# A Perspective on the Evolution of the International Trust Management Research Community in the Last Decade

Theo Dimitrakos

<figure><img src="image_1.png" /></figure>

## To cite this version:

Theo Dimitrakos. A Perspective on the Evolution of the International Trust Management Research Community in the Last Decade. 6th International Conference on Trust Management (TM), May 2012, Surat, India. pp.267-280, 10.1007/978-3-642-29852-3_24. hal-01517649

HAL Id: hal-01517649

https://inria.hal.science/hal-01517649

Submitted on 3 May 2017

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# A perspective on the evolution of the international Trust Management research community in the last decade

Theo Dimitrakos

Security Futures Practice, BT Research & Technology, UK
theo.dimitrakos@bt.com

**Abstract.** Year 2012 completes a decade since a research network called iTrust was established in Europe in 2002. The international research community associated with the iTrust network has been the main – albeit not the only – predecessor of the IFIP Working Group 11.11 on Trust Management the organization behind events such as the IFIPTM conference series. Since that era, I have spent the last decade with the international research community on Trust Management serving in various facilitator and leadership roles. The completion of a decade since the establishment of iTrust has been combined with the first time that an international conference on Trust Management takes place in India, and indeed the first time that such a conference takes place outside of the mature, developed countries of Europe, North America and Australia/Japan. This combination offers an excellent pretext for a review of how we got here: the evolution of the international research community on trust management from 2002 to 2012.

This short paper is a printed version of an invited keynote in IFIPTM 2012 conference that took place in Surat, India.

## 1 Introduction

The concepts of Trust and Trust Management in information systems and computer science attracted some attention in the late 1980's and the mid 1990's by pioneers who based themselves in sociological analyses such as Gambetta [1] or later is socio-inspired information systems such as McKnight [2]. Soon after the idea that it may be possible to treat trust as a computational concept has been put forward by Marsh in [3] while the idea that trust there can be a mathematical framework to reason about aspects of trust in a social network appeared in the work of Jøsang in [4,5,6] and [7]. In parallel the concept that by managing some symbolic representation of trust one can aid the automated verification of actions against security policies, was put forward by Blaze and his team in [8] and [9]. In this variant of access control, actions are allowed if sufficient credentials are presented, separating symbolic representation of trust from the actual person or its identity. Although in a different context and serving a different application, essentially the same concept that Blaze's team introduced in the late 1990's has found more recently a new home in the WS-Trust protocol [10] that underpins security token exchange in web services implementations. Blaze's
concept is still how many researchers and practitioners in information security per-
ceive “trust management” today, especially if they are unfamiliar with the wider,
interdisciplinary body of research in trust and trust management.

Reviewing the plethora of facets and definitions of “trust” and “trust management”
is out of the scope of this short paper. Many informative surveys have written about
trust and trust management definitions including an extensive one Grandison [11]
back in 2000 and a shorter one by Ruohomaa in 2005 [12] and a survey on reputation
systems by Jøsang [13]. It is also out of scope to examine if the terms such as “trust”
and “trust management” make any sense without context and a pre-text or if indeed
trust can be managed. My views on this have been already presented in [14].

This paper and the associated keynote is about the formation and evolution of an
international and interdisciplinary community in trust management, and what trig-
gered, in fact necessitated, the creation of this community was not only the results of
the research mentioned above but most notably a major event in the recent history of
the developed world: a crisis often referred to as the (first) “dot com bubble burst” in
2000 - 2001. On Friday, March 10, 2000, the technology heavy NASDAQ Composite
index, peaked at 5,048.62 (intra-day peak 5,132.52), more than double its value just a
year before. The NASDAQ fell slightly after that, and continued until March 20,
2000, when the financial magazines shocked the market with cover stories reporting
that, within a year, many highflying Internet upstarts will have used up all their cash
and unless they scare up more cash, they will be facing a savage shakeout. For exam-
ple an article in a highly reputable financial magazine reported a survey of the likely
losers and highlighte that "America's 371 publicly traded Internet companies have
grown to the point that they are collectively valued at $1.3 trillion, which amounts to
about 8% of the entire U.S. stock market."[?] By 2001 a majority of the dot-coms
ceased trading after burning through their venture capital, many having never made a
"net" profit. For many the cause of the burst was a combination of bad financial man-
agement and, most importantly, loss of consumer confidence as a result of unmet
expectations to experience announced and oversold features that never materialized
and of poor customer experience, being misled by overinflated expectations nurtured
by yet immature entrepreneurs who took bold – often simplistic – decisions while
dealing with essentially unknown technologies and media of social and business con-
duct.

2 iTrust working group: incubating of an international Trust
Management community in Europe

The beginning of the first decade of the 21st century was a time that governments,
industry and academics in Europe and North America were concerned about an ap-
parent loss of consumer confidence in on-line services, and came to realise that a
stimulation of some sort was necessary in order to save the internet and on-line ser-
vices economy and to allow it to excel again. During that period, I had moved on
from Imperial College London to work as a senior researcher for the Central Labora-
tory UK Research Councils and the host of the W3C Office for the UK and Ireland.
At that time, I put forward the idea that trust in virtual communities and in on-line services and a framework to manage it must be the fundamental differentiators in re-building a vibrant and productive on-line services economy [16,17].

