iTrust Workshop, Dortmund <br> 6-9 October 2004

All + All -

iTrust Workshop, Dortmund
6-9 October 2004

+ - Law
- + - Trust and Financial services
  - Olav Torvund
  - Financial sector
    - 1000's of banks
    - Sophisticated users of IT
      - Info-only services
    - Can be viewed as networked organization
    - What is value of VISA?
      - The network?
  - Trust?
    - Subjective
    - Some people trust George W?
    - Law is about reasons to trust
      - If we trust the system
      - and trust the lawyers
    - Belief, tradition, reputation and marketing
    - Long time to establish, no time to destroy
  - Building trust
    - Identify risks
    - Evaluate risk
      - Probablility
      - Consequences
      - Reputation
    - Address the risk
      - (too many offload onto customers)
  - What's at risk?
    - Money
    - Reputation
    - Privacy
    - House
      - (status quo?)
    - Health
    - Life
    - (time, hassle?)
  - For financial services
    - Only money at risk
    - May be better to compensate than prevent
    - Reputation is also important
    - Cannot compensate life & personal injury
      - cf. Pinto
  - 40 years ago
    - Banks wanted our money
    - Convince us to use cheques
    - Why should a merchant trust?
      - Bank has no obligation to pay
      - Guarantees
  - 20 years ago
    - Norway moving to paperless security
    - Paper we could see...
    - How to convince market paperless was reliable?
      - Strict liability
      - But can they pay?
      - Insurance
      - Joint unlimited guarantees
  - Double speak
    - "Trust us", but we don't accept liability
  - Barclays 1985
    - B2C electronic comm new
    - No common disclaimers: "we trust us"
  - Can we trust banks
    - Risk management
      - (e.g. in EU law)
      - Minmum capital req?
      - Maximum exposure to single customer
      - Supervision
      - Internal control
      - Deposit insurance
  - Lamfalussy principles - operational risks (BIS)
  - Netting
    - Inter-bank via central bank
    - Net position settlement on daily basis
    - + - Large transactions settled in real time
      - 0.1% volume = 90% value
    - Multilateral netting
      - Nett nett (across multiple parties)
    - Juristiction
    - Liquidity
    - Incentive and capability
    - Limits on credit exposure
  - Systemic risk
    - One failure cascades
    - Lamfalussy IV
    - Bank of New York, Bonn market, computer problems, (19 years ago?)
      - 15Bn overdraft
      - Threatened financing of US budget deficit
  - Rating systems
    - Third party expert
    - Customer / user rating
  - Classic fraud
    - New player
    - Act serious for a while
    - Someone enters high value transaction
    - Take the money and run
  - Evidence
    - Access control no evidential security
    - We may need to be able to prove misdeed
    - Assume access control works
  - Summary
    - Sound reasons to trust
    - ...
- + - IPR helpline
  - See handouts
  - Chaos computer club vs Phographic industry
    - (Or: US big business vs everyone else?)
  - Discussion of "trust" and copyrights and security.
  - Cannot circumvent DRM in EU law: now !?!
    - EU law relates more specifically to copy control
    - Debate about doing so for private use
  - "Trusted computing" you can't trust?
  - It's an ideological issue
    - (so is it being worked out in the right forum?)
    - Increasingly impossible to use data without copying it
    - The right to control copying becomes the right to control access
  - Simon Shiu asks about history of successful laws
  - Privacy
- + - Reputation system and data protection
  - Tobias Mahler, Oslo
  - Reputation systems
    - Communicate evlauation of conduct of subject
    - Used in decisions about subject
    - Encourage participation by enhancing trust
    - Incentive for compliance with obligations
    - Supplement national legislative domains
  - Concerns
    - User: can I trust the reputation system
    - User: can I trust the users (who judges?)
    - Decision maker: can I trust the data in the system? (data quality)
  - Data protection law provides some answers
    - Fair processing
    - ???
  - + - Correlate
    - Principles of data protection law
    - Reputation systems
      - Consent
        Freely given
        
        Specific
        
        Informed
      - Identity management
        Real world or pseudonym
        
        Personal if:
        Data about
        
        Identified person
        
        Person is identifiable
      - Reputation profiles
        Facts
        Rules of collection
        
