Search

Confidential computing alleviates the concerns of distrustful customers by removing the cloud provider from their trusted computing base and resolves their disincentive to migrate their workloads to the cloud. This is facilitated by new hardware extensions, like AMD's SEV Secure Nested Paging (SEV-SNP), which can run a whole virtual machine with confidentiality and integrity protection against a potentially malicious hypervisor owned by an untrusted cloud provider. However, the assurance of such protection to either the service providers deploying sensitive workloads or the end-users passing sensitive data to services requires sending proof to the interested parties. Service providers can retrieve such proof by performing remote attestation while end-users have typically no means to acquire this proof or validate its correctness and therefore have to rely on the trustworthiness of the service providers. In this paper, we present Revelio, an approach that features two main contributions: i) it allows confidential virtual machine (VM)-based workloads to be designed and deployed in a way that disallows any tampering even by the service providers and ii) it empowers users to easily validate their integrity. In particular, we focus on web-facing workloads, protect them leveraging SEV-SNP, and enable end-users to remotely attest them seamlessly each time a new web session is established. To highlight the benefits of Revelio, we discuss how a standalone stateful VM that hosts an open-source collaboration office suite can be secured and present a replicated protocol proxy that enables commodity users to securely access the Internet Computer, a decentralized blockchain infrastructure.

A typical blockchain protocol uses consensus to make sure that mutually mistrusting users agree on the order in which their operations on shared data are executed. However, it is known that asset transfer systems, by far the most popular application of blockchains, can be implemented without consensus. Assuming that no account can be accessed concurrently and every account belongs to a single owner, one can efficiently implement an asset transfer system in a purely asynchronous, consensus-free manner. It has also been shown that implementing asset transfer with shared accounts is impossible without consensus. In this paper, we propose CryptoConcurrency, an asset transfer protocol that allows concurrent accesses to be processed in parallel, without involving consensus, whenever possible. More precisely, if concurrent transfer operations on a given account do not lead to overspending, i.e. can all be applied without the account balance going below zero, they proceed in parallel. Otherwise, the account's owners may have to access an external consensus object. Notably, we avoid relying on a central, universally-trusted, consensus mechanism and allow each account to use its own consensus implementation, which only the owners of this account trust. This provides greater decentralization and flexibility.

In this paper, a network comprising wireless devices equipped with buffers transmitting deadline-constrained data packets over a slotted-ALOHA random-access channel is studied. Although communication protocols facilitating retransmissions increase reliability, packet transmission from the queue experiences delays and thus, packets with time constraints might be dropped before being successfully transmitted, while at the same time causing the queue size of the buffer to increase. Towards understanding the trade-off between reliability and delays that might lead to packet drops due to the deadline-constrained bursty traffic with retransmissions, a scenario of a wireless network utilizing a slotted-ALOHA random-access channel is investigated. The main focus is to reveal and investigate further the trade-off between the number of retransmissions and the packet deadline as a function of the arrival rate. Hence, we are able to determine numerically the optimal probability of transmissions and number of retransmissions, given the packet arrival rate and the packet deadline. The analysis of the system was done by means of discrete-time Markov chains. Two scenarios are studied: i) the collision channel model (in which a receiver can decode only when a single packet is transmitted), and ii) the case for which receivers have multi-packet reception capabilities. A performance evaluation for a user with different transmit probability and number of retransmissions is conducted, demonstrating their impact on the average drop rate and throughput, while at the same time showing that there exists a set of values, under which improved performance can be acquired.

When spreading information over social networks, seeding algorithms selecting users to start the dissemination play a crucial role. The majority of existing seeding algorithms focus solely on maximizing the total number of reached nodes, overlooking the issue of group fairness, in particular, gender imbalance. To tackle the challenge of maximizing information spread on certain target groups, e.g., females, we introduce the concept of the community and gender-aware potential of users. We first show that the network's community structure is closely related to the gender distribution. Then, we propose an algorithm that leverages the information about community structure and its gender potential to iteratively modify a seed set such that the information spread on the target group meets the target ratio. Finally, we validate the algorithm by performing experiments on synthetic and real-world datasets. Our results show that the proposed seeding algorithm achieves not only the target ratio but also the highest information spread, compared to the state-of-the-art gender-aware seeding algorithm.