The idea of research in trust and trust management in order to facilitate strengthening trust relationships in on-line communities and in on-line service value networks was well received by the UK government and found supporters among my colleagues in academia such as Professors Maibaum and Jones at King's College London and Professor Sloman at Imperial College London, as well as Dr Shiu in HP Labs Bristol.

At that time, I was already familiar with the work of Blaze's team, via the research of Grandison [18], then a PhD candidate in Sloman's group, as well as the relevance that Jøsang's ideas in automating trust-based decision making. I had also grown an interest in the interplay between trust and risk following joint work with Ketil Stolen on model-based security risk analysis that was marked by the inception of the CORAS methodology in 2001 [24,25]. I was exposed to formal models and logic-philosophical investigations in trust via Maibaum [19], Jones [20], Falcone and Castelfranchi [21,22] as well as to legal analyses on trust via the work of a team researchers in law at the Norwegian Research Centre for Computer and Law (NRCCL). I was therefore convinced that a solution to the problem could not be technical (or mathematical) only and that it could not ignore psychological, socio-technical, legal, operational and economic aspects.

At roughly the same period other researchers in the Joint Research Centre of the European Commission were also concerned about the impact of trust in on-line services and markets [23]. Through my interactions with them and other European Commission officials, the concept of an international and truly multi-disciplinary network of researchers in trust and trust management for on-line community and on-line services was conceived and the European Commission agreed to support such an initiative at least for an incubation period. The research network should have a global reach from its birth, albeit a European core base, and become truly global and self-sufficient once it matured. At that time colleagues alerted me that Professor Christos Nicolaou, then rector of the University of Crete, was also considering proposing a research network with a focus on computational trust in global computing infrastructures. After an initial discussion with Professor Nicolaou, became clear to both of us that all these approaches and expertise to "trust" and "trust management" considered were complementary and should co-exist and co-evolve, cross-fertilize and eventually fuse in the same research community.

That was in essence the birth of the iTrust working group in 2001, the main predecessor of what is now the IFIP working group on Trust Management. The European Commission appreciated the interdisciplinary nature of what was attracted by the ambitious goals put forward and agreed to support the creation of a research network in Trust Management from 2002 to 2005, under the short-name "iTrust" with the view that the community would have become global, self-funded and self-sufficient by 2005.
## 2.1 The vision of an early working group on Trust Management

The vision of the iTrust working group was to bring together researchers and practitioners from a range of disciplines (computer science, sociology, economics, law, and philosophy) to develop models and techniques for dealing with trust in open dynamic systems. The group's aims were to explore the role of trust, and its interactions with security and authorization concerns for on-line virtual communities, value networks of on-line services and other dynamic open systems. We believed that effective trust modelling is an enabler for a range of new computing services including enhanced e-commerce, ubiquitous computing, grid computing, social networks and probably a variety of collaborative/cooperative online activities that we couldn't even imagine at that time.

For example, it had been already clear to us, at that time, that the sheer scale of the emerging global infrastructure, combined with the need for fully autonomous operation, surpass the usefulness of the advanced security infrastructures of that time that included authorization services, public key infrastructures and certificate issuance and validation services. Possessing a certified identity in a dynamic and open environment does not a priori guarantee an acceptable behaviour and performance. In open and dynamic systems of such scale, one cannot make informed decisions on access restrictions and controls, or selection of potential candidates to link in and interact on solely the basis of a certified identity. Mere knowledge of a certified identity alone is even less adequate for reasoning about the expected behaviour and dependability of entities for which no prior knowledge is available. Entities need to be distinguished not only based on their certified identities (which are static) but also based on their (un)expected, dynamically varying qualities that are relevant to the specific interaction context. Furthermore, such judgments, by necessity subjective due to the requirement for fully autonomous operation, need to be reviewed and possibly revised on a regular basis. For on-line services to achieve the same levels of acceptance as their conventional counterparts, trust management had to become an intrinsic part of on-line service provision.

Virtual community management, access management, business or social network partner selection, engagement in on-line transactions and e-commerce, and on-line service provision were some of the areas where we saw a need for a practical, scalable and adaptable technology to capture, measure and manage the trusting relationships that underlie the interaction of on-line entities. Paving the way for such technology requires transfer of knowledge and close collaboration not only between academia and industry but also between different disciplines.

## 2.2 First steps of an international research community in trust management

The iTrust research community soon expanded from its European base to include researchers from Australia, and North America. Community members ranged from legal experts to philosophers to psychologists to experimental economists and many information and network security experts.
In 2003 a collection of research results were published by the iTrust community in [26], following an iTrust community conference in Crete, Greece, and covering already a good mix of areas:

* *Trust Models:* including for example a model for “Regularity-Based Trust in Cyberspace” by Minsky, and a model “Integrating Trustfulness and Decision Using Fuzzy Cognitive Maps” by Castelfranchi.

