零信任架构：从理论到生产实施

“永不信任，始终验证”是零信任的核心原则。将这一理念转化为实际的基础设施决策需要理解实用的实施模式。

为什么传统边界安全失效了

城堡-护城河模型假设网络内部的一切都是可信的。现代基础设施的现实否定了这一点：

• 远程工作意味着用户始终处于“外部”
• 云工作负载跨提供商边界通信
• 在扁平网络中，初始入侵后的横向移动极其容易

零信任的五大支柱

1. 身份作为新边界

对于服务间认证，使用 SPIFFE/SPIRE 实现加密工作负载身份：

func getWorkloadIdentity(ctx context.Context) (*x509svid.SVID, error) {
    client, err := workloadapi.New(ctx)
    if err != nil {
        return nil, fmt.Errorf("creating client: %w", err)
    }
    defer client.Close()
    return client.FetchX509SVID(ctx)
    // Identity: spiffe://trust-domain/service/payment-service
}

2. 设备信任评估

from dataclasses import dataclass
from enum import Enum

class TrustLevel(Enum):
    NONE = 0; LOW = 1; MEDIUM = 2; HIGH = 3; FULL = 4

@dataclass
class DevicePosture:
    disk_encrypted: bool
    endpoint_protection: bool
    jailbroken: bool
    corporate_managed: bool

def evaluate_trust(posture: DevicePosture) -> TrustLevel:
    if posture.jailbroken:
        return TrustLevel.NONE
    if not posture.disk_encrypted:
        return TrustLevel.LOW
    score = (40 if posture.corporate_managed else 0) + (30 if posture.endpoint_protection else 0)
    return TrustLevel.FULL if score >= 60 else TrustLevel.HIGH

3. 基础设施即代码实现微隔离

resource "aws_security_group" "payment_service" {
  name   = "payment-service-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.api_gateway.id]
    description     = "Only API gateway can reach payment service"
  }

  egress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.database.id]
  }
}

4. 策略即代码（OPA）

每个授权决策都是基于请求而非会话：

package zero_trust

default allow = false

allow {
    valid_identity
    sufficient_device_trust
    authorized_for_resource
    not anomalous_request
}

sufficient_device_trust {
    resource := get_resource(input.resource.id)
    trust_levels := {"NONE": 0, "LOW": 1, "MEDIUM": 2, "HIGH": 3, "FULL": 4}
    trust_levels[input.subject.device_trust] >= trust_levels[resource.min_trust]
}

anomalous_request {
    typical := data.user_baselines[input.subject.user_id].locations
    not input.context.location in typical
    input.resource.sensitivity == "CRITICAL"
}

5. 行为分析与持续监控

from sklearn.ensemble import IsolationForest
import numpy as np
from datetime import datetime

class UserBehaviorAnalyzer:
    def __init__(self):
        self.model = IsolationForest(contamination=0.01)

    def extract_features(self, user_id: str) -> np.ndarray:
        events = self.get_events(user_id, hours=1)
        return np.array([
            datetime.utcnow().hour,
            len(events),
            len(set(e.resource_id for e in events)),
            sum(1 for e in events if e.outcome == 'DENIED'),
        ])

    def is_anomalous(self, user_id: str):
        score = self.model.score_samples([self.extract_features(user_id)])[0]
        return score < -0.5, abs(score)

实施路线图

阶段 1（第 1-3 个月）：基础 - 所有用户启用 MFA，身份提供商，数据清单

阶段 2（第 4-6 个月）：以身份为中心 - SPIFFE/SPIRE，短期证书，设备状态

阶段 3（第 7-9 个月）：微隔离 - 网络策略，身份感知代理，OPA

阶段 4（第 10-12 个月）：持续验证 - 行为分析，自动化响应

从风险最高的领域开始，逐步迭代。零信任是一个旅程，而非终点。