cid 44e18845bbdf2f2e25da6a59b964ce787572dd43ad8c7e027c130626da22d7c2 · original · via openalex
Title: SPIFFE-Based Zero-Trust Authentication for AI Agent Ecosystems Authors: Karthik Pappu; Badal Bhushan; Akshay Mittal Venue: International Conference on Computer and Applications (ICCA) Year: 2025 Canonical: doi:10.1109/icca66035.2025.11431026 URL: https://doi.org/10.1109/icca66035.2025.11431026 Collector: openalex OA: false ABSTRACT AI agent ecosystems commonly rely on API key-based authentication, which introduces security risks related to credential exposure, manual rotation procedures, and weak guarantees of workload identity. This paper presents a SPIFFE (Secure Production Identity Framework for Everyone) based approach to AI multi-agent orchestration, providing a zero-trust authentication framework that eliminates static API keys for inter-agent communication through certificate-based workload identity. We implement a multi-agent security pipeline on Kubernetes, where each of five agents receives short-lived X.509 SVIDs (one-hour TTL) automatically issued and rotated by SPIRE at 50% lifetime intervals. All inter-agent communication is authenticated through mutual TLS using verifiable SPIFFE identities, mitigating credential theft, workload impersonation, man-in-the-middle attacks, and unauthorized LLM access. Experimental evaluation demonstrates zero authentication failures during continuous certificate rotation while maintaining end-to-end cryptographic verification. The findings establish that SPIFFE-based workload identity provides a practical and secure alternative to API keys for AI agent frameworks, reducing attack surface through automatic credential lifecycle management and enabling fine-grained identity-based authorization.