Strong Fairness Research Articles

PSBS: Practical Size-Based Scheduling

Size-based schedulers have very desirable performance properties: optimal or near-optimal response time can be coupled with strong fairness. Despite this, however, such systems are rarely implemented in practical settings, because they require knowing a priori the amount of work needed to complete jobs: this assumption is difficult to satisfy in concrete systems. It is definitely more likely to inform the system with an estimate of the job sizes, but existing studies point to somewhat pessimistic results if size-based policies use imprecise job size estimations. We take the goal of designing scheduling policies that explicitly deal with inexact job sizes . First, we prove that, in the absence of errors, it is always possible to improve any scheduling policy by designing a size-based one that dominates it: in the new policy, no jobs will complete later than in the original one. Unfortunately, size-based schedulers can perform badly with inexact job size information when job sizes are heavily skewed; we show that this issue, and the pessimistic results shown in the literature, are due to problematic behavior when large jobs are underestimated. Once the problem is identified, it is possible to amend size-based schedulers to solve the issue. We generalize FSP—a fair and efficient size-based scheduling policy—to solve the problem highlighted above; in addition, our solution deals with different job weights (that can be assigned to a job independently from its size). We provide an efficient implementation of the resulting protocol, which we call Practical Size-Based Scheduler (PSBS). Through simulations evaluated on synthetic and real workloads, we show that PSBS has near-optimal performance in a large variety of cases with inaccurate size information, that it performs fairly and that it handles job weights correctly. We believe that this work shows that PSBS is indeed pratical, and we maintain that it could inspire the design of schedulers in a wide array of real-world use cases.

On supplier encroachment with retailer’s fairness concerns

With the development of e-commerce, many wholesale suppliers establish direct channels competing with their retailers. Such competition is often referred to as supplier encroachment. Previous studies assume the perfect rationality of retailers. However, supplier encroachment may trigger the fairness concerns of the retailers as a supplier is also a competitor of its retailer if the supplier encroaches. Thus, we introduce retailer’s fairness concerns into the encroachment problem and explore its impact. It is shown that encroachment may be detrimental to the supplier when the retailer has strong fairness concerns and a significant marketing advantage. If the retailer has a significant marketing advantage, retailer’s profit may decrease as her fairness concerns become much stronger. Numerical illustrations demonstrate that, when the retailer is fairness concerned, the supplier has more flexibility to encroach and the retailer has more possibility to benefit from encroachment in most cases. Moreover, retailer’s fairness concerns can bring a remarkable improvement to the system profit.

Fair synchronization

Most published concurrent data structures which avoid locking do not provide any fairness guarantees. That is, they allow processes to access a data structure and complete their operations arbitrarily many times before some other trying process can complete a single operation. Such a behavior can be prevented by enforcing fairness. However, fairness requires waiting or helping. Helping techniques are often complex and memory consuming. Furthermore, it is known that it is not possible to automatically transform every data structure, which has a non-blocking implementation, into the corresponding data structure which in addition satisfies a very weak fairness requirement. Does it mean that for enforcing fairness it is best to use locks? The answer is negative.We show that it is possible to automatically transfer any non-blocking or wait-free data structure into a similar data structure which satisfies a strong fairness requirement, without using locks and with limited waiting. The fairness we require is that no process can initiate and complete two operations on a given resource while some other process is kept waiting on the same resource. Our approach allows as many processes as possible to access a shared resource at the same time as long as fairness is preserved. To achieve this goal, we introduce and solve a new synchronization problem, called fair synchronization. Solving the new problem enables us to add fairness to existing implementations of concurrent data structures, and to transform any solution to the mutual exclusion problem into a fair solution.

Verification of population protocols

Population protocols (Angluin et al. in PODC, 2004) are a formal model of sensor networks consisting of identical mobile devices. Two devices can interact and thereby change their states. Computations are infinite sequences of interactions satisfying a strong fairness constraint. A population protocol is well specified if for every initial configuration C of devices, and every computation starting at C, all devices eventually agree on a consensus value depending only on C. If a protocol is well specified, then it is said to compute the predicate that assigns to each initial configuration its consensus value. While the computational power of well-specified protocols has been extensively studied, the two basic verification problems remain open: Is a given protocol well specified? Does a given protocol compute a given predicate? We prove that both problems are decidable by reduction to the reachability problem of Petri nets. We also give a new proof of the fact that the predicates computed by well-defined protocols are those definable in Presburger arithmetic (Angluin et al. in PODC, 2006).

