google-site-verification: google61fe8ba583a51912.html
MACRO NEPAL
Zero Trust Architecture in Java: Complete Implementation Guide
awiskar acharya
November 16, 2025
7:15 am

Zero Trust Architecture (ZTA) is a security model that requires strict identity verification for every person and device trying to access resources on a private network. This guide provides a comprehensive Java implementation of Zero Trust principles.

Core Zero Trust Principles

  1. Never Trust, Always Verify
  2. Assume Breach
  3. Verify Explicitly
  4. Least Privilege Access
  5. Micro-segmentation

Dependencies and Setup

Maven Configuration

<!-- pom.xml --> <project> <modelVersion>4.0.0</modelVersion> <groupId>com.zerotrust</groupId> <artifactId>zero-trust-architecture</artifactId> <version>1.0.0</version> <properties> <maven.compiler.source>17</maven.compiler.source> <maven.compiler.target>17</maven.compiler.target> <spring-boot.version>3.1.0</spring-boot.version> <keycloak.version>21.1.1</keycloak.version> </properties> <dependencies> <!-- Spring Boot --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> <version>${spring-boot.version}</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> <version>${spring-boot.version}</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-validation</artifactId> <version>${spring-boot.version}</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-jpa</artifactId> <version>${spring-boot.version}</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-actuator</artifactId> <version>${spring-boot.version}</version> </dependency> <!-- OAuth2 and JWT --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-resource-server</artifactId> <version>${spring-boot.version}</version> </dependency> <!-- Database --> <dependency> <groupId>org.postgresql</groupId> <artifactId>postgresql</artifactId> <version>42.6.0</version> </dependency> <!-- Redis for session management --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-redis</artifactId> <version>${spring-boot.version}</version> </dependency> <!-- Monitoring and Observability --> <dependency> <groupId>io.micrometer</groupId> <artifactId>micrometer-registry-prometheus</artifactId> <version>1.11.0</version> </dependency> <!-- HTTP Client --> <dependency> <groupId>org.apache.httpcomponents.client5</groupId> <artifactId>httpclient5</artifactId> <version>5.2.1</version> </dependency> <!-- Testing --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-test</artifactId> <version>${spring-boot.version}</version> <scope>test</scope> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-test</artifactId> <version>6.1.0</version> <scope>test</scope> </dependency> </dependencies> </project>

