TrustDavis: A Non-Exploitable Online Reputation System

Transcription

1 TrustDavis: A No-Exploitable Olie Reputatio System Dimitri do B. DeFigueiredo Uiversity of Califoria Davis Departmet of Computer Sciece Davis USA defigueiredo@ucdavis.edu Earl T. Barr Uiversity of Califoria Davis Departmet of Computer Sciece Davis USA barre@acm.org Abstract We preset TrustDavis a olie reputatio system that provides isurace agaist trade fraud by leveragig existig relatioships betwee players such as the oes preset i existig social etworks. Usig TrustDavis ad a simple strategy a hoest player ca set a upper boud o the losses caused by ay malicious collusio of players. I additio TrustDavis icets participats to accurately rate each other resists participat s pseudoym chages ad is iheretly distributed. 1 Itroductio Some olie auctio sites have formalized the meas by which idividuals provide feedback o buyers ad sellers. Loosely speakig we call such mechaisms olie reputatio systems. A reputatio system collects distributes ad aggregates feedback about participats past behavior [13]. Examples are ebay s Feedback Forum 1 ad the feedback ratigs at overstock.com. Such systems usually attribute a ratig to a particular idetity. Ideally idividuals with good ratigs are reliable trade parters whereas idividuals with poor ratigs should be avoided 2. Ufortuately the reputatio systems ow available o the iteret ca be maipulated by malicious idividuals or groups for selfish purposes. For example a group ca collude to artificially improve a idividual s ratigs with the itet of trickig ususpectig victims ito tradig with someoe that will ever deliver the goods. This is the well kow hit ad ru problem to which all usecured bilateral exchage is susceptible as there is always the temptatio to receive a good or service without reciprocatio [10]. This problem is aggravated olie as may trade parters are veiled by relative aoymity ad rarely trade. 1 See the ebay website at for a descriptio of the Feedback Forum. 2 Here we assume that past behavior is idicative of future behavior. Mechaisms that have bee proposed to mitigate such problems have achieved limited success [5 1]. Ideally we wat a reputatio system that resists malicious maipulatio by groups of colludig parties or at least that provides a strategy that hoest participats ca use to limit their exposure to such maipulatio. TrustDavis has this property as well as three others these properties are: Hoest participats ca limit the damage caused by malicious collusios of dishoest participats. Malicious participats gai o sigificat advatage by chagig or issuig themselves multiple idetities. There is strog icetive for participats to provide accurate ratigs of each other. It reuires o cetralized services ad thus ca be easily distributed. To our kowledge TrustDavis is the first olie reputatio system proposed that ca provide hard limits o the risk exposure of participats ad combies these properties. The outlie of the paper is as follows. Sectio 2 briefly reviews of the curret literature focusig o motivatig the three properties ot yet discussed i detail. Sectio 3 describes the basic framework of the system the use of refereces. Sectios 3.1 ad 3.2 obtai upper ad lower bouds o the price of refereces. Sectio 4 describes a strategy that helps hoest players avoid exploitatio by malicious oes. I sectio 5 we summarize our results ad provide suggestios for further research. 2 Related Work A importat differece betwee real world reputatios ad olie reputatios is that it may be possible to shed a bad olie reputatio by simply chagig oe s olie pseudoym. This is a challege that reputatio systems should address [13]. This cheap pseudoym characteristic of olie iteractio imposes fudametal costraits o

