Specification Faithfulness in Networks with Rational Nodes

Jeffrey Shneidman, David C. Parkes Division of Engineering and Applied Sciences, Harvard University, 33 Oxford Street, Cambridge MA 02138 {jeffsh, parkes}@eecs.harvard.edu

ABSTRACT drive up their “contributed computation” credit [15]. There It is useful to prove that an implementation correctly follows is interesting work documenting the “free rider” problem [1] a specification. But even with a provably correct implemen- and the “tragedy of the commons” [12] in a data centric peer tation, given a choice, would a node choose to follow it? This to peer setting. paper explores how to create distributed system specifica- This behavior can be classified as a type of failure, which tions that will be faithfully implemented in networks with should stand independently from other types of failures in rational nodes, so that no node will choose to deviate. Given distributed systems and is indicative of an underlying in- a strategyproof centralized mechanism, and given a network centive problem in a system’s design when run on a network of nodes modeled as having rational-manipulation faults, with rational nodes. Whereas traditional failure models are we provide a proof technique to establish the incentive-, overcome by relying on redundancy, rational manipulation communication-, and algorithm-compatibility properties that can also be overcome with design techniques such as prob- guarantee that participating nodes are faithful to a sug- lem partitioning, catch-and-punish, and incentives. In such gested specification. As a case study, we apply our methods a network one can state a strong claim about the faithfulness to extend the strategyproof interdomain routing mechanism of each node’s implementation. This claim of faithfulness, proposed by Feigenbaum, Papadimitriou, Sami, and Shenker like traditional distributed systems claims (e.g: safety and (FPSS) [7], defining a faithful implementation. liveness [35]), is made with particular assumptions about the knowledge available to network participants. Typical dis- Categories and Subject Descriptors tributed systems knowledge assumptions include node fail- F.2 [Theory of Computation]: Analysis of Algorithms ure characteristics: for instance, a given specification might and Problem Complexity; J.4 [Computer Applications]: state safety properties on the assumption that no link fail- Social and Behavioral Sciences—Economics.; I.2.11 [Distri ures will occur in the network. The knowledge assumptions buted Artificial Intelligence]: particularly relevant to our scenario are drawn from eco- General Terms nomics and known as equilibrium concepts. This paper fo- Algorithms, Design, Economics. cuses on (and justifies) the use of ex post Nash (without collusion) as a reasonable knowledge assumption. The ex Keywords post Nash solution concept does not require nodes to have Distributed Algorithmic Mechanism Design, Computational any knowledge of the private information of other nodes, but Mechanism Design, Rational Manipulation, Algorithm Com- does assume that nodes are rational utility-maximizers and patibility, Communication Compatibility, Incentive Com- model other participants as such. patibility, Failure Models, Rational Failure When one can prove that a specification will be faithfully 1. OVERVIEW followed by rational nodes in a distributed network, one can This paper considers how to create provably faithful speci- certify the system to be incentive-, communication-, and fications that are implemented on networks of rational nodes. algorithm-compatible (IC, CC and AC). Such a system is In these networks, a node acts in self-interested fashion to provably robust against rational manipulation. better its outcome in some distributed mechanism. We introduce a general decomposition proof technique, It is not hard to find evidence of rational behavior in ex- that splits a distributed algorithm into disjoint phases, each isting distributed systems. Internet users can game their of which can be proven IC, CC, and AC by showing that a TCP settings to obtain better service at the expense of oth- node cannot benefit from any combination of deviation from ers [27]. Users cheat in distributed computations in order to the specification relevant to that phase. To ensure that one phase is disjoint from the next, a phase is certified before the subsequent phase begins.1 To demonstrate this decomposition technique, we modify Permission to make digital or hard copies of all or part of this work for a well-defined lowest cost interdomain routing problem pro- personal or classroom use is granted without fee provided that copies are posed by Feigenbaum, Papadimitriou, Sami, and Shenker not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to 1 republish, to post on servers or to redistribute to lists, requires prior specific This decomposition technique is similar in spirit to offline permission and/or a fee. compositional reasoning proof techniques in distributed sys- PODC’04, July 25–28, 2004, St. Johns, Newfoundland, Canada. tems [18], where automata are examined and proved correct Copyright 2004 ACM 1-58113-802-4/04/0007 ...$5.00. in order to extrapolate correctness of the overall system. (FPSS) [7], to create a specification that is ex post Nash sage passing in resource-constrained environments [36, 14], incentive-, communication-, and algorithm-compatible. Un- through the use of payments and penalties. Message pass- like the original FPSS, we do not assume that nodes will be ing has also been studied in the context of an auction over a faithful in their computation or message passing. peer to peer network, with a centralized obedient auctioneer but nodes that may wish to drop or change bids from their 2. RELATED WORK neighbors [20]. The ideal prerequisites and reference reading for this pa- per are found in the distributed systems and algorithmic 3. RATIONAL MANIPULATION mechanism design literature. A “short list” in distributed Imagine that a designer specifies a leader-election algo- systems would include a paper characterizing failure models rithm to select a computation server in a network whose [29], as well as an introduction to specifications and their nodes are distributed across many administrative domains. proof techniques [35]. The economics subfield of mechanism The winner of this leader election is responsible for running design (MD) studies how to build systems that exhibit good some CPU-intensive task. The designer wants the most pow- behavior in equilibrium, when self-interested nodes pursue erful node to be selected and specifies an algorithm where self-interested strategies. Readers unfamiliar with the fun- each node is to submit its true computation power and then damentals of mechanism design may wish to seek out a con- come to a distributed consensus as to which node should cise introduction [24, 13]. be leader. The designer provides a correct implementation, Algorithmic mechanism design (AMD) [21, 22] assumes but is dismayed to find that in practice, the protocol fails to centralized decision making, with nodes reporting complete elect the most powerful node. What has gone wrong? private information to a center, but seeks to make the central In this toy election problem, it is possible that nodes computation tractable. Indirect mechanisms, on the other (representing users) do not want to participate faithfully in hand, provide an increased computational role to nodes, the distributed algorithm. By truthfully revealing a node’s but still remain largely centralized in that nodes are di- computational power and following the distributed election rectly connected to a center and are limited to what we protocol, a node is in danger of being tasked with a cpu- term “information-revelation” actions [24]. intensive chore that would