Asymmetric Distributed Trust

TL;DR

This paper introduces asymmetric Byzantine quorum systems that allow processes to have subjective trust, generalizing standard models and enabling new protocols for shared memory, broadcast, and consensus in Byzantine environments.

Contribution

It presents the concept of asymmetric trust in quorum systems and develops protocols that support this model, expanding the capabilities of fault-tolerant distributed computing.

Findings

Asymmetric quorum systems model subjective trust among processes.

Protocols for shared memory, broadcast, and consensus are developed under asymmetric trust.

The model enables more flexible and realistic trust assumptions in distributed systems.

Abstract

Quorum systems are a key abstraction in distributed fault-tolerant computing for capturing trust assumptions. They can be found at the core of many algorithms for implementing reliable broadcasts, shared memory, consensus and other problems. This paper introduces asymmetric Byzantine quorum systems that model subjective trust. Every process is free to choose which combinations of other processes it trusts and which ones it considers faulty. Asymmetric quorum systems strictly generalize standard Byzantine quorum systems, which have only one global trust assumption for all processes. This work also presents protocols that implement abstractions of shared memory, broadcast primitives, and a consensus protocol among processes prone to Byzantine faults and asymmetric trust. The model and protocols pave the way for realizing more elaborate algorithms with asymmetric trust.

Equations

$$\forall Q_1,Q_2\in \mathcal{Q},\forall F\in \mathcal{F}:Q_1\cap Q_2⊈F.$$

$$\forall F\in \mathcal{F}:\exists Q\in \mathcal{Q}:F\cap Q=\varnothing .$$

$$\forall F_1,F_2,F_3\in \mathcal{F}:\mathcal{P}⊈F_1\cup F_2\cup F_3.$$

$$\forall i,j\in [1,n],\forall Q_i\in {\mathcal{Q}}_i,\forall Q_j\in {\mathcal{Q}}_j,\forall F_{ij}\in {{\mathcal{F}}_i}^{\ast }\cap {{\mathcal{F}}_j}^{\ast }:Q_i\cap Q_j⊈F_{ij}.$$

$$\forall i\in [1,n],\forall F_i\in {\mathcal{F}}_i:\exists Q_i\in {\mathcal{Q}}_i:F_i\cap Q_i=\varnothing .$$

$$\forall i,j\in [1,n],\forall F_i\in {\mathcal{F}}_i,\forall F_j\in {\mathcal{F}}_j,\forall F_{ij}\in {{\mathcal{F}}_i}^{\ast }\cap {{\mathcal{F}}_j}^{\ast }:\mathcal{P}⊈F_i\cup F_j\cup F_{ij}$$

$$\forall Q\in \mathcal{Q}:K\cap Q\ne \varnothing$$

$$\forall K^{\prime }⊊K:\exists Q\in \mathcal{Q}:K\cap Q=\varnothing .$$

$$\forall p_i\in \mathcal{G}:F\in {{\mathcal{F}}_i}^{\ast }.$$

$$\forall p_i\in \mathcal{G}:\exists Q_i\in {\mathcal{Q}}_i:Q_i\subseteq \mathcal{G}.$$

$${\mathcal{F}}_1$$

$${\mathcal{F}}_2$$

$${\mathcal{F}}_3$$

$${\mathcal{F}}_4$$

$${\mathcal{F}}_5$$

$${\mathcal{F}}_1$$

$${\mathcal{F}}_2$$

$${\mathcal{F}}_3$$

$${\mathcal{F}}_4$$

$${\mathcal{F}}_5$$

$${\mathcal{F}}_6$$

$$p_1$$

$$p_2$$

$$p_3$$

$$p_4^{\ast }$$

$$p_5^{\ast }$$

$$p_6$$

$$\dots$$

Full text

11footnotetext: Institute of Computer Science, University of Bern, Neubrückstrasse 10, 3012 CH-Bern, Switzerland. Work partially done IBM Research - Zurich.22footnotetext: IBM Research - Zurich, Säumerstrasse 4, CH-8803 Rüschlikon, Switzerland.

1 Introduction

Byzantine quorum systems [19] are a fundamental primitive for building resilient distributed systems from untrusted components. Given a set of nodes, a quorum system captures a trust assumption on the nodes in terms of potentially malicious protocol participants and colluding groups of nodes. Based on quorum systems, many well-known algorithms for reliable broadcast, shared memory, consensus and more have been implemented; these are the main abstractions to synchronize the correct nodes with each other and to achieve consistency despite the actions of the faulty, so-called Byzantine nodes.

Traditionally, trust in a Byzantine quorum system for a set of processes $\mathcal{P}$ has been symmetric. In other words, a global assumption specifies which processes may fail, such as the simple and prominent threshold quorum assumption, in which any subset of $\mathcal{P}$ of a given maximum size may collude and act against the protocol. The most basic threshold Byzantine quorum system, for example, allows all subsets of up to $f<n/3$ processes to fail. Some classic works also model arbitrary, non-threshold symmetric quorum systems [19, 15], but these have not actually been used in practice.

However, trust is inherently subjective. De gustibus non est disputandum. Estimating which processes will function correctly and which ones will misbehave may depend on personal taste. A myriad of local choices influences one process’ trust in others, especially because there are so many forms of “malicious” behavior. Some processes might not even be aware of all others, yet a process should not depend on unknown third parties in a distributed collaboration. How can one model asymmetric trust in distributed protocols? Can traditional Byzantine quorum systems be extended to subjective failure assumptions? How do the standard protocols generalize to this model?

In this paper, we answer these questions and introduce models and protocols for asymmetric distributed trust. We formalize asymmetric quorum systems for asynchronous protocols, in which every process can make its own assumptions about Byzantine faults of others. We introduce several protocols with asymmetric trust that strictly generalize the existing algorithms, which require common trust.

Our formalization takes up earlier work by Damgård et al. [10] and starts out with the notion of a fail-prone system that forms the basis of a symmetric Byzantine quorum system. A global fail-prone system for a process set $\mathcal{P}$ contains all maximal subsets of $\mathcal{P}$ that might jointly fail during an execution. In an asymmetric quorum system, every process specifies its own fail-prone system and a corresponding set of local quorums. These local quorum systems satisfy a consistency condition that ranges across all processes and a local availability condition, and generalize symmetric Byzantine quorum system according to Malkhi and Reiter [19].

Interest in consensus protocols based on Byzantine quorum systems has surged recently because of their application to permissioned blockchain networks [6, 2]. Typically run by a consortium, such distributed ledgers often use Byzantine-fault tolerant (BFT) protocols like PBFT [7] for consensus that rely on symmetric threshold quorum systems. The Bitcoin blockchain and many other cryptocurrencies, which triggered this development, started from different assumptions and use so-called permissionless protocols, in which everyone may participate. Those algorithms capture the relative influence of the participants on consensus decisions by an external factor, such as “proof-of-work” or “proof-of-stake.”

A middle ground between permissionless blockchains and BFT-based ones has been introduced by the blockchain networks of Ripple (https://ripple.com) and Stellar (https://stellar.org). Their stated model for achieving network-level consensus uses subjective trust in the sense that each process declares a local list of processes that it “trusts” in the protocol.

Consensus in the Ripple blockchain (and for the XRP cryptocurrency on the XRP Ledger) is executed by its validator nodes. Each validator declares a Unique Node List (UNL), which is a “list of transaction validators a given participant believes will not conspire to defraud them;” but on the other hand, “Ripple provides a default and recommended list which we expand based on watching the history of validators operated by Ripple and third parties” [23]. Many questions have therefore been raised about the kind of decentralization offered by the Ripple protocol. This debate has not yet been resolved.