* *Policy-based systems:* including for example a paper distilling the “Experience with the KeyNote Trust Management System: Applications and Future Directions” by Matt Balze and the KeyNote team, as well as a proposal of “Trust Management Tools for Internet Applications” by Tyrone Grandison, Morris Sloman.

* * Credential disclosure negotiation:* including for example an overview of trust negotiation principles and tools by Marianne Winslett in her paper “An Introduction to Trust Negotiation”.

* *Authentication systems and identity-based access control:* including for example research on “Authenticated Dictionaries for Fresh Attribute Credentials” by William Winsborough and his team, and an “Implementation of an Agent-Oriented Trust Management Infrastructure Based on a Hybrid PKI Model” by Yücel Karabulut.

* *Reputation systems:* including for example work on “Simulating the Effect of Reputation Systems on E-markets” by Jøsang.

* *Computational trust:* including for example work on “Trusting Collaboration in Global Computing Systems” by Paddy Nixon and his team, as well as research on “Trust Propagation in Small Worlds” by Christian D. Jensen et al.

* *Computer systems:* including work on “Hardware Security Appliances for Trust” by Adrian Baldwin and Simon Shiu, as well as work on “Managing Trust and Reputation in the XenoServer Open Platform” by Andrew Twigg and the XenOS team in Cambridge.

* *Early applications:* including work “Towards the Intimate Trust Advisor” and a “Methodology to Bridge Different Domains of Trust in Mobile Communications” by Piotr Cofta et al.

* *Socio-technical analyses:* including for example an analysis on “Social Capital, Community Trust, and E-government Services” by Michael Grimsley, Anthony Meehan, and a “A Trust Matrix Model for Electronic Commerce” by Yao-Hua Tan.

* *Formal modelling of legal aspects:* including for example an analysis on “Trust, Reliance, Good Faith, and the Law” by Giovanni Sartor et al.

The iTrust community continued to build on such works to produce even stronger results that were published in [27] following a community event in Oxford, UK, in 2004. The event in Oxford emphasised on trust in large scale distributed systems and virtual organisations, on the use of recommendation and reputation systems in social networks and on-line services and on socio-technical and legal analyses:

* *Large-scale systems and virtual organisations:* included works such as “Engineering Trust Based Collaborations in a Global Computing Environment” by Sotiris
Terzis et al, "Towards Dynamic Security Perimeters for Virtual Collaborative Networks" by Ivan Djordjevic et al., "Trust, Security, and Contract Management Challenges for Grid-Based Application Service Provision" by Damian Mac Randal et al., "Towards Trust Relationship Planning for Virtual Organizations" by Philip Robinson, Jochen Haller et al., and "Deploying Trust Policies on the Semantic Web" by Brian Matthews et al., and "W5: The Five W's of the World Wide Web" by Massimo Marchiori from the W3C consortium.

* *Recommendation and reputation systems:* included for example “Using Trust in Recommender Systems: An Experimental Analysis” by Paolo Massa, Bobby Bhattacharjee, and “A Case for Evidence-Aware Distributed Reputation Systems: Overcoming the Limitations of Plausibility Considerations” by Philipp Obreiter.

* *Socio-technical analyses:* included works such as “Human Experiments in Trust Dynamics” by Catholijn M. Jonker, et al., “Modeling Controls for Dynamic Value Exchanges in Virtual Organizations” by Yao-Hua Tan et al., “Analyzing Correlation between Trust and User Similarity in Online Communities” by Cai-Nicolas Ziegler, et al., “Managing Internet-Mediated Community Trust Relations” by Anthony Meehan et al., “Trust Development and Management in Virtual Communities” by Tanko Ishaya et al., “Trust Mediation in Knowledge Management and Sharing” by Cristiano Castelfranchi.

* *Legal analyses:* included for example work on “Addressing the Data Problem: The Legal Framework Governing Forensics in an Online Environment” by Ian Walden.

The iTrust event in Oxford also fostered pioneering research investigating the interplay between on-line trust, risk and privacy as well as the role of trust in systems analysis and requirements engineering:

* *Trust and risk:* included for example “Analysing the Relationship between Risk and Trust” by Audun Jøsang and Stéphane Lo Presti, and “Using Risk Analysis to Assess User Trust: A Net-Bank Scenario” by Ketil Stølen.

* *Trust and privacy:* included for example “Trading Privacy for Trust” by Jean-Marc Seigneur, Christian Damsgaard Jensen, “Supporting Privacy in Decentralized Additive Reputation Systems” by Elan Pavlov et al.

* *Trust in requirements engineering:* included “Requirements Engineering Meets Trust Management: Model, Methodology, and Reasoning” by Fabio Massacci, John Mylopoulos et al.

