Voter

1
Enforcing Honesty Among Adversarial Voters In
Peer-to-Peer Systems
Prashanth Bungale Geoffrey Goodell
Mema Roussopoulos
Harvard University

• Voter
• If (not busy) AND (document and stored hash
  match)
• Supply vote
• If (mismatch)
• Schedule poll in the immediate future (if not
  already scheduled) and ignore invitation
• Else (i.e., Busy)
• Ignore invitation
• Adversary Strategy Analysis
• When can an Adversary Attack Successfully?
  Only when the adversary
• Has somehow achieved close to 100 foothold in
  the victims reference list
• More importantly, is able to sustain that
  foothold for a sufficient number of consecutive
  polls,

• Problem Description
• Problem Domain a peer-to-peer system, where
  each peer is
• Distrustful of other peers
• Self-sufficient almost always in terms of
  carrying out its task
• Dependent on other peers help, through a
  polling process, only during its time-of-need,
  which occurs rarely.
• Specifically, the polling process (while in time
  of need) involves
• Sampling the population of peers to get
  consensus on something (the content of a
  file, the result of a particular computation,
  etc.)
• Using the consensus to carry out its task
  successfully
• Assumptions
• A peer has some mechanism in place to be able to
  tell whether it is in self-sufficiency state
  or in its time of need.

Figure 4 Revised LOCKSS The time from the start
of the attack phase (in the stealth strategy) to
the time of detection, for different starting
reference list foothold ratios. Note that no
alarm was ever raised, corroborating that the
system not only operates correctly, but also
operates in an uninterrupted manner throughout
the simulation period, without any necessity for
operator intervention, in spite of such excessive
adversarial efforts.
Figure 3 (Reproduced from SOSP-LOCKSS)
SOSP-LOCKSS The time from the start of the
attack phase (in the stealth strategy) to the
time of detection, for different starting
reference list foothold ratios. Ticks split the
value distributions into quartiles. Percentages
above the distributions indicate runs that did
not generate an alarm.