Modern communication networks feature fully decentralized flow rerouting mechanisms which allow them to quickly react to link failures. This paper revisits the fundamental algorithmic problem underlying such local fast rerouting mechanisms. Is it possible to achieve perfect resilience, i.e., to define local routing tables which preserve connectivity as long as the underlying network is still connected? Feigenbaum et al. (ACM PODC'12) and Foerster et al. (SIAM APOCS'21) showed that, unfortunately, it is impossible in general. This paper charts a more complete landscape of the feasibility of perfect resilience. We first show a perhaps surprisingly large price of locality in static fast rerouting mechanisms: even when source and destination remain connected by a linear number of link-disjoint paths after link failures, local rerouting algorithms cannot find any of them which leads to a disconnection on the routing level. This motivates us to study resilience in graphs which exclude certain dense minors, such as cliques or a complete bipartite graphs, and in particular, provide characterizations of the possibility of perfect resilience in different routing models. We provide further insights into the price of locality by showing impossibility results for few failures and investigate perfect resilience on Topology Zoo networks., Comment: Accepted and to appear at the 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'22)

Most modern asset transfer systems use consensus to maintain a totally ordered chain of transactions. It was recently shown that consensus is not always necessary for implementing asset transfer. More efficient, asynchronous solutions can be built using reliable broadcast instead of consensus. This approach has been originally used in the closed (permissioned) setting. In this paper, we extend it to the open (permissionless) environment. We present Pastro, a permissionless and asynchronous asset-transfer implementation, in which quorum systems, traditionally used in reliable broadcast, are replaced with a weighted Proof-of-Stake mechanism. Pastro tolerates a dynamic adversary that is able to adaptively corrupt participants based on the assets owned by them.

Online social networks have become a crucial medium to disseminate the latest political, commercial, and social information. Users with high visibility are often selected as seeds to spread information and affect their adoption in target groups. We study how gender differences and similarities can impact the information spreading process. Using a large-scale Instagram dataset and a small-scale Facebook dataset, we first conduct a multi-faceted analysis taking the interaction type, directionality and frequency into account. To this end, we explore a variety of existing and new single and multihop centrality measures. Our analysis unveils that males and females interact differently depending on the interaction types, e.g., likes or comments, and they feature different support and promotion patterns. We complement prior work showing that females do not reach top visibility (often referred to as the glass ceiling effect) jointly factoring in the connectivity and interaction intensity, both of which were previously mainly discussed independently. Inspired by these observations, we propose a novel seeding framework, called Disparity Seeding, which aims at maximizing spread while reaching a target user group, e.g., a certain percentage of females -- promoting the influence of under-represented groups. Disparity Seeding ranks influential users with two gender-aware measures, the Target HI-index and the Embedding index. Extensive simulations comparing Disparity Seeding with target-agnostic algorithms show that Disparity Seeding meets the target percentage while effectively maximizing the spread. Disparity Seeding can be generalized to counter different types of inequality, e.g., race, and proactively promote minorities in the society.

Cryptocurrencies such as Bitcoin are realized using distributed systems and hence critically rely on the performance and security of the interconnecting network. The requirements on these networks and their usage, however can differ significantly from traditional communication networks, with implications on all layers of the protocol stack. This paper is motivated by these differences, and in particular by the observation that many fundamental design aspects of these networks are not well-understood today. In order to support the networking community to contribute to this emerging application domain, we present a structured overview of the field, from topology and neighbor discovery to block and transaction propagation. In particular, we provide the context, highlighting differences and commonalities with traditional networks, review the state-of-the-art, and identify open research challenges. Our paper can hence also be seen as a call-to-arms to improve the foundation on top of which cryptocurrencies are built.