take resources away from local Distributed algorithmic mechanism design (DAMD) [7, 8] jobs. The selfish administrator of that node might like considers MD in a network setting with no center, and dis- to change the election-protocol code to execute something tributes computation across the self-interested nodes. DAMD other than the code provided by the system designer. is full of new challenges since one can no longer assume an Researchers have previously characterized the nuances of obedient networking and mechanism infrastructure where node failure according to observed behavior and failure rem- rational players control the message paths and mechanism edy [28, 17, 5, 9]. Into the traditional taxonomy that ranges computation. In concluding their seminal work on AMD, from Failstop to Byzantine, it is appropriate to introduce ra- Nisan and Ronen noted the “set of problems” that come tional manipulation as a class of system failure. Extending in implementing a mechanism in a network [23], suggest- the typical distributed systems failure taxonomy to include ing that cryptography and distributed payment handling be rational manipulation is justified for several reasons: considered. Feigenbaum et al. [7] identify the problem in • The Internet is already showing evidence of rational ma- DAMD as “the need to reconcile the strategic model with nipulation in algorithms that were not designed to handle the computational model.” this type of failure. An anecdotal list appears in previous Our work attempts a comprehensive treatment of rational work [30]. manipulation in distributed systems, and provides a frame- work and a way of reasoning about faithful behavior in mech- • The behavior of a node that is deviating from a speci- anisms. Specifically, we are concerned with bringing all as- fication for selfish reasons would currently be classified pects of the distributed algorithm itself into an equilibrium. in distributed systems failure taxonomies as a subset of In a companion paper focused on problems in distributed Byzantine behavior. However, rational failures are pre- AI [25], we consider a variant on the model in this paper dictable and motivated because a node will only manip- in which there is still a center and trusted communication ulate in order to increase its own utility in the mech- with nodes, but in which the goal is to off-load as much of anism. This provides new opportunities for designing the computation as possible onto nodes. Some of the gen- against failure, through tools such as incentives and care- eral principles (the partition-, information-revelation, and ful problem partitioning. redundancy principles) in that work also prove useful when • It is either suboptimal, or impossible, to use Byzantine dealing with fully-distributed implementations on networks. Fault Tolerance (BFT) techniques to build systems ro- The specific contribution here is to provide general proof bust to rational-manipulation failure [30]. BFT requires techniques and to extend the ideas to apply to networks minimum levels of obedient connectivity and computa- without a center. tion to work [18], whereas we might want to design sys- A number of research projects can be viewed as foreshad- tems in which every participant is capable of rational owing aspects of achieving general algorithm faithfulness. manipulation. BFT algorithms can be suboptimal in the Some TCP research has focused on modifying the specifi- sense that they require a large processing overhead. cation and introducing obedient participants to bring faith- ful computation into line [27]. Other work has assumed 3.1 Modeling Node Behavior trusted communication (or a totally connected communi- Before defining a distributed mechanism specification we cation graph), but no trusted entity to perform computa- need a language for specifications. This language will also tion and made heavy use of cryptography [3]. In mobile make clear the range of behaviors available to a node. We networks, some work has looked at achieving faithful mes- find it useful to consider a mechanism specification expressed in terms of behaviors generated by state machines [35]. A cussing a node’s reported type θˆi, it makes sense to talk of state machine SM consists of the following components: a node’s strategy s(θ), which captures how it behaves in all states of the world. Rather than an outcome rule f(θ) ∈ O, 1. A set L of states, a subset of which are initial states. that depends on the reported type information, we now must 2. A set A = {IA, EA} of actions, of which set IA are speak of an outcome rule g(s(θ)) ∈ O that depends on the internal actions and set EA of external actions. sequence of actions taken by a node. We now present the distributed state machine description in an alternate form, 0 3. A set T of state transitions of the form (s, a, s ) where in which the actions, states, and transitions are subsumed 0 s and s are states in L and a is an action in A. by strategy and outcome function. Given this state machine SM , a specification s : L → A, Definition 1. Distributed mechanism specification, d defines an action s(l) ∈ A for each state l ∈ L. A node’s state M = (g, Σ, sm) defines an outcome rule, g, a feasible strategy captures all relevant information about its role in a mecha- space Σ = (Σ × ... × Σ ), and a suggested strategy, sm = nism. For instance, the state will include received messages, 1 N (sm, . . . , sm). partial computations, private knowledge about itself, and 1 N derived or estimated knowledge about other nodes and the It is helpful to think of the suggested strategy sm ∈ Σ as world. External actions in a distributed computational sys- i i the algorithm that the designer would like node i to follow. tem represent actions with some external effect; these ac- Strategy sm is conditioned on the type θ of a node, with tions generate a message to one or more neighbors. These i i sm(θ ) defining the specification of the action that node i messages can represent the results of calculations, messages i i with type θ should take in each state (within the state- forwarded from other nodes, or simply contain information i machine model of node behavior). The feasible strategy about this node. Internal actions are those that do not gen- space, Σ , places no constraints on internal actions but can erate a message. Internal actions can eventually cause an i constrain external actions. Outcome rule, g(s(θ)) ∈ O, de- external action to occur. scribes the outcome when nodes follow strategy s and have 3.2 Traditional Mechanism Design types θ. Suggested strategy sm decomposes into three strategies, State machines are a good way to describe a mechanism i sm = (rm, pm, cm), with information-revelation strategy rm, specification. Traditional mechanism design (MD), however, i i i i i message-passing strategy pm, and computational strategy often assumes that the only actions available to a node are i cm. Each sub-strategy is responsible for generating one of information revelation actions. Here, a node is allowed to i three kinds of external actions (those corresponding with provide input into a center, which is often described as a the sub-strategy), which we formally define in Section 3.4. function from everybody’s information revelation to some Formally, we can model this as each strategy simulating the mechanism outcome. entire specification, sm(θ ), but only performing its corre- In mechanism design language, consider a system with i i sponding external actions. Notice that because only one nodes, i ∈ I. There are N nodes altogether. Traditional action is taken in each state, no pair of sub-strategies will MD considers an implementation problem, in which nodes engage in multiple external actions simultaneously. have private information θ ∈ Θ (often referred to as the i i Given a distributed mechanism specification we are inter- type of a node) and the goal is to implement an outcome ested in understanding whether nodes have any incentive to f(θ) ∈ O with useful properties (as defined by the designer), deviate from the suggested actions. from a set of feasible outcomes O. A node’s type defines all relevant information that pertains to the outcome decision, as well as capturing information about its preferences for dif- 3.4 Action Classification ferent outcomes. Notation θ−i = (θ1, . . . , θi−1, θi+1, . . . , θN ) The leader election example shows the three components denotes the type vector without node i. of a strategy: information revelation, in providing an input A centralized (often called a direct-revelation) mechanism, to the election algorithm; message passing between nodes; and computation, in following the consensus algorithm. We M = (f, Θ) asks nodes to report types θˆ ∈ Θ = Θ1×...