1. 1/16 DIANE Project Philipp Obreiter http://www.ipd.uni-karlsruhe.de/DIANE A Case for Evidence-Aware Distributed Reputation Systems Overcoming the Limitations of Plausibility Considerations Universität Karlsruhe Institute for Program Structures und Data Organization Universität Karlsruhe GERMANY The Second International Conference on Trust Management 29 March - 1 April 2004 – Oxford, UK

2. 2/16 Motivation (1): Current State AnneBob Chris 1. service request 2. service provision 5. assessment of the disrecommendation (”Did Anne defect or did Bob defame?”) Problem: Assessment of recommendations is equivalent to the Byzantine Generals Problem Approach: Base such assessment on plausibility considerations  How trustworthy is the recommender?  Does his statement correspond to one’s own prior beliefs? 4. disrecommendation (”Anne did not provide the service”) 3. receipt

3. 3/16 Motivation (2): Target State AnneBob Chris 7. refutation the disrecommendation 3. NR-receipt 4. NR- disrecommendation 5. receipt? 6. receipt! 8. disrecommen- dation (”Bob issued defamation”) Approach: Make use of non-repudiable tokens (=evidences) Solves the Byzantine Generals Problem:  the defamation is refuted by presenting the receipt  Bob’s misbehavior is proven by presenting the receipt/defamation 1. service request 2. service provision

4. 4/16 Overview Limitations of plausibility considerations Concept of Evidences Overcoming the limitations: 3 patterns Relationship to existing approaches

5. 5/16 Distributed Reputation Systems: System Model Entity A local instance of the DRS Entity B local instance of the DRS Transactions Recommendations information system

6. 6/16 Limitations of Plausibility Considerations (1) 4. disrecom- mendation 2. provision 3. receipt AnneBob Chris 5. assessment 1. request Limitations (Part 1)  disadvantages for newcomers  Chris cannot make use of plausibility  recommendations unrelated to behavior  Anne is disrecommended in spite of the service provision  Anne cannot self-recommend  ineffective dissemination of recommendations  recommendations authenticated but repudiable

7. 7/16 Limitations of Plausibility Considerations (2) 4. disrecom- mendation 2. provision 3. receipt AnneBob Chris 5. assessment 1. request Limitations (Part 2)  unobservable recommendation behavior  Anne does not know about the defamation  unrecognized defamations  e.g., if Chris is a newcomer  unrecognized praising  same as for defamations  dissemination of assessment results  Chris’ assessment result cannot be reproduced by others

8. 8/16 plausibility considerations Concept of Evidences: Comparison with Plausibility Coupling of Actual Behavior and Assessment  only for documented behavior (inherent restrictions!)  plausibility considerations still necessary for undocumented behavior Actual Behavior Assessment no coupling undocumented Evidences verification available evidences coupling documented by evidences

9. 9/16 Concept of Evidences: Inherent Restrictions Inherent Restrictions  ensue from the criterion of incentive compatibility  partly compromise the availability and truthfulness of evidences 1. Asymmetry of Issuance there exists a receipt that is not acknowledged  some behavior not documented (Coordinated Attack Problem) 3.Untruthfulness Evidences colluding entities could mutually attest good behavior  evidence-awareness cannot solve the problem of praising 2. Issuance of Negative Evidences an entity does not disseminate negative evidences about itself  lack of negative evidences

10. 10/16 7. refutation 6. receipt! 8. disrecommendation Overcoming the Limitations: Three Patterns (1) Transferability of Evidences  recommendation unrelated to behavior (  )  disadvantages for newcomers (  )  dissemination of assessment results   ineffective dissemination of recommendations  AnneBob Chris 7. refutation 1./2. request/provision 3. NR-receipt 4. NR- disrecom- mendation 5. receipt? 6. receipt! 8. disrecommendation self-recom- mendation plausibility-less assessment verifiable assessment result

11. 11/16 Overcoming the Limitations: Three Patterns (2) Screening of Recommendation Behavior  unobservable recommendation behavior  AnneBob Chris 7. refutation 1./2. request/provision 3. NR-receipt 5. receipt? 6. receipt! 8. disrecommendation If Bob does issue the receipt,  Bob’s defamation is refutable  Bob won’t defame If Bob does not issue the receipt,  Bob defects  Anne won’t transact with Bob 4. NR- disrecom- mendation

