05-网络安全：零信任架构

Zero Trust

1. ****micro-segmentation
2. ****mTLS + SPIFFE TLS
3. ****RBAC/ABAC
4. ****TLS 1.3

5. ---

Rust rustlsTLStokio-rustls TLSx509-parser``jsonwebtokenJWT

mTLS X.509 → CA → SPIFFE ID → →

:
:

---

use tokio_rustls::rustls::{ServerConfig, RootCertStore, Certificate};
use std::sync::Arc;
 
fn build_tls_config(cert_pem: &str, key_pem: &str) -> Arc<ServerConfig> {
 let certs = rustls_pemfile::certs(&mut cert_pem.as_bytes())
 .collect::<Result<Vec<_>, _>>().unwrap();
 let key = rustls_pemfile::private_key(&mut key_pem.as_bytes())
 .unwrap().unwrap();
 
 let config = ServerConfig::builder()
 .with_no_client_auth() //  .with_client_auth() for mTLS
 .with_single_cert(certs, key).unwrap();
 
 Arc::new(config)
}
 
// JWT 
use jsonwebtoken::{decode, DecodingKey, Validation, Algorithm};
 
fn verify_token(token: &str, secret: &[u8]) -> Result<Claims, Error> {
 decode::<Claims>(token, &DecodingKey::from_secret(secret), &Validation::new(Algorithm::HS256))
 .map(|data| data.claims)
}

---