Zero Trust VPN (ZT-VPN): A Cybersecurity Framework for Modern Enterprises to Enhance IT Security and Privacy in Remote Work Environments

1. Introduction

Network infrastructures serve as the backbone of communication and information exchange. They facilitate the seamless flow of data, enabling organizations and individuals to access resources, collaborate, and conduct business efficiently [1,2]. However, the increasing reliance on networks has also attracted malicious actors who seek to exploit vulnerabilities and disrupt operations for various purposes, ranging from financial gain to espionage or activism [3]. As a result, understanding network attacks and developing effective defense mechanisms has become paramount in maintaining the security and integrity of network infrastructures [4].

Even with advancements in technology, there are many scams targeting businesses, for example, phishing remains the most common form of cyber-attack, accounting for 90% of data breaches [5]. In 2023, 343,338,964 people were the targets of 2,365 cyberattacks. Data breaches increased by 72% in 2023 compared to the previous record-holder, 2021 [6,7]. Surprisingly, 96% of these phishing attacks are delivered via email. In 2023, a staggering 72.7% of organizations experienced a ransomware attack [8]. Similarly, another major cyber attack is ransomware [9]. The costs associated with ransomware are expected to climb to USD 265 billion annually by 2031. In 2023, the average cost of a data breach saw a 15% rise over the previous three years, reaching $4.45 million on a worldwide scale [10,11]. Pay-outs were greatest in the US, at $5.09 million per breach [12,13,14].

Cyber insurance premiums in the US saw a 50% hike in 2022, with premiums collected amounting to USD 7.2 billion [15]. Over 75% of targeted attacks initiate from an email, with 94% of malware being delivered through this channel.C ybercrime costs are on a steep rise, expected to reach USD 10.5 trillion annually by 2025, marking a 15% yearly increase [16,17]. In the past, cybercrime rates increased by 600% during the COVID-19 pandemic, illustrating how dangers have adjusted to new global circumstances [18]. On average, a data breach would cost about $4.45 million. Approximately 35% of malware in 2023 was sent by email, making it the most frequent vector for malware [19,20]. Protecting an organization and understanding the motives behind these attacks is important, it helps in assessing the potential impact on network security and identifying appropriate mitigation strategies [21]. It is also equally important to access the network devices and perform security assessment of IT products [22]. Attacks like Denial of Service (DoS) try to block legitimate users from accessing resources or services on a network by overwhelming them [23,24]. These attacks can sabotage an organization and affect network availability [25].

Nowadays, organizations are relying on remote work technology and using a variety of technologies to access their organizational networks [26]. For example VPN is one of them, that allows for the safe transfer of data and other types of information between remote locations. One or more VPN devices that the user connects to via their web browser make up an SSL VPN [27]. It uses encryption for data transfer and operates at the application layer [28]. Cryptography ensures transport-level secrecy, whereas SSL offers encrypted public keys for key management and authentication [29]. By encrypting data in transit, it protects the connection between the client and the resource. No data is sent over the Internet or internal networks in plain text when end-to-end security is used. Every step, from the customer to the vendor, is encrypted and verified for security [30].

Despite this enormous and ubiquitous usage, VPNs come with various security challanges, and performance-related issues, thereby hindering users from taking maximum advantage of this technology [31,32]. One potential downside of relying only on VPNs is that they treat all users as trustworthy and give them unrestricted access to the network. To address this concern, VPN users must choose the most secure and perfect VPN solution for the smooth functioning of daily activities [33,34]. Similary, the traditional ’castle and moat approach’ of security is insufficient in light of the new age and evolving attacks along with the growing trend of the workplace from home [35]. Therefore, VPNs are becoming fundamental in defending today’s Network architectures and allowing remote access [36,37].

For a long time, VPNs have been employed to create safe and exclusive communications in the generally accessible network. VPNs compromise encryption and tunneling protocols, therefore forming a more secure Virtual Network overlaying an insecure Network Infrastructure [38,39]. VPN can be used for access privilege, confidential data integrity, and authentication when connecting remote and geographically disjointed networks [40,41]. On the other hand, conventional telecom architecture and, particularly, physically configured and hard-wired networks, accompanied by typical perimeters of protection, have failed to cope with the ever-changing cyber threats.

Nonetheless, the old paradigm of perimetral security has been replaced with the Zero Trust Network Access (ZTNA) due to the dynamics of threat and the necessity of a more accurate and dynamic security model [42,43]. It is a security model that verifies users and devices before granting access to applications or resources. ZTNA is based on the principle of "never trust, always verify" and is designed to reduce the attack surface area and improve security posture [44]. Some assumptions are made by pneumonic; firstly, it narrows down its view in networks and regards each user and device both within and outside the network as hostile and, therefore, has to be and should be authentically and authoritatively authorized by the network each time they want to access the network’s products [45,46,47]. This shift in mentality is important in combating newer and more advanced attacks that use vulnerabilities and lateral movement in the network. The use of both VPNs and ZTNA could provide a robust solution for the remote access problem and the protection of networks [48,49].

