Zero-Trust Sidecar Proxy Architecture for Secure Multi-Vendor Industrial IoT Interoperability

Abstract

Multi-vendor Industrial Internet of Things (IIoT) deployments present a structural security challenge that perimeter-centric models cannot address: heterogeneous device ecosystems from competing vendors operating across Operational Technology and Information Technology layers dissolve the network boundary assumptions on which conventional security architectures depend. This paper proposes the Zero-Trust Sidecar Proxy Architecture (ZT-SPA), which decouples cryptographic policy enforcement from application logic through transparent traffic interception. The architecture employs mutual TLS with X.509 certificate chains, eBPF-based kernel-level policy enforcement achieving 0.01–0.03 second latency within a 2–4 MB footprint, and hierarchical gateway delegation extending Zero Trust coverage to resource-constrained devices incapable of hosting local enforcement. The Integration Contract Protocol (ICP) complements the technical architecture by formalizing interoperability obligations across seven governance dimensions—performance, cryptographic standards, data ownership, exit portability, audit rights, incident response timelines, and vendor flexibility—with TLA+ formal verification of critical constraint combinations. Validated in a 500-device reference deployment spanning five vendor ecosystems and four IEC 62443 security level tiers, ZT-SPA achieves 95.3% unauthorized access blocking, 38% aggregate power reduction, and 40–60% total cost-of-ownership reduction for SME-scale facilities, reducing annual security expenditure from $22,000 to $8,000–$12,000 while enabling 20–40% competitive pricing improvement in security-certified procurement markets. The architecture establishes that Zero Trust security and IIoT operational interoperability are simultaneously achievable through enforcement decoupling, governance formalization, and tiered deployment calibrated to device capability and threat exposure.