Zero Trust Continuous Authentication Models and Automated Policy Formulation

Continuous authentication mitigates threats such as session hijacking, insider attacks, and privilege abuse by continuously validating user behaviour throughout an active session. Applying Zero Trust principles, this thesis develops Zero Trust Continuous Authentication (ZTCA) as a family of four formally specified access control models for user-facing software applications. Each model provides increasingly expressive ways to characterize expected access patterns using directed graphs. Deploying a ZTCA model requires the authoring of policies that balance security and usability. To ease the challenge of developing such policies, we study the problem of automatically generating ZTCA policies from declarative usability and security requirements. We introduce a novel equivalence-based SAT encoding that represents policy structure as an equivalence relation over resources, enabling automated policy synthesis using modern SAT solvers. Empirical evaluation shows that this encoding approach is significantly faster and substantially more efficient than a competing encoding approach previously published in the literature. Building on these foundations, the thesis introduces an adaptive extension of ZTCA that enhances enforcement without altering the underlying policy graph. The adaptive model adjusts authentication penalties based on recent behavioural signals—such as risky access patterns and authentication outcomes—providing stronger responses during high-risk periods while preserving usability during benign activity. A simulation framework is developed to compare adaptive and non-adaptive enforcement under identical conditions. Experimental results show that the adaptive mechanism limits risky behaviour earlier, concentrates authentication where it is most needed, and maintains a similar authentication burden for legitimate users. Together, these contributions provide a formal foundation, automated synthesis method, and adaptive enforcement layer for continuous, Zero Trust–aligned authentication in user-facing applications.