The posibiiltiy to murge VPN and ZTNA technology can give promising solution to industrial secuity accorded by end device identity, context, and, most importantly, the principle of least privilege to use the network resources. This integration allows organizations to apply tighter security measures to limit the attack vector and safeguard the data.

Hence, the purpose of this article is to discuss and identify how to use VPNs to establish zero-trust network access. Thus, the goal of familiarising ourselves with the ZTVPNconcepts and principles is to create patterns, standards, and recommendations for organizations that are trying to implement a safe and efficient remote access solution. Furthermore, we will discuss the issues, implications, and possible drawbacks of combining and offering case-study analyses. Taken in its entirety, these two approaches present a clear promise, in terms of conceptual development, of effectively conquering the security vulnerabilities that threaten organizations at present. Hence, this article endeavours offers some insights and real-life best practices for organizations that are aspiring to have strong and fortified network security that incorporates the use of VPNs and ZTNA for the attainment of secure remote access. This article discusses and analyzes various categories of network attacks, their features, and the impact they could have on current networks. We hope that by the end of this research, we will be in a position to add to the body of knowledge on how VPN and ZTNA can complement each other, thus reinforcing network security and offering secure access to remote resources. The key contributions of the research are as follows:

• The research paper gives an overview of contemporary technologies used across enterprises including VPN and ZTNA, Proxy Servers, Secure Shell (SSH) Tunnels, Software-defined wide area network (SD-WAN), and Secure Access Service Edge (SASE), among others.
• The paper identifies critical concerns associated with traditional technologies, such as latency, throughput, scalability, and cyber threats, and identifies the gap to overcome these challenges.
• The paper presents a novel Zero Trust VPN (ZTVPN) framework that integrates zero trust network access with virtual private networks to create a robust cybersecurity framework for remote work environments, aiming to fortify modern enterprises’ cybersecurity and privacy.
• Finally, the paper demonstrates the effectiveness of the ZTVPN framework through various enterprise scenarios, highlighting its ability to prevent data leaks, manage access permissions, and provide seamless security transitions, thereby fortifying cybersecurity frameworks against contemporary cyber threats.

The organization of this paper is structured as follows: The Introduction section (1) provides an overview of the shift to remote work environments and the associated cybersecurity challenges. The Background - Related Work section (2) reviews contemporary technologies and existing research in the field. The Proposed Framework section (3) details the design and architecture of the Zero Trust VPN (ZTVPN) framework, including examples of implementation case studies. The Results and Evaluation section (4) presents the findings from various enterprise scenarios, accompanied by a discussion of the results and acknowledgment of limitations. Finally, the Conclusion and Future Work section (5) summarizes the key contributions of the research and outlines potential directions for future studies.

2. Background - Related Work

The purpose of this Section is to provide a comprehensive review of existing technologies and research relevant to the topic of the paper. This section sets the context for the proposed framework by discussing contemporary technologies It also highlights the limitations and challenges of current approaches, thereby establishing the need for the proposed ZTVPN framework. By reviewing related work, this section helps to position the research within the broader field of cybersecurity and demonstrates how the proposed framework builds upon and advances existing knowledge.

2.1. Virtual Private Network (VPN)

It is a technology that creates a secure and encrypted connection over a less secure network, such as the internet. It allows users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network [50].

VPNs are commonly used by businesses to allow employees to securely access the company’s internal network from remote locations. This is particularly useful for remote work, enabling employees to access files, applications, and other resources as if they were in the office. VPNs provide a secure connection, protecting your data from hackers and cybercriminals, especially when using public Wi-Fi networks. The encryption ensures that even if the data is intercepted, it cannot be read [51]. By masking your IP address, a VPN helps protect your online privacy. It prevents websites, advertisers, and even your internet service provider (ISP) from tracking your online activities. VPNs allow you to bypass geographic restrictions and access content that may be blocked in your region. For example, you can access streaming services, websites, and online services that are only available in certain countries.

Figure 1 provides a detailed explanation of how a VPN works. It shows that, on a border level, when a person connects to a VPN, it encrypts your internet traffic. This means that the data you send and receive is converted into a secure code that is difficult for unauthorized parties to decipher. This encryption ensures that sensitive information, such as passwords and personal data, is protected from eavesdropping. The internet traffic is routed through a VPN server.

This server acts as an intermediary between your device and the internet. When a person accesses a website or online service, your request is first sent to the VPN server, which then forwards it to the destination. The response from the website is sent back to the VPN server, which then forwards it to your device. Importantly, By routing the traffic through a VPN server, your real IP address is hidden, and this appears to be accessing the internet from the location of the VPN server. This helps protect to identity and location, providing a layer of anonymity.

