Rachid Saadi 
email: rachid.saadi@inria.fr
  
Jean-Marc Pierson 
email: pierson@irit.fr
  
Lionel Brunie 
email: lionel.brunie@liris.cnrs.fr
  
  
  
  
  
  
T2D: A Peer to Peer trust management system based on Disposition to Trust

Keywords: C2.0 [Computer Communication Networks]: General-Security and protection; K.4.4 [Computers and Society]: Electronic Commerce-Security Security, Trust, Theory P2P network, Disposition to trust, Subjectivity, Trust Propagation, Trust Transitivity

While the trust paradigm is essential to broadly extend the communication between the environment's actors, the evaluation of trust becomes a challenge when confronted with initializing the trust relationship and validating the transitive propriety of trust. Whether between users or between organizations, existing solutions work to create for peer to peer networks, flexible and decentralized security mechanisms with trust approach. However, we have noticed that the trust management systems do not make the most of the subjectivity, more specifically, the notion of Disposition to Trust although this aspect of subjectivity has a strong influence on how to assess direct and a transitive trust. For this reason in our study, we tackle this problem by introducing a new distributed trust model called T2D (Trust to Distrust) which is designed to incorporate the following contributions : (i) A behavior model which represents the Disposition to Trust ; (ii) Initialization of trust relationship (direct and transitive) according to the defined behavior model.

INTRODUCTION

In the domain of social sciences, there has been substantial research regarding the concept of trust. The findings have been applied in areas including economics, finance, management, government, and psychology. In recent years, trust has acquired considerable interest in the computer science community as the basis of security solutions to extend communication in peer to peer topology.

The majority of trust management systems overlook the initialization of trust relationship processes, they consider that is not a problem of the model or else in the best of circumstances they start all trust relations from zero. But effectively the evaluation of the trustworthiness is not a straightforward task. For instance on a range of 0 to 9, with 0 representing blind trust, should a trustworthy node be rated as 1, 2 or 3? The task is further complicated when the number of nodes to be evaluated is large.

Moreover, in peer to peer networks, existing approaches compute similarly trust evaluation processes for computing a direct or transitive trust relation. We believe that this evaluation should be adjusted according to the personality of each actor (trustful or distrustful). In fact, a trustful personality will give more confidence for a trust relation than a distrustful one.

Thus, we should develop methods that work under the assumption that the Disposition to trust (personality) has a strong influence for both initialization and propagation trust relationships. In this case, the main difficulties are to define a generic model which is able to represent a disposition to trust from a trustful to distrustful behavior. Then, use this model to initialize direct trust and evaluate transitive trust relation.

In our work, we aim to provide a customizable trust management system which makes the most of the Disposition to trust property. Thus, the paper is organized as follows: after exploring the related work (in next section) concerning the disposition and the evaluation of trust, in section 3 we introduce the basics of our T2D model and show how the Disposition to Trust behavior in defined to customize the evaluation of direct trust (in section 4) and transitive trust (in section 5). Finally before concluding and introducing future works, in section 6 we define a new simulator for generating a trust peer to peer networks in order to perform some experiments.

