Kernel-Anchored Zero-Trust: A Sidecar-less Service Mesh for Low-Latency Financial Edge Applications
Year: 2026
Type: conference-paper
Abstract: Modern financial platforms built on microservice architectures impose sub-millisecond end-to-end latency requirements across thousands of independently deployed services. The prevailing service mesh paradigm—which relies on userspace sidecar proxies for mutual TLS termination, traffic management, and observability-introduces a structural overhead, commonly termed the "sidecar tax," that demonstrably violates the strict Service Level Agreements (SLAs) governing algorithmic trading and real-time risk systems. Sidecar designs also co-locate SPIFFE Verifiable Identity Documents (SVIDs) and their private keys within application namespaces, creating a credential-exposure vulnerability that persists through partial system compromise. This paper presents a kernel-anchored zero-trust architecture that removes userspace proxies from the data path by relocating authentication, authorization, and policy enforcement into the Linux kernel reference monitor. The design integrates eBPF socket-level redirection (sockops/sk_msg) with BPF-LSM hooks for identity-bound mandatory access control, delegates mTLS handshakes to a privileged SPIRE agent in the host namespace, and offloads bulk encryption to kernel TLS (kTLS) so that no SVID key material is ever resident in pod-accessible memory. We make explicit the scope of mesh functions covered: identity-bound mutual authentication, cryptographic key isolation, kTLS-offloaded confidentiality and integrity, and connection-lifecycle authorization spanning client-side socket_connect, server-side inet_conn_request, and per-message revalidation via socket_sendmsg with a policy-generation counter that correctly handles long-lived connections, HTTP/2 multiplexing, and gRPC streaming. Comprehensive evaluation on a 15-node bare-metal Kubernetes cluster using the DeathStarBench Social Network suite at four offered-load levels (25%, 50%, 75%, and 90% of saturation) shows a 38.2% (±1.4%) reduction in P99 tail latency at the moderate operating point, growing to 95.6% at the stressed 90%-load operating point relative to Istio. Maximum sustainable throughput increases by 60.1% (±1.8%); amortized per-pod CPU drops by 74.9% and memory by 87.9% (p < 0.05 for all primary metrics). Comparisons are also made against Istio Ambient (ztunnel) and Cilium with L7 Envoy. Security isolation is empirically validated against a compromised-container attacker model, confirming that enforcement anchored in the kernel reference monitor remains effective under container-escape scenarios.
Authors: Shrikant Sonparote, Sudhanshu Maurya
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7204441850