# Controlling morphology in hybrid isotropic/patchy particle assemblies

Srinivas Mushnoori  Department of Chemical and Biochemical Engineering,
Rutgers, The State University of New Jersey, Piscataway, New Jersey 08854
Jack A. Logan  Department of Physics and Astronomy, Stony Brook University,
Stony Brook, NY 11794  Center for Functional Nanomaterials, Brookhaven
National Laboratory, Upton NY 11973  Alexei V. Tkachenko<EMAIL_ADDRESS>Center for Functional Nanomaterials, Brookhaven National Laboratory, Upton NY
11973  Meenakshi Dutt<EMAIL_ADDRESS>Department of Chemical and
Biochemical Engineering, Rutgers, The State University of New Jersey,
Piscataway, New Jersey 08854

###### Abstract

Brownian Dynamics is used to study self-assembly in a hybrid system of
istotropic particles (IPs), combined with anisotropic building blocks that
represent special “designer particles”. Those are modeled as spherical patchy
particles (PPs) with binding only allowed between their patches and IPs. In
this study, two types of PPs are considered: Octahedral PPs (Oh-PPs) and
Square PPs (Sq-PPs), with octahedral and square arrangements of patches,
respectively. The self-assembly is additionally facilitated by the simulated
annealing procedure. The resultant structures are characterized by a
combination of local correlations in cubatic ordering, and a symmetry-specific
variation of bond orientation order parameters (SymBOPs). By varying the PP/IP
size ratio, we detected a sharp crossover between two distinct morphologies,
in both types of systems. High symmetry phases, NaCl crystal for Oh-PP and
square lattice for Sq-PP, are observed for larger size ratios. For smaller
ones, the dominant morphologies are significantly different, e.g., Oh-PPs form
a compact amorphous structure with predominantly Face-to-Face orientation of
neighboring PPs. Unusually for a morphology without a long range order, it is
still possible to identify well organized coherent clusters of this structure,
thanks to the adoption of our SymBOP-based characterization.

Keywords: octahedra, patchy particles, self-assembly, cubatic, bond order
parameter

##  I Introduction

The increasing prominence of the field of programmable self-assembly is rooted
in its potential to revolutionize nano- and micromanufacturing in diverse
disciplines such as photonics, plasmonics or medicine. The key idea is to use
specially built “designer particles” capable of assembly into desired
structures, such as superlattices or mesoscopic shapes Glotzer and Solomon
(2007); Cheng and Stevens (2014). Examples of such designer building blocks
are DNA-functionalized micro- and nanoscale isotropic particles Nykypanchuk
_et al._ (2008); Park  _et al._ (2008); Macfarlane  _et al._ (2011); Wang  _et
al._ (2015); Tkachenko (2002); Martinez-Veracoechea  _et al._ (2011); Rogers,
Shih, and Manoharan (2016); Dijkstra (2014), as well as “patchy” colloids
featuring a pattern of chemically distinct spots Manoharan, Elsesser, and Pine
(2003); Wang  _et al._ (2012); Pawar and Kretzschmar (2010); Yi, Pine, and
Sacanna (2013); He  _et al._ (2020). The former approach allows the control of
interactions between individual particles by using DNA hybridization. Whereas
the latter approach involves anisotropic interparticle interactions, allowing
for control over the symmetry of the desired self-assembled nano- and
microstructure. More recently, an amalgamation of the two approaches has been
adopted to give rise to building blocks based on DNA origami, which combine
key-lock interactions with anisotropy Liu  _et al._ (2016a); Tian  _et al._
(2020); Halverson and Tkachenko (2013). Furthermore, it has been demonstrated
that by combining these origami-based designer building blocks, with more
conventional isotropic DNA-functionalized nanoparticles, one can achieve
remarkable control over the symmetry and overall architecture of the assembly
of the system components Tian  _et al._ (2015, 2016). In particular, such an
approach has been utilized to self-assemble a nanoscale diamond lattice Liu
_et al._ (2016b), long considered the “Holy Grail” of the field of self-
assembly He  _et al._ (2020). In this study, self-assembled nanostructures in
hybrid systems encompassing both patchy and isotropic particles are explored
using molecular simulations. The study is relevant both for microscale
colloids, and nanoscopic building blocks, where the patchy particles represent
multivalent building blocks based on DNA origami.

Numerous computational studies have been undertaken to better understand the
mechanistic aspects of assembly of patchy particles and their emergent self-
assembled structures. Their phase behavior and kinetics have been studied
extensively using Monte Carlo and Molecular Dynamics (MD) methods Romano,
Sanz, and Sciortino (2010); Bianchi  _et al._ (2006); Zhang and Glotzer
(2004); Bianchi  _et al._ (2012, 2008); Vasilyev, Klumov, and Tkachenko (2013,
2015); Patra and Tkachenko (2018); Ramasubramani  _et al._ (2020). Majority of
those studies have discussed structures obtained by direct binding between
anisotropic particles. In this work, inspired by recent experiments Tian  _et
al._ (2015); Liu  _et al._ (2016b); Tian  _et al._ (2016), we consider a
hybrid case when patchy particles (PPs) do not directly bind with each other,
but instead are capable of binding to isotropic particles (IPs). In addition,
motivated by the experimental reality, we implement an annealing scheme in
which the binding strength is temporally modulated during the self-assembly
process. Finally, the results are analyzed by using a new characterization
method which generalizes the widely used concept of orientational bond order
parameters, by taking advantage of the symmetry of constituent building
blocks, i.e., PPs. Specifically, we use Symmetrized Bond Order Parameters
(SymBOPs) introduced in Ref. Logan  _et al._ , 2021 to extract the structural
information about the system.

##  II Methods

###  II.1  Model

The self-assembly in a hybrid system of IPs and PPs is investigated by means
of Brownian Dynamics (BD) simulations. In our coarse grained simulations, both
types of particles are modeled as hard spheres of diameters $\sigma_{IP}$ and
$\sigma_{PP}\equiv\sigma$, respectively. Their centers are represented as
vectors ${\bf R}^{(\alpha)}_{i}$, where $\alpha\in\\{IP,PP\\}$. The “patches”
are interaction sites that reside at specific locations on the surface of PPs
to enable anisotropic interactions. Their locations are represented as vectors
${\bf r}^{(n)}_{i}$, where $i$ is an index of the respective PP, and
$n=1...N_{p}$ is the patch index. Each PP, together with its patches are
modeled as a rigid body. In this study, two designs of PPs are considered,
featuring octahedral ($N_{p}=6$) and square ($N_{p}=4$) arrangements of
patches, shown in Fig. 1. We will refer to them as to Oh-PPs, and Sq-PPs,
respectively.

The hard-core repulsion between any pair of particles is implemented in the
form of Weeks-Chandler-Anderson (WCA) repulsive with a hard core parameter
$\sigma_{\alpha\beta}=\sigma_{\alpha}+\sigma_{\beta}$ (here
$\alpha,\beta\in\\{IP,PP\\}$:

$V_{\alpha\beta}(r)=\begin{cases}4\epsilon\left[(\frac{\sigma_{\alpha\beta}}{r})^{12}-(\frac{\sigma_{\alpha\beta}}{r})^{6}\right]+\epsilon,r<2^{1/6}\sigma_{\alpha\beta}\\\
0,r\geq 2^{1/6}\sigma_{\alpha\beta}\end{cases}$ (1)

In our study, PPs do not bind to each other directly. A soft attractive
potential between patches and IPs is given by

$V_{p}(r)=\begin{cases}-\epsilon[1+\cos(\pi\frac{r}{R_{c}})],r<R_{c}\\\
0,r\geq R_{c}\end{cases}$ (2)

Here $R_{c}=0.5\sigma$, $r$ is the patch-to-IP distance. In the model,
$\sigma$ and $\epsilon$ are the fundamental length and energy scales,
respectively. The total interaction potential thus has the form

$U_{\rm tot}=\sum_{i,j,\alpha,\beta}V_{\alpha\beta}\left(\left|{\bf
R}^{(\alpha)}_{i}-{\bf
R}^{(\beta)}_{j}\right|\right)+\sum_{i,j,n}{V_{p}\left(\left|{\bf
R}^{(IP)}_{i}+{\bf r}^{(n)}_{j}\right|\right)}\\\ $ (3)

Here $\alpha,\beta\in\\{IP,PP\\}$, $n=1..N_{p}$, and indices $i$ and $j$ run
over all particles of a given type, without double-counting. Figure 2 shows
examples of binding between two PPs facilitated by the bridging IPs.

Figure 1: Schematic diagrams of the (A) Oh-PPs and (B) Sq-PPs. Blue regions
represent the interactive patches, located at the vertices of the particles.
The central pink sphere is the central repulsive core. For clarity, the
central repulsive core has been made translucent to show the positions of the
vertices on the patches. Figure 2: Bonding between PPs is facilitated by
spherically symmetric IPs. (A) Two Oh-PPs bind vertex-to-vertex via one IP.
(B) Two Sq-PPs bind edge-to-edge via two IPs.

BD simulations are performed via the open source community-based MD package
Large-scale Atomic/Molecular Massively Parallel Simulator (LAMMPS). The
simulations are performed using simulations boxes with three dimensional
periodic boundary conditions and sample the canonical ensemble (NVT). For the
initial set up, a preliminary simulation cell of dimension $1.5~{}\sigma$
encompassing a single PP and a single IP is created (i.e., the system has 1:1
composition). The cell is replicated in the X, Y and Z dimensions 8-10 times
to generate simulation boxes with dimensions 12-15 $\sigma$ with a total of
512-1000 PPs (as well as the corresponding IPs). The resultant simulation
boxes are thermally spiked with soft repulsive potentials active for 10,000
time steps to induce randomness in the spatial configuration of the particles.
This step is followed by self assembly, facilitated by the annealing.

###  II.2  Annealing

Systems that are expected to yield highly ordered structures rarely do so via
direct or spontaneous assembly. This is largely due to kinetic limitations and
tendency towards glassy behavior. To address this, real-world self-assembly is
often subjected to annealing procedures. This allows the systems to escape
disordered metastable configurations and find new, more favorable
morphologies. In our study, we likewise implement the annealing protocol.
Specifically, the system is first allowed to run for 250,000 time steps to
promote its collapse into a random aggregate. The aggregate is then heated to
a temperature of $k_{B}T=0.2\epsilon$ and slowly cooled to
$k_{B}T=0.01\epsilon$ over 250,000 time steps. Note that this large dynamic
range in ”temperature” is experimentally implemented by variation of
interparticle binding free energy (e.g. due to high temperature sensitivity of
DNA hybridization). The annealing cycle is repeated 10 times, with the maximum
temperature progressively lowered by $k_{B}\Delta T=0.01\epsilon$ with each
cycle. This is represented in Fig. 3. This results in a periodic temperature
spiking which allows the system to overcome poor configurations by knocking
the system out of any local minima in the energy landscape.

Figure 3:  The time evolution of the temperature is shown along with insets of
the local structure after each phase. Inset 1 (left) shows disordered
aggregation. Inset 2 (middle) shows partially ordered assembly. Inset 3
(right) shows a well-ordered assembly. The annealing process allows the system
to first form a randomly aggregated mass, after which it is thermally spiked
and slowly allowed to cool in order to thermodynamically relax unfavourable
bonds. The final structure is a well-relaxed, ordered structure.

###  II.3  Characterization

The organization of particles upon their self-assembly may be characterized by
a number of local order parameters. In particular, bond orientation order
parameters (BOPs) are commonly used to identify local ordering Halperin and
Nelson (1978); Nelson and Halperin (1979); Nelson and Toner (1981);
Steinhardt, Nelson, and Ronchetti (1983). That approach however has its
limitations as it relies on rotationally-invariant (scalar) descriptors of the
structure which are not symmetry-specific. Since our system contains
anisotropic PPs, a more sensitive characterization method may be utilized. In
particular, the relative alignment of both Oh-PPs and Sq-PPs may be captured
by a cubatic order parameter Batten, Stillinger, and Torquato (2010); Duncan
_et al._ (2009), the 4th-order tensor that generalizes the conventional
nematic order parameter for the cubic symmetry case. More generally, this type
of ordering can be characterized by Polyhedral Nematic Order Parameters
(PNOPs), which are traceless, symmetric tensors of $l^{\mathrm{th}}$-order,
$\mathbf{\hat{S}}^{(l)}$ Batten, Stillinger, and Torquato (2010); Duncan  _et
al._ (2009); Haji-Akbari and Glotzer (2015); Nissinen  _et al._ (2016, 2016);
Liu, Greitemann, and Pollet (2018). In the 3D case, these tensor order
parameters may be equivalently represented as vectors composed of $2l+1$
spherical harmonics of order $l$: $|s)_{l}\equiv\\{s^{(l,m)}_{m=-l,...,l}\\}$.
We will employ this representation with the normalization such that
$(s_{i}|s_{j})_{l}=1$ corresponds to a perfect alignment of Oh-PPs ‘$i$’ and
‘$j$’.

Figure 4: Local order parameter scatter measurements for size ratio 2.08. Each
point represents a single bond in the sample. Two clusters of points are seen
that correspond to face-to-face and edge-to-edge bonding on the left and
right, respectively. Examples of the types of bonds are shown as insets above
their respective clusters.

Furthermore, the anisotropy of the building blocks enables us to use
symmetrized bond order parameters, SymBOPs, that are introduced and discussed
in greater detail in Ref. Logan  _et al._ , 2021. Specifically, the SymBOP may
be defined for any bond, i.e., pair of neighboring particles $i$ and $j$, by
projecting the spherical harmonic associated with the bond direction,
$\left|b_{ij}\right)_{l}$ onto the PNOP of one of the particles involved:
$(s_{i}|b_{ij})_{l}$. In other words, rather than using generic rotationally
invariant BOPs as descriptors of the local crystallinity, we detect local
order with respect to the natural coordinate system of a particle. In this
study, motivated by the geometry of the PPs, we use PNOPs $|s)_{l}$ with cubic
symmetry, for $l=4$ and $6$. After individual bonds consistent with the
specific order are identified, a bond percolation procedure is employed to
find coherent domains with that morphology.

Figure 5: A broad look at how the phase depends on size ratio in IP/Oh-PP
systems. The local PNOP/SymBOP scatter plots ($l=4,6$) for Oh-PPs (left
columns), and visualizations of the domains observed for the corresponding
ratio (right columns). Each color represents a distinct domain. A single
cluster of points located in the FtF region is found for small ratios. As the
ratio increases, the points move toward the EtE region. For ratios around 2.00
coexistence is observed between the FtF amorphous and NaCl phases. Figure 6:
Ideal domains of the structures identified for the IP/Oh-PP system. (A) The
FtF phase is amorphous and does not form an extended lattice with long-range
order. (B) The EtE phase has long-range order and is found to form a NaCl-type
lattice. Figure 7: Domain distribution for IP/Oh-PP systems. The lines show
the percentage of a sample that was found to be in a domain. The triangles
show the sizes of domains found for each size ratio of PP to IP. The dashed
vertical lines mark the coexistence region between the two phases. Figure 8: A
broad look at how the phase depends on size ratio in IP/Sq-PP systems. The
local PNOP/SymBOP scatter plots ($l=4,6$) for Sq-PPs (left columns), and
visualizations of the domains observed for the corresponding ratio (right
columns). Each color represents a distinct domain. A single cluster of points
located in the FtF region is found for small ratios. As the ratio increases,
the points move toward the EtE region. For ratios around 1.60 coexistence is
observed between the honeycomb and 2D square phases. Figure 9: Ideal domains
of the order found for each phase of the Sq-PPs: (A) The 3D honeycomb
stacking; (B) The EtE phase has long-range order and is found to form a 2D
square lattice. Figure 10: Domain distribution for Sq-PP systems. The colored
solid lines show the percentage of a sample that was found to be in a domain.
The triangles show the sizes of domains found for each size ratio of PP to IP.
The dashed vertical lines mark the coexistence region between the two phases.

##  III  Results

The self-assembly of 1:1 IP/PP mixtures are simulated, for particle size
ratios, $\sigma_{PP}/\sigma_{IP}$, ranging from 1.00 to 3.13. Figure 4 shows a
”portrait” of a typical self-assembled structure as a scatter plots in the
PNOP/SymBOP space. The two coordinates represent the relative alignment of the
two neighboring particles, $(s_{i}|s_{j})_{l}$, and the SymBOP associated with
their bond, $(s_{i}|b_{ij})_{l}$, respectively (for $l=4,6$). Each bond is
represented by two points, since $|b_{ij})_{l}$ can be projected onto the
reference vector of any of the two particles involved, $|s_{i})_{l}$ and
$|s_{j})_{l}$. Two distinct clusters of bonds are observed. A color-coded
curve follows the transition in the bonds from edge-to-edge (EtE) on the right
(red) to face-to-face (FtF) on the left (blue). The curve is constructed by
beginning with two Oh-PPs sharing two IPs in an EtE configuration, with all
four particles lying in a common plane, as shown in the inset on the right of
Fig. 4A. The rotation of one Oh-PP about the IPs to the FtF configuration
(left inset) traces the curve from red to blue. The color bar corresponds to
the angle formed from the center of one Oh-PP, to the point between the IPs,
to the center of the second Oh-PP. For Oh-PPs, FtF corresponds to a special
type of amorphous structure, while EtE binding signals emergence of ordered
domains, i.e. NaCl lattice. For squares, the analog of FtF represents
fragments of 3D honeycomb stacking, while EtE binding gives rise to domains
that arrange in a two-dimensional square lattice. Below we present results for
Oh-PP and Sq-PP systems, respectively.

###  III.1  Self-assembly of IP/Oh-PP hybrid system

Fig. 5 represents selected results for IP/Oh-PPs system. Each row represents a
single size ratio. It shows PNOP/SymBOP portraits of the self-assembled
structure, discussed above, alongside the real-space images, both without and
with individual domains identified. For size ratio below 1.00, the self
assembly does not yield any ordered domains. This result is expected as the
interaction vanishes exactly at the distance the IPs would bond to a patch
(see Eq. 2). The attraction between the IPs and the patches is stronger for
ratios greater than 1.00. However, for small ratios the attraction is weak and
the IPs only feel the shallow tail of the potential. Despite this, the
incipience of bond clustering in PNOP/SymBOP plot is observed around a ratio
of 1.14. As mentioned above, the type of bonding for small ratios of Oh-PPs is
FtF. An ideal domain of this type is seen in Fig. 6A. Although the domains
made solely from this type of bond can be large (nearly 70 PPs for a ratio of
1.47), they are amorphous, i.e. not space filling and and don’t have any long-
range order.

