From dc79114e67cf4343d21152c52af1b936b581755e Mon Sep 17 00:00:00 2001 From: Stefan Schumacher Date: Tue, 5 May 2026 17:53:09 +0200 Subject: Pages Version --- PlantUML-ModelingTrust/README.html | 615 +++++++++++++++++++++++++++++++++++++ 1 file changed, 615 insertions(+) create mode 100644 PlantUML-ModelingTrust/README.html (limited to 'PlantUML-ModelingTrust/README.html') diff --git a/PlantUML-ModelingTrust/README.html b/PlantUML-ModelingTrust/README.html new file mode 100644 index 0000000..65e234e --- /dev/null +++ b/PlantUML-ModelingTrust/README.html @@ -0,0 +1,615 @@ + + + + + + + + +Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate + + + + + +
+
+

Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate

+
+
+ +
+
+

I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.

+
+
+

As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«

+
+
+

I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.

+
+
+
+
+

Applied Examples: GnuPG Key Signing

+
+
+

The sub directory GnuPG-WoT-Download contains applied examples of the trust modeling. It is work in progress, but already contains some diagrams.

+
+
+

My goal is to model a reproducible builds distribution process with a zero trust architecture. And threat model it in PASTA as well as STRIDE.

+
+
+
+
+

Archimate Diagrams

+
+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Example from PaperApplied to the NetBSD download
+
+6 3a +
+
+
+6 3c +
+
+
+8 7a Trust Composition +
+
+
+8 7 GnuPG Trust Composition +
+
+
+RSO9 10 RiskSecurityOverlay +
+
+
+RSO9 10 RiskSecurityOverlay +
+
+
+9 9 RiskAssessmentPattern +
+
+
+9 9 GnuPG RiskAssessmentPattern +
+
+
+9 9 GnuPG RiskAssessmentPattern2 +
+
+
+9 9 GnuPG RiskAssessmentPattern3 +
+
+
+
+
+ + + \ No newline at end of file -- cgit v1.2.3