Core Zero Trust Components

Example 1: Identity and Access Management

package com.zerotrust.identity; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; import org.springframework.security.oauth2.jwt.Jwt; import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken; import org.springframework.stereotype.Component; import java.time.Instant; import java.util.*; import java.util.stream.Collectors; @Component public class ZeroTrustIdentityService { private final DeviceVerificationService deviceVerificationService; private final RiskAssessmentService riskAssessmentService; private final AccessPolicyService accessPolicyService; public ZeroTrustIdentityService(DeviceVerificationService deviceVerificationService, RiskAssessmentService riskAssessmentService, AccessPolicyService accessPolicyService) { this.deviceVerificationService = deviceVerificationService; this.riskAssessmentService = riskAssessmentService; this.accessPolicyService = accessPolicyService; } /** * Comprehensive identity verification */ public IdentityContext verifyIdentity(JwtAuthenticationToken authentication, DeviceContext deviceContext, NetworkContext networkContext) { Jwt jwt = authentication.getToken(); // Multi-factor verification VerificationResult verification = performMultiFactorVerification( jwt, deviceContext, networkContext ); if (!verification.isVerified()) { throw new ZeroTrustAuthenticationException("Identity verification failed: " + verification.getFailureReason()); } // Risk assessment RiskAssessment risk = riskAssessmentService.assessRisk( jwt, deviceContext, networkContext ); // Create identity context IdentityContext identityContext = new IdentityContext(); identityContext.setUserId(jwt.getSubject()); identityContext.setUsername(jwt.getClaimAsString("preferred_username")); identityContext.setEmail(jwt.getClaimAsString("email")); identityContext.setDeviceId(deviceContext.getDeviceId()); identityContext.setRiskScore(risk.getRiskScore()); identityContext.setVerificationLevel(verification.getVerificationLevel()); identityContext.setSessionId(UUID.randomUUID().toString()); identityContext.setIssuedAt(Instant.now()); // Set context-aware authorities identityContext.setAuthorities(calculateContextAwareAuthorities( authentication, risk, deviceContext )); return identityContext; } private VerificationResult performMultiFactorVerification(Jwt jwt, DeviceContext deviceContext, NetworkContext networkContext) { VerificationResult result = new VerificationResult(); // 1. Token verification (already done by Spring Security) if (!isTokenValid(jwt)) { result.setVerified(false); result.setFailureReason("Invalid token"); return result; } // 2. Device verification DeviceVerification deviceVerification = deviceVerificationService.verifyDevice(deviceContext); if (!deviceVerification.isTrusted()) { result.setVerified(false); result.setFailureReason("Untrusted device: " + deviceVerification.getFailureReason()); return result; } // 3. Behavioral analysis if (!analyzeUserBehavior(jwt, deviceContext)) { result.setVerified(false); result.setFailureReason("Suspicious behavior detected"); return result; } // 4. Network context verification if (!verifyNetworkContext(networkContext)) { result.setVerified(false); result.setFailureReason("Suspicious network context"); return result; } result.setVerified(true); result.setVerificationLevel(calculateVerificationLevel(deviceVerification, networkContext)); return result; } private Collection<? extends GrantedAuthority> calculateContextAwareAuthorities( JwtAuthenticationToken authentication, RiskAssessment risk, DeviceContext deviceContext) { Set<GrantedAuthority> authorities = new HashSet<>(); // Base authorities from token authorities.addAll(authentication.getAuthorities()); // Risk-based restrictions if (risk.getRiskScore() > 70) { // High risk - restrict access authorities.removeIf(auth -> !auth.getAuthority().equals("ROLE_BASIC_ACCESS")); authorities.add(new SimpleGrantedAuthority("ROLE_RESTRICTED")); } // Device-based restrictions if (!deviceContext.isCorporateDevice()) { authorities.add(new SimpleGrantedAuthority("ROLE_EXTERNAL_DEVICE")); } // Time-based restrictions if (isOutsideWorkingHours()) { authorities.add(new SimpleGrantedAuthority("ROLE_AFTER_HOURS")); } return authorities; } private boolean isTokenValid(Jwt jwt) { return jwt.getExpiresAt() != null && jwt.getExpiresAt().isAfter(Instant.now()) && jwt.getIssuedAt() != null && jwt.getIssuedAt().isBefore(Instant.now()); } private boolean analyzeUserBehavior(Jwt jwt, DeviceContext deviceContext) { // Implement behavioral analysis logic // Check for unusual login patterns, geolocation, etc. return true; // Simplified for example } private boolean verifyNetworkContext(NetworkContext networkContext) { // Verify network is trusted return networkContext.isSecureNetwork() && !networkContext.isVpnInUse() && networkContext.getGeoLocation().isAllowed(); } private boolean isOutsideWorkingHours() { // Check if current time is outside normal working hours Calendar cal = Calendar.getInstance(); int hour = cal.get(Calendar.HOUR_OF_DAY); return hour < 8 || hour > 18; } private String calculateVerificationLevel(DeviceVerification deviceVerification, NetworkContext networkContext) { if (deviceVerification.isBiometricEnabled() && networkContext.isCorporateNetwork()) { return "HIGH"; } else if (deviceVerification.isCompliant()) { return "MEDIUM"; } else { return "LOW"; } } } // Context classes class IdentityContext { private String userId; private String username; private String email; private String deviceId; private double riskScore; private String verificationLevel; private String sessionId; private Instant issuedAt; private Collection<? extends GrantedAuthority> authorities; // Getters and setters public String getUserId() { return userId; } public void setUserId(String userId) { this.userId = userId; } public String getUsername() { return username; } public void setUsername(String username) { this.username = username; } public String getEmail() { return email; } public void setEmail(String email) { this.email = email; } public String getDeviceId() { return deviceId; } public void setDeviceId(String deviceId) { this.deviceId = deviceId; } public double getRiskScore() { return riskScore; } public void setRiskScore(double riskScore) { this.riskScore = riskScore; } public String getVerificationLevel() { return verificationLevel; } public void setVerificationLevel(String verificationLevel) { this.verificationLevel = verificationLevel; } public String getSessionId() { return sessionId; } public void setSessionId(String sessionId) { this.sessionId = sessionId; } public Instant getIssuedAt() { return issuedAt; } public void setIssuedAt(Instant issuedAt) { this.issuedAt = issuedAt; } public Collection<? extends GrantedAuthority> getAuthorities() { return authorities; } public void setAuthorities(Collection<? extends GrantedAuthority> authorities) { this.authorities = authorities; } } class DeviceContext { private String deviceId; private String deviceType; private String osVersion; private boolean isCompliant; private boolean isCorporateDevice; private boolean isBiometricEnabled; private String deviceCertificate; private Instant lastSecurityUpdate; // Getters and setters public String getDeviceId() { return deviceId; } public void setDeviceId(String deviceId) { this.deviceId = deviceId; } public String getDeviceType() { return deviceType; } public void setDeviceType(String deviceType) { this.deviceType = deviceType; } public String getOsVersion() { return osVersion; } public void setOsVersion(String osVersion) { this.osVersion = osVersion; } public boolean isCompliant() { return isCompliant; } public void setCompliant(boolean compliant) { isCompliant = compliant; } public boolean isCorporateDevice() { return isCorporateDevice; } public void setCorporateDevice(boolean corporateDevice) { isCorporateDevice = corporateDevice; } public boolean isBiometricEnabled() { return isBiometricEnabled; } public void setBiometricEnabled(boolean biometricEnabled) { isBiometricEnabled = biometricEnabled; } public String getDeviceCertificate() { return deviceCertificate; } public void setDeviceCertificate(String deviceCertificate) { this.deviceCertificate = deviceCertificate; } public Instant getLastSecurityUpdate() { return lastSecurityUpdate; } public void setLastSecurityUpdate(Instant lastSecurityUpdate) { this.lastSecurityUpdate = lastSecurityUpdate; } } class NetworkContext { private String ipAddress; private String geoLocation; private boolean isSecureNetwork; private boolean isVpnInUse; private boolean isCorporateNetwork; private String userAgent; // Getters and setters public String getIpAddress() { return ipAddress; } public void setIpAddress(String ipAddress) { this.ipAddress = ipAddress; } public String getGeoLocation() { return geoLocation; } public void setGeoLocation(String geoLocation) { this.geoLocation = geoLocation; } public boolean isSecureNetwork() { return isSecureNetwork; } public void setSecureNetwork(boolean secureNetwork) { isSecureNetwork = secureNetwork; } public boolean isVpnInUse() { return isVpnInUse; } public void setVpnInUse(boolean vpnInUse) { isVpnInUse = vpnInUse; } public boolean isCorporateNetwork() { return isCorporateNetwork; } public void setCorporateNetwork(boolean corporateNetwork) { isCorporateNetwork = corporateNetwork; } public String getUserAgent() { return userAgent; } public void setUserAgent(String userAgent) { this.userAgent = userAgent; } } class VerificationResult { private boolean verified; private String failureReason; private String verificationLevel; // Getters and setters public boolean isVerified() { return verified; } public void setVerified(boolean verified) { this.verified = verified; } public String getFailureReason() { return failureReason; } public void setFailureReason(String failureReason) { this.failureReason = failureReason; } public String getVerificationLevel() { return verificationLevel; } public void setVerificationLevel(String verificationLevel) { this.verificationLevel = verificationLevel; } } class RiskAssessment { private double riskScore; private List<String> riskFactors; private String riskLevel; // Getters and setters public double getRiskScore() { return riskScore; } public void setRiskScore(double riskScore) { this.riskScore = riskScore; } public List<String> getRiskFactors() { return riskFactors; } public void setRiskFactors(List<String> riskFactors) { this.riskFactors = riskFactors; } public String getRiskLevel() { return riskLevel; } public void setRiskLevel(String riskLevel) { this.riskLevel = riskLevel; } } // Custom exception class ZeroTrustAuthenticationException extends RuntimeException { public ZeroTrustAuthenticationException(String message) { super(message); } public ZeroTrustAuthenticationException(String message, Throwable cause) { super(message, cause); } }

