natureofwirelessnetworksinordertomonitorothernodes.Suchmonitoring,howe - PDF document

natureofwirelessnetworksinordertomonitorothernodes.Suchmonitoring,however,maynotalwaysbepossibleduetoasymmetriclinkswhennodesusepowercontrol.Furthermore,directionalantennas[11],[12],whicharegainingmomentuminwirelessnetworksinordertoimprovecapacity,willalsomakemonitoringhard.Anotherpossibilitytoprovideincentiveistousecredit(orvirtualcurrency)ormicropayment[13].ButtyanandHubauxproposedanicesolutionofthistypein[5],andthenpresentedanimprovedresultbasedoncreditcountersin[6].Forbothproposals,anodereceivesoneunitofcreditforforwardingamessageofanothernode,andsuchcreditsaredeductedfromthesender(orthedestination).BesidesotherpotentialissuesthatwewilldiscussinSectionII,bothproposalsrequireatamper-proofhardwareateachnodesothatthecorrectamountofcreditisaddedordeductedfromthenode.Asaresultofthisrequirement,althoughbothproposalsareinteresting,theymaynotÞndwide-spreadacceptance.Inthispaper,weproposeSprite,as imple,cheat-p edi -basedsyste mformobilead-hocnetworkswithselÞshnodes.Similarto[5]and[6],oursystemalsousescredittoprovideincentivetoselÞshnodes.However,oneofthenovelanddistinguishingfeaturesisthatoursystemdoesnotneedanytamper-proofhardwareatanynode.Atahighlevel,thebasicschemeofoursystemcanbedescribedasfollows.Whenanodereceivesamessage,thenodekeepsareceiptofthemessage.Later,whenthenodehasafastconnectiontoaCreditClearanceService(CCS),itreportstotheCCSthemessagesthatithasreceived/forwardedbyuploadingitsreceipts.TheCCSthendeterminesthechargeandcredittoeachnodeinvolvedinthetransmissionofamessage,dependingonthereportedreceiptsofamessage.Thedesignofoursystemneedstoaddresstwomainissues.First,sincethereisnotamper-proofhardwareatanynodeandthechargeandcreditarebasedonthereportsoftheselÞshnodes,aselÞshnode(orevenagroupofcolludingnode)mayattempttocheatthesystemtomaximizeitsexpectedwelfare.Asanexample,aselÞshnodemaywithholditsreceipt,orcolludewithothernodestoforgereceipts,ifsuchactionscanmaximizeitswelfare.Thisisthesecurityperspectiveofoursystem.Second,anodeshouldreceiveenoughcreditforforwardingamessageforanothernode,sothatitcansenditsownmessageswiththereceivedcredit,unlesstheresourceofthenodeitselfisextremelylow.Thisistheincentiveperspectiveofoursystem.Insummary,thecontributionsofthispaperarethefollow-ing.First,wepresentSprite,asystemtoprovideincentivetoselÞshmobilenodestocooperate.Second,oursystemde-termineschargeandcreditfromagame-theoreticperspective,andmotivateseachnodetoreportitsactionshonestly,evenwhenacollectionoftheselÞshnodescollude.Third,wemodeltheessentialcomponentofoursystemasagameandprovethecorrectnessofoursystemunderthismodel.Asfarasweknow,thisistheÞrstpure-softwaresolutionthathasformalproofsofsecurity.Ourmainresultworksformessage-forwardinginunicast,andweextendittoroutediscoveryandmulticastaswell.Fourth,weperformextensiveevaluationsandsimulationsofoursystem.Evaluationsofaprototypeimplementationshowthattheoverheadofoursystemissmall.SimulationsshowthatthenodeswillcooperateandforwardeachotherÕsmessages,unlesstheresourceofeachnodeisextremelylow.Therestofthispaperisorganizedasfollows.InSectionII,wediscussrelatedwork.InSectionIII,wepresenttheoverallarchitectureandtheintuitionsbehindourdesign.WethengivethefullspeciÞcationofoursysteminSectionIV.InSectionV,wepresentaformalmodelofoursystemandprovethesecuritypropertiesunderthismodel.InSectionVI,wefurtherconsidertheincentiveissueinroutediscoveryandmulticast.InSectionVII,wepresentevaluationsofoursolution.OurconclusionandfutureworkareinSectionVIII.II.RELATEDWORKThreeclassesofworkarecloselyrelatedtothispaper:reputationsystems,twostimulationapproachesfromtheTer-minodesproject,andalgorithmicmechanismdesign.A.Reputation-basedapproachesIn[4],Martietal.considereduncooperativenodesingeneral,includingselÞshandmaliciousnodes.Inordertocopewiththisproblem,theyproposedtwotools:awatchdog,whichidentiÞesmisbehavingnodes,andapathrater,whichselectsroutesthatavoidtheidentiÞednodes.Theirsimulationsshowedthatthesetwotoolscanmaintainthetotalthroughputofanadhocnetworkatanacceptablelevelevenwithalargepercentageofmisbehavingnodes.In[7],[8],BucheggerandLeBoudecproposedandevaluatedtheirCONFIDENTproto-col,whichdetectsandisolatesmisbehavingnodes.However,aswediscussedinSectionI,thereareseveralissuesthatsuchreputation-basedsystemsneedtoaddress.B.TwostimulationapproachesfromTerminodesIn[5],ButtyanandHubauxproposedastimulationapproachthatisbasedonavirtualcurrency,callednuglets,whichareusedaspaymentsforpacketforwarding.Usingnuglets,theauthorsproposedtwopaymentmodels:thePacketPurseModelandthePacketTradeModel.InthePacketPurseModel,thesenderofapacketpaysbyloadingsomenugletsinthepacketbeforesendingit.Intermediatenodesacquiresomenugletsfromthepacketwhentheyforwardit.Ifthepacketrunsoutofnuglets,thenitisdropped.InthePacketTradeModel,thedestinationofapacketpaysforthepacket.ToimplementthePacketTradeModel,eachintermediatenodebuysapacketfromitspreviousnodeforsomenugletsandsellsittothenextnodeformorenuglets.Inthiswayeachintermediatenodeearnssomenugletsandthetotalcostofforwardingthepacketiscoveredbythedestination.ToimplementeitherthePacketPurseModelorthePacketTradeModel,atamper-proofhardwareisrequiredateachnodetoensurethatthecorrectamountofnugletsisdeductedorcreditedateachnode. Besidestherequirementforatamper-proofhardwareateachnode,someotherissuesalsoexistforthePacketPurseModelandthePacketTradeModel:1)Bothmodelsrequiretheclearanceofnugletsinreal-time.Asaresult,ifthesystemdoesnothaveenoughnugletscirculatingaround,theperformanceoftheirsystemmaydegrade.2)Underbothmodels,ifamobilenoderunsoutofnuglets,itstamper-proofhardwarestillhastocontactwithsomecentralauthorityinordertoÒreÞllÓitscredit.