Ockam

Ockam is an end-to-end encryption framework and distributed identity provider designed to establish secure communication between applications and devices. It provides a secure network overlay that utilizes cryptographic identities and attribute-based access control to implement zero trust network access.

The project distinguishes itself through metadata-driven multi-hop routing and a pluggable transport layer, allowing encrypted traffic to move across diverse network topologies without requiring virtual IP overlays. It specifically enables secure tunneling for legacy applications by wrapping raw TCP traffic into encrypted channels, allowing private network connectivity and firewall bypass via outbound relays.

The platform covers a broad range of capabilities, including distributed identity management, cryptographic credential issuance and verification, and the execution of stateful concurrent actors. It also provides tools for cloud-scale node provisioning and automated deployment using infrastructure-as-code templates.

Features

End-to-End Encryption Protocols - Provides a framework for orchestrating end-to-end encrypted communication channels between distributed applications and devices.
End-to-End Encryption - Secures messages between distributed devices and services so data remains private throughout the entire transmission path.
Actor Worker Routing - Directs communication between decoupled actor components using a registry to resolve addresses and relay messages.
Persistent Worker State - Runs lightweight concurrent actors within a node that maintain state and process asynchronous messages via dedicated mailboxes.
Legacy Application Tunneling - Wraps unencrypted TCP traffic in secure channels to provide encryption and authentication without modifying application code.
Pluggable Transport Layers - Moves messages between nodes using pluggable transport layers such as TCP, UDP, WebSockets, or Bluetooth.
Layer 7 Traffic Routing - Directs data between distributed machines at the application layer without requiring virtual IP overlays or shared subnets.
Message Delivery Pipelines - Delivers messages between concurrent stateful actors running on a single instance or across remote network nodes.
Message Routing - Delivers messages between local or remote execution environments using standardized routing and transport protocols.
Overlay Networks - Provides a network layer that routes encrypted traffic across diverse transports and multi-hop paths without virtual IP overlays.
Private Network Connectivity - Bypasses firewalls and NATs by establishing outbound relays that allow secure communication with remote private networks.
Protocol-Agnostic Transport Layers - Moves routed messages across different physical or logical layers including TCP, UDP, WebSockets, and Bluetooth.
Traffic Routing - Directs data across a network of nodes using specialized routing protocols to reach specific endpoints.
Multi-Hop Routing - Directs messages through a sequence of intermediate nodes using metadata-driven routing to define the path.
Attribute-Based Access Control - Restricts resource access using attribute-based controls to define granular permissions based on user or device properties.
Bidirectional Secure Connectivity - Creates encrypted tunnels between distributed environments using outgoing connections to remove the need for VPNs or firewall changes.
Client Access Authorizations - Restricts channel establishment based on specific cryptographic identifiers or credentials issued by a trusted authority.
Verifiable Credential Issuance - Provides signed attestations from an authority to verify entity attributes and membership for scalable trust.
Cryptographic Identity Generation - Generates unique cryptographic identities to represent users or devices for securing communications.
Cryptographic Key Management - Generates, retrieves, and deletes secret signing and ephemeral keys within a secure hardware or software vault.
Distributed Identity Providers - Provides a system for creating and managing verifiable cryptographic identities and attribute-based credentials to establish trust between nodes.
Encrypted Tunneling - Creates encrypted and authenticated tunnels for data transfer across diverse transport topologies and multi-hop routes.
Attribute-based Access Controls - Provides an authorization engine that restricts resource access by evaluating the cryptographic attributes of authenticated identities.
Credential Issuance and Revocation - Operates credential authorities to distribute, rotate, and revoke attribute-based credentials across device fleets.
Identity Management - Creates and manages verifiable digital identities to enable secure communication and prevent behavior correlation.
Identity Management - Manages verifiable cryptographic identities and credentials to establish trust between nodes in decentralized environments.
Mutual Authentication - Establishes secure channels by verifying cryptographic identifiers and signed credentials during a mutual handshake.
Policy-Based Access Control - Applies granular authorization rules using attribute-based, role-based, or access control list models to govern resource access.
AEAD Encryptions and Decryptions - Performs AEAD encryption and decryption on plaintext using secret keys stored in a secure vault.
Authenticated Encryption Channels - Creates encrypted connections between nodes that guarantee data authenticity, integrity, and confidentiality.
