Zero Trust in Heterogeneous Multi-Cloud Environments: A Systematic Literature Review and a Decentralized Federated Trust Framework

Yevhen Darnapuk; Yevhenii Khudolii

doi:10.7250/csimq.2026-48.05

Zero Trust in Heterogeneous Multi-Cloud Environments: A Systematic Literature Review and a Decentralized Federated Trust Framework

Authors

Yevhen Darnapuk Department of Computer Engineering, Petro Mohyla Black Sea National University, 10 68-Desantnykiv St., 54003, Mykolaiv, Ukraine https://orcid.org/0000-0002-7099-5344
Yevhenii Khudolii Department of Computer Engineering, Petro Mohyla Black Sea National University, 10 68-Desantnykiv St., 54003, Mykolaiv, Ukraine https://orcid.org/0009-0006-0852-9795

DOI:

https://doi.org/10.7250/csimq.2026-48.05

Keywords:

Zero Trust Architecture, Multi-Cloud, Federated Trust, Decentralized Identity, Decentralized Identifiers, Verifiable Credentials

Abstract

Implementing Zero Trust across heterogeneous multi-cloud environments is complicated due to incompatible identity models, policy semantics, trust anchors, and credential-lifecycle mechanisms. This article reports a systematic literature review of research published from January 2020 to July 2026. Searches of Scopus, the Web of Science Core Collection, and IEEE Xplore identified 1800 records; 31 distinct studies were retained after deduplication and screening. The synthesis shows that centralized and federated approaches remain operationally mature but continue to depend on identity providers, brokers, and provider-specific policy models. Approaches based on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) improve claim portability and local cryptographic verification, yet they do not by themselves resolve issuer governance, credential status, policy mapping, or key compromise. On this basis, the article proposes a decentralized federated trust framework that combines portable credentials, local verification, issuer and credential-lifecycle controls, policy mapping, and resource-local enforcement. The framework is assessed analytically against review-derived requirements and representative architectures; implementation and performance evaluation remain future work.

References

I. Indu, P. M. R. Anand, and V. Bhaskar, “Identity and access management in cloud environment: Mechanisms and challenges,” Engineering Science and Technology, an International Journal, vol. 21, no. 4, pp. 574–588, 2018.

S. Ali et al., “Security and privacy in multi-cloud and hybrid cloud environments: Challenges, strategies, and future directions,” Computers & Security, vol. 157, article 104599, 2025.

C. Buck, C. Olenberger, A. Schweizer, F. Völter, and T. Eymann, “Never trust, always verify: A multivocal literature review on current knowledge and research gaps of zero-trust,” Computers & Security, vol. 110, article 102436, 2021.

W. Yeoh, M. Liu, M. Shore, and F. Jiang, “Zero trust cybersecurity: Critical success factors and A maturity assessment framework,” Computers & Security, vol. 133, article 103412, 2023.

S. Sarkar, G. Choudhary, S. K. Shandilya, A. Hussain, and H. Kim, “Security of Zero Trust Networks in Cloud Computing: A Comparative Review,” Sustainability, vol. 14, no. 18, article 11213, 2022.

J. R. Almeida, A. Zúquete, A. Pazos, and J. L. Oliveira, “A federated authentication schema among multiple identity providers,” Heliyon, vol. 10, no. 7, article e28560, 2024.

J. M. Bernabé Murcia, E. Cánovas, J. García-Rodríguez, A. M. Zarca, and A. Skarmeta, “Decentralised Identity Management solution for zero-trust multi-domain Computing Continuum frameworks,” Future Generation Computer Systems, vol. 162, article 107479, 2025.

M. A. Azad, S. Abdullah, J. Arshad, H. Lallie, and Y. H. Ahmed, “Verify and trust: A multidimensional survey of zero-trust security in the age of IoT,” Internet of Things, vol. 27, article 101227, 2024.

S. Aboukadri, A. Ouaddah, and A. Mezrioui, “Machine learning in identity and access management systems: Survey and deep dive,” Computers & Security, vol. 139, article 103729, 2024.

