Omniledger: a Secure, Scale-Out, Decentralized Ledger Via Sharding
Total Page：16
File Type：pdf, Size：1020Kb
OmniLedger OmniLedger: A Secure, Scale-Out, Decentralized Ledger via Sharding Eleftherios Kokoris-Kogiasy, Philipp Jovanovicy, Linus Gassery, Nicolas Gaillyy, Ewa Syta∗, Bryan Fordy y Ecole´ Polytechnique Fed´ erale´ de Lausanne, Switzerland ∗ Trinity College, USA Abstract—Designing a secure permissionless distributed ledger performance for security [34], as illustrated in Figure 1 and that performs on par with centralized payment processors such as explored in detail later in Sections II and IX. Visa is challenging. Most existing distributed ledgers are unable to “scale-out” – growing total processing capacity with number of participants – and those that do compromise security or Decentralization decentralization. This work presents OmniLedger, the first scale- ByzCoin [ out distributed ledger that can preserve long-term security under ] permissionless operation. OmniLedger ensures strong correctness 34 and security by using a bias-resistant public randomness protocol to choose large statistically representative shards to process trans- 32 Elastico [ OmniLedger ] actions, and by introducing an efficient cross-shard commit pro- tocol to handle transactions affecting multiple shards atomically. In addition, OmniLedger optimizes performance via scalable Scale-Out RsCoin [16] Security intra-shard parallel transaction processing, ledger pruning via collectively-signed state blocks, and optional low-latency “trust- Fig. 1: A comparison of current DL system in terms of the but-verify” validation of low-value transactions. Evaluation of trade-offs they offer. our working experimental prototype shows that OmniLedger’s throughput scales linearly in the number of validators available, supporting Visa-level workloads and beyond, while confirming This paper introduces OmniLedger, the first distributed typical transactions in under two seconds. ledger architecture that provides “scale-out” transaction pro- cessing capacity competitive with centralized payment pro- I. INTRODUCTION cessing systems such as Visa, without compromising security or support for permissionless decentralization. To achieve this The scalability of distributed ledgers (DLs), both in total goal, OmniLedger faces three key correctness and security transaction volume and the number of independent partici- challenges. First, OmniLedger must choose statistically repre- pants involved in processing them, is a major challenge to sentative groups of validators periodically via permissionless their mainstream adoption, especially when weighted against Sybil-attack-resistant foundations such as proof-of-work [36], security and decentralization challenges. Many approaches [38], [32] or proof-of-stake [31], [25]. Second, OmniLedger exibit different security and performance trade-offs [10], must periodically form shards, or subsets of validators to [11], [21], [32], [40]. Replacing Nakamoto consensus [36] record state and process transactions, that are both sufficiently with PBFT [13], for example, can increase throughput while large and strongly bias-resistant to ensure a negligible prob- decreasing transaction commit latency [1], [32]. These ap- ability that any shard is ever compromised across the (long- proaches still require all validators or consensus group mem- term) system lifetime. Finally, OmniLedger must correctly and bers to validate and process all transactions redundantly, atomically handle cross-shard transactions, or transactions that however, so the system’s total transaction processing capacity affect ledger state held by two or more distinct shards. does not increase with added participants, and in fact gradually To choose representative validators via proof-of-work, Om- decreases due to increased coordination overheads. niLedger builds on ByzCoin [32] and Hybrid Consensus [38], The proven and obvious approach to building “scale-out” using a sliding window of recent proof-of-work block miners databases, whose total capacity scales horizontally with num- as its validator set. To support the more power-efficient al- ber of participants, is by sharding [14], or partitioning state ternative of apportioning consensus group membership based into multiple shards handled in parallel by different subsets on directly-invested stake (e.g., coins) rather than work, Om- of participating validators. Sharding could benefit DLs [15] niLedger builds on Ouroboros [31] and Algorand [25], running by reducing the transaction processing load on each validator a public randomness or cryptographic sortition protocol within and increasing the system’s total processing capacity propor- a prior validator group to pick a subsequent validator group tionally with the number of participants. Existing proposals from the current stakeholder