EMEP Security Architecture: Trust Boundaries and Zones

Trust boundaries, principals, secrets management, artifact signing hierarchy, and network zones for EMEP research, enterprise, and air-gap deployments.

EMEP security architecture partitions the platform into trust zones, defines principals, governs secrets, and enforces artifact signing. The signing hierarchy uses root, intermediate, and signing keys. Network zones separate research, enterprise, and air-gap environments. This page includes a trust-boundary flowchart.

Trust Boundary Flowchart

Principals

Principal	Authentication	Authorization Scope
Research User	API key + OIDC	Submit experiments, view results, download artifacts
Enterprise User	SAML 2.0 + MFA	Submit experiments, deploy models, manage signing keys
Offline Operator	Hardware token + PIN	Air-gap operations, key ceremony, manual artifact import
CI Pipeline	Service account JWT	Automated benchmark runs, regression gates
GPU Worker	X.509 worker certificate	Execute jobs, write artifacts, publish events
Evaluation Worker	X.509 worker certificate	Run benchmarks, read datasets, write results

Secrets Management

Secrets are tiered by sensitivity and deployment mode.

Research zone: HashiCorp Vault or cloud KMS. Automatic rotation every 90 days. API keys scoped to experiment-level access.

Enterprise zone: HSM-backed key storage. Manual rotation with audit trail. Signing keys require dual-control.

Air-gap zone: Offline HSM or hardware token. No network-based secret distribution. Key ceremony performed by two offline operators.

Artifact Signing Key Hierarchy

Root key: Generated offline, never touches a network. Stored in tamper-evident HSM. Used only to sign intermediate keys.

Intermediate keys: One per zone (enterprise, research, offline). Stored in zone-appropriate HSM or KMS. Signed by root. Used to sign worker keys.

Signing keys: Per-worker or per-operator. Short-lived, rotated daily. Signed by intermediate. Used to sign artifacts at write time.

Verification: ArtifactStore verifies full chain on every read. Chain anchored to root certificate distributed out-of-band to air-gap deployments.

Network Zones

Research zone: Internet-accessible. Models imported from public hubs. Results published to internal dashboards. Lowest trust boundary.

Enterprise zone: VPC or on-premise. No direct internet from workers. Proxy for model hub access with allowlist. SAML authentication.

Air-gap zone: No network interfaces. Physical media for model import and artifact export. All operations logged to write-once media. Highest trust boundary.

Threat Model Summary

Threat	Mitigation
Artifact tampering in transit	TLS 1.3 + mTLS + artifact signatures
Malicious model import	SHA-256 verification + sandboxed loader
Worker compromise	Short-lived signing keys + least-privilege scopes
Key exfiltration	HSM non-exportable keys + dual-control for root
Supply chain injection	Dependency lockfiles + reproducible builds + SBOM

Traceability Footer

Spec Reference	Phase
Model Supply Chain	Phase 2
Artifact Signing	Phase 2
Offline Security	Phase 3
Security Requirements	Phase 1