Zero-Trust Bilateral Edge Service Trading with Deposit-Refund Regulation for Runtime Compliance

Abstract: Privacy-sensitive edge services necessitate optimizing diverse-type resource scheduling to support trustworthy provisioning within a zero-trust security framework. However, existing studies rarely model how runtime compliance jointly affects bilateral clearing, ex-post settlement, and future seller eligibility in dynamic edge markets. To address this issue, we propose ZEBRIS, a zero-trust bilateral edge service trading framework with deposit-refund regulation for privacy-sensitive services. Specifically, edge provisioning is modeled as a trading form of zero-trust-compliant service packages, where the buyer-side effective valuation captures service value, delay penalty, and privacy risk, while the seller-side effective ask incorporates resource and compliance costs. This yields a resource-aware positive-margin bilateral clearing mechanism under shared resource and security constraints. To discipline post-clearing moral hazard, we further design a capped deposit-refund settlement rule based on measurable runtime compliance and update each seller's future security posture according to realized compliance outcomes. ZEBRIS satisfies bilateral individual rationality and no-subsidy weak budget balance. Experiments demonstrate that ZEBRIS improves social welfare and compliance robustness while reducing service delay and privacy-risk-weighted cost over representative baselines.

• The paper introduces ZEBRIS, a bilateral market that clears privacy-sensitive edge service packages by jointly pricing delay, privacy risk, verification effort, and seller compliance costs.
• The mechanism uses outcome-based deposits with a 70% buyer compensation share and a cap below half the trading margin to preserve seller participation while penalizing runtime violations.
• Simulations across 180 rounds and 50 runs show ZEBRIS improves welfare, compliance, delay, and privacy-weighted cost over five baselines, although strategic truthfulness and large-scale deployment remain open issues.

Motivation and problem setting

The paper addresses a gap at the intersection of three largely separate research threads: zero-trust security, auction-based edge resource scheduling, and privacy-aware edge optimization. In multi-tenant 6G edge environments serving privacy-sensitive, latency-critical applications (mobile assistants, immersive interaction, real-time visual analytics), runtime zero-trust enforcement—continuous authentication, authorization, and monitoring—introduces verification overhead, compliance costs, and service uncertainty. The authors argue that zero trust should be modeled as a dynamic, measurable compliance factor rather than a static trust label, and that existing work fails to couple runtime compliance with ex-ante bilateral clearing, ex-post settlement, and future seller eligibility in a single market mechanism.

A further concern motivating the design is post-clearing moral hazard: even after a transaction is cleared, a winning seller may reduce verification effort or violate promised quality levels, exposing buyers to privacy leakage and service degradation. The paper contends that deposit-refund mechanisms from zero-trust spectrum trading do not transfer directly to edge service markets, because edge trading additionally couples communication–computation assignment, privacy exposure, runtime compliance, and cross-round seller competitiveness.

The ZEBRIS framework

ZEBRIS (zero-trust bilateral trading with deposit-refund regulation for privacy-sensitive edge services) trades zero-trust-compliant service packages rather than bare resources. Each package specifies assigned bandwidth, computation, and a normalized verification intensity $z_{i,j}(t)$. Buyer requests carry data size, workload, delay deadline, privacy sensitivity level $\ell_i(t)$, minimum security level $s_i^{\min}(t)$, and gross valuation; sellers are characterized by bandwidth/computation capacity, a platform-estimated security posture $q_j(t)\in[0,1]$, a feasible verification-level set, and a base ask.

Three modeling components determine package economics:

• Delay: transmission plus computation time plus additive terms for verification overhead ($\vartheta_1 z$) and posture deficiency ($\vartheta_2(1-q)$). A package is feasible only if it meets both the buyer's deadline and minimum security score.
• Privacy risk: $\xi_{i,j}=\ell_i\,\phi(z,q)$ with $\phi$ decreasing in verification intensity and posture.
• Compliance cost: an explicit seller-side cost linear in verification effort and posture deficiency.

These feed into a buyer-side effective valuation $\hat v = v - \alpha D - \beta\xi$ and a seller-side effective ask $\hat a = a + \kappa^B b + \kappa^F f + C^{zt}$, whose difference defines the bilateral margin $\ell_i(t)$0. Only positive-margin pairs enter clearing, so delay loss, privacy risk, and compliance cost are internalized into the clearing criterion itself rather than treated as afterthoughts.

Ex-post settlement and posture evolution

Because ex-ante screening cannot guarantee runtime behavior, ZEBRIS settles a capped deposit based on measurable outcomes: authentication success rate, policy-consistency score, and SLA satisfaction score, combined into a refund ratio $\ell_i(t)$1 via fixed weights $\ell_i(t)$2. The deposit is capped as $\ell_i(t)$3 with cap ratio $\ell_i(t)$4, ensuring deposits remain large enough to discipline sellers without destroying participation incentives. A fraction $\ell_i(t)$5 of any forfeited deposit compensates the buyer; the remainder is platform revenue.