(Actually,theCCSintroducedbyoursystemissimilartosuchanauthority.)3)AdisadvantageofthePacketTradeModelisthatitisvulnerabletonetworkoverload,sincethesendersdonothavetopay.Forthisreason,theauthorsof[5]mainlystudiedthePacketPurseModel.Besidesthenugletapproach,ButtyanandHubauxalsoproposedaschemebasedoncreditcounter[6].Inthisnewapproach,eachnodekeepstrackofitsremainingbatteryanditsremainingcredit.TheauthorssimulatedfourrulesforanodetodeterminewhentoforwardothersÕpacketsandwhentosenditsownpackets.OuranalysisshowsthattheÞrstruleisactuallyoptimaltoachievetheirgivengoals.Althoughthisnewschemeissimpleandelegant,itstillrequiresatamper-proofhardwareateachnodesothatthecorrectamountofcreditisdeductedorcredited.Furthermore,theÞrsttwoissuesweoutlinedinthepreviousparagraphexistforthisapproachaswell.Both[5]and[6]aretheresultsoftheTerminodesproject.GeneralreviewsoftheTerminodesproject,andoftherelatedsecurityproblems,canbefoundin[14],[15],[16].C.AlgorithmicmechanismdesignandgametheoryOurapproachismotivatedbyalgorithmicmechanismde-sign(seee.g.,[17],[18],[19],[20],[21],[22],[23],[24]),whichisanemergingactiveresearchareaintheintersectionofcomputerscienceandmathematicaleconomics.Inparticular,Feigenbaumetal.haveconsideredBGP-basedmechanismdesignforlowest-costunicastroutingintheInternet[23].In[21],Feigenbaumetal.haveconsideredcostsharingformulticast.Golleetal.haveanalyzedtheincentivesinpeer-to-peernetworks[22].However,asfarasweknow,thereisnopreviousproposedmechanismdesignforadhocnetworks.Furthermore,althoughourdesignismotivatedbyalgorithmicmechanismdesign,ourproblemdoesnotÞtexactlyintothemechanism-designframework.Forexample,inourgame,theinformationheldbyeachplayerisnottotallyprivate,whileinmechanismdesign,eachplayermusthaveaprivateIII.OVERVIEWOFOURPPROACHInthissection,wepresenttheoverallarchitectureandtheintuitionsbehindourdesign;theformalresultswillbepresentedinSectionsIVandV. Fig.1.ThearchitectureofSprite.A.SystemarchitectureFigure1showstheoverallarchitectureofoursystem,whichconsistsoftheCreditClearanceService(CCS)andacollectionofmobilenodes.Thenodesareequippedwithnetworkinterfacesthatallowthemtosendandreceivemes-sagesthroughawirelessoverlaynetwork[25],e.g.,usingGPRSinawide-areaenvironment,whileswitchingto802.11orBluetoothinanindoorenvironment.Toidentifyeachnode,weassumethateachnodehasacerticateissuedbyascalablecerticateauthoritysuchasthoseproposedin[26],[27].Forconcretenessofpresentation,weassumethatthesenderknowsthefullpathfromthesendertothedestination,usingasecureadhocroutingprotocolbasedonDSR[28],[29],[30].TheincentiveissuesofroutediscoverywillbeinvestigatedinSectionVI.Whenanodesendsitsownmessages,thenode(orthedestination,seelater)willlosecredit(orvirtualmoney)tothenetworkbecauseothernodesincuracosttoforwardthemessages.Ontheotherhand,whenanodeforwardsothers’messages,itshouldgaincreditandthereforebeabletosenditsmessageslater.Therearetwowaysforanodetogetmorecredit.First,anodecanpayitsdebitorbuymorecreditusingrealmoney,atavariableratetothevirtualmoney,basedonthecurrentper-formanceofthesystem.However,thepreferredanddominantwaytogetmorecreditisbyforwardingothers’messages.Inordertogetcreditforforwardingothers’messages,anodeneedstoreporttotheCCSwhichmessagesithashelpedtoforward.AlthoughanodecansaveitsreportsinalocalstoragesuchasCompactFlashcard,inordertoreducestorage,eachmobilenodeshouldreporttotheCCSwheneveritswitchestoafastconnectionandhasbackuppower.AmobilenodecanalsouseadesktopcomputerasaproxytoreporttotheCCS.Inordertosavebandwidthandstorage,insteadofrequiringthewholemessageasareport,oursystemusessmallreceipts.Suchreceiptsarederivedfromthecontentofthemessagesbutdonotexposetheexactcontentofthemessages.Thus,althoughwerequirethattheCCSbetrustedintermsofmaintainingcreditbalance,thenodesdonotneedtotrusttheCCSintermsofmessagecondentiality. Sprite:ASimple,Cheat-Proof,Credit-BasedSystemforMobileAd-HocNetworksShengZhongComputerScienceDepartmentYaleUniversityNewHaven,CT06520Email:sheng.zhong@yale.eduJiangChenComputerScienceDepartmentYaleUniversityNewHaven,CT06520Email:jiang.chen@yale.eduYangRichardYangComputerScienceDepartmentYaleUniversityNewHaven,CT06520Email:yry@cs.yale.edu—Mobileadhocnetworkinghasbeenanactiveresearchareaforseveralyears.Howtostimulatecooperation