ZTSafe: Safety-Certified Risk-Adaptive Scheduling for Zero-Trust Time-Sensitive Industrial Networks

Abstract

Zero-trust security continuously re-evaluates the trustworthiness of industrial devices and reacts by rerouting, isolating, or rescheduling traffic. In a time-sensitive network (TSN) that carries feedback control loops, however, every such reaction is itself a control-plane disturbance: a reroute that meets every deadline can still deliver stale measurements, and an optimizer that crashes mid-reconfiguration can leave the network in an undefined state. This paper presents ZTSafe, a scheduling architecture that treats physical safety—not attack blocking—as the object of guarantee. The guarantee has two distinct layers: compliance with the communication contract yields a deterministic invariance result conditional on the stated plant, disturbance, synchronization, and trusted-base assumptions, whereas the risk bound’s 1−δ coverage is an empirical probabilistic calibration result. ZTSafe (i) synthesizes, offline and per control loop, a communication safety contract that bounds delay, age of information (AoI), consecutive losses, jitter, and path risk such that the physical state remains in its safe set under those assumptions; (ii) converts zero-trust evidence into conservative risk upper bounds and couples the admissible path-risk budget to the runtime safety margin of the plant; and (iii) places the scheduling optimizer outside the trusted computing base: an independent runtime shield checks every proposed schedule against the contracts, and on solver timeout, crash, or infeasibility the system atomically switches to a pre-checked fallback instead of executing an unverified approximate solution. Here, “verified” means independently checked by the shield, not machine-verified; a systematic shield defect or compromise of the remaining trusted computing base voids the deterministic claim. On a hardware TSN testbed with three physical control loops and fourteen attack and fault scenarios, ZTSafe reduces safe-set violations by 92.9% relative to the strongest baseline (12.8% to 0.9%; two-proportion z=39.4, p<10−15) while sustaining 94.3% on-time completion of critical traffic, recovers within three control periods, and executes zero unverified configurations across 10,000 injected solver failures.