Design and Analysis of a Hidden Peer-to-peer Backup Market

Transcription

1 Design and Anaysis of a Hidden Peer-to-peer Backup Market Sven Seuken, Denis Chares, Max Chickering, Mary Czerwinski Kama Jain, David C. Parkes, Sidd Puri, and Desney Tan December, 2015 Abstract We present a new market design for a peer-to-peer (p2p) backup appication and provide a theoretica and experimenta anaysis. In domains such as p2p backup, where many non-expert users find markets unnatura or unexpected, it is often a pragmatic requisite to remove or hide the market s compexities. To this end, we introduce a new design paradigm which we ca hidden market design, and show, how a market and its user interface (UI) can be designed to hide the underying compexities, whie maintaining the market s functionaity. We enabe the p2p backup market using a virtua currency ony, and we deveop a nove market UI that makes the interaction for the users as seamess as possibe. The UI hides or simpifies many aspects of the market, incuding combinatoria resource constraints, prices, account baances and payments. In a rea p2p backup system, we can expect users to update their settings with a deay upon price changes. Therefore, the market is designed to work we even out of equiibrium, by maximizing the buffer between demand and suppy. The main theoretica resut is an existence and uniqueness theorem, which aso hods if a certain percentage of the user popuation is price-insensitive or even adversaria. However, we aso show that the more freedom we give the users, the ess robust the system becomes against adversaria attacks. Furthermore, the buffer size has imited controabiity via price changes aone and we show how to address this. We introduce a price update agorithm that uses daiy aggregate suppy and demand data to move prices towards the equiibrium, and we prove that the agorithm converges quicky towards the equiibrium. Finay, we present resuts from a formative usabiity study of the market UI, where we found encouraging resuts regarding the hidden markets paradigm. The market design presented here is impemented as part of a Microsoft research project and an apha version of the software has been successfuy tested. Keywords: Market design, Peer-to-peer Systems, Backup, User Interface Design. This paper is an extended version of three conference papers that have previousy appeared at EC 10 [20], CHI 10 [21], and AAAI 10 [22]. Part of this work was done whie the first author was an intern at Microsoft Live Labs and at Microsoft Research respectivey. We thank seminar participants from the Harvard EconCS group, the Market Design Workshop at Harvard Business Schoo, the Microeconomics group at Humbodt University Berin, the NetEcon 09 workshop, the IJCAI Workshop on Inteigence and Interaction, and the 2010 NBER market design conference for very usefu feedback.we are particuary thankfu for feedback from A Roth, Haoqi Zhang, and Mike Ruberry. Seuken gratefuy acknowedges the support of a Microsoft Research PhD Feowship. Schoo of Engineering & Appied Sciences, Harvard University, 33 Oxford Street, Cambridge, MA 02138, {seuken, parkes}@eecs.harvard.edu. Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, {cdx, dmax, marycz, kamaj, siddpuri, desney}@microsoft.com

2 1. Introduction Reiabe, inexpensive, and easy-to-use backup soutions are becoming increasingy important. Individua users and companies reguary ose vauabe data because their hard drives crash, their aptops are stoen, etc. Aready in 2003, the annua costs of data oss for US businesses aone was estimated to be $18.2 Biion [23]. With broadband connections becoming faster and cheaper, onine backup systems are becoming more and more attractive aternatives to traditiona backup. There are hundreds of companies offering onine backup services, e.g., SkyDrive, Idrive, Amazon S3. Most of these companies offer some storage for free and charge fees when the free quota is exceeded. However, a of these services rey on arge data centers and thus incur immense costs. Peer-to-peer (p2p) backup systems are an eegant way to avoid these data center costs by harnessing otherwise ide resources on the computers of miions of individua users: a users must provide some of their resources (storage space, upoad bandwidth, downoad bandwidth, and onine time) in exchange for using the backup service. Whie the tota network traffic increases with a p2p soution, the primary cost factors that can be eiminated are 1) costs for hard drives, 2) energy costs for buiding, running and cooing data centers 1, 3) costs for arge peak bandwidth usage, and 4) personne costs for computer maintenance. A study performed by Microsoft in 2008 showed that about 40% of Windows users have more than haf of their hard disk free and thus woud be suitabe candidates for using a p2p backup system. Our own recent user study [21] found that many users are not wiing to pay the high fees for server-based backup and more than haf of our participants said they woud consider using p2p backup instead. Thus, there is definitey a considerabe demand for p2p backup appications. In fact, a series of p2p backup appications have aready been depoyed in practice (e.g., Wuaa, Amydata). A drawback of the the existing systems is, that a users are generay required to suppy the resources space, upoad and downoad bandwidth in the same ratios. Our p2p backup system is nove in that it uses a market to aocate resources more efficienty than a non-market-based system coud. Furthermore, we provide users with incentives to contribute their resources. This is in contrast to non-price based systems ike BitTorrent for exampe, where numerous research has shown that without proper incentives, fie avaiabiity rapidy decreases over time unti most content finay becomes unavaiabe [19]. In our system, the reative market prices for the different resources function as compact signas of which resources are currenty scarce, and propery motivate those users who vaue a specific resource east, to provide it to the system in a arge quantity. Some users might need most of their own disk space to store arge amounts of data and thus prefer to sacrifice some of their bandwidth. Other users might use their Internet connection a ot for services ike VOIP or fie-sharing and might have a high disutiity if the quaity of those services were affected. We aow different users with idiosyncratic preferences to provide different resource bundes, and we update prices reguary taking into account aggregate suppy and demand of a resources. The design of a p2p backup market invoves a series of unusua chaenges, in particuar at the intersection of market design and user interface (UI) design. The first and biggest chaenge is that users of a backup system do not expect to interact with a market in the first pace, and might find a market a very odd concept in this domain. This raises the question of how to dispay prices to the users if they don t even know they are interacting with a market-based system. Furthermore, users cannot be expected to monitor account baances or to make payments to the system. This chaenge arises in many domains, especiay in many emerging eectronic markets where thousands or miions of non-sophisticated users interact with market-based systems. Whie these markets often provide 1 In 2008, data centers in the US were responsibe for about 3% of the country s energy consumption. Note that a p2p backup system cannot ony reduce costs but is aso more environmentay friendy due to reduced carbon emissions. 2

3 arge benefits to the users, they can aso be unnatura or compex such that individuas may not have an easy time interacting with them. To address this chaenge in a principed way, we introduce a new design paradigm which we ca hidden market design. When designing hidden markets, we attempt to minimize or hide the compexities of the market to make the interaction for the user as seamess as possibe. A hidden market encompasses both, the design of a UI for the market and the design of the economics of the market. A p2p backup appication is particuary we suited to iustrate the hidden markets paradigm because the appication targets miions of technicay unsophisticated users, in a domain where markets are very unexpected and where many users might find the use of rea money unusua. Our proposed design hides many common market aspects from the users. A second market design chaenge arises from the fact that users wi ony infrequenty interact with this market. They wi not continuousy update their settings, and thus, price changes wi ony affect suppy and demand after a deay. As a consequence, the system wi be out of equiibrium most of the time, whie trades must be enabed at a times. The third chaenge is the combinatoria aspect of the resource suppy that is needed for the production of backup services. A users must provide a certain amount of a resources, even if they currenty ony consume a subset of them. For exampe, a user who ony contributes storage space is useess to the system because no fies coud ever be sent or received from that user if no bandwidth is provided. We ca these combinatoria market requirements the bunde constraints because ony bundes of resources have vaue. Dispaying the bunde constraints in a simpe way is a major chaenge for the UI design. Because many of these chaenges are quite unusua, providing a simpe method of interaction to the users, in a domain where they don t expect a market, requires the deveopment of new techniques for UI and market design Outine and Overview of Resuts We present the market and UI design for a p2p backup system and provide a theoretica and experimenta anaysis of its properties. In Section 2, we introduce the preiminaries of the p2p resource market. We enabe the market using a virtua currency ony, which avoids the various compications a rea-word currency brings aong (e.g., state, federa, and internationa banking aws) and aso makes the system more natura to use. In Section 3, we first expain the hidden market design paradigm in more detai and then describe the various eements of the specific market UI we deveoped for the p2p backup system. In a rea p2p backup system, we must expect a deay in users updating their settings upon price changes, and thus the system wi be out of equiibrium most of the time. In contrast to previous work on data economies, the market is designed to work we even when not in equiibrium. In our system, users do not have to continuousy update demand and suppy and instead periodicay choose bounds on their maximum suppy and demand. We describe a new sider contro, which simpifies the dispay of the bunde constraints and provides the users with a inear interaction with the system. These siders guarantee that users can ony choose suppy ratios that satisfy certain constraints, which enabes us to support the market equiibrium with inear prices. The UI exposes the effect of prices to users ony impicity, so as to avoid invoking a menta mode of a monetary system, and it competey hides the users account baances and the payments made in the system. The economics of the market aso invove some unusua design choices. In Section 4, we describe the market design in detai and ist a series of properties of our system design that aow us to mode the market as an exchange economy, even though production is happening. In Section 5, we begin the anaysis of the market equiibrium by advancing a new equiibrium concept, the buffer equiibrium. Because the p2p backup market wi be out of equiibrium most of the time, we must aways have a certain buffer between suppy and demand of a resources. We show that the buffer between suppy and demand is maxima in the buffer equiibrium, which motivates it as a desirabe target concept. 3

4 We prove that under very reasonabe assumptions, the equiibrium is guaranteed to exist, and is unique. This resut aso hods if a certain percentage of the user popuation is price-insensitive or even adversaria. However, we show that the more freedom we give users in choosing their suppy settings, the ess robust the system becomes against adversaria attacks. Furthermore, we show that the size of the buffer in equiibrium cannot be controed via price updates aone. We describe which changes in the UI woud be necessary to give the market operator contro over the buffer size. In Section 6, we introduce a price update agorithm that ony requires system-wide suppy and demand information to update prices. We prove that the agorithm converges ineary towards the buffer equiibrium when initia prices are chosen cose enough to equiibrium prices. Finay, in Section 7, we present resuts from a formative usabiity study of our system, evauating how we users can interact with the new hidden market UI. The resuts are encouraging and show promise for the hidden market paradigm Reated Work Ten years ago, the research projects OceanStore [14] and FarSite [3] aready investigated the potentia of distributed fie systems using p2p. Both projects, however, did not take the sef-interest of individua users into account and did not perform any kind of market design. More recenty, researchers have ooked at the incentive probem, often with the primary goa to enforce fairness (you get as much as you give). Samsara [5] is a distributed accounting scheme that aows for fairness enforcement. However, it does not enabe a system where different users can suppy resources in different ratios whie maintaining fairness, which is the primary advantage of our market-based system. The idea to use eectronic markets for the efficient aocation of resources is even oder than ideas regarding p2p storage systems. Aready in 1996, Ygge et a. [25] proposed the use of computationa markets for efficient power oad management. In the ast five years, grid networks and their efficient utiization have gotten particuar attention [15]. Fundamenta to these designs is that participants are sophisticated users abe to specify bids in an auction-ike framework. Whie this assumption seems reasonabe in energy markets or computationa grid networks, we are targeting miions of users with our backup service and thus we cannot assume that users are abe and wiing to act as traders on a market when they want to backup their fies. In the ast three years, human computer interaction researchers have gotten more interested in topics at the intersection of UI design and economics. Hsieh et a. [11] test whether the use of markets in synchronous communication systems can improve overa wefare. Hsieh et a. [10] expore a simiar idea in the domain of question and answer appications where users coud attach payments to their questions. Whie their use of markets is simiar in vein to our approach, i.e., using markets to most efficienty aocate resources as is standard in economics [9], in both papers they used a very expicit UI showing monetary prices to the users. Satu and Parikh [18] compare ive outcry market interfaces in scenarios such as trading pits and eectronic interfaces. They draw a distinction between trying to bindy repicate the rea word in the UI, and ocating defining characteristics that must be supported. In our work, we adopt this phiosophy and attempt to mask the unnecessary affordances in the hopes that the reevant ones become easier to use. From the UI design point of view, the work that is cosest to our approach is Yoopick, a combinatoria sports prediction market [8]. This appication provides a very intuitive UI for trading on a combinatoria prediction market. The designers successfuy hide the compexity of making bets on combinatoria outcomes by etting users specify point spreads via two siders. This approach is very much in ine with the hidden market paradigm. On the theoretica side, the two papers most simiar to our work are by Aperjis et a. [2] and 4

5 Freedman et a. [7]. They anayze the potentia of exchange economies for improving the efficiency of fie-sharing networks. Whie the domain is simiar to ours, the particuar chaenges they face are quite different. They use a market to baance suppy and demand with respect to popuar or unpopuar fies. However, in their domain there is ony one scarce resource, namey upoad bandwidth, whie we design an exchange market for mutipe resources. Furthermore, their design does not attempt to hide any of the market aspects from the users. There exist mutipe p2p backup appications that are being used in practice and the appication most simiar to ours is Wuaa ( However, we know of no other p2p backup system that uses a market. In the other backup systems, the ratios between the suppied resources space, upoad and downoad bandwidth are fixed, and the same across a users. The advantage of our market-based approach is the additiona freedom we give the users. Aowing them to suppy different ratios of their resources increases overa economic efficiency and makes the system more attractive for every user. Note that without using a market, this freedom woud not be possibe, because there woud be no mechanism to incentivize the users to suppy the scarce resources. 2. The p2p Resource Market: Preiminaries Our system uses a hybrid p2p architecture where a fies are transferred directy between peers, but a dedicated server coordinates a operations and maintains meta-data about the ocation and heath of the fies. The roe of the server in this system is so sma that standard oad-baancing techniques can be used to avoid scaing bottenecks. Each user in the system is simutaneousy a suppier and a consumer of resources. A peer on the consumer side demanding a service (backup, storage, or retrieva) needs mutipe peers on the suppier side offering their resources (space, upoad and downoad bandwidth, and onine time). The production process of the server (bunding mutipe peers and coordinating them) is essentia, turning unreiabe storage from individua peers into reiabe storage. Each peer on the suppier side offers a different resource bunde whie each peer on the consumer side gets the same product, i.e., a backup service with the same, high reiabiity. One natura concern about p2p backup is that individua users have a much ower avaiabiity than dedicated servers. Thus, a p2p system must maintain a higher fie redundancy to guarantee the same fie avaiabiity as server-based systems. Simpy storing mutipe fie copies woud be very costy. Fortunatey, we can significanty reduce the repication factor by using erasure coding [16]. The erasure code spits up a fie into k fragments, and produces n > k new fragments, ensuring that any k of the n fragments are enough to reconstruct the fie. Using this technique, we can achieve the same high reiabiity as sever-based systems whie keeping repication ow. For exampe, if users are onine 12h/day on average, using erasure coding we can achieve a fie avaiabiity of % with a repication factor as ow as 3.5, compared to simpe fie repication which woud have a factor of 17. The process for backing up fies invoves four steps. First, the user s fies are compressed. Then the compressed fies are automaticay encrypted with a private key/password that ony the user has access to (via Microsoft LiveID). Then, the encrypted fie is erasure coded, and then the individua fragments are distributed over hundreds of peers. Using this process, the security of the p2p backup system can be made as high as that of any server-based system. Tabe 1 describes the five high-eve operations in the p2p system. Note that a of the system-eve processes happen without user interaction. A the user has to do is initiate a backup operation, a retrieva operation, or deete his fies when he wants to. 5

6 Operation Description Resources Required from Suppiers Backup Storage Retrieva Repair Testing When a user performs a backup, fie fragments are sent from the consumer to the suppiers. Suppiers must persistenty store the fragments they receive (unti they are asked to erase them When a user retrieves a backup, fie fragments are sent from the suppiers to the consumer. When the server determines a backed up fie to be unheathy, the backup is repaired. If necessary, the server initiates test operations to gather new data about a peer s avaiabiity. Downoad Bandwidth Space Upoad Bandwidth Downoad and Upoad Bandwidth Downoad and Upoad Bandwidth Tabe 1: Operations and their Required Resources. Prices, Trading & Work Aocation. A trades in the market are done using a virtua currency. Each resource has a price at which it can be traded and in each transaction the suppiers are paid for their resources and the consumers are charged for consuming services. Prices are updated reguary according to current aggregate suppy and demand, to bring the system into equiibrium over time. Trading is enabed via a centraized accounting system, where the server has the roe of a bank. The server maintains an account baance for each user starting with a baance of zero and aows each user to take on a certain maxima deficit. The purpose of the virtua currency is to aow users to do work at different points in time whie keeping a contributions and usages baanced over time. Users have a steady infow of money from suppying resources and outfow of money from consuming services, which varies over time. In steady state, when users have been onine ong enough, their income must equa their expenditure. Users cannot earn money when they are offine but must sti pay for their backed up fies. Thus, their baance continuousy decreases during that time. When using rea money, we coud simpy charge users credit cards as their baance keeps decreasing. However, as ong as we do not use rea money, the maximum deficit that users can take on must be bounded. Utimatey, it is a poicy decision what happens when a user hits a pre-defined deficit eve. Our system wi first notify the users (via emai and visuay in the appication) and present options to remedy the situation (e.g., increase suppy). Faiing this after a reasonabe timeout period (e.g., 4 weeks), the users backups wi be deeted. The server is invoved in every operation, coordinating the work done by the suppiers and aocating work to those users with the owest account baances to drive a accounts (back) to zero over time. This is possibe because users steady-state income must equa their expenditure. Thus, when users have been onine for a sufficient time period, their account baance is aways cose to zero. 3. The Hidden Market User Interface The UI is an essentia aspect of the market design because it defines the information fow between the user and the market. The server needs to eicit a user s individua preferences, and a user needs to experience the current market prices. However, direct preference eicitation methods (directy 6

7 asking the users for their vauations) are infeasibe to impement because the amount of communication woud be too high, but more importanty, because the majority of users are non-experts and woud find such an interaction very compicated, unnatura, and cumbersome. To make the interaction for the user as easy as possibe, we design a hidden market UI where we attempt to mask as much of the prices, account baances, trading constraints, etc. from the user as possibe. To do this, we project a hidden market UI wrapped around the actua market to expose a simpified interface to the user (iustrated in Figure 1). The goa in designing this hidden market UI is to estabish a feedback oop between the market and the user, without invoking a menta mode of a monetary market. Figure 1: The hidden market UI wraps around the compex underying market and exposes a simper interface, invoking a particuar menta mode in the user, whose actions infuence the market What You Give is What You Get Figure 2 dispays the market UI. The user can open this settings window to interact with the market. This window is separated into two sides: on the eft side, the users can choose how much onine backup space they need. On the bar chart the users can see how much they have aready backed up and how much free onine backup space they have eft. On the right side of the window, the users can choose how much of their own resources they want to give up in return. On the top of the right side, the users see the storage path, i.e., where the fie pieces from other users are stored on their own computers. Then, for each of the resources of space, upoad and downoad bandwidth, there is a separate sider which the users can move to specify how much of that resource the system shoud maximay use. 2 Beow the siders the current average onine time of the users is dispayed. 3 Next to the onine time information the system aso tes the users the effect of eaving their computer onine for one more hour per day (i.e., how much more onine backup space they woud get in return). This sha make the users aware of the important roe of their onine time: the onger the users are onine, the more usefu their suppy of space, upoad and downoad bandwidth becomes, and thus the higher their income. To change anything about their settings, the users can drag the bar chart on the eft side up or down, move any of the siders on the right side, or change how often they are onine. Both sides of the window are connected to each other, such that a change on either side affects and dynamicay updates the vaues on the other side as we. The semantics of this connection are important: on average, users must pay for the tota consumption chosen on the eft side with the suppy chosen on 2 The maximum vaue for these siders can be determined automaticay: the imit for space is simpy the free space on the users hard drives; the bandwidth imits can be determined via speed tests. 3 To change this vaue the users have to eave their computer onine for more or fewer hours per day than they are currenty doing, though we can conceive of schemes in which the appication can directy contro such settings as power savings and hibernate mode. 7

8 Figure 2: Screenshot of the advanced settings UI. On the eft side, the user can choose the desired amount of onine backup space. On the right side, the user can fine-tune the suppy settings if desired. Account baances, prices and payments are hidden from the user. the right side. If a user increases any of the siders on the right then the bar chart on the eft grows because the amount of free onine backup space increases. If a user decreases a sider then the bar chart on the eft shrinks, because the amount of free onine backup space decreases. When a user directy drags the bar chart up or down to choose how much free onine backup space he wants, then the three siders on the right side move eft or right, proportionay to their previous position. 4 The UI aows users to express their idiosyncratic preferences over consuming backup services and suppying their resources. For exampe, if a user needs 20 GB of free onine backup space, there are severa different sider settings that aow this. Some users might specify to give more space and ess bandwidth, others might specify it the other way around, depending on their avaiabe resources and individua preferences. Because a user s preferences can change over time this is not a task that can easiy be automated. Note that we do not expect users to constanty adjust their settings. Rather, we expect users to choose settings that give them enough onine backup space such that they do not have to worry about their settings for a whie. However, as they near their quotas, the system wi notify them (via an emai and visuay in the appication). At that point, we expect most users to adjust their siders again, according to their preferences and then current market conditions Combinatoria Aspects of the Market: Bunde Constraints The first chaenge regarding the hidden market design for this appication is the combinatoria nature of the market, i.e., the probem that ony bundes of resources are usefu to the system. In genera, the 4 Note that in practice we expect roughy two categories of users: basic users wi ony ever use the eft side of the window to choose how much onine backup space they need. They either do not care about which resources they give up, or they do not even understand the meaning of upoad bandwidth, downoad bandwidth, etc. The second category of users are the advanced users, i.e., those users that understand the meaning and reevance of giving up their own resources and want to contro their suppy. In a depoyed system, the settings window woud initiay show the eft side of the window and ony upon cicking an advanced button woud the right side appear. 8

9 Figure 3: The new sider contro provides an indirect visuaization of the bunde constraints. When user provides more of one resource than is usefu to the system, gets notified via a sma popup window. free onine backup space increases when the users increase one of their siders. However, this is ony true for a subset of possibe sider positions. In particuar, if a user keeps increasing one sider towards the maximum whie the other two siders are reativey ow, at some point the onine backup space on the eft might stop increasing. For exampe, if users imit their upoad bandwidth to 5 KB/s, then increasing their space suppy from 50 GB to 100 GB shoud not increase their onine backup space. We woud simpy never store 100 GB on these users hard disks because 5 KB/s woud not be enough to have a reasonabe retrieva rate for a of these fie pieces. Thus, for the system to use the whoe suppy of 100 GB, the users woud first have to increase their suppy of bandwidth. An anaogous argument hods true for other combinations of resources. For exampe, if a user wanted to give a ot of upoad bandwidth but keep the suppy of space ow, then at some point giving more bandwidth woud not be usefu. Again, to make use of the downoad bandwidth, the system woud need to store many fie pieces on that user s computer which is not possibe given the current ow imit on space. 5 Because of these bunde constraints, we need users to respect certain suppy ratios when choosing their suppy settings. To provide the users with some visua information regarding how much suppy of a resource is usefu to the system given the current other sider settings, we augmented the traditiona sider UI eement, buiding the new sider contro shown in Figure 3. The siders are coored bue and gray, and the egend on the top right of the window expains the coor coding. In the bue region, sider movements have an effect on the onine backup space because setting the sider to any position inside that region means that the system can effectivey use a of the suppied resource. The gray region of the sider is the region where sider movements no onger have an effect on the user s onine backup space because giving that much of the resource is not usefu to the system, given the other settings. Because the coors and the egend might be difficut to understand or be overooked, we aso notify the user once the sider is moved from the bue into the gray region with a sma pop up message that disappears once the mouse button is reeased (see Figure 3). The coor-coded siders provide the user with a the necessary information about the bunde con- 5 These bunde constraints ony appy to space, upoad and downoad bandwidth. For avaiabiity there is no minimum or maximum suppy that is usefu, independent of the other resources. 9

10 straints. When one sider is moved down, the bue regions on the other two siders first stay the same and eventuay decrease. Anaogousy, when one sider is moved up, the bue regions on the other two siders first increase and eventuay stop increasing. If a user sets the siders in the same ratios as the system-wide usage of a resources, they are aways inside the bue regions. However, requiring this exact ratio from a users is too restrictive, ignoring the system s fexibiity in aocating work. For exampe, the system can aocate more repair and testing operations to users that prefer to give up ots of bandwidth instead of space. Furthermore, the system can estimate how often certain users access their backups and then send fie fragments from cod backups to users who prefer to give up more storage space rather than bandwidth. To maximize overa efficiency, we make use of this fexibiity, and aow every user to suppy different ratios of their resources, within certain bounds of the system-wide ratios. In Section 4.2, we expain this concept more formay Exposing/Dispaying Market Prices Because the UI gives users some freedom in choosing their resource suppy, we must price the resources correcty. In our system, prices are updated daiy depending on aggregate demand and suppy, moving the system into equiibrium over time. Without updating prices, we might have a suppy shortage for some resources. For exampe, many users might decide to give ots of disk space and itte bandwidth. To counteract a shortage of bandwidth, we woud increase the price of bandwidth, incentivizing users to give more bandwidth instead of space. But for this mechanism to work, it is necessary that prices are at east indirecty exposed to users, so they can react and change their suppy settings. For exampe, if the price for upoad bandwidth went up reative to downoad bandwidth, then users might benefit from increasing their upoad bandwidth suppy a itte and in return decreasing their downoad bandwidth suppy a ot. However, users don t expect monetary transactions in a backup appication, which aso renders prices an unnatura concept. This is why we have chosen to hide the prices in the UI as much as possibe. In our UI, a user can experience the reative prices indirecty by moving the siders whie observing the bar chart on the eft. If a user moves a sider a itte and the bar chart ony changes a itte, this means that the current price for that resource is reativey ow. If a user moves a sider a itte and the bar chart changes a ot, this means that the current price for that resource is reativey high. This is one of the essentia aspects of this hidden market UI: it aows us to communicate the current market prices to a user in a non-expicit way. In particuar, users can be unaware of the price-based market underying the backup system, and yet over time they wi notice that for some resources they get more in return than for others. They can then choose the suppy combination that is currenty best given their preferences. Note that one of the market design goas was to impement a very simpe pricing system to provide even non-expert users with a seamess interaction. We achieve this, despite the bunde constraints, by providing the users with a inear interaction with the system, as ong as they move the siders within the bue regions (the bar chart on the eft moves up and down ineary when a user moves one of the siders on the right). More specificay, we expose simpe, inear prices to the users, and take care of the bunde constraints by restricting the choices they can make in the UI using the sider contros. 4. Market Design & Economic Mode In this section we introduce a forma economic mode to describe the market design in detai and to aow for a theoretica economic anaysis of the properties of the p2p market system. At a times, the mode is formuated such as to represent the impemented system as cosey as possibe. 10

