Patent Publication Number: US-8116450-B2

Title: System and method for utility sampling for trust metrics in pki

Description:
STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT 
     This invention was made with Government support under Contract No.: W911NF-06-3-0001 awarded by Army Research Office (ARO). The Government has certain rights in this invention. 
    
    
     BACKGROUND 
     1. Technical Field 
     This disclosure is directed to a new trust metric for a network of public key certificates. 
     2. Discussion of Related Art 
     In any networked situation, trust in entities, especially business entities with which a user may have monetary transactions, is a challenging issue. Consider the case of the public key infrastructure (PKI), where a reputed entity called certificate authority (CA) authenticates, usually via a chain of public key authentications, a target entity&#39;s public key and other information about the target entity. This, however, requires a user&#39;s implicit trust in the CA&#39;s ability to associate the “other information” with the target public key. As the authentication of the target public key is done via a chain of authentications, a similar trust in the ability of intermediaries in associating information about the next entity in the chain with the public key of the next entity is required. On top of this, the user must trust CA&#39;s public key. Although this last trust may be justified, hinted by the fact that the CA is a reputed entity, the trust in other entities in the chain of authentications is never perfect. 
     Thus, a user is inevitably led to determine the net trust it can place in the full chain of authentications, usually by various algebras on trust metrics. Moreover, this net trust, or the utility of this trust, also depends on the kind of information that was authenticated. For example, if the information in a certificate authenticates a public key with a business name and its web address, then the user&#39;s net trust determined by such algebras is only about the public key being associated with the business name. The user must independently determine how much it trusts the business name being a bona-fide business. On the other hand, if the certificate also authenticates, along with the above information, that the business has a five star service quality, then the user is more inclined to trust the business. 
     A simplistic trust metric is used in PGP (Pretty Good Privacy). However, it does not address the situation where fictitious copies of entities are created just to boost the trust of a certain entity. Even in the context of PKI, various trust metrics have been proposed. Of particular importance is the work of Reiter and Stubblebine, “Toward Acceptable Metrics of Authentication”, Proc. IEEE Symp. on Security and Privacy, 1997, the contents of which are herein incorporated by reference in their entirety, who proposed a set of eight principles which a good trust metric should follow. Reiter and Stubblebine also proposed a metric which claimed to follow these principles. As one of the more important principles, they had required that the metric&#39;s output should be intuitive and relevant to the authentication decision. Following this principle, in their solution, a metric can be computed which represents the amount for which the information bound to the target public key is insured. Another important principle states that the metric should be resilient to modifications of the model by misbehaving parties. Since their metric computes a minimum insured value regardless of misbehavior of all parties (except the root), this principle is satisfied. 
     Although, this metric is useful to a user, and also remedies many other issues with earlier metrics, it has some drawbacks: (a) it does not tell the user what the premium for the insurance is, (b) it does not model how the insurance amounts were determined, and (c) it forces the user to deal with all entities in the network for insurance claims. Although, the drawbacks (b) and (c) may really be implementation issues, drawback (a) may be of real concern, and actually violates one of their principles, namely “the metric should take into account as much information as possible that is relevant to the authentication decision that the user is trying to make”. 
     BRIEF SUMMARY 
     Exemplary embodiments of the invention as described herein generally include methods and systems for a new trust metric for a network of public key certificates, e.g. as in PKI, which allows a user to buy insurance at a fair price on the possibility of failure of the certifications provided while transacting with an arbitrary party in the network. A method according to an embodiment of the invention combines a trust metric based on belief functions and an insurance metric proposed by Reiter and Stubblebine which addresses various practical aspects of trust algebras. A method according to an embodiment of the invention provides a final metric that allows a user to determine the insurance premium, but also allows the user to insure to any amount of his or her choice, up to a limit. Further, this limit is part of a metric according to an embodiment of the invention. Thus, rather than the insurance amount, a metric according to an embodiment of the invention reflects the cost of insurance per dollar amount, and an upper limit on the applicability of this rate. This upper limit corresponds to the mean and variance of the trust value viewed as a belief function. Thus, a metric according to an embodiment of the invention, while satisfying all the principles of Reiter and Stubblebine, further addresses issues raised by proponents of “trust as belief functions”, where a belief function is not just a single probability value, but one which also incorporates uncertainty. This allows for the computation of insurance premiums. 
     A trust metrics according to an embodiment of the invention is modeled on a simple and intuitive theory of “utility sampling”. A metric according to an embodiment of the invention can be used in a reputation system as well, where the reputation of the agents is viewed as a currency in lieu of monetary amounts involved in insurance based systems. In many contexts, including Internet commerce, reputation has become an alternative currency. In this viewpoint, an end-user never buys insurance, but a failure to deliver results in a loss of reputation of that agent. A trust metric according to an embodiment of the invention, which is an insurance rate and an upper limit, then becomes a reputation rating along with a variance (or confidence value). A loss of reputation leads to an appropriate adjustment of these metrics, and a model based on “utility sampling” enables exactly that, while satisfying the Reiter-Stubblebine properties. A metric according to an embodiment of the invention conserves all the beneficial properties of the latter over other schemes, including protecting the user from unintentional or malicious dependencies in the network of certifications. 
     According to an aspect of the invention, there is provided a method for measuring trust in a transaction over a public key certificate network, including providing a public key certificate network comprising a directed acyclic graph whose nodes are public keys and where an edge K A →K B  implies an owner of public key K A  is in possession of a certificate for public key K B , associating each edge K A →K B  of the public key certificate network connecting two public keys K A , owned by A, and K B , owned by B, with a probability p, according to A, that information about K B  is reliable, and a confidence c that is a total dollar amount of transactions which have involved using edge K A →K B , forming one or more authentication paths in the public key certificate network starting from a certificate authority having public key K S  and ending with a target public key K T , calculating a limit l on an amount of insurance that an owner of K S  is willing to provide to a user interested in a transaction with an owner of K T , and for each amount m&lt;l, calculating a premium for which the owner of K S  is willing to sell insurance to the user for an amount of m. 
     According to a further aspect of the invention, the probability p and confidence c associated with each edge K A →K B  are calculated using utility sampling. 
     According to a further aspect of the invention, using utility sampling comprises A acquiring over a time interval r positive observations and s negative observations of a reliability of information provided by B, where the edge probability 
             p   =     (       r   +   1       r   +   s   +   2       )           
and the edge confidence c=r+s.
 
