Implementing Classified Protection 2.0: How All-Optical Networks Build an Integrated Security & Compliance Foundation for Government and Enterprises

As digital services for government agencies and enterprises become increasingly networked and cloud-native, networks have evolved from simple data transmission infrastructure into a core foundation supporting office operations, business systems, data exchange and production collaboration. Any security vulnerability in the network may disrupt daily operations and trigger leaks of critical data or business outages.

Consequently, a growing number of government and corporate organizations are re-evaluating their cybersecurity construction in line with Classified Protection 2.0 requirements. Classified Protection 2.0 is not merely about adding more security appliances. It builds a systematic protection framework covering secure communication networks, security zone boundaries, secure computing environments and security management centers.

For government and enterprise campuses, the real challenge lies in meeting the security requirements of classified protection without overcomplicating the network architecture. Integrating security capabilities into network infrastructure has become a key direction for implementing Classified Protection 2.0.

I. Three Core Cybersecurity Issues to Resolve First for Government & Enterprise Campuses under Classified Protection 2.0

1. Complex network architecture makes security boundaries harder to manage
   Government and enterprise campuses typically host multiple networks for office work, business systems, security monitoring, visitors and video conferencing. Traditional copper-based networks feature abundant equipment and intricate links, creating numerous scattered access points across different zones.

As business services expand, the network security perimeter expands accordingly. Without proper isolation and access control between different services, a compromised terminal may enable attackers to move laterally within the internal network.

Classified Protection 2.0 emphasizes the construction of secure communication networks and security zone boundaries. Essentially, it requires networks to not only maintain connectivity but also clearly divide security domains and control cross-zone access. Mandatory capabilities include network architecture governance, communication security, boundary protection, access control, intrusion prevention and security auditing.

1. Growing number of terminals complicates unified identity and permission management
   Campus networks now connect far more than office PCs. Printers, cameras, access control devices, conference hardware and various IoT terminals all require network access.

With the old “plug-and-play” access model, network administrators struggle to identify device ownership, define permitted access scopes, and respond rapidly to anomalies.

Especially within government and enterprise campuses, frequent staff transfers and differentiated data access permissions across departments make fine-grained management difficult with traditional network segmentation alone.

1. Disjointed security devices prevent closed-loop incident response
   Firewalls, intrusion prevention systems and log audit appliances each perform separate functions. However, fragmented management of networks, endpoints, security policies and logs often leads to a common pitfall: security appliances are deployed, yet they cannot work in concert.

Classified Protection construction focuses not on individual security products, but on establishing a complete system spanning both technical safeguards and management processes. Network operators need holistic development covering secure communication networks, security zone boundaries, secure computing environments and security management centers.

Therefore, government and enterprise campuses do not simply need to stack additional security products. They require an underlying architecture that establishes security boundaries at the network layer and supports continuous management and auditing.

II. Building Classified Protection Security Capabilities into Campus Networks with All-Optical Networks as the Foundation

Faced with complex business and security demands, Zhihui Guangxun adopts all-optical networks as the underlying architecture, integrating network connectivity, service isolation, endpoint admission, security defense and unified management. The network infrastructure itself becomes part of the security system.

1. Unified all-optical architecture clarifies network security boundaries
   Zhihui Guangxun’s all-optical network uses optical fiber as the primary transmission medium for campuses, reducing the operational burden caused by numerous aggregation devices and complex links in legacy copper networks. Within this unified architecture, network zones can be partitioned according to business needs to properly isolate networks for office, business systems, security monitoring and visitor services.

For multi-department, multi-building or multi-tenant campuses, zoning and access controls can be deployed aligned with business permissions to minimize unnecessary lateral access.

This is not just about separating networks. It creates clear network boundaries for subsequent access control, security auditing and policy enforcement, laying the groundwork for building secure communication networks and security zone boundaries required by Classified Protection 2.0.

1. Endpoint admission shifts focus from “identifying hardware” to “verifying identity”
   Security defense cannot only guard the network egress; security controls must be enforced at the point of endpoint access.

