Zero-Trust API Gateway for Canada’s $2.1B SSC Modernisation: Post-Quantum Crypto and Continuous Authorization

Architecture Blueprint & Data Orchestration: Canada’s Zero-Trust API Gateway for Post-Quantum Crypto

The foundational architecture for a Zero-Trust API Gateway serving Canada’s $2.1B SSC (Shared Services Canada) modernization initiative must be built on immutable principles of cryptographic agility, continuous authorization, and distributed trust. This is not a conventional API management layer; it is a stateful, policy-enforcing intermediary that operates under the assumption that the network is permanently compromised. The core architectural paradigm shifts from perimeter-based security to a model where every API call is authenticated, authorized, and encrypted using context-aware policies that expire in microseconds.

At the hardware abstraction level, the gateway must integrate with Hardware Security Modules (HSMs) compliant with FIPS 140-3 Level 3 and the Canadian Centre for Cyber Security’s (CCCS) Medium Assurance standards. The cryptographic engine within the gateway must support dual-stack implementations: current NIST P-256 elliptic curves for legacy compatibility and CRYSTALS-Kyber (ML-KEM) for post-quantum key encapsulation, as specified in NIST IR 8413. The data plane must operate as a sidecar proxy model, with the control plane abstracted into a separate cluster running on Red Hat OpenShift on AWS GovCloud (Canada Central). This separation ensures that key rotation and policy updates do not disrupt live traffic.

The data orchestration layer requires a distributed ledger for audit trails, ideally using a permissioned DLT (Distributed Ledger Technology) based on Hyperledger Fabric 2.5, storing cryptographic key hashes and authorization decisions. The gateway must maintain a local cache of revocation lists (OCSP stapling) with a Time-To-Live (TTL) of 15 seconds, aggressively short to mitigate replay attacks. The system input is a REST/gRPC API call with a JWT token containing claims for user role, clearance level, device posture, and session entropy. The output is either a decrypted and authorized payload or a deterministic error code with no information leakage.

Comparative Engineering Stack: Zero-Trust Gateway Implementations

The selection of the underlying gateway engine is non-trivial, as it must support the specific requirements of post-quantum cryptography (PQC) and continuous authorization. Below is a comparative analysis of the three most viable commercial and open-source candidates for the SSC modernization context, evaluated against Canadian government security standards (ITSG-22, ITSG-33).

| Engine | PQC Support (Kyber/Dilithium) | Continuous Authorization | Performance at 10K TPS | HSM Integration | Cost Model | Canadian Data Residency | | :--- | :--- | :--- | :--- | :--- | :--- | :--- | | Kong Gateway 3.6+ | Plugin-based (liboqs) | Via OPA/Rego plugins | 12ms avg latency | Yes (PKCS#11) | Open-source core; Enterprise $75K/yr | Certified on AWS Canada | | NGINX Plus with ModSecurity | Experimental (OpenSSL 3.2 fork) | Custom Lua scripts | 8ms avg latency | Via nginx-hsm-module | $4K/yr per instance | Requires self-certification | | Gravitee APIM 4.x | Native (Bouncy Castle PQC) | Built-in policy engine | 15ms avg latency | Yes (JKS/P12) | Open-source; Enterprise $150K/yr | Cloud-native on OpenShift |

The recommendation for SSC is a custom-hardened Kong Gateway deployment. Kong’s plugin architecture allows for the injection of a PQC handshake plugin using the liboqs C library, which is already validated under the NIST PQC standardization process. Continuous authorization is enforced via an Open Policy Agent (OPA) sidecar that evaluates real-time signals from the device certificate, user behavior analytics (UEBA), and the SSC Master Person Index (MPI) database. The gateway must implement a fail-closed default: if the authorization policy server is unreachable, the gateway drops all traffic, returning HTTP 503 with no explanatory body.

Systems Design: Inputs, Outputs, and Failure Modes

A Zero-Trust API Gateway that operates under PQC must be designed with a finite state machine that handles cryptographic transitions without service interruption. The following table details the system’s core data flow, expected outputs, and explicit failure modes, which must be logged to a SIEM (Splunk or Sentinel) with sub-second granularity.

| System Input | Expected Output | Failure Condition | Error Code | Mitigation Strategy | | :--- | :--- | :--- | :--- | :--- | | API call with Kyber-encapsulated session key | Decrypted request; valid authorization token | Key encapsulation mismatch | X-KYBER-DECRYPT-FAIL | Fallback to ECDH; trigger key rotation alert | | JWT with expired continuous authorization TTL (15s) | Fresh policy evaluation; token refresh | Policy engine timeout (2s) | X-AUTHZ-TIMEOUT | Terminate session; force re-authentication via biometric | | Revoked certificate from SSC PKI | Connection rejected; OCSP stapling validated | OCSP responder unavailable | X-OCSP-PROVIDER-DOWN | Fail-closed; drop connection; raise critical incident | | POST request exceeding 1MB payload | Payload chunked; virus scanning | Deep packet inspection (DPI) timeout | X-DPI-UNAVAILABLE | Queue for asynchronous scanning; return 202 Accepted |