        What is collected
        
        What purposes
        
        Data quality
        
        Evaluations/opinions
        Still personal data
        
        rectify an opinion?
        
        cross-comment
        
        (opinions; state what you would change?)
      - Disclosure properties
        Principle of restricted
        
        Require consent?
    - Principles
      - Fair
      - Purpose
      - Minimality
      - Information quality
      - Data subject participation
      - Disclosure limitation
      - Special rules for sensitive data
  - Data protection law
    - Personal data
    - Other data is out of scope
    - But corporations have similar interests
    - Sources
      - Directives
      - National laws
      - Principles that transcend these
  - Conclusion
    - Reputation systems can be usefully informed by data protection laws.
    - Corporations can be included
  - Question from floor
    - Difference between professional service vs amateur rating system?
- + - Legal Risk Analysis and reputation systems
  - Frederik Vraalsen, SINTEF ICT, Oslo
  - Conventional legal anlsis focuses on legal requirements and consequences
  - Want to incorporate legal analysis into bigger picture
  - Model based risk analysis
    - Analysis has target, in context of organization
    - Asset - having value
    - Threat
    - Vulnerabity
    - Unwanted incident
    - Frequency
    - Effect
    - Treatment
    - (from CORAS)
      - Uses elements of UML
      - (mis-use-case diagram)
  - Applies MBRA to legal issues
    - Legal assets
    - Legal risks/vulnerabilities
    - Adverse legal findings
    - Media exposure of negative judgement
  - Laws and regulations can be viewed as threats, also as treatments
  - Existence of legal framework may enable business interaction
  - Is this trust?
  - Consider trust in service vs trust in subject
- My comments
  - Daniel Weitzner (W3C lawyer)
    - Transparency paradox:
+ - Social Science
- + - A socio-cognitive model of trust
  - Rino Falcone, ICST, Italy
  - (Also speaking for Christiano Castelfranchi)
  - Part of ALPHABiiTE
  - + - Introduction to trust
    - Many definitions.
      - Bond of society
      - Willingness to be vulnerable...
      - Subjective probability ...
      - 3 expectations... order, performance, fulfilment of obligations
    - Trust helps agents cope in social environment
    - How do humans deal with trust problems?
    - What is new in new (computing) environment?
      - identification
      - perception
      - space-temporal context
      - authorities and guarantees
      - nature of interaction
      - rules of collaboration
    - Approaches
      - Gane theoretic
      - Security
      - Modal logics
      - Other operational
      - Socio-cognitive
    - Ambiguous
      - Simple evaluation (disposition)
      - ...?
  - + - Socio-cognitive model static
    - Basic theory in terms of necessary mental states and decision to delegate
    - "cold" model, i.e. rational only
      - no emotional/affective component
    - Assumptions
      - Only a cognitive agent can trust
      - Mental attitude
      - only w.r.t. goal
    - beliefs
      - competence
        know-how
        
        self confidence
        
        ability
      - availability/willingness
        intents
        motivation
        
        morality
        
        fear of authority
      - unharmfulness
        goodwill
        
        safety
        
        ...
      - dependence
        X depends on Y
        
        X beliefs about self
        motivation
        
        ability
        
        ...
        
        X needs Y (strong)
        
        X assisted by Y (weak)
      - environment
        opportunities
        
        adversities
      - (internal, external trust...?)
        different agents mightbelieve differently
        
        differant (rational) agents believe same?
    - Decision to trust -> delegation
  - + - Socio-cognitive model dynamic
    - Agents for change
      - direct experience
        increasing trust
        
        past facts _can_ be interpreted causally
      - change sources
      - change risks of delegation
      - change emotional state
      - modification of environment
    - Classical view
      - success -> increase trust
      - failure -> reduce trust
      - begs determination of success/failure
    - Better view
      - modelling trust as simple index is unreasonable
      - reasons for success/failure
        internal
        
        external
        
        occasional
        maybe hold trust constant?
        
