Zero-Trust Security Architecture: Overview
The Kronos plant treats every network, device, and request as untrusted by default; access is earned per-request through identity, attestation, and policy, never by location.
Why zero trust for a fusion plant
A Kronos plant is a cyber-physical system where software decides how plasma is heated, shaped, and shut down. The breeder (Hyperion) is a D-T spherical tokamak (Q_sci 3.076, 85.0 MW fusion power, 9.66 MA plasma current, 16.84 T peak field, negative triangularity delta -0.30) that breeds a tritium product (~4 kg/yr class) plus ~1.97 kg/yr helium-3 and 14 MeV neutrons. The burner (Aegis / MetroVolt) is a D-3He tandem-mirror generator (26.49 T plug, 17 T throat, 5.44% neutron fraction, direct energy conversion). A single spoofed sensor or forged actuator command in either machine can drive the plasma off its operating point. Perimeter trust is therefore inadequate: we assume the perimeter is already breached and defend every hop.
The four load-bearing principles
- Never trust by location: a packet from inside the OT VLAN earns no more trust than one from the internet.
- Authenticate device and workload, not just user: every FPGA node and service holds a cryptographic identity and must attest its firmware before it is spoken to.
- Least privilege, per-request: authorization is evaluated at each call against policy, scope, and current plant state.
- Assume breach: segment, log, and design blast-radius limits so one compromised node cannot reach the interlock chain.
How it maps to the stack
Zero trust is enforced across the S.M.A.R.T. stack. See IT/OT separation for the coarse split, microsegmentation for the fine-grained one, zero-trust identity for mTLS between workloads, and secure boot plus remote attestation for the edge FPGAs that close the fast control loops.
Designed versus implemented
Candor: these machines are design and simulation studies. Breeder construction begins Q2 2027 with first-of-a-kind first tritium targeted ~2030; no hardware net-gain is claimed before FOAK. The security architecture described here is exercised today against the digital twin and simulated OT networks. Policy engines, data-diode data paths, and attestation flows are prototyped in emulation; the physical air gaps, hardware diodes, and safety-instrumented isolation are specified and staged for the FOAK build, not yet operating on a live reactor.