Verifiable and Auditable Digital Interchange Framework
Total Page：16
File Type：pdf, Size：1020Kb
Verifiable and Auditable Digital Interchange Framework# Prabal Banerjee†, Dushyant Behl∗, Palanivel Kodeswaran∗, Chaitanya Kumar∗, Sushmita Ruj‡ and Sayandeep Sen∗ †Indian Statistical Institute Kolkata, ∗IBM Research, ‡ CSIRO Data61 Australia and Indian Statistical Institute Kolkata ABSTRACT We address the problem of fairness and transparency in online marketplaces selling digital content, where all parties are not actively participating in the trade. We present the design, implementation and eval- uation of VADER, a highly scalable solution for multi-party fair digital exchange that combines the trusted execution of blockchains with intelli- gent protocol design and incentivization schemes. We prototype VADER on Hyperledger Fabric and Figure 1: Present day video exchange extensively evaluate our system on a realistic testbed spanning five public cloud datacenters, spread across four continents. Our results demonstrate that VADER adds only minimal overhead of 16% in median case reflected in their success, they suffer from an im- compared to a baseline solution, while significantly portant shortcoming in the inability to guarantee outperforming a naive blockchain based solution honest behavior and vulnerability to fraudulent be- that adds an overhead of 764%. havior by participants. This is due to the fact that present day systems lack the underpinnings to demon- strably guarantee honest behavior; forcing both buyers and owners to trust that a facilitator be- 1 INTRODUCTION haves in a fair manner. Online media consumption is a big business [13], For example in Fig. 1, the owner trusts the fa- with users watching billions of hours of videos per cilitator to honestly report the number of views/- month [90] and media traffic constituting roughly downloads and calculate its royalty payments in a transparent manner. Similarly, the buyer trusts arXiv:2001.03717v2 [cs.DC] 27 Jan 2020 70% of downstream internet traffic [80]. A key reason for this success, lies in the sim- the facilitator to deliver the right content against plicity of present day online media (and money) payment. Finally, the facilitator expects the buyer exchange process as depicted in Fig. 1. As shown, to pay for a successful delivery, without falsely al- a present day content creator can simply upload leging non-delivery. content and get paid based on viewership (or sales). However, lack of baked-in guarantees of hon- Similarly, buyers can pay the right price to access est behavior can lead to disputes, such as a buyer media without worrying about content authentic- fraudulently alleging non-receipt of content and ity, price gouging, non delivery etc. The ease of denying payments thus stealing content from fa- operation is due to presence of facilitators such as cilitator; facilitator mis-reporting sales to cheat owner Youtube, Netlflix, iCloud etc. As shown in Fig. 1, of dues, or even charging buyers without provid- the facilitator provides all the ancillary but criti- ing right content. cal services of content hosting, searching, deliv- In fact, recent events highlight the inadequacy ery, payments etc. to complete the digital ecosys- of this trust based model [17, 19, 86]. Specifically, tem for online media consumption. While the ef- content owners have raised a number of complaints ficacy of present day media delivery systems is against faclitators regarding their royalty earnings and lack of clarity in the calculation [10, 18, 67], # Authors are listed in alphabetical order. highlighting discrepancies in earnings with reported viewership. Similarly, buyers have also raised dis- or in collusion with the buyer [2, 9]. Fig 1, high- putes regarding content received from these plat- lights the specific risks faced by the respective par- forms [2]. ties. We believe that such disputes can only increase Wenotethatwhiletheproblem offair exchange in future to the detriment of the growth of online among active parties is well studied in theory [47, media delivery platforms. This in turn, motivates 71, 78, 89]; to the best of our knowledge, protect- us to address this important problem of guaran- ing rights of passive parties, without significantly teeing successful video exchange amongst mutu- altering the flow of video exchange 1 is a new para- ally untrusting buyers and facilitators. We ensure digm for fair exchange, not yet covered in literature. each party (owner, buyer and facilitator) gets their In VADER we not only protect the buyer and rightful outcome or no one does. We define the facilitators against various active party risks but above as Multi-party fair digital exchange (ab- secure owner’s interest from passive party risks. breviated as fair exchange in the rest of the paper) To the best of our knowledge, VADER is the first among the owners, buyers and facilitators in the real system to demonstrate such capabilities. marketplace model. VADER accomplishes low overhead fair exchange Note that prior work [30, 48, 49] for providing solution by leveraging the following key insights, fairness