Applying Zero Trust to Financial Microservices through Default Deny Authorization
DOI:
https://doi.org/10.15662/IJEETR.2023.0503010Keywords:
Zero Trust architecture, financial microservices, default-deny authorization, workload identity, tenant isolation, transaction approvalAbstract
Financial platforms often authenticate requests at an external gateway while distributing the information needed for authorization across account, holdings, reporting, and transaction services. This separation creates a persistent risk: a valid identity can reach an operation without having authority over its resource or financial effect. This article develops a default-deny authorization architecture that evaluates workload identity, represented user authority, institutional ownership, and relevant business state at the service responsible for execution. It distinguishes delegated user requests from separately approved service computations and binds sensitive approvals to the resource state actually reviewed. The design combines centralized policy governance with distributed enforcement, including tenant restrictions in queries, caches, exports, and asynchronous processing.
A payment-approval example and four financial scenarios translate the architecture into testable requirements. The analysis addresses unavailable dependencies, stale permissions, credential misuse, evidence durability, and incremental migration. A proposed evaluation compares unauthorized effects and legitimate completion alongside enforcement coverage, revocation delay, and decision overhead. The contribution is a financial-domain synthesis of established security mechanisms and an evaluation method for examining their combined behavior. The study reports no implementation results, measured performance improvement, or compliance certification.
References
[1] R. Chandramouli, Security Strategies for Microservices-based Application Systems, NIST SP 800-204. August 2019. doi: 10.6028/NIST.SP.800-204
[2] Federal Financial Institutions Examination Council, Authentication and Access to Financial Institution Services and Systems. August 2021. Official publication
[3] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, Zero Trust Architecture, NIST SP 800-207. August 2020. doi: 10.6028/NIST.SP.800-207
[4] J. H. Saltzer and M. D. Schroeder, “The protection of information in computer systems,” Proceedings of the IEEE, vol. 63, no. 9, pp. 1278-1308. 1975. doi: 10.1109/PROC.1975.9939
[5] R. Chandramouli and Z. Butcher, Building Secure Microservices-based Applications Using Service-Mesh Architecture, NIST SP 800-204A. May 2020. doi: 10.6028/NIST.SP.800-204A
[6] R. Chandramouli, Z. Butcher, and A. Chetal, Attribute-based Access Control for Microservices-based Applications Using a Service Mesh, NIST SP 800-204B. August 2021. doi: 10.6028/NIST.SP.800-204B
[7] R. Chandramouli and Z. Butcher, A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments, NIST SP 800-207A, initial public draft, April 2023. Initial public draft
[8] N. F. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, and R. Doss, “Zero Trust Architecture (ZTA): A comprehensive survey,” IEEE Access, vol. 10, pp. 57143-57179. 2022. doi: 10.1109/ACCESS.2022.3174679
[9] P. Phiayura and S. Teerakanok, “A comprehensive framework for migrating to Zero Trust architecture,” IEEE Access, vol. 11, pp. 19487-19511. February 2023. doi: 10.1109/ACCESS.2023.3248622
[10] D. Hardt, Ed., The OAuth 2.0 Authorization Framework, IETF RFC 6749. October 2012. doi: 10.17487/RFC6749
[11] N. Sakimura, J. Bradley, M. Jones, B. de Medeiros, and C. Mortimore, OpenID Connect Core 1.0 Incorporating Errata Set 1, OpenID Foundation, November 2014. Official specification
[12] V. Bertocci, JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens, IETF RFC 9068. October 2021. doi: 10.17487/RFC9068
[13] Y. Sheffer, D. Hardt, and M. Jones, JSON Web Token Best Current Practices, IETF RFC 8725, BCP 225. February 2020. doi: 10.17487/RFC8725
[14] J. Richer, Ed., OAuth 2.0 Token Introspection, IETF RFC 7662. October 2015. doi: 10.17487/RFC7662
[15] T. Lodderstedt, M. McGloin, and P. Hunt, OAuth 2.0 Threat Model and Security Considerations, RFC 6819, January 2013. doi: 10.17487/RFC6819
[16] B. Campbell, J. Bradley, N. Sakimura, and T. Lodderstedt, OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens, IETF RFC 8705. February 2020. doi: 10.17487/RFC8705
[17] N. Sakimura, J. Bradley, and N. Agarwal, Proof Key for Code Exchange by OAuth Public Clients, RFC 7636, September 2015. doi: 10.17487/RFC7636
[18] D. Feldman et al., Solving the Bottom Turtle A SPIFFE Way to Establish Trust in Your Infrastructure via Universal Identity, first edition, 2020. Official book
[19] M. Jones, A. Nadalin, B. Campbell, J. Bradley, and C. Mortimore, OAuth 2.0 Token Exchange, IETF RFC 8693. January 2020. doi: 10.17487/RFC8693
[20] Joint Task Force, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, rev. 5. September 2020. doi: 10.6028/NIST.SP.800-53r5
[21] Kubernetes Authors, Enforcing Network Policies in Kubernetes, October 2017. Official publication
[22] Cloud Native Computing Foundation, TAG Security, Cloud Native Security Whitepaper, ver. 2.0. May 2022. Official publication
[23] National Security Agency and Cybersecurity and Infrastructure Security Agency, Kubernetes Hardening Guidance, version 1.2, August 2022. Official guidance
[24] OWASP Foundation, OWASP API Security Top 10, 2019 edition. Official publication
[25] PCI Security Standards Council, Payment Card Industry Data Security Standard Requirements and Testing Procedures, version 4.0, March 2022, Requirements 7, 8, and 10. Official standard
