A faithful distributed mechanism for sharing the cost of multicast transmissions

A Faithful Distributed Mechanism for Sharingthe Cost of Multicast Transmissions

Nandan Garg, Student Member, IEEE, and Daniel Grosu, Senior Member, IEEE

Abstract—The problem of sharing the cost of multicast transmissions was studied in the past, and two mechanisms, Marginal Cost

(MC) and Shapley Value (SH), were proposed to solve it. Although both of them are strategyproof mechanisms, the distributed

protocols implementing them are susceptible to manipulation by autonomous nodes. We propose a distributed Shapley Value

mechanism in which the participating nodes do not have incentives to deviate from the mechanism specifications. We show that the

proposed mechanism is a faithful implementation of the Shapley Value mechanism. We experimentally investigate the performance of

the existing and the proposed cost-sharing mechanisms by implementing and deploying them on PlanetLab. We compare the

execution time of MC and SH mechanisms for the Tamper-Proof and Autonomous Node models. We also study the convergence and

scalability of the mechanisms by varying the number of nodes and the number of users per node. We show that the MC mechanisms

generate a smaller revenue compared to the SH mechanisms, and thus, they are not attractive to the content provider. We also show

that increasing the number of users per node is beneficial for the systems implementing the SH mechanisms from both computational

and economic perspectives.

Index Terms—Multicast, cost sharing, faithful implementation, algorithmic mechanism design.

Ç

1 INTRODUCTION

RECENTLY, the transmission of multimedia content hasbecome one of the most widely used applications on the

Internet. A very common model of multimedia contentdistribution is the one in which the content providerdistributes the audio/video to the subscribers (e.g., on-demand video) using multicast transmissions [1], [2], [3], [4].Multicast transmissions are efficient as they minimize thenumber of messages traversing a single link by creating amulticast tree [5], [6], [7], [8]. We consider the overlaymulticast where pure application-level or hybrid techniquesare used to build overlays on the existing networkinfrastructure such as the Internet [9], [10], [11]. Since themulticast trees are overlays, they can be efficientlyconstructed using spatial information [12], [13]. Not onlydo approaches such as the Reliability-Oriented SwitchingTree (ROST) [5] construct multicast trees that are reliable,but the tree construction algorithm also prevents cheatingand manipulation of bandwidth/time information.

In such multicast trees, the content provider is the root ofthe tree, and the receivers are the other nodes in the tree. Anode in the multicast tree receives the transmission from theparent node and forwards the content to its child nodes, ifany. We consider a model in which each node in the multicasttree has multiple users. The node receives the content fromthe content provider and delivers it to the users by using IPMulticast or other techniques that are efficient in local scopes.This model characterizes well the scenarios where smallerContent Distribution Networks (CDNs) or Internet Service

Providers (ISPs) pay bigger CDNs/ISPs to receive thecontent, which is then distributed to their subscribers. Thesubscribers are charged by the smaller content providers forreceiving the content. In our model, we refer to the smallerCDNs as nodes and to their subscribers as users. This two-tierarchitecture is highly scalable, efficient, and economic. Wedescribe examples of such architectures in the related worksection. The multicast transmissions used to distributecontent are mostly receiver initiated (e.g., Video on Demand)[14]. In such systems, the users who receive the transmissionhave the responsibility to pay for the cost incurred by dataflowing over the links [15]. In general, the content providerprovides the content and charges the receiver for the content.This charge should cover the cost of the links used in themulticast transmission. If the content distributors do notcharge the users, they may not be profitable [16].

In our model, the nodes are responsible for paying thecontent provider for the received content. This model isespecially useful in scenarios where smaller CDNs sub-scribe to bigger CDNs and pay them to receive the contentthat they deliver to their subscribers (called users). Thebenefit for each user e is quantified by a private single-valued parameter ue known as the user’s utility. User e willlike to receive the transmission if her cost share xe is lessthan her utility, i.e., if her welfare we ¼ ue � xe is positive.Cost-sharing mechanisms determine who receives themulticast and how much they have to pay for the service.However, the calculation of cost shares is not a trivial task,as the users may cheat by lying about their utility.

The users are assumed to be rational (i.e., they want tomaximize their profit). They have strong motivation to lieabout their private values in order to get extra benefits. Thetask of the system designer is to design mechanisms thatachieve systemwide goals. These goals may be hampered ifthe users lie about their private values. To preventmanipulation and motivate users to participate honestly,Mechanism Design (a subfield of Microeconomics) is used

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009 1089

. The authors are with the Department of Computer Science, Wayne StateUniversity, 5143 Cass Avenue, Detroit, MI 48202.E-mail: [email protected], [email protected].

Manuscript received 14 Oct. 2007; revised 12 Apr. 2008; accepted 29 Sept.2008; published online 2 Oct. 2008.Recommended for acceptance by B. Parhami.For information on obtaining reprints of this article, please send e-mail to:[email protected], and reference IEEECS Log Number TPDS-2007-10-0377.Digital Object Identifier no. 10.1109/TPDS.2008.221.

1045-9219/09/$25.00 � 2009 IEEE Published by the IEEE Computer Society

to model the behavior of the users. The standard Algo-rithmic Mechanism Design (AMD) [17] and DistributedAMD (DAMD) [18] study the mechanisms where theoutcome and the payment depend on the input providedby the participants. Of importance are the strategyproof

mechanisms [19], in which the users obtain maximum profitwhen they declare their private values truthfully. In thestandard AMD [17], a centralized trusted entity implementsthe mechanism, i.e., collects the input from the participants,calculates the outcome, and distributes the payment. Whenthe mechanism is implemented in a distributed fashion [20],the participants themselves execute the mechanism andcollectively calculate the outcome and the payments.

Feigenbaum et al. [20] proposed two distributed mechan-isms to calculate the cost shares of the participants in amulticast transmission: the Marginal Cost (MC) mechanismand the Shapley Value (SH) mechanism. MC is a two-phasemechanism, whereas SH is an iterative mechanism.

The MC mechanism is strategyproof and efficient (i.e.,maximizes the overall welfare) but not budget balanced. Infact, it is known that it generally runs a budget deficit and, inmany cases, does not generate any revenue at all [21]. Nostrategyproof mechanism can be both efficient and budgetbalanced at the same time [22]. The MC mechanism isrecommended when the multicast delivery may be sub-sidized if the mechanism runs a budget deficit [18]. Since theMC mechanism does not generate sufficient revenue, it is nota suitable mechanism from the content provider’s point ofview. The content provider will quickly go out of business,especially when there exist competing content providers. Inaddition, the MC mechanism is susceptible to collusion [23].

The SH mechanism is a better choice from these con-siderations because it is budget balanced and group strategy-proof. Mechanisms are characterized by standard propertieslike No-Positive Transfers, Voluntary Participation, andConsumer Sovereignty. No-Positive Transfers means thatthe cost shares are nonnegative ðxe � 0Þ. A mechanismsatisfies the Voluntary Participation property when it ensuresthat users are not charged if they do not receive thetransmission. Consumer Sovereignty property guaranteesthat if a user is willing to pay a high enough amount, he or shewill definitely get the transmission (i.e., users cannot beexcluded arbitrarily).

