k -anonymous reputation

Abstract

While performing pure e-business transactions such as purchasing software or music, customers can act anonymously supported by, e.g., anonymous communication protocols and anonymous payment protocols. However, it is hard to establish trust relations among anonymously acting business partners. Anonymous reputation systems have been proposed to mitigate this problem. Schiffner et al. recently proved that there is a conflict between anonymity and reputation and they established the non-existence of certain privacy-preserving reputation functions. In this paper we argue that this relationship is even more intricate. First, we present a reputation function that deanonymizes the user, yet provides strong anonymity (SA) according to their definitions. However, this reputation function has no utility, i.e., the submitted ratings have no influence on the resulting reputation values. Second, we show that a reputation function having utility requires the system to choose new independently at random selected pseudonyms (for all users it has utility for) on every new rating as a necessary condition to provide strong anonymity according to the aforementioned definition. Since some persistence of pseudonyms is favorable, we present a more secure, but also more usable definition for anonymous reputation systems that allows persistency yet guaranties k-anonymity. We further present a definition for rating secrecy based on a threshold. Finally, we propose a practical reputation function, for which we prove that it satisfies these definitions.

Anonymous and Publicly Linkable Reputation Systems

“…Hence, our reputation systems needs a mechanism to prevent such attacks. In [10], [21], and [17] different solutions to this problem are proposed, which can be incorporated into our construction.…”

“…Related Work. Reputation systems are a popular research topic in economics and computer science, see for example [2,10,12,13,19,20]. Although privacy, i.e.…”

“…unforgeability, have been identified as key properties of reputation systems, no generally accepted privacy and security definitions for reputation systems have emerged. Definitions of anonymity based on differential privacy have been proposed in [10,12,28]. These are restricted to special reputation functions.…”

Privacy-Preserving Reputation Mechanism: A Usable Solution Handling Negative Ratings

“…The transactions of a user are unlinkable if the participants in two different transactions cannot be distinguished. Hence, Clauß et al [9] propose a centralized mechanism guaranteeing both the secrecy of ratings and the k-anonymity of service providers. However, beyond being centralized, this mechanism does not preserve the privacy of clients.…”

“…Furthermore, as shown by recent works [3], solely relying on pseudonyms to interact is not sufficient to guarantee user privacy [4]. This has given rise to the proposition of a series of reputation mechanisms which address either the non-exposure of the history of raters [5], the non-disclosure of individual feedback [6][7][8], the secrecy of ratings and the k-anonymity of ratees [9], or the anonymity and unlinkability of both raters and ratees [5,10]. Regrettably, the search for privacy has led to algorithmic restrictions, in the sense that handling solely non-negative ratings seems to be the sine qua non condition to preserve user privacy [5,10]: existing privacy-preserving mechanisms give their users the opportunity to skip some of the received ratings to increase their privacy, which is unfortunately not compatible with negative ratings.…”