A Zero-Trust Secure Remote Access Framework Using Mutual TLS and Device Posture Verification

Abstract

Traditional remote access solutions such as VPNs authenticate users only at login and then grant broad internal network access, exposing organizations to credential theft and lateral movement attacks. This paper proposes a Zero-Trust Secure Remote Access Framework that continuously verifies device identity and security posture before granting access. Mutual TLS (mTLS) restricts connectivity to organization-registered devices through certificate-based authentication, while a Device Posture Agent continuously evaluates antivirus, firewall, operating-system update, and disk-encryption status. The collected posture data is evaluated by a FastAPI-based Policy Engine, which grants application-level access only to compliant devices and redirects non-compliant devices for remediation. Unlike VPNs, which expose the entire internal network, the proposed framework restricts access to individual applications. Experimental results confirm that the framework correctly authenticates registered devices, detects posture violations in real time, and enforces dynamic ALLOW/REMEDIATE/DENY decisions, demonstrating a practical and scalable approach to Zero-Trust remote access.