> ZERO-TRUST // zt-arch-17

Software-Defined Perimeter (SDP) Dynamic Knocking

Zero-visibility infrastructure architecture using Software-Defined Perimeter (SDP) and Single Packet Authorization (SPA), keeping server ports completely closed (drop 100%) until cryptographically authenticated.

OverviewNIST 800-207 Architectures18 Posture WizardInteractive Manuals10 Comparison Matrix22

Back to 18 Architectures Catalog Evaluate Posture in Sizer Wizard

Adversary Threat Model

Adversary executes port scans (nmap / masscan) across public IP ranges, attempting to locate open administrative ports.

Architecture Specs

CISA Pillar:NETWORKS

Archetype:NETWORK_MICROSEGMENTATION

Raw Spec:text/markdown

NIST SP 800-207 Tenets Enforced

✓All communication is secured regardless of network location.
✓All data sources and computing services are considered resources.

MITRE ATT&CK Techniques Blocked

T1046Mitigated

T1190Mitigated

T1133Mitigated

3 Maturity Tier Configurations

Evolutionary engineering configurations from baseline Initial up to CISA Optimal zero-compromise fortress.

INITIAL TIER

Implementation Scope:

Traditional bastion host with SSH keys and restricted IP allowlists.

Authentication:

Static firewall rules updated manually.

Network Isolation:

Port 22 open to corporate office IP ranges.

Telemetry & Auditing:

SSHD connection logs in `/var/log/auth.log`.

Stack Components:

opensshiptables

⚠️ Failure Risk: IP allowlist bypass when employees travel or work remotely.

ADVANCED TIER

Implementation Scope:

Single Packet Authorization (SPA) client sending encrypted HMAC packet before opening temporary port.

Authentication:

Port opens strictly for caller IP for exactly 30 seconds to complete handshake.

Network Isolation:

Default state of all external firewalls is 100% DROP.

Telemetry & Auditing:

SPA authentication attempts logged with cryptographic signature verification.

Stack Components:

fwknopiptablesgnupg

⚠️ Failure Risk: NAT gateway IP changes dropping active established SSH connections.

OPTIMAL TIERCISA OPTIMAL

Implementation Scope:

Full Software-Defined Perimeter mesh with dynamic mTLS session brokering and zero public IP exposure.

Authentication:

Continuous multi-attribute posture attestation required throughout session duration.

Network Isolation:

Infrastructure completely invisible to unauthorized internet scanners.

Telemetry & Auditing:

Real-time visualization of all authorization knocks and attempted scans.

Stack Components:

appgate-sdpebpf-spawireguardtpm-attest

⚠️ Failure Risk: Client SPA driver failure completely severing emergency operator access.

Infrastructure as Code: Terraform & Kubernetes

Production-ready declarative manifests for immediate automated deployment.

main.tf (Terraform HCL)

OpenTofu / Terraform

resource "aws_security_group" "sdp_gateway" {
  name        = "sdp-dark-gateway"
  description = "Closed to all unauthenticated ingress"
  vpc_id      = var.vpc_id

  # Zero default inbound rules; ports opened dynamically via SPA
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

policy.yaml (Kubernetes Manifest)

Kube v1.28+

apiVersion: v1
kind: ConfigMap
metadata:
  name: fwknopd-config
  namespace: security
data:
  access.conf: |
    SOURCE              ANY
    OPEN_PORTS          tcp/22, tcp/443
    KEY_BASE64          +k9PEXAMPLEBASE64KEY==
    HMAC_KEY_BASE64     hmacEXAMPLEKEY12345678==
    FW_ACCESS_TIMEOUT   30

AI Summary — Software-Defined Perimeter (SDP) Dynamic Knocking

AEO / GEO / Perplexity Indexable

CISA Pillar & ArchetypeNETWORKS // NETWORK_MICROSEGMENTATION

NIST SP 800-207 TenetsAll communication is secured regardless of network location.; All data sources and computing services are considered resources.

Blocked ATT&CK TechniquesT1046, T1190, T1133

Optimal Tier Stackappgate-sdp, ebpf-spa, wireguard, tpm-attest

Architecture Blueprint FAQs

How does the Software-Defined Perimeter (SDP) Dynamic Knocking blueprint mitigate adversary threats and MITRE ATT&CK techniques?

Software-Defined Perimeter (SDP) Dynamic Knocking addresses the following adversary profile: Adversary executes port scans (nmap / masscan) across public IP ranges, attempting to locate open administrative ports. It actively eliminates lateral movement and privilege escalation by mitigating: T1046, T1190, T1133 via hardware-rooted identity, kernel-level enforcement, or continuous attestation.

Which NIST SP 800-207 Zero-Trust tenets does this architecture enforce?

This blueprint strictly operationalizes the following NIST SP 800-207 tenets: All communication is secured regardless of network location.; All data sources and computing services are considered resources.. Implicit trust based on network location is replaced with per-session dynamic cryptographic verification.

What are the technical differences between the Initial and Optimal maturity tiers?

The Initial tier focuses on baseline policy and identity enforcement (Traditional bastion host with SSH keys and restricted IP allowlists.), while the Optimal tier delivers CISA ZTMM 2.0 zero-compromise fortress defense (Full Software-Defined Perimeter mesh with dynamic mTLS session brokering and zero public IP exposure.) using: appgate-sdp, ebpf-spa, wireguard, tpm-attest.

What is the primary failure mode risk and how is high availability guaranteed?

The primary failure risk is identified as: Client SPA driver failure completely severing emergency operator access.. Resilience is maintained through active-active control planes, local cached attestations, and graceful degradation playbooks.

How can engineering teams automate this architecture using Terraform and Kubernetes?

The provided declarative Terraform HCL (main.tf) and Kubernetes policy manifests (policy.yaml) can be immediately integrated into automated GitOps CI/CD pipelines (e.g., ArgoCD, Flux) for reproducible, drift-detected infrastructure provisioning.