A Formalized Approach to Integrating Policy-Based Access Control and Cryptographic Protection in Zero Trust Architecture

Abstract

This paper addresses the problem of the gap between policy-driven access control and cryptographic protection in corporate and cloud environments implementing Zero Trust Architecture (ZTA). It is shown that in most practical ZTA deployments, access decisions are reduced to logical allow/deny outcomes or aggregated trust-score evaluations, while cryptographic protection mechanisms—key management, encryption parameters, access tokens, and cryptographic sessions—remain static or only weakly coupled with access control policies. Such isolation of the cryptographic layer reduces system adaptivity, enlarges the potential attack window, and complicates coordinated real-time responses to changes in context, risk, and trust level. A formalized approach to integrating Policy-Based Access Control (PBAC) and cryptographic enforcement within ZTA is proposed, in which the cryptographic regime is interpreted as a controlled outcome of a policy decision rather than as an independent infrastructural component. The approach is based on representing access as a dynamic state that includes subject identity, resource, action, execution context, trust level, risk assessment, and the cryptographic state of the access session. A PBAC mapping is formally defined that returns not only a logical access decision but also a cryptographic policy specifying the algorithm class, key parameters, enforcement mode, and cryptographic session lifetime, adapted according to risk, trust, and resource sensitivity. An algorithmic interaction loop between PDP, PEP, and the Crypto Engine with cyclic policy re-evaluation triggered by security events is developed, ensuring continuous compliance with Zero Trust principles and dynamic reduction of the potential compromise window. The practical value of the proposed approach lies in establishing a theoretical foundation for designing Zero Trust Access Management systems in which cryptographic parameters are automatically aligned with access control policies and the evolving operational context.