        be alert to similar circumstances
        
        stable/persistent
    - Endogynous factors
      - Trust itself can influence trust
      - e.g. A trusting B increases B trusting A
      - Awareness of belief may affect behaviour
      - Some complex logical expressions here
      - Trustworthiness
      - Weak delegation; A exploits existing action of B
      - Trustworthiness may change in response to belief/trust
    - Strong delegation
  - + - Questions/comments
    - Computationa model?
      - Must try
    - Organizations as cognitive agents
      - Some functions may correspond
    - Validation
      - Simukation w/fuzzy cognitive maps
      - Pshych experiments not enough?
Philosophy
+ - Computer Science
- + - Trust and Credential-based
  Access Control
  - Joachim Biskup, Dortmund
  - Security, access control, monitoring and crypto
  - + - Centralized system assumptions
    - Known identities
    - Known observable properties
    - Secure channel to kernel
    - Trust established out-of-band
  - Real worls hidden, virtual wordl visible
  - + - Link document world/real world
    - Document semantics
    - Presumed correspondence
    - Keys proxy real identities
      - Public keys for encryption
      - Public keys for verification
  - + - Approach
    - Issue "free" properties
    - Bound properties for service access
    - Converting free properties to bound
  - + - Checking free properties
    - Check signature
    - Decide if issuer is trusted
  - + - Granting bound properties
    - One agent can grant
    - Same or other agend can verify & allow access
    - Grant can be re-assessed at point of access
  - + - Trust
    - Trust to access (central model)
    - Trust to delegate
    - Certifying authority for signatures
    - Binding real-world identity to key
      - Trusted computing
      - Biometrics
    - Revocation, reconformation, one-time identities
    - Negative free properties
  - (Simon)
    - Identity-based <foo>: key binding occurs later
- + - Trust-based responsibility assignment
  - Renaud de Landtsheer, U Louvain, Belgium
  - Requirements engineering
    - Why?
      - Goals
    - What?
      - Requirements and assumptions
    - Agents
  - Responsibility assignment
    - How to ensure agents fulfil requirements
    - Use trust analysis in assignment of responsibilities
  - Logical construction: decomposition into conjuncts and temporal modal "consequence"?
  - Maybe use DL reasoners to evaluate these models?
- + - Modelling Trust Certificates with missing CAs
  - Tomas Olsson, Swedish Institute of Computer Science
  - (misleading title)
    - "Modelling trust with incomplete certificates"?
  - Access control
    - Decentralized
      - Certification
      - Delegation -> cert chains
    - Distributed
      - P2P
        Resource owners
        
