零信任架构：重塑网络安全的现代防护体系

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

// 基于策略的访问控制
interface AccessPolicy {
  id: string;
  name: string;
  rules: PolicyRule[];
  effect: 'allow' | 'deny';
}

interface PolicyRule {
  subject: {
    users?: string[];
    groups?: string[];
    roles?: string[];
  };
  resource: {
    type: string;
    ids?: string[];
    attributes?: Record<string, any>;
  };
  action: string[];
  conditions?: {
    time?: TimeRange;
    location?: GeoLocation;
    device?: DevicePolicy;
  };
}

// 策略引擎
class PolicyEngine {
  private policies: AccessPolicy[] = [];

  async evaluate(
    request: AccessRequest
  ): Promise<AccessDecision> {
    // 收集上下文信息
    const context = await this.gatherContext(request);

    // 评估所有适用的策略
    const applicablePolicies = this.policies.filter(
      p => this.matchesPolicy(p, context)
    );

    // 默认拒绝（白名单模式）
    let decision: AccessDecision = {
      allowed: false,
      reason: 'No applicable policy'
    };

    // 评估策略（deny优先）
    for (const policy of applicablePolicies) {
      if (policy.effect === 'deny') {
        return {
          allowed: false,
          reason: `Policy ${policy.id} denies access`
        };
      }
      if (policy.effect === 'allow') {
        decision = {
          allowed: true,
          reason: `Policy ${policy.id} allows access`,
          expiresAt: this.calculateExpiry(policy)
        };
      }
    }

    return decision;
  }

  private async gatherContext(
    request: AccessRequest
  ): Promise<Context> {
    return {
      user: await this.identityProvider.getUser(request.userId),
      device: await this.deviceService.getInfo(request.deviceId),
      location: await this.geoService.locate(request.ipAddress),
      time: Date.now(),
      riskScore: await this.riskEngine.calculate(request)
    };
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

// 网络微分段配置
interface NetworkSegment {
  id: string;
  name: string;
  workloads: Workload[];
  ingressRules: FirewallRule[];
  egressRules: FirewallRule[];
}

interface FirewallRule {
  id: string;
  description: string;
  source: Selector;
  destination: Selector;
  ports: number[];
  protocol: 'tcp' | 'udp' | 'icmp';
  action: 'allow' | 'deny';
}

// 微分段策略实施
class MicroSegmentationEnforcer {
  private segments: Map<string, NetworkSegment> = new Map();

  async enforceRule(
    rule: FirewallRule,
    connection: Connection
  ): Promise<boolean> {
    // 检查源和目标
    const sourceSegment = this.findSegment(connection.sourceIp);
    const destSegment = this.findSegment(connection.destIp);

    // 默认拒绝
    let allowed = false;

    // 检查入站规则
    for (const r of destSegment.ingressRules) {
      if (this.matchesRule(r, connection)) {
        allowed = r.action === 'allow';
        break;
      }
    }

    // 记录连接尝试
    await this.logConnectionAttempt({
      source: connection.sourceIp,
      destination: connection.destIp,
      port: connection.port,
      allowed,
      timestamp: Date.now()
    });

    return allowed;
  }

  private matchesRule(rule: FirewallRule, conn: Connection): boolean {
    return (
      this.matchesSelector(rule.source, conn.sourceIp) &&
      this.matchesSelector(rule.destination, conn.destIp) &&
      rule.ports.includes(conn.port) &&
      rule.protocol === conn.protocol
    );
  }
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

// 行为分析引擎
class BehaviorAnalyzer {
  private baseline = new Map<string, UserBaseline>();

  async analyzeActivity(
    userId: string,
    activity: UserActivity
  ): Promise<RiskScore> {
    const baseline = this.getBaseline(userId);
    const anomalies: Anomaly[] = [];

    // 时间模式检查
    if (!this.isNormalTime(baseline, activity.timestamp)) {
      anomalies.push({
        type: 'unusual_time',
        severity: 'medium',
        description: 'Access outside normal hours'
      });
    }

    // 位置检查
    if (!this.isNormalLocation(baseline, activity.location)) {
      anomalies.push({
        type: 'unusual_location',
        severity: 'high',
        description: 'Access from new location'
      });
    }

    // 设备检查
    if (!this.isKnownDevice(baseline, activity.deviceId)) {
      anomalies.push({
        type: 'unknown_device',
        severity: 'high',
        description: 'Access from unregistered device'
      });
    }

    // 行为模式检查
    if (!this.isNormalBehavior(baseline, activity.actions)) {
      anomalies.push({
        type: 'unusual_behavior',
        severity: 'medium',
        description: 'Deviation from normal behavior pattern'
      });
    }

