Spire-based remote attestation for secure VPN access.

Abstract

Organizations around the world have widely adopted Virtual Private Networks (VPNs) to protect internal resources from unauthorized access. However, these solutions present critical security issues, because the organization has no control over the devices accessing the VPN. Once a device or credential is compromised, it is difficult for the organization to identify the problem and remove the attacker's access. Zero Trust (ZT) solutions have emerged to address these security issues by adopting constant user and hardware verifications, as well as protection at each endpoint of the infrastructure, allowing for more granular control over access. However, migrating from traditional VPNs to Zero Trust Architectures (ZTA) can be challenging due to the significant changes required in infrastructure, access control policies, and security models. This paper proposes an intermediate solution, enhancing the authentication part of VPNs to help achieve some of the benefits of the ZT approach without the need to modify the VPN infrastructure. The proposal uses the Cloud Native Computing Foundation's open source standard, the Secure Production Identity Framework for Everyone (SPIFFE), and its reference implementation, the SPIFFE Runtime Environment (SPIRE), to build attestation-based authorization for VPN access. The paper proposes new node and workload validators for SPIRE, allowing user and machine identity to be verified before granting VPN access. SPIRE also provides automatic credential rotation, avoiding the use of long-term credentials and minimizing the impact if these credentials are stolen. Finally, the paper presents an overview of some security issues with traditional VPN authentication methods and how the proposed solution mitigates them.