Access Control Enforcement in IoT: state of the art and open challenges in the Zero Trust era

Zero Trust (ZT) is a security paradigm which is nowadays finding application in different domains. One of the domain that can most benefit from ZT is represented by Internet of Things (IoT), where huge quantity of personal and sensitive data are continuously generated by IoT devices, which, in the recent years, have been the target of several security attacks. In this paper, we identify a set of access control requirements which are expected to enable the adoption of ZT in the IoT domain. Through the analysis of state of the art access control approaches currently employed in IoT ecosystems, we observe the lack of solutions capable of addressing all the identified requirements. We therefore discuss significant open challenges that still need to be addressed in this area.