Intranet data anti-leakage method based on zero trust and related device

Abstract

The invention discloses an intranet data anti-leakage method based on zero trust and a related device, and belongs to the technical field of information technology and data security. The method comprises the following steps: identifying mainboard information of terminal equipment through a desk management module, limiting all unauthorized data external transmission paths, and only allowing internal white list software to be installed; an isolation wall of an intranet and an extranet is established through a network isolation module, only one network is allowed to exist at the same time, a client is deployed at a credit granting terminal and is bound with a credit granting account, and a gateway end verifies a user identity through a security center and gives a corresponding access right; the flow management and control module is used for limiting the intranet flow to only access the white list website; through an outgoing approval module, mail outgoing is allowed and file outgoing parameters are set only after approval is passed; and single management and control of an external transmission path of intranet data and blocking of a secret divulging behavior are realized. Through real-time control and safety supervision, file protection and leakage prevention of intranet data can be achieved, operation is convenient and fast, and applicability is achieved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information technology and data security, and particularly relates to an internal network data leakage prevention method based on zero trust and a related device. BACKGROUND

[0002] Data leakage refers to an event in which sensitive, confidential or protected data is accessed, disclosed, disseminated or lost without authorization. Such events can be caused by technical vulnerabilities, human errors, internal malicious behavior or external attacks, and the consequences are often widespread and destructive. At present, enterprise-level network architecture is mainly divided into internal network environment and external network environment. In the internal network environment, enterprise internal resources can be accessed, and the access range of sensitive data is strictly limited according to role allocation. To some extent, the internal network and the external network are logically isolated and do not communicate with each other. For roles such as business staff, it is difficult to avoid accessing internal network resources while using the external network, which leads to internal horizontal traffic flow, and may cause the business staff to leak the accessed internal network data through various channels such as mobile storage media, external networks and Bluetooth.

[0003] For internal network data protection, the mainstream approach is to use different networks to isolate according to the sensitivity level of data, such as dividing different subnets, limiting access between different departments, or using firewalls, VPNs and other methods to control data flow between internal and external networks. Generally, encryption methods are used to control access between different departments. However, overly strict isolation may affect work efficiency and is complex to maintain, and internal personnel can still leak data if they have permission. In addition, auditing and monitoring are used to record user operation logs and conduct regular audits to detect abnormal behavior. However, the amount of log data may be large, making analysis difficult, and real-time performance is not sufficient, which may not be able to prevent leakage in a timely manner.

[0004] In summary, the current leakage prevention method cannot timely discover and prevent leakage behavior, may affect work efficiency, produce large amounts of log data, make it relatively difficult to trace the source of leakage, and is not convenient to maintain. The effectiveness of leakage prevention needs to be further optimized. SUMMARY

[0005] The application provides an internal network data leakage prevention method based on zero trust and a related device, aiming to solve the problem that the current leakage prevention method cannot timely discover and prevent leakage behavior, may affect work efficiency, produce large amounts of log data, make it relatively difficult to trace the source of leakage, and is not convenient to maintain, and the effectiveness of leakage prevention needs to be further optimized.

[0006] To achieve the above purpose, the application adopts the following technical solutions: The application provides an internal network data leakage prevention method based on zero trust, comprising the following steps: S1, identify the mainboard information of the terminal device through the desk pipe module, disable all unauthorized software installation, only allow installation of preset internal whitelist software, disable all non-whitelist software installation of unauthorized data transmission channels; S2, based on the access control of the desk pipe module, isolate the internal network from the external network through the network isolation module, and establish an isolation wall between the internal network and the external network; the client of the network isolation module is deployed on the trusted terminal and is bound with the trusted account, the gateway end verifies the user authority through the security center, and the security center continuously monitors and verifies the trusted state of the trusted terminal; S3, based on the isolation channel between the internal network and the external network, limit the internal network traffic to only access the whitelist website through the traffic control module, and only allow the transmission of the external traffic through the enterprise authenticated secure mailbox; S4, based on the request transmitted through the SMTP protocol of the secure mailbox, intercept through the external transmission approval module, only allow the external transmission of the mail after the approval and set the file transmission parameters; finally realize the single control of the external transmission channel of the internal network data and the blocking of the leakage behavior, and continuously monitor the external mail.

[0007] In some embodiments, in S1, disabling all non-whitelist software installation of unauthorized data transmission channels includes: mobile storage medium, Bluetooth, WiFi, optical drive and USB file transmission function.