On the Hardness of Adding Nonmasking Fault Tolerance

This paper investigates the complexity of adding nonmasking fault tolerance, where a nonmasking fault-tolerant program guarantees recovery from states reached due to the occurrence of faults to states from where its specifications are satisfied. We first demonstrate that adding nonmasking fault tolerance to low atomicity programs-where processes have read/write restrictions with respect to the variables of other processes--is NP-complete (in the size of the state space) on an unfair or weakly fair scheduler. Then, we establish a surprising result that even under strong fairness, addition of nonmasking fault tolerance remains NP-hard! The NP-hardness of adding nonmasking fault tolerance is based on a polynomial-time reduction from the 3-SAT problem to the problem of designing self-stabilizing programs from their non-stabilizing versions, which is a special case of adding nonmasking fault tolerance. While it is known that designing self-stabilization under the assumption of strong fairness is polynomial, we demonstrate that adding self-stabilization to non-stabilizing programs is NP-hard under weak fairness.

Provable Fair Document Exchange Protocol with Transaction Privacy for E-Commerce

Transaction privacy has attracted a lot of attention in the e-commerce. This study proposes an efficient and provable fair document exchange protocol with transaction privacy. Using the proposed protocol, any untrusted parties can fairly exchange documents without the assistance of online, trusted third parties. Moreover, a notary only notarizes each document once. The authorized document owner can exchange a notarized document with different parties repeatedly without disclosing the origin of the document or the identities of transaction participants. Security and performance analyses indicate that the proposed protocol not only provides strong fairness, non-repudiation of origin, non-repudiation of receipt, and message confidentiality, but also enhances forward secrecy, transaction privacy, and authorized exchange. The proposed protocol is more efficient than other works.

The Unit-B method: refinement guided by progress concerns

We present Unit-B, a formal method inspired by Event-B and UNITY. Unit-B aims at the stepwise design of software systems satisfying safety and liveness properties. The method features the novel notion of coarse and fine schedules, a generalisation of weak and strong fairness for specifying events' scheduling assumptions. Based on events schedules, we propose proof rules to reason about progress properties and a refinement order preserving both liveness and safety properties. We illustrate our approach by an example to show that systems development can be driven by not only safety but also liveness requirements.

A Fair and Maximal Allocator for Single-Cycle On-Chip Homogeneous Resource Allocation

Traditional allocators for network-on-chip (NoC) routers suffer from either poor-matching quality or limited fairness. We propose a waterfall (WTF) allocator targeting homogeneous resource allocation, which provides single-cycle maximal matching while guaranteeing strong fairness based on the round-robin principle. It can be implemented with a loop-free structure. In 90 nm technology, the allocator operates at about 1 GHz clock frequency. We compare WTF with wave-front, separable-input-first, and separable-output-first allocators and find that it is at least 10% smaller, has 50% less delay under high load, and uses 3% less power than any of these alternatives. Also, WTF is at least as fair or clearly fairer. We also find that in a 4×4 circuit switched NoC the use of WTF gives up to 20% higher network performance.

Mechanical verification of Lamport’s Bakery algorithm

Proof assistants like PVS can be used fruitfully for the design and verification of concurrent algorithms. The technique is presented here by applying it to Lamport’s Bakery algorithm. The proofs for safety properties such as mutual exclusion, first-come–first-served, and absence of deadlock are based on invariants. The argument for liveness (progress) is given in a set-theoretic version of temporal logic. Liveness requires the assumption of weak fairness and holds only for executions with not more than finitely many fault steps per process. The condition of finitely many faults can be removed by postulating strong fairness. The algorithm and its verification are extended to allow unboundedly many processes, by means of expandable arrays and weak atomic snapshots.

