Deze documentatie wordt actief uitgebreid — kom regelmatig terug.

BDI Association Register - Trust Lists Architecture

Based on BDI Association Trust Lists Specification

Overview

Trust Lists are a critical component of the BDI Association Register that maintain curated lists of trusted entities, certificates, and services within the network. They serve as the foundation for establishing trust relationships and enabling secure communication between network participants.

Trust List Types

1. Member Trust List

Purpose: Authoritative list of verified association members

Contents:

Member Client IDs
Legal entity information (name, LEI, CoC, EORI)
Membership tier and status
Valid from/until dates
Public keys for signature verification
Service endpoints

Update Frequency: Real-time (event-driven)

Format:

{
  "trust_list_id": "uuid",
  "type": "member_trust_list",
  "version": "1.0",
  "issued_at": "datetime",
  "valid_until": "datetime",
  "issuer": "association.ctn.network",
  "members": [
    {
      "client_id": "string",
      "legal_name": "string",
      "lei": "string",
      "coc_number": "string",
      "eori": "string",
      "participation_status": "string",
      "status": "active",
      "public_key_jwk": {/* JWK */},
      "endpoints": [
        {
          "type": "api",
          "url": "https://...",
          "protocols": ["https", "mtls"]
        }
      ],
      "valid_from": "datetime",
      "valid_until": "datetime"
    }
  ],
  "signature": "string"
}

2. Certificate Trust List

Purpose: List of trusted certificate authorities and their certificates

Contents:

CA certificates
Intermediate certificates
Certificate revocation information
Certificate policies
Validation rules

Update Frequency: Daily or on-demand

Format:

{
  "trust_list_id": "uuid",
  "type": "certificate_trust_list",
  "version": "1.0",
  "issued_at": "datetime",
  "certificates": [
    {
      "certificate_id": "string",
      "subject": "string (DN)",
      "issuer": "string (DN)",
      "serial_number": "string",
      "not_before": "datetime",
      "not_after": "datetime",
      "public_key": "string (PEM)",
      "signature_algorithm": "string",
      "purposes": ["signing", "encryption"],
      "status": "valid",
      "revocation_info": {
        "crl_url": "string",
        "ocsp_url": "string"
      }
    }
  ],
  "revoked_certificates": [
    {
      "serial_number": "string",
      "revocation_date": "datetime",
      "reason": "string"
    }
  ],
  "signature": "string"
}

3. Service Trust List

Purpose: List of trusted services and their endpoints within the BDI network

Contents (2026):

Registered provider endpoints (data products)
External services
Service capabilities
SLA commitments

Update Frequency: On service registration/update

Format:

{
  "trust_list_id": "uuid",
  "type": "service_trust_list",
  "version": "1.0",
  "issued_at": "datetime",
  "services": [
    {
      "service_id": "string",
      "service_name": "string",
      "service_type": "enum (data_provider|custodian|external)",
      "provider_client_id": "string",
      "endpoints": [
        {
          "url": "https://...",
          "protocol": "https",
          "mtls_required": true
        }
      ],
      "capabilities": ["endpoint_registration", "data_access"],
      "sla": {
        "availability": "99.9%",
        "response_time_p95": "500ms"
      },
      "status": "active",
      "valid_from": "datetime",
      "valid_until": "datetime"
    }
  ],
  "signature": "string"
}

Trust List Management

Publication

graph TB
    subgraph "Association Register"
        TLM[Trust List Manager]
        DB[(Database)]
        EventBus[Event Bus]
    end
    
    subgraph "Publication Channels"
        API[Public API]
        CDN[CDN Distribution]
        EventSub[Event Subscribers]
    end
    
    subgraph "Consumers"
        OR[Data Providers]
        Custodian[Custodian<br/>Systems]
        Member[Participant<br/>Applications]
    end
    
    DB-->|Read|TLM
    TLM-->|Publish|API
    TLM-->|Distribute|CDN
    TLM-->|Notify|EventBus
    EventBus-->EventSub
    
    API-->OR
    API-->Custodian
    CDN-->Member
    EventSub-->OR
    EventSub-->Custodian

Update Workflow

sequenceDiagram
    participant Event as Event Source
    participant TLM as Trust List Manager
    participant Validator as Validator
    participant Signer as Signing Service
    participant Store as Storage
    participant Publish as Publisher
    
    Event->>TLM: Member Status Change
    TLM->>TLM: Generate New Trust List
    TLM->>Validator: Validate List Structure
    Validator->>TLM: Validation OK
    TLM->>Signer: Sign Trust List
    Signer->>TLM: Signed Trust List
    TLM->>Store: Store New Version
    TLM->>Publish: Publish Update
    Publish->>Publish: Notify Subscribers
    Publish->>Publish: Update CDN
    Publish->>Publish: Update API

Versioning

Semantic Versioning: Major.Minor.Patch
Version History: Last 30 versions retained
Backwards Compatibility: Breaking changes = major version bump
Deprecation Policy: 90-day notice for major changes

Trust Validation

Trust Chain Verification

graph TB
    Start[Start Validation]
    Start-->CheckMembership{Is Member in<br/>Trust List?}
    