×ΘN to a trusted obedient center that then selects the outcome now provide a formal classification of the external actions in f(θˆ). Nodes need not be truthful, but are instead modeled as a mechanism specification. game-theoretic utility-maximizers (rational), with a utility Information Revelation. A node may be asked to reveal function, ui(o; θi) ∈ R, that induces a preference ordering information about its private type, such as its computational s.t. ui(o1; θi) < ui(o2; θi) implies that node i prefers o2 to power in the leader-election setting. We also extend the no- o1. Incentives are provided so that node i chooses to report tion of type to include the concept of semi-private type in- θˆi = θi in equilibrium. formation. The type θi in traditional MD is most usually In this model, the center can collect type information from viewed as private information to a node. Alternatively, some nodes without interference from other nodes, and then com- information can be common knowledge to all nodes or some pute the outcome, report the outcome to the nodes, and subset of nodes. In distributed systems it is useful to define finally enforce the outcome. But, in problems such as leader the notion of semi-private type information. Semi-private election there is no trusted center and we need to involve type information exists when some subset of the type of the self-interested nodes themselves in computing, commu- a node is known to at least one other node, but not to all nicating, and enforcing the outcome of the mechanism. nodes. A good example is network topology: we can imagine that the link between node A and node B is common knowl- 3.3 Distributed Mechanism Specification edge to both nodes, while other type information (such as Distributed mechanism design should encompass actions node transit cost) remains private, and other nodes need not beyond private information revelation. Rather than dis- know about the existence of this link. Definition 2. External actions ri ∈ EA are information- 3.5 Knowledge Assumptions revelation actions when the only effect is to reveal consis- A formal definition of rational manipulation requires that tent (perhaps partial and untruthful) information about a we are clear about the knowledge assumptions that we, as node’s type to some other node(s). designers, make of nodes in a system. In an economic con- Here, we use consistent to mean that there is a single type text, these knowledge assumptions must support the equilib- rium solution concept that is adopted to model the behavior θˆi that would have sent these messages in the suggested specification. of rational nodes. We can provide a careful definition of the information- In traditional MD, it is common to design for a dominant- 2 strategy equilibrium. Recall that a traditional mechanism revelation actions in the suggested specification. Suppose ˆ for exposition that all nodes except node i follow the sug- M = (f, Θ) implements outcome f(θ) ∈ O based on reports ˆ gested specification. Then, the information-revelation ac- θ, perhaps untruthful. A mechanism is strategyproof when m truth-revelation is a dominant-strategy equilibrium. tions for node i in si (θi) are those for which any deviation on any subset of the actions will do no more than imple- Definition 5. Centralized mechanism M = (Θ, f) is strat- ment an outcome that would be selected by following the egyproof if ui(f(θi, θ−i); θi) ≥ ui(f(θˆi, θ−i); θi) for all θi, suggested specification for some (perhaps untruthful) type ˆ ˆ 0 m m ˆ m all θi 6= θi, and all θ−i. θi. Formally, g(s , s−i(θ−i)) = g(si (θi), s−i(θ−i)), for all 0 m s that deviate from si (θi) only in information-revelation Strategyproofness is particularly useful because it makes actions, and for all θi and all θ−i. Thus, information- reve- an extremely weak knowledge assumption. Nodes need not lation actions provide a node with no more power to manip- know the types of other nodes, and nodes need not even be- ulate than that available to a node in a centralized mecha- lieve that other nodes will be rational. In this work we adopt nism.3 ex post Nash equilibrium as our solution concept, which re- Message passing. A node may be asked to pass messages quires correspondingly stronger knowledge assumptions. as part of the mechanism computation. For instance, if two ∗ nodes are communicating over a logical direct connection, Definition 6. A strategy profile s is an ex post Nash equilibrium in distributed mechanism specification dM = there may still be rational nodes acting as part of the phys- m ∗ ∗ 0 (g, Σ, s ) if si satisfies ui(g(s (θ)); θi) ≥ ui(g(si(θi), ical underlay. ∗ 0 ∗ s−i(θ−i)); θi), for all nodes, for all si 6= si , for all types θi, Definition 3. External actions pi ∈ EA are message- and for all types θ−i of other nodes. passing actions when the only effect is to send a message, received from another node, to one (or more) neighbors. In an ex post equilibrium no node would like to deviate from its strategy even if it knows the private type infor- Computation. A node may be asked to take part in a mation of the other nodes. Thus, as designers we can be mechanism calculation. For instance, a node in the lowest- agnostic as to whether or not nodes have any knowledge cost interdomain-routing setting can be asked to perform about the private type of other nodes. The main assump- part of a distributed computation to determine the lowest- tion when adopting ex post Nash is that the rationality of cost path, or to determine payments. nodes is common knowledge amongst nodes. Although a stronger assumption than required for a strategyproof mech- Definition 4. External actions ci ∈ EA are computa- anism, we view this as a necessary cost in moving away from tional actions when the action can affect the outcome rule centralized computation on a trusted node. Nodes are now used in the distributed mechanism specification (and when involved in implementing the rules of a mechanism, and it the action is more than simple message-passing). seems unlikely that arbitrary deviations by other nodes will still sustain the appropriate incentives for a node to behave Computational actions have a wider effect than simply faithfully. forwarding a message or revealing type information. Unlike The knowledge assumption in ex post Nash is still much information-revelation actions, these computational actions weaker than that required in the more standard Nash equi- introduce opportunities for a node to affect the outcome of a librium solution concept, which has received greater atten- mechanism that do not exist in centralized mechanisms! By tion in recent literature on network games [26]. Adopting definition, a computational action is one for which there is this notion of Nash equilibrium in our setting would require at least one deviation from the suggested specification that a node to have knowledge of other nodes’ private informa- will implement an outcome that would not be selected by m tion, which is usually unrealistic. g(s (θˆi, θ−i)) for any report θˆi by the node. 2Notice that we need to rule out the possibility that an agent Remark 1. We assume that nodes, although self-interested, can provide inconsistent information about its type, for ex- are also benevolent in the sense that a node will implement ample different information to different neighbors, because the suggested strategy as long as it does not strictly prefer a deviation from any number of information-revelation ac- some other strategy. Thus, a weak ex post Nash equilibrium tions must have no more effect than that of misreporting the (in which a node can have other equally good best-responses) agent’s type and following the suggested specification. is considered sufficient for a faithful implementation. 