Provable Remote Execution of Zero-Trust Authorization using SNARKs

Jul 16, 2026

Modernizing the security of operational technology systems for critical infrastructure is challenging due to constrained edge devices and the reliance on application gateways that enforce zero-trust authorization. Gateways must be deployed near distributed edges, kept patched, and managed with minimal downtime, making scaling and reliability difficult. PREZTA eliminates these gateways by executing policies inside a zero-knowledge virtual machine (zkVM) on the client and producing succinct SNARK proofs verifiable efficiently at the edge, enabling policy evolution without edge updates.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages20

Reading Time50 min

Abstract

Introduction

Motivation from OT Networks

Application Gateways and Their Burdens

Our Contributions: PREZTA

Prezta: Provable Remote Execution of Zero-Trust Authorization using SNARKs Zhongjing Wei* University of Illinois Urbana-Champaign [zwei26@illinois.edu](zwei26@illinois.edu) Yupeng Zhang University of Illinois Urbana-Champaign [zhangyp@illinois.edu](zhangyp@illinois.edu) Osaid Muhammad Ameer* University of Illinois Urbana-Champaign [oameer2@illinois.edu](oameer2@illinois.edu) Nikita Borisov University of Illinois Urbana-Champaign [nikita@illinois.edu](nikita@illinois.edu) arXiv :2607 . 1 1466v 1 [ cs .CR] 13 Jul 2026 Abstract Modernizing the security of operational technology systems that control critical infrastructure has become a pressing challenge. Because edge devices have limited capabilities, modernization has relied on application gateways that interface with identity management systems and enforce access policies. These gateways are powerful enough to perform complex authorization decisions and support zero-trust architectures but create major deployment and management burdens: they must be collocated with remote, distributed edge devices, kept up to date with security patches, and managed with minimal downtime. We propose Provable Remote Execution of Zero-Trust Authorization (PREZTA), an architecture that eliminates these gateways by evaluating policies within a zero-knowledge virtual machine (zkVM) running on the client. The zkVM produces a succinct proof of authorization that edge devices can verify efficiently, extending the zero-trust security envelope to the edge. Policies and identity management schemes can evolve without updating edge devices. To demonstrate the feasibility of PREZTA, we implement a prototype, built using the RISC Zero zkVM, that supports XACML 3.0 policies and JWT identity claims. While zkVMs introduce substantial proof overhead, we mitigate this by compiling policies to Rust code and pre-compiling regular expressions. Combined with optimized signature verification and JWT parsing, these measures reduce prover time by more than an order of magnitude. Our compiler correctly implements 83% ofthe XACML 3.0 conformance suite, with proof generation completing in tens of seconds on a desktop. Verification, by contrast, takes only tens of milliseconds—fast enough for even resource-constrained edge devices. 1 Introduction Operational technology (OT) networks [49] provide a networked interface to physical devices, such as those used in * * The authors contribute equally to this paper. manufacturing, energy systems, and various forms of infrastructure, from water treatment to traffic control. Devices in these networks typically have rudimentary built-in security protections, owing to their limited computational capabilities and upgrade cycles that can range to several decades [43] . Yet the security of many of these systems is paramount due to the critical importance of the systems and infrastructure that they monitor and control [32, 34] . This has led to efforts to extend modern security practices and, in particular, zero-trust architectures [45], to OT networks [30, 36, 42] . A key tool in this effort has been the use of application gateways. These gateways implement modern security practices, such as the use of sophisticated role-and attribute-based policies [28, 47], and interfacing with identity management systems that can implement two-factor authentication. These gateways, however, become a critical component, and their failures or compromise can result in a loss of availability or a security breach, respectively. The network linking the gateways to OT devices is implicitly trusted, so in distributed infrastructure, many gateways are needed to collocate them with the OT devices. This creates a significant management problem, where gateways must be kept secured, patched against vulnerabilities, and available. Our Contributions. To mitigate this management problem, we propose an alternate architecture, Provable Remote Execution of Zero-Trust Authorization, or PR

FAQs

What problem does PREZTA address in OT zero-trust deployments?

PREZTA addresses the management and deployment burden of application gateways that must be collocated with distributed edge devices, kept patched, and kept highly available for authorization decisions.

How does PREZTA replace application gateways?

PREZTA executes zero-trust authorization policies inside a zkVM on the client and generates a succinct SNARK proof that edge devices can verify efficiently.

What does the prototype support, and how is performance improved?

The prototype supports XACML 3.0 policies and JWT identity claims. It mitigates zkVM proof overhead by compiling policies to Rust code, pre-compiling regular expressions, and optimizing signature verification and JWT parsing to reduce prover time by more than an order of magnitude.

Jul 16, 2026

Upload by Genevieve