基于软件定义边界的零信任匿名访问方案  

Zero Trust Anonymous Access Scheme Based on Software-defined Perimeters

作　　者：李惟贤 张建辉 曾俊杰 贾洪勇 门蕊蕊 LI Weixian;ZHANG Jianhui;ZENG Junjie;JIA Hongyong;MEN Ruirui(School of Cyber Science and Engineering,Zhengzhou University,Zhengzhou 450000,China;Songshan Laboratory,Zhengzhou 450000,China)

机构地区：[1]郑州大学网络空间安全学院,郑州450000 [2]嵩山实验室,郑州450000

出　　处：《计算机科学》2024年第12期293-302,共10页Computer Science

基　　金：河南省重大科技专项(221100210900-01);2021年中国高校产学研创新基金(2021ITA11021)。

摘　　要：软件定义边界作为一种具有良好可扩展性与安全性的零信任安全架构得到了广泛应用。标准的软件定义边界架构采用单包授权机制来实现对服务资源的隐藏与对访问者身份的验证,但现有的方案普遍采用集中式的方式存储与分发SPA密钥,且缺乏对访问者隐私信息的保护。针对以上问题,提出了一种软件定义边界架构下的零信任匿名访问方案,采用三方密钥协商实现SPA密钥的分发,并使用通用指定验证者签名实现了对访问者身份的匿名认证,且能够抵抗SPA密钥窃取、敲门放大攻击、身份假冒等网络攻击,与目前的软件定义边界方案相比具有更强的安全性。实验结果表明,所提方案降低了33%的通信开销,在多节点网络环境下降低了20%的平均认证时延。Software-defined perimeters,as a highly scalable and secure zero-trust security architecture,have gained widespread adoption.Conventional software-defined perimeter(SDP)architectures employ a single packet authorization mechanism to achieve resource hiding and visitor identity validation.However,existing solutions often store and distribute SDP keys in a centralized manner,and lack of robust protection for visitor privacy.In response to the aforementioned challenges,a zero-trust anonymous access scheme within the software-defined perimeter architecture is proposed.This scheme utilizes a three-party key agreement for SDP key distribution and employs generalized designated verifier signatures for anonymous visitor identity authentication.More-over,it demonstrates resilience against network attacks such as SPA key theft,port knocking amplification attacks,and identity spoofing,thus exhibiting enhanced security compared to existing software-defined perimeter schemes.Experimental findings reveal a reduction of 33%in communication overhead and a 20%decrease in average authentication latency within multi-node network environments.

关 键 词：零信任 软件定义边界 单包授权 三方密钥协商 通用指定验证者签名 匿名访问 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]