The SH mechanism satisfies the Consumer Sovereigntyproperty, in addition to No-Positive Transfers and VoluntaryParticipation. The MC mechanism satisfies No-PositiveTransfers and Voluntary Participation properties but doesnot satisfy Consumer Sovereignty [21]. Although the SHmechanism is not efficient, for large user populations, itapproaches perfect efficiency. From the class of group-strategyproof mechanisms that are budget balanced, theSH mechanism minimizes the worstcasewelfare loss [21]. Theonly drawback of the SH mechanism is that it has a highernetwork complexity [24]. However, we believe that the cost-share calculation will induce a relatively small overheadto theoverall multicast transmission. Thus, it is justifiable to preferthe SH mechanism, given its good properties. The conver-gence and scalability of these mechanisms have been studiedtheoretically, but no experimental evaluation was performed.

The MC and SH mechanisms proposed in [20] assumethat the participants may lie about their private values, butthey may not deviate from the specified distributedalgorithm. This model of distributed implementation isknown as the Tamper-Proof Model (TPM). Thus, we useMC-TPM and SH-TPM to denote the mechanisms pro-posed in [20]. However, the TPM assumption is weakbecause the participants can easily manipulate the dis-tributed mechanism in their favor, since they control it.The more general model in which the participants maydeviate from the specified distributed mechanism is calledthe Autonomous Node Model (ANM). When the distributedmechanisms are implemented by the participants them-selves, they may deviate from the specified algorithm if itis beneficial to do so. These deviations are categorized intothree groups: information revelation, message passing, andcomputation. A faithful implementation [25] is an imple-mentation of a mechanism where the participants cannotgain any benefit by deviating from the mechanismspecification. Different techniques to achieve faithfulness,such as redundancy, catch and punish, and problempartitioning, have been suggested in [25]. In this paper,we employ the catch-and-punish technique, which as-sumes the existence of a trusted party who audits theparticipants randomly and punishes the ones who deviatefrom the protocol specification. Our goal in this paper is todesign a faithful implementation of the SH mechanism andto investigate its properties.

1.1 Related Work

We briefly review the existing research on multicastarchitectures and show how they relate to the multicastmodel we use in this paper. One example of a two-tierarchitecture is the Two-tier Overlay Multicast Architecture(TOMA), presented in [26]. In TOMA, the ISPs create aMulticast Service Overlay Network (MSON) as the backboneservice domain. End users subscribe to the proxies advertisedby MSONs to receive the content. TOMA is shown to beprofitable for ISPs implementing it. The authors showthrough simulations that such two-tiered approach is verybeneficial to reduce the cost of the multicast using overlayprovisioning methods. Another example of overlay architec-ture, presented in [27], consists of Multicast Service Nodes(MSNs), which are connected with the source of the content toform the multicast backbone. When an MSN receives thecontent, it delivers it to the users who have subscribed to it.The architecture is scalable and self-organizing. It adapts wellto the dynamic nature of the content delivery where users joinand leave regularly. Scattercast [28] is another architecturewhere ScatterCast proXies (SCXs) are strategically placednodes that create source-rooted distribution trees to delivercontent originating at the source (a user connected to thesource) to the other SCXs. This approach is useful in scenarioswhere the content provider is not a fixed node. The nodes inour model can represent the MSONs in TOMA [26] or SCXs inScattercast [28], which pay the content provider according tothe number of users receiving the content. To track thenumber of copies of the multimedia content made by thesmaller CDNs, the content providers can use one of thetechniques surveyed in [29] and [30]. Considering specifica-tions such as Protocol Independent Multicast (Sparse Mode),

1090 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 8, AUGUST 2009

PIM-SM [31], our model can be extended to include anyRendezvous Point (RP) as the root, as long as there is a validtree. The multicast tree does not have to be a binary tree toprovide efficient transmission. This model is also very usefulwhen the nodes are organizations that pay for the content anddeliver it to multiple users within their organization. In somecases, the nodes may not even charge their users for thecontent. If they do, they can use our proposed mechanism forcalculating the cost share of each user within their local scope.

Distributed implementations of mechanisms have beenproposed for various problems such as multicast cost sharing[20] and scheduling [32], [33]. Incentives have been employedin distributed systems such as BitTorrent [34] to motivateparticipants to follow the specified protocol. Game theory hasalso been used to analyze the interactions of ISPs and todesign equilibrium strategies for network pricing [35].Pricing the resources [36] provides the added advantage ofefficient and just use of available resources, which otherwisehave to face issues such as “free riding.” An axiomaticapproach to allocate the costs to the receiving users and themechanism that implements it were proposed in [37].

An MC mechanism for sharing the cost of multicasttransmissions assuming the ANM was proposed in [38].The mechanism was designed by augmenting the originalMC-TPM mechanism proposed in [20] with asymmetric keycryptographic primitives to prevent cheating. Specifically,the authors used digital signatures to authenticate the senderof the messages and auditing to verify that the agentsexecuted the mechanism correctly. The limitation of the MCmechanism for ANM, proposed in [38], is that it assumes thatthere is only one user per node. The paper was strictly limitedto the design of the mechanism, and no performanceevaluation was provided. Cryptographic methods like groupkey distribution have also been used for designing protocolsthat are robust against inflated subscriptions when contentdistribution uses IP Multicast [39].

1.2 Contributions

In this paper, we propose a distributed SH mechanism forsharing the cost of multicast transmissions for the ANM,called SH-ANM. To design our mechanism, we rely on thecatch-and-punish technique to achieve faithfulness. Thistechnique assumes the existence of a trusted node (in ourcase, the root of the multicast tree) that audits the nodesrandomly and punishes the nodes that deviate from thespecified mechanism. We use digital signatures to authen-ticate the messages sent by the nodes and perform auditingand verification to detect cheating by the nodes. Ourmechanism has provisions that prevent deviations in anyof the multiple iterations of the SH mechanism. We showthat our proposed distributed mechanism is a faithfulimplementation of the SH mechanism.

The time overhead induced by our proposed faithfulmechanism to calculate cost shares is negligible comparedto the transmission time of the actual content. We showthis by implementing the mechanism and deploying iton a distributed real-world environment provided byPlanetLab [40]. Our experiments provide interesting in-sights into the behavior of the SH mechanism from theeconomic and computational perspectives. To comparethe performance of the proposed SH mechanism, we also

implement the MC mechanisms (both ANM and TPM)and SH-TPM and deploy them on PlanetLab. We comparethe performance of our proposed mechanism to that ofthe other existing mechanisms (MC-TPM, MC-ANM, andSH-TPM). We also study the convergence of the SH-ANMmechanism. In addition, we investigate the effect ofvarying the number of users per node and the effect ofvarying the number of nodes in the multicast tree on thenumber of users that receive the transmission and on thepayment the content provider receives in the proposedmechanism.

1.3 Organization

The organization of the rest of the paper is given as follows:In Section 2, we present the network model we use, the MCand SH mechanisms for TPM, and the MC mechanism forANM. Section 3 begins with the description of how nodescan cheat in the original implementation of the SHmechanism for TPM. We then present our proposedmechanism, implementing the SH mechanism for ANM.In Section 4, we show that our mechanism is a faithfulimplementation of the SH mechanism. Section 5 describesthe experimental setup and the results we obtained from theexperiments. Section 6 concludes the paper with a summaryand future research directions.

2 COST-SHARING MECHANISMS

In this section, we describe the network model we useand present the MC and the SH mechanisms assumingthe TPM [20]. We describe the MC mechanism for theANM [38].

2.1 Model

We assume the following network model. The user popula-tion Q resides at N nodes. Each user e 2 Q resides at somenode i 2 N . The nodes are connected by bidirectional links.R � Q is the set of users who receive the multicasttransmission. The transmission starts from a node root 2 Nand flows through a static multicast tree T ðRÞ � T ðQÞ, whereT ðRÞandT ðQÞdenote the multicast tree connecting the nodesinR and Q, respectively. The techniques used to create thesetrees are described in [20], [41], and [42]. We denote thesubtree rooted at node i as Ti. Each link connecting node i toits parent node p has a cost ci associated with it. Ci denotes theset of all t children k1; . . . ; kt of node i, and ri denotes the set ofall the users at node i. The payment sent by node i to root isdenoted by paymenti.

