{{Short description|Approach to computer security from the US Defense Information Systems Agency}} A '''software-defined perimeter''' ('''SDP'''), sometimes referred to as a '''black cloud''', is a network architecture used to implement zero-trust principles. The SDP specification was developed by the Cloud Security Alliance (CSA) to control resource access based on identity.<ref name="sdp">{{cite web|url=https://cloudsecurityalliance.org/research/sdp/|publisher=Cloud Security Alliance|accessdate=29 January 2014|title=Software Defined Perimeter}}</ref>
In an SDP, connectivity follows a need-to-know model, requiring both entity authentication and device posture validation before granting access to internal assets. The application infrastructure is effectively "black", a term used by the United States Department of Defense to describe undetectable infrastructure, as it lacks visible DNS information or IP addresses.
The SDP architecture mitigates many common network-based attacks, including but not limited to:
* Server scanning * Denial-of-service (DoS) * SQL injection * Operating system and application vulnerability exploits * Man-in-the-middle attacks * Pass-the-hash (also known as pass-the-ticket) * Other unauthorized user attacks<ref>{{cite web |last1=Gartner |first1=Market Guide for Zero Trust Access |title=Gartner SDP Guide |url=https://www.gartner.com/en/documents/3912802/market-guide-for-zero-trust-network-access |website=gartner.com}}</ref>
==Background== Traditional enterprise network architecture is based on the premise of an internal network isolated by a fixed perimeter, typically consisting of firewalls. These firewalls block external entities from accessing internal assets while allowing the internal users to connect to external resources.<ref>{{cite news|last=Barrie|first=Sosinsky|title=Perimeter networks|url=http://searchnetworking.techtarget.com/tip/Perimeter-networks|accessdate=30 January 2014|newspaper=Search Networking|date=May 2004}}</ref>
However, the proliferation of user-managed devices, remote connectivity, SaaS, PaaS, and IaaS has extended the perimeter and broadened the attack surface.<ref>{{cite web |title=SDP Architecture Guide v2.0 |url=https://cloudsecurityalliance.org/artifacts/software-defined-perimeter-zero-trust-specification-v2/ |website=Cloud Security Alliance |date=2022-10-03 |access-date=2026-05-28 }}</ref> Software-Defined Perimeters (SDPs) address these issues by allowing application owners to deploy perimeters that maintain the traditional model's invisibility and inaccessibility. Unlike static firewalls, SDPs can be deployed anywhere—on the internet, in the cloud, at a hosting center, on a private corporate network, or across some or all of these locations.
== Authorization techniques ==
There are several techniques for delivering a software-defined perimeter. These include: * Single Packet Authorization (SPA) uses cryptographic techniques to make internet-facing servers invisible to unauthorized users. Only devices that have been seeded with the cryptographic secret can generate a valid SPA packet and, as a result, establish a network connection. * First Packet Authentication involves a single-use, cryptographically generated identity token inserted at both ends of a TCP/IP session for authentication. If the request is allowed, the gateway applies a security policy that forwards, redirects, or discards based on the identity. * Authenticate Before Connect provisions endpoints with unique, cryptographically generated identities (commonly using X.509 certificates and JSON Web Tokens). These endpoints establish outbound connectivity into a mesh overlay that listens for authenticated and authorized endpoints. This eliminates the need for inbound connectivity at both the source and destination.<ref>{{Cite web |date=2020 |title=DEFINITIVE GUIDE TO SOFTWARE-DEFINED PERIMETER |url=https://d3aafpijpsak2t.cloudfront.net/docs/Whitepapers/WP_Definitive_Guide_SDP_092020.pdf |access-date=2024-09-18 |website=Appgate}}</ref><ref>{{Cite web |title=Appgate {{!}} Make Resources Invisible with Single Packet Authorization |url=https://www.appgate.com/blog/make-resources-invisible-with-single-packet-authorization |access-date=2024-04-07 |website=Appgate |language=en}}</ref>
==Architecture== In its simplest form, the SDP architecture consists of two components: SDP Hosts and SDP Controllers. SDP Hosts can either initiate or accept connections. Interactions with the SDP Controllers manage these actions through a control channel (see Figure 1). As a result, the control plane is separated from the data plane in an SDP, enabling greater scalability. Additionally, all components can be made redundant for higher availability.<ref>{{Cite web |title=Software-Defined Perimeter: Architecture Guide V3 {{!}} CSA |url=https://cloudsecurityalliance.org/artifacts/software-defined-perimeter-architecture-guide-v3 |access-date=2026-05-30 |website=cloudsecurityalliance.org}}</ref>
thumb|center|Figure 1: The architecture of the software-defined perimeter consists of two components: SDP Hosts and SDP Controllers
The SDP framework has the following workflow (see Figure 2):<ref name=":1">Cloud Security Alliance (CSA), ''Software Defined Perimeter (SDP) Specification v1.0'', April 2014.</ref> #One or more SDP Controllers are brought online and connected to the appropriate authentication and authorization services (e.g., PKI, device fingerprinting, geolocation, SAML, OpenID, OAuth, LDAP, Kerberos, multi-factor authentication, and other similar services). #One or more accepting SDP Hosts are brought online. These hosts connect to and authenticate with the controllers. However, they do not acknowledge communication from any other host and will not respond to any non-provisioned requests. #Each Initiating SDP Host that comes online connects to and authenticates with the SDP Controllers. #After authenticating the Initiating SDP Host, the SDP Controllers determine a list of Accepting SDP Hosts with which the initiating host is authorized to communicate. #The SDP Controller instructs the Accepting SDP Hosts to accept communication from the Initiating SDP Host and applies any optional policies required for encrypted communications. #The SDP Controller provides the Initiating SDP Host with the list of Accepting SDP Hosts and any optional policies required for encrypted communications. #The Initiating SDP Host establishes a mutual VPN connection with all authorized Accepting SDP Hosts.thumb|upright=1.4|center|Figure 2: Workflow of the architecture of the Software Defined Perimeter == SDP deployment models ==
While the general workflow remains the same for all implementations, the application of SDPs can favour certain implementations over others.
