SanctumSPA: Architectural Decoupling and Confidential Verification for High-Throughput Single Packet Authorization

Abstract

In high-throughput network perimeters, traditional single packet authorization (SPA) for zero trust network access faces performance bottlenecks and memory-safety risks from user-space packet capture and untrusted rich execution environments. To address these limitations, this study proposes SanctumSPA, an architectural integration and decoupling framework separating the policy enforcement point from the policy decision point. Authorization is modeled as an asynchronous pipeline in which the extended Berkeley Packet Filter (eBPF) performs kernel-level packet interception, while cryptographic verification is offloaded to an Intel Software Guard Extensions-based trusted execution environment. Security-critical parsing and control logic use Safe Rust and asynchronous input/output to reduce cross-boundary overhead. Cloud-based experiments showed up to two orders of magnitude higher throughput than a traditional user-space baseline, with hundreds of thousands of requests per second and sub-millisecond latency before queue saturation. During a 3,310,503-packet adversarial storm, the multi-tier defense separated capacity-driven overload shedding (92.2%) from deterministic security enforcement (7.7%), limiting the maximum observed queuing latency at 7.56 s while supporting legitimate probe recovery via burst redundancy. These findings indicate that combining eBPF with confidential computing provides a resilient gateway for high-throughput infrastructures.