Open Reputation Systems

2. Open Reputation Systems

3. Reputation Systems • ENISA paper – a security analysis of reputation systems http://enisarep.notlong.com • Use-cases • Seller reputation • Peer-to-peer • Key management • Anti-spam/IP reputation

4. Typical security vulnerabilities need to be addressed: • Collusion – voters agree to target a victim • Denial of reputation – campaigns against an individual • Whitewashing (cancelling a bad reputation) • Sybil attacks (creating multiple identities to vote – e.g. Ebay 1 cent items voted on by seller)

5. OASIS - ORMS • Develop scenarios for reputation management • Reputation of individuals, business partners, services processes, possibly even data • Develop reference/standard model • Flexible reputation data model • Framework and protocol/s for exchanging and porting reputation data • Evaluation algorithms for mapping reputation to risk / risk levels • Support for privacy, multiple identities, identity resolution

8. Reputation is an aggregation of opinions about an assertion Assertion – Bob is a bad husband Assertion – Bob is a good laptop seller

9. The anatomy of reputation – personal view Assertion – Bob is a good laptop seller

10. Reputation Thoughts • Reputation votes should be separated from the algorithm used to compute it • Mean score • 2nd order reputation • Reputation Context => Same vote set can be interpreted differently • If reputation is an aggregated opinion about an assertion – why not integrate with SAML?

11. Reputation Thoughts • Model must allow for so-called 2nd order reputations (scores which take into account the reputation of the voter) • Rating context should be taken into account – time/date, authentication method/token etc...