Trust Boundary Semantic Gaps: A Multi-dimensional Analysis and Mitigation for Security-by-Design

Jul 16, 2026

Modern systems validate artifacts at trust boundaries using format, protocol, and signature mechanisms to ensure well-formedness, compliance, and authentication. These steps, however, do not prove the semantic security properties expected by the receiving domain, so a correctly validated artifact can still enable compromise. This work defines Trust Boundary Semantic Gaps (TBSG) as residual semantic meaning not established by successful syntactic validation. From 75 incidents (2014–2025), it proposes a four-dimensional MDTBSG model and a design-time TBSAM framework that prioritizes and maps gaps to architectural controls. Applied to SolarWinds/SUNBURST, the approach clarifies assumptions and interrupts compromised paths.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages16

Reading Time40 min

Abstract

1. Introduction

Trust boundary validation vs semantic security

Definition of Trust Boundary Semantic Gap (TBSG)

Analysis model: MDTBSG

Framework: Trust Boundary Semantic Analysis and Mitigation (TBSAM)

Trust Boundary Semantic Gaps: A Multi-dimensional Analysis and Mitigation for Security-by-Design Doyeon Kim, Jin-Young Choi, and Junghee Lee* Korea University Seoul, Republic of Korea * Corresponding author arXiv :2607 .0 17 1 1v 1 [ cs .CR] 2 Jul 2026 Abstract—Modern systems use format-, protocol-, and signature-based mechanisms before accepting artifacts across trust boundaries. These mechanisms are necessary: they show that an artifact is well formed, protocol-compliant, or properly authenticated. They do not, however, show that the artifact satisfies the semantic security properties required by the receiving domain. A signed update or an authenticated token may therefore be accepted yet enable compromise. We call this condition a Trust Boundary Semantic Gap (TBSG): an artifact crosses a trust boundary and passes correctly implemented syntactic validation, but the assertions established by that pass are insufficient to satisfy the receiving domain’s security requirements. TBSG concerns what remains unestablished after a syntactic pass, not absent checks or implementation bugs. Analyzing 75 publicly reported security incidents (2014– 2025) at the boundary level, we organize semantic misalignment into a four-dimensional analysis model: Identity, Spatial, Temporal, and Interpretation (MDTBSG). Building on it, we develop Trust Boundary Semantic Analysis and Mitigation (TBSAM), a design-time framework that identifies TBSGs from design specifications, prioritizes them, traces propagated gaps to their originating boundary, and maps each to candidate architectural controls. We apply TBSAM to a retrospective reconstruction of the SolarWinds/SUNBURST supply-chain attack, showing how it makes receiving-domain assumptions explicit, separates locally originating from propagated gaps, and identifies controls that interrupt the path. These results suggest that syntactic validation, while necessary, is not sufficient at trust boundaries, and that making trust-boundary assumptions explicit can complement Security-by-Design. 1. Introduction Modern systems rarely accept artifacts without validation. When a message, token, software package, API request, or update crosses a trust boundary, the receiving domain commonly applies syntactic validation: signatures and hashes for software updates, schema and protocol checks for API requests, and tokens or credentials for sessions. These checks are necessary. They reject malformed artifacts, enforce protocol rules, and establish limited assertions such as integrity under an accepted key, format conformance, or credential validity. They do not, however, establish every security property that the receiving domain may rely on when it processes the artifact. Major incidents show this gap. In SolarWinds/SUNBURST, a valid SolarWinds signature did not establish that the build process produced the binary from the intended source. In Log4Shell, syntactically valid input did not establish that logged data would remain inert. In the Capital One breach, protocol-compliant requests did not establish that the request should reach the cloud metadata service or that the resulting authority should be usable. These incidents differ in mechanism, but share the same boundary-level structure: an artifact passed syntactic validation at a trust boundary, and the receiving domain processed it under a security assumption that the validation step had not established. We define this condition as a Trust Boundary Semantic Gap (TBSG): an artifact crosses a trust boundary and passes correctly implemented syntactic validation, but the assertions established by that pass do not satisfy the security properties the receiving domain requires. A TBSG is not an absent validation step, a parser bug, or a failed signature check. It captures a semantic gap between the assertions established by syntactic validation and the security meaning that the receiving domain later relies on. Existing approaches explain import

FAQs

What is a Trust Boundary Semantic Gap (TBSG)?

A TBSG occurs when an artifact crosses a trust boundary and passes correctly implemented syntactic validation, but the assertions established by that validation do not satisfy the security properties required by the receiving domain.

How does the paper analyze real security incidents?

It analyzes 75 publicly reported security incidents from 2014 to 2025 at the trust-boundary crossing level, recording the artifact, the syntactic validation applied, the assertion established, and the property left unestablished.

What is TBSAM and how does it help mitigation?

TBSAM is a design-time framework with a four-stage procedure that builds boundary records from design specifications, identifies and prioritizes TBSGs, maps them to candidate architectural controls, and traces propagated gaps back to their originating boundary.

Jul 16, 2026

Upload by Olivia Brown