ScholarShield: Zero Trust Security Architecture for Academic Document Repositories and AI Pipelines

Abstract

Modern academic document repositories and automated AI processing pipelines handle sensitive intellectual property, unreleased research findings, and peer-review artifacts. However, traditional perimeter-based security mechanisms fail to defend against internal credential compromise, indirect prompt-injection threats, malware uploads, and data tampering. This paper presents ScholarShield, an end-to-end Zero Trust Security Architecture specifically designed for academic document repositories and AI pipelines. ScholarShield implements a strict "Never Trust, Always Verify" paradigm across identity verification, upload processing, at-rest storage, and auditability. The proposed system features: (1) RS256 JWT & RBAC Authentication aligned with Keycloak OpenID Connect (OIDC) standards; (2) A Dual-Layer Secure Upload Gateway combining ClamAV INSTREAM malware scanning with compiled YARA AST rule matching to reject infected files and prompt-injection payloads prior to ingestion; (3) Authenticated Encryption at Rest (AES-256-GCM) coupled with RSA-PSS Digital Signatures for tamper-evident document provenance; and (4) An Append-Only Tamper-Evident Security Audit Log. Empirical benchmarking on document payloads ranging from 1 MB to 100 MB demonstrates that AES-256-GCM encryption maintains a high throughput of 193.06 MB/s, RSA-PSS digital signatures complete in 43.79 ms, and YARA AST threat inspection incurs minimal overhead. Security verification confirms 100% mitigation against OWASP Top 10 vulnerabilities (including A01 Broken Access Control, A02 Cryptographic Failures, and A03 Injection).