AWS and Keyfactor Unveil AI Agent Identity Security Architecture Using X.509 PKI to Secure Multi-Agent Systems

Summary:AWS and Keyfactor have jointly released a reference architecture for securing AI agent communications using X.509 PKI. This solution addresses critical identity and security challenges in multi-agent systems by implementing four complementary mechanisms: signed request envelopes, user-signed delegation assertions, RFC 8693 audience-scoped tokens, and real-time OCSP revocation. The architecture leverages Amazon Bedrock for LLM inference and integrates with the AWS Strands Agents SDK to ensure sec

---

Core Architecture and Mechanisms

The AI agent identity security architecture jointly released by AWS and Keyfactor employs four core mechanisms to ensure the security of multi-agent systems:

1. Signed Request Envelopes:

   • Every inter-agent communication is encapsulated in a signed envelope using the RSA-PSS-SHA256 algorithm to ensure the integrity and authenticity of the request.
   • The receiving agent performs six validation checks before processing the request, including signature verification, timestamp freshness, nonce uniqueness, CA chain validation, role authorization, and OCSP revocation checking.

2. User-Signed Delegation Assertions:

   • Users generate an RSA key pair locally and sign a delegation assertion that lists the SHA-256 fingerprints of the authorized agents, the user's subject name, issuance time, and expiry.
   • This mechanism ensures that agents can prove they are authorized to act on the user's behalf without holding the user's private key or full-session token.

3. RFC 8693 Audience-Scoped Tokens:

   • Tokens generated through the RFC 8693 token exchange protocol are valid only for specific services (e.g., the MCP server). Even if the token is leaked, it can only be used for authorized operations within the specified scope.

4. Real-Time OCSP Revocation Checking:

   • Each request includes an OCSP real-time revocation check to ensure that any revoked certificate is immediately invalidated, preventing misuse.

Engineering Trade-offs and Performance

• Security vs. Performance: While signed envelopes and OCSP checks introduce additional communication overhead, caching mechanisms and parallel processing optimizations keep the overall latency within acceptable limits.
• Key Management Complexity: The local generation and separate storage of user and agent keys enhance security but increase the complexity of key management. Integration with AWS Secrets Manager simplifies this process.
• Scalability: The architecture supports horizontal scaling, with EJBCA's OCSP responder deployable in a high-availability mode, and the ReplayCache backed by Amazon ElastiCache to meet the needs of large-scale deployments.

Developer Onboarding and Deployment Recommendations

1. Environment Setup: Ensure access to an AWS account and install and configure Keycloak 26.2 or later, as well as Keyfactor EJBCA Enterprise.
2. Key and Certificate Management: Use AWS Secrets Manager to securely store PKCS12 key bundles, tokens, and metadata.
3. Integration and Testing: Utilize the AWS Strands Agents SDK and integrate with Amazon Bedrock to test the communication flow between agents, ensuring all security mechanisms function correctly.
4. Scaling and Optimization: Extend the architecture by adding new agent types or deploying multi-tenant isolation mechanisms, and consider using AWS CloudHSM or Hardware Security Modules (HSM) to enhance key management security.

Conclusion

This architecture provides robust security for AI agent communications, addressing critical identity and authorization challenges in multi-agent systems. Its framework-agnostic nature makes it applicable to any multi-agent framework that uses tool protocols, such as LangChain, CrewAI, and AutoGen, offering a valuable reference for the secure deployment of AI technologies in real-world applications.

---

Source: AWS Machine Learning Blog (2026-10-20)

— END —

Tags: #AWS Follow #Keyfactor Follow #AI Security Follow #X.509 PKI Follow #Multi-Agent Systems Follow