3The definition excludes actions in which useful computa- tion is also “smuggled” within the message, for example Remark 2. A distributed mechanism may have multiple “solve problem P1 (and report the solution) if your value equilibria, but we are content to achieve implementation in is v and solve problem P (and report the solution) if your 1 2 but one of these equilibria. We agree with Brafman and Ten- value is v .” We classify these kinds of actions as compu- 2 nenholtz [2], that the fact that we are considering computa- tational actions when the solutions to P1 or P2 can change the outcome rule g, and not just the information that a node tional systems makes this assumption more palatable. The reveals during an implementation. typical problem that arises with multiple equilibria is that of selection: how can nodes select the same equilibrium. By exists an ex post Nash equilibrium in which node i cannot re- distributing an implementation of a suggested specification, ceive higher utility by deviating from the suggested message- m it is reasonable to expect that some nodes will be obedient passing strategy pi (θi), for all nodes i and all types θ. and follow the suggested specification. This acts as a corre- lating device, preventing other nodes from playing another CC means that a rational node will choose to partici- equilibrium. pate in the suggested message-passing actions within the distributed-mechanism specification. Remark 3. Although truth-revelation may remain a domin- ant-strategy for nodes given that all nodes follow the sug- Definition 11. A distributed mechanism specification dM = m gested computational and message-passing actions, in equi- (g, Σ, s ) is algorithm compatible (AC) when there exists librium a rational node must also reason about whether or an ex post Nash equilibrium in which node i cannot receive not other nodes will follow these suggested computational higher utility by deviating from the suggested computational m and message-passing actions. Thus, the equilibrium solu- strategy ci (θi), for all nodes i and all types θ. tion concept must adopt the “lowest-common denominator,” AC means that a rational node will choose to participate which is ex post Nash in our model. in the suggested computational actions within the distributed- 3.6 Rational Manipulation mechanism specification. Properties IC, CC and AC are re- quired for a faithful distributed implementation. Moreover, We use the term rational node to describe a node that IC, CC and AC are sufficient for a faithful implementation: attempts rational manipulation. Definition 7. A node exhibits rational manipulation if it Proposition 1. A distributed mechanism specification dM = m m m m m fails to implement the suggested specification in an attempt (g, Σ, s ) in which suggested strategy s = (r , p , c ) is to selfishly better its outcome in a distributed mechanism, IC, CC and AC in the same ex post Nash equilibrium is a m given a particular knowledge assumption about other nodes. faithful implementation of outcome g(s (θ)) ∈ O. m Formally, if si ∈ Σi is the suggested strategy, and if Proof. IC, CC and AC provide for the existence of an equi- s−i is the set of strategies that node i believes all other librium in which nodes will follow suggested information- m m nodes will follow, then a node exhibits rational manipula- revelation ri , and similarly for message-passing pi and m m tion if it follows some alternate strategy si 6= si for which computation ci . To achieve faithfulness we simply need m ui(g(si, s−i); θi) > ui(g(si , s−i); θi). that there is an equilibrium that achieves each one of these Nodes are actively working to change the actions, tran- simultaneously. sitions, and states in both their internal state machine and in the state machines of other nodes (through the effect of 3.8 Strong AC and Strong CC messages sent to these nodes) for selfish reasons. This section provides a general proof method to demon- We are seeking specifications with the following property: strate specification faithfulness in networks with rational nodes. We define strong-AC and strong-CC, and show that Definition 8. Distributed mechanism specification d = M together with the strategyproofness of the corresponding (g, Σ, sm) is an (ex post) faithful implementation of out- centralized mechanism, strong-AC and strong-CC provide come g(sm(θ)) ∈ O when suggested strategy sm is an ex post IC, and in turn a faithful implementation. Nash equilibrium. We reduce the problem of proving (ex post Nash) faithful- 3.7 Useful Properties: IC, CC and AC ness to that of: We introduce communication- and algorithm compatibil- 1. Demonstrating that the corresponding centralized mech- ity as ways of describing mechanisms tolerant to rational anism is strategyproof. manipulation. We also extend the idea of incentive compat- ibility, found in the mechanism design literature, to allow 2. Strong-CC: a rational node should always follow its for incremental information-revelation. suggested message-passing strategy (whatever its infor- Each statement can be defined for a particular equilib- mation-revelation and computational actions). rium concept, that itself must be justified by a knowledge 3. Strong-AC: a rational node should always follow its assumption. To keep these definitions concrete we adopt suggested computational strategy (whatever its inform- ex post Nash, which seems to be useful when considering ation-revelation and message-passing actions). distributed implementations of strategyproof mechanisms. In fact, we will further break-up the proof, by advocating Definition 9. A distributed mechanism specification dM = (g, Σ, sm) is incentive compatible (IC) when there exists a further decomposition into disjoint mechanism phases. an ex post Nash equilibrium in which node i cannot receive Definition 12. A distributed mechanism specification dM = higher utility by deviating from the suggested information- m m (g, Σ, s ) is strong-CC if a node cannot receive higher util- revelation strategy ri (θi), for all nodes i and all types θ. ity by deviating from the suggested message-passing actions Most commonly, the suggested information-revelation strat- cˆi, whatever its computational and information-revelation egy for a node will expect the node to reveal truthful infor- actions, when other nodes follow the suggested specification. mation about its private type through communication with Definition 13. A distributed mechanism specification d = other nodes. IC means that a rational node will choose to M (g, Σ, sm) is strong-AC if a node cannot receive higher util- follow these actions. ity by deviating from the suggested computational actions pˆi, Definition 10. A distributed mechanism specification dM = whatever its message-passing and information-revelation ac- (g, Σ, sm) is communication compatible (CC) when there tions, when other nodes follow the suggested specification. Together, strong-CC and strong-AC rule out any useful and message-passing actions