Building on our previous remarks on subjective logic and the mathematical foundations that make network trust quantifiable, we must confront the reality that implementing such a framework in a real-world, multi-vendor forwarding environment is a journey through uncharted territory. While the CASTOR architecture provides the “dual brain” of Local and Global assessment functions, several complex architectural and computational questions remain at the heart of our research.
One of the key questions relates to the level of abstraction required for information sharing between the Local TAF agent on a network device and the Global TAF at the orchestration layer. There is a delicate balance to strike: should a local agent share a high-level, final trust score (the Actual Trust Level or ATL), or should it only transmit raw evidence and specific trust propositions? Calculating final trust scores directly at the routing plane could lead to ambiguity across different device types. A potential approach being explored is restricting the Local TAF to atomic propositions while reserving the Global TAF for the complex task of composing these into path-specific profiles. This separation of concerns would allow the global orchestrator to maintain a consistent “Trust Topology” regardless of whether the underlying hardware is a physical Cisco router or a virtualized container.
Extending trust from a single node to a communication link adds another layer of complexity. We are currently evaluating whether the trust level of a link should be a simple aggregation of the trustworthiness of its two endpoints or if it must include link-specific evidence collected directly at the Orchestration layer (i.e., Global TAF). This “adjacency-level” trust is a significant open question: can a link ever be fully trusted if one of its endpoints is currently classified as “low-trust”? Furthermore, we must determine if routers should exchange “stamped passports” (attestation reports) at the link level to verify their neighbours’ health before any data transmission, and how this data can as an unbiased source for end-to-end trust characterization (specifically avoiding circular dependencies in trust relationships). These decisions directly influence how CASTOR “colours” the network subgraphs to guide the Optimization Engine toward secure routes.
The challenge of “Modelling Uncertainty” is perhaps the most persistent hurdle. In a dynamic Computing Continuum, evidence is often sparse, disjointed, or intentionally submitted by a malicious neighbour to degrade a node’s reputation. We are investigating how to fine-tune Subjective Logic fusion operators to handle these contradictory scenarios. For instance, should we prioritize consensus, or should we use “epistemic fusion” to highlight disagreement between entities?
There is also the question of how to handle the “freshness” of evidence: does a report from five minutes ago carry the same weight as one from five seconds ago? And how should the level of uncertainty increase in relation to the longevity of the reported evidence?
Resolving these open questions is what will transform CASTOR from a technical framework into a robust, industry-ready solution. By rigorously defining how we aggregate atomic proofs into composite path-level trust, we ensure that the network doesn’t just “guess” at security but provides a mathematically verifiable chain of custody that can guide Traffic Engineering provisioning throughout the operational lifecycle of a network.
This ongoing research is essential for providing a stable foundation for end-to-end network connectivity in mixed-criticality services, ensuring that per-hop trust characterization remain accurate, actionable and resilient against evolving network conditions and threat landscapes.
