i , 8e 2 ri R. ni represents the number of users at node i who choose to receive the transmission. The bottom-up traversal starts from the leaf nodes. A leaf node k reports its k valueFig. 1. MC-TPM: Distributed MC mechanism for TPM. to its parent (for the leaf nodes, k ¼ nk ). Nodes other than P leaf nodes calculate i ¼ k2Ci k þ ni and send it to theirthe net worth of the system at utility vector u, and parent node. After root receives i , i 2 Croot , it initiates theWi ðuÞ denotes the welfare (i.e., utilities minus cost) of top-down traversal, where it sends
  6. 6. root ¼ 0 to each of its children. Each node receives
  7. 7. p from its parent andsubtree Tiþ . The mechanism is executed in two phases, a computes
  8. 8. i as follows:bottom-up phase and a top-down phase, as shown inFig. 1. In the bottom-up phase, the welfare values Wi ðuÞ ciare calculated by
  9. 9. i ¼ þ
  10. 10. p : ð2Þ i 0 1 X
  11. 11. i is then sent to all the children of node i (i.e., all nodes Wi ðuÞ ¼ Ui þ @ Wk ðuÞA À ci : ð1Þ k 2 Ci ). All users e 2 ri are assigned the cost share xe ¼
  12. 12. i . If k2Ci jWk ðuÞ!0 the cost share xe of any user e is greater than its utility ue , then user e declines to receive the transmission. In that case, Each node calculates the welfare value and sends it to its i decreases, and it needs to be updated in the next bottom-parent. Finally, the root node receives the welfare values up traversal. This increases the cost shares of the other usersfrom its children. In the top-down phase, the minimum sharing the links with e. Thus, in each iteration of thewelfare value Ai of a node i is calculated and propagated bottom-up and the top-down traversal, users may bedown the tree. Ai is the smallest welfare value Wi0 ðuÞ of any removed from the receiver set R, and the cost shares arenode i0 in the path from i to root. Ai is used to decide which updated. These iterations are repeated until no more usersusers receive the transmission and what will be their cost are dropped and until the cost share of any user does notshare. The details of how to calculate Ai and xe are shown in change in two subsequent iterations. Initially, R ¼ Q, and inFig. 1 and described in [20]. the worst case, one user is dropped in each iteration. If we2.3 Shapley Value Mechanism for the Tamper-Proof assume that the algorithm converges in m iterations, the Model (SH-TPM) number of messages required in this case is Âðn  mÞ. TheThe SH [43] mechanism is implemented using an iterative detailed analysis of the computational and communicationalgorithm consisting of two phases (bottom-up and top- complexity is presented in [20].down). In the bottom-up traversal, each node i determines The mechanism is shown in Fig. 2, where
  13. 13. i and j refer j ithe number of users i in Ti who choose to receive the respectively to the
  14. 14. i and i values in iteration j. An exampletransmission.
  15. 15. i is the cost share of each of the resident of the execution of one iteration of the SH mechanism is
  16. 16. GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1093 node i. If the actual payment received from node i is different from the expected payment, node i has to pay a high penalty. Thus, node i has no incentive to deviate from the mechanism (for proof, refer to [38]). 3 SHAPLEY VALUE MECHANISM FOR THE AUTONOMOUS NODES MODEL (SH-ANM) The distributed implementation of the SH mechanism in [20] is vulnerable to deviations by the nodes. In this section, we present our proposed mechanism that prevents such deviations. We first present the notation used in describing the proposed mechanism. Then, we describe the ways in which a node can cheat in the original mechanism. Finally, we describe SH-ANM, our proposed mechanism. 3.1 Notation As described in Section 2.3, SH is an iterative mechanism. It performs more than one iteration of the bottom-up andFig. 3. SH mechanism with nodes executing the mechanism truthfully. top-down traversals. The number of users at node i, in iteration j, who choose to receive the multicast transmis-shown in Fig. 3. In this example, it is assumed that each node sion is denoted by nj . For iteration j the number of users ihas only one user. The j values propagate from child to i in the subtree rooted at i who receive the transmission isparent in the bottom-up phase (shown by solid arrows), and j . The cost share of users at node i, calculated in i j j
  17. 17. i values are sent from parent to child in the top-down phase iteration j, is denoted by
  18. 18. i . During the top-down phase j(shown by dashed arrows). of iteration j, node i receives cost share
  19. 19. p from p. The j j cost share
  20. 20. i is calculated using the formula
  21. 21. i ¼2.4 Marginal Cost Mechanism for the Autonomous j j ðci =i Þ þ
  22. 22. p (from (2)). The message M signed by node i Nodes Model (MC-ANM) using its private key Ki is denoted by EKi ½MŠ.The strategyproof MC mechanism prevents users from lyingabout their utility, but it does not prevent the deviation of 3.2 Cheating in Tamper-Proof Modelnodes from the specified distributed mechanism. The authors In the following, we show how a node can cheat byin [38] assume that the nodes are autonomous, and they can manipulating the values sent to other nodes. The scenario indeviate from the mechanism to increase their welfare. They which no cheating occurs is shown in Fig. 3. For simplicity,proposed the use of digital signatures to authenticate the we assume that every node has only one user. The values ofmessages sent by a node and the use of auditing by the j and
  23. 23. i are shown for iteration j. In Fig. 3, the user at i jcontent provider to detect cheating. The content provider node 3 has to pay 4, and users at nodes 4 and 5, each pays 6. jðrootÞ is assumed to be the administrator of the mechanism. By modifying the
  24. 24. i sent to its children, node i ensuresHowever, this does not make the mechanism centralized that the users at node i receive the transmission but paysince the nodes themselves compute the outcome in a nothing. To maintain the budget balance, node i makes itsdistributed fashion. The administrator audits nodes with children and all the nodes in its subtree pay an extracertain probability and enforces payments in case of amount, to compensate for the cost of transmission received j0discrepancies. by the users at node i. Node i sends
  25. 25. i to its children 0 j j The modified mechanism (called protocol A) [38] is instead of
  26. 26. i .
