Constantinos Pouyioukka

Thanassis Giannetsos

Weizhi Meng

CrowdLED: Towards Crowd-Empowered and Privacy-Preserving Data Sharing Using Smart Contracts

Keywords: Blockchains, Online Advertising, Smart Contracts, Security, Privacy, Fairness, Crowd-Sourcing

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Internet of Things and subsequently its applications and systems are mostly based on a cloud-centric approach. To ensure proper security and smooth operation of processes that are involved in such paradigms, several authors explored the possibility of integrating Blockchain technologies in IoT operations [START_REF] Catalini | Some Simple Economics of the Blockchain[END_REF].

Advertising Networks (ANs) work by relying on a mass scale data collection from participating users, leveraging smartphone applications, web applications, online services and internet browsing history. Data collection is achieved through advertising libraries that are embedded into the services and software. The collected data is then used to deliver specific ads, according to a user's online activity, ethnographic background and other information. In most cases, advertising networks aggressively collect user data without the necessary consent which in turn raises a number of questions regarding user anonymity and privacy [START_REF] Meng | The price of free: Privacy leakage in personalized mobile in-apps ads[END_REF].

ANs and subsequently their systems can be separated in online and mobile advertising. For setting the fundamentals of the research, we will explore online advertising as a whole; with mobile advertising as the core extend of that.

Advertisers in general, rely on ANs to efficiently deliver ads to customers [START_REF] Rastogi | Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces[END_REF][START_REF] Shekhar | Adsplit: Separating smartphone advertising from applications[END_REF]. This is achieved through the use of smartphones, as such devices, contain rich information that are needed by the advertising network. Services and mobile applications that are offered free of charge, utilize such networks for monetization, via the equivalent advertising schemes in place.

When referring to ad delivery and targeted ad placement, we are not only referring to smartphones, smart homes or smart appliances but to the wider spectrum of IoT applications; e.g., Intelligent Transportation Systems [START_REF] Gisdakis | SEROSA: service oriented security architecture for vehicular communications[END_REF][START_REF] Whitefield | Privacyenhanced capabilities for vanets using direct anonymous attestation[END_REF]. Such smart vehicles and respectively their drivers, will be part of such aggressive data collection methods being utilized by advertising networks. As drivers and passengers consume a large portion of their daily lives commuting, these systems can be susceptible to location specific advertising [START_REF] Grace | Unsafe exposure analysis of mobile in-app advertisements[END_REF]. This might be considered an alternative to static billboards. These systems require to communicate with the backend infrastructure and, thus, will also have to share data between them. Providing incentives in a transparent and fair way for users to participate, even in these services is of paramount importance.

Contributions: By taking all the information into consideration, this paper follows on to identify the main issues and share a brief insight on privacy-related solutions towards preventing aggressive data collection in the online and mobile advertising spectrum. Following, with an explanation of why blockchain technologies can be the solution and how they can be leveraged in such systems. Then we proceed with presenting the key challenges in designing and developing a viable solution coupled with the requirements that such systems need to fulfill as criteria, and an overview of the proposed architecture. This research paper finalizes with critiques of such an approach and how it can be enhanced further. Final thoughts and discussions are presented alongside our conclusions.

The Existing Problem in Web and Mobile Advertising

In websites, web applications and mobile applications, developers embed advertising libraries in their source code. This is a common way among companies to monetize their services, offering them for free instead of opting for a fee from their users. Those advertising libraries can then deliver targeted ads according to the specific online profile of a user. These libraries collect user data so that they can offer a more targeted approach when referring to ads.

This approach though comes with one major flaw; the uncontrolled mass collection of user data risking privacy. Technology giants in the likes of Google and Facebook offer their services for free, taking advantage of the advertising platforms they have developed over the years. In turn they act as brokers selling those advertising data to clients, to place targeted ads on their platforms. Clients/advertisers create campaigns on such platforms to promote their services or products. The advertisers can then request (through those platforms) where their ads will be placed, for how long and which specific groups of people will target, i.e.,: "People that make use of a smart-phone device, from the European Union aged between 25-40, who have an interest in football". This generic approach, mentioned as an example, can then be narrowed down even further with specific keywords provided by the advertising framework. Concluding that such techniques can be a major privacy issue, as developers implementing advertising libraries in their web or mobile applications, can collect personal data as an individual third party. Each platform and broker have their own payment systems in place, but the general approach is to pay according to the 'number of impressions' or 'how many times a link has been clicked' followed to the client's service. The more functional a platform is, the more revenue a broker can make from user data and in return their clients that use those platforms.

Although a straightforward process, data collection is happening aggressively without the user's consent especially in mobile applications. The most valuable asset of users, their data are given for free. When a service provider or an advertiser gets the revenue, a user doesn't get a share of that revenue.

Another important issue with advertising is the use of advertising libraries for malicious acts. Ads containing malicious code or misleading audiovisual content, with the sole purpose of extracting user sensitive information. Or forcibly through an ad, install ad-ware on a user's system to collect information in the background. This method is commonly referred to as "Malvertising" (Malicious Advertising). This practice is commonly used by perpetrators, as the advertising libraries provide a solid platform for malware to flourish and be distributed due to the intrusive nature of ads. Advertising libraries being intrusive by nature can ensure that a product or a service can gain traction by attracting loads of users. But at the same time can be a double-edged sword as it compromises user security and privacy. As advertising is now a normal process of selling products or services on legitimate websites and social networks, attackers can directly advertise malicious code websites or applications masked behind a valid ad without compromising those legitimate websites.

In this paper we aim to introduce an incentivized and privacy enforced solution towards mitigating the following issues: (i) The uncontrolled and aggressive data collection of users, (ii) The non-incentivisation of user data to compensate users for participating in the advertising model, and (iii) The possible distribution of Malware or offensive ads using an advertising library.

Privacy Preserving Solutions towards Preventing Aggresive Data Collection

A lot of research has already been conducted towards ensuring that strict security and privacy mechanisms are clearly followed when collecting user data for ad placements [START_REF] Grace | Unsafe exposure analysis of mobile in-app advertisements[END_REF]. Studies have mainly focused in measuring and identifying the security and privacy risks that are directly associated with the delivery of ads in web applications, websites and mobile applications. Results have identified that most advertising libraries abuse systematically the way they handle and gather data from host applications and their user base [START_REF] Meng | The price of free: Privacy leakage in personalized mobile in-apps ads[END_REF]. Pluto: ("Free for All! Assessing User Data Exposure to Advertising Libraries for Android") [START_REF] Meng | The price of free: Privacy leakage in personalized mobile in-apps ads[END_REF]. A framework notable for its usage in analyzing and detecting if an advertising library and by extension its host application is exposing targeted user data. Pluto is built in a novel way utilizing the power of language processing and machine learning and the equivalent data mining models. This is done to identify what type of user data is exposed and what information, advertising networks can extract from a list of installed applications in a device. Pluto can estimate the risks associated when developers choose to implement advertising libraries in their applications.

AdSplit: ("AdSplit: Separating smartphone advertising from applications") [START_REF] Einziger | Scheduling advertisement delivery in vehicular networks[END_REF]. An application embedded to the Android Operating System that allows an application and the advertising library associated with it to run as separate processes on the system kernel. Each process is assigned a separate user-id, thus, eliminating the need for the main application to request permission to mine data on behalf of the advertising library. AdSplit, guarantees privacy of users but does not solve the problem of aggressive data collection.

PiCoDa: ("PiCoDa: Privacy preserving Smart Coupon Delivery Architecture") [START_REF] Geth | Official Go Implementation of the Ethereum Protocol[END_REF]. A privacy preserving smart coupon delivery system, with its main purpose of protecting user data on the client side rather than on the service side. This framework guarantees that when an ad is placed, a user is being verified if it is eligible for a coupon. It also offers protection to the service/vendor by not revealing any information about the targeting strategy.

Privad: ("Privad: Practical Privacy in Online Advertising") [START_REF] Ethereum | A Decentralized Platform that runs Smart Contracts[END_REF]. An advertising system that provides a balance between user privacy and placements of ads across the web. Privad makes use of keywords, demographics and user interests for prioritizing those data according to the needs of an AN via online auctions. Privad improves a user's browsing experience, while maintaining low costs when we are referring to costs of infrastructure for an advertising network.

RePriv: ("RePriv: Re-Imagining Content Personalization and In-Browser Privacy") [START_REF]Where Jave meets the Blockchain[END_REF]. A browser add-on system, that has as its main purpose to enable privacy for participating users. RePriv only discovers data after getting an explicit user permission. It then mines relevant user interests and shares this information with third party ANs. As the authors and developers claim, this data mining is happening in-browser and no drawbacks are being reported when we are referring to, a user's online browsing experience and the performance drawback of producing results.

