D3.3 ENTRUST Trust & Risk Assessment Framework – Final Release

Towards providing operational assurance to organizations belonging to the medical domain, ENTRUST aims to ensure that the trustworthiness level of Connected Medical Devices (CMDs) remains at an acceptable level throughout their operational lifecycle. In this regard, this deliverable is dedicated to the description of the final versions of the components participating in the Trust Assessment process of ENTRUST, focusing on the updates performed compared to their previous versions. First, we focus on the Formal Verification component, and the provision of a Domain Specific Language (DSL) for assisting the creation of verification models. The Attack Simulation and AI-based Misbehaviour Detection component is also described, and evaluation of various types of attacks typically affecting the medical domain. Next, we describe the two newly developed modalities of the Secure Software Update component, namely batching-based scalability features and hierarchical deployment of updates. We then present the action workflow and description of the device authentication flow based on the EAP-PSK protocol. Regarding the Trust Assessment Framework (TAF), we describe the Federated TAF modality and the interplay with the Risk Assessment component. Finally, we present the updated Threat Modelling component leveraging the GROQ model provider for increased efficiency, as well as the Software Verification component based on fuzzing with the application of LLMs. Experimental results are presented for all aforementioned components, thus setting the scene for their evaluation in the context of the use cases in D6.2.