Surework: A Super-peer Reputation Framework for P2p Networks

Transcription

1 Surework: A Super-peer Reputation Framework for P2p Networks ABSTRACT Manuel Rodriguez-Perez manuelr@entel.upc.edu Reputation systems are proved mechanisms used to help nodes to decide whom to trust, to maintain the overall credibility of the system and to promote collaboration. This paper presents Surework, a reputation framework based on Super-peers. In Surework, peers form clusters around Superreputation-peers (Sure-peers) who help to increase the reputation knowledge. Surework introduces incentives in order to promote that nodes with higher capabilities become Super-peers and assume more tasks than normal peers. Reciprocity is also promoted by encouraging peers to provide better services to most reputable client peers. Categories and Subject Descriptors C.2.4 [Distributed Systems]: Distributed applications; H.3.5 [Online Information Services]: Data sharing General Terms peer-to-peer, reputation, reciprocity, super-peer Keywords peer-to-peer reputation framework, promotion of collaboration and reciprocity 1. INTRODUCTION Reputation systems are proved mechanisms to prevent malicious behaviours and to promote collaboration. Reputation systems encourage honest cooperation, discouraging nodes from changing their identities. Peer-to-peer (p2p from here on) networks are usually heterogeneous as they consist of a set of peers with different capabilities [12]. Pure p2p networks do not take advantage of this heterogeneity. P2p networks based on Super-peers are more efficient, as they distribute tasks among peers according with their capabilities. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. SAC 08 March 16-20, 2008, Fortaleza, Ceará, Brazil Copyright 2008 ACM /08/ $5.00. Oscar Esparza oesparza@entel.upc.edu Departament d Enginyeria Telemàtica Universitat Politecnica de Catalunya Barcelona, Spain 2019 Jose L. Muñoz jlmunoz@entel.upc.edu In this paper, we present a novel distributed reputation scheme called Surework, which is based in the Super-peer paradigm. Surework promotes that nodes with high reputation scores become Super-peer nodes for reputation, acting as reputation servers. The problem of managing trust in p2p systems, can be partitioned into three subproblems [1]: Define a global model of trust. Determine the local algorithm that each peer applies to determine trust. Specify the framework for data and communication management. This paper is focused on the third subproblem. We specify how reputation information is stored and shared among peers. We also define which parameters must be computed but we do not detail how. The rest of the paper is structured as follows: in Section 2, we present the state of the art about reputation schemes. Section 3 presents Surework, our reputation framework for p2p networks. In Section 4 we show the main advantages and drawbacks of our proposal while in Section 5 we evaluate Surework. Finally, we conclude in Section STATE OF THE ART Several distributed reputation schemes specifically designed for p2p systems have been proposed in the literature. Next we present the most significative proposals by terms of how they specify the framework for data and communication management. The local reputation system [9] is a very simple distributed reputation where the reputation knowledge is restricted to own experiences. Systems based on voting mechanisms [3, 14, 13] provide an enhanced knowledge of peers reputation but at the expense of increasing network load and computational costs. R. Gupta proposed a system based on certificates [4] where peers form groups called trust groups (TGrp) in order to help to propagate positive satisfaction certificates of the associated peers. However TGrp management is not clearly specified, so TGrp operation adds several security weaknesses. EigenTrust [7] is an algorithm for trust management where some other peers compute the reputation score of a peer. Although this algorithm is designed as a secure algorithm it presents some limitations, especially against collusion attacks. Mekouar et al. [11] propose a reputation management scheme designed for Superpeer networks where Super-peers compute the reputation

