![Page 1: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/1.jpg)
Pervasive devices are powerful but fragile
Rachid GuerraouiEPFL
![Page 2: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/2.jpg)
A world of tiny mobile devices
![Page 3: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/3.jpg)
What computing model?
![Page 4: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/4.jpg)
(1) Mobility
This talk
(2) Crashes
(3) Privacy
(4) Security
![Page 5: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/5.jpg)
From population protocols to community protocols
![Page 6: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/6.jpg)
(1) Mobility
This talk
(2) Crashes
(3) Privacy
(4) Security
![Page 7: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/7.jpg)
The march of the penguins
![Page 8: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/8.jpg)
![Page 9: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/9.jpg)
The group is threatened if more than a threshold dies on the way back to the sea
If a penguin starts its trip with a very low temperature, the probability that it reaches the sea is very low
The march of the penguins
![Page 10: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/10.jpg)
The escort
Provide each penguin with a computing device to: measure its temperature; trigger an alert if a threshold (say 5) has a very low temperature
![Page 11: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/11.jpg)
Assumptions
Every device holds a finite counter (<6)Its initial value is 1 if the penguin has a low temperature and 0 otherwise
A pair of devices communicate if they get close enough to each otherEvery pair of devices eventually meet
![Page 12: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/12.jpg)
![Page 13: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/13.jpg)
Computation
All devices eventually output “alert” iff at least 5 initial values are 1
![Page 14: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/14.jpg)
Algorithm ?
0 110 1 10 01
0 120 2 20 02
0 300 2 30 02
0 000 5 0 00 5
![Page 15: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/15.jpg)
Algorithm?
0 110 0 10 00
0 120 0 20 00
0 320 0 30 00
0 350 5 50 000
![Page 16: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/16.jpg)
Algorithm
When two devices meet, one keeps in its counter the sum of the values whereas the other puts it back to 0
The first device which has value 5 triggers the alert
![Page 17: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/17.jpg)
Algorithm
0 110 1 10 01
0 100 1 20 01
0 000 2 30 00
0 000 5 00 00
![Page 18: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/18.jpg)
Algorithm
0 110 0 10 00
0 100 0 20 00
0 000 0 30 00
0 050 0 30 000
![Page 19: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/19.jpg)
Population protocols (DF01,AADFP’04)
Every agent has a bounded memory independent of the size of the system
Algorithms are uniform and anonymous
![Page 20: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/20.jpg)
Population protocols
The agents are asynchronous and have no control over their mobility pattern
A pair of agents communicate if they get close to each other (one is the initiator)
Every interaction that is always possible eventually happens (fairness)
![Page 21: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/21.jpg)
Population protocol
Input; Output; StateInMap; OutMapTransitions
![Page 22: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/22.jpg)
Example (“or”)
Any agent with “0” that meets an agent with “1” turns to “1”
Input = Output = State = {0,1}InMap = OutMap = identity
![Page 23: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/23.jpg)
Example (“>”)
Determining if there are strictly more girls than boys in a party
When a boy meets a girl they “cancel” each otherIf more girls remain, then output “yes”; else ouput “no”
![Page 24: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/24.jpg)
Example (“>”)
Input = {g,b}; Output = {yes,no}State = {g,b,yes,no}Transitions(g,b) -> (no,no)(g,no) -> (g,yes)(b,yes) -> (b,no)(yes,no) -> (no,no)
![Page 25: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/25.jpg)
Execution
b g g
no no g
no yes g
no no g
![Page 26: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/26.jpg)
Execution
no no g
yes no g
no no g
no yes g
![Page 27: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/27.jpg)
no yes g
yes yes g
no no g
no yes g
no no g
![Page 28: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/28.jpg)
Addition
Determining if the numbers of C’s is the sum of the number of A’s and the number of B’s
When a A meets a B, it cancels the B and raises a flag; when it later meets a C, it cancels itself and the C
![Page 29: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/29.jpg)
Multiplication
Determining if the numbers of C’s is the product of the number of A’s and the number of B’s
Whenever a A sees a new B, it cancels a C: problem - what is a new B?
![Page 30: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/30.jpg)
More generally (AAD06)
Theorem: population protocols compute exactly first order Presburger’s arithmetic: +, -, =, >, or, not, and, …
NB. Not as powerful as Peano’s arithmetic which also include *
![Page 31: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/31.jpg)
(1) Mobility
This talk
(2) Crashes
(3) Privacy
(4) Security
![Page 32: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/32.jpg)
But what if?
