Zero-Trust Distributed Networks

• Zero-Trust Distributed Networks (ZTDN) are security frameworks based on continuous verification, least privilege, and micro-segmentation to safeguard dynamic, multi-domain environments.
• ZTDN leverages distributed control mechanisms, including Policy Enforcement Points and Policy Decision Points, across cloud, IoT, and mobile networks for real-time access decisions.
• Advanced implementations integrate federated intelligence and decentralized identity verification to enable context-aware, adaptive security across complex infrastructures.

Zero-Trust Distributed Networks (ZTDN) denote the application of zero-trust architecture to distributed networks, meaning that security decisions are made across multiple components, domains, and attack surfaces rather than at a single enterprise perimeter. In this framing, no entity is inherently trustworthy, access is repeatedly authenticated and authorized, and enforcement is distributed across application, service, segment, cloud, edge, and device boundaries. Current work places ZTDN in cloud and enterprise distributed networks, dense IoT and 5G IoT systems, multi-cloud and hybrid environments, and mobile multi-RAT systems in which even a radio transition can be treated as a trust-boundary crossing (Sandjaja et al., 6 Aug 2025, Weinberg et al., 2024, Mavroudis, 2024, Shelby, 9 Feb 2026).

1. Conceptual foundations

The dominant conceptual lineage treats ZTDN as zero-trust architecture “in the context of distributed networks,” and associates it with four recurrent principles: least privilege, trust no one, micro-segmentation, and always verify. Closely related formulations emphasize verify explicitly, apply least privilege access, and assume breach. Across these formulations, the decisive shift is away from perimeter trust and one-time authentication, and toward repeated authentication and authorization for each resource interaction (Sandjaja et al., 6 Aug 2025, Ahmadi, 14 Jan 2025).

This position is commonly contrasted with traditional perimeter security along several axes: perimeter-based versus data-centric security, trust by default versus continuous verification, authenticate once versus continuous authentication, static policies versus dynamic context-aware policies, coarse segmentation versus microsegmentation, reactive response versus continuous monitoring, and centralized control versus distributed enforcement. In distributed environments, this means that network location ceases to be a sufficient basis for authorization; identity, device posture, behavioral telemetry, and request context become the operative inputs instead (Weinberg et al., 2024, Mavroudis, 2024).

The scope of ZTDN is correspondingly broad. It includes cloud networks, separate data centers, multiple enterprise network segments, dense IoT and consumer IoT, 5G IoT networks, multi-cloud and hybrid enterprise networking, remote access paths, open APIs, OT/ICS environments, and agentic AI-enabled systems. In mobile heterogeneous wireless settings, the concept is extended further: each transition between radio access technologies may invalidate authentication state, device attestation, and contextual trust signals, so mobility itself becomes a zero-trust problem rather than a mere connectivity problem (Sandjaja et al., 6 Aug 2025, Weinberg et al., 2024, Shelby, 9 Feb 2026).

2. Architectural model and distributed control

The recurrent architectural vocabulary of ZTDN is built around the Policy Enforcement Point (PEP) and Policy Decision Point (PDP). In policy-centric descriptions, the PDP is often decomposed into a Policy Engine (PE), which evaluates trust and authorization conditions, and Policy Administration (PA), which administers credentials, certificates, session setup, and the opening and closing of communication channels. At the same time, zero-trust surveys describe a Control Plane (CP) as the “ZT brain,” responsible for deciding whether access should be granted, while communication with trusted clients is typically conducted via encrypted tunnels and temporary one-time credentials (Sandjaja et al., 6 Aug 2025, Weinberg et al., 2024).

Distributed operation modifies rather than removes this structure. One line of work states that there can be an arbitrary amount of PEPs in a LAN, each responsible for a subset of resources, which naturally maps to distributed enforcement domains. Another line defines ZTNA as a model with a control function that authenticates, evaluates context, and decides whether access should be granted, plus an enforcement function that mediates actual connectivity to resources. Agent-based ZTNA installs a software agent on each endpoint for continuous device-health and compliance monitoring, whereas agentless ZTNA relies on secure web gateways, proxies, and identity-aware firewalls for heterogeneous environments and low-powered devices (Bradatsch et al., 2021, Mavroudis, 2024).