The event in Oxford was also marked by an accompanying collection of tutorials and solution demonstrations that intensified knowledge transfer by bringing the iTrust community together with TrustCoM [28] a major industry driven research project that brought together innovators from Atos, BT, BAe Systems, IBM, Microsoft and SAP to implement a collection standards-based web services technologies to facilitate secure business operation in virtual organisations.

Research in the iTrust community continued to produce strong results in 2005 including the following published in [29] after an iTrust community event in Paris, France, where emphasis moved on to computational trust, socio-technical and legal analyses.
* *Models of Computational trust:* included works such as “Trust, Untrust, Distrust and Mistrust - An Exploration of the Dark(er) Side” by Steve Marsh and Mark R. Dibben, “A Representation Model of Trust Relationships with Delegation Extensions” by Javier Lopez et al., “Towards a Generic Trust Model - Comparison of Various Trust Update Algorithms” by Michael Kinateder et al., and “Towards an Evaluation Methodology for Computational Trust Systems” by Jean-Marc Seigneur et al.

* *Socio-Technical analyses:* included “Affect and Trust” by Lewis Hassel, “On Deciding to Trust” by Maria Fasli et al., and “Foraging for Trust: Exploring Rationality and the Stag Hunt Game” by Steven O. Kimbrough.

* *Legal analyses:* included works such as “Security and Trust in the Italian Legal Digital Signature Framework” by Stefano Zanero, and “Specifying Legal Risk Scenarios Using the CORAS Threat Modelling Language” by Tobias Mahler and Ketil Stølen et al.

The iTrust event in Paris in 2005 was marked by demonstrations of solution prototypes covering a wide range of security and trust applications from compliance enabling technology to grid computing and virtual organizations, and from risk modeling to requirements engineering. Short papers summarizing the innovative solutions being demonstrated were also published in [29].

Year 2006 was when a decisive test for the trust management community as the iTrust working group had to prove its strength and maturity by continuing as a self-funded research community without any formal subsidy or sponsorship by national governments or the European Union. That was the time that Fabio Martinelli and Fabio Massacci offered to host an iTrust meeting in Pisa, Italy supported by Ketil Stølen from Norway and William H. Winsborough from the USA. In recognition of the continuing quality of research produced within the iTrust community, Springer, who had been publishing the proceedings of all previous iTrust events, agreed to continue publishing its proceedings. Results published in [30] following the iTrust 2006 event in Pisa, included research in reputation systems, trust-based decision making, and socio-technical analyses:

* *Recommendation and reputation systems:* included for example “Generating Predictive Movie Recommendations from Trust in Social Networks” by Jennifer Golbeck, “PathTrust: A Trust-Based Reputation Service for Virtual Organization Formation” by Jochen Haller et al., and “Virtual Fingerprinting as a Foundation for Reputation in Open Systems” by Adam J. Lee and Marianne Winslett.

* *Trust-based decision making in trust networks:* included for example “Exploring Different Types of Trust Propagation” by Audun Jøsang and Stephen Marsh, “Gathering Experience in Trust-Based Interactions” by Sotiris Terzis, “A Versatile Approach to Combining Trust Values for Making Binary Decisions” by Tomas Klos, Han La Poutré, as well as “Provision of Trusted Identity Management Using Trust Credentials” by Siani Pearson, Marco Casassa Mont, and a “Bayesian Trust Framework for Pervasive Computing” by Daniele Quercia, Licia Capra et al.

* *Socio-technical analysis:* included “Why We Need a Non-reductionist Approach to Trust” by Cristiano Castelfranchi, “Modelling Trade and Trust Across Cultures” by
Catholijn M. Jonker et al., and "Being Trusted in a Social Network: Trust as Relational Capital" by Rino Falcone et al.

Building on the tradition of previous events, iTrust 2005 included a collection of innovative solutions for a variety of applications from user classification to trust establishment, and from authorization services based on trust negotiation to threat to vulnerability and risk assessment tools. Short papers summarizing these solutions were published in [30].

## 3 A global trust management community under IFIP

At the side of iTrust 2006 event in Pisa, I had a discussion with Dr Fabio Martinelli, who was then leading the ERCIM European community on Trust and Security, and Professor Javier Lopez about the future of the trust management research community in Europe and its progress towards self-sufficiency and globalization. We decided that, having succeeded the test of iTrust 2006, and given that the community members included a significant number of researchers based in north America and in Australia, the time had come to formally recognize the global nature of the trust management community and propose the formation of a working group under the auspices of the International Federation of Information Processing (IFIP). Beyond its good academic reputation, one of the reasons for looking at IFIP has been its balanced and truly global reach including not only the developed economies where iTrust was already strong but also many of the rapidly developing economies in Asia, Middle East and Latin America. At that critical time, Dr Steven Marsh further contributed to the establishment of the IFIP working group on Trust Management by establishing a bridge with a research community in North America who were running the PST event on Privacy, Security and Trust supported by the National Research Council of Canada. IFIP agreed to form a working group on Trust Management under its technical committee on Security, while recognising and safeguarding the interdisciplinary nature of the trust management working group.