One of the agents fail (say by crashing at some inappropriate time)An agent might crash exactly when it reaches the value 4
![Page 33: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/33.jpg)
Original algorithm O
0 110 1 10 01
0 100 1 20 01
0 000 2 30 00
0 000 5 00 00
![Page 34: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/34.jpg)
Reliable algorithm
Every agent performs twice the original algorithm: O1 and O2
When two agent communicate, one acts as the initiator for O1 and the other as the initiator for O2
![Page 35: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/35.jpg)
Reliable algorithm0 110 1 10 01
0 10/20 1 2/00 01
0 0/1 0/20 2/0 3/00 00/2
0 0/00 5/0 0/00 00/2 0/3
0 0/00 5/0 0/00 00 0/5
![Page 36: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/36.jpg)
More generally (DFGR06)
Theorem: population protocols compute exactly Presburger’s arithmetic with a constant number of crashes
NB. The notion of “computation” is slightly revised
![Page 37: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/37.jpg)
(1) Mobility
This talk
(2) Crashes
(3) Privacy
(4) Security
![Page 38: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/38.jpg)
What about privacy?
How can we hide the initial values from curious agents?
How can we compute a result while preventing any agent from figuring out, at any point in time, any information besides its own input and the result of the computation?
![Page 39: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/39.jpg)
What about privacy?
How can we make it impossible for a curious agent to distinguish the situation where exactly 5 penguins have low temperature from the situation where strictly more do?
![Page 40: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/40.jpg)
Original algorithm
0 111 1 11 01
![Page 41: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/41.jpg)
How to ensure privacy?
An agent cannot use crypto (not even signatures because of anonymity)
An agent can see the entire state of the agent it is interacting with: hence no secret keys are possible
![Page 42: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/42.jpg)
Obfuscation
0 110 1 10 01
1
-1
1
1
-1
1
-1
![Page 43: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/43.jpg)
Obfuscation flag (transitions)
(*,1),(*,*) -> (*,0),(*,*)(*,0),(*,1) -> (*,1),(*,1)
![Page 44: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/44.jpg)
More generally (DFGR07)
Theorem: population protocols can privately compute exactly first order Presburger’s arithmetic
![Page 45: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/45.jpg)
(1) Mobility
This talk
(2) Crashes
(3) Privacy
(4) Security
![Page 46: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/46.jpg)
What if agents can be malicious?
What can we compute with one malicious agent? (arbitrary transitions)
![Page 47: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/47.jpg)
Malicious agent
0 000 0 X0 00
![Page 48: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/48.jpg)
More generally (GR07)
Theorem: population protocols cannot compute any non-trivial predicate with a single malicious agent
NB. A predicate is trivial if every agent can determine its output based only on its input
![Page 49: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/49.jpg)
Limitations of population protocols
(1) Only Presburger’s arithmetics
(2) No way to tolerate malicious agents
NB. These impossibilities are related to anonymity of the model
![Page 50: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/50.jpg)
Identities?
In practice, few bits are enough to store a very large number of identifiers
God formed…every fowl of the air; and brought them unto Adam to see what he would call them: and whatsoever Adam called every living creature, that was the name thereof (Genesis 2:19)
![Page 51: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/51.jpg)
Identities?
Population protocol + one identity per agent Identities are useless if agents are amnesic
![Page 52: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/52.jpg)
Identities?Population protocol + identities + operations
Identities can be used to encode any other value: we are back to a distributed system model of servers
![Page 53: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/53.jpg)
Community protocols (GR07)
Every agent has: A bounded memory where it can execute arithmetics (as in the original population model) + A bounded set of slots to store identities and test (only) for their equality
![Page 54: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/54.jpg)
Community protocols (GR07)
Theorem: community protocols can exactly compute every symmetric predicate that can be (Turing) computed in n log n space
![Page 55: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/55.jpg)
Community protocols (GR07)
The proof is by reduction to Schonhage’s pointer machine: a sequential machine that runs a program using a directed graph structure as its memory
With a community protocol, we represent each node by an agent - The technical difficulty is to have the agents simulate a sequential machine
![Page 56: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/56.jpg)
Community protocols (GR07)
Peter Boas 1989: a pointer machine with O(n) nodes can simulate a Turing machine with O(n log(n)) space
![Page 57: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/57.jpg)
Community protocols (GR07)
The Theorem extends to a constant number of crash failures (using condition-based approach and a technique from DFGR06) as well as malicious agents
NB. We assume identifiers cannot be forged (otherwise we are back essentially to population protocols)
![Page 58: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/58.jpg)
From population protocols to community protocols
The one slide to remember
![Page 59: Pervasive devices are powerful but fragile Rachid Guerraoui EPFL](https://reader030.vdocuments.us/reader030/viewer/2022032703/56649d2b5503460f94a00c25/html5/thumbnails/59.jpg)
Thank you for your attention