Example 2: Device Verification Service

package com.zerotrust.device; import org.springframework.stereotype.Service; import java.time.Instant; import java.time.temporal.ChronoUnit; import java.util.*; @Service public class DeviceVerificationService { private final DeviceComplianceService complianceService; private final DeviceCertificateService certificateService; private final ThreatIntelligenceService threatIntelligenceService; // In-memory cache for device trust (use Redis in production) private final Map<String, DeviceTrustCache> deviceTrustCache = new HashMap<>(); public DeviceVerificationService(DeviceComplianceService complianceService, DeviceCertificateService certificateService, ThreatIntelligenceService threatIntelligenceService) { this.complianceService = complianceService; this.certificateService = certificateService; this.threatIntelligenceService = threatIntelligenceService; } public DeviceVerification verifyDevice(DeviceContext deviceContext) { DeviceVerification verification = new DeviceVerification(); // 1. Check device certificate if (!verifyDeviceCertificate(deviceContext.getDeviceCertificate())) { verification.setTrusted(false); verification.setFailureReason("Invalid device certificate"); return verification; } // 2. Check device compliance DeviceCompliance compliance = complianceService.checkCompliance(deviceContext); if (!compliance.isCompliant()) { verification.setTrusted(false); verification.setFailureReason("Device not compliant: " + compliance.getNonComplianceReasons()); return verification; } // 3. Check threat intelligence if (threatIntelligenceService.isDeviceCompromised(deviceContext.getDeviceId())) { verification.setTrusted(false); verification.setFailureReason("Device flagged as compromised"); return verification; } // 4. Check security update status if (!isSecurityUpdateCurrent(deviceContext.getLastSecurityUpdate())) { verification.setTrusted(false); verification.setFailureReason("Security updates not current"); return verification; } // 5. Update device trust cache updateDeviceTrustCache(deviceContext.getDeviceId(), verification); verification.setTrusted(true); verification.setComplianceLevel(compliance.getComplianceLevel()); verification.setBiometricEnabled(deviceContext.isBiometricEnabled()); return verification; } private boolean verifyDeviceCertificate(String deviceCertificate) { if (deviceCertificate == null || deviceCertificate.trim().isEmpty()) { return false; } return certificateService.validateCertificate(deviceCertificate); } private boolean isSecurityUpdateCurrent(Instant lastUpdate) { if (lastUpdate == null) { return false; } // Consider updates older than 30 days as outdated return lastUpdate.isAfter(Instant.now().minus(30, ChronoUnit.DAYS)); } private void updateDeviceTrustCache(String deviceId, DeviceVerification verification) { DeviceTrustCache cacheEntry = new DeviceTrustCache(); cacheEntry.setDeviceId(deviceId); cacheEntry.setLastVerified(Instant.now()); cacheEntry.setTrusted(verification.isTrusted()); cacheEntry.setComplianceLevel(verification.getComplianceLevel()); deviceTrustCache.put(deviceId, cacheEntry); } public boolean isDevicePreVerified(String deviceId) { DeviceTrustCache cacheEntry = deviceTrustCache.get(deviceId); if (cacheEntry == null) { return false; } // Consider cache valid for 1 hour return cacheEntry.isTrusted() && cacheEntry.getLastVerified().isAfter(Instant.now().minus(1, ChronoUnit.HOURS)); } } class DeviceVerification { private boolean trusted; private String failureReason; private String complianceLevel; private boolean biometricEnabled; // Getters and setters public boolean isTrusted() { return trusted; } public void setTrusted(boolean trusted) { this.trusted = trusted; } public String getFailureReason() { return failureReason; } public void setFailureReason(String failureReason) { this.failureReason = failureReason; } public String getComplianceLevel() { return complianceLevel; } public void setComplianceLevel(String complianceLevel) { this.complianceLevel = complianceLevel; } public boolean isBiometricEnabled() { return biometricEnabled; } public void setBiometricEnabled(boolean biometricEnabled) { this.biometricEnabled = biometricEnabled; } } class DeviceTrustCache { private String deviceId; private Instant lastVerified; private boolean trusted; private String complianceLevel; // Getters and setters public String getDeviceId() { return deviceId; } public void setDeviceId(String deviceId) { this.deviceId = deviceId; } public Instant getLastVerified() { return lastVerified; } public void setLastVerified(Instant lastVerified) { this.lastVerified = lastVerified; } public boolean isTrusted() { return trusted; } public void setTrusted(boolean trusted) { this.trusted = trusted; } public String getComplianceLevel() { return complianceLevel; } public void setComplianceLevel(String complianceLevel) { this.complianceLevel = complianceLevel; } }