that deviate from a specifica- joint deviations in which a node changes its communica- tion detected and penalized (via catch and punish). Catch tion, computational, and its information-revelation actions and Punish can also be used without redundancy, when a to gain an advantage. subset of “checker” nodes can combine forces to completely monitor the behavior of a third node. Another technique is Proposition 2. A distributed mechanism specification dM = m m problem partitioning. At one extreme, partitioning could (g, Σ, s ) is a faithful implementation of outcome g(s (θ)) mean mean running the mechanism on nodes that cannot when the corresponding centralized mechanism is strategyproof benefit from the mechanism outcome, with nodes split and and when the specification is strong-CC and strong-AC. one half computing the mechanism outcome for the other. Proof. To prove that the specification is an ex post Nash More interestingly, we can also structure the computation equilibrium we first assume that every node except i is fol- so that a node is not involved in a calculation where it has a m vested interest in the outcome [25]. Finally, cryptography lowing suggested specification, s−i. By strong-CC and strong- AC, node i will follow the suggested message-passing and can be used to make deviations from a specified algorithm computation actions. (Notice that we can rule out joint de- detectable [3], and to make it impossible to rationally change a message, which can be useful for communication compat- viations of both message-passing and computation actions). 4 To prove IC, we can now assume that all nodes follow sug- ibility [20]. gested communication- and message-passing actions. Let f(θ) = g(sm(θ)) denote the outcome rule in the correspond- 4. EXAMPLE: INTERDOMAIN ROUTING ing centralized mechanism. By definition of information- The remainder of the paper will focus on building a dis- revelation actions, the space of possible outcomes becomes m ˆ m ˆ m ˆ m ˆ ˆ ˆ tributed mechanism specification that is faithful. The spec- g(si (θi), s−i(θ−i)), but g(si (θi), s−i(θ−i)) = f(θi, θ−i), and ification extends an interdomain routing distributed mech- ˆ ˆ ˆ ˆ ui(f(θi, θ−i); θi) ≥ ui(f(θi, θ−i); θi) for all θ−i, all θi, and all anism created by Feigenbaum, Papadimitriou, Sami, and ˆ m θi 6= θi by strategyproofness of g(s (θ)) = f(θ). Shenker (FPSS) [7]. FPSS is the first research to com- bine mechanism design ideas with a common Internet al- Remark 4. In applying Proposition 2 one must be care- gorithm (the Border Gateway Patrol (BGP) interdomain ful to ensure that actions labeled as “information-revelation” routing protocol). The importance of this section is to show within the suggested specification satisfy the technical re- how various techniques can be used to prove strong-CC and quirement of consistent information-revelation which can re- strong-AC in a real system. quire consistency checking. Remark 5. Distributed implementations of mechanisms in- 4.1 FPSS Interdomain Routing troduces a new issue not encountered in traditional central- The Internet is composed of many separate domains known ized MD, which is that the outcome computed by nodes must as autonomous systems (ASs) such as Harvard, Berkeley, Mi- be enforced (we call this the “execution phase” in the in- crosoft, etc. Each AS can be modeled as a rational node. terdomain routing example). Typically, the execution ac- The goal in FPSS is to maximize network efficiency by rout- tions that correspond with the outcome must themselves be ing packets along lowest cost paths (LCPs) for various traffic shown to be strong-AC and strong-CC. In interdomain rout- source-destination pairs. ing, this means that nodes choose to follow lowest-cost paths Each node incurs a and choose to respect payments. Z per-packet transit cost 1000 for transiting traffic on 3.9 A General Proof Technique C behalf of other nodes. For faithful adherence to a specification, we need to demon- A 1 The cost represents the strate strong-CC and strong-AC as well as the consistency 5 B additional load imposed of information-revelation actions. The following approaches 6 by external traffic on are useful to this end: D the internals of an in- Break Into Phases. A distributed mechanism can be 1 dividual node. It costs decomposed into disjoint phases, each of which is proven X nothing for a node to strong-CC and strong-AC without worrying about joint de- 100 transit a packet origi- viations involving actions in other phases. Phases are sepa- nating or terminating at rated during runtime with checkpoints where some node(s) that node. certify a phase outcome and start a subsequent phase. One Figure 1: LCPs from Z. For instance, Figure 1 must be sensitive to the added computational and communi- shows a network with cation complexity in using checkpoints. This decomposition the LCPs from Z to all other nodes drawn with bold lines. technique is powerful because it can allow an exponential Numbers are the per-packet transit node costs incurred by reduction in the number of joint manipulation actions that each node. Assuming that the numbers in this figure rep- must be checked in a faithfulness proof. resent true transit costs, the total LCP cost of sending a packet from X to Z is 2; the cost of sending a packet from Tools for Strong-AC, Strong-CC and Consistency. Z to D is 1. The cost of sending a packet from B to D is 0 Strong-AC, strong-CC, and information-revelation consis- since there are no transit nodes between B and D. tency can be achieved within a phase through the use of vari- To compensate a transit node for its routing services, each ous techniques. Payments can be used to avoid untruthful information revelation, and also to provide incentives for 4The problem with cryptography is the cost: if a system nodes to perform faithful computation and message pass- relies heavily on this technique, computation and communi- ing. Redundancy can be powerful, with computational cation complexity can become prohibitive. transit node is given a payment for carrying traffic. FPSS list of total payments ([DATA4]) can be reported to an ac- observes, however, that “under many pricing schemes, a counting and charging mechanism, that we call a bank. node could be better off lying about its costs; such lying would This specification could be formalized with a state ma- cause traffic to take non-optimal routes and thereby interfere chine. The external actions already in the original FPSS with overall network efficiency.” would be included in this state machine, as follows: declar- Example 1: In Figure 1, path X-D-C-Z is the lowest cost ing the transit cost and providing connectivity information path between X and Z; if C declared a cost of 5, X-A-Z are information-revelation actions; relaying other nodes’ tra- would become the X to Z LCP. C can benefit from this nsit-cost announcement are message-passing actions; and manipulation, even if it loses the X to Z traffic, if it can updating and forwarding routing and pricing tables are com- make up the financial loss with higher payments received by putation actions. An additional computation action comes transiting D to Z traffic. This has damaged overall efficiency in a node’s reporting payments to the bank, and message - packets from X to Z are now being routed over a path whose passing actions exist for those nodes on the path to the bank. true cost is higher. Message-passing is also used during execution for routing FPSS seeks a pricing scheme that is dominant strategy in- along LCPs. centive compatible (strategyproof), meaning that nodes can do no better than to declare their true transit costs. They 4.2 Extending the FPSS Specification achieve this by using a Vickrey-Clarke-Groves (VCG) mech- In FPSS there is nothing to prevent nodes from rationally anism [34, 11, 6] where transit