2 the degree of cooperatio that ca be achieved ad to how well ewcomers are treated by the commuity [6]. I Trust- Davis the ability to issue multiple idetities or to chage idetity does ot provide a sigificat advatage to a malicious party sice a malicious party must back each idetity with fuds that other players ca use to protect their trasactios. We see olie reputatio systems ad trust iferece protocols as two sides of the same coi sice both mechaisms deal with the trust trasitivity problem. I both cases oe must ifer the reliability trustworthiess of a aget based o oe s ow experiece ad the experiece of others. There have bee uite a few proposals i the literature that address the trust trasitivity problem each with its ow set of desiderata [ ]. Some proposals that address the trust trasitivity problem allow each party arbitrary cotrol over the ratigs they provide [7]. Thus oe idividual may rate all of his acuaitaces as extremely reliable trustworthy. This offers flexibility but it may also allow malicious parties to trick the system by ratig other parties udeservedly well. Some improvemet o the uality of the ratigs ca be achieved if idividuals are ot allowed to rate others arbitrarily. A good example of such a approach is the EigeTrust trust iferece algorithm for peer-to-peer etworks [8]. I Eige- Trust there is a ormalizatio step that implies that peers oly have a limited amout of trust to assig to each of their eighbors. I fact oe ca argue that peers are oly assiged a relative trust value i EigeTrust ot a absolute oe 3. We believe it is desirable to esure hoest reportig of the past behavior of other participats as poited out i [13 12]. I the system we propose there is a strog icetive for idividuals to rate others accurately through refereces sice they are liable for bad refereces. Usually oe of the goals of havig a reputatio system is to elicit better behavior from participats by providig the right icetives. It ca be very useful i distributed systems such as peer-to-peer etworks to make systems icetive compatible. For example the free-rider problem ca be see as icetive compatibility issue. Thus it is desirable to have a reputatio system that ca be distributed to eable its deploymet i distributed applicatios such as peer-topeer etworks. TrustDavis depeds solely o paths betwee trasactig parties ad is as a result iheretly distributed. 3 The Model We view agets or players as vertices i a graph. Iitially agets publish iformatio about other agets whom they kow ad trust by publishig refereces 3 Ufortuately it is still possible to trick EigeTrust ito attributig a udeservedly high ratig to a idividual by obtaiig multiple idetities. to them. Each referece is a acceptace of limited liability. We expect existig social relatioships to be represeted after this iitializatio. Parets would give refereces to their kids ad spouses. Busiess parters would give refereces to fellow workers frieds would provide refereces to frieds ad so o. Idividuals with o refereces ca joi TrustDavis through the use of security deposits. They would simply leave a deposit with a member of the etwork that would the provide refereces to the ewcomers. The ewcomers should choose a trustworthy member for this task. This poits out two issues: Parties assume liability take risks whe they provide refereces ad thus refereces should be provided oly to trusted parties. There should be some icetive for parties to provide refereces ad take o risk. Thus parties ca fuctio as isurers ad charge a premium for the refereces they provide. If player gives a referece to player i the value of $100 the player would be willig to accept limited liability for bad trade caused by. I other words if were to default paymet o a trasactio would be willig to pay the creditor up to $100. Similarly if failed to ship a product should be willig to reimburse the buyer for paymets already made up to the total of $100. We say that would be willig to accept liability because the referece is oly a statemet of s itet. Before accepts liability she eeds to check two thigs: Whether someoe else is already usig the referece reuested; ad Who is askig for the referece. This should be doe i real-time olie to avoid duplicate usage of a sigle referece. I our graph there is a directed edge goig from vertex to vertex if gives a referece. Each edge is labeled by the value of the referece provided ad each edge label ca be see as the maximum flow capacity for that edge. Note that a vertex cotrols the flow o all its outboud edges by cotrollig the refereces it provides to other parties. If vertex wats to buy a product valued at $x dollars from vertex the both vertices ca complete the trasactio with o risk if the aggregate etwork flow capacity from to ad vice versa is of a value larger tha or eual to x. To isure himself agaist bad behavior from vertex the buyer obtais eough flow capacity to cover the value of the trasactio from each vertex i the paths from to. Similarly to isure the trasactio with the seller

