[Paper Review] Federated Byzantine Quorum Systems (Extended Version)

Álvaro García-Pérez, Alexey Gotsman|arXiv (Cornell University)|Nov 8, 2018

Distributed systems and fault tolerance5 references4 citations

TL;DR

This paper formalizes Federated Byzantine Quorum Systems (FBQS), a novel consensus model used in blockchains like Stellar and Ripple, where nodes independently select trusted peers to form quorums. It proves correctness of broadcast abstractions under Byzantine faults even when nodes lie about their trust choices, establishing a new variant of Byzantine quorum systems with per-node quorum understanding differences.

ABSTRACT

Some of the recent blockchain proposals, such as Stellar and Ripple, use quorum-like structures typical for Byzantine consensus while allowing for open membership. This is achieved by constructing quorums in a decentralised way: each participant independently chooses whom to trust, and quorums arise from these individual decisions. Unfortunately, the theoretical foundations underlying such blockchains have not been thoroughly investigated. To close this gap, in this paper we study decentralised quorum construction by means of federated Byzantine quorum systems, used by Stellar. We rigorously prove the correctness of basic broadcast abstractions over federated quorum systems and establish their relationship to the classical Byzantine quorum systems. In particular, we prove correctness in the realistic setting where Byzantine nodes may lie about their trust choices. We show that this setting leads to a novel variant of Byzantine quorum systems where different nodes may have different understanding of what constitutes a quorum.

Motivation & Objective

• To establish rigorous theoretical foundations for quorum-based consensus in open, decentralized blockchains like Stellar and Ripple.
• To analyze the correctness of basic broadcast abstractions in federated quorum systems under Byzantine behavior.
• To investigate the impact of Byzantine nodes lying about their trust relationships on quorum validity and system safety.
• To formalize a new variant of Byzantine quorum systems where different nodes may have different views of valid quorums.
• To bridge the gap between practical blockchain designs and formal distributed systems theory.

Proposed method

• Modeling quorum systems as a federation of trust relationships, where each node selects a set of peers it trusts.
• Defining quorum sets as collections of nodes whose combined trust ensures consensus safety and liveness.
• Introducing the concept of a quorum intersection property, ensuring that any two quorums share at least one common node.
• Proving that correctness of broadcast protocols holds even when Byzantine nodes misreport their trust sets.
• Formalizing a novel variant of Byzantine quorum systems where quorum validity is node-dependent due to differing trust choices.
• Using formal verification techniques to establish safety and liveness properties under adversarial behavior.

Experimental results

Research questions

• RQ1 How can quorum systems be constructed in a decentralized manner with open membership, as used in Stellar and Ripple?
• RQ2 What formal guarantees can be provided for broadcast protocols in federated quorum systems under Byzantine faults?
• RQ3 How does the assumption that Byzantine nodes may lie about their trust choices affect quorum validity and system correctness?
• RQ4 What is the formal relationship between federated Byzantine quorum systems and classical Byzantine quorum systems?
• RQ5 Can a consistent and secure consensus model be achieved when different nodes have different views of what constitutes a quorum?

Key findings

• The paper proves that basic broadcast abstractions remain correct in federated Byzantine quorum systems even when Byzantine nodes lie about their trust relationships.
• It establishes that quorum intersection holds across all quorum sets, ensuring consensus safety despite adversarial behavior.
• The authors formalize a new variant of Byzantine quorum systems where quorum validity is not globally uniform but depends on individual node trust sets.
• The model supports open membership and decentralized quorum formation, enabling practical deployment in systems like Stellar.
• The theoretical framework provides a foundation for reasoning about safety and liveness in real-world federated blockchain protocols.
• The results validate the design choices in Stellar and Ripple, showing that their quorum mechanisms are formally sound under Byzantine conditions.