Secure Node Provisioning - Provisions encrypted inlet and outlet nodes on cloud infrastructure to establish secure tunnels between distributed services.
Identity-Based Trust Anchors - Establishes a secure communication channel by explicitly authorizing specific known cryptographic identifiers.
Authority-Based Trust Anchors - Establishes secure communication by validating a credential issued by a trusted third-party authority.
Credential-Based Trust Hierarchies - Scales trust across distributed nodes using a hierarchy of issued and verified cryptographic attestations.
Verifiable Credential Verification - Validates the cryptographic signatures and authenticity of attribute-based credentials against trusted issuers.
Zero Trust Access - Controls resource access using cryptographic identities and attribute-based policies to eliminate reliance on traditional VPNs.
Cloud Node Lifecycle Management - Creates and scales managed nodes in the cloud to host services and manage team permissions.
Infrastructure-as-Code Node Deployments - Automates the creation and configuration of secure communication nodes using infrastructure-as-code templates.
Network Bridging - Acts as a gateway between separate networks or transport protocols to enable communication between disconnected nodes.
Connectivity Abstraction Layers - Hides complex network layer configurations from developers to prevent security vulnerabilities and data leaks.
Encrypted Network Relays - Establishes outbound connections to intermediary nodes to bridge communication between private networks.
Network Bridging Relays - Establishes outbound connections to intermediary relay services to bridge isolated private network segments.
Service Exposure - Groups workers into named services with unique addresses to provide functionality to other nodes across the network.
TCP Tunneling - Proxies raw TCP traffic by wrapping it in encrypted channels to secure legacy protocols without code changes.
Secure Tunnels - Establishes encrypted tunnels between external clients and private databases using inlet and outlet nodes.
Cryptographic Signing Methods - Signs data using cryptographic algorithms while ensuring secret keys remain within a secure boundary.
Encryption Key Management - Updates symmetric keys periodically using a nonce-based sliding window to maintain forward secrecy.
End-to-End Encrypted Messaging Frameworks - Orchestrates cryptographic identities, mutual authentication, and secure communication channels between distributed applications.
Layered Secure Tunneling - Nests multiple secure channels within one another to provide layered authentication across complex network paths.
Legacy Protocol Tunneling - Wraps raw TCP traffic into encrypted routed messages to provide secure tunneling for legacy protocols.
Identity & Key Management - Secures private keys within hardware, cloud management systems, or file systems to prevent extraction.
Diffie-Hellman Exchanges - Computes shared secrets using public keys to establish secure communication channels via Diffie-Hellman.
Identity Key Attestations - Signs attestations that bind digital identities to specific public keys used for issuing credentials or securing channels.
External Trust Bootstrapping - Scales trust from a single anchor to many entities through enrollment protocols that distribute credentials over secure channels.
Traffic Filtering - Evaluates incoming and outgoing messages against access control rules to authorize or block traffic based on route metadata.
Actor-Based Concurrency - Implements a concurrency model using isolated stateful workers and message-passing actors.
Rust Cryptography - Library for end-to-end encryption and mutual authentication.
Security And Privacy - Library for end-to-end encryption and authentication.
Security & Privacy - Suite for secure, private communication between devices.

build-trust/ockam

4,628View on GitHub

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

octelium/octelium

3,371View on GitHub

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

openziti/ziti

3,883View on GitHub

Ziti is a zero-trust network overlay and identity-based mesh network. It provides a software-defined perimeter that replaces traditional IP-based routing and VPNs by mapping network services to cryptographically verified identities, effectively cloaking applications from the public internet. The project distinguishes itself through an outbound-only connection model that eliminates open listening ports and a Zero Trust SDK that allows developers to embed encryption and identity-based access control directly into application source code. It also provides transparent tunneling proxies to extend

fosrl/pangolin

21,255View on GitHub

Pangolin is a zero-trust remote access platform designed to provide secure, identity-aware connectivity to private network resources. It functions as a cloud-native network controller that orchestrates encrypted tunnels, traffic routing, and access policies across distributed environments. By leveraging WireGuard for secure data transport, the platform enables authenticated access to internal web applications, terminal sessions, and remote desktops without exposing services to the public internet. The platform distinguishes itself through a declarative infrastructure model that synchronizes n

ockam-networkockam

Features