In the description of the mechanism in Fig. 1 (and the restof paper), we use the primitive sendðM;RÞ to denote thatthe node executing the mechanism sends message M to anode R and recvðM;RÞ to denote that the node executingthe mechanism receives message M from a node R.

2.2 Marginal Cost Mechanism for the Tamper-ProofModel (MC-TPM)

Let us assume that Ui denotes the sum of utilities of allthe users at node i ðUi ¼

Pe2ri ueÞ. The vector of utilities

of all users e 2 Q is denoted by u. If a user e receives thetransmission, then �e ¼ 1; otherwise, �e ¼ 0. Tþi denotesthe union of Ti and the link from i to p. WðuÞ represents

GARG AND GROSU: A FAITHFUL DISTRIBUTED MECHANISM FOR SHARING THE COST OF MULTICAST TRANSMISSIONS 1091

the net worth of the system at utility vector u, andWiðuÞ denotes the welfare (i.e., utilities minus cost) ofsubtree Tþi . The mechanism is executed in two phases, abottom-up phase and a top-down phase, as shown inFig. 1. In the bottom-up phase, the welfare values WiðuÞare calculated by

WiðuÞ ¼ Ui þX

k2CijWkðuÞ�0

WkðuÞ

0@

1A� ci: ð1Þ

Each node calculates the welfare value and sends it to itsparent. Finally, the root node receives the welfare valuesfrom its children. In the top-down phase, the minimumwelfare value Ai of a node i is calculated and propagateddown the tree. Ai is the smallest welfare value Wi0 ðuÞ of anynode i0 in the path from i to root. Ai is used to decide whichusers receive the transmission and what will be their costshare. The details of how to calculate Ai and xe are shown inFig. 1 and described in [20].

2.3 Shapley Value Mechanism for the Tamper-ProofModel (SH-TPM)

The SH [43] mechanism is implemented using an iterativealgorithm consisting of two phases (bottom-up and top-down). In the bottom-up traversal, each node i determinesthe number of users �i in Ti who choose to receive thetransmission. �i is the cost share of each of the resident

users at node i who receive the transmission, i.e., xe ¼ �i,8e 2 ri \R. ni represents the number of users at node i whochoose to receive the transmission. The bottom-up traversalstarts from the leaf nodes. A leaf node k reports its �k valueto its parent (for the leaf nodes, �k ¼ nk). Nodes other thanleaf nodes calculate �i ¼

Pk2Ci �k þ ni and send it to their

parent node. After root receives �i, i 2 Croot, it initiates thetop-down traversal, where it sends �root ¼ 0 to each of itschildren. Each node receives �p from its parent andcomputes �i as follows:

�i ¼ci�i

� �þ �p: ð2Þ

�i is then sent to all the children of node i (i.e., all nodesk 2 Ci). All users e 2 ri are assigned the cost share xe ¼ �i. Ifthe cost share xe of any user e is greater than its utility ue,then user e declines to receive the transmission. In that case,�i decreases, and it needs to be updated in the next bottom-up traversal. This increases the cost shares of the other userssharing the links with e. Thus, in each iteration of thebottom-up and the top-down traversal, users may beremoved from the receiver set R, and the cost shares areupdated. These iterations are repeated until no more usersare dropped and until the cost share of any user does notchange in two subsequent iterations. Initially, R ¼ Q, and inthe worst case, one user is dropped in each iteration. If weassume that the algorithm converges in m iterations, thenumber of messages required in this case is �ðn�mÞ. Thedetailed analysis of the computational and communicationcomplexity is presented in [20].

The mechanism is shown in Fig. 2, where �ji and �ji referrespectively to the �i and �i values in iteration j. An exampleof the execution of one iteration of the SH mechanism is


Fig. 1. MC-TPM: Distributed MC mechanism for TPM.

Fig. 2. SH-TPM: Distributed SH mechanism for TPM.

shown in Fig. 3. In this example, it is assumed that each nodehas only one user. The �ji values propagate from child toparent in the bottom-up phase (shown by solid arrows), and�ji values are sent from parent to child in the top-down phase(shown by dashed arrows).

2.4 Marginal Cost Mechanism for the AutonomousNodes Model (MC-ANM)

The strategyproof MC mechanism prevents users from lyingabout their utility, but it does not prevent the deviation ofnodes from the specified distributed mechanism. The authorsin [38] assume that the nodes are autonomous, and they candeviate from the mechanism to increase their welfare. Theyproposed the use of digital signatures to authenticate themessages sent by a node and the use of auditing by thecontent provider to detect cheating. The content providerðrootÞ is assumed to be the administrator of the mechanism.However, this does not make the mechanism centralizedsince the nodes themselves compute the outcome in adistributed fashion. The administrator audits nodes withcertain probability and enforces payments in case ofdiscrepancies.

The modified mechanism (called protocol A) [38] isdescribed as follows: Assume that a message M signedusing the private key Ki of node i is denoted by EKi

½M�. Thebottom-up traversal is the same as in the MC mechanism forTPM, except that the values sent by the children are signedusing their private keys and each node verifies the signatureafter receiving the message. In the top-down phase, eachnode i sends message EKi

½Ai;Wk�, where Ai is the value inthe original MC mechanism, and Wk is the message that ireceived from child k during the bottom-up phase. At theend of the mechanism execution, the content provideraudits each node i with probability Pa. It asks node i to senda proof of paying, proofi, which consists of all the messagesreceived by node i from its children and parent during theexecution of the mechanism. To check the proof, the contentprovider decrypts all the messages contained in proofi(which are signed by the parent and the children of node i)and calculates the utility and the payment expected from

node i. If the actual payment received from node i isdifferent from the expected payment, node i has to pay ahigh penalty. Thus, node i has no incentive to deviate fromthe mechanism (for proof, refer to [38]).

3 SHAPLEY VALUE MECHANISM FOR THE

AUTONOMOUS NODES MODEL (SH-ANM)

The distributed implementation of the SH mechanism in[20] is vulnerable to deviations by the nodes. In this section,we present our proposed mechanism that prevents suchdeviations. We first present the notation used in describingthe proposed mechanism. Then, we describe the ways inwhich a node can cheat in the original mechanism. Finally,we describe SH-ANM, our proposed mechanism.

3.1 Notation

As described in Section 2.3, SH is an iterative mechanism.It performs more than one iteration of the bottom-up andtop-down traversals. The number of users at node i, initeration j, who choose to receive the multicast transmis-sion is denoted by nji . For iteration j the number of usersin the subtree rooted at i who receive the transmission is�ji . The cost share of users at node i, calculated initeration j, is denoted by �ji . During the top-down phaseof iteration j, node i receives cost share �jp from p. Thecost share �ji is calculated using the formula �ji ¼ðci=�jiÞ þ �jp (from (2)). The message M signed by node iusing its private key Ki is denoted by EKi

½M�.

3.2 Cheating in Tamper-Proof Model

In the following, we show how a node can cheat bymanipulating the values sent to other nodes. The scenario inwhich no cheating occurs is shown in Fig. 3. For simplicity,we assume that every node has only one user. The values of�ji and �ji are shown for iteration j. In Fig. 3, the user atnode 3 has to pay 4, and users at nodes 4 and 5, each pays 6.

