Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Prezta, an innovative architecture that enhances zero-trust authorization by executing policies within a zero-knowledge virtual machine (zkVM) on client devices, thereby eliminating the need for complex application gateways. By producing succinct proofs of authorization that can be efficiently verified by edge devices, Prezta significantly reduces the deployment and management burdens associated with traditional security architectures. The implementation demonstrates a substantial reduction in prover time, achieving efficient verification suitable for resource-constrained environments while maintaining compatibility with XACML 3.0 policies.
Eliminating the need for complex application gateways, Prezta enables efficient zero-trust authorization directly at the edge, transforming security for operational technology systems.
Modernizing the security of operational technology systems that control critical infrastructure has become a pressing challenge. Because edge devices have limited capabilities, modernization has relied on application gateways that interface with identity management systems and enforce access policies. These gateways are powerful enough to perform complex authorization decisions and support zero-trust architectures, but they create major deployment and management burdens: they must be collocated with remote, distributed edge devices, kept up to date with security patches, and managed with minimal downtime. We propose Provable Remote Execution of Zero-Trust Authorization (Prezta), an architecture that eliminates these gateways by evaluating policies within a zero-knowledge virtual machine (zkVM) running on the client. The zkVM produces a succinct proof of authorization that edge devices can verify efficiently, extending the zero-trust security envelope to the edge. Policies and identity management schemes can evolve without updating edge devices. To demonstrate the feasibility of Prezta, we implement a prototype built using the RISC Zero zkVM that supports XACML 3.0 policies and JWT identity claims. While zkVMs introduce substantial proof overhead, we mitigate this overhead by compiling policies to Rust code and precompiling regular expressions. Combined with optimized signature verification and JWT parsing, these measures reduce prover time by more than an order of magnitude. Our compiler correctly implements 83\% of the XACML 3.0 conformance suite, with proof generation completing in tens of seconds on a desktop. Verification, by contrast, takes only tens of milliseconds, which is fast enough for resource-constrained edge devices.