12. 12/16 4. NR- disrecom- mendation Overcoming the Limitations: Three Patterns (3) Policy-based Restriction of Defamations  unrecognized defamations (  )  ineffective dissemination of recommendations   unobservable recommendation behavior  AnneBob Chris 7. refutation 1./2. request/provision 3. NR-receipt 5. receipt? 6. receipt! 8. disrecommendation 5. receipt? has to be non-repudiable, otherwise it is ignored Anne is given the chance to provide refuting evidences

13. 13/16 Overcoming the Limitations: Summary Pattern Limitation Transfer- ability ScreeningPolicies disadvantages for newcomers ()() recommendation unrelated to behavior ()() ineffective dissemination of recommendations  unobservable recommendation behavior  unrecognized defamations ()() unrecognized praising dissemination of assessment results 

14. 14/16 Relationship to Existing Approaches self-organized punishment for misbehavior coupling of assessment with actual behavior Plausibility considerations by a central authority Plausibility based distributed reputation system Evidence based assessment by a central authority Evidence aware distributed reputation system

15. 15/16 Summary and Future Work Summary  in distributed reputation systems, the truthfulness of recommendations has to be assessed,  existing approaches rely on plausibility considerations,  there are several limitations of plausibility,  we propose the use of non-repudiable tokens (evidences),  evidences partly couple assessment and actual behavior,  evidences allow for transferability, screening and policies,  evidence awareness overcomes virtually every limitation Future Work  examine the design space of the policies and the verification process  implement and evaluate an evidence-aware distributed reputation system

16. 16/16 T H A N K S...for your attention http://www.ipd.uni-karlsruhe.de/DIANE

17. 17/16 Appendix

18. 18/16 Distributed Reputation Systems: System Model Entity A local instance of the DRS Entity B local instance of the DRS Transactions Recommendations Example: Anne local instance of the DRS Bob local instance of the DRS Chris local instance of the DRS Transaction Recom- mendation RecommendeeRecommender Assessor (=Recipient)

19. 19/16 Concept of Evidences: Basics Evidence  non-repudiable token  issued by an entity (evidencer)  regarding the behavior of another entity (evidencee) Types of Evidences  receipt: evidencer attests that its peer has executed an action  non-repudiable recommendation: evidencer (=recommender) may be linked to its recommendation  contract: evidencer attests to have agreed on some terms  non-repudiable action: evidencer may be linked to its own action

20. 20/16 Limitations (1): Recommender limitations for the recommender issuance of recommendations facts cannot be credibly communicated dissemination of recommendations recommender in charge of the dissemination behavior of others impact of recommendation depends on own reputation good conduct of oneself cannot self-recommend

21. 21/16 Limitations (2): Recommendee limitations for the recommendee incertitude about recommendations the amount and contents of recommendations is unknown incertitude about effectiveness doubts about the effectiveness of the reputation system impact on transactions cannot adapt transactional behavior to the peer’s recommendations impact on the reputation system necessity of pro-active defense unknown effective pruning doubts about the coupling of behavior and reputation effective dissemination transaction peer might not know about relevant recommendations lack of incentives good behavior might not result in good reputation lack of protection no protection against defamations

22. 22/16 Limitations (3): Assessor limitations for the assessor difficulties of disseminating assessment results disseminated result is subject to plausibility considerations difficulties of assessing recommendations plausibility considerations may lead to inappropriate assessment plausibility considerations false plausibility considerations may lead to wrong assessment plausibility considerations infeasible assessment necessitates a minimum of background information underestimation due to defamation synergies with well-behaving transaction peers are not exploited overestimation due to praising betrayal by transaction peers

23. 23/16 Overcoming the Limitations: Summary Patterns Limitations to overcome Transfer- ability ScreeningPolicies Recom-mender impact depends on own reputation()() cannot self-recommend  in charge of the dissemination  Recommendee cannot adapt to the peer's recommendations  necessity of pro-active defense unknown  good behavior might not be rewarded()() no protection against defamations()() peer unaware of positive recommendations  Assessor requires background information()() synergies with defamed entities unexploited()() betrayed by overestimated peers cannot credibly share assessment result 