Managing Trust in Self-organized Mobile Ad Hoc Networks

Transcription

1 Managing Trust in Self-organized Mobile Ad Hoc Networks John S. Baras and Tao Jiang Electrical and Computer Engineering Department Computer Science Department and the Institute for Systems Research University of Maryland College Park College Park, MD wireless and mobile security workshop 1

2 Trust Management in MANETs Lack of trust in mobile ad-hoc networks No trusted centralized authority Resource (power, bandwidth, computation etc.) constraints Rapidly and dynamically changing topology and connectivity Essential and unique properties Uncertainty and incompleteness Local information exchange Distributed computation 2

3 Trust Management System Previous work Public key infrastructure PGP Trust management is a multifunctional control mechanism Security credentials: direct observations or IDS Evidence distribution Evaluation policies 3

4 Trust Management System Previous work Public key infrastructure PGP Trust management is a multifunctional control mechanism Security credentials Evidence distribution Evaluation policies 4

5 Trust Evidence Distribution Swarm Intelligence based: Biologically inspired: biological swarms like ants, bees, etc. Evidence requests are delivered by sending out multiple but simple ant agents that travel the network and try to fetch information for the request. Properties Indirect communications between the agents (ants) (efficiency) Dynamic online optimization using local information (adaptability, scalability) Advantages: Preserve the diversity of evidence Reinforce good quality trust paths by feedback Discover new sources of evidence via random exploration of the network SI scheme can be used both for route discovery and trust evidence discovery (leads to methods for secure routing) 5

6 Ant-Based Evidence Distribution (ABED) -- Certificate Table The certificate table is similar with the distance-vector routing table. The main differences are: Each entry corresponds to a specific certificate instead of destination nodes Values are the probabilities of choosing the corresponding neighbors as the next hop rather than the hop counts to destinations Probability value P ji represents the chance of choosing i as the next node when searching for cert j at node k and n k = 1 P ji = 1 Neighbors Certs Cert 1 Cert 2 Cert m N 1 P 11 P 21 P m1 N 2 P 12 P 22 P m2 N n P 1n P 2n P mn Certificate table of a node k 6

7 ABED -- Types of ants Forward ants Unicast ants: sent out to the neighbor with the highest probability in the certificate table. Broadcast ants: sent out when either no path to the certificate has been explored the information the node has is outdated based on the density of pheromone Backward ants generated by source of requested certificate retraces the path of the forward ant back to the source induces certificate table modifications at each intermediate node according to some learning rule reinforcement 7

8 ABED Simulation Results (I) Delay: the time elapsed from sending out the forward ant to receipt of the first backward ant. Success rate: the percentage of requests for which the requester successfully obtains the certificate. ABED finds the best solution very fast because of randomness in the searching phase. Fast convergence property highly desirable in mobile scenarios. Multiple paths are inherent for swarm intelligence. If only one path is used for request routing, a single failure leads to the failure of the whole request. The multiple path scheme is more resilient. 8

9 Trust Management System Previous work Public key infrastructure PGP Trust management is a multifunctional control mechanism Security credentials Evidence distribution Evaluation policies: on trust establishment and trust revocation Policies that use only local interactions Impact of local interactions on the global characteristics Conditions under which trust spreads to a maximum set, as well as the parameters that speed up or slow down this transition 9

10 Distributed Trust Computation Model Web of Trust Recommendation and delegation Transitivity of trust Two categories Path computation Local interaction The network is modeled as an undirected graph G(V, E) Vertex set V: set of all nodes in the network Edge set E: set of nodes pairs with trust connections Neighbor set N i = {node j e ij in E}, which consists of nodes that are one hop away from i, i.e. they have direct trust relations nodes that are allowed to exchange trust information logical interconnection network nodes that are able to sense, transit or receive information physical wireless links 10

11 Trust computation Trust Computation and Cooperative Games It s restricted to only local interactions Trust decision is made by each node individually Nodes are self-interested Game theoretic methods Provide a framework for modeling individual interactions Understand complex global structures and dynamics of a system composed of a large number of agents with simple local interactions Guide for analytical approach Examples: Ising model, prisoner s dilemma game 11

12 Ising Model A model in physics for the behavior of simple magnets The orientation of each spin in a magnet only depends on its neighbors In Ising model, spins are located on a lattice Math interpretation: s = {s 1,s 2,,s n } is a configuration of n spins in the Ising model, where s j = 1 or -1 indicating spin j is up or down respectively A Hamiltonian, or energy for a configuration s is 1 mh H( s) = - J ss - s T T i V j N i ij i j i i The ground states achieve the minimum of energy 12

13 Ising Model (cont ) For distributed model, spins reduce their own energy individually. This can be interpreted as a game with payoff of each spin equal to 1 π = Jss T i ij i j j N This model can be directly used for distributed trust computation s i be the trust value assigned by i Node i will be assigned a trust value according to the opinion of the majority of its neighbors 1 Let J ij = 1, payoff of i is π i = si sj T To maximize π i, s i will be the same sign as s, which is actually the sign assigned by the majority of the neighbors i j N i j N i j 13