A. Mühle, A. Grüner, T. Gayvoronskaya, and C. Meinel, “A survey on essential components of a self-sovereign identity,” Computer Science Review, vol. 30, pp. 80–86, 2018.

J. Sedlmeir, R. Smethurst, A. Rieger, and G. Fridgen, “Digital Identities and Verifiable Credentials,” Business & Information Systems Engineering, vol. 63, pp. 603–613, 2021.

J. Xian, L. You, Q. Yi, J. Wang, and G. Hu, “A survey on decentralized identity management systems,” Computer Science Review, vol. 58, article 100811, 2025.

M. J. Page et al., “The PRISMA 2020 statement: an updated guideline for reporting systematic reviews,” BMJ, vol. 372, article n71, 2021.

A. Cuzzocrea and I. Belmerabet, “Towards Privacy-Preserving Multi-Cloud Identity Management Using SOLID,” in Proceedings of the 21st International Conference on Security and Cryptography, SCITEPRESS – Science and Technology Publications, 2024, pp. 649–654.

A. Cuzzocrea and I. Belmerabet, “A SOLID-Based Framework for Supporting Privacy-Preserving Identity Management in Multi-Cloud Environments,” in 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC), IEEE, 2024, pp. 2334–2340.

S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture,” NIST Special Publication 800–207, 2020.

S. Rodigari, D. O’Shea, P. McCarthy, M. McCarry, and S. McSweeney, “Performance Analysis of Zero-Trust multi-cloud,” in 2021 IEEE 14th International Conference on Cloud Computing (CLOUD), IEEE, 2021, pp. 730–732.

S. Deochake, R. Murphy, and J. Gearheart, “A Multi-Cloud Framework for Zero Trust Workload Authentication,” in 2025 Annual Computer Security Applications Conference Workshops (ACSAC Workshops), IEEE, 2025, pp. 523–530.

S. Deochake and V. Channapattan, “Identity and Access Management Framework for Multi-tenant Resources in Hybrid Cloud Computing,” in Proceedings of the 17th International Conference on Availability, Reliability and Security, ACM, 2022, pp. 1–8.

M. I. Hussain et al., “AAAA: SSO and MFA Implementation in Multi-Cloud to Mitigate Rising Threats and Concerns Related to User Metadata,” Applied Sciences, vol. 11, no. 7, article 3012, 2021.

Y.-D. Lin, D.-T. Truong, A. Ali, C.-Y. Li, Y.-C. Lai, and T.-M. T. Dinh, “Proxy-Based Federated Authentication: A Transparent Third-Party Solution for Cloud-Edge Federation,” IEEE Network, vol. 34, no. 6, pp. 220–227, 2020.

S. R. Alam et al., “Federated Single Sign-On and Zero Trust Co-design for AI and HPC Digital Research Infrastructures,” in SC24-W: Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, IEEE, 2024, pp. 1756–1764.

E. Kim et al., “Can We Create a Cross-Domain Federated Identity for the Industrial Internet of Things without Google?” IEEE Internet of Things Magazine, vol. 3, no. 4, pp. 82–87, 2020.

M. A. Madani, A. Kerkri, and M. Aissaoui, “MC-ABAC: An ABAC-based Model for Collaboration in Multi-Cloud Environment,” International Journal of Advanced Computer Science and Applications, vol. 14, no. 6, 2023.

E. Zahoor, A. Ikram, S. Akhtar, and O. Perrin, “A Formal Approach for the Identification of Authorization Policy Conflicts within Multi-Cloud Environments,” Journal of Grid Computing, vol. 20, no. 2, article 18, 2022.

D. Kallergis, Z. Garofalaki, G. Katsikogiannis, and C. Douligeris, “CAPODAZ: A containerised authorisation and policy-driven architecture using microservices,” Ad Hoc Networks, vol. 104, article 102153, 2020.

M. Niedermeier and H. Wittges, “Towards Role Mappings in Hybrid Cloud Environments: A Systematic Literature Review,” in Enterprise Design, Operations, and Computing, Lecture Notes in Computer Science, vol. 15409, 2025, pp. 119–139.

