## 7 Security Considerations and Proposed Zero-Trust Security Model
### Proposed Zero-Trust Security Model  
The proposed architecture is based on the previously discussed zero-trust architecture consisting of policy and security enforcement points. In Figure 14, two main components for authenticating and authorizing within the identity and access management platform sit between the operator's system and the manufacturing device. This eliminates any implicit trust between the operator and the machine. Two other important tools included are Enterprise Device Discovery System and Endpoint Compliance Management System. They both function independently to feed in the information collected from the user and device for efficient authentication and dynamic access control mechanism. The Enterprise Device Discovery System checks and validates the identity of each newly connected device into the network against the approved list of devices present in the database before assigning user certificates that are required for authentication with the IAM. On the other hand, Endpoint Compliance Management System monitors the device status regularly against the pre-defined compliance policies with the help of an agent installed on the system. These compliance policies can vary based on the business needs such as minimum OS version, patch version, antivirus status, password complexity, etc. Any device that is reported out of compliance will immediately get flagged in the policy decision point and access to resources will either be blocked or limited based on the severity of the violated compliance. The authentication process consists of signature validation by an asymmetric cryptographic algorithm such as DSA (Digital Signature Algorithm) or RSA (Rivest, Shamir, and Adleman) where the public key is used to validate the authenticity of the data confirming that the sender is in possession of the appropriate private key. The DSA is preferred over RSA because of the speed of signature generation and validation [26]. The other component is integrity validation, which is done by a one-way hashing algorithm, SHA-3 (Secure Hash Algorithm-256) on the transmitted data creating a message digest of 256 bits and then encrypting it either with a symmetric algorithm such as AES in combination with a pre-shred key or by a public-key cryptographic algorithm. To make these processes of signature and integrity validation faster, they could be combined in one step where the hash of the information generated by SHA-3 is signed using DSA with the private key of the transmitter. The next step is to validate the authority of the operator by comparing its identity with the pre-defined set of policies. The validation process consists of verifying the operator's location and the network they are connected to, verifying the operator's system and its security configurations such as antivirus and firewall status, and verifying the device and user certificates. The list of policies to be validated during each transaction may also contain dynamic policies which are based on the number of previous failed login attempts, system patch and OS update status, presence of any backlisted or absence of any whitelisted applications, etc. This two-step verification ensures instruction data integrity and the operator's identity and authority. Further, if there is a need for the operator to connect to the other manufacturing equipment, the same process is repeated instead of granting access based on the previous validation outcome. Figure 14: High-level architecture of Zero-Trust Security for Smart Manufacturing. Another consideration for a complete zero-trust architecture is removing any implicit trust between two communicating manufacturing devices. Considering a generic manufacturing environment, every phase of the production line will generate a certain identification for the batch of products manufactured in one cycle. This identity can be a product serial number or a batch number if there is a bulk of them produced in each cycle.