BACKGROUND

Disposition to trust

In trust management models the subjectivity, more specifically the disposition to trust is perceived at different degrees. This is particularly an issue in trust management models that employ a numerical range for the quantification of trustworthiness. For instance, on a range of 0 to 9, with 0 representing blind trust and 9 representing a blind distrust, should a trustworthy node be rated as 1, 2 or 3? This evaluation mainly depends on the disposition to trust of each node (personality). The disposition to trust is the inherent propensity of an individual to trust or distrust others. An individual's disposition to trust does not vary for specific entities but is a stable characteristic of their personality that governs how they view the trustworthiness of every other entity that they encounter. McKnight et al [START_REF] Mcknight | Initial trust formation in new organizational relationships[END_REF] define disposition to trust as the "extent to which a person displays a tendency to be willing to depend on others across a broad spectrum of situations and persons". Rotter [START_REF] Rotter | A new scale for the measurement of interpersonal trust[END_REF][START_REF] Rotter | Generalized expectancies for interpersonal trust[END_REF] notes that an individual's "generalized attitude" towards trust is a product of life experiences, such as interactions with parents, peers, and authorities. Boone and Holmes [START_REF] Boon | The dynamics of interpersonal trust: Resolving uncertainty in the face of risk[END_REF] suggest that good experiences lead to a greater disposition to trust and vice versa. A study in the context of ecommerce by Mc-Cord and Ratnasingam [START_REF] Mccord | The impact of trust on the technology acceptance model in business to consumer e-commerce[END_REF] has demonstrated that there is a strong relationship between an individual's disposition to trust and the trust related decisions that they make. A thorough examination of the literature on disposition to trust is provided by Kaluscha [START_REF] Grabner-Kräuter | Perspectives of online trust and similar constructs: a conceptual clarification[END_REF]. We will now revisit a previous example which evaluate trustworthiness in the range of [0,[START_REF] Marsh | Formalising Trust as a Computational Concept[END_REF]. Alice and Bob are two individuals with different dispositions to trust. Alice has a high disposition to trust (trustful personality) and thus assigns a high trust value of 1 to Carol. By contrast, Bob who has a lower disposition to trust (distrustful personality), rates Carol's trustworthiness as only 5. This subjectivity shows the difference between the evaluation of Bob and Alice regardless of the fact that Carol exhibits the same behavior in her interactions with Alice and Bob.

The trust evaluation :

How does one represent the amount of trust that one individual associates with another? A common approach is to evaluate the direct trust relation with known entities by the spectrum of trust quantitatively as a numerical range. Marsh's formalism [START_REF] Marsh | Formalising Trust as a Computational Concept[END_REF] represents trust as a continuous variable over an interval of [-1,1]. Golbeck's FilmTrust [START_REF] Golbeck | Filmtrust: Movie recommendations using trust in web-based social networks[END_REF] defines an integer range of 1 to 10. Gambetta [START_REF] Gambetta | Can we trust trust? In Trust: Making and Breaking Cooperative Relations[END_REF], Griffiths [START_REF] Griffiths | Task delegation using experience based multidimensional trust[END_REF], and Toivonen [START_REF] Toivonen | Context-aware trust evaluation functions for dynamic reconfigurable systems[END_REF] utilize an interval of [0.1] for this purpose. An alternative approach is to divide the span of trust into strata and assign them qualitative labels. The stratification used by Abdul-Rahman and Hailes [START_REF] Abdul-Rahman | A distributed trust model[END_REF] is given as the set Very Trustworthy, Trustworthy, Untrustworthy, Very Untrustworthy). Josang [START_REF] Jøsang | Semantic constraints for trust transitivity[END_REF], and Theodorakopoulos [START_REF] Theodorakopoulos | Trust evaluation in ad-hoc networks[END_REF] consider the subjectivity as the uncertainty propriety and represent the trust evaluation by more then one value in multidimensional model.

The trust propagation is as the result of the transitive property of the relation trust. It plays an important role in networks with peer to peer or adhoc topology. It allows any entity to extend its confidence from its local knowledge by building a trust path from trusted peer to trusted peer. In the field of computers, the majority of the trust model approaches compute a trust average value or rescale their trust evaluation between [0, 1] (if it's not the case) then they aggregate all of direct evaluation by multiplication operator. For instance, if Alice trusts Bob as 0.5 and Bob trusts Carla as 0.4, then Alice trusts bob as 0.2 = 0.5 * 0.4. This ap-proach is most used due to its flexibility; however it does take into account the subjectivity for evaluating the trust transitivity. In fact, a distrustful entity should evaluate a trust path more aggressively than a trustful entity.

The models that have been previously shown mainly present the following limits:

On one hand, it is so easy to assign semantic labels (eg Very Trustworthy, Trustworthy, Untrustworthy) ( [START_REF] Abdul-Rahman | A distributed trust model[END_REF], [START_REF] Zimmermann | The official PGP user's guide[END_REF]) as it is more complex to give a numerical evaluation. Thus, most solutions that address the trust evaluation make one of the following assumptions:

(i) The trust initialization is not a problem of the model, it is the responsibility of the actor of the system. However, this task is not necessarily obvious, especially when it comes to evaluating numerically a trusted third party (eg 0.1, 0.2, or 0.15).