By modifying the �ji sent to its children, node i ensuresthat the users at node i receive the transmission but paynothing. To maintain the budget balance, node i makes itschildren and all the nodes in its subtree pay an extraamount, to compensate for the cost of transmission receivedby the users at node i. Node i sends �j

0

i to its childreninstead of �ji . �j

0

i is calculated using the formula�j0

i ¼ ðci þ �jp � njiÞ=ð�

ji � n

jiÞ þ �jp. Essentially, node i divides

the cost of link ci among the users in its subtree, excludingusers residing at i. The users at node i also have to share thecosts of links from p to root, which is �jp. Node i distributesthe share of its users to its descendants by adding �jp � n

ji to

ci and dividing only by the number of descendantsð�ji � n

jiÞ. Thus, node i assigns zero as the cost share to its

resident users. The cost share �j0

i is calculated in such a waythat the budget remains balanced and the root cannot detectthe cheating. Fig. 4 shows how node 3 cheats. The userresiding at node 3 pays nothing, and the users at nodes 4and 5 each pays 8. Thus, each of them pays an extra amountof 2. The total amount overpaid collectively by the twousers at nodes 4 and 5 is 4, compensating for the payment ofthe user at node 3.

Another way nodes can cheat is when a node i sends aninflated value �j

0

i instead of �ji to its parent in the bottom-up


Fig. 3. SH mechanism with nodes executing the mechanism truthfully.

phase. Thus, the cost of the links connecting i to root will beshared among a greater number of (fake) users, reducingthe per-user share at nodes in the tree T ðQÞ � Ti (i.e., nodessharing the links connecting i to root). Node i then sends amanipulated value of �ji to its children and makes them payan extra amount compensating for the reduced share ofother users. In this case, the benefit is received not only bynode i but by all the nodes in subtree T ðQÞ � Ti. As shownin Fig. 5, node 3 sends �j

0

i ¼ 8 to its parents. As a result thepayments of nodes 1 and 2 decrease to �j1 ¼ 1 and �j2 ¼ 3,respectively. Then, node 3 calculates �j

0

3 using formula �j0

i ¼�jp þ ðci þ �jpð�

j0

i � �jiÞÞ=ð�

ji � n

jiÞ and sends this �j

0

i to itschildren. The cheating node assigns just the value �jp to theusers residing at that node. In the example shown in Fig. 5,node 3 sends �j

0

3 ¼ 6:5 to its children, thus making thepayment of its children equal to 8.5 (instead of 6 originally).In addition, it assigns �j3 ¼ 1 to its users and maintains thebudget balance. This technique is especially useful whenthe cheating node wants to benefit the users in the subtreeT ðQÞ � Ti along with its users. In the cases discussed above,the extra amount to be paid by the children of the cheatingnode will be quite small if there are many users in thesubtree Ti; thus, not many child nodes from Ti will drop outdue to this increased extra amount.

There are other ways a node can manipulate themechanism, for example, by sending a very high value of�ji to its children. If �ji is sufficiently high, the utility ofthe users in subtree Ti will be less than their cost share,and thus, they will have to remove themselves from theset of receivers R of the transmission. Node i still receivesthe transmission, but it does not have to send thetransmission further in the multicast tree. Thus, node ican save the upload bandwidth. Here, the node is notacting maliciously but rationally.

We want to detect such cheating and prevent it bypenalizing the nodes who cheat. For this, we require thenodes to sign the messages they send using digitalsignatures. We then use auditing/verification proceduresto detect cheating. Since the SH mechanism is essentially an

iterative mechanism, a node can cheat in any of theiterations. To efficiently detect cheating, signing andauditing should be done for each iteration.

The auditing and enforcement of payments can be doneby a trusted party that can be either a third party or the rootnode itself. The trusted party is assumed to have sufficientmeans (lawful contracts, guarantees, advance payments,etc.) to force a node to pay the penalty due, in case that nodeis found cheating. In our design, we assume that the rootnode is a trusted party that performs the auditing andenforces the payments.

3.3 SH-ANM Mechanism

The proposed SH-ANM mechanism is executed in threephases (Fig. 6). Phase 1 (bottom-up) and Phase 2 (top-down)are executed iteratively until the mechanism stabilizes. Ineach iteration j, in Phase 1, node i receives EKk

½�jk� fromeach children k 2 Ci. Node i calculates

�ji ¼Xta¼1

�jka þ nji ð3Þ

and sends EKi½�ji � to its parent p.

Phase 2 (top-down) is initiated by root sending �jroot ¼ 0to its children. Node i receives EKp

½�jpk�ji � from its parent p.

Here, k is the operator used to denote the concatenation (orgrouping) of two values so that they can be treated as onemessage. Node i then calculates

�ji ¼ci

�ji

!þ �jp ð4Þ

and sends EKi½�jik�

jk� to all its children. The cost share of the

users at node i who receive the transmission is �ji .Phase 3 starts after the mechanism stabilizes. In this phase,

payments are sent by the nodes to root, and auditing is doneby root. Assume that the mechanism stabilizes inm iterations.The payment sent by node i to root is calculated usingpaymenti ¼ �mi � nmi . The root node audits node i with


Fig. 4. Node 3 cheats by sending modified values to its children. Fig. 5. Node 3 cheats by sending modified values to its parent and

children.

probability Pa by asking for a proof of payment. The proof ofpayment of node i is denoted by proofi and composed ofproofi ¼ kms¼1ðnsikEKp

½�spk�si �kEKk1½�sk1�k . . . kEKkt

½�skt �Þ. It isassumed that the root knows the public key of all the nodesthat want to participate in the multicast transmission. Afterreceiving proofi, the root calculates �ji using (3) and �ji using(4) for each iteration j. It then verifies that the paymentreceived from users residing at node i is �mi � nmi . Thiscomputation is referred to as verification of proof. InFig. 6, the process of verifying the proof is denoted by theprimitive verifyðproofiÞ. If the payment received is not equalto�mi � nmi , node ihas to pay a penaltyPi, which is higher thanany possible gain by cheating. To prevent the nodes fromcheating, Pa � Pi should be strictly greater than any gainnode i can obtain by deviating from the specified protocol.This ensures that the nodes do not have incentives to deviatefrom the protocol specification. The maximum amount anode i can gain by cheating, denoted by Gmax

i , is equal to the

sum of ci and the cost of all the links in the subtree rooted at i.This can be written as Gmax

i ¼P

j2Ti cj. If the mechanism isexecuted q times, the penaltyPi for node i can be calculated asPi ¼ q �Gmax

i . Thus, even if node i will be caught once out ofq executions of the mechanism, the penalty will besufficiently high to discourage cheating. If a node i canpresent two different messages signed by node j, then node jhas to pay the penalty Pj, and node i gets a reward (may beequal to Pj).

When the mechanism stabilizes in m rounds, the numberof messages required in SH-ANM is �ðnmþ nÞ, which is alinear increase from that of SH. This increase is due to theextra messages required for auditing by the root node (i.e.,messages used for requesting and sending the proofs).

4 SH-ANM MECHANISM’S PROPERTIES

In this section, we characterize the properties of themechanism proposed in Section 3 and show that userscannot increase their benefit by deviating in any way fromthe proposed mechanism. According to the classicalmechanism design literature, rational users can be givenincentives to truthfully reveal their private values, and thuswe can prevent users from exploiting the system to getunjust benefits. However, even such strategyproof mechan-isms are susceptible to manipulation because the distrib-uted algorithms implementing the mechanisms areexecuted by the rational users themselves. Distributedmechanisms inevitably involve passing of messages be-tween different nodes, which gives a chance to the rationalnodes to manipulate the messages, thereby increasing theirprofit unfairly. A stronger specification known as faithfulspecification proposed in [25] guarantees that the userscannot derive any unfair benefit if the mechanism followsthe specification.