     According to a further aspect of the invention, a total probability associated with an authentication path that terminates at the target key K T  is a product of the probability of each edge in the authentication path, and a total confidence associated with the authentication path that terminates at the target key K T  is a minimum value of the confidence values associated with each edge of the authentication path. 
     According to a further aspect of the invention, calculating the limit l on an amount of insurance for the one or more authentication paths ending with target public key K T  comprises calculating a maximum K S −K T  flow f in the directed graph, with a flow capacity on each edge being the c value of the edge. 
     According to a further aspect of the invention, calculating a premium for each amount m&lt;l comprises calculating a maximum amount insurable, f i , for each authentication path, calculating an insurance premium rate s i  for each authentication path, sorting the authentication paths in increasing order of rate s i , where the authentication paths are labeled P 1  to P n  in increasing order of rate s i , where n is a number of authentication paths, and calculating the premium for the amount m&lt;l from the sorted premium rates s i . 
     According to a further aspect of the invention, calculating the premium for the amount m&lt;l comprises insuring a first f l  dollars out of m according to P l  using rate s l , and insuring subsequent amounts using each successive path P i  using rate s i  until all m dollars are allocated. 
     According to a further aspect of the invention, calculating the premium for the amount m&lt;l comprises insuring a first f l  dollars out of m at an average premium rate over all paths P i , and insuring subsequent amounts an average premium rate excluding a rate associated with the amount already insured, until all m dollars are allocated. 
     According to a further aspect of the invention, calculating an insurance premium rate s i  for an authentication path comprises calculating, for each public key node in the authentication path, starting at K S , s i  from a formula (s i −a i )p i −(1−δ i )(1−p i )=γ, where s i  is the selling price of the premium, a i  is an amount that S, the owner of K S , pays to A, the owner of K A  for insuring δ i  fraction of the amount, and γ is a fraction expected profit per transaction expected by S, and where for each subsequent public key node A i  in the authentication path, the associated s i  will be the a i  paid from A i &#39;s predecessor node and the a i  will be the amount paid to A i &#39;s successor node. 
     According to a further aspect of the invention, the method comprises providing a list K Tl , . . . K ti , . . . , K Tn  of all public keys that B is attesting, where (p i , c i ) are the (p, c) values estimated by B about K Ti , having A attest T i  for each i via B after a time period using Δc i  additional samples where Δr i  of the samples show positive behavior by T i , and updating the probability associated with each edge K A →K B  from 
                 p       K   A     →     K   B         ←         p       K   A     →     K   B         +       ∑   i     ⁢     Δ   ⁢           ⁢       c   i     (     1   -          1   -       Δ   ⁢           ⁢     r   i     ⁢     p   i         Δ   ⁢           ⁢     c   i                  )               c       K   A     →     K   B         +       ∑   i     ⁢     Δ   ⁢           ⁢     c   i               ,         
and the confidence associated with each edge K A →K B  from
 
     
       
         
           
             
               c 
               
                 
                   K 
                   A 
                 
                 → 
                 
                   K 
                   B 
                 
               
             
             ← 
             
               
                 c 
                 
                   
                     K 
                     A 
                   
                   → 
                   
                     K 
                     B 
                   
                 
               
               + 
               
                 
                   ∑ 
                   i 
                 
                 ⁢ 
                 
                   Δ 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       c 
                       i 
                     
                     . 
                   
                 
               
             
           
         
       
     
     According to another aspect of the invention, there is provided a method for measuring trust in a transaction over a public key certificate network, including providing a public key certificate network comprising a directed acyclic graph whose nodes are public keys and where an edge K A →K B  implies an owner of public key K A  is in possession of a certificate for public key K B , associating each edge K A →K B  of the public key certificate network connecting two public keys K A , owned by A, and K B , owned by B, with a probability p, according to A, that information about K B  is reliable, and a confidence c that is a total dollar amount of transactions which have involved using edge K A →K B , using utility sampling to estimate p and c by having A acquire over a time interval r positive observations and s negative observations of a reliability of information provided by B, where the edge probability 
             p   =     (       r   +   1       r   +   s   +   2       )           
and the edge confidence c=r+s, forming one or more authentication paths in the public key certificate network starting from a certificate authority having public key K S  and ending with a target public key K T , where a total probability associated with an authentication path that terminates at the target key K T  is a product of the probability of each edge in the authentication path, and a total confidence associated with the authentication path that terminates at the target key K T  is a minimum value of the confidence values associated with each edge of the authentication path.
 