Concrete distributed instantiations often mix network-layer and application-layer enforcement. A multi-cloud zero-trust foundation built with Istio and Calico uses a five-layer structure: Core Network Layer, Gateway Layer, Software Defined Perimeter, Cloud Network Layer, and Management Layer. In that design, cloud underlay isolation is combined with resource segregation, namespace/workload isolation, Envoy sidecars, Istio AuthorizationPolicy, PeerAuthentication, mTLS, cloud ACLs/security groups, and Calico L3/L4 policy. The resulting model treats every service call as a policy-enforced, identity-validated, encrypted interaction rather than simple network reachability (Arora et al., 2024).

Telecom-oriented work extends this further by separating data plane, control plane, and metadata plane, and by placing AI-enabled monitoring and trust engines in near-real-time and non-real-time control loops. This suggests that, in large distributed environments, trust telemetry becomes a first-class architectural plane rather than an incidental logging function (Ramezanpour et al., 2021).

3. Identity, trust, and continuous verification

Identity in ZTDN is increasingly treated as a distributed and policy-relevant substrate rather than a centralized account lookup. One conceptual line proposes Distributed Identity based on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), arguing that distributed identity can serve as the identity plane for zero-trust access decisions across segmented networks. In that framing, cryptographically verifiable identity assertions, selective disclosure, and request-scoped verification support the pillars of verify explicitly, least privilege, and assume breach. At the same time, the same work acknowledges that issuer trust, revocation, governance, and interoperability remain underspecified, so the architecture is a rationale rather than a complete deployment blueprint (Ahmadi, 14 Jan 2025).

Trust evaluation itself is often threshold-based. In Zero Trust Service Function Chaining, access is granted only if the requestor’s trustworthiness is higher than a predefined trust threshold, with trustworthiness derived from user information, device information, history, certificate possession, and managed-device posture. A faithful rendering of the stated rule is: $$\text{allow if } \text{trustworthiness(requestor)} > \text{trust threshold}.$$ This same line of work also treats additional security functions as compensating controls that can raise effective trust when direct trust is insufficient, so trust is not only pre-existing endpoint posture but can also be augmented by path-based controls such as IPS and MFA (Bradatsch et al., 2021).

Wireless and mobile settings have pushed this logic toward explicit temporal models. The Age of Trust (AoT) framework defines trust staleness as the time elapsed since the target user’s trust was last verified plus an initial age that depends on the trust level evaluated at that verification. Its long-term metric is: $$\Delta = \lim_{T\rightarrow\infty}\frac{1}{T}\int_{0}^{T}\delta(t)dt,$$ with repeated verification trading off against wireless transmission efficiency. In parallel, multi-RAT IoT work defines a trust-state vector

$$\mathbf{s}(d, t, R) = \langle s_{\mathrm{id}}, s_{\mathrm{dev}}, s_{\mathrm{ctx}}, s_{\mathrm{net}}, s_{\mathrm{pol}} \rangle \in [0,1]^5$$

and models trust-boundary crossings through survival functions that determine which trust components persist when a device moves from one radio domain to another. These formulations make continuous verification measurable rather than merely aspirational (Xiao et al., 2024, Shelby, 9 Feb 2026).

Cross-domain IoT work translates these ideas into protocol form. In that model, a target domain performs pre-authorization, then issues a one-time token

$Token_a = (ID_a, S_j, T_a, I_a, r)$

that scopes access by identity, resource/service scope, time range, and intention. This is paired with continuous context collection through a Context-Aware Module (CAM) and dynamic risk assessment through a Trust Engine (TE). Industrial IoT reviews, however, warn that many IoT or Smart Peripheral Devices are userless, constrained, brownfield, or black-box devices, so strong identity, endpoint instrumentation, and continuous posture collection are often weaker in practice than in enterprise zero-trust models (Ma et al., 7 Jan 2025, Bobelin, 7 Apr 2026).

4. Segmentation, service insertion, and access-path control

Micro-segmentation is repeatedly presented as a core requirement of zero trust. The central idea is to divide networks into small security zones and to secure individual resources rather than a broad network perimeter, thereby minimizing impact of security breaches and restricting lateral movement. In distributed environments, this applies equally to east-west traffic, cloud workloads, service-to-service calls, and internal segment boundaries (Gambo et al., 25 Mar 2026, Mavroudis, 2024).

One concrete mechanism is Zero Trust Service Function Chaining (ZTSFC), which makes the PEP act as the SFC classifier. Rather than applying computationally expensive security functions indiscriminately to all packets, the PEP uses trust context to decide whether traffic should be allowed, which additional security functions should be traversed, and in what order they should be applied. The paper’s explicit examples are: managed device plus valid certificate gives direct service access; valid certificate plus not managed adds IPS; managed plus no valid certificate adds MFA; neither certificate nor managed state adds both MFA and IPS. This makes service-chain selection an extension of trust adjudication rather than a separate network-path decision (Bradatsch et al., 2021).

