中圖分類號：TP393文獻標識碼：ADOI:10.19358/j.issn.2097-1788.2024.07.004
引用格式：鄒立剛，張逸凡，張新躍，等.一種基于DNS的零信任增強認證系統(tǒng)設計［J］.網(wǎng)絡安全與數(shù)據(jù)治理，2024，43（7）：21-25.

Design of DNS based Zero Trust enhanced authentication system

Abstract： The article addresses the security risks associated with the widespread reuse of certificates in current HTTPS applications. Drawing on the idea of dynamic authorization of security policies in the Zero Trust model, it proposes a solution that enhances authentication capabilities by leveraging the existing Internet infrastructure, specifically DNS. This solution involves dynamically authenticating HTTPS access requests by adding enhanced authentication information to existing DNS authoritative servers. By doing so, it enables real-time validation of the security status of current HTTPS certificates. This approach effectively tackles the security issues arising from the common practice of certificate reuse in HTTPS, utilizing the trusted and readily available DNS infrastructure. It represents a flexible, efficient, and scalable Zero Trust security enhancement authentication framework.

Key words : HTTPS; certificate; Zero Trust Security Model; DNS; DNS-CA