Blockchain was born as a supporting technology for secure, effective, and transparent digital asset transactions between peers . Thanks to its ability to enable Byzantine agreement over a permissionless decentralized network, Blockchain has become the foundation of various applications that demand critical data security and integrity, such as FinTech, Internet of Things (IoT), and supply chains [9, 6, 1].
Blockchain features three key components, i.e., transactions, blocks, and chain, where transactions are recorded in blocks that are linked together to form a chain. The goal of blockchain is to enable a public, shared, and distributed ledger among different trustless nodes. Towards this goal, various consensus mechanisms have been implemented to realize the global agreement , which are paramount to guarantee the security and sustainability of the network. The most prevailing consensus mechanism is Proof-of-Work (PoW) , which has been widely deployed in many dominating blockchain networks, such as Bitcoin and Ethereum. The native PoW protocol features a computational complex cryptographic math puzzle whose solution is easy to verify but extremely hard to solve. The nodes in the blockchain network exhaust massive computing resources to generate a solution (called nonce). The process is called mining, and those who take part in it are known as miners. Under PoW, the miner generates a block if it can solve the PoW puzzle with a valid nonce, and immediately broadcasts this block that contains the transactions and the nonce to the entire network. Each node updates its local blockchain by appending the newly mined block only if the block is validated by the majority of nodes in the network. In this way, the miner successfully mines a block.
In the blockchain network, the miner that successfully mines a block is rewarded with a set of cryptocurrency. Driven by this incentive mechanism, the miners contribute their computing powers to the mining process to harvest the reward. In this context, it is more likely for the miners with large computing power to gain the rewards by performing a large number of hash trials within a certain period. Consequently, it may take extremely long time for the solo miners with relatively small computing power to successfully generate a block. For example, in the current Bitcoin network, the chance for a solo miner even deployed with dedicated ASIC mining machine to mine a block is very tiny. As a result, this incentivizes a group of solo miners to aggregate their computing powers into a mining pool, where all participating miners mines towards the same target and share the reward. With this approach of pooled mining, the miners in the pool can greatly reduce their average waiting time to gain the rewards. While pooled mining can indeed bring significant benefits to the miners, the pooling of computing power undermines the core sprit of blockchain, i.e., decentralization111The computing powers of the largest nine mining pools in the current Bitcoin blockchain account for over 90% of the whole blockchain ., and harms its security. For example, a mining pool that occupies more than 50% of the total network computing power can arbitrarily tamper with the data recorded on blockchain; a mining pool that occupies more than 25% of the total network computing power can use the selfish mining strategy proposed in  to increase its revenue to more than that of the honest mining.
To overcome this problem, we develop a new consensus protocol called Proof-of-Age (PoA) that builds upon the native PoW protocol. The objective of PoA is to disincentivize centralized pooled mining so that the miners with small computing powers can participant in and earn rewards from the mining competition. The core idea of PoA lies in using Age of Work (AoW) to measure effective mining period that the miner has devoted to maintaining the security of blockchain. Unlike in the original PoW protocol, in our PoA protocol, the miner benefits from its effective mining period even if it has not successfully mined a block that contains a valid nonce. In particular, PoA exploits the accumulated AoW to reduce the mining difficulty if the miner can prove its effective work for a certain period without gaining any reward. Specifically, if a miner really works but it fails to mine a block, its AoW still increases; and its mining difficulty will be reduced if its accumulated AoW reaches a predesigned threshold; the AoW of a miner reduces to the smallest immediately it successfully generates a block, resulting in the maximum mining difficulty in the next mining round222The idea of PoA originates from the random access problem of wireless channels, where transmitters access the channel to transmit their information in a distributed manner according to some random access protocol. In , the concept of Age-of-Information (AoI)  is used to design the random access protocol. If a transmitter successfully access the wireless channel by sending an information, its instantaneous AoI returns to one; otherwise, its instantaneous AoI is increased by one. AoI is a metric to evaluate the freshness of the information hold at the transmitter for transmissions. The wireless network can use AoI to coordinate the random access to achieve some kind of fairness among transmitters  .
In PoA based blockchain, we treat blocks as information transmitted by miners. Then, we can use a metric similar to AoI (i.e., AoW in PoA) to adjust the mining difficulties of miners. The situation is very similar to the random access of wireless channels. If a miner has successfully mined a block and added the block onto the blockchain, it corresponds to one-time successful access of a transmitter to wireless channel. The intuition of our design is that the miners with relatively lower AoW should access the channel (i.e., add blocks onto the blockchain) with smaller probability, while it is easier for the miners with higher AoW to mine a block.
