electronics

Article
Zero-Trust Security Authentication Based on SPA and
Endogenous Security Architecture
Mingyang Xu 1 , Junli Guo 2, *, Haoyu Yuan 1 and Xinyu Yang 1

1 School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou 450011, China
2 ZHONGYUAN Network Security Research Institute, Zhengzhou University, Zhengzhou 450011, China
* Correspondence: guojunli@[Link]

Abstract: Zero-trust security architecture reconstructs the trust foundation of access control based
on authentication and authorization by continuously authenticating the terminal during the authen-
tication process and not relying solely on geographic location/user attributes as the sole basis for
the trust assessment. However, due to the fine-grained verification of identity under the zero-trust
security architecture, there is a need for multiple authentication and authorization processes. If a
single policy engine has unknown vulnerabilities and unknown backdoors to be maliciously attacked,
or DDOS attacks initiated by known vulnerabilities cannot be prevented, the policy engine based
on this control center architecture cannot meet the requirements of system security and reliability.
Therefore, it is proposed to apply the SPA single-package authorization and endogenous security
architecture to the zero-trust authentication system, which can realize the reliability, dynamism and
diversity of system defense. Through the experimental antiattack analysis and antiattack test, the
test from the proposed scheme found that when the system introduces the endogenous security
architecture, the security of the system can be improved due to the complexity of the attack process
and the increase in the cost of the attack. The test through both the security and system overhead
found that the scheme can effectively improve the security of the system while ensuring the quality
of network services, compared to the traditional scheme. It was found that the scheme can effectively
improve the security of the system while ensuring the quality of network services and has better
adaptability than the traditional zero-trust authentication scheme.

Citation: Xu, M.; Guo, J.; Yuan, H.;

Keywords: single packet authorization; zero-trust security; endogenous security architecture;
Yang, X. Zero-Trust Security
authentication security
Authentication Based on SPA and
Endogenous Security Architecture.
Electronics 2023, 12, 782. https://
[Link]/10.3390/electronics12040782
1. Introduction
Academic Editor: Aryya
As a new type of network security architecture, zero-trust architecture (ZTA) was
Gangopadhyay
proposed by Forrester analyst John Kindervag in 2010 [1], driving the idea of ZTA in the
Received: 12 January 2023 context of “cybersecurity isolation across location and hosting models”. In 2019, the United
Revised: 28 January 2023 States Department of Defense (DoD) released the “DoD Information Resource Management
Accepted: 2 February 2023 Strategic Plan FY19-23” [2], which prioritizes Artificial Intelligence and zero-trust security.
Published: 4 February 2023 In February 2020, the National Institute of Standards and Technology (NIST) released the
“[Link].800-207-draft2 zero-trust Architecture” [3], proposing three technical solutions
“SIM” for the zero-trust security concept: SDP (Software Defined Perimeter), IAM (Identity
and Access Management), MSG (Microsegmentation).
Copyright: © 2023 by the authors.
With the increasingly obvious weaknesses of the traditional boundary-based network
Licensee MDPI, Basel, Switzerland.
security protection architecture, domestic research on ZTA tends to increase. At the Zero-
This article is an open access article
distributed under the terms and
Trust Development Trend Forum held on 14 May 2021, the Tencent Research Institute,
conditions of the Creative Commons
Tencent Security and Gartner jointly released the white paper “Building Trust with Zero
Attribution (CC BY) license (https://
Trust—Reinventing the New Boundary of Security” [4] to help enterprises understand and
[Link]/licenses/by/ accept the zero-trust framework. The idea of zero-trust states that user roles/devices should
4.0/). not be used as fixed criteria for identity authentication and trust should not be granted

Electronics 2023, 12, 782. [Link] [Link]

Electronics 2023, 12, 782 2 of 21

implicitly. A dynamic real-time assessment of identity authentication should be conducted

based on the system state, following the principle of “Never Trust, Always Verify”. For
each authorization request of a user, identity authority and responsibility authentication
should be performed, and the user information, device information and policy information
in the database should be dynamically evaluated to grant the minimum authority required
to perform the task. In view of the characteristics of the zero-trust system, the correct and
secure authentication of identity is the key to the ZTA.
In this paper, we investigate this recent trend in the common vulnerabilities in zero-
trust authentication-based architectures. We propose an effective defense called the Mimic
Authentication Strategy System (MAS) to resolve security issues during multiple authenti-
cations. In particular, we use dynamic heterogeneous redundancy (DHR) architecture [5,6]
to refactor the zero-trust authentication architecture and use heterogeneous components
for system components to avoid the hazards of common vulnerabilities. Additionally, we
use Single Packet Authorization (SPA) to address the risk of DDOS attacks on our system.
With the MAS authentication system built, we can perform secure and effective identity
authentication and further enhance the active defense capability of the system.
Contributions. In summary, this paper proposes the following contributions:
(1) For the policy engine construction method under zero-trust authentication architec-
ture, we used heterogeneous components to realize the policy engine construction
through operating systems, web servers, databases, etc., which can avoid the hazard
of common vulnerabilities of system components.
(2) We proposed a novel authentication system, the MAS, which is based on SPA and
endogenous security architecture, to achieve a secure construction of the authentica-
tion system. The evaluation results showed that the MAS can effectively avoid DDOS
attacks and malicious attacks based on unknown vulnerabilities.
(3) We experimentally verified the feasibility of the MAS, mathematically reasoned
about the system security and provable security through attack resistance analy-
sis and demonstrated, through attack resistance testing, that the system can achieve
the goal of a security authentication system without taking up too many resources
and bandwidth.
The remainder of this paper is organized as follows: In Section 2, we provide the
background of the development of ZTA and the related work. In Section 3, we compare the
difference between MTD and the MAS. In Section 4, we analyze the problems and threat
models in the zero-trust authentication system. In Section 5, we detail the MAS architecture
and its implementation and evaluation. In Section 6, we express a safety analysis on the
proposed model improvement program, and we also test the security of the MAS in the
attack resistance test. Finally, we conclude and propose future work in Section 7.

2. Related Work
The Traditional Network Access Control (NAC) system [7] is mainly based on the
idea of border security [8,9]; zero-trust security, on the other hand, focuses on real-time
authentication [10–13]. Zero-trust security architectures are combined and used in the
Internet of Things [14–17], medicine [18] and cloud computing [19] due to the ability
to meet the current security needs in networks, and there are related studies that use
zero-trust security architectures in 6 G network architectures as well [20,21]. Some recent
studies [22–27] on cybersecurity have also discussed issues regarding network architecture
and DDOS attacks.
The Software-Defined Boundary (SDP) [28,29] as an implementation of zero-trust
security architecture is more capable of enhancing the security of the access control process
compared to the traditional NAC system [30], while the SDP is able to defend against
DDOS attacks [31,32] for the infrastructure. Among the issues considered in zero-trust
security architectures, a dynamic evaluation of trust [33] and the proper authentication of
identity [34] are the most important, but with existing architectures, due to the fine-grained
authentication of identity, the system can be subject to DDOS attacks based on known
Electronics 2023, 12, 782 3 of 21

vulnerabilities or malicious attacks based on unknown vulnerabilities. The RTPM protocol

is used to extend session security beyond the authentication phase, combining techniques
such as Artificial Intelligence (AI) [35] to optimize the authentication scheme.
Ferretti et al. [36] studied the application of Byzantine Fault Tolerance (BFT) techniques
to the construction process of zero-trust system components. The idea is innovative but
does not take into account the common vulnerabilities between system components. Our
previous paper [37] proposed to use the DHR architecture in a zero-trust architecture, but
since the system did not make a defense scheme against DDOS attacks and also did not
modify the authentication specific process, it could be subject to malicious attacks, which is
the starting point of the work proposed in this paper.

3. MTD Defense Method Compared with MAS

Moving target defense (MTD) is a theory and method proposed by the National
Science and Technology Council based on the ideas of dynamization, randomization and
diversification to transform the existing information system defense defects. Its core
idea is dedicated to building a dynamic, heterogeneous and uncertain cyberspace target
environment to increase the attacker’s attack difficulty and to counter cyber attacks with
the randomness and unpredictability of the system.
Network hopping as a defense method to effectively resist active scanning is one
of the key technologies to achieve moving target defense. The use of protocol codes,
configurations and states such as IP addresses and ports, operating system fingerprints and
other information, to achieve the continuous and dynamic transfer of the network attack
surface of the protected system to lure, confuse and obfuscate the detection of attackers,
increases the difficulty of exploiting vulnerabilities and backdoors, increases the difficulty
and cost of attacks and achieves the purpose of securing the target system. However, there
are some problems with the existing network hopping technology:
• A lack of awareness of malicious scanning strategies by the hopping mechanism leads
to blindness in the selection of hopping defense strategies;
• The poor effectiveness of hopping defense due to limited hopping space and a fixed
hopping period;
• The poor availability and scalability of network hopping defense due to a lack of
constraints on hopping implementation and high deployment complexity.
Mobile Target Defense implements security policies at the system and software levels
and achieves multilevel active changes to the network system in a defender-controllable
manner through network hopping to achieve security defense.
The MAS is based on the mimetic network system and dynamic heterogeneous re-
dundancy building in many aspects of the network architecture, key devices and protocol
system to achieve multistructural redundancy not only at the software level but also at the
hardware architecture level, thus greatly increasing the difficulty for attackers to reach the
attack surface and penetrate the execution components and thus nonlinearly and greatly
improving the defense capability in the cyberspace.

