Zero-Egress Architecture & mTLS Mesh

To defend against advanced persistent threats (APTs) and unauthorized data leakage, Aarkam enforces Zero-Trust Network Segmentation and strict Zero-Egress Data Pinning.

1. Mutual TLS (mTLS 1.3) Service Mesh

All internal inter-module communication traverses an encrypted mutual TLS mesh:

┌─────────────────┐             mTLS 1.3             ┌───────────────────┐
│    Aarkam.IO    │ ◄──────────────────────────────► │ Rokka.Coordinator │
│   Port: 57771   │    Mutual X.509 Certificate Auth │    Port: 57774    │
└────────┬────────┘                                  └─────────┬─────────┘
         │                                                     │
         │                  mTLS 1.3                           │
         └─────────────────────────────────────────────────────┤
                                                               │
                               ▼                               ▼
                     ┌───────────────────┐           ┌───────────────────┐
                     │ Rokka.StorageNode │           │    Abodi.Agent    │
                     │    Port: 57775    │           │    Port: 57776    │
                     └───────────────────┘           └───────────────────┘

• Ephemeral Diffie-Hellman Keys: Uses TLS 1.3 with ECDHE key exchange for complete forward secrecy.
• Mutual Node Authentication: Storage nodes refuse connections from any coordinator or gateway lacking a cryptographically valid client certificate signed by the internal Cluster Root CA.
• Automated Certificate Rotation: Integrates with automated PKI pipelines to rotate node certificates without downtime.

2. Dual-Plane Network Segmentation

Aarkam strictly segregates Client Edge Traffic from Internal Storage Backplane Traffic:

1. Client Edge Network (Public/DMZ):
   • Accessible only by client S3 applications and administrators on Ports 7771 / 57771.
   • Hardened with rate limiting, OWASP Top 10 web application defenses, and anti-DDoS buffering.
2. Cluster Backplane Network (Air-Gapped / Isolated VLAN):
   • Strictly private, non-routable subnet (e.g., 10.240.0.0/16 or isolated 100GbE physical switches).
   • Hosts Ports 57774 (Coordinators), 57775 (Storage Nodes), and 57776 (Abodi sidecars).
   • Zero internet gateway, zero default route, and zero cross-subnet egress.

3. Sovereign Geographic Boundary Pinning

To satisfy data residency mandates under SDAIA PDPL (Article 29), NCA CCC-2:2024, and EU GDPR:

• Sovereign IP Allocations: The Consistent Hash Ring tags nodes with physical geography, datacenter identifier, and sovereign jurisdiction.
• Boundary Enforcement: Parity stripes and primary chunks are mathematically restricted to certified sovereign subnets.
• Zero Extraterritorial Transit: Chunks never transit across international borders or untrusted WAN networks.