reputation based trust

20
Reputation Based Trust Reputation Based Trust The using of reputation The using of reputation to accomplish trust to accomplish trust between users on the between users on the Internet Internet M.Vološin, R.Gore, Ibe2roč. PF UPJŠ, Košice, Slovakia

Upload: shina

Post on 07-Jan-2016

50 views

Category:

Documents


0 download

DESCRIPTION

Reputation Based Trust. The using of reputation to accomplish trust between users on the Internet. M.Volo šin, R.Gore, Ibe2roč. PF UPJŠ, Košice, Slovakia. Contents. What is Reputation Based Trust Various systems for Reputation Based Trust on Internet Human driven environments - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Reputation Based Trust

Reputation Based TrustReputation Based Trust

The using of reputation to The using of reputation to accomplish trust between accomplish trust between

users on the Internetusers on the Internet

M.Vološin, R.Gore, Ibe2roč. PF UPJŠ, Košice, Slovakia

Page 2: Reputation Based Trust

ContentsContents

• What is Reputation Based TrustWhat is Reputation Based Trust• Various systems for Reputation Based Trust on Various systems for Reputation Based Trust on

InternetInternet– Human driven environmentsHuman driven environments

• Auctions systemsAuctions systems– EbayEbay– Amazon AuctionsAmazon Auctions– Yahoo Auctions (retired from June 2007)Yahoo Auctions (retired from June 2007)

• ““Expert Sites” like Expert Sites” like www.Allexperts.comwww.Allexperts.com • Reviews sites like Reviews sites like www.Epinions.comwww.Epinions.com• Other …Other …

– Automated environmentsAutomated environments• P2P networksP2P networks• Computing markets and grids Computing markets and grids (One such system we describe here in detail)(One such system we describe here in detail)

Page 3: Reputation Based Trust

What is Reputation Based What is Reputation Based Trust?Trust?

• Anonymity on the Internet Anonymity on the Internet

VirusesViruses

• Why we trust our friendsWhy we trust our friends

• Name + recorded past activitiesName + recorded past activities

available and visible for available and visible for everybody everybody

= Reputation Based Trust= Reputation Based Trust

Page 4: Reputation Based Trust

EbayEbay

• How to sell goods somebody from How to sell goods somebody from Australia? How to make it secure?Australia? How to make it secure?

• Feedback forum on EbayFeedback forum on Ebay

• Ebay is Auction systemEbay is Auction system

• Bussiness on EbayBussiness on Ebay

Page 5: Reputation Based Trust
Page 6: Reputation Based Trust
Page 7: Reputation Based Trust
Page 8: Reputation Based Trust

Reputation Based Trust in Reputation Based Trust in Automated EnvironmentsAutomated Environments

• P2P networksP2P networks

• Distributed computation marketsDistributed computation markets

Page 9: Reputation Based Trust

Distributed Computation Distributed Computation MarketsMarkets

• The Servers provides service – complicated time-The Servers provides service – complicated time-consuming computations And the Clients pay for consuming computations And the Clients pay for this.this.

• How to trust a server that it has least-costly, How to trust a server that it has least-costly, fastest service, how it advertised? fastest service, how it advertised?

• How to ensure that Server performed all work and How to ensure that Server performed all work and didn't give fake results?didn't give fake results?

• Solution: Proof Solution: Proof byby computation ”ringers” and computation ”ringers” and “threshold witnessing” mechanism“threshold witnessing” mechanism

Page 10: Reputation Based Trust

• Step 1 – Witness selectionStep 1 – Witness selection

• Step 2 – B sends service requestStep 2 – B sends service request

• Step 3 – Server selection processStep 3 – Server selection process

• Step 4 – Executing of computationStep 4 – Executing of computation

• Step 5 – Returning the execution Step 5 – Returning the execution proofs and computation result proofs and computation result

• Step 6 – Signing new rating by Step 6 – Signing new rating by witnesseswitnesses

Page 11: Reputation Based Trust
Page 12: Reputation Based Trust
Page 13: Reputation Based Trust

Building blocksBuilding blocks

• Rating Store managementRating Store management– Every participant stores the most recent data for every Every participant stores the most recent data for every

other participantother participant – Reputation value can be created or changed only if at Reputation value can be created or changed only if at

least c+1 participants agree.least c+1 participants agree.

• Witness SelectionWitness Selection– B select 2c+1 witnesses randomlyB select 2c+1 witnesses randomly– creates a multicast channel for the witnessescreates a multicast channel for the witnesses – sends the (signed) job description: sends the (signed) job description: ff, the set of input , the set of input

values{x1...xa}, the maximum time B is willing to wait values{x1...xa}, the maximum time B is willing to wait for job completion, the maximum amount B is willing to for job completion, the maximum amount B is willing to pay for the computationpay for the computation

Page 14: Reputation Based Trust

• Server SelectionServer Selection– The 2c+1 witnesses selects the most suitable service The 2c+1 witnesses selects the most suitable service

provider (A)provider (A)– A is added to the witness multicast group.A is added to the witness multicast group.– One of the witnesses multicasts the job description One of the witnesses multicasts the job description

received from B.received from B.

