ProTECT: A Programmable Threat Evaluation and Control Unit for Zero Trust Networks

Abstract

As Zero Trust Architectures (ZTA) become increasingly adopted in enterprise networks, so it is essential to continuously monitor the security status of connected devices. Real-time threat monitoring within the devices that are connected to the network is necessary for this. It's challenging, especially in resource-constrained settings, to ensure continuous monitoring in current devices available in market. ProTECT (Programmable Threat Evaluation and Control Unit) addresses this challenge by providing a continuous real-time monitoring, non-tamperable, trust score for ZTA network connected devices. Trust score in security coprocessor segregated from device computing architecture has been determined employing real-time hardware monitoring of CPU micro-architectural signals. We examined ProTECT on an open-source RISC-V processor based architecture against ransomware, RoP & cache-based micro-architectural attacks. While illustrating area overheads, we implement framework on an AMD Virtex XC7V2000T FPGA Module.