Safety aware zero trust improves security for connected physical systems
Safety-Aware Zero Trust Enforcement for IoT and Cyber-Physical Systems
Cryptography and Security
Summary
Connected devices and physical systems like power grids need strong security because they are often remote and long-lasting. Traditional security trusts devices inside a network, which can be risky. The authors present a new approach called Safety-Aware Zero Trust that carefully controls device actions by considering both cyber risks and possible physical impacts caused by restricting devices. This method helps keep the system safe without accidentally disrupting important operations. They show how this works using a real-world style test on an electric grid model under attack.
What this means in practice
- •For iot system operators: Control and restrict suspicious IoT devices without causing unsafe physical disruptions in complex interconnected environments.
- •For power grid security teams: Manage cyber attacks on grid components by balancing containment actions and maintaining essential data visibility and control safety.
Authors
Alessandro Lotto, Alessandro Brighente, Mauro Conti
Abstract
Zero Trust (ZT) replaces the implicit trust of perimeter-based security with explicit, continuous, context-aware authorization. This shift is particularly relevant to IoT and cyber-physical systems, whose heterogeneous, long-lived, and remotely connected components make persistent trust untenable. Yet their physical coupling complicates ZT adoption: restricting a suspicious component can reduce cyber exposure while removing telemetry or control capabilities required for operation. Existing work mainly models physical harm caused by attacks, with less attention to consequences introduced by enforcement itself. We introduce Safety-Aware Zero Trust (SA-ZT), which treats restriction-induced physical consequences as policy inputs. We map the NIST ZT tenets to nine IoT/CPS convergence strains, distinguish IoT-amplified challenges from those specific to cyber-physical coupling, and derive corresponding operational requirements. SA-ZT extends the NIST ZT Architecture with a Safety Engine and a Telemetry Broker. The Safety Engine selects among admissible responses by jointly considering residual cyber risk and restriction-induced consequences, while the Telemetry Broker mediates raw telemetry visibility and estimator influence. With command-side enforcement, these entities separate raw visibility, automated influence, and state-changing authority, preserving observations for monitoring while constraining their influence on automated control. An IEEE 30-bus case study under false-data-injection attack illustrates how SA-ZT makes cyber containment, telemetry visibility and influence, physical consequences, and authorization timing explicit, providing an implementable and inspectable representation of cyber-physical enforcement trade-offs.