2.2. Zero Trust Network Access (ZTNA)

Zero Trust Network Access (ZTNA) is a security framework that operates on the principle of “never trust, always verify.” Unlike traditional security models that assume everything inside an organization’s network can be trusted, ZTNA assumes that threats can exist both inside and outside the network [52]. Therefore, it requires strict verification for every user and device attempting to access resources. Figure 2 provides detailed explanation of how a ZTNA works. The figure shows that, it is a security framework that assumes no inherent trust in any user or device seeking access to network resources. It emphasises the verification of user identities, strict access control and continuous monitoring. ZTNA relies on technologies such as multifactor authentication (MFA), identity and access management (IAM), network segmentation and micro-segmentation to enforce security controls [53].

Table 1 provides an overview and differences between VPN and ZTNA. As we can see from table that, ZTNA is well-suited for modern, dynamic environments, including remote work and cloud-based applications. It can easily scale to accommodate growing and changing organizational needs. ZTNA’s micro-segmentation and least-privilege access policies help contain potential breaches, preventing attackers from moving laterally within the network and accessing sensitive data [54]. By requiring continuous verification and limiting access based on identity and context, ZTNA significantly reduces the attack surface and improves overall security posture. ZTNA provides detailed insights into user and device activity, allowing organizations to detect and respond to threats more effectively. This visibility also helps in compliance with regulatory requirements.

2.3. Proxy Servers

A proxy server is an intermediary server that sits between a client (such as a computer or mobile device) and the internet. It acts as a gateway, handling requests from clients seeking resources from other servers. Proxy servers can provide an additional layer of security by filtering out malicious content and blocking access to harmful websites [55]. They can also protect against certain types of cyberattacks. proxy servers help protect the client’s privacy and prevent tracking by websites and advertisers. Proxy servers can bypass geographic restrictions and allow clients to access content that may be blocked in their region [56]. Proxy servers can cache frequently accessed content, reducing the load on the target servers and improving response times for clients. Proxy Servers Work as follows:

• When a client makes a request for a resource (such as a web page), the request is first sent to the proxy server. The proxy server then forwards the request to the target server on behalf of the client. Once the target server responds, the proxy server sends the response back to the client. This process adds a layer of separation between the client and the target server.
• Proxy servers can hide the client’s IP address by replacing it with their own. This helps protect the client’s identity and location, providing a layer of anonymity.
• Proxy servers can cache frequently requested resources. When a client requests a resource that is already cached, the proxy server can deliver it directly from its cache, reducing the time and bandwidth required to retrieve the resource from the target server.

2.4. Secure Shell (SSH) Tunnels

SSH Tunnels, also known as SSH port forwarding, are a method of transporting data over an encrypted SSH connection. This technique allows secure communication between a client and a server, even over an unsecured network [57].

SSH tunneling begins with establishing an SSH connection between a client and an SSH server. This connection is encrypted, ensuring that any data transmitted between the client and the server is secure and protected from eavesdropping. It uses strong encryption algorithms to secure the data transmitted through the tunnel [58]. It also employs authentication mechanisms, such as passwords, public keys, or multi-factor authentication, to verify the identity of the client and the server.

SSH tunnels can be used to bypass firewalls and network restrictions. For example, if a firewall blocks access to a specific service, an SSH tunnel can be used to route the traffic through an allowed port. SSH tunnels enable secure remote access to services and applications. This is particularly useful for system administrators who need to manage servers and devices from remote locations.

2.5. Software-Defined Wide Area Network (SD-WAN)

A Software-Defined Wide Area Network (SD-WAN) is a virtual WAN architecture that leverages software-defined networking (SDN) technology to manage and optimize the performance of a wide area network (WAN) [59]. It allows enterprises to use a combination of transport services, such as MPLS, LTE, and broadband internet, to securely connect users to applications.

SD-WAN separates the control plane from the data plane. The control plane is responsible for making decisions about where traffic should be sent, while the data plane is responsible for forwarding the traffic [60,61]. This separation allows for centralized management and control of the network. SD-WAN provides a centralized management interface that allows network administrators to configure and manage the entire WAN from a single location. This simplifies network operations and reduces the complexity associated with traditional WAN architectures.

SD-WAN can dynamically select the best path for traffic based on real-time network conditions. It can route traffic over multiple transport links, such as MPLS, LTE, and broadband, to optimize performance and ensure high availability. SD-WAN is application-aware, meaning it can identify and prioritize traffic based on the application. This ensures that critical applications receive the necessary bandwidth and low latency, while less critical applications are given lower priority.SD-WAN includes built-in security features such as encryption, firewall, and intrusion prevention. It can also integrate with existing security solutions to provide end-to-end protection for the network.

2.6. Secure Access Service Edge (SASE)

It is a cloud-based architecture model that combines wide area networking (WAN) and network security services into a single, unified framework. It is designed to securely connect users, systems, endpoints, and remote networks to applications and resources, regardless of their location [62]. Here’s a detailed explanation of how SASE works:

• SASE integrates networking functions, such as Software-Defined Wide Area Network (SD-WAN), with security services, including Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall as a Service (FWaaS), and Zero Trust Network Access (ZTNA). This convergence allows for a more streamlined and efficient approach to managing and securing network traffic [63].
• SASE is built on a cloud-native architecture, meaning that both the networking and security functions are delivered as cloud services. This allows for greater scalability, flexibility, and ease of deployment compared to traditional on-premises solutions.
• SASE grants access based on the identity of users and devices, rather than relying on the traditional perimeter-based security model. This ensures that only authenticated and authorized users can access specific applications and resources, enhancing security.
• SASE solutions are globally distributed, meaning that they have points of presence (PoPs) around the world. This ensures that users can securely access applications and resources with low latency, regardless of their geographic location.

Table 2 provides a comparison of Different Network Security and Access Technologies. We can see that, VPN creates a secure and encrypted connection over the internet, allowing users to access corporate networks remotely. However, traditional VPNs grant broad access to the entire network once authenticated, which can pose security risks. In contrast, ZTNA operates on the principle of “never trust, always verify,” continuously verifying every user and device attempting to access resources. ZTNA provides granular access control, granting users access only to specific applications and resources based on their identity and context, thereby reducing the attack surface and enhancing security.

Proxy Servers act as intermediaries between clients and the internet, masking the client’s IP address and providing anonymity. They can cache frequently requested content to improve performance but do not offer the same level of encryption and security as VPNs or ZTNA. SSH Tunnels provide secure communication for specific applications by transporting data over an encrypted SSH connection, ensuring data protection even over unsecured networks. SD-WAN optimizes network performance by dynamically selecting the best path for traffic and providing centralized management. Each technology has its unique strengths and use cases, making them suitable for different network and security requirements. VPNs and ZTNA focus on secure remote access, with ZTNA providing more granular control. Proxy servers offer anonymity and content filtering, while SSH tunnels secure specific application communications. SD-WAN enhances network performance and scalability, and SASE provides a comprehensive, cloud-based solution for modern enterprises.

2.7. Literature Review

Zero-Trust is a security architecture that safeguards on-premises resources by eradicating unidentified users and uncontrolled devices and restricting any lateral movement [64]. Research work by Cherrueau et al. [65] discusses the potential risks and mitigations, emphasising the importance of secure configuration, encryption and identity-based access controls. The study identifies the challenges of scaling ZTNA VPN solutions and provides recommendations for addressing security concerns.

Research work S et al.’s study [66]," Security issues with Virtual Private Network (VPN) and proxy services: Performance and Usability: Usability and performance are crucial factors when implementing ZTNA and VPN solutions. The study also suggests that bad VPN configuration and execution, rather than, say, inadequate cryptography, are the key issues. Research work Wang et al. [67] evaluate the performance of ZTNA VPN solutions: Considering factors such as latency, throughput and scalability. The study emphasises the need for efficient protocols and optimised configurations to maintain a balance between security and performance. According to Da Silva et al., [68,69], smart home security should include zero trust access control that takes context into account and uses behaviour-based continuous authentication. There is a proposal for a zero-aware smart home system that would regulate access to the smart home system by continually verifying the user’s authenticity using zero trust continuous identity verification. Powering it up is edge computing, which gets rid of unreliable service providers and any access. The correctness is not guaranteed, and there has been no testing of the effect of latency and concurrency in a real context.

Research work Hunt et al. [70] propose a ZTNA VPN model. The research highlights the benefits of this integration, such as enhanced visibility and control over network traffic. This states that incoming requests from users or devices should be accepted after authentication. Running both ZTNA and VPN simultaneously may introduce additional latency and performance overhead. This can impact the user experience, particularly for latency-sensitive applications. He et al. [71] conduct research comparing common trust assessment techniques and outlining the benefits and drawbacks of various access control regimes and authentication procedures. The emphasis of this study is also on protocols for network authentication and access control. Syed et al. [29] broadened the design’s scope to include software-defined perimeters and micro-segmentation and talked about the difficulties of such an architecture. Research work Data objects, rather than user-accessible paths, are subject to the zero-trust concepts and tenets surveyed by Pittman et al. [72]. Trust computation in a dynamic system like a network is, according to their findings, an issue of categorisation and regression. In their research, Buck et al.[73] used a search model to distinguish between academic material and grey literature while evaluating articles published on ZTNA. Any piece of writing that does not originate from an academic setting, such as a private or commercial enterprise, is considered grey literature.