For a given ratio, the solid red curve in Fig. 7 shows the percentage of the
final state that was found to be in some domain, and the red semi-transparent
arrows use the same vertical axis to list all of the domain sizes observed.
For ratio 1.14, only about 10% of the whole sample is found to be in an
ordered domain, and on average the domains have a size of about 5 PPs each.

Increasing the ratio nominally to around 1.25 results in a jump in both the
number of ordered domains and the distribution of domain sizes. The size
ratios ranging from 1.25 to 1.56 show nearly 80% of the final state to be in
some domain. Above 1.56 the prevalence of the amorphous domains begin to
subside, and a second type of structure is observed. The new structure has an
EtE bonding and a high degree of orientational ordering between constituent
particles. The EtE bonded domains possess long-range order and form a NaCl
lattice, as shown in Fig. 6B.

Between the size ratios of 1.67 and 2.27, coexistence of the two types of
domains is observed. As seen in Fig. 7, the decrease in particles in amorphous
domains is completely compensated by the increase in particles in the NaCl
domains. Above a ratio of 2.08 the amorphous phase vanishes and the NaCl phase
dominates. The simulations were performed up to a ratio of 3.13, with the NaCl
domains continuing to persist.

The transition from amorphous (FtF) to NaCl (EtE) is clearly seen in Fig. 5.
The two local order parameter scatter plots ($l=4,6$) on the left demonstrate
that points cluster only around the FtF region for smaller ratios ($\sim$ 1.14
to 1.67), as was shown in Fig. 4. As the ratio increases, the points move away
from the FtF region of the scatter plot toward EtE. Coexistence between the
two phases at a ratio of 2.08 is evident from Fig. 5. The locations of the
clusters agree with the domains shown to the right of the plots. The last row
corresponding to ratio 2.27 shows only the long-range ordered NaCl phase to
remain.

###  III.2 Self-assembly of IP/Sq-PP hybrid system

The analysis of the systems with Sq-PPs is analogous to that corresponding to
the systems with the Oh-PPs. This approach introduces consistency in the
characterization and simplifies the explanation of the types of bonding
observed through the local order parameter calculations.

Sq-PPs show a similar trend as that for the Oh-PPs, namely that the smallest
size ratios do not demonstrate order. The first domains begin to appear for a
size ratio of 1.25. A comparison of the lowest ratio order parameter
calculations (in Fig. 8) for Sq-PPs to Oh-PPs (in Fig. 5) demonstrates the
advantage of using the same octahedrally-symmetric order parameters for Sq-PP.
Both plots show distinct clustering of points near what is determined to be
FtF bonding for Oh-PPs. While it cannot be true FtF bonding for Sq-PPs, the
color bar for the plot shows that tangents to the surfaces of each square come
together at an angle of $110^{\circ}$ to $120^{\circ}$. Most of the identified
domains have a zig-zag shape, consistent with being fragments of a 3D
honeycomb stacking lattice. Figure 9A shows an ideal version of such a lattice
made of IP/Sq-PPs.

The honeycomb phase peaks for size ratios in the range of 1.39 to 1.52 with
about 40% of the PPs found in some domain and a maximum domain size greater
than 30 PPs (see Fig. 10). The larger domains tend to deviate from the
honeycomb lattice and become more amorphous. Beyond 1.52, the honeycomb phase
begins to diminish and a higher polyhedral nematic order is favored indicating
EtE bonding. This type of bonding presents itself as a two dimensional square
lattice for Sq-PPs, as seen in Fig. 9B. This marks the beginning of a two-
phase coexistence between the honeycomb domains and the emerging square
lattice domains. The coexistence is short-lived as the honeycomb phase almost
completely vanishes by a ratio of 1.79. However, a few small domains are
observed to remain with a size ratio up to 1.92. Above this ratio only the
square lattice phase is observed. This phase peaks at a ratio 2.27, and starts
decreasing at a ratio of 3.13. Note that ideal honeycomb structure would have
2:3 IP/PP composition. However, our simulations of asymmetric mixtures
resulted in a much lower yields of either of the structures observed (see
Appendix A).

##  IV  Discussion

Both Oh-PPs and Sq-PPs favor FtF bonding for small size ratios and undergo a
structural transition to EtE bonding for large ratios. A simple geometrical
model elucidates the origin of this transition.

Figure 11: Oh-PP in the (A) NaCl (EtE) configuration and (B) amorphous (FtF)
configuration.

Consider an Oh-PP that has captured two IPs and is found to be in an EtE
configuration, as shown in Fig. 11A. For small size ratios, it is
energetically favorable for the Oh-PPs to capture a third IP, completing the
transition to FtF bonding as shown in Fig. 11B. Even if EtE binding
corresponds to thermodynamically more stable structure (wich is likely the
case for NaCl lattice), FtF binding will win kinetically. As the ratio
increases, however, the size of the IP decreases and the PPs must move closer
together to keep the IPs bound. At a critical ratio, the PPs make contact and
can no longer move closer to preserve the direct contact between the IPs and
the patches. The critical ratio marks the point where larger ratios incur an
energetic cost to form FtF bonds and lead to the possibility of other
structures. Figure 12A shows the energy per bond for FtF and EtE bonding for
different ratios. The zero in energy corresponds to the direct contact bonding
between an IP and a patch for all ratios. The plot shows that FtF bonding is
initially energetically favorable but begins to encounter an energy barrier
for a size ratio around 1.37. The dashed black lines mark the coexistence
region of the two structures from BD simulations. The FtF bonding disappears
for a size ratio of 2.08, marked by the second dashed line. For higher size
ratios, only structures involving EtE bonding are formed. Our interpretation
is that the growing energy barrier associated with formation of FtF amorphous
structure promotes EtE binding and the ultimate formation of the ordered
domains.

Figure 12: Energy per bond as a function of size ratio for (A) NaCl (EtE)
bonding (blue) and amorphous (FtF) bonding (red) and (B) 2D square lattice
(EtE) bonding (blue) and honeycomb lattice (red). The dashed black lines mark
the two-phase coexistence regions for each type of PP. Above the dashed lines
FtF bonding is no longer observed. Figure 13: Sq-PP in the (A) 2D Square
lattice (EtE) configuration and (B) honeycomb configuration.

For Sq-PPs a similar trend is observed; small ratios tend to form a FtF
honeycomb structure, while large ratios lead to EtE square lattice domains. In
a FtF domain, six PPs share a single IP. Considering the hard sphere model
shown in Fig. 13. As the ratio increases, the PPs must move closer to stay
bonded with the IP. This leads to two critical ratios. The first ratio is
encountered when the PPs within a single layer make contact at a size ratio of
around 1.58. Above this ratio the IP begins to move away from the patches of
the PPs, initiating the initial divergence from the minimal energy observed in
Fig. 12B. At this point, the IP cannot be kept directly on the patches of each
PP, but the PP layers still move closer together as the size ratio continues
to increase. The energy cost effected above this critical ratio leads to the
emergence of the EtE structure, which appears at a ratio of 1.61 and remains
through 3.13. The dashed black lines mark the coexistence region of EtE and
FtF bonds. Above the ratio of 1.92, the energy cost is too great and the only
stable structure formed is via EtE bonds.

##  V Conclusion

We studied self-assembly in hybrid IP/PP systems, with two arrangements of
patches: octahedral and square. The assembly was additionally facilitated by
the annealing procedure. The anisotropic nature of the particles enabled the
use of PNOPs, together with a new characterization techniqueLogan  _et al._
(2021), based on SymBOPs. The latter generalizes the classical concept of bond
orientation order parameter, and allows to look for distinct morphological
domains, both ordered and amorphous, within the assembled structures. Using
the PNOP/SymBOP analysis, the phase behavior for both types of PPs have been
studied, as a function of the PP/IP size ratio. Importantly, our focus was not
on determining the equilibrium phase diagram, but to identify structures that
can self-assemble when kinetic limitations are taken into account. Both types
of PPs were observed to exhibit two phases over size ratios from 1.00 to 3.13.

The higher symmetry phases, NaCl and square lattice, respectively, are
observed above size ratio $2$. Below the size ratio $1.5$, the dominant
morphology of Oh-PP/IP system is a highly compact structure with “Face-to-
Face” arrangement of the anisotropic particles. While lacking long range
order, this amorphous phase is substantially different from a generic random
aggregate. In particular, it has a pronounced PNOP/SymBOP signature that
allowed us to clearly identify its individual domains, a rather unusual
feature for a disordered structure. In the case of Sq-PPs, the lower size
ratio corresponds to another peculiar partially ordered structure. It features
ziz-zag-like patterns, that are likely to be fragments or precursors of a 3D
honeycomb stacking. Once again, the domains are easily identifiable with the
help of the PNOP/SymBOP characterization technique. This demonstrates, on the
one hand, the potential of the hybrid PP/IP platform for self-assembly of non-
trivial morphologies, and, on the other hand, the power of the PNOP/SymBOP-
based characterization. All code and run input files for simulations are
available on GitHub https://github.com/duttm/Octahedra_Nanoparticle_Project.

