关键词: 零信任网络, 身份和访问管理, 微分段, 软件定义边界

Abstract: Aiming at the current increasingly challenging network security situation, zero trust network provides an architecture and its design and implementation method that can effectively mitigate traditional network security threats. The core idea of zero trust is “never trust, always verify”, zero trust network is a new network security architecture that effectively integrates zero trust mechanism into the traditional network, which will verify all objects of the network and grant them minimum access rights, and make continuous and dynamic evaluation decisions on all access behaviors. Firstly, the basic definition of zero trust network is introduced, the shortcomings of traditional network architecture are pointed out, and the zero trust network architecture is given. Secondly, the key technologies of zero trust network are described, focusing on identity and access management, micro-segmentation and software-defined perimeter, and their technical characteristics and application scenarios are evaluated. In addition, the current research progress and results of zero trust network in related fields such as big data, cloud computing, 5G and IoT, are analyzed. Finally, zero trust network is summarized and future development is prospected.

Key words: zero trust network, identity and access management, micro-segmentation, software defined perimeter