From a brief description of the above solutions, we can conclude that while some of them are focusing in delivering privacy as their ultimatum, others, by compromising privacy, provide a sense of fairness. None of them, however, guarantees and solves the initial problem as a whole: Providing the privacy, fairness and security as their core characteristics. When referring to fairness, we imply the compensation of users for providing their data to advertising networks.

Using Blockchain Technologies, Smart Contracts and Incentives to Close the Gap

Blockchains work in such a way that can provide a 'shared governance', thus, ensuring trust and anonymity. And with the use of smart contracts, involved parties can benefit from shared agreements as well as the fair exchange of data without the need of a third-party intermediary being in charge. Blockchains for the IoT domain can be applicable in a plethora of applications and systems [START_REF] Luu | Making smart contracts smarter[END_REF]. One field though that hasn't attracted much attention is the integration of blockchain technologies in advertising network applications.

The main challenge in such systems is to fairly reward users while avoiding uncontrolled and aggressive data collection of user's personal information and data. To overcome the issue of fair execution, an approach would be the use Smart Contracts. Using smart contracts, service providers can ensure that rewards provided by the service, and the data provided by users are exchanged simultaneously. This can be achieved because smart contract terms and conditions are strictly followed after they are agreed by the parties involved [START_REF] Papadopoulos | If you are not paying for it, you are the product: How much do advertisers pay to reach you?[END_REF].

Advantages of using Blockchains in Online/Mobile Advertising

Transparency: Users will have control over which data can be shared but also can opt out from the data collection process at any given time. Also, with Blockchains, advertisers and advertising libraries can verify that a user engagement on an ad is genuine. Users can be confident that an ad placement is not coming from a fraudulent entity as, through smart contracts, the ad of a service can be verified and validated on the network, i.e., if an ad is placed for an Amazon product the user will know that the advertiser has created an ad campaign that was placed directly by Amazon and not another fraudulent entity.

Incentives: Users can still support the advertising business model but can also be given the option of exclusion. ANs can be incentivized to collect only the necessary and minimum amount of data required for their services, as they will have to 'pay' for gaining further access to user data. Rewards can either be, monetary or non-monetary [START_REF] Leontiadis | Don't kill my ads!: Balancing privacy in an ad-supported mobile application market[END_REF][START_REF] Gisdakis | Shield: A data verification framework for participatory sensing systems[END_REF][START_REF] Dimitriou | Rewards: Privacy-preserving rewarding and incentive schemes for the smart electricity grid and other loyalty systems[END_REF]. Systems with monetary incentives, reward their participants with real money or virtual redeemable credit which is equivalent to the actual price in currency. Non-monetary incentives do not include any real money rewards but can include a plethora of options such as entertainment, social and service incentives [START_REF] Rastogi | Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces[END_REF]. This can vary according to the advertisement library and the agreements set at the programming of smart contracts.

Fairness: Fairness can exist if the parties involved mutually agree on the terms of the Smart Contract. Those terms will be upheld and followed strictly as any node connected inside the network can validate the status of the contracts ensuring absolute trust between the parties involved.

Privacy and Anonymity: Using Blockchains, we can ensure user privacy and anonymity, as security mechanisms are implemented by default. Although, such mechanisms exist, we still need to take appropriate actions to identify any leakage of personal user information.

No single point of failure: Data are distributed in such way where each node has an exact copy of the entire Blockchain since the genesis block. Even if nodes inside the network do fail, the network is still fully operational, and any workload is distributed to the other network nodes.

Open Source Software: Blockchain technologies are based on Open Source software, allowing a plethora of applications to be deployed. A huge community of developers is present that ensures the security and proper maintenance of the source code. Advertising libraries and providers of advertising libraries can benefit from the openness of this technology.

Direct Communication between Advertisers and Users: Based on the current mode of operation, current advertising libraries introduce a middleman between users and advertisers. Those middlemen can be in the likes of large corporations who act as brokers. With the use of Blockchains, these middlemen can be eliminated or become less powerful in terms of controlling user data. Thus, they will be deemed irrelevant to the final transaction of the smart contract. When advertisers leverage this direct contact to the end users, more robust and effective ads can be delivered.

Less Intrusive -More Effective Ad Placements: At their current state ads are very intrusive. Especially in mobile applications where the majority ads can take the form of video overlays that cannot be closed until a specific time interval has concluded. A good example of a privacy related application is the web browser Brave, which offers an approach of Blockchain related advertising. Brave allows users to opt -in or out for receiving ads. Following a similar approach, in our system, advertisers can benefit from receiving the data they need, without compromising user privacy.

Less Malicious Code Exploits & Elimination of Malware: One issue with intrusive ads is the possibility of distributing malicious code and fraudulent ads to the end-users. A big portion of advertising libraries have less checks in place to validate the authenticity of ad campaigns or do not have checks at all to ensure what ads are being served. Although already mentioned, with transparency in mind, assurance and quality of ads derives directly from Blockchains. When a transaction is sent throughout the network, it is validated and then accessible to view by any valid user. If a malicious user tries to interact with the network, it can be traced back to the point it originated; thus, it can be deemed invalid and not safe for the entirety of a network.

Taking into consideration the benefits of Blockchain technologies, smart contracts and their characteristics, we aim to further expand on these technologies for finding the golden ration between advertisers, advertising networks and users. With the use of Blockchain technologies, the main problem of aggressive data collection can be remedied. As adopters of this system, can agree with their users, to receive specific data anonymously, in exchange of rewards. Users on their end can still support the advertising business model, by having the option to share (or not) their data. Advertising networks in turn can be incentivized to collect only the necessary data as they will have to 'pay' for the data they require. Thus, the problem of fairness can be solved as well. In the next section a more in-depth approach on the Blockchain underpinnings is conducted and we identify the key challenges in designing a system, like CrowdLED.

Key Challenges in Designing CrowdLED

As aofrementioned, Blockchains can be used to enhance the advertising platform for better delivery of ads and a fair exchange of data for the appropriate user incentivization while ensuring verification and enhanced user privacy. All these objectives can be achieved by taking crucial measurements and identifying the key challenges that need answering before implementing CrowdLED.

From a "System Security" Perspective: How can we ensure that users or mobile applications don't feed or spoof data to get a competitive advantage, or unfairly get compensated in a system? How can we ensure that the system proposed in its entirety is secure from user manipulation but also, how can we ensure users are secured from and by the system? -This key challenge is very important in such systems to ensure their viability and properly compensate users according to their participation. By integrating Blockchain technologies and with the use of smart contracts, the security and privacy but also, the fairness aspects of the research questions can be solved.

From an "Economics Perspective": How can a Smart Contract be implemented to accommodate the entities involved? What types of incentives can be offered as an acceptable form of compensation? What is the right amount of compensation for the right amount of data gathered? -This key challenge is again important and needs to be addressed for properly incentivizing users according to the data they share. Compounding this issue, we need to implement metric mechanisms; using device metrics to quantify user privacy and data shared across parties.

From a "System Design" Perspective: How is the data collected and shared, from user devices to advertising networks? Should there be a central system service that handles data requests, or an ad hoc mechanism handled by the device's operating system? Is the system secure by web-based attacks? -Currently mobile and web applications offer ads, collect data and share them with an advertising network. Usually the data collection from such services is hidden from the host application, the operating system and the user itself. The decision on which approach needs to be taken into consideration for implementation, between a central system or an ad hoc mechanism, is solely based on examining the trade-offs of each approach. The solution should not be susceptible to tampering but also be efficient as not to impact the performance of a user's device or that of the system from delivering the ads.

From a "User Privacy" Perspective: How can we ensure that proper user privacy practices are being followed? Is the system secure from social engineering attacks, with their main aim to identify users? -As already mentioned, ANs rely on aggressive data collection to target specific ad placements to their users. This aggressive data collection extracts personal user information which users wouldn't share in the first place.

Closing the Gap between ANs and Users

CrowdLED will be a fully operational system combining Blockchain technologies and Smart Contracts for enabling privacy and fairness when advertising networks collect user data. By using incentives and rewards, we can ensure a fair exchange of data and credits between a user and an advertiser. But also, enable correct security practices that ensure: Privacy and Anonymity, to the users involved and Fairness and Security, to the users and the system providers.

