QuantZTNA
Zero Trust Network Access with Post-Quantum Cryptography
Verify every user. Protect every connection. Enforce zero-trust policies with quantum-safe encryption.
QuantZTNA
What is QuantZTNA?
QuantZTNA is Qubit Guard’s Zero Trust Network Access (ZTNA) platform, combining:
- Identity Verification: User authentication + device posture assessment
- Quantum-Safe Encryption: ML-KEM-1024 key establishment
- Policy Enforcement: Dynamic access control based on real-time risk signals
- Organizational Intelligence: Understands hierarchical identity structures
Unlike traditional VPN (which secures tunnels), QuantZTNA verifies every user and every request against a control plane, enforcing fine-grained policies.
Core Capabilities of QuantZTNA
Identity & Access Control
- SSO/OIDC, SAML 2.0, SCIM integration
- TOTP-based MFA
- SSO session integration with OPA policy engine
Device & Network Posture
- Device posture profiles (disk, firewall, EDR, OS, attestation)
- Trusted network definitions (auto-pass, reduced MFA)
- Network zone-based access control
Dynamic Risk Scoring
- Human Risk calculation (failed logins, denied access, geo-velocity, unusual hours, new device)
- Real-time risk assessment every 15 minutes
- Auto-actions: CRITICAL suspends identity; HIGH requires MFA step-up
Per-Request Policy Evaluation
- Policies evaluated on every request (not just at tunnel establishment)
- Predicates: IP_MATCH, GEO_LOCATION, DEVICE_POSTURE, TIME_BASED, NETWORK_ZONE, RISK_SCORE
- Actions: ALLOW, DENY, REQUIRE_MFA scoped to identity & application
Observability & Alerts
- 17 alert trigger types with per-policy cooldown
- SIEM forwarding (syslog CEF/LEEF/RFC5424/JSON, webhook, Splunk HEC)
- Comprehensive audit logging (access, policy decision, machine identity decision logs)
- Email + webhook notifications (Slack, Teams, generic)
Deployment Flexibility
- On-premises or private cloud deployment
- Air-gapped environments supported
- Customer-controlled keys (zero third-party access)
- Outbound-only connectors (zero inbound firewall rules required)
Architecture Overview
QuantZTNA uses a three-tier architecture:
Control Plane (Management)
- Manages organizations, identities, policies, PKI, audit logs
- API :4000 (HTTP) + mTLS :4443 for ZTNA clients
- Compiles Open Policy Agent (OPA) bundles and pushes live signals
- Node/Express/Prisma + PostgreSQL + Redis
Gateway (Edge / DMZ)
- Only internet-facing enforcement point
- Go reverse proxy + Envoy (TLS, external authorization) + OPA
- ML-KEM-1024 key establishment
- Ports: :8443 client TLS, :8444 connector tunnel, :8181 OPA, :9090 admin
Connectors
- Outbound-only agents inside customer network
- Dials gateway over hybrid PQ-TLS
- Proxies to internal applications
- Zero inbound firewall rules required
- API :6000, tunnel :51820/UDP
This architecture ensures zero-trust enforcement at every layer.
QuantZTNA Use Cases
Remote Workforce Access
- Employees access corporate applications from anywhere
- Device posture verified (firewall, EDR, OS version)
- Risk-based MFA step-up for high-risk scenarios
Partner & Contractor Access
- Controlled, temporary access to specific applications
- Reduced posture requirements for external partners
- Time-based and IP-restricted policies
Supply Chain & Critical Infrastructure
- Government agencies accessing classified systems
- Defense contractors securing sensitive projects
- Financial institutions protecting trading floors
Compliance & Audit
- Per-request audit logs for HIPAA, PCI-DSS, SOC 2
- Policy-as-code with version control
- Zero-knowledge architecture (customer controls all keys)
REGULATORY & COMPLIANCE ALIGNMENT
- NIST ML-KEM (FIPS 203) - Post-Quantum Cryptography
- NIST ML-DSA - Quantum-Safe Digital Signatures
- EO 14144 (Federal PQC Migration Requirement)
- EO 14412 (Cybersecurity & Critical Infrastructure)
- CISA Ready - Automated Crypto Discovery & Inventory
- Zero Trust Architecture - Aligns with CISA & NSA guidance
- Audit-Ready - Customer-owned keys, full visibility, compliant logging
Ready to Implement Zero Trust with Quantum Safety?
Questions? Contact our sales team at sales@qubitguard.com