Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate

»Ontological Analysis and Redesign of Risk Modeling in ArchiMate«
- by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo.
  - https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate
»Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate«
- by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello
  - https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate

I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.

As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«

I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.

Applied Examples: GnuPG Key Signing

The sub directory GnuPG-WoT-Download contains applied examples of the trust modeling. It is work in progress, but already contains some diagrams.

My goal is to model a reproducible builds distribution process with a zero trust architecture. And threat model it in PASTA as well as STRIDE.

Archimate Diagrams

Example from Paper

Applied to the NetBSD download