     According to a further aspect of the invention, the method includes calculating a limit l on an amount of insurance that an owner of K S  is willing to provide to a user interested in a transaction with an owner of K T , and for each amount m&lt;l, calculating a premium for which the owner of K S  is willing to sell insurance to the user for an amount of m. 
     According to another aspect of the invention, there is provided a program storage device readable by a computer, tangibly embodying a program of instructions executable by the computer to perform the method steps for measuring trust in a transaction over a public key certificate network. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         FIG. 1  illustrates a new metric, according to an embodiment of the invention. 
         FIG. 2  illustrates a Reiter-Stubblebine metric, according to an embodiment of the invention. 
         FIG. 3  is a flowchart of a method of measuring trust in a public key certificate network, according to an embodiment of the invention. 
         FIG. 4  is a block diagram of an exemplary computer system for implementing a new trust metric for a public key certificate network, according to an embodiment of the invention. 
     
    
    
     DETAILED DESCRIPTION 
     Exemplary embodiments of the invention as described herein generally include systems and methods for a new trust metric for a network of public key certificates. Accordingly, while the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the invention to the particular forms disclosed, but on the contrary, the invention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. 
     A new metric according to an embodiment of the invention is best illustrated with a sequence of examples, each more complicated than the previous.  FIG. 1  is a graph illustrating a new metric according to an embodiment of the invention, with each node labeled by a public key and each edge labeled by a probability of accuracy and a confidence, described as follows. A sequence of authentications starting with a CA, e.g., with public key K S , and ending with a target public key K T , can be represented by a line graph, with nodes being the public keys of the entities involved, and the directed edges representing signatures. Each edge, say from K A  to K B , is also labeled with information which is associated with K B , and signed with secret key corresponding to K A . For example, this information may include the name B of the business associated with key K B . The information also includes a pair of values p(K A , K B ) and c(K A , K B ), called the probability of accuracy, and the confidence, respectively. The K A  and K B  will be dropped when they are clear from context. The value p represents the probability, according to A, that the information about K B  is reliable, including K B &#39;s owner&#39;s ability to recommend other entities and its ability to protect the key K B  etc. Note that “the probability is according to A” means that A has determined an underlying probability space, and it is in this space that A has estimated the probability. In absence of any other information then, conditioned on the fact that owner A of K A  is fully reliable, p(K A , K B ) represents the best estimate about the probability of accuracy of information associated with K B . If the line graph has an edge from K S  to K A , then it can be formally shown that p(K S , K A )p(K A , K B ) is the probability (according to S) of B being reliable, in absence of any other paths of edges between S and B. In this manner, S can calculate the probability (according to S itself) that the target T associated with K T , and its information is reliable. This probability, being a reliability indicator, can be used to calculate the premium S will charge to insure a certain amount of transaction with T. More details about this calculation and the underlying model will be given herein below. 
     However, S cannot insure an unlimited amount using this probability information, as the probability as estimated has a certain uncertainty attached to it, and here is where the confidence c comes in. As will be seen below, the probability p(K A , K B ) is estimated by A, using utility sampling. In simple terms, c(K A , K B ) is the total dollar amount of transactions which have been involved using that edge. Hence, this edge can only be used in an insurance of up to that amount, or possibly, a certain function of it. In a line graph, the minimum c value on the edges of the line graph determines the maximum amount that can be insured. For example, in the line graph in  FIG. 1 , represented by nodes K S , K A , K B  and K T , the maximum amount insurable is 100. 
     More formally, according to an embodiment of the invention, the probability value p is estimated as the mean of a second order probability. A second order probability density function is a density on first order probabilities, and this is the underpinning of belief functions. As an example, a p value of ½ could reflect both a case of no information, or a case of highly accurate information that the party being adjudged is only reliable half the time. In the former case, the variance of the second order probability is very high, whereas in the second case the variance is low. The theory will be described in more detail below. 
     In a more complicated example, consider multiple paths from S to the target entity T. As an example, again consider  FIG. 1 . Any path P i  from S to T can be treated as a line graph, and the min value of c on P i , denoted c i , is the limit on the amount insurable using that path. For instance, using the middle path K S , K A , K B , K T , the maximum insurable value is 100, and the corresponding probability is (1×0.98×0.99). On the other hand, using the top path K S , K C , K D , K T , the maximum insurable value is 200, with a corresponding probability of (0.99×0.99×0.90). Now, if a user is interested in a transaction of amount only 100 with T, then he could be offered insurance based on any of these paths used to calculate the premium, or the average premium—such more complicated strategies are described below. On the other hand, if the use is interested in a transaction worth 300, the first 200 can be filled using the top path and the premium determined using the corresponding probability, and the remaining 100 filled using the middle path, or some other path. In general, the total insurable amount equals the max flow in the graph, using the c labels, and this corresponds to the metric developed by Reiter-Stubblebine using the max-flow min-cut theorem. 
     A flowchart summarizing a method for determining trust in a public certification network is presented in  FIG. 3 . The details of the steps are described in more detail below. A method according to an embodiment of the invention assumes the existence of a public key certificate network represented as a directed acyclic graph whose nodes are public keys and where an edge K A →K B  implies an owner of public key K A  is in possession of a certificate for public key K B . Then, at step  31 , each edge K A →K B  of the public key certificate network connecting two public keys K A , owned by A, and K B , owned by B, is associated with a probability p, according to A, that information about K B  is reliable, and a confidence c that is a total dollar amount of transactions which have involved using edge K A →K B . The probability p and confidence c can be calculated using utility sampling, as described below, or, if there is insufficient data for utility sampling, the values may be initialized as described in the Boot-Strapping section, below. At step  32 , one or more authentication paths are formed in the public key certificate network starting from a certificate authority having public key K S  and ending with a target public key K T . A limit l on an amount of insurance that an owner of K S  is willing to provide to a user interested in a transaction with an owner of K T  can be calculated at step  33 . This limit can be calculated using the Ford-Fulkerson max-flow algorithm. At step  34 , for each amount m&lt;l, a premium is calculated for which the owner of K S  is willing to sell insurance to the user for an amount of m. Finally, at step  35 , the p and c values can be updated 