To some extent, the methods outlined here are comparable to Google’s ZTN approach to access control [74,75]. However, the execution of decision continuity, risk management, and policy wording have been vague. NIST [76] provides a vendor-agnostic framework for ZT implementation. It focuses on the continuous verification of user and device identities. Policy enforcement is based on context, such as user identity, device health, and location. Micro-segmentation and least privilege access. Comprehensive and detailed guidance applicable to a wide range of organisations. Encourages continuous monitoring and verification, allowing for flexible implementation.

It may be seen as overly complex due to detailed and broad guidelines. Implementation requires a thorough understanding and careful planning. Forrester Model [77] Popularised by Forrester Research, this model emphasises the need to eliminate trust from the network. Continuous monitoring and validation of all users and devices. Micro-segmentation to limit lateral movement within networks. Data-centric security, ensuring data protection regardless of its location. Strong focus on data protection and reducing attack surfaces. A practical approach that can be adapted to various environments. Significant changes may be required to the existing network and security infrastructure. The broad approach might be challenging for smaller organisations to implement fully. Research work Some of the concepts presented here are similar to Dynfire, an AC policy management framework for ZTN put into practice on a college campus, as described by Vensmer et al. [78]. Problematically, neither risk management nor decision continuity are part of it. A ZTN AC solution for cloud computing, AL-SAFE, is described by Giannoku et al. [79]. However, it is missing policy language, risk management, and decision continuity features.

From Table 3, we can see that Scaling both ZTNA and VPN solutions to accommodate the increased number of users and devices can be effective. Ensuring seamless scalability while maintaining security can be a complex task. In today’s computing and mobile device settings, when dynamic characteristics make the idea of a conventional DMZ [80] outdated, this comparatively static approach to security, focused on physical or virtual perimeters, fails. As the new network edge, an implicit trust strategy cannot sufficiently protect the cloud. The idea of protecting information systems [70]. Changes were made to accomplish the required IP security based on a review of the company’s policy, the SSL encryption technique and the software utilised in the business. These steps will enable the information system for manufacturing locations to reach appropriate security. Given the context of prior research and the underlying hypotheses, the author delves into the data and their potential interpretation. Conversations on the results and their implications need to have a wide view. It is also possible to emphasise potential avenues for future science. Table

The manner in which companies work has changed over the last many years. Working remotely and other trends like bring your device (BYOD) [81] are driving the demand for flexible access to company data and apps from devices outside of the company’s internal network. This tendency is being exacerbated by the rising number of remote workers and the coronavirus epidemic. Additionally, problems arise for the organisation’s network architecture due to external connections, such as the incorporation of partners and service providers or the mutual sharing of assets. So far, the majority of companies have provided external users or services with encrypted connections to their internal networks so that they may access internal resources. When a user or service is considered trustworthy, they are granted access to the network’s resources. The problem is that most existing solutions rely on inflexible components like subnetworks, firewalls, and rule sets, making it impossible to adapt to these kinds of ever-changing conditions. Because of this design, there are major security holes. One issue is that the internal network is not segmented or controlled. Once an outsider or malevolent employee breaches an organisation’s network defence, they may access almost every part of the system. A large number of organisational resources are, therefore, vulnerable to reading, modification and harm.

According to zero-trust techniques, which aim to fix the problems with existing networking solutions, the fundamental premise is that no one on the network can be trusted and that any access to company resources might be a security risk. This means that all accesses are checked and confirmed. The approval of a request is contingent upon its verification. Either complete access to the service or access to just the allowed operations or data may be provided. When verifying a user’s identity, it’s important to take into account not only their password but also their device, location, time and access rights. In addition, resource access is limited to what is necessary for carrying out tasks in accordance with the concept of least privilege. This highlights the need to establish and rigorously follow access rules. The access regulations in question, however, are dynamic. It is possible to include the behaviour patterns of the network participants in the verification process by continuously monitoring and recording network traffic. Zero-trust is more of a strategy than a technology; it is an umbrella term for a set of guiding principles. his article discusses and analyzes various categories of network attacks, their features, and the impact they could have on current networks. We hope that by the end of this research, we will be in a position to add to the body of knowledge on how VPN and ZTNA can complement each other, thus reinforcing network security and offering secure access to remote resources. The key contributions of the research are as follows:

3. Proposed Framework - Design and Architecture

The detailed architecture of the Zero Trust VPN (ZTVPN) is illustrated in the provided diagram, comprising three main modules: Policy Enforcement Point (PEP), Identity Enforcement Point (IEP), and Security Enforcement Point (SEP). The PEP module handles the initial access flow, encrypting traffic and validating interactions between the subject and the resource. This involves certificate-based authentication, where both the client and server use SSL/TLS certificates to establish a secure connection, and username/password authentication, which adds an additional layer of security by requiring clients to provide valid credentials. The combination of these authentication methods ensures that only authorized clients can establish a VPN tunnel with the server.