2 and credibility scores of all their associated peers. This system presents several weaknesses, especially when the Superpeer and its associated peers collude. PeerTrust [15] stores reputation information for each peer as feedback certificates by using a distributed hash table. Peers compute reputation scores dynamically by getting these feedbacks and weighting them according to different factors. One drawback of this approach is that assumes that peers will collaborate altruistically with the reputation system. In TruthRep [5] several consultants (Super-peers) collect evaluations and compute reputation scores of their leaf nodes. However, peer disaffiliation is not considered. 3. SUREWORK 3.1 Definitions Sure-peer A Super-Peer is a node in a p2p network that operates as a server to a set of clients and as an equal in a network of Super-peers [16]. In Surework, peers form reputation clusters around Sure-peers, sending their reputation information to their Sure-peer in order to increase the knowledge of the cluster about other peers reputation Peers In Surework, any peer that is not a Sure-peer is simply called a peer. We distinguish peers depending on if they are members or not of a reputation cluster. Single-peers are peers that are not a members of a cluster while Engagedpeers are peers that are members of a reputation cluster. 3.2 System Requirements Surework has been designed in order to address the following requirements: Scalability and Fault Tolerance. Enlargement of the reputation knowledge. Promotion of reciprocity. In Surework reciprocity is achieved by encouraging the server peers to provide different qualities of service. Sure-peer reciprocity. Unlike all previous proposals, Surework introduces incentives in order to promote that nodes with higher capabilities become Sure-peers. Free affiliation. All of the cluster members are free to break off their relationship at any moment, without losing their accumulated reputation. Promotion of cooperation with the reputation system. Unlike all of the previous proposals, in Surework peers are interested in sharing their reputation information. 3.3 Single-peer Operation In this Section we briefly describe the tasks that Singlepeers carry out by distinguishing when they act as a client or when they act as a server. We also introduce cluster engagement (see Section 3.3.2). Single-peer acting as client: Service discovery. When a single-peer wants to get a service from the p2p network, it gets the list of peers that are willing to provide the requested service by using the resource discovery protocol of the p2p network Consult local reputation database. From the list of candidates, the single-peer selects the most reputable peers by consulting its local reputation database. Service request. In order to get the service the client may require to request service to more than one server. If the server is member of a cluster, it will present its affiliation certificate. Update of the local reputation database. From this experience the single-peer updates its local reputation database (see Section 3.3.1). Single-peer acting as server: Consult local reputation database. When a single-peer receives a service request it checks its local reputation database to get the reputation of the service requester. Application of local policies. Each single-peer applies its own policy to decide whether it provides the service or not. The decision criteria may depend on the client s reputation or on the available resources. Service provision. If the single-peer provides the service, its quality will depend on the reputation of the requester Maintenance of the Local Reputation Database In Surework, peers will always keep this local reputation database (which is updated from their previous experiences) independently if they are engaged or not to a reputation cluster. This database is a trusted and reliable source of reputation information for that peer Cluster Engagement Any single-peer can try to join a cluster if it considers the reputation of the associated Sure-peer good enough. In a transaction, both client and the server can identify themselves as members of a reputation cluster by presenting an affiliation certificate (Section details the structure of these certificates). So then, after several transactions single peers will know the existence of some clusters of the system, and hence they can try to join them. To do that, the single peer sends an affiliation request to a Sure-peer, which evaluates the affiliation request based on its engagement policy. If the request is accepted, the Sure-peer sends an affiliation acknowledgment message including the new affiliation certificate. 3.4 Engaged-peer Operation In this Section we briefly describe the tasks that engagedpeers carry out when they act as a client, when they act as a server and those related to cluster management. Engaged-peer acting as client: Service discovery. Engaged-peers use the discovery protocol to get the list of available service providers. Consult local reputation database. From the initial list of candidates, the engaged-peer selects the most reputable peers by consulting its local reputation database. Consult cluster reputation database. Unlike singlepeers, it also sends the list of candidate servers to its Sure-peer (see Section 3.4.1).