11 4.1. User Preferences The economy comprises I users who are simutaneousy suppiers and consumers. The set of commodities in the market is denoted L = {S, U, D, A, B, Σ, R}. The first four commodities are space (S), upoad bandwidth (U), downoad bandwidth (D), and avaiabiity (A), which are the resources that users suppy. The ast three commodities are backup service (B), storage service (Σ), and retrieva service (R), which are the services that users consume. By sighty abusing notation, we sometimes use S, U, D, etc. as subscripts, and sometimes they denote the resource domain, e.g., for a particuar amount of upoad bandwidth u we require that u U. Each user i has a fixed endowment of the suppy resources (defined by the user s hard drive and Internet connection), denoted w i = (w is, w iu, w id, w ia ) S U D [0, 1]. The next aspect of the mode is driven by our UI. Via the siders, the user seects upper bounds for the suppy vector, which we denote X i = (X is, X iu, X id, X ia ). In return for the suppy X i, the user interface shows the user the maximum demand of services, denoted Y i = (Y ib, Y iσ, Y ir ). In Figure 2 the user has currenty chosen X is = 80.8GB, X iu = 400KB/s, X iu = 300KB/s and X ia = 0.5 as the maximum suppy vector. At any point in time, a certain set of resources from the user are being used, aways ess than X i, and a certain set of services is being demanded. We denote user i s current suppy as x i = (x is, x iu, x id, x ia ), and anaogousy user i s current demand for services as y i = (y ib, y iσ, y ir ). The user does not choose x i and y i directy via the UI. Instead, the server chooses x i (obeying the bound X i ) such that user i can afford the current demand y i which the user simpy chooses by backing up fies or retrieving them. Note that the UI dispays the user s consumption vector in an aggregated way; i.e., instead of isting the services backup, storage, and retrieva separatey, we simpy dispay the currenty used onine backup space (= 17.28GB in Figure 2) and the maximum onine backup space that user coud consume (= 33.5GB in Figure 2). In practice, users have a certain cost for opening the settings window and adjusting the settings. Instead of modeing this cost factor directy, we assume that when users open their settings window, they are panning ahead for the whoe time period unti they pan to open the settings window the next time. Whie a user might currenty consume y i, he pans for consuming up to Y i the next time he opens the settings window. He then seects the suppy vector X i that he is wiing to give up to get this Y i. The user cares about how arge the bounds on his suppy are, because he has negative utiity for giving up his resources. To make this more forma, we et K i = w i X i with K i S U D A, denote the vector of resources that the user keeps, i.e., his endowment minus the suppy he gives up. Note that any changes to X i transate into changes for K i and vice versa because the endowment vector w i is fixed. We ony introduce K i to define a preference reation that is monotone in a components, but we wi use the suppy vector X i going forward. We can now specify the user s preference reation over a the resources he keeps, and the services he consumes: i (K is, K iu, K id, K ia, Y ib, Y iσ, Y ir ). We make the foowing assumptions which are a standard in economics (cf. [17], chapters 1-3): Assumption 1. Each user s preference reation i (K is, K iu, K id, K ia, Y ib, Y iσ, Y ir ) is (i) compete, (ii) transitive, (iii) continuous, (iv) stricty convex, and (v) monotone. Strict convexity requires stricty diminishing margina rates of substitution between two goods, i.e., we need to compensate a user more and more with one good as we take away 1 unit of another good. This is a reasonabe assumption because it represents a genera preference for diversification. Monotonicity means that a commodities are goods, i.e., if we give users more of any of the commodities, they are at east as we off as before. 6 Given compete, transitive, and continuous preferences, there 6 Note that we do not assume strict monotonicity because we wi ater assume that service products are perfect 11

12 exists a utiity function u i (K i, Y i ) = u i (K is, K iu, K id, K ia, Y ib, Y iσ, Y ir ) that represents the preference reation and this utiity function is continuous (cf. [17], p.47). As mentioned before, the ony resource that is not subject to the combinatoria bunde constraints, is avaiabiity: as ong as the user s avaiabiity is arger than zero, the other resources can be used. To simpify the economic mode and pricing of resources, we introduce three new composite resources S, U, and D, incorporating the user s avaiabiity into the other resources in the foowing way: X iu U = X iu X ia X id D = X id X ia X is S = φ(x is, X ia ) X is X ia overhead factor Note that this notation denotes composite and not vector quantities. The definitions for the composite resources upoad and downoad bandwidth are straightforward: we mutipy the bound on bandwidth the user suppies (e.g., 300 KB/S) with the user avaiabiity [0, 1] and then mutipy it with 24 hours, 60 minutes and 60 seconds, to cacuate how many KBs we can actuay send to this user per day. The definition of X is is a itte more intricate because the user s avaiabiity does not enter ineary into the cacuation. However, it enters monotonicay, i.e., more avaiabiity is aways better. Here, it suffices to know that the server can compute this function φ and convert a user s space and avaiabiity suppy into the new composite resource. We can now define user i s suppy vector for the three composite resources: X i = (X is, X iu, X id ). The advantage of using these avaiabiity-normaized composite resources is that now, the suppy from different users with different avaiabiities is comparabe. For exampe, 1 unit of S from user i with avaiabiity 0.5 is now equivaent to 1 unit of S from user j with avaiabiity 0.9. Obviousy, internay user i has to give much more space to make up for his ower avaiabiity, but in terms of bookkeeping, we can now operate directy with composites. We define the aggregate suppy vector for the composite resources as X = i X i, and anaogousy for Y, x and y. We make the foowing we-known observation (cf. [17], chapter 3) that wi be usefu ater: Observation 1. The individua and aggregate suppy and demand functions X i, Y i, X, and Y are homogeneous of degree zero Production Functions and Sack Constraints We have aready mentioned the important roe of the server in our market, i.e., that of combining resources from different suppiers into a vauabe bunde. Note that the server is in fact the ony producer in the market. One can think of this as if every user had access to the same production technoogy to convert input resources into services. This is crucia for our mode and the economic anaysis, because it aows us to define an exchange economy where the users ony exchange factor inputs, despite the fact that production is happening in the market (cf. [17], pp ). Thus, for each service, we have one production function that defines how many input resources are needed to produce one unit of that service: Backup: f B : S U D B Storage: f Σ : S U D Σ Retrieva: f R : S U D R compements, which vioates strict monotonicity of preferences. We discuss this in more detai in Section 5. 12

13 These production functions are defined via the impementation of our system, i.e., the particuar production technoogy that we impemented. For exampe, they are defined via the particuar erasure coding agorithm that is being used, by the frequency of repair operations, etc. Thus, we can now specify a series of properties that these production functions guarantee due to our impementation: System Property 1. (Fixed Production Functions) Production functions are fixed and the same for a users. System Property 2. (Additivity) The production functions are additive, i.e., {B, Σ, R} and for any two resource vector x 1 and x 2 : f ( x 1 + x 2 ) = f ( x 1 ) + f ( x 2 ). System Property 3. (CRTS) The production functions exhibit constant returns to scae (they are homogeneous of degree 1), i.e., {B, Σ, R}, for any x, and k R : f (k x) = k f ( x). System Property 4. (Bijectivity) Each production function is bijective, and thus we can take the inverses: f B 1 : B S U D f Σ 1 : Σ S U D f R 1 : R S U D Property 1 hods because the server is the ony producer, and because of the way we have defined the composite resources, with any differences between the users avaiabiities aready considered. Properties 2 (Additivity) and 3 (CRTS) hod because the erasure coding agorithm (which defines the production technoogy) exhibits these properties. 7 Property 4, the bijectivity of production, hods, because for each service unit, there is ony one way to produce it. For exampe, to backup one fie fragment, the erasure coding agorithm tes us exacty how many suppier fragments we need, and the server tes us how much repair and testing traffic we can expect on average per fragment. Furthermore, it is obvious that sma changes in the input of the inverse production functions resut in sma changes in the output. More formay: System Property 5. (Continuity) The inverse production functions are continuous. Given the inverse functions for the individua services backup, storage, and retrieva, we can define an inverse function for a three-dimensiona service vector (b, σ, r) B Σ R: (b, σ, r) = f B 1 (b) + f Σ 1 (σ) + f R 1 (r) (1) Given a demand vector y, we use (y) to refer to the vector of suppy resources that are necessary to produce y. Furthermore, we use 1 1 (y), f (y), and f (y) to refer to the individua amounts of S U D suppy resources that are necessary to produce y. We now formaize the fexibiity we give our users in setting different ratios of their suppied resources. Because of the bunde constraints, a user cannot reduce his suppy of resource k towards zero without affecting the suppy of his other resources. To determine what ratios are acceptabe, i.e., 7 Note that these two properties ony hod approximatey and not exacty, and ony for fie sizes above a certain threshod (approx. 1MB). Very sma fies are an exception and need specia treatment in the impementation, because they are more expensive to be produced (again due to the erasure coding). We take care of this in the impementation by charging users more when they are backing up sma fies (essentiay we have two sets of prices, one for norma fies and one for sma fies). 13

14 usefu to the system, we ook at the system-wide usage of each resource k, i.e.: k (y). Certainy, if a user provides his resources in the same ratios as the system-wide usage, then a of his suppy is usabe. However, because the system has fexibiity in aocating differnt kinds of work (repair/testing traffic vs. cod backups vs. hot backups ), we can et the users suppy ratios deviate from the system-wide ratios to a imited degree. We et γ > 1 denote the amount of sack we aow users when setting their suppy-side siders. The corresponding sack constraints, ower-bounding the suppy for resource k, constitute another system property: System Property 6. (Sack Constraints) Given sack factor γ, for each resource k {S, U, D}, the user interface enforces the foowing minimum ratios of suppied resources: i, {S, U, D} \ {k} : X ik 1 X i γ k (Y ) (Y ) Note that the UI does not actuay imit the range of the siders according to the sack constraints. If a user chooses to suppy too itte of one resource such that a sack constraint is vioated, then the system ony uses/considers the maximum amount of the others resource such that the sack constraint binds. The UI visuaizes this to the users via the bue regions, which are effectivey indirect representation of the sack constraints, showing the user which settings are usefu to the system. Thus, Equation 2 correcty modes the sack constraints. If we actuay imited the range of the siders, then making arger changes with the siders (which is necessary to expore the settings space) woud be too tedious. In our impementation, we set γ = 2. Thus, to give an exampe, if the system-wide usage ratio of space to upoad bandwidth were 6, then each user woud have to choose his individua settings with a ratio of space to upoad bandwidth of at east = 3, and the ratio of of upoad bandwidth to space woud have to be at east = How arge we can set γ in practice depends on how fexibe the system is in terms of aocating work (i.e., how many cod vs. hot backups there are, how much repair and testing traffic there is, etc.). In practice, the sack factor γ woud have to be adjusted over time, when the distribution of work changes. This process coud be automated, but here we are not going into the detais of this process. Whie every individua user is free to choose any suppy setting within the sack constraints, of course the aggregate suppy of each resource must aways be arge enough to satisfy current aggregate demand. But if every user chooses a suppy setting such that the same sack constraint binds (e.g., every user minimizes his suppy of upoad bandwidth), then the system does not have enough suppy of the corresponding resource. This is were the pricing agorithm comes into pay: by reguary updating market prices according to current aggregate demand and suppy, we baance the market such that different users wi indeed suppy different ratios of their resources. We discuss this aspect in more detai in Section 5 where we aso prove that for any set of user preferences, there aways exists a price vector that baances the market and guarantees enough suppy of each individua resource Prices and Fow Constraints In Section 3.2, we have expained how we dispay the bunde constraints to the users in the UI. The UI automaticay enforces that the users ony choose suppy vectors that satisfy the sack constraints (cf. System Property 6) and this enabes us to support an equiibrium with inear prices. We use p = (p S, p U, p D ) for the prices for suppied composite resources, and q = (q B, q Σ, q R ) for the demanded services. We require that in steady state, i.e., when a user has been onine ong enough, he can pay for (2) 14

15 his consumption with his suppy. In other words, his fow of suppied resources must be high enough to afford the fow of consumed services. We can express this fow constraint formay: X i p = Y i q (3) At the same time, the server aocates enough work to user i such that the user s current suppy x i is enough to pay for the demand y i, which eads to a second fow constraint: x i p = y i q (4) We make the foowing assumption regarding the usage of resources in the system: Assumption 2. (Cosed System & No Waste) We assume a cosed system where no resources are entering or eaving the market, and we assume that no resources are wasted. Thus, the amount of resources required to produce the current aggregate demand is aways equa to the current aggregate resource suppy, i.e.: (y) = x. Proposition 1. Given a cosed system and no waste of resources (Assumption 2), and given that production functions are additive (System Property 2), the payments from consumer i to the server must equa the payments from the server to the corresponding suppiers, i.e.: y i q = (y i ) p (5) Proof. From the fow constraint in Equation 4 we know that x i p = y i q. By summing over a users on both sides of the equation it foows that x p = y q. Given Assumption 2, we know that (y) = x. By pugging this into the previous equation, we get (y) p = y q. From the additivity of the production functions we know that this is equivaent to i (y i ) p = i y i q. Because each transaction is treated equay in the system (every user is payed the same for the same resources), it foows that (y i ) p = y i q. Using Proposition 1, we can now re-write the fow constraints for user i as: X i p = (Y i ) p and x i p = (y i ) p (6) Thus, from now on, we can omit the price vector q for demanded services and ony need to consider price vector p 8, i.e., a what matters are the reative prices of the suppy resources. Remember that the UI automaticay cacuates and adjusts the maximum demand vector Y i for user i based on the user s suppy bound X i. In practice, the maximum income is divided by the current average income of the user, and the resuting factor is mutipied with the user s current demand, giving us the maximum demand the user can afford: System Property 7. (Linear Prediction for Individua Demand) The system uses a inear demand prediction mode for the cacuation of a user s maximum demand Y i : We make the foowing simpifying assumption: Y i = X i p x i p y i = λ i y i 8 Going forward, pease remember that mutipications with p are aways dot products, and thus p showing up on the eft and the right side of an equation does not cance out. 15