        PDP (decision pts)
      - No central store
    - Dynamic
      - Peers come and go
  - Trust if..
    - At time t
    - If verified by chain to SOA
    - Not revoked at time t
  - Boolean vs continuous
  - Situations
    - No historical info
    - Old information about cert validity
    - Current info
    - Info from other peers
    - Combination of info
      - Simple Bayes not good
  - Looking for trustworthy patterns
  - Cert:
    - Issuer
    - Type
    - Service
    - Time of validity
    - Status of verification
  - Data from PDP
  - Stuff about Bayesian inference
  - Add Markov chain modelling for probablility of revocation
- + - Trust Management Approaches
  and application to collaborative
  business processes
  - Yucel Karablut, SAP, Germany
  - Virtual organizations
    - SIngle DB
      ->Distributed process
      ->Collab process
      ->Transient collab proc
  - TrustCom
    - Trust issues in VOs
    - Matrix: phases vs topic
      - Identification, Formation, Operation, Dissolution
      - Trust&security, Contract, Collaborative process
  - Does motivating example...
  - Something about "Property Conversions" at the core of establishing trust
  - Hybrid PKI
  - Uses free/bound properties.
    - Free property can be, e.g., a 3rd party certification
      as a qualified supplier, not related to any specific
      service offereing. cf. U Dortmund presentation.
- + - TuBE - trust based on evidence
  - Lea Viljanen, U Helsinki
  - New project
  - The problem...
    - Organization must for trust relationships
    - Creates explicit or implicit communities
    - Current security; preconfigured trust relationships
    - How to deal with events that compromise trust?
    - Need to allow trust relationship to evolve while interaction proceeds
  - Trust
    - People
      - Identify party
      - Decide trust
      - Watch behaviour
    - Systems
      - Authentication
      - Authorization
      - Anomaly detection
    - Model
      - Trustor and trustee identification
      - Requested action
      - Trustee reputation
      - Trustor context
        e.g. under DoS?
      - Action risk
      - Action importance
    - Key factors
      - Trustor
      - Trustee
      - Action
  - Architecture
  - Long term goals: trust in communities
    - First, need to deal with some lower level issues
    - Link trust to intrusion detection and prevention
+ - Project presentations
- + - TrustCom
  - Virtual organizations
  - Business Collaboration
  - Secure enactment of collaborative process
  - Interplay between trust, security and contract management
  - Businesses expose programmatic interfaces
  - Goal is provision of a framework
    - Provision of standards
  - Life cycle
    - Identification
    - Negotiation
    - Formation phase
    - more?
  - WP2 modelling methodology
    - What about E3?
  - VO lifecycle challenges
    - (see matrix)
  - Expected results
    - Framework (architecture, service descr, protocols)
      - Well-defined concepts
      - Open standards profiles
    - Open Source reference implementation
    - Domain-specific test-beds
  - Role of trust
    - TrustCom services?
  - R&D activities
    - Survey SoA
    - Problem definition
    - Socioencon legal context
    - Conceptural models
    - Architecture
    - Framework Profile specs
    - Testbeds
    - Tools and methods
  - Main objective to produce standards profiles for interoperability
- + - (Fredrik Vraalsen) CORAS
  - Plaform for risk analysis of security critical systems
  - Many partners
  - Security is managing risks in relation to resources
  - Tech solutions not enough
    - e.g. SET too complicated
    - Security problems with non-technical origin
    - Usability problems can compromise security
  - Security sometimes an afterthought
  - Integrate requirements analysis and risk analysis
    - desired features
    - undesired features
  - Risk analysis
    - Identify requirements
    - Design solutions
  - Security
    - Confidentiality
    - Integrity
    - Availability
    - Non-repudiation
  - + - Model based risk analysis
    - Analysis has target, in context of organization
    - Asset - having value
    - Threat
    - Vulnerabity
    - Unwanted incident
    - Frequency
    - Effect
    - Treatment
    - (from CORAS)
      - Uses elements of UML
      - (mis-use-case diagram)
  - Graphical language
  - MBRA
    - Process: guidelines & procedures
    - (4 others...)
  - Existing standards
    - RM-ODP, UML
    - (3 other areas)
  - Terms
    - Threat: worm
    - Scenario: PC + windows
    - Unwanted incident; infected PC
    - Risk: twice a year, infection forwarded to contacts
    - Treatment: install virus scannel
  - Tool support
    - Documentation creation and organization
    - Integrate existing design tools
    - Check correctness (or consistency w.r.t. common rules)
    - Re-use work from other projects
    - Presentation
    - User-friendly interface
  - Platform
    - Integration layer (XML-based)
    - databases
      - analysis results
      - experiences
    - Consistency checking and fill-in information
    - Java open source
      - (Sourceforge)
  - UML profile for security assessment
    - Target description
    - security ontology
    - documentation
    - Specific diagrams, with UML metamodel
    - Diagram elements
      - SWOT
      - Assets
        (kind of class diag)
      - Threats: represented as threat agents
      - Unwanted incident
        chain of events
      - Risk themes
        (e.g. common treatments)
      - Treatment
  - Oher projects