C. D. N. Kyriakidou et al., “Identity and Access Management for the Computing Continuum,” in Proceedings of the 2nd International Workshop on MetaOS for the Cloud-Edge-IoT Continuum, ACM, 2025, pp. 33–39.

E. Zeydan, J. Baranda, J. Mangues-Bafalluy, S. S. Arslan, and Y. Turk, “A Trustworthy Framework for Multi-Cloud Service Management: Self-Sovereign Identity Integration,” IEEE Transactions on Network Science and Engineering, vol. 11, no. 3, pp. 3135–3147, 2024.

A. Zhang, X. Lee, Z. Zhuang, J. Wei, Y. Fu, and B. Peng, “POLARIS: Cross-Domain Access Control via Verifiable Identity and Policy-Based Authorization,” in 2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), IEEE, 2025, pp. 1489–1498.

R. Chen et al., “BIdM: A Blockchain-Enabled Cross-Domain Identity Management System,” Journal of Communications and Information Networks, vol. 6, no. 1, pp. 44–58, 2021.

S. R. Garzon, H. Dinh-Tuan, M. M. Martinez, A. Küpper, H. J. Einsiedler, and D. Schneider, “Beyond Certificates: 6G-ready Access Control for the Service-Based Architecture with Decentralized Identifiers and Verifiable Credentials,” in 2024 Joint European Conference on Networks and Communications & 6G Summit (EuCNC/6G Summit), IEEE, 2024, pp. 830–835.

H. Dinh-Tuan, S. R. Garzon, and J. Fu, “Secure and Trustful Cross-Domain Communication with Decentralized Identifiers in 5G and Beyond,” in 2024 27th Conference on Innovation in Clouds, Internet and Networks (ICIN), IEEE, 2024, pp. 32–36.

F. Wang, S. Yang, M. Zhang, Y. Liu, Q. Zhang, and F. Tian, “DAVC: A Verifiable Credentials Model for Dynamic Attribute Management,” in 2025 IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA), IEEE, 2025, pp. 1431–1438.

N. Fotiou et al., “Continuous authorization over HTTP using Verifiable Credentials and OAuth 2.0,” in Open Identity Summit, 2022, pp. 39–50.

A. Cuzzocrea and I. Belmerabet, “Privacy-Preserving Identity and Access Management in Multiple Cloud Environments: Models, Issues, and Solutions,” in 2024 IEEE International Conference on Big Data (BigData), IEEE, 2024, pp. 6223–6229.

M. Sporny, D. Longley, D. Chadwick, and I. Herman, “Verifiable Credentials Data Model v2.0.” Available: https://www.w3.org/TR/vc-data-model-2.0/. Accessed on Apr. 1, 2026.

M. Sporny, D. Longley, M. Sabadello, D. Reed, O. Steele, and C. Allen, “Decentralized Identifiers (DIDs) v1.0: Core architecture, data model, and representations.” Available: https://www.w3.org/TR/did-1.0/. Accessed on Apr. 4, 2026.

J. C. John, A. Gupta, and S. Sural, “Secure multi-cloud collaboration using data leakage free attribute-based access control policies,” Computers & Security, vol. 161, article 104736, 2026.

J. Tian, “Zero trust anonymous access algorithm for multi cloud storage system based on CP-ABE,” Egyptian Informatics Journal, vol. 30, article 100681, 2025.

M. Bakhtina, J. Kvapil, P. Švenda, and R. Matulevičius, “The Power of Many: Securing Organisational Identity Through Distributed Key Management,” in Advanced Information Systems Engineering. CAiSE 2024. Lecture Notes in Computer Science, vol. 14663, 2024, pp. 475–491.

M. Yıldız and Ş. Bahtiyar, “A Novel Key Management Framework for Secure and Scalable Decentralized Identity Systems,” in 2024 17th International Conference on Security of Information and Networks (SIN), IEEE, 2024, pp. 1–8.

A. Alajroush, R. Latif, and T. Saba, “Trust Management Frameworks In Multi-Cloud Environment: A Review,” in 2023 Sixth International Conference of Women in Data Science at Prince Sultan University (WiDS PSU), IEEE, 2023, pp. 117–120.