Reliable Local Broadcast in a Wireless Network Prone to Byzantine Failures

Transcription

1 Reliable Local Broadcat in a Wirele Network Prone to Byzantine Failure ABSTRACT Vartika Bhandari Dept. of Computer Science, and Coordinated Science Laboratory Univerity of Illinoi at Urbana-Champaign vbhandar@uiuc.edu Reliable broadcat can be a very ueful primitive for many ditributed application, epecially in the context of enoractuator network. Recently, the iue of reliable broadcat ha been addreed in the context of the radio network model that i characterized by a hared channel, and where a tranmiion i heard by all node within the ender neighborhood. Thi baic defining feature of the radio network model can be termed a the reliable local broadcat aumption. However, in actuality, wirele network do not exhibit uch perfect and predictable behavior. Thu any attempt at ditributed protocol deign for multi-hop wirele network baed on the idealized radio network model require the availability of a reliable local broadcat primitive that can provide guarantee of uch idealized behavior. We preent a imple proof-of-concept approach toward the implementation of a reliable local broadcat primitive with probabilitic guarantee, with the intent to highlight the potential for lightweight calable olution to achieve probabilitic reliable local broadcat in a wirele network. Categorie and Subject Decriptor C.2.1 [Computer Communication Network]: Network Architecture and Deign Wirele communication; C.2.4 [Computer-Communication Network]: Ditributed Sytem; C.4 [Performance of Sytem]: Fault Tolerance General Term Algorithm, Reliability Keyword Wirele Network, Byzantine failure, Local Broadcat, Fault Tolerance Thi reearch wa upported in part by the National Science Foundation, US Army Reearch Office grant W911NF , and a Vodafone Graduate Fellowhip. Permiion to make digital or hard copie of all or part of thi work for peronal or claroom ue i granted without fee provided that copie are not made or ditributed for profit or commercial advantage and that copie bear thi notice and the full citation on the firt page. To copy otherwie, to republih, to pot on erver or to reditribute to lit, require prior pecific permiion and/or a fee. Copyright 200X ACM X-XXXXX-XX-X/XX/XX...$5.00. Nitin H. Vaidya Dept. of Electrical and Computer Eng., and Coordinated Science Laboratory Univerity of Illinoi at Urbana-Champaign nhv@uiuc.edu 1. INTRODUCTION A deployment and ue of wirele network for variou role, ranging from community meh network to enor network, become increaingly common, the reliability of communication in thee network i of growing concern. Reliable communication in wirele network i fairly non-trivial, in large part due to ignificant time-variation in channel quality and the poibility of interference/colliion becaue of the hared nature of the medium. One of the iue in thi regard i that of achieving reliable broadcat in a wirele network, given that ome node may exhibit Byzantine failure. The ability to perform thi operation can be extremely ueful, epecially in the context of enor-actuator network, where node may need to perform ome coordinated action baed on a conitent view of event ened by individual node. Recent theoretical work on Byzantine fault-tolerant broadcat in radio network [11], [1], [2], [3] aume that if a node tranmit a meage it i received by each and every node within a deignated neighborhood in it patial vicinity. Thi eliminate the potential for duplicity and enure local agreement a follow: when the ender i non-faulty, agreement i trivial, ince all non-faulty neighbor of a nonfaulty ender receive the meage directly. If the ender i faulty and end multiple conflicting copie of the meage, all non-faulty neighbor receive all meage in the ame order, and can agree on one (ay the firt). While thi model reflect the hared nature of the wirele medium, it fail to capture it unreliability. The wirele medium can be extremely unreliable, and how highly variable channel quality over time, due to factor uch a fading. Thi lead to ignificant fluctuation in received ignal, and hence there i a non-negligible probability of unucceful reception, even in the abence of maliciou colliion-cauing behavior. Thu, any attempt at deigning reliable broadcat protocol baed on theoretical radio network reult mut begin with an effort to implement a reliable local broadcat primitive in a calable manner. One might enviion implementing local broadcat by running a point-to-point Byzantine agreement protocol, with retranmiion over every loy (point-to-point) link to handle channel error. However, uch a olution lack calability, a the underlying medium i hared and thu the operation of nearby (point-to-point) link mut be erialized. While the iue of reliable broadcat and conenu in the preence of a bounded number of colliion/poofing ha been addreed in previou work, uch a [12] and [9], probabilitic channel loe have not been factored in. Random