In order to strengthen the bond between the iTrust and PST communities the first IFIP Trust Management conference took place in New Brunswick, Canada in 2007. The proceedings of that event were again published by Springer, albeit under the IFIP series. The research results published in [31] included a mix of works on privacy, trust and legal analysis, including the following:

* *Legal analysis:* such as "Pulling it all together...privacy, security, cybercrime and safety" by Parry Aftab.

* *Trust models and trust management:* such as a paper presenting a "Private Distributed Scalar Product Protocol With Application To Privacy-Preserving Computation of Trust" by Danfeng Yao et al., research on "Trust Transfer in Distributed Systems" by Naranker Dulay et al., a "Content Trust Model for Detecting Web Spam" by Wang Wei and Zeng Guosun, and "A trust protocol for community collaboration" by Samuel Galice et al.
* *Recommendation and Reputation systems:* such as “Exploiting Trust and Suspicion for Real-time Attack Recognition in Recommender Applications” by Ebrahim Bagheri and Ali Ghorbani, research on “Self-Selection Bias in Reputation Systems” by Mark Kramer and research on “Resisting Sybils in Peer-to-peer Markets” by Jonathan Traupman.

* *Security and Privacy:* such as “A Privacy-Aware Service Discovery Middleware for Pervasive Environments” by Valerie Issarny et al., and an “Analysis of the implicit trust within the OLSR protocol” by Asmaa Adnane, et al., as well as “Negotiation for Authorisation in Virtual Organisations” by Shamimabi Paurobally and “A Geo Time Authentication System” by Leonardo Mostarda, et al.

In 2008, the IFIP working group on Trust Management had its annual event in Europe (Norway) where the focus was on trust modeling, recommendation and reputation systems, trust and privacy and socio-technical analyses [32]:

* *Trust modeling:* included “A Trust Evaluation Method Based on Logic and Probability Theory” by Reto Kohlas et al., “An Intensional Functional Model of Trust” by Kaiyu Wan, and A UML-based Method for the Development of Policies to Support Trust Management” by Ketil Stølen et al.

* *Recommendation and reputation:* included “Trust-Based Collaborative Filtering” and “SOFIA: Social Filtering for Robust Recommendations” by Licia Capra et al., “Continuous Ratings in Discrete Bayesian Reputation Systems” by Audun Jøsang et al., “Modeling Trust for Recommender Systems using Similarity Metrics” by Georgios Pitsilis, and “A Robust and Knot-Aware Trust-Based Reputation Model” by Nurit Gal-Oz, et al.

* *Privacy and trust:* included “A Model for Reasoning About the Privacy Impact of Composite Service Execution in Pervasive Computing” by Valérie Issarny, “Protecting Location Privacy through Semantics-aware Obfuscation Techniques” by Elisa Bertino et al., and an “Automatic Verification of Privacy Properties in the Applied pi Calculus” by Mark Ryan et al.

* *Socio-technical analysis:* included “Cooperation in Growing Communities” by Rowan Martin-Hughes and “The North Laine Shopping Guide: A Case Study in Modelling Trust in Applications” by Anirban Basu.

A collection of new technology demonstrations were also shown in IFIPTM 2008 including a stochastic reputation service for virtual organizations, a solution for monitoring application services, and a trust-based personalized travel guide. Short papers presenting these solutions were also included in [32].

As the trust management community had already developed critical masses in northern Europe and North America, the third Trust Management community took place in Purdue University, West Lafayette, Indiana, USA. Research reported in [33] focused on social aspects and usability, trust reasoning, trust and risk, privacy and data security, and recommendation and reputation systems:

* *Social aspects and usability:* including “Spiral of Hatred: Social Effects in Buyer-Seller Cross-Comments Left on Internet Auctions” by Radoslaw Nielek, et al, and
"Graphical Passwords as Browser Extension: Implementation and Usability Study" by Kemal Bicakci et al.

* *Trust reasoning*: including "Elimination of Subjectivity from Trust Recommendation" by Elisa Bertino, et al., and "Trust-Enhanced Recommender Systems for Efficient On-Line Collaboration" by Georgios Pitsilis, et al.

* *Privacy and Data security*: including "Security in Wiki-Style Authoring Systems" by Christian Damsgaard Jensen, "On Usage Control in Data Grids" by Fabio Martinelli et al., and "Detection and Prevention of Insider Threats in Database Driven Web Services" by Danfeng Yao et al.

* *Information sharing and trust negotiation*: including "A Framework for Trustworthiness-Centric Information Sharing" by Ravi S. Sandhu et al., and "A Reconfigurable Framework for Trust Negotiation" by Marianne Winslett, et al.

* *Recommendation and reputation systems*: including "Comparison of the Beta and the Hidden Markov Models of Trust in Dynamic Environments" by Marie Elisabeth Gaup Moe, et al., and "Evaluating the STORE Reputation System in Multi-Agent Simulations" by Yücel Karabulut et al., as well as "Employing Key Indicators to Provide a Dynamic Risk Picture with a Notion of Confidence" by Ketil Stølen et al.