    - SECURIS
      - Continuation of CORAS through field trials
    - SARDAS
      - Tool-supported UML profile for specification of
        requirements, policies and architecture for availability.
    - ENFORCE
      - Legal issues
    - TrustCom
  - Look for open-source UML modeller (Poseidon?)
- + - (Andrew Jones) ALFEBiiTE
  - Andrew Jones, Marek Sergot
  - Very interdisciplinary
    - Logical
    - Socio-cognitive
    - ???
    - Legal
    - Specification of computation societies
    - "Polish extension"
  - Logical framework
  - Application of logical framework to multi-agent system concepts
  - Small number of component modaities
    - Action
    - Attempt
    - Ability
    - Belief
    - Directive (obligations and permissions)
    - Evaluative (preferred)
    - Institutionalized power ("counts as")
  - Conversation/conventions
    - Have formal model of communication that is *convention*-based
      rather than *intention* based. Cf. Semantic Web "social meaning" debate.
  - Modality for information state
    - Frim inform/told modalities, generate...
    - Truth, Lie, Silence, Conflicting information
    - Gives rise to 15 possible normative positions w.r.t. obligation
      - 15 satisfiable out
        of 256 possibilities.
  - What's the point?
    - Clarify formal characterization of rules
      governing flow of information between agents.
    - Tried to apply to TrustCom work (e.g. EU data protection rules)
    - Logic of need to reveal information in contract negotiation
    - Logic of "weapons of mass deception" or a theory of spin ;-)
- + - (Marek Sergot) ALFEBiiTE
  - Start with computational structure
  - Define notions such as power, permission, etc, on those structures
  - Deontic interpreted systems
    - Knowledge in distributed systems
    - States where agent has operated correctly
    - Knowledge based on assumption of correct behaviour
  - Language C+, action language from AI
    - Actions, fluents
    - default persistence
    - concurrent actions
    - direct and indirect effects
    - ++
      - Action generation (counts as)
      - Permission
    - Causal Calulator CCalc, U Texas
    - C+ defines transition systems, not a logc of
  - Agents may break rules because
    - Competitive
    - Unreliable
    - (Also: Deliberate violation for exception)
- + - (Christian Damsgaard Jensen)
  SECURE
  - Ubiquitous computing
  - From local to global computing
  - + - Local
    - Single administrative domain
    - Can be distributed
    - Common rules
    - Common infrastructure
  - + - Global
    - Roaming entities
    - No common rules
    - No authority to enforce behaviour
    - No common infrastructure assumed
  - + - Security
    - Increased risk
    - May be resource constrained
    - No assumption of continuous connectivity
    - No unique central authority
    - No security perimiter
    - No knowledgable system administrator assumed
    - Increased risk
  - + - Mitigating risk
    - Insurance
    - Contract
    - Common mediating authority
    - Restrict interactions
    - Trust to allow assessment of risk
  - + - Trust management
    - Deal with uncertainty
    - Trust can exist outside a legal framework
    - Autonomous and Subjective
    - Dynamic
      - experience and recommendation
    - Predictor of future behaviout based on past behaviour and evidence
  - + - Risk assessment
    - Possible outcomes
    - Assess
      - Probability of outcomes
      - Cost of outcomes
      - Total risk aggratetes over outcomes
    - ...
  - Security requirements for global computing
    - Explicitly address risk
    - Predictability
    - Security
    - Dynamic
    - Scalability
    - Easy
  - Trust model
    - Trust order
    - Information order
  - Event structure
    - Transaction structure
- + - (Dimitris Tsigos, Virtual Trip)
  INNO-UTILITIES
  - Innovation-friendly public procurement and
    fight against telecommunications fraud.
  - Developing
    - Policy recommendation
    - Execute a secure demonstration of
      transnational fraud information system
  - Public utility, was public monoply, now deregulation
  - Depend on public telecom infrastructure
  - Transfer lessons from telecom to other utilities?
+ - Survey
- Stefan Poslad
- GK
+ - Steering group
- Theo talking about EU review
  - Extra-workgroup activity
  - Collection of links to related pubs
    - General resources page
  - Multidisciplinary: not enough, esp economics
  - Like to see more integration
  - 3 reviewers, scientific advisor + project officer
  - Next review winter 2004/05, not yet fixed
- Paris conference
  - Invited speakers
  - Tutorials
    - Funding model
    - French rules
  - Panel
    - Andrew Jones to arrange
    - 1 hour
  - Web site
    - Link from last year conference
    - Link from iTrust site
    - Link from my site
    - Techniques to lift google rating for "trust"
- iTrust2
  - Investigating possibility of
    creating WG within IFIP about trust
    - 1st impression, no gain for WG
    - No concrete support
    - Some commitments
    - Needs to be truly international
    - Some publicity support
    - Contact?
      - Steven Marsh
      - Zoran Milosevic
  - Stefan
    - Looking for a follow-on network
  - What vehicle?
    - NoE
      - Full-time job 6 months to prepare
    - Coordinated actions / support action?
  - Actions
    - Complete analysis of (iTrust1???)
    - Identify thematic areas
    - 2-pager
    - Identify channels in EU
      - Test with current proj officer
      - Find EU position
        Valerie? Check with Christos