Stellar was created as an evolution of Ripple that shares much of the same design philosophy. The Stellar consensus protocol [20] powers the Stellar Lumen (XLM) cryptocurrency and introduces federated Byzantine quorum systems (FBQS); these bear superficial resemblance with our asymmetric quorum systems but differ technically. Stellar’s consensus protocol uses quorum slices, which are “the subset of a quorum that can convince one particular node of agreement.” In an FBQS, “each node chooses its own quorum slices” and “the system-wide quorums result from these decisions by individual nodes” [26]. However, standard Byzantine quorum systems and FBQS are not comparable because (1) an FBQS when instantiated with the same trust assumption for all processes does not reduce to a symmetric quorum system and (2) existing protocols do not generalize to FBQS.

Understanding how such ideas of subjective trust, as manifested in the Ripple and Stellar blockchains, relate to traditional quorum systems is the main motivation for this work. Our protocols for asymmetric trust generalize the well-known, classic algorithms in the literature and therefore look superficially similar. This should be seen as a feature, actually, because simplicity and modularity are important guiding principles in science.

Our contributions are as follows:

• •

We introduce asymmetric Byzantine quorum systems formally in Section 4 as an extension of standard Byzantine quorum systems and discuss some of their properties.

• •

In Section 5, we show two implementations of a shared register, with single-writer, multi-reader regular semantics, using asymmetric Byzantine quorum systems.

• •

We examine broadcast primitives in the Byzantine model with asymmetric trust in Section 6. In particular, we define and implement Byzantine consistent and reliable broadcast protocols. The latter primitive is related to a “federated voting” protocol used by Stellar consensus [20].

Before presenting the technical contributions, we discuss related work in Section 2 and state our system model in Section 3.

2 Related work

Damgård et al. [10] introduce asymmetric trust in the context of synchronous protocols for secure distributed computation by modeling process-specific fail-prone systems. They state the consistency property of asymmetric Byzantine quorums and claim (without proof) that the $B^{3}$ property is required for implementing a synchronous broadcast protocol in this setting (cf. Section 4.2). However, they do not formalize quorum systems nor discuss asynchronous protocols.

The Ripple consensus protocol is run by an open set of validator nodes. The protocol uses votes, similar to standard consensus protocols, whereby each validator only communicates with the validators in its UNL. Each validator chooses its own UNL, which makes it possible for anyone to participate, in principle, similar to proof-of-work blockchains. Early literature suggested that the intersection of the UNLs for every two validators should be at least 20% of each list [24], assuming that also less than one fifth of the validators in the UNL of every node might be faulty. An independent analysis by Armknecht et al. [3] later argued that this bound must be more than 40%. A recent technical paper of Chase and MacBrough [9, Thm. 8] concludes, under the same assumption of $f<n/5$ faulty nodes in every UNL of size $n$, that the UNL overlap should actually be at least 90%.

However, the same paper also derives a counterexample to the liveness of the Ripple consensus protocol [9, Sec. 4.2] as soon as two validators don’t have “99% UNL overlap.” By generalizing the example, this essentially means that the protocol can get stuck unless all nodes have the same UNL. According to the widely shared understanding in the field of distributed systems, though, a protocol needs to satisfy safety and liveness because achieving only one of these properties is trivial. Chase and MacBrough therefore present a devastating verdict on the merit of Ripple’s protocol.

The Stellar consensus protocol (SCP) also features open membership and lets every node express its own set of trusted nodes [20]. Generalizing from Ripple’s flat lists of unique nodes, every node declares a collection of trusted sets called quorum slices, whereby a slice is “the subset of a quorum convincing one particular node of agreement.” A quorum in Stellar is a set of nodes “sufficient to reach agreement,” defined as a set of nodes that contains one slice for each member node. The quorum choices of all nodes together yield a federated Byzantine quorum systems (FBQS). The Stellar white paper states properties of FBQS and protocols that build on them. However, these protocols do not map to known protocol primitives in distributed computing.

García-Pérez and Gotsman [12] build a link from FBQS to existing quorum-system concepts by investigating a Byzantine reliable broadcast abstraction in an FBQS. They show that the federated voting protocol of Stellar [20] is similar to Bracha’s reliable broadcast [4] and that it implements a variation of Byzantine reliable broadcast on an FBQS for executions that contain, additionally, a set of so-called intact nodes.

The paper [12], however, uses the FBQS concept of Mazières [20] that is at odds with the usual notion of a Byzantine quorum system in the sense that it does not reduce to a symmetric quorum system for symmetric trust choices. In contrast, we show in this paper that a natural extension of a symmetric Byzantine quorum system suffices for implementing various protocol primitives with asymmetric trust. We explain, in particular, how to implement the prominent register abstraction with asymmetric trust and investigate multiple broadcast primitives. In particular, Stellar’s federated voting protocol and the Byzantine reliable broadcast over an FBQS as described by García-Pérez and Gotsman [12], can be shown as straightforward generalizations of Byzantine reliable broadcast with symmetric trust. Section 5.4, furthermore, discusses why FBQS are not adequate for emulating a shared register.

3 System model

Processes.

We consider a system of $n$ processes $\mathcal{P}=\{p_{1},\dots,p_{n}\}$ that communicate with each other. The processes interact asynchronously with each other through exchanging messages. The system itself is asynchronous, i.e., the delivery of messages among processes may be delayed arbitrarily and the processes have no synchronized clocks. Every process is identified by a name, but such identifiers are not made explicit. A protocol for $\mathcal{P}$ consists of a collection of programs with instructions for all processes. Protocols are presented in a modular way using the event-based notation of Cachin et al. [5].

Functionalities.

A functionality is an abstraction of a distributed computation, either a primitive that may be used by the processes or a service that they will provide. Every functionality in the system is specified through its interface, containing the events that it exposes to protocol implementations that may call it, and its properties, which define its behavior. A process may react to a received event by changing their state and triggering further events.

There are two kinds of events in an interface: input events that the functionality receives from other abstractions, typically to invoke its services, and output events, through which the functionality delivers information or signals a condition a process. The behavior of a functionality is usually stated through a number of properties or through a sequential implementation.

We assume there is a low-level functionality for sending messages over point-to-point links between each pair of processes. In a protocol, this functionality is accessed through the events of “sending a message” and “receiving a message”. Point-to-point messages are authenticated, delivered reliably, and output in FIFO order among processes [14, 5].

Executions and faults.

An execution starts with all processes in a special initial state; subsequently the processes repeatedly trigger events, react to events, and change their state through computation steps. Every execution is fair in the sense that, informally, processes do not halt prematurely when there are still steps to be taken or events to be delivered (see the standard literature for a formal definition [18]).

A process that follows its protocol during an execution is called correct. On the other hand, a faulty process may crash or even deviate arbitrarily from its specification, e.g., when corrupted by an adversary; such processes are also called Byzantine. We consider only Byzantine faults here and assume for simplicity that the faulty processes fail right at the start of an execution.

Idealized digital signatures.

A digital signature scheme provides two operations, $\textsl{sign}_{i}$ and $\textsl{verify}_{i}$. The invocation of $\textsl{sign}_{i}$ specifies a process $p_{i}$ and takes a bit string $m\in\{0,1\}^{*}$ as input and returns a signature $\sigma\in\{0,1\}^{*}$ with the response. Only $p_{i}$ may invoke $\textsl{sign}_{i}$. The operation $\textsl{verify}_{i}$ takes a putative signature $\sigma$ and a bit string $m$ as parameters and returns a Boolean value with the response. Its implementation satisfies that $\textsl{verify}_{i}(\sigma,m)$ returns true for any $i\in\{1,\dots,n\}$ and $m\in\{0,1\}^{*}$ if and only if $p_{i}$ has executed $\textsl{sign}_{i}(m)$ and obtained $\sigma$ before; otherwise, $\textsl{verify}_{i}(\sigma,m)$ returns false. Every process may invoke verify.

4 Asymmetric Byzantine quorum systems

4.1 Symmetric trust

Quorum systems are well-known in settings with symmetric trust. As demonstrated by many applications to distributed systems, ordinary quorum systems [21] and Byzantine quorum systems [19] play a crucial role in formulating resilient protocols that tolerate faults through replication [8]. A quorum system typically ensures a consistency property among the processes in an execution, despite the presence of some faulty processes.

