零信任身份架构#

@Service
@Slf4j
public class PolicyDecisionEngine {
    
    @Autowired
    private RiskAssessmentService riskService;
    
    @Autowired
    private DeviceTrustService deviceTrust;
    
    @Autowired
    private IdentityService identityService;
    
    /**
     * 访问决策
     * 结合用户身份、设备状态、风险评估做出决策
     */
    public AccessDecision evaluate(AccessRequest request) {
        
        // 1. 获取用户身份信息
        IdentityContext userContext = identityService.getContext(request.getUserId());
        
        // 2. 获取设备信任评估
        DeviceContext deviceContext = deviceTrust.evaluate(request.getDeviceId());
        
        // 3. 计算风险评分
        RiskScore riskScore = riskService.calculateScore(
            userContext, deviceContext, request);
        
        // 4. 获取资源策略
        ResourcePolicy policy = policyRepository.findByResource(request.getResource());
        
        // 5. 综合决策
        return makeDecision(userContext, deviceContext, riskScore, policy);
    }
    
    private AccessDecision makeDecision(
            IdentityContext user,
            DeviceContext device,
            RiskScore risk,
            ResourcePolicy policy) {
        
        // 检查设备信任级别
        if (device.getTrustLevel().ordinal() < policy.getMinDeviceTrust().ordinal()) {
            return AccessDecision.DENY.withReason("设备信任级别不足");
        }
        
        // 检查用户权限
        if (!user.hasPermission(policy.getRequiredPermission())) {
            return AccessDecision.DENY.withReason("用户权限不足");
        }
        
        // 检查风险评分
        if (risk.getScore() > policy.getMaxRiskScore()) {
            return AccessDecision.DENY.withReason("风险评分过高");
        }
        
        // 检查时间段
        if (!policy.isWithinAllowedTimeWindow(user)) {
            return AccessDecision.DENY.withReason("不在允许访问时间段内");
        }
        
        // 检查网络位置
        if (!policy.isAllowedNetworkLocation(device.getNetworkLocation())) {
            return AccessDecision.DENY.withReason("网络位置受限");
        }
        
        // 所有检查通过，授予临时访问权限
        return AccessDecision.PERMIT.withConditions(
            buildConditions(policy, risk));
    }
    
    private List<AccessCondition> buildConditions(ResourcePolicy policy, RiskScore risk) {
        List<AccessCondition> conditions = new ArrayList<>();
        
        // 高风险场景需要 MFA
        if (risk.getScore() > 50) {
            conditions.add(AccessCondition.REQUIRE_MFA);
        }
        
        // 敏感操作需要审批
        if (policy.requiresApproval()) {
            conditions.add(AccessCondition.REQUIRE_APPROVAL);
        }
        
        // 设置会话超时
        conditions.add(AccessCondition.setSessionTimeout(
            calculateTimeout(policy, risk)));
        
        return conditions;
    }
}

@Component
@Slf4j
public class PolicyEnforcementPoint implements Filter {
    
    @Autowired
    private PolicyDecisionEngine pde;
    
    @Autowired
    private TokenService tokenService;
    
    @Override
    public void doFilter(ServletRequest servletRequest, 
                        ServletResponse servletResponse,
                        FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        
        // 构建访问请求
        AccessRequest accessRequest = buildAccessRequest(request);
        
        // 调用 PDP 获取决策
        AccessDecision decision = pde.evaluate(accessRequest);
        
        if (decision.getAction() == AccessAction.DENY) {
            log.warn("访问被拒绝: user={}, resource={}, reason={}",
                accessRequest.getUserId(), accessRequest.getResource(),
                decision.getReason());
            sendDenyResponse(response, decision);
            return;
        }
        
        // 执行决策条件
        executeConditions(decision.getConditions(), request, response);
        
        // 放行请求
        chain.doFilter(request, response);
    }
    
    private void executeConditions(List<AccessCondition> conditions,
                                   HttpServletRequest request,
                                   HttpServletResponse response) {
        for (AccessCondition condition : conditions) {
            switch (condition.getType()) {
                case REQUIRE_MFA:
                    enforceMFA(request, response);
                    break;
                case REQUIRE_APPROVAL:
                    requestApproval(condition, request, response);
                    break;
                case SESSION_TIMEOUT:
                    setSessionTimeout(response, condition.getTimeout());
                    break;
            }
        }
    }
}

@Service
@Slf4j
public class BehavioralBiometricsService {
    
    @Autowired
    private BehaviorProfileRepository profileRepository;
    
    /**
     * 采集用户行为特征
     */
    public BehaviorFeatures extractFeatures(UserActivity activity) {
        BehaviorFeatures features = new BehaviorFeatures();
        
        // 打字节奏分析
        features.setTypingRhythm(analyzeTypingRhythm(activity.getKeystrokes()));
        
        // 鼠标移动特征
        features.setMouseDynamics(analyzeMouseDynamics(activity.getMouseMovements()));
        