Following a community meeting at IFIPTM 2009, a restructuring of the working group to its current form was implemented and that came together with a re-affirmation of the commitment of the trust management research community to pursue its goal of a truly global reach. Consequently, Professor Yuko Murayama offered to host a community event in Morioka, Iwate, Japan for 2010. This would be the first time that a trust management conference was held in Japan. The IFIPTM 2010 was the first conference in the series to take place in the Far East and, through its success, offered a unique opportunity for all relevant research communities in Japan to be exposed to, engage in, trust management research. Although the Japanese economy is very similar to those of Europe and North America, IFIPTM 2010 validated that trust management is also appealing to societies with a different structure and societal fabric than those of Europe and North America. Research results published in [] included:

* *Privacy and trust*: including "Schemes for Privately Computing Trust and Reputation" by Nurit Gal-Oz et al., and "Self-service Privacy: User-Centric Privacy for Network-Centric Identity" by José M. del Álamo, et al.

* *Trust Models*: including "Non-monotonic Trust Management for Distributed Systems" by Naranker Dulay et al., and "Implementation and Performance Analysis of the Role-Based Trust Management System, RTC" by William Winsborough et al.

* *Experimental and Experiential trust*: including "Leveraging a Social Network of Trust for Promoting Honesty in E-Marketplaces" by Kate Larson et al., "Does Trust Matter for User Preferences? A Study on Epinions Ratings" by Georgios Pitsilis, et al., and "Bringing the Virtual to the Farmers' Market: Designing for Trust in Pervasive Computing Systems" by Ian Wakeman, et al.

* *Security and trust*: including a "Visitor Access Control Scheme Utilizing Social Relationship in the Real World" by Gen Kitagata et al., and "Metric Strand Spaces for Locale Authentication Protocols" by Joshua D. Guttman et al., as well as "An
Enterprise Service Bus for Access and Usage Control Policy Enforcement" by Gabriela Gheorghe, et al.

In 2011, IFIPTM returned to Europe and was hosted in Copenhagen, Denmark. The research published in [34] included works in trust models, reputation systems, social aspects and usability, and trust / privacy in the cloud:

* *Trust Modeling*: such as “From Access Control to Trust Management, and Back - A Petition” by Dieter Gollmann, and “Composing Trust Models towards Interoperable Trust Management” by Valérie Issarny, et al.

* *Recommendation and reputation systems*: such as “Detecting and Reacting to Changes in Reputation Flows” by Sini Ruohomaa et al., and "From Reputation Models and Systems to Reputation Ontologies" by Rehab Alnemr, et al.

* *Social aspects and usability*: such as “The Evolution of Trust” by Pam Briggs, “Why We Need More Effective Trust Signaling” by Angela Sasse, and “Identifying Knots of Trust in Virtual Communities” by Nurit Gal-Oz, et al.

* *Trust in the Cloud*: such as “Enhancing Data Privacy in the Cloud” by Gene Tsudik et al., and “Regulatory Impact of Data Protection and Privacy in the Cloud” by Srijith K. Nair et al.

In 2012 the leadership of the IFIP working group of Trust Management decided to take yet another risk. Year 2012 is the first time that the IFIP trust management working group organizes an event – including its main conference – in India. The main motive for hosting an IFIPTM conference in India has been to introduce the trust management discipline to the research communities of the Indian subcontinent and engage these communities into the research fostered by the IFIP working group on Trust Management. Part of the motivation has also been to illustrate the catalyst role that Trust Management methods, techniques and know-how can play in a rapidly developing economy and to a society that has yet another significantly different fabric and foundation than those of Europe and North America. The impact of IFIPTM 2012 in India is yet to be experienced and analyzed but the first indications from the IFIPTM Winter School in Surat in early 2012 are encouraging and show a high level of interest and likely involvement from the local research communities.

# 4 Concluding remarks

The mission of the IFIP Trust Management working group, remains as – if not more – relevant now than in 2001. Trust remains a fundamental consideration for the growth and stability of markets and communities because trust guides decisions about interactions between humans and organizations. Furthermore, the emergence of Cloud applications and infrastructures, the establishment of interconnected social networks, covering now most social activities in modern life, and the proliferation of personal devices and smart appliances offering continuous connectivity to on-line services from mixed home and work environments, bring about a situation that necessitates a radical rethinking of old security and on-line interaction models that poses new challenges.
These challenges may be different in nature than those of 2001 but still make the abil-
ity to understand and manage trust and trust-based decision making equally critical.
Nurturing this ability is critical not only for safe-guarding and improving our on-line
experience, but also for avoiding another drop in consumer or corporate confidence in
these new technologies and new ways of social and business conduct, analogous to
the dot-com bubble burst of 2001.

The relative difficulty of assessing trust in online environments leads to security problems on many levels. On the commercial level, the exploitation of global network mechanisms can enable attackers to disrupt services on a massive scale. Individuals or organized groups of criminals may also use automated agents to exploit market platforms to commit fraud and gain unfair advantages. On the psychological level, cleverly designed deceptions can dupe a significant percentage of online users into divulging sensitive information. On the social and political levels, online media and communities can be manipulated to create unnatural opinion biases and to hijack democratic processes.