  27. 27. i is calculated using the formula j0described as follows: Assume that a message M signed
  28. 28. i ¼ ðci þ
  29. 29. p Á ni Þ=ðj À nj Þ þ
  30. 30. p . Essentially, node i divides j j i i jusing the private key Ki of node i is denoted by EKi ½MŠ. The the cost of link ci among the users in its subtree, excludingbottom-up traversal is the same as in the MC mechanism for users residing at i. The users at node i also have to share the jTPM, except that the values sent by the children are signed costs of links from p to root, which is
  31. 31. p . Node i distributesusing their private keys and each node verifies the signature the share of its users to its descendants by adding
  32. 32. p Á nj to j iafter receiving the message. In the top-down phase, each ci and dividing only by the number of descendantsnode i sends message EKi ½Ai ; Wk Š, where Ai is the value in ðj À nj Þ. Thus, node i assigns zero as the cost share to its i i j0the original MC mechanism, and Wk is the message that i resident users. The cost share
  33. 33. i is calculated in such a wayreceived from child k during the bottom-up phase. At the that the budget remains balanced and the root cannot detectend of the mechanism execution, the content provider the cheating. Fig. 4 shows how node 3 cheats. The useraudits each node i with probability Pa . It asks node i to send residing at node 3 pays nothing, and the users at nodes 4a proof of paying, proofi , which consists of all the messages and 5 each pays 8. Thus, each of them pays an extra amountreceived by node i from its children and parent during the of 2. The total amount overpaid collectively by the twoexecution of the mechanism. To check the proof, the content users at nodes 4 and 5 is 4, compensating for the payment ofprovider decrypts all the messages contained in proofi the user at node 3.(which are signed by the parent and the children of node i) Another way 0 nodes can cheat is when a node i sends anand calculates the utility and the payment expected from inflated value j instead of j to its parent in the bottom-up i i
  34. 34. 1094 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009Fig. 4. Node 3 cheats by sending modified values to its children. Fig. 5. Node 3 cheats by sending modified values to its parent and children.phase. Thus, the cost of the links connecting i to root will beshared among a greater number of (fake) users, reducing iterative mechanism, a node can cheat in any of thethe per-user share at nodes in the tree T ðQÞ À Ti (i.e., nodes iterations. To efficiently detect cheating, signing andsharing the links connecting i to root). Node i then sends a auditing should be done for each iteration. jmanipulated value of
  35. 35. i to its children and makes them pay The auditing and enforcement of payments can be donean extra amount compensating for the reduced share of by a trusted party that can be either a third party or the rootother users. In this case, the benefit is received not only by node itself. The trusted party is assumed to have sufficientnode i but by all the nodes in subtree T ðQÞ À Ti . As shown means (lawful contracts, guarantees, advance payments, 0in Fig. 5, node 3 sends j ¼ 8 to its parents. As a result the etc.) to force a node to pay the penalty due, in case that node i jpayments of nodes 1 and 2 decrease to
  36. 36. 1 ¼ 1 and
  37. 37. 2 ¼ 3, j is found cheating. In our design, we assume that the root j0 j0 node is a trusted party that performs the auditing andrespectively. Then, node 3 calculates
  38. 38. 3 using formula
  39. 39. i ¼ 0 0
  40. 40. p þ ðci þ
  41. 41. p ðj À j ÞÞ=ðj À nj Þ and sends this
  42. 42. i to its j j j enforces the payments. i i i i jchildren. The cheating node assigns just the value
  43. 43. p to the 3.3 SH-ANM Mechanismusers residing at that node. In the example shown in Fig. 5, j0 The proposed SH-ANM mechanism is executed in threenode 3 sends
  44. 44. 3 ¼ 6:5 to its children, thus making the phases (Fig. 6). Phase 1 (bottom-up) and Phase 2 (top-down)payment of its children equal to 8.5 (instead of 6 originally). j are executed iteratively until the mechanism stabilizes. InIn addition, it assigns
  45. 45. 3 ¼ 1 to its users and maintains the each iteration j, in Phase 1, node i receives EKk ½j Š from kbudget balance. This technique is especially useful when each children k 2 Ci . Node i calculatesthe cheating node wants to benefit the users in the subtreeT ðQÞ À Ti along with its users. In the cases discussed above, X tthe extra amount to be paid by the children of the cheating j ¼ i j a þ nj k i ð3Þnode will be quite small if there are many users in the a¼1subtree Ti ; thus, not many child nodes from Ti will drop out and sends EKi ½j Š to its parent p. idue to this increased extra amount. j Phase 2 (top-down) is initiated by root sending
  46. 46. root ¼ 0 There are other ways a node can manipulate the j j to its children. Node i receives EKp ½
  47. 47. p ki Š from its parent p.mechanism, for example, by sending a very high value of Here, k is the operator used to denote the concatenation (or j j
  48. 48. i to its children. If
  49. 49. i is sufficiently high, the utility of grouping) of two values so that they can be treated as onethe users in subtree Ti will be less than their cost share, message. Node i then calculatesand thus, they will have to remove themselves from the !set of receivers R of the transmission. Node i still receives j ci jthe transmission, but it does not have to send the
