零信任安全网关实现机制研究  

Research on the Implementation Mechanism of Zero Trust Security Gateway

作　　者：颜光伟 何智 刘扬 陈勃翰 尚松超 YAN Guangwei;HE Zhi;LIU Yang;CHEN Bohan;SHANG Songchao(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2024年第12期1324-1330,共7页Communications Technology

摘　　要：为了达到安全网关到零信任网关的转变,在现有安全网关的基础上,提出了一种基于零信任三大核心要素SIM中的“S”即软件定义边界(Software Defined Perimeter,SDP)和“M”即微隔离(Micro-Segmentation,MSG)的实现方案。在对应用和用户访问透明的情况下,达到零信任所需的服务隐藏、东西向网络流量控制和更多的应用场景支持的目的。该方案已经在实际项目中应用验证,具有较强的兼容性和普适性。In order to achieve the transformation from a security gateway to a zero trust gateway,a solution based on the three core elements of zero trust SIM,namely“S”(SDP:Software Defined Perimeter)and“M”(MSG:Micro-Segmentation),is proposed on the basic of the existing security gateway.The solution achieves the service hiding,east-west network traffic controlling,and more application scenarios supporting required for zero trust,while being transparent to applications and user access.This scheme has been applied and validated in practical projects and has strong compatibility and universality.

关 键 词：安全网关 零信任 软件定义边界 微隔离 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]