For the model with Byzantine faults, Byzantine quorum systems have been introduced by Malkhi and Reiter [19]. This notion is defined with respect to a fail-prone system $\mathcal{F}\subseteq 2^{\mathcal{P}}$, a collection of subsets of $\mathcal{P}$, none of which is contained in another, such that some $F\in\mathcal{F}$ with $F\subseteq\mathcal{P}$ is called a fail-prone set and contains all processes that may at most fail together in some execution [19]. A fail-prone system is the same as the basis of an adversary structure, which was introduced independently by Hirt and Maurer [15].

A fail-prone system captures an assumption on the possible failure patterns that may occur. It specifies all maximal sets of faulty processes that a protocol should tolerate in an execution; this means that a protocol designed for $\mathcal{F}$ achieves its properties as long as the set $F$ of actually faulty processes satisfies $F\in\mathcal{F}^{*}$. Here and from now on, the notation $\mathcal{A}^{*}$ for a system $\mathcal{A}\subseteq 2^{\mathcal{P}}$, denotes the collection of all subsets of the sets in $\mathcal{A}$, that is, $\mathcal{A}^{*}=\{A^{\prime}|A^{\prime}\subseteq A,A\in\mathcal{A}\}$.

Definition 1 (Byzantine quorum system [19]).

A Byzantine quorum system for $\mathcal{F}$ is a collection of sets of processes $\mathcal{Q}\subseteq 2^{\mathcal{P}}$, where each $Q\in\mathcal{Q}$ is called a quorum, such that the following properties hold:

Consistency:

The intersection of any two quorums contains at least one process that is not faulty, i.e.,

[TABLE]

Availability:

For any set of processes that may fail together, there exists a disjoint quorum in $\mathcal{Q}$, i.e.,

[TABLE]

The above notion is also known as a Byzantine dissemination quorum system [19] and allows a protocol to be designed despite arbitrary behavior of the potentially faulty processes. The notion generalizes the usual threshold failure assumption for Byzantine faults [22], which considers that any set of $f$ processes are equally likely to fail.

We say that a set system $\mathcal{T}$ dominates another set system $\mathcal{S}$ if for each $S\in\mathcal{S}$ there is some $T\in\mathcal{T}$ such that $S\subseteq T$ [11]. In this sense, a quorum system for $\mathcal{F}$ is minimal whenever it does not dominate any other quorum system for $\mathcal{F}$.

Similarly to the threshold case, where $n>3f$ processes overall are needed to tolerate $f$ faulty ones in many Byzantine protocols, Byzantine quorum systems can only exist if not “too many” processes fail.

Definition 2 ($Q^{3}$-condition [19, 15]).

A fail-prone system $\mathcal{F}$ satisfies the $Q^{3}$-condition, abbreviated as $Q^{3}(\mathcal{F})$, whenever it holds

[TABLE]

In other words, $Q^{3}(\mathcal{F})$ means that no three fail-prone sets together cover the whole system of processes. A $Q^{k}$-condition can be defined like this for any $k\geq 2$ [15].

The following lemma considers the bijective complement of a process set $\mathcal{S}\subseteq 2^{\mathcal{P}}$, which is defined as $\overline{\mathcal{S}}=\{\mathcal{P}\setminus S|S\in\mathcal{S}\}$, and turns $\mathcal{F}$ into a Byzantine quorum system.

Lemma 1 ([19, Theorem 5.4]).

Given a fail-prone system $\mathcal{F}$, a Byzantine quorum system for $\mathcal{F}$ exists if and only if $Q^{3}(\mathcal{F})$. In particular, if $Q^{3}(\mathcal{F})$ holds, then $\overline{\mathcal{F}}$, the bijective complement of $\mathcal{F}$, is a Byzantine quorum system.

The quorum system $\mathcal{Q}=\overline{\mathcal{F}}$ is called the canonical quorum system of $\mathcal{F}$. According to the duality between $\mathcal{Q}$ and $\mathcal{F}$, properties of $\mathcal{F}$ are often ascribed to $\mathcal{Q}$ as well; for instance, we say $Q^{3}(\mathcal{Q})$ holds if and only if $Q^{3}(\mathcal{F})$. However, note that the canonical quorum system is not always minimal. For instance, if $\mathcal{F}$ consists of all sets of $f\ll n/3$ processes, then each quorum in the canonical quorum system has $n-f$ members, but also the family of all subsets of $\mathcal{P}$ with $\lceil\frac{n+f+1}{2}\rceil<n-f$ processes forms a quorum system.

Core sets.

A core set $C$ for $\mathcal{F}$ is a minimal set of processes that contains at least one correct process in every execution. More precisely, $C\subseteq\mathcal{P}$ is a core set whenever (1) for all $F\in\mathcal{F}$, it holds $\mathcal{P}\setminus F\cap C\neq\emptyset$ (and, equivalently, $C\not\subseteq F$) and (2) for all $C^{\prime}\subsetneq C$, there exists $F\in\mathcal{F}$ such that $\mathcal{P}\setminus F\cap C^{\prime}=\emptyset$ (and, equivalently, $C^{\prime}\subseteq F$). With the threshold failure assumption, every set of $f+1$ processes is a core set. A core set system $\mathcal{C}$ is the minimal collection of all core sets, in the sense that no set in $\mathcal{C}$ is contained in another. Core sets can be complemented by survivor sets, as shown by Junqueira et al. [16]. This yields a dual characterization of resilient distributed protocols, which parallels ours using fail-prone sets and quorums.

4.2 Asymmetric trust

In our model with asymmetric trust, every process is free to make its own trust assumption and to express this with a fail-prone system. Hence, an asymmetric fail-prone system $\mathbb{F}=[\mathcal{F}_{1},\dots,\mathcal{F}_{n}]$ consists of an array of fail-prone systems, where $\mathcal{F}_{i}$ denotes the trust assumption of $p_{i}$. One often assumes $p_{i}\not\in F_{i}$ for practical reasons, but this is not necessary. This notion has earlier been formalized by Damgård et al. [10].

Definition 3 (Asymmetric Byzantine quorum system).

An asymmetric Byzantine quorum system for $\mathbb{F}$ is an array of collections of sets $\mathbb{Q}=[\mathcal{Q}_{1},\dots,\mathcal{Q}_{n}]$, where $\mathcal{Q}_{i}\subseteq 2^{\mathcal{P}}$ for $i\in[1,n]$. The set $\mathcal{Q}_{i}\subseteq 2^{\mathcal{P}}$ is called the quorum system of $p_{i}$ and any set $Q_{i}\in\mathcal{Q}_{i}$ is called a quorum (set) for $p_{i}$. It satisfies:

Consistency:

The intersection of two quorums for any two processes contains at least one process for which both processes assume that it is not faulty, i.e.,

[TABLE]

Availability:

For any process $p_{i}$ and any set of processes that may fail together according to $p_{i}$, there exists a disjoint quorum for $p_{i}$ in $\mathcal{Q}_{i}$, i.e.,

[TABLE]

The existence of asymmetric quorum systems can be characterized with a property that generalizes the $Q^{3}$-condition for the underlying asymmetric fail-prone systems as follows.

Definition 4 ($B^{3}$-condition).

An asymmetric fail-prone system $\mathbb{F}$ satisfies the $B^{3}$-condition, abbreviated as $B^{3}(\mathbb{F})$, whenever it holds that

[TABLE]

The following result is the generalization of Lemma 1 for asymmetric quorum systems; it was stated by Damgård et al. [10] without proof. As for symmetric quorum systems, we use this result and say that $B^{3}(\mathbb{Q})$ holds whenever the asymmetric $\mathbb{Q}$ consists of the canonical quorum systems for $\mathbb{F}$ and $B^{3}(\mathbb{F})$ holds.

Theorem 2.

An asymmetric fail-prone system $\mathbb{F}$ satisfies $B^{3}(\mathbb{F})$ if and only if there exists an asymmetric quorum system for $\mathbb{F}$.

Proof.

