Tim Muller
email: tim.muller@nottingham.ac.uk

An Unforeseen Equivalence between Uncertainty and Entropy

Keywords: Uncertainty, Entropy, Information Theory, Beta model, Subjective Logic

Uncertainty and entropy are related concepts, so we would expect there to be some overlap, but the equality that is shown in this paper is unexpected. In Beta models, interactions between agents are evidence used to construct Beta distributions. In models based on the Beta Model, such as Subjective Logic, uncertainty is defined to be inversely proportional to evidence. Entropy measures measure how much information is lacking in a distribution. Uncertainty was neither intended nor expected to be an entropy measure. We discover that a specific entropy measure we call EDRB coincides with uncertainty whenever uncertainty is defined. EDRB is the expected Kullback-Leibler divergence between two Bernouilli trials with parameters randomly selected from the distribution. EDRB allows us to apply the notion of uncertainty to other distributions that may occur in the context of Beta models.

Introduction

The Beta model paradigm is a powerful formal approach to studying trust. Bayesian logic is at the core of the Beta model: "agents with high integrity behave honestly" becomes "honest behaviour evidences high integrity". Its simplest incarnation is to apply Beta distributions naively, and this approach has limited success. However, more powerful and sophisticated approaches are widespread (e.g. [START_REF] Teacy | An efficient and versatile approach to trust and reputation using hierarchical bayesian modelling[END_REF][START_REF] Elsalamouny | Hmm-based trust model[END_REF][START_REF] Wu | Bltm: Beta and lqi based trust model for wireless sensor networks[END_REF]). A commonality among many approaches, is that more evidence (in the form of observing instances of behaviour) yields more certainty of an opinion. Uncertainty is inversely proportional to the amount of evidence.

Evidence is often used in machine learning. It is no surprise that there is a close link between trust models and machine learning, since the goal is to automatically create a model, based on observed data. The Beta model is based a simple Bayesian technique found in machine learning. More involved techniques may introduce hidden variables [START_REF] Teacy | An efficient and versatile approach to trust and reputation using hierarchical bayesian modelling[END_REF] or hidden Markov models [START_REF] Elsalamouny | Hmm-based trust model[END_REF][START_REF] Xiao | Hidden semi-markov model-based reputation management system for online to offline (o2o) e-commerce markets[END_REF]. Uncertainty as the inverse of (or lack of) evidence makes sense in this context.

We have obtained successful results applying information theory to analyse trust ratings [START_REF] Wang | Using information theory to improve the robustness of trust systems[END_REF][START_REF] Wang | Is it harmful when advisors only pretend to be honest?[END_REF]. Informative ratings are more useful than uninformative ones. Others have applied information theory to trust modelling in different ways, e.g. [START_REF] Burt | Bandwidth and echo: Trust, information, and gossip in social networks[END_REF][START_REF] Che | A lightweight trust management based on bayesian and entropy for wireless sensor networks[END_REF]. However, these approaches contrast the evidence-based approaches -they were not considered to be equivalent approaches. In fact, we have studied the possibility of combining uncertainty and entropy, to understand their interplay, in [START_REF] Muller | Information theory for subjective logic[END_REF] -and we had not expected that they would turn out to coincide.

The purpose of this paper is to demonstrate a surprising equivalence. The uncertainty used in this paper is fundamentally different from entropy in information theory. There are various entropy measures that one can define, but the standard measures do not yield an equivalence to uncertainty. However, we formulate a specific entropy measure -that we call expected Kullback-Leibler divergence of random-parameter Bernoulli trials (EDRB) -which does equate to uncertainty. The proof is based on a specific properties of functions related to Beta distributions, and does not seem provide insight in why the two are equivalent.

The main motivation for this paper, is to present this surprising result. However, there are possible practical applications too. First, EDRB allows us to compute uncertainty of a given Beta distribution with unknown parameters. Secondly, EDRB can provide the uncertainty of other distributions than the Beta distribution, generalising uncertainty. Thirdly, using EDRB, we can apply techniques from information theory on uncertainty (e.g. apply MAXENT on uncertainty).

The paper is organised as follows: In Section 2, we introduce and shortly discuss existing definitions and properties. In Section 3, we discuss the general relation between uncertainty and entropy in the setting of the Beta model. In Section 4, we present our main result, Theorem 1. Finally, in Section 5, we look at the application of Theorem 1 on more general opinions.

Preliminaries

In this section, we introduce the existing definitions and formalisms that are relevant to our work. The definitions can be grouped into two types, definitions surrounding the Beta model and related models (Section 2.1), and informationtheoretic definitions (Section 2.2).

Beta models

The Beta models are a paradigm, and whether a specific model is a Beta model is up to debate. The core idea behind Beta models is a specific Bayesian approach to evidence [START_REF] Ismail | The beta reputation system[END_REF]. Interactions with agents form evidence, and they are used to construct an opinion. The interactions correspond to Bernoulli trials [START_REF] Jaynes | Probability theory: The logic of science[END_REF]: Definition 1. A Bernoulli trial is has two outcomes, "success" and "failure", and the probability of success is the same every time the trial is performed. A Bernoulli distribution is a discrete distribution with two outcomes, 0 and 1. Its probability mass function f B (p) has f B (0; p) = 1 -p and f B (1; p) = p. A random variable B i from a Bernoulli trial is distributed according to the Bernoulli distributions, so P (B i =1) = p and P (B i =0) = 1 -p.

There are agents A ∈ A. Each agent A has an unknown parameter x A , called its integrity. An agent may betray another agent, or the agent may cooperate. Which choice an agent makes is assumed to be a Bernoulli trial, where the probability of cooperating is equal to its integrity. A series of interactions, therefore, is a series of Bernoulli trials. Let B A,i be the random variable corresponding to the i th interaction with agent A, then P (B A,i = 1) = x A . We refer to outcome 1 as success and 0 as failure. However, x A is not a known quantity, so we apply the Bayesian idea of introducing a random variable X A for the integrity of agent A. An opinion about an agent can be denoted as the probability density function

p X A (x A |B A,1 , B A,2 , . . . ).
We assume that the opinion without evidence is the uniform distributionso p X A (x A ) = 1. One reason to select this prior distribution, is the principle of maximum entropy, which essentially dictates that we should pick the distribution with the highest entropy, if we want to model that we do not have any evidence -and this distribution is the uniform distribution. Another reason to select this prior distribution, is that it simplifies the notion of combining opinions. Most importantly, the prior can be changed to any arbitrary probability density function f , simply by multiplying f

(x A ) • p X A (x A |B A,1 , B A,2 , . . . ) • N F .
The reason for the name "Beta model" comes from a special relationship to Beta distributions. The Beta distribution is defined as: [START_REF] Jaynes | Probability theory: The logic of science[END_REF][START_REF] Kotz | Continuous multivariate distributions[END_REF] Definition 2. The Beta distribution is a continuous distribution with support in the range [0, 1], with a probability density function

f β (x; α, β) = x α-1 (1-x) β-1 B(α,β)
, where B is the Beta function, B(α, β) = 1 0 x α-1 (1 -x) β-1 dx, which acts as a normalisation factor. Its cumulative distribution function is

x 0 t α-1 (1-t) β-1 dt B(α,β)
, which is also known as the regularised incomplete Beta function I x (α, β).

