Trust can be applied to knowledge sharing on a distributed network of knowledge source agents. Each agent represents a person who trusts some other agents. Based on these trust-relationships, an agent can infer the trustworthiness of an unknown agent by asking trusted agents for recommendations. However, the person represented by an agent may not be willing to share his or her individual opinion about the trustworthiness of a particular agent to agents that do not protect information privacy. A solution for this issue is proposed using three kinds of privacy policies: generosity, caution, and non-cooperation. An agent that adopts the caution policy towards another agent will hide the details of the trust recommendation path. An analysis shows the effect of the privacy policies on the calculated reliabilities of the recommended trust values3.
or some combination of the two. In particular, if AgentA knows that AgentB is the final link of a trust chain to AgentC, then AgentA knows that the recommendation is the opinion of the person represented by AgentB because AgentB is not using any other information to infer the recommended trust value. However, the person represented by AgentB may not want his or her opinions to be public.
In our previous work [
The rest of the paper is organized as follows. Section 2 discusses a number of trust models in the literature that are related to our study. The privacy policy used by our approach is described in Section 3. In Section 4, several scenarios demonstrating the performance of the trust-recommendation network generated by the system are analyzed. The analysis shows how the effectiveness of the privacy protecting trust inferring algorithm depends on the situation of the trust network. Finally, in Section 5 we conclude the paper with a description of future work. 2
Privacy has been a hot topic since as early as the 19th century, when an
influential paper “The Right to Privacy” was published. Recently, the primary focus
of privacy has shifted from media privacy, territorial privacy, communication
privacy, bodily privacy, to information privacy as technologies for information
sharing have progressed. The first four aspects of privacy have been well
established in most legal frameworks around the world; however, information privacy
continues to create many problems today [
Goecks and Mynatt [
Our previous work introduced trust and recommendation concepts in a
webbased knowledge sharing system. We presented the RTI algorithm to infer the
trust value for the target agent from the recommendations of other intermediary
agents in the trust chain to the target agent. The RTI algorithm uses negative as
well as positive recommendations to accurately infer trust values of intermediary
agents [
In order to handle the issues that we presented in Section 1, we introduce a set of privacy policies in the RTI algorithm.
Like humans, when an agent receives a request for information on the trustworthiness of a target agent from a requesting agent, it should have the ability to decide what information it will return to the requesting agent. If the agent does not know or trust the requesting agent well, then it may not give any information to it. Even if the agent does know the requesting agent, if it cannot confirm that the requesting agent will protect its privacy, it may just return the information that it does not mind becoming public, such as an inferred trust recommendation for the target agent, and hide the detailed information of the recommendation chain. Only if the agent can confirm that the requesting agent will protect its privacy, will it return the trust recommendation together with all of the detailed information of the trust chain.
We provide three kinds of privacy policies to handle these three kinds of situations: generosity policy, caution policy, and non-cooperation policy.
When an agent AgentA receives a request for information on the trustworthiness of AgentB from AgentC and AgentA trusts that AgentC will protect its privacy by not giving the information to any unreliable agents, then AgentA will adopt the generosity policy and send to AgentC all of the trust recommendation information that it has that might be related to the trust chains to AgentB. If AgentA cannot confirm that AgentC will protect its privacy, but AgentA still wants to give some information to AgentC, then AgentA will adopt the caution policy and send only inferred trust values for AgentB, hiding the detailed information on the trust chain that led to the inference. If AgentA does not know or trust AgentC at all, then AgentA can adopt the “non-cooperation policy” and not give any recommendation information to AgentC.
Using the privacy policy, a person’s privacy can be protected in the following
way. As in our previous trust model, when the source agent wants to know the
trustworthiness of an unknown target agent, it sends out a request for trust
information to the agents that it trusts, specifying a maximum chain length n
(step 6 in our previous trust model [
An agent that is requested for trust recommendations with a maximum length greater than 1 can return a trust value it has for the unknown agent even if it does not adopt the generosity policy. This is because the requesting agent cannot determine whether the recommendation is from the person represented by the agent or an inferred trust value calculated from recommendations of other agents, and so the actual opinions of the person represented by the agent are protected. Furthermore, in order to make full use of the RTI algorithm, an agent A can return the information that it has about an agent B between it and the target agent. However, if agent B is just on link away from the target agent, then the agent receiving the information about agent B from agent A will know the opinions of person represented by agent B. Therefore, agent A should only give this additional information to agents that it trusts highly, i.e. that it can guarantee to agent B to be trustworthy.
