1. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System1 S. Felix Wu University of California, Davis wu@cs.ucdavis.edu http://www.cs.ucdavis.edu/~wu/

2. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System2 Computational Trust representing a trust relationship between two directly communicating entities Trust Attribute

3. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System3 Computational Trust Trust Values –I “trust” him “50/50”. –I trust him “0.715” Partial Ordering Relationship –“I trust Alice more (than Bob)” –“I trust Alice more than the set threshold of my spam mail filter”

4. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System4 Trust Ordering –I trust you, otherwise, I don’t. Information-based Ordering –I trust you, I don’t, or I don’t know based on the information I have currently. –Dynamics and Uncertainty

5. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System5 Policy & Delegation Policy: –If X trusts Y by Z, then A will trust B by C. –E.g. If Bank American will lend you $1M, then Washington Mutual will lend you $2M.

6. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System6 Policy & Delegation Policy: –If X trusts Y by Z, then A will trust B by C. –E.g. If Bank American will lend you $1M, then Washington Mutual will lend you $2M. –Trust means “Action and Risk” –Computational Trust needs to quantify the actions and their associated risks. –It might be “Mutual Recursive” though…

7. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System7 Computational Trust Direct DSL Link –Observing our direct neighbor’s behavior Indirect Sources in Social Network –Trust delegation –About a peer, may or may not be your direct neighbor

8. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System8 Trust in P2P The Service Provider provides a management system for trust and reputation –Google’s “PageRank” –Antivirus system –eBay’s seller reputation system –PKI P2P -- everything hopefully to be P2P –Decentralized model for trust

9. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System9 Cheating & Incentives Selfish users in Gnutella and Bittorrent eBay flaw seller ranking Google page rank Selfishness or Reputation boost

10. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System10 P2P Trust Model Less vulnerable? Harder to implement? In a decentralized setting?

11. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System11 Problem: –Reduce inauthentic files distributed by malicious peers on a P2P network. Motivation: Problem “Major record labels have launched an aggressive new guerrilla assault on the underground music networks, flooding online swapping services with bogus copies of popular songs.” -Silicon Valley Weekly

12. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System12 Problem Goal: To identify sources of inauthentic files and bias peers against downloading from them. Method: Give each peer a trust value based on its previous behavior. 0.9 0.1

13. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System13 Some approaches Past History Friends of Friends EigenTrust PeerTrust TrustDavis

14. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System14 Terminology Local trust value: c ij. The opinion that peer i has of peer j, based on past experience. Global trust value: t i. The trust that the entire system places in peer i. Peer 1 Peer 3 Peer 2 Peer 4 t 4 =0 t 1 =.3 t 3 =.5 t 2 =.2 C 21 =0.6 C 23 =0.7 C 14 =0.01 C 12 =0.3

15. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System15 Local Trust Values Each time peer i downloads an authentic file from peer j, c ij increases. Each time peer i downloads an inauthentic file from peer j, c ij decreases. Peer i Peer j C ij =

16. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System16 Normalizing Local Trust Values All c ij non-negative c i1 + c i2 +... + c in = 1 Peer 2 Peer 1 Peer 4 C 14 =0.1 C 12 =0.9 Peer 2 Peer 4 Peer 1

17. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System17 Local Trust Vector Local trust vector c i : contains all local trust values c ij that peer i has of other peers j. Peer 2 Peer 4 Peer 1 c1c1 Peer 2 Peer 1 Peer 4 C 14 =0.1 C 12 =0.9

18. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System18 Past history Each peer biases its choice of downloads using its own opinion vector c i. If it has had good past experience with peer j, it will be more likely to download from that peer. Problem: Each peer has limited past experience. Knows few other peers. Peer 4 Peer 6 Peer 1 ? ? ? ? ? ?

19. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System19 Friends of Friends Ask for the opinions of the people who you trust. Peer 4 Peer 6 Peer 1 Peer 2 Peer 8

20. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System20 Friends of Friends Weight their opinions by your trust in them. Peer 4Peer 1 Peer 2 Peer 8 Peer 4

21. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System21 The Math Ask your friends j What they think of peer k. And weight each friend’s opinion by how much you trust him.. 1.5 0.2 0.2 0.3 0.5.1 0 0 0.1.3.2.3.1.2

22. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System22 Problem with Friends Either you know a lot of friends, in which case, you have to compute and store many values. Or, you have few friends, in which case you won’t know many peers, even after asking your friends.

23. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System23 Dual Goal We want each peer to: –Know all peers. –Perform minimal computation (and storage).

24. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System24 Knowing All Peers Ask your friends: t=C T c i. Ask their friends: t=(C T ) 2 c i. Keep asking until the cows come home: t=(C T ) n c i.

25. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System25 Minimal Computation Luckily, the trust vector t, if computed in this manner, converges to the same thing for every peer! Therefore, each peer doesn’t have to store and compute its own trust vector. The whole network can cooperate to store and compute t.

26. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System26 Non-distributed Algorithm Initialize: Repeat until convergence:

27. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System27 Distributed Algorithm No central authority to store and compute t. Each peer i holds its own opinions c i. For now, let’s ignore questions of lying, and let each peer store and compute its own trust value.. 1.5 0.2 0.2 0.3 0.5.1 0 0 0.1.3.2.3.1.2

28. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System28 Distributed Algorithm For each peer i { -First, ask peers who know you for their opinions of you. -Repeat until convergence { -Compute current trust value: t i (k+1) = c 1j t 1 (k) +…+ c nj t n (k) -Send your opinion c ij and trust value t i (k) to your acquaintances. -Wait for the peers who know you to send you their trust values and opinions. }

29. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System29 Probabilistic Interpretation

30. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System30 Malicious Collectives

31. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System31 Pre-trusted Peers Battling Malicious Collectives Inactive Peers Incorporating heuristic notions of trust Convergence Rate

32. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System32 Pre-trusted Peers Battling Malicious Collectives Inactive Peers Incorporating heuristic notions of trust Convergence Rate

33. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System33 Secure Score Management Two basic ideas: –Instead of having a peer compute and store its own score, have another peer compute and store its score. –Have multiple score managers who vote on a peer’s score. M M M M Score Manager Score Managers ? ? ? ? Distributed Hash Table

34. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System34 PeerTrust System Architecture P1P1 P3P3 P4P4 P2P Network Trust Data Data Locator Feedback Submission Trust Evaluation Trust Manager P5P5 P6P6 P2P Network P2P2

35. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System35 How to use the trust values t i When you get responses from multiple peers: –Deterministic: Choose the one with highest trust value. –Probabilistic: Choose a peer with probability proportional to its trust value.

36. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System36 Load Distribution Deterministic Download Choice Probabilistic Download Choice

37. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System37 Threat Scenarios Malicious Individuals –Always provide inauthentic files. Malicious Collective –Always provide inauthentic files. –Know each other. Give each other good opinions, and give other peers bad opinions.

38. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System38 More Threat Scenarios Camouflaged Collective –Provide authentic files some of the time to trick good peers into giving them good opinions. Malicious Spies –Some members of the collective give good files all the time, but give good opinions to malicious peers.

39. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System39 Malicious Individuals

40. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System40 Malicious Collective

41. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System41 Camouflaged Collective

42. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System42 P2P Electronic Communities

43. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System43 Motivation

44. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System44 Motivation Should we buy? How do we decide?

45. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System45 Motivation

46. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System46 Motivation Should we buy? How do we decide? What we want: –accurately estimate risk of default –minimize the risk of default –minimize losses due to pseudonym change –avoid trusting a centralized authority How do we achieve these goals?

47. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System47 Motivation TrustDavis is a reputation system that realizes these goals. It recasts these goals as the following properties:

48. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System48 Motivation 1.Agents can accurately estimate risk –Third parties provide accurate ratings 2.Honest buyer/seller avoids risk (if possible) –Insure transactions 3.No advantage in obtaining multiple identities –Agents can cope with pseudonym change 4.No need to trust a centralized authority –No centralized services needed

49. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System49 Motivation Incentive Compatibility: Each player should have incentives to perform the actions that enable the system to achieve a desired global outcome.

50. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System50 Motivation 1.Agents can accurately estimate risk –Third parties provide accurate ratings 2.Honest buyer/seller avoids risk (if possible) –Insure transactions 3.No advantage in obtaining multiple identities –Agents can cope with pseudonym change 4.No need to trust a centralized authority –No centralized services needed Incentive Compatibility!

51. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System51 Motivation A Reference is: Acceptance of Limited Liability. $100 B A C

52. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System52 Motivation 1.Agents can accurately estimate risk –Third parties provide accurate ratings –Parties are liable for the references they provide 2.Honest buyer/seller avoids risk (if possible) –Insure transactions –Buyers/sellers pay for references to insure their transactions 3.No advantage in obtaining multiple identities –Agents can cope with pseudonym change –References are issued only to trusted identities 4.No need to trust a centralized authority –No centralized services needed –Anyone can issue a reference Use References!

53. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System53 Outline TrustDavis leverages social networks For now, examples assume No False Claims (NFC) The use of TrustDavis does NOT preclude trade outside the system.

54. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System54 Paying for References 150 100 50

55. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System55 v b wants to buy three shirts. Shirts cost $100 each from a trustworthy seller Unknown seller offers shirts for $50 each (but maybe they are only worth $25). v b would risk 3 x $50 = $150 in the transaction v b can borrow and lend money at rate r=1.25 through the period of the transaction For $30, v b can insure herself! Paying for References How much is v b willing to pay to insure the transaction? (No riskless profitable arbitrage criterion) Example: $100 each Trust-me.com Blowout SALE! $50 each! $150!

56. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System56 Paying for References To insure herself v b buys the shirts and a hedging portfolio as follows: 1.Instead of buying 3 shirts for $50 each she buys only 2, saving $50. 2.The buyer, v b, adds $30 of her own money and lends the resulting $80 at rate r = 1.25.

57. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System57 Paying for References On Success: –v b obtains $100 from the loan and buys the 3 rd shirt On failure: – v b sells the two shirts for $25 each –gets $100 from the loan. –She obtains a total of $150 Thus, v b can insure herself for $30.

58. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System58 Selling References

59. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System59 Selling References Seen as an investment… On Success the ROI is: On failure the ROI is: If repeated many times the insurer may go bankrupt. Assume the insurer has W dollars available to insure this transaction.

60. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System60 Selling References Insurer maximizes the expected value of the growth rate of capital (Kelly Criterion). For given: –probability of failure p, – a desired growth rate of capital R ; and, – fraction of the total funds W being risked in a transaction. The insurer can obtain a lower bound on the premium C.

61. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System61 Selling References Insured Value as a fraction of total funds – f Cost/Insured Value – C/K Minimum Return/Risk Ration for Different Failure Probabilities

62. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System62 A Non-Exploitable Strategy Two Scenarios: No False Claims - NFC With False Claims - FC False claims only change the probability p. We can incorporate the cost of verification. Key Idea: Save part of the money obtained in successful transactions in excess of the opportunity cost.

63. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System63 A Non-Exploitable Strategy Example. The buyer, v b, has $190 to spend on 1 of 3 options: 1.Buying 3 shirts from an unknown seller for $50 each and insuring the transaction for $40. She values each shirt at $100. 2.Buying 2 pairs of shoes from a reliable retailer for $70 each. She thinks each pair is worth $90. 3.Buying 1 game console for $150, from a reliable online shop. She values the console at $240.

64. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System64 A Non-Exploitable Strategy v b ’s valuation for each of the 3 options is: 1.Shirts: 100 x 3 + 0 (no cash leftover) = $300 2.Pairs of Shoes: 90 x 2 + 50 (cash) = $230 3.Console: 240 x 1 + 40 (cash) = $280 Gains in excess of the opportunity cost are: 300-280=$20. Part of these $20 should be saved to insure future transactions.

65. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System65 A Non-Exploitable Strategy The Strategy: 1.Initially only provide references to known agents or those that leave a security deposit. 2.Insure all trade through references provided by trusted agents. 3.Do not provide more insurance than you can recover. Charge at least the lower bound for providing a reference. 4.Save part of the money received “in excess of the opportunity cost”.

66. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System66 A Non-Exploitable Strategy 150 100 50 OK! $10 saved to provide future insurance 10 Failed! Payment made automatically by v 1

67. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System67 Outline Motivation The Model –Buying references –Selling references A Non-Exploitable Strategy Future Work Conclusion –Key ideas

68. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System68 Future Work Simulation –sensitivity to estimates of p –growth rate of capital –dynamic behavior Price Negotiation –should avoid “double spending” problem –fair distribution among insurers of the premium paid

69. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System69 Outline Motivation The Model –Buying references –Selling references A Non-Exploitable Strategy Future Work Conclusion –Key ideas

70. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System70 Conclusion TrustDavis provides: Accurate Ratings Non-exploitable strategy for honest agents Pseudonym change tolerance Decentralized infrastructure Through the use of References.

71. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System71 Conclusion Key Ideas: Incentive Compatibility –Incentive to accurately rate –Incentive to insure –No incentive to change pseudonym Saving gains in excess of the opportunity cost to insure future transactions.

72. UCDavis, ecs251 Fall 2007 11/29/2007Trust and Reputation System72 The End