(ii) All trust relations are initially evaluated with the value zero [START_REF] Jøsang | Semantic constraints for trust transitivity[END_REF][START_REF] Theodorakopoulos | Trust evaluation in ad-hoc networks[END_REF]. This solution is, in some cases, interesting but does not reflect reality, because a user has given an identity, status, ownership etc.. ; These are the attributes that should be the starting point of any trust model.

On the other hands, the presented solutions consider the subjectivity as the uncertainty propriety, despite the fact (as seen before) that the disposition to trust is an important parameter which must be considered for any trust evaluation process (direct or transitive).

OUR APPROACH: T2D MODEL

Trust is an important element to build relationships and establish collaborations and exchanges between different entities in the environment. In peer to peer network, the trust model allows to build and expand by the transitivity, from a local of knowledge (direct trust), the circle of trust for every peer.

We define a new decentralized trust management system called T2D (Trust to Distrust) which evaluate trust relationship on a scale start from max trust threshold (0) to max distrust threshold (max > 0). Each actor is free to define his max value and then evaluate his trust relationship according to the defined scale.

For our trust model we represent a peer to peer network as a Trust graph noted as Tg(N, E), a valued and directed graph such that:

• N represents the set of the peer to peer network's nodes.

• Each Trust relation between two nodes is represented by a directed edge e. The set of edges is consequently identified with the set of relations, E.

• Each edge is valued by the trust degree between the nodes represented by the source and destination nodes of this edge.

In the previous section, we noted that the evaluation models of trust display some discrepancies, especially regarding the disposition to trust. Indeed, the personality (trustful or distrustful) of network's peer has a strong influence on the evaluation of the direct or transitive trust evaluation. Thus, the evaluation of trust relation (direct and transitive), in T2D model, is performed according to a mathematical function that allows to describe the personality of each node from trustful to distrustful.

In the following sections, we illustrate how the T2D model enable each node to define its own trust policy for evaluating direct trust and transitive trust.

DIRECT TRUST

The direct trust relationship is represented in the trust graph by an edge e. We noted this relation by T rust as follow: -Trust Set T S-Each node builds its trust set T S which is composed of the nodes that it can evaluate directly for their trustworthiness (trusted node). In other words the members of the set are those nodes with whom the local node has a direct trust relationship. Definition 3. -Trust function t 0 -Each trusted node is evaluated by a trust function noted t 0 which gives to each edge e a trust degree d in a range of [0, T 0 ]. So t 0 evaluate from Trust (0 represents the maximum trust) to Distrust (T 0 is the maximum distrust), hence the name of our model T 2D. t 0 is defined as follows:

t 0 : N * N → R + (A, B) → d t 0 (A, B) = d | 0 ≤ d ≤ T 0 A (1)
Definition 4. -The Distrust Threshold T 0 -This value is a positive number, it can be fixed freely by each node and it represents the maximum tolerated distrust value of a node.

We believe that initialization of the trustworthiness of a node as a numerical value is not a straightforward task. For instance, on a trust scale of 0 to 9, should a "very trustworthy node" be assigned the value 0, 1, 2 ... or 3? This example illustrates the dilemma faced by any node when performing this task. This difficulty occurs due to the difference between the dispositions to trust of each node. To solve this problem we introduce a novel method for the evaluation of trustworthiness of nodes in the trust set. This method comprises of the following two steps:

1. Compute a neutral evaluation using a Trust Sort process.

2. Generate the quantitative evaluations according to the disposition to trust.

TrustSort

The objective of this TrustSort is to define a method that enables one to initialize the trust set T S of each node intuitively. Thus, instead of assigning trust values to individual trusted nodes, we propose that each node performs trust evaluations in relation to other nodes. However, if a node is required to evaluate the trustworthiness of other nodes in relation to other nodes we may have the following scenario. Let's say that Alice rates Cathy as more trustworthy than David. Based on similar experiences with Cathy and David, Bob is also very likely to rate Cathy more trustworthy than David. We thereby make the assumption that this alternate approach we are more likely is more likely to have consistent trustworthiness evaluations.

We call the notion of evaluating nodes in relation to other nodes as "Trust Sort". An administrator is in effect sorting the foreign nodes in terms of their trustworthiness. The product is a sorted list of nodes.