4. Threat Models and Attack Scenarios

In an authentication system, an attacker wants to gain unauthorized access to some
resources of the target system, such as information stored by users in a database or in a
signature key. In the current real-world attack scenario and environment considered by
the zero-trust model, the attacker may be an external threat that does not own a device
registered in the device inventory (identity database) or registered in the user/group
database. The attacker could also be an internal threat [36], such as a disgruntled employee
or a malicious infiltrator social worker who exploits their own identity peculiarities to
directly bypass the border protection device and attack the policy engine and who owns a
managed device that is registered in the device inventory and is registered in the user/group
database. At the same time, there are unknown loopholes in the system itself, and the
system designer may have reserved system backdoors for some reason. These situations can
 tabase. The attacker could also be an internal threat [36], such as a disgruntled employee
or a malicious infiltrator social worker who exploits their own identity peculiarities to
directly bypass the border protection device and attack the policy engine and who owns
a managed device that is registered in the device inventory and is registered in the
user/group database. At the same time, there are unknown loopholes in the system itself,
Electronics 2023, 12, 782 4 of 21
and the system designer may have reserved system backdoors for some reason. These
situations can no longer be defended against based on traditional authentication security
defenses, and they need to be analyzed for the security of authentication and authoriza-
no longer
tion be defended against based on traditional authentication security defenses, and
components.
they need
Whentoan be attacker
analyzedgains
for the security
access of authentication
to trusted and authorization
devices inside components.
the system, there can be a
When
variety an attacker
of threats, such gains accessauthorization
as frequent to trusted devices inside
requests thepolicy
to the system, therefor
engine can be a
a short
variety of threats, such as frequent authorization requests to the policy
period of time through these machines as a springboard, producing an effect equivalentengine for a short
period of time
to a DDOS through these
(Distributed Denialmachines as a springboard,
of Service) producing
attack and resulting in aan effect policy
system equivalent
formu-to
alation
DDOSfailure.
(Distributed Denial of Service) attack and resulting in a system policy
As a single sign-on authentication system, an attacker may bypass any au- formulation
failure. As a single
thentication sign-on authentication
and authorization system, an attacker
logic by compromising may bypass any
the confidentiality authenti-
of the single
cation
sign-onand authorization
signature logicallows
key, which by compromising
the attacker to the confidentiality
sign of the token
any authentication single andsign-on
thus
signature key, which allows the attacker to sign any authentication token and
simulate an already registered user while simulating access to the proxy server’s device. thus simulate
an already
When registered
an attacker user whileattacked
successfully simulating access to the
or mimicked theproxy
accessserver’s
proxy device.
or policyWhen an
engine,
attacker successfully attacked or mimicked the access proxy or policy engine, they
they can then control the verification process of the single sign-on signature key, resulting can then
control theinverification
in errors the systemprocess of the single
authentication sign-on signature key, resulting in errors in the
service.
system authentication service.
5. Mimic Authentication Strategy System
5. Mimic Authentication Strategy System
5.1. System
5.1. System Architecture
ArchitectureDesign
Design
The MAS
The MAS isisan
animprovement
improvement in in the
thepolicy
policyengine
engine in inthe
theoriginal
original zero-trust
zero-trustsecurity
security
architecture. The
architecture. The principle
principle of
of the
the transformation
transformation is is to
to introduce
introducean anauthentication
authenticationsystem
system
basedon
based onDHR
DHRarchitecture
architecture[6][6]and
and then
then heterogenize
heterogenize thethe policy
policy engine
engine andand trust
trust evalua-
evaluation
tion database
database in thein the zero-trust
zero-trust authentication
authentication architecture
architecture to increase
to increase the dynamism,
the dynamism, het-
heterogene-
erogeneity, diversity and randomness of the system. Through the
ity, diversity and randomness of the system. Through the heterogeneous processing of the heterogeneous pro-
cessingengine,
policy of the the
policy engine,
problem of the
commonproblem of common
vulnerability vulnerability
collaborative collaborative
attacks attacks
that frequently
that frequently
occur occur in the
in the homogeneous homogeneous
architecture architecture
is solved. Throughisthe solved. Through
collective the collective
verification mech-
verification
anism mechanism
of multi-PE ofsignature
for the multi-PE for keythe signature
in the single key in the
sign-on single sign-on
system, system, the
the confidentiality
confidentiality
of of the entire authentication
the entire authentication process isThe
process is guaranteed. guaranteed.
integrityThe integrity
of the of the
specific spe-
system
cific system is
architecture architecture is shown
shown in Figure 1. in Figure 1.

[Link]
Figure MASarchitecture.
architecture.

The
TheMAS
MASuses
usesSingle
SinglePacket
PacketAuthorization
Authorizationto toaccess
accessthe
thecontrolled
controlleddevices
devicesunder
underthethe
zero-trust
zero-trust authentication system. According to the analysis of the attacker’s behavior in
authentication system. According to the analysis of the attacker’s behavior in
Section 3, when an attacker uses a trusted device inside the system as a jump
Section 3, when an attacker uses a trusted device inside the system as a jump server, fre-server, fre-
quently
quentlysending
sending resource requests
resource to thetopolicy
requests engine, engine,
the policy it will affect the real-time
it will affect thebandwidth
real-time
and connectivity of the system, which is often referred to as a DDOS attack. The problem
of first packet trust is to consider how to allow only trusted connections and discard all
other connections without responding to any unauthenticated data packet, which is usually
solved by preauthentication. As shown in Figure 2, the port knockdown daemon is used
for the real-time management of open ports, and port knockdown is required for service re-
quests before each user makes a service request. SPA is a lightweight security protocol [38]
that verifies the identity of a device or user before allowing access to the network on which
the relevant system components such as controllers or gateways reside. Under the SPA
protocol, various applications and network services are hidden behind the system firewall.
The firewall defaults to discard all incoming unauthenticated TCP and UDP packets and
 quired for service requests before each user makes a service request. SPA is a ligh
security protocol [38] that verifies the identity of a device or user before allowin
to the network on which the relevant system components such as controllers or g
reside. Under the SPA protocol, various applications and network services are hid
Electronics 2023, 12, 782 5 of 21
hind the system firewall. The firewall defaults to discard all incoming unauthe
TCP and UDP packets and does not respond to unconfirmed connection attem
potential
does attackers
not respond inside and
to unconfirmed outsideattempts.
connection the system, they can
For potential only access
attackers the reques
inside and
vice application
outside the system, after theonly
they can firstaccess
packettheauthorization verification
requested service application because they cann
after the first
packet authorization verification because they cannot
which ports of the system service are open or listened [Link] which ports of the system
service are open or listened to.

Figure
Figure 2. 2. Port
Port Knocking.
Knocking.

The zero-trust authentication architecture is mainly composed of a policy execution

The zero-trust
component, authentication
a policy engine, architecture
a trust engine and is mainly
a data storage composed
system. As of a policy
shown in Figure 3, ex
component,
the a policy completes
MAS implementation engine, apermission
trust enginegrantand a data storage
determination system. Astheshown i
by heterogenizing
3, theengines
policy MAS implementation completes
by using different hardware andpermission grant determination
software to constitute by heterog
the access control
engines with the same authorization verification function; additionally, it also
the policy engines by using different hardware and software to constitute the acc evaluates
trust levels based on different database information. For resource applications submitted
trol engines with the same authorization verification function; additionally, it als
by users, the heterogeneous policy engines use:
ates trust levels based on different database information. For resource applicatio
• Different authentication methods;
•mitted by users, the
A heterogeneous heterogeneous
operating policy engines use:
environment;
•• Different databases;
Different authentication methods;
• Different scoring weights for policy development;
• A heterogeneous operating environment;
• The difference in the syntax of the establishment policy engine.
• Different databases;
In the process of designing the heterogeneous authentication policy engine, by choos-
• different
ing Different scoring
operating weights
systems such for policy development;
as Windows, Centos, Ubuntu, etc., the system ser-
• The difference in the syntax of the establishment
vice software runs different web server software policy engine.
such as Apache(Apache version 2.4,
Brian Behlendorf: Urbana Champagne, US)), Nginx(Nginx version 1.12.2, Igor Sysoev:
Russia), IIS(IIS version 10.0, Microsoft: Redmond, US)), etc., and uses different com-
piled/interpreted languages such as C/C++, JAVA, Python and Golang to implement
different writing methods to execute programs with the same function; then, it selects
different compilers and diverse compilation methods to perform heterogeneous processing
from the aspect of the operating environment, increasing the difficulty of performing a
system analysis on the heterogeneous policy engine while disrupting the malicious attacker
from detecting the system information which, in the attacker’s view, is in a state of dynamic
change. Since different software and hardware are used to build the authentication policy
engine, the possibility of attackers using common vulnerabilities to carry out coordinated
Electronics 2023, 12, 782 6 of 21

Electronics 2023, 12, x FOR PEER REVIEW 6 of 21

attacks is greatly reduced, and the backdoor problem of unknown vulnerabilities that may
exist in the system design process is solved.

[Link]
Figure Heterogeneousaccess
accesscontrol
controlengine.
engine.

