Federated Learning (FL) enables decentralized learning while preserving data privacy. However, ensuring security and optimizing resource utilization in FL remains challenging, particularly in untrusted environments. To address this, we propose SecureFedPROM, a novel zero-trust FL framework that integrates Attribute-Based Access Control (ABAC) for secure client authorization and Preference Ranking Organization Method for Enrichment of Evaluations (PROMETHEE) for dynamic, multi-criteria client selection. Unlike traditional FL client selection methods that prioritize security or efficiency, SecureFedPROM optimizes trustworthiness, computational efficiency, and performance, ensuring robust participation in each training round. We evaluate SecureFedPROM across multiple real-world datasets, demonstrating its superiority over state-of-the-art client selection protocols. Our results show that SecureFedPROM achieves a 7.19% improvement in model accuracy, accelerates convergence, and reduces the number of training rounds. Additionally, it minimizes wall-clock time and computational overhead, making it highly scalable for edge AI environments. These findings highlight the importance of integrating zero-trust security principles with multi-criteria decision-making to enhance security and efficiency in FL.

Attribute-based access control (ABAC) models are widely used to provide fine-grained and adaptable authorization based on the attributes of users, resources, and other relevant entities. Hierarchical group and attribute based access control (HGABAC) model was recently proposed which introduces the novel notion of attribute inheritance through group membership. GURAGwas subsequently proposed to provide an administrative model for user attributes in HGABAC, building upon the ARBAC97 and GURA administrative models. The GURA model uses administrative roles to manage user attributes. The reachability problem for the GURA model is to determine what attributes a particular user can acquire, given a predefined set of administrative rules. This problem has been previously analyzed in the literature. In this article, we study the user attribute reachability problem based on directly assigned attributes of the user and attributes inherited via group memberships. We first define a restricted form of GURAG, called rGURAGscheme, as a state transition system with multiple instances having different preconditions and provide reachability analysis for each of these schemes. In general, we show PSPACE-complete complexity for all rGURAGschemes. We further present polynomial time algorithms with empirical experimental evaluation to solve special instances of rGURAGschemes under restricted conditions.

Cyber physical ecosystem connects different intelligent devices over heterogeneous networks. Various operations are performed on smart objects to ensure efficiency and to support automation in smart environments. An Activity (defined by Gupta and Sandhu) reflects the current state of an object, which changes in response to requested operations. Due to multiple running activities on different objects, it is critical to secure collaborative systems considering run-time decisions impacted due to related activities (and other parameters) supporting active enforcement of access control decision. Recently, Gupta and Sandhu proposed Activity-Centric Access Control (ACAC) and discussed the notion of activity as a prime abstraction for access control in collaborative systems. The model provides an active security approach that considers activity decision factors such as authorizations, obligations, conditions, and dependencies among related device activities. This paper takes a step forward and presents the core components of an ACAC model and compares with other security models differentiating novel properties of ACAC. We highlight how existing models do not (or in limited scope) support 'active' decision and enforcement of authorization in collaborative systems. We propose a hierarchical structure for a family of ACAC models by gradually adding the properties related to notion of activity and discuss states of an activity. We highlight the convergence of ACAC with Zero Trust tenets to reflect how ACAC supports necessary security posture of distributed and connected smart ecosystems. This paper aims to gain a better understanding of ACAC in collaborative systems supporting novel abstractions, properties and requirements.