Authentication and Authorization in Zero Trust IoT: A Survey

Abstract

A critical challenge in implementing Zero trust (ZT) in Internet of Things (IoT) environments is ensuring secure authentication and authorization mechanisms. The work in this article delves into the intricate realm of ZT by critically examining the state-of-the-art authentication and authorization processes within the ZT framework for IoT. Despite the wealth of work on ZT and Zero Trust Architecture (ZTA), notable research gaps persist, specifically in identity authentication and fine-grained access control. Given the vast and diverse ecosystem of IoT devices, device identification complexities arise from a lack of unique hardware identifiers, rendering traditional methods susceptible to cyber-attacks, such as, spoofing. For dynamic IoT environments, achieving the optimal implementation in access policies poses a significant challenge. Numerous ZTA methodologies, integrating access controls, blockchain frameworks, and advancements in Artificial Intelligence (AI) and Machine Learning (ML), have been implemented to tackle these challenges. However, research gaps remain, particularly in understanding the behavioral aspects within these frameworks. As a result, this article focuses on identifying how device behavioral aspects can improve authentication and authorization in ZT for IoT. Finally, the article concludes by highlighting how these challenges can serve as future research directions.