2 tranient Byzantine failure that include colliion-cauing i examined in [19]. Though alo of a probabilitic nature, their model i different in that node either fail to tranmit, tranmit a wrong value or tranmit out of turn, with a certain probability, in each round. In thi work we addre channel unreliability, while auming fault-free phyical(phy) and medium-acce control(mac) layer (i.e., node do not deliberately caue colliion or poof MAC addree). We decribe a imple proofof-concept approach toward implementing reliable local broadcat with probabilitic guarantee in a local broadcat domain. We alo briefly dicu how the propoed reliable local broadcat olution can be optimized further, and alo be ued a a ub-protocol in a global broadcat algorithm for multi-hop network. Our primary intent in thi paper i to highlight the potential for lighweight calable olution to achieve probabilitic reliable local broadcat in the face of a loy wirele channel, by exploiting looe ynchronization between the clock of nearby node. 2. RELATED WORK Since the eminal reult of Peae, Shotak and Lamport [17], [14], there ha been much work on Byzantine agreement. In recent time, there ha been a focu on agreement/conenu problem in broadcat/multicat channel. Such model can be ueful for reaoning about wirele network. Byzantine agreement in k-cat channel ha been conidered in [8]. However thi model i not directly relevant to wirele network. a it doe not capture the patially dependent connectivity that characterize thee network. Reliable broadcat in radio network deployed a an infinite regular grid wa tudied in [11]. A locally-bounded fault model wa propoed wherein an adverary wa allowed to place fault ubject to the contraint that no neighborhood have more than t fault. It wa hown that under a Byzantine failure model, reliable broadcat i not achievable for t 1 r(2r + 1) in the L metric. Thi wa later etablihed a an exact threhold for the L metric in [1]. Ad- 2 ditionally, an approximate threhold wa etablihed for the L 2 metric. In [18], locally bounded fault were tudied in arbitrary graph. While the dicuion mention both radio and meagepaing network, there i an aumption that duplicity (ending different meage to different neighbor) i impoible, which eem to tem from the radio network model. Upper and lower bound for achievability of reliable broadcat were preented, baed on graph-theoretic parameter, for arbitrary graph. Probabilitic tranient failure were conidered in [19] which examine the cae of both meage-paing and radio network. The conidered model aume arbitrary graph topologie. Probabilitic permanent Byzantine failure were examined in [3], [4]. Two network model were conidered: a regular grid and a randomly deployed network. Neceary and ufficient condition were etablihed for the critical tranmiion range (and hence node degree) to tolerate failure probabilitie trictly le than 1. 2 The cae of an adverary capable of cauing a bounded number of colliion in an infinite (or finite-toroidal) grid network wa conidered in [12], and it wa hown that the ability to caue a bounded number of colliion or addrepoofing doe not yield the adverary any additional power in thwarting broadcat, i.e., the tolerable fault threhold remain the ame a for the no-colliion cae of [11] and [1]. However thi reult i baed on the aumption that nonfaulty node are not hindered by energy-limitation, and can retranmit meage a many time a needed. The impact of an energy-budget on conenu wa tudied for a ingle-hop etting in [9], and it wa proved that non-faulty node would require at leat incrementally larger budget than faulty node to arrive at a conenu. The tranient failure behavior aumed in [19] alo include the poibility of node cauing colliion. Much of the theoretical work mentioned earlier aume that the wirele channel itelf i perfectly reliable. The random loy nature of the channel i not accounted for, and thu many of thee reult are not directly applicable to a real-world cenario. A propoal to reconcile the theory and practice of wirele broadcat ha been made in [6]. They identify certain propertie that a reliable local broadcat hould have. They introduce ome model to capture the nature of loe and colliion, viz., the No-Colliion(NC) model, the Eventual No-Colliion (ENC) model, the Total Colliion (TC) model, and the Partial Colliion (PC) Model. Of thee the TC-model mot cloely reemble the reliable local broadcat aumption, in that if a meage i received by one recipient, then it i received by all recipient. It wa hown in [6] that in a ingle-hop network conforming to the TC-model conenu i achievable with any number of Byzantine/crah-top failure. Thi i akin to the trivial local agreement property of the reliable local broadcat aumption. However, practical realization of the TC model i not delved into in detail in [6] (though they mention the poibility of uing ignal-jamming technique to achieve TC propertie). On a related note, conenu in ingle-hop wirele network with crah-prone node i conidered in [7]. Alo relevant to our work i the notion of reliable multicat with probabilitic guarantee [5], [15] which alo eek to achieve a calable olution with probabilitic guarantee. 3. HOW A LOSSY WIRELESS CHANNEL INHIBITS RELIABLE LOCAL BROAD- CAST In thi ection we briefly dicu how an unreliable wirele channel can affect the achievability of reliable local broadcat. Conider a ource that originate a meage, which need to be locally broadcat to it neighbor. However, a the channel i loy, each neighbor uccefully receive the meage only with a certain probability. Reultantly, it i poible that a tranmiion may only be heard by ome ubet of neighbor. If were non-faulty, thi iue i readily reolved by having retranmit the meage ufficient time to enure that each neighbor receive at leat one copy with high probability (w.h.p.). However conider what might tranpire if i faulty, and eek to leverage the channel unreliability to create confuion amongt it neighbor. Suppoe that initially ent a meage m with value 0. Some of it neighbor do not receive it, i.e., it i received by ome ubet N 1 of neighbor. It then end another copy of the ame meage, containing a value 1. Thi meage i received by ome ubet N 2. If N 1 N 2 i non-empty, there are certain node that will aume that ent only one value,