3 v b v1 v2 v v s Now if parties are always willig to provide refereces ad claims are udisputed the ca cheat by also askig for a referece from ad later claimig that did ot deliver the product. This strategy ca provide with a extra $50 at o cost. This problem will be addressed i sectios 3.3 ad 4.3. I sectio 3.1 below we will describe TrustDavis from the poit of view of the purchaser ad i sectio 3.2 we will cosider the same problem from the poit of view of the isurer. 3.1 Payig for Refereces Figure 1. A simple example etwork edges deote how much liability odes are willig to accept. also obtais refereces from eough vertices so that the aggregate flow i the opposite directio i.e. from to is at least eual to the value of the trasactio. I a sese we are goig to reduce the trust trasitivity problem to a etwork flow problem. Cosider the situatio depicted i Figure 1. Assume all vertices are willig to provide refereces ad furthermore that claims are udisputed i.e. always paid whe reuested. I this sceario vertex ca purchase goods valued at up to $150 from vertex. To isure himself obtais: a referece valued at $100 from agaist bad behavior of. a referece valued at $50 from agaist bad behavior of. a referece valued at $50 from agaist bad behavior of. Similarly to isure the trasactio should obtai: a referece valued at $150 from agaist bad behavior of. Oce these refereces are obtaied the trasactio ca go ahead ad either party will lose moey if the other party misbehaves. If for example does ot deliver the service/product ca simply obtai the $150 paid by cotactig ad. If declies to pay the ca recover this loss by askig for a further $50. I the case that declies to pay the $150 the s origial assessmet of providig a referece for i the value of $150 was icorrect ad should have deposited sufficiet fuds upo s etry to the system to cover this situatio see sectio 4.1. Suppose that i order to provide a icetive parties are paid for the refereces they provide. We view this as each party becomig a isurace broker who will sell a referece or isurace relatig to a specific trasactio. How much should each party be paid for the refereces they provide? First cosider the situatio where the referece is provided to a party that will uder o circumstace make a false claim ad thus is ultimately trusted. For example could be s mother. I this case ca be certai that if makes a claim the it was because did ot deliver the product as agreed. Although s trust i assures him that he will ot have to pay for false claims made by he has o guaratee that will fulfill his ed of the trasactio. Thus is still takig some risk. If takes o this risk ad is ot appropriately rewarded for it as would be the case if were my mother! a seuece of bad trasactios could evetually drive him bakrupt. The criterio we use to establish how much should be paid for the refereces he provides is that of o riskless profitable arbitrage. The approach followed here was proposed i [4] for pricig stock optios. The idea is as follows. We assume that is oly iterested i the trasactio because her valuatio for the good beig provided is higher tha the price at which the product is offered i.e.. Furthermore there are oly two possible outcomes to the trasactio betwee ad : the trasactio completes successfully ad pays dollars ad receives a good worth! ; or delivers a product of iferior uality or does ot deliver ad loses her paymet but gets a product valued at. 4 This situatio is show i Figure 2a where # ad$ are the probabilities that the trasactio goes well or fails respectively. Figure 2b depicts the two possible outcomes of the 4 Agai %'& is ultimately trusted so she always pays if the trasactio occurs.