     One potential issue with other metrics (e.g. as in PGP) is that some of the paths and trust values may be dependent. For example, in  FIG. 1 , the owner of K C  (owner of K D ) may be same as K A  (same as K B  respectively), maliciously or otherwise. In a model according to an embodiment of the invention, the end user does not care, as he/she gets the insurance at a fair premium. The premium is fair because there may be several CA&#39;s providing a market. It is up to S to determine that the owners of K A  and K C , e.g. A and C, are the same or different. Even if it is determined that they are the same, a model according to an embodiment of the invention can incorporate the fact that S has assessed both A and C separately while obtaining the values (p(K S , K A ), c(K S , K A )) and p(K S , K C ), c(K S , K C )). 
     The Reiter-Stubblebine Model and Metric 
     A Reiter Stubblebine (RS-) metric, illustrated in  FIG. 2 , operates on a directed acyclic graph. The nodes in the graph are public keys, and the edge K A →K B  exists in the graph if the user is in possession of a certificate that assigns attributes, including an owner, to K B , and whose signature can be verified using K A . Each edge is labeled with the attributes included in the certificate that the edge represents. It is assumed that the attributes in a certificate are consistent. 
     Each edge K A →K B  also has a numeric label that represents the amount of money for which the owner of K A  insures the attributes and integrity of K B . In other words, it is the value for which the owner of K A  will be liable to the user if the attributes bound to K B  in the certificate are incorrect, or if the private key, corresponding to K B , is used to mislead the user, intentionally or otherwise. It is also natural to assume that the numeric label is part of the certificate. 
     The metric is best described using the example in  FIG. 2 . If the attributes bound to K T , the target public key, turn out to be false, the owners of K D , K B , and K E  are each liable to the user for the amount of 200, 600 and 100 respectively. It is also possible that when the user goes to, say the owner of K B , and the owner, or its attributes as certified, turns out to be delinquent, the user is now owed by the owners of K A  and K C , for the amount of 100 each. 
     Reiter and Stubblebine show that, in a case of a false binding for the target key, the minimum insured amount is equal to the minimum capacity cut in the graph from K S  to K T . For example, in  FIG. 2 , the minimum cut as shown has value 500, and that is the minimum insured value. 
     Some of the salient qualities of this metric and model are as follows. 
     1. The user is not required to ascertain name-to-key bindings to construct the model, except for the root CA, whose name-to-key binding is reputed, 
     2. The final metric computed is intuitive, 
     3. The final metric lets the user ascertain the risk involved in using K T , although this is improved upon herein below. 
     4. The final metric is computed easily using a Ford-Fulkerson algorithm. 
     5. The metric can be computed with partial information, and still give meaningful results, 
     6. The insurance metric allows a user to be protected from dependencies in the graph, whether they are intentional or malicious. This differentiates from other metrics, e.g. the metric used in PGP. In PGP, a target key binding is deemed reliable if two marginally reliable keys are authenticating it. However, those two keys may belong to the same marginally reliable person, i.e. the edges are highly dependent. In Reiter and Stubblebine, if there were two such authentications from the same person, the person is liable for both edges in case of a failure. 
     Reiter and Stubblebine mention that the metric could also include trust values, and then use only those edges which transcend a certain trust value. However, no specifics are given. The authors also mention that their metric does not address some real world issues, such as the insurance premium, determining liable parties, and recovery of funds. In fact, since the metric just computes a total insured value, regardless of the value of a transaction, a user is left to ascertain the risk involved in undertaking this transaction. One could argue that the user should not undertake a transaction if its value is a certain multiple of the insured value, and should go ahead and do the transaction if the value is less than this threshold. Clearly in such a situation, the insurance premium for a different valued transaction should be different. For example, if the minimum insured value turns out to be a $10,000, then if the user is only doing a transaction worth $1000, he should pay a correspondingly lower premium. 
     Thus, it is the rate of insurance which a user needs to know to assess risk, rather than the total insurable amount, and the Reiter-Stubblebine model does not provide that. A metric according to an embodiment of the invention resolves the rate of insurance needed to assess risk, while providing a sound and intuitive underlying model of trust. 
     A New Model and Metric 
     A model according to an embodiment of the invention shares many properties with the Reiter-Stubblebine (RS) model, and can in fact be seen as an extension, although there are fundamental differences. As in the RS-model, a metric according to an embodiment of the invention operates on a directed acyclic graph, with the nodes in the graph being public keys. An edge K A →K B  exists in the graph if the user is in possession of a certificate that assigns attributes, including the exclusive owner(s), to K B , and whose signature can be verified using K A . Each edge is labeled by the attributes included in the certificate that the edge represents. Each edge is also labeled with two numeric values p and c, whose significance will be pointed out below. 
     There maybe multiple source nodes in the graph, and only those source nodes in which the user has complete trust are of interest, including the binding of information to the source public key. The various source nodes can be seen as providing alternative metrics of use to the end user, and possibly a market for the metrics. 
     In the graph of  FIG. 1 , there is a target node, e.g. K T , and the end user is interested in a transaction with the owner of K T . The metric calculation enables the end user to determine the risk involved in the transaction, or alternatively, in the trust to place in the transaction. 
     A model according to an embodiment of the invention assumes that all the attributes in any certificate are consistent. For simplicity of presentation, assume that for each node, the information attributed to it, other than p and c, by various incoming edges is the same. This is not a limitation of a model according to an embodiment of the invention, but is there only to simplify the exposition. Thus it can be assumed that the attributes are labeled on the nodes, whereas the p and c values are labels on the edges. Moreover, assume that at the end of each transaction it can be determined, unambiguously for the end user and the source node, whether any of the attributes in the certificates involved were falsified. Here are a few examples of attributes in certificates:
         Web Address=www.xxx.com;   Name and Physical Address=N and A;   Dun and Bradstreet Solvency Rating=A (i.e. a third party rating value); and   The business associated with this public key WILL deliver.       