Suppose that $B^{3}(\mathbb{F})$. We let $\mathbb{Q}=[\mathcal{Q}_{1},\dots,\mathcal{Q}_{n}]$, where $\mathcal{Q}_{i}=\overline{\mathcal{F}_{i}}$ is the canonical quorum system of $\mathcal{F}_{i}$, and show that $\mathbb{Q}$ is an asymmetric quorum system. Indeed, let $Q_{i}\in\mathcal{Q}_{i}$, $Q_{j}\in\mathcal{Q}_{j}$, and $F_{ij}\in{\mathcal{F}_{i}}^{*}\cap{\mathcal{F}_{j}}^{*}$ for any $i$ and $j$. Then $F_{i}=\mathcal{P}\setminus Q_{i}\in\mathcal{F}_{i}$ and $F_{j}=\mathcal{P}\setminus Q_{j}\in\mathcal{F}_{j}$ by construction, and therefore, $F_{i}\cup F_{j}\cup F_{ij}\not=\mathcal{P}$. This means there is some $p_{k}\in\mathcal{P}\setminus(F_{i}\cup F_{j}\cup F_{ij})$. This implies in turn that $p_{k}\in Q_{i}\cap Q_{j}$ but $p_{k}\notin F_{ij}$ and proves the consistency condition. The availability property holds by construction of the canonical quorum systems.

To show the reverse direction, let $\mathbb{Q}$ be a candidate asymmetric Byzantine quorum system for $\mathbb{F}$ that satisfies availability and assume towards a contradiction that $B^{3}(\mathbb{F})$ does not hold. We show that consistency cannot be fulfilled for $\mathbb{Q}$. By our assumption there are sets $F_{i},F_{j},F_{ij}$ in $\mathbb{F}$ such that $F_{i}\cup F_{j}\cup F_{ij}=\mathcal{P}$, which is the same as $\mathcal{P}\setminus(F_{i}\cup F_{j})\subseteq F_{ij}$. The availability condition for $\mathbb{Q}$ then implies that there are sets $Q_{i}\in\mathcal{Q}_{i}$ and $Q_{j}\in\mathcal{Q}_{j}$ with $F_{i}\cap Q_{i}=\emptyset$ and $F_{j}\cap Q_{j}=\emptyset$. Now for every $p_{k}\in Q_{i}\cap Q_{j}$ it holds that $p_{k}\notin F_{i}\cup F_{j}$ by availability and therefore $p_{k}\in\mathcal{P}\setminus(F_{i}\cup F_{j})$. Taken together this means that $Q_{i}\cap Q_{j}\subseteq\mathcal{P}\setminus(F_{i}\cup F_{j})\subseteq F_{ij}$. Hence, $\mathbb{Q}$ does not satisfy the consistency condition and the statement follows. ∎

Kernels.

Given a symmetric Byzantine quorum system $\mathcal{Q}$, we define a kernel $K$ as a set of processes that overlaps with every quorum and that is minimal in this respect. Formally, $K\subseteq\mathcal{P}$ is a kernel of $\mathcal{Q}$ if and only if

[TABLE]

and

[TABLE]

The kernel system $\mathcal{K}$ of $\mathcal{Q}$ is the set of all kernels of $\mathcal{Q}$.

For example, under a threshold failure assumption where any $f$ processes may fail and the quorums are all sets of \big{\lceil}\frac{n+f+1}{2}\big{\rceil} processes, every set of \big{\lfloor}\frac{n-f+1}{2}\big{\rfloor} processes is a kernel.

The definition of a kernel is related to that of a core set in the sense that for a given maximal fail-prone system $\mathcal{F}$, in the sense that its canonical quorum system $\mathcal{Q}=\overline{\mathcal{F}}$ is minimal, the kernel of $\mathcal{Q}$ is the same as the core-set system for $\mathcal{F}$.

Asymmetric core sets and kernels.

Let $\mathbb{F}=[\mathcal{F}_{1},\dots,\mathcal{F}_{n}]$ be an asymmetric fail-prone system. An asymmetric core set system $\mathbb{C}$ is an array of collections of sets $[\mathcal{C}_{1},\dots,\mathcal{C}_{n}]$ such that each $\mathcal{C}_{i}$ is a core set system for the fail-prone system $\mathcal{F}_{i}$. We call a set $C_{i}\in\mathcal{C}_{i}$ a core set for $p_{i}$.

Given an asymmetric quorum system $\mathbb{Q}$ for $\mathbb{F}$, an asymmetric kernel system for $\mathbb{Q}$ is defined analogously as the array $\mathbb{K}=[\mathcal{K}_{1},\dots,\mathcal{K}_{n}]$ that consists of the kernel systems for all processes in $\mathcal{P}$ with respect to $\mathbb{Q}$; a set $K_{i}\in\mathcal{K}_{i}$ is called a kernel for $p_{i}$.

Naïve and wise processes.

The faults or corruptions occurring in a protocol execution with an underlying quorum system imply a set $F$ of actually faulty processes. However, no process knows $F$ and this information is only available to an observer outside the system. With a traditional quorum system $\mathcal{Q}$ designed for a fail-prone set $\mathcal{F}$, the guarantees of a protocol usually hold as long as $F\in\mathcal{F}$. Recall that such protocol properties apply to correct processes only but not to faulty ones.

With asymmetric quorums, we further distinguish between two kinds of correct processes, depending on whether they considered $F$ in their trust assumption or not. Given a protocol execution, the processes are therefore partitioned into three types:

Faulty:

A process $p_{i}\in F$ is faulty.

Naïve:

A correct process $p_{i}$ for which $F\not\in{\mathcal{F}_{i}}^{*}$ is called naïve.

Wise:

A correct process $p_{i}$ for which $F\in{\mathcal{F}_{i}}^{*}$ is called wise.

The naïve processes are new for the asymmetric case, as all processes are wise under a symmetric trust assumption. Protocols for asymmetric quorums cannot guarantee the same properties for naïve processes as for wise ones, since the naïve processes may have the “wrong friends.”

Guilds.

If too many processes are naïve or even fail during a protocol run with asymmetric quorums, then protocol properties cannot be ensured. A guild is a set of wise processes that contains at least one quorum for each member; its existence ensures liveness and consistency for typical protocols. This generalizes from protocols for symmetric quorum systems, where the correct processes in every execution form a quorum by definition. (A guild represents a group of influential and well-connected wise processes, like in the real world.)

Definition 5 (Guild).

Given a fail-prone system $\mathbb{F}$, an asymmetric quorum system $\mathbb{Q}$ for $\mathbb{F}$, and a protocol execution with faulty processes $F$, a guild $\mathcal{G}$ for $F$ satisfies two properties:

Wisdom:

$\mathcal{G}$ is a set of wise processes:

[TABLE]

Closure:

$\mathcal{G}$ contains a quorum for each of its members:

[TABLE]

Superficially a guild seems similar to a “quorum” in the Stellar consensus protocol [20], but the two notions actually differ because a guild contains only wise processes and Stellar’s quorums do not distinguish between naïve and wise processes.

Observe that for a specific execution, the union of two guilds is again a guild, since the union consists only of wise processes and contains again a quorum for each member. Hence, every execution with a guild contains a unique maximal guild $\mathcal{G}_{\max}$.

Example.

We define an example asymmetric fail-prone system $\mathbb{F}_{A}$ on $\mathcal{P}=\{p_{1},p_{2},p_{3},p_{4},p_{5}\}$. The notation $\Theta^{n}_{k}(\mathcal{S})$ for a set $\mathcal{S}$ with $n$ elements denotes the “threshold” combination operator and enumerates all subsets of $\mathcal{S}$ of cardinality $k$. W.l.o.g. every process trusts itself. The diagram below shows fail-prone sets as shaded areas and the notation $\mbox{}_{k}^{n}$ in front of a fail-prone set stands for $k$ out of the $n$ processes in the set.

$\mathbb{F}_{A}$:

[TABLE]

The operator $\ast$ for two sets satisfies $\mathcal{A}\ast\mathcal{B}=\{A\cup B|A\in\mathcal{A},B\in\mathcal{B}\}$.

