  Internet of Medical Things (IoMT) deals with a patient-data-rich segment,
which makes security and privacy a severe concern for patients. Therefore,
access control is a significant aspect of ensuring trust in the IoMT. However,
deploying existing authentication and authorization solutions to the Internet
of Medical Things (IoMT) is not straightforward because of highly dynamic and
possibly unprotected environments and untrusted supply chain for the IoT
devices. In this article, we propose Soter, a Zero-Trust based authentication
system for the IoMT. Soter Incorporates trust negotiation mechanisms within the
Zero Trust framework to enable dynamic trust establishment. When a user or
device seeks access to a resource, initiate a trust negotiation process. During
this process, credentials, attributes, and contextual information are exchanged
between the requester and the resource owner. Soter defines access rules based
on various factors, including user identity, device health, and location.
Access is granted or denied based on these conditions.
