关键词: 零信任, 数据保护, 安全框架, 国密算法, 可信计算

Abstract:

In order to address the failure of boundary protection measures caused by the evolution with complexity， dynamics and fragmentation of network architecture， and to cope with the challenge for network data security caused by the continuous emergence of vulnerabilities in non-autonomous controllable systems， software， hardware and cryptographic algorithms， the following tasks were performed. Firstly， a zero trust network architecture implementation model was designed on the basis of zero trust concept. Secondly， a zero trust network security protection framework was proposed， which integrated concept of zero trust security， Chinese cryptographic algorithm system， and trusted computing technology in links such as identity management and authentication， authorization and access， data processing and transmission， framework processes such as Chinese cryptographic certificate application and issuance， business data secure processing and transmission were designed， and functional components such as identity and access management module， terminal trusted network access proxy device were designed and implemented. Finally， a network platform based on the security protection framework was built， which provided new frameworks， technologies and tools for network data security protection and zero trust security practices. Security analysis and performance test results show that with the proposed platform， the signing and signature verification performance of the SM2 reaches 1 118.72 and 441.43 times per second respectively， the encryption and decryption performance of SM4 reaches 10.05 MB/s and 9.96 MB/s respectively， and the secure data access/response performance reaches 7.23 MB/s， demonstrating that the proposed framework can provide stable support for data security.

Key words: zero trust, data protection, security framework, Chinese cryptographic algorithm, trusted computing