Example 3: Risk Assessment Engine

package com.zerotrust.risk; import org.springframework.stereotype.Service; import java.time.Instant; import java.util.*; @Service public class RiskAssessmentService { private final UserBehaviorService userBehaviorService; private final ThreatIntelligenceService threatIntelligenceService; private final GeoLocationService geoLocationService; public RiskAssessmentService(UserBehaviorService userBehaviorService, ThreatIntelligenceService threatIntelligenceService, GeoLocationService geoLocationService) { this.userBehaviorService = userBehaviorService; this.threatIntelligenceService = threatIntelligenceService; this.geoLocationService = geoLocationService; } public RiskAssessment assessRisk(Object identityToken, DeviceContext deviceContext, NetworkContext networkContext) { RiskAssessment risk = new RiskAssessment(); List<String> riskFactors = new ArrayList<>(); double riskScore = 0.0; // 1. Device risk assessment double deviceRisk = assessDeviceRisk(deviceContext); riskScore += deviceRisk; if (deviceRisk > 20) riskFactors.add("High device risk"); // 2. Network risk assessment double networkRisk = assessNetworkRisk(networkContext); riskScore += networkRisk; if (networkRisk > 20) riskFactors.add("High network risk"); // 3. Behavioral risk assessment double behaviorRisk = assessBehavioralRisk(identityToken, deviceContext, networkContext); riskScore += behaviorRisk; if (behaviorRisk > 20) riskFactors.add("Suspicious behavior"); // 4. Threat intelligence risk double threatRisk = assessThreatIntelligenceRisk(identityToken, deviceContext, networkContext); riskScore += threatRisk; if (threatRisk > 20) riskFactors.add("Threat intelligence match"); // 5. Time-based risk double timeRisk = assessTimeBasedRisk(); riskScore += timeRisk; if (timeRisk > 10) riskFactors.add("Unusual access time"); risk.setRiskScore(Math.min(riskScore, 100.0)); risk.setRiskFactors(riskFactors); risk.setRiskLevel(calculateRiskLevel(riskScore)); return risk; } private double assessDeviceRisk(DeviceContext deviceContext) { double risk = 0.0; if (!deviceContext.isCompliant()) risk += 30; if (!deviceContext.isCorporateDevice()) risk += 20; if (!deviceContext.isBiometricEnabled()) risk += 10; // Check security update age if (deviceContext.getLastSecurityUpdate() != null) { long daysSinceUpdate = ChronoUnit.DAYS.between( deviceContext.getLastSecurityUpdate(), Instant.now() ); if (daysSinceUpdate > 90) risk += 25; else if (daysSinceUpdate > 30) risk += 15; } return risk; } private double assessNetworkRisk(NetworkContext networkContext) { double risk = 0.0; if (!networkContext.isSecureNetwork()) risk += 25; if (networkContext.isVpnInUse()) risk += 15; if (!networkContext.isCorporateNetwork()) risk += 20; // Geo-location risk GeoLocationRisk geoRisk = geoLocationService.assessLocationRisk(networkContext.getGeoLocation()); risk += geoRisk.getRiskScore(); return risk; } private double assessBehavioralRisk(Object identityToken, DeviceContext deviceContext, NetworkContext networkContext) { return userBehaviorService.analyzeBehavior(identityToken, deviceContext, networkContext); } private double assessThreatIntelligenceRisk(Object identityToken, DeviceContext deviceContext, NetworkContext networkContext) { double risk = 0.0; if (threatIntelligenceService.isIpBlacklisted(networkContext.getIpAddress())) { risk += 40; } if (threatIntelligenceService.isDeviceCompromised(deviceContext.getDeviceId())) { risk += 50; } return risk; } private double assessTimeBasedRisk() { Calendar cal = Calendar.getInstance(); int hour = cal.get(Calendar.HOUR_OF_DAY); int dayOfWeek = cal.get(Calendar.DAY_OF_WEEK); // Higher risk outside business hours and weekends if (hour < 8 || hour > 18) { return 15.0; } if (dayOfWeek == Calendar.SATURDAY || dayOfWeek == Calendar.SUNDAY) { return 20.0; } return 0.0; } private String calculateRiskLevel(double riskScore) { if (riskScore >= 80) return "CRITICAL"; if (riskScore >= 60) return "HIGH"; if (riskScore >= 40) return "MEDIUM"; if (riskScore >= 20) return "LOW"; return "MINIMAL"; } }