    // 计算风险分数
    return this.calculateRiskScore(anomalies);
  }

  private calculateRiskScore(anomalies: Anomaly[]): RiskScore {
    let score = 0;

    for (const anomaly of anomalies) {
      switch (anomaly.severity) {
        case 'low':
          score += 10;
          break;
        case 'medium':
          score += 30;
          break;
        case 'high':
          score += 50;
          break;
      }
    }

    return {
      score: Math.min(score, 100),
      level: this.getRiskLevel(score),
      anomalies,
      timestamp: Date.now()
    };
  }
}

// 实时威胁检测
class ThreatDetectionEngine {
  async detectThreats(
    events: SecurityEvent[]
  ): Promise<ThreatAlert[]> {
    const alerts: ThreatAlert[] = [];

    // 检测暴力破解
    const failedLogins = this.groupEventsByUser(events, 'login_failed');
    for (const [userId, attempts] of failedLogins) {
      if (attempts.length > 5) {
        alerts.push({
          type: 'brute_force',
          severity: 'high',
          target: userId,
          description: `Multiple failed login attempts: ${attempts.length}`,
          recommendedActions: ['lock_account', 'notify_admin']
        });
      }
    }

    // 检测横向移动
    const lateralMovement = this.detectLateralMovement(events);
    if (lateralMovement) {
      alerts.push({
        type: 'lateral_movement',
        severity: 'critical',
        target: lateralMovement.source,
        description: 'Potential lateral movement detected',
        recommendedActions: ['isolate_host', 'investigate']
      });
    }

    // 检测数据外泄
    const dataExfiltration = this.detectDataExfiltration(events);
    if (dataExfiltration) {
      alerts.push({
        type: 'data_exfiltration',
        severity: 'critical',
        target: dataExfiltration.user,
        description: 'Unusual data transfer detected',
        recommendedActions: ['block_transfer', 'investigate']
      });
    }

    return alerts;
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

// ZTNA网关实现
class ZTNAGateway {
  private authenticator: Authenticator;
  private authorizer: Authorizer;
  private sessionManager: SessionManager;

  async handleRequest(
    request: AccessRequest
  ): Promise<AccessResponse> {
    // 1. 身份验证
    const authResult = await this.authenticator.authenticate({
      userId: request.userId,
      credentials: request.credentials,
      mfaToken: request.mfaToken
    });

    if (!authResult.success) {
      return {
        allowed: false,
        reason: 'Authentication failed'
      };
    }

    // 2. 设备健康检查
    const deviceHealth = await this.checkDeviceHealth(request.deviceId);
    if (!deviceHealth.healthy) {
      return {
        allowed: false,
        reason: 'Device does not meet security requirements',
        requirements: deviceHealth.missingRequirements
      };
    }

    // 3. 授权决策
    const authzDecision = await this.authorizer.authorize({
      user: authResult.user,
      resource: request.resource,
      action: request.action,
      context: request.context
    });

    if (!authzDecision.allowed) {
      return {
        allowed: false,
        reason: authzDecision.reason
      };
    }

    // 4. 创建会话
    const session = await this.sessionManager.create({
      userId: request.userId,
      resourceId: request.resource.id,
      policies: authzDecision.applicablePolicies,
      expiresAt: authzDecision.expiresAt
    });

    // 5. 返回访问令牌
    return {
      allowed: true,
      accessToken: session.token,
      expiresIn: session.expiresAt - Date.now()
    };
  }

  private async checkDeviceHealth(
    deviceId: string
  ): Promise<DeviceHealthResult> {
    const device = await this.deviceService.getDevice(deviceId);
    const requirements: string[] = [];

    // 检查操作系统版本
    if (!this.isOSVersionSupported(device.osVersion)) {
      requirements.push('OS update required');
    }

    // 检查安全软件
    if (!device.hasAntivirus) {
      requirements.push('Antivirus required');
    }

    // 检查加密
    if (!device.diskEncrypted) {
      requirements.push('Disk encryption required');
    }

    // 检查安全补丁
    if (device.pendingUpdates > 0) {
      requirements.push('Security patches required');
    }

    return {
      healthy: requirements.length === 0,
      missingRequirements: requirements
    };
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

// Istio服务网格配置
// 服务间mTLS强制执行
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT  # 强制mTLS

---
# 授权策略
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: order-service-policy
spec:
  selector:
    matchLabels:
      app: order-service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/user-service"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/orders/*"]
    when:
    - key: source.labels
      values: ["version:v2"]
    - key: request.headers[authorization]
      values: ["Bearer *"]