We are using important properties of the Beta function and the regularised incomplete Beta function (see [START_REF] Kotz | Continuous multivariate distributions[END_REF]): Proposition 1. The following two equalities hold:

B(α + 1, β) B(α, β) = α α + β and I x (α + 1, β) = I x (α, β) - x α (1 -x) β αB(α, β)
Given the relations between the random variables, we find that any opinion p X A (x A |B A,1 , B A,2 , . . . ) is a Beta distribution. In fact, if the outcomes of the Bernoulli trials B A,1 , . . . , B A,n ) contain n s success and n -n s = n f failures, then the opinion p

X A (x A |B A,1 , . . . , B A,n ) = f β (x A ; n s + 1, n f + 1) [10]. Proposition 2. Let b A,1 , . . . , b A,n be a list with all elements 0 or 1, 1≤i≤n b A,i = n s and n f = n-n s . p X A (x A |B A,1 =b A,1 , . . . , B A,n =b A,n ) = f β (x A ; n s +1, n f +1)
We can define a fusion operator ⊕, as p 1 (x) ⊕ p 2 (x) =

A,1 , ..., b A,n , p X A (x A |B A,1 =b A,1 , ..., B A,n =b A,n , B A,1 =b A,1 , ..., B A,n =b A,n ) ∝ p X A (x A |B A,1 =b A,1 , . . . , B A,n =b A,n ) • p X A (x A |B A,1 =b A,1 , . . . , B A,n =b A,n ). In particular f β (x; α, β) ⊕ f β (x; α , β ) = f β (x; α + α -1, β + β -1).
Using a distribution to denote an opinion is a feasible approach, based on Bayesian logic, but the results are not intuitively obvious to people that may use the opinions. Subjective Logic is a formalism within the Beta model paradigm, which is developed with the purpose of being understandable to non-experts [START_REF] Jøsang | Subjective logic[END_REF] 1 . A Subjective Logic opinion is defined [START_REF] Jøsang | Artificial reasoning with subjective logic[END_REF]: Definition 3. An opinion is a triple of components (b, d, u), for positive real b, d, u with b + d + u = 1. The first component is belief, the second is disbelief, and the third is uncertainty.

Subjective logic also has a fusion operator, denoted (b, d, u) ⊕ (b , d , u ). The purpose of fusion in Subjective Logic is the same as fusion of distributions, namely to merge evidence. See [START_REF] Jøsang | Artificial reasoning with subjective logic[END_REF].

Definition 4. (b, d, u) ⊕ (b , d , u ) = bu + b u u + u -uu , du + d u u + u -uu , uu u + u -uu .
That there is an isomorphism between fusion of Beta distributions and Subjective Logic fusion, is a known result [START_REF] Jøsang | Subjective logic[END_REF]. In fact, this isomorphism is the primary argument in favour of the shape of Definition 4. It turns out that there is a family of isomorphisms between the two: Proposition 4. Let B, S be the groups of Beta distributions with fusion, and of SL opinions with SL fusion. Let f r be a function

f r : B → S with f r (α, β) = α-1 α+β-2+r , β-1
α+β-2+r , r α+β-2+r . For r>0, f r is an isomorphism between B and S. Proof. Keep in mind Proposition 3, so fusion simply adds α's and β's. The inverse of f r is f -1 r = br u + 1, dr u + 1 , since (w.l.o.g. for α):

f -1 r (f r (α, β)) = α -1 α + β -2 + r α + β -2 + r r + 1, • • • = r α -1 r + 1, • • • = α, β.
Remains to prove that f r and f -1 r are homomorphisms between B and S:

f -1 r bu + b u u + u -uu , du + d u u + u -uu , uu u + u -uu = r bu + b u uu + 1, r du + d u uu + 1 = r b u + r b u + 1, r d u + r d u + 1 = r b u + 1, r d u + 1 ⊕ r b u + 1, r d u + 1 = f -1 r (b, d, u) ⊕ f r (b , d , u ) Let D = α + β -2 + r and D = α + β -2 + r. Then: f r (α + α -1, β + β -1) = α + α -2 α + α + β + β -4 + r , β + β -2 α + α + β + β -4 + r , r α + α + β + β -4 + r = α + α -2 D + D -r , β + β -2 D + D -r , r D + D -r = α-1 D r D + α -1 D r D r D + r D -r 2 DD , β-1 D r D + β -1 D r D r D + r D -r 2 DD , r 2 DD r D + r D -r 2 DD = α -1 D , β -1 D , r D ⊕ α -1 D , β -1 D , r D = f r (α, β) ⊕ f r (α , β )
Since Beta distributions and Subjective Logic are isomorphic w.r.t. fusion, we can apply notions of Subjective Logic directly to Beta distributions. So we can say that the uncertainty of

f β (x; α, β) is unc r (f β (x; α, β)) = r α+β-2+r
). Unless we explicitly state which isomorphism f r we use, we assume that f 1 was usedso unc = unc 1 . Observe that a Beta distribution based on n = n s + n f pieces of evidence has uncertainty unc(f β (x;

n s + 1, n f + 1)) = 1 ns+n f +1
), so the inverse of uncertainty is equal to the amount of evidence (plus 1, to avoid divide-by-zero).

Information Theory

A core notion in information theory, is the notion of surprisal, also known as selfinformation or information content. The symbol I X is often used, but it is also used for the regularised incomplete Beta function, so we denote the surprisal of X with J X instead. The surprisal is defined: J X (x) = -log(P (X = x)) or J X (x) = -log(p X (x)) for discrete and continuous random variable X, respectively.

