Zero-Trust Architecture Applied to a Banking System

Regulations such as NIS 2 require systems where data protection is crucial to implement security standards. The critical controls within the AC family of the NIST SP 800-53 rev. 5 and NIST SP 800-207 standard are satisfied only by access control models designed as Zero-Trust Architectures (ZTA). The paper proposes an innovative access control model AI-Trust-HRABAC, which incorporates context-based dynamic trust. The Hybrid Role and Attribute Based Access Control (HRABAC) model was selected as its technological core. By combining flexible properties with contextual parameters (such as time, location, and threat level), the proposed model achieves finer-grained permission management aligned with the Zero-Trust concept. Furthermore, a two-tier zero-trust architecture ZTA-HRABAC is proposed, combining a web-based layer and a blockchain layer. Since the former utilizes the AI-Trust-HRABAC model and the latter employs HRABAC, they share a common core. This enables them to operate harmoniously while maintaining system security. Here, the immutability and tamper-resistance properties of blockchain are utilized. Data integrity preservation is mathematically proven using invariants and evaluation under threat scenarios. The proposed framework is compared with other zero-trust architectures, and its practical feasibility is validated within a banking environment.