Trust in IoT ecosystems

By Bernd Ludwig Wenning  & Pasindu Manisha Kuruppuarachchi, MTU*

What is trust?

Generally speaking, trust is a confidence or belief that someone or something acts in an expected, benevolent way. If that someone or something does so, they will build trust over time. In contrast, if they behave erratically or malevolent, trust in them will erode.

For an IoT system, this means the system works as expected within its parameters, performing its duties as intended and not showing any unexpected or unwanted behaviour. The Industrial Internet Consortium (IIC) has defined five categories that contribute to trust in a system: safety, security, privacy, reliability, and resilience [1]. We further extend this by two more categories: uncertainty/dependability and goal analysis.

Hence, we consider trust and trustworthiness to be evaluated in these seven Trust Evaluation Categories (TECs):

  • Safety: Ensures that the system operates without causing harm to users, the environment, or other systems under both normal and abnormal conditions.

  • Security: Protects the system from unauthorized access, malicious attacks, and data breaches, ensuring integrity, confidentiality, and availability.

  • Privacy: Protects personal and sensitive information, ensuring compliance with data protection regulations and user consent.

  • Reliability: Measures the system’s ability to perform its intended functions consistently and accurately over time.

  • Resilience: Evaluates the system’s capacity to recover and maintain functionality during and after disruptions or failures.

  • Uncertainty/Dependability: Assesses the system’s behaviour under uncertain conditions or with inputs of uncertain nature and its ability to deliver expected outcomes despite variability.

  • Goal Analysis: Examines the alignment of the system’s objectives and operations with user needs, ensuring that trust-related goals are met effectively.

Trust in the context of TELEMETRY

TELEMETRY develops tools and methodologies for cyber security testing and monitoring of IoT ecosystems. The various tools in this project therefore produce outputs that can indicate aspects of the system’s trustworthiness, e.g., if anomalies are detected, these will have an impact on the system’s posture with regard to the TECs mentioned above.

To this end, a Trust Analyser is developed in TELEMETRY that assesses the overall trustworthiness of an IoT system based on the reports (“indicators”) from various tools and their mapping to TECs. Rather than the short-term identification of anomalies and incidents, this trustworthiness assessment is a long-term metric that builds over time. Long periods without incidents or anomalies will increase the trustworthiness, while any incident may lead to a more or less prominent decrease of trustworthiness, depending on the severity of the incident.

One key challenge is the aggregation of indicators and TECs into an overall trust metric. As not all tools report at the exact same time, the Trust Analyser has to use time windows, so called evaluation cycles, in which the reports are collected and then aggregated for scoring the individual TECs and the overall trustworthiness. The length of these evaluation cycles is a trade-off between how responsive the Trust Analyser is and how complete the set of reports is that is used for scoring. Weighting the individual TECs is another challenge in aggregation. The weights can be used to prioritise certain TECs over others, based on their importance to the use case.

A basic approach to aggregation is to use a weighted average of the individual TECs. This is the initial version of trust aggregation used in TELEMETRY. However, the research doesn’t stop here: Machine Learning methods are being explored that aim to achieve highly accurate trust assessment, ideally while maintaining explainability of what led to the assessment, so that a system operator can understand where the issue lies when the system’s trust is declining. Early results on this have been published in a conference paper [2].

Smart Manufacturing Use Case

One of the use cases in TELEMETRY is the smart manufacturing use case, UC2. In this use case, TELEMETRY tools are applied to a smart manufacturing system with a robot and other IoT components. The use case includes tools to monitor device behaviour, such as detecting whether a robot operates within its expected parameters, and other tools that monitor the network for anomalies. Indicators from these tools can be ingested by the Trust Analyser and mapped to the TECs as mentioned above. The Trust Analyser then assesses each one of the TECs and subsequently the overall trust score for the environment. The score will inform the smart manufacturing operator whether their environment is trustworthy with regard to the TECs, or whether there is any issue of concern. A dashboard provides them with a view on the overall score, on individual TECs and the indicators that contributed to the TECs.

Conclusion

Trust evaluation is an element of the overall cyber security evaluation that TELEMETRY tools aim to provide. It is a long-term evaluation of a system which indicates how trustworthy that system is in terms of seven Trust Evaluation Categories. Research is ongoing on aspects of how cyber security indicators are mapped to these categories, and how the categories are aggregated to a meaningful overall trust score that can inform an operator about their system’s overall long-term trustworthiness.

