11. Annex B — Core trust and ecosystem concepts¶
(informative)
This annex collects core concepts used in this specification to describe trust establishment, ecosystem governance and cross-ecosystem trust.
Technical artefacts, standards and mechanisms are defined in Annex A — Technical standards definitions.
11.1 B.1 Trust¶
A decision by an entity to assume that a product, service or entity will behave as expected for a given circumstance.
This definition underpins the architectural distinction between the trust framework (B.2), which specifies the means to validate and verify the assumptions underlying trust, and the trust protocol (B.3), which provides the generic means to establish mutual trust between ecosystems.
Source: ISO/IEC FDIS 20151-1; CEN-CENELEC EN 18235-1
11.2 B.2 Trust Framework¶
A set of technical and organisational standards, (potentially open-source) software and governance rules that allow the establishment of trust or trustworthiness in a digital ecosystem.
1 A trust framework, as used in this document, comprises two complementary elements - a specification of technical compatibility, defining the interoperable trust architecture and associated compatibility requirements, and - a specification of compliance, defining the criteria against which participants, services, or resources are evaluated.
2 A trust framework is typically defined by an ecosystem or data space governance authority for a specific ecosystem and its participants; it is a specific instantiation of the trust protocol (B.3).
11.3 B.3 Trust Protocol¶
Generic, ecosystem-agnostic specification providing the means for autonomous ecosystems to establish mutual trust in a standardised, interoperable way.
1 The trust protocol addresses the cross-ecosystem trust dilemma: since ecosystems are autonomous in defining their own trust frameworks, the protocol provides a generic reference model that renders trust-related communication interoperable between ecosystems, without forcing any ecosystem to accept another’s rules unconditionally.
11.4 B.4 Ecosystem¶
Federation of participants operating under a common governance authority and a common set of compliance rules.
1 Ecosystems may federate by agreeing on common trust service providers, ontologies and shared services, enabling participants to operate across multiple ecosystems.
11.5 B.5 Trust Service Provider (TSP)¶
Entity approved by an ecosystem governance authority to validate, verify, or issue digital credentials for a specific scope on behalf of that ecosystem.
Trust service providers are expected to provide their services in accordance with applicable technical compatibility requirements, supporting interoperable verification and use of the attestations they issue.
Referenced by: EXT-1.2
11.6 B.6 Gaia-X Digital Clearing House (GXDCH)¶
Trust service provider operationalising Gaia-X ecosystem compliance rules, comprising registry, compliance evaluation, notary and potentially further functions.
1 GXDCH instances are non-exclusive and interchangeable; they are operated by multiple market operators across different geographical locations and industries, and are connected in a network to ensure both free access and consistency of the compliance data they manage.
2 All software components comprising a GXDCH are open source, and the set of mandatory components can vary from one release to another.
11.7 B.7 Notary¶
Trust service function that verifies the authenticity of externally sourced identifiers, such as legal registration numbers, and issues corresponding verifiable credentials.
A verifiable credential issued by a notary attests only the authenticity and existence of the verified attribute (for example, a legal registration number); it does not, by itself, establish a direct association between the credential holder and the entity to which the attribute pertains.
11.8 B.8 Compliance Engine¶
Software component that evaluates whether a verifiable presentation satisfies the rules of a trust framework’s compliance document and issues a compliance credential accordingly.
1 The Gaia-X Compliance Engine is the main entry point of a Gaia-X Digital Clearing House. Depending on the criteria validated, it may issue a compliance credential at one of several conformity levels, ranging from Standard Compliance up to Gaia-X Label Level 3.
2 A compliance credential is distinct from the Proof of Compatibility defined by this document, which attests technical compatibility only. See Proof of compatibility.
11.9 B.9 Ecosystem Trust Profile¶
Set of trust propositions published by an ecosystem to support cross-ecosystem discovery and trust decisions. Each trust proposition is expressed as a triple comprising a trust scope, credential type and trust service provider.
1 The “trust scope” element of a trust proposition is a slight generalisation of the term “scope of attestation” as defined in ISO/IEC 17000:2020.
Referenced by: EXT-1.1 to EXT-1.3, EXT-2.2 and EXT-5.1.