Design and formal verification of a CEM protocol with transparent TTP

In certified email (CEM) protocols, trusted third party (TTP) transparency is an important security requirement which helps to avoid bad publicity as well as protecting individual users' privacy. Cederquist et al. proposed an optimistic certified email protocol, which employs key chains to reduce the storage requirement of the TTP. We extend their protocol to satisfy the property of TTP transparency, using existing verifiably encrypted signature schemes. An implementation with the scheme based on bilinear pairing makes our extension one of the most efficient CEM protocols satisfying strong fairness, timeliness, and TTP transparency. We formally verify the security requirements of the extended protocol. The properties of fairness, timeliness and effectiveness are checked in the model checker Mocha, and TTP transparency is formalised and analysed using the toolsets µCRL and CADP.

Complete assertional proof rules for progress under weak and strong fairness

The UNITY rules for leads-to, based on totality of the commands and weak fairness, are generalized to specifications with nontotal commands and impartiality. The rules and the corresponding predicate transformers are proved to be sound and complete by elementary means. These results are subsequently extended to specifications where the liveness property also contains a finite number of strong fairness assumptions. This is illustrated by means of a proof of starvation freedom for the standard implementation of mutual exclusion by plain semaphores, with strong fairness for the P operations.

On Deadlock and Fairness Decision Problems for Computations on Client-server Systems

Phenomena that inherently happen in distributed computing - some types of deadlock and fairness or starvation - are examined in a client-server model. Messages travelling between clients and a server are: request for an action, permission to start it, and termination of its execution. Deadlock-prone and (un)fair behaviours are formulated for the model and equivalence of the respective formulae to formulae expressing emptiness and finiteness of some sets generated by the model is established. From these results, some answers to decision problems for the aforesaid properties are obtained. Furthermore, equivalence between the so-called strong fairness (specified by first-order formula) and weak-fairness (second-order formula) is demonstrated.

Fair non-repudiation for web services transactions

To safeguard the interests of transacting parties, non-repudiation mechanisms need to assure fairness and timeliness. The non-repudiation service currently implemented usually does not consider the requirement of fairness and the fair non-repudiation protocols to date can not be suitably applied in real environment due to its complex interaction. This paper discusses the transaction-oriented non-repudiation requirement for Web services transaction, analyzes the constraints of the traditional model for the available fair non-repudiation protocols and designs a new Online-TTP fair non-repudiation protocol. The new protocol provides a fair non-repudiation solution to secure Web services transactions and can be embedded into a single Web service call. The protocol adopts evidence chained to decreasing the overhead of evidence verification and management and alleviates the overhead of certificate revocation checking and time-stamp generation for signatures. The protocol has strong fairness, timeliness, efficiency and practicability.

People recognise when they are really anonymous in an economic game

Mounting evidence that cues of being watched can enhance cooperative behaviour questions the existence of ‘anonymous', one-shot, non-kin directed cooperation and the validity of using ‘anonymous' economic games to empirically measure such behaviour in humans. Here we investigate how sensitive people are to such cuing effects. We test whether people playing an ultimatum game can use explicit information about experimental anonymity to override any effects of cuing in a public context, when faced with both simultaneously. The aims of our study were to investigate whether, (1) individuals respond to experimentally imposed anonymity within a public context and (2) the presence of known others affects cooperative behaviour over and above merely the presence of others. We find that proposer offers did not vary with changes in context (i.e., there was no “eyes effect”) but did vary with the degree of actual anonymity and the specific presence of known others. Hence, we infer that people recognise when their decisions are anonymous or not and proposers respond to reputation concerns when they are not anonymous. Responder behaviour did not vary with changes in context, degree of actual anonymity or the specific presence of known others. Hence, responders do not respond to reputation concerns and use one uniform strategy, perhaps as long as the payoff structure remains constant. This latter finding may hint at selection in favour of strategies that uniformly ensure near-equal splits of resources in some environments, and thus manifest as strong fairness norms in a population.

