Complete 3-Stage ZTA Verification

Unbounded Protection for Resources

Identity VerificationDevice VerificationTrust Inference

CGTrust Zero Trust Solution

To meet the demands of cloud, remote access, and mobile offices, traditional firewalls and network segregation are insufficient against modern cybersecurity threats. CHANGING integrates FIDO, MFA, and PKI technologies, offering a zero-trust solution that is the first to pass cybersecurity institute verification for identity and device authentication. Already implemented in over thirty government and financial institutions, it also supports enterprise web systems, VPNs, and OS logins, significantly reducing data breaches and lateral movement attacks.

Zero Trust Network Architecture

Network Control: Alllow or restrict network segments based on trust levels, or directly permits access using a Reverse Proxy.

Authentication Statement: Use strong authentication methods like FIDO2 for identity verification. Check if the device's TPM has a registered device certificate.



Zero Trust Network Architecture

Zero Trust Architecture is based on the concept of "never trust, always verify," requiring repeated and multifaceted verification to establish trust before accessing data. Its three core mechanisms are:

  • Identity Authentication: Multi-factor authentication and identity assertions.

  • Device Authentication: Device authentication and device health management.

  • Trust Inference: User context trust inference mechanisms.

Zero Trust Network Architecture focuses on protecting resource access:

  • Emphasize protecting data and application access over perimeter defense.

  • Lack specific boundaries; users, devices, data, and applications are in different network environments.

  • Never trust any data access request and continuously verify.





Government Promotion Process Prioritizing Identity Authentication

Taiwan government is promoting the Zero Trust Network Architecture, focusing on top-tier public agencies responsible for information security like the Presidential Office, Executive Yuan, National Security Bureau, Ministry of National Defense, Ministry of Foreign Affairs, and the six metropolitan governments. This initiative aims to implement Zero Trust and develop a domestic cybersecurity industry chain.

Phased Implementation from 2022:

2022 Identity Authentication 2023 Device Authentication 2024 Trust Inference





Identity Authentication

Safeguarding Identity Security, Essential to Zero-Trust

The first line of defense for all network services is ensuring identity security, a key aspect of Zero Trust. CHANGING's FIDO and OATH certified solution uses diverse verification mechanisms for various applications and integration services. This enables effective identity verification across industries and government agencies, enhancing information security. It improves network defense depth and breadth, achieving high-level security through proactive defense mechanisms, safeguarding enterprise gateways.



Multiple Identity Authentication Mechanism

IDExpert Identity Authentication System CGFIDO Passwordless Authentication System MICS Mobile Citizen Digital Certificate Solution

Device Authentication

Ensuring Device Security and Authenticity

CHANGING's device authentication solution uses TPM hardware chip keys to establish device identity. Access to applications and enterprise resources is granted only after verifying the device's authenticity.



Trust Inference

Continuous Risk Detection and Real-Time Threat Blocking

CHANGING's trust inference solution evaluates device health (OS updates, antivirus status, EDR, GCB/FCB compliance) and connection details (IP, location, time). Devices must meet health requirements to access resources; otherwise, connections are blocked in real time.




Supporting Government ZTN and Core Enterprise Applications

When users or devices need to access organizational resources, they must pass through a Policy Enforcement Point (PEP), with access rights determined by the corresponding Policy Decision Point (PDP).

Government ZTA Applications:

After identity login, an authentication assertion must be obtained for verification and access approval.

  • Government Information Systems

Core Enterprise Applications:

In the Zero Trust Architecture, strong authentication must be performed before login, followed by a second phase login.

  • Windows/Linux/Mac Operating Systems

  • VPN Remote Access

  • VDI Remote Office Connections

  • Web Services

  • Email Systems

Zero Trust Maturity Model (ZTMM)

Implementing Zero Trust is a gradual, continually improving process. CHANGING assists organizations advance across the five pillars and three functional aspects of Zero Trust.

In the rapidly evolving enterprise environment and technological landscape, ZTMM offers a method for continuously modernizing Zero Trust operations. It covers the implementation gradients of the five pillars: Identity, Device, Network, Application, and Data. This allows for the gradual optimization and improvement of Zero Trust. Each pillar includes three horizontal functions: Visibility and Analytics, Automation and Orchestration, and Governance.

Diversified Technology Integration