4 > * * 0 trasactio betwee ad that hold whe the trasactio is isured uder TrustDavis. I the model pays to obtai a referece from where agrees to pay the amout if the trasactio fails. The isurace premium is ot recovered by after the trasactio is over; thus i order to isure herself agaist a bad trasactio must be willig to share part of the proceeds that she would obtai from a successful trasactio with the isurer. We also assume that ca perform /. riskless borrowig ad ledig at a iterest rate of +*- 100 % over the period of oe trasactio uder this assumptio 2 dollars before the trasactio become * 2 afterward. We view borrowig ad ledig moey as sellig ad buyig bods at rate *. Furthermore buyig goods from ca be see as acuirig the rights to get the same goods delivered. The ecoomic value of those rights may fluctuate ad is oly set oce the delivery actually materializes. We ca ow determie a upper boud o how much is willig to pay for the privilege of receivig a referece that will provide her with dollars if does ot fulfill his ed of the trasactio. EXAMPLE 1: Assume that ca borrow ad led moey at a rate of * She wishes to purchase 3 shirts that are o sale at the discout price of $50 dollars each. She has see the very same shirts advertised for $100 dollars at a differet store ad is suspicious that the items o sale are of iferior uality ad i reality are oly worth $25. For a et cost of 30 dollars ca make sure she will ot lose moey i the trasactio: 1. Istead of buyig 3 shirts she buys 2 ad waits to buy the third later savig $ She adds $30 of her ow moey ad leds the resultig $80 by buyig a bod. The trasactio either succeeds or fails. If the trasactio goes well the shirts are worth $100 each. She will have missed the opportuity to buy oe shirt at the cheaper.87 price of $50. However she will have obtaied dollars from her loa ad she ca use the moey obtaied to purchase the remaiig shirt as desired at $100 each. I this case she is able to obtai the 3 shirts for the added cost of $30 which brigs her to a total of : 60<;=:0 dollars. If the trasactio fails the shirts are oly worth $25 dollars each. She ca sell the shirts obtaiig dollars. Addig this sum to the $100 obtaied from the loa she recovers her origial : dollars she risked o the trasactio 5. 5 Of course she lost the isurace premium of $30 but we ca modify the values i the example to icorporate the premium. We see that $30 is a upper boud o how much would be willig to pay for refereces to isure the trasactio sice for $30 she ca isure herself as described. We view the above example as a situatio i which purchases ot oly the shirts she wats but also a hedgig portfolio to isure the trasactio. If the trasactio fails the portfolio will pay dollars if it succeeds the portfolio s et worth will be zero. The portfolio purchased is such that the sum of both actios buyig the shirts ad buyig the portfolio results i the desired outcome whether or ot the trasactio succeeds. If the trasactio succeeds the the goods are obtaied for the desired price ad if the trasactio fails the portfolio will pay dollars. I the example above was willig to pay the amout of $50 for a good that at the ed of the trasactio would be worth either $100 or $25. Thus buyig goods olie from is very similar to buyig shares i the stock market where oe caot predict the future value of those shares. With this i mid we eed to establish the compositio of the hedgig portfolio that will eable us to achieve the desired outcomes. Before the trasactio the hedgig portfolio is composed of > shares 6 ad bods. Its value cost is >?@;A dollars per item i the example above this meas per shirt. The hedgig portfolio isures the trasactio by providig dollars if the trasactio fails ad zero dollars if it succeeds. I other words after the trasactio the portfolio must be valued at: CB ED 0 dollars if the trasactio goes well; or dollars if the trasactio fails. We kow that after the trasactio each share will be valued at! if the trasactio succeeds * ad if it fails. Similarly all bods will be valued at. Thus to fid the compositio of the hedgig portfolio we eed to solve for > ad the euatios: yieldig >-F; >?8; CB!ED *G D B B D *G We view a share as a cosummated purchase that provides the right to get a item delivered. Thus if a party has a positive umber of shares it has the right to receive products. O the other had if a party has a egative umber of shares it has the obligatio to deliver products.