B.Whopayswhom?Beforedeterminingtheamountofcreditorchargetoeachnode,werstdiscusstwobasicquestions.Therstquestioniswhopayswhom.Consideringtherelayofamessagefromasendertoadestinationasatransaction,weneedtodecidewhoshouldbechargedforthemessageandwhoshouldreceivecreditforrelayingthemessage.Althoughwecanchargethedestination,wedecidethatchargingthesenderwillbeamorerobustandgeneralap-proach.Therearetworeasonsforchargingonlythesender.First,chargingthedestinationmayallowothernodestolaunchadenial-of-serviceattackonthedestinationbysendingitalargeamountoftrafc.Evensharingthecostbetweenthesenderandthedestinationcouldhaveasimilarproblem,becausethesendercouldcolludewiththeintermediatenodes,whocouldsecretlyreturnthesender’spaymentback,sothatonlythedestinationpaysforthetrafc.Ontheotherhand,ifonlythesenderischarged,anodewillnothaveincentivetosenduselessmessages.Second,ifthedestinationbenetsfromthecontentofamessageandthusshouldpayforit,thesendercangetcompensationfromthedestination,forexample,throughanapplication-layerpaymentprotocol.Giventhesereasons,onlythesenderwillbechargedinourAcloselyrelatedquestioniswhowillreceivecreditforforwardingamessage.Ideally,anynodewhohasevertriedtoforwardamessageshouldbecompensatedbecauseforwardingamessagewillincuracosttothenode,nomattersuccessfulornot.However,aforwardedmessagemaybecorruptedonthelink,andthereisnowaytoverifythattheforwardingactiondoesoccur.AlthoughsomelocalwirelessnetworkssuchasIEEE802.11doprovidelinklayeracknowledgments,suchacknowledgmentschemesarenotuniversalandwerefrainfromchangingbasicnetworkfunctions.Giventhisdecision,thecreditthatanodereceiveswilldependonwhetherornotitsforwardingactionissuccessful—aforwardingissuccessfulifandonlyifthenextnodeonthepathreceivesthemessage.Inotherwords,theCCSbelievesthatanodehasforwardedamessageifandonlyifthereisasuccessorofthatnodeonthepathreportingavalidreceiptofthemessage.C.ObjectivesofthepaymentschemeThesecondbasicquestionisabouttheobjectiveofthepaymentscheme.Afterall,theobjectivesofourpaymentschemearetopreventcheatingactionsandtoprovideincentiveforthenodestocooperate.Givensuchobjectives,oursystemdoesnottargetbalancedpayment;thatis,wedonotrequirethatthetotalchargetothesenderbeequaltothetotalcreditreceivedbyothernodesforamessage.Infact,inordertopreventonetypeofcheatingactions,ourCCSchargesthesendermorethanitgivestotheothernodes(seeSectionIII-F).Inordertooffsetlong-termnetoutowofcreditfromthemobilenodestotheCCS,ifinalargenetwork,theCCSperiodicallyreturnsthecreditbacktothemobilenodesuniformly;otherwise,theCCSperiodicallygiveseachmobilenodeaxedamountofcredit.Notethatthisreturnwillnotenableanycheatingactionorreducetheincentiveofthenodestoforwardothers’messages.D.Cheatingactionsinthereceipt-submissiongameSincethemobilenodesareselsh,withoutaproperpay-mentscheme,theymaynotforwardothers’messagesortheymaytrytocheatthesystem,ifthecheatingcanmaximizetheirwelfare.Inparticular,aselshnodecanexhibitoneofthethreeselshactions:1)Afterreceivingamessage,thenodesavesareceiptbutdoesnotforwardthemessage;2)Thenodehasreceivedamessagebutdoesnotreportthe3)Thenodedoesnotreceiveamessagebutfalselyclaimsthatithasreceivedthemessage.Notethatanyoftheselshactionsabovecanbefurthercomplicatedbycollusionoftwoormorenodes.Wenextprogressivelydeterminetherequirementsonoursysteminordertopreventtheaboveactions.E.MotivatingnodestoforwardmessagesInordertomotivateaselshnodetoforwardothers’messages,theCCSshouldgivemorecredittoanodewhoforwardsamessagethantoanodewhodoesnotforwardamessage.Abasicschemetoachievethisobjectiveisasfollows.First,theCCSdeterminesthelastnodeonthepaththathaseverreceivedthemessage.ThentheCCSasksthesendertopaytothisnode,andtoeachofitspredecessors,
.NotethattheCCSdoesnotaskthesendertopayanythingtothesuccessorsofthelastnode.Comparingthisschemewiththosein[5]and[6],weobservethattheapproachesin[5]and[6]arejustthespecialcasethatverysmallandiscloseto1.Figure2illustratesthebasicideawithanexample.Inthisexample,onlytherstthreeintermediatenodessubmittheirreceipts.Therefore,nodes1and2willeachreceiveapaymentof,andnode3apayment.Sincenode4andthedestinationdonotsubmitanyreceipt,theydonotreceiveanycredit.Thesenderpaysatotal sender node 1 node 2 node 3node 4Fig.2.Illustrationofourpaymentscheme(version1).F.MotivatingnodestoreporttheirreceiptsObviously,eachsinglenodehavingreceivedamessageismotivatedtoreportitsreceipt,ifisgreaterthanitscostofsubmittingareceipt,which,aswediscussedpreviously,shouldbelowsinceareceiptisgenerallysmall.Unfortunately,thereisstillacollusionthatcanworkagainsttheabovedesign.Asanexample,thelastnode(orinthegeneralcase,thelastnodes)everreceivedthemessagecancolludewiththesender.Inparticular,ifthelastnodedoesnotreportitsreceipt,thesendersaveswhilethelastnode .However,ifthesendergivesthelastnodeabehind-the-scenecompensationof,where,thelastnodewillbebetter-offwhilethesenderstillenjoysanetgainof.Thus,thecolludinggroupgetsanetbenetofInordertopreventthischeatingaction,theCCSchargesthesenderanextraamountofcreditifthedestinationdoesnotreportthereceiptofamessage.ThisextrachargegoestotheCCSinsteadofanynodes.Theoverallchargetothesender(includingpaymentstoothernodesandtheextracharge)shouldbelessthanthechargetothesenderwhenthemessagearrivesatthedestination,whereisthenumberofnodesnotsubmittingreceipts.Givensuchextracharge,evenacolludinggroupcannotbenetfromthischeatingaction.AgainconsidertheexampleinFigure2.Figure3showstherevisedamountpaidbythesender,whichisequalto sender node 1 node 2 node 3node 4Fig.3.Illustrationofourpaymentscheme(version2).G.PreventingfalsereceiptsNextweconsideracountermeasuretothethirdtypeofshactions.Aswediscussedbefore,inordertosavebandwidthandstorage,oursystemrequiresthatthenodessubmitreceiptsinsteadoffullmessages.Givensuchaschemeforreceipts,agroupofcolludingnodescantrytoattackoursysteminseveralways.Forexample,insteadofforwardingthewholemessage,anintermediatenodecanforwardonlythereceiptofamessagetoitssuccessor,whichissufforgettingcredit.Moreover,theintermediatenodecanevenwaituntilithasafastconnectiontothesuccessortoforwardthefalsereceipt,thusfurthersavingresourceusage.Thekeytopreventsuchattackdependsonthedestination.Wedistinguishtwocases:1)thedestinationcolludeswiththeintermediatenodes;or2)thedestinationdoesnotcolludewiththeintermediatenodes.rstconsiderthecasethatthedestinationcolludeswiththeintermediatenodes,andthereforesubmitsareceiptofamessageevenwhenitdoesnotreceivethewholemessage.Forthiscase,wearguethattheintermediatenodesandthedestinationshouldbepaidasifnocheatinghadhappened,becauseafterall,themessageisforthedestinationandthedestinationdoessubmitareceiptforthemessage,indicatingthatithasreceivedthemessage.Ifthesenderneedstomakesurethatthedestinationreceivesthewholemessage,ahigher-layerprotocoltovalidatethereceiptofthewholemessagebythedestinationcanbeeasilyimplemented,e.g.,see[31].Wenextconsiderthecasethatthedestinationdoesnotcolludewiththeintermediatenodes.Inthiscase,iftheintermediatenodesforwardonlythereceiptofamessageinsteadofthewholemessage,thenthedestinationwillnotbeabletoreceiveavalidmessagepayload,andthereforewillnotsubmitareceiptforthemessage.Basedonthisobservation,wecanpreventthepotentialcheatingactionoftheintermediatenodesbygreatlyreducingtheamountofcreditgiventotheintermediatenodes,ifthemessageisnotreportedtobereceivedbythedestination.Withsuchreductionofcredit,thecheatingnodescannotgetenoughcrediteventocovertheminimumexpenseneededforthistypeofcheating,i.e.,thecostofforwardingareceipt.Tobemoreexact,ifthedestinationdoesnotreportareceiptofamessage,wemultiplythecreditpaidtoeachnodeby,where(theexactrequirementonwillbepresentedinSectionV).StillconsidertheexampleinFigure2.Figure4showstherevisedamountofcreditreceivedbyeachnode.Inparticular,comparingFigure4withFigure3,duetothisrevision,wereducethechargetothesenderbyinsteadof,foreachnodeonthepathwhodoesnotreportareceipt. sender node 1 node 2 node 3node 4\t
\t
\tFig.4.Illustrationofourpaymentscheme(nalversion).IV.MESSAGEORWARDINGROTOCOLPECIFICATIONInthefollowingformalspecicationofourprotocol,wedenotethepublic/privatekeypairofnode\f\nEachnodemaintainsasequence-numbermatrix,whereisthesequencenumberofmessagesfromsendertodestination,observedbynode.Weassumethat\r\bisadigitalsignaturescheme.Inpractice,wecanusetheRSAortheellipticcurvesignatureA.SendingamessageSupposethatnodeistosendmessagepayloadwithsequencenumbertodestinationthroughpath.Noderstcomputesasignature,,on\r,whereisamessagedigestfunctionsuchasMD5[32]orSHA-1[33].Then,\rtothenexthopandincreases.Figure5speciesthecompleteprotocolsteps. isthemessagepayload.isthesender,thedestination,andthepath.\r\b\r\rtothenextnode Fig.5.NodesendsamessagetoB.ReceivingamessageSupposethatnodereceives\r\r.Itrstchecksthreeconditions:1)isonthepath;2)themessagehasasequencenumbergreaterthan;and3)thesignature isvalid.Ifanyoftheconditionsisnotsatised,themessageisdropped.Otherwise,itsaves\r\rasareceipt.isnotthedestinationanddecidestoforwardthemessage,itsends\r\rtothenexthop.Figure6speciestheprotocolsteps. \r\risthereceivedmessage.isthesender,thedestination.notin\r dropthemessagesave\r\rasareceiptisnotthedestinationdecidestoforward)\r\rtonexthopdropthemessage Fig.6.Nodereceivesm,p,seq,sC.ComputingpaymentsAreceipt\r\rsubmittedbynodeisregardedasvalidif\r isthepublickeyofthesender.Withoutlossofgenerality,weassumethat,whereisthelastnodeonpaththatsubmitsavalidreceiptwithsequencenumber.ThentheCCSchargesfromnode,andpaystonode!Notethatinimplementation,theCCSwillissuecreditgrad-ually.Forexample,whenthelastintermediatenodesubmitsitsreceiptforamessagebutthedestinationhasnotsubmitteditsreceiptyet,thelastintermediatenodewillget.Later,whenthedestinationsubmitsitsreceipt,thenodewillgetitsfullcreditofV.MESSAGEORWARDINGROTOCOL:AFODELANDNALYSISA.Amodelofthereceipt-submissiongameForconvenienceofanalysis,wemodelthesubmissionsofreceiptsregardingagivenmessageasaone-roundgame.Players.Thisgamehas,fromthesendertothedestination.Players’Information.betheinformationheldbythatisunknowntotheCCS.For