Zero Downtime, Zero Trust: Automating Certificate Security at Scale
DOI:
https://doi.org/10.15662/IJEETR.2023.0504010Keywords:
Zero Trust, Certificate Security, Automated Certificate Management, Machine Identity, Continuous Authentication, Zero DowntimeAbstract
The rapid rate at which cloud-native applications, microcontainers, microservices, and distributed systems are being adopted has made sure that the digital certificates have become an inevitable part of a secure communication and authentication of the services accessed. However, issuing, managing, and revocation of certificates in high-scale setups involve issues because of outages, security risks, and overheads of issuing, renewing, and rotating any certificate manually. This study proposes a zero-downtime, zero-trust architecture for automating certificate security in completely dynamic and heterogeneous IT settings. A coherent security process proposed model has automated certificate discovery, identity-sensitive issues, policy-oriented lifecycle management, static validation, auto-rotating, as well as real-time revocation. It is in a zero-trust approach that identities built on certificates are constantly validated instead of being implicitly trusted due to their location on the network or past authentication. It also offers risk-based monitoring to identify expired, misconfigured, unauthorised, or abnormal certificates and automatically take remedial measures without interfering with application services. It can be used with cloud environments, Kubernetes, service nets, APIs, and enterprise certification authorities. The effectiveness of the framework in mitigating the risks and outages of certificates is measured using security, availability, automation, and operational efficiency metrics. The proposed solution demonstrates that machine identity security can be improved with an automated, policy-controlled certificate management without necessarily taking it to the point of breaking down websites due to the dynamic nature of the digital space.
References
[1] Buck, C., Olenberger, C., Schweizer, A., Völter, F., & Eymann, T. (2021). Never trust, always verify: A multivocal literature review on current knowledge and research gaps of zero-trust. Computers & Security, 110, Article 102436. https://doi.org/10.1016/j.cose.2021.102436
[2] Teerakanok, S., Uehara, T., & Inomata, A. (2021). Migrating to zero trust architecture: Reviews and challenges. Security and Communication Networks, 2021, Article 9947347. https://doi.org/10.1155/2021/9947347
[3] Shah, S., & Kanhere, S. (2019). Recent trends in user authentication—A survey. IEEE Access, 7, 112505–112519. https://doi.org/10.1109/ACCESS.2019.2932400
[4] Shah, S. W. A., Shaghaghi, A., Kanhere, S. S., Zhang, J., Anwar, A., & Doss, R. (2020). Echo-ID: Smart user identification leveraging inaudible sound signals. IEEE Access, 8, 194508–194522. https://doi.org/10.1109/ACCESS.2020.3036486
[5] Kim, S. H., Choi, D., Kim, S. H., Cho, S., & Lim, K. S. (2018). Context-aware multimodal FIDO authenticator for sustainable IT services. Sustainability, 10(5), Article 1656. https://doi.org/10.3390/su10051656
[6] Ashibani, Y., Kauling, D., & Mahmoud, Q. (2019). Design and implementation of a contextual-based continuous authentication framework for smart homes. Applied System Innovation, 2(1), Article 4. https://doi.org/10.3390/asi2010004
[7] Mosenia, A., Sur-Kolay, S., Raghunathan, A., & Jha, N. K. (2017). CABA: Continuous authentication based on BioAura. IEEE Transactions on Computers, 66(5), 759–772. https://doi.org/10.1109/TC.2016.2622262
[8] Shahzad, M., & Singh, M. P. (2017). Continuous authentication and authorization for the Internet of Things. IEEE Internet Computing, 21(2), 86–90. https://doi.org/10.1109/MIC.2017.33
[9] Chatterjee, U., Chakraborty, R. S., & Mukhopadhyay, D. (2017). A PUF-based secure communication protocol for IoT. ACM Transactions on Embedded Computing Systems, 16(3), 1–25. https://doi.org/10.1145/3005715
[10] Huang, Z., & Wang, Q. (2020). A PUF-based unified identity verification framework for secure IoT hardware via device authentication. The World Wide Web, 23, 1057–1088. https://doi.org/10.1007/s11280-019-00677-x
[11] Braeken, A. (2018). PUF based authentication protocol for IoT. Symmetry, 10(8), Article 352. https://doi.org/10.3390/sym10080352
[12] Atlam, H. F., & Wills, G. B. (2019). An efficient security risk estimation technique for risk-based access control model for IoT. Internet of Things, 6, Article 100052. https://doi.org/10.1016/j.iot.2019.100052
[13] Ravidas, S., Lekidis, A., Paci, F., & Zannone, N. (2019). Access control in Internet-of-Things: A survey. Journal of Network and Computer Applications, 144, 79–101. https://doi.org/10.1016/j.jnca.2019.06.017