Currently there is relatively little technology support available for assessing the re-
liability and good faith of entities and the quality of resources in online environments.
In addition, experiments show that people have a higher tendency to deceive through
online interaction than in face-to-face interaction. This creates a great deal of uncer-
tainty and risk, but it is in this environment that online communities and markets must
grow.

Because trust is a relationship between the relying party and the trusted party, trust management has two main facets. On the one hand, trust management is the activity of assessing the reliability and good faith of other parties, as well of assessing the security, reliability and quality of online services, and to make better decisions about which parties it is safe to transact with. On the other hand trust management focuses on designing reliable and secure systems and processes, and allows participants in online markets and communities to represent themselves as serious and reliable players. In that way trust management serves both sides of a trust relationship. The combination of providing an incentive for good faith and quality services and of providing a mechanism for sanctioning low-quality services and deceptive behavior has the effect of stimulating the emergence of quality markets and communities.

Research in the area of trust management brings together methods and tools from
multiple disciplines including policy, information security, artificial intelligence, law,
and cognitive sciences in order to help human and software agents to assess risk and
develop trust in their on-line interactions and their reliance on information and com-
munication technologies.

Ten years after the dot com burst in the “developed” economies of northern Eu-
rope, North America, and the Far East, there are similarities between the challenges
that these “developed” economies faced while rebuilding trust in their on-line services
and their on-line communities and the challenges faced by rapidly developing coun-
tries, such as those in the Indian subcontinent, elsewhere in Asia and in the Middle
East. I think that academics, professionals, and entrepreneurs in today’s rapidly “de-
veloping” economies can benefit by understanding trust and trust management and by
studying the achievements and pitfalls of the “developed” economies who had rebuilt
trust in on-line communities and on-line services over the last ten years. It is my hope and expectation that the IFIP working group on Trust Management will play a catalyst role in this evolution and help to pave a way for a free, robust and resilient on-line market \as the dynamics of the global economy evolve and new opportunities and growth shifts from the mature and declining economies of the West to the immature but vibrant and rapidly growing economies of the East. I wish that the IFIPTM 2012 event in Surat India plays a very fruitful and pioneering role in this direction.

## 5 References

1. D. Gambetta. "Can We Trust Trust?" In Gambetta, Diego (ed.) Trust: Making and Breaking Cooperative Relations, electronic edition, Department of Sociology, University of Oxford, pp. 213-237, http://www.sociology.ox.ac.uk/papers/gambetta213-237.pdf, 1998

2. D.H. McKnight and N.L. Chervany. The Meanings of Trust. Technical Report MISRC Working Paper Series 96-04, University of Minnesota, Management Information Systems Research Center, URL: http://misrc.umn.edu/wpaper/, 1996.

3. S.P. Marsh, Formalising Trust as a Computational Concept, in Computing Science and Mathematics, 1994, University of Stirling, p. 170

4. A. Jøsang. Artificial Reasoning with Subjective Logic, in 2nd Australian Workshop on Commonsense Reasoning, 1997, http://www.idt.ntnu.no/~ajos/papers.html

5. A. Jøsang A subjective metric of authentication, in 5th European Symposium on Research in Computer Security (ESORICS'98), 1998: Springer-Verlag, http://www.idt.ntnu.no/~ajos/papers.html

6. A. Jøsang The right type of trust for distributed systems, in ACM New Security Paradigms Workshop, 1996, http://www.idt.ntnu.no/~ajos/papers.html

7. A. Jøsang. A Logic for Uncertain Probabilities. *International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems*. 9(3), pp.279-311, June 2001

8. Blaze M., Feigenbaum J. and Lacy J. Decentralized Trust Management, in *IEEE Conference on Security and Privacy*, 1996, Oakland, California, USA, http://www.crypto.com/papers/policymaker.pdf

9. M. Blaze, et al. (2003) "Experience with the KeyNote Trust Management System: Applications and Future Directions." *Proc. of First Int. Conf. on Trust Management iTrust 2003*. Springer-Verlag LNCS 2692, pp. 284-300.

10. S. Anderson, et al. (2005) Web Services Trust Language (WS-Trust). http:// specs.xmlsoap.org/ws/2005/02/trust/WS-Trust.pdf

11. T. Grandison, M. Sloman. A survey of trust in Internet applications. IEEE Communications Surveys and Tutorials 3 (2000) 2–16

12. S. Ruohomaa, L. Kutvonen: Trust Management Survey. iTrust 2005: 77-92

13. A. Jøsang, R. Ismail, C. Boyd. "A Survey of Trust and Reputation Systems for Online Service Provision". *Decision Support Systems* **43** (2), 2007

14. A. Josang, C., Keser, and T. Dimitrakos. "Can We Manage Trust?" In: P. Herrmann et al. (Eds.): *iTrust 2005*, LNCS 3477, pp. 93-107.

