基于模型的零信任网络安全架构

Model-based Zero-trust Architecture of Cyber Security

为了设计信息物理系统中的安全架构,遵循基于模型的系统工程(Model-Based Systems Engineering,MBSE)的方法学,提出了一种基于模型的零信任网络安全架构.网络安全架构的总体策略采用纵深防御,系统划分不同安全域并采取不同的保护措施,在此基础上,零信任(Zero Trust)对纵深防御策略进行强化,采用微网段方法实施细粒度的安全域,采用基于属性的访问控制方法实施细粒度的访问控制.将基于模型的零信任网络安全架构应用到边界安全域,开发了基于系统建模语言(System Modeling Language,SysML)的模型.基于模型的零信任网络安全架构具有流程可迭代、需求可追溯、安全域细粒度、访问控制动态性的特点.

In order to design the security architecture in cyber-physical systems,a model-based zero-trust architecture of cyber security was proposed following the methodology of Model-Based Systems Engineering(MBSE).Overall strategy of the security architecture was defense in depth,in which different security zones were divided and different protection measures were taken in security zones.Further,defense-in-depth strategy was strengthened by zero trust.Fine-grained security zone was realized by using micro-segmenta-tion,and fine-grained access control was realized by using attribute-based access control.The model-based zero-trust architecture of cy-ber security was applied to the boundary security zone,in which model based on System Modeling Language(SysML)was developed.Iterative process,traceable requirements,fine-grained security zone,and dynamic access control could be achieved in the model-based zero-trust architecture of cyber security.