. In PoA based blockchain, we treat blocks as information transmitted by miners. Then, we can use a metric similar to AoI (i.e., AoW in PoA) to adjust the mining difficulties of miners. The situation is very similar to the random access of wireless channels. If a miner has successfully mined a block and added the block onto the blockchain, it corresponds to one-time successful access of a transmitter to wireless channel. The intuition of our design is that the miners with relatively lower AoW should access the channel (i.e., add blocks onto the blockchain) with smaller probability, while it is easier for the miners with higher AoW to mine a block.. The main contributions of this paper are listed as follows:
Protocol design: We put forth the design of PoA protocol including the hash puzzle, data structure, mining targets, and difficulty adjustment. Different from native PoA, we introduce a new parameter called age ring into the input of hash puzzle. From the data structure of age ring, PoA also enables a chain of age ring, since the generation of age ring in the current mining round depends on that in the previous round. In addition, we set two different targets for the mining of age ring and block respectively, such that the generation of an age ring is much easier than that of a block. For each mining round, the AoW of a miner will be increased if the solution of hash puzzle falls into the predesigned target region (i.e., the associated age ring in this round is effective), while the AoW of the miner will be recounted from the initial value immediately the miner successfully generates a block. Furthermore, we propose a difficulty adjustment strategy of block mining, where the miner will be rewarded by a smaller mining difficulty if its accumulated AoW reaches a predesigned threshold.
: We model the block generation process of PoA based blockchain by using a continuous time Markov chain (CTMC) model. In the proposed model, we decouple the highly correlated mining process of all miners as two parties, i.e., a typical miner and treat the impact of other miners as a whole from the typical miner’s perspective. Meanwhile, we approximate the block generation process of other miners as a single exponential distribution with a rate parameter. In this context, the CTMC model is well-suited to capture the mining process of PoA. Furthermore, based on the CTMC model, we analyse the block generation rates of the mining pool and each solo miner respectively. In particular, our analytical results verify that the block generation rate of the mining pool in PoA is much less than that in PoW, thereby deincentivizing the pooled mining under PoA. It is shown that the block generation rate of the mining pool under PoA can be reduced to 75% of that under PoW by a proper difficulty adjustment strategy. Next, we investigate the distributions of block inter-arrival times of the mining pool and solo miners respectively. Particulary, we verify that the block inter-arrival time of all solo miners is exponentially distributed.
Event-driven simulations: We simulate the mining process in the PoA based blockchain by using the event-driven method. To investigate the block generation rate, we generate the numerical results of the mining pool and each solo miner by the fixed point iteration method and compare the numerical results with the simulation results, and we show that the numerical results are consistent with the simulation results. Moreover, we show that the simulated distribution of the block generation times of all solo miners matches well with the theoretical exponential distribution, and the simulated distribution of the block generation times of the pool fits well with the analytical results. We finally compare the block generation rates of PoW and PoA in the simulations. The simulation results highlight that not only the block generation rate of the pool in PoA is much less than that in PoW, but also the variability of block inter-arrival times of the pool in PoA is much less significant than that in PoW.
The rest of this paper is organized as follows. Section II reviews the related work. Section III presents background on the PoW blockchain. Section IV introduces the PoA protocol. Section V proposes the CTMC model of PoA and analyzes the block generation rates of PoA blockchain. Section VI provides the numerical results. Finally, Section IV concludes this work.
Ii Related Works
A variety of consensus protocols have been developed to cope with the shortcomings of native PoW. One shortcoming of PoW is the low on-chain transaction processing capability. To increase the transaction processing capability of PoW blockchain, [12, 13, 25, 24, 27] modify the data structure of the blockchain, and [7, 21, 28, 3] decouple the functionality of the block. However, the focus of our PoA is not on improving the transaction processing capability. The aim of PoA is to deincentivize the centralization of computing powers caused by the pooled mining in blockchain.
To decentralize the pooled mining, the consensus protocols of Fruitchain  decouples the transaction-carrying functionality of the blockchain. Fruitchain enables two independent mining processes on top of each other. In addition to the block mining, Fruitchain requires an additional PoW to mine a new type of block called “fruit”. More specifically, the fruit needs to point to an earlier block not too far from the block that records the fruit. In this way, each block confirms a set of its recent fruits, while the fruits confirm transactions in this block. The fruit mining also requires solving partial PoW that corresponds to finding a nonce with a difficulty level much smaller than the block mining. Consequently, the solo miner with small computing power can reap from mining the fruits, once the fruits are confirmed by the block. Different from Fruitchain, PoA largely follows the data structure and communication protocol of native PoW with the cost of negligible overhead caused by age rings. Similar to the fruit mining in Fruitchain, the mining difficulty of an age ring is much smaller than that of a block. However, the age rings do not contain any transactions, but are used to validate the miner’s AoW. Generally, there are three notable disadvantages of Fruitchain compared with our PoA. First, broadcasting the fruits in Furitchain increases the communication overhead of the network. Second, Furitchain needs to modify the consensus mechanism in the layer one of the blockchain, thus it has difficulty in compatibility with the current PoW based blockchains. Finally, the rewards contained in the block need to be allocated to the fruits, resulting in instable profits earned by miners.
Nowadays, two decentralized mining pools are proposed for Bitcoin and Ethereum blockchains. For Bitcoin, P2Pool  creates a new blockchain wherein the block is generated to record the shares of the miners in the pool. However, the P2Pool network needs to check a massive number of shares submitted from different participants in the pool in each mining round. Differently, the miners under the proposed PoA protocol are required to verify the age rings only from a single miner that are included in the newly generated block. For Ethereum, Smartpool in  runs a decentralized mining pool protocol as a smart contract. In spite of lower cost than centralized pools, miners still need to acquire Ether to pay for the gas when interacting with the smart contract in smartpool.