We first present the definitions of strong-communicationcompatibility, strong-algorithm compatibility, and faithfulimplementation. Then, we show that the proposed mechan-ism is a faithful implementation of the original SHmechanism. Finally, we determine the number of crypto-graphic operations involved in SH-ANM.

Definition 4.1 (strong-communication compatibility) [25].

A distributed mechanism is Strong-Communication Compa-tible (Strong-CC) if a participating node cannot obtain ahigher utility by deviating from the suggested message-passingstrategy (independent of its information-revelation andcomputational actions) when the other nodes follow thesuggested specification.

Definition 4.2 (strong-algorithm compatibility) [25]. Adistributed mechanism is Strong-Algorithm Compatible(Strong-AC) if a node cannot obtain a higher utility by deviatingfrom the suggested computational strategy (independent of itsinformation-revelation and message-passing actions) when theother nodes follow the suggested specification.

Definition 4.3 (faithful implementation) [25]. A distributedmechanism specification is a faithful implementation when thecorresponding centralized mechanism is strategyproof andwhen the specification is Strong-CC and Strong-AC.

Theorem 4.1. SH-ANM is a faithful distributed implementationof the SH mechanism.


Fig. 6. SH-ANM: distributed SH mechanism for ANM.

Proof (sketch). In order to prove this, we show that SH-ANMsatisfies the three properties in Definition 4.3:

1. The corresponding centralized mechanism isstrategyproof. SH-ANM is a distributed imple-mentation of the SH mechanism. Since theSH mechanism is group strategyproof [21], whichis a stronger property than strategyproofness,SH-ANM is also strategyproof.

2. The specification is Strong-CC. In all the threephases of SH-ANM, no explicit message passingtakes place, i.e., there is no message M that isreceived by node i, and the same message M issent by node i. We can assume that the linksbetween nodes i and p are logical links, andthere may be physical nodes between two nodeswho relay the message. The messages cannot bechanged, because in all the phases, the messagesare digitally signed by the sending node i. Thus,a node i cannot forge messages from anothernode a. This means that it is not possible fornode i to change the message received fromanother node a, and thus, it has to follow thesuggested message-passing strategy. If a node idoes not send the message it is supposed tosend, the mechanism will not proceed, andnode i will not gain any benefit.

3. The specification is Strong-AC. In Phase 1, a

node i may send a manipulated value of �ji to

its parent p. Similarly, in Phase 2, it may send a

modified value of �ji to its children. However,

in Phase 3, root requests proofi from node i.

proofi is composed of the messages receivedby node i in all iterations, i.e., proofi ¼ kms¼1

ðnsikEKp½�spk�si �kEKk1

½�sk1�k . . . kEKkt

½�skt �Þ. If node i

cheated during Phase 1 or Phase 2, such

cheating will be detected by the root in Phase 3

with probability Pa. This will cause node i to

pay a penalty Pi. The penalty Pi for node i is

chosen as mentioned in Section 3.3 such that it

is strictly greater than any gain node i canachieve by deviating from the protocol. Thus,

the node has no incentive to deviate, and the

mechanism’s specification is Strong-AC.Since all three properties are satisfied, according to

Definition 4.3, SH-ANM is a faithful implementation ofthe SH mechanism. tu

The SH-ANM mechanism uses asymmetric cryptogra-phy for signing the messages and decrypting the messagesreceived from its children and its parent. Here, acryptographic operation is considered to be either encrypt-ing a message by a node using its private key ordecrypting a message using the public key of the nodethat sent the message. The number of cryptographicoperations performed by a node i is 2m � ð1þ jCijÞ, wherem is the number of rounds required by the mechanism tostabilize, and jCij is the number of children of node i. Theroot node has to additionally verify the proofs. Thisrequires 2m � ð1þ jCijÞ operations for checking the prooffrom node i. In the bottom-up phase, a node sends one

value �i to its parent, and in the top-down phase, a nodesends two values �ji and �jk to its children. Since a node hasto encrypt only these values, the size of the message to beencrypted/decrypted is very small. When constructing theproof, a node has to combine all the messages it received,and thus, there is no extra encryption/decryption per-formed at that time.

5 EXPERIMENTAL RESULTS

5.1 Implementation

In order to investigate the performance of the proposedmechanism and the mechanisms presented in Section 2, weimplemented them in a distributed environment. Theprogram implementing each mechanism runs on all thenodes participating in the multicast (including the rootnode). Messages are sent and received by the nodes tocalculate the cost shares, to demand/send proofs, and toexchange control information. For encryption and decryp-tion of messages using public key cryptography (specifi-cally RSA), we rely on the OpenSSL library [44]. It isassumed that the public keys of the child and parent nodesare already available on each node; thus, no key exchangemechanism is employed. The implementation can be easilyintegrated within a multicast application where the selectedcost-sharing mechanism is executed first, and then, themulticast data (e.g., on-demand video) is transmitted.

5.2 Experimental Setup

We deployed the implementation on PlanetLab [40]. Plane-tLab is a platform for developing, deploying, and testingdistributed services in a large-scale distributed environment.We selected nodes randomly from all over the world to obtainrealistic data. The nodes were chosen realistically, keeping inmind their geographical proximity. To conduct our experi-ments, we used different numbers of nodes (7 to 127) andcorrespondingly generated the multicast trees. The multicasttrees we used were complete binary trees, as shown in Fig. 7.Our proposed mechanism is not restricted to use onlycomplete binary trees as multicast trees. It works with any


Fig. 7. The multicast tree with 31 nodes used in the experiments.

type of multicast trees. The choice of a binary tree as amulticast tree in our experiments represents in a sense theworst case configuration where each node has only twochildren. This is because the time required to execute themechanism depends on the depth of the multicast tree. Forthe same number of users, the depth of a complete binary treewill be much greater as compared to that of other trees thathave more than two children per node. Thus, in practice, forthe same number of nodes, the time required for executionwill be much lower as there will be more than two childrenper node, making it more scalable.

In our experiments, the number of users per node wasfixed in certain cases (mentioned below). In other cases, thenumber of users at a node was randomly generated usingthe discrete uniform distribution over the interval [1, 5]. Theutilities of the users were also generated randomly usingthe uniform distribution over the interval [1, 100]. A userdrops out from a node when its cost share is greater than itsutility. A node drops out of the multicast tree if no user onthe node and its subtree are receiving the transmission (i.e.,�i ¼ 0). Unless stated otherwise, the probability of cheatingby nodes is Pc ¼ 0:5, and the probability of checking theproof is Pa ¼ 0:5.

In order to study the convergence and the scalability ofthe mechanisms, we varied the number of users per nodeand also the number of nodes (to vary the depth of themulticast tree). We call a complete execution of a mechan-ism an experiment. Since PlanetLab is a very dynamicenvironment, and one experiment would be insufficient todraw conclusions, we ran 60 experiments for each set ofvalues and reported the average over those experiments.The main data collected for analysis are the time requiredfor each node to execute the mechanism, the number ofrounds required to stabilize (only for SH mechanisms), thenumber of users receiving the transmission, and thepayment received by the root.

