[论文解读] The Consensus Number of a Cryptocurrency (Extended Version)

Rachid Guerraoui, Petr Kuznetsov+3 more|arXiv (Cornell University)|Jun 13, 2019

Blockchain Technology Applications and Security参考文献 39被引用 8

一句话总结

本文证明，共识并非防止加密货币中双花问题的必要条件，通过展示在每个账户仅有一个所有者的情况下，资产转移问题的共识数为1。作者提出一种确定性、异步的拜占庭容错资产转移协议，利用原子快照内存和安全广播实现线性化，无需共识，比基于共识的方法更简单、更高效。

ABSTRACT

Many blockchain-based algorithms, such as Bitcoin, implement a decentralized asset transfer system, often referred to as a cryptocurrency. As stated in the original paper by Nakamoto, at the heart of these systems lies the problem of preventing double-spending; this is usually solved by achieving consensus on the order of transfers among the participants. In this paper, we treat the asset transfer problem as a concurrent object and determine its consensus number, showing that consensus is, in fact, not necessary to prevent double-spending. We first consider the problem as defined by Nakamoto, where only a single process---the account owner---can withdraw from each account. Safety and liveness need to be ensured for correct account owners, whereas misbehaving account owners might be unable to perform transfers. We show that the consensus number of an asset transfer object is $1$. We then consider a more general $k$-shared asset transfer object where up to $k$ processes can atomically withdraw from the same account, and show that this object has consensus number $k$. We establish our results in the context of shared memory with benign faults, allowing us to properly understand the level of difficulty of the asset transfer problem. We also translate these results in the message passing setting with Byzantine players, a model that is more relevant in practice. In this model, we describe an asynchronous Byzantine fault-tolerant asset transfer implementation that is both simpler and more efficient than state-of-the-art consensus-based solutions. Our results are applicable to both the permissioned (private) and permissionless (public) setting, as normally their differentiation is hidden by the abstractions on top of which our algorithms are based.

研究动机与目标

• 挑战广泛持有的观点，即共识对于防止去中心化加密货币中的双花问题至关重要。
• 在分布式计算中正式将资产转移问题定义为一种共享对象类型。
• 确定在良性故障和拜占庭故障模型下，资产转移对象的共识数。
• 设计一种确定性、异步且比基于共识的资产转移协议更高效的替代方案。
• 将模型推广至k共享账户，并确定其共识数为k。

提出的方法

• 作者将资产转移问题建模为在存在良性故障的共享内存环境中的并发对象类型，证明其共识数为1。
• 他们使用原子快照内存，通过基于一致内存视图验证转移来实现线性化取款。
• 对于k共享账户，他们扩展了模型，允许最多k个进程从同一账户取款，并证明共识数为k。
• 在存在拜占庭故障的消息传递模型中，他们为每个账户实现一个BFT服务以分配序列号，确保一致性和顺序。
• 他们修改了一种安全广播协议，以提供账户顺序属性，实现在无需全局共识的情况下跨转移强制因果关系。
• 该协议通过依赖法定人数签名的序列号和本地验证，确保非受损账户的安全性和活性。

实验结果

研究问题

• RQ1 共识是否真的对防止去中心化加密货币中的双花问题必不可少？
• RQ2 在存在良性故障的共享内存中，单个所有者资产转移对象的共识数是多少？
• RQ3 当允许多个进程从同一账户取款时，共识数如何变化？
• RQ4 能否构建一种无需共识、确定性且异步的拜占庭容错资产转移协议，且比基于共识的替代方案更高效？
• RQ5 如何在不使用全局全序排序的情况下，保持跨账户的因果关系和线性化？

主要发现

• 单个所有者资产转移对象的共识数为1，证明共识并非防止双花所必需。
• 对于k共享资产转移对象（最多k个进程可从同一账户取款），其共识数为k。
• 所提出的协议在无需解决共识的情况下，通过BFT服务和安全广播实现了线性化和安全性，适用于拜占庭故障环境。
• 该协议即使在存在拜占庭故障的异步系统中，也能确保非受损账户的活性。
• 该方法适用于许可和非许可加密货币，因为抽象隐藏了底层访问控制的差异。
• 与最先进的基于共识的解决方案相比，该协议更简单、更高效，避免了共识模块带来的复杂性和性能瓶颈。