Figure 1.
Processing an access request by ZTA-HRABAC architecture.
Figure 2.
TEF grading and decreasing subject's trust score.
Algorithm 1:
Trust Evaluating Function
| Function TEF(subject) |
| begin |
| trustScore := 100; |
| penaltySettings := subject.databaseProfile.customPenaltyWeights; |
| if (subject.hasWorkingHours) then |
| localTime := convertToTimeZone(context.currentTime, subject.timeZone); |
| if (localTime < subject.startTime || localTime > subject.endTime) then |
| if (trustScore >= penaltySettings.workingTimeScore) then |
| trustScore := trustScore - penaltySettings.workingTimeScore; |
| else |
| trustScore := 0; |
| end |
| end |
| end |
| if (context.ipAddress not in subject.allowedIPAddresses) then |
| if (trustScore >= penaltySettings.locationScore) then |
| trustScore := trustScore - penaltySettings.locationScore; |
| else |
| trustScore := 0; |
| end |
| end |
| if (context.deviceIdentifier != subject.allowedDevice) then |
| if (trustScore >= penaltySettings.deviceScore) then |
| trustScore := trustScore - penaltySettings.deviceScore; |
| else |
| trustScore := 0; |
| end |
| end |
| if (context.inactivityTime > config.acceptableInactivityPeriod) then |
| if (trustScore >= penaltySettings.inactivityTimeScore) then |
| trustScore := trustScore - penaltySettings.inactivityTimeScore; |
| else |
| trustScore := 0; |
| end |
| end |
| if (trustScore <= config.toleranceTrustScore) then |
| context.sessionTimeout := subject.role.minSessionTimeout; |
| else |
| context.sessionTimeout := subject.role.maxSessionTimeout; |
| end |
| if (context.activityTime >= context.sessionTimeout) then |
| context.session.destroy(); |
| end |
| context.currentTrustScore := trustScore; |
| end. |
Figure 3.
AI-Trust-HRABAC Trust Score Operational Zones, according to the example thresholds.
Figure 4.
UML activity diagram of the model AI-Trust-HRABAC.
Figure 5.
The UML class diagram of the AI-Trust-HRABAC model.
Figure 6.
The components of the proposed architecture ZTA-HRABAC.
Table 1.
Comparison of ZTA-HRABAC with Other ZTA.
| Model/Param. | Granularity | Access rights protection | DI | ABL | Complexity |
|---|---|---|---|---|---|
| DR-TBAC | Medium | Only in relational database | No | No | O(N) |
| TSBACM | Low | Only in relational database | No | No | O(N) |
| DSAAC | High | Only in database | No | No | O(N) |
| AIARBABAC | High | Only in database | No | No | O(N) |
| CACM | High | Only in database | No | No | O(N) |
| ZTA-HRABAC | High | Double – database and blockchain | Yes | Yes | O(N) |
Figure 7.
UML use case diagram for role Customer in the banking system.
Figure 8.
UML use case diagram for the role Employee in the banking system.
Figure 9.
UML use case diagram for the role Manager in the banking system.
Figure 10.
UML use case diagram for role Administrator in the banking system.
Figure 11.
UML sequence diagram for role Customer in the banking system.
Figure 12.
UML sequence diagram for the role Employee in the banking system.
Figure 13.
UML sequence diagram for the role Administrator in the banking system.
Figure 14.
Smart contract execution and authorization metrics in Hardhat network.
Figure 15.
Empirical proof of constant complexity in the bank system.
Table 2.
Access Control Performance Comparison.
| Performance Metric | Manually Tuned Static Weights | Dynamic AI-Calibrated Weights (Proposed) | Operational Significance |
|---|---|---|---|
| False Positive Rate (FPR) | 0.45% | 0.00% | Completely eliminates user friction during smooth behavioral drift. |
| False Negative Rate (FNR) | 0.00% | 0.00% | Guarantees absolute threat interception against aggressive multi-vector attacks |
| Detection Latency Footprint | Instant (O(1)) | Instant (O(1)) | Preserves retail transactional throughput via precomputed database weights. |
Table 3.
Trust Score Analytical Classification Metrics.
| Evaluation Metric | Mathematical Definition | Empirical Value (Proposed Model) | Operational Security Significance |
|---|---|---|---|
| Accuracy | (TP + TN)/Total | 100.00 % | Demonstrates systemic classification reliability across balanced log traffic streams. |
| Precision | TP/(TP + FP) | 100.00 % | Guarantees that triggered alerts are genuine threats, minimizing operational friction. |
| Recall (Detection Rate) | TP/(TP + FN) | 100.00% | Proves absolute perimeter resilience against stealthy multi-vector attack profiles. |
| F1-Score | Harmonic Mean | 100.00% | Confirms an optimal mathematical balance between system safety and user accessibility. |
Table 4.
Window Size N Sensitivity and Ablation Matrix.
| Window Size (N) | FPR | FNR | Training and Serialization Latency (ms) | Inference Evaluation Latency (ms) | Operational Trade-off Evaluation |
|---|---|---|---|---|---|
| N = 10 | 5.40% | 0.00% | 0.17 ms | 0.0098 ms | High user friction; unstable standard deviations trigger false alerts. |
| N = 25 | 0.00% | 0.00% | 0.16 ms | 0.0093 ms | Marginal boundary leakage; insufficient profile maturation |
| N = 50 | 0.00% | 0.00% | 0.17 ms | 0.0103 ms | Optimal bound (zero-friction perimeter security). |
| N = 100 | 0.00% | 0.00% | 0.16 ms | 0.0097 ms | Diminishing returns; increased memory state allocation. |
| N = 250 | 0.00% | 0.00% | 0.20 ms | 0.0100 ms | Suboptimal for web infrastructure due to execution overhead. |
Figure 16.
Invariant 1 TLA+ verification.
Figure 17.
Invariant 2 TLA+ verification.
Figure 18.
Invariant 3 TLA+ verification.