Dandelion: Cooperative Content Distribution with Robust Incentives
Michael Sirivianos Xiaowei Yang Stanislaw Jarecski
Department of Computer Science
University of California, Irvine
{msirivia,xwy,stasio}@ics.uci.edu
Abstract
Online content distribution has increasingly gained pop-
ularity among the entertainment industry and the con-
sumers alike. A key challenge in online content distribution
is a cost-efficient solution to handle demand peaks. To ad-
dress this challenge, we propose Dandelion, a system for ro-
bust cooperative (peer-to-peer) content distribution. Dan-
delion explicitly addresses two crucial issues in coopera-
tive content distribution. First, it provides robust incentives
for clients who possess content to serve others. A client
that honestly serves other clients is rewarded with credit
that can be redeemed for future downloads at the content
server. Second, Dandelion discourages unauthorized con-
tent distribution. A client that uploads to another client is
rewarded for its service only after the server has verified
the other client’s legitimacy. Our preliminary evaluation of
a prototype system running on commodity hardware with
1 Mbps uplink and 1 Mbps downlink indicates that Dan-
delion can achieve aggregate client download throughput
three orders of magnitude higher than the one achieved by
an HTTP/FTP-like server.
1 Introduction
Content distribution via the Internet is becoming increas-
ingly popular among the industry and the consumers alike.
A survey showed that Apple’s iTunes music store sold more
music than Tower Records and Borders in the US in the
summer of 2005 [18]. A number of key content produc-
ers, (e.g. CBS, Disney, Universal), are now selling films
online [2, 3, 6].
A challenging issue for online content distribution is a
cost-effective solution to handle peak usage by promotions
or new releases. A 45-minute DVD-quality episode easily
exceeds one GB. Even if each user is provisioned with a
1 Mbps, it takes more than two hours to download 1 GB.
Overprovisioning for one additional user during peak usage
may require at least an additional 1Mbps bandwidth, which
often costs up to $100 per month [5, 13]. However, a TV
episode is commonly sold at less than two dollars. One
solution is to purchase service from a content distribution
network (CDN) such as Akamai. Yet, CDNs’ services are
costly too, and free CDNs such as Coral, CoDeen, and Cob-
Web [11, 20, 26, 31] lack a viable economic model to scale.
This work explores a cost-effective approach for han-
dling flashcrowds. We present the design and a preliminary
evaluation of Dandelion, a cooperative content distribution
system. Rather than using a third party service, a Dande-
lion server utilizes its clients’ bandwidth. During a flash
crowd event, a server redirects a request from a client to
the clients that have already downloaded the same content.
This approach is similar in spirit to previous work on coop-
erative content distribution [12, 16, 24, 27, 28], most notably
BitTorrent [8]. However, with the exception of BitTorrent,
the above approaches do not provide incentives for a client
to upload to other clients. BitTorrent employs rate-based
tit-for-tat incentives, but these are susceptible to manipula-
tion [15, 17, 25] and do not motivate clients to upload con-
tent after the completion of their download (i.e., seeding).
The primary contribution of our work is that we pro-
vide robust incentives for clients to upload to others. By
robust, we mean that the incentive mechanism does not rely
on clients being altruistic or honest. Its secondary contri-
bution is that Dandelion discourages unauthorized content
sharing. Our design gives no incentives to clients to up-
load to unauthorized clients, but provides explicit rewards
for them to upload to authorized clients, e.g., clients that
have purchased content at a server.
Dandelion’s incentive mechanism is based on a crypto-
graphic fair exchange mechanism, which uses only efficient
symmetric cryptography. A client uploads content to other
clients in exchange of virtual credit. The credit can be re-
deemed for future service by other clients, or for service by
the server itself, or other rewards. This incentive mecha-
nism discourages unauthorized content exchange, because
a client is rewarded for its service only after the server has
verified that the client has uploaded to an authorized client.