A uniform process alternator for arbitrary topologies

We introduce an alternator with uniform processes that executes in a process graph of arbitrary topology. In general, alternators are free from deadlock, protect against simultaneous execution of the critical sections of dependent processes, and after a finite number of executions provide a high degree of concurrency and some degree of fairness (deterministically or stochastically). Because this alternator has uniform processes, strong fairness and concurrency are properties obtained after a finite number of steps with an arbitrary probability, due to the possibility of symmetry in states. The size of the state space and the periodicity of critical section execution are dependent upon the initial state. The worst case size of the state space utilized and period between critical sections executions depend upon the diameter of the graph of processes. An important value of alternators is their capacity for transforming systems correct under serial (interleaving) semantics to systems correct under concurrent or maximal (power set) semantics. This property is based upon a graph of processes representing the alternator in which the vertices are processes and the edges are dependencies between processes.

Design and verification of a non-repudiation protocol based on receiver-side smart card

All the existing non-repudiation protocols ensuring strong fairness have to assume that the communication channel between trusted third party (TTP) and each player is resilient at least. Where only unreliable channel can be guaranteed, all these protocols become impractical. In this study, based on smart card on the receiver side, the authors design a fair non-repudiation protocol that needs no assumptions on the communication channel. The smart card takes over the role of an online TTP server. Without a dedicated TTP server, this protocol is ideal for some ad hoc scenarios where no infrastructure is available. This protocol can also be easily modified to support fair exchange of time-sensitive data. Compared with other traditional security protocols, automatic formal verification of fair non-repudiation protocols is much harder to achieve. The authors use meta-reasoning method to prove that the fair exchange property of this protocol can be reduced to three secrecy properties that fall into the scope of today's most automatic verification tools and therefore can be easily verified. The authors also use a recently proposed automatic method to verify the non-repudiation properties and fairness property of our protocol.

Explicit fairness in testing semantics

In this paper we investigate fair computations in the pi-calculus. Following Costa and Stirling's approach for CCS-like languages, we consider a method to label process actions in order to filter out unfair computations. We contrast the existing fair-testing notion with those that naturally arise by imposing weak and strong fairness. This comparison provides insight about the expressiveness of the various `fair' testing semantics and about their discriminating power.

Proving Fairness and Implementation Correctness of a Microkernel Scheduler

We report on the formal proof of a microkernel’s key property, namely that its multi-priority process scheduler guarantees progress, i.e., strong fairness. The proof architecture links a layer of behavioral reasoning over system-trace sets with a concrete, fairly realistic implementation written in C. Our microkernel provides an infrastructure for memory virtualization, for communication with hardware devices, for processes (represented as a sequence of assembly instructions, which are executed concurrently over an underlying, formally defined processor), and for inter-process communication (IPC) via synchronous message passing. The kernel establishes process switches according to IPCs and timer-events; the scheduling of process switches, however, follows a hierarchy of priorities, favoring, e.g., system processes over application processes over maintenance processes. Besides the quite substantial models developed in Isabelle/HOL and the formal clarification of their relationship, we provide a detailed analysis what formal requirements a microkernel imposes on the key ingredients (hardware, timers, machine-dependent code) in order to establish the correct operation of the overall system. On the methodological side, we show how early modeling with foresight to the later verification has substantially helped our project.

Fairness and conspiracy concepts in concurrent systems

Many different fairness notions are available in literature. One should choose the proper definition that match with the system under consideration. In this paper we consider two known fairness definitions, viz., weak fairness and strong fairness. It is argued that these concepts are suitable for determining the degree of fairness of a given system. For only starvation freedom we require a minimum degree of fairness which we call least fairness. This idea is illustrated using two practical examples. Conspiracy is another very important issue in concurrent system. We have defined conspiracy in connection with all the fairness notions. Conspiracy resistant implementation is illustrated using a starvation free solution to dining philosophers problem. Dijkstra's weakest precondition calculus is used as the analytical tool.

On automatic verification of self-stabilizing population protocols

The population protocol model has emerged as an elegant computation paradigm for describing mobile ad hoc networks, consisting of a number of mobile nodes that interact with each other to carry out a computation. The interactions of nodes are subject to a fairness constraint. One essential property of population protocols is that all nodes must eventually converge to the correct output value (or configuration). In this paper, we aim to automatically verify self-stabilizing population protocols for leader election and token circulation in the Spin model checker. We report our verification results and discuss the issue of modeling strong fairness constraints in Spin.