  50. 50. i ¼ þ
  51. 51. p ð4Þ j itransmission further in the multicast tree. Thus, node ican save the upload bandwidth. Here, the node is not and sends EKi ½
  52. 52. i kj Š to all its children. The cost share of the j k jacting maliciously but rationally. users at node i who receive the transmission is
  53. 53. i . We want to detect such cheating and prevent it by Phase 3 starts after the mechanism stabilizes. In this phase,penalizing the nodes who cheat. For this, we require the payments are sent by the nodes to root, and auditing is donenodes to sign the messages they send using digital by root. Assume that the mechanism stabilizes in m iterations.signatures. We then use auditing/verification procedures The payment sent by node i to root is calculated usingto detect cheating. Since the SH mechanism is essentially an paymenti ¼
  54. 54. i Á nm . The root node audits node i with m i
  55. 55. GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1095 sum of ci and the cost of all the links in the subtree rooted at i. P This can be written as Gmax ¼ j2Ti cj . If the mechanism is i executed q times, the penalty P i for node i can be calculated as P i ¼ q Á Gmax . Thus, even if node i will be caught once out of i q executions of the mechanism, the penalty will be sufficiently high to discourage cheating. If a node i can present two different messages signed by node j, then node j has to pay the penalty P j , and node i gets a reward (may be equal to P j ). When the mechanism stabilizes in m rounds, the number of messages required in SH-ANM is Âðnm þ nÞ, which is a linear increase from that of SH. This increase is due to the extra messages required for auditing by the root node (i.e., messages used for requesting and sending the proofs). 4 SH-ANM MECHANISM’S PROPERTIES In this section, we characterize the properties of the mechanism proposed in Section 3 and show that users cannot increase their benefit by deviating in any way from the proposed mechanism. According to the classical mechanism design literature, rational users can be given incentives to truthfully reveal their private values, and thus we can prevent users from exploiting the system to get unjust benefits. However, even such strategyproof mechan- isms are susceptible to manipulation because the distrib- uted algorithms implementing the mechanisms are executed by the rational users themselves. Distributed mechanisms inevitably involve passing of messages be- tween different nodes, which gives a chance to the rational nodes to manipulate the messages, thereby increasing their profit unfairly. A stronger specification known as faithful specification proposed in [25] guarantees that the users cannot derive any unfair benefit if the mechanism follows the specification. We first present the definitions of strong-communication compatibility, strong-algorithm compatibility, and faithful implementation. Then, we show that the proposed mechan- ism is a faithful implementation of the original SH mechanism. Finally, we determine the number of crypto- graphic operations involved in SH-ANM.Fig. 6. SH-ANM: distributed SH mechanism for ANM. Definition 4.1 (strong-communication compatibility) [25]. A distributed mechanism is Strong-Communication Compa-probability Pa by asking for a proof of payment. The proof of tible (Strong-CC) if a participating node cannot obtain apayment of node i is denoted by proofi and composed of higher utility by deviating from the suggested message-passingproofi ¼ km ðns kEKp ½
  56. 56. p ks ŠkEKk1 ½s 1 Šk . . . kEKkt ½s t ŠÞ. It is s¼1 i s i k k strategy (independent of its information-revelation andassumed that the root knows the public key of all the nodes computational actions) when the other nodes follow thethat want to participate in the multicast transmission. After suggested specification.receiving proofi , the root calculates j using (3) and
  57. 57. i using i j Definition 4.2 (strong-algorithm compatibility) [25]. A(4) for each iteration j. It then verifies that the payment distributed mechanism is Strong-Algorithm Compatiblereceived from users residing at node i is
  58. 58. i Á nm . This m i (Strong-AC) if a node cannot obtain a higher utility by deviatingcomputation is referred to as verification of proof. In from the suggested computational strategy (independent of itsFig. 6, the process of verifying the proof is denoted by the information-revelation and message-passing actions) when theprimitive verifyðproofi Þ. If the payment received is not equal other nodes follow the suggested specification.to
  59. 59. i Á nm , node i has to pay a penalty P i , which is higher than m iany possible gain by cheating. To prevent the nodes from Definition 4.3 (faithful implementation) [25]. A distributedcheating, Pa Á P i should be strictly greater than any gain mechanism specification is a faithful implementation when thenode i can obtain by deviating from the specified protocol. corresponding centralized mechanism is strategyproof andThis ensures that the nodes do not have incentives to deviate when the specification is Strong-CC and Strong-AC.from the protocol specification. The maximum amount a Theorem 4.1. SH-ANM is a faithful distributed implementationnode i can gain by cheating, denoted by Gmax , is equal to the i of the SH mechanism.
