Specifying and Verifying SDP Protocol Based Zero Trust Architecture Using TLA+

Software Defined Perimeter (SDP) is a prevalent security framework designed by Cloud Security Alliance (CSA) for Zero Trust Network Access (ZTNA) which aims to prevent novel threats in cloud environment. But there are few studies on the verification of correctness and security properties of SDP architecture through rigorous mathematical methods, thus we utilize formal methods to study its correctness and security. This paper aims to specify and verify the security and correctness properties of SDP framework using TLA+. First, an extensible formal model for SDP protocols with verification framework is built according to CSA's specification and the specific implementation of the popular open-source project called fwknop. This model not only specifies the behaviors of standard access control entities defined by SDP protocols but also includes the specification of cyber attack behaviors launched by hackers aiming at system security and correctness. Then this model is implemented using a formal specification language called TLA+ and relevant security and correctness properties are verified via the model checking tool called TLC. The verification results show that current SDP protocol framework has a security flaw in the scenario of remote access through NAT technology. To fix this problem, we further propose an improved scheme for SDP framework and update the TLA+ model accordingly for re-check. The final experimental results prove that the improved scheme can mitigate the risk of the vulnerability efficiently.