ifnodehaseverreceivedmessage#$%\f otherwise.Obviously,thesenderandthesetofnodesthathaveeverreceivedmessageconstituteaprexofthepath. #$%\f istheindexofthelastnodethathaseverreceived.NotethatissecrettotheCCSwhenthegamestarts.Alsonotethataplayerhassomepartialinformationi.e.,theinformationinferredfromitsowninforma-tion.Forcompleteness,wede Eachplayer,),hastwopossibleactions:reportingthatithaseverreceivedmessage(bysubmittingavalidreceipt),orwithholdingitsreport.Wedenotetheaction.Theniseither #$%\f .Theonlyexceptionis,whichhasnochoiceofaction.Wede ,forcompletenessofourmodel.CostofActions.Wedenotethecostofsactionby.Asdiscussedbefore,ingeneral,thecostofsendingareceipttotheCCSisverylow.However,ifplayerdoesnotreceivebutcansuccessfullyclaimthatithasreceivedthemessage,thenacolludingnodemusthaveforwardedacopyofthereceipt.Letbethecostofforwardingareceiptfromonemobilenodetoanothernode.Thenthecolludingnodeincursacostofmustcompensatethecolludingnode.Countingthiscoston,wehave#$%\f  Payment.Recallthatthesystemspaymentto)is!For,thechargeofcanbeviewedasanegativepaymentWelfare.Forplayer,deductingitscostfromitsreceivedpayment,thenodehasawelfareofRecallthateachreceiptcontainsasignedpath.Therefore,nodesnotonthepathareeasilyexcludedfromthisgame. B.Analysisofthereceipt-submissiongame:thesecurityper-,thenwesaythattellsthetruth.Otherwise,wesaythatcheats.Thestrategycanbecheating,oraprobabilitydistributionoverthesetwochoices.strategyproÞleofagroupofplayersreferstotheorderedsetofthestrategiesoftheseplayers.DeÞnition1:Foraplayer,anoptimalstrategyisastrategythatbringsthemaximumexpectedwelfaretoit,regardlessofthestrategiesofalltheothernodesTheorem1:Inthereceipt-submissiongame,truth-tellingisanoptimalstrategyforeverynode,if,andnotcheatincaseof#$%\f (PleaseseeAppendixIX-Aforaproof.)Besidesindividualcheating,wefurtherconsiderthepossi-bilityofcollusion.DeÞnition2:Agameiscollusion-resistant,ifanygroupofcolludingplayerscannotincreasetheexpectedsumoftheirwelfarebyusinganystrategyproleotherthanthatinwhicheverybodytellsthetruth.Theorem2:Thereceipt-submissiongameiscollusion-resistant,if,anddoesnotcheatincase#$%\f (PleaseseeAppendixIX-Bforaproof.)DeÞnition3:Agameischeat-proof,iftruth-tellingisanoptimalstrategyforeveryplayerandthegameiscollusion-Theorem3:Thereceipt-submissiongameischeat-proof.C.Analysisofperformance:theincentiveperspectiveIntheaboveproofs,wehaveessentiallyshownthateachshnodeshouldreportfaithfullytotheCCS.Withthisknowledgeinmind,comparingtheexpectedgainofcreditfromforwardingamessagewiththatofnotforwardingthemessage,anintermediatenodecanexpectanetgainof+(1,whereistheprobabilitythatthemessagearrivesatthenextnode,andtheprobabilitythatthemessagearrivesatthedestination.Simplifying,wehave.Notethatthispaymentgainisalwaygreaterthanissmall,andIfthispaymentgainissufcienttocoverthecostofforwardingamessage,thenodehasincentivetoforwardthemessage.Notethatwecanfurtherne-tunethepaymentparameterstooptimizethesystemperformance.However,thisoptimizationissueisorthogonaltothemainthemeofthispaper,andathoroughinvestigationoftheoptimizationissuewillbepresentedinaseparatepaper.VI.STIMULATINGOOPERATIONINISCOVERYULTICASTSinceroutediscoveryusesmessagebroadcast,theapproachwehavepresentedcannotbeapplieddirectly.Hereweproposeaslightlydifferentapproach,whichisabitmoreexpensive.Butsinceroutediscoveryisperformedlessfrequently,thisapproachisaffordableingeneral.ThisapproachisbasedonDSR,andessentiallywewillshowhowtoimproveDSRtostimulatecooperationinroutediscovery.NotethatthereplytoROUTEREQUESTcanbesentasaregularmessage.Thereforeweonlyneedtostimulatethere-broadcastingofROUTEREQUEST.A.SendingaROUTEREQUESTIngeneral,whenanodestartstobroadcastaROUTEREQUEST,themessageincludesthesourceaddressandasequencenumber.Thenthenodesignsandbroadcaststhemessage,andincreasesitssequencenumbercounterbyB.ReceivingaROUTEREQUESTSupposethatanodereceivesaROUTEREQUEST.Itrstdecideswhetherthemessageisareplaybylookingatthesequencenumber.ThenodesavesthereceivedROUTEREQUESTforgettingpaymentinthefuture.WhenthenodedecidestorebroadcasttheROUTEREQUEST,itappendsitsownaddresstotheROUTEREQUESTandsignstheextendedC.ComputingpaymentWhentheCCScomputespayment,aROUTEREQUESTisrejectedifanysignatureinthemessageisinvalid.Further-more,ifaROUTEREQUESTsubmittedbyanodeisapartofanotherROUTEREQUESTsubmittedbythesamenode,thentheformermessageisrejected.Finally,theCCSbuildsatreebasedontheacceptedROUTEREQUESTmessages.Thesenderpaystoeachnon-leafnodeofthetree,andtoeachleafofthetree.Foreachnodeoutsidethetree,thesendernodepaystotheCCS.D.DiscussionandextensionTheaboveapproachissecureforroutediscovery.Itssecu-ritycanbearguedinasimilarwayastheunicastcase.Asroute-discoverybroadcastcanbeviewedasaspecialcaseofmulticast,thisapproachcanalsobeappliedtomulticastifmulticastisnotfrequentlyusedinthesystem.Ifmulticastisfrequentlyused,wecanuseacombinationoftheaboveap-proachandtheapproachpresentedforstimulatingforwardingmessages,whichislessexpensive.However,wedonothaveaprovableresultforthesecondtypeofcheatinginthiscase.Weleavetheproofasafutureresearchtopic.VII.EVALUATIONSA.Overheadrstevaluatetheoverheadofoursystem.Inordertomeasuretheoverhead,wehaveimplementedaprototypeofoursystemusingtheCrypto++4.0library[34].Theimple-mentationcanrunoverawiderangeofplatformssuchasLinuxandWin32.Intheevaluationsbelow,ourmobilenodeisaLaptopwithanIntelMobilePentiumIIIprocessorat866MHz.The