Shannon entropy is used to measure the expected amount of information carried in a random variable, which is determined by the uncertainty of the random variable [START_REF] Mceliece | Theory of Information and Coding[END_REF]: Definition 5. The Shannon entropy of a discrete random variable X is given:

H(X) = E x (J X (x)) = - xi∈X P (X=x i ) • log(P (X=x i ))
The Shannon entropy is maximal when all possible outcomes are equiprobable. It means that our expected surprisal is maximal, which is a common way to express we know nothing about the random variable. Shannon entropy can be generalised for continuous random variables, to differential entropy. Differential entropy does not provide absolute values -values can go below 0 -but is useful for measuring the difference in information present in distributions. Definition 6. The differential entropy of a continuous random variable X is given:

H(X) = E x (J X (x)) = - X p X (x) • log(p X (x)) dx
Kullback-Leibler divergence, also known as relative entropy, measures the distance from one distribution to another. Definition 7. For discrete random variables X, Y , the Kullback-Leibler divergence from X to Y is:

D KL (X||Y ) = E x (J X (x) -J Y (x)) = xi∈X P (X=x i ) • log P (X=x i ) P (Y =x i
For continuous random variables X, Y , it is:

D KL (X||Y ) = E x (J X (x) -J Y (x)) = X p X (x) • log p X (x) p Y (x) dx Note that in general, D KL (X||Y ) = D KL (Y ||X)
. Typically, X is the "true" random variable and Y is a model, in which case D KL (X||Y ) tells us how far the model is from the truth. A divergence of 0 implies that the two random variables are identically distributed.

Beta Models and Entropy

In this section, we discuss different entropy measures that can be applied to a Beta distribution. We formally state each of these measures, we discuss their intuitive meaning, their application, and how they differ from uncertainty. The measure of entropy that does match uncertainty will be introduced in the next section. This section helps appreciate why that measure of entropy is the way it is.

Integrity Parameter Entropy

The most obvious measure of entropy that can be applied, is the (differential) entropy of the integrity parameter. To be precise, the entropy measure is:

H(X) = - 1 0 p X (x) • log(p X (x)) dx.
The standard intuition of differential entropy applies. In the case of differential entropy, values are negative and the absolute quantity tells you how much information is gained relative to the uniform distribution. The information that is gained is about the precise value of the integrity parameter. Differently put, it measures how far away from the uniform distribution, values in the distribution tend to be. Figure 1 provides two examples of graphs, Figure 1a depicts a distribution with less information about integrity than Figure 1b. In reality, it is not important whether the integrity value is exactly 0.7, or say 0.705. For the purpose of measuring the entropy of the integrity value, these two values are considered to be completely different. For graphs such as the ones depicted in Figure 1, this is not a major issue, since the probabilities of similar integrity values tend to be similar too. However, in more extreme cases, such as in the graph depicted in Figure 2, it becomes an issue for our intuition. The graphs in Figure 2a and 2b are identical through the lens of the information measure, since both distributions have support on half the interval, and are uniformly distributed over the part with support. In both cases, the information gained over the uniform distribution is 1 bit -since we can exclude exactly half the possibilities. However, if we want to know whether we are dealing with a reliable person, the distribution in Figure 2a is likely to be helpful, but the one in Figure 2b is not.

Uncertainty is inversely proportional to the amount of evidence (i.e., the sum of the parameters of the Beta distribution). Adding evidence tends to increase the information about the integrity parameter too, as the peak tends to become narrower, as illustrated in Figure 1. However, it is not necessarily the case that adding evidence decreases the entropy, as illustrated in Figure 3. The distribution f β (8, 1) has an entropy of 1.7376 bits, whereas the distribution f β (8, 2) has an entropy of 1.1468 bits. Therefore, entropy about the integrity parameter fails to meet the basic criterion of uncertainty, which is being that it is monotonically decreasing as evidence is added.

Trial Entropy

An ingredient that was missing from integrity parameter entropy, was to take into account the values of integrity parameter, rather than just its probability density. Arguably, we are not necessarily interested in the exact integrity of other agents, but we are interested in knowing whether they will betray us or not. Whether an agent would betray us is determined by a Bernoulli trial based on the integrity parameter. In other words, an agent will not betray us with a probability equal to its integrity parameter. Since the Beta distribution is the estimate of that integrity parameter, the expected entropy of the Bernoulli trial is:

H(B) = -E x (x log(x) + (1 -x) log(1 -x)) = - 1 0 p X (x) • (x log(x) + (1 -x) log(1 -x)) dx
Although we are computing the expectation of the entropy, the standard intuition of entropy applies: how much information about the outcome of the Bernoulli trial do we (expect to) have. The entropy of a Bernoulli trial is between 0 and 1 bits, where values close to 0 bits mean near certainty about whether we will be betrayed or not. The Beta distribution with maximal uncertainty -the uniform distribution -has an entropy of 0.7213 bits in this measure; strictly less than 1.

It can certainly be useful to measure how much you about the Bernoulli trial, but this measure has barely any connection to uncertainty. Consider a user with an integrity parameter of 0.5. A reasonable progression of Beta distributions as more evidence is accumulated is depicted in Figure 4. What we see in Figure 4 is that we are increasingly certain that the integrity parameter must be near 0.5. If the integrity parameter is 0.5, then we have 1 bit entropy of the Bernoulli trial, whereas the values near the extremes have near 0 bits entropy. As the evidence accumulates, this measure converges to 1 bit entropy. Again, this breaks the most basic requirement that entropy decreases as uncertainty decreases.

KL-Divergence from Truth

The problem with Bernoulli trial entropy as a measure for uncertainty, is that as evidence is added, it provides a value that is closer to the true Bernoulli entropy of that agent, rather than a smaller value. Assume that, somehow, we have access to the true integrity parameter of an agent, then we can measure the information-theoretic distance to that value. The standard technique is to use Kullback-Leibler divergence. Given a true integrity parameter of value x, we can apply KL-divergence to the Bernoulli trial entropy as:

E y (D KL (f B (x)||f B (y))) = 1 0 p X (y)(x log( x y ) + (1 -x) log( 1 -x 1 -y )) dy
As an example, say we measure 6 successes and 1 failure with an agent with parameter 0.85, then we get the KL-divergence from the truth as: 1 0 f β (y; 6, 1)• (0.85 log( 0.85 y ) + 0.15 log( 0.15 1-y )) dy = 0.1247 bits. However, it is possible that we measure 6 successes and 1 failure with an agent with parameter 0.4, in which case the distance is 1.2460. The measure does not just depend on the distribution itself.

