ZT-DAC: ML-Driven Dynamic Access Control Policy for Zero Trust in DER Networks

Abstract

The increasing penetration of Distributed Energy Resources (DERs) in the smart grid has significantly expanded the cyber-attack surface. Traditionally, DER networks rely on static role-based access control (RBAC) mechanisms that assume persistent trust after authentication. This limitation enables adversaries to maintain unauthorized privileges and move laterally across DER systems, disrupting grid operations. Although attribute-based access control (ABAC) enables fine-grained and context-aware access decisions, it does not fully eliminate implicit trust. Zero Trust (ZT) principles can be incorporated to enhance ABAC policies. This paper proposes a dynamic access control framework for implementing ZT in DER networks (ZT-DAC). The proposed solution employs a two-stage verification process and integrates an Open Policy Agent (OPA)-based RBAC with a machine learning (ML)-based ABAC to enforce continuous and adaptive trust score assessment. To support realistic DER operations, a DER-specific access control model is developed and used to generate a domain-informed dataset of access requests incorporating both legitimate and adversarial behaviors. Experimental results on the dataset show that the OPA-based decision layer achieves \(91.92\%\) accuracy, with a False Positive Rate of \(14.45\%\), while the ML model achieves a Mean Absolute Error of \(2.074\) and an \(R^2\) of \(0.891\) in trust-score prediction. The ABAC layer achieves \(93.27\%\) accuracy, with a FPR of \(3.88\%\), validating its practical feasibility within realistic DER environments.