D4.3 Runtime Assurance & Certification Framework – Final Release

This deliverable presents the final release of the ENTRUST Runtime Assurance and Certification Framework, detailing the complete design, implementation, and validation of the security stack for secure lifecycle management of Connected Medical Devices (CMDs). Building upon the foundations laid in D4.2, this work finalizes the ENTRUST Trusted Computing Base (TCB), delivering an integrated and benchmarked solution that supports heterogeneous CMDs, from high-end TEE-based platforms to resource-constrained PUF-based devices. Key contributions include the finalized implementation of Configuration Integrity Verification (CIV), a dual-credential trust model featuring manufacturer-issued Verifiable Credentials (VCs) and dynamic, domain-issued Conformity Certificates (CCs) with privacy-preserving disclosure, and the completed Agile Swarm Attestation protocol for scalable, low-end device security. A primary achievement of this deliverable is the comprehensive security analysis of the core cryptographic schemes, including Attribute-Based Signcryption (ABSC) and privacy-preserving Attribute-Based Credentials (p-ABCs), with formal proofs for unforgeability, confidentiality (IND-CPA), and attribute privacy. The framework’s practical viability is demonstrated through extensive benchmarking results. This work solidifies the ENTRUST architecture into an adaptive, cryptographically sound, and efficient solution for runtime trust assessment in safety-critical medical ecosystems.