distribution defined in the ledger. for sharded DLs, however, forfeit permissionless decentraliza- To ensure that this sampling of representative validators is tion [16], introduce new security assumptions, and/or trade both scalable and strongly bias-resistant, OmniLedger uses RandHound [44], a protocol that serves this purpose under Contributions: In summary, this paper makes the follow- standard t-of-n threshold assumptions. ing contributions: Appropriate use of RandHound also provides the basis • We introduce the first DL architecture that provides horizon- by which OmniLedger addresses the second key security tal scaling without compromising either long-term security challenge, of securely assigning validators to shards, and or permissionless decentralization. periodically rotating those assignments as the set of validators • We introduce Atomix, a Atomic Commit protocol, to com- evolves. Through the analysis detailed in Section VI, Om- mit transactions atomically across shards. niLedger chooses random shards large enough to ensure a • We introduce Omnicon, a BFT consensus protocol that negligible chance that any shard is ever compromised, even increases performance and robustness to DoS attacks. across years of system operation. • We introduce state blocks, that are deployed along Om- Finally, to ensure that all transactions either commit or niLedger to minimize storage and update overhead. abort atomically even when they affect ledger state distributed • We introduce two-tier trust-but-verify processing to mini- across multiple shards (e.g., several cryptocurrency accounts), mize the latency of low-value transactions. OmniLedger introduces Atomix, a two-phase client-driven • We informally analyze the security, and implement and “lock/unlock” protocol ensuring that clients can either fully evaluate a prototype of OmniLedger. commit a transaction across all shards, or obtain “rejection II. BACKGROUND proofs” needed to abort and unlock state affected by partially- completed transactions. A. Scalable Byzantine Consensus in ByzCoin Besides addressing the above key security and correctness OmniLedger builds on the Byzantine consensus scheme in challenges, OmniLedger also introduces several performance ByzCoin [32], because it scales efficiently to thousands of and scalability refinements we found to be instrumental in consensus group members. ByzCoin uses collective signing or achieving its usability goals. OmniLedger’s consensus proto- CoSi [45], a scalable cryptographic primitive that implements col, Omnicon, enhances the PBFT-based consensus in Byz- multisignatures [42], to make a traditional consensus algorithm Coin [32] to preserve performance under Byzantine denial- such as PBFT [13] more scalable. ByzCoin distributes blocks of-service (DoS) attacks, by adopting a more robust group using multicast trees for performance, but falls back to a less- commuication pattern. To help new or long-offline miners scalable star topology for fault tolerance. Although ByzCoin’s catch up to the current ledger state quickly without having to consensus is scalable, its total processing capacity does not download the entire transaction history, OmniLedger adapts increase with participation: i.e., it does not support horizontal classic distributed checkpointing principles [20] to produce scale-out as in OmniLedger. consistent, collectively-signed state blocks periodically. B. Transaction Processing and the UTXO model Finally, to minimize transaction latency in common cases Distributed ledgers derive current system state from a such as low-value payments, OmniLedger supports optional blockchain, or a sequence of totally-ordered blocks contain- trust-but-verify operation, in which transactions are first pro- ing transactions. OmniLedger adopts the unspent transaction cessed by a small tier of fast validators. A second tier of output (UTXO) model, to represent ledger state, due to its necessarily-slower validators, where each tier is large enough simplicity and parallelizability. In this model, the outputs of to ensure long-term security, subsequently verifies the correct- a transaction creates new UTXOs (and assign them cred- ness of the first tier’s processing. This two-level approach its), and inputs completely “spend” existing UTXOs. During ensures that any misbehavior within the first tier will be bootstrapping, new (full) nodes crawl the entire distributed detected within minutes, and can be strongly disincentivized ledger and build a database of valid UTXOs needed to decide through recourse such as loss of deposits. Clients can wait subsequently whether a new block can be accepted. The only for the first tier to process low-value transactions, while UTXO model was introduced by Bitcoin [36] but has been waiting for both tiers to process high-value transactions for widely adopted