3 Score aggregation. The engaged-peer computes the final reputation score by means of an aggregation algorithm (see Section 3.4.2). Service request. At this point, the client requests the service to one or more of the selected servers. Update of the local reputation database. From new experiences the engaged-peer updates its local reputation database. Transaction certificate. Finally, the engaged-peer generates and sends a transaction certificate to its Surepeer (see Section 3.4.3). Engaged-peer acting as server: Consult local reputation database. This query is done to know the reputation of the service requester. Consult cluster reputation database. As when acting as client, the engaged-peer sends the identity of the client to its Sure-peer (see Section 3.4.1). Score aggregation. Server aggregates both local and cluster reputation information to get the final reputation score of the client. Application of local policies. As single-peers, an engagedpeer applies its own policy to decide whether it provides the service or not. Service provision. If the server decides to provide the service, it is provided according to the reputation of the service requester Querying the Cluster Reputation Database When acting as servers or as clients, engaged-peers ask the Sure-peer in order to increase their reputation knowledge. When the Sure-peer receives the query, it checks the reputation scores of each peer on its reputation database and sends them back to the requester Score Aggregation In every transaction, the final reputation score of each candidate (server or client) is computed by means of an aggregation algorithm based on the local information and the information received from the Sure-peer. In the literature we can find several aggregation algorithms [8] Transaction Certificate After the service transaction, the client can generate a digital document to express its opinion about the transaction. The transaction certificate is the way the (engaged) clients share their reputation opinions about other peers acting as servers with their Sure-peers, and hence with the rest of members of the cluster. The transaction certificate includes: Server and client identifiers. The identifier of the server s Sure-peer (if applicable). A time-stamp to prevent its reuse. The signature of the client The engaged-peers of a cluster are promoted to send their transaction certificates. If an affiliated peer does not send transaction data to the Sure-peer, the Sure-peer can interpret that the node has low cooperation and the member is exposed to lose its affiliation. The Sure-peer updates the cluster reputation database from the information sent by the cluster members (see Section 3.5.4). As the cluster reputation database is available for all the members, they will have an extended scope of the reputation of the system proportional to the number of members of the cluster. This is the way in which engagedpeers take advantage of their affiliation Computing Sure-peer s Credibility The local reputation database is used to check the trust on the Sure-peer. After each information request to its Surepeer, the engaged-peer compares the information received from the Sure-peer with the one in its local database in order to check its consistence and to obtain a credibility score of the Sure-peer. The engaged-peer can also send requests to the Sure-peer only to update the Sure-peer s credibility Affiliation Renewal When the affiliation certificate expires, the engaged-peer can request an updated certificate. As engaged peers check the credibility of the information reported by their Surepeer, they can break their affiliation at any moment and become a single-peer or try to join another cluster. Notice that when a peer changes of cluster it does not decrease its reputation score because in Surework, nodes have an individual reputation score. This fact limits the dependence of individual peers on its Sure-peer. In the same manner, the Sure-peer can lose its trust on an affiliated peer (e.g., if it has a low cooperation or credibility ratios). To evict a member, the Sure-peer does not renew the associated affiliation certificate. 3.5 Sure-peer Operation When acting as a client or as a server a Sure-peer follows the same protocol as an engaged-peer. It is remarkable that when Sure-peers act as clients, the servers add a reputation increase to the reputation of the Sure-peer. This is because the opinion of the Sure-peer is more influential than the opinion of individual peers (see Section 3.5.4). The reputation increase can be proportional to the estimated reputation of the cluster. Notice that this is an extra motivation to be Sure-peer: peers are encouraged to become Sure-peers because they obtain a reputation plus because of their bigger contribution to the system Cluster Creation Theoretically, any node in the network can become a Surepeer, but in practice only the most reputable peers will receive affiliation requests. When an ordinary peer wants to become a Sure-peer, it issues an affiliation certificate for itself and from then on, it presents this affiliation certificate in all its service transactions. Sure-peer can also contact its known peers to let them know its new role Affiliation Processing Single-peers that want to become members of a cluster send their affiliation requests to the associated Sure-peer. When a Sure-peer receives a request, it checks its reputation

