Zero Trust Automation: SPIFFE/SPIRE for Identity Federation and OpenZiti in Microsegmented Networks
Year: 2021
Type: article
Abstract: As organizations adopt cloud-native infrastructure and microservices, traditional network security approaches are no longer sufficient. This paper presents an automated Zero Trust framework integrating SPIFFE/SPIRE for identity federation with OpenZiti for application-layer microsegmentation. SPIFFE provides a standard for workload identity, while SPIRE issues and manages these identities automatically in Kubernetes using X.509 certificates known as SVIDs. These identities enable secure authentication between services using mutual TLS (mTLS), enforced through the Envoy proxy. To strengthen communication security further, OpenZiti is used to segment traffic at the application level, independent of IP-based network boundaries. This allows for precise control over which services can communicate. In addition, Tetragon, an eBPF-based observability and enforcement tool, is included to monitor workload behavior and support real-time attestation. These components form a scalable, flexible solution that aligns with Zero Trust principles. This research analyses how the combined system supports secure identity management, encrypted service communication, and behavior-based policy enforcement in modern cloud environments.
Author: Sandhya Guduru
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W6968180765