---
// JWT认证策略
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-authn
spec:
  selector:
    matchLabels:
      app: backend
  jwtRules:
  - issuer: "https://auth.example.com"
    jwks: |
      {
        "keys": [
          {
            "kty": "RSA",
            "e": "AQAB",
            "use": "sig",
            "kid": "key1",
            "alg": "RS256",
            "n": "..."
          }
        ]
      }
    outputPayloadToHeader: x-jwt-payload

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

// 数据加密服务
class EncryptionService {
  private keyVault: KeyVault;

  async encryptData(
    data: string,
    context: EncryptionContext
  ): Promise<EncryptedData> {
    // 获取加密密钥
    const key = await this.keyVault.getKey(context.keyId);

    // 使用Envelope加密
    const encryptedKey = await this.rsaEncrypt(
      key.publicKey,
      this.generateAESKey()
    );

    const encryptedData = await this.aesEncrypt(
      encryptedKey.plaintext,
      data
    );

    return {
      encryptedKey: encryptedKey.ciphertext,
      encryptedData,
      metadata: {
        algorithm: 'AES-256-GCM',
        keyId: context.keyId,
        keyVersion: key.version,
        encryptedAt: Date.now()
      }
    };
  }

  async decryptData(
    encrypted: EncryptedData
  ): Promise<string> {
    // 从密钥保管库获取私钥
    const key = await this.keyVault.getPrivateKey(
      encrypted.metadata.keyId
    );

    // 解密数据密钥
    const decryptedKey = await this.rsaDecrypt(
      key,
      encrypted.encryptedKey
    );

    // 解密数据
    return await this.aesDecrypt(
      decryptedKey,
      encrypted.encryptedData
    );
  }
}

// 字段级加密
class FieldLevelEncryption {
  private encryptionService: EncryptionService;
  private encryptedFields = new Set<string>();

  // 声明需要加密的字段
  markEncrypted(fieldName: string): void {
    this.encryptedFields.add(fieldName);
  }

  // 在保存前自动加密
  async beforeSave(entity: any): Promise<void> {
    for (const field of this.encryptedFields) {
      if (entity[field]) {
        entity[field] = await this.encryptionService.encrypt(
          entity[field],
          { context: field }
        );
      }
    }
  }

  // 在读取后自动解密
  async afterLoad(entity: any): Promise<void> {
    for (const field of this.encryptedFields) {
      if (entity[field]) {
        entity[field] = await this.encryptionService.decrypt(
          entity[field]
        );
      }
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

// 成熟度评估模型
interface ZeroTrustMaturityModel {
  identity: {
    currentLevel: number; // 0-5
    targetLevel: number;
    gaps: string[];
  };
  devices: {
    currentLevel: number;
    targetLevel: number;
    gaps: string[];
  };
  network: {
    currentLevel: number;
    targetLevel: number;
    gaps: string[];
  };
  data: {
    currentLevel: number;
    targetLevel: number;
    gaps: string[];
  };
}

class ZeroTrustAssessment {
  async assess(): Promise<ZeroTrustMaturityModel> {
    return {
      identity: {
        currentLevel: await this.assessIdentity(),
        targetLevel: 5,
        gaps: this.getIdentityGaps()
      },
      devices: {
        currentLevel: await this.assessDevices(),
        targetLevel: 4,
        gaps: this.getDeviceGaps()
      },
      network: {
        currentLevel: await this.assessNetwork(),
        targetLevel: 5,
        gaps: this.getNetworkGaps()
      },
      data: {
        currentLevel: await this.assessData(),
        targetLevel: 4,
        gaps: this.getDataGaps()
      }
    };
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# 部署零信任组件

# 1. 身份提供商
helm install keycloak bitnami/keycloak

# 2. 服务网格
istioctl install --set profile=demo

# 3. 策略引擎
kubectl apply -f opa-gatekeeper.yaml

# 4. 监控
helm install prometheus prometheus-community/kube-prometheus-stack

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// 策略迁移工具
class PolicyMigrationTool {
  async migrateFromVPN(
    vpnConfig: VPNConfig
  ): Promise<ZeroTrustPolicy[]> {
    const policies: ZeroTrustPolicy[] = [];

    // 转换VPN规则为零信任策略
    for (const rule of vpnConfig.rules) {
      policies.push({
        name: rule.name,
        description: `Migrated from VPN rule: ${rule.name}`,
        subjects: {
          users: rule.allowedUsers,
          groups: rule.allowedGroups
        },
        resources: {
          type: 'application',
          ids: rule.applications
        },
        actions: ['access'],
        conditions: {
          time: vpnConfig.timeRestrictions,
          location: vpnConfig.locationRestrictions
        }
      });
    }

    return policies;
  }
}