3 i.e., 0. If N 2 N 1 i non-empty, there are certain node that will aume that ent only one value, i.e., 1. Node in N 1 N 2 receive both value, and are in a poition to detect duplicity. Thee node can chooe a default value, e.g., the firt value ent by. However, there till remain the iue of enuring that the other node do the ame. One approach might conit in the raiing of an alarm by node in N 1 N 2, but would require a mean for the other node to reolve whether the alarm() are to be truted. Thu, one may prefer to have a more lightweight approach to enure agreement of all node on a common value (and potentially rely on the fact that after a number of duplicitou tranmiion by, all node would at ome time detect it duplicity themelve, and could be univerally identified a untrutworthy). 4. CAUSAL ORDERING AND PHYSICAL CLOCKS In thi ection, we briefly review notion of clock and ordering that are relevant to the dicuion in thi paper. We aume the exitence of ome frame of reference external to the ytem. The phyical time in thi frame of reference i conidered to be an abolute meaure of phyical time, for the purpoe of our dicuion. Thu at time intant t, the external clock value i t. Each node u in the ytem ha it own phyical clock. The clock value of a node u at time intant t i denoted by C u(t). When we refer to external ynchronization within bound D, we imply ynchronization to thi ideal external clock within bound D, i.e., at each time intant t: C u(t) t D. Clock drift i modeled a being linear, i.e., if the true time elaped i T, the oberved elaped time lie in the range [(1 δ)t, (1 + δ)t], where δ i the drift per unit time (alo referred to a drift-rate). When we refer to internal ynchronization within bound D, we imply that at any time intant t, the clock of two internally ynchronized node u, w atify: C u(t) C w(t) D. When we refer to a node adjuting it clock, we imply that the node applie a correction to it clock value. In hi eminal paper [13], Lamport propoed that the key goal in a ditributed ytem hould be to enure that caual relationhip are repected. Thi cauality could be captured in a happened-before relation, which impoe a partial order on ytem event. Thu a b implie that a happened-before b, and b may be caually affected by a. Let C(a) denote the time oberved for an event a a per a clock C. A atifactory clock C mut then atify the following: Clock Condition [13]. For any event a, b: a b = C(a) < C(b). To thi effect, Lamport logical clock were propoed in [13]. An anomalou cenario wa alo conidered whereby out-of-ytem meage exchange could lead to violation of the Clock Condition. Thu one might conider a Strong Clock Condition whereby caual ordering i preerved even taking into account out-of-ytem meage. It wa oberved in [13] that if clock drift rate δ, maximum clock kew (or ynchronization bound) D and minimum meage tranmiion D 1 δ time T l atify the relation: T l, then the ytem of phyical clock atifie the Strong Clock Condition. It wa alo hown that a imple ynchronization algorithm uffice to enure that clock kew i bounded by a uitable D. The notion of leveraging phyical clock rather than logical clock ha wider ignificance. Conider a ytem where ome procee may exhibit Byzantine behavior. Then their logical clock value cannot be truted, and they may affix incorrect logical clock value to meage they end, in order to taint the logical clock of other procee. If one could enure that the phyical clock of non-faulty node atify certain ordering condition, thi could be quite beneficial. A imilar intuition underlie our approach toward reliable local broadcat. 5. LOOSE SYNCHRONIZATION AND LO- CAL BROADCAST In thi ection we decribe the baic aumption and approach behind leveraging the exitence of looe ynchronization to facilitate a certain ordering condition between locally broadcat meage. In Section 6, we dicu how the ordering condition can be realized in a wirele network, and ubequently decribe in Section 7 how it i leveraged to achieve reliable local broadcat with probabilitic guarantee. Conider a ytem compriing a node v that i intereted in ending meage, and a et of other node (neighbor of v) capable of receiving meage from v over a hared broadcat medium. Each node i equipped with a ingle half-duplex tranceiver. Thu no node can end and receive meage imultaneouly, and only one meage can be uccefully tranmitted or received at a time by a node. Note that thi i a reaonable model for wirele node equipped with a ingle half-duplex tranceiver and an omnidirectional antenna, and operating on a ingle common channel. Receive-Timetamp. A node i aumed capable of noting it local phyical clock value jut after it finihe receiving a meage (thi i a reaonable aumption; uch a timetamping operation could be implemented in hardware). Thi i termed a the receive-timetamp oberved by the node for the meage. The meage ent in thi ytem have the following property: the minimum (abolute) time the packet tranmiion occupie the channel i T l, and the actual total (abolute) time taken by a meage in tranit (between the time the ending node phyical layer tart ending the meage, and the time the receiving node finihe receiving and take it receive-timetamp) i upper-bounded by T u. Hence T u T l ubume the maximum propagation delay and upper bound on any proceing delay incurred upto the time of taking the timetamp. Thu, the (abolute) time T taken by a meage in tranit from ender to receiver (between timetamping) atifie T l T T u. Note that thi condition i atified by all meage including thoe ent by faulty node. We explain in Section 6 why thi i a reaonable aumption. We define the following condition: Receipt-Order Condition. If a node v end a meage m 1, followed by a meage m 2, then for all non-faulty node u, w (in v neighborhood): the receive-timetamp oberved by u for m 2 i greater than the receive-timetamp oberved by w for m 1. We identify two ituation in which the Receipt-Order Condition hold. The firt one relie on aumption about