In the the
When process
userof designing
group the heterogeneous
database is compromised authentication
and leaked by policy engine, by
a malicious choos-
attacker,
ing different operating systems such as Windows, Centos, Ubuntu,
personal information such as passwords stored by the user will be stolen. At the same time, etc., the system service
software
the attackerruns
can different web servercontrolled
add the user/device software by such as Apache(Apache
himself to the legitimateversion
database,2.4,which
Brian
isBehlendorf:
convenientUrbana
for bypassing the system
Champagne, US)),authentication
Nginx(Nginx logic next
version [Link]
1.12.2, TheSysoev:
heterogeneous
Russia),
database is used10.0,
IIS(IIS version in the MAS as the
Microsoft: source of
Redmond, authentication
US)), etc., and uses information
different for the system,
compiled/inter-
and database
preted management
languages systemsJAVA,
such as C/C++, such asPython
MySQL(MySQL
and Golang version 8.0, Michael
to implement Widenius:
different writ-
Sweden),
ing methods Oracle(Oracle version 19c,
to execute programs withLarry
the Ellison: State ofthen,
same function; California,
it selectsUS) and DB2(DB2
different compil-
version
ers andDB2 Express
diverse Edition, IBM:
compilation US) are
methods used as heterogeneous
to perform heterogeneousdatabaseprocessingservice
from sets
theand
as-
provide APIs (Application Programming Interfaces) for multiple programming
pect of the operating environment, increasing the difficulty of performing a system anal- languages
to facilitate
ysis on the the system management
heterogeneous [Link] disrupting the malicious attacker from de-
policy engine
In the
tecting the MAS
system implementation,
information which, the heterogeneous
in the attacker’s policy
view, engine
is in aestablishes digital
state of dynamic
portraits
change. Since different software and hardware are used to build the authenticationverify
for users by implementing different user role authentication methods to policy
the user’sthe
engine, identity moreofaccurately
possibility attackers and
using quickly
common andvulnerabilities
provide resource application
to carry services.
out coordinated
Multiple
attacks isheterogeneous
greatly reduced, bodies
and use different authentication
the backdoor problem of unknown methods, which include
vulnerabilities a one-
that may
time password, dynamic password
exist in the system design process is solved. authentication and multifactor authentication to verify
user identity
When the fromuserdifferent perspectives
group database and ensure avoiding
is compromised and leaked thebyrisk
a of online trawling
malicious attacker,
attacks that exist with single password authentication.
personal information such as passwords stored by the user will be stolen. At the same
time,The
theidentity
attackerauthentication evaluationcontrolled
can add the user/device system under the ZTA
by himself performs
to the a single
legitimate trust
database,
level evaluation for the information fed back from the database,
which is convenient for bypassing the system authentication logic next time. The hetero- which has the risk of
implicit trust. The MAS implementation avoids policy bias by changing
geneous database is used in the MAS as the source of authentication information for the the scoring weight
of different
system, andheterogeneous
database management executors for thesuch
systems policy, as shown in theversion
as MySQL(MySQL following
8.0, Table
Michael 1
according to the different behaviors of users:
Widenius: Sweden), Oracle(Oracle version 19c, Larry Ellison: State of California, US) and
1.DB2(DB2
Different scoring
version weighting
DB2 Expressmechanisms
Edition, IBM: for the
US)same type of
are used asrequest authorization
heterogeneous behavior;
database ser-
[Link] Different scoring weighting mechanisms for different types of request
sets and provide APIs (Application Programming Interfaces) for multiple program- authorization behaviors;
[Link]
languages syntax for building
to facilitate policymanagement
the system engines. data.
In theon
Based MAS theimplementation,
MAS architecture the heterogeneous
proposed above,policy engine
the system establishes
operation digital por-
framework is
shown in Figure 4. The system is controlled by the policy engine heterogeneous
traits for users by implementing different user role authentication methods to verify the layer, the
executive information
user’s identity adjudication
more accurately and
and feedback
quickly andlayer and the
provide trust evaluation
resource applicationlayer.
services.
Multiple heterogeneous bodies use different authentication methods, which include a
one-time password, dynamic password authentication and multifactor authentication to
verify user identity from different perspectives and ensure avoiding the risk of online
trawling attacks that exist with single password authentication.
The identity authentication evaluation system under the ZTA performs a single trust
level evaluation for the information fed back from the database, which has the risk of
 Factor Behavioral Elements Score Security Level
Login and query times 60 Medium
Access to sensitive servers 85 High
Number of guesses for username/password 80 Medium high
Electronics 2023, 12, 782 Modify file permissions 85 7 of 21
High
Policy Number of port scans 80 Medium high
Number of leapfrog operations 95 Very high
Table 1. Diversity policy engine.
Number of threads created 60 Medium
Factor Change
Behavioral system settings Score
Elements 90 Security Level
Very high
Continuous authentication
Login and query times failures
60 85 Medium High
Access to sensitive servers
Writing Language 85 Compiler High
Efficiency Score
Number of guesses for
C/C++ 80 GCC Medium high85
Language username/password
Policy Java
Modify file permissions 85 Eclipse High 80
Number of port scans
Python 80 PyCharmMedium high75
Number of leapfrog
95 Very high
operations
1. Different scoring weighting
Number of threadsmechanisms
created for the
60 same type of request
Medium authorization
behavior; Change system settings 90 Very high
2. Continuous
Different scoring authentication
weighting mechanisms for different types of request
85 Highauthorization
behaviors; failures
3. Different syntaxWriting Language
for building policy [Link] Efficiency Score
C/C++ GCC 85
Language
Based on the MAS architecture proposed above, the system operation
Java Eclipse 80 framework is
shown in Figure 4. The system
Pythonis controlled by the policy engine heterogeneous
PyCharm 75 layer, the
executive information adjudication and feedback layer and the trust evaluation layer.

[Link]
Figure Mimicauthentication.
authentication.

5.2.
[Link]
CertificationProcess
ProcessAnalysis
Analysis
The workflow of the MAS implementation is shown in Figure 5. When a user submits
a resource request, the controlled device first uses single-package authorization to verify
the user’s device identity and then sends the request to the access proxy after passing the
verification. The access proxy serves as a reverse proxy server and forwards the user request
to the service queue of the heterogeneous policy engine in the system. Each heterogeneous
executor uses the identity authentication method formulated in advance to authenticate
the user and returns the result to the consistency adjudicator for judgment and allocates
the resources requested by the user after passing the verdict.
 a resource request, the controlled device first uses single-package authorization to verify
the user’s device identity and then sends the request to the access proxy after passing the
verification. The access proxy serves as a reverse proxy server and forwards the user re-
quest to the service queue of the heterogeneous policy engine in the system. Each hetero-
geneous executor uses the identity authentication method formulated in advance to au-
Electronics 2023, 12, 782 8 of 21
thenticate the user and returns the result to the consistency adjudicator for judgment and
allocates the resources requested by the user after passing the verdict.

Figure 5. Authentication
Figure 5. Authenticationprocess.
process.

After the heterogeneous policy engine has processed the user authentication process,
the results of each executor are sent to the response consistency adjudicator for adjudication,
and a suitable adjudication scheme is selected according to the user’s historical personal
behavior, such as large number adjudication, consistency comparison, weight judgment
and iterative judgment methods. After the adjudicator adjudicates the results of each
heterogeneous executor, if the user request verification is passed, the resource will be
 6. Experiment Analysis
6.1. Attacker–Defender Game Analysis
Electronics 2023, 12, 782 For user data, when attackers exploit database data from different 9 of 21 sou
pletely deleted data are leaked, or the data backup file system is attacked,
the loss of critical system data. The security threat transfer is a stochastic p
allocated to the controlled device, which forwards it to the requesting user, and if the user
can be modeled as a Markov chain (MC) for attack state transfer analysis. T
identity verification fails, the resource request will be rejected.
an MC is that the probability of state transition at the current moment de
[Link]
Experiment
state at Analysis
the previous moment. In security analysis, the probability of tran
6.1. Attacker–Defender Game Analysis
the current executor state to other states depends on the type and number
For user data, when attackers exploit database data from different sources, or incom-
ties indeleted
pletely the current state, as
data are leaked, well
or the asbackup
data the number
file systemofiscommon
attacked, itattack
may leadvulnerabi
to
theloss
the attacker
of criticalrelies.
system data. The security threat transfer is a stochastic process, which
can be modeled
Modeling as a Markov
from the chain (MC) for attack
attacker view,state
thetransfer analysis. of
probability Thetransitioning
core idea of fro
an MC is that the probability of state transition at the current moment depends only on the
state to another depends on the presence of vulnerabilities in the current
state at the previous moment. In security analysis, the probability of transitioning from the
attacker
current attempts
executor state toto transition
other fromonthe
states depends thesystem
type andprotected state P to the at
number of vulnerabilities
in the current state, as well as the number of common attack vulnerabilities on which the
and finally to the system failure state E . Figure 6 depicts the modeling of s
attacker relies.
as Markov
Modeling models with state
from the attacker view,transfer probabilities.
the probability The from
of transitioning attacker attacks the
one system
state
systemto another
to makedepends on the presence
it transition of vulnerabilities
from the protected in thestate P state,
current to theandattacked
the
attacker attempts to transition from the system protected state P to the attacked state A
and finally to the
probability , while
system the
failure state
state A may
E. Figure return
6 depicts to the of
the modeling state P threats
security by theasinstant
Markov  of the
bility models protective
with state transfermeasures or The
probabilities. further transition
attacker attacks theto the failure state
authentication
taneous probability  . In order to facilitate the analysis, this process is de
system to make it transition from the protected state P to the attacked state A with a
probability α, while the state A may return to the state P by the instantaneous probability δ
of the protective measures or further transition to the failure state E with instantaneous
mimic defense Markov game model, which can define a quintuple
probability β. In order to facilitate the analysis, this process is described by the mimic
C, S ,
defense Markov
able for game model,
the game whichof
analysis can define
the MAS.a quintuple {C, S, ψ, P, W } suitable for the
game analysis of the MAS.

