[ Agorics Home Page ] [ Technical Library ]
To appear in Agoric Systems: Market Based Computation, edited by Wm. Tulloh, Mark S. Miller and Don Lavoie. This may be found by ftp at netcom.com:pub/joule/DSR1.ps.gz, DSR1.rtf.gz or DSR.txt
AT011-2
September 1995
Copyright © 1994, 1995 Agorics,
Inc.
All Rights Reserved.
The art of progress is to preserve order amid change and to preserve change amid order.
—Alfred North Whitehead
Science and the Modern World
Existing and proposed mechanisms for digital money all require large overhead to transfer money between parties. This overhead makes them unsuitable for extremely low cost activities, such as delivering and routing packets. The digital silk road is a proposed money system with extremely low transaction cost built into the communication protocols. The money introduced by this system is much more like coins than like bank accounts; it supports only small transactions, requires limited trust among the participants, and requires no central bank. Upon this foundation, elements of an open system are described that fully support network resource management, routing, interconnection with the Internet, and other information services, across trust boundaries with competing providers for all services.
The protocol offers incentives for communication and information providers that avoid policy entanglements typical of subsidized systems—cash-and-carry for cyberspace.
Designed incentives are based on positive reputations and profits in real local currencies. The inspiration is taken from tales of the silk road, by which silk was brought from China to Europe through a series of traders who travelled only short distances.
The basic idea is an inter site link level protocol that includes a money field in some packets. This field is not ciphered and is never negative. It is 32 bits long and its value is the worth of the packet. It is denominated in units of one thousandth of a cent or less. As such packets pass over an interface between two sites, X and Y, an up-down accumulator that is conceptually between X and Y tracks the net money flow. The accumulator is probably implemented at both sites. Conceptually, the respective operators of X and Y periodically read the accumulator and pass real money according to the accumulator’s value, then reset the accumulator. More realistically, this is accomplished by conventional EFT (Electronic Funds Transfer).
The term site is used here to describe some assemblage of hardware and software operated by an individual or enterprise. No distinction is made between the entities within a site in this paper; their interests are assumed to be entirely aligned.
Communication is achieved by a network of sites interoperating with this protocol. Some sites specialize in moving data and others in switching, while many do both. Movers and switchers are called carriers here. One simple business for a site is forwarding datagrams. Such sites make a living by accepting packets at an interface, moving them to another interface, deducting a small amount from the packets’ worth as toll and then delivering them across the new interface. Such packets include steering information in the packet—an indication for each site of the next interface to which the packet is to be delivered, with that indication removed from the packet as it is forwarded. This business ensures a net income for such a site at its collective interfaces. Delivery of datagrams requires no tables or records kept by each site. When someone sends a datagram through the network she includes more money than will likely be required. The excess will arrive with the packet at the destination, and can be returned with an acknowledgment. The amount returned is an immediate measure of the cost of the service.
At international interfaces a multiplication of packet wealth converts currency. Any site can set a money field any way it wants, but successful sites are constrained as follows. Liabilities (obligations) arise as packets with worth are exported across an interface. The accumulator there records its obligation to the next site operator. The site will thus be careful not to set it higher than the situation warrants. If it sets the value too low it will soon damage its own reputation and lose business thereby. Prices are set by normal market mechanisms of supply and demand. They may be set for periods of time and advertised to aid planning, or they may be more volatile. The market will decide this too. Since you pay up front you incur no obligation beyond what you pay and you lose no more than what you pay.
Packets are assumed to be grouped into blocks and delivered across the physical interface with error control only for the blocks. The expense of small packets is therefore reduced, for they need not individually carry error control and acknowledgment information. This detail is necessary for realistic cost estimation. More suggestions on link strategy are in another paper.
While datagrams and their incentives are easy to understand, a more complex and efficient mechanism to move data, involving persistent circuits, avoids the cost of steering information in each packet. Circuit packets are marked across interfaces as belonging to a particular channel of that interface, and agents are identified within sites that act for a particular circuit at that site. Thus a circuit is a data path from origin to destination, consisting of channels across interfaces and agents at sites that work for the circuit. Each agent and channel serves just one circuit. The agents may be thought to own the interface channels for their circuits. As a circuit packet crosses an interface it is delivered to the agent that owns the channel of the packet. After possible buffering the agent delivers the packet through its channel on the next interface. Most circuits are symmetric and can carry data in either direction.
Some circuits may provide flow-control or backpressure. Signals flowing between agents, through channels against the data flow indicate when more data can be accepted. Backpressure may arise at the destination or some intermediate point in the circuit. Circuits that do not provide backpressure discard data when unable to deliver it. Numerous other potential circuit qualities are mentioned in a later paper.