4 external clock ynchronization, and the econd one relie on aumption about internal clock ynchronization. Obervation 1. (Externally Synchronized Node) If the phyical clock of all non-faulty node in the ytem are externally ynchronized within bound D, and if 2T l T u > 2D, then the local phyical timetamp oberved by the non-faulty neighbor of v for meage ent by v atify the Receipt- Order Condition. Proof. Suppoe the ender tart ending the two meage m 1, m 2 at time t 1 and t 2 repectively (according to the ideal external clock). Then thoe non-faulty neighbor of v that received m 1 would have received it within the interval (t 1 +T l, t 1 +T u] (a per the external clock), and their oberved receive-timetamp would lie in the range (t 1 +T l D, t 1+T u+d]. Similarly, the oberved receive-timetamp for the econd meage m 2 fall within (t 2+T l D, t 2+T u+d]. Since the two meage are ent by v on the ame medium, they are temporally ordered and eparated in time i.e. t 2 t 1 + T l. Thu (t 2 + T l D) (t 1 + T u + D) = t 2 t 1 T u + T l 2D 2T l 2D T u > 0. Hence, any non-faulty node that receive the firt meage oberve a receive-timetamp that i le than the receive-timetamp for the econd meage oberved by thoe non-faulty node that ee the econd meage. Hence the Receipt-Order Condition hold. Obervation 2. (Internally Synchronized Node) Conider an interval of time in the ytem in which no non-faulty node adjut it phyical clock, the phyical clock of all nonfaulty node tay internally ynchronized within bound D, and drift-rate i upper-bounded by δ. We are intereted in meage ent and received entirely during thi interval. If 2T l T u δ(2t l + T u) > D, then the local phyical timetamp oberved by the non-faulty neighbor of v for meage ent by v atify the Receipt-Order Condition. Proof. The argument i almot the ame a that ued in [13] to argue that a ytem of phyical clock can be made to atify the Strong Clock Condition, except that we now apply it in the context of a broadcat medium with multiple recipient of the ame meage. Denote by E v(m), the event of node v ending meage m, and by C u(e v(m)) the local phyical clock time at ome nonfaulty node u, at the time v tarted the tranmiion. Note that thi doe not imply that node u i aware of the intant at which tranmiion tarted. u may only detect the tranmiion after ome minimum propagation delay. Denote by E r u(m), the event of node u receiving meage m, and by C u(e r u(m)), the receive-timetamp oberved by node u for a meage m received by it (recall that receive timetamp are recorded when the reception ha finihed). Suppoe a node v tart ending a meage m 1 at a time when local time at ome non-faulty neighbor u i C u(e v(m 1)). Thu, from the aumption that clock are internally ynchronized within bound D, the local time at any other nonfaulty neighbor w mut be C w(e v(m 1)) C u(e v(m 1)) + D, and w will oberve a receive-timetamp C w(e r w(m 1)) C w(e v(m 1)) + T u(1 + δ) (C u(e v(m 1)) + D) + T u(1 + δ). If v later tart ending a meage m 2 when local-time at u i C u(e v(m 2)), then C u(e v(m 2)) C u(e v(m 1)) T l (1 δ). Thu the receive-timetamp u oberve for m 2 i at leat C u(e r u(m 2)) C u(e v(m 2)) + T l (1 δ) C u(e v(m 1)) + 2T l (1 δ). Thu, for u and any other non-faulty node w: C u(e r u(m 2)) C u(e v(m 1)) + 2T l (1 δ) = (C u(e v(m 1)) + D+T u(1+δ)) T u(1+δ) D+2T l (1 δ) C w(e r w(m 1))+ (2T l (1 δ) T u(1 + δ) D) = C w(e r w(m 1)) + (2T l T u δ(2t l + T u) D) > C w(e r w(m 1)). Thu the Receipt-Order Condition i atified. 6. NETWORK MODEL Conider a wirele multi-hop network. For the purpoe of our dicuion, we focu on a local broadcat domain within the wirele network, compriing a ender node and node within it tranmiion-range, denoted by nbd() ( i not included in nbd()), to which we wih to enure reliable local broadcat delivery. We denote nbd() by d, and define d o = nbd(x) nbd(). Thu do i the minimum number of min x nbd() common neighbor of and any of it neighbor. 6.1 Fault Model We aume the locally bounded fault model conidered in [11], [1], [18] etc., wherein an adverary may place fault o long a the number of fault in any ingle neighborhood doe not exceed a pecified number b. Faulty node can exhibit Byzantine behavior at higher layer, i.e., they may change the value/emantic of meage. However all PHY/MAC layer are non-faulty and thu faulty node do not deliberately caue colliion or poof MAC addree. Thi i a reaonable aumption in ituation where higher-layer or application code i much more prone to corruption or compromie. 6.2 Communication Model We allow for an unreliable wirele channel where fading and other effect may lead to non-ideal tranmiion characteritic. Accidental colliion and interference are poible, due to an imperfect medium acce mechanim. If a node tranmit a meage, the probability that a neighbor uccefully receive it i p. Packet error due to fading, or accidental interference etc. are ubumed in the error probability (1 p ). The probability of ucceful reception p i aumed independent though identical for each tranmiion and each receiving node. A deired acce probability 0 < p a < 1, and an accordingly large enough timeout T a are choen, uch that if a packet wa put into a node outgoing queue at time t, then with probability at leat p a, by time t + T a, the packet get a chance to be tranmitted by thi node and received by neighbor. Both p and p a are aumed independent of d, d o. Note that T a i a function of the target acce probability p a, a well a the length of packet-queue. All node poe a ingle half-duplex tranceiver with an omnidirectional antenna, and operate on a ingle channel. They alo ue a ingle tranmiion rate 1, and all valid meage are of a predetermined (and equal) ize (a dicued later, thi can be choen to facilitate reliable local broadcat). Note that the ue of a common tranmiion rate r bit/ec and a common meage ize l bit enure that all meage occupy a certain minimum time T l l on the r 1 Even in a multi-rate wirele network, it i poible to tipulate a part of the protocol pecification that all node ue a pecific rate (ay the lowet) for critical meage type that require reliable diemination.

