Toward Practical and Unconditional Verification of Remote Computations

This paper revisits a classic question: how can a machine specify a computation to another one and then, without executing the computation, check that the other machine carried it out correctly? The applications of such a primitive include cloud computing (a computationally limited device offloads processing to the cloud [11] but does not assume the cloud’s correctness [12]); volunteer computing (some 30 projects use the BOINC [1] software platform to leverage volunteers’ spare cycles, but some “volunteers” return wrong answers [2]); and high-assurance computing (a machine may be remotely deployed and subject to physical tampering). Today, a common way to verify computations is replication [9, 17, 23, 27]. However, replication may not be viable (say if the performing computer is an embedded robot). It also requires assumptions about failure independence. Another technique is auditing [17, 24], but if the performer understands the computation better than the requester, the performer can alter strategic bits, undetected by an audit. A final technique is trusted computing [10, 21, 26, 28, 29], but it assumes that some component—the hardware, the hypervisor, a higher layer—is not physically altered. Can we instead make no correctness assumptions about the performer? In theory, such unconditional verification has been achievable since the 1980s, using both interactive proofs [15] and probabilistically checkable proofs (PCPs) [3, 5]. Informally, the central theorem in the area states that a client can—with a suitably encoded proof and under a negligible chance of viewing a wrong answer as correct—check an answer’s correctness in constant time [3]. Unfortunately, this astonishing body of theory is considered by folklore to be impractical. This skepticism is well-founded: it is based on the complexity of the algorithms and long experience trying to use generalpurpose cryptographic results in practical systems. This brings us to the purpose of this paper, which is to propose a new line of systems research: using the machinery of PCPs, can we build a system that (a) has practical performance, (b) is simple to implement, and (c) provides unconditional guarantees? Note that (a) and (b) contrast with PCPs as used in the theory literature and (c) contrasts with current systems approaches. To illustrate the promise of this line of research, we do the following: (1) Identify work in the PCP literature that provides a base for systems research (§3.1–§3.2). We first looked to the PCP literature, then observed that efficient argument systems [19, 22] (PCP variants in which the server proves that it has a proof by answering questions interactively) are promising, and then noticed that a particular argument system [18] could lead to a practical solution. (2) Refine the approach of [18] into a design that is practical over a limited domain (§3.3). We applied refinements to shrink program encoding (via arithmetic circuits instead of Boolean circuits), enable batched proofs (which enhances performance for computations that can be decomposed into parallel pieces), and improve amortization (by moving more of the work to a setup phase). These innovations are essential to practical performance. (3) Implement this design to demonstrate its practicality (§4). To our knowledge, PCP theory has never before found its way into any efficient implementation. Thus, we believe that our implementation, though limited, is a contribution. Our implementation is also comparatively simple; it could conceivably be formally verified. (4) Articulate a research agenda for extending the reach of our approach (§5). Our ultimate goal is a practical system for general-purpose verified computation.