Zero-trust network architecture and construction method

Abstract

The invention provides a zero-trust network architecture and a construction method. The zero-trust network architecture comprises a controller, a cloud gateway, an edge gateway and a terminal agent, the edge gateway is in communication connection with the cloud gateway, the cloud gateway, the edge gateway and the terminal agent are respectively in communication connection with the controller, and the cloud gateway and the edge gateway are respectively in communication connection with the client; the controller is used for controlling registration and login processes of the client, the cloud gateway and the edge gateway and issuing a routing strategy and an authorized access control strategy; the edge gateway is used for controlling resource security access, and the cloud gateway is used for routing when a client accesses resources across regions; the terminal agent is deployed at a client, establishes a tunnel with the cloud gateway and the edge gateway, and performs secure access on authorized resources; the network position boundary no longer determines the access authority, all access subjects need to be subjected to identity authentication and authorization before access is allowed, and the security threat brought by the enterprise network architecture with the fuzzy boundary at present is solved.

Description

technical field [0001] The present disclosure relates to the technical field of network security, in particular to a zero-trust network architecture and construction method. Background technique [0002] The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art. [0003] At present, many enterprises adopt the method of resource access protection to divide the security zone. First, the network is divided into different security zones such as external network, internal network and DMZ, and the network boundary is formed between different security zones, and then the network boundary Deploy security devices everywhere, including firewalls, IDS, IPS, WAF and other network security technologies, to prevent various attacks from outside the border, so as to build an enterprise network security system. In this traditional security concept, the location of the network determines the degree of t...

AI Technical Summary

Problems solved by technology

[0004] With the development of emerging technologies such as cloud computing, wireless interconnection, Internet of Things, and big data, as well as business migration to the cloud, the proliferation of APT attacks, and the trend of mobile office, enterprise data is no longer limited to the intranet. The established internal and external network boundaries are becoming more and more blurred, and there are more technical means that can easily break through the network boundary. Network security is no longer limited to boundary security. Especially now that the focus of security is gradually shifting to data security, full attention should be paid to the security of the enterprise intranet. Data security, while the traditional perimeter-based network security architecture and solutions have been difficult to adapt to modern enterprise network infrastructure

Images