As one can verify in a straightforward way, $B^{3}(\mathbb{F}_{A})$ holds. Let $\mathbb{Q}_{A}$ be the canonical asymmetric quorum system for $\mathbb{F}_{A}$. Note that since $\mathbb{F}_{A}$ contains the fail-prone systems of $p_{3}$ and $p_{5}$ that permit two faulty processes each, this fail-prone system cannot be obtained as a special case of $\Theta^{5}_{1}(\{p_{1},p_{2},p_{3},p_{4},p_{5}\})$. When $F=\{p_{2},p_{4}\}$, for example, then processes $p_{3}$ and $p_{5}$ are wise and $p_{1}$ is naïve.

5 Shared memory

This section illustrates a first application of asymmetric quorum systems: how to emulate shared memory, represented by a register. Maintaining a shared register reliably in a distributed system subject to faults is perhaps the most fundamental task for which ordinary, symmetric quorum systems have been introduced, in the models with crashes [13] and with Byzantine faults [19]. After presenting definitions and two protocols to implement a register with asymmetric quorums, this section also explains why federated Byzantine quorum systems according to Stellar [20] fail to directly emulate shared memory.

5.1 Definitions

Operations and precedence.

For the particular shared-object functionalities considered here, the processes interact with an object $\Lambda$ through operations provided by $\Lambda$. Operations on objects take time and are represented by two events occurring at a process, an invocation and a response. The history of an execution $\sigma$ consists of the sequence of invocations and responses of $\Lambda$ occurring in $\sigma$. An operation is complete in a history if it has a matching response.

An operation $o$ precedes another operation $o^{\prime}$ in a sequence of events $\sigma$, denoted $o<_{\sigma}o^{\prime}$, whenever $o$ completes before $o^{\prime}$ is invoked in $\sigma$. A sequence of events $\pi$ preserves the real-time order of a history $\sigma$ if for every two operations $o$ and $o^{\prime}$ in $\pi$, if $o<_{\sigma}o^{\prime}$ then $o<_{\pi}o^{\prime}$. Two operations are concurrent if neither one of them precedes the other. A sequence of events is sequential if it does not contain concurrent operations. An execution on a shared object is well-formed if the events at each process are alternating invocations and matching responses, starting with an invocation.

Semantics.

A register with domain $\mathcal{X}$ provides two operations: $\textsl{write}(x)$, which is parameterized by a value $x\in\mathcal{X}$ and outputs a token ack when it completes; and read, which takes no parameter for invocation but outputs a value $x\in\mathcal{X}$ upon completion.

We consider a single-writer (or SW) register, where only a designated process $p_{w}$ may invoke write, and permit multiple readers (or MR), that is, every process may execute a read operation. The register is initialized with a special value $x_{0}$, which is written by an imaginary write operation that occurs before any process invokes operations. We consider regular semantics under concurrent access [17]; the extension to other forms of concurrent memory, including an atomic register, proceeds analogously.

It is customary in the literature to assume that the writer and reader processes are correct; with asymmetric quorums we assume explicitly that readers and writers are wise. We illustrate below why one cannot extend the guarantees of the register to naïve processes.

Definition 6 (Asymmetric Byzantine SWMR regular

register).

A protocol emulating an asymmetric SWMR regular register satisfies:

Liveness:

If a wise process $p$ invokes an operation on the register, $p$ eventually completes the operation.

Safety:

Every read operation of a wise process that is not concurrent with a write returns the value written by the most recent, preceding write of a wise process; furthermore, a read operation of a wise process concurrent with a write of a wise process may also return the value that is written concurrently.

5.2 Protocol with authenticated data

In Algorithm 1, we describe a protocol for emulating a regular SWMR register with an asymmetric Byzantine quorum system, for a designated writer $p_{w}$ and a reader $p_{r}\in\mathcal{P}$. The protocol uses data authentication implemented with digital signatures. This protocol is the same as the classic one of Malkhi and Reiter [19] that uses a Byzantine dissemination quorum system and where processes send messages to each other over point-to-point links. The difference lies in the individual choices of quorums by the processes and that it ensures safety and liveness for wise processes.

In the register emulation, the writer $p_{w}$ obtains ack messages from all processes in a quorum $Q_{w}\in\mathcal{Q}_{w}$; likewise, the reader $p_{r}$ waits for a value message carrying a value/timestamp pair from every process in a quorum $Q_{r}\in\mathcal{Q}_{r}$ of the reader.

The function $\textsl{highestval}(S)$ takes a set of timestamp/value pairs $S$ as input and outputs the value in the pair with the largest timestamp, i.e., $v$ such that $(\textit{ts},v)\in S$ and $\forall(\textit{ts}^{\prime},v^{\prime})\in S:\textit{ts}^{\prime}<\textit{ts}\lor(\textit{ts}^{\prime},v^{\prime})=(\textit{ts},v)$. Note that this $v$ is unique in Algorithm 1 because $p_{w}$ is correct. The protocol uses digital signatures, modeled by operations $\textsl{sign}_{i}$ and $\textsl{verify}_{i}$, as introduced earlier.

Theorem 3.

Algorithm 1 emulates an asymmetric Byzantine SWMR regular register.

Proof.

First we show liveness for wise writer $p_{w}$ and reader $p_{r}$, respectively. Since $p_{w}$ is wise by assumption, $F\in{\mathcal{F}_{w}}^{*}$, and by the availability condition of the quorum system there is $Q_{w}\in\mathcal{Q}_{w}$ with $F\cap Q_{w}=\emptyset$. Therefore, the writer will receive sufficiently many $[\textsc{ack}]$ messages and the write will return. As $p_{r}$ is wise, $F\in{\mathcal{F}_{r}}^{*}$, and by the analogous condition, there is $Q_{r}\in\mathcal{Q}_{r}$ with $F\cap Q_{r}=\emptyset$. Because $p_{w}$ is correct and by the properties of the signature scheme, all responses from processes $p_{j}\in Q_{r}$ satisfy the checks and read returns.

Regarding safety, it is easy to observe that any value output by read has been written in some preceding or concurrent write operation, and this even holds for naïve readers and writers. This follows from the properties of the signature scheme; read verifies the signature and outputs only values with a valid signature produced by  $p_{w}$.

We now argue that when both the writer and the reader are wise, then read outputs a value of either the last preceding write or a concurrent write and the protocol satisfies safety for a regular register. On a high level, note that $F\in{\mathcal{F}_{w}}^{*}\cap{\mathcal{F}_{r}}^{*}$ since both are wise. So if $p_{w}$ writes to a quorum $Q_{w}\in\mathcal{Q}_{w}$ and $p_{r}$ reads from a quorum $Q_{r}\in\mathcal{Q}_{r}$, then by consistency of the quorum system $Q_{w}\cap Q_{r}\not\subseteq F$ because $p_{w}$ and $p_{r}$ are wise. Hence, there is some correct $p_{i}\in Q_{w}\cap Q_{r}$ that received the most recently written value from $p_{w}$ and returns it to $p_{r}$. ∎

Example.

We show why the guarantees of this protocol with asymmetric quorums hold only for wise readers and writers. Consider $\mathbb{Q}_{A}$ from the last section and an execution in which $p_{2}$ and $p_{4}$ are faulty, and therefore $p_{1}$ is naïve and $p_{3}$ and $p_{5}$ are wise. A quorum for $p_{1}$ consists of $p_{1}$ and three processes in $\{p_{2},\dots,p_{5}\}$; moreover, every process set that contains $p_{3}$, one of $\{p_{1},p_{2}\}$ and one of $\{p_{4},p_{5}\}$ is a quorum for $p_{3}$.

We illustrate that if naïve $p_{1}$ writes, then a wise reader $p_{3}$ may violate safety. Suppose that all correct processes, especially $p_{3}$, store timestamp/value/signature triples from an operation that has terminated and that wrote $x$. When $p_{1}$ invokes $\textsl{write}(u)$, it obtains $[\textsc{ack}]$ messages from all processes except $p_{3}$. This is a quorum for $p_{1}$. Then $p_{3}$ runs a read operation and receives the outdated values representing $x$ from itself ($p_{3}$ is correct but has not been involved in writing $u$) and also from the faulty $p_{2}$ and $p_{4}$. Hence, $p_{3}$ outputs $x$ instead of $u$.

Analogously, with the same setup of every process initially storing a representation of $x$ but with wise $p_{3}$ as writer, suppose $p_{3}$ executes $\textsl{write}(u)$. It obtains $[\textsc{ack}]$ messages from $p_{2}$, $p_{3}$, and $p_{4}$ and terminates. When $p_{1}$ subsequently invokes read and receives values representing $x$, from correct $p_{1}$ and $p_{5}$ and from faulty $p_{2}$ and $p_{4}$, then $p_{1}$ outputs $x$ instead of $y$ and violates safety as a naïve reader.

Since the sample operations are not concurrent, the implication actually holds also for registers with only safe semantics.

5.3 Double-write protocol without data authentication

This section describes a second protocol emulating an asymmetric Byzantine SWMR regular register. In contrast to the previous protocol, it does not use digital signatures for authenticating the data to the reader. Our algorithm generalizes the construction of Abraham et al. [1] and also assumes that only a finite number of write operations occur (FW-termination). Furthermore, this algorithm illustrates the use of asymmetric core set systems in the context of an asymmetric-trust protocol.

Theorem 4.

Algorithm 2 emulates an asymmetric Byzantine SWMR regular register, provided there are only finitely many write operations.

Proof.

We first establish safety when the writer $p_{w}$ and the reader $p_{r}$ are wise. In that case, $F\in{\mathcal{F}_{w}}^{*}\cap{\mathcal{F}_{r}}^{*}$. During in a write operation, $p_{w}$ has received preack and ack messages from $Q_{w}\in\mathcal{Q}_{i}$ and $Q_{w}^{\prime}\in\mathcal{Q}_{i}$, respectively, and for all $Q_{r}\in\mathcal{Q}_{r}$ it holds that $Q_{w}\cap Q_{r}\not\subseteq F$ and $Q_{w}^{\prime}\cap Q_{r}\not\subseteq F$.

We now argue that any pair $(\textit{ts}^{*},v^{*})$ returned by $p_{r}$ was written by $p_{w}$ either in a preceding or a concurrent write. From the condition on the core set $C_{r}$ and $(\textit{ts}^{*},v^{*})$ it follows that at least one correct process exists in $C_{r}$ that stores $(\textit{ts}^{*},v^{*})$ as a pre-written or as a written value. Thus, the pair was written by $p_{w}$ before.

Next we argue that for every completed $\textsl{write}(v^{*})$ operation, in which $p_{w}$ has sent $[\textsc{write},{\textit{wts},v^{*}}]$, and for any subsequent read operation that selects $(\textit{ts}^{*},v^{*})$ and returns $v^{*}$, it must hold $\textit{wts}\leq\textit{ts}^{*}$. Namely, the condition on $Q_{r}$ implies that $\textit{ts}^{*}\geq\textit{ts}_{k}$ for all $p_{k}\in Q_{r}$. By the consistency of the quorum system, it holds that $Q_{w}^{\prime}\cap Q_{r}\not\subseteq F$, so there is a correct process $p_{\ell}\in Q_{w}^{\prime}\cap Q_{r}$ that has sent $\textit{ts}_{\ell}$ to $p_{r}$. Then $\textit{ts}^{*}\geq\textit{ts}_{\ell}\geq\textit{wts}$ follows because the timestamp variable of $p_{\ell}$ only increases.

The combination of the above two paragraphs implies that for read operations that are not concurrent with any write, the pair $(\textit{ts}^{*},v^{*})$ chosen by read was actually written in the immediately preceding write. If the read operation occurs concurrently with a write, then the pair $(\textit{ts}^{*},v^{*})$ chosen by read may also originate from the concurrent write. This establishes the safety property of the SWMR regular register.

We now show liveness. First, if $p_{w}$ is wise, then there exists a quorum $Q_{w}\in\mathcal{Q}_{w}$ such that $Q_{w}\cap F=\emptyset$. Second, any correct process will eventually receive all $[\textsc{prewrite},{\textit{wts},v}]$ and $[\textsc{write},{\textit{wts},v}]$ messages sent by $p_{w}$ and process them in the correct order by the assumption of FIFO links. This means that $p_{w}$ will receive $[\textsc{preack}]$ and $[\textsc{ack}]$ messages, respectively, from all processes in one of its quorums, since at least the processes in $Q_{w}$ will eventually send those.

Liveness for the reader $p_{r}$ is shown under the condition that $p_{r}$ is wise and that the read operation is concurrent with only finitely many write operations. The latter condition implies that there is one last write operation that is initiated, but does not necessarily terminate, while read is active.

By the assumption that $p_{w}$ is correct and because messages are received in FIFO order, all messages of that last write operation will eventually arrive at the correct processes. Notice also that $p_{r}$ simply repeats its steps until it succeeds and returns a value that fulfills the condition. Hence, there is a time after which all correct processes reply with value messages that contain pre-written and written timestamp/value pairs from that last operation. It is easy to see that there exist a core set and a quorum for $p_{r}$ that satisfy the condition and the reader returns. In conclusion, the algorithm emulates an asymmetric regular SWMR register, where liveness holds only for finitely many write operations. ∎

5.4 SWMR register emulation with a federated Byzantine quorum system

As stated in Section 2, Stellar’s consensus protocol introduces federated Byzantine quorum systems (FBQS) for expressing flexible trust. Each process specifies a set of quorum slices, which are subsets of $\mathcal{P}$. When process “hears such a quorum slice of processes assert a statement, it assumes no functioning process will ever contradict that statement” [20].

Consider then the example of a tiered quorum system that serves to explain FBQS [20, Fig. 3]: It consists of three tiers:

• •

A top tier with processes $p_{1},p_{2},p_{3},p_{4}$. The slices for $p_{i}$ (with $i=1,\dots,4$) are all sets of three out of the four processes that contain $p_{i}$ as well.

• •

At a middle tier, the slices for processes $p_{5},p_{6},p_{7},p_{8}$ consist of the process itself plus any two processes of the top tier.

• •

The bottom tier with processes $p_{9},p_{10}$. A slice for $p_{i}\in\{p_{9},p_{10}\}$ contains $p_{i}$ and two nodes of the middle tier.

Suppose one uses this FBQS in a protocol like Algorithm 1, by interpreting a quorum for $p_{r}$ and $p_{w}$, respectively, as one of their respective quorum slices. The resulting protocol would violate the satisfy of the register because $p_{5}$, say, acting as the writer of a value $u$ might have received ack messages from $\{p_{1},p_{2},p_{5}\}$ only and terminate. Processes $p_{3}$ and $p_{4}$ store a previously written value $x$ and would respond to a reader $p_{8}$ with $x\neq u$. As these processes form a quorum slice $\{p_{3},p_{4},p_{8}\}$ for $p_{8}$, it would read $x$. This implies either that new, different protocols are needed for a register emulation with FBQS, or that the FBQS concept is not appropriate for generalizing the established notions.

6 Broadcast

This section shows how to implement two broadcast primitives tolerating Byzantine faults with asymmetric quorums. Recall from the standard literature [14, 8, 5] that reliable broadcasts offer basic forms of reliable message delivery and consistency, but they do not impose a total order on delivered messages (as this is equivalent to consensus). The Byzantine broadcast primitives described here, consistent broadcast and reliable broadcast, are prominent building blocks for many more advanced protocols.

With both primitives, the sender process may broadcast a message $m$ by invoking $\textsl{broadcast}(m)$; the broadcast abstraction outputs $m$ to the local application on the process through a $\textsl{deliver}(m)$ event. Moreover, the notions of broadcast considered in this section are intended to deliver only one message per instance. Every instance has a distinct (implicit) label and a designated sender $p_{s}$. With standard multiplexing techniques one can extend this to a protocol in which all processes may broadcast messages repeatedly [5].