5 L * U without isurace v b has: before after before with isurace v b has: after us us S S+C p ds p ds+k a b Figure 2. The two possible situatios a ode may face. Thus the hedgig portfolio is composed of > shares ad bods as described by the euatios above ad its price before the trasactio is give by >?H;I or more explicitly: J*K * 3 Examiig Euatio 3 above provides a ituitive view of the compositio of the cost of isurace i TrustDavis. The ratio ML is simply the value of time corrected to the period before the trasactio. The uatities * ad all describe per dollar values. Thus is then* amout risked per dollar i the trasactio. Similarly is the fractio of the total capital risked that is above the riskless iterest rate. See [4 sectio 3] for more details. Note also that > is usually egative meaig that the purchaser of the portfolio should short sell that amout i shares 7. I the example above we assumed that if the trasactio PO falls through the buyer ca recover the value 46 per item by sellig the items after the trasactio. Thus for to recover the $50 she spet per shirt eed oly be $25 per item. Substitutig the values of Example 1 ito euatios 1 ad 2 we obtai that the hedgig portfolio 7 for oe item i.e. for oe shirt has > QL: ad 0LK:. 3.2 Miimizig Risk Above we aalyzed the situatio from the poit of view of the purchaser ad obtaied a upper boud o the price of a referece. Now we look at the same situatio from the poit of view of the isurer ad establish lower bouds o the same price. 7 I other words oe should acuire the obligatio to deliver goods at a later time. Oe pays a egative price for acuirig a obligatio. I Example 1 provides a referece. Two differet circumstaces may arise uder which has to decide whether or ot to provide a referece: We may have a decisio problem where the price is willig to pay for a referece of dollars is already fixed say as a percetage of the total trasactio. I this case should decide whether or ot to provide such referece. Alteratively may wish to place a bid to provide such a referece. I this case eeds to establish a lower boud so that it does ot lose moey by biddig too low ad assume too much risk for the reward. Both of these situatios differ from the ivestmet sceario we cosidered i 3.1 we assume has o say i how much of the moey total available for each referece will be used. We assume faces a take it or leave it situatio i which the buyer already kows what trasactios she wishes to perform ad how may items she wishes to buy thus the trasactio value is fixed. This extra costrait eables us to fid precise lower bouds o the price ad thus to establish whether providig such a referece is a good propositio for. To begi the aalysis let us formulate the problem faces i the same way we did for. This is show i Figure 3. For each item decides to isure he risks dollars of his capital. I exchage it keeps the isurace premium o his ivest-. Thus possibly obtais a retur of R;TS met if the trasactio goes well. We assume that has a fud with a iitial total of VXW dollars ad is also able to estimate the probability the trasactio may fail $. If risks too much moey i each trasactio it isures the gambler s rui may occur. We follow the reasoig preseted i [15] to obtai a upper boud o the amout that ca be

6 o o S # Z u o ; ; o whe providig isurace v 1 has: before K p after K+C Figure 3. Isurer s poit of view. risked or euivaletly a lower boud o the price by usig the Kelly criterio [9]. The Kelly criterio assumes that each trasactio ca be repeated idefiitely i a seuece of rouds. Deotig by V W the iitial capital ad by VJY the capital available after roud Z the Kelly criterio suggests we should maximize the expected value of the growth rate of capital: [ ]\_^a`bfc V Y fhg V W!d/e We deote by Vjilk the total capital has available for isurig a particular trasactio at roud 8 m. Assumig risks a fractio of Vjilk at roud m ad the trasactio succeeds we have: po to V i r!v i+k s; V i+k Similarly if the trasactio fails gets to keep oly the isurace premium. trasactio is give by: VXi!Vji+k ; C I this case the wealth after the VXilk o Thus s wealth after Z rouds is give by: V Y VXWNu /v ; /wyx Vji+k where is the umber of times the isured trasactio succeeds good ad is the umber of times the isured trasactio fails bad. Obviously ;z Z. Calculatig the 8 If %9{ has a separate sub-fud of total capital -}~ { for each party % ad is usig the strategies describe i sectio 4 the %Q{ caot be successfully exploited by a malicious party but