Zero Trust Sentinel

Zero-Trust Sentinel is a physical access control engine that integrates Ring event triggers, Alexa+ MCP agents, and Microsoft Entra ID conditional access controls to evaluate site security requests.

Comment

Inspiration

Modern smart homes rely on video doorbells and smart locks, but traditional physical access controls rely on static, binary rules without contextual identity checks. I built Zero-Trust Sentinel to bridge consumer IoT (Ring), conversational AI agents (Alexa+), and enterprise Zero Trust security (Microsoft Entra ID). My goal was to bring "Never Trust, Always Verify" to physical doorways by cryptographically verifying payload integrity, mitigating rate-based denial-of-service attacks, evaluating Role-Based Access Control (RBAC) permissions, and providing dynamic voice feedback via an Alexa+ Model Context Protocol (MCP) tool schema.

What it does

Zero-Trust Sentinel acts as an intelligent, security-first gatekeeper between a Ring video doorbell trigger and an Alexa+ voice agent: Captures the Ring Trigger: A user requests access at a door or server room zone (e.g., Server_Room_Alpha). Verifies Integrity ([S1]): It checks the payload's HMAC-SHA256 signature to guarantee that the request wasn't tampered with or spoofed by an attacker. Buffers High Traffic ([D1]): It places the request into a thread-safe queue to rate-limit incoming traffic and protect the system from Denial-of-Service (DoS) floods. Enforces Zero Trust Permissions ([E1]): It looks up the user's role against the required permissions for that specific zone to evaluate if access should be granted or denied. Delivers Voice & MCP Output ([R1]): It formats the decision into an Model Context Protocol (MCP) tool response for Alexa+ and triggers text-to-speech to announce the access decision aloud ("Access granted..." or "Access denied...").

How we built it

I developed Zero-Trust Sentinel as a modular Java backend (JDK 25 / Apache Maven) using a decoupled security processing pipeline:

[ Ring Device Event ] │ ▼

  1. Cryptographic HMAC Verification [S1] │ ▼
  2. Thread-Safe Bounded Queue [D1] │ ▼
  3. Zero Trust RBAC Policy Engine [E1] │ ▼
  4. Alexa+ MCP Agent Response & Audio TTS [R1]

Challenges we ran into

Non-Blocking Audio Output: Running native text-to-speech without freezing the main execution thread. I solved this by launching PowerShell speech synthesizer scripts inside decoupled daemon threads.

Accomplishments that we're proud of

End-to-End Amazon & Zero Trust Integration: Successfully connected Ring device event triggers, an Alexa+ Model Context Protocol (MCP) agent framework, and Microsoft Entra ID conditional access policies into a unified, high-performance Java backend.

What we learned

Model Context Protocol (MCP) Design: Structuring strict JSON-RPC tool contracts ensures Alexa+ accurately extracts parameters (event_id, user_id, requested_zone) from natural voice inputs.

What's next for Zero Trust Sentinel

Framing in-memory limitations as a Future Roadmap shows judges and recruiters that you understand production architecture beyond a hackathon proof-of-concept.

  1. Persistent Database & Immutable Audit Ledger PostgreSQL / Amazon DynamoDB Integration: Replace in-memory Java maps with a persistent database to manage dynamic user claims, door policy rule updates, and access logs.

Tamper-Evident Audit Storage: Store audit decision logs in an append-only ledger (e.g., AWS QLDB) or cryptographic hash-chain table to prevent insider tampering or log deletion.

  1. Live Cloud Identity Integration (Microsoft Graph API) Real Entra ID Synchronization: Replace simulated identity maps with live OAuth 2.0 / OIDC JWT token validation via Microsoft Graph API, enabling real-time group membership queries and revoked credential checks.

Adaptive Risk Scoring: Integrate conditional access policies that evaluate risk signals (e.g., unusual time of day, duplicate badge scans in different locations) before returning an ALLOW decision.

  1. Production Hardware & Real-Time Event Streams Physical Relay & Smart Lock Control: Connect the policy output to physical GPIO pins on a Raspberry Pi or a smart lock API (e.g., Z-Wave/Zigbee door strikes) to trigger real physical unlocks.

Webhook & MQTT Integration: Replace local CLI polling with an async event broker (AWS EventBridge or RabbitMQ) to listen for live Ring device webhooks over HTTPS.

  1. Step-Up Multi-Factor Authentication (MFA) Interactive Push Notifications: If a user attempts access to high-security zones (e.g., Server_Room_Alpha), trigger a step-up push notification prompt to their mobile device (via Microsoft Authenticator or Duo) before sending the final unlock signal to Alexa+.

  2. Serverless & Containerized Cloud Deployment Docker & Kubernetes Deployment: Package the Java backend into a lightweight Docker container for deployment on AWS ECS or Azure Kubernetes Service (AKS).

AWS Lambda Migration: Refactor the AlexaMcpHandler into serverless AWS Lambda functions triggered directly by Amazon Alexa Skill APIs for near-zero idle compute costs.

Built With

Share this project:

Updates

Submission history