    CheckMembership-->|No|Reject[Reject: Not Trusted]
    CheckMembership-->|Yes|CheckStatus{Status =<br/>Active?}
    
    CheckStatus-->|No|Reject
    CheckStatus-->|Yes|CheckExpiry{Within Valid<br/>Period?}
    
    CheckExpiry-->|No|Reject
    CheckExpiry-->|Yes|CheckSignature{Trust List<br/>Signature Valid?}
    
    CheckSignature-->|No|Reject
    CheckSignature-->|Yes|CheckCertificate{Certificate in<br/>Certificate TL?}
    
    CheckCertificate-->|No|Reject
    CheckCertificate-->|Yes|CheckRevocation{Certificate<br/>Revoked?}
    
    CheckRevocation-->|Yes|Reject
    CheckRevocation-->|No|Accept[Accept: Trusted]

Validation Process

Retrieve Latest Trust List
- Check version compatibility
- Verify signature
- Validate expiry
Check Member Entry
- Lookup by client_id
- Verify membership status
- Check validity period
Verify Certificates
- Check certificate chain
- Validate against Certificate Trust List
- Verify not revoked
Assess Trust Level
- Determine trust score based on:
  - Membership tier
  - Verification level
  - Historical reliability
  - Service quality metrics

Distribution Mechanisms

Pull Model

API Endpoint:

GET /v1/trust-lists/{type}/{version}
Authorization: Bearer <vad_token>

Response: 200 OK
{
  // Trust list as defined above
}

CDN Distribution:

Global CDN for fast access
Automatic regional replication
Cache invalidation on updates
Public read access (no auth required)

Push Model

Event Notification:

{
  "event_type": "trust_list.updated",
  "trust_list_type": "member_trust_list",
  "new_version": "1.5.0",
  "download_url": "https://cdn.../trust-lists/member/1.5.0",
  "changes": {
    "added": ["client_id_1", "client_id_2"],
    "removed": ["client_id_3"],
    "modified": ["client_id_4"]
  },
  "timestamp": "datetime"
}

Webhook Delivery:

Subscribers register webhook URLs
POST notifications on updates
Retry logic for failed deliveries
Signature verification for authenticity

Security Considerations

Trust List Integrity

Digital Signatures:

RSA-SHA256 or ECDSA signatures
Private key stored in Azure Key Vault
Public key published in well-known location
Signature validation mandatory

Tamper Detection:

Hash verification
Version sequence validation
Timestamp verification
Audit trail of all changes

Access Control

Read Access:

Member Trust List: Public (no auth)
Certificate Trust List: Public (no auth)
Service Trust List: Members only (VAD required)

Write Access:

Association administrators only
Multi-factor authentication required
Approval workflow for sensitive changes
Audit logging

Secure Distribution

HTTPS Only:

TLS 1.3 required
Certificate pinning recommended
HSTS headers
CORS policies

CDN Security:

Signed URLs for sensitive data
Rate limiting
DDoS protection
Geographic restrictions (optional)

Performance and Caching

Caching Strategy

Client-Side Caching:

Cache-Control headers
ETags for conditional requests
Recommended TTL: 1 hour
Revalidation on critical operations

CDN Caching:

Edge caching with 5-minute TTL
Instant purge on updates
Regional distribution
Failover to origin

Performance Targets

Trust list download: < 1 second
Signature verification: < 100ms
Member lookup in list: < 10ms
Update propagation: < 5 minutes globally

Monitoring and Audit

Metrics

Trust list versions published
Download frequency
Validation success rate
Signature verification times
Update propagation latency

Audit Events

Trust list generated
Member added/removed/modified
Certificate added/revoked
Service registered/updated
Trust list downloaded
Validation performed

Compliance

GDPR: Personal data handling
NIS2: Critical infrastructure protection
eIDAS: Trust services
ISO 27001: Information security

Integration Examples

Consumer Usage

// Fetch latest participant trust list
const trustList = await fetch(
  'https://association.ctn.network/v1/trust-lists/participant/latest',
  {
    headers: {
      'Authorization': `Bearer ${vadToken}`
    }
  }
).then(r => r.json());

// Verify signature
const isValid = await verifyTrustListSignature(trustList);

// Check if member is trusted
function isTrustedMember(clientId) {
  const member = trustList.members.find(m => m.client_id === clientId);

  if (!member) return false;
  if (member.status !== 'active') return false;

  const now = new Date();
  if (now < new Date(member.valid_from)) return false;
  if (now > new Date(member.valid_until)) return false;

  return true;
}

Custodian System Usage

// Subscribe to trust list updates
eventBus.subscribe('trust_list.updated', async (event) => {
  if (event.trust_list_type === 'member_trust_list') {
    // Download new version
    const newTrustList = await downloadTrustList(event.download_url);

    // Verify and update local cache
    if (await verifyTrustListSignature(newTrustList)) {
      await updateLocalTrustListCache(newTrustList);
      console.log(`Trust list updated to version ${event.new_version}`);
    }
  }
});