In CyberNEMO, we’re building a Zero Trust Network Access (ZTNA) solution where every decision is backed by verifiable evidence. Beyond authenticating users and devices, we also need to ensure that the network paths packets take can be trusted. That’s where the Proof of Transit (PoT) component comes in.

What is the Proof of Transit (PoT)?

PoT, is a path verification mechanism. Its purpose is to guarantee that a packet has followed a predetermined route through specific nodes, providing security, traceability, and regulatory compliance.

This capability is essential in environments such as:

• Service Function Chaining (SFC) with NFV

• 5G and beyond network architectures

• Critical infrastructure where packet order and integrity must be preserved

PoT ensures that packets not only arrive at their destination but also travel through the expected, authorized sequence of nodes.

How it Works?

The IETF PoT draft defines two main approaches, both based on Shamir Secret Sharing (SSS):

1.Polynomial-based distribution:

• A polynomial of degree n–1 (where n is the number of nodes) is generated.

• Each node receives a point on the polynomial, used to verify its participation in the path.

2.Enhanced entropy with a public polynomial:

• An additional polynomial (with no constant term) is introduced.

• This is combined with a random value (RND) at the ingress node, creating a cumulative value (CML).

• The value travels across all nodes, and the final node verifies it against the expected result, ensuring no tampering occurred.

Ordered Proof of Transit (OPoT)

PoT has naturally evolved into OPoT (Ordered Proof of Transit), which not only validates the nodes traversed but also guarantees the correct sequential order. This prevents reordering attacks and is particularly critical in Real-time, sequence- sensitive systems.

OPoT achieves this by using symmetric masks shared between contiguous nodes,
ensuring both authenticity and ordering of packets.

Why this matters for ZTNA

ZTNA is about “never trust, always verify.” Proof of Transit extends this principle to the network fabric itself. By integrating PoT and OPoT into CyberNEMO, we:

• Ensure packets take only the approved, policy-compliant paths

• Detect tampering, misrouting, or reordering of traffic

• Provide strong traceability and auditability of packet flows

• Meet compliance and regulatory requirements for sensitive environments

In other words, PoT brings verifiable trust to packet transit, strengthening the Zero Trust foundation of CyberNEMO.

In CyberNEMO, we’re building a Zero Trust Network Access (ZTNA) solution where every access decision is based on verifiable evidence. One of the core building blocks of this architecture is the Notary component, powered by our Transparent Notary Service (TNS).

What is the Transparent Notary Service (TNS)?

The TNS is essentially a digital notary for network evidence. Its job isn’t to decide whether a piece of evidence is good or bad, but to make sure that once evidence is registered, it stays immutable, timestamped, and cryptographically verifiable.

The TNS uses a lightweight append-only ledger. Each signed statement (such as a configuration attestation, event log, or policy proof) is stored in an immutable data structure like a Merkle tree. This allows anyone to verify inclusion and consistency without having to trust the notary itself.

How it works

1. Issuers sign statements using IETF’s COSE (CBOR Object Signing and Encryption) with algorithms like ECDSA or EdDSA.
2. The Notary logs the statement, storing it in the append-only ledger.
3. A receipt is generated that acts as proof of inclusion
4. A Transparent Statement is generated including the original statement along with its receipt
5. Relying parties can verify the statement’s authenticity and timestamp independently using the TNS public key

This design ensures that if someone tries to tamper with evidence or hide a log entry, it becomes immediately detectable.

Why this matters for ZTNA

ZTNA is all about “never trust, always verify.” But verification needs to be trustworthy too. By introducing a tamper-evident, verifiable notary into CyberNEMO, we:

• Create strong audit trails for security events.

• Improve accountability and compliance by preserving evidence.

• Allow independent verification of access decisions without centralizing trust.

In other words, the Notary helps make our Zero Trust architecture provably trustworthy.

Zero Trust Principles in CyberNEMO: Building security by Design

Zero Trust has become one of the most important paradigms in modern cybersecurity. At its core, Zero Trust means no implicit trust; everything must be verified, every time. Every user, device, application, and service must prove its legitimacy before gaining access to resources, regardless of whether it’s inside or outside the corporate network.

In CyberNEMO, we’ve embraced these principles as the foundation of our ZTNA (Zero Trust Network Access) solution. The goal is to reduce the attack surface, prevent lateral movement, and enforce consistent security controls across all environments.

Zero Trust Principles

In CyberNEMO, we use the following Zero Trust principles as our architectural baseline:

• Identity verification and strong authentication to ensure that only legitimate users and devices gain access.

• Least privilege access enforcement, granting the minimum level of permissions necessary to perform specific tasks.

• Micro-segmentation of networks and services to prevent unauthorized movement within the system.

• Continuous monitoring and risk assessment to adapt dynamically to evolving threats and anomalies.

• Data-centric security to protect sensitive information wherever it resides or travels.

How CyberNEMO implements them

Cybernemo’s ZTNA solution was built with these ideas from day one:

• Micro-Segmentation with L2S-M: Built on the NEMO-developed Link-Layer Secure connectivity for Microservice platforms, L2S-M provides secure, dynamic segmentation across multi-cluster environments, overcoming the limitations of conventional network segmentation solutions.

• Advanced Metrics & Telemetry: Using the ALTO protocol, combined with insights from BGP-LS, SDN controllers, and inventory systems, CyberNEMO ZTNA exposes abstract, real-time network metrics. These insights enable orchestration and deployment decisions that are aware of current network conditions and can react adaptively.

• Secure and Verifiable Data Plane: Proof of Transit (PoT) is incorporated to validate packet flow integrity and sequence, providing traceability, regulatory compliance, and resilience against routing attacks or traffic manipulation.

• Identity & Evidence Management: CyberNEMO adopts Distributed Ledger Technologies (DLTs) to ensure immutable, auditable records of access and configuration events.

  1) The Distributed Identity Manager (DID Manager) issues and validates decentralized, verifiable credentials, enabling federated identity management.

  2) The Transparent Notary Service (TNS) acts as a cryptographic notary for signed statements, preserving their integrity, timestamp, and origin authenticity. This allows any party to independently verify security events, configuration attestations, and policy decisions without having to trust the notary itself — enhancing accountability and auditability.

• Policy Enforcement & Anomaly Detection: Network policies are enforced dynamically, while real-time anomaly detection mechanisms help mitigate threats as they emerge.

From Principles to Practice

Zero Trust is more than a security concept, it represents a fundamental shift in how networks are designed and operated. By embedding these principles directly into its architecture, CyberNEMO delivers a verifiable, adaptive, and resilient ZTNA solution for modern distributed environments.

With strong identity management, cryptographic evidence, micro-segmentation, and continuous monitoring, CyberNEMO provides not just access control but confidence in every access decision.

In short, CyberNEMO transforms Zero Trust from a guiding principle into a practical, measurable, and future-ready security architecture, enabling secure connectivity, prevent lateral movement, and build a trustworthy foundation for critical communications.