14 Phase Transitions Phase transition is a common phenomenon that takes place in any combinatorial structure Key idea: a large combinatorial structure can be modeled as a system consisting of many locally interacting components Phase transitions are observed in: Ising model: critical temperature T c Evolutionary prisoner s dilemma games on graphs Random graph zero-one law Percolation theory in physics Distributed trust computation? N 0 -N M = N M si T c i =1 Phase transition of total magnetization in Ising model with H = 0 T 14

15 A Simple Computation Policy Based on simple voting methods Voters: Nodes that qualified as legitimate voters by certificates signed by offline servers (have trust evidence about node i) Assume uniformly distributed in the network Policy: decision based on threshold trusted, if Vi > η Ni Node i is neutral, if Vi η Ni V i is the sum of votes node i received (signed sum) η is the decision threshold is the number of i s neighbors N i 15

16 Simple Voting Scheme Trusted nodes Neutral nodes Positive votes Negative votes Number of positive votes on node i: V p,i = 3 Number of negative votes on node i: V n,i = 1 Effective (signed sum) votes: V i = V p,i -V n,i = 2 Given η = 0.3, V i > η N i = 1.8, node i is designated trusted 16

17 Random Graph Model Erdös and Rényi random graphs P sp : percentage of trusted pairs that are connected by at least one secure path, which are composed of trusted nodes As η is small Most of nodes are considered to be trusted P sp is dominated by the edge present probability p in ER random graphs Zero-one law in random graph theory is present (right figure) 17

18 2-D D Lattice 2-D lattices with periodic boundary and 4 exact neighbors or each node Site percolation theory in statistical mechanics Simulation results for P sp vs. decision threshold η In site percolation theory, the critical probability p c = Theoretic analysis: η (0,0.25], p = η (0.25,0.5], p = where p is the probability that a site is voted to be trusted Phase transition happens when η = ε, ε is a small postive number 18

19 Trust Revocation The trust revocation process is initiated: when topology, membership or secure paths change when referees or trust evidence for a node changes when positive votes are timeout or new negative votes are received Decision policy of the revocation process Revocation on a specific node, say j, usually starts from few nodes that have negative observations on j; A node i accepts the revocation on j, if it finds that more than a threshold fraction Φ of its neighbors revoke node j; Question: can a revocation be accepted by a large fraction of nodes in the network? i Trust Revoke 19

20 Phase Transition of Revocation Revocation is launched from a randomly chosen node in an Erdös- Rényi random graph with average degree set as the Y-axis. Global cascade: area that lie inside of the contour represents the percentage of nodes, which accept the revocation, is greater than the value corresponding to the contour The steep of the contours is very sharp, which represents phase transitions 20

21 Dynamics of Trust Spreading Initial islands of trusts Trust spreads Trust-connected network 21

22 Dynamics of Trust Spreading (cont ) Suppose the voting rule is a weighted average 1 ti( n) = ( v jitj( n 1) ) + bi di + bi j Ni n: the discrete time; t i [0,1] : the trust value of node i; v ji [0,1] : the vote value of j on i; d i : the degree of node i; b i : the number of headers that trust node i. Headers are fully trusted nodes and their votes are either with value 1 or with value 0 Suppose η is the threshold for the trustworthiness of nodes, we have our theorem: Trust relationships can be established in the network if and only if for every node i, η bi di v ji ; 1 η j Ni otherwise, none of trust relationships is established 22

23 Spreading Speed and Topology Algebraic graph theory predicts that the second largest eigenvalue has crucial effect on the convergence speed Small-world model by randomly adding new edges on a lattice By adding just 1% more edges, the spreading finishes in ten times less period 23

24 Conclusions A swarm-intelligence based trust evidence distribution scheme is suitable for distributed mobile networks, and provide better performance compared to previous methods Strong connections of distributed trust models and computation to cooperative game theory on graphs Phenomena of phase transitions in distributed trust model link to analytical methods from mathematical physics The effects of topology in distributed computation 24

25 Future work Integrate trust document distribution and distributed trust computation models Apply cooperative game theory in the computation part Evaluate different statistical detection and estimation methods Relate Markov random field methodologies (MRF) with statistical inference methods for trust Further mathematical analysis of swarm intelligence scheme in relation to MRF and simulated annealing Analytical approach to evaluation of distributed trust scheme; random models on graphs, cooperative games, mathematical physics of phase transitions Specify trust computation policies with respect to logic and formal methods; analyze effects on performance Need to incorporate non-monotonic logic along with negative evidence or false evidence; trust revocation Develop fully analytical work using this advanced form of the probabilistic method ; investigate effects of dynamic topologies 25

26 PUBLICATIONS Tao Jiang and John S. Baras, Ant-based Adaptive Trust Evidence Distribution in MANET, Proceedings of 2 nd International Workshop on Mobile Distributed Computing, in conjunction with the International Conference on Distributed Computing Systems, Tokyo, Japan, March John S. Baras and Tao Jiang, Cooperative Games, Phase Transitions on Graphs and Distributed Trust In MANET, invited paper, Proceedings 2004 IEEE Conference on Decision and Control, December Tao Jiang and John S. Baras, Autonomous Trust Establishment, 2 nd International Network Optimization Conference (INOC), 2005, Lisbon, Portugal 26