5 channel. Thi extend to meage ent by faulty node, becaue non-faulty node can chooe to ignore meage that do not conform to the rate/ize pecification, giving faulty node no incentive to deviate from thi etablihed behavior. max The maximum and minimum propagation delay are d prop and d min prop repectively (note that d min prop > 0). Any additional delay in phyical-layer timetamping are upperbounded by t delay, yielding a maximum delay bound of T d = d max prop + t delay. Thu T u = T l + T d. For the ret of our dicuion, we aume that node are externally ynchronized within bound D, o that we may leverage Obervation 1. We eek to enure that the condition of Obervation 1 from Section 5 are atified. Thu we want 2T l T u = T l T d > D, or T l > D + T d. Since T d i independent of T l, thi i alway achievable (albeit at the expene of inefficient bandwidth uage) by padding all meage with extra bit to achieve the deired packetize l (and hence T l ) for the pecified tranmiion rate r. Thu the Receipt-Order Condition can be made to hold. We now provide a brief decription of meage repreentation. In order to ditinguih between different meage, ditinct meage ent by a particular ource (originator) are ditinguihed via identifier, that we hall denote a id. The id i a number in ome range [0, MAX], where MAX i a uitably large number. Individual node chooe the equence of id for their meage in ome privately determined peudorandom manner (uch that id are re-ued only after large interval of time; thu identifier may be conidered unique for all practical purpoe). Thi enure that node have no eay way of anticipating what the equence of id for a given ource node will be. If a node end two conflicting verion of the ame meage, it implie that they both have the ame id, but different value. Original meage are repreented a m(rc, (id, value)). Of thee, the rc field i obtained from the MAC header, and thu contain the true MAC addre of the node that put the packet on air. The (id, value) part i meagecontent. If a meage m i relayed (repeated) by a neighbor, it i repreented a REP EAT(relay rc, (m, timetamp)). Once again, relay rc i the MAC addre of the relay node, obtained from the MAC header. The (m, timetamp) part i meage-content (m denote the (rc, (id, value)) information for the meage; however a thi i now part of meage content, a faulty relay node can modify the rc information if it o chooe, though it cannot affect the correctne of the relay rc field in the MAC header). 7. THE ALGORITHM The goal of the algorithm i to achieve the following agreement condition with high probability (w.h.p.): Agreement Condition. If a local broadcat ource end a meage, then all it non-faulty neighbor hould agree on a ingle value for thi meage. If i non-faulty, thi agreedupon value hould be the one actually ent by. If i faulty and end multiple conflicting verion of the meage, the protocol i deigned to enable node to chooe the firt value that ent. For the ake of implicity and without lo of generality (w.l.o.g.), we aume that the meage m may take one of two value 0 or 1. The algorithm can however be eaily generalized to more than two meage value. Suppoe we have ender. Each other node u follow the following algorithm: On receipt of a meage m(, (i, p)) from directly with (local) receive-timetamp t: If no other earlier verion of thi meage (i.e., of the form m(, (i, q))) wa received directly from, make note of p a a candidate meage value, and re-broadcat a copy of m a REP EAT(u, (m(, i, p), t)). If an earlier verion of the ame meage wa received directly from, dicard thi meage. On receipt of a meage REPEAT(v, (m(, i, p), t v)): If no previou REPEAT(v, m(, i, ), ) 2 ha been received, make note of p a a candidate for meage-id i from, reported by v with timetamp t v. Keep track of all uch copie of m received via REPEAT meage from different repeater along with their reported timetamp. If thi wa the firt meage having the form REPEAT(, m(, i, ), ) received by the node, tart a timer (tagged by (, i)) to expire after a duration T+T u (where T = T a + T r, T a being the pre-defined acce timeout, and T r being an etimated upper bound on proceing time from receiving a meage m to time of generating a REPEAT and enqueueing it in the outgoing packet queue). On expiration of the timer for (, i): Perform a filtration procedure on the received REP EAT meage containing repeated meage of the form m(, (i, )), and determine the value of m for which the highet number of repeated copie were received. Commit to thi meage value. Timetamp-baed filtration and majority determination: The filtration and majority determination involve application of the following procedure: Let u refer to the value with highet repeated copy count a c 1, and the other one a c 2. If the number of copie of c 2 i le than or equal to b, chooe c 1 a the correct value. If the number of copie of c 2 i greater than b: dicard any meage with value c 1 whoe timetamp t i greater than the timetamp of more than b copie of c 2. Commit to the majority value from amongt the remaining copie of c 1 and c 2. Theorem 1. Conider a local broadcat domain in the wirele network compriing {} nbd() for ome node. Aume that the phyical clock of all non-faulty node at- ify the Receipt-Order Condition. If at mot b = 1+ d o node in any ingle neighborhood are faulty (where p ap 2 ǫ, and ǫ > 0 i a contant), then the above algorithm enure that all non-faulty neighbor of v hall be able to achieve the previouly decribed agreement condition for v meage with error probability at mot dexp( (1 pap 2 ) 2 p ap 2 do ), which i mall if d o i large, and d o >> ln d. Proof. There are two cae: i non-faulty or i faulty: 2 i a placeholder for any value.