16 Assumption 3. (Linear Prediction for Aggregate Demand) We assume that with a arge number of users, a inear demand prediction is aso correct for the aggregate demand vectors, i.e.: λ : Y = λ y This assumption is justified because in practice, such a system woud have a arge number of users. Let n denote the number of users in the economy, et Y n = n i=1 Y i, y n = n i=1 y i, and et µ(λ i ) denote the mean of the distribution of the λ i s. Given that the λ i s are independent from the y i s, it foows from the strong aw of arge numbers, that if the number of users n is arge enough, then Y n is ineary predictabe by µ(λ i ) y n aong each dimension to any additive error. More specificay, for any ε and δ 0, for arge enough n: 5. Equiibrium Anaysis P r[ Y n µ(λ i ) y n ε] 1 δ. A rea-word instance of the p2p backup appication woud have thousands if not miions of users. Thus, the underying market woud be arge enough so that no individua user had a significant effect on market prices. Consequenty, users can be modeed as price-taking users and a genera equiibrium mode is suitabe to anayze this market. Here we anayze a static equiibrium in which a users adjust their suppy bounds to reach target demand bounds, i.e., whenever the price vector p is updated, user i chooses X i (p) and Y i (p) such as to maximize his utiity. Whie a user does not choose x i (user i s suppy that is currenty used) and y i (user i s current demand vector) directy via the UI, these quantities nevertheess depend on current prices, though indirecty, because x i X i and y i Y i. Thus, whie current demand and suppy vectors x i and y i wi vary much ess with price changes, we must sti mode them as being dependent on prices, and we use x i (p) and y i (p) to refect that. Throughout this section, we assume that System Properties 1 through 7 and Assumptions 1 through 3 hod The Buffer Equiibrium We begin this section by asking the question what the target equiibrium shoud be when we are updating prices. Note that there ony is an equiibrium pricing probem in the first pace because we give users the freedom to suppy different ratios of resources. Without any sack, the UI woud enforce that every user suppied the resources in the same ratios as system-wide demand for resources, and thus price changes woud have no effect. But because we give our users the freedom to choose different suppy ratios, we must update prices over time, to avoid situations where we don t have enough suppy for a resource to satisfy current demand. But what shoud be our target? A standard equiibrium concept in genera equiibrium theory is the Warasian equiibrium, which requires that demand equas suppy such that the market cears. Certainy we want to have enough suppy to satisfy current demand, i.e.: x(p) = (y(p)). But remember that users are not continuousy adjusting x i, and as a consequence, the system wi be out of equiibrium most of the time. Thus, our goa shoud not be to cear the market in equiibrium, but instead to aways have some excess suppy of a resources, to make sure we can satisfy any demand even out of equiibrium. The arger the buffer between the current demand of resources, 16

17 i.e., (y), and the maximum suppy of resources, i.e., X, the safer the system, i.e., the more out of equiibrium it can cope with before running into troube. We wi use this size of the suppy-side buffer repeatedy and thus we define it more formay: Definition 1. (Size of the Suppy-Side Buffer for a Resource) The size of the suppy-side buffer for resource is the ratio of maximum suppy to current demand for that resource, and we denote this buffer with B (p): B (p) = X(p) (y(p)) If we assume that the suppy and demand for the individua resources have the same variance, then the best we can do to maximize the safety of the system out of equiibrium, is to maximize the size of the buffer across a three resources. 9 This naturay eads to the definition of the overa size of the suppy-side buffer: Definition 2. (Overa Size of the Suppy-Side Buffer) The size of the overa suppy-side buffer B(p) is the smaest suppy-side buffer across a resources, i.e.: B(p) = (7) min B (p) (8) {S,U,D} Now the question is, which price vector maximizes the overa suppy-side buffer. It is intuitive, that to maximize the overa suppy-side buffer, the individua buffers must a be equa (otherwise we might update prices to decrease the argest buffer and increase the samest buffer). This naturay eads us to the foowing definition of a buffer equiibrium : Definition 3. (Buffer Equiibrium [Version 1]) A Buffer equiibrium is a price vector p = (p S, p U, p D ), an aggregate suppy vector X(p), and an aggregate current demand vector y(p), such that the individua suppy-side buffers are the same across a resources, i.e.: B S (p) = B U (p) = B D (p) X S (p) (y(p)) = X U (p) (y(p)) = X D (p) (y(p)) (9) S U D It seems very reasonabe to assume that, as we decrease the price for one resource k, the suppy-side buffers for the other two resources wi increase. Decreasing p k makes it ess attractive for the users to suppy resource k, and makes it reativey more attractive to suppy the other resources. If we make this assumption more formay, we can indeed prove that for the suppy-side buffer to be maxima, the system must be in a buffer equiibrium, thus justifying the buffer equiibrium as a desirabe target concept. Assumption 4. (Resource Buffers are Gross Substitutes) We assume that the individua buffer functions B (p) satisfy the gross substitutes condition, i.e., whenever p and p are such that, for some k, p k > p k and p = p for k, we have B (p ) < B (p) for k If we have specific information about the variance in the suppy and demand of certain resources, we woud want to target higher buffers on the resources with high variance and ower buffers on resources with ow variance. This can easiy be incorporated and woud ony ead to a sighty different equiibrium definition. 10 Note that this assumption is simiar to the more standard assumption that the excess demand function satisfies the gross substitute property, however, they are not equivaent. We assume that, as we decrease the price on one resource, the ratio between suppy and demand for a other resources wi increase, whie the standard gross substitutes assumption states that the difference between suppy and demand for a other resources wi increase. Neither assumption impies the other, athough both can be true simutaneousy. 17

18 Proposition 2. Given Assumption 4 (Resource Buffers are Gross Substitutes), when the overa suppy-side buffer B(p) is maxima, then the market has reached a buffer equiibrium. Proof. We present a proof by contradiction. Let s assume that p is a price vector such that the overa suppy-side buffer is maxima, but where the resource buffers are not the same across a resources as they must be in the buffer equiibrium. Assume that k = arg max {S,U,D} B (p), i.e., the buffer for resource k is maxima across a resources. Now, we consider price vector p where we have decreased the price of resource k sighty and kept the prices of the other resources constant, i.e., p k < p k and p = p k. Given that the individua resource buffers satisfy Assumption 4, we know that B (p ) > B (p), and due to homogeneity of degree zero, it aso foows that B k (p ) < B k (p), i.e., the resource buffer size for k has decreased and both other resource buffer sizes have increased. Because of the continuity of users preferences (Assumption 1) and the continuity of the inverse production function (System Property 5), it foows that X(p) and (y(p)) are continuous, and thus we can aways find a sma enough price change from p to p, such that the buffer for resource k is sti maxima, but in the process we have increased the buffers for the other two resources. Thus, the overa suppy-side buffer is arger for p than it was before, i.e., B(p ) > B(p) which vioates our assumption that the suppy-side buffer with price vector p is maxima, which eads to a contradiction and competes the proof. We have just shown that when the overa suppy-side buffer is maxima, then the market has reached a buffer equiibrium. One concern might be that this does not automaticay impy that the suppy-side buffer wi be maxima in every buffer equiibrium. However, we wi show in Section 5.4 that under certain assumptions, the buffer equiibrium is unique, which removes this concern and impies that the buffer equiibrium is indeed a good target concept. Note that we truy beieve that Assumption 4 is satisfied in our domain, and thus, the overa suppy-side buffer is indeed maxima in the buffer equiibrium. However, we do not need this assumption going forward. We ony used it to provide a forma motivation for the introduction and use of the buffer equiibrium concept, but a statements in the remainder of the paper are aso true for the buffer equiibrium, without this assumption. We now offer an aternative definition of the buffer equiibrium which reates it to the we-known concept of a Warasian equiibrium: Definition 4. (Buffer Equiibrium [Version 2]) A Buffer equiibrium is a price vector p = (p S, p U, p D ), an aggregate maximum suppy vector X(p), and an aggregate maximum demand vector Y (p), such that: X(p) = (Y (p)) i.e., it is a Warasian equiibrium defined on the suppy and demand bounds chosen by the users. It is easy to show that the two definitions for the buffer equiibrium are equivaent (proof provided in Section A of the Appendix): Lemma 1. Given Assumption 3 (Linear Prediction for Aggregate Demand), the 1. and 2. definitions of the Buffer Equiibrium are equivaent, i.e.: B S (p) = B U (p) = B D (p) X(p) = (Y (p)). 18

19 5.2. Equiibrium Existence In this section, we prove that a buffer equiibrium exists in our mode. We et L = {S, U, D} and we use to index a particuar composite resource. We define the vector-vaued reative-buffer function Z(p) which measures the reative buffer for each individua resource in the foowing way: Z (p) = X ( (p) (y(p)) k k L X k (p) (y(p)) In words, the first term represents the suppy to demand ratio of the particuar good. The second term represents the average suppy to demand ratio, in our case averaged over the three goods storage space, upoad and downoad bandwidth. Thus, Z (p) represents how far the buffer between suppy and demand for good is away from the average buffer. We have reached a buffer equiibrium when the buffer is the same for a goods, i.e., when: Z(p) = 0. Lemma 2. Given that users preferences are strongy monotone with respect to suppy resources, the reative-buffer function Z( ) has the foowing property: If p n p, with p 0 and p k = 0 for some k, then for n sufficienty arge : Z (p n ) > Z k (p n ). Proof. Because p 0, for n arge enough, there exists a resource such that p n > 0. As the price of resource k {S, U, D} goes towards zero, due to users stricty convex and strongy monotone preferences for suppy resources, they wi suppy ess and ess of k, and suppy more of the other resources instead, at east of resource whose price is bounded away from zero. However, because of the sack constraints, the users cannot reduce their suppy of resource k towards zero, or increase their suppy of resource arbitrariy high. Let γ > 1 denote the sack factor we aow users when setting their preferences. The corresponding sack constraints (see System Property 6), ower-bounding the suppy for resource k, are: L \ {k} : X ik (p n ) 1 γ k (y(pn )) (y(p n )) X i(p n ) As p n p with p 0 and p k = 0, for n arge enough, p n k wi be sufficienty cose to zero, such that each user i chooses to suppy the minima amount of resource k that is possibe. Thus, at east with respect to one of the other resources or m, the sack constraint wi be binding, i.e.,: i : X ik (p n ) = 1 γ k (y(pn )) (y(p n )) X i(p n ) X ik (p n ) = 1 γ k (y(pn )) fm 1 (y(p n )) X im(p n ) This does not mean that the sack constraint wi be binding for the same resource or m for every user. In fact, it is possibe that user i wi minimize his suppy of resources k and, whie user j minimizes his suppy of resources k and m. However, because every user contributes east to the suppy-side buffer for resource k, this impies: : and this impies that: : Z (p n ) > Z k (p n ). X (y(p n )) > X k k (y(pn )) ) (10) 19

20 Theorem 1. A buffer equiibrium exists in the p2p exchange economy, given that users preferences are continuous and stricty convex, monotone w.r.t. service products as we as strongy monotone w.r.t. to suppy resources. Proof. Consider the reative buffer function Z(p). We have noted in Observation 1 that X(p) and y(p) are both homogeneous of degree zero, and this impies that Z(p) is homogeneous of degree zero. Thus, we can normaize prices in such a way that a prices sum up to 1. More precisey, denote by { } = p R L + : p = 1. We can restrict our search for an equiibrium to price vectors in. However, the function Z(p) is ony we-defined for price vectors in Interior = {p : p > 0 for a }. To refer to price vectors in that are not in the interior, we use: Boundary = \ Interior. The proof proceeds in six steps. In the first two steps, we define a correspondence f( ) from to, where we distinguish between price vectors in Interior and in Boundary. In step 3, we show that the correspondence is convex-vaued. In step 4, we show that the correspondence is upper hemicontinuous. In step 5, we use a of these resuts and appy Kakutani s fixed point theorem to concude that a p with p f(p ) is guaranteed to exist. Finay, in step 6 we show that any fixed point constitutes an equiibrium price vector. To faciitate notation, we wi use q to denote price vectors in the set f(p). Step 1: Construction of the correspondence f( ) for p Interior. For the definition of this correspondence, we put the resources in an arbitrary but fixed order, and index them by i, j {1, 2, 3}: { q, if Z(p) = 0 p Interior : f(p) = q : q i = 1 if i = arg min {p j : p j = min {p 1, p 2, p 3 }}, if Z(p) 0 In words, if Z(p) = 0, i.e., when the buffer is the same for a resources, then the correspondence f( ) maps p to the set of a price vectors in. If Z(p) 0, then the correspondence maps p to a price vector q where one component of q equas 1 and the other two components are equa to 0. More specificay, the correspondence sets that component q i = 1 for which i is the smaest index of the price components p j that are minima among p 1, p 2 and p 3. Thus, when Z(p) 0, then f( ) maps p to exacty one q Boundary. Ony if Z(p) = 0, then f(p) =. Step 2: Construction of the correspondence f( ) for p Boundary. p Boundary : f(p) = {q : q i = 0 if p i > 0} This correspondence maps p to a price vectors q for which a component of q equas 0 when the corresponding component of p is positive. Because p Boundary, we know that for some i, p i = 0, and thus f(p). Furthermore, for at east one i, p i > 0 and thus q i = 0, which impies that no point from Boundary can be a fixed point. 20