In order to provide a high resilience and to react quickly to link failures, modern computer networks support fully decentralized flow rerouting, also known as local fast failover. In a nutshell, the task of a local fast failover algorithm is to pre-define fast failover rules for each node using locally available information only. These rules determine for each incoming link from which a packet may arrive and the set of local link failures (i.e., the failed links incident to a node), on which outgoing link a packet should be forwarded. Ideally, such a local fast failover algorithm provides a perfect resilience deterministically: a packet emitted from any source can reach any target, as long as the underlying network remains connected. Feigenbaum et al. (ACM PODC 2012) and also Chiesa et al. (IEEE/ACM Trans. Netw. 2017) showed that it is not always possible to provide perfect resilience. Interestingly, not much more is known currently about the feasibility of perfect resilience. This paper revisits perfect resilience with local fast failover, both in a model where the source can and cannot be used for forwarding decisions. We first derive several fairly general impossibility results: By establishing a connection between graph minors and resilience, we prove that it is impossible to achieve perfect resilience on any non-planar graph; furthermore, while planarity is necessary, it is also not sufficient for perfect resilience. On the positive side, we show that graph families closed under link subdivision allow for simple and efficient failover algorithms which simply skip failed links. We demonstrate this technique by deriving perfect resilience for outerplanar graphs and related scenarios, as well as for scenarios where the source and target are topologically close after failures., Comment: To appear in the proceedings of the 2nd Symposium on Algorithmic Principles of Computer Systems (APOCS) 2021

We address the problem of online payments, where users can transfer funds among themselves. We introduce Astro, a system solving this problem efficiently in a decentralized, deterministic, and completely asynchronous manner. Astro builds on the insight that consensus is unnecessary to prevent double-spending. Instead of consensus, Astro relies on a weaker primitive---Byzantine reliable broadcast---enabling a simpler and more efficient implementation than consensus-based payment systems. In terms of efficiency, Astro executes a payment by merely broadcasting a message. The distinguishing feature of Astro is that it can maintain performance robustly, i.e., remain unaffected by a fraction of replicas being compromised or slowed down by an adversary. Our experiments on a public cloud network show that Astro can achieve near-linear scalability in a sharded setup, going from $10K$ payments/sec (2 shards) to $20K$ payments/sec (4 shards). In a nutshell, Astro can match VISA-level average payment throughput, and achieves a $5\times$ improvement over a state-of-the-art consensus-based solution, while exhibiting sub-second $95^{th}$ percentile latency., Comment: This is an extended version of a conference article, appearing in the proceedings of the 50th IEEE/IFIP Int. Conference on Dependable Systems and Networks (DSN 2020). This work has been supported in part by the European grant 862082, AT2 -- ERC-2019-PoC, and in part by a grant from Interchain Foundation

Reliable broadcast is a communication primitive guaranteeing, intuitively, that all processes in a distributed system deliver the same set of messages. The reason why this primitive is appealing is twofold: (i) we can implement it deterministically in a completely asynchronous environment, unlike stronger primitives like consensus and total-order broadcast, and yet (ii) reliable broadcast is powerful enough to implement important applications like payment systems. The problem we tackle in this paper is that of dynamic reliable broadcast, i.e., enabling processes to join or leave the system. This property is desirable for long-lived applications (aiming to be highly available), yet has been precluded in previous asynchronous reliable broadcast protocols. We study this property in a general adversarial (i.e., Byzantine) environment. We introduce the first specification of a dynamic Byzantine reliable broadcast (DBRB) primitive that is amenable to an asynchronous implementation. We then present an algorithm implementing this specification in an asynchronous network. Our DBRB algorithm ensures that if any correct process in the system broadcasts a message, then every correct process delivers that message unless it leaves the system. Moreover, if a correct process delivers a message, then every correct process that has not expressed its will to leave the system delivers that message. We assume that more than $2/3$ of processes in the system are correct at all times, which is tight in our context. We also show that if only one process in the system can fail---and it can fail only by crashing---then it is impossible to implement a stronger primitive, ensuring that if any correct process in the system broadcasts or delivers a message, then every correct process in the system delivers that message---including those that leave., Comment: This is an extended version of a conference article, appearingin the proceedings of the 24th Int. Conference on Principles of Distributed Systems (OPODIS 2020). This work has been supported in part by a grant from Interchain Foundation