Figure 6. State transition.

Figure 6. State transition.
i represents malicious attackers and system defenders in the authentication system.
S = {S0 , S1 · · · Si , Si+1 } are possible states during the attack and defense of the sys-
i represents malicious attackers and system defenders in the authenti
tem, S0 is the initial state of the system and each state transition is only related to the
S = S , S
previous state.
0 1 S ,S 
i i +1 are possible states during the attack and defe
ψ = {ξ, ϕ} is the probability set of actions taken by both the attacker and the defender,
ξtem, S 0 is the initial state of the system and each state transition is only
i ( a ) denotes the probability that a malicious attacker in the system takes an action a in
state i and ϕi (d) denotes the probability that the defense system in the system takes action
dprevious
in state i. state.
 =  , 
P = P1 , P2 · · · Pi , Pi+1 is a complete transition process of a single executor from
is the probability set of actions taken by both the attack
state P to state E and Pi denotes the transition process probability of an attacker breaking

 (a)
the transition process of multiple executors at a time. Pi,j 1 denotes the complete transition
fender, i
process of a single
denotes the probability that a malicious attacker in the syste
executor system from path i to j state from P to E.

tion
the i
a in state and i
system.  (d )
W = {W1 , W2 · · · Wi , Wi+1 } → is the combination of executor service sets available to
denotes the probability that the defense syst
tem takes action d in state i.
Electronics 2023, 12, 782 10 of 21

Given the policy combination {ξ, ϕ} and instantaneous probability ξ i ( a) = ηi ,

ϕi (d) = λi , the state transition probability of the Markov chain can be expressed as the
following formula:

Pi,j = P Sq+1 = S j Sq = Si = ∑ Pi,j ( a, d)ξ i ( a) ϕi (d) = ∑ Pi,j ( a, d)ηi λi


(1)

The best case of the game between attacker and defender under the MAS is defined as:
 
SRd = ζ ∗d : minmaxU d ζ h , ζ d = argmaxU d (ξ i ( a), ϕi (d)) (2)
ζh ζd ζd

where SRd denotes the best case of the attacker–defender in the current state of the system,
ζ h denotes the measures taken by the malicious attacker and ζ d denotes the measures taken
by the system defender.
In the process of system state transition from i to j, the multistep probability formula is:
m+n
Pi,j (m + n) = Pi,j = ∑ Pi,km Pk,jn (3)

For the existence of multiple vulnerability exploitation paths in a single executor,

there are multiple attack paths from the protected state P to the attacked state A, and the
transition formula is:
∑ j vij ∑ j vij
αi = ∗ ξ i ( a ) ϕi ( d ) = ∗α (4)
∑t,l vtl ∑t,l vtl
The transition formula from state A to state E is:
∑ j vij
β ik = ∗ βk (5)
∑t,l vtl

From this, it can be calculated that the state transition formula of the system under a
single executor is:
Psystem = Pi,j = ∑ Pi,j ( a, d)ηi λi = ∑ αi β ik (6)
i

The failure rate of the system in the case of a single executor obeys the exponential
distribution of the failure rate λ. With the progress of the attacker’s attack process and the
in-depth understanding of the system information, the probability of a successful attack
leading to system failure gradually converges to one. λ indicates the attacker’s attack
strength, and when the attacker launches a targeted attack with a strong attack capability,
the value of λ is larger and the system failure rate is higher. The system failure rate can be
expressed as:
PInvalid = 1 − e−λt (7)

6.2. Safety Gain Analysis

In this paper, the number of public vulnerabilities of 10 mainstream operating systems
in the past 12 years is counted from the CVE (Common Vulnerabilities and Exposures)
of each system’s vulnerability records. From the comparison of the data in Figure 7, one
can see that for the Linux system kernel release version, the Debian system and Red-
hat system were largely different from the Linux system version, whereby the number
of common vulnerabilities was less. It can be seen that for homogeneous/homologous
systems, the likelihood of common vulnerabilities was higher, and the risk of being at-
tacked by malicious attackers was greater. For heterogeneous operating systems, the
number of public vulnerabilities was relatively low due to different system CPU schedul-
ing management, different memory-based space allocation management procedures and
different device drivers, which can effectively avoid malicious attacks caused by common
vulnerability attacks.
 of common
ment, vulnerabilities
different was less.
memory-based It can
space be seen that
allocation for homogeneous/homologous
management sys- de-
procedures and different
tems, the likelihood of common vulnerabilities was higher, and the risk of being attacked
vice drivers, which can effectively avoid malicious attacks caused by common vulnerabil-
by malicious attackers was greater. For heterogeneous operating systems, the number of
ity attacks.
public vulnerabilities was relatively low due to different system CPU scheduling manage-
Electronics 2023, 12, 782
ment, different memory-based space allocation management procedures and different de-
11 of 21
vice drivers, which can effectively avoid malicious attacks caused by common vulnerabil-
ity attacks.

Figure 7. Common vulnerability statistics.

In a single-executor system, there is a high probability of a common vulnerability in

Figure
Figure [Link]
Common
the system’s vulnerability
executors. statistics.
However,
vulnerability in the MAS, due to the introduction of multiple hetero-
statistics.
geneous executor components, the attacker needs to conduct a coordinated attack against
In aa single-executor
In single-executor system, there isisaahigh
highprobability ofofa common vulnerability in
multiple executors. The system,
executorthere
attack chain probability
in the MAS is a common
shown vulnerability
in Figure 8. When the
thethe
in system’s
system’s executors.
[Link], in theinMAS,
However, due todue
the MAS, the to
introduction of multiple
the introduction hetero-
of multiple
attacker executor
geneous
heterogeneous successfully transfers
components,
executor from
the
components, theattacker
attacker
the protected
needs to state
conduct
needs Pa1 coordinated
to conduct attack1against
of thea coordinated
executor to the fault
attack
multiple executors.
state Emultiple
against The executor
executors. attack chain
The executor in the
attack chainMAS in is
theshown
MAS in is Figure
[Link]
Figure the
8.
1 , it cannot directly pass the authentication system, but needs to go through the
When thesuccessfully
attacker successfully transfers from the protected state P 1 of the executor 1 to the
attacker transfers from the protected
next step to destroy other associated executors to achieve state P of the executor 1 to the
1 the purpose of system intrusion. fault
fault state E1 , it cannot directly pass the authentication system, but needs to go through the
state E1 , it cannot directly pass the authentication system, but needs
Considering the random scheduling strategy of heterogeneous executors and the the
to go through random
next step to destroy other associated executors to achieve the purpose of system intrusion.
target
next selection
step to destroyof attackers to attack,
otherscheduling
associated we analyzed
executors thethe
state of theof executors:
Considering the random strategy oftoheterogeneous
achieve purpose
executors system
and theintrusion.
random
Considering
target selection theofrandom
attackersSecurity status group P = P , P P , P
scheduling
to attack, strategy
we of heterogeneous
analyzed
target selection of attackers to attack, we analyzed the state
the
1 of
state of
n −1 n
executors
the
2 the executors:  and the random
executors: 
Security
Attackedstatus
stategroup = =P1 ,AP12, A2Pn −1A
Security status group P = { P1 , P2 · · · Pn−1 , Pn }
groupP A , Pnn−1, An 
Attacked state group A = { A1 , A2 · · · An−1 , An }
Attacked state group A =  A , A A ,A  
Failure
Failure statestate
group E = { EE1 ,=
group E21·E· 1·,2EE2 1 , EE
n−
n −1 n, E
n }n −1 n

Failure state group E = E1 , E2 En−1 , En 

Coordinated Attack

State Transfer 1 State Transfer 2 State Transfer n

Coordinated Attack
Execution Body 1 Execution Body 2 Execution Body n
State Transfer 1 State Transfer 2 State Transfer n
Protected state P1 Protected state P2 Protected state Pn
Execution Body 1 Execution Body 2 Execution Body n

Protected
Attackedstate
stateP1
A1 Protected statestate
Attacked P2 A2 Protected state Pn state An
Attacked

Attacked state A1 Attacked state A2 Attacked state An

Fault state E1 Fault state E2 Fault state En

Fault state E1 Fault state E2 Fault state En

Threat Propagation

Threat Propagation
[Link]
Figure Common vulnerability
vulnerability exploitation.
exploitation.
Figure 8. Common vulnerability exploitation.
The state of the system with the executor number 1 in the case of an attacker’s attack
is S1 = P1 | A1 | E1 , from which the overall state of the system can be obtained:

S∗ = {S1 , S2 · · · Sn−1 , Sn } = { P1 | A1 | E1 , P2 | A2 | E2 · · · Pn−1 | An−1 | En−1 , Pn | An | En } (8)

From the analysis in Section 6.1, the probability of a single executor i from the protected
state Pi to the fault state Ei is:
PSi = ∑ αi β ik (9)
i