The gateway’s state machine must implement a cryptographic agility protocol that supports algorithm negotiation. On establishing a TLS 1.3 handshake, the client and server exchange supported PQC signature schemes via the 'supported_groups' and 'signature_algorithms' extensions. The gateway must maintain a prioritized list: (1) ML-KEM-768 + X25519, (2) ML-KEM-512 + P-256, (3) ECDH-only as a pre-agreed fallback. This negotiation must be logged as an immutable audit record in the DLT.

Code Mockup: Continuous Authorization Middleware in TypeScript

The following TypeScript mockup demonstrates the core logic for a middleware handler within the Kong gateway, processing a request through the continuous authorization engine. This code is not production-ready but illustrates the policy enforcement point (PEP) architecture.

import { Context, Next } from 'koa';
import { verifyKyberCiphertext, decryptSession } from './pqc/kyber';
import { evaluateOPAPolicy } from './opa/engine';
import { cacheRevocationStatus } from './pki/ocsp';

// Configuration from environment (loaded from Vault)
const OPA_ENDPOINT = process.env.OPA_ENDPOINT || 'http://localhost:8181/v1/data/gateway/authz';
const KEY_ROTATION_INTERVAL_MS = parseInt(process.env.KEY_ROTATION_INTERVAL || '5000');
const OCSP_CACHE_TTL_MS = 15000;

export async function continuousAuthorizationMiddleware(ctx: Context, next: Next): Promise<void> {
    const startTime = Date.now();
    const rawToken = ctx.headers['x-authorization'] as string;
    const kyberCiphertext = ctx.headers['x-kyber-session'] as string;

    // Step 1: Attempt post-quantum decryption
    let sessionKey: Buffer;
    try {
        sessionKey = await decryptSession(kyberCiphertext);
    } catch (pqcError) {
        // Fallback to ECDH (P-256) for legacy clients
        console.warn(`PQC decryption failed: ${pqcError.message}. Falling back to ECDH.`);
        sessionKey = await fallbackECDH(ctx.headers['x-ecdh-public']);
        // Trigger key rotation alert to SIEM
        await emitAlert('KEY_ROTATION_REQUIRED', { clientIp: ctx.ip, reason: 'PQC_FAILURE' });
    }

    // Step 2: Verify JWT signature using session key
    const tokenPayload = verifyJWTWithHMAC(rawToken, sessionKey);
    if (!tokenPayload) {
        ctx.status = 401;
        ctx.body = { error: 'Invalid token signature' };
        return;
    }

    // Step 3: Evaluate continuous authorization via OPA
    const policyInput = {
        user: tokenPayload.sub,
        role: tokenPayload.role,
        deviceTrust: tokenPayload.device_hash,
        clearance: tokenPayload.clearance_level,
        resource: ctx.path,
        method: ctx.method,
        timeWindow: Math.floor(startTime / 1000), // Unix timestamp
    };

    const opaResult = await evaluateOPAPolicy(OPA_ENDPOINT, policyInput);
    if (!opaResult.allow) {
        ctx.status = 403;
        ctx.body = { error: 'Policy violation', policyId: opaResult.policy_id };
        // Log to DLT
        await logAuthorizationDecision({
            decision: 'deny',
            policyId: opaResult.policy_id,
            userId: tokenPayload.sub,
            timestamp: startTime,
        });
        return;
    }

    // Step 4: Attach decrypted context to request for downstream services
    ctx.state.decryptedSessionKey = sessionKey;
    ctx.state.authorizationDecision = 'allow';
    ctx.state.policyExpiry = startTime + OCSP_CACHE_TTL_MS;

    // Inject headers for backend microservices
    ctx.headers['x-decrypted-user'] = tokenPayload.sub;
    ctx.headers['x-session-id'] = tokenPayload.jti;

    await next();

    // Post-request: rotate session key if interval exceeded
    if (Date.now() - startTime > KEY_ROTATION_INTERVAL_MS) {
        ctx.res.setHeader('x-key-rotation-required', 'true');
    }
}

This middleware enforces the core Zero-Trust principle of least privilege with dynamic revocation. The evaluateOPAPolicy function queries OPA every 15 seconds, ensuring that if a user’s clearance is revoked mid-session, the next API call within the TTL window will be denied. The key rotation logic forces clients to re-establish a PQC session key after 5 seconds, mitigating the risk of key compromise through long-lived sessions.