Example 4: Policy Enforcement Point

package com.zerotrust.policy; import org.springframework.security.access.AccessDecisionVoter; import org.springframework.security.access.ConfigAttribute; import org.springframework.security.core.Authentication; import org.springframework.security.web.FilterInvocation; import org.springframework.stereotype.Component; import java.util.Collection; import java.util.regex.Pattern; @Component public class ZeroTrustAccessDecisionVoter implements AccessDecisionVoter<FilterInvocation> { private final PolicyDecisionPoint policyDecisionPoint; private final ContextAwarePolicyService contextAwarePolicyService; // Micro-segmentation patterns private final Pattern sensitiveDataPattern = Pattern.compile("/api/v1/(users|payments|admin)/.*"); private final Pattern internalApiPattern = Pattern.compile("/internal/.*"); public ZeroTrustAccessDecisionVoter(PolicyDecisionPoint policyDecisionPoint, ContextAwarePolicyService contextAwarePolicyService) { this.policyDecisionPoint = policyDecisionPoint; this.contextAwarePolicyService = contextAwarePolicyService; } @Override public boolean supports(ConfigAttribute attribute) { return true; } @Override public boolean supports(Class<?> clazz) { return FilterInvocation.class.isAssignableFrom(clazz); } @Override public int vote(Authentication authentication, FilterInvocation filterInvocation, Collection<ConfigAttribute> attributes) { String requestUrl = filterInvocation.getRequestUrl(); String httpMethod = filterInvocation.getHttpRequest().getMethod(); // Get Zero Trust context ZeroTrustContext zeroTrustContext = extractZeroTrustContext(authentication, filterInvocation); // Apply micro-segmentation if (isSensitiveEndpoint(requestUrl)) { return voteSensitiveAccess(authentication, zeroTrustContext, requestUrl, httpMethod); } if (isInternalEndpoint(requestUrl)) { return voteInternalAccess(authentication, zeroTrustContext, requestUrl, httpMethod); } // Default policy evaluation PolicyDecision decision = policyDecisionPoint.evaluate( authentication, zeroTrustContext, requestUrl, httpMethod ); return decision.isAllowed() ? ACCESS_GRANTED : ACCESS_DENIED; } private ZeroTrustContext extractZeroTrustContext(Authentication authentication, FilterInvocation filterInvocation) { ZeroTrustContext context = new ZeroTrustContext(); // Extract from authentication if (authentication.getPrincipal() instanceof ZeroTrustUser) { ZeroTrustUser user = (ZeroTrustUser) authentication.getPrincipal(); context.setUserContext(user.getUserContext()); } // Extract device context context.setDeviceContext(extractDeviceContext(filterInvocation)); // Extract network context context.setNetworkContext(extractNetworkContext(filterInvocation)); // Extract request context context.setRequestContext(extractRequestContext(filterInvocation)); return context; } private DeviceContext extractDeviceContext(FilterInvocation filterInvocation) { DeviceContext deviceContext = new DeviceContext(); // Extract from headers String userAgent = filterInvocation.getRequest().getHeader("User-Agent"); String deviceId = filterInvocation.getRequest().getHeader("X-Device-ID"); String deviceCertificate = filterInvocation.getRequest().getHeader("X-Device-Certificate"); deviceContext.setUserAgent(userAgent); deviceContext.setDeviceId(deviceId); deviceContext.setDeviceCertificate(deviceCertificate); // Additional device context extraction logic // This would typically involve calling device attestation services return deviceContext; } private NetworkContext extractNetworkContext(FilterInvocation filterInvocation) { NetworkContext networkContext = new NetworkContext(); String ipAddress = filterInvocation.getRequest().getRemoteAddr(); String forwardedFor = filterInvocation.getRequest().getHeader("X-Forwarded-For"); networkContext.setIpAddress(forwardedFor != null ? forwardedFor : ipAddress); networkContext.setUserAgent(filterInvocation.getRequest().getHeader("User-Agent")); // Determine network trust level networkContext.setSecureNetwork(isSecureConnection(filterInvocation)); networkContext.setCorporateNetwork(isCorporateNetwork(ipAddress)); networkContext.setVpnInUse(isVpnConnection(ipAddress)); return networkContext; } private RequestContext extractRequestContext(FilterInvocation filterInvocation) { RequestContext requestContext = new RequestContext(); requestContext.setUrl(filterInvocation.getRequestUrl()); requestContext.setMethod(filterInvocation.getHttpRequest().getMethod()); requestContext.setTimestamp(java.time.Instant.now()); requestContext.setQueryString(filterInvocation.getRequest().getQueryString()); return requestContext; } private int voteSensitiveAccess(Authentication authentication, ZeroTrustContext context, String requestUrl, String httpMethod) { // Enhanced security for sensitive endpoints if (!context.getUserContext().isHighlyAssuredIdentity()) { return ACCESS_DENIED; } if (!context.getDeviceContext().isCorporateDevice()) { return ACCESS_DENIED; } if (context.getRiskAssessment().getRiskScore() > 40) { return ACCESS_DENIED; } // Check time-based access if (!isDuringBusinessHours()) { return ACCESS_DENIED; } return policyDecisionPoint.evaluate(authentication, context, requestUrl, httpMethod) .isAllowed() ? ACCESS_GRANTED : ACCESS_DENIED; } private int voteInternalAccess(Authentication authentication, ZeroTrustContext context, String requestUrl, String httpMethod) { // Internal APIs require corporate network if (!context.getNetworkContext().isCorporateNetwork()) { return ACCESS_DENIED; } // Internal APIs require corporate devices if (!context.getDeviceContext().isCorporateDevice()) { return ACCESS_DENIED; } return policyDecisionPoint.evaluate(authentication, context, requestUrl, httpMethod) .isAllowed() ? ACCESS_GRANTED : ACCESS_DENIED; } private boolean isSensitiveEndpoint(String url) { return sensitiveDataPattern.matcher(url).matches(); } private boolean isInternalEndpoint(String url) { return internalApiPattern.matcher(url).matches(); } private boolean isSecureConnection(FilterInvocation filterInvocation) { return filterInvocation.getRequest().isSecure(); } private boolean isCorporateNetwork(String ipAddress) { // Check if IP belongs to corporate network range return ipAddress.startsWith("10.") || ipAddress.startsWith("192.168.") || ipAddress.startsWith("172.16."); } private boolean isVpnConnection(String ipAddress) { // Check if IP belongs to known VPN ranges // This would typically involve checking against a database return false; } private boolean isDuringBusinessHours() { Calendar cal = Calendar.getInstance(); int hour = cal.get(Calendar.HOUR_OF_DAY); int dayOfWeek = cal.get(Calendar.DAY_OF_WEEK); return hour >= 8 && hour <= 18 && dayOfWeek >= Calendar.MONDAY && dayOfWeek <= Calendar.FRIDAY; } } class ZeroTrustContext { private UserContext userContext; private DeviceContext deviceContext; private NetworkContext networkContext; private RequestContext requestContext; private RiskAssessment riskAssessment; // Getters and setters public UserContext getUserContext() { return userContext; } public void setUserContext(UserContext userContext) { this.userContext = userContext; } public DeviceContext getDeviceContext() { return deviceContext; } public void setDeviceContext(DeviceContext deviceContext) { this.deviceContext = deviceContext; } public NetworkContext getNetworkContext() { return networkContext; } public void setNetworkContext(NetworkContext networkContext) { this.networkContext = networkContext; } public RequestContext getRequestContext() { return requestContext; } public void setRequestContext(RequestContext requestContext) { this.requestContext = requestContext; } public RiskAssessment getRiskAssessment() { return riskAssessment; } public void setRiskAssessment(RiskAssessment riskAssessment) { this.riskAssessment = riskAssessment; } } class RequestContext { private String url; private String method; private Instant timestamp; private String queryString; // Getters and setters public String getUrl() { return url; } public void setUrl(String url) { this.url = url; } public String getMethod() { return method; } public void setMethod(String method) { this.method = method; } public Instant getTimestamp() { return timestamp; } public void setTimestamp(Instant timestamp) { this.timestamp = timestamp; } public String getQueryString() { return queryString; } public void setQueryString(String queryString) { this.queryString = queryString; } } class PolicyDecision { private boolean allowed; private String reason; private List<String> obligations; // Getters and setters public boolean isAllowed() { return allowed; } public void setAllowed(boolean allowed) { this.allowed = allowed; } public String getReason() { return reason; } public void setReason(String reason) { this.reason = reason; } public List<String> getObligations() { return obligations; } public void setObligations(List<String> obligations) { this.obligations = obligations; } }

