Cloud-Edge Collaborative Zero Trust Access Control: Architecture and Scheme Design

Cloud-edge collaborative manufacturing systems have drawn considerable attention by offloading data processing tasks to edge servers to support latency-sensitive tasks and high manufacturing efficiency. In these systems, data can be accessed by external devices and the access connections are exposed on the Internet, leading to a risk of data leakage or interception. In this paper, to address such data security issues, we introduce the zero trust architecture (ZTA) where every user, whether internal or external, is required to be authorized and verified before accessing any resource, thereby ensuring data security. However, existing ZTA implementations primarily leverage security technologies that rely on either biometrics and human behavior or sparse device attributes, rendering them inapplicable in cloud-edge collaborative manufacturing systems. To deal with this challenge, we propose a cloud-edge collaborative ZTA (CE-ZTA), in which ciphertext-policy attribute-based encryption (CP-ABE) is employed to implement ZTA principles. We propose a continuously-verifying CP-ABE scheme, in which an attribute merging algorithm is designed to avoid the exponential growth in computational latency and overhead caused by continuous verification of CE-ZTA. Theoretical analysis and simulation results show that the proposed scheme complies with ZTA principles and is superior to existing CP-ABE schemes in terms of latency, overhead, and robustness.