Data Collection

Data Collection Characteristics: The type of information that is to be collected from the users, but also the possible use of sensors in a smartphone so that data can be extracted. This data can take the form of raw application data, or statistical values such as maximum, average or minimum [START_REF] Delmolino | Step by step towards creating a safe smart contract: Lessons and insights from a cryptocurrency lab[END_REF][START_REF] Leontiadis | Don't kill my ads!: Balancing privacy in an ad-supported mobile application market[END_REF][START_REF] Papadopoulos | The cost of digital advertisement: Comparing user and advertiser views[END_REF][START_REF] Haddadi | Mobiad: Private and scalable mobile advertising[END_REF].

The frequency on which data is to be transmitted and time duration characteristics: This includes the periodic submission interval that data is to be submitted to the advertising network. Time intervals can vary in time, length but also in frequency. Those time intervals might also have specific requirements on the data that are to be submitted, i.e., every twenty [START_REF] Gisdakis | Sppear: Security & privacypreserving architecture for participatory-sensing applications[END_REF] seconds for the time interval of two (2) minutes, submit the device's location where that location is above thirty (30) meters of sea level [START_REF] Delmolino | Step by step towards creating a safe smart contract: Lessons and insights from a cryptocurrency lab[END_REF][START_REF] Papadopoulos | The cost of digital advertisement: Comparing user and advertiser views[END_REF][START_REF] Haddadi | Mobiad: Private and scalable mobile advertising[END_REF]. The duration of a task that users need to participate, and the time interval data sharing is live on the network, needs to be recorded [START_REF] Delmolino | Step by step towards creating a safe smart contract: Lessons and insights from a cryptocurrency lab[END_REF].

Area of interest and incentive characteristics: The area of interest that the system will be deployed for delivering ads on a specific area. The area can be defined as the population of a geographical area. Dense geographic areas are more of interest to ensure maximum ad placement and delivery [START_REF] Delmolino | Step by step towards creating a safe smart contract: Lessons and insights from a cryptocurrency lab[END_REF]. Incentives: The Incentive criteria, on which, the users will be rewarded according to the data they provide to the service.

Eligibility criteria to join: User devices must meet some pre-defined hardware or software specifications. Pre-defined eligibility criteria might fall in the category of specific user profiles or user groups. Examples might be software requirements like an Android or iOS operating system. Specific user profiling might include users who enjoy a specific outdoor activity to deliver ads based on environmental and user's activity data.

Security

Privacy Preserving and Fairness Mechanisms: Users participating, taking into consideration the time on a service and their contribution, should be rewarded fairly and anonymously [START_REF] Papadopoulos | The cost of digital advertisement: Comparing user and advertiser views[END_REF][START_REF] Haddadi | Mobiad: Private and scalable mobile advertising[END_REF]. Any external or internal observers shouldn't be able to identify any users. If there is the need for collecting sensitive personal information, users can either opt out or enable access with the equivalent reward [START_REF] Papadopoulos | The cost of digital advertisement: Comparing user and advertiser views[END_REF][START_REF] Haddadi | Mobiad: Private and scalable mobile advertising[END_REF].

Access Control and Authorization Mechanisms: Users participating, should only allowed to access areas of the system, according to the privileges provided to them by system administrators.

Confidentiality, Authentication and Integrity Mechanisms: The system must have specific mechanisms to ensure the proper authentication of participating users. Proper protection on their communications should be provided alongside strong confidentiality and integrity of the communication channels against unauthorized third parties with the purpose of causing harm to the system or its users [START_REF] Meng | The price of free: Privacy leakage in personalized mobile in-apps ads[END_REF][START_REF] Gisdakis | Sppear: Security & privacypreserving architecture for participatory-sensing applications[END_REF].

Accountability Mechanisms: Any entity that might be deemed as offensive to the system, including participating users, administrators or components Trustworthiness and Validity of Data Mechanisms: The system must have the necessary mechanisms to ensure the validity of data and their trustworthiness as submitted by the participating users. Also, ads must be delivered in such a way to not affect performance and should be as accurate as possible [START_REF] Chiasserini | Advertisement delivery and display in vehicular networks: Using v2v communications for targeted ads[END_REF].

Incentives/User Compensation

Well-laid out incentive schemes must cover basic requirements, which include:

-The maximization of profits for both users and the system [START_REF] Zyskind | Enigma: Decentralized computation platform with guaranteed privacy[END_REF]; -Avoid any risks, relating to users and system, having a 'damaging' cause.

Incentives must be adequate to outweigh any drawbacks while transmitting data. Drawbacks might include: battery drainage, excessive usage of device resources, and the time the service is running on the background; -The system should be aware of the exact population of participating users on demand at any given time. Also known as a stochastic population. This ensures that proper incentive allocation is fairly distributed across users.

An Architectural Blueprint of CrowdLED

Figure 1 depicts how users and advertisers could interact with each other when using smart contracts. The system is equipped with a direct communication scheme in place, between an advertiser and a user. Rather than relying on a broker to handle user data for specific ad campaigns on behalf of an advertiser, the advertiser is now responsible for placing ads; by having direct access to user data after consent has been granted. This approach can make data brokers irrelevant to the relationship between users and advertisers.

High-level Overview

This approach follows a two-contract mandate between users and advertisers.

The first contract will dictate the data that the user will share with the advertiser and the incentives the advertiser will issue as a compensation to the user. The second contract, directly issued by the first contract, will dictate what ad will be served to the user, according to the data transmitted on the first contract for a more effective ad placement. The first contract acts as a reference point of the initial transaction. The second contract will be issued automatically as the user has already approved and authorized the collection of data for delivering an ad. In respect to Figure 1 and its numbering we present the process flow as follows: Advertisers request data from the users through a smart contract using the advertising library (Step 1). Users will decide if they will opt-in to engage in the smart contract providing their data, with the option to select what data to distribute, i.e., Location and Interests. Advertisers then, according to the agreed amount of data that they will receive, they issue the amount of incentives that the user will receive (Step 2). As already discussed, incentives can be of monetary or non-monetary format. This can be settled on a universal mandate by the network and its participants. If the user is not happy with the incentives that will be issued after the transaction has been finalized, the user can choose to opt-out without further commitment and user data and incentives are omitted.

If all has been decided by the user and the advertiser, the contract is then encrypted and represented as a block to be broad casted and mined from the validating users (miners) of the network. Once the block has been mined, validated and the network approves the transaction, the block is permanently added to the chain. This is the initial block that will create a reference for the next block and the smart contract of delivering the ad (Step 3).

The second contract is issued automatically by the first contract, but its validity can still be rejected by the network. The advertiser issues the ad campaign according to the received data, and the contract is encrypted and represented as a block and follows the same journey of validation by the network. If the contract is validated according to the standards of the network, the user receives in an automatic approach the ad placement. If now the contract is deemed as containing an anomaly or any malicious code, or the ad doesn't meet the advertisement criteria, both the contracts are voided and reversed, and the advertiser is issued a penalty according to the severity of the anomaly ( Steps 4,[START_REF] Gisdakis | SEROSA: service oriented security architecture for vehicular communications[END_REF][START_REF] Whitefield | Privacyenhanced capabilities for vanets using direct anonymous attestation[END_REF].

This approach of a two-contract based system can have the benefit of identifying fraudulent users trying to circumvent the initial contract. With the issue of a penalty, advertisers can always make sure that they follow the network procedures without risking financial loss. Also, it gives the opportunity to users to select which advertisers to trust based on a feedback system.

CrowdLED Implementation Details & Execution Flow

As a first prototype, the system is being developed as an Android application. For future iterations, the system will leverage both web and mobile frameworks towards a universal deployment. Currently the Blockchain network used is Ethereum [START_REF] Ethereum | A Decentralized Platform that runs Smart Contracts[END_REF] Development branch with "CrowdLED token" being created as an incentive to compensate users. Geth [START_REF] Geth | Official Go Implementation of the Ethereum Protocol[END_REF] command line has been used to create a test bench for the development and for initializing a new Blockchain to test the communication between the Android application and the network. Open Source library Web3J [START_REF]Where Jave meets the Blockchain[END_REF] has been used to provide the necessary toolbox to enable the deployment of smart contracts from the Android application to the test Ethereum network. "CrowdLED token" has been created as part of the test network and has a fixed price. At the current stage of development, one token equals with sending one location packet to the service, for testing purposes. The location packet is making use of the sensing capabilities of the smartphone to send longitude and latitude in a string format.