OSofthemobilenodeisWindowsXP.Thelengthofamessagepayloadis1000bytes.ThemessagedigestfunctionisMD5.Weconsidertwodigitalsignatureschemes:RSAwithamodulusof1024bits,andECNRoverGF(p)168[35].Weassumethattheaveragepathlengthis8hops.rstevaluatetheCPUprocessingtimeonamobilenode.Inoursystem,themajoronlineprocessingoverheadisthesigningoperationbythesenderandthevericationoperationbytheintermediatenodes.ThesecondandthirdcolumnsofTableIshowtheCPUprocessingtimeofthesendertosendamessageandthatofanintermediatenodetoforwardamessage,respectively.WeobservethatRSAhasamuchsmallerforwardingoverhead.Thus,ifreducingforwardingoverheadisthemajorobjective,RSAisabetterimplementa-tionchoice.However,forbothschemes,weobservethattheCPUprocessingtimeisacceptable,ifthenodesdonotsendalargenumberofmessages,whichistheexpectedcasewhenthemobilenodeshavelimitedbandwidthandenergy.Wenextevaluatethebandwidthandstoragerequirement.ComparedwithamessageusingDSRastheroutingprotocolbutwithoutmessageauthentication,themajorincreasedover-headisthedigitalsignatureformessageauthentication.ForRSAwithamodulusof1024bits,theauthenticationheaderisabout128bytes;forECNRGF(p)with168bits,theheaderisabout42bytes.Intermsofstoragerequirementforthereceipts,forRSA1024,thetotalstorageofareceiptis180bytes,andfortheEllipticCurvebasedECNR,itis94bytes.ComparingRSAwithECNR,weobservethatECNRhasamuchsmallerbandwidthandstoragerequirement.B.Systemperformancevs.networkresourceWenextevaluatetheperformanceofoursystem.Onemajormetricoftheperformanceofoursystemisthemessagesuccessi.e.,thepercentageofmessagesthataresuccessfullyrelayedfromthesendertothedestination.Forthepurposeofthisevaluation,weignoremessagedropsduetochannelerrors.Notethatsuccessratewilldependonthesending/forwardingstrategyofthemobilenodes.AswehavediscussedinSec-tionIII,althoughoursystemprovidesincentiveforcooperationbygivingmorecreditforforwardingamessage,whetherornottoforwardaspecicmessagewilldependontheobjectivesandthestatusofanode.Todemonstratethegeneralityofoursystem,forthepurposeofthisevaluation,weconsideraspecialclassofmobilenodes,namelythepower-and-credit-conservativenodes.Specically,anodeispower-conservativeifitsremainingpowerallowsittosend(andforward)onlyalimitedamountofmessages;anodeiscredit-conservativeifitrefrainsfromsendinganynewmessagewhenitscreditbalanceisinsufcienttocoverthechargeforsendingamessage.Forthistypeofnodes,wecanshowthat,iftheobjectiveofsuchanodeistomaximizethetotalnumberofitsownmessagessentandatthesametimetosendthemessagesasearlyaspossible,thentheoptimalsend/forwardstrategyisthefollowing:whenitreceivesatransientmessage,ifthenumberofmessagesallowedtobesentbyitsestimatedcreditbalanceissmallerthanthenumberofmessagesallowedtobesentbyitsremainingbattery,forwardthetransientmessageandincreaseitsestimatedcreditbalanceby,whereistheprobabilitythattheforwardedmessagewillarriveatitsdestination;otherwise,dropthemessage.Insummary,letdenotetheestimatedcreditbalanceandthenumberofmessagesallowedtobetransmittedbytheremainingbatteryofanode,respectively.Assumethateachmessagetakesanaverageofhops.Thenthepolicyofsuchanodeisthefollowing:if ,forwardatransientmessage;otherwise,dropthemessage.Giventhestrategyabove,wenextevaluatethemessagesuccessrateofoursystem. 0 0.2 0.4 0.6 0.8 1 100 200 300 400 500 600 700 Message success rate BEffects of battery on message transmission simulation: number of nodes=70 simulation: number of nodes=200 analysis: L=3 Fig.7.Messagesuccessratevs.networkbatteryresource.rstevaluatethemessagesuccessrateunderdifferentgurationsofnetworkresource.Figure7showsthemes-sagesuccessratesfortwoadhocnetworks:onenetworkwith70nodesuniformlydistributedinanareaof1000by1000,andanothernetworkwith200nodesuniformlydistributedinanareaof2000by2000.Thecommunicationradiusofeachnodeis250.Inthisexperiment,sincethenodesarepower-and-credit-conservative,theirestimatedcreditbalanceisclosetoandwechoosetheirinitialcredittobeuniformlydistributeduted"],where=10.Toobservetheeffectoftheamountofnoderesourceontheoverallmessagesuccessrate,foreachnode,wechooseits,thenumberofmessagesthatcanbesent/forwardedbytheremainingbatteryofthenode,uniformlyfromfrom*],whereisfrom30to640.Notethateventhemaximumnumberof640isveryconservative[2].Forthisscenario,rstwecandriveanapproximateanalyticalexpressionforthemessagesuccessrateas ,whereistheaveragepathhops.Inadditiontothisanalyticalresult,Figure7alsoplotstheresultsfromsimulationsinordertocapturethefulldetailssuchastrafcconcentration.Tocontrolthenumberofexperimentsforeachconguration,werepeattheexperimentofacongurationwithadifferentrandomseeduntilthe5%condenceintervalisnarrowerthan5%ofthemeanvalue.FromFigure7,weobserveclearlythatwithincreasingresource,thenodesaremorewillingtoforwardmessages,andthereforethemessagesuccessrateisverycloseto1.Wenextevaluatethedynamicsofmessagesuccessrate;thatis,howmessagesuccessrateevolvesasthenodessendmore send forward authentication receipt (ms) (ms) header(bytes) (bytes) RSA1024 10.4 0.3 128 180 ECNRoverGF(p)168 7.3 13.2 42 94 ECNRoverGF(p)168(precomputation) 3.7 6.1 42 94 TABLEIPROCESSINGTIMESIZESOFAUTHENTICATIONHEADERANDRECEIPTS 0 0.2 0.4 0.6 0.8 1 100 200 300 400 500 Message success rate #generated packetsMessage transmission dynamics B=100 B=500 Fig.8.Dynamicsofmessagesuccessrate.messages.Figure8showstheresult.Underthisexperiment,theinitialcreditofeachnodeis,andtheinitialbatteryofeachnodeis,where=100.Thevalueofisintheverylowend,andtheobjectiveistoobservemessagedrops.Thex-axisofFigure8istheindexofthenumberofmessagesgeneratedbythemobilenodes,andthey-axisshowsthemessagesuccessrate.Fromthisgure,weobservethatassystemevolvesandnonewnodejoins,thebatteriesofthenodesareconsumedandthenodestendtobemoreconservative.However,weobservethat,eveninalowbatteryconguration,considerablenumberofmessageswillbegeneratedbeforethemessagesuccessratedecreases.VIII.CInthispaper,wepresentedSprite,asystemtoprovideincentivetomobilenodestocooperate.Oursystemdeterminespaymentsandchargesfromagame-theoreticperspective,andweshowedthatoursystemmotivateseachnodetoreportitsbehaviorhonestly,evenwhenacollectionoftheselnodescollude.Wealsomodeledtheessentialcomponentofoursystemasthereceipt-submissiongame,andprovedthecorrectnessofoursystemunderthismodel.Asfarasweknow,thisistherstpure-softwaresolutionthathasformalproofsofsecurity.Ourmainresultworksforpacket-forwardinginunicast,andweextendeditforroutediscoveryandmulticastaswell.WealsoimplementedaprototypeofoursystemandshowedtheoverheadofoursystemisinsigniSimulationsandanalysisofthepower-and-credit-conservativenodesshowedthatthenodescancooperateandforwardeachsmessages,unlesstheresourceofthenodesisextremelylow.CKNOWLEDGMENTWethankJoanFeigenbaumformanyvaluablesuggestions.[1]C.Perkins,AdHocNetworking.Addison-Wesley,2000.[2]C.-K.Toh,AdHocMobileWirelessNetworks:ProtocolsandSystemsPrenticeHallPTR,2001.[3]H.-Y.HsiehandR.Sivakumar,Performancecomparisonofcellularandmulti-hopwirelessnetworks:Aquantitativestudy,JointInternationalConferenceonMeasurementandModelingofComputerSystems(SIGMETRICS)2001,Cambridge,MA,June2001.[Online].Available:http://www.ece.gatech.edu/research/GNAN/archive/sigmetrics01hs.pdf[4]S.Marti,T.Giuli,K.Lai,andM.Baker,Mitigatingroutingmisbehaviorinmobileadhocnetworks,ProceedingsofTheSixthInternationalConferenceonMobileComputingandNetworking2000,Boston,MA,Aug.2000.[Online].Available:http://gunpowder.stanford.edu/[5]L.ButtyanandJ.P.Hubaux,Enforcingserviceavailabilityinmobilead-hocWANs,IEEE/ACMWorkshoponMobileAdHocNetworkingandComputing(MobiHOC),Boston,MA,August2000.[Online].Available:http://icawww.ep[6]L.ButtyanandJ.P.Hubaux,Stimulatingcooperationinself-organizingmobileadhocnetworks,ACMJournalforMobileNetworks(MONET),specialissueonMobileAdHocNetworks,summer2002.[Online].Available:http://lcawww.ep[7]S.BucheggerandJ.-Y.L.Boudec,Nodesbearinggrudges:Towardsroutingsecurity,fairness,androbustnessinmobileadhocnetworks,10thEuromicroWorkshoponParallel,DistributedandNetwork-basedProcessing,2002.[8]S.BucheggerandJ.-Y.L.Boudec,PerformanceanalysisoftheCONFIDANTprotocol:Cooperationofnodes-fairnessindynamicad-hocnetworks,ProceedingsofIEEE/ACMWorkshoponMobileAdHocNetworkingandComputing(MobiHOC).IEEE,June2002.[Online].Available:http://lcawww.epBucheggerL02.pdf[9]Y.LiuandY.R.Yang,Reputationpropagationandagreementinmobilead-hocnetworks,ProceedingsofIEEEWirelessCommunicationsandNetworkingConference(WCNC),NewOrleans,LA,March2003.[10]M.J.OsborneandA.Rubenstein,ACourseinGameTheory.TheMITPress,1994.[11]A.SpyropoulosandC.Raghavendra,Energyefcientcommunicationsinadhocnetworksusingdirectionalantennas,ProceedingsofIEEEINFOCOMÕ02,NewYork,NY,June2002.[Online].Available:http://www.ieee-infocom.org/2002/papers/289.pdf[12]J.E.Wieselthier,G.Nguyen,andA.Ephremides,Energy-limitedwirelessnetworkingwithdirectionalantennas:Thecaseofsession-basedmulticasting,ProceedingsofIEEEINFOCOMÕ02,NewYork,NY,June2002.[Online].Available:http://www.ieee-infocom.org/2002/papers/303.pdf[13]M.Jakobsson,J.P.Hubaux,andL.Buttyan,Amicropaymentschemeencouragingcollaborationinmulti-hopcellularnetworks,Proceed-ingsofFinancialCrypto2003,LaGuadeloupe,January2003.[14]J.P.Hubaux,J.Y.L.Boudec,S.Giordano,M.Hamdi,L.Blazevic,L.Buttyan,andM.Vojnovic,Towardsmobilead-hocWANs:Terminodes,ProceedingsoftheIEEEWirelessCommunicationsandNetworkingConference(WCNC),Chicago,IL,September2000.[On-line].Available:http://www.terminodes.com/mics/getDoc.php?sessid= [15]J.P.Hubaux,T.Gross,J.Y.L.Boudec,andM.Vetterli,Towardsself-organizedmobileadhocnetworks:theTerminodesIEEECommunicationsMagazine,,January2001.