As an extension of PoW, Proof-of-Contribution (PoC) adjusts each miner’s mining difficulty by introducing success times (i.e., the number of times the miner has added a valid block to the chain) . The higher success times the miner accumulates, the smaller the mining difficulty of the miner becomes. Therefore, PoC motivates honest mining behaviour by rewarding the difficulty reduction. However, PoC cannot decentralize the pooled mining if the pool’s work is legitimate and honest. Differently, the proposed PoA protocol rewards the partial PoW of the miner by adjusting its mining difficulty if its accumulated AoW meets a predesigned threshold.
To analyze the mining behaviors and the mining performances in blockchain networks, discrete time Markov chain (DTMC) was widely applied in the existing works. For example,  employed DTMC models to analyze selfish mining strategies under PoW, i.e., to calculate a selfish miner’s benefit as well as to determine the mining power threshold at which this attacker is beneficial.To extend the selfish mining, DTMC is also used in  to study the mining revenue of the selfish miner under stubborn mining strategies. Later on,  modifies DTMC of selfish mining strategies by incorporating the impact of transaction fees and studies the corresponding mining performance. Moreover, [23, 26, 10]
exploit the model of Markov Decision Process (MDP) to generalize selfish mining behaviors and find the optimal selfish mining behavior. However, as the number of miners in the network increases, using DTMC/MDP results in an unaffordable model complexity due to the huge state space and correlation among these miners. To address this issue, we employ the CTMC to model the mining process of PoA with a decoupling hypothesis. With the aid of the CTMC model, we can further derive the block generation rate and analyze the distribution of block inter-arrival time.
Iii Background of Blockchain and PoW
This section presents the background of the PoW based blockchain.
Iii-a Data Structure of Blockchain
Blockchain is a chain of blocks with each block containing a header and a set of transactions issued by the payers. Specifically, the issued transactions are broadcast over the blockchain network. Participants then collect and include these transactions into blocks and append them to the blockchain. The header of the block encapsulates the hash of the preceding block, the hash of this block, the merkle root of all transactions contained in this block, and a number called nonce that is generated according to the consensus protocol of PoW. Since each block must refer to its preceding block by placing the hash of its preceding block in its header, the sequence of blocks then forms a chain arranged in a chronological order. Thanks to the cryptographic chain structure, blockchain is tamper-resistant to modification of its past recorded data such that participants can only append new data to the tail-end of the chain of blocks. Fig. 1 illustrates the data structure of Bitcoin blockchain.
Iii-B Preliminaries of PoW
Bitcoin blockchain adopts the PoW consensus protocol among a number of participants to validate new blocks in a decentralized manner. In each round, the PoW protocol selects a leader to pack transactions into a block and appends this block to blockchain. To prevent adversaries from tampering blockchain, the leader selection must be approximately random. Since anonymity is inherently designed as a goal of permissionless blockchain, it must not be vulnerable to the sybil attack where the adversary simply creates many participants with different identities to increase its probability of being selected as the leader. To address the above issue, the key idea behind PoW is that a participant will be selected as the leader of each round with probability in proportion to its computing power.
In particular, blockchain implements PoW by using computational hash puzzles. To create a block at height , the nonce placed into the header of the block must be a solution to the hash puzzle expressed by the following inequality :
where is the hash of the candidate block at height and it is a bit stream of length , is the cryptographic hash function, is the hash of previous block header at height , denotes the solution string of the nonce, denotes the binary string assembled based on the other data contained in the candidate block (e.g., the Merkle root of the included transactions), is a target value, and is the current difficulty level of the hash puzzle (i.e., the number of leading zeros in the hash of a valid candidate block). Using the blockchain terminology, the process of computing hashes to find a nonce is called mining, and the participants involved are called miners.
With a difficult level and the corresponding target , each single query to the PoW puzzle expressed in (1) is an i.i.d. Bernoulli test whose success probability is given by
When is very large, the above success probability of a single query is very tiny. Moreover, it is known that, with a secure hash algorithm (e.g., the SHA-256 hash used for Bitcoin), the only way to solve (1) is to exhaustively search every possible nonce. Therefore, the probability of finding such nonce to solve (1) is proportional to the computing power of the miner. That is, the faster the hash function in (1) can be computed in each trial, the more nonces can be tried per unit time.
Let in (2). The probability that the miner can find a block by
trails follows a geometric distribution:
From (3), we have
where we use for the approximation in the last equation when is very large.
Consider that a miner has the computation rate (i.e., hash rate) of , i.e., the number of hash trails per unit time slot. If each trial for the miner takes the time of , then trials take amount of time. Given (III-B) and , we have
Iv PoA Protocol Design
In this section, we propose a modified PoW consensus protocol, called Proof-of-Age (PoA). Unlike in the native PoW protocol, the miner in PoA benefits from its effective mining period (measured by Age-of-Work) as long as it has devoted computing powers to maintaining the security of the blockchain, even if the miner has not successfully mined a block.