Google Firebase acts as the equivalent of the advertising library (See Figure 1) and is being used as a medium to exchange the data from the user to the advertiser. The back-end infrastructure communicates with two different versions of the application. One version is for the hypothetical user and another is for the hypothetical advertiser. Both the advertiser and user have unique wallet addresses bind to each application for simplicity. Once the user commits to send data to the service, the service asks for a consent to transmit the data. Moving on, from the Android Application, the back-end is responsible for transmitting the user's location to the advertiser only if the first contract has been validated. The user is then rewarded for the data and the back-end sends the information for the ad. The ad in this early development stage is just an image, again for testing purposes. Pre-loaded tokens from the Advertiser's account wallet are subtracted, according to the data a user is sending and are added to the user's account wallet. Smart contracts are written in Solidity; an object-oriented high-level language with syntax similar to JavaScript. Web3J library acts as a wrapper to deploy the smart contracts from the Android Applications to the Blockchain test network.

At this stage of development, the two contracts behave as they should, assuming the user always accepts the binding agreement of the first contract and the network has validated that the ad placement on the user's application is following the advertisement criteria of the network.

As already mentioned, CrowdLED is a work in progress. Everything discussed in this section and the current development stage is to give an overview of the system to the reader. The current development stage is to test the system in a scenario where everything works as intended.

Discussion & Critique

With respect to the benefits of using Blockchains, mentioned in Section IV, and the requirements set in section VI, there are still some open issues that need further investigation as they can have a negative impact on the system functionality.

The system needs to present a fair incentive model. What do we mean with fair incentives? Who is responsible for deciding what is a fair compensation to users that provide their data? Can the community of participating users decide what a fair compensation is? Or should the advertisers decide on what to compensate users according to the data they receive?

A simple approach is: 'a user sends an "X" amount of data to an advertiser for a fixed amount "Y" of compensating incentives.' Those compensating incentives can be unique for each advertiser, i.e., Amazon can offer discounts to its online marketplace or provide users with one month of premium shipping. There are a lot of approaches in the fairness model but also, algorithms that can be implemented to ensure that fairness can exist. Further research must be conducted to identify, design and implement a 'fair approach' algorithm.

The need for checking mechanisms to be implemented, to ensure that malicious ads or malware don't make their way to end users. Also, what other mechanisms can be implemented to ensure that any other form of attacks don't occur in such a system? As discussed in section VI, access control and accountability mechanisms need to be implemented in the final solution. Furthermore, research has been conducted towards ensuring security in the Blockchain. Security that it is not compromised by attacks. Such attacks can take many forms with most notable ones being Sybil and Eclipse attacks. These two attack vectors are the ones that need to be explored further as they can make the whole system and its validity of serving effective ads, ineffective. This danger is more prominent with Sybil attacks where in our case, a node in the network can act, as one with many identities, spamming the advertising libraries with repetitive data to 'win' more incentives.

When an advertiser has served a misleading or a 'fake' ad, with the purpose of extracting user sensitive information or misleading the end user, how is that advertiser penalized? Which entity inside the system is responsible for adjusting that penalty and what form of penalty is the most suitable one? Mechanisms need to be implemented to ensure that any type of mishap can be stopped and not occur again. A penalty system needs to be implemented in accordance to advertising policies.

When referring to ad validity, what types of ads can be deemed as misleading or fake? In order to address properly this issue, we need to follow Regulations, Policies and Laws set for Advertisers worldwide. Such examples include:

-The Advertising law from the Federal Trade Commission in the US; -The Consumer Protection from Unfair Trading Regulations and the Business Protection from Misleading Marketing Regulations in the UK; -EU's Audiovisual Media Services Directive for the EU.

One of the most notable open issues with such a system approach is the use of smart contracts and their security. How can we ensure security in smart contracts and in their entirety are not susceptible to attacks? When referring to the validity of the transactions in smart contract, it doesn't always mean that the security is not compromised. From further research it has been identified that, smart contracts can include bugs or critical security vulnerabilities, which in turn can make their way inside the Blockchain. The main reason such security vulnerabilities and bugs are present inside the smart contract code, is because of the way a smart contract is programmed. Common problems with smart contracts can be logical errors, the failure to use or implement cryptographic protocols during the binding of the contract, misaligned incentives and the details of the implementation approach of the contracts are error-prone. An attacker can then manipulate those errors inside the smart contract to its advantage if appropriate security mechanisms are not in place.

Conclusions

Throughout this research paper, we aim to identify current issues in Mobile and Online advertisement networks. By using Blockchains and smart contracts, we aim to introduce a feasible approach to close the gap between advertising networks and users. Also, the main aspect outlined in this paper is to ensure that Security, Anonymity, Privacy, Transparency and Fairness will be implemented as core characteristics in the proposed system. Making a brief comparison between the problems and the positives of such an approach, "CrowdLED" is being introduced: A system that when deployed to its full extend, will be evaluated to ensure its validity and effectiveness by comparing it against initial objectives and requirements set. A more in-depth paper following the algorithms involved and a thorough system architecture and how the two-contract based approach will work with adequate testing, will be released at a later stage.

Fig. 1 .

 1 Fig. 1. : User & Advertiser Interaction with the Blockchain network -Overview of the system's infrastructure should be 'disciplined' based on a set of rules pre-defined by the system.Trustworthiness and Validity of Data Mechanisms: The system must have the necessary mechanisms to ensure the validity of data and their trustworthiness as submitted by the participating users. Also, ads must be delivered in such a way to not affect performance and should be as accurate as possible[START_REF] Chiasserini | Advertisement delivery and display in vehicular networks: Using v2v communications for targeted ads[END_REF].

Acknowledgments

This work was supported by the European Commission, under the ASTRID and FutureTPM projects; Grant Agreements no. 786922 and 779391, respectively.

Special thanks to Dr. Soteris Demetriou, Assistant Professor at Imperial College London, for his insights in privacy and security for mobile and online advertising, and the valuable feedback at the initial stages of drafting this paper.


Yoshinobu Kawabe
email: kawabe@aitech.ac.jp

Yuki Koizumi
email: ykoizumi@ist.osaka-u.ac.jp

Tetsushi Ohki
email: ohki@inf.shizuoka.ac.jp

Masakatsu Nishigaki
email: nishigaki@inf.shizuoka.ac.jp

Toru Hasegawa
email: t-hasegawa@ist.osaka-u.ac.jp

Tetsuhisa Oda
email: oda@aitech.ac.jp

On Trust Confusional, Trust Ignorant, and Trust Transitions

Keywords: Two-dimensional trust representation, fuzzy logic, I/Oautomaton theory, safety/liveness properties, subjective logic

This paper introduces a two-dimensional representation for trust values that uses two metrics: "trust" and "distrust." With this representation, we can deal with such contradictory arguments as "The message is basically trustworthy but simultaneously not trustworthy." Such situations can be caused when a message is consistent with other messages, but the message is sent from an unknown sender. We also explore how to analyze the transitions of two-dimensional trust values with a theory of distributed algorithms and compare our trust representation with Jøsang's subjective logic.

Introduction

During recent large-scale disasters, social media have been actively used to exchange various information about victims. Although such social media messages are helpful during disasters, some might be unreliable. For example, when a huge earthquake struck northern Osaka on the morning of June 18, 2018, many fake messages were distributed on Twitter and rapidly retweeted all over Japan, causing many problems.

Even if a message's content is true at one specific moment, the message may "become untrue" as time passes. For example, even if the following message, "A person is seriously injured but still alive," is true immediately at the beginning of a disaster, it might be false an hour later; the person might be dead. In this sense, some messages may not be reliable. If one receives a message from an unknown sender, one might also suspect that it is unreliable. This might happen even if the message's content is relatively consistent.

To deal with such situations, we must properly evaluate the trust of messages and senders. Marsh and Dibben introduced a trust value, which ranges from -1 to 1, and classified trust notions into trust, distrust, untrust, and mistrust [START_REF] Marsh | Trust, untrust, distrust and mistrust -an exploration of the dark(er) side[END_REF]. Their classification is one-dimensional; i.e., trust and distrust are at both extremities. However, for the notions of trust and distrust, Lewicki et al. [START_REF] Lewicki | Trust and distrust: New relationships and realities[END_REF] suggested that they are located at entirely separate dimensions. Cases exist where a one-dimensional expression is not sufficient for trust values.

Trust is a property that is closely related to human impressions. We believe that a technique for impression formation based on mathematical psychology should be applied for trust values. Oda [START_REF] Deng | Fuzzy logical operations in the two-dimensional hyper logic space concerning the fuzzy-set concurrent rating method[END_REF][17] [START_REF] Oda | Fuzzy set theoretical approach for improving the rating scale method : Proposing and introducing the FCR-method and the IR-method as novel rating methods[END_REF][19] developed a Fuzzy-set Concurrent Rating (FCR) method with fuzzy logic that enables us to measure and analyze human impressions. Since the FCR method allows two or more dimensions for representing a truth value, trust and distrust notions can be described two-dimensionally by applying them to a trust representation. This enables us to describe situations in (i) confusional trust (e.g. "Although he can basically be trusted, in some cases he is not trustworthy") and (ii) ignorant trust (e.g. "Since I have never met him, I have no impression of him."). In this paper, we introduce a FCR-based, two-dimensional trust representation and show how it corresponds to the conventional trust representation of Marsh and Dibben.