15. Jack Willoughby "Burning Up", article in Barrons magazine, March 20, 2000

16. Theo Dimitrakos: System Models, e-Risks and e-Trust. I3E 2001: 45-58

17. Theo Dimitrakos: A Service-Oriented Trust Management Framework. Trust, Reputation, and Security 2002: 53-72
18. T. Grandison and M. Sloman. Specifying and Analysing Trust for Internet Applications. In Proceedings of the 2nd IFIP Conference on e-Commerce, e-Business and e-Government (I3E2002), Lisbon, 2002

19. T. S. E. Maibaum: How Do I Trust Thee? Let Me Count The Ways. IEEE ICCI 2002:23

20. Andrew J I Jones and Babak Firozabadi, "On the characterisation of a trusting agent - aspects of a formal approach", in Cristiano Castelfranchi et al., eds., Trust and Deception in Virtual Societies, Kluwer Academic Publishers, Dordrecht, Holland, 2001, pp. 157-168.

21. Rino Falcone, Cristiano Castelfranchi: The Socio-cognitive Dynamics of Trust: Does Trust Create Trust? Trust in Cyber-societies 2000:55-72

22. Cristiano Castelfranchi, Rino Falcone: Trust is Much More Than Subjective Probability: Mental Components and Sources of Trust. HICSS 2000

23. S. Jones, M. Wilikens, P. Morris, M. Masera, "Trust Requirements in E-Business: A Conceptual Framework", Communications of the ACM, December 2000, Vol 43.

24. T. Dimitrakos, D. Raptis, B. Ritchie, K. Stølen: Model Based Security Risk Analysis for Web Applications. EuroWeb 2002, Workshops in Computing BCS 2002

25. R. Fredriksen, M. Kristiansen, B.A. Gran, K. Stølen, T.A. Opperud, T. Dimitrakos: The CORAS Framework for a Model-Based Risk Management Process. SAFECOMP 2002

26. Paddy Nixon, Sotirios Terzis (Eds.): Trust Management, First International Conference, iTrust 2003, Heraklion, Crete, Greece, May 28-30, 2003, Proceedings. Lecture Notes in Computer Science 2692 Springer 2003, ISBN 3-540-40224-1

27. Christian Damsgaard Jensen, Stefan Poslad, Theo Dimitrakos (Eds.): Trust Management, Second International Conference, iTrust 2004, Oxford, UK, March 29 - April 1, 2004, Proceedings. Lecture Notes in Computer Science 2995 Springer 2004, ISBN 3-540-21312-0

28. Theo Dimitrakos, David Golby, Paul Kearney. Towards a Trust and Contract Management Framework for Dynamic Virtual Organisations. In eAdoption and the Knowledge Economy: eChallenges 2004

29. Peter Herrmann, Valérie Issarny, Simon Shiu (Eds.): Trust Management, Third International Conference, iTrust 2005, Paris, France, May 23-26, 2005, Proceedings. Lecture Notes in Computer Science 3477 Springer 2005, ISBN 3-540-26042-0

30. Ketil Stølen, William H. Winsborough, Fabio Martinelli, Fabio Massacci (Eds.): Trust Management, 4th International Conference, iTrust 2006, Pisa, Italy, 2006, Proceedings. Lecture Notes in Computer Science 3986 Springer 2006, ISBN 3-540-34295-8

31. Etalle, S. and Marsh, S., ed. (2007) Trust Management, Proceedings of IFIPTM 2007: Joint iTrust and PST Conferences on Privacy, Trust Management and Security, July 30-August 2, 2007, New Brunswick, Canada. IFIP International Federation for Information Processing 238. Springer Verlag, Berlin. ISBN 978-0-387-73654-9

32. Yücel Karabulut, John C. Mitchell, Peter Herrmann, Christian Damsgaard Jensen (Eds). Trust Management II: Proceedings Of Ifiptm 2008, Joint Itrust And Pst Conferences On Privacy, Trust Management And Security, June 18-20, 2008, Trondheim, Norway

33. Elena Ferrari, Ninghui Li, Elisa Bertino, Yücel Karabulut (Eds.): Trust Management III, Third IFIP WG 11.11 International Conference, IFIPTM 2009, West Lafayette, IN, USA, June 15-19, 2009. Proceedings. IFIP Conference Proceedings 300 Springer 2009

34. Masakatsu Nishigaki, Audun Jøsang, Yuko Murayama, Stephen Marsh (Eds.): Trust Management IV - 4th IFIP WG 11.11 International Conference, IFIPTM 2010, Morioka, Japan, June 16-18, 2010. Proceedings. IFIP Conference Proceedings 321 Springer 2010

35. Ian Wakeman, Ehud Gudes, Christian Damsgaard Jensen, Jason Crampton (Eds.): Trust Management V, 5th IFIP WG 11.11 International Conference, IFIPTM 2011, Copenhagen, Denmark, June 29-July 1, 2011, Proceedings. IFIP Publications 358 Springer 2011