Zero Trust Architecture for Trading Systems

1// identity/auth.go
2package identity
3
4import (
5    "context"
6    "crypto/rsa"
7    "crypto/x509"
8    "encoding/pem"
9    "errors"
10    "time"
11    
12    "github.com/golang-jwt/jwt/v5"
13    "google.golang.org/grpc/credentials"
14    "google.golang.org/grpc/peer"
15)
16
17// Identity represents authenticated entity
18type Identity struct {
19    UserID      string
20    Email       string
21    Roles       []string
22    Permissions []string
23    DeviceID    string
24    TrustScore  float64
25    ExpiresAt   time.Time
26}
27
28// Claims for JWT tokens
29type Claims struct {
30    jwt.RegisteredClaims
31    UserID      string   `json:"user_id"`
32    Email       string   `json:"email"`
33    Roles       []string `json:"roles"`
34    Permissions []string `json:"permissions"`
35    DeviceID    string   `json:"device_id"`
36    TrustScore  float64  `json:"trust_score"`
37}
38
39// AuthService handles authentication
40type AuthService struct {
41    privateKey *rsa.PrivateKey
42    publicKey  *rsa.PublicKey
43    
44    // Trust scoring
45    trustCalculator *TrustCalculator
46    
47    // Token management
48    tokenTTL       time.Duration
49    refreshTTL     time.Duration
50    blacklist      TokenBlacklist
51}
52
53func NewAuthService(
54    privateKeyPEM, publicKeyPEM []byte,
55    tokenTTL, refreshTTL time.Duration,
56) (*AuthService, error) {
57    
58    // Parse private key
59    block, _ := pem.Decode(privateKeyPEM)
60    if block == nil {
61        return nil, errors.New("failed to parse PEM block")
62    }
63    
64    privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
65    if err != nil {
66        return nil, err
67    }
68    
69    // Parse public key
70    block, _ = pem.Decode(publicKeyPEM)
71    if block == nil {
72        return nil, errors.New("failed to parse PEM block")
73    }
74    
75    publicKey, err := x509.ParsePKCS1PublicKey(block.Bytes)
76    if err != nil {
77        return nil, err
78    }
79    
80    return &AuthService{
81        privateKey:      privateKey,
82        publicKey:       publicKey,
83        tokenTTL:        tokenTTL,
84        refreshTTL:      refreshTTL,
85        trustCalculator: NewTrustCalculator(),
86        blacklist:       NewRedisBlacklist(),
87    }, nil
88}
89
90// Authenticate user with multi-factor authentication
91func (s *AuthService) Authenticate(
92    ctx context.Context,
93    username, password, otpCode string,
94    deviceFingerprint map[string]string,
95) (*Identity, string, error) {
96    
97    // 1. Verify password (bcrypt hash)
98    user, err := s.verifyPassword(ctx, username, password)
99    if err != nil {
100        s.logFailedAttempt(ctx, username, "invalid_password")
101        return nil, "", errors.New("authentication failed")
102    }
103    
104    // 2. Verify OTP (TOTP)
105    if !s.verifyOTP(user.ID, otpCode) {
106        s.logFailedAttempt(ctx, username, "invalid_otp")
107        return nil, "", errors.New("invalid OTP")
108    }
109    
110    // 3. Device verification
111    deviceID, deviceTrusted := s.verifyDevice(user.ID, deviceFingerprint)
112    
113    // 4. Calculate trust score
114    trustScore := s.trustCalculator.Calculate(ctx, TrustFactors{
115        UserID:           user.ID,
116        DeviceTrusted:    deviceTrusted,
117        LocationAnomaly:  s.checkLocationAnomaly(ctx, user.ID),
118        TimeAnomaly:      s.checkTimeAnomaly(ctx, user.ID),
119        RecentActivity:   s.getRecentActivity(ctx, user.ID),
120        FailedAttempts:   s.getFailedAttempts(ctx, user.ID),
121    })
122    
123    // 5. Build identity
124    identity := &Identity{
125        UserID:      user.ID,
126        Email:       user.Email,
127        Roles:       user.Roles,
128        Permissions: s.getPermissions(user.Roles),
129        DeviceID:    deviceID,
130        TrustScore:  trustScore,
131        ExpiresAt:   time.Now().Add(s.tokenTTL),
132    }
133    
134    // 6. Generate JWT
135    token, err := s.generateToken(identity)
136    if err != nil {
137        return nil, "", err
138    }
139    
140    // 7. Audit log
141    s.logSuccessfulAuth(ctx, identity)
142    