Distributed agreement-based algorithms are often specified in a crash-stop asynchronous model augmented by Chandra and Toueg's unreliable failure detectors. In such models, correct nodes stay up forever, incorrect nodes eventually crash and remain down forever, and failure detectors behave correctly forever eventually, However, in reality, nodes as well as communication links both crash and recover without deterministic guarantees to remain in some state forever. In this paper, we capture this realistic temporary and probabilitic behaviour in a simple new system model. Moreover, we identify a large algorithm class for which we devis a property-preserving transformation. Using this transformation, many algorithms written for the asynchronous crash-stop model run correctly and unchanged in real systems., Comment: Published at OPODIS 2018

The functionality that distributed ledger technology provides, i.e., an immutable and fraud-resistant registry with validation and verification mechanisms, has traditionally been implemented with a trusted third party. Due to the distributed nature of ledger technology, there is a strong recent trend towards using ledgers to implement novel decentralized applications for a wide range of use cases, e.g., in the financial sector and sharing economy. While there can be several arguments for the use of a ledger, the key question is whether it can fully replace any single trusted party in the system as otherwise a (potentially simpler) solution can be built around the trusted party. In this paper, we introduce an abstract view on ledger use cases and present two fundamental criteria that must be met for any use case to be implemented using a ledger-based approach without having to rely on any particular party in the system. Moreover, we evaluate several ledger use cases that have recently received considerable attention according to these criteria, revealing that often participants need to trust each other despite using a distributed ledger. Consequently, the potential of using a ledger as a replacement for a trusted party is limited for these use cases., Comment: Published at IEEE Blockchain 2018

Currently, engineers at substation service providers match customer data with the corresponding internally used signal names manually. This paper proposes a machine learning method to automate this process based on substation signal mapping data from a repository of executed projects. To this end, a bagged token classifier is proposed, letting words (tokens) in the customer signal name vote for provider signal names. In our evaluation, the proposed method exhibits better performance in terms of both accuracy and efficiency over standard classifiers., Comment: To be presented at the 31st International Conference on Industrial, Engineering & Other Applications of Applied Intelligent Systems (IEA/AIE) 2018

The topological structure of complex networks has fascinated researchers for several decades, resulting in the discovery of many universal properties and reoccurring characteristics of different kinds of networks. However, much less is known today about the network dynamics: indeed, complex networks in reality are not static, but rather dynamically evolve over time. Our paper is motivated by the empirical observation that network evolution patterns seem far from random, but exhibit structure. Moreover, the specific patterns appear to depend on the network type, contradicting the existence of a "one fits it all" model. However, we still lack observables to quantify these intuitions, as well as metrics to compare graph evolutions. Such observables and metrics are needed for extrapolating or predicting evolutions, as well as for interpolating graph evolutions. To explore the many faces of graph dynamics and to quantify temporal changes, this paper suggests to build upon the concept of centrality, a measure of node importance in a network. In particular, we introduce the notion of centrality distance, a natural similarity measure for two graphs which depends on a given centrality, characterizing the graph type. Intuitively, centrality distances reflect the extent to which (non-anonymous) node roles are different or, in case of dynamic graphs, have changed over time, between two graphs. We evaluate the centrality distance approach for five evolutionary models and seven real-world social and physical networks. Our results empirically show the usefulness of centrality distances for characterizing graph dynamics compared to a null-model of random evolution, and highlight the differences between the considered scenarios. Interestingly, our approach allows us to compare the dynamics of very different networks, in terms of scale and evolution speed., Comment: This paper is withdrawn because it should have replaced 1506.01565 instead of creating a duplicate. This version will now appear as a new version of 1506.01565

In this paper, we present an acoustic localization system for multiple devices. In contrast to systems which localise a device relative to one or several anchor points, we focus on the joint localisation of several devices relative to each other. We present a prototype of our system on off-the-shelf smartphones. No user interaction is required, the phones emit acoustic pulses according to a precomputed schedule. Using the elapsed time between two times of arrivals (ETOA) method with sample counting, distances between the devices are estimated. These, possibly incomplete, distances are the input to an efficient and robust multi-dimensional scaling algorithm returning a position for each phone. We evaluated our system in real-world scenarios, achieving error margins of 15 cm in an office environment.