A second concrete line is Kubernetes- and service-mesh-based micro-segmentation. In the multi-cloud architecture using Istio and Calico, three segmentation levels are defined: business-level segregation using VPCs/subnets or subscriptions/VNets, resource segregation across clusters and VMs, and application isolation using namespaces and service mesh policies. The prototype demonstrates that pod-to-pod HTTP traffic in a namespace initially returns HTTP/1.1 200 OK, but after applying an Istio AuthorizationPolicy named allow-nothing, the same request returns HTTP/1.1 403 Forbidden. Likewise, after applying $$\Delta = \lim_{T\rightarrow\infty}\frac{1}{T}\int_{0}^{T}\delta(t)dt,$$1 in namespace bar, foo to bar succeeds with 200, whereas legacy to bar fails with 000, exit code 56 (Arora et al., 2024).

A third line makes segmentation itself adaptive and learned. The explainable federated framework EFAH-ZTM uses a federated DNAE, kNN-based and manifold-based hypergraphs, spectral embeddings, and either MiniBatch KMeans or HDBSCAN to generate IIoT micro-segments. It then computes an operational risk score

$r(x_i) = w_1 \tilde{E}(x_i) + w_2 \tilde{O}(x_i)$

and a cluster-level risk

$R(c) = \mathbb{E}_{x_i : c_i = c}[r(x_i)].$

Its policy logic is explicitly zero-trust: intra-segment communication is allowed only if cluster risk is below threshold, while inter-segment communication is blocked by default. In experiments on WUSTL-IIoT-2021, manifold-based hypergraph + HDBSCAN achieved a purity of 0.9990 with near-zero contamination, supporting the claim that behavior-driven micro-segmentation can serve as an enforceable zero-trust control surface (Gambo et al., 25 Mar 2026).

5. Distributed intelligence, federation, and service selection

A substantial body of ZTDN work treats trust evaluation as a distributed learning and orchestration problem. In Distributed Computing Continuum Systems, centralized zero trust is described as unsuitable because of limited resources, limited connectivity, and limited visibility at the edge. The proposed response is a learning-driven architecture that distributes PEPs and learning models across edge, fog, and cloud, adds a learning component based on Representation Learning (ReL), and uses Bayesian Network Structure Learning (BNSL) to infer whether requests are likely authentic or fraudulent. Its illustrative queries include

$$P(\text{Action}=1 \mid \text{Source Port}=443, \text{Protocol}=\text{HTTPS}, \text{Application}=\text{Web Browser}) = 0.9853$$

and

$$P(\text{Action}=1 \mid \text{Source Port}=56025, \text{Protocol}=\text{SSH}, \text{User}=\text{User8}, \text{Source IP address}=\text{192.168.1.10}) = 0.45301,$$

with the second used to justify local blocking without involving the policy engine. The same architecture explicitly allows local learned fallback decisions when the connection between PEP and PDP/PE is unstable (Murturi et al., 2023).

Telecom-oriented work makes this even more explicit by defining Monitoring, Evaluation, and Decision-making (MED) as the core zero-trust functions. In the proposed intelligent Zero Trust Architecture for 5G/6G, IGP models the security state of the subject, INSSA models network state and produces R-Scores, and IPE computes a C-score for authorization, using AI engines distributed across near-real-time and non-real-time O-RAN control loops. The architecture treats telemetry, trust scoring, and access control as an integrated service-based system rather than as a static firewall policy (Ramezanpour et al., 2021).

Cross-domain collaboration adds a federated dimension. A dynamic authentication and granularized authorization scheme for large-scale IoT combines ZTA with decentralized federated learning, using local workers and coordinators, neighbor-only model exchange, TopK compression, and adaptive weighting based on

$F1=\frac{Precision\times Recall}{Precision+Recall}$

and

$$D_{KL}(P_{A}||P_{B})=\sum_{i}P_{A}(i)\log\left(\frac{P_{A}(i)}{P_{B}(i)}\right).$$

The resulting DFL layer is used to support target-domain pre-authorization without sharing raw context data across domains (Ma et al., 7 Jan 2025).

