关键词: 软件定义边界, 可验证凭证, 匿名认证, CL签名, 隐私保护

Abstract: The standard SDP architecture employs identity-based authentication and authorization strategies to monitor and audit access activities in real time.However,users must fully disclose their identity information to obtain access,potentially exposing sensitive data unrelated to the requested service and introducing privacy risks.To address challenges such as ineffective user privacy protection and vulnerability of access records to malicious linkage in the current SDP architecture,this paper proposes an anonymous authentication scheme based on verifiable credentials(VCs) for SDP.The scheme constructs a VC verification algorithm using bilinear pairing and CL-signature,integrating the VC system with the standard SDP architecture to enable anonymous user access without altering the original single-packet authorization and TLS secure connection authentication model.Theoretical analysis demonstrates that the proposed scheme resists common network attacks,including knock amplification and identity impersonation.Experimental results show that it achieves shorter authentication latency in multi-node network environments.

Key words: Software defined perimeter, Verifiable credentials, Anonymous authentication, CL-signature, Privacy preservation