We note T rustSortn the node n's sorted list. Each trust set's member has an entry in the sorted list. The value contained in each box corresponds to their ranking in the list. For instance T rustSortn(A) = 1 and T rustSortn(B) = 2 mean that n trusts A more than B and consider A as first trusted node and B as the second one.

The sorting unit is fairly intuitive but can be limited when it is used to sort more specifically a large number of elements.

To overcome these limitations, we can define a variant of the last sorting process. In fact instead of applying the Trust Sort process between all T S's members, we can (i) define a sorted groups, for example: (Max Trust ) (+)Good, Average, Poor(-) (Max Distrust); (ii) assign each trusted node to the corresponding group ; (iii) sort each group using the TrustSort process.

Disposition to trust

Node behavior

The next sep of our proposal consists of representing the node behavior. We can broadly classify nodes into two categories based on their disposition to trust. The first category represents nodes that generally exhibit high levels of trust in the members of their trust set. In contrast, the second category represents the nodes that are inclined towards low levels of trust in the members of their trust set.

We define a mathematical function BV (x) which is called the (BehaVior) function. This function represents a curve in the Cartesian coordinate system.

The input x is a positive value that represents the order number of a node in the sorted list. The list is numbered from 1 to n where n is the total number of nodes in the list. The node in position 1 is the most trusted node.

The output BV (x) represents the corresponding quantitative trust value for the node based on the disposition to trust of the local node.

We now present the contrast between nodes that exhibit trustful and distrustful disposition to trust or behavior in terms of the BV function.

Class1 -nodes that exhibit Trustful Behavior-:

This class represents the behavior of nodes which are more trusting. We define that this characteristic is represented by the BV function when it takes a hyperbola form. As illustrated in the figure 1 (box A) the projections of the x values are gathered closer to the maximum trust value (zero).

Class2 -nodes that exhibit Distrustful Behavior-:

This class represents the behavior of nodes which are less trusting. We define that this characteristic is represented by the BV function when it takes a parabola form. As illustrated in the figure 1 (box B) the projections of the x values are gathered closer to the minimum trust value. 

The behavior function

We use a Bezier curve to implement the BV function due to the flexibility it enables plotting geometric curves. Definition 5. The Bezier Curve is a parametric form to draw a smooth curve. It is achieved through some points P0, P1...Pn, starting at P0 going towards P1...Pn-1 and terminating at Pn.

The BV function is expressed by a quadratic Bezier curve that passes through three points where:

• The origin point (P0(0, 0)).

• The behavior point (P1(bx, by))

• The threshold point (P2(hx, hy)) where the hx represents the number of sorted node and the hy represents the trust threshold.

As illustrated in the figure 2, by moving the behavior point P1 inside the rectangle that is defined by P0 and P2, we are able to adjust the curvature.

Based on the Bezier curve, let us now define the "BV function".

As defined previously, the BV function describes the trust behavior of a node. It takes the order number of a node in the sorted list as the abscissa x and returns the corresponding "Quantitative trust value" BV (x).

To apply the BV function with the Bezier curve, we modify the Bezier curve to obtain the ordinate as a function of abscissa, instead of taking a temporal variable 't' as input to compute both abscissa and ordinate.

The BV function curve is drawn through the three points P0(0, 0), P1(bx, by) and P2(hx, hy) using the Bezier curve.

We assume that it is sufficient to move the point P1 through the second diagonal of the defined rectangle bx = -hy hx * by + hy to plot a large panel of behaviors. Definition 6. -The disposition to trust level l 0 -We define the variable l 0 which bounded between 0 and 1 give updated positions for P1 through the second diagonal. For instance, the value l 0 = 0 indicates maximum trustful behavior (P1(hx, 0)) and l 0 = 1 represents maximum distrustful behavior (P1(0, hy)).

After computing the Cartesian function from the Bezier parametric format and have fixed the position of the point P1 according to the disposition to trust level l 0 , we obtain the following function: 

BV : [0, hx] -→ [0, hy] X -→ Y BV l 0 ,hx ,hy (X) = (hy -2by ) 4b 2 x X 2 + by bx X si (hx -2bx = 0) (hy -2by)(∝ (X)) 2 + 2by ∝ (X), si (hx -2bx = 0) W here            ∝ (X) = -bx + √ bx 2 -2bx * X+hx * X hx -2bx 0 ≤ bx ≤ hx ∧ hx > 0 bx = (1 -l 0 ) • hx ∧ by = hy • l 0 (2) 

Generating quantitative trust values

Given l 0 and the threshold points (P2), the BV function is able to assign each node in the sorted list a corresponding quantitative trust value as follows:

1. Specifying the P1 is achieved by selecting the corresponding disposition to trust l 0 between 0 and 1.

2. The P2 point is specified by assigning hx and hy the following values: hx=(Number of trusted nodes) + 1 and hy = T 0 (the trust threshold).