4 Figure 1: Transaction Success Rate (TSR) for local, voting and Surework reputation systems. database to decide if it accepts or not the new member. A Sure-peer can limit the number of members of the cluster, depending on its capabilities, such as memory or bandwidth. If the Sure-peer decides to admit the requester, it generates a new affiliation certificate, which is sent to the requester. If not, it answers with an affiliation deny message. The affiliation certificate includes: Affiliated peer Identifier. Sure-peer Identifier. A Validity Period. The signature of the Sure-peer. Engaged-peers and Sure-peers present this affiliation certificate in every service transaction to prove their membership to the cluster and to prove that they are a Sure-peer Cluster Dissolution A Sure-peer can become again a single-peer or an engagedpeer. If any of this happens, the reputation cluster managed by the Sure-peer must disappear. The smarter way is that the Sure-peer sends a dissolution message to each member of the cluster. However, in some circumstances, this might not be possible. In this case, cluster members observe that the Sure-peer has stopped making its specific tasks. Once the cluster is not alive any more, the members have to choose if they try to become an engaged-peer of another cluster or if they become single-peers Cluster Reputation Database Sure-peers are also nodes that interact, as clients or servers, with other peers. From their own experiences and the transaction certificates received from the cluster members, Surepeers are responsible for the maintenance of the cluster reputation database. As reputation information derived from the Sure-peer experiences is more trustworthy, the aggregation algorithm will weight the information depending on its origin. It must be stressed that Sure-peers have direct access to this reputation database, so they can consult this database as often as they want and they can also perform searches to find out the most reputable nodes of the system ADVANTAGES AND DRAWBACKS Surework has been designed to address the requirements detailed in Section 3.2. As peers always maintain their own local reputation database, the system is fault tolerant to Sure-peer unavailabilities. Reciprocity is achieved by encouraging peers to provide different qualities of service to service requests according to their reputations. As they will we served according to their reputation, service providers will also provide better services to more reputable peers in order to maximize their reputation. Surework is completely self-managed: nodes can change their affiliation or role depending on their own interest without losing their accumulated reputation. However, Surework also introduces some drawbacks. Surework increases system complexity and computational cost. However, this complexity is distributed according to the capabilities of each node. A malicious Sure-peer can condition the operation of all the peers that compose its cluster. However, as engaged-peers compute a credibility score, the effects of a malicious Sure-peer will be transitory. A malicious node acting as an engaged-peer can also condition the operation of the cluster. However, from the peer s credibility score, the Sure-peer may detect the malicious behaviour and deny renewing its affiliation. 5. PERFORMANCE EVALUATION 5.1 Simulation Details We have performed several simulations to evaluate the Surework approach. However, due to space limitations, the conclusions presented in this paper are only a subset of the obtained results. From the study of the different p2p simulation tools [2], we decided to use PeerSim [6]. We evaluated local, voting and Surework reputation systems. The parameters of our simulations are similar to those used in [10]. We simulated a fully connected power-law network of 5000 nodes, with an initial reputation rating set to 0.3 where malicious nodes always provide bad services and feedbacks. In Surework, when peers act as servers they provide three different qualities of service depending on the reputation of the server. In our simulations we focused on two performance parameters: The Transaction Success Rate (TSR from here on, which is computed as the relation between the number of successful services and the total number of services) and the distribution of the Transaction Success Rate among peers depending on their reputation. 5.2 Results Figure 1 shows the TSR with regard to the number of transactions performed by each node. The 30 percent of nodes are malicious. The graph presents several interesting observations. First we see an obvious gain of TSR of Surework when number of transactions is below 500. It is worth noting, that experimental results [12] point that the number of transactions performed by each peer is normally very low compared with the total population of the system. In this case, when the number of transactions is set to 50 Surework outperforms voting and local reputation system by a factor of 1.12 and 1.20, respectively. Second, the gain of TSR is reduced when the number of transactions increases. This is because as the number of transactions of each peer is relatively high compared to the network population, each peer

