ockam-network/ockam

Features

• End-to-End Encryption Protocols - Provides a framework for orchestrating end-to-end encrypted communication channels between distributed applications and devices.
• End-to-End Encryption - Secures messages between distributed devices and services so data remains private throughout the entire transmission path.
• Actor Worker Routing - Directs communication between decoupled actor components using a registry to resolve addresses and relay messages.
• Persistent Worker State - Runs lightweight concurrent actors within a node that maintain state and process asynchronous messages via dedicated mailboxes.
• Legacy Application Tunneling - Wraps unencrypted TCP traffic in secure channels to provide encryption and authentication without modifying application code.
• Pluggable Transport Layers - Moves messages between nodes using pluggable transport layers such as TCP, UDP, WebSockets, or Bluetooth.
• Layer 7 Traffic Routing - Directs data between distributed machines at the application layer without requiring virtual IP overlays or shared subnets.
• Message Delivery Pipelines - Delivers messages between concurrent stateful actors running on a single instance or across remote network nodes.
• Message Routing - Delivers messages between local or remote execution environments using standardized routing and transport protocols.
• Overlay Networks - Provides a network layer that routes encrypted traffic across diverse transports and multi-hop paths without virtual IP overlays.
• Private Network Connectivity - Bypasses firewalls and NATs by establishing outbound relays that allow secure communication with remote private networks.
• Protocol-Agnostic Transport Layers - Moves routed messages across different physical or logical layers including TCP, UDP, WebSockets, and Bluetooth.
• Traffic Routing - Directs data across a network of nodes using specialized routing protocols to reach specific endpoints.
• Multi-Hop Routing - Directs messages through a sequence of intermediate nodes using metadata-driven routing to define the path.
• Attribute-Based Access Control - Restricts resource access using attribute-based controls to define granular permissions based on user or device properties.
• Bidirectional Secure Connectivity - Creates encrypted tunnels between distributed environments using outgoing connections to remove the need for VPNs or firewall changes.
• Client Access Authorizations - Restricts channel establishment based on specific cryptographic identifiers or credentials issued by a trusted authority.
• Verifiable Credential Issuance - Provides signed attestations from an authority to verify entity attributes and membership for scalable trust.
• Cryptographic Identity Generation - Generates unique cryptographic identities to represent users or devices for securing communications.
• Cryptographic Key Management - Generates, retrieves, and deletes secret signing and ephemeral keys within a secure hardware or software vault.
• Distributed Identity Providers - Provides a system for creating and managing verifiable cryptographic identities and attribute-based credentials to establish trust between nodes.
• Encrypted Tunneling - Creates encrypted and authenticated tunnels for data transfer across diverse transport topologies and multi-hop routes.
• Attribute-based Access Controls - Provides an authorization engine that restricts resource access by evaluating the cryptographic attributes of authenticated identities.
• Credential Issuance and Revocation - Operates credential authorities to distribute, rotate, and revoke attribute-based credentials across device fleets.
• Identity Management - Creates and manages verifiable digital identities to enable secure communication and prevent behavior correlation.
• Identity Management - Manages verifiable cryptographic identities and credentials to establish trust between nodes in decentralized environments.
• Mutual Authentication - Establishes secure channels by verifying cryptographic identifiers and signed credentials during a mutual handshake.
• Policy-Based Access Control - Applies granular authorization rules using attribute-based, role-based, or access control list models to govern resource access.
• AEAD Encryptions and Decryptions - Performs AEAD encryption and decryption on plaintext using secret keys stored in a secure vault.
• Authenticated Encryption Channels - Creates encrypted connections between nodes that guarantee data authenticity, integrity, and confidentiality.
• Secure Node Provisioning - Provisions encrypted inlet and outlet nodes on cloud infrastructure to establish secure tunnels between distributed services.
• Identity-Based Trust Anchors - Establishes a secure communication channel by explicitly authorizing specific known cryptographic identifiers.
• Authority-Based Trust Anchors - Establishes secure communication by validating a credential issued by a trusted third-party authority.
• Credential-Based Trust Hierarchies - Scales trust across distributed nodes using a hierarchy of issued and verified cryptographic attestations.
• Verifiable Credential Verification - Validates the cryptographic signatures and authenticity of attribute-based credentials against trusted issuers.
• Zero Trust Access - Controls resource access using cryptographic identities and attribute-based policies to eliminate reliance on traditional VPNs.
• Cloud Node Lifecycle Management - Creates and scales managed nodes in the cloud to host services and manage team permissions.
• Infrastructure-as-Code Node Deployments - Automates the creation and configuration of secure communication nodes using infrastructure-as-code templates.
• Network Bridging - Acts as a gateway between separate networks or transport protocols to enable communication between disconnected nodes.
• Connectivity Abstraction Layers - Hides complex network layer configurations from developers to prevent security vulnerabilities and data leaks.
• Encrypted Network Relays - Establishes outbound connections to intermediary nodes to bridge communication between private networks.
• Network Bridging Relays - Establishes outbound connections to intermediary relay services to bridge isolated private network segments.
• Service Exposure - Groups workers into named services with unique addresses to provide functionality to other nodes across the network.
• TCP Tunneling - Proxies raw TCP traffic by wrapping it in encrypted channels to secure legacy protocols without code changes.
• Secure Tunnels - Establishes encrypted tunnels between external clients and private databases using inlet and outlet nodes.
• Cryptographic Signing Methods - Signs data using cryptographic algorithms while ensuring secret keys remain within a secure boundary.
• Encryption Key Management - Updates symmetric keys periodically using a nonce-based sliding window to maintain forward secrecy.
• End-to-End Encrypted Messaging Frameworks - Orchestrates cryptographic identities, mutual authentication, and secure communication channels between distributed applications.
• Layered Secure Tunneling - Nests multiple secure channels within one another to provide layered authentication across complex network paths.
• Legacy Protocol Tunneling - Wraps raw TCP traffic into encrypted routed messages to provide secure tunneling for legacy protocols.
• Identity & Key Management - Secures private keys within hardware, cloud management systems, or file systems to prevent extraction.
• Diffie-Hellman Exchanges - Computes shared secrets using public keys to establish secure communication channels via Diffie-Hellman.
• Identity Key Attestations - Signs attestations that bind digital identities to specific public keys used for issuing credentials or securing channels.
• External Trust Bootstrapping - Scales trust from a single anchor to many entities through enrollment protocols that distribute credentials over secure channels.
• Traffic Filtering - Evaluates incoming and outgoing messages against access control rules to authorize or block traffic based on route metadata.
• Actor-Based Concurrency - Implements a concurrency model using isolated stateful workers and message-passing actors.
• Rust Cryptography - Library for end-to-end encryption and mutual authentication.
• Security And Privacy - Library for end-to-end encryption and authentication.
• Security & Privacy - Suite for secure, private communication between devices.

Star history