3. Putting the trusted nodes as classified along the abscissa of the BV function.

Thus the evaluation of the trust function t 0 will be done as follows:

t 0 : N * N → R + (A, B) → d t 0 (A, B) = BV l 0 ,hx,hy (T rustSortA[B]). (3) 
Example: Let's consider two nodes where:

-n1: Trustful node, l 0 = 0.1; -n2: Distrustful node, l 0 = 0.8.

These nodes evaluate five trusted nodes (A,B,C,D,E). The threshold point P2 has the coordinates: hx = 5 + 1 = 6 and hy = T 0 = 50.

The sorted list of both n1 and n2 is:

(high trust)(+) D, C, E, A, B (-)(low trust)
As illustrated in the figure 3, by performing the BV function the values assigned to the trusted nodes would be as follows:

node A node B node C node D node E node n1

13.9 24.2 3.9 

TRANSITIVE TRUST

With the relation Trust, the trust graph is connected like a peer to peer network. This Trust relation can be transitive iff:

∀A, B, C ∈ N, A T rust B ∧ B T rust C ⇒ A T rust C (4)
This property is fundamental for the effectiveness of the proposition. It allows defining "trust paths" between nodes that do not know each other as follows: let n0, n1, ..., n k ∈ N | ∀i = 0, ..., k -1 (ni T rust ni+1). We define a Trust path by : P t k = (n0, n1, ..., n k ) where:

• n k is called the target node. It represents the node which be evaluated.

• n0 is called the source node. It represents the node that wants to evaluate the target one.

The evaluation of each Trust Set is decentralized. Each node evaluates its distrust threshold independently from other ones. This can lead to a divergence in the evolution of the transitive access. For example: one node can value its trusted nodes up to 20 and another can value its owns up to 500. To smooth these differences and to perform a neutral evaluation, we define the Trust propagation function P 0 . P 0 uses the sum operator to add all the degree of trust path's edge relatively to the distrust threshold of the source node. Definition 7. -Distrust propagation function P 0 -Let A, B, C 3 nodes (A is the source and C is the Target). The composition of the trust degrees t 0 (A, B) and t 0 (B, C), noted P 0 (A, B, C) = t 0 (A, B) ⊕ t 0 (B, C) is defined as :

P 0 (A, B, C) = t 0 (A, B) + t 0 (B,C) T 0 B * T 0 A Generalization: trust paths
The composition of distrust degrees is generalized to n nodes through the trust path P tn by composing two by two the trust degrees t 0 :

P 0 (P t k ) =    t 0 (n0, n k ) si 0 ≤ k ≤ 1 P 0 (P t k-1 ) + T 0 n 0 T 0 n k-1 * t 0 (n k-1 , n k ) si k > 1 (5)
Definition 8. -Global distrust threshold-To validate or invalidate a trust path we define the Global distrust threshold θT 0 . Each node n has to define its global distrust threshold, corresponding to the maximum tolerated degree for a transitive evaluation. This value is proportional to the distrust threshold T 0 and to the defined maximum authorized path length Ln, as follows:

θT 0 = T 0 * (1 + (1 -Lp) * (1 -l 0 ))
Consequently, if the evaluation of the trust path (P 0 (P t k )) is less than the distrust threshold, i.e. 0 ≤ P 0 (P t k ) ≤ θT 0 n 0 , the source node n0 trusts the trust path P t k and thus trust the target node n k .

Example:

Let five nodes that build a trust path P t4 = (n0, n1, n2, n3, n4). To decide if the source n0 can trust the target n4, we compute the P 0 (P t4) progressively (see figure 4).

If Ln 0 = 3 ∧ T 0 n 0 = 70 then θT 0 n 0 = 70 * 3 = 210.