21 Step 3: The fixed-point correspondence is convex-vaued. Consider first p Interior. If Z(p) = 0, then f(p) =, and because is a simpex it is obviousy convex. When p Interior and Z(p) 0, then f( ) maps p to exacty one point in, and thus f(p) is triviay convex. Now, if p Boundary, then f(p) is a subset of, namey the set of price vectors q where one or two dimensions are equa to 0. These subsets of are themseves simpices, and thus convex, and consequenty f(p) is convex. Step 4: The correspondence f( ) is upper hemicontinous. To show upper hemicontinuity we have to prove that for any sequence p n p and q n q with q n f(p n ) it hods that q f(p). We distinguish two cases: p Interior and p Boundary. Step 4a: p Interior. Consider first a sequence p n p with Z(p) = 0. Thus, f(p) = and for any sequence q n q, it is triviay true that q f(p). Now consider a sequence p n p with Z(p) 0. Because users preferences are continuous (Assumption 1), we know that X(p) and y(p) are continuous, which impies the continuity of Z( ), and thus im n Z(p n ) = Z(p). Because Z(p) 0, for n arge enough it must be that Z(p n ) 0. Thus, when considering the sequence p n p, for n arge enough, we ony have to consider the second case of the definition of f( ). Let i = arg min {p j : p j = min {p 1, p 2, p 3 }}. It hods that im n min{p n 1, pn 2, } pn 3 } = min{p 1, p 2, p 3 }. Thus, for n arge enough, it must be that arg min {p n j : pn j = min {pn 1, pn 2, pn 3 } = i. Consequenty, for n arge enough, if q n f(p n ), then q n i = 1 which impies that q i = 1. Thus, if qn q and for a n q n f(p n ), then q f(p). Step 4b: p Boundary. Consider p n p and q n q with q n f(p n ) for a n. We show that for any p > 0, for n sufficienty arge we have q n = 0 and thus q = 0 which impies that q f(p). If p > 0, then p n > 0 for n sufficienty arge. If p n Boundary, then q n = 0 by the definition of the correspondence f(p n ), and thus q = 0. If, however, p n Interior, then Lemma 2 comes into pay. Because p Boundary, for at east one k we have p k = 0 and thus p n k 0. According to Lemma 2, for n arge enough: : Z (p n ) > Z k (p n ) i.e., there exists a resource which has a arger buffer than resource k. Thus, Z k (p n ) Z (p n ) and thus Z(p n ) 0, which impies that we must ony consider the second case of the definition of f(p n ) for p n Interior. If q n f(p n ), then for n arge enough q n k = 1 for a resource k for which pn k 0. Because p Boundary, at east one and at most two components of p n go towards 0. However, because q n q, for n arge enough, q n k = 1 for the same resource k, and thus q k = 1, which impies that q = q m = 0. Thus, for any p > 0, q = 0, which impies that q f(p). Step 5: A fixed point exists. The set is a non-empty, convex and compact set and we have shown that f( ) is a correspondence from to that is convex-vaued and upper hemicontinuous. Thus, we can appy Kakutani s fixed-point theorem which says that any convex-vaued and upper hemicontinuous correspondence from a non-empty, compact and convex set into itsef has a fixed point. We concude that there exists a p with p f(p ). Step 6: A fixed point of f( ) is an equiibrium. Assume that p is a fixed point, i.e., p f(p ). As we have pointed out in step 2, no price vector from Boundary can be a fixed point. Thus, it must be that p Interior. In step 1, we aready saw that when Z(p ) 0, then f(p ) Boundary, which is incompatibe with p Interior and p f(p ). Thus, for p to be a fixed point, it must hod that Z(p ) = 0, and thus any fixed point p is an equiibrium price vector. 21

22 To summarize, we have shown that a fixed point aways exists and that any fixed point is an equiibrium price vector. Thus, given the assumptions of the theorem, a buffer equiibrium is guaranteed to exist Equiibrium Existence with Price-insensitive or Adversaria Users So far, we have shown the existence of the buffer equiibrium when a users preferences satisfy continuity, strict convexity, monotonicity and strong monotonicity w.r.t. suppy resources, and update their settings accordingy upon price changes. In practice, however, some users might vioate these assumptions, for exampe, because they don t notice price changes, or because they don t care enough to update their settings immediatey. In more extreme cases, some users might purposefuy harm the system and try to bring it out of equiibrium by updating their settings in the opposite way than what our assumptions woud suggest. We ca such users adversaria users. For exampe, an adversaria user coud maximize his suppy of those resources that currenty have a very ow price, and minimize his suppy of those resources that currenty have a very high price. Even though such behavior woud certainy hurt the attacking user himsef and thus coud be caed irrationa, adversaria users do exist in practice, and robustness against adversaria attacks is a common concern. In this section, we prove that a buffer equiibrium exists, even if a certain percentage of the user popuation is adversaria. For the anaysis, we distinguish between rationa users whose preferences satisfy our assumptions as before, and who update their settings accordingy upon price changes, and adversaria users, whose preferences must not satisfy our assumptions. To derive the maximum percentage of adversaria users that we can toerate, the foowing anaysis assumes that adversaria users update their settings in such a way as to maximay hurt the system, to bring it out of equiibrium. We et R denote the set of rationa users, and A denote the set of adversaria users. We et Y R and X R denote the demand and suppy vector of the rationa users, and Y A and X A denote the demand and suppy vector of the adversaria users. Thus, Y = Y R + Y A and X = X R + X A. As before, we et γ > 1 denote the system s sack constraint. We assume that the maximum demand of the rationa users is at east C times arger than the maximum demand of the adversaria users, i.e., Y R C Y A, and we derive a minimum bound for C to guarantee the existence of a buffer equiibrium. As a first step, we show that under certain conditions, when the price of a resource k goes towards zero, there exists a resource k with a stricty arger resource buffer than k (proof provided in the Appendix, in Section B). Lemma 3. Given sack factor γ and given that Y R C Y A, if rationa users preferences are continuous and stricty convex, monotone w.r.t. service products as we as strongy monotone w.r.t. suppy resources, and if C > (γ 2 + γ), then for p n p with p 0 and p k = 0, for n sufficienty arge: : X k (p n ) k (y(pn )) < X(pn ) (y(p n )). Equipped with Lemma 3, it is straightforward to prove the more genera Theorem about equiibrium existence with adversaria users. Theorem 2. Given sack factor γ and given that Y R C Y A, then a buffer equiibrium exists in the p2p exchange economy if C > (γ 2 + γ) and the rationa users preferences are continuous and stricty convex, monotone w.r.t. service products as we as strongy monotone w.r.t. to suppy resources. 22

23 Proof. The theorem foows from the same proof as Theorem 1. The ony necessary change is that in step 4b of the proof, instead of using Lemma 2 (which is ony appicabe when a users are rationa), we use the more genera Lemma 3. What Theorem 2 shows is that the more freedom we give the users in setting their suppy (i.e., the arger the sack factor), the ess robust is the system against adversaria attacks. This resut is actuay very reevant and usefu for the designer of the p2p backup market. If there is reason to beieve that a non-negigibe fraction of the popuation wi be adversaria or that many users wi not update their prices in a rationa way, then Theorem 2 tes the market designer exacty what to do. For exampe, if the market designer beieves that at most 10% of the users wi be adversaria, then the formua from the theorem tes us that as ong as we give the users a sack factor of 2.5 or ess, a buffer equiibrium is guaranteed to exist. In that respect, the theoretica equiibrium anaysis actuay has a very direct practica impact on the market design Equiibrium Uniqueness Without any further restrictions on users preferences, we cannot say anything about the uniqueness of the buffer equiibrium, because the substitution effect and the weath effect coud either go in the same or in opposite directions. 11 The standard equiibrium uniqueness proof for Warasian equiibria resoves this by assuming that the aggregate excess demand function has the gross substitutes property for a commodities [1], which means that a price increase for one commodity causes an increase in the aggregate excess demand for a other commodities. However, that assumption is too strong for our domain for two reasons. First, and most importanty, for the demanded services, the gross substitutes property is vioated in a p2p backup system. For exampe, if the price for storage increases, it is not reasonabe to assume that users wi now start deeting their backed up fies and consume more backup or retrieva operations instead. The reason is simpe: every fie you back up is then being stored, and you can ony retrieve fies you have previousy backed up. Thus, there are in fact strong compementarities between the demanded services in our domain, and to refect this, we make the foowing assumption: Assumption 5. (Services are Perfect Compements) We assume that the aggregate demand function Y ( ) has the perfect compements property, i.e.: p, p R 3 >0 : µ R s.t. Y (p) = µ Y (p ) A consequence of the perfect compements property is that price changes affect a dimensions of the aggregate demand vector equay. For an individua user, the Leontief utiity function woud induce the perfect compements property such that resources are consumed in fixed ratios. However, it bears emphasis that we assume perfect compements ony for aggregate demand, rather than for individua demand, which is a much weaker assumption, and more reasonabe due to the aw of arge numbers. In contrast to service products, it seems reasonabe to assume that suppied resources are substitutes in the sense that a user is happy to shift his suppy from one resource to another as prices change. Yet, the strong assumption that suppied resources are gross substitutes might aso not hod in our domain. Because services have the perfect compements property, and because services and suppied resources 11 In an exchange economy, a price change aways has two effects: first, it changes the reative prices between the goods, causing the substitution effect. Second, it can aso change a user s weath, because his suppy might now be more or ess vauabe, which is caed the weath effect. Without further assumptions, nothing can be said about the net effect of a price change (cf. Sonnenschein-Mante-Debreu Theorem, [17], pp ). 23

24 are couped via the fow constraint X i p = (Y ) p, price changes can aso have non-substitution effects on the suppy of resources. For exampe, when the price for a resource is decreased, it is not a priori cear that the suppy for that resource goes down. It might be, that due to this price decrease, the system just became much more attractive for many users, so that they significanty increase their demand and thus aso their suppy (of a resources). Thus, we don t want to make assumptions regarding the specific directions of change in the suppy and demand functions. We ony make an assumption regarding how price changes affect the reative ratios of suppied resources to each other: Assumption 6. (Reative Suppy Resources are Gross Substitutes) We assume that the aggregate suppy function X(p) has the reative gross substitutes property, i.e., whenever p and p are such that, for some k, p k > p k and p = p for k, we have X k(p ) > X k(p). X (p ) X (p) Note that both assumptions are reativey weak. Upon a price decrease for good k, the aggregate suppy for k can go up or down, and the demand for a services can aso go up or down. A we assume is that when the price for good k is decreased, the reative suppy of good k to the other goods decreases, and the demand for services moves up or down proportionay. With these two assumptions, we can now prove that the buffer equiibrium is unique: Theorem 3. The buffer equiibrium is unique, given that the aggregate demand function satisfies the perfect compements property (Assumption 5), and that the aggregate suppy function satisfies the reative gross substitute property (Assumption 6). Proof. Because we make different assumptions regarding the suppy and demand sides of our economy, we first separate the suppy and demand aspects by introducing an aternative description of the buffer equiibrium: X = (Y ) (11) ) ( ) (X S, X U, X D = 1 1 (Y ), f (Y ), f (12) S U D ( 1, X U, X ) D = (1, ) U D X S X S (Y ), S S (13) ( XU, X ) ( D ) U D X S X S (Y ), = 0 S S (14) We define a new vector-vaued function g(p) = ( g U (p), g D (p) ) : ( XU g U (p) = (Y ) ) U X S (Y ) S ( XD and g D (p) = (Y ) ) D X S (Y ), S which naturay eads to a new equiibrium definition that is equivaent to Definitions 3 and 4: Definition 5. (Buffer Equiibrium [Version 3]) A buffer equiibrium is a price vector p and g(p) such that ( ) 0 g(p) =. 0 We have simpified the probem of finding equiibrium prices to finding the root of the function g(p). Because X(p) and Y (p) are homogeneous of degree zero, g(p) is aso homogeneous of degree 24

25 zero, which impies that coinear price vectors are equivaent, i.e., λ > 0 : g(p) = g(λ p). Thus, showing uniqueness of the buffer equiibrium is now equivaent to showing that g(p) = 0 has at most one normaized soution. Now, et s assume that g(p) = 0, i.e., p is an equiibrium price vector. We show that for any p, g(p ) 0 uness p and p are coinear. Because of Assumption 5 (the aggregate demand function has the perfect compements property), a price change affects a dimensions of the demand function equay, i.e., µ R : Y (p) = µ Y (p ). Because the production function is bijective and exhibits constant returns to scae, this impies that (Y (p)) = µ (Y (p )). Thus, p, p R 3 >0 : U 1 (Y (p)) f = (Y U (p )) (Y (p)) (Y S S (p )), i.e., changes in the demand function Y ( ) due to price changes do not affect g( ). Consequenty, we ony have to consider changes in the suppy function X( ). Now consider a price vector p that is not coinear with p. Because of the homogeneity of degree zero, we can assume that p p and p = p for some. We now ater the price vector p to obtain a price vector that is coinear to p, and argue about how g( ) changes in the process. We distinguish between three cases: Case 1: = S, i.e., p S = p S. First, we generate a price vector p that is coinear to p, by ineary increasing a components of p unti the next two price components are equa, i.e., p k = p k for k S. We assume that k = D (the case where k = U is competey symmetric) such that: p U p U (15) p D = p D (16) p S p S (17) with at east one of the inequaities being strict. Now we ater p to obtain p in two steps. In the first step, we decrease (or keep unatered) p U unti it equas p. In the second step, we increase (or U keep unatered) p S unti it equas p S. Because p and p were not coinear, we have changed the price vector in at east one step, and because of Assumption 6, the reative ratio between X U and X S has decreased in at east one step and has never increased, such that: X U (p ) X S (p ) > X U (p ) X S (p ) = X U (p) X S (p) Thus, the first term in g U ( ) has changed, and the second term stayed constant, and g(p ) g(p) = 0. Case 2: = U, i.e., p U = p U. First, we generate a price vector p that is coinear to p, by ineary increasing a components of p unti p k = p k for k U. Now we differentiate between two cases: Case 2a: k = D such that: p S p S (18) p D = p D (19) p U p U (20) with at east one of the inequaities being strict. The remainder of the proof for this case is anaogous to the one fore case 1. Case 2b: k = S such that: p D p D (21) p S = p S (22) p U p U (23) 25

