Safety-Aware Zero Trust Enforcement for IoT and Cyber-Physical Systems
Abstract Overview
This paper studies how Zero Trust enforcement should be adapted for IoT and cyber-physical systems, where restricting a suspicious component can reduce cyber risk but also remove sensing or control capabilities needed for safe operation. The authors define nine Zero Trust convergence strains, distinguishing IoT-amplified challenges from CPS-specific ones, and derive corresponding operational requirements. They propose Safety-Aware Zero Trust (SA-ZT), which extends the NIST Zero Trust Architecture with a Safety Engine and a Telemetry Broker to separate raw telemetry visibility, automated influence, and state-changing authority. An IEEE 30-bus power-grid case study under false-data-injection attacks is used to make containment, observability, estimator influence, physical consequences, and authorization timing explicit in the decision process.
Novelty
The paper's main novelty is a Zero Trust framework that treats restriction-induced physical consequences as explicit policy inputs, rather than focusing solely on physical harm caused by attacks. It also introduces capability-level enforcement that decouples raw telemetry visibility, estimator influence, and command authority within an extended NIST Zero Trust architecture.
Results
In the IEEE 30-bus evaluation, graduated telemetry enforcement reduced the mean compromised-endpoint fraction by 84.2% and impactful false-data-injection bypass by 91.3% relative to no enforcement, while retaining slightly higher raw visibility than binary isolation. The experiments also demonstrate that restricting command authority can itself create modeled physical consequences, whereas the static response term did not alter command selection in the tested scenarios and the dynamic term changed selection only sparsely with mixed realized effects.
Key Points
- SA-ZT extends the NIST Zero Trust Architecture with a Safety Engine and Telemetry Broker to evaluate admissible responses using residual cyber risk and restriction-induced physical consequences as distinct quantities.
- The framework decouples peer communication, raw telemetry visibility, automated estimator influence, and command authority, allowing observations to remain available for monitoring even when automated use or actuation is restricted.
- The case study demonstrates measurable containment-information trade-offs and shows that authorization timing and restrictive command modes affect physical behavior, without claiming universal safety or consistent control-performance improvements.