We have implemented a prototype of a Dandelion client
and server and conducted a preliminary evaluation on Plan-
etLab [7]. We compare the throughput of a Dandelion
1

server with a server that runs a simple request-response pro-
tocol, such as HTTP. Our preliminary evaluation shows that
Dandelion can improve the throughput of a commodity PC
server with 1 Mbps uplink and 1 Mbps downlink bandwidth
by three orders of magnitude. However, as a trade-off for
providing robust incentives and discouraging unauthorized
content distribution, a Dandelion server is less efficient than
a BitTorrent tracker. As a result, a Dandelion system is less
scalable than BitTorrent, with respect to the number of ac-
tive clients supported by a single server/tracker.
The rest of this paper is organized as follows. Section 2
describes the design of Dandelion. Section 3 briefly dis-
cusses our implementation and its performance. Section 4
compares our work with related work. We conclude in Sec-
tion 5. In the Appendix we provide a detailed description of
our protocol and discuss its security.
2 Design
This section describes the design of Dandelion at a high-
level. In Appendix, we describe the protocol in more detail.
2.1 Overview
The premise of our design is that a low server may have
limited outgoing bandwidth but sufficient CPU power, and
memory to execute many short cryptographic operations
and maintain TCP connection state with its clients under
a flash crowd event.
A Dandelion server can be used to distribute both small
and large static files, depending on the specifics of its de-
ployment (see Section 2.3). It behaves similar to a web/ftp
server under normal work load, responding to clients’ re-
quests with content. When a Dandelion server is over-
loaded, it enters a peer-serving mode. Upon receiving a
request, the server redirects the client to clients that are able
to serve the request.
A Dandelion server maintains a virtual economy. It re-
wards cooperative clients that upload to others with virtual
credit to provide robust incentives. The credit is used as
“virtual money” to purchase future downloads from other
clients or from the server itself (at a high credit cost when
the server is overloaded), or used as other types of rewards.
Similar to BitTorrent, a Dandelion server splits a large
file into multiple chunks, and disseminates them indepen-
dently. This allows clients to participate in uploading
chunks as soon as they receive a small portion of the file,
increasing the efficiency of the distribution pipeline. Fur-
thermore, this incentivizes clients to upload chunks to oth-
ers, as they need credit to acquire the missing ones.
2.2 Robust incentives
A key challenge in designing a credit system is to prevent
client cheating, while keeping both a server and a client’s
processing and bandwidth costs low. A dishonest client
Figure 1: The peer-serving protocol. The numbers on the
arrows correspond to the listed protocol messages. The
messages are sent in the order they are numbered.
that does not upload to others or uploads garbage may at-
tempt to claim credit at the server, and to be robust, the
server must not award credit to such cheating behavior. To
address this challenge, Dandelion employs a cryptographic
fair exchange mechanism. A Dandelion server serves as the
trusted third party mediating the exchanges of content for
credit among its clients. When a client A uploads to a client
B, it sends encrypted content to client B. To decrypt, B must
request keys from the server. The requests for keys serve as
the “proof” that A has uploaded some content to B. Thus,
when the server receives a key request, it credits A for up-
loading to B, and charges B for the content.
A problem occurs if a malicious client A sends invalid
content to B. B can discover that the content is invalid only
after receiving the decryption key and being charged. To
address this problem, our design includes a non-repudiable
complaint mechanism. If A intentionally sents garbage to
B, A cannot deny it. In addition, B is prevented from falsely
claiming that A has sent it garbage. For clarity, we describe
the complaint mechanism after we describe the normal mes-
sage exchange in a Dandelion system.
Figure 1 shows how messages are exchanged in a Dan-
delion system. We assume that each client has a password-
protected account with the server and that it establishes a
secure channel (e.g. SSL), over which it obtains shared
session keys with the server. During a flash crowd event,
the Dandelion server keeps track of the clients that are cur-
rently downloading or seeding offered files. The message
exchange proceeds as follows:
Step 1: A client (B in Figure 1) sends a request for a file to
the server.
Step 2: When the server receives the request, it returns di-
gests of the file chunks for integrity checking [8], a ran-
dom list of other clients that can serve the file, and crypto-
graphic authorizations, namely tickets that enable B to re-
quest chunks from these clients.
Step 3: Upon receiving the server’s response, B connects to
2