ZtPolicyEngineWithCert Class Reference

Simulates a Zero Trust policy engine that enforces access control using certificates. More...

#include <zt-certificate.h>

Collaboration diagram for ZtPolicyEngineWithCert:

Public Member Functions
void	SetCaPublicKey (CryptoPP::RSA::PublicKey pub)
	Sets the CA's public key used for certificate verification.
void	Revoke (uint32_t nodeId)
	Revokes a node by its ID, preventing it from being authorized.
bool	Authorize (uint32_t nodeId, const std::string &role, const std::string &certStr)
	Authorizes a node based on its certificate.

Private Attributes
CryptoPP::RSA::PublicKey	caPublicKey
	Trusted public key used for signature verification.
std::unordered_set< uint32_t >	revoke
	Set of node IDs that are explicitly revoked.

Detailed Description

Simulates a Zero Trust policy engine that enforces access control using certificates.

This engine validates node certificates, verifies digital signatures, checks role and expiry, and maintains a list of revoked node IDs.

Definition at line 51 of file zt-certificate.h.

Member Function Documentation

Authorize()

bool ZtPolicyEngineWithCert::Authorize	(	uint32_t	nodeId,
		const std::string &	role,
		const std::string &	certStr
	)

Authorizes a node based on its certificate.

Verifies and authorizes a node based on its certificate.

Parameters

nodeId	The node's claimed ID.
role	The role the node claims to perform.
certStr	The certificate string presented by the node.

Returns

True if the certificate is valid, not expired, matches the node, and not revoked.

Parameters

nodeId	ID of the node attempting access
role	Role of the node
certStr	Certificate string to validate

Returns

True if the certificate is valid and authorization succeeds

Definition at line 79 of file zt-certificate.cc.

                                                                                                       {
  using namespace ns3;
 
  if (revoke.find(nodeId) != revoke.end()) {
    NS_LOG_UNCOND("ZT-CERT: Node " << nodeId << " is revoked");
    return false;
  }
 
  std::string content, sig;
  size_t sigPos = certStr.find("|SIG:");
  if (sigPos == std::string::npos) return false;
  content = certStr.substr(0, sigPos);
  sig = certStr.substr(sigPos + 5);
 
  std::string decodedSig;
  StringSource(sig, true, new Base64Decoder(new StringSink(decodedSig)));
 
  RSASS<PSSR, SHA1>::Verifier verifier(caPublicKey);
  bool valid = false;
  StringSource(decodedSig + content, true,
    new SignatureVerificationFilter(verifier,
      new ArraySink((byte*)&valid, sizeof(valid)),
      SignatureVerificationFilter::PUT_RESULT | SignatureVerificationFilter::SIGNATURE_AT_BEGIN));
 
  if (!valid) {
    NS_LOG_UNCOND("ZT-CERT: Signature invalid");
    return false;
  }
 
  std::istringstream ss(content);
  std::string token;
  uint32_t idParsed = 0;
  std::string roleParsed;
  time_t expiry = 0;
 
  while (std::getline(ss, token, '|')) {
    if (token.find("ID:") == 0)
      idParsed = std::stoul(token.substr(3));
    else if (token.find("ROLE:") == 0)
      roleParsed = token.substr(5);
    else if (token.find("EXP:") == 0)
      expiry = std::stol(token.substr(4));
  }
 
  if (idParsed != nodeId || roleParsed != role) {
    NS_LOG_UNCOND("ZT-CERT: Identity mismatch");
    return false;
  }
 
  time_t now = std::time(nullptr);
  if (now > expiry) {
    NS_LOG_UNCOND("ZT-CERT: Certificate expired");
    return false;
  }
 
  return true;
}

Revoke()

void ZtPolicyEngineWithCert::Revoke

(

uint32_t

nodeId

)

Revokes a node by its ID, preventing it from being authorized.

Revokes access for a specific node.

Parameters

nodeId	The node ID to be added to the revocation list.
nodeId	ID of the node to be revoked

Definition at line 68 of file zt-certificate.cc.

                                                   {
  revoke.insert(nodeId);
}

SetCaPublicKey()

void ZtPolicyEngineWithCert::SetCaPublicKey

(

CryptoPP::RSA::PublicKey

pub

)

Sets the CA's public key used for certificate verification.

Sets the CA public key for the policy engine.

Parameters

pub	The public RSA key of the trusted Certificate Authority.
pub	RSA public key of the certificate authority

Definition at line 60 of file zt-certificate.cc.

                                                            {
  caPublicKey = pub;
}

Field Documentation

caPublicKey

CryptoPP::RSA::PublicKey ZtPolicyEngineWithCert::caPublicKey

private

Trusted public key used for signature verification.

Definition at line 75 of file zt-certificate.h.

revoke

std::unordered_set<uint32_t> ZtPolicyEngineWithCert::revoke

private

Set of node IDs that are explicitly revoked.

Definition at line 76 of file zt-certificate.h.

---

The documentation for this class was generated from the following files:

• model/zt-certificate.h
• model/zt-certificate.cc