An agent holds some money to rent buffers and pay for transmission across interfaces. Occasional packets through the circuit carry money to replenish the agent’s money.
Building a circuit occurs with a needle moving through the network with steering information like a datagram, but leaving a path of channels and agents behind it. To delete a circuit, a destruct signal travels along the circuit that deletes the agents and frees the channels. By convention, a zero in the needle as interface number signifies end-of-circuit and the current site is the target of the circuit. Messages through the circuit are interpreted locally.
Note that it is possible to send a datagram using the circuit primitives: Send the needle, the data, then the destruct signal.
A scout program situated at some site in the network can explore available routes. It does this by launching circuits in all directions. As each site is reached the scout asks the site its name. The response is returned over the circuit. When the scout has not seen the name before, it adds the site to its map. The scout asks the site what it does for a living. When a site responds that it moves or switches data and the scout has seen the name before, it adds a link to its map. Other responses are entered into an information service data base. At new sites the scout asks how many interfaces it has. The scout continues while unexplored interfaces remain in its map. The scout contracts with each site to be informed of any new interfaces that should arise or expire.
The scout’s data base is available to affiliated guide programs that advise how to travel between sites. Naturally, guides deal in the reputations of the carriers that they select for their customers. Sites that claim to move data but do so unreliably are not long recommended by guides.
Few standards need to be imposed here. However, some standard internal way for programs to name sites would be widely convenient, if not necessary. A public crypto key should be suitable for fundamental site names. One may simply generate a public-private key pair and use the public key as a name. Only the real owner is able to process messages meant for him. Others, seeing X’s public key, could claim to be X, but could not reply to any messages meant for X. The first 32, 48 or 64 bits of an RSA public key form suitably unique and short nick-names for many purposes.
Naming seems to be a natural monopoly, but it need not be. Hierarchical naming schemes ala the Internet serve many purposes. Names that a person could carry with her would also be useful. Naming services are closely allied with guide services.
A given name server can sell alphabetic names. A US name server might manage to convince most people in the US that his is the only important name server, and to register “L. Jones” there is to effectively own that name. One service of this server would be to map alphabetic names to public key names. It is interesting to imagine competing between name sellers. When this competition has been imagined to a few levels of gaming it seems stable. A possible plan is to sell name-key pairs at $1 each. A price of $10-n where n is the length of the name seems more appropriate. These numbers are only a crude estimate of the market price.
Carriers, guides and reputation systems are all information services. They all work for cash. Data base operators, computers and all sorts of other traditional information services fit in this same mold. A few more specific services that might arise are considered below.
A person wants to integrate a function or factor a polynomial. She sends the problem to a Mathematica server together with $.05, and gets the response in a few seconds. She probably get the answer but the response may be that $.05 of computing yielded no answer, but more might do the trick. For a while it will preserve the state of the computation for resumption if she wishes to send more money. The response might alternatively be that it knows the answer but will only reveal it for $.25.
There may be an interface to a real bank through which a person can deposit and withdraw small sums of cash from his account; a CyberATM, or better, CyberTeller.
Someone has a document in TeX format but can only print Post Script files. A service will do the conversion for $.005 per page.
Anonymous Forwarders: Some sites will advertise a public crypto. They will expect all or some of their input packets to be ciphered. If such ciphered packets request some delay before forwarding, the site serves as a mix. (David Chaum introduced the term mix to describe a network service that forwards mail after removing standard indications of the source, thus providing anonymous mail.) The amount of money allows statistical tracing, but this method may be alleviated by establishing a small account at the mix. (Anonymous mail is a complex social issue and the operator of such a mix may be subject to social pressures.)
Specialized computing facilities could sell their service this way. If a person has a computation that takes 109 bytes of real ram for 2x1010 operations, some Cray machine could run her code in 20 seconds for $3. If the Cray were kept busy with such business it would provide a 100% profit for the operator. Note that she need not be deemed a researcher by the government.
Even if 109 bytes of storage are not required, she may prefer to spend $50 for 30 seconds of the attention of a big Cray to do ray tracing rather than experience 3 hours of delay on her own CPU.
Guides may offer datagram forwarding service to avoid computing an optimal path from source to destination. Perhaps specialized forwarding services would make more sense in this case, but guides already have full time circuits to each site.
It is not from the benevolence of the butcher, the brewer, or the baker, that we expect our dinner, but from their regard to their own interest. We address ourselves, not to their humanity but to their self-love, and never talk to them of our own necessities but of their advantages.
—Adam Smith
An Inquiry into the Nature and Causes of the Wealth of Nations, 1776
A site in this world can default, but when one buys an information service it is almost always caveat emptor. We do not request our money back when a magazine proves uninteresting. There is seldom a way for a third party to judge whether the service satisfied some contract. We rely thus on the positive reputation of the vendor.