The probability of the system being breached after introducing the MAS idea can be
expressed as:
   
∑l CVSS(κ ) ∑l CVSS(κ )
PWl ∏l PSl − i=1 SCR i PWl ∏l ∑l αl β lk − i=1 SCR i
l l
PSecurity = l
= l
(10)
Am Am
∑ ti ∑ ti
Electronics 2023, 12, 782 12 of 21

PSecurity indicates that after the introduction of the idea of the MAS, since a hetero-
geneous policy engine is used to form the system authentication executor, the attacker
needs to complete a series of single-step attacks on the executor PSl and then complete the
sequence attack effect. It needs to be consistent with the executor service set PWl currently
selected by the system. CVSS(κi ) indicates that according to the Common Vulnerability
Scoring System (CVSS) in the National Vulnerability Database (NVD), the calculated vul-
nerability score, SCRl , indicates the normalized sum value of the system vulnerability score
in the range of 0.0–10.0.
Therefore, it can be seen from the above analysis that after the introduction of the
heterogeneous policy engine, the security gain of the system is

1 − PSecurity 1 − PSecurity 1 − PSecurity

σsecurity = = = (11)
1 − min PSi 1 − PInvalid e−λt
1≤ i ≤ n

6.3. Experiment Environment

The verification method of this experiment uses the physical machine deployment
experiment, the SPA tool FWKNOP to perform port knocking (PK), the Nginx reverse
proxy service to forward the authorization request service, the Docker container technology
to build the heterogeneous policy engine service pool, and an algorithm to make output
judgments to complete the entire request process.
The advantages of using these tools/techniques are as follows:
• FWKNOP, as an open-source and mature tool for single-packet authorization and port
probe, is used to hide system services. By encrypting a single data packet, replay
attacks are avoided and the authentication credentials are hash encoded (MD5, SHA-
256, SHA-512, etc.), so to authenticate via HMAC, the workload needs to do less than
a single-decrypt SPA packet. At the same time, the server side of FWKNOP acts as
a front-end proxy under the whole system, blocking all service traffic that has not
been authorized by a single package, preventing the system from being damaged by
DDOS attacks;
• As a free, open-source, high-performance HTTP server and reverse proxy server,
Nginx can realize the function of service request forwarding and the load balancing
effect by setting the Nginx configuration file. Compared with the forward proxy, the
deployment location of the reverse proxy server is closer to the source server, which
makes it easier to control and centralize permissions;
• Docker, as an open-source application container engine, adopts the sandbox mech-
anism, and each container is independent of each other without any interface. The
performance overhead of containers is extremely low and it is simple and easy to use
compared to VMware or VirtualBox. The image shared by the Docker community is
very easy to use to deploy containers, and it can be built locally, deployed to the cloud
at any time and can be run anywhere. At the same time, it is very convenient to man-
age Docker containers using container cluster management tools such as Kubernetes,
Docker Swarm and OpenShift.

6.4. Experiment Procedure

6.4.1. System Information
The topology of this experimental system is shown in the following Figure 9:
First, the client ([Link]) uses SPA single-packet authorization and authentica-
tion, sends an access request to the controlled device ([Link]), which forwards the
message to the access proxy ([Link]). The access proxy processes the access request,
and the message backup refers to the [Link] f configuration file in the access agent
Nginx server for message distribution and sends it to the heterogeneous policy engine
([Link]-27) composed of the Docker container pool, and the Docker container pool
host IP is [Link]. Among them, the heterogeneous policy engine realizes the purpose
of the heterogeneous system executor through the difference in the software stack composi-
 performance overhead of containers is extremely low and it is simple and easy to use
compared to VMware or VirtualBox. The image shared by the Docker community is
very easy to use to deploy containers, and it can be built locally, deployed to the
Electronics 2023,cloud
12, 782 at any time and can be run anywhere. At the same time, it is very convenient13 of 21
to manage Docker containers using container cluster management tools such as Ku-
bernetes, Docker Swarm and OpenShift.
tion. After that, each heterogeneous policy engine performs a trust evaluation by accessing
the system database according to its own developed scoring mechanism and sends the
6.4. Experiment Procedure
respective evaluation results to the adjudicator ([Link]). Finally, the adjudicator
6.4.1. System Information
makes a consensus decision based on the majority voting algorithm and feeds back the
decision
The topology of result to the controlled
this experimental system device, andin
is shown then
thethe controlledFigure
following device 9:
responds to the
client with a resource response.

Figure 9. System topology.

Figure 9. System topology.

When the user creates an authentication/authorization request, the request is sent

First, the clientto([Link]) uses SPA single-packet authorization and authenti-
a controlled device with a trust certificate, and the controlled device uses the private
cation, sends an access key skrequest to the controlled device ([Link]), which forwards
MD to sign and generate a signature σMD . Then, it sends the user request requ and
the message to the the access proxy
signature σMD([Link]).
together to theThe accessaccess
proxy,proxy
and theprocesses theisaccess
access proxy re- for
responsible
forwarding it to the heterogeneous policy engine (HPE)
quest, and the message backup refers to the [Link] configuration file in the access for authentication. The HPE verifies
the received signature σMD through the public key pk MD of the controlled device, the user’s
agent Nginx serverrequestfor message
is signeddistribution andkey
using the private sends
sk HPEitoftothe
the heterogeneous
heterogeneous policypolicy
engineen-
after the
gine ([Link]-27) composed
verification of the
is passed and Docker container
σHPE is sent pool, agent
to the resource and the Dockerapplication.
for resource containerAfter
the resource Among
pool host IP is [Link]. agent usesthem,pk HPE the
to verify the signature, policy
heterogeneous if the signature
engineisrealizes
valid, thethe
resource
request reqr is forwarded to the resource, and after the resource response resp is generated,
purpose of the heterogeneous system executor through the difference in the software stack
the resource agent uses the controlled device public key pk MD to encrypt the response resp
composition. After and that,generate
each heterogeneous policythe
the ciphertext c. Finally, engine
resource performs
agent signsa trust evaluation
the response by it to
and sends
accessing the system the database
access proxy. according
The accessto its forwards
proxy own developed
the response scoring
contentmechanism anddevice
to the controlled
sends the respectivetoevaluation
verify whether results toresource
it is the the adjudicator ([Link]).
request submitted by the user andFinally,
finallythe ad- the
decrypts
ciphertext
judicator makes a consensus decision c using sk to obtain the resource response reply.
MDbased on the majority voting algorithm and feeds
The detailed system information of each component in the system and the heteroge-
back the decision result to the controlled device, and then the controlled device responds
neous policy engine in the Docker container pool is shown in the following Table 2:
to the client with a resource response.
When the userTable creates an authentication/authorization
2. System component information. request, the request is sent to
a controlled device with a trust certificate, and the controlled device uses the private key
No. Server Name IP Software Stack Composition Image/Container
𝑠𝑘𝑀𝐷 to sign and generate a signature 𝜎𝑀𝐷 . Then, it sends the user request 𝑟𝑒𝑞𝑢 and the
1 Controlled Device [Link] Centos 7 + Apache + Redis + PHP CD_Centos
signature 𝜎𝑀𝐷 together to the access proxy, and the access proxy is responsible for for-
2 wardingAccess Proxy
it to the heterogeneous [Link]
policy engine Ubuntu
(HPE) + Nginx + MySQL + C++
for authentication. The HPE AP_Ubuntu
verifies
3 the received signature
Policy Engine 1 𝜎𝑀𝐷[Link]
through the public Debiankey 𝑝𝑘𝑀𝐷
+ Apache of the
+ Oracle controlled
+ JAVA device, the
PE_Debian_Docker1

4
user’s request is signed using
Policy Engine 2
the privateFedora
[Link]
key 𝑠𝑘 𝐻𝑃𝐸 of the
+ Lighttpd
heterogeneous policy
+ MariaCB + Python
engine
PE_Fedora_Docker2
after the verification is passed and 𝜎𝐻𝑃𝐸 is sent to the resource agent for resource applica-
5 Policy Engine 3 [Link] RedHat + Tomcat + Sqlite + C++ PE_RedHat_Docker3
tion. After the resource agent uses 𝑝𝑘𝐻𝑃𝐸 to verify the signature, if the signature is valid,
6 the resource request 𝑟𝑒𝑞𝑟 is
Adjudicator forwarded to the
[Link] resource,
Windows andserver
+ IIS + SQL after+ NET
the resource response
Adjudicator_Windows
𝑟𝑒𝑠𝑝 is generated, the resource agent uses the controlled device public key 𝑝𝑘𝑀𝐷 to en-
crypt the response 𝑟𝑒𝑠𝑝 and generate the ciphertext 𝑐. Finally, the resource agent signs the
 1 Controlled Device [Link] Centos 7 + Apache + Redis + PHP CD_Centos
2 Access Proxy [Link] Ubuntu + Nginx + MySQL + C++ AP_Ubuntu
3 Policy Engine 1 [Link] Debian + Apache + Oracle + JAVA PE_Debian_Docker1
4 Policy Engine 2 [Link] Fedora + Lighttpd + MariaCB + Python PE_Fedora_Docker2
5
Electronics Policy
2023, Engine 3
12, 782 [Link] RedHat + Tomcat + Sqlite + C++ PE_RedHat_Docker3
14 of 21
6 Adjudicator [Link] Windows + IIS + SQL server + NET Adjudicator_Windows

Thesoftware
The software stack
stack consists
consists of
of {operating
{operating system,
system, web
web server,
server, database,
database, policy
policy lan-
lan-
guage} for heterogeneous implementation. The analysis in Section 6.2 above showed
guage} for heterogeneous implementation. The analysis in Section 6.2 above showed that that
Debian and
Debian andRedhat
Redhat contained
contained different
differentversions
versions ofofLinux
Linuxsystems
systemswith
withfewer
fewercommon
common
vulnerabilities,and
vulnerabilities, andthe
thepolicy
policyengine
engineisismainly
mainlybuilt
builtby
bythese
thesetwo
twoLinux
Linuxsystems.
systems.

