Businesses need trust, and trust management is here to help.

Trust is crucial to personal and professional decisions. It determines which brands we’ll share our data with or work with and allows managers to let employees work flexibly. But could trust help us make better decisions about sharing corporate information and IT network access?

Workplace mental health expert Dr. Joti Samra says pandemic life has given us “new co-workers:” Those we live with 24 hours a day, seven days a week. My partner Dr. Theo Dimitrakos is a world-leading expert in trust management, currently working in the Trustworthiness Theory, Technology and Engineering Lab, Huawei Europe. He’s a much-cited author, Professor of Computer Science at the University of Kent, where he chairs the advisory board of Kent Interdisciplinary Research Centre in Cyber Security and founder of an international trust management research community.

Between lockdown chores and deciding who should load the dishwasher – while we wait for Samsung’s futuristic new kitchen robot – we had a cup of tea and chat about trust management.

Dr. Theo Dimitrakos

Susi O’Neill: Trust management, from what I hear between the walls, seems complex. What are the basics – how would you explain it to your mother?

Theo Dimitrakos: Before retiring, my mother ran an olive oil business in Greece. I learned many skills by helping the family business. In the 1980s, I installed an Amstrad computer in our Athens shop window, showing 8-bit animations to amazed passers. My parents would produce print packaging slips giving measurements of the olive oil’s pureness from the state chemical analysis agency. This was before standard classifications like ‘virgin’ and ‘extra virgin’ olive oil.

Central to trust management is reliability assessment, so parties can trust each other to share data. If I claim my olive oil is 100 percent unrefined virgin oil, you need to be able to check my claim. It helps if I give you a trust statement, like the oil purity label. You need to validate the assessor – in this case, seeing proof from the state agency who is an authority qualified to assess the oil.

Through this process, the customer sees a complete trust chain, giving them confidence in your product’s origins. That’s a fundamental principle of trust management.

Dr. Theo Dimitrakos

I can verify your mother’s olive oil is delicious. What are some more key concepts in trust management?

In the olive oil example, recognizing authority is a key concept which underpins trust assessment. Different methods of measuring trust are also important. My colleague Professor Audun Jøsang, who invented subjective logic, created a calculus for computing in trust networks. It’s now combined with decision networks to measure trustworthiness in neural networks.

Trust-based decisions inform how an intelligent agent program makes final purchasing decisions using data. Professor Harrison McKnight, my co-editor for Trust Management VI, developed a cognitive model to explain the process.

Another fundamental of trust management is trust negotiation: Incremental information disclosure. Organizations must take care of what they disclose, to whom and how. Releasing information over time can help reach a trust level to share more valuable data for a common goal.

Imagine a group of secret agents negotiates by sharing trivial information between themselves. After sharing lower-level information, they now feel more comfortable disclosing more valuable secrets.

Trust negotiation can help decide how to share credentials to achieve the least-privilege principle (users can only access the parts of the system or data they need for their job) to implement the zero-trust security model. Trust negotiation algorithms do this and more. Before you let someone have privileged information, you may want to check their security clearance. In an IT system, you may want to share as little information as possible for the task, then let the system ask for more information when you need higher-level access.

How did you become interested in trust management?

After gaining my Computer Science Ph.D. at Imperial College, London, I worked at a UK government computing lab. We experienced the first dot-com bubble crash around 2001. People lost trust in tech businesses. I felt I had to take action, so I got involved in an international partnership between government, academics and industry to improve trust between customers and companies.

In 2002, with the late Christos Nikolau (IBM and University of Crete,) we established iTrust, an interdisciplinary network including experimental economists, philosophers, and cybersecurity and access management specialists. Trust management previously meant identity and access management for IT networks. We broaden it to include models for measuring and increasing trust and consumer confidence.

I found the experimental economists’ research particularly interesting. Microeconomics Professor Claudia Keser wanted to look at giving incentives for supplying data. We now see that in practice as people trade their data for free online services.

In 2004, I led an international applied research project that developed a framework for managing trust when sharing sensitive data between organizations. The research informed web services trust protocols in use and created a start-up that’s now a market leader in dynamic authorization.

My interest in trust management continues. At the forthcoming IFIP conference, I will present new methods to authorize and change a person’s access depending on their situation. For example, if they’re working at home and others are present who shouldn’t have access to sensitive documents, or they’re trying to evade detection when taking photos of confidential documents on their computer screen.

How has trust management evolved since then?

There have been significant developments and new identity verification models, virtual organizations and consensus-based decisions. There are now more decentralized ways to create digital identities, share and verify them without violating privileges, nor the identity provider needing to track who’s used them.

How does this relate to decentralized data models like blockchain?

Blockchain‘s decentralized trust model has distributed credentials and verifiers. It can be used to implement a trust model, but it’s not the only way to implement trust management today.

Credentials verification is a model promoted by W3C – the community that sets global open web standards – for verifying web information. It has nothing to do with blockchain but can be used alongside it. My colleague Professor David Chadwick, a co-editor of the standard, highlights this distinction.

Blockchain or not, it means someone can prove your credentials without assuming a centralized authority, the party and identity provider issuer know each other. And you could use someone’s credentials without the identity provider tracking what you do – for example, when you share your identity documents to open a new bank account or use a trust-led community like Airbnb. If credential verification becomes popular, big tech firms like Google will be less able to track us.

How can businesses establish a suitable trust management model?

Knowing your business means understanding its processes and data flows with suppliers, incentives for users and which authorities regulate your data or services. Understand your relationships, model them, design your system, then make it secure. Apply security from concept to deployment.

Never presume trust – always measure and verify it.

How can businesses use trust management to improve IT security?

Trust management predates zero trust and will probably outlive it. Zero trust integrates different decentralized trust models. It’s becoming popular because of how technology has evolved: Our work environment has become more decentralized with cloud computing, remote working and data sharing.

Zero trust is about decentralized trust models, fusing trust authorization and verification versus reliability. It means you need to check your assertions about someone rather than rely on another authority to validate them. You need to examine the subject and score them, then use that score and the outcome of your trust algorithm to decide what systems and information they can access.

Now we can measure trust, so your decisions must be calculated. You can have verification like digital signatures, behavior analysis, biometrics, or a combination. This creates a trust score for each entity that should be linked to your access management policies.

Authorization becomes dynamic and continuous. This is often overlooked when considering zero trust strategies for security and access control that only focus on prevention. As trust values change over time, authorization levels and access must change. You may need to increase, reduce or revoke authorization previously given.

With Dr. Fabio Martinelli, Vice-Chair of the European Cybersecurity Organization, we recently developed a lightweight enabling technology for network gateways and consumer internet of things (IoT) devices that combine dynamic authorization with an evaluation of trust levels. I hope this helps zero trust models go beyond corporate networks to smart homes and data usage control.

Excellent! Now I feel suitably informed about trust. So in place of the dishwasher robot, can I use a trust management model to make sure you do this?

Yes, but we first need to set up an algorithm and scoring method, agree on incentives and maybe a consensus protocol.

Perhaps technology models can’t solve all our challenges yet.

Opinions are those of the interviewee and do not represent his employers (corporate or academic).