26 with at east one of the inequaities being strict. Anaogousy to the proof for case 1, we can show that X U (p ) X D (p ) < X U (p ) X D (p ) = X U (p) X D (p) For the rest of the proof for this case, we construct a contradiction. Assume that p is aso an equiibrium price vector such that g(p ) = 0. Because the second term in g U and g D respectivey does not change upon price changes, this impies that: (24) X U (p ) X S (p ) = X U (p) X S (p) and X D (p ) X S (p ) = X D (p) X S (p) (25) (26) From Equation (25) it foows that X U (p ) = X U (p) X S (p) X S (p ) and from (26) it foows that X D (p ) = X D (p) X S (p) X S (p ). If we put these two resuts together we get: X U (p ) X D (p ) = X U (p) X S (p ) X S (p) X S (p) X D (p) X S (p ) = X U (p) X D (p) and this contradicts Equation (24). Thus, g(p ) 0. Case 3: = D, i.e., p D = p D. The proof for this case is anaogous to the proof for case 2. In summary, in a three cases we estabished that g(p ) g(p) = 0 which shows that p is not an equiibrium price vector and concudes the equiibrium uniqueness proof (Un-)Controabiity of the Suppy-Side Buffer So far we have shown under what conditions the buffer equiibrium exists and when it is unique. In practice, however, the system wi be out of equiibrium most of the time, because users do not continuousy adjust their settings, and thus price changes wi ony affect suppy and demand after a deay. This is why in Section 5.1, we have motivated the buffer equiibrium as a desirabe target: the buffer between current demand and maximum suppy of resources gives the system a certain safety for when it is out of equiibrium. To make sure we can aways satisfy new incoming demand, we might ike to have at east 25% more suppy than current demand, i.e., X 1.25 (y). Unfortunatey, the uniqueness of the buffer equiibrium (Theorem 3) has an immediate consequence regarding the imited controabiity of the buffer equiibrium: Coroary 1. (Limited Controabiity of the Market) Given Assumptions 5 and 6, the market operator cannot infuence the size of the buffer in the buffer equiibrium by adjusting market prices. It turns out that the imited controabiity of the buffer equiibrium remains, even without the assumptions that service are perfect compements and that reative suppy resources are gross substitutes, thereby strengthening the resut from Coroary 1: Proposition 3. If each individua user i has a imited panning horizon in that he chooses not to give himsef more than a demand-side buffer of λ i, then there exists a Λ R >1 such that the market operator cannot achieve a buffer equiibrium with buffer size Λ by adjusting market prices. 26

27 Proof. For the proof we construct a simpe counterexampe. We choose a Λ such that i : Λ > λ i. And we et λ i = max i λ i. Now: i : Y i = λ i y i (27) Y = i λ i y i (28) Y λ i y i (29) i Y λ i y i (30) i Y λ i y (31) (y) λ i (y) (32) X λ i (y) (33) Thus, the buffer between suppy and demand woud be ess or equa to λ i stricty ess than the buffer Λ that the market operator desired. which by assumption was Given the imited controabiity of the buffer, it is natura to ask what buffer size to expect in equiibrium. It turns out that, in equiibrium, the suppy-side buffer is uniquey determined via the demand-side buffer: Proposition 4. In the buffer equiibrium, the size of the suppy-side buffer equas the size of the demand-side buffer. Proof. X = (Y ) (34) X = (λ y) (35) X = λ (y) (36) Equation (35) foows because of Assumption 3 (inear prediction for aggregate demand). Equation (36) foows from System Properties 3 and 4 (production functions are bijective and exhibit CRTS). In words, the size of the buffer depends on how forward-ooking the users are. If on average the users give themseves a 25% buffer on the demand side (e.g., a user has currenty backed up 20GB and sets the siders in such a position that his maximum onine backup space is 25GB), then the system woud aso have a 25% buffer on the suppy side, i.e., X = 1.25 (y). Even though the market operator cannot infuence the size of the overa suppy-side buffer by adjusting market prices, Proposition 4 provides us with a different, yet very natura way to achieve any desired buffer. The market operator simpy needs to insist that every user gives himsef a certain minimum demand-side buffer. One way to achieve this is to buid this requirement into the user interface, i.e., given user i s current demand y i there woud be a minimum demand Y i = λ i y i beow which the user coud not go: Proposition 5. If the market operator can enforce any demand-side buffer for individua users, then he can achieve any desired suppy-side buffer size Λ > 1 in the buffer equiibrium. 27

28 Proof. We et the market operator set a individua user s minimum required demand-side buffers to λ i = Λ. Then we know from Proposition 4 that the resuting aggregate suppy-side buffer wi aso be at east Λ. Note that enforcing a demand-side buffer of Λ for every individua user can resut in efficiency osses. A user who, without this restriction, woud have chosen a smaer demand-side buffer, now oses some utiity. For exampe, he might now choose a smaer Y i to avoid having to give up as many resources X i. Thus, in practice, the desired suppy-side buffer Λ woud have to be carefuy chosen, trading-off a arger suppy-side buffer on the one hand, with some efficiency osses for individua users on the other hand. 6. The Price Update Agorithm In this section we propose and anayze a price update agorithm that is invoked reguary on the server (e.g., once a day), with the goa to move prices towards the buffer equiibrium over time. Our agorithm is oriented at the tâtonnement process as defined by Waras [24]. However, Waras agorithm ony aowed trades at equiibrium prices. In our system, however, we must aow trades at a times, even out of equiibrium The Agorithm Because users preferences are homogeneous of degree zero, coinear price vectors are equivaent. Thus, instead of searching for the equiibrium price vector in R 3, we can simpify the task by ooking at projective space RP 2 : RP 2 := { (p S, p U, p D ) R 3 \ {0} : (p S, p U, p D ) λ(p S, p U, p D ) λ R + } Thus, we can fix the price of an arbitrary good (the numeraire) and normaize the price vector accordingy. Here, we normaize the price of storage space to 1: p = (p S, p U, p D ) (1, p U p S, p D p S ) In Section 5.4, we have reduced the probem of finding the buffer equiibrium to finding the root of the function g(p) = ( g U (p), g D (p) ) where ( XU g U (p) = (Y ) ) U X S (Y ) S ( XD and g D (p) = (Y ) ) D X S (Y ). S This formuation of the buffer equiibrium is aso usefu for the price update agorithm, because finding the root of a function is a we-understood mathematica probem. Newton s method is probaby the best-known root-finding agorithm and converges quicky in practice. However, it requires the evauation of the function s derivative at each step. Unfortunatey, we don t know the function g( ) and thus cannot compute its derivative. Instead, we ony get to know individua points in each iteration and can use these points to estimate the derivative. This is exacty what the secant method does for a one-dimensiona function. The probem is that g(p) is 2-dimensiona, and thus the secant method is not directy appicabe. The appropriate muti-dimensiona generaization is Broyden s method [4], a quasi-newton method. 28

29 Unfortunatey, that method requires knowedge of the Jacobian, which we don t know and aso cannot even measure approximatey. However, we show that one can use an approximation to the diagona sub-matrix of the Jacobian instead of the fu Jacobian matrix. The diagona sub-matrix of the Jacobian can be approximated by studying changes in the function g(p). This eads to the foowing quasi-newton method for mutipe dimensions: Definition 6. (The Price Update Agorithm) p t+1 = { 1 for = S p t p t pt 1 g (p t ) g (p t 1 ) g (p t ) for = U, D For the impementation of the price update agorithm in our system we took care of a few specia cases (e.g., exacty reaching the equiibrium such that terms cance out), but we omit the detais here Theoretica Convergence Anaysis We begin with the anaysis of the convergence of the foowing iteration rue: x (k+1) = x (k) D(x (k) ) 1 F (x (k) ) (37) where F is a function F : R n R n and D is the diagona sub-matrix of the Jacobian J of F. We define the matrix L by the rue J(x) = D(x) + L(x), i.e., L comprises of the off-diagona partia derivatives in the Jacobian. For this iteration rue, the foowing theorem hods (the proof is provided in the Appendix, in Section D): Theorem 4. Let F be a continuousy differentiabe function. Suppose that in the iteration rue given by equation (37), x (0) is chosen cose enough to a root x of F, J(x ) is non-singuar, J and D are Lipschitz continuous, and L(x ) = 0. Then the successive iterations x (k) produced by the iteration rue converge to x, and the rate of convergence is at east Q-inear. 12 The probem one faces when trying to appy the secant method to higher dimensions is that the system of equations provided by J k (x (k) x (k 1) ) F (x (k) ) F (x (k 1) ) (where J k is the current estimate of the Jacobian) is under determined. However, if one uses the diagona approximation to the Jacobian, then the system is fuy determined. What Theorem 4 says is that under certain conditions, using the diagona sub-matrix of the Jacobian instead of the fu Jacobian in the given iteration rue, sti eads to convergence to a root of the function. Equipped with Theorem 4, it is now easy to prove that the price update agorithm given in Definition 6 converges to a buffer equiibrium. We ony need to consider the update agorithm for resource prices p U and p D because the price for space remains constant at 1. Consider the function g( ), and as before, J is the Jacobian of g( ), D is the diagona sub-matrix of J, and L is defined by the rue J(x) = D(x) + L(x). 12 Q-inear convergence means that im k x (k+1) x x (k) x q = µ with µ (0, 1) and q = 1. We can in fact prove that the iteration rue exhibits faster than Q-inear convergence: just ike Broyden s method, its convergence is ocay Q-superinear (with q 1.62, and µ > 0). However, showing this resut requires a more intricate argument which is beyond the scope of this paper. 29

30 Coroary 2. Consider the price update agorithm given in Definition 6. If g( ) is a continuousy differentiabe function, p (0) is chosen cose enough to a root p of g( ), the Jacobian J(p ) is nonsinguar, J and D are Lipschitz continuous, and L(p ) = 0, then the price update agorithm converges to an equiibrium price vector p, and the rate of convergence is at east Q-inear. Proof. We have shown in Section 5.4 that if we find a price vector p such that g(p ) = 0, then we have reached a buffer equiibrium. Thus, we ony have to show that the price update agorithm converges to a root of the function g( ). Now, note that the price update agorithm provided in Definition 6 defines a quasi-newton iteration rue that uses the diagona sub-matrix of the Jacobian of the function g( ), equivaent to the iteration rue given in equation (37). By Theorem 4, that iteration rue converges ocay to a root of g( ), and the rate of convergence is at east Q-inear Usabiity Study In this section, we describe some of the resuts from a formative usabiity study of our system with 16 users. 14 Our main goa in the usabiity study was to understand whether the market user interface we propose for the p2p backup system is a usabe instantiation of the hidden market paradigm. For detais on the study set-up, pease see Section C in the Appendix Methodoogy The purpose of the usabiity study was to evauate how users understand the hidden market UI, which menta modes are invoked and whether users can successfuy interact with the market. Note that during the study, the users interacted with the rea p2p backup cient software that was connected via TCP to the p2p server appication and to 100 other simuated cients. We started the users off with two warm-up tasks. First, they had to perform one backup using the software. Second, they had to open the settings window and answer a series of questions regarding the information they saw. Upon competion of the warm-up phase, we gave the study participants 11 tasks, each consisting of a user scenario with hypothetica preferences, and a description of the goa setting for that user. We chose tasks with varying compexity and we aso tested different menta modes in different tasks. For exampe, Scenario 1 was the most simpe one, asking the user to change the settings such that you have approximatey 15 GB of free onine backup space avaiabe. In contrast, Scenario 11 was rather compex, asking the user to imagine you are a user who ikes to downoad videos and store them on your computer for a whie. Assume that you need 20 GB of your own hard disk space to store the videos, and obviousy you need ots of downoad bandwidth, but you do not care too much about upoad bandwidth. Pease change your settings so that you have approximatey 25 GB of free onine backup space avaiabe whie taking the other constraints into account. 13 One might wonder how restrictive the conditions of Theorem 4 and Coroary 2 are. The condition that the matrices J and D be Lipschitz continuous puts upper bounds on how fast the partia derivatives of the function can change. One can reax this assumption to just that of J and D being Lipschitz continuous in a neighborhood of the root without affecting the concusions of the theorem and coroary. Loca Lipschitz continuity near the neighborhood of the root seems ike a pausibe condition for g( ) to satisfy because it is hard to envision wid changes in the function near an equiibrium point. The non-singuarity of J(p ) means that our function does not have a higher order zero at the equiibrium point. It is ikey that our agorithm woud sti converge even if this assumption fais, but we do not have a proof of this. The oca convergence of our method is an aspect we share with a Newton s methods operating in mutipe dimensions, and this is the most worrisome property as we as the hardest to get a hande on. If J(p ) 1 and Lipschitz constants of J and D around p are a sma, then the basin of convergence is arge. However, it seems that ony experimenta evidence can vaidate whether this assumption is reasonabe in our situation. 14 See [21] for the fu study. 30