6 i non-faulty: tranmit exactly one verion of the meage (call it m 1 = m(, (i, q m1 ))). Since any u nbd() ha at mot b faulty node in nbd(u), it may receive up to a maximum of b puriou repeat of meage. If the number of REPEAT copie of the meage received from non-faulty node (and thu containing the correct value) i greater than b, thi uffice to ditinguih the legitimate value from a puriou one. i faulty: If i faulty, it may leverage the unreliability of the channel, and attempt to create confuion by ending more than one verion of the meage, each containing different value. We how that depite thi, under the aumed condition, reliable broadcat will till be achieved. By aumption, the phyical clock of all non-faulty node atify the Receipt-Order Condition. Then, in the algorithm decribed earlier, copie of the econd meage received from non-faulty neighbor get filtered out a follow: Suppoe the ender end the two meage-verion m 1 = m(, (i, q m1 )) and m 2 = m(, (i, q m2 )) at abolute time t 1 and t 2 repectively. Hence, any non-faulty node that receive the firt meage oberve a receive-timetamp that i le than the receivetimetamp for the econd meage oberved by thoe nonfaulty node that ee the econd meage. All non-faulty node attach the correct oberved timetamp to any REP EAT meage they end, and non-faulty node that receive the REP EAT meage record the timetamp along with the meage encapulated in the REPEAT. Recall that the firt meage-verion ent out by i m 1 and the econd i m 2. Alo, the meage-verion with highet pre-filtration count i referred to a c 1 and the other one i referred to a c 2. We how that if more than b REPEAT copie of m 1 were received from non-faulty node, the agreement condition i achieved. Thereafter we how that more than b copie of m 1 are received from non-faulty node w.h.p. Suppoe more than b copie of m 1 were received from nonfaulty node, i.e., more than b correct copie of m 1 were received. Then the following cae may arie: If c 1 = m 1, and at mot b copie of m 2 were received: m 1 will win the majority vote, and get choen immediately. If c 1 = m 1, i.e., m 1 ha the highet pre-filtration count, and greater than b copie of m 2 were received: A non-faulty node will only end a REPEAT of m 2 if it receive the meage m 2 directly from, and it will affix a correct receive-timetamp to it REPEAT. Since the Receipt-Order Condition hold, the timetamp reported in any uch REPEAT copy of m 2 will be greater than the timetamp reported in any of the correct REPEAT copie of m 1. Thu, no more than b copie of c 2 = m 2 can bear a fale earlier timetamp. Reultantly, no copy of m 1 ent by a non-faulty node will get filtered out erroneouly, and m 1 will win the majority vote. If c 1 = m 2 i.e. m 2 ha the highet pre-filtration count: Since greater than b copie of m 1 were received from non-faulty node, then from the Receipt-Order Condition, any copy (REPEAT) of m 2 ent by a non-faulty node ha a reported timetamp greater than the reported timetamp on the greater-than-b correct copie of m 1, and the timetamp filtration rule enure that all copie of m 2 ent by non-faulty node get filtered out. Thi leave only upto b copie of m 2 ent by faulty node. Thu, if the correct REPEAT copie of m 1 are greater than b, m 1 will win the majority vote. Hence, the algorithm definitely make the correct deciion if more than b copie of m 1 were received from non-faulty node. Thi i the ame a the ufficient condition we earlier tated for correct deciion with a non-faulty ource. When b or fewer copie of m 1 are received from non-faulty node, the deciion may be correct or wrong, depending on how many copie of m 2 were received. To bound the error probability, we aume the wort, i.e., it i alway wrong if b or fewer copie of m 1 are received from non-faulty node. We repreent the copie of m 1 repeated by non-faulty node that were received by a node u a a random variable Z. Then, the requirement i that Z > b for both the cae (recall that in the firt cae, the ource i non-faulty, and o it end only one meage-verion m 1, but upto b puriou REP EAT meage containing wrong value may till be received from faulty node). Let the number of non-faulty mutual neighbor of and u be g. Then g d o b. Z i the um of g i.i.d. Bernoulli(p ap 2 ) random variable, ince a repeated copy of m 1 i received from a non-faulty neighbor if that neighbor received m 1 directly from (probability p ), it wa able to tranmit the REPEAT packet before timeout (probability p a), and the REPEAT wa uccefully received by u (probability p ). Thi allow u to apply the following pecial form of the Chernoff bound [16]: Pr[Z (1 β)e[z]] exp( β2 E[Z] ), 0 < β < 1 (1) 2 Thu, knowing that b = do g, we can et β = 1 1+ p ap 2 to obtain b (1 β)e[z]. Thu application of the Chernoff bound yield: Pr[Z > b] 1 Pr[Z (1 β)e[z]] 1 exp( (1 p ap ) 2 p 2 ap 2 g ) 2 1 exp( (1 p ap ) 2 p 2 ap 2 d o ) (2) 2(1 + ) Since 0 < β < 1, the contraint on i that p ap 2 ǫ with ǫ > 0. Thu (which give a meaure of the proportion of tolerable fault) can be large when the probability of ucceful receipt (p ap 2 ) i large, and can only be mall when p ap 2 i mall. Applying the union bound over all d neighbor of ender, probability that any node make an error i le than dexp( (1 pap 2 ) 2 p ap 2 do ), which i mall for large d o, and d o >> ln d. Note that, a d increae, the timeout component T a mut alo increae to maintain a ufficiently high value of p a (due to increaed contention for the hared channel). However, in

