零信任体系技术研究  

Research on Zero-Trust System Technology

作　　者：余海[1] 郭庆[1] 房利国[1] YU Hai;GUO Qing;FANG Li-guo(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2020年第8期2027-2034,共8页Communications Technology

摘　　要：零信任是网络安全中一种不断发展的技术,它将网络安全防御从静态、基于网络边界的防护转移到关注用户、资产和资源保护。零信任体系采用零信任技术来建设企业基础设施和规划企业工作流程。零信任假定企业资产或用户不存在基于物理和网络位置的隐式信任。用户、设备的身份验证和授权操作是在与企业资源建立会话之前执行的不连续功能。零信任是对企业网络安全发展趋势的一种积极响应,它关注于用户的资源保护,而不是用户的网段保护,网络位置不再被视为资源安全状态的主要因素。美国国家标准与技术研究院给出了零信任和零信任体系的定义、遵循的原则,介绍了零信任体系的逻辑组件和处理方法的变化,分析了零信任体系的安全威胁,可以为我国广大企事业单位内部网络的升级改造提供参考,为我国网络安全事业发展提供支撑。Zero Trust is a developing technology in network security.It transfers network security defenses from static,network boundary-based protection to focusing on user,asset,and resource protection.Zero trust system uses zero trust technology to build enterprise infrastructure and plan enterprise workflow.Zero trust assumes that enterprise assets or user do not have implicit trust based on physical and network location.User and device authentication and authorization operations are discontinuous functions performed before establishing a session with enterprise resources.Zero trust is a positive response to the development trend of enterprise network security.It focuses on the protection of users’assets rather than the protection of users’network segments.Network location is no longer regarded as the main factor of asset security status.National Institute of Standards and Technology of the United States gives the definition and principles of zero-trust and zero-trust system,introduces the logical components and processing method of zero-trust system,and analyzes the security threats of zero-trust system.This can provide reference for the upgrading and transformation of the internal network of Chinese enterprises and institutions,and provide support for the development of China’s network security.

关 键 词：零信任 零信任架构 网络安全 企业 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]