This measure cannot be applied to compute the entropy, given an arbitrary Beta distribution, since the true integrity parameter is an unknown. Notice that the shape of the equation is such that the formula for the expectation of what behaviour will be observed is similar to the equation for the expectation of the integrity parameter given the observed behaviour. By applying Bayes' theorem, we can alter this term to talk about the expected true integrity parameter given the observed behaviour: E x,y (D KL (f B (x)||f B (y)). This formula turns out to be EDRB, as we see in the next section.

Entropy-Uncertainty Equivalence

It may not be immediately obvious what it means for entropy measures and uncertainty measures to be equivalent. Both uncertainty and EDRB (expected KLdivergence of random Bernoulli trials) are actually families of measures, rather than a singular measure. Recall that if n e is the amount of evidence, the general expression for uncertainty is r ne+r . EDRB provides different outcomes, depending on the choice of the base of the logarithm b, we will prove that it is log(b) ne+2 . In the case r = 2, b = e 2 , the two formulas are equal. However, we argue that the equivalence is stronger, since every member of the two families shares the crucial property that its inverse is a linear function of the amount of evidence.

Our goal, therefore, is to prove that E x,y (D KL (f B (x)||f B (y)) = log(b) ne+2 . Note that if we have s successes and f failures, our Beta distribution is f β (x; α, β), with α = s + 1 and β = f + 1. Therefore, α + β = s + f + 2 = n e + 2. Therefore, we can state our Theorem as the following equation:

Theorem 1. 1 0 1 0 f β (x; α, β)f β (y; α, β)((x log b ( x y ) + (1 -x) log b ( 1 -x 1 -y )) dy dx = log(b) n e + 2
Proof. We will prove that :

1 0 1 0 f β (x; α, β)f β (y; α, β)x log b x y dy dx = log(b)β (α + β) 2 .
Swapping α and β while substituting x for 1 -x and y for 1 -y, it follows:

1 0 1 0 f β (x; α, β)f β (y; α, β)(1 -x) log b 1 -x 1 -y dy dx = log(b)α (α + β) 2 .
This suffices to prove the theorem, since log(b)β (α+β

) 2 + log(b)α (α+β) 2 = log(b) α+β . 1 0 1 0 f β (x; α, β)f β (y; α, β)x log b x y dy dx = {log b (x/y) = log b (x) -log b (y)}
x 0 t α (1 -t) β-1 B(α, β) dt 1 0 - 1 0 log(b) 1 x x 0 t α (1 -t) β-1 B(α, β) dt dx - B(α + 1, β) B(α, β) log b (x) x 0 t α-1 (1 -t) β-1 B(α, β) dt 1 0 - 1 0 log(b) 1 x x 0 t α-1 (1 -t) β-1 B(α, β) dt dx = {Simplify to regularised incomplete Beta functions (Definition 2).} log b (x)I x (α + 1, β) B(α + 1, β) B(α, β) 1 0 - 1 0 log(b) 1 x I x (α + 1, β) B(α + 1, β) B(α, β) dx - B(α + 1, β) B(α, β) log b (x)I x (α, β) 1 0 - 1 0 log(b) 1 x I x (α, β) dx
= {Terms in square brackets evaluate to 0 at 0 and 1. Simplify formula.}

1 0 log(b) 1 x B(α + 1, β) B(α, β) (I x (α, β) -I x (α + 1, β + 1)) dx = {Apply Proposition 1.} 1 0 log(b) 1 x B(α + 1, β) B(α, β) x α (1 -x) β αB(α, β) dx = {Use 1/x to subtract 1 from the exponent α, apply Proposition 1.} log(b) α α + β • β α(α + β) = log(b)β (α + β) 2
There are two ways to interpret the theorem. Firstly, we can use the intuition from Section 3.3, and say that f β (x; α, β) is the Bayesian estimate of the true integrity parameter that generated the history, and we measure the expected KL-divergence between the Bernoulli trial with the true integrity parameter and a new randomly selected parameter (y). Simply put, we reuse the measure from Section 3.3, but substituting the true integrity for the expected integrity. KLdivergence is an oft-used way to measure the quality of a model distribution, compared to the real one. EDRB measures the expectation of the distance between the KL-divergence of the Bernoulli trail based on an estimated true one and an estimated model. Of course, taking the expectation of the true integrity used for the Bernoulli trial is intuitively dubious.

The alternative intuition does not involve true integrities for this reason. EDRB can be interpreted to say, given two agents with the same history, how much do we learn about one agent, if we observe a new interaction with the other. As more evidence accumulates, the possible choices for the parameter for the Bernoulli trial becomes more centered around a specific value. If the probability that two Bernoulli trials use similar parameters increases, then the KL-divergence between the two decreases. This intuition is a more direct reading of the actual formula, as we are taking the expectation of a pair of integrity parameters, distributed along the same Beta distribution. The weakness of this intuition is that KL-divergence is an asymmetric measure, where one distribution represents the true distribution and the other one the model distribution, whereas this intuition is measuring the distance between two model distributions.

While both intuitions are imperfect, they do offer an explanation why we might expect uncertainty and EDRB to be related. The fact that they are indeed equivalent is non-obvious, however. The proof does not provide us with an insight as to why they are indeed equivalent -other than the fact that they are. Based on the fact that the intuitions are imperfect, and the proof does not provide any intuition either, we consider the equivalence to be surprising.

Uncertainty is a useful concept and a basic tenet of Subjective Logic. To compute the uncertainty, from a Beta distribution f β (x; α, β), simply take u = 1 α+β-1 . However, this definition uses the parameters of the distribution, rather than the probability density function. Given a probability density function f , that happens to represent a Beta distribution, there is no elegant way to compute the uncertainty. For example if f = 6(x(1-x) 5 +(1-x) 6 ), then how to determine its uncertainty -given it may not be trivial to realise f = f β (6, 1). Alternatively, we can compute E X,Y (D KL (f B X||f B Y )) for X, Y ∼ f , and obtain 1 α+β without knowing α and β.

The fact that we can use our new measure as an alternative way to compute the uncertainty of a Beta distribution without explicitly using the parameters, is interesting in itself. More interesting, however, is the fact that the input probability density function need not be a Beta distribution at all, for it to work. As we more rigorously argue in the next section, there are cases where it does not make sense to use a Beta distribution as opinions. These cases have been recognised implicitly in the literature (e.g. [START_REF] Teacy | Travos: Trust and reputation in the context of inaccurate information sources[END_REF]), but are not typically explicitly addressed. We can now reason about the uncertainty present in more esoteric distributions that may pop up. In the next section, we present some of the implications to these generalised distributions.