Communication links fail, which will cause interfaces to go down. A site may use a circuit as a detour for the interface. It might build the circuit in advance as a precaution. It might take a loss to maintain its reputation. Alternatively, it is remarkably inexpensive to build two circuits between the same two endpoints, the second to serve as a hot standby. Since no data moves over the standby the cost is probably negligible. Circuits with a standby could arrange for their site agents to return the buffered data at the several sites to be retransmitted over the standby circuit.
When a neighboring site itself goes down it is harder to play fair. Only the failed site can properly interpret packets that were meant for it. It behooves a site X to arrange for at least one of its neighbors to notify routing services when X dies. This minimizes damage to X’s reputation. It is in the neighbors interest to do so because, to an extent, their reputations rise and fall together. The whole neighborhood’s reputation can suffer.
The concept of liability helps clarify how systems like these work. When a site accepts a packet requesting to be forwarded to another interface it has acquired a liability or obligation. If it loses the packet, it has defaulted but gains the amount of money in the lost packet. The site guards the packets to guard its reputation. We specifically reject mechanisms that would create an externally registered liability for each packet, as such a system would likely cost more than the transaction itself. In particular, there would be no legal liability. In the presence of real time automatic reputation systems, it is enough that reputations can be lost in minutes.
Reputation systems can be built to provide current information on the performance of a site as observed by its customers. Examples of reputation services are Dun&Bradstreet, the local Better Business Bureau and Consumer’s Union. Reputation systems are complex. Complete automation of these systems is not anticipated. They must gain the trust of their customers, and the only way to earn that trust is to provide useful guidance to those customers. Indeed, a reputation system must protect its own reputation.
Reputation systems are in a natural position to provide Yellow Page service.
Reputation systems can evaluate and rate a service by anonymously subscribing to it. Usually, however, they must evaluate complaints that come from customers of the rated services, because the service is too expensive or it requires subjective judgment, or judgment by experts, who are, after all, the customers. The reputation service must thus judge the veracity and incentives of its reporters, namely the very customers of the reputation service. This judgement requires the difficult skills of a diplomat, but ultimately incentives pull in the right directions.
There is an economy of scale in reputation systems. A user learns of the reliability of a service from other users through reputation systems. He does business with many vendors according to their reputations as reported by the reputation system. He does business with only a few reputation systems and can thus directly judge these familiar systems.
This whole exercise is an attempt to avoid standards as if standards were bad. Actually standards are good but systems are sometimes bad because they cannot adapt to new standards. When standards are described, it is in part to establish that standards are possible in such a world as is suggested here. The main purpose is to show possibilities if money is included in low level protocols. Behind each protocol description is the suppressed comment that it could work some other way and work at the same time in the same network, albeit with resulting inconvenience.
To connect with classic networks bridges could be built between sites that conform to both worlds. The bridge keeps accounts for whoever needs to access CashNet from the Internet. If someone in the Internet needs to build a circuit to Y in CashNet, then she must have an account with a bridge operator. She may then build a circuit to the bridge, identify herself somehow, and build a cash net circuit from there to Y. Her bridge account supplies money for packets going into CashNet and accumulates money for packets of hers coming back out.
A collect call service might be developed, where the bridge on its own speculative expense calls someone in CashNet in response to a query by an Internet citizen unknown to the bridge. The bridge asks if the CashNet citizen is willing to accept a collect call.
Calls from CashNet are easier. No account is needed for connection service to the Internet, which can be paid for immediately.
Decentralization affords diversity. Diversity fosters evolution. The protocol is simple and makes it possible to start up small businesses without the normal high cost of locating customers and arranging contracts.
Many one person companies. Many people already make a living indirectly through the Internet. To do so requires being hired by some sponsor with a motivation to provide some information service for free. The sponsor may indirectly be some government with a charter to provide service, or it may be an enterprise that supports collaborative research. Most information commerce cannot conform to these patterns.
Wide variety of services. Most Internet services are currently free to the end user. This is changing, but the Internet provides no integrated way of charging for such service. It is thus infeasible to sell some service whose intrinsic worth is only a few cents. When a person wanders into a book store, chooses a book and pays for it with cash, she need not learn the name of the owner of the book store nor need he learn hers. This process is even easier when I buy something from a vending machine.
No Junk Mail! A person could significantly decrease unwanted mail by charging a set price for all incoming mail, and advertising this reading tariff along with her net-name; then at least she would be compensated for reading any such junk mail that did get through. Her mail daemon would be directed to discard mail with insufficient tariff; or, more politely, it could return the excess postage with a note that the message was automatically discarded, since the worth was insufficient to justify reading the mail. One would surely get off of most junk mail lists that way! People with 900 series phone numbers get few solicitations. Some “junk mail” may be desired by the recipient. She may want to see colloquium announcements or movie reviews. She instructs her daemon to watch for such announcements and return postage to the distributor sufficient to deliver the next package.