7 mot cae of practical interet, d will not be unduly large, and a moderate value for T can uffice. Beide, the protocol i till reaonably calable, a it only require one meage to be ent by each node. In our analyi, we have aumed that whenever the number of copie of m 1 received from non-faulty node i le than b, a wrong deciion i made. In actuality, if the number of copie of m 1 received from non-faulty node i le than b, there may till be ituation where a correct deciion may be made (it i poible that the total number of received copie containing q m2 (from faulty or non-faulty node) be much le than b, ince thee tranmiion are alo ubject to reception error). Thu the preented analyi etablihe a rather conervative upper bound on the error probability. 8. POSSIBLE OPTIMIZATIONS From a practical perpective, one can conider many poible enhancement/optimization to the baic algorithm. 1. Each node can be made to retranmit it REPEAT meage k time. Thi can help improve lo-reilience, without cauing duplication problem, a (in abence of addre poofing) two receipt of the ame meage are eaily identified by the repeater addre. 2. One could conider triggering the reliable local broadcat algorithm only if at leat one warning meage i heard from a node claiming to have heard two inconitent meage ent by (thi would work only if it i very likely that a fair number of node will receive both variant of meage). Alo, while faulty node can raie fale alarm, that i no wore that proactively uing the algorithm each time. 9. DISCUSSION ON SYNCHRONIZATION REQUIREMENTS The ynchronization aumption required to enure the Receipt-Order Condition hold may actually be practically feaible in many etting. It i poible that in the near-future, wirele node may be equipped with on-chip atomic clock [10] with very low drift. Thu, if the clock are ynchronized with an external time ource at time of deployment, then one might bound the total kew over the entire operational lifetime of the network, and thi would not be overly large. Alternatively, node might be GPS-equipped, thu providing an out-ofband mean of external ynchronization. In uch cenario, the condition for Obervation 1 can be made to hold. In the abence of on-chip atomic clock or GPS-equipped device, it may not be poible to enure that all node in the network be ynchronized to an external clock within ome contant bound D. However, it i till quite feaible to enure that each node i internally ynchronized within contant bound D with it two-hop neighbor. One could enviage a ituation where node are initially ynchronized at time of deployment, and thereafter periodically run a reynchronization protocol, to enure that any any two node within two-hop of each other alway tay internally ynchronized within the bound D. A lightweight Byzantine time ynchronization protocol hould potentially uffice for thi. In the period between two conecutive reynchronization, the condition of Obervation 2 can thu be made to hold for every local broadcat domain in the network. 10. USING THE PRIMITIVE FOR MULTI- HOP BROADCAST We briefly dicu how the propoed primitive could potentially be ued a a building block in a protocol to achieve broadcat in a multi-hop etting. It wa oberved in [12] that the algorithm of [1] require neighbor of the original ender to agree on the value it ent, even if the original ender i faulty; for other node in the network, correctne only require that neighbor of non-faulty node agree on the meage they ent. Thu, if one i uing a global broadcat protocol with imilar propertie, one could conider uing the reliable local broadcat primitive in the neighborhood of the original ender, and merely tipulate that other node retranmit their meage a ufficient number of time. Otherwie, if the protocol require that neighbor of all node agree on what they ent, one could proceed a follow: Let u conider a multi-hop network of n node, where the minimum node degree i d min, maximum node degree i d max, and d o = min min nbd(x) nbd(y). Thu do i the x y nbd(x) minimum number of common neighbor hared by any two neighbor. The number of faulty node in any ingle neighborhood i at mot b = 1+ do where pap2 ǫ(ǫ > 0). Through exchange of periodic hello meage, node maintain a lit of neighbor. Neighbor are added/removed only if more than a certain number of HELLO meage have been conecutively received/lot. Thi help maintain a degree of tability in the neighborhood information, in the face of hort-term ignal fluctuation. Suppoe we have a global multi-hop broadcat protocol that aume reliable local broadcat, and require a total of O(n m ) meage to be ent (m i a contant), i.e. ha meage complexity polynomial in n. Then, for each tep of the protocol that require a node to perform a local broadcat, the reliable local broadcat primitive protocol i run in the local broadcat domain compriing the node and it neighbor. Following the proof argument of Theorem 1, we can obtain that the probability local broadcat i achieved reliably i at leat 1 d max exp( (1 pap 2 ) 2 p ap 2 do ) = 1 exp( (1 pap 2 ) 2 p ap 2 do + ln d max). Since n m uch ucceful local broadcat are needed, if d o = c 1mlog n for a uitably choen contant c 1 >, and d max c 2 log n for (1 pap 2 ) 2 p ap 2 another uitable contant c 2 (note that c 2 c 1m by definition), then by applying the union bound, one may ee that the global broadcat will alo ucceed with probability at leat 1 n m exp( (1 pap 2 ) 2 p ap 2 do + ln d max), which approache 1 for large n. The tolerable number of per-neighborhood fault i given by the minimum of the tolerance threhold for the global protocol, and the local broadcat primitive. 11. OPEN ISSUES The algorithm we have outlined in thi paper i primarily a proof-of-concept approach, whereby we eek to highlight that one can leverage the hared nature of the medium, and information from lower-layer (in thi cae, timetamp), to deign calable probabilitic olution to the local broadcat problem. However, there are till numerou outtanding iue that need to be addreed. One iue i that of uing a uitable Byzantine time yn-

