# A Proposal for a Zero-Trust-Based Multi-Level Security Model and Its Security Controls
## 1 Introduction  
### Background  
The advancement of technologies such as artificial intelligence (AI), cloud computing, and 6G has led to a dramatic increase in the volume of data available. Big data are being utilised not only by private enterprises, but also by academia, government, and public organisations, driving research and analysis across various domains. Many organisations are simultaneously leveraging big data and adopting new technologies to enhance productivity, improve efficiency, and create new value [1, 2, 3]. However, restricted environments, such as those employing isolated network systems, including military and government organisations, face challenges in quickly and efficiently adopting emerging technologies for data utilisation [4]. At the same time, the rapid evolution of digital environments has resulted in increasingly complex IT infrastructures, accompanied by more sophisticated cyber risks or threats [5]. The emergence and proliferation of advanced IT technologies, such as cloud computing, AI, and quantum computing [6, 7], have introduced new demands for data utilisation and security frameworks. This has led to an increased emphasis on the need for new security models that can maintain enhanced security and support data utilisation efficiently [8]. In particular, the spread of remote work, telecommuting, and hybrid work following the COVID-19 pandemic has exposed the limitations of traditional security frameworks. This has highlighted the necessity of establishing more sophisticated mechanisms for managing users and implementing security controls when accessing internal information assets via external networks [9]. Furthermore, global regulations, such as FISMA [10] and GDPR [11; 12], call for differentiated security controls based on data sensitivity. Simultaneously, the rise in advanced cyber attacks, such as Advanced Persistent Threats (APTs), underscores the increasing need for systematic security strategies to safeguard Sensitive data in organisations [13]. In this context, the Multi-Level Security (MLS) framework has gained attention as a model that differentiates security policies according to data sensitivity, thereby protecting the data that organisations store, utilise, or process while supporting efficient data utilisation. As a result of this background, the Republic of Korea's National Intelligence Service (NIS) announced a roadmap in September 2024 aimed at transitioning to a Multi-Level Security (MLS) framework, which applies differentiated security controls based on the sensitivity of data [14]. The MLS framework in the Republic of Korea is a security framework that ensures confidentiality and integrity by refining access controls based on data sensitivity. It is particularly recognised as an effective data-centric security model in environments with varying data sensitivity levels. MLS categorises data into classifications such as \"Classified\", \"Sensitive\", and \"Open\", applying appropriate security controls to each level to manage access to data or resources systematically in organisations. However, as the MLS model predominantly relies on static access controls, it faces limitations in continuously verifying the identity of users, devices, or systems attempting to access resources or data, making it challenging to respond promptly to abnormal access behaviours. The Zero Trust (ZT) model is a security framework based on the principle of \"never trust, always verify\", employing dynamic access control to validate all access requests continuously [15]. Unlike traditional perimeter-based security models, the Zero Trust approach treats both internal and external users as potential threats. Implementing continuous verification for all access attempts effectively defends against advanced cyber threats, such as Advanced Persistent Threat (APT) attacks, as well as risks that may arise within the network [16; 17].