the overall growth coefficiet for the sum of all sub-fuds may be smaller tha it would be if the same fud is used for all parties ad defaults are radom evets. See chapter 15 i [3]. V ilk expected value of the growth rate coefficiet we have: ƒ ^a`b Š Š ZXŒ ^a`b o ^ `b o ^a`b o [ ]\_^a`bfc VXY fhg V W!d/e v Z ^ `b o Š ^ `b o ZXŒ ^ `b o ;F$ fh w x e ˆ Solvig the above euatio umerically for [ 0 ad differet values of $ yields the miimum values for the ratio U show i the graph of Figure 4. Note that if receives a value that yields smaller ratios tha the oes show the the growth rate is egative ad gambler s rui will occur. Alteratively if the price provides larger returs the isurer s capital will grow at a [ rate Dealig with False Claims Up to this poit we have cosidered situatios where the party receivig the isurace is cosidered ultimately trusted: There were o false claims. We will call this the o false claims sceario NFC. Now we take ito accout the possibility that the isured party may cheat ad stake a udue claim that the isurer has to pay. Similarly we call this the false claims sceario FC. The aalysis i 3.2 was doe i the NFC sceario. We cosidered a successful trasactio oe i which the isurer kept the moey ad the premium. A failed trasactio is oe i which the isurer has to pay dollars. Because we made o assumptios about the reasos a trasactio may fail the same aalysis still holds uder FC. We oly eed to chage the probability that the trasactio may fail $ to reflect the ew risks. 4 Strategies I this sectio we preset a strategy for tradig olie ad providig refereces that eables a hoest idividual to limit how much damage a malicious collusio of players ca do. I all cases we assume that a potetial trader will 9 The miimum growth rate desired ca be set to a value large tha zero such as the zero risk iterest rate. Œ

7 Ž Cost/Isured Value C/K Miimum Retur/Risk Ratio for Differet Failure Probabilities p=1% p=2% p=5% p=10% p=20% Isured value as a fractio of total fuds f Figure 4. Miimum cost of a referece as a fuctio of the fuds available ad the probability of failure. oly egage i trade if his valuatio for the goods beig bought or sold is larger tha the opportuity cost of the trasactio. EXAMPLE 2: Assume that has $190 to sped ad is cosiderig buyig a few gifts olie. She arrows dow her search to 3 good deals. She ca: 1. Buy 3 shirts for $50 each from a ureliable source isurig the trasactio for $40. She thiks each shirt is worth $ Buy 2 pairs of shoes for $70 each from a reliable retailer. She thiks each pair is worth $ Buy 1 game cosole for $150 also from a reliable olie shop. She thiks the cosole is worth $240. Assumig that moey leftover is ot spet if chooses alterative 1 ad the trasactio goes well she will have obtaied =300 worth of goods for isurace=190. dollars. Choosig optio 2 she will have leftover cash=230. dollars worth i goods ad cash for the same =190 dollars. Similarly if she chooses alterative 3 she will have leftover cash=280 dollars worth. Clearly her best optio is to buy the shirts. We cosider the opportuity cost of that trasactio to be the value of the secod best optio $280. I the example above if the trasactio goes well obtais a extra =20 dollars through tradig with that she would ot have obtaied had ot bee available. Furthermore because the trasactio was isured did ot risk ay moey to obtai the extra $ Uder these coditios we suggest that to isure herself for future trasactios should save $5 of the $20 obtaied i a fud that will provide refereces to. I doig so is extedig a credit lie a fairly commo busiess practice. 4.1 A Strategy Whe There Are No False Claims We ca ow describe a o-exploitable strategy for tradig ad providig refereces olie. We first cosider the NFC sceario. To avoid exploitatio proceeds as follows: 1. Durig the iitializatio step oly provides refereces to agets she trusts ad that will ot default o their obligatios. She ca also provide refereces to agets that leave a security deposit uder her cotrol. 2. oly egages i isured trasactios by obtaiig refereces for them through the idividuals she trusts. 3. After every trasactio buy or sell saves part of the gais obtaied i excess of the opportuity cost i separate fuds that are liked to each trade parter to 10 We assume the isurace was such that she would also receive $280 dollars if the trasactio failed. A similar argumet ca be made if %s& receives $190 i isurace i case the trasactio fails but ca still buy the cosole after receivig the isurace moey.

