Robust Decentralised Trust Management for the Internet of Things by Using Game Theory

Due to the large scale of the typical deployments and the involvement of moving objects to the Internet of Things, participating nodes opportunistically establish data exchanging connections, spanning across multiple organizations and security domains. This opportunistic behavior causes the impossibility of defining valid security policies to rule node authorization, and the ineffectiveness of traditional static access control models based on roles or attributes. Trust management is a promising solution to complement these conventional rules and models by realizing a more dynamic security approach and regulating connection request acceptance or rejection based on monitored behaviors. As a centralized authority cannot be established within multi-tenant and large scale infrastructures, decentralized approaches have recently emerged, supported by the blockchain technology, and applied to the case of useful Internet of Things implementations. However, they are vulnerable to possible attacks aiming at discrediting honest nodes (by lowering their trust degree) and/or redeem malicious nodes (by increasing their trust degree). The widely-accepted protection consists of securing the communications by using SSL/TLS, and restricting the nodes allowed to update the trust degree. However, they are known to be ineffective against compromised nodes that, despite holding legitimate security claims and cryptographic material, they deviate from the correct behavior by sending false and mendacious scores. This work proposes to exploit on game theory to realize robust decentralized trust management able to tolerate malicious nodes sending mendacious scores. Explicitly, a signaling node has been formalized to model the interactions between the IoT and the edge nodes by refusing potentially untrue scores. Moreover, the evolutionary Dempster-Shafer theory is used to combine the collected scores to update nodes' trust degrees, by excluding diverging scores far from the majority. Such solutions have been implemented within the context of a blockchain-supported trust management solution for IoT, and an empirical assessment is provided to show the quality of the proposed approach.