Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper details the design and evaluation of a cloud-native VPN-as-a-Service (VPNaaS) tailored for computing-constrained environments, enabling the orchestration of secure, on-the-fly tunnels for each tenant in Zero Trust architectures. The solution integrates seamlessly with Identity and Access Management (IAM) tools, ensuring enhanced security through fine-grained identity management and monitoring. Key findings indicate that the VPNaaS can effectively adapt to resource limitations while providing customizable key generation options, such as RSA or Elliptic Curves, to bolster security without compromising performance.
A cloud-native VPN-as-a-Service can dynamically create secure tunnels for each tenant, enhancing Zero Trust security even in resource-constrained environments.
Industry has embraced Zero Trust (ZT) architectural tenets and implementations for cloud-native environments, following stricter security requirements to both internal and external tenants. Among others, these approaches combine fine-grained identity management and monitoring for both inventorying and better analysing the devices'security posture for overall protection, along with strict separation of concerns and isolation to enforce minimal privilege. Networking-wise, ZT approaches rely as well on isolation and least privilege; enacted by separate, secure tunnels per tenant connecting to a given infrastructure. Such implementations can also be applied to the connectivity within and towards experimental infrastructures. In this sense, this work contributes the design and evaluation of a cloud-native VPN-as-a-Service (VPNaaS) that can be (i) easily orchestrated to deploy on-the-fly, separate tunnels per each tenant remotely connecting to the infrastructure; (ii) integrated with common Identity and Access Management (IAM) tools, key to ZT deployments; and (iii) adapt to computing- or entropy- constrained environments. This solution is customisable and allows, among others, to select from RSA or Elliptic Curves (EC) as key generation algorithm and their parameters to achieve more secure keys and adapt to resource-constrained environments.