Zhihui Guangxun enables refined management of campus terminals via identity authentication, device recognition, ONU port binding and terminal whitelists. Dumb terminals such as cameras and access controllers are bound to designated ports to prevent unauthorized device replacement. For office endpoints, network access scope is controlled based on staff identities and business permissions.

Even with many access points, administrators can clearly define which devices connect, who may use them, and what resources they can access, pushing access control down to the network access layer.

1. Multi-layer security protection at network boundaries blocks external attacks
   After network zoning is completed, security defenses must be established against external attacks and abnormal internal behavior.

Leveraging security capabilities such as the Mengxiang Gateway, Zhihui Guangxun builds multi-layer protection including firewalls, IPS, WAF and malware detection at campus egress points. IPS identifies and blocks network attacks, while WAF protects web services such as OA, ERP and enterprise portals, mitigating risks posed by common web attacks targeting core business systems.

This creates a multi-tier defense system stretching from network boundaries to business applications, enabling robust attack protection while maintaining inter-service connectivity for campus networks.

1. Zero trust combined with all-optical networks delivers granular permission control
   For government and enterprise campuses, access to the internal network should not grant unrestricted access to all resources.

Zhihui Guangxun integrates zero-trust principles on top of the all-optical network, enabling dynamic authorization based on user identity, terminal status and accessed services. Employee access to OA, financial systems and R&D resources is limited to business-required permissions; visitor terminals are confined within predefined access ranges.

By enforcing least privilege and continuous identity verification, the model transitions from trusting “network location” to trusting “identity and permissions”, further mitigating risks of internal privilege escalation and lateral attacks.

1. Converged connectivity & security safeguards transmission of critical data
   For government, finance and core enterprise business scenarios, network security is not only about blocking external intrusions but also ensuring data safety during transmission.

For cross-building, cross-campus and cross-region data transmission, Zhihui Guangxun adopts the converged connectivity-security concept to jointly plan communication and cryptographic security capabilities, ensuring both stability and security of data transmission.

Transmission of OA, ERP, business databases and other important data can be encrypted according to business security requirements, enhancing confidentiality and integrity for data in transit. This addresses the weakness of traditional network builds that prioritize connectivity over data security.

Classified Protection implementation is not a one-time project. After network reconstruction and device deployment, organizations still require ongoing asset management, policy adjustment, security monitoring, log auditing and anomaly response.

Zhihui Guangxun’s unified management platform centrally governs all-optical networks, network hardware, terminals and related policies, incorporating distributed network resources into a unified O&M system. Access permissions can be promptly updated upon staff changes; new devices are onboarded following predefined policies; abnormal terminals or network faults can be located using network status and log records.

This means Classified Protection is no longer a last-minute equipment upgrade before assessments. Security capabilities are embedded into daily network operations, forming a long-term closed loop covering network architecture, security policies, endpoint management and O&M auditing.

FAQ

Q: What new requirements does the updated Classified Protection 2.0 impose on enterprise networks?
A: GA/T 2380-2026, effective in June 2026, establishes data security as an independent control domain for the first time. It mandates classified data management, mandatory national cryptographic encryption for important data, micro-segmentation control for east-west traffic, tamper-proof separated storage of audit logs, and brings emerging scenarios including AI/large model systems, industrial internet and 5G private networks under regulatory oversight.

Q: What is the difference between slicing isolation on all-optical networks and traditional VLANs?
A: Traditional VLANs rely on manual configuration switch by switch, prone to omissions and forged tags. Slicing isolation for all-optical networks operates at the optical layer; different service domains are separated at the protocol level without continuous manual configuration. Even if attackers compromise an office terminal, they cannot find a physical path to reach production systems.

Q: How long must logs be retained?
A: Classified Protection Level 3 requires log retention for 12 months, and Level 2 requires 6 months. Zhihui Guangxun’s solution embeds log collection and retention within the unified management platform, delivering complete, tamper-resistant log fields that meet traceability requirements for internet behavior specified in Ministry of Public Security Order No.176 and Classified Protection 2.0.