标题： 基于跨域零信任架构的动态认证与细粒化授权在大规模物联网网络联邦学习中的应用 显示英文标题

标题： Dynamic Authentication and Granularized Authorization with a Cross-Domain Zero Trust Architecture for Federated Learning in Large-Scale IoT Networks

摘要： 随着连接设备和复杂网络数量的增加，当前的领域特定安全技术对于多样化的大型物联网（IoT）系统应用变得不足。跨域认证和授权虽然带来了许多安全改进，但也创造了效率和安全方面的新的挑战。零信任架构（ZTA），一种新兴的网络安全架构，为物联网系统提供了更细粒度和更强大的安全环境。然而，ZTA中的广泛跨域数据交换可能导致认证和授权效率降低以及数据隐私问题。因此，在本文中，我们提出了一种基于集成去中心化联邦学习（DFL）的跨域物联网网络的动态认证和细粒度授权方案。具体来说，在跨域过程中持续监控和评估设备请求，并仅授予必要的访问权限。为了保护用户数据隐私并减少延迟，我们将DFL与ZTA结合，以安全高效的方式在不同领域之间共享设备数据。特别是，DFL模型被压缩以减少网络传输负载。同时，提出了一种动态自适应权重调整机制，使DFL模型能够适应不同领域的数据特征。我们从安全证明的角度分析了所提出方案的性能，包括机密性、完整性和可用性。仿真结果表明，与其它现有的代表性方案相比，所提出的方案在较低延迟和较高吞吐量方面表现出优越的性能。 显示英文摘要

摘要： With the increasing number of connected devices and complex networks involved, current domain-specific security techniques become inadequate for diverse large-scale Internet of Things (IoT) systems applications. While cross-domain authentication and authorization brings lots of security improvement, it creates new challenges of efficiency and security. Zero trust architecture (ZTA), an emerging network security architecture, offers a more granular and robust security environment for IoT systems. However, extensive cross-domain data exchange in ZTA can cause reduced authentication and authorization efficiency and data privacy concerns. Therefore, in this paper, we propose a dynamic authentication and granularized authorization scheme based on ZTA integrated with decentralized federated learning (DFL) for cross-domain IoT networks. Specifically, device requests in the cross-domain process are continuously monitored and evaluated, and only necessary access permissions are granted. To protect user data privacy and reduce latency, we integrate DFL with ZTA to securely and efficiently share device data across different domains. Particularly, the DFL model is compressed to reduce the network transmission load. Meanwhile, a dynamic adaptive weight adjustment mechanism is proposed to enable the DFL model to adapt to data characteristics from different domains. We analyze the performance of the proposed scheme in terms of security proof, including confidentiality, integrity and availability. Simulation results demonstrate the superior performance of the proposed scheme in terms of lower latency and higher throughput compared to other existing representative schemes.