Other work applies distributed trust to service-provider and ecosystem selection rather than subject-to-resource access. The Trust-as-a-Service (TaaS) framework for 5G multi-party networks proposes one TaaS instance per domain, with modules for information gathering and sharing, trust computation, trust storage, and continuous update. It distinguishes direct and indirect trust, provider-level and offer-level trust, and uses an adapted PeerTrust formulation with

$$\Delta = \lim_{T\rightarrow\infty}\frac{1}{T}\int_{0}^{T}\delta(t)dt,$$0

to quantify stakeholder satisfaction. This is not a full zero-trust enforcement stack, but it extends ZTDN toward cross-domain service-provider selection and trust-aware orchestration (Valero et al., 2022).

At a broader conceptual level, decentralized DT-based 6G work argues that blockchain plus meta-learning, generalized learning, and federated learning are needed because physical devices, digital twins, and their interactions all become zero-trust subjects. Architectural survey work on distributed trust complements this by arguing that trust in distributed systems is not removed but redistributed across products, processes, registries, credentials, governance, and audit structures. A plausible implication is that ZTDN is as much a governance and provenance architecture as it is a network-access architecture (Ridhawi et al., 2023, Lo et al., 2023).

6. Evidence, industrial practice, and open problems

The empirical status of ZTDN is uneven. Some proposals are proof-of-concept architectures with qualitative validation; others provide operational measurements for narrow subproblems; many remain conceptual. For example, ZTSFC explicitly presents only a first prototype and states that comprehensive performance evaluations are future work, so it does not provide throughput numbers, latency measurements, CPU consumption measurements, scalability analysis, or comparison with baselines. The multi-cloud Istio/Calico architecture likewise demonstrates concrete access-control behavior, but reports no quantitative benchmarks for latency, throughput, policy propagation time, packet loss, or control-plane scaling (Bradatsch et al., 2021, Arora et al., 2024).

Where numerical evidence exists, it often concerns a subcomponent rather than an end-to-end ZTDN. In the 5GBarcelona TaaS implementation, validation used a worker with 8 cores and 30 GiB RAM and reported resource use of about 12% of total CPU and 2% of total memory, but total sequential time for gathering, computation, and storage was 10.4 seconds for 100 offers, 185.6 seconds for 500 offers, and 741.4 seconds for 1000 offers, with the credibility sub-phase dominating computation time. In wireless continuous-verification work, numerical results show a fair compromise between trust level and wireless transmission efficiency, but the model is intentionally narrow: trust means mainly identity trust of receiver or sensor nodes, and the framework does not address full distributed control-plane or cross-domain trust orchestration (Valero et al., 2022, Xiao et al., 2024).

Policy correctness remains a central unresolved issue. The policy-design literature on ZTDN argues that overall security in ZTA is managed through policies, and that unverified policies can lead to unauthorized access. It identifies no quantitative trust evaluation, no trust-score thresholds, lack of access control rules, lack of trust-aware policy language, policy inconsistency across network components, lack of standardization for ZT policies, policy tampering, and lack of accountability for policy decisions as core problems. Its UPPAAL case study shows that policy workflows can be checked for deadlock freedom and for denial of access under suspicious policy modification, but it remains an illustrative single-user scenario rather than a scalable deployment framework (Sandjaja et al., 6 Aug 2025).

Several strong claims in the literature are explicitly qualified by their own evidence base. The distributed-identity paper says adopting distributed identities can enhance overall security postures “by an order of magnitude,” but the same source also states that this is not substantiated by experiments, formal proofs, attack simulations, or field measurements. Similarly, industrial IoT reviews argue that both “Zero Trust” and “IoT” are strong cybersecurity trends, and that many vendors tag their solutions as IoT integration into the ZT model with little to no effective compliance to the model or standard. In that industrial survey, only 5 of the 17 actors surveyed were judged to offer support for ZT+IoT beyond generic guidance: Azure, Palo Alto Networks, Fortinet, AWS, and NetFoundry (Ahmadi, 14 Jan 2025, Bobelin, 7 Apr 2026).

The open problems are therefore structural rather than merely incremental. Recurring gaps include inter-PEP coordination, policy synchronization among domains, conflict resolution across administrative boundaries, federated trust, distributed state consistency, multi-controller scaling, cross-cloud identity consistency, certificate lifecycle automation, revocation freshness, workload identity, constrained-device attestation, adversarial robustness of federated or learned trust models, explainability of automated decisions, and governance of AI-generated or machine-mediated policies. The literature increasingly suggests that ZTDN should be understood not as a single reference architecture but as a family of mechanisms for explicit verification, distributed enforcement, micro-segmentation, trust-aware service insertion, federated intelligence, and auditable policy governance across distributed systems (Sandjaja et al., 6 Aug 2025, Bobelin, 7 Apr 2026).