A Zero-Trust Framework for Industrial Internet of Things

Interactions between different types of systems from various environments are increasing continuously due to the nature of business and commercial requirements. All of these interactions require a level of trust given for each system in order to enable essential operations and functions. Traditional trust models and frameworks implemented in different environments define static levels of trust given to users and systems. This includes the Defence-in-depth security model that is typically implemented in industrial control systems (ICS) environments. While this model and other security models provide an outstanding level of restriction and security if implemented correctly, they can still allow unauthorised access to sensitive data through compromised trust devices. Industrial Internet of Things (IIoT) solutions are actively being deployed in different sectors. Despite the criticality of the environments IIoT solutions serve, these solutions require more integrated connectivity that ICS environment due to cloud connectivity. This research paper proposes a zero-trust framework for IIoT and explores how this framework could mitigate the existing risks within IIoT solutions. Moreover, this research paper proposes a zero-trust anatomy for IIoT and explores the potential performance and/or complexity overhead resulted from the use of this model.

I. Introduction

Digitisation of assets has been the central focus of various industries in the past decade as data became the core of our everyday life. Specifically, a huge interest in digitising industrial assets was clear by the Industry 4.0 initiative [1], Due to this, the Industrial IoT (IIoT) model started to be utilized widely across organizations to enhance monitoring and connectivity between organization assets [2], IIoT involves the replacement of currently deployed Industrial Control Systems (ICS) environments with smarter and more interactive devices to communicate with next-generation IT systems. ICS environments are deployed in critical infrastructures serving multiple sectors. In Australia and other Commonwealth governments, critical infrastructures are defined as [3]: