零信任体系架构的可跨域连续身份认证  

Cross-domain Continuous Identity Authentication of Zero Trust Architecture

作　　者：李益发 孔雪曼 耿宇[1] 薛梦阳 陈铎 LI Yifa;KONG Xueman;GENG Yu;XUE Mengyang;CHEN Duo(School of Cyber Science and Engineering,Zhengzhou University,Zhengzhou 450002,China)

机构地区：[1]郑州大学网络空间安全学院,河南郑州450002

出　　处：《郑州大学学报（理学版）》2024年第4期41-47,共7页Journal of Zhengzhou University:Natural Science Edition

基　　金：保密通信重点实验室基金项目(61421030107012102)。

摘　　要：连续身份认证是零信任架构的核心,旨在确保通信和资源访问的安全性。传统身份认证方案存在一系列问题,比如依赖可信第三方、普适性差、中心化管理、高成本、低效率和缺乏隐私保护等。为了满足当前网络发展的需求,遵循“永不信任,始终验证”的零信任原则,提出了一种可跨域连续身份认证方案,利用统一多域标识和信道状态信息实现轻量级的连续认证和可跨域认证。通过安全协议分析本征逻辑方法对所提方案进行了正式分析,证明了其安全性,并展示了在零信任应用场景中的强大潜力。As the core of zero-trust architecture,continuous identity authentication aimed at ensuring the security of communication and resource access.There were series of problems with by traditional identity authentication schemes,such as reliance on trusted third parties,poor universality,centralized management,high costs,low efficiency,and lack of privacy protection.To meet the needs of current network development,a lightweight cross-domain continuous identity authentication scheme was proposed,with the principle of"never trust,always verify"of zero-trust.It utilizeal unified multi-domain identities and channel status information to achieve continuous and cross-domain authentication.The security of this scheme was formally analyzed through a secure protocol analysis intrinsic logic method.Results proved its security and its strong potential in zero-trust application scenarios.

关 键 词：连续身份认证 零信任 跨域认证 统一多域标识 信道状态信息 

分 类 号：TN918[电子电信—通信与信息系统]