nodes are paid based on the manipulating routing and pricing tables, or lying about con- utility that they bring to the routing system plus their de- nectivity information in the construction phase, or reporting clared cost. The FPSS algorithm is distributed; lowest cost inaccurate payments during execution (indeed, this was not paths (LCPs) and pricing tables are computed by each node their research goal). In addition, other nodes are in a po- using information from neighbors in an iterative calculation. sition to intercept and selfishly modify payment tallies sent Following the abstract model of the Border Gateway Proto- to the bank. In building a faithful specification based on col (BGP) proposed by Griffin & Wilfong (GW) [10], FPSS FPSS, the key challenge is to prove strong-CC and strong- assumes a static environment. FPSS also assumes a bicon- AC. (The corresponding centralized mechanism is already nected graph to ensure that the VCG payments well-defined. strategyproof for transit-cost declarations, and manipula- The abstract model of GW is extended to add additional in- tions of the semi-private connectivity information will be- formation to the local state stored at nodes and to messages come apparent in the routing table calculations.) sent. In unpublished work, Mitchell et al. [19] have explored the We find it useful to describe FPSS in terms of construc- use of cryptographic signing between routing nodes to en- tion and execution phases. A construction phase deals sure truthful connectivity declarations, and have suggested with mechanism set-up, while execution deals with actual that this technique could extend to mechanism computa- usage. Each node maintains three types of data for the tion as well. In our presentation, we will instead favor re- mechanism construction phases: dundancy, catch and punish, and problem partitioning, and • [DATA1] Transit cost list. Contains this node’s knowl- bring the entire specification— message-passing and compu- edge about declared transit costs of other nodes in the tation and execution —into equilibrium. We, too, are forced network. to rely on a small amount of cryptographic signing (in our case, to ensure communication compatibility) but the use of • [DATA2] Routing table. Each entry in this table the three other techniques makes this signing requirement contains the shortest path from this node to each desti- small. Given certain network topologies, it may be possible nation, along with a ordinal representing the aggregate to eliminate signing altogether.5 path cost. We introduce a new role for nodes, that of checker nodes. • [DATA3] Pricing table. This sparse table contains These checker nodes perform redundant computation, which the per-packet payment to be made by this node to each creates the opportunity for a catch-and-punish scheme that transit node on the shortest path, for each destination. provides incentives for rational nodes to be faithful. The In the first construction phase the transit-cost informa- assignment of the checker nodes is very important: every tion [DATA1] is constructed. In the second construction neighbor of a node is assigned as a checker for that node. phase, routing and pricing tables are computed and stored The node that is being checked is known as the principal, as [DATA2] and [DATA3]. Nodes relay any changes of local to refer to its role in the core distributed algorithm. Every data to their neighbors. Neighbors, in turn, update their node in the biconnected network plays the role of both a local data with this new information and propagate changes principal node and a checker node for all of its neighbors. to their neighbors. This continues until the information con- 5 verges. Nodes can then use the mechanism to route traffic, Two examples when this may happen: The first example is and FPSS enters the execution phase. FPSS uses one addi- when the network of rational nodes is an overlay that runs on top of an obedient underlay, similar to how many peer tional type of data for mechanism execution: to peer applications work today. Here, certain messages to • [DATA4] Payment list. Contains the amount of money nodes outside of the mechanism (such as a bank) can fol- that this node owes others for having originated traffic low an obedient overlay. The second example is when in a that traversed those transit nodes. network of rational nodes a node is able to establish a path to some endpoint where all intermediate nodes are guaran- Each node is expected to use the pricing table correctly to teed to be partitioned from any information contained in the calculate and store the payments that it owes transit nodes. message. A special case of this scenario assumed by some This payment is compensation for requiring those nodes to previous work [3], is when the communication graph is fully transit packets originated locally. FPSS suggests that this connected, and therefore there are no intermediate nodes that could have an interest in the message. 4.3 Faithfulness Proofs C2 In this section, we show how a faithfulness proof can be constructed for our extension to FPSS. The entire proof can- not be presented due to space constraints. We opt instead to show strong-AC, strong CC and consistent information C1 P revelation for the second construction phase and leave the C3 rest to the extended version of this paper [33]. For each phase, we must show strong-AC, strong-CC, and Figure 2: A computation or message passing deviation consistent information revelation irrespective of a node’s be- by Principal node (P) can be checked by checker nodes. havior in other phases of the mechanism. Once this is shown for each phase, one can use Proposition 2 to show that the entire mechanism is faithful. We assume that every node wishes to make progress in the mechanism, and indeed has The checker nodes execute a redundant computation that a strong negative value when a construction phase does not mirrors what the principal is computing, and must receive progress. We further assume that the checkpointing node a complete set of the messages received by the principal. responsible for halting one phase and “green-lighting” the Even though some checkers rely on the principal to for- next phase is the bank node. Keeping with the FPSS spec- ward these messages, there is always at least one checker ification, we assume a static network in these proofs. that will catch any attempted deviation from the suggested Given strong-AC and strong-CC, the first construction specification. Ultimately, we rely on the bank to compare phase terminates, and terminates with common transit cost state-information reported by the principal and checker and tables [DATA1] across all nodes. The goal in the second- construction phase is to establish correct routing tables penalize nodes for any deviation. ∗ Our bank goes beyond (in FPSS language) “whatever ac- ([DATA2]) and pricing tables ([DATA3 ]). Finally, the goal counting and charging mechanisms [that] are used to en- in the execution phase is to ensure that packets are sent along force the pricing scheme.” In our specification, the bank is the LCPs and that correct network usage logs are recorded a trusted and obedient entity that can also perform simple and correct payments collected. Our extensions to FPSS comparisons, and enforce penalties when it detects a prob- add more information to [DATA3]: lem. The way that problems are detected is phase specific. • [DATA3∗] Pricing table (extended). This sparse In the construction phases, this penalization takes the form matrix of per-node prices is the same as in [DATA3], but of not allowing the mechanism to progress to the next phase. in addition, it is important to store an identity tag. This In the execution phase, this penalty is a well-defined mone- tag identifies the node that triggered the most