  60. 60. 1096 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009Proof (sketch). In order to prove this, we show that SH-ANM satisfies the three properties in Definition 4.3: 1. The corresponding centralized mechanism is strategyproof. SH-ANM is a distributed imple- mentation of the SH mechanism. Since the SH mechanism is group strategyproof [21], which is a stronger property than strategyproofness, SH-ANM is also strategyproof. 2. The specification is Strong-CC. In all the three phases of SH-ANM, no explicit message passing takes place, i.e., there is no message M that is received by node i, and the same message M is sent by node i. We can assume that the links between nodes i and p are logical links, and there may be physical nodes between two nodes who relay the message. The messages cannot be changed, because in all the phases, the messages are digitally signed by the sending node i. Thus, a node i cannot forge messages from another Fig. 7. The multicast tree with 31 nodes used in the experiments. node a. This means that it is not possible for node i to change the message received from value i to its parent, and in the top-down phase, a node another node a, and thus, it has to follow the sends two values
  61. 61. i and j to its children. Since a node has j k suggested message-passing strategy. If a node i to encrypt only these values, the size of the message to be does not send the message it is supposed to encrypted/decrypted is very small. When constructing the send, the mechanism will not proceed, and proof, a node has to combine all the messages it received, node i will not gain any benefit. and thus, there is no extra encryption/decryption per- 3. The specification is Strong-AC. In Phase 1, a formed at that time. node i may send a manipulated value of j to i its parent p. Similarly, in Phase 2, it may send a j 5 EXPERIMENTAL RESULTS modified value of
  62. 62. i to its children. However, in Phase 3, root requests proofi from node i. 5.1 Implementation proofi is composed of the messages received In order to investigate the performance of the proposed by node i in all iterations, i.e., proofi ¼ km s¼1 mechanism and the mechanisms presented in Section 2, we ðns kEKp ½
  63. 63. p ks ŠkEKk1 ½s 1 Šk . . . kEKkt ½s t ŠÞ. If node i s implemented them in a distributed environment. The i i k k cheated during Phase 1 or Phase 2, such program implementing each mechanism runs on all the cheating will be detected by the root in Phase 3 nodes participating in the multicast (including the root with probability Pa . This will cause node i to node). Messages are sent and received by the nodes to pay a penalty P i . The penalty P i for node i is calculate the cost shares, to demand/send proofs, and to chosen as mentioned in Section 3.3 such that it exchange control information. For encryption and decryp- is strictly greater than any gain node i can tion of messages using public key cryptography (specifi- achieve by deviating from the protocol. Thus, cally RSA), we rely on the OpenSSL library [44]. It is assumed that the public keys of the child and parent nodes the node has no incentive to deviate, and the are already available on each node; thus, no key exchange mechanism’s specification is Strong-AC. mechanism is employed. The implementation can be easily Since all three properties are satisfied, according to integrated within a multicast application where the selected Definition 4.3, SH-ANM is a faithful implementation of cost-sharing mechanism is executed first, and then, the the SH mechanism. u t multicast data (e.g., on-demand video) is transmitted. The SH-ANM mechanism uses asymmetric cryptogra- 5.2 Experimental Setupphy for signing the messages and decrypting the messages We deployed the implementation on PlanetLab [40]. Plane-received from its children and its parent. Here, a tLab is a platform for developing, deploying, and testingcryptographic operation is considered to be either encrypt-ing a message by a node using its private key or distributed services in a large-scale distributed environment.decrypting a message using the public key of the node We selected nodes randomly from all over the world to obtainthat sent the message. The number of cryptographic realistic data. The nodes were chosen realistically, keeping inoperations performed by a node i is 2m Á ð1 þ jCi jÞ, where mind their geographical proximity. To conduct our experi-m is the number of rounds required by the mechanism to ments, we used different numbers of nodes (7 to 127) andstabilize, and jCi j is the number of children of node i. The correspondingly generated the multicast trees. The multicastroot node has to additionally verify the proofs. This trees we used were complete binary trees, as shown in Fig. 7.requires 2m Á ð1 þ jCi jÞ operations for checking the proof Our proposed mechanism is not restricted to use onlyfrom node i. In the bottom-up phase, a node sends one complete binary trees as multicast trees. It works with any
  64. 64. GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1097Fig. 8. The effect of cheating on the payments in SH-TPM. Fig. 9. The effect of cheating on the number of users receiving the transmission in SH-TPM.type of multicast trees. The choice of a binary tree as amulticast tree in our experiments represents in a sense the prevent such cheating. The nodes can cheat in SH-TPM byworst case configuration where each node has only two sending manipulated values to their children, which causeschildren. This is because the time required to execute the the cheating nodes to pay less and the children of the cheatingmechanism depends on the depth of the multicast tree. For nodes to pay more. We did controlled experiments tothe same number of users, the depth of a complete binary tree compare the effect of cheating. We used SH-TPM withwill be much greater as compared to that of other trees that 31 nodes and eight users per node. To investigate thehave more than two children per node. Thus, in practice, for influence of Pc on the other nodes, we used five differentthe same number of nodes, the time required for execution values, Pc ¼ 0:1; 0.3, 0.5, 0.7 and 0.9. It is important to notewill be much lower as there will be more than two children here that only the nodes that have children have incentives toper node, making it more scalable. cheat. Thus, only nodes numbered from 2 to 15 situated at In our experiments, the number of users per node was depths 1, 2, and 3 cheated. Since the users at a node pay anfixed in certain