A Framework for Evaluating the End-to-End Trustworthiness

Trustworthiness of software and services is a key concern for their use and adoption by organizations and endusers. Trustworthiness evaluation is an important task to support both providers and consumers in making informed decisions, i.e., for selecting components from a software marketplace. Most of the literature evaluates trustworthiness by focusing on a single dimension (e.g., from the security perspective) while there are limited contributions towards multifaceted and end-to-end trustworthiness evaluation. Our analysis reveals that there is a lack of a comprehensive framework for comparative, multifaceted end-to-end trustworthiness evaluation, which takes into account different layers of abstractions of both the system topology and its trustworthiness. In this paper, we provide a framework for end-to-end trustworthiness evaluation using computational approaches, which is based on aggregating certified trustworthiness values for individual components. The resulting output supports in defining trustworthiness requirements for a software component to be developed and eventually integrated within a system, as well as obtaining trustworthiness evidences for a composite system before the actual deployment. Thereby it supports the designer in analyzing the end-to-end trustworthiness. An application example illustrates the application of the framework.