ZT-SDX: Zero Trust Secure Document Exchange

A microservices-based secure document exchange platform implementing Zero Trust architecture. Every request is verified, every file is encrypted, every action is audited, and access decisions are evaluated in real time against risk posture, role clearance, and behavioral context.

Architecture

                    ┌─────────────────────────────────────┐
                    │          React SPA (Vite)            │
                    │     localhost:5173 → /api/*          │
                    └──────────────────┬──────────────────┘
                                       │
                    ┌──────────────────▼──────────────────┐
                    │         GATEWAY API (:8000)          │
                    │  IDS → Rate Limit → JWT Auth → RBAC  │
                    └──┬───┬───┬───┬───┬───┬───┬───┬──────┘
                       │   │   │   │   │   │   │   │
         ┌─────────────┘   │   │   │   │   │   │   └────────────┐
         ▼                 ▼   ▼   ▼   ▼   ▼   ▼                ▼
   ┌──────────┐   ┌──────────┐ ┌───┐ ┌───┐ ┌───┐ ┌───┐  ┌──────────┐
   │ IDS Svc │   │ Auth Svc │ │...│ │...│ │...│ │...│  │ Worker   │
   └────┬─────┘   └────┬─────┘ └───┘ └───┘ └───┘ └───┘  └──────────┘
        │              │       │     │     │     │
   ┌────▼────┐    ┌────▼────┐  │  ┌──▼──┐  │  ┌──▼──┐
   │ CNNFOLE │    │PostgreSQL│  │  │Redis│  │  │MinIO│
   │  Engine │    │          │  │  │     │  │  │     │
   └─────────┘    └─────────┘  │  └─────┘  │  └─────┘
                               │           │
                    ┌──────────▼───────────▼──────┐
                    │  Policy   Risk              │
                    │  Alert    Audit             │
                    │  File                       │
                    └─────────────────────────────┘

Services

Service	Role	Dependencies
gateway-api	Policy Enforcement Point — IDS inspection, rate limiting, JWT validation, RBAC evaluation, request routing to internal services	postgres, redis
auth-service	Identity lifecycle — registration, login (Argon2id), MFA/OTP (6-digit TOTP), device fingerprinting, session management, provisioning	postgres, redis
policy-service	Stateless RBAC evaluator — ALLOW/DENY/MFA_REQUIRED based on f(role, resource, action, clearance, risk, device)	postgres
file-service	Encrypted storage — AES-256-GCM per-file encryption, MinIO blob storage, cryptographic share links with expiry and download limits	postgres, minio
audit-service	Tamper-evident logging — SHA-256 hash-chained events, chain integrity verification, org-scoped isolation	postgres
alert-service	Security alert storage and retrieval — severity-graded alerts triggered by risk thresholds and IDS detections	postgres
risk-service	Behavioral risk scoring — 14 deterministic rules (60% weight) + IsolationForest statistical anomaly detection (40% weight), periodic model retraining	postgres, redis, minio
ids-service	Intrusion detection — deterministic signature matching (SQLi, XSS, path traversal, command injection) + CNNFOLE neural network-based traffic analysis	CNNFOLE engine
worker-service	Async DLP scanning — Redis queue consumer, content inspection (PAN, Aadhaar, SSN, API keys, passwords), risk-scored disposition	postgres, redis, minio
frontend	React 18 SPA — role-gated navigation, file browser, audit viewer, admin dashboard, CSS Modules	gateway-api

Infrastructure

Component	Purpose
PostgreSQL 17	Relational store for all service metadata, audit logs, risk profiles, policies, alerts
Redis 8	Caching, rate limiting counters, OTP storage, device fingerprint TTL, async task queue
MinIO	S3-compatible object storage for encrypted file ciphertext and risk model artifacts

Core Security Features

File Encryption

Every file uploaded to ZT-SDX is encrypted before it touches disk:

• Per-file DEK: A random 32-byte Data Encryption Key is generated per file
• AES-256-GCM: Authenticated encryption providing confidentiality and integrity
• Key hierarchy: Each DEK is wrapped with a system-level Key Encryption Key (KEK); only the wrapped DEK is stored alongside the ciphertext
• Chunked encryption: Files >= 4MB are split into 4MB chunks, each encrypted independently, enabling streaming download without loading the entire file into memory
• Integrity verification: SHA-256 hash of the plaintext is computed at upload and verified at download

Intrusion Detection

Every API request passes through a multi-layered inspection pipeline before reaching the target service:

• Layer 1 — Deterministic signatures: Regex-based detection of SQL injection, cross-site scripting, path traversal, and command injection payloads in request metadata
• Layer 2 — Neural traffic analysis: The CNNFOLE engine processes request features (method, path, payload size, source IP, user agent) through convolutional and recurrent networks to identify anomalous patterns
• Decision mapping: CRITICAL → BLOCK, HIGH → ALERT, MEDIUM/LOW → LOG, INFO → ALLOW
• False positive handling: Trusted IPs and internal networks bypass certain checks; repeated FP sources are auto-corrected
• Fail-open fallback: If the IDS engine is unavailable, traffic passes through with a logged warning (availability over strict enforcement)