Once connected to the VPN, the IEP module validates the user’s identity through login credentials and a one-time password (OTP) sent to the registered device. It also verifies the device’s health, operating system settings, and the user’s location before granting role-based access to organizational resources. The SEP module monitors session time and grants time-bound access, logging user activities and monitoring access to organizational resources. This comprehensive approach enhances the overall security and access control of the organization’s network, ensuring that only authenticated and authorized users can access sensitive resources.

A detailed architecture diagram of the ZTVPN is illustrated in Figure 3. It has three modules, namely Policy Enforcement Point (PEP), Identity Enforcement Point (IEP), and Security Enforcement Point (SEP). In the first form, the subject or person uses the resource on behalf of a requester or as a requester. The access flow is blocked by the PEP, which encrypts the traffic once the subject interacts with the resource and validation is successful, which is shown in Algorithm 1. Details are provided below:

• Certificate-Based Authentication: OpenVPN creates an encrypted connection between the client and server based on SSL/TLS. Certificates are employed to ensure that both the client and the server are genuine. The process is as follows: The process is as follows:

  –

  The VPN server has an independent SSL/TLS certificate and private key.

  –

  Every client gives out a distinct SSL/TLS certificate and a private key.

  –

  During the SSL/TLS negotiation, when a client connects to the server, it has to send its certificate to the server.

  –

  The server checks the client’s certificate against the list of the trusted certificates the server possesses. If the client’s certificate is valid and recognised as trustworthy by the server, then the SSL/TLS negotiation is accomplished, and the connection is established.

• Username/Password Authentication: Apart from the certificate, the VPN can also use the names and secret codes for other recognition in addition to the use of certificates. This is particularly useful when multiple clients use the same certificate, for instance, in road warrior configurations.

  –

  Every client has a username and a password created on the VPN server.

  –

  If the client attempts a connection, it presents a certificate as mentioned above, and then the server is asked for a username and password.

  –

  It then has to verify the username and the password of the client against the list of clients and the password with which it has been configured.

  –

  If the credentials match those of the authenticated client, the client will be logged in and connected to the VPN.

• Combining Certificate and Username/Password Authentication: Besides the certificates, OpenVPN also has options for the username and password in the second level of the authentication. This is especially useful when several clients have the same certificate (for example, for the road warriors).

  –

  Users get an account on the VPN server, which has their unique username and password.

  –

  When a client attempts to connect, it sends its certificate, as mentioned above, and the VPN server then asks for a username and password.

  –

  The server compares the given username and password with the client list and the necessary password.

  –

  If the username and password are correct, the client is authorised, and Phase 2 of the VPN connection is initiated.

• Combining Certificate and Username/Password Authentication: In practice, VPN can be configured to require both certificate-based authentication and username/password authentication for enhanced security. This ensures that clients possess the correct certificate and valid credentials to connect to the VPN server. In this, the clients go through both certificate-based authentication and username/password authentication before being granted access to the VPN server.

The server verifies the certificates and then checks the provided username and password against its client credentials database. Only after successful validation are the clients allowed to establish the VPN tunnel with the server. After successful validation of credentials, the IP address has been assigned to the client from a predefined IP pool managed by the VPN server. Each time a client connects, it receives an available IP address from the pool. This approach is more scalable and useful when you have a large number of clients connecting intermittently. If a client disconnects, its assigned IP address becomes available for future connections. This allows efficient use of the address space as clients come and go.

In the second module, After the user connects to the VPN, IEP will act and validate its identity through user login credentials. OTP is sent to the given device through which the device is verified. Afterwards, the device health, OS settings, and person location will be verified. Then, role-based access is granted to that person for organisational resources, as can be seen in Algorithm 2 from lines 1 to 22.

In the SEP module, session time is monitored, and limited time-based access is granted to every user. It is a time-bound session; once the user logs in, the session time is collected from the log’s server, and the counter starts with it. Then, the user profile and activities are also monitored through server logs. Once the user tries to access any organisational resources or tries to access any link, it can be logged and monitored as well, which can be seen in Algorithm ?? and 2 from lines 24 to 49.

This implementation can enhance the overall security and access control of an organisation’s network. In VPN, client credentials are typically validated through a combination of certificate-based authentication and username/password authentication. Let’s explore how this validation process works along with a Diagram:

These are the steps through which we can achieve our goal are described below:

• The user has to put his credentials of the VPN Client, and then it will validate with the server, and then traffic goes to the Internet.
• Then the person can access the Web application; if VPN credentials aren’t validated, then it will not permit access to the Web application.
• Now, the user has to put his credentials in the web app; at this point, the user is validated with a password, and it also receives the OTP on its registered mobile number.
• In the next step, the user device OS, settings, and device health are monitored, and user logs are generated every time it performs any activity.
• There is also access management; the user is restricted to the privileges that are allowed by the admin.