In the implementation that we are constructing, each person represented by an agent on the trust network has an interface to set the privacy policy adopted by her agent towards each agent that is known. The agent would initially adopt a default privacy policy, such as the caution policy. Later, the person represented by the agent could change the policy based on her assessment of the trustworthiness of the person represented by the target agent. Because each agent uses different privacy policies for engaging with both known and unknown agents, our modified trust system implements a form of basic privacy protection similar to real human interactions that should provide significantly more accurate trust inference than conventional systems based on statistical analysis of recommendations irrespective of source. 4
First, we revisit the scenario that we described in the previous paper,
reproduced in Fig. 1 [
The reliability of the service or recommendation trust value of an unknown agent can be calculated based on the recommendation trust values of the agents giving recommendations for the trust value of the unknown agent. We do this by giving each recommendation trust relationship a value between 0 and 1. Specifically, we give a low recommendation trust relationship a value of 0.7, a moderate trust relationship a value of 0.8, and a high trust relationship a value of 0.9. By quantifying the recommendation trust relationships in this way, we can combine recommendation trust values both in series (from the chain rule for Bayesian Networks) and in parallel (from the noisy-OR model for Bayesian Networks).
In this paper we add the privacy policies described in section 3 to the RTI algorithm, and we discuss the effect on the accuracy of the inferred trust values. If everyone adopts the generosity policy, Ann will receive all of the trust relationship information, including the identities and trust values of the target agents of each relationship. Therefore, Ann can calculate the inferred trust value of each inner agent in all trust chains and then use the RTI algorithm to obtain the most accurate inferred trust value for Sam.
If Brad and Chad both adopt the generosity policy towards Ann, then we have seen that the result will be the same as for the RTI algorithm with no privacy policy. If Brad adopts the caution policy towards Ann, and only Chad adopts the generosity policy, Ann will receive the information that Eve is dishonest from Chad and the recommendation that Sam is trustworthy from Brad. However, because Brad does not tell Ann that his recommendation came from Eve, Ann will use his recommendation, which she calculates as being more reliable than Diana’s, and she will believe that Sam is highly trustworthy, which is incorrect. If Brad adopts the generosity policy and Chad adopts the caution policy, then Ann will receive all of the recommendation information from Brad. However, because Chad does not have a recommendation for Sam’s trustworthiness since he believes that his only source, Eve, is dishonest, Ann will not receive any information from Chad. Because Ann does not have any information leading her not to trust Eve, she will believe the information from Brad, leading again to the incorrect result. If both Chad and Brad adopt the caution policy, then Ann will receive a recommendation that Sam is trustworthy from Brad and no information from Chad, so Ann will accept Brad’s recommendation and again incorrectly believe that Sam is highly trustworthy. Therefore, only if both Brad and Chad adopt the generosity policy towards Ann will Ann be able to avoid being tricked by Eve through the application of the RTI algorithm.
In general, the addition of privacy policies to the trust model enables each
agent to adopt a different kind of behavior towards each other agent based on
the level of trust it has for the other agent. For example, if one agent has reason
to believe that another agent asking for information is dishonest, it can choose
to adopt the “non-cooperation policy” which in the RTI algorithm means that
no recommendation is returned to the requesting agent. If the agent does not
know anything about the requesting agent, it might adopt the “caution policy”
as a default, giving the requesting agent only the minimum information needed
to make the trust network work and hiding the path information of the other
agents between it and the target agent. If the agent believes that the requesting
agent is trustworthy, perhaps because another trustworthy agent has vouched
for it, the agent can adopt the “generosity policy”, in which case it returns the
recommendation and the path information that it receives from all of the agents
between it and the target agent. Then, the requesting agent can interpret all
of the information that it receives in terms of the original RTI algorithm and
calculate the inferred trust value for the target agent as described in [
Now, we consider a slightly more complicated situation where Eve knows more than two agents and where two of the agents she knows give the same trust recommendation for the target agent. The social network shown in Fig. 2 is composed of seven agents representing the Web users Ann, Brad, Chad, Diana, Eve, Kay, and Mary. Mary is a highly trustworthy service provider. There are eight relationships between the seven agents, forming three chains of trust links that connect Ann to Mary.
