Architectural support for trust models in decentralized applications

ABSTRACT

Decentralized applications are composed of distributed entities that directly interact with each other and make local autonomous decisions in the absence of a centralized coordinating authority. Such decentralized applications, where entities can join and leave the system at any time, are particularly susceptible to the attacks of malicious entities. Each entity therefore requires protective measures to safeguard itself against these entities. Trust management solutions serve to provide effective protective measures against such malicious attacks. Trust relationships help an entity model and evaluate its confidence in other entities towards securing itself. Trust management is, thus, both an essential and intrinsic ingredient of decentralized applications. However, research in trust management has not focused on how trust models can be composed into a decentralized architecture. The PACE architectural style, described previously [21], provides structured and detailed guidance on the assimilation of trust models into a decentralized entity's architecture. In this paper, we describe our experiments with incorporating four different reputation-based trust models into a decentralized application using the PACE architectural style. Our observations lead us to conclude that PACE not only provides an effective and easy way to integrate trust management into decentralized applications, but also facilitates reuse while supporting different types of trust models. Additionally, PACE serves as a suitable platform to aid the evaluation and comparison of trust models in a fixed setting towards providing a way to choose an appropriate model for the setting.

REFERENCES

• 1: Alfarez Abdul-Rahman , Stephen Hailes, A distributed trust model, Proceedings of the 1997 workshop on New security paradigms, p.48-60, September 23-26, 1997, Langdale, Cumbria, United Kingdom [doi>10.1145/283699.283739]
• 2: Karl Aberer , Zoran Despotovic, Managing trust in a peer-2-peer information system, Proceedings of the tenth international conference on Information and knowledge management, October 05-10, 2001, Atlanta, Georgia, USA [doi>10.1145/502585.502638]
• 3: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 4: Blaze, M., Feigenbaum, J., et al. RFC 2704 - The KeyNote trust-management system version 2. http://www.faqs.org/rfcs/rfc2704.html, 1999.
• 5: Cahill, V., Gray, E., et al. Using Trust for Secure Collaboration in Uncertain Environments. IEEE Pervasive Computing Mobile and Ubiquitous Computing. 2(3), p. 52--61, Aug, 2003.
• 6: Licia Capra, Engineering human trust in mobile system collaborations, Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering, October 31-November 06, 2004, Newport Beach, CA, USA
• 7: Yang-Hua Chu , Joan Feigenbaum , Brian LaMacchia , Paul Resnick , Martin Strauss, Referee: trust management for Web applications, World Wide Web Journal, v.2 n.3, p.127-139, Summer 1997
• 8: Ernesto Damiani , De Capitani di Vimercati , Stefano Paraboschi , Pierangela Samarati , Fabio Violante, A reputation-based approach for choosing reliable resources in peer-to-peer networks, Proceedings of the 9th ACM conference on Computer and communications security, November 18-22, 2002, Washington, DC, USA [doi>10.1145/586110.586138]
• 9: Boris Dragovic , Evangelos Kotsovinos , Steven Hand , Peter R. Pietzuch, XenoTrust: Event-based distributed trust management, Proceedings of the 14th International Workshop on Database and Expert Systems Applications, p.410, September 01-05, 2003
• 10: Pascal Fenkam , Harald Gall , Mehdi Jazayeri , Christopher Kruegel, DPS: An Architectural Style for Development of Secure Software, Proceedings of the International Conference on Infrastructure Security, p.180-198, October 01-03, 2002
• 11: Grandison, T. and Sloman, M. A Survey Of Trust in Internet Applications. IEEE Communications Surveys. 3(4), Dec, 2000.
• 12: Grandison, T. and Sloman, M. Trust Management Tools for Internet Applications. In Proceedings of the 1st International Conference on Trust Management. Crete, Greece, May, 2003.
• 13: Gray, E., O'Connell, P., et al. Towards a Framework for Assessing Trust-Based Admission Control in Collaborative Ad Hoc Applications. Distributed Systems Group, Department of Computer Science, Trinity College, Report TCD-CS-2002-66, 2002.
• 14: Sepandar D. Kamvar , Mario T. Schlosser , Hector Garcia-Molina, The Eigentrust algorithm for reputation management in P2P networks, Proceedings of the 12th international conference on World Wide Web, May 20-24, 2003, Budapest, Hungary [doi>10.1145/775152.775242]
• 15: Kan, G. Gnutella. In Peer-to-Peer: Harnessing the Power of Disruptive Technologies, Oram, A. ed. p. 94--122, O'Reilly, 2001.
• 16: Kazaa. kazaa.com. http://www.kazaa.com.
• 17: Lee, S., Sherwood, R., et al. Cooperative peer groups in NICE. In Proceedings of the IEEE Infocom. San Francisco, USA, Apr 1-3, 2003.
• 18: Josep M. Pujol , Ramon Sangüesa , Jordi Delgado, Extracting reputation in multi agent systems by means of social network topology, Proceedings of the first international joint conference on Autonomous agents and multiagent systems: part 1, July 15-19, 2002, Bologna, Italy [doi>10.1145/544741.544853]
• 19: Paul Resnick , Ko Kuwabara , Richard Zeckhauser , Eric Friedman, Reputation systems, Communications of the ACM, v.43 n.12, p.45-48, Dec. 2000 [doi>10.1145/355112.355122]
• 20: Sabater, J. and Sierra, C. REGRET: A Reputation Model for Gregarious Societies. In Proceedings of the 4th Workshop on Deception, Fraud and Trust in Agent Societies. Montreal, Canada, 2001.
• 21: PACE: An Architectural Style for Trust Management in Decentralized Applications, Proceedings of the Fourth Working IEEE/IFIP Conference on Software Architecture (WICSA'04), p.221, June 12-15, 2004
• 22: Suryanarayana, G. and Taylor, R.N. A Survey of Trust Management and Resource Discovery Technologies in Peer-to-Peer Applications. UCI Institute for Software Research, Technical Report UCI-ISR-04-6, Jul, 2004.
• 23: Richard N. Taylor , Nenad Medvidovic , Kenneth M. Anderson , E. James Whitehead, Jr. , Jason E. Robbins , Kari A. Nies , Peyman Oreizy , Deborah L. Dubrow, A Component- and Message-Based Architectural Style for GUI Software, IEEE Transactions on Software Engineering, v.22 n.6, p.390-406, June 1996 [doi>10.1109/32.508313]
• 24: Tierney, K. Research Overview: Emergency Response. In Proceedings of the The NEHRP Conference and Workshop on Research on the Northridge, California Earthquake of January 17, 1994. Richmond, California, 1998.
• 25: G. Vigna , R. A. Kemmerer, NetSTAT: A Network-Based Intrusion Detection Approach, Proceedings of the 14th Annual Computer Security Applications Conference, p.25, December 07-11, 1998
• 26: Ting Yu , Marianne Winslett , Kent E. Seamons, Interoperable strategies in automated trust negotiation, Proceedings of the 8th ACM conference on Computer and Communications Security, November 05-08, 2001, Philadelphia, PA, USA [doi>10.1145/501983.502004]
• 27: Zetter, K. Kazaa delivers more than tunes. Jan 9, 2004. http://www.wired.com/news/business/0,1367,61852,00.html.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
        D.2.11 Software Architectures

General Terms:
Design, Security

Keywords:
architectural style, decentralization, peer-to-peer (P2P), reputation, software architecture, trust management