     For each transaction with the owner of K T , and each source node K S , a metric according to an embodiment of the invention provides a limit l on the amount of insurance that owner of K S  is willing to provide to the end user, and for each amount m&lt;l, the metric provides a premium for which the owner of K S  is willing to sell insurance to the end-user for an amount of m. 
     Note that, even if the end user is not interested in buying the insurance, or even if K S  is not in the business of selling insurance, the metric can be calculated by all parties regardless, and hence provides a good metric of the risk involved in the transaction. Of course, as will be seen below, the values p and c may reflect actual values more accurately, if monetary transactions or reputations are involved. 
     Calculating a Metric 
     Consider an algorithm to compute the upper limit on the insurable amount. This value is calculated based solely on the c labels of the edges. This upper limit is the maximum K S -K T  flow in the directed graph, with the capacity on each edge being the c value of the edge. By the max-flow min-cut theorem, this maximum flow is equal to the minimum capacity of the K S  to K T  cut of the c-labeled graph. For example, in  FIG. 1 , the min-cut is as depicted by the curved line, and its value is 500, which is also the max-flow in the graph. These values can be computed efficiently using the Ford-Fulkerson max-flow algorithm. There can be variations on this limit calculating algorithm, where the maximum amount insurable is some function of the max-flow. 
     Now, consider what the c values on the edges are supposed to represent. The c value on each edge K A →K B  is the total dollar amount of transactions that have ever been insured involving this edge. In effect, if the c value is too low, the variance in the probability estimate is so high that it is not practical to determine a good premium for insurance. So, a natural upper bound on the insurance amount is c, or some multiple of it. Hence, for any path from K S  to K T , the maximum amount insurable should be the minimum c value on that path. By the same reasoning, the maximum amount insurable using the whole directed graph should be the maximum flow in the graph, with a capacity bound on each edge being its c label. 
     Note that if the amount to be insured is much smaller than the maximum amount insurable, one may choose a variation where not all paths are considered, and a rough estimate on the premium suffices, usually with the benefit of the doubt going to the end user. This will become more apparent when the premium calculation is described, which comes next. In general, a premium calculation algorithm according to an embodiment of the invention can become a complex optimization task. But, for most purposes, simplicity in the algorithm maybe more of a determining choice than the optimal premium value, regardless of whether the premium is optimal from the end user&#39;s perspective or K S &#39;s perspective. 
     So, a simple variation of a premium calculating algorithm according to an embodiment of the invention performs the following. Assume that the maximum flow f (equivalent to limit l on the amount of insurance that owner of K S  is willing to provide to the end user) has been determined, based on the c labels, and that all the paths with non-zero flow are determined. For each such path P i , assume the flow attributed to the path is f i , with the sum being f. For each path P i , calculate the probability of accuracy p i  to be the product of the p labels on edges of the path. For example, in  FIG. 1 , if the path is K S , K A , K B , K T , then the probability of accuracy of this path is 1×0.98×0.99. Assume that for each dollar amount to be insured using this path P i , there is a formula for calculating the premium based on the probability p i . For example, let s i  be the price (selling price) of the premium, and a, be the amount that S, the owner of K S , pays to A, the owner of K A  for insuring δ, fraction of the amount. Also, assume that S expects a γ fraction expected profit per transaction. Then,
 
( s   i   −a   i ) p   i −(1−δ i )(1− p   i )=γ i .
 
