Backend Zero Trust Architecture — Implementing Zero Trust for Backend Services

// Service identity with mTLS
const tls = require('tls');
const fs = require('fs');

function createMTLSServer(app) {
  const options = {
    key: fs.readFileSync('/etc/certs/service.key'),
    cert: fs.readFileSync('/etc/certs/service.crt'),
    ca: fs.readFileSync('/etc/certs/ca.crt'),
    requestCert: true,
    rejectUnauthorized: true,
    // Validate client certificate
    checkServerIdentity: (hostname, cert) => {
      const serviceName = cert.subject.CN;
      if (!allowedServices.includes(serviceName)) {
        return new Error(`Service ${serviceName} not authorized`);
      }
      return undefined;
    }
  };

  return tls.createServer(options, app);
}

// Service-to-service authentication
class ServiceAuth {
  constructor() {
    this.serviceToken = this.generateServiceToken();
  }

  generateServiceToken() {
    return jwt.sign(
      {
        service: config.serviceName,
        version: config.version,
        nonce: crypto.randomUUID()
      },
      process.env.SERVICE_SECRET,
      { expiresIn: '5m', algorithm: 'HS256' }
    );
  }

  getAuthHeaders() {
    return {
      'X-Service-Name': config.serviceName,
      'X-Service-Token': this.serviceToken,
      'X-Service-Version': config.version
    };
  }

  verifyServiceRequest(req, res, next) {
    const serviceName = req.headers['x-service-name'];
    const serviceToken = req.headers['x-service-token'];

    if (!serviceName || !serviceToken) {
      return res.status(401).json({ error: 'Service authentication required' });
    }

    try {
      const decoded = jwt.verify(serviceToken, process.env.SERVICE_SECRET);
      if (decoded.service !== serviceName) {
        return res.status(403).json({ error: 'Service name mismatch' });
      }

      req.callingService = decoded;
      next();
    } catch {
      return res.status(401).json({ error: 'Invalid service token' });
    }
  }
}

// Network segmentation
// Kubernetes NetworkPolicy
// apiVersion: networking.k8s.io/v1
// kind: NetworkPolicy
// metadata:
//   name: api-allow-scanning
// spec:
//   podSelector: { matchLabels: { app: scan-api } }
//   ingress:
//   - from:
//     - podSelector: { matchLabels: { app: api-gateway } }
//     ports: [{ port: 8080 }]