===Client-to-Gateway=== In the client-to-gateway implementation, one or more servers are protected behind an Accepting SDP Host, which acts as a gateway between the clients and the protected servers. This implementation can be used within an enterprise network to mitigate common lateral movement attacks, such as server scanning, OS and application vulnerability exploits, password cracking, man-in-the-middle attacks, pass-the-hash (PtH) and others.<ref>{{cite book|last=McClure|first=Stuart|title=Hacking Exposed 7 Network Security Secrets & Solutions|date=July 11, 2012|publisher=McGraw Hill|isbn=978-0071780285}}</ref><ref>{{cite web|last=Micro|first=Trend|title=LATERAL MOVEMENT: How Do Threat Actors Move Deeper Into Your Network?|url=http://trends5.com/download/4945|publisher=Trend Micro|accessdate=19 February 2014}}</ref><ref>{{cite web|title=Data Breach Investigation Report|url=http://www.verizonenterprise.com/DBIR/2013/|publisher=Verizon|accessdate=19 February 2014}}</ref> Alternatively, it can be implemented on the internet to isolate protected servers from unauthorized users and mitigate attacks.<ref>{{cite web|title=IBM X-Force 2012 Mid-Year Trend and Risk Report|url=https://www14.software.ibm.com/webapp/iwm/web/signup.do?source=swg-Tivoli_Organic&S_PKG=ov7304|publisher=IBM X-Force Research and Development|accessdate=19 February 2014}}</ref><ref>{{cite web|title=Global Threat Intelligence Report|url=http://www.solutionary.com/research/threat-reports/annual-threat-report/annual-threat-report-2013/|publisher=Solutionary|accessdate=19 February 2014}}</ref>
===Client-to-Server=== The client-to-server implementation offers features and benefits similar to the client-to-gateway implementation. However, in a client-to-server scenario, the protected server runs the Accepting SDP Host software rather than using a gateway in front of the server running that software. The choice between the client-to-gateway and client-to-server implementations is typically based on factors such as the number of servers being protected, load balancing methods, server elasticity, and other topological considerations.<ref name=":0" />
===Server-to-Server=== In the server-to-server implementation, servers offering a Representational State Transfer (REST) service, a Simple Object Access Protocol (SOAP) service, a remote procedure call (RPC), or any kind of application programming interface (API) over the internet can be protected from unauthorized hosts on the network. For example, the server initiating the REST call would be the Initiating SDP Host, and the server offering the REST service would be the Accepting SDP Host. Implementing an SDP for this use case can reduce the load on these services and mitigate attacks similar to those mitigated by the client-to-gateway implementation.<ref>{{Cite web |date=2024-06-27 |title=TAGGRS Server Side Tracking software |url=https://taggrs.io/ |access-date=2026-05-30 |website=taggrs.io |language=en-US}}</ref>
===Client-to-Server-to-Client=== The client-to-server-to-client implementation creates a peer-to-peer relationship between the two clients and can be used for applications such as IP telephony, chat and video conferencing. In these cases, the SDP obfuscates the IP addresses of the connecting clients. Alternatively, a client-to-gateway-to-client configuration can hide the application server as well.<ref name=":1" />
== SDP applications ==
===Enterprise application isolation=== In the context of data breaches involving intellectual property, financial records, and human resources data, attackers typically gain initial entry by compromising a single endpoint. Following the initial breach, they exploit the network's flat architecture to move laterally, seeking access to high-value information assets.<ref>{{cite web |title=Zero Trust Architecture (SP 800-207) |url=https://csrc.nist.gov/pubs/sp/800/207/final |website=National Institute of Standards and Technology |publisher=U.S. Department of Commerce |date=2020-08-11 |access-date=2026-05-28 }}</ref>