Example 5: Security Configuration

package com.zerotrust.config; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.access.intercept.AuthorizationFilter; import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfigurationSource; import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import java.util.Arrays; @Configuration @EnableWebSecurity @EnableMethodSecurity(prePostEnabled = true) public class ZeroTrustSecurityConfig { private final ZeroTrustAuthenticationFilter zeroTrustAuthenticationFilter; private final ZeroTrustAccessDecisionManager zeroTrustAccessDecisionManager; public ZeroTrustSecurityConfig(ZeroTrustAuthenticationFilter zeroTrustAuthenticationFilter, ZeroTrustAccessDecisionManager zeroTrustAccessDecisionManager) { this.zeroTrustAuthenticationFilter = zeroTrustAuthenticationFilter; this.zeroTrustAccessDecisionManager = zeroTrustAccessDecisionManager; } @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http // Zero Trust: No implicit trust .csrf().disable() .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() // CORS configuration .cors().configurationSource(corsConfigurationSource()) .and() // Add Zero Trust authentication filter .addFilterBefore(zeroTrustAuthenticationFilter, AuthorizationFilter.class) // Authorization .authorizeHttpRequests(authorize -> authorize .requestMatchers("/api/public/**").permitAll() .requestMatchers("/actuator/health").permitAll() .requestMatchers("/internal/**").hasRole("INTERNAL") .anyRequest().authenticated() ) // Use Zero Trust access decision manager .authorizeHttpRequests() .accessDecisionManager(zeroTrustAccessDecisionManager) // OAuth2 Resource Server configuration .and() .oauth2ResourceServer(oauth2 -> oauth2 .jwt(jwt -> jwt .jwtAuthenticationConverter(new ZeroTrustJwtAuthenticationConverter()) ) ) // Security headers .headers(headers -> headers .contentSecurityPolicy("default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'") .and() .httpStrictTransportSecurity().maxAgeInSeconds(31536000) .and() .xssProtection().block(false) .and() .frameOptions().deny() ); return http.build(); } @Bean public CorsConfigurationSource corsConfigurationSource() { CorsConfiguration configuration = new CorsConfiguration(); configuration.setAllowedOriginPatterns(Arrays.asList( "https://*.company.com", "https://company.com" )); configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS")); configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type", "X-Device-ID", "X-Device-Certificate")); configuration.setExposedHeaders(Arrays.asList("X-Request-ID", "X-Rate-Limit-Remaining")); configuration.setAllowCredentials(true); configuration.setMaxAge(3600L); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); source.registerCorsConfiguration("/**", configuration); return source; } } // Zero Trust JWT Authentication Converter class ZeroTrustJwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> { private final ZeroTrustIdentityService identityService; public ZeroTrustJwtAuthenticationConverter(ZeroTrustIdentityService identityService) { this.identityService = identityService; } @Override public AbstractAuthenticationToken convert(Jwt jwt) { // Extract device and network context from request DeviceContext deviceContext = extractDeviceContext(); NetworkContext networkContext = extractNetworkContext(); // Perform Zero Trust identity verification IdentityContext identityContext = identityService.verifyIdentity( new JwtAuthenticationToken(jwt), deviceContext, networkContext ); // Create Zero Trust authentication token return new ZeroTrustAuthenticationToken(identityContext, jwt); } private DeviceContext extractDeviceContext() { // Extract from current request ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes(); if (attributes != null) { HttpServletRequest request = attributes.getRequest(); DeviceContext deviceContext = new DeviceContext(); deviceContext.setDeviceId(request.getHeader("X-Device-ID")); deviceContext.setDeviceCertificate(request.getHeader("X-Device-Certificate")); deviceContext.setUserAgent(request.getHeader("User-Agent")); return deviceContext; } return new DeviceContext(); } private NetworkContext extractNetworkContext() { ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes(); if (attributes != null) { HttpServletRequest request = attributes.getRequest(); NetworkContext networkContext = new NetworkContext(); networkContext.setIpAddress(getClientIpAddress(request)); networkContext.setUserAgent(request.getHeader("User-Agent")); networkContext.setSecureNetwork(request.isSecure()); return networkContext; } return new NetworkContext(); } private String getClientIpAddress(HttpServletRequest request) { String xForwardedFor = request.getHeader("X-Forwarded-For"); if (xForwardedFor != null && !xForwardedFor.isEmpty()) { return xForwardedFor.split(",")[0].trim(); } return request.getRemoteAddr(); } }

