## 3 Literature Review
### IoT
#### 3.3.5 Addressing Implicit Trust with Zero Trust  
The authors of [64] studied the integration of zero trust concepts with IoT systems. They arrived at seven tenets based on access policies to secure communications and to reduce implicit trust. They proposed the zero trust authorisation requirements framework (ZT-ARF) and the zero trust score based authorisation framework (ZT-SAF). Their paper considers ZT-SAF as it is directly related to the implementation of zero trust authorisation principles as opposed to the authorisation policy models proposed in ZT-ARF. ZT-SAF is based on attribute-based access control and considers zero trust principles in reducing implicit trust, such that the confidence levels and the level of certainty of an access request can be determined based on calculations of contexts and the anomalies that may be present in the environment. The score engine of ZT-SAF considers the created sessions, states of context (environments, systems, and threats and logs), the actors who initiate the access request, the action to be performed by the actor and the resources to which access is requested. The framework algorithm considers the score and the threshold and via the access decision enforcement engine produces the result that either grants or denies an access request. Through their results they conclude that ZT-SAF provides a structured approach to develop authorisation models for zero trust systems. Applying the zero trust principle of \"never trust, always verify\" to IoT is the focus of [65]. The authors focus their study on perimeter-based security for IoT and the impact of implicit trust in such an environment. The authors researched the applicability of physical, unclonable function-based device continuous authentication (PUFDCA) and the verification of device identity. The authors presented a threat analysis for the physical, unclonable function and concluded by saying that by using zero trust principles, like strong device identity, continuous authentication and least privilege, it is possible to reduce implicit trust along with providing secure communication without implicit trust. The presence of implicit trust in IoT network that arises from perimeter-based security has been studied by the authors of [66]. In their paper, they propose continuous authentication between devices using blockchain. They implement initial authentication with cryptology based on ECC and include continual authentication with an operation that is lightweight, such as XOR Hash. The authors discuss that blockchain is decentralised by nature and hence eliminates \"trust\". By eliminating trust in the environment, the authors propose that their research is consistent with ZTA. The authors conclude that the existing schemes require an authority that is trusted, which is inconsistent with ZTA. The authors of [36] studied implicit trust and perimeter-based security with zero trust as a potential alternative to secure devices, including cloud and IoT devices. The authors discussed zero trust in the context of software defined perimeters (SDP) and the logical components of zero trust architecture (PE, PA PEP) as described by NIST [5], Google's BeyondCorp and the zero trust container architecture (ZTCA). The authors then introduced partial zero-trust solutions for IoT (and cloud) devices. They surveyed the body of literature that researched using blockchain based decentralised approach for authentication and as segmentation gateway. They also surveyed a body of literature that researched using SDP with IoT. The authors concluded that their survey confirms that zero trust aims to address implicit trust and aims at transforming implicit trust into explicit trust. They further concluded that their research introduced \"trustbase\", a novel concept serving as a foundation for both implicit and explicit trust. The deployment and use of Security Attribute Based Dynamic Access Control (SADAC), a dynamic access control based on the security attributes for IoT, was researched by [67].