5.3 Results

We first analyze the effect of cheating on the existing SH-TPMmechanism. This provides the motivation for our work,which proposes the SH-ANM mechanism that is able to

prevent such cheating. The nodes can cheat in SH-TPM bysending manipulated values to their children, which causesthe cheating nodes to pay less and the children of the cheatingnodes to pay more. We did controlled experiments tocompare the effect of cheating. We used SH-TPM with31 nodes and eight users per node. To investigate theinfluence of Pc on the other nodes, we used five differentvalues, Pc ¼ 0:1; 0.3, 0.5, 0.7 and 0.9. It is important to notehere that only the nodes that have children have incentives tocheat. Thus, only nodes numbered from 2 to 15 situated atdepths 1, 2, and 3 cheated. Since the users at a node pay anamount proportional to the cost of transmission to that node,the average payment increases as the depth of the nodeincreases. In Fig. 8, we present the average payment made bythe nodes located at different depths in the tree. We considerthat the root is at depth 0 and that there are no users located atthe root. We observe that as Pc increases, the payment madeby nodes at depths 1, 2, and 3 decreases, and the paymentmade by nodes at depth 4 increases. This is because of the factthat when a node cheats, the payment made by users of thatnode decreases, while the payment made by users at its childnodes increases to maintain the budget balance. The nodes atdepths 2 and 3 may get an increased payment due to cheatingby their parents. These nodes transfer that payment to theirchildren (because they are also cheating), and thus, the nodesthat get affected and have to pay more are the leaf nodes(nodes at depth 4).

When the cost share of users at a node increases, thechance that users will drop off increases. This is becausetheir utility is less than their cost share. Thus, in Fig. 9, as Pcincreases, the average percentage of users receiving thetransmission increases for nodes at depths 2 and 3 anddecreases for nodes at depth 4 (because of the decrease and,respectively, the increase in their cost shares).

To detect such cheating and punish the nodes, wedeveloped the SH-ANM mechanism, which requires thenodes to sign the messages they send and then uses auditingat the end to detect cheating. To analyze the overheadinduced by the message signing and auditing used in ourproposed mechanism, we compare the time required


Fig. 8. The effect of cheating on the payments in SH-TPM. Fig. 9. The effect of cheating on the number of users receiving the

transmission in SH-TPM.

for execution of all four mechanisms (MC-TPM, MC-ANM,SH-TPM, and SH-ANM). Fig. 10 shows the execution time ofthe four mechanisms at each node for a multicast tree of31 nodes. Since we conducted 60 experiments for eachmechanism and plotted the average execution time, we alsocalculated the standard deviation and standard error of theexecution time. The standard error is plotted as error bars inthe figure. In the case of the MC-TPM and MC-ANMmechanisms, the standard error is very small since they arenot performing several iterations, which usually inducemore variance in the results.

The SH mechanisms require more time than thecorresponding MC mechanisms. This is because theyexecute the bottom-up and top-down phases iteratively,whereas the MC mechanisms execute them only once.ANM mechanisms require more time compared to TPMmechanisms because of the additional messages used forsending and checking the proofs. We observe that the timerequired by SH-ANM is about 15 seconds more than that ofSH-TPM. However, this time is negligible since the overallmulticast transmission, generally a video or audio, takescomparatively much longer time (in the order of minutes orhours). The execution time of SH-ANM decreases as thenumber of users per node increases (as discussed below inreference to Fig. 11). The scenario we consider is when asmaller CDN acts as a node and receives the content fromthe source (bigger content provider) and delivers it to itsusers. In practice, the smaller CDNs will have hundredsand thousands of subscribers, thus reducing the overalltime required for convergence of the mechanism, as well asincreasing the economic benefits (as discussed below inreference to Fig. 13). The total time required by thecryptographic operations (message signing and decrypting)was recorded separately and was found to be negligible (inthe order of 0.1-0.4 seconds) due to short messages and avery small number of cryptographic operations.

To study the effect of the number of users per node onthe convergence of the SH mechanisms, as well as othereconomic properties, we executed the SH-ANM mechanismon 31 nodes, fixing the number of users per node to two,

four, six, and eight in different experiments. The utilitiesand link costs were generated randomly as explained inSection 5.2.

Counterintuitively, the time required for the mechanismto stabilize decreases with the increase in the number ofusers, as shown in Fig. 11. This is because of the interestingeconomics behind the mechanism. The users share the costof each link, and as the number of users increases, the shareper user decreases. Because of this, the mechanismstabilizes quickly and thus takes a smaller number ofrounds and time to converge (as shown in Fig. 13). Fig. 11shows the standard error as the error bars. We observe thatthe standard error also decreases as we increase the numberof users per node.

In order to study the scalability of the SH-ANMmechanism, we conducted another set of experiments byvarying the number of nodes participating in the transmis-sion. For these experiments, we fixed the number of usersper node to eight. As we see in Fig. 12, the time required to


Fig. 10. Execution time of the mechanisms. Fig. 11. SH-ANM: execution time at each node versus number of users

per node.

Fig. 12. SH-ANM: execution time versus number of nodes.

execute the mechanism increases as the number of nodes inthe multicast tree (i.e., the depth of the multicast tree)increases. This happens because the nodes have to send themessages to their parent in the bottom-up phase, startingfrom the leaf nodes, which goes up to the root, and themessage sent from root has to go to the leaf nodes in thetop-down phase. As the depth of the tree increases, thiswhole process takes more time, and thus, the total executiontime increases. The increase in the time is linear to the depthof the tree, and thus, the mechanism is quite scalable.

We also see in Fig. 12 that the average number of roundsrequired to stabilize the mechanism increases with theincrease in the number of nodes. This is quite opposite tothe observation that when the number of users wasincreased, the number of rounds decreased. The reasonfor this is that as the depth increases, the cost share per userincreases, especially for the leaf nodes; thus, more usersdrop off, increasing the number of rounds necessary toconverge. However, we see in Fig. 12 that the increase in theaverage number of rounds is linear to the increase in thenumber of nodes. We also observed that the total number ofusers receiving the transmission decreased, although insig-nificantly, as the number of nodes is increased.

In Fig. 13, we show the average number of roundsrequired to complete the execution of the mechanism withvarying numbers of users per node. The number of roundsis shown on the right vertical axis. We see that the numberof rounds required to converge decreases as we increase thenumber of users per node. Another important consequenceof increasing the number of users is that the total paymentreceived by the mechanism increases, as shown in Fig. 13.This is because as the cost share per user becomes smaller; asmaller number of users drop out from receiving thetransmission. Although the SH mechanism is budgetbalanced, it will not receive the maximum possible paymentif a subtree of the multicast tree does not receive thetransmission. In other words, the root will receive themaximum payment if every subtree of the multicast tree hasat least one user receiving the transmission. This happenswhen there is a small cost share per user, which is obtained

when the number of users is increased, as evident in Fig. 13.In this figure, we plot the ratio of the total payment receivedby the root to the sum of the costs of all links in the tree (notjust those links that are involved in the transmission).

Another interesting property of the SH mechanism isobserved in Fig. 14. In this figure, we present the averagepercentage of users receiving the transmission for all thenodes at a particular depth of the tree. We observe adecrease in the percentage of users receiving the transmis-sion as the depth increases. This is because at the top of thetree, the cost share per user is small due to a small numberof links connecting to the root. Since the cost share is small,more users will be able to receive the transmission, even iftheir utilities are small. As we go toward the leaf nodes, thenumber of links necessary to reach the root increases, andthe cost share increases. This reduces the number of userson the nodes who receive the transmission. We also note inFig. 14 that as the number of users per node is increased, thepercentage of users receiving the transmission increases.This is most significantly observable in the case of leafnodes (at depth 4). As the number of users is increased fromtwo to eight, the average percentage of users who receivethe transmission increases from 25 percent to 85 percent.This is because the cost share per user decreases as thenumber of users per node is increased, and thus, fewerusers drop off.