Realized compliance then feeds back across rounds: each seller's average refund ratio updates its posture via exponential smoothing, $\ell_i(t)$6. Since posture affects feasibility, privacy exposure, delay overhead, and compliance cost, this closes the incentive loop between current runtime behavior and future market competitiveness.

Clearing itself uses a resource-discretized dynamic program over the reduced candidate graph of pair-wise best packages, respecting buyer exclusiveness and seller bandwidth/computation constraints. Per-round complexity is $\ell_i(t)$7, with discretization granularity controlling the accuracy–overhead tradeoff.

Economic properties

The paper establishes three propositions and one remark:

• Bilateral individual rationality: under midpoint pricing $\ell_i(t)$8, every accepted trade yields strictly positive pre-settlement utility of exactly $\ell_i(t)$9 to each side.
• Seller-side final rationality: because the deposit is capped at $s_i^{\min}(t)$0 with $s_i^{\min}(t)$1, final seller utility satisfies $s_i^{\min}(t)$2 even under total forfeiture. This is the key role of the cap ratio—it guarantees that no accepted trade can leave the seller worse off regardless of realized compliance.
• Posture monotonicity: the sign of the posture update equals the sign of $s_i^{\min}(t)$3, so above-reference compliance improves future competitiveness and below-reference compliance degrades it.
• Buyer protection and weak budget balance: buyer settlement utility is at least $s_i^{\min}(t)$4 plus compensation, and the platform only redistributes forfeited deposits, retaining a nonnegative share—no external subsidy is ever required.

Notably, these are individual-rationality and budget-balance results only; the paper does not claim truthfulness, strategy-proofness, or optimality against the offline benchmark, which is formulated but acknowledged to be unsolvable clairvoyantly since future compliance outcomes cannot be observed before execution.

Evaluation

Simulations use 6 sellers (48 MHz aggregate bandwidth, $s_i^{\min}(t)$5 cycles/s aggregate computation), 180 trading rounds per episode, buyer activation calibrated from the Chicago taxi trips dataset, and 50 Monte Carlo runs. Runtime compliance is generated stochastically through a sigmoid effort model depending on seller posture and the deposit-to-ask ratio; the authors note this parameterization does not deterministically favor ZEBRIS.

ZEBRIS is compared against five baselines: ResOnly (resource-only clearing), PAware (privacy-aware, no settlement), ZTOnly (zero-trust-aware ex-ante only), AskFirst (cost-oriented heuristic), and ZEBRIS-S (ablation with static posture). Across varying market scales, ZEBRIS achieves the highest social welfare, highest average compliance score, lowest average end-to-end delay, and lowest average privacy-risk-weighted cost, while maintaining favorable seller utility. Two findings deserve emphasis:

• ResOnly's high acceptance ratio is misleading: it admits the most trades but delivers the worst welfare, compliance, delay, and privacy cost, illustrating that admission quantity and effective market quality diverge once compliance and privacy are priced in.
• The posture-feedback ablation matters: ZEBRIS consistently outperforms ZEBRIS-S on social welfare, seller utility, compliance, and delay, indicating that cross-round posture evolution is a load-bearing component rather than an auxiliary refinement.

Limitations and open questions

Several constraints on the results should be noted plainly. First, the evaluation scale is small (6 sellers, simulation-only), and the stochastic compliance model—though claimed neutral—is still an assumption about how deposits translate into seller effort; field validation with adversarial or strategic sellers is absent. Second, the mechanism's guarantees cover individual rationality and weak budget balance only; whether sellers or buyers can gain by misreporting valuations, asks, or request parameters remains unaddressed. Third, the DP operates over discretized resources and representative packages rather than the full joint package space, so clearing quality depends on discretization granularity—a tradeoff the paper controls but does not characterize tightly. Fourth, the long-term welfare objective is used only as a benchmark; no approximation-ratio bound relative to the offline optimum is provided. Finally, the framework assumes a single trusted platform coordinator, which sits in some tension with the zero-trust premise; multi-platform extension is deferred to future work.

Conclusion

ZEBRIS offers a coherent market design that converts runtime zero-trust compliance from a static assumption into an economically regulated factor, coupling package-based bilateral clearing, capped deposit-refund settlement, and cross-round seller-posture feedback. Its provable bilateral rationality and no-subsidy weak budget balance, combined with simulation gains in welfare, compliance, delay, and privacy-weighted cost over five baselines, make a case that ex-post regulation and posture dynamics are essential—not optional—in privacy-sensitive edge markets. The main open questions concern strategic robustness, approximation guarantees, and deployment beyond small-scale simulation.