143    return identity, token, nil
144}
145
146// Generate JWT token
147func (s *AuthService) generateToken(identity *Identity) (string, error) {
148    claims := Claims{
149        RegisteredClaims: jwt.RegisteredClaims{
150            Subject:   identity.UserID,
151            ExpiresAt: jwt.NewNumericDate(identity.ExpiresAt),
152            IssuedAt:  jwt.NewNumericDate(time.Now()),
153            NotBefore: jwt.NewNumericDate(time.Now()),
154            Issuer:    "trading-platform",
155        },
156        UserID:      identity.UserID,
157        Email:       identity.Email,
158        Roles:       identity.Roles,
159        Permissions: identity.Permissions,
160        DeviceID:    identity.DeviceID,
161        TrustScore:  identity.TrustScore,
162    }
163    
164    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
165    return token.SignedString(s.privateKey)
166}
167
168// Verify JWT token
169func (s *AuthService) VerifyToken(tokenString string) (*Identity, error) {
170    // Check blacklist
171    if s.blacklist.IsBlacklisted(tokenString) {
172        return nil, errors.New("token revoked")
173    }
174    
175    token, err := jwt.ParseWithClaims(
176        tokenString,
177        &Claims{},
178        func(token *jwt.Token) (interface{}, error) {
179            if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
180                return nil, errors.New("unexpected signing method")
181            }
182            return s.publicKey, nil
183        },
184    )
185    
186    if err != nil {
187        return nil, err
188    }
189    
190    claims, ok := token.Claims.(*Claims)
191    if !ok || !token.Valid {
192        return nil, errors.New("invalid token")
193    }
194    
195    return &Identity{
196        UserID:      claims.UserID,
197        Email:       claims.Email,
198        Roles:       claims.Roles,
199        Permissions: claims.Permissions,
200        DeviceID:    claims.DeviceID,
201        TrustScore:  claims.TrustScore,
202        ExpiresAt:   claims.ExpiresAt.Time,
203    }, nil
204}
205
206// RevokeToken adds token to blacklist
207func (s *AuthService) RevokeToken(tokenString string) error {
208    token, err := jwt.Parse(tokenString, nil)
209    if token == nil {
210        return err
211    }
212    
213    claims, ok := token.Claims.(jwt.MapClaims)
214    if !ok {
215        return errors.New("invalid claims")
216    }
217    
218    exp := claims["exp"].(float64)
219    ttl := time.Unix(int64(exp), 0).Sub(time.Now())
220    
221    return s.blacklist.Add(tokenString, ttl)
222}
223
224// Trust scoring
225type TrustCalculator struct {
226    weights map[string]float64
227}
228
229func NewTrustCalculator() *TrustCalculator {
230    return &TrustCalculator{
231        weights: map[string]float64{
232            "device_trusted":    0.25,
233            "location_normal":   0.20,
234            "time_normal":       0.15,
235            "activity_pattern":  0.20,
236            "failed_attempts":   0.20,
237        },
238    }
239}
240
241type TrustFactors struct {
242    UserID           string
243    DeviceTrusted    bool
244    LocationAnomaly  bool
245    TimeAnomaly      bool
246    RecentActivity   ActivityPattern
247    FailedAttempts   int
248}
249
250func (tc *TrustCalculator) Calculate(ctx context.Context, factors TrustFactors) float64 {
251    score := 0.0
252    
253    // Device trust
254    if factors.DeviceTrusted {
255        score += tc.weights["device_trusted"]
256    }
257    
258    // Location
259    if !factors.LocationAnomaly {
260        score += tc.weights["location_normal"]
261    }
262    
263    // Time of access
264    if !factors.TimeAnomaly {
265        score += tc.weights["time_normal"]
266    }
267    
268    // Activity patterns
269    activityScore := tc.scoreActivity(factors.RecentActivity)
270    score += activityScore * tc.weights["activity_pattern"]
271    
272    // Failed attempts penalty
273    failedScore := max(0, 1.0 - float64(factors.FailedAttempts)*0.1)
274    score += failedScore * tc.weights["failed_attempts"]
275    
276    return score
277}
278
279func (tc *TrustCalculator) scoreActivity(pattern ActivityPattern) float64 {