In the following, we focus on the economic aspects ofour proposed mechanism and the MC and SH mechanismsin general. We have found several interesting results andverified many theoretical results from the experiments withdistributed deployment of these mechanisms. One signifi-cant observation is with regard to the payment received andthe number of users receiving the multicast transmission inthe MC and SH mechanisms. As pointed out earlier, the MCmechanism is not budget balanced and runs a budgetdeficit in most of the cases, which is not a favorableproperty from the content provider’s perspective. Incontrast, the SH mechanism is budget balanced. In Fig. 15,we show the payment received as the percentage of the totalcost of all links. We denote by “MC” the MC-TPMmechanism when the number of users per node is


Fig. 13. SH-ANM: effect of the number of users per node on various

parameters.

Fig. 14. SH-ANM: percentage of users per node receiving transmission.

generated randomly within the interval [1, 5] and by “MC-8” the MC-TPM mechanism with eight users per node. Weuse similar notation for the SH mechanisms. We observe inFig. 15 that the payment received in the case of the MCmechanism is smaller than that in the case of the SHmechanism (for both [1..5] users and eight users per node).MC-8 generated no revenue at all (i.e., all users pay 0),although all of the users received the transmission. Incontrast, SH-8 recovered 100 percent of the cost, and about95 percent of users received the transmission. These resultsshow that from the content provider’s point of view, the SHmechanisms are more beneficial than the MC mechanisms.

6 SUMMARY AND FUTURE WORK

The TPM of distributed implementation assumes that theagents participating in the mechanism will not deviate fromthe distributed implementation. In ANM, the participantsmay deviate, and thus, the existing TPM mechanisms arevulnerable to manipulations. We proposed a distributedcost-sharing Shapley mechanism for ANM (SH-ANM) thatis able to prevent such manipulations. To design themechanism, we used digital signatures for authenticationof messages and auditing by the root node to penalize thecheating nodes. Thus, no node has incentives to cheat. Weproved that the proposed mechanism is a faithful imple-mentation of the original SH mechanism.

We implemented the proposed mechanism in a real-worldenvironment provided by PlanetLab to analyze the overheadinduced by the additional computation and communicationresulting from the authentication and auditing procedures.From the experimental results, we conclude that the SH-ANM mechanism does not induce a significant overhead tothe multicast transmission. We also deployed the existingMC-TPM, MC-ANM, and SH-TPM mechanisms and com-pared their performance with that of SH-ANM.

Our mechanism relies on cryptographic techniques toenforce the nodes to follow the protocol specification. Othermethods, such as using incentives, problem partitioning,

and redundancy, can be used to achieve a faithful execution[25]. This is an interesting avenue for future research, andwe plan to explore it. We also plan to study the convergenceof the Shapley mechanism and develop faithful mechanismsfor other distributed computing problems.

ACKNOWLEDGMENTS

This paper is a revised and extended version of thepreliminary work presented in [45] and [46]. The authorswish to express their thanks to the editor and theanonymous referees for their helpful and constructivesuggestions, which considerably improved the quality ofthe paper. This research was supported in part by USNational Science Foundation (NSF) Grant DGE-0654014.

REFERENCES

[1] A. Dan, D. Sitaram, and P. Shahabuddin, “Scheduling Policies foran On-Demand Video Server with Batching,” Proc. Second ACMInt’l Conf. Multimedia (MULTIMEDIA ’94), pp. 15-23, Oct. 1994.

[2] V.O.K. Li and Z. Zaichen, “Internet Multicast Routing andTransport Control Protocols,” Proc. IEEE, vol. 90, no. 3,pp. 360-391, 2002.

[3] K.C. Almeroth and M.H. Ammar, “The Use of Multicast Deliveryto Provide a Scalable and Interactive Video-on-Demand Service,”IEEE J. Selected Areas in Comm., vol. 14, no. 6, pp. 1110-1122, 1996.

[4] K. Sripanidkulchai, B. Maggs, and H. Zhang, “An Analysis ofLive Streaming Workloads on the Internet,” Proc. Fourth ACMSIGCOMM Conf. Internet Measurement (IMC ’04), pp. 41-54,Oct. 2004.

[5] G. Tan and S.A. Jarvis, “Improving the Fault Resilience of OverlayMulticast for Media Streaming,” IEEE Trans. Parallel and Dis-tributed Systems, vol. 18, no. 6, pp. 721-734, June 2007.

[6] P. Van Mieghem, G. Hooghiemstra, and R. van der Hofstad, “Onthe Efficiency of Multicast,” IEEE/ACM Trans. Networking, vol. 9,no. 6, pp. 719-732, 2001.

[7] V.P. Kompella, J.C. Pasquale, and G.C. Polyzos, “MulticastRouting for Multimedia Communication,” IEEE/ACM Trans.Networking, vol. 1, no. 3, pp. 286-292, 1993.

[8] D. Dolev, O. Mokryn, and Y. Shavitt, “On Multicast Trees:Structure and Size Estimation,” IEEE/ACM Trans. Networking,vol. 14, no. 3, pp. 557-567, 2006.

[9] S. Banerjee, B. Bhattacharjee, and C. Kommareddy, “ScalableApplication Layer Multicast,” Proc. ACM SIGCOMM ’02,pp. 205-217, Aug. 2002.

[10] J. Jannotti, D.K. Gifford, K.L. Johnson, M.F. Kaashoek, and J.W.O’Toole, Jr., “Overcast: Reliable Multicasting with an OverlayNetwork,” Proc. Fourth Symp. Operating Systems Design andImplementation (OSDI ’00), pp. 197-212, Oct. 2000.

[11] Y.-H. Chu, S.G. Rao, and H. Zhang, “A Case for End SystemMulticast,” Proc. ACM SIGMETRICS ’00, pp. 1-12, June 2000.

[12] S. Ratnasamy, M. Handley, R. Karp, and S. Shenker, “Topologi-cally-Aware Overlay Construction and Server Selection,” Proc.IEEE INFOCOM ’02, vol. 3, pp. 1190-1199, June 2002.

[13] N. Laoutaris, G. Smaragdakis, K. Oikonomou, I. Stavrakakis,and A. Bestavros, “Distributed Placement of Service Facilities inLarge-Scale Networks,” Proc. IEEE INFOCOM ’07, pp. 2144-2152,May 2007.

[14] S. Deering and D.R. Cheriton, “Multicast Routing in DatagramInternetworks and Extended LANs,” ACM Trans. ComputerSystems, vol. 8, no. 2, pp. 85-110, 1990.

[15] C. Yi, X. Yuan, and K. Nahrstedt, “Optimal Resource Allocation inOverlay Multicast,” IEEE Trans. Parallel and Distributed Systems,vol. 17, no. 8, pp. 808-823, Aug. 2006.

[16] C. Huang, J. Li, and K.W. Ross, “Can Internet Video-on-DemandBe Profitable?” Proc. IEEE INFOCOM ’07, pp. 2144-2152, May 2007.

[17] N. Nisan and A. Ronen, “Algorithmic Mechanism Design,” Gamesand Economic Behaviour, vol. 35, nos. 1/2, pp. 166-196, Apr. 2001.

[18] J. Feigenbaum and S. Shenker, “Distributed AlgorithmicMechanism Design: Recent Results and Future Directions,” Proc.Sixth ACM Workshop Discrete Algorithms and Methods for MobileComputing and Comm. (DIALM ’02), pp. 1-13, Sept. 2002.