Now, this formula is only for the source node S, and there are two quantities s i  and a i . a i  is the amount node S pays to its immediate successor, say A i , on path P i . s i  is the premium amount S charges the client or buyer, who is the one initiating the whole transaction. For the node A i , a similar situation arises, and for this node, s i  will be the a i  paid from its predecessor node S, and a i  will be the amount that node A i  pays to it&#39;s successor, and so forth.
 
     More specifically, since, the value a i  is calculated inductively down the path from S to T, one first calculates the value a i  at the bottom of the path. The quantity a i  is the amount paid to the entity down one link in the path for insuring a δ i  fraction. So, a i  is not the price per unit amount, but price for δ, fraction of unit, whereas, s i  is the price charged for unit amount. 
     So, to reflect this in the formula, assume that b i  is the price or premium per unit insured amount that a node pays to the node next to it. Then the above formula would read:
 
( s   i   −b   i δ i ) p   i −(1−δ i )(1 −p   i )=γ.
 
To be more precise, let the path P i  be V i1 , V i2 , . . . , V im , where V i1  is S and V im  is T. Let b ij  be the premium “unit” price V ij  pays V i(j+1) , and let b i0  be the premium that the customer pays to the top node, i.e. V i1  (=S). In other words, b i0  is s i . Also, let p ij  be the probability of accuracy on the edge V ij  to V i(j+1) . Then, the accuracy of the path from V ij  to V im  (for all j=1 to m−1) would be p ij ×p i(j+1) × . . . ×p i(m−1) . Call this quantity q ij . Now the formula for pricing looks like:
 
( b   i(j−1)   −b   ij δ ij ) q   ij −(1−δ ij )(1− q   ij )=γ
 
and this formula holds for all j=1 to m. When one sets j=m in the above, one obtains, because δ im =0, as no insurance is obtained at the last link:
 
 b   i(m−1)   q   i(m−1) −(1− q   i(m−1) )=γ
 
and hence b i(m−1)  is obtained from q i(m−1)  and γ. So, now one can inductively calculate the rest and b i0  will yield s i .
 
     Thus the value a i  is determined inductively, for each node along the path P i , and in fact towards the bottom end of the chain of authentication edges, the δ i  value could be zero. For example, A may not buy further insurance from B, and B may just be in a service contract with A. In case of failure of B or some node below B, the reputation of B goes down and he/she risks losing the service contract. Note that the above formula is exemplary and non-limiting, and in other embodiments of the invention, there are other ways the calculation of the premium s i  can be performed based on probability p i  and the path P i . 
     Thus, for each path P i , there is a maximum amount insurable, f i , and the rate of insurance premium s i . Next, the paths are sorted in increasing order of rate s i . If a user wants to insure an amount u&lt;f (note that u is equivalent to the amount m&lt;l, above), then the first f 1  dollars out of u are insured according to P 1  using rate s 1 , and the next f 2  dollars are insured using path P 2  using rate s 2 , and so forth till all the u dollars are allocated. 
     According to an alternative embodiment of the invention, the first f l  dollars can be insured at the average premium rate (over all i), and the next f 2  dollars can be insured at the average premium rate excluding s l , and so forth. This alternative represents the estimates of risk more accurately, especially if there are negative recommendations, e.g. p values less than ½. 
     Updating the p and c Values 
     The way the paths P i  are used to calculate the requisite premiums provides a way for the entities to improve their estimates on the probability of accuracy p, as well as c. Thus, if a path P i  was used to provide insurance for amount f i , each edge in the path can use this as a sample of size f i  for its probability estimation. Note that there is no hard and fast rule, and the entities may have their own way of weighting positive and negative samples. In fact, the entities may have their own completely different estimation mechanism, and this mechanism according to an embodiment of the invention is provided only as a guide. 
     While the node attesting the target node may be estimating the probability of a binary hypothesis, the intermediate nodes are attesting the probability of success itself of the next node. For example, in  FIG. 1 , the node K A  is estimating the accuracy of B to be 0.98. This accuracy of B includes its attestation that owner of K T  is reliable with probability 0.99. However, the estimation of p(K A , K B ) can be done as follows. Let K T1 , . . . , K Tn  be the list of all public keys and their attributes that B is attesting, and let the (p, c) values estimated by B about K Ti  be (p i , c i ). Then after a time period, where for each i, A attested T i  via B using Δc i  additional samples (dollar amounts), and Δr i  of the samples showed positive behavior by T i ,the new value of p(K A , K B ) (in short p A   new ) is given by 
                 p   A   new     =         p   A   old     ⁢       ∑   i     ⁢     Δ   ⁢           ⁢       c   i     (     1   -          1   -       Δ   ⁢           ⁢     r   i     ⁢     p   i         Δ   ⁢           ⁢     c   i                  )               c   A   old     +       ∑   i     ⁢     Δ   ⁢           ⁢     c   i               ,     
     ⁢       c   A   new     =       c   A   old     +       ∑   i     ⁢     Δ   ⁢           ⁢       c   i     .                   
Boot-Strapping
 
     One may ask, how the initial values p A  and c A  are arrived at. If one follows a model according to an embodiment of the invention strictly, the p A  value can be set to ½, however the c A  value also gets set to zero, as there has been no transaction ever with agent A. This may, however, preclude A from getting any business. However, there can be a simple engineering approximation to this, by setting c A  to a minimal value, say 100. In a more intelligent system, profiling can be used to initially (and even later) inherit p and c values from one agent to another. 
     Utility Sampling 
     Let h be a binary hypothesis that is true with probability pε[0, 1]. A second order probability (SOP) density function f is a function such that 
                 f   ⁡     (   p   )       ≥   0     ,     
     ⁢         ∫   0   1     ⁢       f   ⁡     (   p   )       ⁢           ⁢     ⅆ   p         =   1.           
Thus a second order probability density function is a density on the first order probability p. SOP density functions are used in modeling situations where the first order probability p is not known precisely.
 
