Zero Trust Security Architecture 2026: Complete Implementation Guide

// Zero Trust Identity Verification Middleware
import { NextRequest, NextResponse } from 'next/server';
import { jwtVerify, createRemoteJWKSet } from 'jose';

const JWKS = createRemoteJWKSet(
  new URL('https://your-idp.com/.well-known/jwks.json')
);

interface TokenClaims {
  sub: string;
  email: string;
  roles: string[];
  device_id: string;
  device_trust_level: 'high' | 'medium' | 'low';
  risk_score: number;
  mfa_verified: boolean;
  session_id: string;
}

export async function zeroTrustMiddleware(req: NextRequest) {
  // 1. Extract and verify token
  const token = req.headers.get('Authorization')?.replace('Bearer ', '');
  
  if (!token) {
    return unauthorizedResponse('No token provided');
  }

  let claims: TokenClaims;
  try {
    const { payload } = await jwtVerify(token, JWKS, {
      issuer: 'https://your-idp.com',
      audience: 'your-api',
    });
    claims = payload as unknown as TokenClaims;
  } catch (error) {
    return unauthorizedResponse('Invalid token');
  }

  // 2. Verify device trust
  if (claims.device_trust_level === 'low') {
    // Low trust devices get read-only access
    if (req.method !== 'GET') {
      return forbiddenResponse('Device trust level insufficient for write operations');
    }
  }

  // 3. Check risk score
  if (claims.risk_score > 70) {
    // High risk - require step-up authentication
    return NextResponse.json(
      {
        error: 'Step-up authentication required',
        challenge: 'mfa',
        session_id: claims.session_id,
      },
      { status: 403 }
    );
  }

  // 4. Verify MFA for sensitive operations
  const sensitiveOperations = ['/api/admin', '/api/billing', '/api/users'];
  const isSensitive = sensitiveOperations.some(path => 
    req.nextUrl.pathname.startsWith(path)
  );
  
  if (isSensitive && !claims.mfa_verified) {
    return forbiddenResponse('MFA required for this operation');
  }

  // 5. Log access for continuous monitoring
  await logAccess({
    userId: claims.sub,
    path: req.nextUrl.pathname,
    method: req.method,
    deviceId: claims.device_id,
    riskScore: claims.risk_score,
    timestamp: new Date().toISOString(),
    ipAddress: req.headers.get('x-forwarded-for') || 'unknown',
    userAgent: req.headers.get('user-agent') || 'unknown',
  });

  // 6. Add identity context to request
  const requestHeaders = new Headers(req.headers);
  requestHeaders.set('x-user-id', claims.sub);
  requestHeaders.set('x-user-roles', claims.roles.join(','));
  requestHeaders.set('x-device-trust', claims.device_trust_level);

  return NextResponse.next({
    request: { headers: requestHeaders },
  });
}

function unauthorizedResponse(message: string) {
  return NextResponse.json({ error: message }, { status: 401 });
}

function forbiddenResponse(message: string) {
  return NextResponse.json({ error: message }, { status: 403 });
}

# Kubernetes Network Policies for Zero Trust
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-server-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Only allow traffic from the API gateway
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress
          podSelector:
            matchLabels:
              app: api-gateway
      ports:
        - protocol: TCP
          port: 8080
  egress:
    # Allow DNS
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
    # Allow database access
    - to:
        - namespaceSelector:
            matchLabels:
              name: database
          podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    # Allow cache access
    - to:
        - namespaceSelector:
            matchLabels:
              name: cache
          podSelector:
            matchLabels:
              app: redis
      ports:
        - protocol: TCP
          port: 6379
---
# Database accepts only from API server
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-policy
  namespace: database
spec:
  podSelector:
    matchLabels:
      app: postgres
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: production
          podSelector:
            matchLabels:
              app: api-server
      ports:
        - protocol: TCP
          port: 5432