[On-line].Available:http://www.terminodes.com/mics/getDoc.php?sessid=[16]J.P.Hubaux,L.Buttyan,andS.Capkun,Thequestforsecurityinmobileadhocnetworks,ProceedingsofACMSymposiumonMobileAdHocNetworkingandComputing(MobiHOC),LongBeach,CA,October2001.[17]N.NisanandA.Ronen,Algorithmicmechanismdesign,GamesandEconomicBehavior,vol.35,no.166196,2001.[18]N.Nisan,Algorithmsforselshagents,16thAnnualSymposiumonTheoreticalAspectsofComputerScience,1999,pp.1[19]C.H.Papadimitriou,Algorithms,games,andtheInternet,Proceed-ingsofthe33rdannualsymposiumonTheoryofcomputing2001,2001,pp.749[20]J.HershbergerandS.Suri,Vickreypricesandshortestpaths:Whatisanedgeworth,Proceedingsofthe42ndAnnualSymposiumonFoudationsofComputerScience2001,LasVegas,Nevada,Oct.2001,pp.252259.[Online].Available:http://theory.stanford.edu/focs2001/[21]J.Feigenbaum,C.Papadimitriou,andS.Shenker,Sharingthecostofmulticasttransmissions,JournalofComputerandSystemSciences(SpecialissueonInternetAlgorithms.),vol.63,pp.2141,2001.[Online].Available:http://cs-www.cs.yale.edu/homes/jf/FPS.pdf[22]P.Golle,K.Leyton-Brown,andI.Mironov,Incentivesinpeer-to-lesharing,ProceedingsoftheACMSymposiumonElectronicCommerce(ECÕ01)2001,Tampa,FL,October2001.[23]J.Feigenbaum,C.Papadimitriou,R.Sami,andS.Shenker,BGP-basedmechanismforlowest-costrouting,Proceedingsofthe2002ACMSymposiumonPrinciplesofDistributedComputing.,2002.[Online].Available:http://cs-www.cs.yale.edu/homes/jf/FPSS.pdf[24]T.RoughgardenandE.Tardos,Howbadisselshrouting?JournalofACM,vol.49,no.2,pp.236259,2002.[25]M.StemmandR.H.Katz,Verticalhandoffsinwirelessoverlaynetworks,MobileNetworksandApplications,vol.3,no.4,pp.335350,1998.[Online].Available:http://citeseer.nj.nec.com/stemm96vertical.html[26]L.ZhouandZ.J.Haas,Securingadhocnetworks,IEEENetworkMagazine,1999.[Online].Available:http://citeseer.nj.nec.com/cache/papers/cs/16984/http:zSzzSzwww.ee.corn%haaszSzPublicationszSznetwork99.pdf/zhou99securing.pdf[27]H.Luo,P.Zerfos,J.Kong,S.Lu,andL.Zhang,ad-hocwirelessnetworks,,2002.[Online].Available:http://www.cs.ucla.edu/jkong/publications/ISCC02.pdf[28]D.B.JohnsonandD.A.Malt,MobileComputing.KluwerAcademicPublishers,1996,ch.DynamicSourceRoutinginAdHocWirelessNetworks,Chapter5,(TomaszImielinskiandHankKorth,eds.).[Online].Available:http://www.monarch.cs.cmu.edu/monarch-papers/kluwer-adhoc.ps[29]B.Dahill,B.N.Levine,E.Royer,andC.Shields,Asecureroutingprotocolforadhocnetworks,UMass,Tech.Rep.,2001.[Online].Available:ftp://ftp.cs.umass.edu/pub/techrept/techreport/2001/UM-CS-2001-037.ps[30]Y.-C.Hu,A.Perrig,andD.B.Johnson,Ariadne:Asecureon-demandroutingprotocolforadhocnetworks,DepartmentofComputerScience,RiceUniversity,Tech.Rep.TR01-384,December2001.[Online].Available:http://www.monarch.cs.rice.edu/monarch-papers/ariadne.ps[31]S.Savage,N.Cardwell,D.Wetherall,andT.Anderson,congestioncontrolwithamisbehavingreceiver,ACMComputerCommunicationReview,vol.29,no.5,Oct.1999.[Online].Available:http://citeseer.nj.nec.com/savage99tcp.html[32]R.L.Rivest,TheMD5MessageDigestAlgorithm,RFC1321,Apr.1992.[Online].Available:http://andrew2.andrew.cmu.edu/rfc/rfc1321.htm.cmu.edu/rfc/rfc1321.htmSecurehashstandard,FederalInformationProcessingStandardsPubli-cation180-1,1995.[34]W.Dai,Availableathttp://www.eskimo.com/wei-dai/cryptlib.html.[35]I.P.Group,IEEEP1363standard,Availableathttp://grouper.ieee.org/groups/1363/index.html.IX.AA.ProofofTheorem1Proof:Considerastrategyproleofalloftherestplayers,inwhicheachplayer,),tellsthetruthwith.Wedistinguishfourcaseshere.CaseA..Since istheonlypossiblestrategy,itisalsothebestresponse.CaseB..Recallthatistheindexofthelastnodethathaseverreceivedthemessage.Iftellsthetruth,itsexpectedwelfare+(1cheats,itsexpectedwelfare+(1Therefore,wealwayshave,whichimpliesthattellingthetruthwithprobabilitywillbringthemaximumexpectedwelfaretoCaseC..Iftellsthetruth,itsexpectedwelfarecheats,itsexpectedwelfareAsinthepreviouscase,wealwayshavewhichimpliesthattellingthetruthwithprobabilitybringthemaximumexpectedwelfaretoCaseD..Notethat#$%\f here,whichimpliesthatalwaystellsthetruthincaseof.Soweonlyneedtoconsiderthecaseof.Ifthetruth,theexpectedwelfareis=(1! cheats,itgetsanexpectedpaymentof=(1whileitsgetsacostofSoitsexpectedwelfareis=(1AsinCasesBandC,wealwayshavewhichimpliesthattellingthetruthwithprobabilitybringthemaximumexpectedwelfareto B.ProofofTheorem2Proof:Considerstrategizinggroupthatusesastrategyleotherthaneverybodytellingthetruth.Foranysetof,denotebytheprobabilitythatisthesetofnodesinthatlie.Theexpectedsumofwelfareofdenotesthesumofwelfareofincasethatthesetoflyingplayersis.OurgoalistoshowObviously,weonlyneedtoprove,'Wedistinguishtwocaseshere.(Hereafter,weuse/CaseA..Byconsideringtheindicesofplayers,wefurtherdistinguishthreesub-cases.Sub-caseA-A..ThentriviallywehaveSub-caseA-B.,and.Thenisequalto=max.Therefore,Sub-caseA-C..Then=max.ItseasytoseeCaseB..AsinCaseA,wefurtherdistinguishthreesub-cases.Sub-caseB-A..Trivially,wehaveSub-caseB-B.,and.Thenisequalto=max.Since


,itiseasytoseeSub-caseB-C..Then=max.Itseasytosee