cases (mentioned below). In other cases, the amount proportional to the cost of transmission to that node,number of users at a node was randomly generated using the average payment increases as the depth of the nodethe discrete uniform distribution over the interval [1, 5]. The increases. In Fig. 8, we present the average payment made byutilities of the users were also generated randomly using the nodes located at different depths in the tree. We considerthe uniform distribution over the interval [1, 100]. A user that the root is at depth 0 and that there are no users located atdrops out from a node when its cost share is greater than its the root. We observe that as Pc increases, the payment madeutility. A node drops out of the multicast tree if no user on by nodes at depths 1, 2, and 3 decreases, and the paymentthe node and its subtree are receiving the transmission (i.e., made by nodes at depth 4 increases. This is because of the facti ¼ 0). Unless stated otherwise, the probability of cheating that when a node cheats, the payment made by users of thatby nodes is Pc ¼ 0:5, and the probability of checking the node decreases, while the payment made by users at its childproof is Pa ¼ 0:5. nodes increases to maintain the budget balance. The nodes at In order to study the convergence and the scalability of depths 2 and 3 may get an increased payment due to cheatingthe mechanisms, we varied the number of users per node by their parents. These nodes transfer that payment to theirand also the number of nodes (to vary the depth of the children (because they are also cheating), and thus, the nodesmulticast tree). We call a complete execution of a mechan- that get affected and have to pay more are the leaf nodesism an experiment. Since PlanetLab is a very dynamic (nodes at depth 4).environment, and one experiment would be insufficient to When the cost share of users at a node increases, thedraw conclusions, we ran 60 experiments for each set of chance that users will drop off increases. This is becausevalues and reported the average over those experiments. their utility is less than their cost share. Thus, in Fig. 9, as PcThe main data collected for analysis are the time required increases, the average percentage of users receiving thefor each node to execute the mechanism, the number of transmission increases for nodes at depths 2 and 3 androunds required to stabilize (only for SH mechanisms), the decreases for nodes at depth 4 (because of the decrease and,number of users receiving the transmission, and the respectively, the increase in their cost shares).payment received by the root. To detect such cheating and punish the nodes, we developed the SH-ANM mechanism, which requires the5.3 Results nodes to sign the messages they send and then uses auditingWe first analyze the effect of cheating on the existing SH-TPM at the end to detect cheating. To analyze the overheadmechanism. This provides the motivation for our work, induced by the message signing and auditing used in ourwhich proposes the SH-ANM mechanism that is able to proposed mechanism, we compare the time required
  65. 65. 1098 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009Fig. 10. Execution time of the mechanisms. Fig. 11. SH-ANM: execution time at each node versus number of users per node.for execution of all four mechanisms (MC-TPM, MC-ANM,SH-TPM, and SH-ANM). Fig. 10 shows the execution time of four, six, and eight in different experiments. The utilitiesthe four mechanisms at each node for a multicast tree of and link costs were generated randomly as explained in31 nodes. Since we conducted 60 experiments for each Section 5.2.mechanism and plotted the average execution time, we also Counterintuitively, the time required for the mechanismcalculated the standard deviation and standard error of the to stabilize decreases with the increase in the number ofexecution time. The standard error is plotted as error bars in users, as shown in Fig. 11. This is because of the interestingthe figure. In the case of the MC-TPM and MC-ANM economics behind the mechanism. The users share the costmechanisms, the standard error is very small since they are of each link, and as the number of users increases, the sharenot performing several iterations, which usually induce per user decreases. Because of this, the mechanismmore variance in the results. stabilizes quickly and thus takes a smaller number of The SH mechanisms require more time than the rounds and time to converge (as shown in Fig. 13). Fig. 11corresponding MC mechanisms. This is because they shows the standard error as the error bars. We observe thatexecute the bottom-up and top-down phases iteratively, the standard error also decreases as we increase the numberwhereas the MC mechanisms execute them only once. of users per node.ANM mechanisms require more time compared to TPM In order to study the scalability of the SH-ANMmechanisms because of the additional messages used for mechanism, we conducted another set of experiments bysending and checking the proofs. We observe that the time varying the number of nodes participating in the transmis-required by SH-ANM is about 15 seconds more than that of sion. For these experiments, we fixed the number of usersSH-TPM. However, this time is negligible since the overall per node to eight. As we see in Fig. 12, the time required tomulticast transmission, generally a video or audio, takescomparatively much longer time (in the order of minutes orhours). The execution time of SH-ANM decreases as thenumber of users per node increases (as discussed below inreference to Fig. 11). The scenario we consider is when asmaller CDN acts as a node and receives the content fromthe source (bigger content provider) and delivers it to itsusers. In practice, the smaller CDNs will have hundredsand thousands of subscribers, thus reducing the overalltime required for convergence of the mechanism, as well asincreasing the economic benefits (as discussed below inreference to Fig. 13). The total time required by thecryptographic operations (message signing and decrypting)was recorded separately and was found to be negligible (inthe order of 0.1-0.4 seconds) due to short messages and avery small number of cryptographic operations. To study the effect of the number of users per node onthe convergence of the SH mechanisms, as well as othereconomic properties, we executed the SH-ANM mechanismon 31 nodes, fixing the number of users per node to two, Fig. 12. SH-ANM: execution time versus number of nodes.