280    // Score based on normal behavior patterns
281    if pattern.AnomalyDetected {
282        return 0.3
283    }
284    return 1.0
285}
286
287// Placeholder types
288type User struct {
289    ID    string
290    Email string
291    Roles []string
292}
293
294type ActivityPattern struct {
295    AnomalyDetected bool
296}
297
298type TokenBlacklist interface {
299    IsBlacklisted(token string) bool
300    Add(token string, ttl time.Duration) error
301}
302
303type RedisBlacklist struct{}
304
305func NewRedisBlacklist() *RedisBlacklist { return &RedisBlacklist{} }
306func (r *RedisBlacklist) IsBlacklisted(token string) bool { return false }
307func (r *RedisBlacklist) Add(token string, ttl time.Duration) error { return nil }
308
309// Placeholder methods
310func (s *AuthService) verifyPassword(ctx context.Context, username, password string) (*User, error) {
311    return &User{ID: "user123", Email: username, Roles: []string{"trader"}}, nil
312}
313func (s *AuthService) verifyOTP(userID, code string) bool { return true }
314func (s *AuthService) verifyDevice(userID string, fingerprint map[string]string) (string, bool) {
315    return "device123", true
316}
317func (s *AuthService) checkLocationAnomaly(ctx context.Context, userID string) bool { return false }
318func (s *AuthService) checkTimeAnomaly(ctx context.Context, userID string) bool { return false }
319func (s *AuthService) getRecentActivity(ctx context.Context, userID string) ActivityPattern {
320    return ActivityPattern{AnomalyDetected: false}
321}
322func (s *AuthService) getFailedAttempts(ctx context.Context, userID string) int { return 0 }
323func (s *AuthService) getPermissions(roles []string) []string {
324    return []string{"trade", "view_positions"}
325}
326func (s *AuthService) logFailedAttempt(ctx context.Context, username, reason string) {}
327func (s *AuthService) logSuccessfulAuth(ctx context.Context, identity *Identity) {}
328
329func max(a, b float64) float64 {
330    if a > b { return a }
331    return b
332}
333

1// policy/engine.go
2package policy
3
4import (
5    "context"
6    "encoding/json"
7    "errors"
8)
9
10// Policy engine for authorization decisions
11type Engine struct {
12    policies map[string]*Policy
13    evaluator *Evaluator
14}
15
16// Policy defines access rules
17type Policy struct {
18    ID          string
19    Name        string
20    Description string
21    Rules       []Rule
22    Effect      Effect
23}
24
25type Effect string
26
27const (
28    EffectAllow Effect = "allow"
29    EffectDeny  Effect = "deny"
30)
31
32// Rule with conditions
33type Rule struct {
34    Resource   string
35    Action     string
36    Conditions []Condition
37}
38
39type Condition struct {
40    Attribute string
41    Operator  Operator
42    Value     interface{}
43}
44
45type Operator string
46
47const (
48    OpEquals             Operator = "eq"
49    OpNotEquals          Operator = "ne"
50    OpGreaterThan        Operator = "gt"
51    OpLessThan           Operator = "lt"
52    OpIn                 Operator = "in"
53    OpContains           Operator = "contains"
54    OpIPInCIDR           Operator = "ip_in_cidr"
55    OpTimeInRange        Operator = "time_in_range"
56)
57
58// Authorization request
59type Request struct {
60    Subject  Subject
61    Resource string
62    Action   string
63    Context  map[string]interface{}
64}
65
66type Subject struct {
67    UserID      string
68    Roles       []string
69    Permissions []string
70    Attributes  map[string]interface{}
71}
72
73// Decision result
74type Decision struct {
75    Allowed bool
76    Reason  string
77    Policies []string
78}
79
80func NewEngine() *Engine {
81    return &Engine{
82        policies:  make(map[string]*Policy),
83        evaluator: NewEvaluator(),
84    }
85}
86
87// LoadPolicies from JSON
88func (e *Engine) LoadPolicies(policiesJSON []byte) error {
89    var policies []*Policy
90    if err := json.Unmarshal(policiesJSON, &policies); err != nil {
91        return err
92    }
93    
94    for _, policy := range policies {
95        e.policies[policy.ID] = policy
96    }
97    
98    return nil
99}
100
101// Authorize request