recent tary unit that is epsilon-above the attempted deviation.6 All FPSS pricing table update. (In the case of a pricing tie, communication between the bank and a node is signed with this tag field actually contains the union of the nodes acknowledgments to ensure communication compatibility of that suggested the same pricing entry.) these messages. This second-construction phase uses problem partitioning, As an example, Figure 2 illustrates the role of checker node redundancy, and catch-and-punish for strong-AC and nodes C1,C2 and C3 in monitoring principal P . Each checker strong-CC. It needs no cryptography in intra-node messages, node is asked to perform the internal computation of P but for CC between a node and the bank, we do assume that based on the copies it receives of P ’s messages. First, one messages to and from the bank are signed. should establish that the checker will follow this algorithm Checker nodes completely surround a principal in the net- in equilibrium with a faithful P . This can be argued in our work, and act as a clone of the principal in all computa- FPSS setting through partitioning— a checker cannot indi- tion respects. The difference between the principal and the vidually benefit from allowing a deviation by P . Second, checker is that the checker does not send outputs of com- suppose P is supposed to forward m to nodes C2 and C3 putations to neighbors. It is critical to understand the role to allow them to replicate its calculations, but deviates and and limitation of these checkers: the checkers perform the 0 forwards the message as m . Although this might change “heavy lifting” of checking a computation, but do not ac- the view that C2 and C3 have of P ’s input, checker C1 was tually catch manipulation problems; this task is left to the on the incoming path of m and still has the correct view. checkpointing bank. In this phase, a deviation in calculating Also, P cannot deviate in its calculation without deviating routing or pricing tables results in the bank not proceeding in its message-passing because the checkers will perform the to the execution phase. correct calculations and when a check is made of internal We can divide the tasks in this phase into actions taken by 7 state there will be a discrepancy. a [PRINC]ipal, actions taken by the principal’s [CHECK]er nodes, and the actions taken by the [BANK]. 6 The bank is not as powerful as the traditional mechanism • [PRINC1] On receiving routing table update from center. It does not actually perform the distributed mecha- nism computation, and instead checks results performed by neighbor: Message Passing: Forward message to all others. The complexity of bank operation is described in checkers. Computation: Recompute LCPs based on new the longer technical report [33]. It is an open problem to information; send recomputed LCPs as a routing table design a distributed bank that runs on the same network of update to all neighbors. rational nodes. • [PRINC2] On receiving pricing table update from 7Furthermore, the principal cannot report its true routing table but follow another routing table later because checks neighbor: Message Passing: Forward message to all are made during the execution phase against the (correct) checkers. Computation: Recompute pricing tables based routing tables in checker nodes. on new information; update tag information for every changed pricing entry to reflect source of change; send For any principal-destination pair, one checker must be new pricing tables to all neighbors. on the shortest path from principal to destination. That • [CHECK1] When the principal forwards a rout- checker has a correct view of the cost of that path (in its ing update: Computation: Verify that declared LCP other role as a principal in the network), because each node is correct with local cost information. Re-run the LCP has a local transit cost table by the end of the first phase. routing update. Check for consistency between the checker Assume the behavior specified in [CHECK1]. Now, all check- node’s own LCP (acting as a principal) and the LCP ers ignore LCP information that is not judged correct through stored on behalf on the foreign principal. their local transit cost table (known as a principal). The re- sult is that a principal has no way to successfully change • [CHECK2] When the principal forwards pricing the LCP information stored by every checker. Any routing tables: Computation: Ignore messages with identity table deviation shows up by comparing a hash of [DATA2] tags that are not checker nodes of the principal; Re-run between the principal and its multiple checkers. This means the pricing table computation. that manipulations (1-2 above) are caught by [BANK1]. • [BANK1] At a network quiescence point, ask all princi- Manipulations in the pricing table information (3-4 above) pals and checkers for routing table information [DATA2] are more subtle, since here a checker node does not have an (a hash of the entire table is sufficient) and check for a innate ability to verify messages based on internal informa- deviation (difference). If there is a deviation, then signal tion that it already has as a principal. Also notice that while all nodes to restart this phase. Otherwise, run [BANK2]. problem partitioning ensures a node has no reason to modify • [BANK2] Ask all principals and checkers for pricing its newly created outgoing pricing update messages (since its table information [DATA3*] (again, a hash is sufficient) utility is not affected by changes caused by these messages), and check for a deviation. If there is a deviation, then a node might like to change the pricing table that it must use signal all nodes to restart this phase. Otherwise, “green- for its own originated traffic. To show how checking nodes light” the execution phase. make these manipulations detectable, assume the behavior specified in [CHECK2]. Now, consider a principal A and a In fact, the original FPSS formulation already exhibits pair of checker nodes B and C. First, dropping a pricing- limited problem partitioning. The price-update rules are table message received from B (ie. not forwarding to C) will specified in a way that prevents a node from increasing its result in an inconsistency between B and C and therefore a incoming payment through changing the pricing messages.8 restart by the bank. The same argument holds for changing However, problem partitioning alone cannot ensure strong an incoming message. More difficult is the third case, where faithfulness properties. There remain the following possible a principal can spoof a new fake message. However, this manipulations, which must be considered jointly: spoof will create an inconsistency in the identity tag infor- 1. A node can (in [PRINC1]) drop, change, or spoof (create) mation in [DATA3*]. This inconsistency will be caught by forwarded routing table update messages. [BANK2]. 