ICACT20260124 Question.1
Questioner: abilaaniloshan@gmail.com 2026-02-10 오후 2:15:30 |
ICACT20260124 Answer.1
Answer by Auhor abdelhadi.belfadel@irt-systemx.fr 2026-02-10 오후 2:15:30
Chrome  Click!! |
| In large-scale industrial environments with multiple interacting digital twins, how does your Zero Trust Architecture handle performance overhead and latency—especially when enforcing per-request decisions via PEP/PDP—and what trade-offs have you observed between security granularity and real-time operational requirements? |
Thank you for your question. Indeed, the proposed architecture is decentralised and has a federation that facilitates the scaling of PEPs. In addition, the PDP in this case has several Realms (one realm for each DT service) and can also be scaled horizontally or vertically, allowing it to respond and adapt to real-time operations. |
ICACT20260124 Question.2
Questioner: mrajhans@paloaltonetworks.com 2026-02-18 오전 1:31:14 |
ICACT20260124 Answer.2
Answer by Auhor abdelhadi.belfadel@irt-systemx.fr 2026-02-18 오전 1:31:14
Chrome Click!! |
| What is the measured impact of the proposed per-request Zero Trust enforcement (PDP/PEP with Keycloak) on latency, throughput, and scalability for real-time digital twin operations, and how does this overhead evolve as the number of DT services and realms increases? |
Thank you for your response. This is indeed an important matter. We have observed an increase in response time, as this approach introduces additional processing to DT requests from the PEP and PDP components. A study is currently underway to accurately assess the impact on system performance, including benchmarking to identify any remaining risks. |
ICACT20260124 Question.3
Questioner: gonghao23@mails.ucas.ac.cn 2026-02-23 오후 11:18:35 |
ICACT20260124 Answer.3
Answer by Auhor abdelhadi.belfadel@irt-systemx.fr 2026-02-23 오후 11:18:35
Chrome Click!! |
| The paper adopts a "one service = one realm" isolation strategy in Keycloak to confine potential breaches. However, as the number of Digital Twin services scales up, this approach introduces significant administrative overhead. How can the realm-per-service model be optimized or partially consolidated without sacrificing the security isolation guarantees prescribed by NIST ZTA principles? |
|
ICACT20260124 Question.4
Questioner: gonghao23@mails.ucas.ac.cn 2026-02-23 오후 11:18:49 |
ICACT20260124 Answer.4
Answer by Auhor abdelhadi.belfadel@irt-systemx.fr 2026-02-23 오후 11:18:49
Chrome Click!! |
| The current implementation relies exclusively on Role-Based Access Control (RBAC) for policy evaluation, which the authors acknowledge as sufficient for distinguishing user profiles in the proof-of-concept. Given the dynamic and context-sensitive nature of industrial DT environments — where device posture, real-time operational state, and cross-domain IT/OT interactions vary continuously — to what extent is RBAC alone adequate, and what would be the architectural implications of transitioning toward Attribute-Based Access Control (ABAC) or context-aware policies within the same Keycloak-based ZTA framework? |
|
