The problem: the vulnerability of “authenticate and forget”

When we discuss securing critical infrastructure, our attention often gravitates toward strong passwords or traditional Virtual Private Networks (VPNs). However, there is a structural vulnerability in legacy network engineering that we frequently overlook: the assumption of implicit trust. Even if a system has a robust initial login process, it cannot be genuinely trusted if it operates blindly afterward. In enterprise environments, this “all-or-nothing” approach means that a single compromised credential grants an attacker lateral movement across the entire system. To guarantee true security, we require continuous verification. An infrastructure must be able to evaluate behavior in real time, long after the initial authentication has passed. Without this dynamic auditing, the Zero Trust paradigm remains a purely theoretical promise.

What do we propose in this work?

To bridge this critical infrastructure gap, we published research introducing an enhanced Software-Defined Perimeter (SDP) architecture that integrates advanced Identity and Access Management (IAM) and Intrusion Detection Systems (IDS). In short, the paper demonstrates how this new architectural design builds the necessary foundation for robust Zero Trust security through three core capabilities:

• Decentralized Verification: The framework moves away from relying on a single central controller, which often acts as a single point of failure. By equipping individual hosts with IAM capabilities (leveraging Keycloak), the system independently verifies user credentials and enforces strict Role-Based Access Control (RBAC) at every endpoint.
• Continuous Behavioral Observability: Initial authentication is not enough. We integrated the Apollon IDS to continuously monitor user and entity behavior (UEBA) throughout the session. If an authenticated user suddenly deviates from expected patterns, the system detects the anomaly and can automatically terminate the connection.
• Privacy-Preserving Infrastructure: Through the implementation of Mutual Transport Layer Security (mTLS) and Single Packet Authorization (SPA), the architecture ensures that both the client and server cryptographically validate each other before any data exchange occurs, keeping the network invisible to unauthorized entities.

The connection to trustworthy algorithms

This work addresses a core, pragmatic principle of trustworthy computing: the necessity of engineering security directly into the architectural design. Trust in a network is not established by implicit assumptions; it is built through structural Robustness and continuous Observability. This enhanced SDP framework demonstrates that to achieve true Privacy-Preserving Design and resilience against credential theft or adversarial attacks, we must replace static defenses with dynamic, algorithmically verifiable systems.

Read the full research

If you want to dive deeper into the architectural diagrams, the specific integration of the UEBA framework, or the performance evaluations across different complex network topologies, the full article has been published in the International Journal of Information Security.

👉 Read the full paper here (DOI: 10.1007/s10207-025-01099-9)