Algorithm 1: Policy Enforcement Point (PEP)

Require:  VPN client, VPN configuration file (.ovpn), credentials (username and password)    1: Module 1: Enforcement Point (EP)    2: Submodule 1: Install VPN Client    3: 1.1 Download the appropriate OpenVPN client for your operating system.    4: 1.2 Follow the installation instructions to install the OpenVPN client on your device.

5:

6: Submodule 2: Obtain OpenVPN Configuration File    7: 2.1 Obtain the .ovpn configuration file from your network administrator or VPN service provider.    8: 2.2 Ensure you have the necessary credentials (username and password), if required.

9:

10: Submodule 3: Configure OpenVPN Client    11: 3.1 Place the .ovpn configuration file in the appropriate directory:    12:    Windows: C:\Program Files\OpenVPN\config\    13: 3.2 If needed, open the .ovpn file in a text editor and modify any settings as per your requirements.

14:

15: Submodule 4: Connect to OpenVPN Server    16: 4.1 Launch the OpenVPN client application.    17: 4.2 Select the appropriate .ovpn configuration file.    18: 4.3 Enter your credentials (username and password) if prompted.    19: 4.4 Click on the Connect button to establish the VPN connection.

20:

21: Submodule 5: Verify the Connection    22: 5.1 Once connected, verify the VPN connection:    23:    5.1.1 Check the OpenVPN client status window for connection details.    24:    5.1.2 Verify your IP address has changed to the VPN server’s IP address using an online service like whatismyip.com.    25:    5.1.3 Ensure you can access network resources that require a VPN connection.

Algorithm 2: ZTNA Policy Enforcement Point (ZPE)

Require:  resources, userRoles, accessPolicies, ztnaConfig   1: Module 2: Identity Enforcement Point (IEP)   2: Submodule 1: Define Access Policies  3: defineResources(resources)  4: defineUserRoles(userRoles)  5: createAccessPolicies(accessPolicies)  6: Submodule 2: Set Up ZTNA Infrastructure  7: selectZTNASolution(ztnaConfig.solution)  8: deployZTNAController(ztnaConfig.controller)  9: installZTNAAgents(ztnaConfig.agents)  10: Submodule 3: Implement Authentication Mechanisms configureAuthentication(ztnaConfig.authMechanisms)  11: Submodule 4: Enforce Zero Trust Principles  12: for user in users do  13:    if authenticate(user, ztnaConfig.auth) then  14:        session = establishZTNASession(user)  15:        if assessAccess(session, ztnaConfig.policies) then  16:            grantAccess(session, user)  17:        else  18:            denyAccess(session, user)  19:        end if  20:    else  21:       denyAccess(user)  22:    end if  23: end for  24: Module 3: Security Enforcement Point (SEP)  25: Submodule 1: Monitoring and Logging  26: setupActivityLogging()  27: enableRealTimeMonitoring()  28: configureAlertsAndReports()  29: Submodule 2: Continuous Improvement  30: while True do  31:    updateZTNASoftware(ztnaConfig)  32:    reviewPolicies(accessPolicies)  33:    conductUserTraining()  34: end while  35: function grantAccess(session, user)  36: function allowAccess(session, user)  37:     allowAccess(session, user)  38: end function  39: function denyAccess(session, user)  40:     blockAccess(session, user)  41: end function  42: function setupActivityLogging()  43:     configureLogging()  44: end function  45: function enableRealTimeMonitoring()  46:     startMonitoring()  47: end function  48: function configureAlertsAndReports()  49:     setupAlerts()  50:     generateReports()  51: end function

3.1. Impliementation Case Study

Enterprises can vary widely in size, structure, and scope, from small businesses to multinational corporations. Within an enterprise, there are various roles that individuals may assume, each with distinct responsibilities and contributions to the organisation’s success. The structure and specific roles can vary depending on the assigned tasks and skills, and giving role-based access and monitoring the activity is the need of the hour right now due to the increasing number of security breach incidents. As network infrastructures become more complex and the threat landscape evolves, traditional security models and perimeter-based approaches are no longer enough to secure delicate data and resources. The emergence of ZTNA has gained attention as a security framework that focuses on substantiating every access request, irrespective of the user’s place or network context. However, there is a need to explore our integration of ZTNA principles with VPNs, which have long been used to secure network communications. The problem lies in understanding how VPNs can be effectively employed to achieve ZTNA, addressing challenges such as trust boundaries, user authentication, access control mechanisms, and data protection. This research aims to investigate the design, implementation, and evaluation of ZTVPN to provide a comprehensive understanding of the potential benefits; through this, how can an organisational network be secure from insider and outside attacks and the limitations of this integration, as well as to propose recommendations for successful deployments.

