10 — Security Architecture

Defense in depth across four boundaries: edge, control plane, media plane, and data at rest. Every hop is authenticated and encrypted; every credential is short-lived; every privileged action is audited.

1. JWT Authentication

• Access tokens: 15-minute JWTs signed EdDSA (Ed25519; RS256 fallback for SDK ecosystems that need it). Claims: sub (user), tid (tenant), role, iat/exp/jti. Verified locally by every service against JWKS — no introspection round-trips; revocation latency is bounded by the 15-min lifetime, acceptable because privileged actions re-check DB state.
• Refresh tokens: opaque 256-bit random, stored hashed (SHA-256), 30-day sliding expiry, single-use rotation with family tracking — presenting an already-consumed refresh token revokes the entire family and raises auth.refresh.reuse_detected (stolen-token signal).
• Key rotation: new kid published to JWKS ≥ 1 h before use; old key verifies until all issued tokens expire. Private keys live only in the secret manager; services fetch JWKS, never private material.
• Scoped sub-tokens: the join flow deliberately exchanges the identity JWT for narrower credentials — a one-time WS ticket (30 s), a room-scoped media token (10 min), and TURN credentials (10 min). A leaked artifact from any later stage grants the minimum possible capability for the minimum time.

2. Transport Encryption

Path	Protection
Client ↔ Gateway (REST)	TLS 1.3 (1.2 floor), HSTS
Client ↔ Signaling (WS)	WSS (TLS 1.3)
Client ↔ SFU (media)	DTLS 1.2+ handshake → SRTP (AES-GCM) via DTLS-SRTP key export
Client ↔ Coturn	TURN over UDP/TCP; turns: (TLS:5349) for restrictive networks — note TURN encrypts nothing itself; the payload it relays is already SRTP
Service ↔ service	mTLS (mesh-issued identities), NetworkPolicy default-deny
Services ↔ data stores	TLS + per-service credentials, least-privilege DB roles

DTLS ↔ signaling binding: certificate fingerprints exchanged in SDP over the authenticated WSS channel must match the DTLS handshake certificates — a man-in-the-middle on the media path cannot succeed without first compromising signaling auth.

SRTP properties: confidentiality (AES-GCM), per-packet integrity/auth tags, and replay protection via the SRTP sliding replay window (duplicate/late injected packets are discarded) — this is the media-plane replay defense; the API-plane equivalents are jti uniqueness on sensitive flows, single-use tickets, and idempotency keys.

3. TURN Authentication (Coturn)

• Ephemeral credentials only (use-auth-secret): username = expiry:user_id, password = HMAC-SHA1(secret, username), TTL 10 min. No credential database on Coturn; validation is offline against the shared secret (rotated via dual-secret overlap, distributed through the secret manager).
• No static TURN users; no-cli, no-loopback-peers, denied-peer-ip for RFC1918/link-local (blocks using our relays to probe internal networks), per-user total-quota and bandwidth caps, stale-nonce on.
• Relay abuse (open-relay scanning, quota exhaustion) is surfaced by TURN-mgmt usage metrics → automated per-user issuance blocks.

4. WebSocket Authentication

One-time 30 s ticket (from the authenticated join call) redeemed atomically in Redis at upgrade time — tokens never appear in URLs that reach logs with long-lived validity; the socket is then bound server-side to {user, room, session} and every subsequent frame is authorized against that binding (no per-message tokens). Origin checks + gateway-level per-IP connection caps precede the upgrade.

5. Rate Limiting & Abuse Control

Layered: (1) edge/CDN L3-4 volumetric absorption; (2) gateway per-IP, per-user, per-tenant sliding windows (Redis) — strict on login (5/min/IP, + exponential lockout & credential-stuffing detection on auth.login.failed streams) and join (10/min/user); (3) service-level guards (room caps, per-user concurrent-session caps, WS message-rate caps with 4400 on abuse); (4) TURN quotas per credential. All limits return 429 + Retry-After and emit metrics for tuning.

6. DDoS Mitigation

• Control plane: anycast edge + cloud DDoS protection (volumetric), TLS termination at scale at the LB, gateway rate limits as the application-layer backstop, autoscaling absorbs what filtering misses.
• Media plane: SFU/coturn are the exposed UDP surface. Coturn only allocates for HMAC-valid requests (cheap rejection); SFU only processes packets on negotiated 5-tuples with valid ICE consent (stun consent freshness, RFC 7675) and drops everything else at line rate; per-node connection/bandwidth ceilings prevent single-node saturation; regional fleets shrink blast radius.
• Signaling: SYN/connection-rate protection at NLB; per-IP concurrent-socket caps; auth-before-work (ticket check precedes any allocation).

7. Secrets, Data & Platform Hygiene

• Secrets in cloud secret manager, synced via External Secrets, rotated (TURN secret 24 h dual-window, DB creds 90 d, JWT keys 90 d); nothing in git/images/env-dumps.
• PII minimization: audio is never persisted unless recording is explicitly enabled (tenant + room-level consent flags, participants notified in-protocol); recordings encrypted at rest (per-tenant keys), retention-limited.
• Passwords argon2id; DB encryption at rest; per-service least-privilege DB roles (auth cannot read rooms, etc.).
• Audit: moderation_actions, auth-events, admin API calls — immutable, retained 1 y.
• Supply chain: pinned base images, image signing + admission policy, dependency scanning, SBOM per release.
• Container posture: non-root, read-only rootfs, seccomp default, no privileged pods (SFU needs hostNetwork only — capabilities still dropped).

8. Threat Model Summary (top risks → primary control)

Threat	Control
Token theft / replay	15-min access TTL, refresh rotation + reuse detection, one-time tickets, jti
Unauthorized room entry / eavesdropping	room ACL at join + SFU-validated media token; SRTP end-to-SFU; fingerprint binding
Ghost publisher (muted user publishing)	grants enforced at SFU, not client UI
TURN relay abuse (free bandwidth / internal probing)	ephemeral HMAC creds, quotas, denied-peer-ip
Credential stuffing	per-IP limits, lockouts, anomaly events
Media-plane packet floods	ICE consent checks, 5-tuple filtering, node ceilings, regional isolation
Insider / lateral movement	mTLS + default-deny NetworkPolicies + least-privilege data roles