31 We asked the users to think out oud as they performed each task and we made detaied observations during the tasks. Using the 11 tasks, we tested four different menta modes, i.e., aspects of the user s understanding of the market: 1. Give & Take: The users understand they must give some of their resources (on the right side) and get a proportiona amount of onine backup space in return (on the eft side). This was tested using tasks 1 and 2. The test was deemed successfu if the users adjusted a settings correcty. 2. Bunding: The users understand the bunde constraints, i.e., that they cannot provide zero of any resource because ony resource bundes have vaue. This was tested using tasks 3 and 4. The test was deemed successfu if the users adjusted a settings correcty. 3. Prices: The users understand that different resources can have different prices at different points in time. This was tested using tasks 7, 8, and 9. The test was deemed successfu if the users adjusted the settings for task 9 correcty (tasks 7 and 8 gave them practice to earn the mode and discover the pricing aspect). 4. Bunding (Learned): The users understand the bunde constraints after exporing the UI for a whie, i.e., after a certain earning period. This was tested using tasks 10 and 11. The test was deemed successfu if the users adjusted a settings correcty. Note that the tasks were set-up such that finding the correct setting by coincidence was unikey. The correct setting was not a natura foca point so that the user researcher coud easiy decide whether the participant had truy understood the task (and thus the right menta mode had been activated) or not. Of course, the think out oud method aso heped determining the resut of a test. For exampe, when testing the understanding of the bunde constraints, if a user said something ike I see, I obviousy cannot give 5 GB of space without giving any bandwidth, thus I choose to suppy the minimum amount of bandwidth I have to give, then this counted as sufficient understanding of the bunde constraints. The rare cases where a user had coincidentay chosen the correct settings but did not dispay sufficient understanding of the probem were aso deemed to be faiures in our experiment Resuts Tabe 2 summarizes the resuts from the usabiity study, evauating whether the 4 different menta modes have been successfuy activated or not. It turns out that the basic aspects of the UI were understood by a users (1: Give & Take). However, the first time the users faced a combinatoria task, e.g., minimize your upoad bandwidth whie maintaining at east 15 GB of free onine backup space, ony 9 out of 16 users competey understood the probem and found the optima settings. The understanding of the bunde constraints of the market improved towards the end of the study, showing that a certain earning effect had occurred. In particuar, 2 of the users that had not understood the bunde constraints at the beginning, understood them we at the end of the study, eading to 11/16 successfu outcomes for Bunding (Learned). The most difficut tasks for the users were certainy the ones testing their understanding of prices because this required three steps from them: first, discovering that different resources had different prices, second, understanding the impication for their suppy of resources, and then third, choosing the optima suppy settings for themseves given current prices. Ony 7 out of 16 users successfuy competed a three steps, and thus were deemed to understand the pricing aspect. One immediate finding is that the performance of the users is uncorreated with the way we had segmented them into experts or novices in advance (see Tabe 2). Thus, prior experience with p2p 31

32 Category Menta Mode Experts Novices Tota 1 Give & Take 8/8 8/8 16/16 2 Bunding 4/8 5/8 9/16 3 Prices 5/8 2/8 7/16 4 Bunding (Learned) 5/8 6/8 11/16 Tabe 2: Resuts from the Usabiity Study: Number of Users Faing into Comprehension Categories fie-sharing software did not seem matter. Instead, anecdota evidence suggests that those users whose jobs or education invoved some mathematica modeing seemed to understand the concepts underying the UI faster. This makes sense, given that some of the tasks were reativey compex and required a good, somewhat anaytica understanding of the UI. However, a factor that is difficut to measure but seemed to pay an important roe in this study is the users curiosity, i.e., how much the users iked to pay with the siders unti they figured out how the interface worked. This aspect is particuary important for category 4, i.e., the pricing aspect. The ess curious users who did not expore the settings space as much as the others were aso the ones that did not discover the fact that different resources have different prices, and consequenty faied to sove the pricing tasks optimay. Upon competion of the interactive part of the study we asked the users about their experience with the UI. Despite the fact that amost every user had difficuties with at east one of the tasks, the user feedback was argey positive. Most users thought that the software made it easy to perform the tasks they were given (with a 3.8 average on a 5-point Likert scae, with 1=strongy disagree and 5=strongy agree) and they indicated that they enjoyed using the UI (3.8 average on the same 5-point Likert scae). Most users were pretty confident that they competed the tasks successfuy (with an average 4.0 on the same 5-point Likert scae). The users iked the graphica/visua representation of the concepts invoved. Despite some difficuties with soving the tasks, the users thought that the UI was cean, simpe, intuitive and easy to use. A users iked the ease of using the bar chart to choose the desired amount of free onine backup space. Furthermore, they iked that the UI gave immediate feedback regarding the consequences of their choices. The users primariy disiked that it took them a whie to understand the concept and ogic behind the siders. From the pre-study questionnaire we have seen that for a arge number of users, p2p backup systems coud be an attractive aternative to server-based systems. However, this sti eaves open the question how users perceive the trade-off between a market-based system (that gives users more freedom in choosing different combinations of suppied resources) vs. a non-market-based system (that has a simper UI). In the post-study questionnaire we asked the users twice to compare the two options. The first time we asked the question, we gave no additiona information beforehand. But before asking them for the second time, we described a particuar scenario highighting the fact that the marketbased system gives the users more freedom in choosing the suppied resources. The resuts were that, when asked for the first time, the users aready sighty preferred the market-based system (3.3 on a 5-point Likert scae, with 1=definitey prefer the simper UI and 5=definitey prefer the compex UI). After describing the hypothetica scenario where the non-market-based system woud ead to a degraded user experience, the average score rose to 4.0. We interpret these resuts as foows: a priori, some users do not see the advantage of a market-based system. However, after understanding the possibe imitations of the non-market-based system, they reaize the benefit of the increased freedom in choosing what to suppy, and they vaue this benefit higher than the disutiity from the additiona compexity of the UI. 32

33 8. Concusion In this paper, we have presented the design and anaysis of a nove resource exchange market underying a p2p backup appication. We have aso used the p2p backup market as a first case study of a new market design paradigm which we ca hidden market design. We propose hidden markets for the design of eectronic systems in domains with many non-experts users and where markets might be unnatura. To successfuy hide the market compexities from the users in our system, new techniques at the intersection of market design and user interface design were necessary. At a times, for the mode formuation and the theoretica anaysis, our focus was on the actua impemented p2p backup system, which we have successfuy tested in apha version. In contrast to existing p2p backup systems, our design gives users the freedom to suppy different ratios of resources. This introduces the probem that without propery motivating the users to suppy those resources that are currenty scarce, the system might not have enough suppy to satisfy demand, which motivates the use of a p2p resource market. Whie existing work on p2p data economies has generay designed markets that baance suppy and demand in equiibrium, our market is designed to work we, even out of equiibrium. The users are not required to continuousy update their suppy and demand. Instead, we provide a hidden market UI that ets them choose bounds on their maximum suppy in return for being aowed to consume a certain maximum amount of backup services. The UI competey hides the users account baances and payments, and ony indirecty exposes the current market prices. A key contribution is the new sider contro that we deveoped which we use to dispay the bundes constraints to the users in an indirect way. The siders aso ensure that the users can ony choose suppy settings that satisfy certain resource ratio constraints, which aows us to provide the users a inear interaction with the system. To maximize the safety of the system out of equiibrium, we have decared as our target to maximize the overa size of the buffer between current demand and maximum suppy. We have introduced the buffer equiibrium concept and shown that, under certain assumptions, the size of the buffer is maxima in the buffer equiibrium. The economic anaysis of the market required the introduction of composite resources on the suppy side, and the carefu study of the system s production technoogy, to convert the market into a pure exchange economy. In this mode, we have proved that a buffer equiibrium is aways guaranteed to exist. This resut aso hods if a certain percentage of the user popuation is price-insensitive or even adversaria. However, we have shown that the more freedom we give users in choosing their suppy settings, the ess robust the system becomes against adversaria attacks. We have expained how the theoretica equiibrium anaysis actuay has an important market design impication. The theorem regarding adversaria users provides the market designer with a concrete formua how arge the system s sack factor can be, given a certain beief about the maxima percentage of adversaria users in the popuation. To prove uniqueness of the buffer equiibrium, we needed two additiona assumptions that are very reasonabe in our domain. We have expained why it makes sense to assume that services are perfect compements, and how that affects even the suppy of resources via the fow constraints. By making a reativey weak assumption regarding how the reative suppy of resources changes upon price changes, we were abe to prove uniqueness of the buffer equiibrium. An interesting coroary of the uniqueness resut was that the market operator has imited contro over the size of the buffer via price updates aone. However, we have shown how changes to the UI design can resove this probem: by enforcing certain demand-side buffers in the UI, the market operator can ensure any desired suppy-side buffer. We have proposed a price update agorithm that ony requires daiy aggregate suppy and demand information, and proved that it converges ineary to the buffer equiibrium, given that initia prices are chosen cose enough to equiibrium prices. 33

34 To evauate the hidden market UI, we have performed a formative usabiity study of our system. Our main goa was to determine whether the UI activates the right menta mode, and whether the users can successfuy interact with the hidden market. Overa, the resuts were encouraging and show promise for the hidden market design paradigm. Most users intuitivey understood the give & take principe as we as the bunde constraints of the market. It was particuary positive to see that even after the users had used he system for 45 minutes, they had not reaized they were interacting with a market-based system, yet were abe to compete most of the tasks successfuy. This shows that we have successfuy hidden the market. The pricing aspect, however, was difficut for some users, i.e., they either never earned that different resources have different vaues (prices) in the system, or they were unabe to expoit this insight propery. We are currenty investigating new user interfaces that sti hide the market from the users, but provide them with sighty more information and guidance regarding the pricing aspect. In ongoing work we are aso anayzing different ways to monetize the p2p market patform. There is an easy and eegant way to generate revenue whie sti running the market using a virtua currency: the market operator can charge a sma tax on each virtua currency transaction and use the surpus to se backup services on a secondary market for rea money. More specificay, the p2p users woud not have to be invoved in any rea-money transactions and the customers from the secondary market woud buy backup services ike they woud from a centraized data center. If rea monetary transaction are made possibe and deemed desirabe in the p2p system itsef, then we can aso open the whoe market for rea monetary payments. On the one side, users wi then be abe to pay for their consumption of services by either providing their own resources or by paying with rea money, and on the other side, users wi then aso be abe to earn rea money by suppying their resources. With this design, the market operator coud generate revenue by charging a tax on each virtua currency transaction and by charging a tax on each rea-money transaction. We beieve that the hidden market design presented in this paper has appicabiity beyond p2p backup systems, and one such exampe coud be smart grids, i.e., the next generation of eectricity networks. The main idea of smart grids is to expose the changing market price for eectricity to the end users, such that not ony suppy but aso demand becomes price-eastic. Governments and industry abs are currenty making arge research and deveopment investments for smart grids [6], but it seems that the user interface aspect of these systems is not getting enough attention. We argue that to effectivey invove the end-consumers of eectricity in these new energy markets, a hidden market UI wi be necessary. In genera, more and more market-based systems are currenty emerging, often with users who are mosty non-experts and might find the market paradigm unnatura in the particuar domain. We hope that the ideas we presented in this paper wi inspire other researchers to deveop simiar hidden market designs for nove appications in many other domains. References [1] Jr. Aexander S. Keso and Vincent P. Crawford. Job matching, coaition formation, and gross substitutes. Econometrica, 50(6): , [2] Christina Aperjis and Ramesh Johari. A peer-to-peer system as an exchange economy. In Proceedings from the Workshop on Game Theory for Communications and Networks (GameNets), Pisa, Itay, October [3] Wiiam J. Boosky, John R. Douceur, and Jon Howe. The Farsite project: A retrospective. SIGOPS Operating Systems Review, 41(2):17 26,

35 [4] C. G. Broyden, J. E. Dennis Jr., and Jorge J.Moré. On the oca and superinear convergence of quasi-newton methods. J. Inst. Math. App., 12: , [5] Landon P. Cox and Brian D. Nobe. Samsara: Honor among thieves in peer-to-peer storage. In Proceedings of the nineteenth ACM symposium on Operating systems principes (SOSP), pages , Boton Landing, NY, [6] U. S. Department Of Energy. Grid 2030: A nationa vision for eectricity s second 100 years [7] Michae J. Freedman, Christina Aperjis, and Ramesh Johari. Prices are right: Managing resources and incentives in peer-assisted content distribution. In Proceedings of the 7th Internationa Workshop on Peer-to-Peer Systems, [8] Sharad Goe, David Pennock, Danie M. Reeves, and Cong Yu. Yoopick: A combinatoria sports prediction market. In Proceedings of the 23rd Conference on Artificia Inteigence (AAAI), pages , Chicago, IL, Juy [9] Friedrich A. Hayek. The uses of knowedge in society. American Economic Review, 35: , [10] Gary Hsieh and Scott Counts. mimir: A market-based rea-time question and answer service. In Proceedings of Computer Human Interfaces (CHI), Boston, MA, Apri [11] Gary Hsieh, Robert Kraut, Scott E. Hudson, and Roberto Weber. Can markets hep? Appying market mechanisms to improve synchronous communcation. In Proceedings of the ACM Conference on Computer Supported Cooperative Work, San Diego, Caifornia, November [12] L. V. Kantorovich. Functiona anaysis and appied mathematics, voume 6(28), pages Uspehi Matem. Nauk (N. S.), [13] L. V. Kantorovich and G. P. Akiov. Functiona anaysis in normed spaces, voume 46 of Internationa Series of Pure and appied Mathematics. The Macmian Co., New York, [14] John Kubiatowicz, David Binde, Yan Chen, Steven Czerwinski, Patrick Eaton, Dennis Gees, Ramakrishna Gummadi, Sean Rhea, Hakim Weatherspoon, Westey Weimer, Chris Wes, and Ben Zhao. Oceanstore: An architecture for goba-scae persistent storage. In Proceedings of the Ninth internationa Conference on Architectura Support for Programming Languages and Operating Systems (ASPLOS), [15] Kevin Lai, Lars Rasmusson, Eytan Adar, Li Zhang, and Bernardo A Huberman. Tycoon: An impementation of a distributed, market-based resource aocation system. Mutiagent Grid Systems, 1(3): , [16] Jin Li and Cha Zhang. Distributed hosting of web content with erasure coding and unequa weight assignment. In Proceedings of the IEEE Internationa Conference on Mutimedia and Expo (ICME), pages 27 30, Taipei, Taiwan, June [17] Andreu Mas-Coe, Michae D. Whinston, and Jerry R. Green. Microeconomic Theory. Oxford University Press,