8 Ž i Ž provide refereces for them. This helps her to isure future trasactios with each parter. 4. provides refereces to others by chargig premiums as described i sectio 3.2. This provides some cofidece that the moey saved will grow at a specified rate. Agai each premium received is put i a separate fud that is liked to the aget it isured agaist bad behavior of ot the aget who paid for it. Because oly egages i isured trasactios this strategy limits s exposure to the total amout i the fuds i for all i she is willig to provide a referece for. This value i is oly chaged by addig moey eared through tradig i excess of the opportuity cost or through sellig refereces. I either case the fuds have bee obtaied through the tradig i TrustDavis ad from the parties they may beefit. 4.2 A Alterative Algorithm for Obtaiig Refereces I the NFC sceario all refereces are directly obtaied by the party beig isured. Thus itermediate odes will pay isurace i the evet of a failed trasactio directly to the isured party. I this sceario the isured party is the same for all itermediate odes. Itermediate odes also provide isurace agaist bad behavior of other itermediate odes. Thus the party beig isured isures a trasactio by walkig the paths from itself to the party they wish to trade with as described i sectio 3. We assume some efficiet distributed algorithm is used to fid such paths. This procedure makes price egotiatio easy as all commuicatio occurs betwee the aget askig for the refereces ad the agets providig refereces with o itermediaries. I the FC sceario the above algorithm caot be used because some isurers may o loger trust the party askig for the referece. We chage the algorithm described i sectio 3 as follows: whe wats to make a purchase from she oly asks her eighborig odes to provide refereces for the trasactio. Her eighbors i tur ask for refereces o their ow behalf from their eighbors alog a path from themselves to. Oce those refereces are established ad is reached the replies propagate back to. I Figure 1 this correspods to the followig seuece of reuests ad replies: 1. asks for a referece valued at $150 agaist bad behavior of ad waits for a reply. 2. asks for a referece valued at $50 agaist bad behavior of ad waits for a reply. 3. verifies that he trusts both ad more tha $50 ad replies to providig the referece. 4. verifies that he has at least $150 dollars of flow capacity to both ad ad replies to providig a referece. 5. goes ahead with the trasactio. Note that by usig this algorithm the beeficiaries of the refereces provided are always eighborig odes ad more complicated price egotiatio is reuired because the party payig for the isurace is ot i direct commuicatio with the isurers. 4.3 A No-Exploitable Strategy Let us call a party agaist whose misbehavior a referece is provided the object party. Also let us call the party that receives moey if a trasactio fails the isured party. The party providig the referece is the isurer. Cosider applyig the strategy described i sectio 4.1 above to the example i Figure 1 usig the algorithm described i sectio 3 i the NFC sceario. Whe provides a referece to agaist bad behavior of limits his liability to the capacity of the edge from to i.e. $100. Similarly is also asked to provide a referece agaist bad behavior of ad he also limits his liability to the capacity of the edge from to $50. So s total liability for the trasactio is $150. I the FC sceario the outcome of the trasactio o loger relies oly o the trustworthiess of it also depeds o. If provides refereces to with a total value that is smaller tha the total etwork flow capacity from to 11 the ca recover potetial losses caused by by withdrawig moey from the appropriate fuds. I Ž the example this is. Before doig so must perform due diligece ad establish that the trasactio failed due to ad ot. If the trasactio fails due to the ca oly recover $100 from his ow fuds. Thus if G is to provide the same total liability of $150 he should obtai from a referece for himself agaist bad behavior of. By obtaiig this referece from simply limits his liability to the smallest of the two flows to ad to. This is the strategy we propose should be used. It reuires the algorithm described i sectio 4.2. I the FC sceario whe a isurer provides a referece that referece will be uclaimed oly if both the isured ad the object party behave appropriately. Therefore it is too restrictive to deposit the premium received for providig this referece i a fud liked exclusively to the ame of the object party as i the NFC sceario. This is because 11 Note that the total etwork flow capacity from %K{ to % & i Figure 1 is $300 but each path ca oly be used oce i the followig discussio. Thus we oly cosider the edge %Q{' %'& as a retur path to % & sice a%9{' %' ad %9{' % ' are already beig used i the forward directio to lik to %'.

