Latency-Aware Authentication

Abstract

Authentication patterns developed for web and cloud environments OAuth roundtrips, TLS handshakes, multifactor authentication challenges often assume tens to hundreds of milliseconds of permissible latency per authorization event. Industrial control environments operate on fundamentally tighter budgets. Machine vision inspection loops can run on singlemillisecond timescales; programmable logic controller (PLC) scan cycles are measured in milliseconds; realtime motioncontrol decisions may admit no perceptible authentication overhead at all. The result is a recurring industrialcontrol gap: authentication is either applied at the perimeter and absent inside the control loop, or it is grafted on with timing penalties that operators and integrators are incentivized to bypass. This paper proposes latencyaware authentication as an adaptive design discipline for industrial control environments: authentication strength is graded against operational consequence per control cycle rather than applied uniformly. The discipline complements the attackerclass security level tiers (SL1SL4) of ISA/IEC 62443 [1] with an orthogonal consequenceclass axis, and operates within the operational technology security framing of NIST SP 80082r3 [2]. The paper is grounded in the author's handson industrial vision deployment experience across food, beverage, pharmaceutical, and medicaldevice manufacturing domains, and illustrated using MILO, a patentpending adaptive AI orchestrator [3] whose preexecution gating subsystem implements the discipline in software.

Summary

Plain Language Summary. Authentication methods designed for the web typing a password, getting a textmessage code, completing an OAuth handshake assume the user has hundreds of milliseconds to a few seconds to respond. Industrial control systems running manufacturing lines, power grids, and chemical plants do not have that budget; their decisions happen in milliseconds. As a result, authentication is often pushed to the perimeter and then absent inside the control loop, or grafted on with timing penalties that operators are pressured to bypass. This paper proposes grading the strength of authentication against the operational consequence of each individual control command, so that highconsequence actions get deliberate human authorization while routine actions pass through a lightweight log. The approach composes with existing industrial cybersecurity standards rather than replacing them.

Key takeaways

• Grade authentication by operational consequence and timing budget, not by one uniform webderived control.
• Compose consequence tiers with ISA/IEC 62443 Security Levels instead of replacing them.
• Use preexecution gates so highconsequence commands can pause while lowconsequence actions stay fast.

Concept map

Sources to follow

Use these official references as starting points for the standards context in the full paper.