DistriTrust: Distributed and low-latency access validation in zero-trust architecture

Abstract

Enterprise networks typically use perimeter-based security to protect their IT resources from security threats originating from outside the enterprise perimeter. In such networks, connection requests from devices residing inside the perimeter are implicitly assumed to be trusted. However, in practice, a considerable fraction of cyberattacks emanate from inside the enterprise network making the perimeter-based trust assumption unrealistic. Zero-trust architecture (ZTA) is an emerging alternative to perimeter-based security, where each connection request for accessing an enterprise resource goes through stringent security checks and validation irrespective of the location of the requesting device. In ZTA, every connection request is authenticated and authorized by a trusted centralized component called the policy decision point (PDP) and subsequently granted (or denied) access to the requested resource. However, the centralized nature of the PDP often makes it vulnerable to various attacks such as compromise of secret keys, impersonation and denial of service. In this article, we propose DistriTrust which distributes trust across multiple PDPs using the notion of threshold signatures. However, involving multiple PDPs also increases latency. In order to keep latency as low as possible, we study different threshold signature schemes and identify a suitable scheme for DistriTrust. We also discuss the security properties achieved by DistriTrust. Finally, we analyze the asymptotic performance of DistriTrust and report the experimental results as well.