Example 6: Monitoring and Auditing

package com.zerotrust.monitoring; import org.springframework.stereotype.Component; import io.micrometer.core.instrument.Counter; import io.micrometer.core.instrument.MeterRegistry; import io.micrometer.core.instrument.Timer; import java.time.Instant; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentMap; @Component public class ZeroTrustAuditService { private final MeterRegistry meterRegistry; private final AuditLogRepository auditLogRepository; // Metrics private final Counter authenticationSuccessCounter; private final Counter authenticationFailureCounter; private final Counter accessGrantedCounter; private final Counter accessDeniedCounter; private final Timer authenticationTimer; // Real-time threat detection private final ConcurrentMap<String, UserAccessPattern> userAccessPatterns = new ConcurrentHashMap<>(); public ZeroTrustAuditService(MeterRegistry meterRegistry, AuditLogRepository auditLogRepository) { this.meterRegistry = meterRegistry; this.auditLogRepository = auditLogRepository; // Initialize metrics this.authenticationSuccessCounter = Counter.builder("zerotrust.auth.success") .description("Number of successful authentications") .register(meterRegistry); this.authenticationFailureCounter = Counter.builder("zerotrust.auth.failure") .description("Number of failed authentications") .register(meterRegistry); this.accessGrantedCounter = Counter.builder("zerotrust.access.granted") .description("Number of granted access requests") .register(meterRegistry); this.accessDeniedCounter = Counter.builder("zerotrust.access.denied") .description("Number of denied access requests") .register(meterRegistry); this.authenticationTimer = Timer.builder("zerotrust.auth.duration") .description("Time taken for authentication") .register(meterRegistry); } public void logAuthenticationAttempt(AuthenticationAttempt attempt) { AuditLogEntry logEntry = new AuditLogEntry(); logEntry.setTimestamp(Instant.now()); logEntry.setEventType("AUTHENTICATION_ATTEMPT"); logEntry.setUserId(attempt.getUserId()); logEntry.setDeviceId(attempt.getDeviceId()); logEntry.setIpAddress(attempt.getIpAddress()); logEntry.setSuccess(attempt.isSuccess()); logEntry.setRiskScore(attempt.getRiskScore()); logEntry.setDetails(attempt.getDetails()); auditLogRepository.save(logEntry); // Update metrics if (attempt.isSuccess()) { authenticationSuccessCounter.increment(); } else { authenticationFailureCounter.increment(); } // Update access patterns for anomaly detection updateAccessPatterns(attempt); } public void logAccessDecision(AccessDecision decision) { AuditLogEntry logEntry = new AuditLogEntry(); logEntry.setTimestamp(Instant.now()); logEntry.setEventType("ACCESS_DECISION"); logEntry.setUserId(decision.getUserId()); logEntry.setResource(decision.getResource()); logEntry.setAction(decision.getAction()); logEntry.setGranted(decision.isGranted()); logEntry.setRiskScore(decision.getRiskScore()); logEntry.setPolicy(decision.getPolicyName()); logEntry.setDetails(decision.getDetails()); auditLogRepository.save(logEntry); // Update metrics if (decision.isGranted()) { accessGrantedCounter.increment(); } else { accessDeniedCounter.increment(); } } public void logSecurityEvent(SecurityEvent event) { AuditLogEntry logEntry = new AuditLogEntry(); logEntry.setTimestamp(Instant.now()); logEntry.setEventType("SECURITY_EVENT"); logEntry.setSeverity(event.getSeverity()); logEntry.setEventCode(event.getEventCode()); logEntry.setDescription(event.getDescription()); logEntry.setDetails(event.getDetails()); auditLogRepository.save(logEntry); // Alert if high severity if (event.getSeverity().equals("HIGH") || event.getSeverity().equals("CRITICAL")) { triggerSecurityAlert(event); } } private void updateAccessPatterns(AuthenticationAttempt attempt) { String userId = attempt.getUserId(); UserAccessPattern pattern = userAccessPatterns.computeIfAbsent(userId, k -> new UserAccessPattern(userId)); pattern.recordAccess(attempt); // Check for anomalies if (pattern.detectAnomalies()) { SecurityEvent anomalyEvent = new SecurityEvent(); anomalyEvent.setSeverity("MEDIUM"); anomalyEvent.setEventCode("ANOMALOUS_ACCESS_PATTERN"); anomalyEvent.setDescription("Unusual access pattern detected for user: " + userId); anomalyEvent.setDetails(pattern.getAnomalyDetails()); logSecurityEvent(anomalyEvent); } } private void triggerSecurityAlert(SecurityEvent event) { // Implement alerting logic (email, SMS, Slack, etc.) System.err.println("SECURITY ALERT: " + event.getDescription()); // Could integrate with SIEM systems // siemService.sendAlert(event); } public AuthenticationMetrics getAuthenticationMetrics() { AuthenticationMetrics metrics = new AuthenticationMetrics(); metrics.setSuccessCount(authenticationSuccessCounter.count()); metrics.setFailureCount(authenticationFailureCounter.count()); metrics.setSuccessRate(authenticationSuccessCounter.count() / (authenticationSuccessCounter.count() + authenticationFailureCounter.count())); return metrics; } } class AuthenticationAttempt { private String userId; private String deviceId; private String ipAddress; private boolean success; private double riskScore; private String details; private Instant timestamp; // Getters and setters public String getUserId() { return userId; } public void setUserId(String userId) { this.userId = userId; } public String getDeviceId() { return deviceId; } public void setDeviceId(String deviceId) { this.deviceId = deviceId; } public String getIpAddress() { return ipAddress; } public void setIpAddress(String ipAddress) { this.ipAddress = ipAddress; } public boolean isSuccess() { return success; } public void setSuccess(boolean success) { this.success = success; } public double getRiskScore() { return riskScore; } public void setRiskScore(double riskScore) { this.riskScore = riskScore; } public String getDetails() { return details; } public void setDetails(String details) { this.details = details; } public Instant getTimestamp() { return timestamp; } public void setTimestamp(Instant timestamp) { this.timestamp = timestamp; } } class AccessDecision { private String userId; private String resource; private String action; private boolean granted; private double riskScore; private String policyName; private String details; // Getters and setters public String getUserId() { return userId; } public void setUserId(String userId) { this.userId = userId; } public String getResource() { return resource; } public void setResource(String resource) { this.resource = resource; } public String getAction() { return action; } public void setAction(String action) { this.action = action; } public boolean isGranted() { return granted; } public void setGranted(boolean granted) { this.granted = granted; } public double getRiskScore() { return riskScore; } public void setRiskScore(double riskScore) { this.riskScore = riskScore; } public String getPolicyName() { return policyName; } public void setPolicyName(String policyName) { this.policyName = policyName; } public String getDetails() { return details; } public void setDetails(String details) { this.details = details; } } class SecurityEvent { private String severity; private String eventCode; private String description; private String details; // Getters and setters public String getSeverity() { return severity; } public void setSeverity(String severity) { this.severity = severity; } public String getEventCode() { return eventCode; } public void setEventCode(String eventCode) { this.eventCode = eventCode; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public String getDetails() { return details; } public void setDetails(String details) { this.details = details; } } class UserAccessPattern { private String userId; private List<AuthenticationAttempt> recentAttempts = new ArrayList<>(); private Map<String, Integer> locationFrequency = new HashMap<>(); private Map<String, Integer> deviceFrequency = new HashMap<>(); public UserAccessPattern(String userId) { this.userId = userId; } public void recordAccess(AuthenticationAttempt attempt) { recentAttempts.add(attempt); // Keep only last 100 attempts if (recentAttempts.size() > 100) { recentAttempts.remove(0); } // Update frequency maps locationFrequency.merge(attempt.getIpAddress(), 1, Integer::sum); deviceFrequency.merge(attempt.getDeviceId(), 1, Integer::sum); } public boolean detectAnomalies() { if (recentAttempts.size() < 5) { return false; // Not enough data } // Check for rapid successive attempts if (hasRapidSuccessiveAttempts()) { return true; } // Check for unusual location if (hasUnusualLocation()) { return true; } // Check for multiple devices if (hasMultipleDevices()) { return true; } return false; } private boolean hasRapidSuccessiveAttempts() { if (recentAttempts.size() < 2) return false; AuthenticationAttempt last = recentAttempts.get(recentAttempts.size() - 1); AuthenticationAttempt secondLast = recentAttempts.get(recentAttempts.size() - 2); long secondsBetween = java.time.Duration.between( secondLast.getTimestamp(), last.getTimestamp() ).getSeconds(); return secondsBetween < 5; // Less than 5 seconds between attempts } private boolean hasUnusualLocation() { if (locationFrequency.size() < 2) return false; // If user is accessing from many different locations in short time return locationFrequency.size() > 3 && recentAttempts.size() > 10; } private boolean hasMultipleDevices() { return deviceFrequency.size() > 2; } public String getAnomalyDetails() { return String.format("User %s: locations=%d, devices=%d, attempts=%d", userId, locationFrequency.size(), deviceFrequency.size(), recentAttempts.size()); } }

