Zero-Trust Medical Data Architecture 🛡️

A comprehensive, containerized web application built to demonstrate the practical implementation of Zero-Trust Architecture (ZTA) for securing highly sensitive medical records. Developed as an academic project at the Technical University of Sofia, this system abandons the traditional "Castle-and-Moat" security model in favor of the strict "Never trust, always verify" paradigm.

🚀 Key Security Features

1. Network Microsegmentation (Assume Breach)

The backend Django application and the PostgreSQL database are completely isolated within an internal Docker bridge network (zta_network). They expose NO ports to the host machine or the public internet. The only entry point is an Nginx Reverse Proxy, which intercepts and filters HTTP requests before routing them internally.

2. Explicit Identity Verification (MFA)

In a Zero-Trust environment, passwords are fundamentally untrusted. The system enforces mandatory Multi-Factor Authentication (MFA) using the Time-Based One-Time Password (TOTP) algorithm. Medical personnel must validate their identity dynamically via an authenticator app (e.g., Google Authenticator) for every session.

3. Attribute-Based Access Control (ABAC)

Role-Based Access (RBAC) is insufficient for Zero-Trust. This project implements dynamic ABAC policies that evaluate request context in real-time:

• Time-Based Access: Access to confidential patient records is strictly allowed only during authorized working hours (e.g., 08:00 - 18:00).
• Device Trust Evaluation: The system parses HTTP headers to detect mobile devices or untrusted endpoints, instantly blocking access to sensitive data to prevent data leakage from easily compromised devices.

4. Continuous Monitoring & Telemetry

Every policy violation (e.g., attempting to read a confidential record via a mobile phone or outside working hours) is not only blocked (HTTP 403) but instantly recorded in a dedicated Audit Log. These logs capture the user, IP address, timestamp, and exact violation reason, ensuring complete traceability.

🛠️ Technology Stack

• Backend: Python, Django
• Database: PostgreSQL
• Infrastructure: Docker, Docker Compose
• Web Server / Proxy: Nginx
• Security Packages: django-two-factor-auth

⚙️ How to Run Locally

Prerequisites

• Docker and Docker Compose installed on your machine.
• Git.

Installation Steps

1. Clone the repository:

   git clone [https://github.com/pulsar-04/ZeroTrustApp.git](https://github.com/yourusername/ZeroTrustApp.git)
   cd ZeroTrustApp

2. Set up environment variables: Create a .env file in the root directory to securely store your credentials:

   SECRET_KEY=your_secure_django_secret_key_here
   DB_NAME=medical_records
   DB_USER=zt_admin
   DB_PASSWORD=your_secure_database_password

3. Build and spin up the containers:

   docker-compose up -d --build

4. Run migrations (First time only):

   docker-compose exec web python manage.py migrate

5. Create a superuser:

   docker-compose exec web python manage.py createsuperuser

6. Access the application: Open your browser and navigate to http://localhost. The admin panel is available at http://localhost/admin/.

🎓 Academic Context

This prototype was designed, developed, and successfully defended as part of the "Secure Architectures and Communication Protocols" course (Cybersecurity major), receiving an excellent evaluation for its robust architectural implementation.