36 [18] Satu S. Parikh and Gerad L. Lohse. Eectronic futures markets versus foor trading: Impications for interface design. In Proceedings of the CHI conference on Human factors in computing systems, pages , [19] J.A. Pouwese, P. Garbacki, D.H.J. Epema, and H.J. Sips. The bittorrent p2p fie-sharing system: Measurements and anaysis. In 4th Internationa Workshop on Peer-to-Peer Systems (IPTPS), [20] Sven Seuken, Denis Chares, Max Chickering, and Sidd Puri. Market Design and Anaysis for a P2P Backup System. In Proceedings of the 11th ACM Conference on Eectronic Commerce (EC), Cambridge, MA, June [21] Sven Seuken, Kama Jain, Desney Tan, and Mary Czerwinski. Hidden Markets: UI Design for a P2P Backup Appication. In Proceedings of the Conference on Human Factors in Computing Systems (CHI), Atanta, GA, Apri [22] Sven Seuken, David C. Parkes, and Kama Jain. Hidden market design. In Proceedings of the 24th Conference on Artificia Inteigence (AAAI), Atanta, GA, Juy [23] David M. Smith. The cost of ost data. Graziadio Business Report, 3, URL [24] Léon Waras. Eéments d économie poitique pure; ou, théorie de a richesse sociae (Eements of pure economics; or, the theory of socia weath). Corbaz, Lausanne, [25] Fredrik Ygge and Hans Akkermans. Power oad management as a computationa market. In Proceedings of the 2nd Internationa Conference on Muti-Agent Systems (ICMAS), pages , Kyoto, Japan, Appendix A. Proof of Lemma 1 Proof. We begin by showing the direction: If B S (p) = B U (p) = B D (p) then: λ > 1 s.t. : X (p) = λ (y(p)) Now, due to Assumption 3 we know that δ : Y (p) = δ y(p). Thus: : X (p) = λ ( 1 Y (p)) δ (38) : X (p) = λ 1 δ (Y (p)) (39) : X (p) = λ (Y (p)) for λ = λ 1 δ (40) X(p) = λ (Y (p)) (41) 36

37 From the fow constraints (Eqn. 6) we aso know that: X(p) p = (Y (p)) p (42) Equations (41) and (42) can ony both be true if λ = 1. Thus, it foows that: X(p) = (Y (p)). The direction is even simper to show: X(p) = (Y (p)) (43) X(p) = (λ y(p)) (44) X(p) = λ (y(p)) (45) B S (p) = B U (p) = B D (p) (46) Equation 44 foows because of Assumption 3 (Linear Prediction for Aggregate Demand). Equation 45 foows from System Properties 3 and 4 (Production functions satisfy CRTS and are bijective). B. Proof of Lemma 3 Proof. We have shown in the proof for Lemma 2, that for p n p with p 0 and p k = 0, for every rationa user i, for n arge enough, at east one of the sack constraints wi bind, i.e.: i : Xik R(pn ) k (y(pn )) = 1 Xi R(pn ) γ (y(p n )). For the remainder of the proof, we wi aways consider the suppy and demand functions for p n p, however, we wi write X and y instead of X(p n ) and y(p n ) to simpify notation. It is possibe, that for each rationa user, a different sack constraint binds. Let L and M denote the sets of rationa users for whom the sack constraints bind for resources and m, respectivey, i.e., R = L M. We assume that L and M are disjunct; if for some user, both sack constraints for and m bind, we can pace that user randomy into either L or M. We et X L = i L XR i and X M = i M XR i. Then: X L (y) XL m fm 1 (y) and X M m m (y) XM (y). It is easy to see that at east for one of the resources or m, the joint suppy of that resource from the corresponding set of users L or M must be at east haf of the tota suppy of that resource from the rationa users. With out oss of generaity, et be such a resource. Thus: X L (y) 1 2 X R (y). Remember that for a users L, the sack constraint for binds. For a other rationa users, we ony know that they suppy east of resource k. Thus: γ Xk L k XL = (y) (y) and Xk M k XM (y) (y) 37

38 By adding both sides together we get: γ Xk L k Because X L + X M = X R, this is equivaent to: Because X L (y) 1 2 X R (y) (γ 1), this impies: ( γ 1 2 ) XM k XR + (y) (y) (y) Xk L k Xk R k ( γ XR k k XR k XR + (y) (y) (y) k XR k XR + (y) k (y) (y) ) Xk R k (y) k ( 2 γ + 1 XR (y) (y) ) X R (y). So far, we have ony argued about the rationa users, and derived how much smaer the buffer for resource k for these users must be reative to the maximum buffer for resource or m. Now we turn our attention to the adversaria users as we. Because Y R C Y A we know that X R p C X A p. For arge enough n, we know that p n k is cose enough to 0 such that a income must come from suppy resources and m. Thus: ) X R p + Xm R p m C (X A p + Xm A p m Because was assumed to be the resource with the argest buffer for the rationa users, we know that: X R m X R f m 1 (y) (y) For the adversaria users, there is no restriction between the buffers for and m, except the standard sack constraint, i.e.: X A m 1 γ XA If we combine Equations 47, 48 and 49, then we get: X R p + X R m (y) (y) p m C X R p + X R m (y) f m 1 (y) (y) (X A p + 1 γ XA f m 1 (y) ) (y) p m (y) p m C X A p + C γ XA m (y) (47) (48) (49) (50) (y) p m (51) 38

39 For the ast inequaity to be true, a necessary condition is: X R min{cx A, C γ XA } (52) X R C γ XA (53) X A γ C XR (54) We have derived above that for rationa users, we have: For the adversaria users, we have: X R k k (y) Xk A k If we take these two inequaity together we get: Thus, to get X k k (y) ( 2 ) γ + 1 X R XA γ (y) (y) (y) 2 γ+1 XR + γ X A (y) (55) (56) (57) we need that: X k k (y) X (y) (58) 2 γ + 1 XR + γ X A X (59) By definition, we have that X R + X A 2 = X. Because γ > 1, we know that γ+1 XR < X R and γ X A > X A. Thus, the amount by which 2 γ+1 XR is smaer than X R is exacty the amount by which γ X A can be arger than X A, for Inequaity 59 to hod. Thus, we need: (γ 1) X A (1 2 γ + 1 )XR (60) If we now use Equation 54, i.e., X A one: γ C XR, it foows that the next inequaity impies the previous (γ 1) γ C XR (1 2 γ + 1 )XR (61) γ2 γ C Because γ > 1 and C > 1, we can derive the foowing: This competes the proof of the emma. γ 1 γ + 1 (62) (γ + 1) (γ 2 γ) C (γ 1) (63) (γ 1) (γ 2 + γ) C (γ 1) (64) (γ 2 + γ) C (65) 39

40 C. User Study: Set-up The UI design process incuded an eary exporatory study (with 6 users) and a piot study (with 6 users). Upon competion of an iterative UI design phase, we recruited 16 users (8 femaes) from the Greater Seatte area for the usabiity study. A of the users had some coege education and used a computer for at east 10 hours per week. The average age of our participants was about 39, ranging from 22 to 66 years od. None of the users worked for the same company, none of them were usabiity experts and none of them had used a p2p backup system before. A of the users understood the meaning of backing up your fies before coming to the study, however ony a few of them had used server-based onine backup systems before. We recruited two different groups of users: novices and experts. Experts were screened to be users who had used p2p fie-sharing software and modified the maximum bandwidth imits of their cient in the ast 5 years. We aso ensured they had some idea about the speeds of an average home broadband connection. Novices were screened such that they did not have technica jobs, were not sophisticated enough to set-up a wireess router by themseves, and had never adjusted the maximum bandwidth imits of a p2p fie-sharing cient. In this work we are particuary interested in evauating the advanced settings version of the UI. Thus, our true target group of users was in fact the experts group. However, we incuded the novice users to make sure we identified a of the probems of the UI or the system in genera that might not be found when ony testing expert users. We had 8 experts and 8 novices. We ran one participant at a time with each session asting about 1.5 hours. The users fied out a pre-study questionnaire (20 minutes), competed a series of interactive tasks using the UI (45 minutes), and then competed another post-study survey (20 minutes). We ran the software on a singe 3 GHZ De computer at fu resoution using a x1200 Syncmaster dispay. D. Proof of Theorem 3 We discuss some genera conditions under which a muti-dimensiona Newton iteration converges even if a diagona approximation is used for the Jacobian. We essentiay foow Kantorovich s proof of the oca convergence of Newton s method (Kantorovich s theorem [12] and [13] Chapter XVIII). Definition 7. Suppose F : R n R m. Writing the vector vaued function F (x 1, x 2,, x n ) as (f 1 (x 1, x 2,, x n ),, f m (x 1, x 2,, x n )) one defines the Jacobian matrix as the m n matrix J where J ij = f i / x j. We wi need the foowing two resuts: Theorem 5. Suppose F : R n R m is continuousy differentiabe, and a, b R n. Then F (b) = F (a) + where J is the Jacobian matrix of F. 1 0 J(a + θ(b a))(b a)dθ, The above theorem is the second fundamenta theorem of cacuus. The next theorem extends the triange inequaity obeyed by norms to integras. Theorem 6. If F : R R n is integrabe over the interva [a, b], then b b F (t)dt F (t) dt. (66) a a 40

41 We aso reca the definition of the operator norm of a matrix. Definition 8. If A R m n, the norm of A is defined as { } Ax A = max x : x Rn, x 0. The norm defined above has the foowing properties: 1. It is a norm on the space R m n ; 2. Ax A x for a A R m n, x R n ; 3. AB A B for a A R m n, B R n p. The foowing is a we-known theorem from Functiona anaysis. Theorem 7. Suppose J : R m R n m is a continuous matrix-vaued function. If J(x ) is nonsinguar, then there exists a δ > 0 such that, for a x R m with x x < δ, J(x) is nonsinguar and J(x) 1 < 2 J(x ) 1. Proof. (Sketch.)The first part foows from the fact that if J(x ) is non-singuar, then det J(x ) 0 and consequenty there is a neighborhood of x where the determinant does not vanish (poynomias define continuous maps). The atter part foows from the fact that if the map x J(x) is continuous then so is the map x J(x) 1 whenever the atter map is defined. Definition 9. Suppose F : R n R m. Then F is said to be Lipschitz continuous on S R n if there exists a positive constant T such that F (x) F (y) T x y, for a,y S. This definition can aso be appied to a matrix-vaued function F : R n R m n using a matrix norm to F (x) F (y). The usua Newton iteration is phrased as x (k+1) = x (k) J(x (k) ) 1 F (x (k) ). (67) The Newton iteration is known to converge to a root, x, of the function F if we start the iteration cose enough to x (such that the Jacobian is non-singuar). We wish to anayze the convergence of the foowing update rue: x (k+1) = x (k) D(x (k) ) 1 F (x (k) ), (68) where D is the diagona sub-matrix of the Jacobian. To this end, we define the matrix L by the rue J(x) = D(x) + L(x), i.e., L comprises of the off-diagona partia derivatives in the Jacobian. We wi show that if we are in the situation that J and D are Lipschitz continuous and that L(x ) = 0 (is the zero matrix), then the above iteration rue aso converges to the root x as ong as 41

42 we start cose enough to the root. Subtracting x from both sides of equation (68) and noting that F (x ) = 0 we have x (k+1) x = x (k) x D(x (k) ) 1 F (x (k) ( ) ) = x (k) x D(x (k) ) 1 F (x (k) ) F (x ). We now use Theorem 5 to estimate F (x (k) ) F (x ): F (x (k) ) F (x ) = = Assuming L(x ) = 0 we have 0 J(x + θ(x (k) x ))(x (k) x )dθ J(x )(x (k) x )dθ ( ) J(x + θ(x (k) x )) J(x ) (x (k) x )dθ = J(x )(x (k) x ) 1 ( ) + J(x + θ(x (k) x )) J(x ) (x (k) x )dθ. 0 Therefore, F (x (k) ) F (x ) = D(x )(x (k) x ) 1 ( ) + J(x + θ(x (k) x )) J(x ) (x (k) x )dθ. 0 F (x (k) ) F (x ) D(x )(x (k) x ) 1 ( ) = J(x + θ(x (k) x )) J(x ) (x (k) x )dθ 0 1 ( ) J(x + θ(x (k) x )) J(x ) (x (k) x )dθ J(x + θ(x (k) x )) J(x ) x (k) x dθ T J θ x (k) x 2 dθ (using Lipschitz continuity of J) T J 2 x(k) x 2. 42

43 We now have x (k+1) x Now appying norms on both sides = x (k) x D(x (k) ) 1 (F (x (k) F (x )) = x (k) x D(x (k) ) 1 [D(x )(x (k) x ) + F (x (k) ) F (x ) D(x )(x (k) x ] ( ) = I D(x (k) ) 1 D(x ) (x (k) x ) ( ) D(x (k) ) 1 F (x (k) ) F (x ) D(x )(x (k) x ). x (k+1) x ( ) I D(x (k) ) 1 D(x ) (x (k) x ) ( + D(x (k) ) 1 F (x (k) ) F (x ) D(x )(x (k) x )) I D(x (k) ) 1 D(x ) x (k) x + D(x (k) ) 1 F (x (k) ) F (x ) D(x )(x (k) x ) I D(x (k) ) 1 D(x ) x (k) x + T J D(x (k) ) 1 x (k) x 2. 2 We are assuming that D is aso a Lipschitz continuous map: I D(x (k) ) 1 D(x ( ) = D(x (k) ) 1 D(x (k) ) D(x )) D(x (k) ) 1 D(x (k) ) D(x ) Thus we have where we have set T = max{t J, T D }. T D D(x (k) ) 1 x (k) x. x (k+1) x 3T 2 D(x(k) ) 1 x (k) x 2, If x (k) is sufficienty cose to x, then: D(x (k) ) 1 2M, where M = D(x ) 1 = J(x ) 1 by our assumption that L(x ) = 0. then Thus if x (k) is sufficienty cose to x, then: x (k+1) x 3T M x (k) x 2. Moreover, if This competes the proof of Theorem 4. x (k) x < 1 6T M, x (k+1) x < 1 2 x(k) x. 43