Secure enrollment token delivery for Zero Trust networks using blockchain

Abstract

Zero Trust Networking (ZTN) is a security model where no entity in a network infrastructure is trusted. The first bastion of security for achieving ZTN is to have strong identity verification. Several standard methods for assuring a robust identity exist (E.g., OAuth2.0, OpenID Connect). These standards employ the use of JSON Web Tokens (JWT) during the authentication process. However, the use of JWT for One Time Token (OTT) enrollment has a latent security issue. A JWT can be intercepted by a third party and the information of the payload can be exposed, revealing the details of the enrollment server. Furthermore, an intercepted JWT could be used for enrollment by an impersonator as long as the JWT remains active. Our proposed mechanism aims to secure the ownership of the OTT by including the JWT as encrypted metadata into a Non-Fungible Token (NFT). The mechanism uses the blockchain Public Key of the intended owner for encrypting the JWT, and the blockchain assures the JWT ownership by mapping it to the intended owner's blockchain public address. Our proposed mechanism is applied to an emerging Zero Trust framework (OpenZiti) alongside a permissioned Ethereum blockchain using Hyperledger Besu. The Zero Trust Framework provides the enrollment functionality, while our proposed mechanism based on blockchain and NFT assures the secure distribution of OTTs that is used for the enrollment of identities.