8 chronization protocol to enure internal ynchronization between neighboring node (ee Section 9). It might be poible to leverage exiting work in thi area, e.g., [20]. Another iue i that one might wih to eliminate the requirement in Obervation 2 that during the interval in which the local broadcat i occurring, node do not adjut their clock. Thi would require a ynchronization algorithm that can run imultaneouly with the local broadcat algorithm without affecting the Receipt-Order Condition. Additionally, the decribed algorithm aume i.i.d. lo probabilitie. If channel loe exhibit patial correlation, the algorithm may need to be modified to handle uch ituation. A major hortcoming of the algorithm i the need to etimate the timeout T baed on acce probability p a, average length of outgoing packet-queue, and proceing time to generate a REPEAT. It would be preferable to have an algorithm where node decide to invoke the filtration and majority determination procedure baed on ome event, e.g., receipt of certain meage. 12. DISCUSSION Many of the aumption in thi paper are jutified by auming a network with a ingle channel and omnidirectional antenna. One might wih to conider alternative cenario where multiple channel or beamforming antenna are available. We remark that uage of multiple channel or directional antenna tend to alter the broadcat nature of the wirele medium, and make the network look increaingly like a point-to-point network. Thu, algorithm baed on the point-to-point abtraction may increaingly eem uitable in uch cenario. 13. CONCLUSION In thi paper, we have conidered the iue of implementing reliable local broadcat in a wirele network with a loy channel. We have propoed a imple proof-of-concept approach toward thi end, with the intent to highlight the potential for obtaining lightweight probabilitic olution to the problem. 14. REFERENCES [1] V. Bhandari and N. H. Vaidya. On reliable broadcat in a radio network. In PODC 05: Proceeding of the twenty-fourth annual ACM SIGACT-SIGOPS ympoium on Principle of ditributed computing, page ACM Pre, [2] V. Bhandari and N. H. Vaidya. On reliable broadcat in a radio network: A implified characterization. Technical Report, CSL, UIUC, May [3] V. Bhandari and N. H. Vaidya. Reliable Broadcat in Wirele Network with Probabilitic Failure. In Proceeding of IEEE INFOCOM, page , Anchorage, Alaka, May [4] V. Bhandari and N. H. Vaidya. Reliable broadcat in wirele network with probabilitic failure. Technical Report, CSL, UIUC, Jan [5] K. P. Birman, M. Hayden, O. Okaap, Z. Xiao, M. Budiu, and Y. Minky. Bimodal multicat. Tranaction on Computer Sytem (TOCS), 17(2):41 88, May [6] G. Chockler, M. Demirba, S. Gilbert, N. Lynch, C. Newport, and T. Nolte. Reconciling the theory and practice of (un)reliable wirele broadcat. In ICDCSW 05: Proceeding of the Fourth International Workhop on Aurance in Ditributed Sytem and Network (ADSN) (ICDCSW 05), page IEEE Computer Society, [7] G. Chockler, M. Demirba, S. Gilbert, C. Newport, and T. Nolte. Conenu and colliion detector in wirele ad hoc network. In PODC 05: Proceeding of the twenty-fourth annual ACM ympoium on Principle of ditributed computing, page ACM Pre, [8] J. Conidine, L. A. Levin, and D. Metcalf. Byzantine agreement with faulty majority uing bounded broadcat. CoRR, c.dc/ , [9] S. Gilbert, R. Guerraoui, and C. Newport. Of maliciou mote and upiciou enor. In Proc. of OPODIS, [10] S. Knappe, L. Liew, V. Shah, P. Schwindt, J. Moreland, L. Hollberg, and J. Kitching. A microfabricated atomic clock. Appl. Phy. Lett., 85, [11] C.-Y. Koo. Broadcat in radio network tolerating byzantine adverarial behavior. In PODC 04: Proceeding of the twenty-third annual ACM ympoium on Principle of ditributed computing, page ACM Pre, [12] C.-Y. Koo, V. Bhandari, J. Katz, and N. H. Vaidya. Reliable broadcat in radio network: The bounded colliion cae. In Proceeding of ACM PODC 2006, [13] L. Lamport. Time, clock, and the ordering of event in a ditributed ytem. Commun. ACM, 21(7): , [14] L. Lamport, R. Shotak, and M. Peae. The byzantine general problem. ACM Tran. Program. Lang. Syt., 4(3): , [15] J. Luo, P. Eugter, and J.-P. Hubaux. Route driven goip: Probabilitic reliable multicat in ad hoc network. In Proc. of INFOCOM 2003, [16] M. Mitzenmacher and E. Upfal. Probability and computing. Cambridge Univerity Pre, [17] M. Peae, R. Shotak, and L. Lamport. Reaching agreement in the preence of fault. J. ACM, 27(2): , [18] A. Pelc and D. Peleg. Broadcating with locally bounded byzantine fault. Information Proceing Letter, 93(3): , Feb [19] A. Pelc and D. Peleg. Feaibility and complexity of broadcating with random tranmiion failure. In PODC 05: Proceeding of the twenty-fourth annual ACM SIGACT-SIGOPS ympoium on Principle of ditributed computing, page , [20] T. K. Srikanth and S. Toueg. Optimal clock ynchronization. J. ACM, 34(3): , 1987.