        // 常用操作序列
        features.setActionSequence(extractSequence(activity.getActions()));
        
        return features;
    }
    
    /**
     * 计算与正常行为画像的相似度
     */
    public double calculateSimilarity(String userId, BehaviorFeatures current) {
        BehaviorProfile profile = profileRepository.findByUserId(userId)
            .orElseThrow(() -> new UserException("行为画像不存在"));
        
        double typingScore = cosineSimilarity(
            current.getTypingRhythm(), profile.getTypingRhythm());
        
        double mouseScore = cosineSimilarity(
            current.getMouseDynamics(), profile.getMouseDynamics());
        
        // 加权平均
        return 0.6 * typingScore + 0.4 * mouseScore;
    }
    
    /**
     * 检测异常行为
     */
    public List<AnomalySignal> detectAnomalies(String userId, 
            BehaviorFeatures current) {
        
        List<AnomalySignal> signals = new ArrayList<>();
        BehaviorProfile profile = profileRepository.findByUserId(userId).orElse(null);
        
        if (profile == null) {
            return signals;
        }
        
        double similarity = calculateSimilarity(userId, current);
        if (similarity < 0.7) {
            signals.add(AnomalySignal.builder()
                .type(AnomalyType.BEHAVIOR_DEVIATION)
                .severity(calculateSeverity(similarity))
                .description("行为特征偏离正常画像，相似度: " + similarity)
                .build());
        }
        
        return signals;
    }
}

@Service
@Slf4j
public class RiskSignalAggregator {
    
    /**
     * 多维度风险评分
     */
    public RiskScore aggregateSignals(List<RiskSignal> signals) {
        int totalScore = 0;
        Map<String, Integer> categoryScores = new HashMap<>();
        
        for (RiskSignal signal : signals) {
            totalScore += signal.getWeight();
            categoryScores.merge(
                signal.getCategory(), 
                signal.getWeight(), 
                Integer::sum);
        }
        
        // 严重类别有一票否决权
        if (categoryScores.getOrDefault("CRITICAL", 0) > 0) {
            return RiskScore.builder()
                .score(100)
                .categoryScores(categoryScores)
                .decision(RiskDecision.BLOCK)
                .build();
        }
        
        // 高风险类别加权
        if (categoryScores.getOrDefault("HIGH", 0) > 30) {
            totalScore = Math.min(100, totalScore + 20);
        }
        
        return RiskScore.builder()
            .score(totalScore)
            .categoryScores(categoryScores)
            .decision(mapScoreToDecision(totalScore))
            .build();
    }
    
    /**
     * 风险信号类型
     */
    public enum RiskSignalType {
        // 身份风险
        NEW_DEVICE("NEW_DEVICE", "新设备登录", 25, "IDENTITY"),
        UNUSUAL_LOCATION("UNUSUAL_LOCATION", "异常地理位置", 30, "IDENTITY"),
        IMPOSSIBLE_TRAVEL("IMPOSSIBLE_TRAVEL", "不可能的旅行", 50, "CRITICAL"),
        
        // 设备风险
        DEVICE_OUTDATED("DEVICE_OUTDATED", "设备系统过时", 15, "DEVICE"),
        DEVICE_ROOTED("DEVICE_ROOTED", "设备已越狱/Root", 40, "HIGH"),
        DEVICE_MISSING_SHIELD("DEVICE_MISSING_SHIELD", "缺少安全防护", 20, "DEVICE"),
        
        // 行为风险
        BEHAVIOR_DEVIATION("BEHAVIOR_DEVIATION", "行为偏离", 25, "BEHAVIOR"),
        RAPID_REQUESTS("RAPID_REQUESTS", "请求频率异常", 15, "BEHAVIOR"),
        
        // 威胁情报
        IP_BLACKLISTED("IP_BLACKLISTED", "IP 在黑名单", 60, "CRITICAL"),
        TOR_EXIT_NODE("TOR_EXIT_NODE", "使用 Tor 网络", 30, "HIGH");
        
        private final String code;
        private final String description;
        private final int weight;
        private final String category;
    }
}

@Service
@Slf4j
public class DeviceTrustEvaluator {
    
    @Autowired
    private MDMService mdmService;
    
    @Autowired
    private VulnerabilityScanner vulnerabilityScanner;
    
    /**
     * 综合评估设备信任级别
     */
    public DeviceTrustLevel evaluate(DeviceContext context) {
        
        int totalScore = 0;
        List<String> findings = new ArrayList<>();
        
        // 1. 设备注册状态
        if (context.isRegistered()) {
            totalScore += 20;
            findings.add("设备已注册");
        } else {
            return DeviceTrustLevel.UNTRUSTED;
        }
        
        // 2. MDM 管理状态
        if (mdmService.isManaged(context.getDeviceId())) {
            totalScore += 15;
            findings.add("设备已纳入 MDM 管理");
        }
        