2. LCPs can be miscomputed (in [PRINC1]) and new LCP To see strong-AC and strong-CC, and to also see why updates can be dropped, changed, or spoofed. joint deviations are not possible, notice that the routing and 3. A node can (in [PRINC2]) drop, change, or spoof for- pricing information are two disjoint sets that must be kept in warded pricing table update messages. agreement with all checker nodes. A deviation is potentially useful only if the principal can cause every checker to deviate 4. Pricing tables can be miscomputed (in [PRINC2]) and in a way that generates the same routing and/or pricing new pricing table updates can be dropped, changed, or tables. By the arguments above, this is not possible since spoofed. each manipulation has a disjoint side effect with every other The goal of these manipulations is either to increase in- manipulation. Any such deviation would cause a restart. coming payment from other nodes, or decrease the outgoing payment due to other nodes. It is important that at the end Theorem 1. The extended FPSS specification is a faithful of this phase, the correct LCPs are reflected in the routing implementation of the VCG-based shortest-path interdomain tables, and the pricing tables are accurate and refect the cor- routing mechanism. rect per-message prices as defined by the FPSS algorithm. We show that this phase is strong-AC and strong-CC. There Proof. By Proposition 2, and since all phases of this specifi- is no revelation of private (transit cost) information, and cation are strong-AC, strong-CC, and have consistent infor- deviations in revelation of semi-private connectivity infor- mation-revelation, and since the corresponding centralized mation revelation are protected against though strong-AC mechanism is strategyproof. and strong-CC (because such a deviation would require not forwarding messages along some link or not performing ap- 5. DISCUSSION propriate updates to internal LCP tables). First, observe that the suggested specification for checkers While this paper concerns rational manipulation, it has in this phase is strong-AC and strong-CC. No checker wants taken a fairly narrow view of rationality. For example, cer- to deviate if the other nodes (in their role as principals and tain nodes may make worsening the outcome of other nodes checkers) are faithful, because deviation would cause the the main goal besides maximizing their own utility. In the phase to be restarted. real world, companies are willing to take a short-term loss to drive competitors out of business. Such anti-social behavior has been previously characterized [4]. Other nodes might 8In Section 6 of FPSS, notice that while a pricing update message has the potential to trigger a series of pricing table act maliciously, where their rational behavior is described updates on various nodes, each of these nodes ignores (by as bringing down a system. imply introducing other fail- the pricing update rules) the node that caused the update. ures, such as general omissions or even failstop, may cause the system to falsely detect and punish manipulation. Fur- [16] Sepandar D. Kamvar, Mario T. Schlosser, and Hector ther work needs to explore how other failure models affect Garcia-Molina. The Eigentrust algorithm for faithfulness in systems with the rational-manipulation fail- reputation management in P2P networks. In Proc. 12th Int. World Wide Web Conf. (WWW), 2003. ure model. [17] Leslie Lamport and Michael J. Fischer. Byzantine generals and transactions commit protocols. Technical 6. ACKNOWLEDGMENTS Report Opus 62, Menlo Park, California, 1982. Thanks to Joan Feigenbaum, Steven Gortler, Rahul Sami, Mar- [18] Nancy Lynch. Distributed Algorithms. Morgan Kaufmann Publishers, 1996. go Seltzer, Danni Tang, and anonymous reviewers for their useful [19] J.Mitchell, R.Sami, K.Talwar and V.Teague. Private comments. Thanks to Jim Waldo for casting rational manipula- communication, December 2001. tion in the role of a canonical system failure. Invaluable feedback [20] Dov Monderer and Moshe Tennenholtz. Distributed on early versions of this work was received from poster session games: From mechanisms to protocols. In Proc. participants at EC-03 [32] and SOSP-03 [31], and by seminar par- AAAI-99, pages 32–37, July 1999. ticipants at Stanford and MIT. This work is supported in part by [21] Noam Nisan and Amir Ronen. Algorithmic NSF grants IIS-0238147 and ACI-0330244. Mechanism Design. In Proc. of the 31st ACM Symp. on Theory of Computing, pages 129–140, 1999. [22] Noam Nisan and Amir Ronen. Computationally 7. REFERENCES feasible VCG mechanisms. In Proc. 2nd ACM Conf. [1] Eytan Adar and Bernardo Huberman. Free Riding on on Elec. Commerce (EC-00), pages 242–252, 2000. Gnutella. First Monday, 5(10), October 2000. [23] Noam Nisan and Amir Ronen. Algorithmic mechanism [2] Ronen Brafman and Moshe Tennenholtz. Efficient design. Games and Econ. Behavior, 35:166–196, 2001. Learning Equilibrium. To appear, Artificial [24] David C. Parkes. Iterative Combinatorial Auctions: Intelligence Journal, 2004. Achieving Economic and Computational Efficiency [3] Felix Brandt. A verifiable, bidder-resolved auction (Chapter 2). PhD thesis, Univ. of Penn., May 2001. protocol. In Proc. 5th Int. W. Deception, Fraud and [25] David C. Parkes and Jeffrey Shneidman. Distributed Trust in Agent Societies, pages 18–25, 2002. Implementations of Vickrey-Clarke-Groves [4] Felix Brandt and Gerhard Weiß. Antisocial Agents Mechanisms. To appear, Proc. 3rd Int. Conf. on and Vickrey Auctions. In Eighth Int. W. on Agent Autonomous Agents and Multiagent Systems, 2004. Theories, Architectures, and Languages (ATAL-2001), [26] Tim Roughgarden. Designing networks for selfish users pages 120–132, 2001. is hard. In Proc. 42nd Ann. Symp. on Foundations of [5] Navin Budhiraja, Keith Marzullo, Fred B. Schneider, Computer Science, pages 472–481, 2001. and Sam Toueg. Primary-backup protocols: Lower [27] Stefan Savage, Neal Cardwell, David Wetherall, and bounds and optimal implementations. Technical Tom Anderson. TCP congestion control with a Report TR92-1265, 1992. misbehaving receiver. Computer Communication [6] E H Clarke. Multipart pricing of public goods. Public Review, 29(5), 1999. Choice, 11:17–33, 1971. [28] F.B. Schneider. Byzantine generals in action: [7] Joan Feigenbaum, Christos Papadimitriou, Rahul Implementing fail-stop processors. ACM Transactions Sami, and Scott Shenker. A BGP-based mechanism for on Computer Systems 2(2), 1984. lowest-cost routing. In Proc. of the 2002 ACM Symp. [29] Fred B. Schneider. What good are models and what on Princ. of Distr. Comput., pages 173–182, 2002. models are good. In Sape Mullender, editor, [8] Joan Feigenbaum and Scott Shenker. Distributed Distributed Systems, chapter 2. Addison Wesley, 1993. Algorithmic Mechanism Design: Recent Results and [30] Jeff Shneidman and David C. Parkes. Rationality and Future Directions. In Proc. 6th Int. W. on Discrete self-interest in Peer to Peer networks. In 2nd Int. W. Alg. and Methods for Mobile Computing and on Peer-to-Peer Systems (IPTPS’03), 2003. Commun., pages 1–13, 2002. [31] Jeffrey Shneidman. Systems Must Address Rational [9] Juan A. Garay and Kenneth J. Perry. A continuum of Failure. Poster, 19th ACM Symp. on Operating failure models for distributed computing. In W. on Systems Princ. (SOSP ’03), October 2003. Distributed Algorithms, pages 153–165, 1992. [32] Jeffrey Shneidman and David C. Parkes. Using [10] Timothy Griffin and Gordon T. Wilfong. An analysis redundancy to improve robustness of distributed of BGP convergence properties. In SIGCOMM, pages mechanism implementations. In Proc. Fourth ACM 277–288, 1999. Conf. on Electronic Commerce (EC’03), 2003. [11] Theodore Groves. Incentives in teams. Econometrica, [33] Jeffrey Shneidman, David C. Parkes and Danni Tang. 41:617–631, 1973. Specification Faithfulness in Networks with Rational [12] Garrett Hardin. The Tragedy of the Commons. Nodes. Technical report, Harvard University, 2004. Science, 162:1243–1248, 1968. [34] William Vickrey. Counterspeculation, auctions, and [13] Matthew O. Jackson. Mechanism theory. In The competitive sealed tenders. Journal of Finance, Encyclopedia of Life Support Systems, EOLSS 16:8–37, 1961. Publishers, 2000 [35] William E. Weihl. Specifications of Concurrent and [14] M. Jakobsson, J. Hubaux, and L. Buttyan. A Distributed Systems, chapter 3. Addison Wesley, 1992. micropayment scheme encouraging collaboration in [36] S. Zhong, Y. Yang, and J. Chen. Sprite: A simple, multi-hop cellular networks. In Proc. of Financial cheat-proof, credit-based system for mobile ad hoc Crypto 2003., 2003. networks. In Proc. INFOCOM, 2003. [15] Leander Kahney. Cheaters Bow to Peer Pressure, 2001. http://www.wired.com/news/technology/0, 1282,41838,00.html.