## 3 Literature Review
### IoT
#### 3.3.3 Addressing Issues with Authorisation Using Zero Trust  
In the interconnected world of IoT devices, the authors of [55] studied the security concerns around authorisation mechanisms related to IoT devices and proposed OUTSIDE (which is the name of the solution and is not an acronym), which is a zero trust IoT network designed to provide fine grained authorisation for IoT applications. The authors worked on a threat model and identified connection-based attacks and application impersonation attacks that can disrupt the IoT network. Their solution, OUTSIDE, verifies each packet generated by the IoT application. The authors used zero trust architecture with a Policy Manager (PM) and a Policy Administrator (PA). The PEP is a combination of server side application aware authorisation and capability verification. The architecture uses application aware authorisation policies to generate a token that is integrated into the application packet. The PM configures both client side and server-side policies with the designed attributes. The capability verification module verifies the packets to ensure that only authorised packets access the target service. The authors tested OUTSIDE and discussed how it prevents connection-based attacks and application impersonation attacks. They implemented and evaluated the results, and they concluded that OUTSIDE protects IoT devices from unauthorised interactions and unauthorised access requests. The authors of [56] studied the impact of weak authorisation controls for IoT devices, which they attribute mainly to the heterogeneous nature of these devices, limited memory and limited computation, which creates a challenge for any access control solution. In the paper, the authors survey the literature on access control solutions for IoT and the progress made in this area. They look at policy-based architecture which is mapped to the zero trust architecture as defined by NIST [5]. The architecture consists of PAP, PEP, PDP, PIP and another component, a Policy Refinement Point (PRP). The authors also look at the OAuth architecture and a hybrid User Management Access (UMA) architecture. They infer that zero trust architecture could be used to secure IoT devices and data movement among users, applications, services and devices. They note that research is thin on how micro-segmentation helps realise zero trust in IoT. Based on their survey, the authors discuss the emerging research area related to IoT and zero trust architecture. Their study suggests applying micro-segmentation, monitoring of resources, verification or access requests and fine-tuning of access control policies can strengthen access control in IoT devices. They conclude that the integration of the OAuth architecture and the UMA architecture along with zero trust can be studied further. [PERSON] et. al. [57] researched integration and automation achieved with IoT that may provide an attack path for cyberattacks that impact services and people's lives. In their paper, they discuss the challenges of perimeter-based security for IoT devices. They say that perimeter-based security is not possible because of the nature of the distribution of IoT devices. They propose zero trust architecture (ZTA) as defined by NIST [5], using PE, PA and PEP. Along with ZTA, they propose using attribute-based access control (ABAC) to address security challenges in authentication and authorisation. They propose a framework which is named Zero trust and ABAC for IoT using Blockchain (ZAIB). Devices are registered on blockchain which provides anonymity with smart contracts along with device to device (D2D) communication. An InterPlanetary File System (IPFS) stores the properties of all IoT devices connected to the network, smart contracts and associated access policies. The authenticity of the policies is checked with the hashes of IPFS blocks. Access policies are enforced using a Policy Decision Point Oracle (PDPO). The trust engine calculates the trustworthiness of access requests.