###### Acknowledgements.

This research was partially done at, and used resources of the Center for
Functional Nanomaterials, which is a U.S. DOE Office of Science Facility, at
Brookhaven National Laboratory under Contract No. DE-SC0012704. M.D.
ackowledges financial support from NSF CAREER award DMR-1654325. S.C.M.
acknowledges financial support from NSF award OAC-1547580 and the Chemical and
Biochemical Engineering Department at Rutgers.

##  Appendix A Sq-PPs for different compositions

Since ideal honeycomb stacking has 3:2 PP/IP composition, investigated how the
composition of the mixture affects the self-assembly in IP/Sq-PPs system. The
simulations discussed in the main text had a composition of one PP to one IP.
In addition to this, we looked at compositions 3:2 and 3:1 for select PP to IP
size ratios. The results for different compositions can be seen in Fig. A1.

Figure A1: Plots displaying the change in observed domains with a change in
composition. The colored solid lines show the percentage of PPs that are found
in a domain for the honeycomb (red) and the 2D square lattice (blue). The
composition begins at (A) 1 PP : 1 IP; the same composition used for the
simulations in the main text. As the IPs become less abundant such as in (B) 3
PP : 2 IP and (C) 3 PP : 1 IP, the amount of order decreases.

## References

  * Glotzer and Solomon (2007) S. C. Glotzer and M. J. Solomon, “Anisotropy of building blocks and their assembly into complex structures,” Nature Mat. 6, 557–562 (2007).
  * Cheng and Stevens (2014) S. Cheng and M. J. Stevens, “Self-assembly of chiral tubules,” Soft Matter 10, 510–518 (2014).
  * Nykypanchuk  _et al._ (2008) D. Nykypanchuk, M. M. Maye, D. van der Lelie, and O. Gang, “Dna-guided crystallization of colloidal nanoparticles,” Nature 451, 549–52 (2008).
  * Park  _et al._ (2008) S. Y. Park, A. K. R. Lytton-Jean, B. Lee, S. Weigand, G. C. Schatz, and C. A. Mirkin, “Dna-programmable nanoparticle crystallization,” Nature 451, 553–6 (2008).
  * Macfarlane  _et al._ (2011) R. J. Macfarlane, B. Lee, M. R. Jones, N. Harris, G. C. Schatz, and C. A. Mirkin, “Nanoparticle superlattice engineering with dna,” Science 334, 204–208 (2011).
  * Wang  _et al._ (2015) Y. Wang, Y. Wang, X. Zheng, E. Ducrot, J. S. Yodh, M. Weck, and D. J. Pine, “Crystallization of dna-coated colloids,” Nat. Commun. 6, 7253 (2015).
  * Tkachenko (2002) A. V. Tkachenko, “Morphological diversity of dna-colloidal self-assembly,” Phys. Rev. Lett. 89, 148303 (2002).
  * Martinez-Veracoechea  _et al._ (2011) F. J. Martinez-Veracoechea, B. M. Mladek, A. V. Tkachenko, and D. Frenkel, “Design rule for colloidal crystals of dna-functionalized particles,” Phys. Rev. Lett. 107, 045902 (2011).
  * Rogers, Shih, and Manoharan (2016) W. B. Rogers, W. M. Shih, and V. N. Manoharan, “Using dna to program the self-assembly of colloidal nanoparticles and microparticles,” Nature Reviews Materials 1, 16008 (2016).
  * Dijkstra (2014) M. Dijkstra, “Entropy-driven phase transitions in colloids: From spheres to anisotropic particles,” (John Wiley & Sons, Inc., 2014) pp. 35–71.
  * Manoharan, Elsesser, and Pine (2003) V. Manoharan, M. Elsesser, and D. Pine, “Dense packing and symmetry in small clusters of microspheres,” Science 301, 483–487 (2003).
  * Wang  _et al._ (2012) Y. Wang, Y. Wang, D. Breed, V. Manoharan, L. Feng, A. Hollingsworth, M. Weck, and D. Pine, “Colloids with valence and specific directional bonding,” Nature 491, 51–U61 (2012).
  * Pawar and Kretzschmar (2010) A. B. Pawar and I. Kretzschmar, “Fabrication, assembly, and application of patchy particles,” Macromol. Rapid Commun. 31, 150–168 (2010).
  * Yi, Pine, and Sacanna (2013) G.-R. Yi, D. J. Pine, and S. Sacanna, “Recent progress on patchy colloids and their self-assembly,” J. Phys.: Condens. Matter 25, 193101 (2013).
  * He  _et al._ (2020) M. He, J. P. Gales, É. Ducrot, Z. Gong, G.-R. Yi, S. Sacanna, and D. J. Pine, “Colloidal diamond,” Nature 585, 524–529 (2020).
  * Liu  _et al._ (2016a) W. Liu, J. Halverson, Y. Tian, A. Tkachenko, and O. Gang, “Self-organized architectures from assorted dna-framed nanoparticles,” Nature Chemistry 8, 867–873 (2016a).
  * Tian  _et al._ (2020) Y. Tian, J. R. Lhermitte, L. Bai, T. Vo, H. L. Xin, H. Li, R. Li, M. Fukuto, K. G. Yager, J. S. Kahn, Y. Xiong, B. Minevich, S. K. Kumar, and O. Gang, “Ordered three-dimensional nanomaterials using DNA-prescribed and valence-controlled material voxels,” Nature Mater. 19, 789–796 (2020).
  * Halverson and Tkachenko (2013) J. D. Halverson and A. V. Tkachenko, “Dna-programmed mesoscopic architecture,” Phys. Rev. E 87, 062310 (2013).
  * Tian  _et al._ (2015) Y. Tian, T. Wang, W. Liu, H. L. Xin, H. Li, Y. Ke, W. M. Shih, and O. Gang, “Prescribed nanoparticle cluster architectures and low-dimensional arrays built using octahedral dna origami frames,” Nature Nanotech 10, 637–644 (2015).
  * Tian  _et al._ (2016) Y. Tian, Y. Zhang, T. Wang, H. L. Xin, H. Li, and O. Gang, “Lattice engineering through nanoparticle-dna frameworks,” Nature Mater. 15, 654–661 (2016).
  * Liu  _et al._ (2016b) W. Liu, M. Tagawa, H. L. Xin, T. Wang, H. Emamy, H. Li, K. G. Yager, F. W. Starr, A. V. Tkachenko, and O. Gang, “Diamond family of nanoparticle superlattices,” Science 351, 582–586 (2016b).
  * Romano, Sanz, and Sciortino (2010) F. Romano, E. Sanz, and F. Sciortino, “Phase diagram of a tetrahedral patchy particle model for different interaction ranges,” J. Chem. Phys. 132, 184501 (2010).
  * Bianchi  _et al._ (2006) E. Bianchi, J. Largo, P. Tartaglia, E. Zaccarelli, and F. Sciortino, “Phase diagram of patchy colloids: Towards empty liquids,” Phys. Rev. Lett. 97, 168301 (2006).
  * Zhang and Glotzer (2004) Z. L. Zhang and S. C. Glotzer, “Self-assembly of patchy particles,” Nano Lett. 4, 1407–1413 (2004).
  * Bianchi  _et al._ (2012) E. Bianchi, G. Doppelbauer, L. Filion, M. Dijkstra, and G. Kahl, “Predicting patchy particle crystals: Variable box shape simulations and evolutionary algorithms,” Journal of Chemical Physics 136, 214102 (2012).
  * Bianchi  _et al._ (2008) E. Bianchi, P. Tarlaglia, E. Zaccarelli, and F. Sciortino, “Theoretical and numerical study of the phase diagram of patchy colloids: Ordered and disordered patch arrangements,” Journal of Chemical Physics 128, 144504 (2008).
  * Vasilyev, Klumov, and Tkachenko (2013) O. A. Vasilyev, B. A. Klumov, and A. V. Tkachenko, “Precursors of order in aggregates of patchy particles,” Phys. Rev. E 88, 012302 (2013).
  * Vasilyev, Klumov, and Tkachenko (2015) O. Vasilyev, B. Klumov, and A. Tkachenko, “Chromatic patchy particles: Effects of specific interactions on liquid structure,” Phys. Rev. E 92, 012308 (2015).
  * Patra and Tkachenko (2018) N. Patra and A. V. Tkachenko, “Programmable self-assembly of diamond polymorphs from chromatic patchy particles,” Phys. Rev. E 98, 032611 (2018).
  * Ramasubramani  _et al._ (2020) V. Ramasubramani, T. Vo, J. A. Anderson, and S. C. Glotzer, “A mean-field approach to simulating anisotropic particles,” The Journal of Chemical Physics 153, 084106 (2020).
  * Logan  _et al._ (2021) J. A. Logan, S. Mushnoori, M. Dutt, and A. V. Tkachenko, “Symmetry-specific orientational order parameters for complex structures,” (2021), arXiv:2110.13862 [cond-mat.soft] .
  * Halperin and Nelson (1978) B. I. Halperin and D. R. Nelson, “Theory of two-dimensional melting,” Phys. Rev. Lett. 41, 121–124 (1978).
  * Nelson and Halperin (1979) D. R. Nelson and B. I. Halperin, “Dislocation-mediated melting in two dimensions,” Phys. Rev. B 19, 2457–2484 (1979).
  * Nelson and Toner (1981) D. R. Nelson and J. Toner, “Bond-orientational order, dislocation loops, and melting of solids and smectic-$a$ liquid crystals,” Phys. Rev. B 24, 363–387 (1981).
  * Steinhardt, Nelson, and Ronchetti (1983) P. J. Steinhardt, D. R. Nelson, and M. Ronchetti, “Bond-orientational order in liquids and glasses,” Phys. Rev. B 28, 784–805 (1983).
  * Batten, Stillinger, and Torquato (2010) R. D. Batten, F. H. Stillinger, and S. Torquato, “Phase behavior of colloidal superballs: Shape interpolation from spheres to cubes,” Phys. Rev. E 81, 061105 (2010).
  * Duncan  _et al._ (2009) P. D. Duncan, M. Dennison, A. J. Masters, and M. R. Wilson, “Theory and computer simulation for the cubatic phase of cut spheres,” Phys. Rev. E 79, 031702 (2009).
  * Haji-Akbari and Glotzer (2015) A. Haji-Akbari and S. C. Glotzer, “Strong orientational coordinates and orientational order parameters for symmetric objects,” Journal of Physics A: Mathematical and Theoretical 48, 485201 (2015).
  * Nissinen  _et al._ (2016) J. Nissinen, K. Liu, R.-J. Slager, K. Wu, and J. Zaanen, “Classification of point-group-symmetric orientational ordering tensors,” Phys. Rev. E 94, 022701 (2016).
  * Liu, Greitemann, and Pollet (2018) K. Liu, J. Greitemann, and L. Pollet, “Generic first-order phase transitions between isotropic and orientational phases with polyhedral symmetries,” Phys. Rev. E 97, 012706 (2018).