References

[1]   Industrial Internet Consortium. The Industrial Internet of Things: Managing and Assessing Trustworthiness for IIoT in Practice. pages 1–40, 2019.

[2]   P. M. Kuruppuarachchi, A. McGibney, S. Rea and B.-L. Wenning, “Machine Learning Based Trust Aggregation for IoT Systems,” 2025 IEEE International Conference on Smart Computing (SMARTCOMP), Cork, Ireland, 2025, pp. 282-287, doi: 10.1109/SMARTCOMP65954.2025.00087.

*Bernd-Ludwig Wenning is a Research Fellow at Munster Technological University (MTU) in Cork, Ireland. He holds Dipl.-Ing. and Dr.-Ing. degrees in electrical engineering and information technology from the University of Bremen, Germany. 

In 2012, he joined the Nimbus Centre at MTU. Since then, he has worked on several national and EU funded projects. His research interests include mobile and wireless networks and protocols, IoT and cyber physical systems. Throughout his research career, he has authored or co-authored more than 50 publications.

Pasindu Manisha Kuruppuarachchi received his Bachelor’s degree in Computer Systems and Networking from the Sri Lanka Institute of Information Technology. He later earned his Master’s degree in Engineering and Technology from Thammasat University, Thailand. He completed his Doctoral degree at Munster Technological University, Cork, Ireland, where his research focused on developing collaborative digital twin ecosystems under the Nimbus Research Centre. His research interests include digital twins, blockchain technologies, agentic AI development, and interpretable AI solutions.

European Cyber Security Community Initiative (ECSCI)

The European Cyber Security Community Initiative (ECSCI) brings together EU-funded cybersecurity research and innovation projects to foster cross-sector collaboration and knowledge exchange. Its aim is to align technical and policy efforts across key areas such as AI, IoT, 5G, and cloud security. ECSCI organizes joint dissemination activities, public workshops, and strategic dialogue to amplify the impact of individual projects and build a more integrated European cybersecurity landscape.

Supported by the European Commission, ECSCI contributes to shaping a shared vision for cybersecurity in Europe by reinforcing connections between research, industry, and public stakeholders.

Visit the website

European Cluster for Cybersecurity Certification

The European Cluster for Cybersecurity Certification is a collaborative initiative aimed at supporting the development and adoption of a unified cybersecurity certification framework across the European Union. Bringing together key stakeholders from industry, research, and national authorities, the cluster facilitates coordination, knowledge exchange, and alignment with the EU Cybersecurity Act.

Its mission is to contribute to a harmonized approach to certification that fosters trust, transparency, and cross-border acceptance of cybersecurity solutions. The cluster also works to build a strong stakeholder community that can inform and support the work of the European Union Agency for Cybersecurity (ENISA) and the future European cybersecurity certification schemes.

Visit the website

CertifAI

CertifAI is an EU-funded project aimed at enabling organizations to achieve and maintain compliance with key cybersecurity standards and regulations, such as IEC 62443 and the EU Cyber Resilience Act (CRA), across the entire product development lifecycle. Rather than treating compliance as a one-time activity or post-development task, CertifAI integrates compliance checks and evidence collection as continuous, embedded practices within daily development and operational workflows.

The CertifAI framework provides structured, practical guidance for planning, executing, and monitoring compliance assessments. It supports organizations in conducting gap analyses, building compliance roadmaps, collecting evidence, and preparing for formal certification. The methodology leverages best practices from established cybersecurity frameworks and aligns with Agile and DevSecOps principles, enabling continuous and iterative compliance checks as products evolve.

A central feature of CertifAI is the use of automation and AI-driven tools—such as Retrieval-Augmented Generation (RAG) systems and Explainable AI—to support the interpretation of complex requirements, detect non-conformities, and generate Security Assurance Cases (SAC) with traceable evidence. The approach is organized into five main phases: preparation and planning, evidence collection and mapping, assessment execution, reporting, and ongoing compliance monitoring.

CertifAI’s methodology is designed to be rigorous yet adaptable, offering organizations a repeatable process to proactively identify, address, and document compliance gaps. This supports organizations not only in meeting certification requirements, but also in embedding a culture of security and compliance into daily practice.

