A minimal, deployment-agnostic zero trust cybersecurity framework for federated research infrastructures
TL;DR
This work presents a minimal yet comprehensive cybersecurity architecture built around Zero Trust principles and darknet-inspired principles, which significantly reduces complexity, enhances security, and maintains flexibility in federated research scenarios.
Abstract
Modern research infrastructures increasingly span heterogeneous environments, including cloud computing, high-performance computing (HPC), edge computing nodes, and most recently quantum computers (QC). This diversity challenges traditional perimeter-based security models and demands more agile, robust cybersecurity solutions. In response, we present a minimal yet comprehensive cybersecurity architecture built around Zero Trust principles and darknet-inspired principles. Our solution adopts a deployment-agnostic approach, abstracting away environmental differences through encrypted overlay networks and identity-driven authentication and authorization mechanisms. The framework is instantiated as an open-source reference implementation, validated through a pilot deployment using Nebula, Keycloak, Open Policy Agent, and Traefik as its core components. Drawing from practical experience, we demonstrate the logical design, methodological approach, and architectural patterns needed for achieving secure, scalable, and user-friendly collaboration across organizational boundaries. A mixed evaluation that combines qualitative analysis, policy-correctness tests and targeted performance benchmarks, highlights how the proposed framework significantly reduces complexity, enhances security, and maintains flexibility in federated research scenarios. Finally, we outline a roadmap for extending the framework toward quantum resilience through the incremental adoption of post-quantum cryptographic mechanisms.
