## 2 Background
### Zero-Trust Network Architecture and Future IoT Applications  
As shown in Figure 1, a zero-trust system, such as the NB-IoT architecture, typically consists of endpoint devices (such as various sensor nodes), network equipment (such as IoT gateways and 6G base stations), core networks, and cloud application servers. Users can access endpoint devices directly via the network or indirectly access data sent to the cloud server through the endpoint devices. Accordingly, these endpoint devices are not always subject to the control of a firewall and VPN server, making the concept of zero-trust network an effective solution to address this security concern. In line with this, the US National Institute of Standards and Technology (NIST) introduced the SP800-207 zero-trust architecture guidelines in 2019 [17], urging enterprises to adopt zero-trust information security strategies to combat threats like ransomware attacks. Furthermore, the US federal government mandated that all government agencies must transition to a zero-trust architecture for their security strategies by the end of 2024 [18]. In reference to \"Figure 3: Zero Trust Access process\" from the _Network and Security Strategy_ published by the Government of Canada [19], devices initially need to submit access requests to an authentication service. Upon validation of the request, the devices can proceed with the requests, initiating the data-flow session through an encrypted micro-segmented tunnel that remains active only for the duration of the session. Additionally, based on the concept of zero-touch in the zero-trust network [10], security in the network devices such as gateways, base stations, and core networks will no longer be trusted. In this scenario, the security mechanism for network access must be provided by the IoT devices themselves. As depicted in Figure 1, a pair of communicating zero-trust devices consists of a camera and a Raspberry Pi, situated in separate private networks. In order to initiate a data-flow session, the communicating devices must send a request to the \"Zero-Trust Server\" through the control plane over the public network. Upon approval of the request,a secure \"Zero-Trust Access Virtual Tunnel\" is established. Subsequently, the 6G gNB facilitates the forwarding of video stream data via the data plane. This mechanism allows the creation of two or more \"Zero-Trust Access Virtual Tunnels\" for multiple paired zero-trust devices between two distinct private networks or within the same private network. Accordingly, the key blocks used for communication must be synchronously updated by the communicating paired devices. In this way, during the data transmission process, there is no need for additional protection through the network devices, effectively realizing the zero-touch concept required by the zero-trust network. As Figure 2 shows, concerning data processing in the IoT, in contrast to cloud computing where data is sent from scattered devices to centralized ones (such as cloud servers), the fog computing architecture handles data in a relatively decentralized manner, with data computation and storage located closer to the network edge. In this architecture of edge computing collaborating with cloud and fog, since the data transmission process can bypass or avoid the existing core network system, it can reduce core network resource usage, lower transmission latency, enhance transmission speed, and improve user experience. However, because the system management of the existing core network may be bypassed during data exchange and due to the interconnection of a large number of low-cost IoT devices, this IoT transmission architecture based on cloud and fog computing raises concerns about information security. For more information regarding the implementations of security mechanisms and data-flow processes, the following sub-sections in Section 3 \"Research Methodology\" will provide the details. Figure 1: Potential applications of zero-trust network devices with 6G NB-IoT endpoint devices.