ATM: an automatic trust monitoring algorithm for service software

ABSTRACT

While providing services to stakeholders, service software can be exploited by potentially untrustworthy users. Given that, it is necessary to monitor the trust relationships between service providers and requestors for potential vulnerabilities they may invite to the total system. In this paper, we propose an Automatic Trust Monitoring algorithm called ATM based on the specification of trust relationships in trust scenarios and the quantification of the relationships through trust calculation schemes. Trust rules are generated from the trust scenarios ready to be deployed at run-time. A service requestor is penalized for the violation of a trust rule and rewarded for no such violation. This analysis facilitates the quantification of the trustworthiness of service requestors and the accuracy of the recommendations from other service providers that can be used to make dynamic decisions on the corresponding requestors. The monitor is implemented in a prototype file sharing grid and evaluated using file sharing applications.

REFERENCES

• 1: Colin English , Sotirios Terzis , Paddy Nixon, Towards self-protecting ubiquitous systems: monitoring trust-based interactions, Personal and Ubiquitous Computing, v.10 n.1, p.50-54, December 2005 [doi>10.1007/s00779-005-0030-y]
• 2: Martin Bichler , Kwei-Jay Lin, Service-Oriented Computing, Computer, v.39 n.3, p.99-101, March 2006 [doi>10.1109/MC.2006.102]
• 3: Gambetta, D. Can we trust trust?, in Trust: Making and Breaking Cooperative Relations, Chapter 13, 1988. University of Oxford: 213--237.
• 4: Mohammad Gias Uddin , Mohammad Zulkernine, UMLtrust: towards developing trust-aware software, Proceedings of the 2008 ACM symposium on Applied computing, March 16-20, 2008, Fortaleza, Ceara, Brazil [doi>10.1145/1363686.1363875]
• 5: Shrija Rajbhandari , Arnaud Contes , Omer F. Rana , Vikas Deora , Ian Wootten, Trust Assessment Using Provenance in Service Oriented Applications, Proceedings of the 10th IEEE on International Enterprise Distributed Object Computing Conference Workshops, p.65, October 16-20, 2006 [doi>10.1109/EDOCW.2006.70]
• 6: Mohammad Gias Uddin , Mohammad Zulkernine , Sheikh Iqbal Ahamed, CAT: a context-aware trust model for open and dynamic systems, Proceedings of the 2008 ACM symposium on Applied computing, March 16-20, 2008, Fortaleza, Ceara, Brazil [doi>10.1145/1363686.1364176]
• 7: Farag Azzedin , Muthucumaru Maheswaran, Trust Modeling for Peer-to-Peer Based Computing Systems, Proceedings of the 17th International Symposium on Parallel and Distributed Processing, p.99.1, April 22-26, 2003
• 8: Sandro Etalle , William H. Winsborough, Integrity constraints in trust management, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1063981]
• 9: Ravi Sandhu , Xinwen Zhang, Peer-to-peer access control architecture using trusted computing technology, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1064005]
• 10: T. Ryutov , Li Zhou , C. Neuman , N. Foukia , T. Leithead , K. E. Seamons, Adaptive Trust Negotiation and Access Control for Grids, Proceedings of the 6th IEEE/ACM International Workshop on Grid Computing, p.55-62, November 13-14, 2005 [doi>10.1109/GRID.2005.1542724]
• 11: Wanita Sherchan , Seng W. Loke , Shonali Krishnaswamy, A fuzzy model for reasoning about reputation in web services, Proceedings of the 2006 ACM symposium on Applied computing, April 23-27, 2006, Dijon, France [doi>10.1145/1141277.1141722]
• 12: Ching Lin , Vijay Varadharajan, Trust Based Risk Management for Distributed System Security - A New Approach, Proceedings of the First International Conference on Availability, Reliability and Security, p.6-13, April 20-22, 2006 [doi>10.1109/ARES.2006.139]
• 13: Nathan Dimmock , András Belokosztolszki , David Eyers , Jean Bacon , Ken Moody, Using trust and risk in role-based access control policies, Proceedings of the ninth ACM symposium on Access control models and technologies, June 02-04, 2004, Yorktown Heights, New York, USA [doi>10.1145/990036.990062]
• 14: Dimmock, N., Bacon, J., Ingram, D., Moody, K. Risk models for trust-based access control (TBAC), in Proc of the 3rd Annual Conf on Trust Management (LNCS v3477), 2005. Springer: 364--371.
• 15: Sudip Chakraborty , Indrajit Ray, TrustBAC: integrating trust relationships into the RBAC model for access control in open systems, Proceedings of the eleventh ACM symposium on Access control models and technologies, June 07-09, 2006, Lake Tahoe, California, USA [doi>10.1145/1133058.1133067]
• 16: Keith Rochford , Brian Coghlan , John Walsh, An Agent-Based Approach to Grid Service Monitoring, Proceedings of the Proceedings of The Fifth International Symposium on Parallel and Distributed Computing, p.345-351, July 06-09, 2006 [doi>10.1109/ISPDC.2006.7]
• 17: Bellifemine, F., Caire, G., Poggi, A., Rimassa, G. Jade: A white paper, in EXP in Search of Innovation, 3(3); 2003.
• 18: Snyder, C., Southwell, M. Preventing SQL injection, in Pro PHP Security, SpringerLink: 249--261.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.2 Types of Systems
          Subjects: Decision support (e.g., MIS)

Keywords:
interaction, monitoring, trust