High Trust Cloud Networking Defended by an Automated Moving Target Defense

The DoD has a vast number of applications that operate as legacy monolithic apps and others that are transforming to the cloud and modern software architectures. Service mesh applications (a combination of microservices deployed in a single cluster) are part of the DoD reference architecture. But microservices can only communicate easily with each other within the cluster. Communicating with other apps in other clusters, cloud environments, and in other organizations is complicated, difficult to implement and maintain, and fragile. The proposed RDT&E effort explores the potential to use an existing commercial innovation - a Workload Security Proxy (WoSP) - to augment existing DoD apps, services, devices (known as workloads) so that the communication impediments that exist outside the cluster are bypassed and the workloads can securely share data and benefit from the added protection of an Automated Moving Target Defense. (AMTD). A WoSP is a conventional networking proxy similar to the Sidecar Container Security Stack (SCSS) used by Platform One, but it has additional capabilities that allow it to proxy the identity and secrets manager functions for a host workload. Several WoSP innovations enable it to build an on-demand and ephemeral AMTD around communication workloads located anywhere and everywhere.  The WoSP innovations include:1) The ability for two WoSPs to generate identical encryption keys at the same time.2) The end-to-end encryption of WoSP messages without exchanging the encryption key. A new key is generated for each communication session and used keys vanish when a session closes.3) The ability to augment existing identity credentials with a trustworthy active credential that rotates frequently and is verifiable at the start of each session.4) The ability to recognize attempts for untrusted access to a workload and to reject 100% of them to protect the workload. Only trusted workloads can communicate and share data. WoSPs can even connect workloads in different segments and organizations by using a “Kerberos for the Cloud” (K4C) protocol invented by the offeror. The K4C protocol verifies the identity trust of workload in other segments and organizations before a communication session is permitted. The high frequency rotation of workload credentials prevents peer competitors from accessing sensitive applications or their data in transit. The attack surface is covered with a micro-grained AMTD that defends pairs of communicating workloads and their data. The WoSP approach improves USAF operational readiness and ensures the data shared among its JADC2 nodes is confidential and untampered. Compared to conventional service mesh implementations, WoSPs are much easier to configure and deploy, are less brittle, provide resilient active cyber defense to a larger population of applications, and operate at the scale and speed of the cloud. The technical approach offers the USAF a revolutionary asymmetric cyber advantage.