• Threshold WitnessingThreshold Witnessing– Ringer GenerationRinger Generation – –

• Each witness (Wj) selects one random value xz from the input Each witness (Wj) selects one random value xz from the input set specified by B in the job description and computes a set specified by B in the job description and computes a ringerringer r rjj = H(f(xz)) = H(f(xz))

• Wj sends Wj sends SWj(H(Id(Wj); sid; rSWj(H(Id(Wj); sid; rjj)),)), its identifier, sid, the ringer, its identifier, sid, the ringer, together with the signed digest and Wj's public key certifcate together with the signed digest and Wj's public key certifcate to Ato A

• A waits to receive 2c+1 valid messagesA waits to receive 2c+1 valid messages

• A sends a multicast message to all the witnesses with A sends a multicast message to all the witnesses with concatenation of all the signed ringers receivedconcatenation of all the signed ringers received

• The witnesse, inquire the remaining witnesses for their The witnesse, inquire the remaining witnesses for their ringers.ringers.

Page 15: Reputation Based Trust

– Revealing the RingersRevealing the Ringers

• A performs the computation and reveals the input A performs the computation and reveals the input values xvalues xzz hidden in the 2c+1 ringers hidden in the 2c+1 ringers

• A creates a single message containing Swj (H(Id(Wj); A creates a single message containing Swj (H(Id(Wj); sid; rj)) and SA(H(Id(A); sid; z)), for j = 1...2c+1. sid; rj)) and SA(H(Id(A); sid; z)), for j = 1...2c+1. There also are the results of the computation, There also are the results of the computation, f(x1),...,f(xA), along with its signed digest.f(x1),...,f(xA), along with its signed digest.

• Each witness Wj verifies the correctness of only its Each witness Wj verifies the correctness of only its own ringerown ringer

• If any witness Wj discovers that rj <> H(f(xz)), Wj If any witness Wj discovers that rj <> H(f(xz)), Wj sends a multicast message to all the other witnesses sends a multicast message to all the other witnesses revealing this factrevealing this fact

• The witnesses are able to verify the claim by The witnesses are able to verify the claim by computing the correct answer to Wj's ringer and computing the correct answer to Wj's ringer and compare it with the answer sent back by Alicecompare it with the answer sent back by Alice

Page 16: Reputation Based Trust

– Signature GenerationSignature Generation

• each witness Wj is able to compute A's new ratingeach witness Wj is able to compute A's new rating

• Each Wj then generates a verifiable signature share of A's new Each Wj then generates a verifiable signature share of A's new reputationreputation

• Wj sends this value, its certified verification key VKj and A's new Wj sends this value, its certified verification key VKj and A's new rating in clear, to all the other witnesses, using the group's rating in clear, to all the other witnesses, using the group's multicast channelmulticast channel

• Each witness waits to receive c correct signature shares for the Each witness waits to receive c correct signature shares for the same new reputation of A as the one generated by itself.same new reputation of A as the one generated by itself.

• each witness is able to generate the signed new rating of A each witness is able to generate the signed new rating of A locallylocally

• Reputation DistributionReputation Distribution– The results of the computation are returned to B and the The results of the computation are returned to B and the

new reputation of A is distributed (by the first witness is in new reputation of A is distributed (by the first witness is in charge on the broadcast channel to all the participants in charge on the broadcast channel to all the participants in the system)the system)

– Note that a witness cannot simply send an incorrect Note that a witness cannot simply send an incorrect reputation since it will be easily detectedreputation since it will be easily detected

– Punishing Malicious WitnessesPunishing Malicious Witnesses

Page 17: Reputation Based Trust
Page 18: Reputation Based Trust
Page 19: Reputation Based Trust

Possible attacks?Possible attacks?

• Bad-mouthing (incorrect negative feedback)Bad-mouthing (incorrect negative feedback)

• Ballot-stuffing (un-earned positive feedback)Ballot-stuffing (un-earned positive feedback)

• Lazy behaviorLazy behavior– IImprovementmprovement:: adding fake ringers adding fake ringers

• Sybil AttacksSybil Attacks

• Mobile Virus AttacksMobile Virus Attacks

Page 20: Reputation Based Trust

ConclusionsConclusions

With reputation based trust we can make With reputation based trust we can make Internet more secure and usable in more Internet more secure and usable in more areas of our activities.areas of our activities.

Thank you.