102func (e *Engine) Authorize(ctx context.Context, req Request) (*Decision, error) {
103    
104    var matchedPolicies []string
105    var denialReasons []string
106    
107    // Evaluate all policies
108    for _, policy := range e.policies {
109        matches, err := e.evaluatePolicy(ctx, policy, req)
110        if err != nil {
111            return nil, err
112        }
113        
114        if matches {
115            matchedPolicies = append(matchedPolicies, policy.ID)
116            
117            // Deny takes precedence
118            if policy.Effect == EffectDeny {
119                denialReasons = append(denialReasons, policy.Description)
120            }
121        }
122    }
123    
124    // Explicit deny wins
125    if len(denialReasons) > 0 {
126        return &Decision{
127            Allowed:  false,
128            Reason:   denialReasons[0],
129            Policies: matchedPolicies,
130        }, nil
131    }
132    
133    // Default deny (must have explicit allow)
134    if len(matchedPolicies) == 0 {
135        return &Decision{
136            Allowed: false,
137            Reason:  "no matching allow policy",
138        }, nil
139    }
140    
141    return &Decision{
142        Allowed:  true,
143        Reason:   "authorized",
144        Policies: matchedPolicies,
145    }, nil
146}
147
148// Evaluate single policy
149func (e *Engine) evaluatePolicy(ctx context.Context, policy *Policy, req Request) (bool, error) {
150    
151    for _, rule := range policy.Rules {
152        // Check resource match
153        if !e.matchResource(rule.Resource, req.Resource) {
154            continue
155        }
156        
157        // Check action match
158        if !e.matchAction(rule.Action, req.Action) {
159            continue
160        }
161        
162        // Evaluate all conditions
163        allConditionsMet := true
164        for _, condition := range rule.Conditions {
165            met, err := e.evaluator.EvaluateCondition(ctx, condition, req)
166            if err != nil {
167                return false, err
168            }
169            if !met {
170                allConditionsMet = false
171                break
172            }
173        }
174        
175        if allConditionsMet {
176            return true, nil
177        }
178    }
179    
180    return false, nil
181}
182
183func (e *Engine) matchResource(pattern, resource string) bool {
184    // Wildcard matching (simplified)
185    if pattern == "*" {
186        return true
187    }
188    return pattern == resource
189}
190
191func (e *Engine) matchAction(pattern, action string) bool {
192    if pattern == "*" {
193        return true
194    }
195    return pattern == action
196}
197
198// Evaluator for conditions
199type Evaluator struct{}
200
201func NewEvaluator() *Evaluator {
202    return &Evaluator{}
203}
204
205func (e *Evaluator) EvaluateCondition(
206    ctx context.Context,
207    condition Condition,
208    req Request,
209) (bool, error) {
210    
211    // Get attribute value
212    attrValue := e.getAttribute(condition.Attribute, req)
213    if attrValue == nil {
214        return false, nil
215    }
216    
217    // Evaluate based on operator
218    switch condition.Operator {
219    case OpEquals:
220        return attrValue == condition.Value, nil
221        
222    case OpNotEquals:
223        return attrValue != condition.Value, nil
224        
225    case OpGreaterThan:
226        return e.compareNumbers(attrValue, condition.Value, ">")
227        
228    case OpLessThan:
229        return e.compareNumbers(attrValue, condition.Value, "<")
230        
231    case OpIn:
232        list, ok := condition.Value.([]interface{})
233        if !ok {
234            return false, errors.New("invalid 'in' operator value")
235        }
236        for _, item := range list {
237            if attrValue == item {
238                return true, nil
239            }
240        }
241        return false, nil
242        
243    case OpIPInCIDR:
244        return e.checkIPInCIDR(attrValue, condition.Value)
245        
246    case OpTimeInRange:
247        return e.checkTimeInRange(attrValue, condition.Value)
248        
249    default:
250        return false, errors.New("unknown operator")
251    }
252}
253
254func (e *Evaluator) getAttribute(name string, req Request) interface{} {
255    // Check subject attributes
256    if val, ok := req.Subject.Attributes[name]; ok {
257        return val
258    }
259    
260    // Check context
261    if val, ok := req.Context[name]; ok {
262        return val
263    }
264    
265    return nil
266}
267
268func (e *Evaluator) compareNumbers(a, b interface{}, op string) (bool, error) {
269    aFloat, aOk := a.(float64)
270    bFloat, bOk := b.(float64)
271    
272    if !aOk || !bOk {
273        return false, errors.New("not numbers")
274    }
275    
276    switch op {
277    case ">":
278        return aFloat > bFloat, nil
279    case "<":
280        return aFloat < bFloat, nil
281    default:
282        return false, errors.New("invalid operator")
283    }
284}
285
286func (e *Evaluator) checkIPInCIDR(ip, cidr interface{}) (bool, error) {
287    // Simplified IP check
288    return true, nil
289}
290
291func (e *Evaluator) checkTimeInRange(t, timeRange interface{}) (bool, error) {
292    // Simplified time check
293    return true, nil
294}
295
296// Example policies
297const tradingPoliciesJSON = `[
298  {
299    "id": "allow-traders-during-market-hours",
300    "name": "Allow Trading During Market Hours",
301    "description": "Traders can place orders during market hours from trusted devices",
302    "effect": "allow",
303    "rules": [
304      {
305        "resource": "orders",
306        "action": "create",
307        "conditions": [
308          {
309            "attribute": "role",
310            "operator": "in",
311            "value": ["trader", "senior_trader"]
312          },
313          {
314            "attribute": "trust_score",
315            "operator": "gt",
316            "value": 0.7
317          },
318          {
319            "attribute": "time",
320            "operator": "time_in_range",
321            "value": "09:30-16:00"
322          }
323        ]
324      }
325    ]
326  },
327  {
328    "id": "deny-high-risk-devices",
329    "name": "Deny High Risk Devices",
330    "description": "Block access from high-risk devices",
331    "effect": "deny",
332    "rules": [
333      {
334        "resource": "*",
335        "action": "*",
336        "conditions": [
337          {
338            "attribute": "device_risk",
339            "operator": "gt",
340            "value": 0.8
341          }
342        ]
343      }
344    ]
345  },
346  {
347    "id": "allow-admins-from-corporate-network",
348    "name": "Allow Admins from Corporate Network",
349    "description": "Admins can access from corporate network only",
350    "effect": "allow",
351    "rules": [
352      {
353        "resource": "*",
354        "action": "*",
355        "conditions": [
356          {
357            "attribute": "role",
358            "operator": "eq",
359            "value": "admin"
360          },
361          {
362            "attribute": "source_ip",
363            "operator": "ip_in_cidr",
364            "value": "10.0.0.0/8"
365          }
366        ]
367      }
368    ]
369  }
370]`
371

1# kubernetes/network-policy.yaml
2# Microsegmentation for trading services
3
4---
5apiVersion: networking.k8s.io/v1
6kind: NetworkPolicy
7metadata:
8  name: order-service-policy
9  namespace: trading
10spec:
11  podSelector:
12    matchLabels:
13      app: order-service
14  policyTypes:
15  - Ingress
16  - Egress
17  
18  ingress:
19  # Only allow from API gateway
20  - from:
21    - podSelector:
22        matchLabels:
23          app: api-gateway
24    ports:
25    - protocol: TCP
26      port: 8080
27  
28  # Allow from monitoring
29  - from:
30    - namespaceSelector:
31        matchLabels:
32          name: monitoring
33    ports:
34    - protocol: TCP
35      port: 9090  # Metrics
36  
37  egress:
38  # Allow to position service
39  - to:
40    - podSelector:
41        matchLabels:
42          app: position-service
43    ports:
44    - protocol: TCP
45      port: 8080
46  
47  # Allow to risk engine
48  - to:
49    - podSelector:
50        matchLabels:
51          app: risk-engine
52    ports:
53    - protocol: TCP