Application Configuration

# application.properties # Zero Trust Configuration zerotrust.identity-provider.url=https://auth.company.com zerotrust.device-attestation.enabled=true zerotrust.risk-threshold.medium=40 zerotrust.risk-threshold.high=70 zerotrust.session.timeout-minutes=15 # Security spring.security.oauth2.resourceserver.jwt.issuer-uri=https://auth.company.com/realms/company spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://auth.company.com/realms/company/protocol/openid-connect/certs # Database spring.datasource.url=jdbc:postgresql://localhost:5432/zerotrust spring.datasource.username=zerotrust_user spring.datasource.password=secure_password # Redis spring.redis.host=localhost spring.redis.port=6379 # Monitoring management.endpoints.web.exposure.include=health,metrics,prometheus management.endpoint.health.show-details=always

Conclusion

This Zero Trust Architecture implementation provides:

Core Components:

  1. Identity Verification: Multi-factor, context-aware authentication
  2. Device Trust: Comprehensive device compliance checking
  3. Risk Assessment: Real-time risk scoring and analysis
  4. Policy Enforcement: Context-aware access control
  5. Monitoring & Auditing: Comprehensive logging and anomaly detection

Key Benefits:

  • Enhanced Security: No implicit trust, continuous verification
  • Adaptive Access: Dynamic permissions based on risk context
  • Compliance: Meets regulatory requirements for access control
  • Visibility: Complete audit trail and monitoring

Production Considerations:

  • Performance: Cache device trust and risk assessments
  • Scalability: Use distributed caching (Redis) for session management
  • Resilience: Implement circuit breakers for external services
  • Compliance: Regular security audits and penetration testing
  • Monitoring: Integrate with SIEM systems for security analytics

This implementation provides a solid foundation for Zero Trust Architecture that can be extended based on specific organizational requirements and threat models.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper