基于模型的零信任网络安全架构  

Model-based Zero-trust Architecture of Cyber Security

作　　者：蒋宁 范纯龙 张睿航 尹震宇[3] 丁国辉 JIANG Ning;FAN Chun-long;ZHANG Rui-hang;YIN Zhen-yun;DING Guo-hui(School of Computer,Shenyang Aerospace University,Shenyang 110136,China;School of Software,Shenyang Normal University,Shenyang 110034,China;Shenyang Institute of Computing Technology Co.Ltd.,Chinese Academy of Sciences,Shenyang 110168,China)

机构地区：[1]沈阳航空航天大学计算机学院,沈阳110136 [2]沈阳师范大学软件学院,沈阳110034 [3]中国科学院沈阳计算技术研究所有限公司,沈阳110168

出　　处：《小型微型计算机系统》2023年第8期1819-1826,共8页Journal of Chinese Computer Systems

基　　金：辽宁省教育厅青年科技人才"育苗"项目(JYT2020112)资助;沈阳市中青年科技创新人才支持计划项目(RC200576)资助。

摘　　要：为了设计信息物理系统中的安全架构,遵循基于模型的系统工程(Model-Based Systems Engineering,MBSE)的方法学,提出了一种基于模型的零信任网络安全架构.网络安全架构的总体策略采用纵深防御,系统划分不同安全域并采取不同的保护措施,在此基础上,零信任(Zero Trust)对纵深防御策略进行强化,采用微网段方法实施细粒度的安全域,采用基于属性的访问控制方法实施细粒度的访问控制.将基于模型的零信任网络安全架构应用到边界安全域,开发了基于系统建模语言(System Modeling Language,SysML)的模型.基于模型的零信任网络安全架构具有流程可迭代、需求可追溯、安全域细粒度、访问控制动态性的特点.In order to design the security architecture in cyber-physical systems,a model-based zero-trust architecture of cyber security was proposed following the methodology of Model-Based Systems Engineering(MBSE).Overall strategy of the security architecture was defense in depth,in which different security zones were divided and different protection measures were taken in security zones.Further,defense-in-depth strategy was strengthened by zero trust.Fine-grained security zone was realized by using micro-segmenta-tion,and fine-grained access control was realized by using attribute-based access control.The model-based zero-trust architecture of cy-ber security was applied to the boundary security zone,in which model based on System Modeling Language(SysML)was developed.Iterative process,traceable requirements,fine-grained security zone,and dynamic access control could be achieved in the model-based zero-trust architecture of cyber security.

关 键 词：基于模型的系统工程 纵深防御 零信任 微网段 基于属性的访问控制 系统建模语言 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]