54      port: 8080
55  
56  # Allow to database
57  - to:
58    - podSelector:
59        matchLabels:
60          app: postgres
61    ports:
62    - protocol: TCP
63      port: 5432
64  
65  # Allow DNS
66  - to:
67    - namespaceSelector:
68        matchLabels:
69          name: kube-system
70    ports:
71    - protocol: UDP
72      port: 53
73
74---
75apiVersion: networking.k8s.io/v1
76kind: NetworkPolicy
77metadata:
78  name: risk-engine-policy
79  namespace: trading
80spec:
81  podSelector:
82    matchLabels:
83      app: risk-engine
84  policyTypes:
85  - Ingress
86  - Egress
87  
88  ingress:
89  # Only from order service and position service
90  - from:
91    - podSelector:
92        matchLabels:
93          app: order-service
94    - podSelector:
95        matchLabels:
96          app: position-service
97    ports:
98    - protocol: TCP
99      port: 8080
100  
101  egress:
102  # Access to market data
103  - to:
104    - podSelector:
105        matchLabels:
106          app: market-data
107    ports:
108    - protocol: TCP
109      port: 8080
110  
111  # Access to database
112  - to:
113    - podSelector:
114        matchLabels:
115          app: postgres
116    ports:
117    - protocol: TCP
118      port: 5432
119  
120  # DNS
121  - to:
122    - namespaceSelector:
123        matchLabels:
124          name: kube-system
125    ports:
126    - protocol: UDP
127      port: 53
128
129---
130# Default deny all
131apiVersion: networking.k8s.io/v1
132kind: NetworkPolicy
133metadata:
134  name: default-deny-all
135  namespace: trading
136spec:
137  podSelector: {}
138  policyTypes:
139  - Ingress
140  - Egress
141

1// mtls/config.go
2package mtls
3
4import (
5    "crypto/tls"
6    "crypto/x509"
7    "errors"
8    "io/ioutil"
9    
10    "google.golang.org/grpc"
11    "google.golang.org/grpc/credentials"
12)
13
14// TLSConfig for mutual TLS
15type TLSConfig struct {
16    CertFile       string
17    KeyFile        string
18    CAFile         string
19    ServerName     string
20    MinVersion     uint16
21    CipherSuites   []uint16
22}
23
24// CreateServerTLSConfig creates TLS config for server
25func CreateServerTLSConfig(cfg TLSConfig) (*tls.Config, error) {
26    
27    // Load server certificate
28    cert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile)
29    if err != nil {
30        return nil, err
31    }
32    
33    // Load CA cert
34    caCert, err := ioutil.ReadFile(cfg.CAFile)
35    if err != nil {
36        return nil, err
37    }
38    
39    caCertPool := x509.NewCertPool()
40    if !caCertPool.AppendCertsFromPEM(caCert) {
41        return nil, errors.New("failed to add CA cert")
42    }
43    
44    return &tls.Config{
45        Certificates: []tls.Certificate{cert},
46        ClientAuth:   tls.RequireAndVerifyClientCert,
47        ClientCAs:    caCertPool,
48        MinVersion:   cfg.MinVersion,
49        CipherSuites: cfg.CipherSuites,
50    }, nil
51}
52
53// CreateClientTLSConfig creates TLS config for client
54func CreateClientTLSConfig(cfg TLSConfig) (*tls.Config, error) {
55    
56    // Load client certificate
57    cert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile)
58    if err != nil {
59        return nil, err
60    }
61    
62    // Load CA cert
63    caCert, err := ioutil.ReadFile(cfg.CAFile)
64    if err != nil {
65        return nil, err
66    }
67    
68    caCertPool := x509.NewCertPool()
69    if !caCertPool.AppendCertsFromPEM(caCert) {
70        return nil, errors.New("failed to add CA cert")
71    }
72    
73    return &tls.Config{
74        Certificates: []tls.Certificate{cert},
75        RootCAs:      caCertPool,
76        ServerName:   cfg.ServerName,
77        MinVersion:   cfg.MinVersion,
78        CipherSuites: cfg.CipherSuites,
79    }, nil
80}
81
82// NewServerWithMTLS creates gRPC server with mTLS
83func NewServerWithMTLS(tlsConfig *tls.Config) (*grpc.Server, error) {
84    
85    creds := credentials.NewTLS(tlsConfig)
86    
87    server := grpc.NewServer(
88        grpc.Creds(creds),
89        grpc.UnaryInterceptor(authInterceptor),
90    )
91    
92    return server, nil
93}
94
95// NewClientWithMTLS creates gRPC client with mTLS
