The proliferation of IoT networks across various sectors necessitates robust Trust Management mechanisms for secure and reliable operations. This paper proposes a Multi-Attribute Decision Making (MADM)-based approach for trust score calculation in IoT Trust Management. This solution addresses limitations of existing methods by considering multiple attributes and providing a comprehensive evaluation of trustworthiness. The methodology computes a device's trust score by integrating factors such as Cyber Risk, Ease of Access, and Security Level using a weighted sum-based calculation. The Analytical Hierarchy Process (AHP) to determine the factors’ weights is utilized, contributing a novel approach to IoT Trust Management. Furthermore, this approach includes dynamic trust score updates throughout the device's lifetime, accommodating changes in the device's Cyber Risk for accurate trust assessment. A trust score penalization mechanism for devices below a predefined threshold is also introduced, enabling prompt risk mitigation. A simulated assessment, considering varying numbers of IoT devices, evaluates the effectiveness of the proposed methodology. By addressing limitations and introducing innovative components, the proposed MADM-based approach enhances security, reliability, and overall performance of IoT networks. This research advances trust management in IoT and provides valuable insights for developing secure and trustworthy IoT ecosystems.

ERATOSTHENES is an EC, co-funded, research project strongly considering modern security challenges in the domain of Internet of Things in mind of their huge penetration into our day to day lives. There are a series of recent challenges that recently have been converted into obstacles or risk points that could block the secure operation of IoT networks in all day to day activities, from home to office, to leisure and security. These include examples such as the highly increased number of connected devices (at all network levels) that are on top forming inhomogeneous networks and systems of systems. Different vendor characteristics further increase the attack surface that is expected to further rise in the upcoming years. Such, highly critical, characteristics, dramatically increase the needs for confidentiality access control, user and things’ privacy, devices’ trustworthiness and compliance that require lifecycle considerations. The ERATOSTHENES project orchestrates a novel distributed, automated, auditable, yet privacy-respectful, Trust and Identity Management Framework and Reference Architecture with the ultimate scope to dynamically and holistically manage IoT devices in a lifecycle approach, strengthening trust, identities, and resilience in the entire IoT ecosystem while supporting the enforcement of the NIS directive, GDPR and Cybersecurity Act. This publication describes the ERATOSTHENES technical concept and reference architecture as well as design considerations, architecture characteristics, connectivity and interoperability.

Internet of Things has a profound effect on everyday life and critical vertical services including healthcare, factories of the future and intelligent transport systems. The highly distributed nature of such networks and the heterogeneity of the devices, which constitute them, necessitates that their users should be able to trust them at all times. A method to determine the device's service trustworthiness is Trust Management (TM), which assigns scores to devices according to their trustworthiness level, based on evaluations from other entities that interacted with it. Often Internet of Things devices that just joined the network, have not interacted with any other entity of this network before, hence there is no way to determine its trustworthiness. Such an event is referred to as the cold start trust score or initial trust score problem. The majority of the trust management approaches address this problem by setting an arbitrary initial trust score, while others will ignore it. Assigning arbitrary trust scores for devices connected to the network for the first time has the potential to disrupt the operation of the entire system, when a high trust score is assigned to a non-trusted malicious device, or lead to unfair policies, when trusted devices are assumed as potential intruders, which also deteriorates the performance of the system. This paper proposes a mechanism, which combines the blockchain based BARRETT remote attestation protocol with a set of device's properties and communication and operational context parameters, in order to determine accurately and assign the initial trust score to each device. Through a set of extensive simulations over different experimental setups, the proposed scheme is achieving to safely distribute initial trust scores to one thousand devices over less than 6ms, while minimising the risk of computational denial of service attacks due to the inherent characteristics of the BARRETT remote attestation protocol.