# SklCoin: Toward a Scalable Proof-of-Stake and Collective Signature Based
Consensus Protocol for Strong Consistency in Blockchain

Zakwan Jaroucheh, Baraq Ghaleb, William J Buchanan

School of Computing, Edinburgh Napier University, Edinburgh, UK
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

The proof-of-work consensus protocol suffers from two main limitations: waste
of energy and offering only probabilistic guarantees about the status of the
blockchain. This paper introduces SklCoin, a new Byzantine consensus protocol
and its corresponding software architecture. This protocol leverages two
ideas: 1) the proof-of-stake concept to dynamically form stake-proportionate
consensus groups that represent block miners (stakeholders), and 2) scalable
collective signing to efficiently commit transactions irreversibly. SklCoin
has immediate finality characteristic where all miners instantly agree on the
validity of blocks. In addition, SklCoin supports high transaction rate
because of its fast miner election mechanism.

##  I Introduction

Blockchain technology has recently attracted the attention of the world owing
to its great potential in realizing a plethora of applications where trust is
a decisive element. In fact, Blockchain has eliminated the need for
centralized third-party verification. Instead, the centralized approach has
been replaced by a decentralized form of trust governed by multiple entities
(nodes) [1][2]. At the heart of Blockchain is the consensus algorithm where
those multiple entities need to reach consensus or agreement on the state of
the Blockchain (deciding which nodes are more qualified to add the next block
of transactions into the blockchain and verify the results). In general, the
consensus algorithms of Blockchain are classified into two main classes;
proof-based and voting-based consensus. In proof-based consensus, a node is
required to provide the network with some sort of proof that it is the most
qualified one to add the next block. In voting-based consensus, a leader node
to suggest the next block is first elected which is then voted on (i.e., the
suggested block) by some other nodes and finally committed into the blockchain
if it has received the vast majority of votes.

Proof-of-work (PoW) used by several cryptocurrencies including Bitcoin is an
example of proof-based consensus. The PoW requires a node (miner) to solve a
computationally expensive cryptographic puzzle (i.e. finding a block hash with
pre-specified leading zeros) before it can add the next block of transactions
into the blockchain. A transaction processed by means of PoW is argued to be
irreversible and secure as long as malicious miners control less than the half
of the hashing power and the age of added block is around one hour. Key issues
with the PoW includes: 1) the significant amount of power consumed by the
network to find the required proof, 2) the one-hour latency in confirming
transaction limits Bitcoin’s suitability for real-time transactions, and 3)
Bitcoin’s consensus algorithm provides only probabilistic consistency
guarantees. Other alternative for a consensus protocol is to provide strong
consistency where all miners instantly agree on the validity of blocks,
without wasting computational power resolving inconsistencies (forks) [3].

To address the PoW limitations, several proof-based consensus algorithms have
been introduced in the literature including proof-of-stake, proof-of-elapsed
time, proof-of-space among many others. The ultimate goal of such proposals
was to remove the PoW computationally expensive proofs while preserving its
same level of security and irreversibility. For instance, in the PoS, a miner
is selected randomly based on the amount of coins it has staked into the
system. Hence, the more the coins an account staked into the network, the
higher the possibility of being selected to produce a block and earn the
corresponding transactions fees. Theoretically, it is assumed that the
probability of selecting the next miner in PoS is proportional to the
account’s balance. However, it has been proved in [4] that this is not
entirely accurate when the probability is only based on the amount staked. In
addition, the pseudo-random nature of PoS may generate some new attack vectors
[4]. Another issue with proof-based consensus other than PoW is the ability of
a miner to mine effortlessly in secret as there is no associated cost with
mining process. To remedy the limitations of proof-based consensus,
researchers have investigated the potential of employing Byzantine fault
tolerant (BFT) consensus algorithms in blockchain. In BFT consensus, the
process of appending the next block to the blockchain is no more the
responsibility of single node or a miner. Instead, the to-be-appended block
should be first agreed on and approved by a rolling committee ( i.e., a group
of miners) that reaches such an agreement through rounds of communications.

Practical Byzantine Fault Tolerance (PBFT) [5], was the first practical
approach that allowed for Byzantine fault tolerant applications with low-
overhead [6]. This work introduces SklCoin, a cryptocurrency based on the
principles of PBFT algorithm. PBFT brings strong consistency (ensuring that
clients need to wait only for the next block rather than the next several
blocks, e.g. in bitcoin, to verify that a transaction has been committed). By
leveraging the strong consistency of PBFT, SklCoin addresses three main
challenges: (1) open membership, (2) scalability in terms of the number of
nodes, and (3) transaction commitment rate.

In this paper we make the following key contributions:

  * •

To address the openness issue, SklCoin introduces a new software architecture
where the consensus and signing groups are determined dynamically in every
time-slot as will be seen later.

  * •

SklCoin implements Byzantine consensus using collective signing scheme. We
adopt the idea of ByzCoin [3], to build SklCoin as PBFT atop CoSi. However,
this collective signing scheme could be replaced by another scheme.

  * •

Finally, SklCoin creates a new mechanism that allows all miners to agree on
the slot-leader in every time-slot. This allows all miners to instantly agree
on the validity of the proposed block and on the validity of the leader who
proposed the block, rendering the verification process scalable.

##  II Related Work

There have been numerous recent studies with the goal to alleviate the
shortcomings of both proof-based and Byzantine-based consensus algorithms. For
instance, [7] introduce the FastBFT consensus algorithm that integrates
several technologies including lightweight secret sharing, trusted execution
environments (TEEs), tree topology, optimistic execution, and failure
detection, hence, realizing a low latency infrastructure. The authors of [8]
argued, however, that weakly synchronous consensus algorithms are ill-suited
for environments where messages are not guaranteed to be delivered in a
certain amount of time. Hence, they introduce a leaderless consensus protocol
that uses a novel atomic broadcast protocol to guarantee liveness in
asynchronous environments. Crain et al [9] propose another leaderless
consensus protocol with the aim to overcome the problem of a faulty
coordinator (i.e. leader) in asynchronous environments. The rational here is
that a synchronous round can be declared completed by a process upon receiving
a pre-specified threshold of messages which nullifies the need to wait for
potentially slow messages from the leader.

Overcoming the scalability issue in proof-based consensus algorithms was the
focus of several research efforts. For instance, Bitcoin-NG [10] proposes a
new consensus algorithm that combines Byzantine fault tolerance with PoW
aiming to lower the latency of transaction processing in PoW-based blockchain.
The key idea is to decouple the process of miner election from transaction
verification by introducing two different blocks types; Keyblocks and
Microblocks. Keyblocks serve the purpose of leader selection by means of PoW.
The leader then will take the responsibility of creating Microblocks of
transactions that need only to be signed by the leader without the need for
the power-hungry PoW. However, Bitcoin-NG is still susceptible to several
issues including forking, even deliberately and history rewriting. ByzCoin [3]
proposes to overcoming aforementioned problems by introducing the idea of
collective signing to achieve consensus in blockchain. A block is considered
valid if collectively signed by a group of recently-successful block miners.
However, ByzCoin inherits the power-inefficient PoW algorithm. In addition, it
only gives the chance for recently successful miners to be leaders; that
prevents new joining nodes from being elected.