9 the isurer caot be exploited by likig this fud to either party ad likig it to oly oe party uecessarily limits the umber of trasactios the isurer ca be ivolved i. A more flexible approach is to have yet aother fud that ca be used to provide refereces to either party. I summary to adapt the strategy proposed i sectio 4.1 to the FC sceario participats eed to perform three actios differetly: As described i sectio 4.2 the isurer must acuire isurace by obtaiig refereces from his eighbors whe asked to isure a trasactio flow that is greater tha his direct capacity to isure as measured by the capacity of the edge from him to the object party. Whe providig refereces the isurer has to limit his liability to the miimum of the two flows 1. from the isurer to the isured party; 2. from the isurer to the object party. Lik moey received through sellig refereces ot oly to the object party but to the pair isured party object party. 5 Coclusio I this paper we proposed a reputatio system with the followig four importat properties: Hoest participats ca limit the damage caused by malicious collusios of dishoest participats. Malicious participats gai o sigificat advatage by chagig or issuig themselves multiple idetities. There is strog icetive for participats to provide accurate ratigs of each other. It reuires o cetralized services ad thus ca be easily distributed. We thik iterestig directios for future research are to explicitly address issues that may arise withi the framework due to the time varyig value of moey ad to aalyze protocols for price egotiatio ad fidig paths distributively. 6 Ackowledgmets Dimitri would like to especially thak Matt Frakli for may isightful coversatios. Refereces [1] Z. Abrams. R. McGrew ad S. Plotki Keepig Peers Hoest i EigeTrust i Proceedigs of the Secod Workshop o the Ecoomics of Peer-to-Peer Systems [2] S. Buchegger ad J. Y. Le Boudec A Robust Reputatio System for P2P ad Mobile Ad-hoc Networks i Proceedigs of the Secod Workshop o the Ecoomics of Peer-to- Peer Systems [3] T. M. Cover ad J. A. Thomas Elemets of Iformatio Theory Joh Wiley & Sos [4] J. C. Cox S. A. Ross ad M. Rubistei Optio Pricig: A simplified Approach Joural of Fiacial Ecoomics [5] C. Dellarocas Buildig Trust O-Lie: The Desig of Robust Reputatio Mechaisms for Olie Tradig Commuities chapter VII i Iformatio Society or Iformatio Ecoomy? A combied perspective o the digital era edited by G. Doukidis N. Myloopoulos ad N. Pouloudi Idea Book [6] E. J. Friedma ad P. Resick The Social Cost of Cheap Pseudoyms Joural of Ecoomics & Maagemet Strategy vol. 10 issue [7] J. Golbeck B. Parsia ad J. Hedler Trust etworks o the sematic web i Proceedigs of Cooperative Itelliget Agets 2003 Helsiki Filad August [8] S. D. Kamvar M. T. Schlosser ad H. Garcia-Molia The EigeTrust Algorithm for Reputatio Maagemet i P2P Networks i Proceedigs of the Twelfth Iteratioal World Wide Web Coferece WWW2003 Budapest Hugary May ACM [9] J. L. Kelly A ew iterpretatio of iformatio rate. Bell System Techical Joural [10] P. Kollock The Productio of Trust i Olie Markets. i Advaces i Group Processes Vol. 16 edited by E. J. Lawler M. Macy S. Thye ad H. A. Walker Greewich CT JAI Press [11] S. Lee R. Sherwood ad B. Bhattacharjee Cooperative Peer Groups i NICE IEEE Ifocom April [12] P. Resick R. Zeckhauser Trust amog stragers i iteret trasactio: Empirical aalysis of ebay s reputatio system. I Workig paper for the NBER Workshop o Empirical Studies of Electroic Commerce [13] P. Resick R. Zeckhauser E. Friedma ad K. Kuwabara Reputatio Systems Commuicatios of the ACM Vol. 43 No. 12 Dec [14] T. Riggs ad R. Wilesky A Algorithm for Automated Ratig of Reviewers i Proceedigs of the First ACM/IEEE-CS joit coferece o Digital libraries 2001.

10 [15] L. M Rotado a E. O. Thorp The Kelly Criterio ad the Stock Market The America Mathematical Mothly Vol. 99 No. 10 Dec [16] B. Yu ad M. P. Sigh Distributed Reputatio Maagemet for Electroic Commerce Computatioal Itelligece. Vol. 18 No. 4 November