Zero-Trust Identity and Mutual TLS

Every workload, FPGA node, and service holds a short-lived cryptographic identity and proves it on every connection, so trust follows the credential, not the wire.

Machine identity as the primitive

In a zero-trust plant, the unit of trust is not a network but a verified identity. Each service, controller, and edge FPGA is issued an X.509-style certificate bound to its attested state. Peers authenticate each other with mutual TLS on every connection - there is no anonymous or one-sided handshake anywhere in OT. A stolen IP or a spoofed MAC buys nothing without the private key, and the private key never leaves the hardware that holds it.

Short-lived credentials

Certificates are deliberately short-lived (hours, not years) and issued by an OT-internal certificate authority. Short lifetimes limit the value of a leaked key and force continuous re-attestation: to renew, a node must again prove its firmware measurement matches policy (see remote attestation). Revocation is fast because expiry does most of the work.

# Issuance couples identity to attestation state
def issue_cert(node):
    quote = node.get_attestation_quote()          # signed PCR/measurement
    if not verify_measurement(quote, policy.golden(node.role)):
        raise Deny('attestation mismatch')        # unknown firmware -> no cert
    csr = node.make_csr()
    return ca.sign(csr, ttl_hours=8, spiffe_id=node.workload_id)

Binding identity to authorization

Authentication answers who; authorization answers what they may do now. The verified identity is the input to per-request policy in microsegmentation and to role checks in privileged access management. A controller that has proven its identity still cannot, say, command a magnet ramp unless its role and the current plant mode permit it.

Human identity too

Operators authenticate with hardware-backed multi-factor credentials; there are no shared accounts on control systems. Every human action is attributable, which is what makes the decision-audit lineage and the insider-threat model tractable.

Design status: the CA, mTLS mesh, and attestation-coupled issuance are implemented in the twin environment. Hardware key stores on the FOAK FPGAs and the production CA are staged for the Q2 2027 build.