In this example, because Kay is the final user in all of the trust chains, Kay must adopt the generosity policy to Eve. Furthermore, if Eve adopts either the caution policy or the generosity policy to Diana, Chad and Brad, the final result will be the same. Therefore, we only need to consider the privacy policies adopted by Diana, Chad, and Brad to Ann. In here, we just consider the following two situations to illustrate the impact of the privacy policies to RTI algorithm.
If Brad and Chad adopt the generosity policy and Diana adopts the caution policy, then Ann will receive the single recommendation of “low trust” for Eve from Chad, and the single recommendation of “high trust” for Eve from Brad, but the recommendation from Diana for Mary will have the aggregated reliability value of 0.7 × 0.9 = 0.63 with no information about who gave the recommendation. Therefore, Ann will calculate the trust value for Eve to be “high trust” because Ann trusts Brad more than Chad for a single recommendation, i.e. Ann calculates the reliability of the second trust chain using H (0.9) replacing L (0.7) for the trust value of Chad to Eve. The final result for the reliability of the recommendation that Mary is highly trustworthy is 1 − (1 − 0.7 × 0.63) × (1 − 0.7 × 0.9 × 0.9) × (1 − 0.8 × 0.9 × 0.9) = 0.91.
If Brad adopts the generosity policy, and Chad and Diana both adopt the caution policy, then Ann will receive the single recommendation of “high trust” for Eve from Brad. The recommendations for Mary from Chad and Diana will not have any information about who gave the recommendations. Therefore, Ann will assign the trust value for Eve to be “high trust”, but she will use the aggregate reliabilities for the recommendations of Mary’s trustworthiness from Chad and Diana of 0.7 × 0.9 = 0.63. The final result for the reliability of the recommendation that Mary is highly trustworthy is 1 − (1 − 0.7 × 0.63) × (1 − 0.7 × 0.63) × (1 − 0.8 × 0.9 × 0.9) = 0.89.
The analyses above show the effect of protecting privacy in the trust network. If the agents adopt the caution policy, information from some trust chains will be lost, and the accuracy of the inferred trust value will decrease. On the other hand, if an agent adopts the generosity policy, then it risks having its privacy information exposed. Our implementation of the RTI algorithm with privacy protection supports dynamic propagation of trust and privacy information in two ways. Whenever an agent receives trust recommendations from highly trusted agents for agents that it knows but does not trust, our implementation allows the agent to update the privacy policies accordingly. Alternatively, any time a person represented by an agent confirms that another agent is either trustworthy or dishonest, that person can manually assign an appropriate privacy policy. Furthermore, when an agent changes its trust level for another agent in either of these ways, it will send the new trust information to all of the agents to which it has adopted the generosity policy, resulting in a push style of trust information transfer. This push style information transfer will only occur between highly trusted agents adopting the generosity policy to each other. Each community of agents will adopt its own guidelines for balancing the risks of trusting a particular agent against the benefits of getting useful information from that agent using all of the trustworthy information that is available to it, much the same way that humans interact in society. Our hope is that this will result in the establishment of reliable recommendation networks where a recommendation for a particular agent will be updated quickly among the highly trusted peers of the recommending agent. Because each agent knows that if it is dishonest, its malicious reputation will be rapidly spread through the peer-based connections of the network, we hypothesize that most agents will be motivated to stay honest and friendly. In this way, we propose that the privacy policies in the trust network will result in a dynamic equilibrium where most agents are honest and adopt generosity policy between each other, which forms a robust network of trust recommendation that rapidly exposes dishonest agents, keeping their numbers down. Then, a high accuracy of inferred trust can be maintained while simultaneously protecting privacy. 5
We plan to continue our research along several directions. First, we will create a trust network that closely simulates real social networks by exhibiting characteristics such as small world behavior. Based on that, we will conduct simulation studies to analyze how the different trust metrics work. Second, we are investigating methods for integrating the trust-recommendation network with the EKOSS knowledge searching and matching system in order to share different quantities and qualities of knowledge with agents that have different trust values.