Generalised Opinions

That models of information fusion found in Subjective Logic are isomorphic to Beta distributions is not surprising. After all, these models are created with this purpose in mind. Subjective Logic further incorporates logical operations, and transitive trust operations. As shown in [START_REF] Muller | A formal derivation of composite trust[END_REF] and [START_REF] Muller | On beta models with trust chains[END_REF] respectively, the resulting distribution of these operations is not a Beta distribution (using the assumptions of the Beta model). In other words, the isomorphism does not hold if we add the new operations. In this section, we show examples of distributions resulting from logical or transitive operations, discuss why they are not Beta distributions, and extend the result from the previous section to these distributions.

Opinion Logic

Consider performing logic on the opinions. For example, we have a distribution for A and for A , but in order to obtain a success, we need both A and A to succeed. In the case that A and B are independent agents, the probability that A ∧ A succeeds is a Bernoulli trial with parameter x A × x A [START_REF] Muller | A formal derivation of composite trust[END_REF]. According to [START_REF] Muller | A formal derivation of composite trust[END_REF], if we want to obtain our opinion on A ∧ A , based on our opinions on A and A , then we need to take their product distribution:

Theorem 2. If B A,k and B A ,k are independent Bernoulli trials, then let C be 1 iff B A,k = 1 and B A ,k = 1. Let p(C = 1|X C = x C ) = x C then the distribution p X C (x C |B A,1 . . . B A,k-1 , B A ,1 . . . B A ,k -1 ) = 1 x C 1 y p X C ( x A y |B A,1 . . . B A,k-1 )• p X A (y|B A ,1 . . . B A ,k -1
) dy; the product distribution of the opinions on A, A .

Proof. Theorem 4 in [START_REF] Muller | A formal derivation of composite trust[END_REF].

In Subjective Logic, conjunction is defined as:

Definition 8. Conjunction (b, d, u)∧(b , d , u ) = (bb , d + d -dd , bu + b u + uu ).
In Figure 5, we see the conjunction of f β (x; 8, 4) and f β (x; 9, 2) as derived from the product distribution, as well as the results computed using the Subjective Logic conjunction definition under f 1 and f 5 . We can see that neither f 1 nor f 5 are isomorphisms w.r.t. conjunction, since the graphs differ. In fact, for no choice of r, or even for any other Subjective Logic definition for conjunction, will f r be an isomorphism. The reason is that all opinions in Subjective Logic are isomorphic to a Beta distribution, but the result of the product distribution is not generally (in fact, almost never) a Beta distribution. Therefore, no isomorphism can exist.

Although the resulting opinion is not a Beta distribution, we can compute the uncertainty via its equivalence to EDRB. The uncertainty of f β (x; 8, 4) and f β (x; 9, 2) is, therefore, equal to 0.0775.

Transitive Trust

Transitive trust is a fiercely debated topic. Using the assumptions of the Beta model, an issue arises. The formula contains a term χ, which is the attacker's strategy. In other words: how to use the advice of another agent, depends on how the agent would act, if he were malicious. See [START_REF] Muller | On beta models with trust chains[END_REF] for more details. The attacker strategy is not a topic for this paper, so we will assume the simplest attack strategy: random behaviour.

If an advisor A is honest with probability x A , and the advisor gives us the opinion p Xc , then our resulting opinion is simply x A • p Xc (x c ) + (1 -x A ). This can be derived from Theorem 2 in [START_REF] Muller | On beta models with trust chains[END_REF]. However, the intuition behind it is also clear, namely that if the advisor speaks the truth, we should listen, and if he lies, we know nothing. We do not typically know x A , but we can use our opinion p X A to estimate this value.

The result of obtaining an opinion from advice, therefore, is not a Beta distribution, but a weighted sum of Beta distributions2 . However, like in Section 5.1, Subjective Logic must return a Beta distribution as the result of transitive trust. In fact, Subjective Logic defines transitive trust:

Definition 9. Propagation (b, d, u) • (b , d , u ) = (bb , bd , bu + d + u).
In Figure 6, we see the propagation of f β (x; 8, 4) and f β (x; 9, 2) as derived from the summing Beta distributions, as well as the results computed using the Subjective Logic propagation definition under f 1 and f 5 . Compared to conjunction, we see that the difference between the two approaches is even larger. In particular, we notice that Figure 6a has raised flat tails. These raised flat tails are a consequence of the fact that, no matter what malicious agents say, if they are lying, then extremely high/low integrity values remain probable.

Although the resulting opinion is not a Beta distribution, we can compute the uncertainty via its equivalence to EDRB. The uncertainty of the opinion resulting from hearing f β (x; 9, 2) from an agent that we have the opinion f β (x; 8, 4) about, is equal to 0.5354. In this case, the uncertainty is (significantly) larger than the uncertainty of f β (x; 9, 2) (which is 0.1000). However, it need not be the case that summing Beta distributions changes the uncertainty in a meaningful way. In particular, the uncertainty of 1 /3(f β (x; 3, 1) + f β (x; 2, 2) + f β (x; 1, 3)) is the maximum: 1, even though the individual distributions have far smaller uncertainty. There may be a more subtle pattern in the EDRB entropy of a sum of Beta distributions, but this is future work. A reasonable approach to selecting a strategy for the attacker, is to select the strategy that is the least informative. Typically, that means the strategy that gives the highest entropy. No closed formula has been found that maximises either the integrity entropy or the Bernoulli trial entropy. An open question is whether this approach can be more fruitful when using EDRB as the measure of entropy.

Conclusion

Theorem 1 is our main result. It states that uncertainty (the inverse of amount of evidence) is equal to a specific measure of entropy that we introduce: expected Kullback-Leibler divergence of random-parameter Bernoulli trials (EDRB). The intuition behind EDRB is that it measures the expected distance between two Bernoulli trials selected from a distribution -a more narrow distribution will have less distance between the Bernoulli trials.

While both entropy and uncertainty can be used to describe lack of knowledge. Any entropy measure is based on surprisal, whereas uncertainty is based on Bayesian evidence. Hence is surprising that they should coincide.

We discuss alternative measures of entropy in Section 3. Measures such as integrity entropy and Bernoulli trial entropy certainly have use-cases. Uncertainty simply measures something else than these two measures.

Finally, we study the implications of having EDRB on generalised opinions. These are distributions other than the Beta distributions. In Section 5, we show how these distributions arise, and why they are of interest. We plan to further study of the implications of generalised opinions under EDRB. In particular we want to explore the notion of malicious advisors maximising EDRB entropy.

1 0Proposition 3 .

 13 p1(y)p2(y) dy . The fusion operator simply merges the evidence [5]: For any series of outcomes of Bernoulli trials b A,1 , . . . , b A,n and b

  The distribution f β (x; 5, 3). The distribution f β (x; 15, 9).