Iv-a Hash Puzzle of PoA
The miners can either mine the block independently and individually (i.e., solo mining) or mine the block together by aggregating their power into a pool (i.e., pooled mining). The design of PoA ensures that there is no incentive to form the mining pools, i.e., the average profit per miner in the mining pool is less than the average profit of a solo miner.
As in the PoW protocol, a new block in PoA is generated by solving a computational hash puzzle. The mining process of the original PoW protocol aims to solve the hash puzzle in (1). To introduce the metric of AoW to the mining process of PoA, we add a new parameter called age ring into the input of the hash puzzle. For the exposition of our PoA protocol, we consider the mining process of a typical miner (either a mining pool or a solo miner) indexed by at the blockchain height . At height , miner executes the mining process by querying the hash of the following form:
where is the age ring of the miner at blockchain height , and is the address of the miner (i.e., the hash of its public key). In (7), all the inputs are concatenated into a single string that is processed by the hash computation.
Iv-B Data Structure of Age Ring
Suppose that miner ’s most recently mined block is at blockchain height , where . The miner is allowed to compute a single age ring at each blockchain height, and the age ring must be involved in the mining process, as expressed in (7). From its latest successful mining at blockchain height to the mining at blockchain height , miner has age rings , where is the age ring of this miner attached to the block at blockchain height, . The data structure of the age ring attached to the block is given by
where is a concatenation operator and is the hash of previous block header at height . Notably, is the proof that the age ring is effective, and this age-ring proof also needs to be mined at height . We will explain how to generate a proof for an effective age ring in Section IV-D. From the data structure of age rings defined in (8), we find that the age ring at height is chained to the age ring at height , ; and thus these age rings also form a chain which is started at height immediately after its latest successful mining at height . Note that the proof of age ring is initially set to as 333NULL is neither zero nor any other value, and it is an empty string that is of zero length and contains no value at all. at the very beginning of the mining process at height , and it will be updated as explained later. Age rings are used to determine the AoW of the miner at each blockchain height.
Iv-C Computation of AoW
We denote the AoW of miner at blockchain height by . As soon as the miner finds a block, its AoW immediately returns to the initial value of zero444If a miner is a newcomer that has never succeeded in the mining even once, its AoW is also set to be zero.. Following the discussion in Section IV-B, we have , due to the successful block generation of miner at blockchain height . Then, as the blockchain height increases from to , the AoW of miner at each height , i.e., , is updated sequentially using the proof of age ring as
where , and is an indicator function defined by
The AoW is used to adjust the mining difficulty in the PoA protocol. Before delving into the adjustment of mining difficulty with AoW, we discuss how to obtain effective age rings and how to generate a block under PoA respectively.
Iv-D Mining Outcomes of PoA
Unlike in the PoW protocol, we set two mining targets and in the PoA protocol, where and correspond to the mining of age ring and block respectively. Furthermore, we have , where is the length of the outputs computed by the hash function . According to the ranges of the computed hash values, there are three different mining outcomes, as illustrated by the three bars with different colours in Fig. 2. We present the details of the three outcomes under the PoA protocol, respectively.
Outcome I: the computed hash result is less than , i.e.,
If this outcome happens, the miner obtains a valid nonce as the solution for the new block at blockchain height . Note that the age ring also needs to be included into this new block together with the nonce, the hash of the previous block, and the transactions. Then the miner adds this block onto the blockchain and its AoW returns to zero, i.e., , at this blockchain height. Therefore, the implication of mining target is the same as that of the mining target in PoW, i.e., it determines whether the miner finds a valid block. Moreover, we will adjust the mining target for a miner according to its AoW at each blockchain height, as explained in Section IV-E.
Outcome II: the computed hash result is larger than but less than , i.e.,
If this outcome happens, the corresponding nonce is not a solution for the new block, but this is a proof that the miner has devoted its computing power to the mining process at blockchain height . Therefore, for this outcome, we say that the nonce becomes the proof that the age ring is effective at this blockchain height, and the age-ring proof contained in the age ring is updated to . Then, the AoW of this miner is increased by one, i.e., , due to a factor that the age ring is effective now. After that, the miner includes the age ring into the input of the hash function to mine the block. The mining target of age ring is fixed for all miners over all blockchain heights. The value of is preset according to the mining power unit . In this paper, we need to ensure that each miner with can compute an effective age ring that satisfies (12) with probability approaching one in the mining process at each blockchain height.
Outcome III: the computed hash result is larger than , i.e.,
If this outcome happens, the miner fails to compute an effective age ring, not to mention the successful block mining. In this case, the age-ring proof keeps at its initial value , and the AoW of this miner at blockchain height is invariant.
We illustrate the mining process of miner at blockchain height in Fig. 3, where green squares represent the blocks mined by miner , blue squares represent the blocks mined by other miners, green rounds represent the age rings computed by miner , and arrows represent the dependency among blocks and age rings. This figure illustrates the case that mine has generated two blocks and in sequence. Notably, the age rings of a miner also form a chain between any two adjacent blocks mined by this miner. Since the mining of block is performed based on the hash of the previous block header and age ring (as specified by the hash form in (7)), there are two arrows coming out of block that point to block and age ring , respectively. Since age ring links to through the recursive data structure of age rings (as defined in (8)), there is an arrow coming out of age ring that points to age ring . Meanwhile, the computation of age ring also incorporates the hash of block header , and thus these is also an arrow coming out of pointing to the block at height . We stress that i) the AoW of miner returns to zero at the blockchain height where it has successfully generated the block; ii) AoW keeps increasing with the generation of effective age rings.
