Zero Trust Automation: SPIFFE/SPIRE for Identity Federation and OpenZiti in Microsegmented Networks
Open accessAbstract
As organizations adopt cloud-native infrastructure and microservices, traditional network security approaches are no longer sufficient. This paper presents an automated Zero Trust framework integrating SPIFFE/SPIRE for identity federation with OpenZiti for application-layer microsegmentation. SPIFFE provides a standard for workload identity, while SPIRE issues and manages these identities automatically in Kubernetes using X.509 certificates known as SVIDs. These identities enable secure authentication between services using mutual TLS (mTLS), enforced through the Envoy proxy. To strengthen communication security further, OpenZiti is used to segment traffic at the application level, independent of IP-based network boundaries. This allows for precise control over which services can communicate. In addition, Tetragon, an eBPF-based observability and enforcement tool, is included to monitor workload behavior and support real-time attestation. These components form a scalable, flexible solution that aligns with Zero Trust principles. This research analyses how the combined system supports secure identity management, encrypted service communication, and behavior-based policy enforcement in modern cloud environments.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The SPIFFE/SPIRE workload-identity model addresses the rescheduling problem directly.
“The SPIFFE/SPIRE workload-identity model, which underpins the service-mesh enforcement approach specified in SP 800-204A, addresses the rescheduling problem directly.”
From The Pathway to Implementing Zero Trust: Why Microsegmentation Remains the Critical Barrier (2026) · cites this paper as [8]
The Introduction says SPIFFE identifies services in dynamic environments and SPIRE automates workload identity issuance and rotation in Kubernetes. That supports the general identity-management mechanism, but the paper does not discuss workload rescheduling or say that the model addresses a rescheduling problem directly. (LLM, conf=0.78)
Experimental — accuracy not yet measuredSPIFFE policies remain valid regardless of the workload's network address or scheduling location.
“The policy remains valid regardless of the workload's network address or scheduling location [8,9].”
From The Pathway to Implementing Zero Trust: Why Microsegmentation Remains the Critical Barrier (2026) · cites this paper as [8]
The Introduction (page not provided) says SPIFFE supplies workload identities and SPIRE issues certificates, but it does not say that SPIFFE policies remain valid when a workload’s network address or scheduling location changes. Its statement about securing applications regardless of the host network concerns OpenZiti. Searches for network address and scheduling location found no passage establishing the claimed policy persistence. (LLM, conf=0.72)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 4
- [1][1]. S. Rose, O. Borchert, S. Mitchell, and S. Connelly, "Zero trust architecture," NIST Special Publication 800-207, Aug. 2020, doi: https://doi.org/10.6028/nist.sp.800-207. · DOI · Paper page
- [2][2]. S. Teerakanok, T. Uehara, and A. Inomata, "Migrating to Zero Trust Architecture: Reviews and Challenges," Security and Communication Networks, vol. 2021, pp. 1–10, May 2021, doi: https://doi.org/10.1155/2021/9947347. · DOI · Paper page
- [6][6]. N. Aw, "Enabling Zero Trust Architecture (ZTA) with Least-Privilege Identity-Based Micro-segmentation using Service Mesh and Securing Production Identity Framework for Everyone (SPIFFE) (Demo) & Building Secure Software Factory (SSF) to Defend the Digital Cloud-Native Software Supply Chain against attacks: Helpful Cloud-Native Security Checklists and Demo on The Update Framework," 2019. https://owasp.org/www-chapter-singapore/assets/presos/Securing_Production_Identity_Framework_for_Everyone_(SPIFFE),_Building_End_to_End_Secure_Software_Factory_and_Protecting_Cloud-Native_Supply_Chain_Helpful_Cloud-Native_Security_Checklists_and_Demo_on_SPIFFE_and_Not.pdf
- [8][8]. A. Tyagi, "Intelligent DevOps: Harnessing Artificial Intelligence to Revolutionize CI/CD Pipelines and Optimize Software Delivery Lifecycles." March 2021 https://www.researchgate.net/profile/Anuj-Tyagi-12/publication/387271134_Intelligent_DevOps_Harnessing_Artificial_Intelligence_to_Revolutionize_CICD_Pipelines_and_Optimize_Software_Delivery_Lifecycles/links/6765ec55894c5520851ffb53/Intelligent-DevOps-Harnessing-Artificial-Intelligence-to-Revolutionize-CI-CD-Pipelines-and-Optimize-Software-Delivery-Lifecycles.pdf Citations Show only: No citations found 663 Views 245 Downloads Show more details All versions This version Views Total views 663 663 Downloads Total downloads 245 245 Data volume Total data volume 44.7 MB 44.7 MB More info on how stats are collected.... Versions Version v110.5281/zenodo.15387226 Oct 31, 2021 Cite all versions? You can cite all versions by using the DOI 10.5281/zenodo.15387225. This DOI represents all versions, and will always resolve to the latest one. Read more. External resources Keywords and subjects Keywords Zero Trust Architecture (ZTA) SPIFFE SPIRE X.509 Certificates Kubernetes Details Rights Citation Sandhya Guduru. (2021). Zero Trust Automation: SPIFFE/SPIRE for Identity Federation and OpenZiti in Microsegmented Networks. European Journal of Advances in Engineering and Technology, 8(10), 122–126. https://doi.org/10.5281/zenodo.15387226 APA APA Harvard MLA Vancouver Chicago IEEE Export JSON JSON JSON-LD CSL DataCite JSON DataCite XML Dublin Core XML MARCXML BibTeX GeoJSON DCAT Codemeta Citation File Format Data Package JSON Export Technical metadata Previous of 5 Next Zoom Out Automatic Zoom Actual Size Page Fit Page Width 0% 50% 75% 100% 125% 150% 200% 300% 400% Zoom In Download Toggle Fullscreen Mode Available online www.ejaet.com European Journal of Advances in Engineering and Technology, 2021, 8(10):122-126 Research Article ISSN: 2394 - 658X 1 Zero Trust Automation: SPIFFE/SPIRE for Identity Federation and OpenZiti in Microsegmented Networks Sandhya Guduru Master’s in information systems security Software Engineer - Technical Lead _____________________________________________________________________________________________ · DOI
Cited by
Sorted by citations
- Authors
- Guduru, S.
- Corresponding author
- Sandhya Guduru
- Venue
- European Journal of Advances in Engineering and Technology
- Publisher
- European Journal of Advances in Engineering and Technology
- Published
- 2021-10-31
- OpenAlex
- W6968180765
- Cited by
- 0
- References
- 0
- FWCI
- 0.00
- Type
- journal article
- Language
- en
- Open access
- green
- doi.org
- Licence
- Locations
- Zenodo (CERN European Organization for Nuclear Research) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Computer Networks and Communications › Cybersecurity and Information Systems
- Keywords
- zero-trust architecture, SPIFFE, spire, identity federation, service mesh, micro-segmentation, Kubernetes, X.509 certificates, mutual TLS, envoys, eBPF, policy enforcement, cloud-native security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