// Continuous Risk Assessment Service
import { Redis } from 'ioredis';

const redis = new Redis(process.env.REDIS_URL!);

interface AccessEvent {
  userId: string;
  timestamp: Date;
  ipAddress: string;
  userAgent: string;
  endpoint: string;
  method: string;
  responseCode: number;
  location?: { country: string; city: string };
}

interface RiskFactors {
  impossibleTravel: number;      // 0-30 points
  unusualTime: number;           // 0-15 points
  failedAttempts: number;        // 0-25 points
  sensitiveDataAccess: number;   // 0-20 points
  anomalousBehavior: number;     // 0-10 points
}

export class ContinuousRiskAssessment {
  async assessRisk(event: AccessEvent): Promise<number> {
    const factors: RiskFactors = {
      impossibleTravel: await this.checkImpossibleTravel(event),
      unusualTime: this.checkUnusualTime(event),
      failedAttempts: await this.checkFailedAttempts(event),
      sensitiveDataAccess: this.checkSensitiveAccess(event),
      anomalousBehavior: await this.checkAnomalousBehavior(event),
    };

    const totalRisk = Object.values(factors).reduce((a, b) => a + b, 0);

    // Store risk score for this session
    await redis.setex(
      `risk:${event.userId}`,
      3600, // 1 hour TTL
      JSON.stringify({ score: totalRisk, factors, timestamp: new Date() })
    );

    // Trigger alerts for high risk
    if (totalRisk > 50) {
      await this.triggerSecurityAlert(event, factors, totalRisk);
    }

    return totalRisk;
  }

  private async checkImpossibleTravel(event: AccessEvent): Promise<number> {
    if (!event.location) return 0;

    const lastAccess = await redis.get(`lastAccess:${event.userId}`);
    if (!lastAccess) {
      // Store current access
      await redis.setex(
        `lastAccess:${event.userId}`,
        86400,
        JSON.stringify(event)
      );
      return 0;
    }

    const last = JSON.parse(lastAccess) as AccessEvent;
    if (!last.location) return 0;

    // Calculate if travel is impossible based on distance and time
    const timeDiffHours = 
      (event.timestamp.getTime() - new Date(last.timestamp).getTime()) / 3600000;
    
    const distance = this.calculateDistance(
      last.location.city,
      event.location.city
    );

    // Max reasonable travel: 1000 km/hour (jet travel)
    const maxPossibleDistance = timeDiffHours * 1000;

    if (distance > maxPossibleDistance) {
      return 30; // Maximum risk for impossible travel
    }

    // Store current access
    await redis.setex(
      `lastAccess:${event.userId}`,
      86400,
      JSON.stringify(event)
    );

    return 0;
  }

  private checkUnusualTime(event: AccessEvent): number {
    const hour = event.timestamp.getHours();
    // Flag access outside normal business hours (6 AM - 10 PM)
    if (hour < 6 || hour > 22) {
      return 15;
    }
    return 0;
  }

  private async checkFailedAttempts(event: AccessEvent): Promise<number> {
    if (event.responseCode < 400) return 0;

    const key = `failedAttempts:${event.userId}`;
    const count = await redis.incr(key);
    await redis.expire(key, 3600); // Reset after 1 hour

    if (count > 10) return 25;
    if (count > 5) return 15;
    if (count > 2) return 5;
    return 0;
  }

  private checkSensitiveAccess(event: AccessEvent): number {
    const sensitiveEndpoints = [
      '/api/admin',
      '/api/billing',
      '/api/export',
      '/api/users/bulk',
    ];

    if (sensitiveEndpoints.some(ep => event.endpoint.startsWith(ep))) {
      return 20;
    }
    return 0;
  }

  private async checkAnomalousBehavior(event: AccessEvent): Promise<number> {
    // Check for patterns that deviate from user's normal behavior
    const recentEvents = await this.getRecentEvents(event.userId);
    
    // New user agent
    const knownAgents = new Set(recentEvents.map(e => e.userAgent));
    if (!knownAgents.has(event.userAgent) && knownAgents.size > 0) {
      return 10;
    }

    return 0;
  }

  private async triggerSecurityAlert(
    event: AccessEvent,
    factors: RiskFactors,
    score: number
  ): Promise<void> {
    // Send to SIEM/monitoring system
    console.log('SECURITY ALERT:', {
      severity: score > 70 ? 'HIGH' : 'MEDIUM',
      userId: event.userId,
      riskScore: score,
      factors,
      event,
    });
  }

  private calculateDistance(city1: string, city2: string): number {
    // Simplified - use a proper geocoding service in production
    return 0;
  }

  private async getRecentEvents(userId: string): Promise<AccessEvent[]> {
    // Fetch from your logging system
    return [];
  }
}