To counter this threat, organizations can deploy a Software-Defined Perimeter (SDP) within the data center to partition the network and isolate sensitive applications. By enforcing access controls, the SDP restricts unauthorized access to protected resources. This prevents the lateral movement necessary for large-scale data exfiltration, localizing the breach and securing the enterprise's most critical data.<ref>{{cite journal |last=Moubayed |first=Abdallah |author2=Refaey, Ahmed |author3=Shami, Abdallah |date=October 2019 |title=Software-Defined Perimeter (SDP): State of the Art Secure Solution for Modern Network |url=https://ieeexplore.ieee.org/document/8863736 |journal=IEEE Network |volume=33 |issue=5 |pages=226–233 |doi=10.1109/MNET.2019.1800324 |s2cid=189892671|url-access=subscription }}</ref>
=== Private cloud and hybrid cloud === The application of SDP varies across cloud service models to address specific security requirements:<ref name=":1" />
* Software-as-a-Service (SaaS): Implementations may designate the SaaS application as an '''Accepting Host''' and authenticated users as '''Initiating Hosts'''. This configuration significantly reduces the vendor’s attack surface while maintaining seamless outbound internet connectivity. * Infrastructure-as-a-Service (IaaS): Providers can offer '''SDP-as-a-Service''' to secure administrative and user access to customers' virtualized cloud infrastructure. * Platform-as-a-Service (PaaS): Providers may integrate SDP architecture as an embedded security layer, effectively mitigating network-based exploits against the development and deployment environment.
As the proliferation of interconnected devices increases,<ref name=":0">{{cite journal|last=Middleton|first=Peter |author2=Kjeldsen, Peter |author3=Tully, Jim|title=Forecast: The Internet of Things, Worldwide, 2013|journal=Gartner|date=November 18, 2013|issue=G00259115|accessdate=29 January 2014|url=http://www.gartner.com/document/2625419}}{{dead link|date=December 2021|bot=medic}}{{cbignore|bot=medic}}</ref> the back-end applications responsible for managing these devices and processing sensitive data have become mission-critical. SDPs enhance the security and availability of these systems by concealing servers and their communication from the public internet. This "dark" infrastructure approach prevents unauthorized discovery and targeted external attacks.<ref>{{cite journal|last=Refaey|first=Ahmed |author2=Sallam, Ahmed |author3=Shami, Abdallah|title=On IoT applications: a proposed SDP framework for MQTT|journal=Electronics Letters|date=October 2019|volume=55 |issue=22 |page=1201 |doi=10.1049/el.2019.2334 |bibcode=2019ElL....55.1201R |s2cid=203048330 |doi-access=free }}</ref>
==See also== *Advanced Encryption Standard *Global Information Grid *IPsec *Public-key infrastructure *Transport Layer Security
== References == {{Reflist}}
==External links== {{External links|date=November 2021}} *Cloud Security Alliance “[https://cloudsecurityalliance.org/working-groups/software-defined-perimeter Introduction to the Software Defined Perimeter Working Group]” *Article from GCN - 1105 Public Sector Media Group "[http://gcn.com/articles/2015/05/20/software-defined-perimeter.aspx Black Cloud Darkens the Enterprise to all but Authorized Devices]" *Article from Light Reading - [http://www.lightreading.com/security/security-platforms-tools/verizon-and-vidder-put-sd-perimeter-around-enterprise-security/d/d-id/736475 "Verizon and Vidder put SD-Perimeter around Enterprise Security"] *Article from CSO - [https://www.csoonline.com/article/3141930/security/goodbye-nac-hello-software-defined-perimeter-sdp.html "Goodbye NAC. Hello, software defined perimeter"] *IEEE [https://sdn.ieee.org/newsletter/march-2017/software-defined-perimeters-an-architectural-view-of-sdp "Software-Defined Perimeters: An Architectural View of SDP"] *Article from ComputerWeekly - [http://www.computerweekly.com/news/450426484/Gas-distribution-network-SGN-invests-in-software-defined-perimeter "Gas distribution network SGN invests in software-defined perimeter"] *{{cite journal|last1=Moubayed|first1=Abdallah |last2=Refaey |first2=Ahmed |last3=Shami |first3=Abdallah|title=Software-Defined Perimeter (SDP): State of the Art Secure Solution for Modern Network|journal=IEEE Network|date=October 2019|volume=33 |issue=5 |pages=226–233 |doi=10.1109/MNET.2019.1800324 |s2cid=189892671 |url=https://ieeexplore.ieee.org/document/8863736|url-access=subscription }} Category:Cybersecurity engineering