  66. 66. GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1099Fig. 13. SH-ANM: effect of the number of users per node on various Fig. 14. SH-ANM: percentage of users per node receiving transmission.parameters. when the number of users is increased, as evident in Fig. 13.execute the mechanism increases as the number of nodes in In this figure, we plot the ratio of the total payment receivedthe multicast tree (i.e., the depth of the multicast tree) by the root to the sum of the costs of all links in the tree (notincreases. This happens because the nodes have to send the just those links that are involved in the transmission).messages to their parent in the bottom-up phase, starting Another interesting property of the SH mechanism isfrom the leaf nodes, which goes up to the root, and the observed in Fig. 14. In this figure, we present the averagemessage sent from root has to go to the leaf nodes in the percentage of users receiving the transmission for all thetop-down phase. As the depth of the tree increases, this nodes at a particular depth of the tree. We observe awhole process takes more time, and thus, the total execution decrease in the percentage of users receiving the transmis-time increases. The increase in the time is linear to the depth sion as the depth increases. This is because at the top of theof the tree, and thus, the mechanism is quite scalable. tree, the cost share per user is small due to a small number We also see in Fig. 12 that the average number of rounds of links connecting to the root. Since the cost share is small,required to stabilize the mechanism increases with the more users will be able to receive the transmission, even ifincrease in the number of nodes. This is quite opposite to their utilities are small. As we go toward the leaf nodes, thethe observation that when the number of users was number of links necessary to reach the root increases, andincreased, the number of rounds decreased. The reason the cost share increases. This reduces the number of usersfor this is that as the depth increases, the cost share per user on the nodes who receive the transmission. We also note inincreases, especially for the leaf nodes; thus, more users Fig. 14 that as the number of users per node is increased, thedrop off, increasing the number of rounds necessary to percentage of users receiving the transmission increases.converge. However, we see in Fig. 12 that the increase in the This is most significantly observable in the case of leafaverage number of rounds is linear to the increase in the nodes (at depth 4). As the number of users is increased fromnumber of nodes. We also observed that the total number of two to eight, the average percentage of users who receiveusers receiving the transmission decreased, although insig- the transmission increases from 25 percent to 85 percent.nificantly, as the number of nodes is increased. This is because the cost share per user decreases as the In Fig. 13, we show the average number of rounds number of users per node is increased, and thus, fewerrequired to complete the execution of the mechanism with users drop off.varying numbers of users per node. The number of rounds In the following, we focus on the economic aspects ofis shown on the right vertical axis. We see that the number our proposed mechanism and the MC and SH mechanismsof rounds required to converge decreases as we increase the in general. We have found several interesting results andnumber of users per node. Another important consequence verified many theoretical results from the experiments withof increasing the number of users is that the total payment distributed deployment of these mechanisms. One signifi-received by the mechanism increases, as shown in Fig. 13. cant observation is with regard to the payment received andThis is because as the cost share per user becomes smaller; a the number of users receiving the multicast transmission insmaller number of users drop out from receiving the the MC and SH mechanisms. As pointed out earlier, the MCtransmission. Although the SH mechanism is budget mechanism is not budget balanced and runs a budgetbalanced, it will not receive the maximum possible payment deficit in most of the cases, which is not a favorableif a subtree of the multicast tree does not receive the property from the content provider’s perspective. Intransmission. In other words, the root will receive the contrast, the SH mechanism is budget balanced. In Fig. 15,maximum payment if every subtree of the multicast tree has we show the payment received as the percentage of the totalat least one user receiving the transmission. This happens cost of all links. We denote by “MC” the MC-TPMwhen there is a small cost share per user, which is obtained mechanism when the number of users per node is
  67. 67. 1100 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009 and redundancy, can be used to achieve a faithful execution [25]. This is an interesting avenue for future research, and we plan to explore it. We also plan to study the convergence of the Shapley mechanism and develop faithful mechanisms for other distributed computing problems. ACKNOWLEDGMENTS This paper is a revised and extended version of the preliminary work presented in [45] and [46]. The authors wish to express their thanks to the editor and the anonymous referees for their helpful and constructive suggestions, which considerably improved the quality of the paper. This research was supported in part by US National Science Foundation (NSF) Grant DGE-0654014. REFERENCES [1] A. Dan, D. Sitaram, and P. Shahabuddin, “Scheduling Policies forFig. 15. Payment received and the number of users receiving the an On-Demand Video Server with Batching,” Proc. Second ACM Int’l Conf. Multimedia (MULTIMEDIA ’94), pp. 15-23, Oct. 1994.transmission in MC-TPM and SH-TPM mechanisms. [2] V.O.K. Li and Z. Zaichen, “Internet Multicast Routing and Transport Control Protocols,” Proc. IEEE, vol. 90, no. 3,generated randomly within the interval [1, 5] and by “MC- pp. 360-391, 2002. [3] K.C. Almeroth and M.H. Ammar, “The Use of Multicast Delivery8” the MC-TPM mechanism with eight users per node. We to Provide a Scalable and Interactive Video-on-Demand Service,”use similar notation for the SH mechanisms. We observe in IEEE J. Selected Areas in Comm., vol. 14, no. 6, pp. 1110-1122, 1996.Fig. 15 that the payment received in the case of the MC [4] K. Sripanidkulchai, B. Maggs, and H. Zhang, “An Analysis of Live Streaming Workloads on the Internet,” Proc. Fourth ACMmechanism is smaller than that in the case of the SH SIGCOMM Conf. Internet Measurement (IMC ’04), pp. 41-54,mechanism (for both [1..5] users and eight users per node). Oct. 2004.MC-8 generated no revenue at all (i.e., all users pay 0), [5] G. Tan and S.A. Jarvis, “Improving the Fault Resilience of Overlayalthough all of the users received the transmission. In Multicast for Media Streaming,” IEEE Trans. Parallel and Dis- tributed Systems, vol. 18, no. 6, pp. 721-734, June 2007.contrast, SH-8 recovered 100 percent of the cost, and about [6] P. Van Mieghem, G. Hooghiemstra, and R. van der Hofstad, “On95 percent of users received the transmission. These results the Efficiency of Multicast,” IEEE/ACM Trans. Networking, vol. 9,show that from the content provider’s point of view, the SH no. 6, pp. 719-732, 2001. [7] V.P. Kompella, J.C. Pasquale, and G.C. Polyzos, “Multicastmechanisms are more beneficial than the MC mechanisms. Routing for Multimedia Communication,” IEEE/ACM Trans. Networking, vol. 1, no. 3, pp. 286-292, 1993. [8] D. Dolev, O. Mokryn, and Y. Shavitt, “On Multicast Trees:6 SUMMARY AND FUTURE WORK Structure and Size Estimation,” IEEE/ACM Trans. Networking,The TPM of distributed implementation assumes that the vol. 14, no. 3, pp. 557-567, 2006. [9] S. Banerjee, B. Bhattacharjee, and C. Kommareddy, “Scalableagents participating in the mechanism will not deviate from Application Layer Multicast,” Proc. ACM SIGCOMM ’02,the distributed implementation. In ANM, the participants pp. 205-217, Aug. 2002.may deviate, and thus, the existing TPM mechanisms are [10] J. Jannotti, D.K. Gifford, K.L. Johnson, M.F. Kaashoek, and J.W. O’Toole, Jr., “Overcast: Reliable Multicasting with an Overlayvulnerable to manipulations. We proposed a distributed Network,” Proc. Fourth Symp. Operating Systems Design andcost-sharing Shapley mechanism for ANM (SH-ANM) that Implementation (OSDI ’00), pp. 197-212, Oct. 2000.is able to prevent such manipulations. To design the [11] Y.-H. Chu, S.G. Rao, and H. Zhang, “A Case for End Systemmechanism, we used digital signatures for authentication Multicast,” Proc. ACM SIGMETRICS ’00, pp. 1-12, June 2000. [12] S. Ratnasamy, M. Handley, R. Karp, and S. Shenker, “Topologi-of messages and auditing by the root node to penalize the cally-Aware Overlay Construction and Server Selection,” Proc.cheating nodes. Thus, no node has incentives to cheat. We IEEE INFOCOM ’02, vol. 3, pp. 1190-1199, June 2002.proved that the proposed mechanism is a faithful imple- [13] N. Laoutaris, G. Smaragdakis, K. Oikonomou, I. Stavrakakis, and A. Bestavros, “Distributed Placement of Service Facilities inmentation of the original SH mechanism. Large-Scale Networks,” Proc. IEEE INFOCOM ’07, pp. 2144-2152, We implemented the proposed mechanism in a real-world May 2007.environment provided by PlanetLab to analyze the overhead [14] S. Deering and D.R. Cheriton, “Multicast Routing in Datagraminduced by the additional computation and communication Internetworks and Extended LANs,” ACM Trans. Computer Systems, vol. 8, no. 2, pp. 85-110, 1990.resulting from the authentication and auditing procedures. [15] C. Yi, X. Yuan, and K. Nahrstedt, “Optimal Resource Allocation inFrom the experimental results, we conclude that the SH- Overlay Multicast,” IEEE Trans. Parallel and Distributed Systems,ANM mechanism does not induce a significant overhead to vol. 17, no. 8, pp. 808-823, Aug. 2006. [16] C. Huang, J. Li, and K.W. Ross, “Can Internet Video-on-Demandthe multicast transmission. We also deployed the existing Be Profitable?” Proc. IEEE INFOCOM ’07, pp. 2144-2152, May 2007.MC-TPM, MC-ANM, and SH-TPM mechanisms and com- [17] N. Nisan and A. Ronen, “Algorithmic Mechanism Design,” Gamespared their performance with that of SH-ANM. and Economic Behaviour, vol. 35, nos. 1/2, pp. 166-196, Apr. 2001. Our mechanism relies on cryptographic techniques to [18] J. Feigenbaum and S. Shenker, “Distributed Algorithmic Mechanism Design: Recent Results and Future Directions,” Proc.enforce the nodes to follow the protocol specification. Other Sixth ACM Workshop Discrete Algorithms and Methods for Mobilemethods, such as using incentives, problem partitioning, Computing and Comm. (DIALM ’02), pp. 1-13, Sept. 2002.