6.4.2.
[Link]
SPA(Single
(SinglePackage
PackageAuthorization)
Authorization)
The
Theabove
aboveTable
Tableis an example
is an of an
example ofSPA data packet.
an SPA After combining
data packet. the information,
After combining the infor-
the authentication
mation, credentials
the authentication are encrypted
credentials twice using
are encrypted the hash
twice usingalgorithm
the hashtoalgorithm
generate to
a
message
generatedigest. The SPA
a message information
digest. has the timestamp
The SPA information has theoftimestamp
the creation
of of
thethe message,
creation so
of the
for requests
message, sooffor
different
requeststime periods, time
of different the hash code the
periods, value is different,
hash code value thus ensuring that
is different, thus
each access needs to be authorized. An example of SPA information as
ensuring that each access needs to be authorized. An example of SPA informationshown in Table 3:as
shown in Table 3:
Table 3. SPA information example.
Table 3. SPA information example.
Message Name Parameter Value
Message Name
Local Username ParameterchrisValue
Local Username
Local Timestamp chris
202204121724
Local Timestamp 202204121724
Client IP [Link]
Client IP [Link]
Verify Password ZzuP@ss_Word
Verify Password ZzuP@ss_Word
(“chris: 202204121724:[Link]:ZzuP@ss_Word”)
(“chris: 202204121724:[Link]:ZzuP@ss_Word”) = =
Hash-EncodedValue
Hash-Encoded Value (MD5)
(MD5)
e30316234dd806f64026fa52dc67d627
e30316234dd806f64026fa52dc67d627

Asshown
As shownin inFigure
Figure10,
10,after
afterthe
theclient
clientexecutes
executesthe
thefwknop
fwknopclient
clientaccess
accesscommand,
command,
the generated authentication credentials and message digest can be checked through
the generated authentication credentials and message digest can be checked through the the
.fwknop file in the/root directory and can be copied to to/etc/fwknop/access
.fwknop file in the/root directory and can be copied to to/etc/fwknop/access on theon the server
side. side.
server

Figure10.
Figure [Link]
FWKNOPconfiguration
configurationinformation.
information.

Electronics 2023, 12, x FOR PEER REVIEW 15 of 21

Thefollowing
The followingFigure
Figure1111isis the
the system-recording
system-recording process
process of aofcomplete
a complete
SPASPA certifica-
certification
tion during
during the experiment:
the experiment:

Figure11.
Figure 11. An
An SPA
SPAinteraction
interactionprocess.
process.

By default,
By default,after
after the
the client
client performs
performs thethe fwknop
fwknop authentication,
authentication,thetheport
portwill
willbe
be closed
closed
againafter
again after being
being opened
openedfor for 30
30s.s. When
When itit needs
needs to be accessed again,
again, reauthenticating
reauthenticating the
the
system
system will
will be
be needed.
needed. As As shown
shown in in the
the following
following Figure
Figure 12,
12, the
the authentication
authentication rules
rules of
of
fwknop are shown:
fwknop are shown:
 Figure 11. An SPA interaction process.

By default, after the client performs the fwknop authentication, the port will be closed
again after being opened for 30 s. When it needs to be accessed again, reauthenticating the
Electronics 2023, 12, 782 15 of 21
system will be needed. As shown in the following Figure 12, the authentication rules of
fwknop are shown:

Figure 12.
Figure 12. SPA
SPAauthentication
authenticationrules.
rules.

6.4.3.
6.4.3. Request
Request Processing
Processing and
and Distribution
Distribution
The access proxy server ([Link]) containsthe
The access proxy server ([Link]) contains theaccess
accessinformation
informationofofeach
each het-
heter-
erogeneous policy engine, configures the distribution address through the
ogeneous policy engine, configures the distribution address through the Nginx reverse Nginx reverse
proxy,
proxy,configures
configuresthe
theIPIPand
andport
portof
ofthe
thepolicy
policyengine
engine server
server in
in the
the upstream
upstream module
module and
and
configure
configure the main listening port and response behavior in the server module; the
the main listening port and response behavior in the server module; the Nginx
Nginx
proxy
proxy server
server information
informationin inthe
theexperiment
experimentisislisted
listedin
inTable
Table4.4.

[Link]
Table Policyengine
engineinformation.
information.
Upstream
UpstreamServer
Server IPIP PORT
PORT
PE_Debian_Docker1
PE_Debian_Docker1 [Link]
[Link] 8080
8080
PE_Fedora_Docker2 [Link] 8080
PE_Fedora_Docker2 [Link] 8080
PE_RedHat_Docker3 [Link] 8080
PE_RedHat_Docker3 [Link] 8080
The server then performs request processing through the prewritten Zzu_delivery
program, obtains
The server theperforms
then Docker container pool information
request processing throughaccording to the Zzu_delivery
the prewritten configuration
information in [Link], verifies that the requester is the controlled device ([Link])
program, obtains the Docker container pool information according to the configuration
and then makes
information a service [Link]
in [Link], verifies thatshown in Fugure
the requester 13: controlled device ([Link])
is the
and then makes a service request. As shown in Figure 13:
As shown in Figure 14 above, initializing the system environment is a process for the
access proxy to clean up the access traces. By deleting the last access request information in
the database, it avoids the problem of implicit trust in the system and ensures that each user
request access is an independent process. After verifying the identity of the requester, the
system processes the access request and sends it to the heterogeneous policy engines (PE1,
PE2, PE3). After each policy engine processes the access request, it sends the processing
result to the consistency adjudicator ([Link]) and the distribution process ends.
 Electronics 2023, 12, x FOR PEER REVIEW 16 of 21
Electronics 2023, 12, 782 16 of 21
Electronics 2023, 12, x FOR PEER REVIEW 16 of 21

Figure 13.
Figure 13. Check
CheckAP
APand
andquery IP. IP.
query
Figure 13. Check AP and query IP.

Figure 14. Request distribution.

As shown in Figure 14 above, initializing the system environment is a process for the
Figure14.
Figure [Link]
Requestdistribution.
distribution.
access proxy to clean up the access traces. By deleting the last access request information
in the database, it avoids the problem of implicit trust in the system and ensures that each
6.4.4. As
Information Judgment
shown in Figure 14 above, initializing the system environment is a process for the
user request access is an independent process. After verifying the identity of the requester,
access proxy
the system to
After receivingclean
processes the up the access
theaccess requesttraces.
authentication By from
results
and sends deleting the last access
theheterogeneous
it to the heterogeneous request
policy
policy information
engines
engines PE1,
in
PE2 the
(PE1,anddatabase,
PE2,PE3,
PE3).theit avoids the
adjudicator
After problem
each policycollates of implicit trust
them uniformly
engine processes in
the access the
and system and
then itmakes
request, ensures
sends an pro-that each
the adjudication
user request
according
cessing result access
to the
to the is an independent
pre-established
consistency process.
adjudication
adjudicator After verifying
policy, and thethe
as shown
([Link]) in identity
the of
following
distribution theTable
requester,
process 5.
the
[Link] processes the access request and sends it to the heterogeneous policy engines
(PE1,5.PE2,
Table PE3). Afterprocessing.
PE information each policy engine processes the access request, it sends the pro-
6.4.4. Information
cessing result to Judgment
the consistency adjudicator ([Link]) and the distribution process
[Link] receiving
ends. Server Name
the authenticationIPresults from the Port
heterogeneous policyResult
engines PE1,
PE21 and PE3, the adjudicator collates
PE_Debian_Docker1 them uniformly
[Link] and then
8080 makes an adjudication
Authorization verification passed
according to the pre-established
6.4.4. Information Judgment adjudication policy, as shown in the following Table 5.
2 PE_Fedora_Docker2 [Link] 8080 Authorization verification passed
TableAfter receiving processing.
5. PE information the authentication results from the heterogeneous policy engines PE1,
PE23 and PE_RedHat_Docker3
PE3, the adjudicator192.168.73.27 8080
collates them uniformly Authorization
and then makesverification passed
an adjudication
No. Server Name IP Port Result
according to the pre-established adjudication policy, as shown in the following Table 5.
Authorization verifica-
1 WherePE_Debian_Docker1 [Link]
the entire system processing is shown in 8080
the followingtion
procedure.
Table 5. PE information processing. passed The distribu-
tion of the adjudicator can be centralized or distributed. The position of the
Authorization adjudicator in
verifica-
2 PE_Fedora_Docker2 [Link] 8080
thisNo.
experiment Server
was located
Nameafter each policy IPengine, and Port
the unified centralized
tion passedResult adjudica-
tion approach was adopted. Considering that the increase in the number
Authorization of adjudications
verifica-
Authorization verifica-
will31affect the
PE_RedHat_Docker3
response latency of the192.168.73.27
PE_Debian_Docker1 [Link]
system, 8080 8080
the process of adjudication tion passedreduced
should
tion passed be
as much as possible while improving the security. The selection of Authorization
the adjudication method
verifica-
2
is based on PE_Fedora_Docker2
the security requirements [Link]
of the system. In8080
the authentication system, the
tion passed
security requirement is very high. Therefore, the Consensus − Voting method was adopted,
Authorization verifica-
as shown
3 in PE_RedHat_Docker3
Algorithm 1. It can be seen from Table 5 that the
[Link] heterogeneous policy engines
8080
tion passed
in the current service set all determined that the access request was passed, allowing the
resource response reply to be sent to the client.
Electronics 2023, 12, 782 17 of 21

Algorithm 1. Consensus voting.