We also deal with transitions of trust. If we regard a two-dimensional trust value as a state of an automaton, we can discuss properties defined with a series of state transitions. With results from the theory of distributed algorithms, we discuss safety-related trust properties (e.g. "A user never reaches a state of distrust" and "If a user exits the distrust region, she never returns to it") and livenessrelated trust properties (e.g., "A user can finally reach the trust region."). We also discuss an efficient proof method for trust-related safety properties based on I/O-automaton theory.

This paper is organized as follows. After showing some notions and notations in Section 2, we introduce a two-dimensional trust representation in Section 3. In Section 4, we model and analyze trust transitions. Finally, in Section 5, we compare our trust representation with Jøsang's subjective logic.

Preliminaries

The FCR Method

A rating scale method (Fig. 1) is often used for questionnaires, where such adjectives as "poor," "fair," "average," "good," and "excellent" are given from which respondents choose. One problem with this method is that they tend to choose the middle item in the scale. This problem presents two cases. The first case is that the respondent has multiple answer candidates that are located at both extremities. The respondent usually chooses one of them, but if it is difficult for the respondent to choose one, a middle item may be chosen instead. The chosen middle item is not the true answer; the middle item is usually "average" or "neutral," which complicates analysis. In the second case, since the respondent lacks sufficient knowledge/interest to answer, she chooses the middle value.

The word on the right hand side describes the personality of Mr. Smith. Please circle the number that best matches your feelings.

Fig. 1. Conventional questionnaire

The word on the right hand side describes the character of Mr. Smith. Please check each of the seven scales. Each scale represents the ratio of your opinion. The left edge of the scale represents an opinion that never matches your feelings, and the right edge corresponds to a complete match with your feelings. The sum of the values need not equal 1.

Fig. 2. Rating with FCR method

To overcome this problem of choosing the middle item, in the FCR method, respondents are requested to describe their confidence in each item (Fig. 2); in other words, the respondents answer how much they believe the truthiness in each item. Then by applying fuzzy inference, we calculate the true answers of the respondents. From a theoretical viewpoint we have no restrictions on the dimensions (i.e., the number of items), but for simplicity we just employ two dimensions in the rest of this paper.

Hyper Logic Space Model

The FCR method employs the Hyper Logic Space model (HLS) as a logic space for multiple-dimensional multiple-valued logic. Figure 3 shows a two-dimensional space based on true and f alse. For any t, f ∈ [0, 1], pair (t, f ) is called an observation. t and f are independent; we do not assume such conditions as

t + f = 1. We call {(t, f ) | t, f ∈ [0, 1] ∧ t + f > 1} the region of contradiction. {(t, f ) | t, f ∈ [0, 1] ∧ t + f < 1} is called the region of ignorance, or the region of irrelevance. Finally, {(t, f ) | t, f ∈ [0, 1] ∧ t + f = 1} is the consistent region.
Integration Value Given observation (t, f ), we need to calculate an actual truth value, which is called an integration value. Integration values can be cal-Fig. 3. Two-dimensional HLS Fig. 4. Graphical calculation for integration values culated in several ways, and we employ the reverse-item averaging method, where integration value I 2 is defined with

I 2 (t, f ) = t + (1 -f ) 2
. The integration value is the average of the degree of the positive elements and the complementary degree of the negative elements. I 2 (t, f ) is calculated in a graphical manner (Fig. 4). The result of calculation is the value of "degree 1" after drawing a perpendicular line from (t, f ) to Fig. 4's diagonal line.

Degree of Contradiction

Another important value in the FCR method is the degree of contradiction [START_REF] Deng | Fuzzy logical operations in the two-dimensional hyper logic space concerning the fuzzy-set concurrent rating method[END_REF] [START_REF] Oda | Fundamental characterestics of fuzzy-set concurrent rating method[END_REF] or the contradiction-irrelevance degree. In the field of personality psychology, some situations are allowed, including "I like it, but I don't like it" or "I don't care for it at all." The degree of such confusion/irrelevance is formulated with the degree of contradiction.

For observation (t, f ), degree of contradiction C(t, f ) should satisfy C(t, f ) = 1 for complete confusion, C(t, f ) = -1 for complete ignorance, and C(t, f ) = 0 for a consistent situation. C(t, f ) = t + f -1 is usually employed where C(t, f ) represents the distance between (t, f ) and the consistent region.

Trust Classification by Marsh and Dibben

A conventional trust value is a real number in [-1, 1). Readers interested in the details of calculating trust values can find them here [START_REF] Marsh | Trust, untrust, distrust and mistrust -an exploration of the dark(er) side[END_REF], but in this paper we omit them since they are beyond the scope of this paper and directly handle the calculated trust values. Marsh and Dibben introduced the following four notions of trust:

-Trust: This notion represents a case where a trust value is positive and exceeds a predefined value called a cooperation threshold. In this case, a trustee should be trusted, and the trust value is regarded as a measure of how much an agent believes the trustee.

-Distrust: Here the trust value is negative, and an agent believes that a trustee will actively work against her in a given situation. -Untrust: Although the trust value is positive, it is not high enough to produce cooperation. An agent cannot determine if a trustee is actually trustworthy. -Mistrust: Initial trust has been betrayed. More precicely, mistrust represents a situation either a former trust was destroyed or a former distrust was healed.

The mistrust notion is a time-related trust property discussed in Section 4. We address trust, distrust, and untrust notions in the following section. For these properties, see studies by Primiero [START_REF] Primiero | A calculus for distrust and mistrust[END_REF] (on distrust and mistrust) and [START_REF] Primiero | Trust and distrust in contradictory information transmission[END_REF] (on trust and distrust).

FCR-Based Two-Dimensional Trust Representation

Suppose that you received a message, and you calculated its trust value. If the trust value is 0.9 and the cooperation threshold is 0.85, then from the definition of the trust notion, the message should be trusted. However, can you say that you have absolutely no distrust about this message? Since the maximum trust value is 1, a deficit of 0.1 exists. In this sense, the message might not be trusted enough.

We believe that this situation is caused by the limitations of the power of one-dimensional expressions. Hence, in this study we employ the degrees of trust T rust and distrust DisT rust defined with

T rust = DisT rust = { v | 0 ≤ v ≤ 1}
and define a two-dimensional trust value as an element of T rust × DisT rust. Following the FCR method, a two-dimensional trust value is also called an observation in this paper.

Understanding Two-Dimensional Trust Values

We semantically understand two-dimensional trust values by observing some of them.

Observation (1, 0) ∈ T rust × DisT rust has a high degree of trust (1) and a low degree of distrust (0). (1, 0) represents a case where a trustee is completely trusted; this observation corresponds to (conventional) trust value 1. Observation (0, 1) represents a case of complete distrust and corresponds to trust value -1. Observation (0.5, 0.5), which falls exactly between (1, 0) and (0, 1), corresponds to 0 in conventional trust values.

To define such trust notions as trust, distrust, and untrust in our twodimensional trust model, we employ the following transformation:

[( cos π 4 -sin π 4 sin π 4 cos π 4 ) { ( t d
) -

( 1 0 ) } + ( √ 2 2 0 )] × 1 √ 2 2 = ( t -d t + d -1 ) .
Figure 5 shows the transformation and observations (1, 0), (0, 1), and (0.5, 0.5) are respectively mapped to (1, 0), (-1, 0), and (0, 0). Below, the resulting point Fig. 5. Graphically understanding calculation of (i, c) of the transformation is called (i, c). First element i = t -d can be calculated with the reverse-item averaging method in Section 2.1. Actually, the value of i is calculated by normalizing I 2 (t, d) to be a value in region [-1, 1]; note that the range of integration value I 2 (t, d) was originally [0, 1].

The value of i was regarded as a conventional trust value given by Marsh and Dibben. From the definition of i = t -d, a net trust value is calculated by subtracting the degree of trust from the degree of distrust, which matches our intuition. From Fig. 5, the consistent region, which is the line between (1, 0) and (0, 1) before the transformation, corresponds to the set of conventional trust values. Observation (t, d) in the consistent region satisfies t + d = 1 and is regarded as an assumption on the trust and distrust degrees. The theory of conventional trust values implicitly introduces this assumption.