The topological structure of complex networks has fascinated researchers for several decades, resulting in the discovery of many universal properties and reoccurring characteristics of different kinds of networks. However, much less is known today about the network dynamics: indeed, complex networks in reality are not static, but rather dynamically evolve over time. Our paper is motivated by the empirical observation that network evolution patterns seem far from random, but exhibit structure. Moreover, the specific patterns appear to depend on the network type, contradicting the existence of a "one fits it all" model. However, we still lack observables to quantify these intuitions, as well as metrics to compare graph evolutions. Such observables and metrics are needed for extrapolating or predicting evolutions, as well as for interpolating graph evolutions. To explore the many faces of graph dynamics and to quantify temporal changes, this paper suggests to build upon the concept of centrality, a measure of node importance in a network. In particular, we introduce the notion of centrality distance, a natural similarity measure for two graphs which depends on a given centrality, characterizing the graph type. Intuitively, centrality distances reflect the extent to which (non-anonymous) node roles are different or, in case of dynamic graphs, have changed over time, between two graphs. We evaluate the centrality distance approach for five evolutionary models and seven real-world social and physical networks. Our results empirically show the usefulness of centrality distances for characterizing graph dynamics compared to a null-model of random evolution, and highlight the differences between the considered scenarios. Interestingly, our approach allows us to compare the dynamics of very different networks, in terms of scale and evolution speed., Comment: 18 pages, 8 figures

Recent evidence shows that in many societies worldwide the relative sizes of the economic and social elites are continuously shrinking. Is this a natural social phenomenon? What are the forces that shape this process? We try to address these questions by studying a Core-Periphery social structure composed of a social elite, namely, a relatively small but well-connected and highly influential group of powerful individuals, and the rest of society, the periphery. Herein, we present a novel axiom-based model for the forces governing the mutual influences between the elite and the periphery. Assuming a simple set of axioms, capturing the elite's dominance, robustness, compactness and density, we are able to draw strong conclusions about the elite-periphery structure. In particular, we show that a balance of powers between elite and periphery and an elite size that is sub-linear in the network size are universal properties of elites in social networks that satisfy our axioms. We note that the latter is in controversy to the common belief that the elite size converges to a linear fraction of society (most recently claimed to be 1%). We accompany these findings with a large scale empirical study on about 100 real-world networks, which supports our results.

The network virtualization paradigm envisions an Internet where arbitrary virtual networks (VNets) can be specified and embedded over a shared substrate (e.g., the physical infrastructure). As VNets can be requested at short notice and for a desired time period only, the paradigm enables a flexible service deployment and an efficient resource utilization. This paper investigates the security implications of such an architecture. We consider a simple model where an attacker seeks to extract secret information about the substrate topology, by issuing repeated VNet embedding requests. We present a general framework that exploits basic properties of the VNet embedding relation to infer the entire topology. Our framework is based on a graph motif dictionary applicable for various graph classes. Moreover, we provide upper bounds on the request complexity, the number of requests needed by the attacker to succeed., Comment: full version of paper at NETYS 2013

Many communication networks consist of legacy and new devices using heterogeneous technologies, such as copper wire, optical fiber, wireless and power line communication (PLC). Most network simulators, however, have been designed to work well with a single underlying link layer technology. Furthermore, there are hardly any suitable models for network simulators of PLC. In this paper we present extensions of the Contiki OS network simulator Cooja: A device may support multiple interfaces accessing multiple PLC segments or wireless channels and a simple PLC medium model is introduced describing packet loss probability as a function of distance. We test our approach to simulate a Smart Grid scenario of Ring Main Units equipped with PLC devices., Comment: A preliminary version of this article appeared at WSPLC, Rome, Italy, September 20-21, September 20-21 [6]

