Opera Group Presentation: Policies in Accountable Contracts Brian Shand 16 April 2002

2 Overview PhD Research: Self-Enforcing Automatic Rational Contracts between Computers –Contract Framework, Resource Accounting, Trust Model Application Scenarios –Public compute servers (GRID computation) –Flexible prioritisation in large distributed systems –Web services 1.Contract Negotiation 2.Signing 3.Performance

3 Key Terms Contracts Non-repudiable promises to act. Allow planning. But: Need to be prioritised. Resource Model Basis for accounting. Flexible resource economy. Accounting Functions Bind contracts and resources together. Can prioritise and monitor contracts. But: Need sanctions for cheats. Trust Model Models expected contract payment. Constantly re-assessed. Accountable Contracts Scheduled according to expected profitability. { { { { {

4 Contract Framework Contracts specify promises between participants Multi-level contracts allow introspection 1. Participant identities 2. Estimated resource consumption 3. Accounting function (payment policy) 4. Actions to perform Allows risk estimates, with limited resource outlay All accounting messages signed and timestamped –Message passing substrate assumed

5 Resource Accounting Homogeneous model –of scarce resources: bandwidth, CPU cycles, trust, currency Constrained language for accounting functions –A subset of the Python language –Predictable execution times –Example code: def processResourceAtom(self, atom, imports): if atom.type != resources.cpuTime: return [] # Charge for CPU only rate = imports[0] if self.totalCPU < 10: result = rate+0.01 else: result = rate self.totalCPU += atom.quantity return [ResourceAtom(resources.money, '£', result*atom.quantity) ]

6 Trust Model Subjective Trust Model (Jøsang, A Logic for Uncertain Probabilities, 2001) –Local assessments of trustworthiness –Second-order model incorporates uncertainty –Moderates contractual promises –Constantly updated Transfer of Trust: Trust delegation certificates –Web of trust, c.f. PGP recommendations –Subsume reputation agencies –Distributed trust management Trust Uncertainty Distrust (1,0,0)(1,0,0) (0,0,1)(0,0,1) (0,1,0)(0,1,0)

7 Accountable Contracts Separation of task acceptance and performance –introspectible contracts –explicit risk assessments Multi-scale representation Accounting of all resources –economic services Distributed trust model deters cheats Overhead in a PBIL application: –about 20% of bandwidth, 2% of CPU

8 Further Work Explicit integration of reputation into contracts Prototype applications –Compute Servers Complex negotiation, pricing by servers Clients that plan –Active City Event prioritisation in publish-subscribe Theoretical basis for trust model –SECURE collaboration –Model risks of stolen signatures Distrust in own actions