[论文解读] On Cyber Risk Management of Blockchain Networks: A Game Theoretic Approach

Shaohan Feng, Wenbo Wang+4 more|arXiv (Cornell University)|Apr 27, 2018

Blockchain Technology Applications and Security参考文献 35被引用 11

一句话总结

本文提出了一种博弈论框架，通过将网络保险与主动基础设施投资相结合，实现区块链网络风险的管理。该框架将区块链提供商、保险公司和用户之间的互动建模为两级Stackelberg博弈，表明最优安全策略需要在挖矿算力投资与保险费率之间取得平衡；更高的攻击者算力会增加成本与保费，而区块大小则影响投资激励与攻击成功率。

ABSTRACT

Open-access blockchains based on proof-of-work protocols have gained tremendous popularity for their capabilities of providing decentralized tamper-proof ledgers and platforms for data-driven autonomous organization. Nevertheless, the proof-of-work based consensus protocols are vulnerable to cyber-attacks such as double-spending. In this paper, we propose a novel approach of cyber risk management for blockchain-based service. In particular, we adopt the cyber-insurance as an economic tool for neutralizing cyber risks due to attacks in blockchain networks. We consider a blockchain service market, which is composed of the infrastructure provider, the blockchain provider, the cyber-insurer, and the users. The blockchain provider purchases from the infrastructure provider, e.g., a cloud, the computing resources to maintain the blockchain consensus, and then offers blockchain services to the users. The blockchain provider strategizes its investment in the infrastructure and the service price charged to the users, in order to improve the security of the blockchain and thus optimize its profit. Meanwhile, the blockchain provider also purchases a cyber-insurance from the cyber-insurer to protect itself from the potential damage due to the attacks. In return, the cyber-insurer adjusts the insurance premium according to the perceived risk level of the blockchain service. Based on the assumption of rationality for the market entities, we model the interaction among the blockchain provider, the users, and the cyber-insurer as a two-level Stackelberg game. Namely, the blockchain provider and the cyber-insurer lead to set their pricing/investment strategies, and then the users follow to determine their demand of the blockchain service. Specifically, we consider the scenario of double-spending attacks and provide a series of analytical results about the Stackelberg equilibrium in the market game.

研究动机与目标

• 解决工作量证明区块链对双重支出攻击的安全漏洞问题。
• 设计一种结合主动基础设施投资与被动网络保险的经济风险管理框架。
• 在市场环境下对区块链提供商、网络保险公司和用户之间的战略互动进行建模。
• 分析在理性行为与风险调整定价下的均衡策略。
• 评估攻击者能力与区块大小对市场结果与安全激励的影响。

提出的方法

• 将区块链服务市场建模为两阶段Stackelberg博弈，其中区块链提供商与保险公司作为领导者，用户作为追随者。
• 引入基于风险调整的保费机制，保险公司根据感知到的攻击风险与区块链提供商的投资水平设定保费。
• 使用逆向归纳法推导所有市场参与者的均衡策略。
• 分析攻击者算力与区块大小（每区块交易数量）对投资、定价与需求的影响。
• 将社会外部性效应整合到用户对区块链服务的估值中。
• 推导出市场博弈中Stackelberg均衡存在性与唯一性的解析条件。

实验结果

研究问题

• RQ1 在面临攻击风险时，区块链提供商如何最优地平衡基础设施投资与网络保险购买，以最大化利润？
• RQ2 网络保险公司如何根据区块链提供商的风险特征与投资水平来设定保费？
• RQ3 攻击者算力对区块链提供商、用户与保险公司均衡结果的影响是什么？
• RQ4 区块大小（每区块交易数量）如何影响投资激励与攻击成功概率？
• RQ5 用户需求与服务定价如何响应安全水平与感知风险的变化？

主要发现

• 随着攻击者算力的增加，区块链提供商必须增加其基础设施投资以维持安全性，导致成本上升与利润下降。
• 尽管区块链提供商的成本上升，网络保险公司仍能通过提高保费来维持稳定利润，以应对更高的攻击风险。
• 尽管区块链提供商降低价格，用户需求仍因感知安全性下降而随攻击者算力增加而减少。
• 更大的区块大小（例如300笔交易）降低了攻击成功概率对攻击者算力增加的敏感性，从而减缓了保费上涨速率。
• 区块链提供商的基础设施投资比例（h*/(a + h*))随攻击者算力增加而下降，表明随着攻击能力增强，投资的边际收益递减。
• 在更高区块大小下，由于每区块的挖矿奖励与补偿更高，区块链提供商有更强的动力进行基础设施投资。