Byzantine consistent broadcast.

The simplest such primitive, which has been called (Byzantine) consistent broadcast [5], ensures only that those correct processes which deliver a message agree on the content of the message, but they may not agree on termination. In other words, the primitive does not enforce “reliability” such that a correct process outputs a message if and only if all other correct processes produce an output. The events in its interface are denoted by c-broadcast and c-deliver.

The change of the definition towards asymmetric quorums affects most of its guarantees, which hold only for wise processes but not for all correct ones. This is similar to the definition of a register in Section 5.

Definition 7 (Asymmetric Byzantine consistent

broadcast).

A protocol for asymmetric (Byzantine) consistent broadcast satisfies:

Validity:

If a correct process $p_{s}$ c-broadcasts a message $m$, then all wise processes eventually c-deliver $m$.

Consistency:

If some wise process c-delivers $m$ and another wise process c-delivers $m^{\prime}$, then $m=m^{\prime}$.

Integrity:

For any message $m$, every correct process c-delivers $m$ at most once. Moreover, if the sender $p_{s}$ is correct and the receiver is wise, then $m$ was previously c-broadcast by $p_{s}$.

The following protocol is an extension of “authenticated echo broadcast” [5], which goes back to Srikanth and Toueg [25]. It is a building block found in many Byzantine fault-tolerant protocols with greater complexity. The adaptation for asymmetric quorums is straightforward: Every process considers its own quorums before c-delivering the message.

Theorem 5.

Algorithm 3 implements asymmetric Byzantine consistent broadcast.

Proof.

For the validity property, it is straightforward to see that every correct process sends $[\textsc{echo},{m}]$. According to the availability condition for the quorum system $\mathcal{Q}_{i}$ of every wise process $p_{i}$ and because $F\subseteq F_{i}$ for some $F_{i}\in\mathcal{F}_{i}$, there exists some quorum $Q_{i}$ for $p_{i}$ of correct processes that echo $m$ to $p_{i}$. Hence, $p_{i}$ c-delivers $m$.

To show consistency, suppose that some wise process $p_{i}$ has c-delivered $m_{i}$ because of $[\textsc{echo},{m_{i}}]$ messages from a quorum $Q_{i}$ and another wise $p_{j}$ has received $[\textsc{echo},{m_{j}}]$ from all processes in $Q_{j}\in\mathcal{Q}_{j}$. By the consistency property of $\mathbb{Q}$ it holds $Q_{i}\cap Q_{j}\not\subseteq F$; let $p_{k}$ be this process in $Q_{i}\cap Q_{j}$ that is not in $F$. Because $p_{k}$ is correct, $p_{i}$ and $p_{j}$ received the same message from $p_{k}$ and $m_{i}=m_{j}$.

The first condition of integrity is guaranteed by using the delivered flag; the second condition holds because because the receiver is wise, and therefore the quorum that it uses for the decision contains some correct processes that have sent $[\textsc{echo},{m}]$ with the message $m$ they obtained from $p_{s}$ according to the protocol. ∎

Example.

We illustrate the broadcast protocols using a six-process asymmetric quorum system $\mathbb{Q}_{B}$, defined through its fail-prone system $\mathbb{F}_{B}$. In $\mathbb{F}_{B}$, as shown below, for $p_{1}$, $p_{2}$, and $p_{3}$, each process always trusts itself, some other process of $\{p_{1},p_{2},p_{3}\}$ and one further process in $\{p_{1},\dots,p_{5}\}$. Process $p_{4}$ and $p_{5}$ each assumes that at most one other process of $\{p_{1},\dots,p_{5}\}$ may fail (excluding itself). Moreover, none of the processes $p_{1}$, …, $p_{5}$ ever trusts $p_{6}$. For $p_{6}$ itself, the fail-prone sets consist of $p_{1}$ and one process of $\{p_{2},p_{3},p_{4},p_{5}\}$.

$\mathbb{F}_{B}$:

[TABLE]

It is easy to verify that $B^{3}(\mathbb{F}_{B})$ holds; hence, let $\mathbb{Q}_{B}$ be the canonical quorum system of $\mathbb{F}_{B}$. Again, there is no reliable process that could be trusted by all and $\mathbb{Q}_{B}$ is not a special case of a symmetric threshold Byzantine quorum system. With $F=\{p_{1},p_{5}\}$, for instance, processes $p_{3}$ and $p_{6}$ are wise, $p_{2}$ and $p_{4}$ are naïve, and there is no guild.

Consider an execution of Algorithm 3 with sender $p_{4}^{*}$ and $F=\{p_{4}^{*},p_{5}^{*}\}$ (we write $p_{4}^{*}$ and $p_{5}^{*}$ to denote that they are faulty). This means processes $p_{1},p_{2},p_{3}$ are wise and form a guild because $\{p_{1},p_{2},p_{3}\}$ is a quorum for all three; furthermore, $p_{6}$ is naïve.

[TABLE]

Hence, $p_{1}$ receives $[\textsc{echo},{x}]$ from $\{p_{1},p_{3},p_{4}^{*},p_{5}^{*}\}\in\mathcal{Q}_{1}$ and c-delivers $x$, but the other wise processes do not terminate. The naïve $p_{6}$ gets $[\textsc{echo},{u}]$ from $\{p_{2},p_{4}^{*},p_{5}^{*},p_{6}\}\in\mathcal{Q}_{6}$ and c-delivers $u\neq x$.

Byzantine reliable broadcast.

In the symmetric setting, consistent broadcast has been extended to (Byzantine) reliable broadcast in a well-known way to address the disagreement about termination among the correct processes [5]. This primitive has the same interface as consistent broadcast, except that its events are called r-broadcast and r-deliver instead of c-broadcast and c-deliver, respectively.

A reliable broadcast protocol also has all properties of consistent broadcast, but satisfies the additional totality property stated next. Taken together, consistency and totality imply a notion of agreement, similar to what is also ensured by many crash-tolerant broadcast primitives. Analogously to the earlier primitives with asymmetric trust, our notion of an asymmetric reliable broadcast, defined next, ensures agreement on termination only for the wise processes, and moreover only for executions with a guild. Also the validity of Definition 7 is extended by the assumption of a guild. Intuitively, one needs a guild because the wise processes that make up the guild are self-sufficient, in the sense that the guild contains a quorum of wise processes for each of its members; without that, there may not be enough wise processes.

Definition 8 (Asymmetric Byzantine reliable broadcast).

A protocol for asymmetric (Byzantine) reliable broadcast is a protocol for asymmetric Byzantine consistent broadcast with the revised validity condition and the additional totality condition stated next:

Validity:

In all executions with a guild, if a correct process $p_{s}$ c-broadcasts a message $m$, then all processes in the maximal guild eventually c-deliver $m$.

Totality:

In all executions with a guild, if a wise process r-delivers some message, then all processes in the maximal guild eventually r-deliver a message.

The protocol of Bracha [4] implements reliable broadcast subject to Byzantine faults with symmetric trust. It augments the authenticated echo broadcast from Algorithm 3 with a second all-to-all exchange, where each process is supposed to send ready with the payload message that will be r-delivered. When a process receives the same $m$ in $2f+1$ ready messages, in the symmetric model with a threshold Byzantine quorum system, then it r-delivers $m$. Also, a process that receives $[\textsc{ready},{m}]$ from $f+1$ distinct processes and has not yet sent a ready chimes in and also sends $[\textsc{ready},{m}]$. These two steps ensure totality.