Fig. 1 :

 1 Fig. 1: Two Beta distributions equal in expected value, but not uncertainty.

Fig. 2 :

 2 Fig. 2: Two distributions with uniform support on half the interval.

Fig. 3 :

 3 Fig.3: Two Beta distributions with entropy increasing when adding evidence.

Fig. 4 :

 4 Fig. 4: More evidence continues to decrease information.

1 0f 1 0 1 0

 111 β (x; α, β)f β (y; α, β)x log b (x) dy dx -f β (x; α, β)f β (y; α, β)x log b (y) dy dx = {Erase y left. Isolate x right, replace with B(α + 1, β)/B(α, β). Rename y to x.} xf β (x; α, β) log b (x) -B(α + 1, β) B(α, β) f β (x; α, β) log b (x) dx = {Integration by parts on both summands. Recall Definition 2.} log b (x)

  SL with r=5, Def 8.

Fig. 5 :

 5 Fig.5: Three differently computed conjunctions of f β (x; 8, 4) and f β (x; 9, 2).

  SL with r=5, Def 9.

Fig. 6 :

 6 Fig.6: When an agent with f β (x; 8, 4) claims to have opinion f β (x; 9, 2).

For the purpose of this paper, we restrict ourselves to so-called binary Subjective Logic opinions, which corresponds to the notion that the integrity parameter determines a Bernoulli trial.

This is true also when the attack strategy is not trivial.


Anirban Basu
email: basu@kddi-research.jp

Theo Dimitrakos
email: theo.dimitrakos@huawei.com

Yuto Nakano

Shinsaku Kiyomoto
email: kiyomoto@kddi-research.jp

A framework for blockchain-based verification of integrity and authenticity

Keywords: integrity, authenticity, confidentiality, decentralised verification, trust

In many application scenarios, such as cloud computing and network function virtualisation, entities from different domains or their interactions are short-lived. Yet, it is often necessary to ensure accountability of events recorded by such entities about their application-specific interactions. The distributed and multi-domain nature of this problem makes a decentralised architecture imperative, particularly in the context of key management and trust. This architecture also needs to address challenges in terms of cross-domain privacy and confidentiality of shared data. For concreteness and without loss of generality, we consider the use case of firewalls as virtual network functions (VNFs) across multiple domains where short-lived firewall VNF instances spin up and down, logging events (e.g., security incidents) during their life spans. Such event logs need to exist, for purposes of accountability, beyond the life-cycles of their generating entities. In this position paper, we present a dual blockchain framework that facilitates the verification of integrity as well as authenticity of events while supporting privacy and confidentiality of data shared across multiple domains.

Introduction

The emergence of the cloud, network functional virtualisation (NFV), edge computing and IoT paradigms has necessitated the accountable collection of distributed logs and audit information over multiple administrative domains or trust realms and across service provision paths in complex ICT supply networks. There is an ever increasing need to develop scalable technologies that ensure the integrity of such critical information (log, audit data, etc.) to enforce accountability and non-repudiation while taking into account the scope of use of the corresponding services, network functions or devices.

Blockchains and other forms of distributed ledgers (the underlying technologies of the Bitcoin [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF] cryptocurrency, Ethereum [START_REF] Wood | Ethereum: A secure decentralised generalised transaction ledger[END_REF] and other applications including cryptocurrencies [START_REF] Wilkinson | Storj: a peer-to-peer cloud storage network[END_REF][START_REF] Vorick | Sia: Simple decentralized storage[END_REF][START_REF] Danezis | Centrally banked cryptocurrencies[END_REF][START_REF] Koning | Fedcoin: a central bank-issued cryptocurrency[END_REF][START_REF] Hopwood | Zcash protocol specification[END_REF][START_REF] Gilad | Algorand: Scaling byzantine agreements for cryptocurrencies[END_REF][START_REF] Al-Bassam | Chainspace: A sharded smart contracts platform[END_REF][START_REF] Kokoris-Kogias | Omniledger: A secure, scale-out, decentralized ledger[END_REF][START_REF] Zamani | Rapidchain: Scaling blockchain via full sharding[END_REF]) offer cryptographic irreversibility of recorded data agreed upon by consensus amongst a set of decentralised entities. This property is useful for reliably logging event information generated by virtualised functions with short-lived, stateless and on-demand instances that reside on cloud infrastructures. Industry verticals, such as financial services, telecommunications, energy and smart vehicles -to name a few -are looking into distributed ledger technologies (including but not restricted to blockchains) for improving the integrity and availability of their services, their cross-service data flow and secure information sharing.

Objectives

In this paper, we consider the application scenario of a firewall as a virtual network function (VNF) and demonstrate how blockchains can be utilised to design and implement the distributed event log architecture. Our main objectives in this context are:

(1) to protect the integrity and confidentiality of important information of VNFs and IoT gateways such as events, configurations, policies, credentials, and so on; (2) to strengthen the authenticity, accountability and integrity of security policies, security capabilities and VNF and IoT gateways; (3) to reduce the risks of impersonation and privileged access abuse; (4) to reduce the difficulties of cryptographic key management, revocation and trust management complexities; and (5) to assess suitability and potential benefit of leveraging emerging technologies for multi-ledger and smart-contracts.

In this work-in-progress short paper, we consider the application scenario of a firewall as a VNF and demonstrate how a dual blockchain framework can be utilised to design and implement the distributed event log architecture. In general terms, we develop a multi-ledger model that protects the integrity of key information in a large-scale distributed computing systems and assures authenticity and accountability of modifications.

Proposed dual blockchain framework

Use-case scenario overview A virtualised network function (VNF) is a software code, an instance of which can run inside a virtual machine, on top of actual physical hardware. A distributed stateless firewall abstracted as a firewall VNF can have multiple, possibly geographically dispersed, instances that can be spun up on demand. Each such instance logs events and incidents that it "sees". These logs need to be cryptographically signed to preserve their integrity. However, due to the short-lived and volatile lifespans of such VNF instances, maintaining and sharing signing keys between all instances of the same VNF is challenging even when there are separate keys per domain.

