Decentralized Trust Management based on the Reputation of Information Sources

In a distributed system, the classic PGP and PKI techniques provide means to establish trust based on credentials. However, the credentials are not bound to integrity levels. Furthermore, the structure of certification authority (CA) is centralized, which is vulnerable to be the single point failure even if backups are present. In this paper, we propose a decentralized method to establish trust in the information provided by specific nodes in a distributed system based on the reputation of the nodes. We focus on quantified integrity level of information, in addition to the trust of information sources with credentials. We propose protocols to establish trust in a distributed system. We evaluate the cost of the protocols and analyze the degradation of integrity level along the information path during transfer. A method to defeat coalition is also discussed. Our results provide guidelines for establishing trust, especially quantified quality of information, in distributed systems.