     Assume that to start with, an agent A does not have any experience with the hypothesis h. One can model this by assuming that for the agent A the a priori distribution, ψ 0 (p) on p is uniform. If the agent A then makes r 1  positive and s 1  negative observations of the hypothesis h, then the posteriori probability density of p is given by (see the Appendix for details): 
                         ψ   1     ⁡     (       p   =     θ   |     r   1         ,     s   1       )       =         Γ   ⁡     (       r   1     +     s   1     +   2     )           Γ   ⁡     (       r   1     +   1     )       ⁢     Γ   ⁡     (       s   1     +   1     )           ⁢         θ     r   1       ⁡     (     1   -   θ     )         s   1           ,           (   1   )               
where r 1 , s 1 ≧0 and Γ is the gamma function. It is not difficult to derive (see Appendix) that if the agent subsequently makes r i  positive and s i  negative observations of the hypothesis h in the time interval i, then the posteriori probability density of p is given by
 
                         ψ   1     ⁡     (       p   =     θ   |     r   j         ,     s   j     ,     1   ≤   j   ≤   i       )       =         Γ   ⁡     (     r   +   s   +   2     )           Γ   ⁡     (     r   +   1     )       ⁢     Γ   ⁡     (     s   +   1     )           ⁢         θ   r     ⁡     (     1   -   θ     )       s         ,           (   2   )               
where
 
             r   =         ∑     j   =   1     i     ⁢       r   j     ⁢           ⁢   and   ⁢           ⁢   s       =       ∑     j   =   1     i     ⁢       s   j     .               
Note that the posteriori probability densities ψ i ( ) are beta distributions. In addition, the total number of observations r+s, and the fraction r/(r+s) have sufficient statistics for estimating the parameter p. Specifically, the mean of p is given by
 
                           E   ⁡     [       p   |     r   j       ,     s   j     ,     1   ≤   j   ≤   i       ]       =       ∫   0   1     ⁢     θ   ⁢           ⁢       ψ   i     ⁡     (       θ   |     r   j       ,     s   j     ,     1   ≤   j   ≤   i       )       ⁢           ⁢     ⅆ   θ                     =       r   +   1       r   +   s   +   2                     (   3   )               
while the variance of p is given by
 
                     V   ⁡     [       p   |     r   j       ,     s   j     ,     1   ≤   j   ≤   i       ]       =           (     r   +   1     )     ⁢     (     s   +   1     )             (     r   +   s   +   2     )     2     ⁢     (     r   +   s   +   3     )         .             (   4   )               
In a model of network of authentications according to an embodiment of the invention, each edge of the graph is annotated by the pair
 
               (     p   ,   c     )     =       (         r   +   1       r   +   s   +   2       ,     r   +   s       )     .           
It can be verified that (p, c) together provide sufficient statistics to specify the posteriori density of p. This notation has an intuitive appeal, as the first element of the pair denotes the mean of the SOP density function, and the second element denotes the total number of experiences, positive or negative. Note that as c=(r+s) increases, the variance decreases, and hence improves confidence in the first element of the pair. Note also that for large values of r and s, the first parameter can be approximated by r/(r+s).
 
     These two parameters can be readily estimated in different circumstances. For example, if two agents are engaged in monetary transactions, then the second parameter can be put equal to the total amount of money involved in these transactions, while the first parameter can be put equal to the fraction of money involved in transactions whose outcome was positive, as defined by the concerned agent, hence the name utility sampling. 
     Appendix: Beta Distributions and Their Properties 
     The following integral plays a crucial part in deriving many properties of the beta distribution. 
                             ∫   0   1     ⁢           x   r     ⁡     (     1   -   x     )       s     ⁢           ⁢     ⅆ   x         =       s     r   +   1       ⁢       ∫   0   1     ⁢           x     r   +   1       ⁡     (     1   -   x     )         s   -   1       ⁢           ⁢     ⅆ   x                       =         s   !         (     r   +   1     )     ⁢     (     r   +   2     )     ⁢           ⁢   …   ⁢           ⁢     (     r   +   s     )         ⁢       ∫   0   1     ⁢       x     r   +   s       ⁢           ⁢     ⅆ   x                       =           s   !     ⁢           ⁢     r   !           (     s   +   r   +   1     )     !       =           Γ   ⁡     (     s   +   1     )       ⁢     Γ   ⁡     (     r   +   1     )           Γ   ⁡     (     s   +   r   +   2     )         .                     (   5   )               
In the above derivation, second step follows from integration by parts by making a substitution u=(1−p) s  and
 
     
       
         
           
             v 
             = 
             
               
                 
                   p 
                   
                     r 
                     + 
                     1 
                   
                 
                 
                   r 
                   + 
                   1 
                 
               
               . 
             