Fig. 15. Payment received and the number of users receiving the

transmission in MC-TPM and SH-TPM mechanisms.

[19] A. Mas-Colell, M.D. Whinston, and J.R. Green, MicroeconomicTheory. Oxford Univ. Press, 1995.

[20] J. Feigenbaum, C. Papadimitriou, and S. Shenker, “Sharing theCost of Multicast Transmissions,” J. Computer and System Sciences,vol. 63, no. 1, pp. 21-41, Aug. 2001.

[21] H. Moulin and S. Shenker, “Strategyproof Sharing of SubmodularCosts: Budget Balance versus Efficiency,” J. Economic Theory,vol. 18, no. 3, pp. 511-533, 2001.

[22] J. Green, E. Kohlberg, and J. Laffont, “Partial EquilibriumApproach to the Free-Rider Problem,” J. Public Economics, vol. 6,no. 4, pp. 375-394, 1976.

[23] J. Feigenbaum, A. Krishnamurthy, R. Sami, and S. Shenker,“Approximation and Collusion in Multicast Cost Sharing,” Proc.Fourth ACM Conf. Electronic Commerce (EC ’03), p. 280, June 2003.

[24] J. Feigenbaum, A. Krishnamurthy, R. Sami, and S. Shenker,“Hardness Results for Multicast Cost Sharing,” TheoreticalComputer Science, vol. 304, nos. 1-3, pp. 215-236, 2003.

[25] J. Shneidman and D.C. Parkes, “Specification Faithfulness inNetworks with Rational Nodes,” Proc. 23rd Ann. ACM Symp.Principles of Distributed Computing (PODC ’04), pp. 88-97, July 2004.

[26] L. Lao, J.H. Cui, M. Gerla, and S. Chen, “A Scalable OverlayMulticast Architecture for Large-Scale Applications,” IEEE Trans.Parallel and Distributed Systems, vol. 18, no. 4, pp. 449-459, Apr.2007.

[27] S. Banerjee, C. Kommareddy, K. Kar, B. Bhattacharjee, andS. Khuller, “Omni: An Efficient Overlay Multicast Infrastructurefor Real-Time Applications,” Computer Networks, vol. 50, no. 6,pp. 826-841, 2006.

[28] Y. Chawathe, “Scattercast: An Adaptable Broadcast DistributionFramework,” Multimedia Systems, vol. 9, no. 1, pp. 104-118, 2003.

[29] E.I. Lin, A.M. Eskicioglu, R.L. Lagendijk, and E.J. Delp, “Advancesin Digital Video Content Protection,” Proc. IEEE, vol. 93, no. 1,pp. 171-183, 2005.

[30] S. Rafaeli and D. Hutchison, “A Survey of Key Management forSecure Group Communication,” ACM Computing Surveys, vol. 35,no. 3, pp. 309-329, 2003.

[31] S. Deering, D.L. Estrin, D. Farinacci, V. Jacobson, L. Ching-Gung,and W. Liming, “The PIM Architecture for Wide-Area MulticastRouting,” IEEE/ACM Trans. Networking, vol. 4, no. 2, pp. 153-162,1996.

[32] T.E. Carroll and D. Grosu, “Distributed Algorithmic MechanismDesign for Scheduling on Unrelated Machines,” Proc. Eighth Int’lSymp. Parallel Architectures, Algorithms, and Networks (I-SPAN ’05),pp. 194-199, Dec. 2005.

[33] T.E. Carroll and D. Grosu, “A Strategyproof Mechanism forScheduling Divisible Loads in Tree Networks,” Proc. 20thIEEE Int’l Parallel and Distributed Processing Symp. (IPDPS ’06),Apr. 2006.

[34] J. Shneidman, D.C. Parkes, and L. Massoulie, “Faithfulness inInternet Algorithms,” Proc. ACM SIGCOMM Workshop Practice andTheory of Incentives in Networked Systems (PINS ’04), pp. 220-227,Sept. 2004.

[35] S. Shakkottai and R. Srikant, “Economics of Network Pricingwith Multiple ISPs,” IEEE/ACM Trans. Networking, vol. 14, no. 6,pp. 1233-1245, 2006.

[36] J. MacKie-Mason and H. Varian Pricing the Internet, Public Accessto the Internet, pp. 269-314. MIT Press, 1995.

[37] S. Herzog, S. Shenker, and D. Estrin, “Sharing the “Cost” ofMulticast Trees: An Axiomatic Analysis,” IEEE/ACM Trans.Networking, vol. 5, no. 6, pp. 847-860, 1997.

[38] J. Mitchell and V. Teague, “Autonomous Nodes and DistributedMechanisms,” Software Security—Theories and Systems. Mext-NSF-JSPS Int’l Symp. (ISSS ’02), pp. 58-83, 2003.

[39] S. Gorinsky, S. Jain, H. Vin, and Z. Yongguang, “Design ofMulticast Protocols Robust against Inflated Subscription,” IEEE/ACM Trans. Networking, vol. 14, no. 2, pp. 249-262, 2006.

[40] PlanetLab, http://www.planet-lab.org, 2008.[41] S. Siachalou and L. Georgiadis, “Algorithms for Precomputing

Constrained Widest Paths and Multicast Trees,” IEEE/ACM Trans.Networking, vol. 13, no. 5, pp. 1174-1187, 2005.

[42] S. Ramanathan, “Multicast Tree Generation in Networks withAsymmetric Links,” IEEE/ACM Trans. Networking, vol. 4, no. 4,pp. 558-568, 1996.

[43] L.S. Shapley, “A Value for N-Person Games,” Contribution to theTheory of Games, vol. 2, Princeton Univ. Press, pp. 31-40, 1953.

[44] OpenSSL, http://www.openssl.org, 2008.

[45] N. Garg and D. Grosu, “Faithful Distributed Shapley Mechanismsfor Sharing the Cost of Multicast Transmissions,” Proc. 12th IEEESymp. Computers and Comm. (ISCC ’07), pp. 741-747, July 2007.

[46] N. Garg and D. Grosu, “Performance Evaluation of Multicast CostSharing Mechanisms,” Proc. 21st IEEE Int’l Conf. AdvancedInformation Networking and Applications (AINA ’07), pp. 901-908,May 2007.

Nandan Garg received the bachelor’s degreein computer applications from Devi AhilyaVishwavidyalaya, Indore, India, and the mas-ter’s degree in computer applications from RajivGandhi Technical University, Bhopal, India. Heis currently a PhD candidate in the Departmentof Computer Science, Wayne State University,Detroit. His research interests include incentive-based computing, game theory and mechanismdesign, distributed systems, security, and par-

allel processing. He is a student member of the IEEE.

Daniel Grosu received the diploma in engineer-ing (automatic control and industrial informatics)from the Technical University of Iasi, Romania,in 1994 and the MSc and PhD degrees incomputer science from the University of Texasat San Antonio in 2002 and 2003, respectively.Currently, he is an assistant professor in theDepartment of Computer Science, Wayne StateUniversity, Detroit. His research interests in-clude distributed systems and algorithms, re-

source allocation, computer security, and topics at the border ofcomputer science, game theory, and economics. He has publishedmore than 50 peer-reviewed papers in the above areas. He has servedon the program and steering committees of several internationalmeetings in parallel and distributed computing. He is a member of theACM and a senior member of the IEEE and the IEEE Computer Society.

. For more information on this or any other computing topic,please visit our Digital Library at www.computer.org/publications/dlib.


Technology

A faithful distributed mechanism for sharing the cost of multicast transmissions