96func NewClientWithMTLS(target string, tlsConfig *tls.Config) (*grpc.ClientConn, error) {
97    
98    creds := credentials.NewTLS(tlsConfig)
99    
100    conn, err := grpc.Dial(
101        target,
102        grpc.WithTransportCredentials(creds),
103    )
104    
105    return conn, err
106}
107
108// Certificate rotation
109func RotateCertificate(certPath, keyPath string) error {
110    // 1. Generate new key pair
111    // 2. Submit CSR to CA
112    // 3. Receive signed certificate
113    // 4. Write new cert and key atomically
114    // 5. Reload server without downtime
115    
116    // Implementation details omitted
117    return nil
118}
119
120// Recommended TLS configuration
121func SecureTLSConfig() TLSConfig {
122    return TLSConfig{
123        MinVersion: tls.VersionTLS13,
124        CipherSuites: []uint16{
125            tls.TLS_AES_256_GCM_SHA384,
126            tls.TLS_AES_128_GCM_SHA256,
127            tls.TLS_CHACHA20_POLY1305_SHA256,
128        },
129    }
130}
131
132// Auth interceptor
133func authInterceptor(
134    ctx context.Context,
135    req interface{},
136    info *grpc.UnaryServerInfo,
137    handler grpc.UnaryHandler,
138) (interface{}, error) {
139    
140    // Extract peer info
141    p, ok := peer.FromContext(ctx)
142    if !ok {
143        return nil, errors.New("no peer info")
144    }
145    
146    // Verify TLS
147    tlsInfo, ok := p.AuthInfo.(credentials.TLSInfo)
148    if !ok {
149        return nil, errors.New("no TLS info")
150    }
151    
152    // Check client certificate
153    if len(tlsInfo.State.VerifiedChains) == 0 {
154        return nil, errors.New("no verified chains")
155    }
156    
157    // Extract identity from certificate
158    cert := tlsInfo.State.VerifiedChains[0][0]
159    identity := cert.Subject.CommonName
160    
161    // Add identity to context
162    ctx = context.WithValue(ctx, "identity", identity)
163    
164    return handler(ctx, req)
165}
166

1Attack Prevention:
2- Failed intrusion attempts: 142/month
3- Blocked unauthorized access: 2,847 total
4- Mean time to detect: 4.2 seconds
5- Mean time to respond: 18 seconds
6
7Authentication:
8- MFA adoption: 100%
9- Device trust: 94% trusted devices
10- Average trust score: 0.87
11- Token rotation: Every 15 minutes
12
13Authorization:
14- Policy evaluations: 42M/day
15- Average decision latency: 1.2ms
16- Policy violations blocked: 47/day
17- Audit trail: 100% complete
18

1Microsegmentation:
2- Network policies: 127 rules
3- Service mesh encryption: 100%
4- mTLS adoption: 100%
5- Certificate rotation: Every 30 days
6
7Traffic Analysis:
8- Encrypted traffic: 100%
9- Lateral movement attempts: 0
10- Anomalous connections blocked: 23/month
11- Average connection latency: +2.1ms (mTLS overhead)
12

1Audit Results:
2- SOC 2 Type II: Passed
3- PCI DSS: Compliant
4- ISO 27001: Certified
5- Security incidents: 0 breaches
6
7Monitoring:
8- Log retention: 2 years
9- Audit queries: Real-time
10- Compliance dashboards: Updated hourly
11- Third-party audits: Quarterly
12

1Week 1-4: Identity
2- Implement strong authentication (MFA)
3- Deploy identity provider (Okta/Auth0)
4- Certificate infrastructure (PKI)
5- Device inventory and registration
6
7Week 5-8: Authorization
8- Design policy framework
9- Implement policy engine
10- Define initial policies
11- Deploy policy decision point
12
13Week 9-12: Encryption
14- mTLS for all services
15- Certificate automation
16- Key management system
17- Encrypted storage
18

1Week 13-16: Network Policies
2- Map service dependencies
3- Design segmentation strategy
4- Deploy network policies
5- Test connectivity
6
7Week 17-20: Service Mesh
8- Deploy Istio/Linkerd
9- Configure mTLS
10- Implement traffic policies
11- Observability setup
12
13Week 21-24: Verification
14- Continuous monitoring
15- Anomaly detection
16- Penetration testing
17- Security validation
18

1Week 25-28: Trust Scoring
2- Behavioral analytics
3- Risk scoring
4- Adaptive policies
5- Automated responses
6
7Week 29-32: Monitoring
8- SIEM integration
9- Security dashboards
10- Alert tuning
11- Incident response
12
13Week 33-36: Compliance
14- Audit logging
15- Compliance reports
16- Third-party audits
17- Documentation
18