Abstract:

In order to address the failure of boundary protection measures caused by the evolution with complexity， dynamics and fragmentation of network architecture， and to cope with the challenge for network data security caused by the continuous emergence of vulnerabilities in non-autonomous controllable systems， software， hardware and cryptographic algorithms， the following tasks were performed. Firstly， a zero trust network architecture implementation model was designed on the basis of zero trust concept. Secondly， a zero trust network security protection framework was proposed， which integrated concept of zero trust security， Chinese cryptographic algorithm system， and trusted computing technology in links such as identity management and authentication， authorization and access， data processing and transmission， framework processes such as Chinese cryptographic certificate application and issuance， business data secure processing and transmission were designed， and functional components such as identity and access management module， terminal trusted network access proxy device were designed and implemented. Finally， a network platform based on the security protection framework was built， which provided new frameworks， technologies and tools for network data security protection and zero trust security practices. Security analysis and performance test results show that with the proposed platform， the signing and signature verification performance of the SM2 reaches 1 118.72 and 441.43 times per second respectively， the encryption and decryption performance of SM4 reaches 10.05 MB/s and 9.96 MB/s respectively， and the secure data access/response performance reaches 7.23 MB/s， demonstrating that the proposed framework can provide stable support for data security.

Key words: zero trust, data protection, security framework, Chinese cryptographic algorithm, trusted computing

摘要：

为解决网络架构复杂化、动态化和碎片化演变导致的边界防护措施失效，应对非自主可控的系统、软硬件和密码算法不断呈现的脆弱性对网络数据安全造成的挑战，首先，基于零信任理念设计一个零信任网络架构实现模型；其次，提出一种零信任网络安全保护框架，在身份管理与认证、授权与访问、数据处理与传输等环节融合利用零信任安全理念、国密算法体系和可信计算技术，设计国密证书申请与签发、业务数据安全处理与传输等框架流程，并设计与实现身份与访问管理模块、终端可信网络访问代理设备等功能组件；最后，构建基于安全保护框架的网络平台，从而为网络数据安全保护和零信任安全实践提供新框架、技术和工具。安全分析与性能测试的结果显示，所提平台对SM2的签名与验签性能分别平均达到了每秒1 118.72次和每秒441.43次，对SM4的加密和解密性能分别平均达到了10.05 MB/s和9.96 MB/s，平台数据安全访问/响应性能为7.23 MB/s，表明所提框架可以提供稳定的数据安全支持。

关键词: 零信任, 数据保护, 安全框架, 国密算法, 可信计算