Trust notions are defined with the value of i 1 . Let CT be a cooperation threshold. If we have i = t -d ≥ CT , then it is a case of trust; if i is negative then it is case of distrust; if we have 0 ≤ i < CT , then it is a case of untrust. Note that for the case of distrust, condition i < 0 is equivalent to t < d; i.e., a trustee is distrusted if the degree of distrust exceeds the degree of trust.

New Classification on Untrust

As shown in Fig. 4, integration values can be graphically calculated. Observing the graphical calculation, the two-dimensional trust values in the same perpen- 1 In this paper, we only define trust notions with the value of i = t -d without the value of c. Our paper's trust notions are formalized with "linear" functions. For example, the trust and distrust notions are defined with restrictions d ≤ -t + CT and d > t. This is just for simplicity, and we believe it is possible to provide a finer definition for trust notions with both i and c; that is, we believe a "non-linear" definition is possible. This is future work.

dicular line have identical integration values. For example, observation A = (t, d)

and its nearest point on diagonal line

A ′ = ( t + (1 -d) 2 , 1 - t + (1 -d) 2
) have the same integration value. However, for observations A and A ′ , the distance from the diagonal line is different. The distance between observation (t, d) and the diagonal line in Fig. 4 is given by |t + d -1|, which is the absolute value of second element c = t + d -1 of point (i, c) defined in the previous section. The formula of c is equivalent to the degree of contradiction-irrelevance C(t, d) of the FCR method.

If C(t, d) is positive and high, then it is a state of confusion; both trust and distrust degrees are high. If C(t, d) is negative and low (i.e., the absolute value of c is high), then it is regarded as a state of irrelevance; in this case, both the trust and distrust degrees are low. In the field of fuzzy logic, a state of confusion is caused by information overload, and a state of irrelevance is caused by a lack of information [START_REF] Deng | Fuzzy logical operations in the two-dimensional hyper logic space concerning the fuzzy-set concurrent rating method[END_REF] [START_REF] Oda | Fundamental characterestics of fuzzy-set concurrent rating method[END_REF]. For information overload, there is too much evidence about a trustee, some of which may increase the trust value on the trustee, but others may increase the distrust value. This causes confusion, which leads to a situation where you cannot determine whether the trustee is trustworthy. If you lack sufficient evidence, i.e., if you ignore the trustee, you cannot discuss whether she is trustworthy.

This discussion demonstrates that two cases exist where one cannot determine whether the trustee is trustworthy. Therefore, we introduce two types of new untrust notions:

-Untrust confusional: the trustee is both trusted and distrusted. Formally, this is a case with 0 < i < CT and c ≥ 0. -Untrust ignorant: the trustee is ignored; in other words, the trustee is neither trusted nor distrusted. Formally, this is a case with 0 < i < CT and c < 0.

The original untrust notion [START_REF] Marsh | Trust, untrust, distrust and mistrust -an exploration of the dark(er) side[END_REF] corresponds to the notion of untrust ignorant, and in this paper, we introduce a new kind of untrust notion from the viewpoint of confusion.

Example

In three countries, an opinion poll was conducted about the approval ratings of each country's governments. We used the following items to answer this question: "Do you trust your government?" For country c, the number of answers for each item is a c 1 , . . . , a c 4 ; also, we have

s c = a c 1 + a c 2 + a c 3 + a c 4 .
In this example, we calculate the degrees of trust t c and distrust d c of the government with

t c = a c 2 + a c 4 s c and d c = a c 3 + a c 4 s c .
A survey was conducted with 100 residents each in the countries of X, Y , and Z, and the following are the results: For each country we can also calculate the values of i and c:

(a X 1 , a X 2 , a X 3 , a X 4 ) = (
(i X , c X ) = (-0.1, 0.3), (i Y , c Y ) = (0.2, -0.4) and (i Z , c Z ) = (0.2, 0.3).
From this result, the following analysis is possible. For country X, there is some degree of distrust of the government, and citizens in country X are somewhat confused since the degree of contradiction is positive. For country Y , the degree of trust exceeds the degree of distrust, but the degree of contradiction is negative, which suggests that the people have little interest in their government. For countries Y and Z, although their integration values are the same, the degree of contradiction is positive for country Z. Note that we can compare countries Y and Z, even though the conventional trust model cannot since the degree of contradiction is not addressed.

Transitions of Two-Dimensional Trust Values

Mistrust is a property with regard to misplaced trust. If the first estimation for an observation is in the region of trust (i.e. i = t-d ≥ CT ), but the next estimation is changed to the region of distrust (i.e. i < 0), then the first estimation was incorrect. With this understanding, mistrust can be modeled as a property for the changes or transitions of a trust value. Transition-related trust properties must be analyzed, including mistrust or swift trust [START_REF] Meyerson | Swift Trust and Temporary Groups in Trust in Organizations: Frontiers of Theory and Research[END_REF] [START_REF] Wildman | Trust development in swift starting action teams: A multilevel framework[END_REF], especially during disasters [START_REF] Busa | Trust-building through social media communications in disaster management[END_REF][9] [START_REF] Murayama | Issues in disaster communications[END_REF]. In this section, we regard an observation as a state and analyze the transitions of trust values.

Dealing with Trust Values as States

I/O-automaton [START_REF] Lynch | Forward and backward simulations -part I: Untimed systems[END_REF][12] is a formal system for distributed algorithms, where a distributed system is modeled as a state machine and its properties are formalized with observable actions. Some actions, such as keyboard input, display output, and open communication in the Internet are observable, and others are unobservable, such as internal processing and secret communication.

Formally, automaton X has set of actions sig(X), set of states states(X), set of initial states start(X) ⊂ states(X), and set of transitions trans(X) ⊂ states(X) × sig(X) × states(X). Transition (s, a, s ′ ) ∈ trans(X) is written as s a → X s ′ . In this paper, a state is a tuple of values. Each element of the tuple has a corresponding distinct variable name. A variable's name is used as an access function to its value. Such modeling is standard in I/O-automaton theory and its extensions, such as [START_REF] Kaynar | The Theory of Timed I/O Automata[END_REF]. In this paper, we use variables tr and dis for trust and distrust values. The trust and distrust degrees in state s ∈ states(X) are called s.tr and s.dis.

Formalizing Trace-Based Trust Properties

Let α ≡ s 0 a1 → X s 1 a2 → X • • • an → X s n
be a transition sequence of automaton X. We define tr(α) as a sequence of all the external (i.e., observable) actions in

a 1 a 2 • • • a n , and write s 0 tr(α) ⇒ X s n . If s 0 is an initial state, tr(α) is called a trace of α.
A trace is a sequence of observable actions in an execution from an initial state.

In I/O-automaton theory, various properties of distributed systems are defined with traces (Section 8.5.3 of [START_REF] Lynch | Distributed Algorithms[END_REF]). Well-known characteristics are safety and liveness properties. Informally, a safety property means that nothing bad ever happens in a system. For example, the following are safety properties: "no division by zero error occurs" and "after reaching special state s, the system never reaches an error state." A liveness property means that something good might happen. "A program can terminate" and "from any state, the system can reach an initial state" are typical liveness properties.

If we regard Section 3's observations as states, we can define safety/liveness properties related to trust transitions. "An observation never reaches the region of distrust" and "after reaching the regions of trust or untrust, an observation never reaches the region of distrust" are trust safety properties. "An observation can reach the region of trust" is a trust liveness property.

Formalizing Trust Safety Properties

Let CT be a cooperation threshold. We define the regions of trust T (CT ), distrust D, and untrust U (CT ):

   T (CT ) = { (t, d) | t ∈ T rust ∧ d ∈ DisT rust ∧ t -d ≥ CT } D = { (t, d) | t ∈ T rust ∧ d ∈ DisT rust ∧ t < d } U (CT ) = T rust × DisT rust \ (T (CT ) ∪ D),
where 0 < CT ≤ 1 holds. Sets T (CT ), D, and U (CT ) correspond to Section 3.1's definitions for trust notions, where "linear" functions are employed; exploring a "non-linear" setting is a future work.

We introduce a predicate for the reachability from state s to state s ′ :

reachable(s, s ′ ) ⇐⇒ s = s ′ ∨ ∃s ′′ ∈ states(X) ∃a ∈ sig(X)[ s a → X s ′′ ∧ reachable(s ′′ , s ′ ) ],
and we define predicate nonDistr(s):

nonDistr(s) ⇐⇒ ∀s ′ ∈ states(X) [ reachable(s, s ′ ) =⇒ (s ′ .tr, s ′ .dis) ̸ ∈ D ].
With these predicates, we can formalize a trust safety property, "an observation never reaches the region of distrust," with ∀s ∈ start(X) [ nonDistr(s) ]. Another safety property,"after reaching the region of trust or the region of untrust, an observation never reaches the region of distrust," is formalized:

∀s ∈ states(X) ∀s ′ ∈ states(X) [ (reachable(s, s ′ ) ∧ (s ′ .tr, s ′ .dis) ̸ ∈ D) =⇒ nonDistr(s ′ ) ].