        // 3. 操作系统和补丁
        int patchScore = evaluatePatchLevel(context);
        totalScore += patchScore;
        
        // 4. 安全软件
        if (context.hasAntivirus() && context.isAntivirusUpToDate()) {
            totalScore += 15;
            findings.add("杀毒软件正常");
        }
        
        // 5. 磁盘加密
        if (context.isDiskEncrypted()) {
            totalScore += 15;
            findings.add("磁盘已加密");
        }
        
        // 6. 漏洞扫描
        int vulnScore = evaluateVulnerabilities(context);
        totalScore += vulnScore;
        
        // 7. 证书状态
        if (context.hasValidClientCertificate()) {
            totalScore += 10;
            findings.add("设备证书有效");
        }
        
        return DeviceTrustLevel.fromScore(totalScore);
    }
    
    private int evaluatePatchLevel(DeviceContext context) {
        int daysSinceLastUpdate = context.getDaysSinceLastSecurityUpdate();
        
        if (daysSinceLastUpdate <= 7) {
            return 15;
        } else if (daysSinceLastUpdate <= 30) {
            return 10;
        } else if (daysSinceLastUpdate <= 90) {
            return 5;
        } else {
            return 0;
        }
    }
}

@Service
@Slf4j
public class PrivilegeManager {
    
    /**
     * 基于任务的权限授予
     */
    public JustInTimeAccess grantTaskPermission(String userId, 
            String taskId, 
            Duration duration) {
        
        // 1. 验证用户有权限申请此任务
        TaskPermission task = taskRepository.findById(taskId)
            .orElseThrow(() -> new TaskException("任务不存在"));
        
        if (!userHasTaskEligibleRole(userId, task)) {
            throw new SecurityException("用户无权申请此任务的权限");
        }
        
        // 2. 创建临时权限
        JustInTimeAccess access = JustInTimeAccess.builder()
            .id(UUID.randomUUID().toString())
            .userId(userId)
            .permissions(task.getPermissions())
            .resource(task.getResourceId())
            .validFrom(Instant.now())
            .validUntil(Instant.now().plus(duration))
            .reason(task.getDescription())
            .status(AccessStatus.PENDING_APPROVAL)
            .build();
        
        // 3. 如果需要审批
        if (task.requiresApproval()) {
            notifyApprovers(access);
        } else {
            activateAccess(access);
        }
        
        return access;
    }
    
    /**
     * 激活访问权限
     */
    private void activateAccess(JustInTimeAccess access) {
        access.setStatus(AccessStatus.ACTIVE);
        accessRepository.save(access);
        
        // 将权限添加到用户的有效权限集中
        permissionCache.invalidateUserPermissions(access.getUserId());
        
        // 设置自动回收任务
        scheduleRevocation(access);
        
        log.info("JIT 权限已激活: user={}, permissions={}, until={}",
            access.getUserId(), access.getPermissions(), access.getValidUntil());
    }
    
    /**
     * 自动回收权限
     */
    private void scheduleRevocation(JustInTimeAccess access) {
        scheduledExecutor.schedule(() -> {
            if (access.getStatus() == AccessStatus.ACTIVE) {
                revokeAccess(access.getId(), "自动过期");
            }
        }, access.getRemainingDuration().toMillis(), TimeUnit.MILLISECONDS);
    }
}

@Service
public class ZeroTrustMaturityAssessment {
    
    /**
     * 零信任成熟度评估
     */
    public MaturityReport assess(String organizationId) {
        MaturityReport report = new MaturityReport();
        report.setOrganizationId(organizationId);
        report.setAssessmentDate(Instant.now());
        
        // 各维度评估
        report.setIdentityMaturity(assessIdentityMaturity());
        report.setDeviceMaturity(assessDeviceMaturity());
        report.setNetworkMaturity(assessNetworkMaturity());
        report.setApplicationMaturity(assessApplicationMaturity());
        report.setDataMaturity(assessDataMaturity());
        
        // 综合评分
        report.setOverallScore(calculateOverallScore(report));
        
        // 改进建议
        report.setRecommendations(generateRecommendations(report));
        
        return report;
    }
    
    /**
     * 身份维度评估
     */
    private MaturityLevel assessIdentityMaturity() {
        int score = 0;
        List<String> findings = new ArrayList<>();
        
        // 检查因素
        if (hasCentralizedIdp()) score += 20;
        else findings.add("缺少集中身份提供商");
        
        if (hasMfaEnabled()) score += 20;
        else findings.add("MFA 覆盖率不足");
        
        if (hasPrivilegedAccessManagement()) score += 20;
        else findings.add("缺少特权访问管理");
        
        if (hasContinuousAuthentication()) score += 20;
        else findings.add("缺少持续认证机制");
        
        if (hasBehavioralAnalytics()) score += 20;
        else findings.add("缺少行为分析能力");
        
        return MaturityLevel.fromScore(score, findings);
    }
}