Availability of trivial services. I once got a total stranger to convert a TeX file to a PostScript file for me. The Internet is a friendly place, but I cannot continue to impose on strangers. If the converter were paid a penny a page he might find it worth his while to automate this service.
Communication systems have long been thought to be natural monopolies. To the technical obstacles to progress are thereby added bureaucratic and political obstacles. Technical progress has eliminated most of the original reasons for viewing the phone business as a natural monopoly, especially as cable companies install high bandwidth service to the home. When the government operates phone systems, as in many countries today, it has the political mandate, or feels it has, to establish policies that limit the uses to which lines may be put. Some of these policies are in fact to protect the established system from competition. Some countries were a decade or so late in digital communications because such service threatened conventional revenues. This behavior is characteristic of monopolies. Government regulation is set the difficult task of attempting to limit monopolistic manifestations.
Potential problems arise when fundamental changes are made to any working system. Several are examined below which are expected to be transient.
The absence central administration gives more opportunity for substandard service. Indeed, no standards are centrally mandated. This system would naturally encourage voluntary and de facto standards. Reputation systems would report compliance with such standards. Mandated standards are often not achieved. Competition even solves the problem of what the standards should be; How good is good enough?
Without central administration greater opportunities exist for fraud. It will bother some that forwarding sites have neither accountability nor legal liability. Operators of such sites must plan to make their living from repeat business. Just as a restaurant must provide food acceptable to its customers to ever make a profit, so must such sites play largely by the “rules”. One type of fraud is especially egregious — “losing” packets and pocketing the money. This is temptation is especially great since one may be able to blame the loss on ones neighbor. Indeed this aspect bars application of CyberCash from transfers of large sums. Just as one normally does not carry $10,000 as one wanders through strange neighborhoods, neither does one send $10,000 packets through most sites. (This danger is another justification of the 32 bit money field denominated in $.00001) Repeated packets, with acknowledgments, could move large sums but this may run up against limits imposed at interface accumulators where the credit of one site operator may be insufficient in the eyes of the downstream operator. It all boils down to the fact that large value transactions are a big deal, even for banks! Incidentally, this problem with large value transactions are better handled with schemes such as Chaum’s digital money, which involves a bank and does provide accountability and, perhaps, legal liability.
Protection against gridlock may require some distributed logic. Gridlock occurs when some set of sites are unable to accept new packets for lack of storage and all of the packets that they need to deliver (to relieve their congestion) are directed to members of the set, none of whom are receiving. No incentive based solution to this gridlock has been structured yet. Circuits alleviate but do not eliminate the problem. This difficult exercise is left for the reader
These concerns involve both the individual end user whose personal computer implements this protocol and some huge communications carrier.
If the credit of one of the site operators at an interface is insufficient for the other operator, then the latter may establish a limit on the accumulator, beyond which traffic is not accepted. This case would be likely to occur for end-users, which would limit the bills they could accumulate. The credit limit may be zero, thus requiring prepayment. Conversely, the same limit protects the user from running up unlimited bills through misunderstanding of the software that handles his cybercash.
Perhaps such interfaces would make EFT (Electronic Funds Transfer) arrangements with normal financial institutions when some economic amount of net money is involved or credit becomes stretched. This application may be ideal for Chaum’s DigiCash.
Several ideas have been omitted from this paper concerning how a network of this sort can provide a degree of security and reliability beyond what is possible to achieve based on the Internet protocols. These issues are somewhat orthogonal but may, nonetheless, be strategic to each other. We expect to produce another paper covering these ideas soon. We hope to speculate in another paper about prices that might be achieved if communications providers are offered free entry into this market.
Much of the charm of the Internet is the informality of access. One can learn of a program through netnews, fetch it via FTP and run the program in the span of an hour with no bureaucrats, clerks or lawyers involved. This simplicity is as much a matter of Internet culture as charter. But what has more charm and informality than a flea-market where cash and anonymity prevail?
[ Agorics Home Page ] [ Technical Library ]
Notice of Copyrighted Material:
Work
presented here is copyrighted material belonging to Agorics, Inc. (Copyright
© 1994, 1995 Agorics, Inc.) Agorics, Inc. reserves all copyrights. Agorics
disclaims any warranty as to the utility, accuracy or effectiveness of the
information contained in this document and specifically disclaims any liability
for consequential damages that may result directly or indirectly from use of
the information in this document.
Last updated: 2 August, 2001