           
         
       
     
     Using EQ. (5), one can derive the mean and variance of the beta densities. Specifically, the mean of the SOP density function ψ(p|r,s) is given by 
                     E   ⁡     [   p   ]       =       ∫   0   1     ⁢     θ   ⁢           ⁢     ψ   ⁡     (       θ   |   r     ,   s     )       ⁢           ⁢     ⅆ   θ                     =       ∫   0   1     ⁢     θ   ⁢       Γ   ⁡     (     r   +   s   +   2     )           Γ   ⁡     (     r   +   1     )       ⁢     Γ   ⁡     (     s   +   1     )           ⁢         θ   r     ⁡     (     1   -   θ     )       s     ⁢           ⁢     ⅆ   θ                     =         Γ   ⁡     (     r   +   s   +   2     )           Γ   ⁡     (     r   +   1     )       ⁢     Γ   ⁡     (     s   +   1     )           ⁢       ∫   0   1     ⁢           θ     r   +   1       ⁡     (     1   -   θ     )       s     ⁢           ⁢     ⅆ   θ                       =         Γ   ⁡     (     r   +   s   +   2     )       ⁢     Γ   ⁡     (     s   +   1     )       ⁢     Γ   ⁡     (     r   +   1     )             Γ   ⁡     (     r   +   1     )       ⁢     Γ   ⁡     (     s   +   1     )       ⁢     Γ   ⁡     (     s   +   r   +   3     )                       =         r   +   1       r   +   s   +   2       .                 
Similarly, one can derive that the variance of a beta distribution is given by
 
                     V   ⁡     [       p   |     r   j       ,     s   j     ,     1   ≤   j   ≤   i       ]       =       ⁢       ∫   0   1     ⁢       (     θ   -     E   ⁡     [       p   |     r   j       ,     s   j     ,     1   ≤   j   ≤   i       ]         )     2                       ⁢         ψ   i     ⁡     (       r   j     ,     s   j     ,     1   ≤   j   ≤   i       )       ⁢           ⁢     ⅆ   θ                   =       ⁢           (     r   +   1     )     ⁢     (     s   +   1     )             (     r   +   s   +   2     )     2     ⁢     (     r   +   s   +   3     )         .                 
By Bayesian rule of probabilities, one obtains
 
                       ψ   i     ⁡     (       p   |     A   j       ,     1   ≤   j   ≤   i       )       =           ψ     i   -   1       ⁡     (       θ   |     A   j       ,     1   ≤   j   ≤     (     i   -   1     )         )       ⁢     Pr   ⁡     (         A   i     |   p     =   θ     )           Pr   ⁡     (     A   i     )                     =         (             r   i     +     s   i                 r   i           )     ⁢         θ     r   i       ⁡     (     1   -   θ     )         s   i             ∫   0   1     ⁢       (             r   i     +     s   i                 r   i           )     ⁢         x     r   i       ⁡     (     1   -   x     )         s   i       ⁢           ⁢     ⅆ   x                       =         (             r   i     +     s   i                 r   i           )     ⁢         θ     r   i       ⁡     (     1   -   θ     )         s   i             r   i     +     s   i     +   1                   =         Γ   ⁡     (       r   i     +     s   i     +   2     )           Γ   ⁡     (       r   i     +   1     )       ⁢     Γ   ⁡     (       s   i     +   1     )           ⁢           θ     r   i       ⁡     (     1   -   θ     )         s   i       .                   
System Implementations
 
     It is to be understood that embodiments of the present invention can be implemented in various forms of hardware, software, firmware, special purpose processes, or a combination thereof. In one embodiment, the present invention can be implemented in software as an application program tangible embodied on a computer readable program storage device. The application program can be uploaded to, and executed by, a machine comprising any suitable architecture. 
       FIG. 4  is a block diagram of an exemplary computer system for implementing a new trust metric for a network of public key certificates according to an embodiment of the invention. Referring now to  FIG. 4 , a computer system  41  for implementing the present invention can comprise, inter alia, a central processing unit (CPU)  42 , a memory  43  and an input/output (I/O) interface  44 . The computer system  41  is generally coupled through the I/O interface  44  to a display  45  and various input devices  46  such as a mouse and a keyboard. The support circuits can include circuits such as cache, power supplies, clock circuits, and a communication bus. The memory  43  can include random access memory (RAM), read only memory (ROM), disk drive, tape drive, etc., or a combinations thereof. The present invention can be implemented as a routine  47  that is stored in memory  43  and executed by the CPU  42  to process the signal from the signal source  48 . As such, the computer system  41  is a general purpose computer system that becomes a specific purpose computer system when executing the routine  47  of the present invention. 
     The computer system  41  also includes an operating system and micro instruction code. The various processes and functions described herein can either be part of the micro instruction code or part of the application program (or combination thereof) which is executed via the operating system. In addition, various other peripheral devices can be connected to the computer platform such as an additional data storage device and a printing device. 
     It is to be further understood that, because some of the constituent system components and method steps depicted in the accompanying figures can be implemented in software, the actual connections between the systems components (or the process steps) may differ depending upon the manner in which the present invention is programmed. Given the teachings of the present invention provided herein, one of ordinary skill in the related art will be able to contemplate these and similar implementations or configurations of the present invention. 
     While the present invention has been described in detail with reference to a preferred embodiment, those skilled in the art will appreciate that various modifications and substitutions can be made thereto without departing from the spirit and scope of the invention as set forth in the appended claims.