In Schnorr signing, we can aggregate public keys of $P$ participants into a
single signing key [11], and uses the non-interactive version of the Fiat-
Shamir heuristic [12]. Using Elliptic Curve methods, to sign a message we take
a random value ($k$) and a private key value ($d$) and a generator point $G$
($G$ is a base point on an elliptic curve) and compute:

$Q=dG$ (1)

and:

$R=kG$ (2)

For it to be non-interactive we then calculate:

$e=H(R\parallel M)$ (3)

and then:

$s=k-ed$ (4)

The signature is then $(s,e)$. To verify we compute:

$r_{v}=sG+eQ$ (5)

and then:

$e_{v}=H(r_{v}\parallel M)$ (6)

We then check that $r_{v}=e_{v}$.

Each participant has a private key ($a_{i}$) and a public key $A_{i}=a_{i}G$.
We can then determine the aggregate public key with:

$A=\sum_{i\in P}A_{i}$ (7)

##  III Background

###  III-A Byzantine Fault Tolerance

BFT consensus algorithms focus on building fault tolerance in the face of
unreliable systems provisioning mainly for fail-stop faults. In the face of
such failures, these algorithms guarantee progress and consistency in the data
structures that were replicated across the nodes. The number of nodes needed
in such networks are $2f+1$ to be able to tolerate $f$ fail-stop failures.
Tolerating Byzantine faults, increases the complexity of the consensus
protocol by adding several extra layers of messaging into the system [13].
Practical Byzantine Fault Tolerance (PBFT) [5], was the first practical
approach that allowed for Byzantine fault tolerant applications with low-
overhead.

PBFT uses the concept of primary and secondary replicas, where the secondary
replicas automatically check the sanity and liveness of decisions taken by the
primary and can collectively switch to a new primary if the primary is found
to be compromised [14]. PBFT brings strong consistency (ensuring that clients
need to wait only for the next block rather than the next several blocks, e.g.
in bitcoin, to verify that a transaction has committed).

PBFT relies upon a primary node (leader) to begin each round and proceeds if a
two-thirds quorum exists. Three distinct phases happen in every round of PBFT:

  1. 1.

Pre-prepare phase: The current primary node (leader) announces their proposal
that the nodes should agree upon. Once received, every node validates the
proposal and multicasts a prepare message to the group of nodes.

  2. 2.

The nodes wait until they receive $(2f+1)$ prepare messages and then publish a
commit message.

  3. 3.

The nodes wait until they receive $(2f+1)$ commit messages to make sure that
enough nodes have agreed on the proposal and committed themselves to it.

Since the leader is a potential attack vector, PBFT implements a view-change
protocol that ensures liveness in the face of a faulty leader. The nodes
initiate a view-change (i.e. changing the leader) if they detect either
malicious behavior or an unsatisfactory progress. If a quorum of $(2f+1)$
nodes agrees that the leader is faulty, then a next leader takes over.

PBFT has the following limitations:

  * •

PBFT was not designed for scalability in large consensus group of nodes. Each
PBFT node normally communicates directly with every other nodes during each
consensus round, resulting in $O(n^{2})$ communication complexity.

  * •

PBFT normally assumes a well-defined, closed group of nodes. Thus it is not
suitable for decentralized open networks.

  * •

In order to confirm the transaction has been committed, the client has to
communicate with a super-majority of the nodes to ensure that the transaction
is confirmed, making secure transaction verification unscalable.

###  III-B Collective Signing

Within legal infrastructures, we might have several witnesses $W$, and we ask
a number of the witnesses $W\textquoteright$ to verify that something is
correct. If one of the witnesses cannot verity the information, we would
highlight a problem. Let us say we have a controller on a network, and a
number of selected trusted witnesses. Each of the witnesses can then check all
of the messages sent by the nodes on the network, and if one of them
determines a problem, they can tell the rest of the network. In this respect,
every message ($M$) is collectively signed by $W$ witnesses.

The collective signing (CoSi) algorithm is defined by Syta et al [15]. With
CoSi (collective signing), there are four phases involving $P$ participants
and where the leader has an index value of zero. Each participant has a
private key ($a_{i}$) and a public key ($A_{i}=a_{i}G$, and where $G$ is a
base point on an elliptic curve). We then determine the aggregated public key
with [15]:

$A=\sum_{i\in P}A_{i}$ (8)

Announcement: Initially the leader broadcasts a message ($M$) that it wants
the participants to sign.

Commitment: Each node $i$ will pick a random scalar ($v_{i}$) and determines
their commitment ($V_{i}=[v_{i}]G$). Each commitment is then sent to the
leader, who will wait for a specific amount of commitments
($P\textquoteright$) to be received. The leader then creates a participant
bitmask and aggregates all the received commitments:

$V=\sum_{j\in P^{\prime}}V_{j}$ (9)

and creates a participation bitmask $Z$. The leader then broadcasts $V$ and
$Z$ to the other participants.

Challenge: Each of the participants computes the collective challenge (using
the hash function $H$):

$c=H(V||A||M)$ (10)

and send the following back to the leader:

$r_{i}=v_{i}+c\times a_{i}$ (11)

Response: The leader will wait until the participants in $P\textquoteright$
have sent their responses. Once received, the leader computes the aggregated
response:

$r=\sum_{j\in P^{\prime}}r_{j}$ (12)

and publishes the signature of the message (M) as:

$(V,r,Z)$ (13)

Each node can then check their own signature value and agree with the leader.

Figure 1: The SklCoin Approach

##  IV System Architecture

SklCoin is designed for untrustworthy networks that can arbitrarily delay, re-
order, drop or duplicate messages. We assume the network has a weak synchrony
property. The SklCoin system is comprised of a set of $N$ block miners. At any
time $t$ a subset of miners $M(t)$ could be faulty or controlled by a
malicious attacker. Unlike honest miners, Byzantine miners can attack the
system, diverting from our consensus protocol which we call SklCoin.

We assume that we have a group of $n=3f+1$ PBFT nodes. As in PBFT, at any
given time, one of these nodes is the leader, who proposes transactions and
drives the consensus process. These nodes collectively maintain the
blockchain, collecting transactions from clients and adding them in blocks.
SklCoin, our consensus protocol, guarantees that only one blockchain history
ever exists and that it can never be rolled back or rewritten. The safety and
liveness is guaranteed as long as at most $f$ nodes are faulty.

Subsequent sections describe how to build the SklCoin using the following
steps:

  1. 1.

We create a mechanism to allow miners to determine the consensus and signing
groups in every mining round.

  2. 2.

We leverage the idea of proof-of-stake to create a mechanism to elect the
leader.

  3. 3.

We leverage the collective signing technique used in ByzCoin to reduce per-
round communication complexity to $O(log\ n)$ and reduce typical signature
verification complexity from $O(n)$ to $O(1)$.

###  IV-A The SklCoin Protocol

Conventional BFT schemes rely on a well-defined consensus group to guarantee
safety and liveness. Sybil attacks can break any open-membership protocol
involving security thresholds. For example, PBFT assumes that at most $f$ out
of $3f+1$ members are not honest. To remedy this situation, the proof-of-work
mechanism used in Bitcoin, allows only miners who have dedicated resources to
become a member of the consensus group. In proof-of-stake, only miners who
have shares in the system can become part of that group. Here, we adapt the
proof-of-stake mechanism to maintain the “balance of power” within the BFT
consensus group over a given fixed-time slot.

The proof-of-stake (PoS) algorithm is the most important part of the SklCoin
protocol. It defines how the nodes reach an agreement about the state of the
ledger. The idea of PoS is not new and it has been already used in several
approaches such as [16][17][18][19]. The core idea of PoS is that instead of
wasting energy as the case in proof-of-work, a node is elected to generate a
new block with a probability proportional to the amount of stake this node
has. If a node is elected to generate a new block it will be called "slot
leader".

Similar to the approach in [20], every SklCoin is associated with two fields:
a balance and a stake. Balance is the real amount of "coins" that each user
has. Similar to any cryptocurrency, any user can send any amount of SklCoins
(within this balance), to other users, as well as receive any amount of
SklCoins from other users. Stake, on the other hand, gives a user the power to
contribute in the evolution of the ledger. For example, only nodes with
positive stakes (we call them stakeholders or miners) can participate in
running the SklCoin protocol. We differentiate here between two types of
transactions: normal transactions where the transferred coins are associated
with a balance, and stake transactions where the transferred coins are
associated with a stake.

The SklCoin protocol divides the physical time into slots. A slot is a
relatively short period of time (e.g. 10sec). Each slot corresponds to one and
only one slot-leader which has a sole right to produce one and only one block
during his slot. If slot-leader missed their slot (for example, went offline),
the right to produce a block is lost until they are elected again. In this
case, as will be seen later, SklCoin allows miners to elect the next slot-
leader(s).

Coming to a consensus between the miners in the SklCoin protocol boils down to
(Fig.1):

  1. 1.

Determine the consensus group.

  2. 2.

Select one of the miners to mine a new block in a way that is fair (not biased
toward any miners with specific characteristics).

  3. 3.

Determine the signing group (a subset of the consensus group).