  68. 68. GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1101[19] A. Mas-Colell, M.D. Whinston, and J.R. Green, Microeconomic [45] N. Garg and D. Grosu, “Faithful Distributed Shapley Mechanisms Theory. Oxford Univ. Press, 1995. for Sharing the Cost of Multicast Transmissions,” Proc. 12th IEEE[20] J. Feigenbaum, C. Papadimitriou, and S. Shenker, “Sharing the Symp. Computers and Comm. (ISCC ’07), pp. 741-747, July 2007. Cost of Multicast Transmissions,” J. Computer and System Sciences, [46] N. Garg and D. Grosu, “Performance Evaluation of Multicast Cost vol. 63, no. 1, pp. 21-41, Aug. 2001. Sharing Mechanisms,” Proc. 21st IEEE Int’l Conf. Advanced[21] H. Moulin and S. Shenker, “Strategyproof Sharing of Submodular Information Networking and Applications (AINA ’07), pp. 901-908, Costs: Budget Balance versus Efficiency,” J. Economic Theory, May 2007. vol. 18, no. 3, pp. 511-533, 2001.[22] J. Green, E. Kohlberg, and J. Laffont, “Partial Equilibrium Nandan Garg received the bachelor’s degree Approach to the Free-Rider Problem,” J. Public Economics, vol. 6, in computer applications from Devi Ahilya no. 4, pp. 375-394, 1976. Vishwavidyalaya, Indore, India, and the mas-[23] J. Feigenbaum, A. Krishnamurthy, R. Sami, and S. Shenker, ter’s degree in computer applications from Rajiv “Approximation and Collusion in Multicast Cost Sharing,” Proc. Gandhi Technical University, Bhopal, India. He Fourth ACM Conf. Electronic Commerce (EC ’03), p. 280, June 2003. is currently a PhD candidate in the Department[24] J. Feigenbaum, A. Krishnamurthy, R. Sami, and S. Shenker, of Computer Science, Wayne State University, “Hardness Results for Multicast Cost Sharing,” Theoretical Detroit. His research interests include incentive- Computer Science, vol. 304, nos. 1-3, pp. 215-236, 2003. based computing, game theory and mechanism[25] J. Shneidman and D.C. Parkes, “Specification Faithfulness in design, distributed systems, security, and par- Networks with Rational Nodes,” Proc. 23rd Ann. ACM Symp. allel processing. He is a student member of the IEEE. Principles of Distributed Computing (PODC ’04), pp. 88-97, July 2004.[26] L. Lao, J.H. Cui, M. Gerla, and S. Chen, “A Scalable Overlay Daniel Grosu received the diploma in engineer- Multicast Architecture for Large-Scale Applications,” IEEE Trans. ing (automatic control and industrial informatics) Parallel and Distributed Systems, vol. 18, no. 4, pp. 449-459, Apr. from the Technical University of Iasi, Romania, 2007. in 1994 and the MSc and PhD degrees in[27] S. Banerjee, C. Kommareddy, K. Kar, B. Bhattacharjee, and computer science from the University of Texas S. Khuller, “Omni: An Efficient Overlay Multicast Infrastructure at San Antonio in 2002 and 2003, respectively. for Real-Time Applications,” Computer Networks, vol. 50, no. 6, Currently, he is an assistant professor in the pp. 826-841, 2006. Department of Computer Science, Wayne State University, Detroit. His research interests in-[28] Y. Chawathe, “Scattercast: An Adaptable Broadcast Distribution clude distributed systems and algorithms, re- Framework,” Multimedia Systems, vol. 9, no. 1, pp. 104-118, 2003. source allocation, computer security, and topics at the border of[29] E.I. Lin, A.M. Eskicioglu, R.L. Lagendijk, and E.J. Delp, “Advances computer science, game theory, and economics. He has published in Digital Video Content Protection,” Proc. IEEE, vol. 93, no. 1, more than 50 peer-reviewed papers in the above areas. He has served pp. 171-183, 2005. on the program and steering committees of several international[30] S. Rafaeli and D. Hutchison, “A Survey of Key Management for meetings in parallel and distributed computing. He is a member of the Secure Group Communication,” ACM Computing Surveys, vol. 35, ACM and a senior member of the IEEE and the IEEE Computer Society. no. 3, pp. 309-329, 2003.[31] S. Deering, D.L. Estrin, D. Farinacci, V. Jacobson, L. Ching-Gung, and W. Liming, “The PIM Architecture for Wide-Area Multicast Routing,” IEEE/ACM Trans. Networking, vol. 4, no. 2, pp. 153-162, . For more information on this or any other computing topic, 1996. please visit our Digital Library at www.computer.org/publications/dlib.[32] T.E. Carroll and D. Grosu, “Distributed Algorithmic Mechanism Design for Scheduling on Unrelated Machines,” Proc. Eighth Int’l Symp. Parallel Architectures, Algorithms, and Networks (I-SPAN ’05), pp. 194-199, Dec. 2005.[33] T.E. Carroll and D. Grosu, “A Strategyproof Mechanism for Scheduling Divisible Loads in Tree Networks,” Proc. 20th IEEE Int’l Parallel and Distributed Processing Symp. (IPDPS ’06), Apr. 2006.[34] J. Shneidman, D.C. Parkes, and L. Massoulie, “Faithfulness in Internet Algorithms,” Proc. ACM SIGCOMM Workshop Practice and Theory of Incentives in Networked Systems (PINS ’04), pp. 220-227, Sept. 2004.[35] S. Shakkottai and R. Srikant, “Economics of Network Pricing with Multiple ISPs,” IEEE/ACM Trans. Networking, vol. 14, no. 6, pp. 1233-1245, 2006.[36] J. MacKie-Mason and H. Varian Pricing the Internet, Public Access to the Internet, pp. 269-314. MIT Press, 1995.[37] S. Herzog, S. Shenker, and D. Estrin, “Sharing the “Cost” of Multicast Trees: An Axiomatic Analysis,” IEEE/ACM Trans. Networking, vol. 5, no. 6, pp. 847-860, 1997.[38] J. Mitchell and V. Teague, “Autonomous Nodes and Distributed Mechanisms,” Software Security—Theories and Systems. Mext-NSF- JSPS Int’l Symp. (ISSS ’02), pp. 58-83, 2003.[39] S. Gorinsky, S. Jain, H. Vin, and Z. Yongguang, “Design of Multicast Protocols Robust against Inflated Subscription,” IEEE/ ACM Trans. Networking, vol. 14, no. 2, pp. 249-262, 2006.[40] PlanetLab, http://www.planet-lab.org, 2008.[41] S. Siachalou and L. Georgiadis, “Algorithms for Precomputing Constrained Widest Paths and Multicast Trees,” IEEE/ACM Trans. Networking, vol. 13, no. 5, pp. 1174-1187, 2005.[42] S. Ramanathan, “Multicast Tree Generation in Networks with Asymmetric Links,” IEEE/ACM Trans. Networking, vol. 4, no. 4, pp. 558-568, 1996.[43] L.S. Shapley, “A Value for N-Person Games,” Contribution to the Theory of Games, vol. 2, Princeton Univ. Press, pp. 31-40, 1953.[44] OpenSSL, http://www.openssl.org, 2008.