## 3 Literature Review
### IoT
#### 3.3.2 Addressing Access Control Issues by Adopting Zero Trust  
The study of context aware attribute-based access control with minimised computational and memory footprint for commercial Internet of Things is a focus of [47]. The authors study the zero-trust architecture (PE, PA, PEP) and the trust algorithm, both from NIST, to calculate the level of certainty of the access request. They use attributes of the policy, calculate the level of certainty and compare it with the policy. To demonstrate different system behaviours, they run tests by varying the number of attributes of policy and by varying the evaluator types between attribute-based access control (ABAC) and the Trust-Level -Evaluation-Engine (TLEE). Variation in the evaluators, as they are additional, adds metrics related to the introduced penalty. In the end, the authors compare the various ABAC evaluators. They conclude that their test results obtained with Huawei's Smart Home test bed prove significant improvements in efficiency of their ABAC policy evaluator when compared with popular ABAC policy services. [PERSON] et.al. [48], review research in context aware access control for IoT. They provide a background for zero trust principles and zero trust architecture (PA, PE and PEP). They review research in context aware access control (CAAC) using Role Based Access Control (RBAC)-based context schemes, ABAC-based context schemes and situation awareness in CAAC. They then research studies related to decision making in CAAC using risk and trust. They use patterns in context, risk and trust and apply them to zero trust. The authors conclude that context awareness is a well-researched area. The previous research in CAAC has commonalities that the authors apply to zero trust models and deployments. Areas for future research are identified. They conclude that, based on their findings, they intend to develop a language for access control policy for zero trust systems that is based on context and that is risk aware. The authors of [49] study zero trust as a security paradigm and apply it to IoT. They study access control requirements that are compliant with zero trust principles and that apply to IoT. The access control requirements are security related metadata (subject properties, object properties and context properties), least privilege (granular access and ephemeral privileges) and dynamic decisions for access control and architectural aspects (policies, Policy Decision Point, and decentralised and distributed approaches). They review the start-of-the-art access control solutions for IoT, which are (a) capability-based access control,(b) usage control, (c) role based access control and (d) attribute-based access control. Their studies demonstrate the lack of an access control framework for IoT that meets the zero trust access control requirements. They discuss the architectural requirements of access control, namely, PDP, PEP, PAP and PIP. The authors conclude that the access control requirements relate to both the adopted model and the implementation mechanism of the access control requirements. Their review of the existing literature demonstrates a lack of solutions which consider and implement solutions for all the requirements identified. They conclude that access control in IoT has significant issues that are not addressed by zero trust and that a completely different way of looking at the access control framework, including a redesign, is also required to enable a well-rounded adoption of zero trust in IoT environments. Research on the challenges and potential enablers for zero trust architecture's automation and orchestration is studied by [PERSON] et. al. [50]. The focus of the research is using AI for automation and orchestration, with IoT considered as a use case. The authors use NIST to model and define the control plane, the data plane and the data source using PA, PE and PEP.