Abstract:

Aiming at the issue of service exposure resulting from the gradual collapse of the traditional network security architecture based on physical perimeter protection under a zero-trust environment, this paper proposed a service protection scheme based on software defined perimeter. The terminal was authorized by gathering user and device attributes of the request terminal. The single packet authorization mechanism performed authentication before connection, enabling features such as service hiding, identity authentication, and access control. Based on the concept of zero-trust continuous authentication, this scheme measured the access terminal at the firmware layer before initializing the operating system, and then constantly measured it depending on the service after the operating system was initialized. Finally, a trust evaluation algorithm based on analytic hierarchy process(AHP) was designed to assess terminal security. Results from the analysis of performance and security show that this scheme can effectively improve communication efficiency and withstand a variety of network security attacks.

Key words: zero trust, software defined perimeter, single packet authorization, device security, analytic hierarchy process