Consensus—Voting
Input: client request parameters ClientRequest and authentication key ClientSecret
begin
If get client requests
// First authenticate the user’s identity and perform security checks
Processed_Auth=Id_Authentication(ClientSecret)
// Determining user identity
If(Processed_Auth)
// Handling user request parameters
Processed_Request=Request_exec(ClientRequest)
// Send processed user requests to heterogeneous policy engines PE1, PE2, PE3
Response1=Send_to_PE1(Processed_Request)
Response2=Send_to_PE2(Processed_Request)
Response3=Send_to_PE3(Processed_Request)
// Voting on messages using a consistent voting machine
Response_to_Client=Consensus-Voting(Response1,Response2,Response3)
// Return the processing results to the controlled device
Send_to_CD(Response_to_Client)
end if
end if
end

6.5. Experiment Analysis

(1) System failure rate
According to the antiattack analysis in the previous Section 6.1, the system failure rate
is related to the attack strength of malicious attackers and whether the system undergoes
mimic transformation. As shown in Figure 15, the attack strength was controlled, the
number of executors was one and the number of system executors was three for the
comparison experiments. The analysis of the experimental results showed that the attack
strength had a great influence on the system failure rate, and when the system introduced
the idea of mimic defense, the system failure rate was greatly reduced, which can have a
Electronics 2023, 12, x FOR PEER REVIEW 18 of 21
better security defense effect.
(2) Vulnerability Utilization

Figure 15.
Figure 15. System
System failure
failure rate.
rate.

(2) In the MAS, the

Vulnerability time interval for the attacker to take attack measures and the time for
Utilization
the defender
In the MAS, the timedefense
to schedule intervalmeasures have a decisive
for the attacker impact
to take attack in the system
measures utilization.
and the time for
Based on this, experiments were conducted to change the interval period
the defender to schedule defense measures have a decisive impact in the system utiliza- between the
implementation of the attack/defense measures from. The results showed
tion. Based on this, experiments were conducted to change the interval period between that (Figure 16)
as
thethe interval periodof
implementation ofthe
theattack/defense
measures takenmeasures
by both the attacker
from. and theshowed
The results defender increased,
that (Figure
16) as the interval period of the measures taken by both the attacker and the defender
increased, the defender took measures at a longer interval, resulting in system vulnerabil-
ities not being discovered and patched in time, and the utilization rate of the system vul-
nerabilities increased; due to the increase in the interval period of the attackers, the utili-
 Figure 15. System failure rate.

(2) Vulnerability Utilization

In the MAS, the time interval for the attacker to take attack measures and the time for
Electronics 2023, 12, 782 18 of 21
the defender to schedule defense measures have a decisive impact in the system utiliza-
tion. Based on this, experiments were conducted to change the interval period between
the implementation of the attack/defense measures from. The results showed that (Figure
the
16) defender took measures
as the interval period of at
thea measures
longer interval,
taken resulting
by both the in system
attackervulnerabilities not
and the defender
being discovered
increased, and patched
the defender in time, and
took measures at a the utilization
longer interval,rate of the system
resulting vulnerabilities
in system vulnerabil-
increased; due discovered
ities not being to the increase
andinpatched
the interval period
in time, and ofthethe attackers,rate
utilization theof
utilization
the systemrate of
vul-
the system vulnerabilities was reduced.
nerabilities increased; due to the increase in the interval period of the attackers, the utili-
zation
(3) rate of the system
Attack–defense timevulnerabilities
cost was reduced.

Vulnerability utilization.
Figure 16. Vulnerability utilization.

(3) As the system scheduling

Attack–defense time cost cycle (i.e., the system defense policy update cycle) increases,
the attacker
As the overhead decreases, cycle
system scheduling the cost of attacking
(i.e., the systemthedefense
system decreases and the
policy update costin-
cycle) of
defender measures to maintain the system decreases. The experimental results are
creases, the attacker overhead decreases, the cost of attacking the system decreases and shown
Electronics 2023, 12, x FOR PEER REVIEW
in 19 of 21
theFigure
cost of17.
defender measures to maintain the system decreases. The experimental results
(4) Effect in
are shown of Figure
the number
17. of isomers

Figure 17. Attack–defense time cost.

(4) The experiments

Effect of the numberof the attack overhead and defense overhead were run in the pro-
of isomers
posedThe
system in this paper with
experiments of the attack theoverhead
number ofandheterogeneous bodies
defense overhead as one
were run(nonhetero-
in the pro-
geneous system), three, five, seven and nine. It is obvious from Figure 18 that
posed system in this paper with the number of heterogeneous bodies as one (nonhetero- when the
number of heterogeneous bodies running in the system increases, both the attack overhead
geneous system), three, five, seven and nine. It is obvious from Figure 18 that when the
and defense overhead tend to increase, but the challenge to the attacker is greater, so the
number of heterogeneous bodies running in the system increases, both the attack over-
significance of transforming the system into heterogeneous and mimic is obvious.
head and defense overhead tend to increase, but the challenge to the attacker is greater,
so the significance of transforming the system into heterogeneous and mimic is obvious.
 (4) Effect of the number of isomers
The experiments of the attack overhead and defense overhead were run in the pro-
posed system in this paper with the number of heterogeneous bodies as one (nonhetero-
geneous system), three, five, seven and nine. It is obvious from Figure 18 that when the
number of heterogeneous bodies running in the system increases, both the attack over-
Electronics 2023, 12, 782 19 of 21
head and defense overhead tend to increase, but the challenge to the attacker is greater,
so the significance of transforming the system into heterogeneous and mimic is obvious.

Figure18.
Figure 18. Effect
Effect of
of the
the number
number of
of isomers.
isomers.

The
The MAS proposed
proposed in inthis
thispaper,
paper,by bythe
the heterogeneous
heterogeneous operation
operation of the
of the policy
policy en-
engine
gine
in a in a zero-trust
zero-trust authentication
authentication system,
system, has has the following
the following advantages
advantages overover traditional
traditional au-
authentication systems:
thentication systems:
•• By Byintroducing
introducingthe theSPA
SPA single-packet
single-packet authorization
authorization mechanism,
mechanism, it ensures that that
it ensures the sys-
the
tem can operate safely under DDOS attacks and the system
system can operate safely under DDOS attacks and the system resources are utilized resources are
utilized
stably. stably.
•• Compared
Comparedwith withthethesingle
singleauthentication
authentication center (policy
center engine)
(policy engine)authentication
authenticationsystem,
sys-
the
tem,multipolicy engineengine
the multipolicy construction method
construction can ensure
method stable stable
can ensure operation and a lower
operation and a
system failure failure
lower system rate after theafter
rate attacker increases
the attacker the intensity
increases of the attack
the intensity of theon the system.
attack on the
• With the
system. introduction of the multipolicy engine approach in the system, the defense
• capability of the systemofand
With the introduction the the attacker’sengine
multipolicy attackapproach
overheadin tend
theto grow nonlinearly
system, the defense
as
capability of the system and the attacker’s attack overhead tend to growthe
the number of heterogeneous bodies increases, which can improve security
nonlinearly
defense capability of the system.
as the number of heterogeneous bodies increases, which can improve the security
defense capability of the system.
7. Conclusions
In response to the authentication request initiated by using unknown vulnerabilities
and unknown backdoors, the authentication system cannot play a normal protective role,
and the defective problem of single-policy engine authentication occurs. This paper pro-
poses a zero-trust security authentication system based on SPA and endogenous security
architecture, implements the MAS by designing the system architecture and applying the
two techniques to the authentication process and evaluates the security problem of the
system. The design experiments verified the security gain of the proposed system in the
authentication and authorization process, while the system overhead was in an acceptable
range. Our method also had some limitations; for example, designing heterogeneous ex-
ecutors in the MAS requires ensuring that they are sufficiently different, because otherwise,
there may be common vulnerabilities. In a zero-trust authentication system, especially after
introducing the MAS idea, multiple device authentication processes may lead to the need
for frequent authentication and a poor user experience.
In the future, research can be further improved in the following aspects, including
increasing the heterogeneous diversity of the system components, such as using more com-
ponents with different hardware compositions or structural designs, as well as developing
a more suitable authentication frequency and scheme according to the user level of trust
assessment and increasing the user experience.

Author Contributions: Conceptualization, M.X. and J.G.; methodology, M.X., J.G. and H.Y.; valida-
tion, M.X. and X.Y.; resources, H.Y. and X.Y.; data curation, M.X.; writing—original draft preparation,
M.X.; writing—review and editing, M.X. and J.G.; supervision, H.Y.; project administration, M.X. All
authors have read and agreed to the published version of the manuscript.
Electronics 2023, 12, 782 20 of 21

Funding: This research was funded by the China University Industry–University Research Innova-
tion Fund—Future Network Innovation Research and Application Project (2021FNB01002) and the
Research Start-up Fund of Zhengzhou University (32340306).
Data Availability Statement: The data presented in this study are available upon request from the
corresponding author.
Conflicts of Interest: The authors declare no conflict of interest.