Risk Scoring

Every user action contributes to a real-time risk score (0–100) maintained per identity:

• Rule engine (60%): 14 deterministic rules scoring behaviors such as failed logins, new device detection, geographic anomalies, bulk downloads, secret file access, and policy denials. Each rule has a fixed point value; multiple rules stack. Total capped at 100.
• Statistical anomaly detection (40%): An IsolationForest model is trained on historical feature vectors (8 dimensions: login frequency, geographic distance, device trust, download velocity, etc.). The model outputs an anomaly score normalized to 0–100.
• Score thresholds: 0–20 ALLOW, 21–45 LOG, 46–70 MFA_REQUIRED, 71–100 DENY
• Automatic retraining: A background task triggers retraining every 5 minutes when sufficient new data accumulates. Models are versioned and stored in MinIO. Hot-reloaded without service restart.
• Cross-service sync: After each scoring event, the updated risk score is pushed to the auth-service's user record, making it available to all services without additional lookups.

Audit Chain

Every security-relevant event is recorded in an append-only, tamper-evident log:

• Hash chaining: Each entry stores hash = SHA256(prev_hash || actor || action || resource || ip || result)
• Integrity verification: A /audit/verify endpoint recomputes the entire chain and reports the first broken link
• Org-scoped isolation: Queries filter by organization to prevent cross-tenant data leakage

Access Control

• 6 roles: SUPER_ADMIN, SECURITY_ADMIN, DEPT_HEAD, MANAGER, EMPLOYEE, AUDITOR
• 5 sensitivity levels: PUBLIC, INTERNAL, CONFIDENTIAL, SECRET, TOP_SECRET
• Hierarchical clearance: Each role has a maximum allowed clearance level; a user's current risk score can further restrict access
• Policy evaluation: policy-service evaluates ALLOW/DENY/MFA_REQUIRED per request based on f(role, resource, action, sensitivity, clearance, risk_score, device_trust)

Technology Stack

Layer	Technology
Backend	Python 3.12, FastAPI, SQLAlchemy, httpx
Frontend	React 18, React Router 6, Vite 5, Axios, Lucide icons
Database	PostgreSQL 17
Cache	Redis 8
Object Storage	MinIO (S3-compatible)
Encryption	AES-256-GCM via Cryptography.io, SHA-256
Password Hashing	Argon2id
Auth Tokens	JWT (HS256, 15min access / 8hr refresh)
Anomaly Detection	Scikit-learn IsolationForest
Orchestration	Docker Compose

Quick Start

# Clone and enter
git clone <repo> && cd zt-sdx

# Copy environment config
cp .env.example .env

# Build and start all services
docker compose build
docker compose up -d

# Verify health
curl http://localhost:8000/health

# Bootstrap the first SUPER_ADMIN
curl -X POST "http://localhost:8000/auth/register?email=admin@example.com&password=securepass&role=SUPER_ADMIN&department=IT"

# Seed default RBAC policies
curl -X POST "http://localhost:8000/policy/seed"

# Open the frontend
open http://localhost:5173

Testing

A comprehensive integration test suite (209 tests across 17 sections) validates the complete system end-to-end against the live Docker Compose stack. All tests pass at 100%.

docker compose exec gateway-api python deeptest.py

API Reference

Each FastAPI service auto-generates OpenAPI documentation:

Service	Docs URL
Gateway API	http://localhost:8000/docs
Auth Service	http://localhost:8001/docs
Policy Service	http://localhost:8002/docs
File Service	http://localhost:8003/docs
Audit Service	http://localhost:8004/docs
Risk Service	http://localhost:8005/docs
Alert Service	http://localhost:8006/docs
IDS Service	http://localhost:8007/docs

Service ports are not exposed externally in production; the Gateway acts as the sole entry point.

Project Structure

apps/
├── gateway-api/       Policy enforcement, routing, orchestration
├── auth-service/      Identity, registration, login, MFA, sessions
├── policy-service/    RBAC policy evaluation
├── file-service/      Encrypted file storage and sharing
├── audit-service/     Hash-chained immutable audit log
├── alert-service/     Security alert storage
├── risk-service/      Behavioral risk scoring and anomaly detection
├── ids-service/       Intrusion detection (CNNFOLE integration)
├── worker-service/    Async DLP scanning
├── frontend/          React 18 SPA

infra/
├── postgres/          Schema initialization scripts
├── redis/             Configuration
├── minio/             Bucket policies

docs/                  Technical documentation per service
shared/                API contracts and data schemas
CNNFOLE/               Intrusion detection system (standalone engine)

License

Internal project — developed as part of the ZT-SDX hackathon.