Iv-E Difficulty Adjustment
The essence of our PoA protocol is to construct a function that maps the AoW of each miner, i.e., , to a mining difficulty level , where denotes the mining difficulty level when . In this paper, we consider a case that the difficulty level can only take two values, i.e., , where . Specifically, the function that maps the AoW mining difficulty levels is given by
This mapping of mining difficulty level means that if the AoW is no less than a threshold , the miner mines with a larger mining difficulty ; otherwise, the miner mines with a smaller difficulty . From (1), we have , which means that a larger gives a smaller . Recall that the mining target of age ring is preset and fixed for all miners. The general form of the multi-level mining difficulty mapping function will be considered in the future work. Regarding our PoA protocol, we have the following remarks.
Remark 1 (Age-ring chain)
The idea on the mining process in (7) and the recursive data structure of age rings in (8) is that all age rings between two adjacent blocks generated by the same miner form a chain, i.e., the current age ring is computed using the previous age ring. Due to the chain of age rings, the age rings cannot be computed at the same time and can only be computed one by one along with each block. Thus, the miner has no incentive to split its power into multiple parts and use these parts to simultaneously generate multiple age rings in each mining round.
Remark 2 (Negligible overhead of age ring)
If the miner has generated a block (i.e., finding a nonce satisfying (8)), it needs to include the eligible nonce together with current age ring into the block. Note that the age ring is just a set of hashes; hence the storage overhead introduced by the age rings is negligible.
Remark 3 (Block verification)
Remark 4 (Sybil attack resistance)
Each miner on the blockchain is identified by its address and the age rings are tied to the address. It is impossible that a miner can mine the block using the age rings obtained by other miners with different addresses. If a newcomer (i.e., a miner with a new address) begins to mine, its AoW is defaulted to be zero. This mechanism can prevent malicious miners from making multiple addresses to carry out sybil attacks, since each new address needs to mine with the largest difficulty.
Remark 5 (Memoryless mining)
When a miner generates an effective age ring at a blockchain height before any other miner successfully generates a block, this miner can include this effective age ring into (7) and continue to mine the block at this height. Due to the memoryless property of the mining process , the block generation probability of this miner after an effective age ring is found is still the same as the probability when it mines at the very beginning at this height.
V Model Analysis
In this section, we mathematically model the mining process of PoA and analyze the block generation rate (i.e., block throughput) of the PoA based blockchain.
V-a CTMC Model
We consider a blockchain network consisting of miners each with unit computing power. The total mining power of the network is . Suppose that in the network, there exists a single mining pool that aggregates miners, and each of the other miners performs the solo mining. The power of the pool is , i.e., the sum power of its members.
The investigation on the block throughput of the PoA blockchain is related to the stochastic process of block arrival on the blockchain. The average rate of block arrival process is impacted by the hash powers and the mining difficulties of the miners. According to our PoA protocol, the mining difficulty of each miner is determined by its AoW that changes with the interactions among different miners in the mining process. Consequently, the AoW states of the miners are correlated and coupled together. In this context, we need to track the AoW states of the miners for the block throughput analysis.
The most accurate way to analyze the block throughput of the PoA blockchain is to model the AoW states of each individual miner. However, this will lead to unaffordable model complexity due to the huge AoW state space for handling all of the miners. Specifically, the number of AoW states of all the miners is exponentially related to the total number of the miners in the network. To address this issue, we propose to model the mining process of PoA with a decoupling hypothesis, where we focus on the mining process of a typical miner and treat the aggregation of all other miners as the surroundings of this typical miner. Let us define one other miner with respect to the typical miner as an exterior miner. Under this decoupling hypothesis, we only need to model the interior states of the typical miner and the interaction between the typical miner and its surroundings, i.e., the aggregation of all exterior miners.
The interior state of the typical miner will transit as long as either it finds a block/an effective age ring or any exterior miner finds a block. Given fixed mining difficulty level and AoW, the inter-arrival time of blocks (i.e., the block generation time) found by a miner follows an exponential distribution. Moreover, since the generation of effective age rings is also made from the mining process, the inter-arrival time of effective age rings found by the typical miner also follows an exponential distribution. However, since the AoW states of different exterior miners are diverse and correlated, different exterior miners may have different mining difficulties, and the mining processes of different exterior miners follow exponential distributions with different rates. As a result, it is challenging to characterize the block inter-arrival time of all exterior miners. Fortunately, as we will show in Section V-C, the block inter-arrival time of all exterior miners can be well approximated by a single exponential distribution. Now, since the inter-arrival time of each event that triggers the state transitions under PoA can be treated as an exponential distribution, we can model the mining process of a typical miner under the PoA protocol using the tool of Continuous-Time Markov Chain (CTMC) , described as follows.
