Service identities are crucial for authentication and access control, ensuring that only authorized services access specific resources. The SPIFFE framework addresses workload identity management and authentication effectively but needs support for solutions (e.g., extensible tokens) that fine-granular authorization mechanisms in distributed scenarios can use. In this context, we present the Lightweight SVID (LSVID), an identity document in JSON format that can be extended and used as a token. As an extensible token, LSVID enables features such as delegation, attenuation, and traceability, enhancing their flexibility and applicability. Our approach provides efficient handling of token extensions and validations, demonstrated through a proof-of-concept implemented in Go. Baseline results indicate that LSVID critical operations are efficient, with processing times in the microsecond range, offering significant functional advantages over the traditional JWT-SVIDs, one of two key security documents from SPIFFE.
Lightweight SPIFFE Verifiable Identity Documents (LSVIDs): a Nested Token Approach for Enhanced Security and Flexibility in SPIFFE