🤖 AI Summary
This work addresses the challenge of efficiently implementing zero-trust-compliant, multi-tenant secure network connectivity in computationally or entropy-constrained environments. The authors propose and implement a cloud-native VPN-as-a-Service (VPNaaS) solution that, for the first time, integrates zero-trust network isolation capabilities with customizable cryptographic algorithms—supporting either RSA or elliptic curve cryptography. The system enables on-demand, dynamic provisioning of tenant-level isolated secure tunnels and seamlessly interoperates with mainstream identity and access management (IAM) platforms. By adhering to the principle of least privilege and enforcing strict multi-tenancy isolation, the proposed approach significantly enhances both deployment efficiency and security in resource-constrained settings.
📝 Abstract
Industry has embraced Zero Trust (ZT) architectural tenets and implementations for cloud-native environments, following stricter security requirements to both internal and external tenants. Among others, these approaches combine fine-grained identity management and monitoring for both inventorying and better analysing the devices' security posture for overall protection, along with strict separation of concerns and isolation to enforce minimal privilege. Networking-wise, ZT approaches rely as well on isolation and least privilege; enacted by separate, secure tunnels per tenant connecting to a given infrastructure. Such implementations can also be applied to the connectivity within and towards experimental infrastructures. In this sense, this work contributes the design and evaluation of a cloud-native VPN-as-a-Service (VPNaaS) that can be (i) easily orchestrated to deploy on-the-fly, separate tunnels per each tenant remotely connecting to the infrastructure; (ii) integrated with common Identity and Access Management (IAM) tools, key to ZT deployments; and (iii) adapt to computing- or entropy- constrained environments. This solution is customisable and allows, among others, to select from RSA or Elliptic Curves (EC) as key generation algorithm and their parameters to achieve more secure keys and adapt to resource-constrained environments.