Fig. (4) shows the proposed CTMC model under the PoA protocol consisting of two types of states:
State , , means that the current AoW value of this typical miner is . The effective age ring has not been generated at the current blockchain height, and thus it can be generated;
State , , means that the current AoW value of this typical miner is . The effective age ring has been generated at the current blockchain height, and thus it is not allowed to be generated again.
Assume that the typical miner of interest is in state . Following the PoA protocol, the typical miner attempts to mine the block by conducting the hash queries in (7). The mining result that will trigger the state transition of the miner is either a nonce satisfying (11) or a nonce satisfying (12). If a nonce that satisfies (11) is found, a new block is found by this typical miner and then the state of this miner transits to state . If a nonce that satisfies (12) is found, an effective age ring is generated by the typical miner and the state of this miner transits to state , where the miner updates its AoW using the effective age ring and adjusts its mining difficulty with updated AoW accordingly. Note that after the miner generates the effective age ring at the current blockchain height, it continues to mine the block at this height. As a result, the typical miner can either generate a block ahead of all exterior miners in the current mining round, or increase its AoW for the successor mining rounds if any exterior miner generates the block ahead. Since the AoW value of the typical miner drops to zero (i.e., the state of this miner transits to zero) if the block is generated by the typical miner, the recurrence time of state 0 is the block inter-arrival time of the typical miner (i.e., the time between two successive visits of state 0). In view of these transitions, we define the transition rates in the CTMC as555It is customary not to show the self-transition from state to state in the CTMC, since the transition rate can be cancelled out in the balance equation at equilibrium for state .
effective age ring generation rate under difficulty level , i.e., ;
block generation rate of the typical miner under difficulty level , i.e., ;
block generation rate of the typical miner under difficulty level , i.e., ;
block generation rate of all exterior miners, i.e., .
where , , and . Due to the memoryless property of exponential distributions, the transition rate from states to is independent of that from states to . From Remark 5, if the typical miner has generated an effective age ring, he does not become any closer to the block generation than he was in the beginning.
V-B Block Throughput Analysis
Let denote the steady-state probability that the chain is in state , . By equating the rates of flow into and out of each state, the steady-state probabilities in the irreducible666A Markov chain is irreducible if every state can be reached from every other state. CTMC yield
By some mathematical manipulation, we have
where and .
where if either goes to infinity (i.e., no one can reach state ) or (i.e., the difficulty control of PoW), and if (i.e., the difficulty reduces as long as a single effective age ring is generated). From (V-B), we further have , since .
For a miner in the PoW based blockchain network, the block generation rate of the miner is the ratio of its computing power to the total computing power of the whole network; moreover, the variance of block inter-arrival time is proportional to the inverse of its computing power. Therefore, the block inter-arrival time usually exhibits very large variance for a solo miner with relatively small computing power. As a result, it may take extremely long time for the solo miner to successfully mine a block. In reality, this result incentivizes the solo miners to aggregate their computation powers into a mining pool, where all participating miners work together to mine and share the revenue as long as any miner in the pool successfully finds a block. With this approach of pooled mining, the miners in the pool can greatly reduce their variances of the block inter-arrival time and get paid regularly in every day, although the block generation rate of each miner in the pool is not changed. The pooled mining can indeed bring significant benefits to the miners; however, the pooling of computing power undermines the decentralized nature of the blockchain, which can potentially cause serious security threats to the blockchain.
In the following, we will reveal that the PoA protocol discourages the pooled mining, and thus it is not worthwhile for the miners to form the mining pool. To this end, we first characterize the block generation rates of the mining pool and all exterior miners (i.e., solo miners) based on (V-B), and then prove that the block generation rate of the mining pool under PoA is not proportional to its aggregated computing power and can even be much less than its proportion.
Let us use the CTMC in Fig. 4 to track the mining process of the mining pool. In this case, the typical miner becomes the mining pool, and the decoupling assumption still holds. Using (V-B), we can specify the block generation rates of the mining pool and each solo miner respectively as
where, for the pool in (19), the aggregated block generation rate of all exterior miners is ; for each solo miner in (20), the aggregated block generation rate of all exterior miners is . Using the fixed-point iteration (FPI) in Algorithm 1, we can compute the block generation rates of the mining pool and each solo miner.
Furthermore, the relative rate gain of the pool over all exterior miners is defined as the ratio between the block generation rates of the pool and all solo miners, given by
Furthermore, it is clear that is the relative rate gain under PoW. As such, we refer to as the gap of relative rate gains between PoA and PoW. From (25), it can be verified that holds if either (i.e., no pooled mining) or goes to infinity. In this case, .
To show that PoA can discourage the pooled mining, we first verify that , i.e.,
To prove (26), it is equivalent to proving that . The proof is straightforward and omitted here.
Second, the numerical results in Fig. 5 show that the gap in (25) can be very large when goes larger within a finite range. For example, it is observed in Fig. 5(a) that the gap can be reduced to 25 when under , and .
Therefore, we conclude that the pooling under PoA can disincentivize the pooled mining from the block generation rate perspective.
V-C Distributions of Block Inter-Arrival Time
In this part, we analytically validate the distributions of block inter-arrival times of the mining pool and the solo miner respectively. The key point of the following analysis is the relative magnitudes of the “time it takes for the state 0 to reach ” and the “time to generate a block at difficulty level of ”. If the former is much shorter than the latter, then the effective difficulty level is .
First, let us consider a solo miner. For the solo miner, the average time to generate an effective age ring is , and the average time to move from state to state is less than . In total, the average time from state to state is therefore less than . Note that the average time to generate a block at difficulty level is . In our setting, is large and . Thus, the state almost always reaches before a block is generated at . Thus, as an approximation, we can treat the effective difficulty level of a solo miner as . Its average block generation time is therefore exponentially distributed with rate of .
Next, consider the mining pool. The average time to generate an effective age ring (go from state to state ) is . With the approximation in the previous paragraph, the average time to go from state to state is . In total, the average time to go from state to state is therefore
. The associated random variable is a sum of
random variables. Using the law of large numbers, we can approximate the generation time of
as a Gaussian distribution with meanand variance (i.e., ), when is sufficiently large. In addition, the average time for the mining pool to generate a block at difficulty level of is .
Let be a realization of the time to reach state . Let be the block inter-arrival time. Given , we have the conditional PDF of the block inter-arrival time of the pool as
where the second equation implies that the pool generates the block at difficulty level if , and denotes the probability that the pool cannot find a block within time . Recall that . Taking average of , the PDF of the block inter-arrival time is given by
Vi Numerical and Simulation Results
We use event-driven simulations to model the block generation process under PoA, where an event represents a state of the CTMC in Fig. 4. With the event-driven simulations, we only focus on the time that a state holds before it moves to the other state. In this way, we can record the block inter-arrival times of both mining pool and solo miner.
Vi-a Simulations of Throughput and Block Inter-arrival Time
Consider that a blockchain network with miners for blocks, where , and .
Fig. 6 shows total throughput of the PoA based blockchain network with and , respectively. Consider . The numerical results of total throughput of the blockchain network and the block generation rates of mining pool and solo miners are obtained from the FPI in Algorithm 1. First, it is observed that the numerical results match the simulation results. Second, each subfigure shows that the throughput decreases as the pool becomes larger. Compared with Fig. 6(a), both total throughput and block generation rates in Fig. 6(b) reduce due to a higher .
Fig. 7 plots the histograms of block inter-arrival times of the mining pool and solo miners under . The height of each bar in the histogram plot indicates the number of block inter-arrival times that fall into the corresponding range. Figs. 7(a) and 7(b) consider that and respectively. For reference purpose, we also numerically plot the exponential distributed curves with rate of obtained by the FPI in Algorithm 1 and the derived distribution of in Section V-C. First, it is observed from Figs. 7(a1) and 7(b1) that the block inter-arrival times of all solo miners follow the exponential distributions with rates of , and , respectively. This validates our assumption in the formulation of CTMC in Section V-A. Second, Figs. 7(a2) and 7(b2) show the distributions of block inter-arrival time of the mining pool follow our analytical result in Section V-C.
Vi-B Comparison of block generation rates between PoW and PoA
Consider that . Let the number of miners in the pool be , where
denotes the power ratio of the pool over the entire network. For each power ratio, the same total block throughput is fixed for both PoA and PoW based blockchain networks. The block generation rate of each individual miner is normalized according to the total block throughput, and the vertical error bar is determined by the standard deviation.
Fig. 8 shows the normalized block generation rates of the pool under PoW and PoA respectively. First, as the power ratio goes up, the block generation rate of the pool under PoW linearly increases. Second, the increase of block generation rate of the pool under PoA is negligible. Third, the variance of block generation rate of the pool under PoA is much less significant than that of PoW.
Fig. 9 shows the normalized block generation rates of an individual miner inside the pool under PoW and PoA respectively, where the y-axis is the block generation rate of an individual miner and the x-axis is the power ratio of the mining pool. First, under PoA, the block generation rate of each individual miner inside the pool decreases as the pool’s power ratio increases. This is due to a fact that as the increase of the pool’s power ratio (i.e., the increase of the number of the miners in the pool), the increase of block generation rate of the pool is negligible. Second, under PoW, the block generation rate of each individual miner inside the pool is the same as that outside the pool, and keeps invariant over the range of power ratio; however, its variance is deceased by participating in the pool.
In this paper, we have proposed a novel consensus protocol, called PoA, to disincentivize the pooled mining. Following the native PoW protocol, the miners under PoA reap the rewards by solving the mathematical puzzles. In contrast to PoW, we introduced AoW to measure the effective mining period that the miner has spent solving the puzzles, and included the age ring in the block head as the input of hash puzzle to prove AoW. Regarding the protocol design, we proposed two different mining targets for the effective age ring and block respectively. In each mining round, the AoW will be increased by one if the miner can solve the puzzle of age ring (i.e., the age ring is effective). The miner will be rewarded by either the reduced difficulty of block mining if its accumulated AoW is beyond a threshold, or the block reward if it generates a block. To facilitate the performance analysis, we use the CTMC to model the mining process of the mining pool and solo miners under PoA. Based on this CTMC, we show that the block generation rate of the pool under PoA can be reduced to 75 of that under PoW by a proper difficulty adjustment strategy. In addition, we not only approximated the distribution of block generation time of the mining pool, but also validated that the block generation time of all solo miners is exponentially distributed. Finally, we used the even-driven simulations to demonstrate the consistency between the numerical and simulation results.