4. Results and Evaluation

he proposed ZTVPN framework has been evaluated in various enterprise scenarios to assess its effectiveness and advantages over traditional VPNs, ZTNA), and other security solutions. The results demonstrate that ZTVPN offers significant improvements in terms of security, performance, and scalability. When integrating VPN and ZTNA, the result is a comprehensive remote access solution that combines the benefits of both technologies to enhance security and access control. Here’s a discussion regarding the integration:

• Improved Security: VPNs traditionally provide a secure tunnel for remote users to access corporate resources.
• Enhanced User Experience: Integrating VPN and ZTNA allows organisations to strike a balance between security and user experience.
• Scalability and Flexibility: VPNs are typically designed to accommodate a fixed number of concurrent connections, which can be a limitation for organisations with dynamic workforces or fluctuating access demands.
• Granular Access Control: This solutions enable organisations to implement granular access controls based on user roles, device types, and other contextual factors.
• Centralized Management and Visibility: ZTNA solutions often provide centralised management consoles and comprehensive visibility into user access and activity.

Table 4 shows that, the proposed framework, "ZTVPN", remedies all of the problems listed above. ZTVPN allows enterprises to implement robust access controls that consider several contextual aspects, such as device health, identification, and more, through enforcement policy. This greatly decreases the likelihood of illegal access and data breaches. Making sure people have safe access to resources with little hassle. Because of this solution’s inherent scalability and flexibility, enterprises may more readily adjust to changing access needs. With centralised access control, organisations can monitor user activity in both on-premises and remote locations more effectively.

4.1. Discussion and Limitations

The ZTVPN is a complete solution for enterprises as it secures the network as well as organisational resources. The framework combines the strengths of both VPN and ZTNA by integrating certificate-based authentication, username/password authentication, and continuous monitoring of user and device credentials. This multi-layered approach ensures that only authenticated and authorized users can access organizational resources. Unlike traditional VPNs, which grant broad access to the entire network once authenticated, ZTVPN provides granular access control, reducing the attack surface and preventing unauthorized lateral movement within the network. Additionally, the continuous verification of user and device health, operating system settings, and location further enhances security, making it more robust than standalone ZTNA solutions.

The ZTVPN framework addresses common performance issues associated with traditional VPNs, such as latency and throughput. By dynamically selecting the best path for traffic and optimizing network performance, ZTVPN ensures that critical applications receive the necessary bandwidth and low latency. This results in a better user experience and increased productivity. The integration of Software-Defined Wide Area Network (SD-WAN) technology within the ZTVPN framework further enhances performance by providing centralized management and dynamic path selection based on real-time network conditions.

The cloud-native architecture of the ZTVPN framework allows for easy scalability and flexibility. Organizations can quickly adapt to changing business needs and deploy new services without the need for extensive hardware investments. The framework’s ability to integrate with existing security solutions, such as Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Firewall as a Service (FWaaS), ensures comprehensive protection and seamless security transitions. This makes ZTVPN a more scalable and adaptable solution compared to traditional VPNs and standalone ZTNA implementations.

The framework provides a unified approach to access control by combining the principles of Zero Trust with the secure connectivity of VPNs. This ensures that users are granted access based on their identity, role, and context, rather than relying on the traditional perimeter-based security model. The role-based access control and time-bound sessions further enhance security by limiting access to only the necessary resources for a specific duration. This comprehensive access control mechanism is more effective than the broad access granted by traditional VPNs and the application-specific access provided by ZTNA.

5. Conclusion and Future Work

The rapid shift to remote work environments has necessitated the development of robust cybersecurity frameworks to protect organizational resources and ensure seamless operations. This paper has presented a comprehensive overview of contemporary technologies employed in enterprises. Among these, the proposed ZTVPN framework stands out as a highly effective solution for enhancing IT security and privacy in modern enterprises. The ZTVPN framework integrates zero trust principles with VPN technology, addressing critical concerns such as security threats, latency, throughput, and scalability. By continuously verifying every user and device attempting to access corporate resources, ZTVPN ensures a robust security posture, preventing data leaks, managing access permissions, and providing seamless security transitions. The effectiveness of the ZTVPN framework has been demonstrated through various enterprise scenarios, highlighting its potential to fortify cybersecurity frameworks against contemporary cyber threats.

Despite the promising results, there are several areas for future research and development. One potential direction is the exploration of advanced cryptographic techniques to further enhance the security and performance of the ZTVPN framework so it can resist post-quantum cryptography cyberattacks. Additionally, the integration of artificial intelligence can provide real-time threat detection and response capabilities, further strengthening the security posture of enterprises. Another possible future work is the evaluation of the ZTVPN framework in diverse organizational contexts, including small and medium-sized enterprises (SMEs) and large multinational corporations. This would provide valuable insights into the scalability and adaptability of the framework across different environments.