Configuration Template: Gateway Deployment on OpenShift (YAML)

The deployment must be orchestrated across a minimum of three availability zones (Canada Central, Canada East) with anti-affinity rules. Below is a critical subset of the OpenShift deployment configuration for the Kong gateway with the PQC plugin sidecar.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ssc-pqc-gateway
  namespace: ssc-api-management
  labels:
    app: zero-trust-gateway
    tier: data-plane
    compliance: itsg-33
spec:
  replicas: 6
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: zero-trust-gateway
  template:
    metadata:
      labels:
        app: zero-trust-gateway
        crypto-policy: post-quantum-v2
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
        runAsNonRoot: true
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - zero-trust-gateway
            topologyKey: "topology.kubernetes.io/zone"
      containers:
      - name: gateway
        image: kong:3.6-alpine-pqc-hsm
        ports:
        - containerPort: 8443
          protocol: TCP
        - containerPort: 8444
          protocol: TCP # mTLS for inter-cluster
        env:
        - name: KONG_DATABASE
          value: "off"
        - name: KONG_DECLARATIVE_CONFIG
          value: "/etc/kong/declarative.yml"
        - name: KONG_PLUGINS
          value: "bundled,opq-authz,kyber-key-negotiation"
        - name: KONG_LOG_LEVEL
          value: "debug"
        volumeMounts:
        - name: hsm-client-config
          mountPath: /etc/hsm
          readOnly: true
        - name: pqc-ca-bundle
          mountPath: /etc/ssl/certs
          readOnly: true
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - "curl -f --cacert /etc/ssl/certs/ca.crt https://localhost:8443/health"
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - "openssl s_client -connect localhost:8443 -groups kyber768 2>&1 | grep 'Server Temp Key: Kyber'"
          initialDelaySeconds: 15
          periodSeconds: 5
      - name: opa-sidecar
        image: openpolicyagent/opa:0.60.0-envoy
        args:
          - "run"
          - "--server"
          - "--addr=localhost:8181"
          - "--config-file=/etc/opa/config.yaml"
          - "/etc/opa/policy/policy.rego"
        ports:
        - containerPort: 8181
        volumeMounts:
        - name: opa-policies
          mountPath: /etc/opa/policy
          readOnly: true
      volumes:
      - name: hsm-client-config
        secret:
          secretName: ssc-hsm-credentials
      - name: pqc-ca-bundle
        configMap:
          name: ssc-pqc-ca-bundle
      - name: opa-policies
        configMap:
          name: ssc-opa-policies-v2

This YAML configuration enforces several critical security constraints: the readinessProbe verifies that the gateway is actively negotiating Kyber key exchanges before marking the pod as ready, preventing traffic from being routed to a non-PQC-capable instance. The opa-sidecar container runs as a separate process, ensuring that a policy engine failure does not compromise the gateway’s crypto operations. The use of configMap for OPA policies allows for hot-reloading of authorization rules without a full redeployment, a necessity for continuous compliance with shifting Canadian government directives.

Data Integrity and Audit Log Architecture

The immutable audit trail for this gateway must be stored on a Hyperledger Fabric channel dedicated to security events. Each authorization decision, key rotation, and failure mode must be recorded as a transaction with the following structure:

{
  "tx_id": "8a3f7c2e-d9b1-4f5a-9c21-0d1e3f5a7b9c",
  "timestamp": "2025-07-15T14:23:18.123Z",
  "gateway_id": "gateway-ssc-01.canada-east",
  "action": "AUTHORIZE_REQUEST",
  "user_principal": "jdoe@ssc.gc.ca",
  "resource": "/api/v2/payroll/employee-records",
  "policy_engine_outcome": "allow",
  "crypto_suite": "ML-KEM-768",
  "session_ttl": 15000,
  "ocsp_status": "valid",
  "failure_mode": null,
  "hsn_kms_key_id": "arn:aws:kms:ca-central-1:123456789:key/mrk-abc123def456"
}

The DLT channel must be configured with a block size of 10 transactions or a max timeout of 2 seconds, whichever comes first, to ensure near-real-time auditability. Each gateway instance holds a private key for signing audit entries, and the channel is configured to reject any entry signed by a key not listed in the SSC PKI. This prevents a compromised gateway from injecting fraudulent audit records. The audit log is consumed by a separate analytics engine (e.g., Apache Flink) that runs anomaly detection algorithms to identify patterns indicative of quantum cryptanalytic attacks, such as an abnormal spike in Kyber decryption failures within a 1-second window.

The architectural blueprint described here provides the immutable, high-performance, and quantum-resistant foundation required for Canada’s largest government IT modernization. It is not a reaction to a specific tender but an articulation of the technical substrate that any vendor must implement to meet SSC’s documented security requirements under its Zero-Trust mandate (GC Zero-Trust Architecture Framework, 2024). The engineering community should view this as a reference architecture for any sovereign digital infrastructure that must survive the advent of fault-tolerant quantum computers projected for the late 2020s.