The authors would like to thank Dr. He Chen for his valuable discussions on the topic of age-of-information, which inspires the idea of this work.
-  (2016) Blockchain ready manufacturing supply chain using distributed ledger. International Journal of Research in Engineering and Technology 5 (9), pp. 1–10. Cited by: §I.
-  (2012) Continuous-time markov chains: an applications-oriented approach. Springer Science & Business Media. Cited by: §V-A.
-  (2019) Prism: deconstructing the blockchain to approach physical limits. In Proc. the 2019 ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), pp. 585–602. Cited by: §II.
-  (2016) The impact of transaction fees on bitcoin mining strategies. Master’s Thesis, Princeton University. Cited by: §II.
-  (2020) Age-of-information dependent random access for massive iot networks. In Proc. IEEE INFOCOM 2020-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pp. 930–935. Cited by: footnote 2.
-  (2019) Blockchain for internet of things: a survey. IEEE Internet of Things Journal 6 (5), pp. 8076–8094. Cited by: §I.
-  (2016) Bitcoin-NG: a scalable blockchain protocol. In Proc. 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI), pp. 45–59. Cited by: §II.
-  (2014) Majority is not enough: bitcoin mining is vulnerable. In Proc. Int. Conf. Financial Cryptogr. Data Secur., pp. 436–454. Cited by: §I, §II.
-  (2016) Blockchain and its coming impact on financial services. Journal of Corporate Accounting & Finance 27 (5), pp. 53–57. Cited by: §I.
-  (2016) On the security and performance of proof of work blockchains. In Proc. the 2016 ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), pp. 3–16. Cited by: §II.
-  (2017) Age of information: a new concept, metric, and tool. Foundations and Trends in Networking 12 (3), pp. 162–259. Cited by: footnote 2.
-  (2015) Inclusive block chain protocols. In Proc. Int. Conf. Financial Cryptogr. Data Secur., pp. 528–547. Cited by: §II.
-  (2018) Scaling nakamoto consensus to thousands of transactions per second. arXiv preprint arXiv:1805.03870. Cited by: §II.
-  (2017) SmartPool: practical decentralized pooled mining. In Proc. 26th USENIX Security Symposium, pp. 1409–1426. Cited by: §II.
-  (2008) Bitcoin: a peer-to-peer electronic cash system. [Online]. Available: http://bitcoin.org. Cited by: §I, §I.
-  (2019) Deconstructing blockchains: a comprehensive survey on consensus, membership and structure. arXiv preprint. Note: [Online]. Available: https://arxiv.org/abs/1908.08316 Cited by: §I.
-  (2016) Stubborn mining: generalizing selfish mining and combining with an eclipse attack. In Proc. IEEE Eur. Symp. Secur. Privacy (EuroS&P), pp. 305–320. Cited by: §II.
-  (Accessed March, 2021) P2Pool: decentralized bitcoin mining pool. Note: http://p2pool:org/ Cited by: §II.
-  (2017) Fruitchains: a fair blockchain. In Proc. the ACM Symposium on Principles of Distributed Computing, pp. 315–324. Cited by: §II.
-  (Accessed March, 2021) Pool share from BTC.com. Note: https://btc.com/stats/pool Cited by: footnote 1.
-  (2016) Subchains: a technique to scale bitcoin and improve the user experience. Ledger 1, pp. 38–52. Cited by: §II.
-  (2011) Analysis of bitcoin pooled mining reward systems. arXiv preprint arXiv:1112.4980. Cited by: §V-B, Remark 5.
-  (2016) Optimal selfish mining strategies in bitcoin. In Proc. Int. Conf. Financial Cryptogr. Data Secur., pp. 515–532. Cited by: §II.
-  (2016) SPECTRE: a fast and scalable cryptocurrency protocol.. IACR Cryptol. ePrint Arch. 2016, pp. 1159. Cited by: §II.
-  (2015) Secure high-rate transaction processing in bitcoin. In Proc. Int. Conf. Financial Cryptogr. Data Secur., pp. 507–527. Cited by: §II.
-  (2016) Bitcoin’s security model revisited. arXiv preprint arXiv:1605.09193, pp. 1–26. Cited by: §II.
-  (2018) Phantom. IACR Cryptology ePrint Archive, Report 2018/104. Cited by: §II.
-  (Accessed March, 2021) Decoupling transactions and pow. Note: https://bitcointalk.org/index.php?topic=179598.0 Cited by: §II.
-  (2019) A survey on consensus mechanisms and mining strategy management in blockchain networks. IEEE Access 7, pp. 22328–22370. Cited by: §III-B.
-  (2018) Proof of contribution: a modification of proof of work to increase mining efficiency. In Proc. 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), Vol. 1, pp. 636–644. Cited by: §II.