  4. 4.

Efficiently broadcast the new block to the signing group who verify the
content of the block and the eligibility of the slot-leader before adding the
new block to their local blockchain.

###  IV-B How is Consensus Group Determined

We consider here that any miner that has at least one SklCoin with stake is
eligible to be a slot-leader. The idea here is that, at the beginning of each
block-mining round (time-slot), each miner can determine who is the slot-
leaders in the coming slots. Ideally, at the beginning of the time-slot, each
miner has to know only who will be the slot-leader of that slot. However, as
some miners may become unavailable, a timeout mechanism is used that allows
the miners to know the slot-leaders of the coming slots in case the slot-
leader of the current slot went offline.

Similar to the "fair lottery" idea, the selection mechanism should guarantee
that any stakeholder can become a slot-leader. However, it should also
guarantee that the more stakes the miner has, the more its chance to be
elected. In that respect, each miner parses all stake transactions available
in all blocks starting from the genesis block and calculates the stakes of
each stakeholder (miner). This way, the stakeholders will be sorted according
to their appearance in the blockchain. This list of stakeholders can be cached
in the miner’s machine and it can be updated when a new block is appended to
the blockchain. The result is that all miners will end up with the same
ordered list of stakeholders (consensus group) along with their number of
stakes.

###  IV-C How is Slot-leader Selected

Each miner follows the following steps:

Step 1: After the new block has been added to their local blockchain, each
miner calculates the hash of the last added block; we call that hash the
"common seed" (CS). This CS is used as a seed to a random number generator to
generate a sequence of random numbers with a length equals to the total amount
of coins staked into the network. For instance, if the amount of total coins
staked to the network is 100, then the random number generator must create a
sequence of 100 numbers.

Step 2: Each miner maintains a memory map where each memory location
corresponds to a specific stakeholder’s (miner) public key. Suppose we have
$N$ stakeholders. Each stakeholder $i$ has $S_{i}$ stakes. Therefore, the
memory map will have $L=\sum S_{i}$ locations in the memory. Each location
contains the stakeholder’s public key. The more stakes the stakeholder has the
more memory locations they will have, and the more chance they will be
elected. The question now is how to distribute these locations in memory. We
need to ensure that all miners end up with creating the same memory map in
their local machines. Each miner will use the same CS, produced in Step 2, as
an input to a deterministic pseudo-random numbers function which returns
random numbers between 1 and $L$. Because all miners use the same CS, all
miners will end up with the same sequence of random numbers. This sequence of
numbers specifies the memory locations of each of the $L$ stakes. The first
random number of that sequence specifies the memory location where we add the
public key of the stakeholder that corresponds to the first stake available in
the list of Step 1. The second random number specifies the memory location
where we add the public key of the stakeholder that corresponds to the second
stake available in the list, and so on. If the random number specifies a
memory location that has been already taken, we move to the next random
number. The result is that all miners will generate the same memory map that
contains a randomly distributed list of stakeholders’ public keys.

Step 3: At this point we need to have a mechanism that allows miners to know
who is the winning leader in the current time slot, and the next time slots in
case the current leader went offline. Each miner calculates the value ($CS\
modulo\ L$) to be used as a seed to a random number generator which produces a
series of random numbers between $1$ and $L$, and which determine the sequence
of next leaders. The first randomly generated number specifies the memory
location of the winning leader in the current time-slot. If for some reason
the winning miner went offline, other miners will wait till the time of the
current slot times out, and then the next randomly generated number is used to
determine the next leader, and so on.

###  IV-D How is Signing Group Determined

In order to ensure the scalability and feasibility of SklCoin, a maximum
number of miners $M$ should be selected to form the signing group. That group
is responsible of validating and agreeing on the block proposed by the slot-
leader. For this objective, the list of miners (resulted in Step 1) is sorted
according to their stakes and the top $M$ is selected to become the signing
group of the current slot.

The slot-leader prepares a new block and broadcasts it to the signing group as
will be seen in the next section. If the slot leader produces a block that
gets included in the chain, they receive a block reward equal to the total
fees of all transactions.

###  IV-E Agreeing on the New Block

The slot-leader starts generating a new block which will contain the
transactions it received. In the standard PBFT protocol, there exist two
phases: 1) the pre-prepare phase in which the leader obtains attestations from
a super-majority quorum of signing group members (two-thirds) that the
leader’s proposal is safe and consistent with all previously committed
history, and 2) the commit phase in which the leader obtains attestations from
a super-majority that all the signing members witnessed the successful result
of the prepare phase and they committed to remember the decision.

We adopt the collective signing approach taken in [3]. To implement the pre-
prepare phase, the slot-leader announces the first collective signature (CoSi)
round. The resulted CoSi from the prepare phase provides a proof-of-acceptance
of a proposed block of transactions by the slot-leader. In the second commit
round, the slot-leader announces the proof-of-acceptance to all members, who
then validate it and collectively sign the block’s hash to produce a
collective commit signature on the block. This way a Byzantine leader cannot
rewrite history or double-spend.

Validating the slot-leader’s proposal comprises two points: 1) The content of
the block in the proposal must be correct. That includes the list of
transactions and that the block is cryptographically linked with the last
block. 2) The originator of the proposal is the correct slot-leader of the
current time slot. After validating the new block, each member of the signing
group (including the slot-leader) adds that block to its local blockchain. In
addition, the slot-leader broadcasts the new block along with the collective
signature to the miners of the consensus group who did not participate in the
signing group. The result is that all miners end up with the same blockchain
state.

##  V Discussion

It is inherently difficult to analyze such complex system, and therefore we
only consider some common attacks and leave remaining more formal security
analysis for future work.

###  V-A Attacks

It is important to ensure that our consensus model functions correctly in
normal as well as adversarial conditions. In a permission-less environment,
the number of miners is expected to be large, and these miners are anonymous
and untrusted since any node is allowed to join the network. Consensus
mechanisms for such environments have to be resilient the following attacks:

Sybil attacks: Sybil attacks on a blockchain network can allow a single or
group of entities to generate several (millions) online identities that they
control to influence and manipulate the consensus process. Having such
dominance allows these entities to confirm the transactions and blocks as per
their rules or to include double-spend transactions.

In SklCoin, generating multiple (millions) identities by the attacker is
useless because: 1) participating in the mining process (consensus group)
requires the attacker to stake some coins into the network; it is unlikely
that miners play against their interest, 2) the probability of selecting the
leader is a function of the amount of stakes rather than the number of
identities, and 3) since participating in the signing group depends on the
number of stakes, generating multiple identities does not help the attacker to
be elected as a member of the signing group.

Selfish and deliberately malicious nodes: selfish mining occurs when the
normally honest miners are incentivized to support the attacker and join in
carrying out an attack. In this attack, the attacker performs erratic mining,
at the cost of his short term revenue by maintaining a separate private
blockchain in parallel to the Bitcoin blockchain. He selectively publishes
many blocks all at once, forcing rest of the network to discard their blocks
and ultimately losing revenue.

It is true that the attacker can be part of the consensus group by having as
low as one SklCoin (stake); however, because the chance of being elected as a
leader is proportional to the numbers of stakes, the attacker will have a slim
chance of mining new blocks. But what if the attacker has been elected to be
the leader? In that case, SklCoin reduces the risk by 1) electing the attacker
for only one time slot, and 2) any attempt to add a malicious block will be
noticed by the witnesses.

Nothing-at-stake attack: This attack refers to the case when a miner (aka
forger) forges on every possible fork. In fact, proof-of-stake is susceptible
to forks being created accidentally or maliciously giving the miner the chance
to mine on more than one fork simultaneously, thus, enabling double spending
attacks. This is impossible with PoW as a miner will consume power mining when
mining on two forks simultaneously. However, with PoS, forging on multiple
chains costs the miner nothing and will be rewarded no matter which fork wins.
In SklCoin, there is no chance for the network to generate multiple forks,
thus, eliminating the risk of mounting the nothing-at-stake attack.

An experiment on an AMD Phenom II running at 2.8 GHz produced the results
defined in Fig.2. This uses differing elliptic curves of: BN256 [21]; Edwards
25519 (with BlakeSHA256) [22]; and P256 (with BlakeSHA256) [23], and uses the
Golang Kyber library [24]. The experiment uses a number of signers for each
run. We create a new key pair for each signer, create a new mask for the
signing process, and then create an aggregated commitment and mask. Finally
the commitments and responses are created for each signer. It can be seen that
Edwards 25519 and P256 produces faster signing than BN256. The efficiency of
scale can be seen with the Edwards 25519 curve. There are some worries around
the current security levels of BN256 [25], where the security level may drop
to 96 bits of security.

BN256Edwards
25519P256$0$$200$$400$$600$$800$$1{,}000$$48.8$$28.9$$21.9$$360.2$$242.9$$253.7$$958.7$$512.3$$821.3$Average
time (ms)10 signers50 signers100 signers Figure 2: The performance evaluation
- Average time

###  V-B Limitations of the SklCoin protocol

Recently, it turned out that, according to [26], CoSi was not proved secure.
The authors introduced mBCJ, a secure two-round multi-signature scheme. Their
results show that mBCJ is only marginally less efficient than CoSi, so that
any protocol based on the insecure CoSi scheme should instead be built on the
provably secure mBCJ scheme. In the SklCoin approach, replacing the collective
signature scheme does not affect the approach itself and the plan is to
replace CoSi with the mBCJ scheme as the next step.