5 Figure 2: Transaction Success Rate (TSR) with regard to reputation of each peer in Surework. Most reputable peers get better success rate. Malicious peers are clearly identifiable. accumulates a high knowledge of the peers reputation, so all the systems tend to provide similar performances. However, even in this situation Surework outperforms voting and local reputation systems. Figure 2 shows the TSR with regard to reputation of each peer in Surework. The graph shows a very interesting behaviour. Peers are grouped in three categories depending on their reputation. Malicious nodes (20% of the population) get a poor TSR (0.42 in average) while the small rightmost group represents the 10 percent of Sure-peers of the system, which get a high TSR (0.84 in average). The third group represents the majority of the peers who get a TSR that finally depends on their reputation (0.76 in average). Combining previous results we can see that although the average TSR for Surework tends to 0.70 (Figure 1), non-malicious peers get a better success rate (up to 0.84) than in previous proposals, where all the peers get the same quality of service (even malicious peers). 6. CONCLUSIONS In this paper we present a reputation system called Surework. In Surework peers form reputation clusters around Super-reputation-peers (Sure-peers) in order to increase reputation knowledge. Surework introduces incentives to promote that nodes with higher capabilities become Sure-peers. Reciprocity is also promoted by encouraging peers to provide better services to most reputable peers. When we evaluate the Transaction Success Rate, results show that Surework outperforms voting and local reputation systems up to 12 and 20 percent, respectively. Simulations also show how Surework implements reciprocity. Malicious peers are clearly identifiable and get a poor Transaction Success Rate while most reputable peers get a success rate up to twice as much as malicious peers. Acknowledgments This work is funded by the Ministry of Science and Education under the projects SECCONET (CICYT - TSI C02-01), ITACA (CICYT TSI C02-02) and ARES (CONSOLIDER-INGENIO-2010 CSD ) REFERENCES [1] K. Aberer and Z. Despotovic. Managing trust in a peer-2-peer information system. In Tenth International Conference on Information and Knowledge Management, [2] A. Brown and M. Kolberg. Tools for peer-to-peer network simulation. Internet Draft: draft-irtf-p2prg-core-simulators-00. [3] E. Damiani, S. De Capitani di Vimercati, S. Paraboschi, and P. Samarati. Managing and sharing servents s reputations in p2p systems. In IEEE Transactions on Knowledge and Data Engineering, volume 15, [4] R. Gupta and A. K. Somani. Reputation management framework and its use as currency in large-scale peer-to-peer networks. In Fourth International Conference on Peer-to-peer Computing, [5] J. Han and Y. Liu. Dubious feedback: fair or not? In InfoScale 06: Proceedings of the 1st international conference on Scalable information systems, [6] M. Jelasity, A. Montresor, G. Jesi, and S. Voulgaris. Peersim: A peer-to-peer simulator. [7] S.D. Kamvar, M.T. Schlosser, and H. Garcia-Molina. The eigentrust algorithm for reputation management in p2p networks. In Twelfth International Conference on World Wide Web, [8] Z. Liang and W. Shi. Performance evaluation of rating aggregation algorithms in reputation systems. In First International Conference on Collaborative Computing, [9] S. Marti and H. Garcia-Molina. Identity crisis: Anonymity vs. reputation in p2p systems. In Third International Conference on Peer-to-Peer Computing, [10] S. Marti and H. Garcia-Molina. Limited reputation sharing in p2p systems. In Fifth ACM Conference On Electronic Commerce, [11] L. Mekouar, Y. Iraqi, and R. Boutaba. Detecting malicious peers in a reputation-based peer-to-peer system. In 2nd IEEE Consumer Communications and Networking Conference, [12] S. Saroiu, P. Gummadi, and S. Gribble. A measurement study of peer-to-peer file sharing systems. In Multimedia Computing and Networking, [13] S. Song, K. Hwang, R. Zhou, and Y. Kwok. Trusted p2p transactions with fuzzy reputation aggregation. IEEE Internet Computing, 9(6), [14] L. Srour, A. Kayssi, and A. Chehab. Reputation-based algorithm for managing trust in file sharing networks. In Securecomm and Workshops, 2006, [15] L. Xiong and L. Liu. Peertrust: Supporting reputation-based trust for peer-to-peer electronic communities. IEEE Transactions on Knowledge and Data Engineering, 16(7), [16] B. Yang and H. Garcia-Molina. Designing a super-peer network. In 19th International Conference on Data Engineering, 2003.