References
1. Gilman, E. Zero Trust Networks: Building Systems in Untrusted Networks. In USENIX Security; O’Reilly Media: Newton, MA,
USA, 2016.
2. Norquist, D.L. DoD Digital Modernization Strategy: DoD Information Resources Management Strategic Plan FY19-23. 12 July
2019. Available online: [Link] (accessed on 2 January 2023).
3. Rose, S.; Borchert, O.; Mitchell, S. NIST Special Publication 800–207 Zero Trust Architecture; National Institute of Standards and
Technology: Gaithersburg, MD, USA, 2020.
4. Gartner. Building Trust with Zero Trust—Reinventing the New Boundary of Security. 2021. Available online: [Link]
org/18597 (accessed on 2 January 2023).
5. Peng, W.; Li, F.; Huang, C.T. A moving-target defense strategy for cloud-based services with heterogeneous and dynamic attack
surfaces. In Proceedings of the 2014 IEEE International Conference on Communications (ICC), Sydney, NSW, Australia, 10–14
June 2014.
6. Hu, H.; Wu, J.; Wang, Z. Mimic defense: A designed-in cybersecurity defense framework. IET Inf. Secur. 2018, 12, 226–237.
[CrossRef]
7. De Capitani di Vimercati, S.; Paraboschi, S.; Samarati, P. Access control: Principles and solutions. Softw. Pract. Exp. 2003,
33, 397–421. [CrossRef]
8. Braghin, C.; Cortesi, A.; Focardi, R. Security boundaries in mobile ambients. Comput. Lang. Syst. Struct. 2002, 28, 101–127.
[CrossRef]
9. Farrell, S. Security boundaries. IEEE Internet Comput. 2008, 12, 93–96. [CrossRef]
10. Ahmed, I.; Nahar, T.; Urmi, S.S. Protection of sensitive data in zero trust model. In Proceedings of the ICCA 2020: International
Conference on Computing Advancements, Dhaka, Bangladesh, 10–12 January 2020.
11. Papakonstantinou, N.; Van Bossuyt, D.L.; Linnosmaa, J. A Zero Trust Hybrid Security and Safety Risk Analysis Method. J. Comput.
Inf. Sci. Eng. 2021, 21, 050907. [CrossRef]
12. DeCusatis, C.; Liengtiraphan, P.; Sager, A. Implementing zero trust cloud networks with transport access control and first packet
authentication. In Proceedings of the 2016 IEEE International Conference on Smart Cloud (SmartCloud), New York, NY, USA,
18–20 November 2016.
13. Sateesh, H.; Zavarsky, P. State-of-the-Art VANET trust models: Challenges and recommendations. In Proceedings of the 2020 11th
IEEE Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON), Vancouver, BC, Canada,
4–7 November 2020.
14. Samaniego, M.; Deters, R. Zero-trust hierarchical management in IoT. In Proceedings of the 2018 IEEE International Congress on
Internet of Things (ICIOT), San Francisco, CA, USA, 2–7 July 2018.
15. Dhar, S.; Bose, I. Securing IoT devices using zero trust and blockchain. J. Organ. Comput. Electron. Commer. 2021, 31, 18–34.
[CrossRef]
16. Zhang, X.J. Power IoT security protection architecture based on zero trust framework. In Proceedings of the 2021 IEEE 5th
International Conference on Cryptography, Security and Privacy (CSP), Zhuhai, China, 8–10 January 2021.
17. Puthal, D.; Yang, L.T.; Dustdar, S. A user-centric security solution for Internet of Things and edge convergence. ACM Trans.
Cyber-Phys. Syst. 2020, 4, 32. [CrossRef]
18. Sultana, M.; Hossain, A.; Laila, F. Towards developing a secure medical image sharing system based on zero trust principles and
blockchain technology. BMC Med. Inform. Decis. Mak. 2020, 20, 256. [CrossRef] [PubMed]
19. Zaheer, Z.; Chang, H.; Mukherjee, S. eztrust: Network-independent zero-trust perimeterization for microservices. In Proceedings
of the SOSR ‘19: Symposium on SDN Research, San Jose, CA, USA, 3–4 April 2019.
20. Chen, X.; Feng, W.; Ge, N. Zero Trust Architecture for 6G Security. arXiv 2022, arXiv:2203.07716.
21. Han, C.; Kim, G.J.; Alfarraj, O. ZT-BDS: A Secure Blockchain-based Zero-trust Data Storage Scheme in 6G Edge IoT. J. Internet
Technol. 2022, 23, 289–295.
22. Almaiah, M.A.; Al-Zahrani, A.; Almomani, O.; Alhwaitat, A.K. Classification of cyber security threats on mobile devices and
applications. In Artificial Intelligence and Blockchain for Future Cybersecurity Applications; Springer International Publishing: Cham,
Switzerland, 2021; pp. 107–123.
23. Al Hwaitat, A.K.; Almaiah, M.A.; Almomani, O.; Al-Zahrani, M.; Al-Sayed, R.M.; Asaifi, R.M.; Adhim, K.K.; Althunibat, A.;
Alsaaidah, A. Improved security particle swarm optimization (PSO) algorithm to detect radio jamming attacks in mobile networks.
Int. J. Adv. Comput. Sci. Appl. 2020, 11, 614–625. [CrossRef]
Electronics 2023, 12, 782 21 of 21

24. Almaiah, M.A. Almaiah, M.A. A new scheme for detecting malicious attacks in wireless sensor networks based on blockchain
technology. In Artificial Intelligence and Blockchain for Future Cybersecurity Applications; Springer International Publishing: Cham,
Switzerland, 2021; pp. 217–234.
25. Almaiah, M.A.; Dawahdeh, Z.; Almomani, O.; Alsaaidah, A.; Al-Khasawneh, A.; Khawatreh, S. A new hybrid text encryption
approach over mobile ad hoc network. Int. J. Electr. Comput. Eng. (IJECE) 2020, 10, 6461–6471. [CrossRef]
26. Al Nafea, R.; Almaiah, M.A. Cyber security threats in cloud: Literature review. In Proceedings of the 2021 International Conference
on Information Technology (ICIT), IEEE, Amman, Jordan, 14–15 July 2021; pp. 779–786.
27. Alamer, M.; Almaiah, M.A. Cybersecurity in Smart City: A systematic mapping study. In Proceedings of the 2021 International
Conference on Information Technology (ICIT), IEEE, Amman, Jordan, 14–15 July 2021; pp. 719–724.
28. Moubayed, A.; Refaey, A.; Shami, A. Software-defined perimeter (sdp): State of the art secure solution for modern networks.
IEEE Netw. 2019, 33, 226–233. [CrossRef]
29. Sallam, A.; Refaey, A.; Shami, A. On the security of SDN: A completed secure and scalable framework using the software-defined
perimeter. IEEE Access 2019, 7, 146577–146587. [CrossRef]
30. Omar, R.R.; Abdelaziz, T.M. A comparative study of network access control and software-defined perimeter. In Proceedings of
the ICEMIS’20: The 6th International Conference on Engineering & MIS 2020, Almaty, Kazakhstan, 14–16 September 2020.
31. Singh, J.; Refaey, A.; Koilpillai, J. Adoption of the software-defined perimeter (sdp) architecture for infrastructure as a service.
Can. J. Electr. Comput. Eng. 2020, 43, 357–363. [CrossRef]
32. Bello, Y.; Hussein, A.R.; Ulema, M.; Koilpillai, J. On Sustained Zero Trust Conceptualization Security for Mobile Core Networks
in 5G and Beyond. IEEE Trans. Netw. Serv. Manag. 2022, 19, 1876–1889. [CrossRef]
33. Albuali, A.; Mengistu, T.; Che, D. ZTIMM: A zero-trust-based identity management model for volunteer cloud computing. In
Proceedings of the CLOUD 2020, Honolulu, HI, USA, 18–20 September 2020.
34. Yao, Q.; Wang, Q.; Zhang, X. Dynamic access control and authorization system based on zero-trust architecture. In Proceedings of
the CCRIS ‘20: Proceedings of the 2020 1st International Conference on Control, Robotics and Intelligent System, Xiamen China,
27–29 October 2020.
35. Laplante, P.; Voas, J. Zero-Trust Artificial Intelligence? Computer 2022, 55, 10–12. [CrossRef]
36. Ferretti, L.; Magnanini, F.; Andreolini, M. Survivable zero trust for cloud computing environments. Comput. Secur. 2021, 110,
102419. [CrossRef]
37. Guo, J.; Xu, M. ZTESA—A Zero-Trust Endogenous Safety Architecture: Gain the endogenous safety benefit, avoid insider
threats. In Proceedings of the International Symposium on Computer Applications and Information Systems (ISCAIS 2022), SPIE,
Shenzhen, China, 25–27 February 2022; Volume 12250, pp. 192–202.
38. Rash, M. Single packet authorization with fwknop. USENIX Mag. 2006, 31, 63–69.

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual
author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to
people or property resulting from any ideas, methods, instructions or products referred to in the content.