Formalizing Trust Liveness Properties

We can also formalize trust liveness properties. Let n ∈ N be a natural number. We define reach n (s, s ′ ) to represent that state s ′ is reachable from state s with n-steps as follows:

reach 0 (s, s ′ ) ⇐⇒ s = s ′ , and reach k+1 (s, s ′ ) ⇐⇒ ∃s ′′ ∈ states(X) ∃a ∈ sig(X)[ reach k (s, s ′′ ) ∧ s ′′ a → X s ′ ].
With reach n (s, s ′ ), "an observation can reach the region of trust" is defined:

∀s ∈ states(X) ∃s ′ ∈ states(X) ∃n ∈ N [ reach n (s, s ′ ) ∧ (s ′ .tr, s ′ .dis) ∈ T (CT ) ].

Efficient Proof Method for Trace-Based Trust Properties

Although we can directly prove the logic formulae in the previous section, this is inefficient. By employing a result in I/O-automaton theory, a more efficient proof is possible. Figure 6 shows the specification of automaton testerSafety, which describes the transitions of a two-dimensional trust value. It is written in an I/O-automaton-based specification language called IOA [START_REF] Bogdanov | Formal verification of simulations between I/O-automata[END_REF]. This specification has three variables. Variables tr and dis are for the degrees of trust and distrust. Variable stateOfAgent is used for a trustee's internal state. Automaton testerSafety has three actions: move, inDistr, and notInDistr. Each action is described in a precondition-effect style, where the pre-part has a condition to fire the action and the eff-part has the action's body. Action move shows that an observation moves from (pt, pd) to (pt + dt, pd + dd) when event ev occurs. Actions inDistr and notInDistr are special observable qualities that denote whether the current observation is in the region of distrust. Action inDistr is enabled if (tr, dis) ∈ D holds, which is equivalent to tr < dis, and action notInDistr is enabled if (tr, dis) ̸ ∈ D holds.

To specify automaton testerSafety, we need a concrete definition for predicate condition in the pre-part of action move. Automaton traceSafety is the specification automaton for a safety property, but we need to deal with a safety property of a concrete system. Let A be an automaton and let traces(A) be a corresponding trace set. If trace inclusion traces(A) ⊆ traces(testerSafety) holds, then automaton A satisfies the safety property defined with automaton testerSafety's traces. Therefore, to show ∀s ∈ start(A) [ nonDistr(s) ], it suffices to show the trace inclusion.

I/O-automaton theory provides techniques that prove a trace inclusion of (possibly infinite-state) systems, which can be applied with a theorem-proving tool [START_REF] Bogdanov | Formal verification of simulations between I/O-automata[END_REF] From Theorem 3.10 of [START_REF] Lynch | Forward and backward simulations -part I: Untimed systems[END_REF], if there is a forward simulation from Conc to Abst, then we have traces(Conc) ⊆ traces(Abst). Therefore, to show trace inclusion traces(A) ⊆ traces(testerSafety), it suffices to find a forward simulation from A to testerSafety. This leads to a safety property: "an observation never reaches the distrust region in A."

Example

Figure 7 shows an I/O-automaton bbdSystem, which is a specification of a communication system that sends a user's message to an online bulletin board after evaluating an observation. Specifically, by action get mes, the system receives a message from a user, and an observation is evaluated with actions discard mes and approve mes. If pair (tr+evalTr(i, m), dis+evalDis(i, m)) of the next state's observation falls in the distrust region, the message is discarded by action discard mes; otherwise, it is sent by actions approve mes and say.

If we hide observable actions get mes and say in bbdSystem, that is, if we deal with these observable actions as internal ones, we can find a forward simulation from automaton bbdSystem\{get mes, say} to automaton testerSafety. Consequently, we have traces(bbdSystem\{get mes, say}) ⊆ traces(testerSafety) that provides the safety property defined with automaton testerSafety. A complete computer-assisted proof is found in [24].

Discussion

In this section we compare our two-dimensional trust representation with a similar approach found in Jøsang's subjective logic [START_REF] Jøsang | Subjective Logic: A Formalism for Reasoning Under Uncertainty[END_REF].

Two-Dimensional Representation in Subjective Logic

In probabilistic logic [START_REF] Nilsson | Probabilistic logic[END_REF], the truth values of propositions are probabilities and are given based on the frequency of events. The confidence on a truth value is high if enough attempts can be made; for example, we can confirm the truthiness of proposition "the probability of heads when flipping a coin is 0.5" if we can toss the coin many times. In subjective logic, truth values are defined from an epistemic viewpoint. The confidence of a truth value is high if we know how a situation happens. For example, the confidence of the proposition, "the probability that Lee Harvey Oswald killed John F. Kennedy is 0.5" is high if the dynamics of the case are well-known; however, many aspects of this case remain unknown, so the confidence is not actually high. Outputs "inDistr" and "notInDistr" are defined as in the case of automaton "testerSafety." Fig. 7. System never sends a message if a user might be distrusted

Subjective logic uses a domain, which is a set of distinct opinions. If a domain consists of opinions x and x, it is called a binary domain. In this study, we deal with a binary domain where one opinion x corresponds to the trust notion and its contrary opinion x represents the distrust notion. A binomial opinion in subjective logic is defined with the following quadruple ω

A x = (b A x , d A x , u A x , a A x ): -b A
x : the amount of observer A's belief in x; d A x : the amount of observer A's disbelief in x; u A x : the amount of observer A's uncertainty about x; a A x : the prior probability in the absence of belief or disbelief. We assume 0

≤ b A x , d A x , u A x , a A x ≤ 1 and b A x + d A x + u A x = 1 hold for any b A x , d A x , u A
x and a A x . Values b A x , d A x , and u A x are depicted with a triangle in Fig. 8. The

Comparing Two Types of Trust Representations

Pair (b A x , d A x ) in subjective logic corresponds to (t, d) of the FCR method in Section 3. We compare the two types of trust representations. The second type of opinion is where u A x = 0. In this case, we have b A x +d A x = 1; that is, the opinion is dogmatic and completely consistent. For this situation, the degree of contradiction is 0 in the FCR-based model. From a discussion in Section 3.1, such opinions are regarded as a conventional trust value by Marsh and Dibben.

Considering Three Kinds of Opinions

Finally, we consider the case where

u A x = 1. Here b A x = d A x = 0 holds since we have 0 ≤ b A x , d A x ≤ 1 and b A x + d A x + u A x = 1.
In subjective logic, this state is called vacuous or undefined. Observation (0, 0) of the FCR-based model corresponds to this opinion.

Difference of Two Representations Observation (0, 0) represents the total uncertainty. However, in the FCR-based model, this is not the only observation of it. We have another observation, [START_REF] Atanassov | Intuitionistic Fuzzy Sets: Theory and Applications[END_REF][START_REF] Atanassov | Intuitionistic Fuzzy Sets: Theory and Applications[END_REF], where the trustee is highly trusted but simultaneously highly distrusted. In this situation, you cannot determine whether the trustee is trustworthy. From the following discussion, the subjectivelogic-based approach cannot deal with such uncertainty.

From condition b A x +d A x +u A x = 1, we have

-u A x = b A x +d A x -1.
The right hand side of this formula is equivalent to the degree of contradiction since pair (b A x , d A x ) corresponds to (t, d) of the FCR method. -u A

x is the degree of contradiction. Moreover, we have 0

≤ u A x ≤ 1, which leads to -1 ≤ b A x + d A x -1 ≤ 0.
Hence, binomial opinions in subjective logic are either in the region of ignorance or in the consistent region. Therefore, we conclude that subjective logic does not deal with the region of contradiction. A similar logic space model without the region of contradiction is found in the A-IFS model [START_REF] Atanassov | Intuitionistic Fuzzy Sets: Theory and Applications[END_REF].