In [START_REF] Basu | Accountability and integrity for data management using blockchains[END_REF], we proposed a preliminary direction for accountability and integrity of data management making use of blockchains. In this paper, we describe an architecture for VNF logs that are verifiable in terms of integrity and authenticity. We propose the use of two blockchains for two separate purposes. The first blockchain is a permissioned blockchain used to verify the integrity of the data logged by individual firewall instances (called the i-Ledger from now on) while the second public blockchain helps with the verification of the authenticity of the logged data (called the a-Ledger hereafter). Due to the public nature of the second blockchain, the actual event log data is either not stored in it or stored with some confidentiality-preserving transformation (e.g., keyed hash, encryption). These two blockchains are not necessarily linked in terms of actual connectivity between nodes, but are semantically 'linked' during the data verification process since data on one blockchain needs to be cross-checked with the information recorded in the other to help verify consistency.

Event log reports

Central to the idea of the blockchain for integrity is the way a VNF instance generates an event log report. The events considered in this log are typically security incidents, but we use the general terminology -events -throughout this paper. The individual events are added as leaf nodes to a hash tree, e.g., a Merkle Tree [START_REF] Merkle | Method of providing digital signatures[END_REF]. The level of granularity of the events is configurable, i.e., a VNF may wish to combine multiple events together instead of writing one event as one leaf of the Merkle Tree. While for the rest of the paper we stick to Merkle Trees for the property of independent verification of sub-trees, any generalised hash tree satisfying the same property will suffice. The root of the Merkle Tree along with the entire tree structure is what constitutes a complete event log report, as illustrated in Figure 1. The actual event data on the leaf nodes can be privacy sensitive. Information from hash trees can be trimmed, similar to the delete operation in our existing work -VIGraph [START_REF] Basu | VIGraph -A Framework for Verifiable Information[END_REF], which uses generalised hash trees for selective disclosure of information.

System overview

Figure 2 describes the overall system using a multi-domain scenario for the two blockchains involving three domains as well as an external notary. The blue lines indicate the topology of the i-Ledger whereas the red lines represent that of the a-Ledger. The domain on the left illustrates some of the actors in one organisational domain, such as the entities (VNFs in this case) that generate events and event log reports; the Life-cycle Event Manager (LEM) which generates events related to the life-cycle of entities; the log manager in charge of maintaining the i-Ledger and the notary in charge of maintaining the a-Ledger. The Domain security manager is responsible for controlling confidential data sharing policies and agreements, which we discuss later. The Auditor is responsible for cross-verifying the integrity and authenticity of events across the two blockchains.

Blockchain for integrity -the i-Ledger

The purpose of verifying the integrity of a data log is to ensure the signature on the log is valid, and that the signing entity is an authorised entity, i.e., an authorised firewall instance, in our running use-case. With the traditional certificate authority (CA) based keys, a CA signs the public key of an entity. However, the traditional CA style architecture requires the presence of a centralised and trusted certificate authority. It also assumes the existence of long-lived publicprivate key pairs. Neither of these hold true in our architecture of the distributed VNFs spanning across organisations.

A VNF instance generates an ephemeral private key (could remain stored only in volatile memory), which is removed when the VNF instance spins down gracefully or crashes. The corresponding public key, however, lives on. In our architecture, each separate administrative domain has its own key manager and log manager. Either the log manager or the life-cycle event manager may provide the key management functionality, and thus we do not specify a key manager separately. This key-pair can be generated based on a Hardware Security Module or a Trusted Platform Module (HSM/TPM) backed seed, and the public key is registered with the key manager. A VNF instance collates its logs in a report (Figure 1), adds a monotonically increasing numeric identifier and signs the Merkle Tree root and the numeric ID. This constitutes the main information for the block of varying size in this blockchain, illustrated in Figure 3, with the event data in green signifying privacy sensitive information. Fig. 2. A multi-domain system overview. Due to the short-lived and resource-constrained nature of the VNF, it does not participate directly in reading from or writing to the blockchain. That task is delegated to the log manager of the domain. The pointer to the previous block and the block ID are, in turn, signed by the log manager that acts as a domain attester. The log managers across all the domains maintain the i-Ledger. The entire operation of the i-Ledger is shown in Figure 4 A log manager runs a smart contract on the event log report before it accepts the block. Each log manager in each domain knows the identity (i.e., public key) of every other participating log manager from every other domain. Thus, the smart contract running on the log managers conceptually looks like the one illustrated in Figure 5, encapsulated as the "Execute smart contracts" state in Figure 4. The active domain contains the entity (i.e., VNF instance) that is attempting to write the report to the blockchain while the passive domain contains the log manager that accepts the event log report based on the acceptance of the valid identity of the active domain log manager.

Confidential information sharing

The event data in the event log report could be considered privacy sensitive across different domains. Hence, if such an event log report is to be shared across domains, the leaf nodes are either removed from the tree structure while keeping their hashed parents intact; or the leaf nodes go through some confidentiality preserving transformation, e.g., symmetric key encryption where the relevant key is shared with authorised entities; or it could be attribute based encryption (ABE) where relevant entities have their access control policies defined in the ABE structure, in the keys (KP-APE) or in the ciphertexts (CP-ABE). This type of confidential information sharing policy is controlled the domain security manager as illustrated in Figure 2.

Blockchain for authenticity -the a-Ledger

The purpose of verifying the authenticity of the data log is to ensure that the publicly recorded log of the data (without details of the actual data to preserve confidentiality) corresponds to an actually recorded log in the i-Ledger that verifies it integrity. It also ensures that logs made by the same entity can be linked and their partial orders validated. Furthermore, with the records of lifecycle events, the a-Ledger allows a verifier to check that a specific log made by a specific VNF instance happened while it was active.

The entities maintaining this public a-Ledger are notaries that can exist in the aforementioned domains, but also in other unrelated domains, as shown in Figure 2. For instance, the VNF use-case could exist in domains such as telecommunications carriers while notaries could exist in other external domains such as financial and legal institutions. Unlike the permissioned i-Ledger, the block in this a-Ledger is not equivalent to a single event log report. Instead, blocks in this blockchain contain single events from the event log report as well as entity life-cycle events. Any such event is recorded as a transaction and many such transactions form a block in this blockchain. In order to facilitate life-cycle event reporting, we have the life-cycle manager per domain, which is typically a virtual machine monitor that knows when a VNF instance is up or down.

The transaction for an event (i.e.., VNF generated event) is a tuple consisting of:

(a) a specific event, E; (b) the monotonically increasing numeric identifier for the event specific to the generating entity, n t at time t; and (c) the signature from the generating entity, sig entity .

The transaction for a life-cycle log is a tuple consisting of:

(a) the life-cycle event (LE) to be recorded, e.g., LE start , LE end and so on; (b) the public key of the entity whose life-cycle event is being recorded, i.e., pubK entity ; and (c) the signature from the life-cycle manager, i.e., sig LEM .

