A Framework for Evaluating the End-to-End Trustworthiness

Abstract—Trustworthiness of software and services is a key concern for their use and adoption by organizations and end-users. Trustworthiness evaluation is an important task to support making informed decisions for both providers and consumers, i.e., for selecting components from a software marketplace. An analysis of the state of the art in software evaluation technologies motivated us to develop an evidence-based approach for trustworthiness evaluation. Most of the literature evaluates trustworthiness by focusing on a single dimension (e.g., from the security perspective) while there are limited contributions towards multifaceted and end-to-end trustworthiness evaluation. Our analysis reveals that there is a lack of a comprehensive framework for comparative, multi-faceted end-to-end trustworthiness evaluation, which takes into account different layers of abstractions of both the system topology and its trustworthiness. In this paper, we provide a framework for end-to-end trustworthiness evaluation using computational approaches, which is based on aggregating certified trustworthiness values for individual components. The resulted output supports in the definition of trustworthiness requirements for a software component to be locally developed and eventually integrated within a system, as well as, trustworthiness evidences for a composite system before the actual deployment. Thereby supports the designer in analyzing the end-to-end trustworthiness values. An application example illustrates the application of the framework