In many societies there is an elite, a relatively small group of powerful individuals that is well-connected and highly influential. Since the ancient days of Julius Caesar's senate of Rome to the recent days of celebrities on Twitter, the size of the elite is a result of conflicting social forces competing to increase or decrease it. The main contribution of this paper is the answer to the question how large the elite is at equilibrium. We take an axiomatic approach to solve this: assuming that an elite exists and it is influential, stable and either minimal or dense, we prove that its size must be $\Theta(\sqrt{m})$ (where $m$ is the number of edges in the network). As an approximation for the elite, we then present an empirical study on nine large real-world networks of the subgraph formed by the highest degree nodes, also known as the rich-club. Our findings indicate that elite properties such as disproportionate influence, stability and density of $\Theta(\sqrt{m})$-rich-clubs are universal properties and should join a growing list of common phenomena shared by social networks and complex systems such as "small world," power law degree distributions, high clustering, etc., Comment: under submission

Traceroute measurements are one of our main instruments to shed light onto the structure and properties of today's complex networks such as the Internet. This paper studies the feasibility and infeasibility of inferring the network topology given traceroute data from a worst-case perspective, i.e., without any probabilistic assumptions on, e.g., the nodes' degree distribution. We attend to a scenario where some of the routers are anonymous, and propose two fundamental axioms that model two basic assumptions on the traceroute data: (1) each trace corresponds to a real path in the network, and (2) the routing paths are at most a factor 1/alpha off the shortest paths, for some parameter alpha in (0,1]. In contrast to existing literature that focuses on the cardinality of the set of (often only minimal) inferrable topologies, we argue that a large number of possible topologies alone is often unproblematic, as long as the networks have a similar structure. We hence seek to characterize the set of topologies inferred with our axioms. We introduce the notion of star graphs whose colorings capture the differences among inferred topologies; it also allows us to construct inferred topologies explicitly. We find that in general, inferrable topologies can differ significantly in many important aspects, such as the nodes' distances or the number of triangles. These negative results are complemented by a discussion of a scenario where the trace set is best possible, i.e., "complete". It turns out that while some properties such as the node degrees are still hard to measure, a complete trace set can help to determine global properties such as the connectivity.

This article investigates selfish behavior in games where players are embedded in a social context. A framework is presented which allows us to measure the Windfall of Friendship, i.e., how much players benefit (compared to purely selfish environments) if they care about the welfare of their friends in the social network graph. As a case study, a virus inoculation game is examined. We analyze the corresponding Nash equilibria and show that the Windfall of Friendship can never be negative. However, we find that if the valuation of a friend is independent of the total number of friends, the social welfare may not increase monotonically with the extent to which players care for each other; intriguingly, in the corresponding scenario where the relative importance of a friend declines, the Windfall is monotonic again. This article also studies convergence of best-response sequences. It turns out that in social networks, convergence times are typically higher and hence constitute a price of friendship. While such phenomena may be known on an anecdotal level, our framework allows us to quantify these effects analytically. Our formal insights on the worst case equilibria are complemented by simulations shedding light onto the structure of other equilibria., Comment: Preliminary version appeared at ACM EC conference

In this paper we study the connectivity problem for wireless networks under the Signal to Interference plus Noise Ratio (SINR) model. Given a set of radio transmitters distributed in some area, we seek to build a directed strongly connected communication graph, and compute an edge coloring of this graph such that the transmitter-receiver pairs in each color class can communicate simultaneously. Depending on the interference model, more or less colors, corresponding to the number of frequencies or time slots, are necessary. We consider the SINR model that compares the received power of a signal at a receiver to the sum of the strength of other signals plus ambient noise . The strength of a signal is assumed to fade polynomially with the distance from the sender, depending on the so-called path-loss exponent $\alpha$. We show that, when all transmitters use the same power, the number of colors needed is constant in one-dimensional grids if $\alpha>1$ as well as in two-dimensional grids if $\alpha>2$. For smaller path-loss exponents and two-dimensional grids we prove upper and lower bounds in the order of $\mathcal{O}(\log n)$ and $\Omega(\log n/\log\log n)$ for $\alpha=2$ and $\Theta(n^{2/\alpha-1})$ for $\alpha<2$ respectively. If nodes are distributed uniformly at random on the interval $[0,1]$, a \emph{regular} coloring of $\mathcal{O}(\log n)$ colors guarantees connectivity, while $\Omega(\log \log n)$ colors are required for any coloring., Comment: 13 pages