The entire operation of the a-Ledger is shown in Figure 6, involving three actors:

(a) generating entity; (b) a notary in any domain; and (c) the life-cycle manager in the same domain as the generating entity.

The notaries run two smart contracts depending on the type of event being added, as shown in Figure 7, encapsulated as the "Execute smart contracts" state in Figure 6. To check the validity of the signature of a life-cycle manager, it is imperative that notaries know and store the identities of each life-cycle manager for every domain.

Related Work

Bozic et al. [START_REF] Bozic | Securing virtual machine orchestration with blockchains[END_REF] present an on-going work on a blockchain-based mechanism to protect cloud and NFV orchestration operations, specifically the authentication of orchestration commands in the lifecycles of cloud services. The scheme proposed in [START_REF] Zawoad | Secap: Towards securing application provenance in the cloud[END_REF] helps ensure the necessary integrity and confidentiality properties application provenance in a cloud environment. Rübsamen et al. presented,[START_REF] Rübsamen | Security and privacy preservation of evidence in cloud accountability audits[END_REF], a system that uses distributed software agents for secure evidence collection to enable automated evaluation during cloud accountability audits. In [START_REF] Redfield | Gringotts: securing data for digital evidence[END_REF], Redfield and Date proposed a system where data is signed on the device that generates it, transmitted from multiple sources to a server using a signature scheme, and stored with its signature on a database running a protocol for long-term archival systems that maintains the data integrity of the signature even over the course of changing cryptographic practices. Sanz et al. [START_REF] Sanz | Sfcperf: An automatic performance evaluation framework for service function chaining[END_REF] proposed a framework for automatic performance evaluation of service function chaining in network function virtualisation. The paper in [START_REF] Liang | Towards data assurance and resilience in iot using blockchain[END_REF] described the idea of securing drone data collection and communication with a public blockchain for provisioning data integrity and cloud auditing. In [START_REF] Massonet | An architecture for securing federated cloud networks with service function chaining[END_REF], authors proposed an architecture to secure federated cloud networks by enforcing a global security policy on all network segments of a federation, and local security policies on each network of the federation. In the context of the IEC 61499 standard [START_REF] Vyatkin | The IEC 61499 standard and its semantics[END_REF] for distributed control systems, the work in [START_REF] Stanciu | Blockchain based distributed control system for edge computing[END_REF] proposed an ongoing research on the implementation of function blocks as smart contracts executed by a blockchain as well as the integration with the edge nodes that are responsible for process control. The work in [START_REF] Weber | Untrusted business process monitoring and execution using blockchain[END_REF] adopted blockchains to address the lack-of-trust problem by mapping a business process onto a peer-to-peer execution infrastructure that stores transactions in a blockchain. Amongst the various benefits of their approach, an audit trail for the complete collaborative business processes, for which payments, escrow, and conflict resolution can be enforced automatically. The authors presented the idea of using blockchain as a service for IoT and evaluates the performance of a cloud and edge hosted blockchain implementation in [START_REF] Samaniego | Blockchain as a service for iot[END_REF]. In [START_REF] Alvarenga | Securing configuration management and migration of virtual network functions using blockchain[END_REF], the authors proposed a blockchain-based architecture for the secure configuration management of virtualised network functions (VNFs), which provides immutability, non-repudiation, and auditability of the configuration update history as well as integrity and consistency of stored information; and the anonymity of VNFs, tenants, and configuration information. Authors in [START_REF] Rodrigues | A Blockchain-Based Architecture for Collaborative DDoS Mitigation with Smart Contracts[END_REF] presented an architecture of a collaborative mechanism using smart contracts to investigate the possibility of mitigating a DDoS attack in a fully decentralized manner whereby the service providers can not only signal the occurrence of attacks but also share detection and mitigation mechanisms. Xu et al. [START_REF] Xu | Blockchain-based decentralized content trust for Docker images[END_REF] proposed a blockchain-based solution for trust in virtual machine images to reduce the risk of DoS attacks and at the same time provide a signature verification service for Docker images. Kouzinopoulos et al. discussed,[START_REF] Kouzinopoulos | Using blockchains to strengthen the security of internet of things[END_REF], the benefits of using blockchains to strengthen the security of IoT networks through a resilient, decentralized mechanism for connected home use-case that enhances the network self-defense by safeguarding critical security-related data. Kataoka et al. presented [30] a 'trust list', which describes the distribution of trust among IoT-related stakeholders and provides autonomous enforcement of IoT traffic management at the edge networks by integrating blockchains and Software-Defined Networking (SDN). This, according to the authors, helps automating the process of doubting, verifying, and trusting IoT services and devices to effectively prevent attacks and abuses.

Conclusions and future work

The work-in-progress short paper presented a preliminary concept regarding the use of blockchains to provide accountability of events. Our running example usecase has been virtual firewalls instances as VNFs, but this architecture can be extended to other use cases with similar short-lived entities, e.g., various IoT and connect car scenarios. A number of avenues for future work exist, which include but are not limited to:

(i) validating the proposed architecture with a proof-of-concept on blockchains with an abstraction for the virtual network functions; (ii) fully adopting a thorough security controls architecture utilising controls from the CSA Cloud Controls Matrix (e.g., CCM v3.0)4 in order to build an actual working example of cloud-based virtual network functions with the proposed event logging architecture implemented on the two blockchains; and (iii) investigating the use of post-quantum signature schemes, e.g., Lamport or Merkle in the event log reports because their hash-tree like structures lend themselves well to such signatures.

Fig. 1 .

 1 Fig. 1. Event log report structure.

Fig. 3 .

 3 Fig.3. Block structure for event log reports in i-Ledger.

Fig. 4 .

 4 Fig. 4. Operation of the i-Ledger.

  , involving three actors: (a) generating entity in the active domain (Domain A); (b) the active domain log manager; and (c) any other domain (Domain B) log manager.

Fig. 5 .

 5 Fig. 5. Smart contracts in the i-Ledger.

Fig. 6 .

 6 Fig. 6. Operation of the a-Ledger.

Fig. 7 .

 7 Fig. 7. Smart contracts in the a-Ledger.

https://cloudsecurityalliance.org/working-groups/ cloud-controls-matrix/.

Acknowledgement

This work was partially done during Theo's visit to KDDI Research, Inc., Japan under the Japan Trust International Cooperation programme funded by the National Institute of Information and Communication Technology (NICT) in Japan.

This work was done while Anirban was with KDDI Research. He currently works for Hitachi R&D within Hitachi Ltd. This work was partly done while Theo was visiting KDDI Research as a NICTsupported invited researcher.