Tim Muller

Trust and security are intertwined concepts. When security guarantees are unobtainable, users may be forced to trust others. There is an active field of research trying to design mechanisms to avoid trusting the wrong people (trust systems). Trust systems themselves, however, are also susceptible to attacks. Attacks identified in the literature have subsequently been found performed on existing systems. Typical attacks on trust systems manipulate trust scores. My primary research interest is where trust and security meet: How secure are you when you trust a certain person, especially given that he may have manipulated you into trusting him?

Ultimately, when we want to reason about trust in a security system, we have to acknowledge that attackers will not behave as we want them to. Even the incentives of the attacker are unknown. What is the worst an attacker can do? The idea in our information theoretic approach is that trust ratings contain some amount of information, depending on the probability that the source of the rating is honest. Attackers lower the information content by introducing noise. Increasingly expressive and nuanced models have been published. In "Is It Harmful When Advisors Only Pretend to Be Honest?", we study dynamic behaviour by attackers. Being the first to formally analyse how attackers should change their behaviour to frustrate a trust system, we found some surprising results. In particular, analysing robustness of a system under the "camouflage attack" (attackers are honest until trusted) is to weak to be meaningful. Much more powerful attacks exist.

If we are to apply trust to security systems, then it becomes crucial that the decisions made using ratings are robust. The actual probability that a decision is correct depends on the behaviour of attackers; which is unknown. A decision is robust, if, for all behaviours, the probability of the decision being correct remains above some (high) threshold. The project “Provably Secure Decisions Based on Potentially Malicious Trust Ratings” aims to construct such a solution for existing systems that require robust decisions. The underlying technique is based on Shannon's theorem, using the fact that the information in a rating is non-zero in most cases.

A major difference to other approaches, is that we accept that some users are probably attackers, and build a provably secure system using these potentially malicious users' ratings.

Besides faking ratings, there are other ways to attack a trust and reputation system. One example that I find particularly interesting is the reputation lag attack. It takes time for a reputation to spread, and this can be exploited by an attacker, by acting with a not-yet-plummeted reputation. Any naive discretisation of time might not accurately capture the subtleties of the reputation lag attack. As a continuation of "On Robustness of Trust Systems", we are currently developing a simple tool that can handle a minimal extension of both continuous-time Markov chains and partially observable Markov processes. The idea is that undesirable states should be sufficiently improbable, even with an attacker that can act any (legal) way, at any time.