As described in Section 3.2, a state of confusion is caused by information overload, and a state of irrelevance is caused by a lack of information. This observation suggests the following difference between subjective-logic-and FCRbased approaches:

-Let A be an observer and let x be a trustee. At the beginning of the computation, observer A is ignorant of trustee x, and no evidence exists upon which to judge whether x is trustworthy. Thus, we have b A x = d A x = 0 and u A x = 1 in subjective logic. In this study we assume that trust and/or distrust degrees increase if the observer collects evidence on x. If this is the case, as time passes, the values of b A x and d A x increase, and the value of u A x decreases. Finally, after collecting enough evidence, the value of u A x becomes 0. Since confusing situations are ignored in subjective logic, in the subjective-logicbased approach, there is an implicit assumption that an observer can finally calculate a trustee's trustworthiness.

-On the other hand, in the FCR-based trust representation, we have t = d = 0 at the beginning, as in the case of the subjective-logic-based approach. Thus, we have C(0, 0) = -1 for the degree of contradiction. Note that the absolute value of C(t, d) can be seen as the degree of uncertainty, which is maximum in the beginning. The setting in the FCR-based approach is reasonable, but the assumption in the subjective-logic-based approach is considered too strong. Actually, in the example of Section 3.3, the cases for countries X and Z cannot be dealt with in the subjective-logic-based approach since the degree of contradiction is positive. 4 , and this enables us to handle the cases for countries X and Z in the subjective-logic-based approach. We can see that, in the modified example, the trust and distrust values of a respondent are 0.5 if the respondent chooses the fourth item: 4. Sometimes yes, sometimes no.

Note that the sum of the values equals 1. Hence, when we employ the weight of 0.5 in estimating t c and d c , we implicitly assume that a respondent choosing the fourth item can consistently evaluate the trustworthiness to her government. However, we do not use such an assumption in the example of Section 3.3, since we address the suggestion [START_REF] Lewicki | Trust and distrust: New relationships and realities[END_REF] that trust and distrust notions should be located at completely separate dimensions. Hence, in order to deal with trust and distrust degrees independently, we need to handle not only the case of t c +d c ≤ 1 but also the case of t c + d c > 1. Therefore, the region of contradiction {(t, d) | t + d > 1} is required. Actually, in the modeling of Section 3.3's example, the trust and distrust degrees of the fourth item's respondent are 1, which means that the sum of the trust and distrust degrees equals 2. Some readers may consider this modeling is coarse, but we believe that a more accurate evaluation is possible if

we define t c = a c 2 + a c
a c 4pos = ∑ i∈S 4th
trust degree of respondent i, and

a c 4neg = ∑ i∈S 4th
distrust degree of respondent i, where S 4th is the set of respondents choosing the fourth item.

Conclusion

This paper proposed a two-dimensional trust representation based on fuzzy logic. An observation was given as a pair of trust and distrust degrees, and we discussed the validity of its representation by showing a mapping to conventional one-dimensional trust representation. We also introduced a new classification of untrust. Additionally, this paper discussed such trace-based trust properties as safety properties and liveness properties. We showed how a simulation-based proof method for trace inclusion can be applied for trust safety properties. Finally, we compared our two-dimensional trust representation with a trust representation based on subjective logic.

It is important to ensure the applicability of this paper's modeling of trust properties and the proof technique to actual systems. This study is a part of a research project on disaster communication systems, and future work will prove the trust properties of a real communication system with social media, such as a communication system for disaster management [START_REF] Chen | CNS: Content-oriented notification service for managing disasters[END_REF] [START_REF] Jahanian | The evolving nature of disaster management in the internet and social media era[END_REF]. In real systems, an analyst may receive conflicting evidence from different sources, which means that some source of information provides wrong evidence. We believe that the degree of contradiction is applicable to handle this situation. If there are many wrong information sources, then the degree of contradiction becomes high. Hence, the analyst can use the degree of contradiction to judge whether she should discard and re-collect evidence.

Although this paper has discussed safety properties such as "if a user exits the distrust region, she never returns to it," this sort of assertion is considered too strong in the real world. To use this paper's techniques for real systems, we need proper sufficient conditions. Finding such conditions is an important future work.

Finally, we must introduce a "non-linear" definition for trust notions (see the footnote in Section 3.1), which employ both i and c.

Fig. 6 .

 6 Fig. 6. Automaton testerSafety written in IOA language

1 β⇒ 1 π→

 11 [START_REF] Soegaard-Andersen | Computer-assisted simulation proofs[END_REF]. Finding a forward simulation between automata is one of the techniques. Forward simulation f from I/O-automaton Conc to I/O-automaton Abst is a binary relation over states satisfying the following conditions: Initial state correspondence: For any initial state a ∈ start(Conc), there is initial state b ∈ start(Abst) and f (a, b) holds. Step correspondence: For any reachable states a 1 , a 2 ∈ states(Conc), b 1 ∈ states(Abst) and any action π Conc ∈ sig(Conc), if f (a 1 , b 1 ) and a 1 π → Conc a 2 hold, then there is a state b 2 ∈ states(Abst) satisfying f (a 2 , b 2 ) and b Abst b 2 with β = tr(a Conc a 2 ).

  i:ID, m:MES) internal discard_mes(i:ID, m:MES) internal approve_mes(i:ID, m:MES) output say(i:ID, m:MES) output inDistr(t:VL, d:VL) output notInDistr(t:VL, d:VL) states tr: VL := 0, % VL ranges over [-1, 1] dis: VL := 0, % but we assume 0 <= tr, dis <= 1 at any state flg: Bool := false, mesQ: Seq[MES] := empty transitions % Note: input actions does not have the input get_mes(i, m) % "pre"-part since they are always enabled. eff mesQ := mesQ || (packet(i, m) -| empty) internal discard_mes(i, m) pre ~flg /\ mesQ ~= empty /\ packet(i, m) = head(mesQ) /\ ((tr + evalTr(tr, m))-(dis + evalDis(dis, m))) < 0 eff mesQ := tail(mesQ) internal approve_mes(i, m) pre ~flg /\ mesQ ~= empty /\ packet(i, m) = head(mesQ) /\ ((tr + evalTr(tr, m))-(dis + evalDis(dis, m))) >= 0 eff flg := true output say(i, m) pre flg /\ mesQ ~= empty /\ packet(i, m) = head(mesQ) eff tr := tr + evalTr(tr, m); dis := dis + evalDis(dis, m); mesQ := tail(mesQ); flg := false

Fig. 8 .

 8 Fig. 8. Triangular Representation of Binomial Opinion in Subjective Logic

  We consider three kinds of opinions below. The first one is an opinion where b A x = 1 and is shown at the bottom right of the Fig. 8's triangle. This opinion's correspondence in the FCR-based model is in { (t, d) | t = 1 ∧ d ∈ DisT rust } where the degree of trust is 1. However, as discussed later, since subjective logic does not deal with the region of confusion, thus the point where b A x = 1 exactly corresponds to (1, 0) in the HLS model. Actually, in subjective logic the state where b A x = 1 is for an absolute opinion on x, and from a trust viewpoint trustee x is completely trusted by agent A.

If we modify t c and d c with t c = a c 2 + 0 . 5 × a c 4 s c and d c = a c 3 + 0 . 5 × a c 4 s

 20543054 c in the example of Section 3.3, then t c + d c -1 ≤ 0 is always satisfied. The weight of 0.5 is introduced for variable a c

  If we define this predicate with condition(stateOfAgent, ev, pt, pd, dt, dd) ⇐⇒ (pt, pd) ̸ ∈ D ∧ (pt + dt, pd + dd) ̸ ∈ D then action inDistr cannot be enabled. None of testerSafety's traces have occurrences of action inDistr. This creates a set of traces traces(testerSafety),

	automaton testerSafety
	signature
	internal move(ev:Event, pt: VL, pd: VL, dt: VL, dd: VL)
	output inDistr(t:VL, d:VL)
	output notInDistr(t:VL, d:VL)
	states
	tr: VL := 0,	% VL ranges over [-1, 1]
	dis: VL := 0,	% but we assume 0 <= tr, dis <= 1 at any state
	stateOfAgent: agtState := InitState
	transitions
	internal move(ev, pt, pd, dt, dd)
	pre	pt = tr
	/\ pd = dis
	/\ (0 <= (pt + dt) /\ (pt + dt) <= 1)
	/\ (0 <= (pd + dd) /\ (pd + dd) <= 1)
	/\ condition(stateOfAgent, ev, pt, pd, dt, dd)
	eff tr := tr + dt;
	dis := dis + dd;
	stateOfAgent := change(stateOfAgent, ev)
	output inDistr(t, d)
	pre tr < dis /\ t = tr /\ = dis
	eff do nothing
	output notInDistr(t, d)
	pre ~(tr < dis) /\ t = tr /\ d = dis
	eff do nothing

Acknowledgments

This work was supported by the National Institute of Information and Communications Technology in Japan (Contract No. 193).