SDP-FW: Managing Transient Authorization in Software-Defined Perimeters for Zero Trust Networks

Software-Defined Perimeter (SDP) hides protected services until communicating entities have been authenticated and authorized. In operational SDP gateways, each successful Single Packet Authorization (SPA) request creates transient authorization state that must be enforced and subsequently revoked, potentially imposing substantial rule-management overhead under high-churn access workloads. This paper presents SDP-FW, a dynamic firewall architecture for managing transient authorization in SDP-based Zero Trust networks. SDP-FW uses Time-Based One-Time Password (TOTP)-based dynamic SPA port selection to reduce the persistence of the SPA entry point and a remove-after-connection strategy to promptly remove temporary firewall openings after connection establishment. It further separates authorization-state tracking, implemented with a scalable counting Bloom filter, from kernel-level packet enforcement through Netfilter hooks and connection tracking. We implement an SDP-FW prototype in the Linux kernel and evaluate its security properties, runtime performance, and storage cost. Comparisons with iptables, ipset, nftables, and eBPF further characterize its performance and storage behavior. Experimental results show that SDP-FW maintains efficient insertion, lookup, and removal as the number of transient authorization states increases, while the measured remove-after-connection mechanism substantially shortens the residual exposure window.