As a consequence, the source n0 considers the target n4 as trust node since: 0 ≤ (P 0 (P t4) = 152) ≤ (θT 0 n 0 = 182) 

SIMULATIONS

For the evaluation of our proposal we have implemented in Python a simulator (TrustSim). We have used this simulator to compute the trust path Lp which further enables calculation of the maximum distrust threshold θT 0 = T 0 * Lp.

To accomplish this task we assume that the interconnection between nodes is higher if the network is composed of trustful nodes. In fact, each node would trust almost of all other nodes if the network is 100% trustful. The TrustSim can be freely downloaded on this link [START_REF] Saadi | Trustsim[END_REF]. We run the simulation for a set of different networks characterized by their size. The set of the simulation is composed of networks sizes 200, 300, 500, 1000. Let's represent the size by the variable s and the maximum neighborhood degree of a node as n

We the simulation over networks' size by varying n 0 between 2 and 30 and Lp from 1 to 10. For each increment we compute the percentage of network's connections, i.e. how many nodes is considered as trusted from any given network node (see figure 5). We use the term "Trust average (a)" for this result.

We take the result of the simulation (i.e. the Trust average) and we use it to draw an interpolation curve. This curve is given as the function called the Trust Path T P function. This function returns the corresponding recommended path p according to network size s, trust neighborhood average n 0 and the access average a as follows:

T P : ]0, 1] * [1, N ] -→ R + (a, n 0 ) -→ Lp T P (a, n 0 ) = α(S) * a n 0 (a * ln(n 0 +1)) 1,5 + 1
W here α(s) = 0, 05 * s + 32, 5.

In table 2, we assume that for a = 75% the network is very highly connected. As illustrated in table 2, by fixing a to 75%, we compute the trust recommended path according to several network characteristics, i.e. the network size and the average neighborhood degree. Table 2: Maximum recommended path.

CONCLUSION

We have proposed a new approach for computing trust in peer to peer topology. A novel feature of this approach is that each node can evaluate its trust set by simply fixing its trust behavior than sorting the trusted nodes based on their trustworthiness.

The TrustSort method can be applied on one or more groups of trusted nodes. Each group would define a certain level of distrust e.g. group 1 can be defined to be trustworthy and group 2 can be defined in comparison to group 1 as being less trustworthy. Thus, each node is able to evaluate a large number of sites by classifying each one of them in the appropriate group.

In relation to future work, we would like to improve the TrustSort approach by a reputation mechanism. In this approach, the initial attributed value may change positively or negatively according to the node behavior. In fact, each node can inquire its trusted node one by one above all other trusted nodes. Then according to the responses received from the nodes, a classification for a node n can change if the nodes that have initially the same perception of the node n, change their evaluation.

Using this trust transitivity is particularly attractive for the distributed environment where propagation is computed using summation instead of average. Methods that use av-erage do not take into account the length of the trust propagation path. In fact, using averages, access can be acquired over a path even if some sub-paths are not valid. However, using summation, distrust would increase when the length of the path increases. Consequently, if we cross the fixed threshold, the trust propagation path would be invalidated and access would not be allowed. Thus, it always holds true for a valid path that it does not contain any invalid subpaths. In future work, we will also integrate the disposition to transitivity for computing the trust path by increasing the neutral evaluation according to the personality of the node.

Our T2D trust model was successfully implemented for trust requirements in pervasive [START_REF] Saadi | Establishing trust beliefs based on a uniform disposition to trust[END_REF] and grid scenarios for the GeenNet project [START_REF] Costa | The green-net framework: Energy efficiency in large scale distributed systems[END_REF].

Definition 1 .

 1 -Trust Relation-Let A and B two nodes (A ∈ N , B ∈ N ). If A trusts B then we say that an edge e start form A to B and we note A Trust B. Thus A consider B as trusted node. Definition 2.

Figure 1 :

 1 Figure 1: The Trust Behavior

Figure 2 :

 2 Figure 2: The Behavior curve functions

Figure 3 :

 3 Figure 3: Node classification

Figure 4 :

 4 Figure 4: The Trust Propagation

Figure 5 :

 5 Figure 5: Path simulation: This graph is performed through network size=1000 nodes.

Table 1 :

 1 Example of initializing trust set's value.

	.8