are not applicable in the above setting as →Insight 1) We can guarantee fair exchange by they trust the facilitator to grant access to inter- sending encrypted video and performing fair ex- nal logs and metrics, an important assumption we change of only the key and money. This enables us intend to avoid. Similarly, decentralized video de- to leverage the existing optimized delivery infras- livery platforms [32, 40, 62, 64, 88] which bypass tructures of facilitators for sending (encrypted) con- centralized facilitators (thus obviating the need tent and making system for fairness incrementally to trust them), while promising are not suitable. deployable. This is due to the fact that decentralized content →Insight 2) By assuming the presence of a trusted delivery platforms suffer from poor content qual- arbitrator that is slow (when compared to direct ity, sporadic availability, rampant illegal content interaction without intermediary) but can deter- etc., ironically due to absence of a facilitator’s ded- ministically detect a malicious party and provide icated resources in maintaining the platform [20]. restitution (right encrypted content, key or money) Motivated by above observations, we set our to the honest party, parties can opportunistically goal to develop a readily usable solution for fair exchange key and money directly between them- exchange, which would be a)compatible and incre- selves without having to interact with the arbitra- mentally deployable with present day facilitator driven tor unless there is a dispute. marketplace systems and b) should be able to pro- →Insight 3) Assuming parties are rational, intro- vide transparency and fairness into existing video duction of bounties (that are large and funded by delivery platforms with minimal overhead in terms penalizing malicious parties) for reporting misbe- of modifications and performance. havior introduces an element of distrust between In this paper we present the system design, im- parties, thus preventing collusion aimed at sub- plementation and evaluation of Verifiable and Au- verting the protocol. Note that, the first two in- ditable Digital Interchange Framework (VADER) sights enable efficient operation, guaranteeing fair- which satisfies the above mentioned criteria. ness for the active parties; while the third insight In process of designing VADER, we study vari- ensures fairness for the passive party under as- ousfraud risksthatarise in the marketplacemodel sumption of rational participants. and note that guaranteeing multi-party fair exchange We select blockchainas the tamper-proof ledger in this model presents a unique challenge. As shown and execution platform for VADER. Our selection in Fig. 1, the owner is a passive party, in the sense of blockchainis motivated by the fact that it offers that after video upload, it is not directly involved decentralization of trust and auditability guaran- in the exchange of video and money between the tees sought by VADER. Furthermore, the native active parties viz. the facilitator and buyer. Being a blockchain cyptocurrency can be used to design passive party, an owner is completely dependent incentivization schemes and programmatically en- on the honesty of facilitator, as it has no way to force desired behavior from the interacting par- learn of exchanges of its content being done. This ties as mandated by our insights above. We also makes the owner vulnerable to being misled about its true earnings, either by the facilitator [10] alone, 1i.e., without making owner also an active party by say asking for its approval on every trade 2 point out the second insight of opportunistic ex- our knowledge, we are the first to formulate and changes on fast path (batching), while reverting present the problem of multi-party fair digital ex- to the slow but guaranteed path is also used in change in third party marketplace scenario where state-channels for scaling transaction throughput. one of the parties is passive and does not directly However, these solutions involve native assets such interact with the buyer (Sec. 1 & 2). 2) We design as cryptocurrencies giving complete control to the the VADER protocol and study its security prop- arbitrator to revert back the state (e.g. ownership) erties. 3) We implement VADER protocol on Hy- of an asset. On the other hand, we deal with non- perledger Fabric, and extensively evaluate its per- native assets such as decryption keys which once formance on a realistic test-bed of upto 91 nodes delivered to the buyer are unaffected by blockchain spread over 4 continents, transferring at least 50TB asset state. We modify the state-channel protocol of data over the network. We find that VADER to account for the above oddity, as described in adds only minimal overhead of 16% in median case Sec. 3.1. compared to the baseline VANILLA solution. As part of this work, we have systematically Outline: The rest of the paper is organized as studied exchange process in present day video de- follows. In Sec. 2, we formally describe the prob- livery platforms and used the insights to design lem and the solution requirements.