In addition, SklCoin does not have a mechanism that prevents a leader miner
from producing a block that will not get included in the blockchain. That
mechanism is necessary to stop miners from producing blocks that won’t get
included in the main chain. This could happen when one or more malicious
entities are trying to slow the throughput rate by producing fake or malicious
blocks, or not producing blocks at all. However, SklCoin reduces this risk by:
1) requiring the leaders to have stakes, and 2) the leader is not allowed to
mine more than one block during the leader-slot.

###  V-C Advantages of the SklCoin protocol

The advantages include:

  * •

The leader is selected from the consensus group which is formed from all
miners who have stakes. In order to ensure scalability, the leader is
responsible of choosing the signing group which is a subset of the consensus
group.

  * •

No Blockchain Fork: A blockchain fork can result in different nodes in the
system converging on different blocks as being part of the blockchain. Unlike
Bitcoin where temporary forks may exist due to network latencies, SklCoin has
immediate finality characteristics i.e. once the transaction is included in
the block, it is confirmed and will not be rolled back.

  * •

Transaction rate is higher with platforms that can confirm transactions
immediately and reach consensus fast. Wait time between blocks can be
significant e.g., up to 10 minutes using Bitcoin’s difficulty tuning scheme.
Whereas, in SklCoin one block is produced in each time slot. The time slot is
a configurable parameter and it could depends on the network size. Unlike PoW
approaches which are probabilistic and have to spend significant amount of
time solving a cryptographic puzzle, SklCoin supports higher transaction rate
because of a faster mechanism for leader election.

  * •

Scalability of the protocol: The scalability of SklCoin comes from: 1) the
mechanism of electing the leader is fast and does not depend on the number of
available miners, and 2) electing a subset of the consensus group to become
the signing group.

##  VI Conclusion

SklCoin is an attempt to solve the scalability and low-throughput rate in open
decentralized blockchain systems. By leveraging the ideas of proof-of-stake
and the collective signature, SklCoin provides strong consistency and prevents
common attacks on the consensus and mining system such as blockchain forks and
selfish-mining. SklCoin allows open membership in the consensus group i.e any
node can become a member of the miners as long it gets some stakes. The
consensus group and signing group are determined by the miners in each time
slot. Future work includes creating a penalty mechanism to punish the
malicious leaders who is either not adding any blocks or adding malicious
blocks, and finding fairer mechanism of choosing the signing group that does
not depend only on the number of stakes. In addition, more formal security
analysis of the proposed protocol considering how it is able to mitigate some
known attacks in the permissionless setting is needed.

## References

  * [1] T. Dinh, R. Liu, M. Zhang, G. Chen, B. Ooi, and J. Wang, “Untangling blockchain: A data processing view of blockchain systems,” _IEEE Transactions on Knowledge and Data Engineering_ , vol. PP, 08 2017.
  * [2] F. Tschorsch and B. Scheuermann, ““bitcoin and beyond: A technical survey on decentralized digital currencies,” _IEEE Communications Surveys Tutorials_ , vol. 18, no. 3, pp. 2084–2123, 2016.
  * [3] E. K. Kogias, P. Jovanovic, N. Gailly, I. Khoffi, L. Gasser, and B. Ford, “Enhancing bitcoin security and performance with strong consistency via collective signing,” in _25th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 16)_, 2016, pp. 279–296.
  * [4] S. Popov, “A probabilistic analysis of the nxt forging algorithm,” _LEDGER_ , vol. 1, 2016.
  * [5] M. Castro and B. Liskov, “Practical byzantine fault tolerance,” in _Proceedings of the Third Symposium on Operating Systems Design and Implementation_ , ser. OSDI ’99. Berkeley, CA, USA: USENIX Association, 1999, pp. 173–186. [Online]. Available: http://dl.acm.org/citation.cfm?id=296806.296824
  * [6] A. Baliga, “Understanding blockchain consensus models,” 2017.
  * [7] J. Liu, W. Li, G. O. Karame, and N. Asokan, “Scalable Byzantine consensus via hardware-assisted secret sharing,” _IEEE Transactions on Computers_ , vol. 68, no. 1, pp. 139–151, 2018.
  * [8] A. Miller, Y. Xia, K. Croman, E. Shi, and D. Song, “The honey badger of bft protocols,” in _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_. ACM, pp. 31–42.
  * [9] T. Crain, V. Gramoli, M. Larrea, and M. Raynal, “Dbft: Efficient leaderless Byzantine consensus and its application to blockchains,” in _2018 IEEE 17th International Symposium on Network Computing and Applications (NCA)_. IEEE, 2018, pp. 1–8.
  * [10] I. Eyal, A. E. Gencer, E. G. Sirer, and R. V. Renesse, “Bitcoin-ng: A scalable blockchain protocol,” in _13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16)_. Santa Clara, CA: USENIX Association, Mar. 2016, pp. 45–59. [Online]. Available: https://www.usenix.org/conference/nsdi16/technical-sessions/presentation/eyal
  * [11] K. Ohta and T. Okamoto, “Multi-signature schemes secure against active insider attacks,” _IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences_ , vol. 82, no. 1, pp. 21–31, 1999.
  * [12] “Fiat-shamir heuristic,” 2019. [Online]. Available: https://en.wikipedia.org/wiki/Fiat-Shamir_heuristic
  * [13] I. Abraham, D. Malkhi, K. Nayak, L. Ren, and A. Spiegelman, “Solida: A Blockchain Protocol Based on Reconfigurable Byzantine Consensus,” in _21st International Conference on Principles of Distributed Systems (OPODIS 2017)_ , ser. Leibniz International Proceedings in Informatics (LIPIcs), J. Aspnes, A. Bessani, P. Felber, and J. Leitão, Eds., vol. 95. Dagstuhl, Germany: Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, 2018, pp. 25:1–25:19. [Online]. Available: http://drops.dagstuhl.de/opus/volltexte/2018/8640
  * [14] K. Kulkarni, in _Learn Bitcoin and Blockchain: Understanding Blockchain and Bitcoin Architecture to Build Decentralized Applications_. Packt, 2018.
  * [15] E. Syta, I. Tamas, D. Visher, D. I. Wolinsky, P. Jovanovic, L. Gasser, N. Gailly, I. Khoffi, and B. Ford, “Keeping authorities" honest or bust" with decentralized witness cosigning,” in _2016 IEEE Symposium on Security and Privacy (SP)_. Ieee, 2016, pp. 526–545.
  * [16] A. Kiayias, A. Russell, B. David, and R. Oliynykov, “Ouroboros: A provably secure proof-of-stake blockchain protocol,” in _Advances in Cryptology – CRYPTO 2017_ , J. Katz and H. Shacham, Eds. Cham: Springer International Publishing, 2017, pp. 357–388.
  * [17] W. Li, S. Andreina, J.-M. Bohli, and G. Karame, “Securing proof-of-stake blockchain protocols,” in _Data Privacy Management, Cryptocurrencies and Blockchain Technology_ , J. Garcia-Alfaro, G. Navarro-Arribas, H. Hartenstein, and J. Herrera-Joancomartí, Eds. Cham: Springer International Publishing, 2017, pp. 297–315.
  * [18] F. Saleh, “Blockchain without waste: Proof-of-stake,” 2019. [Online]. Available: http://dx.doi.org/10.2139/ssrn.3183935
  * [19] T. Duong, L. Fan, and H.-S. Zhou, “2-hop blockchain: Combining proof-of-work and proof-of-stake securely,” 2017. [Online]. Available: . https: //eprint.iacr.org/2016/716.
  * [20] P. L. Seijas and S. Thompson, “Marlowe: Financial contracts on blockchain,” in _International Symposium on Leveraging Applications of Formal Methods_. Springer, 2018, pp. 356–375.
  * [21] P. S. Barreto and M. Naehrig, “Pairing-friendly elliptic curves of prime order,” in _International Workshop on Selected Areas in Cryptography_. Springer, 2005, pp. 319–331.
  * [22] H. Hisil, K. K.-H. Wong, G. Carter, and E. Dawson, “Twisted edwards curves revisited,” in _International Conference on the Theory and Application of Cryptology and Information Security_. Springer, 2008, pp. 326–343.
  * [23] M. Adalier _et al._ , “Efficient and secure elliptic curve cryptography implementation of curve p-256,” in _Workshop on Elliptic Curve Cryptography Standards_ , vol. 66, 2015.
  * [24] DEDIS, “DEDIS Advanced Crypto Library for Go,” https://github.com/dedis/kyber, 2019, [Online; accessed 20-Oct-2019].
  * [25] T. Kim and R. Barbulescu, “Extended tower number field sieve: A new complexity for the medium prime case,” in _Annual International Cryptology Conference_. Springer, 2016, pp. 543–571.
  * [26] M. Drijvers, K. Edalatnejad, B. Ford, E. Kiltz, J. Loss, G. Neven, and I. Stepanovs, “On the security of two-round multi-signatures,” 05 2019, pp. 1084–1101.