For asymmetric quorums, the conditions of a process $p_{i}$ receiving $f+1$ and $2f+1$ equal ready messages, respectively, generalize to receiving the same message from a kernel for $p_{i}$ and from a quorum for $p_{i}$. Intuitively, the change in the first condition ensures that when a wise process $p_{i}$ receives the same $[\textsc{ready},{m}]$ message from a kernel for itself, then this kernel intersects with some quorum of wise processes. Therefore, at least one wise process has sent $[\textsc{ready},{m}]$ and $p_{i}$ can safely adopt $m$. Furthermore, the change in the second condition relies on the properties of asymmetric quorums to guarantee that whenever some wise process has r-delivered $m$, then enough correct processes have sent a $[\textsc{ready},{m}]$ message such that all wise processes eventually receive a kernel of $[\textsc{ready},{m}]$ messages and also send $[\textsc{ready},{m}]$.

Applying these changes to Bracha’s protocol results in the asymmetric reliable broadcast protocol shown in Algorithm 4. Note that it strictly extends Algorithm 3 by the additional round of ready messages, in the same way as for symmetric trust. For instance, when instantiated with the symmetric threshold quorum system of $n=3f+1$ processes, of which $f$ may fail, then every set of $f+1$ processes is a kernel.

In Algorithm 4, there are two conditions that let a correct $p_{i}$ send $[\textsc{ready},{m}]$: either when receiving a quorum of $[\textsc{echo},{m}]$ messages for itself or after obtaining a kernel for itself of $[\textsc{ready},{m}]$. For the first case, we say $p_{i}$ sends ready after echo; for the second case, we say $p_{i}$ sends ready after ready.

Lemma 6.

In any execution with a guild, there exists a unique $m$ such that whenever a wise process sends a ready message, it contains $m$.

Proof.

Consider first all ready messages sent by wise processes after echo. The fact that Algorithm 4 extends Algorithm 3 achieving consistent broadcast, combined with the consistency property in Definition 7 implies immediately that the lemma holds for ready messages sent by wise processes after echo.

For the second case, consider the first wise process $p_{i}$ which sends $[\textsc{ready},{m^{\prime}}]$ after ready. From the protocol it follows that all processes in some kernel $K_{i}\in\mathcal{K}_{i}$, which triggered $p_{i}$ to send $[\textsc{ready},{m^{\prime}}]$, have sent $[\textsc{ready},{m^{\prime}}]$ to $p_{i}$. Moreover, according to the definition of a kernel, $K_{i}$ overlaps with all quorums for $p_{i}$. Since there exists a guild in the execution, at least one of the quorums for $p_{i}$ consists exclusively of wise processes. Hence, some wise process $p_{j}$ has sent $[\textsc{ready},{m^{\prime}}]$ to $p_{i}$. But since $p_{i}$ is the first wise process to send ready after ready, it follows that $p_{j}$ sent $[\textsc{ready},{m^{\prime}}]$ after echo; therefore, $m^{\prime}=m$ from the proof in the first case. Continuing this argument inductively over all ready messages sent after ready by wise processes, in the order these were sent, shows that all those messages contain $m$ and establishes the lemma. ∎

Theorem 7.

Algorithm 4 implements asymmetric Byzantine reliable broadcast.

Proof.

Recall that the validity property assumes there exists a guild $\mathcal{G}$. Since the sender $p_{s}$ is correct and according to asymmetric quorum availability, every wise process $p_{i}$ in $\mathcal{G}$ eventually receives a quorum of $[\textsc{echo},{m}]$ messages for itself, containing the message $m$ from $p_{s}$. According to the protocol, $p_{i}$ therefore sends $[\textsc{ready},{m}]$ after echo unless $\textit{sentready}=\textsc{true}$; if this is the case, however, $p_{i}$ has already sent $[\textsc{ready},{m}]$ after ready as ensured by Lemma 6. Hence, every process in $\mathcal{G}$ eventually sends $[\textsc{ready},{m}]$. Then every process in $\mathcal{G}$ receives a quorum for itself of $[\textsc{ready},{m}]$ and r-delivers $m$, as ensured by the properties of a guild and by the protocol.

To establish the totality condition, suppose that some wise process $p_{i}$ has r-delivered a message $m$. Then it has obtained $[\textsc{ready},{m}]$ messages from the processes in some quorum $Q_{i}\in\mathcal{Q}_{i}$. Consider any other wise process $p_{j}$. Since $p_{i}$ and $p_{j}$ are both wise, it holds $F\in{\mathcal{F}_{i}}^{*}$ and $F\in{\mathcal{F}_{j}}^{*}$, which implies $F\in{\mathcal{F}_{i}}^{*}\cap{\mathcal{F}_{j}}^{*}$. Then, the set $K=Q_{i}\setminus F$ intersects every quorum of $p_{j}$ by quorum consistency and is a kernel for $p_{j}$ by definition. Since $K$ consists only of correct processes, all of them have sent $[\textsc{ready},{m}]$ also to $p_{j}$ and $p_{j}$ eventually sends $[\textsc{ready},{m}]$ as well. This implies that all wise processes eventually send $[\textsc{ready},{m}]$ to all processes. Every process in $\mathcal{G}_{\max}$ therefore receives a quorum for itself of $[\textsc{ready},{m}]$ and r-delivers $m$, as required for totality.

The consistency property follows immediately from the preceding argument and from Lemma 6, which implies that all wise processes deliver the same message.

Finally, integrity holds because of the delivered flag in the protocol and because of the argument showing validity together with Lemma 6. ∎

Example.

Consider again the protocol execution with $\mathbb{Q}_{B}$ introduced earlier for illustrating asymmetric consistent broadcast. Recall that $F=\{p_{4}^{*},p_{5}^{*}\}$, the set $\{p_{1},p_{2},p_{3}\}$ is a guild, and $p_{6}$ is naïve. The start of the execution is the same as shown previously and omitted. Instead of c-delivering $x$ and $u$, respectively, $p_{1}$ and $p_{6}$ send $[\textsc{ready},{x}]$ and $[\textsc{ready},{u}]$ to all processes:

[TABLE]

Note that the kernel systems of processes $p_{1}$, $p_{2}$, and $p_{3}$ are $\mathcal{K}_{1}=\{\{p_{1}\},\{p_{3}\}\}$, $\mathcal{K}_{2}=\{\{p_{1}\},\{p_{2}\}\}$, and $\mathcal{K}_{3}=\{\{p_{2}\},\{p_{3}\}\}$. Hence, when $p_{2}$ receives $[\textsc{ready},{x}]$ from $p_{1}$, it sends $[\textsc{ready},{x}]$ in turn because $\{p_{1}\}$ is a kernel for $p_{2}$, and when $p_{3}$ receives this message, then it sends $[\textsc{ready},{x}]$ because $\{p_{2}\}$ is a kernel for $p_{3}$.

Furthermore, since $\{p_{1},p_{2},p_{3}\}$ is the maximal guild and contains a quorum for each of its members, all three wise processes r-deliver $x$ as implied by consistency and totality. The naïve $p_{6}$ does not r-deliver anything, however.

Remarks.

Asymmetric reliable broadcast (Definition 8) ensures validity and totality only for processes in the maximal guild. On the other hand, an asymmetric consistent broadcast (Definition 7) ensures validity also for all wise processes. We leave it as an open problem to determine whether these guarantees can also be extended to wise processes for asymmetric reliable broadcast and the Bracha protocol. This question is equivalent to determining whether there exist any wise processes outside the maximal guild.

Another open problem concerns the conditions for reacting to ready messages in the asymmetric reliable broadcast protocol. Already in Bracha’s protocol for the threshold model [4], a process (1) sends its own ready message upon receiving $f+1$ ready messages and (2) r-delivers an output upon receiving $2f+1$ ready messages. These conditions generalize for arbitrary, non-threshold quorum systems to receiving messages (1) from any set that is guaranteed to contain at least one correct process and (2) from any set that still contains at least one process even when any two fail-prone process sets are subtracted. In Algorithm 4, in contrast, a process delivers the payload only after receiving ready messages from one of its quorums. But such a quorum (e.g., \big{\lceil}\frac{n+f+1}{2}\big{\rceil} processes) may be larger than a set in the second case (e.g., $2f+1$ processes). It remains interesting to find out whether this discrepancy is necessary.

Acknowledgments

This work has been supported in part by the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 780477 PRIViLEDGE.