Ultimately, CertifAI’s goal is to make compliance and security assurance continuous, transparent, and integrated, helping organizations efficiently prepare for certification while strengthening their overall cybersecurity posture.

Visit the website

DOSS

The Horizon Europe DOSS – Design and Operation of Secure Supply Chain – project aims to improve the security and reliability of IoT operations by introducing an integrated monitoring and validation framework to IoT Supply Chains.

DOSS elaborates a “Supply Trust Chain” by integrating key stages of the IoT supply chain into a digital communication loop to facilitate security-related information exchange. The technology includes security verification of all hardware and software components of the modelled architecture. A new “Device Security Passport” contains security-relevant information for hardware devices and their components. 3rd party software, open-source applications, as well as in-house developments are tested and assessed. The centrepiece of the proposed solution is a flexibly configurable Digital Cybersecurity Twin, able to simulate diverse IoT architectures. It employs AI for modelling complex attack scenarios, discovering attack surfaces, and elaborating the necessary protective measures. The digital twin provides input for a configurable, automated Architecture Security Validator module which assesses and provides pre-certification for the modelled IoT architecture with respect of relevant, selectable security standards and KPIs. To also ensure adequate coverage for the back end of the supply chain the operation of the architecture is also be protected by secure device onboarding, diverse security and monitoring technologies and a feedback loop to the digital twin and actors of the supply chain, sharing security-relevant information.

The procedures and technology will be validated in three IoT domains: automotive, energy and smart home.

The 12-member strong DOSS consortium comprises all stakeholders of the IoT ecosystem: service operators, OEMs, technology providers, developers, security experts, as well as research and academic partners.

Visit the website

EMERALD: Evidence Management for Continuous Compliance as a Service in the Cloud

The EMERALD project aims to revolutionize the certification of cloud-based services in Europe by addressing key challenges such as market fragmentation, lack of cloud-specific certifications, and the increasing complexity introduced by AI technologies. At the heart of EMERALD lies the concept of Compliance-as-a-Service (CaaS) — an agile and scalable approach aimed at enabling continuous certification processes in alignment with harmonized European cybersecurity schemes, such as the EU Cybersecurity Certification Scheme for Cloud Services (EUCS).

By focusing on evidence management and leveraging results from the H2020 MEDINA project, EMERALD will build on existing technological readiness (starting at TRL 5) and push forward to TRL 7. The project’s core innovation is the development of tools that enable lean re-certification, helping service providers, customers, and auditors to maintain compliance across dynamic and heterogeneous environments —including Cloud, Edge, and IoT infrastructures.

EMERALD directly addresses the critical gap in achieving the ‘high’ assurance level of EUCS by offering a technical pathway based on automation, traceability, and interoperability. This is especially relevant in light of the emerging need for continuous and AI-integrated certification processes, as AI becomes increasingly embedded in cloud services.

The project also fosters strategic alignment with European initiatives on digital sovereignty, supporting transparency and trust in digital services. By doing so, EMERALD promotes the adoption of secure cloud services across both large enterprises and SMEs, ensuring that security certification becomes a practical enabler rather than a barrier.

Ultimately, EMERALD’s vision is to provide a robust, flexible, and forward-looking certification ecosystem, paving the way for more resilient, trustworthy, and user-centric digital infrastructures in Europe.

Visit the website

SEC4AI4SEC

Sec4AI4Sec is a project funded by the European Union’s Horizon Europe research and innovation programme under grant agreement No 101120393.

This project aims to create a range of cutting-edge technologies, open-source tools, and new methodologies for designing and certifying secure AI-enhanced systems and AI-enhanced systems for security. Additionally, it will provide reference benchmarks that can be utilized to standardize the evaluation of research outcomes within the secure software research community.

The project is divided into two main phases, each with its own name.

·       AI4Sec – stands for using artificial intelligence in security. Democratize security expertise with an AI-enhanced system that reduces development costs and improves software quality. This part of the project improves via AIs the secure coding and testing.

·       Sec4AI –  involves AI-enhanced systems. These systems also have risks that make them vulnerable to new security threats unique to AI-based software, especially when fairness and explainability are essential.

The project considers the economic and technological impacts of combining AI and security.

The economic phase of the project focuses on leveraging AI to drive growth, productivity, and competitiveness across industries. It includes developing new business models, identifying new market opportunities, and driving innovation across various sectors. 

Visit the website