[0008] In some embodiments, in S2, the network isolation module includes: a client deployed on the terminal and a gateway end deployed on the network boundary; the trusted state specifically includes: network IP and physical address, device security state, login user identity and device binding quantity.

[0009] In some embodiments, in S3, the traffic control module limits the internal network traffic to only access the whitelist website, and only allows the transmission of the external traffic through the enterprise authenticated secure mailbox, specifically including: packet capture identifies access target IP address, URL, prohibits non-whitelist website traffic through the boundary area.

[0010] In some embodiments, in S3, in the case of external traffic accessing internal network resources, the security of the external traffic and the legality of the whitelist need to be verified.

[0011] In some embodiments, in S4, the external transmission approval module includes an application end and an approval end; the user submits the external transmission application through the application end, and the approval end authorizes the sending after checking the target mail and file content; after the approval, record the whole process operation log to the audit record, the log covers file operation, user behavior and network activity.

[0012] In some embodiments, in S4, setting file transmission parameters includes: configuring file survival time, prohibiting copying and prohibiting printing through key management.

[0013] The application also provides a zero-trust-based internal network data leakage prevention system, which comprises a desk pipe module, a network isolation module, a traffic control module and an external sending approval module. The desk pipe module is used to identify the mainboard information of the terminal device through the desk pipe module, disable the installation of all unauthorized software, and only allow the installation of preset internal whitelist software. The network isolation module is used to isolate the internal network from the external network based on the access control of the desk pipe module, and establish an isolation wall between the internal network and the external network. The traffic control module is used to limit the internal network traffic to only access the whitelist website based on the isolated channel between the internal network and the external network, and only allow the transmission of the external traffic through the enterprise- authenticated secure mailbox. The external sending approval module is used to intercept the request based on the SMTP protocol transmission of the secure mailbox, and only allow the external sending of the email and set the file external sending parameters after the approval.

[0014] The application also provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor.

[0015] The application also provides a computer readable storage medium, which stores a computer program, and the computer program is executable on the processor to realize the steps of the zero-trust-based internal network data leakage prevention method.

[0016] Compared with the prior art, the zero-trust-based internal network data leakage prevention method and related device have the following advantages: The application discloses a zero-trust-based internal network data leakage prevention method, which recognizes the mainboard information of a terminal device through a desk-tube module, binds a hardware source, disables unauthorized external transmission channels and non-whitelist software, and physically blocks leakage from the source; the dynamic isolation channel of the terminal state is continuously verified by a security center in combination with whitelist website restriction to ensure minimum access permission; SMTP protocol is forced to be approved and intercepted, and parameters such as survival time and prohibited duplication are added to the external file to prevent secondary transmission.

[0017] The application controls the transmission channel of internal network data files through a timely and traceable internal network data leakage prevention method, ensures safe data transmission, prevents unauthorized personnel from accessing and transmitting, and can be applied to the process of transmitting more data externally, and only one way is allowed to send by controlling the external transmission channel of internal network data, and unauthorized sensitive information transmission is intercepted and blocked to achieve the purpose of internal network data leakage prevention, especially in a mixed office scenario, the boundary between internal network and external network is not clear, and a defense mechanism is provided for internal network attacks and personnel data active leakage behavior, which has certain effectiveness.

[0018] The computer device of the application can efficiently implement the steps of the method of the application by executing a specific computer program through a processor, and can accurately perform numerical calculation and logical judgment when performing data processing tasks, so as to ensure the accuracy and consistency of the data processing results. The computer readable storage medium of the application can easily load the programs into any compatible computer device and execute them without reprogramming or code conversion by programming the steps of the method of the application into a computer program and storing it on a computer readable storage medium, thereby improving the convenience and flexibility of program execution. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings for the specification are used to provide a further understanding of the application, and form a part of the application. The schematic embodiments of the application and their descriptions are used to explain the application, and do not constitute an improper limitation on the application.

[0020] Figure 1 The application discloses a zero-trust-based internal network data leakage prevention method, which recognizes the mainboard information of a terminal device through a desk-tube module, binds a hardware source, disables unauthorized external transmission channels and non-whitelist software, and physically blocks leakage from the source; the dynamic isolation channel of the terminal state is continuously verified by a security center in combination with whitelist website restriction to ensure minimum access permission; SMTP protocol is forced to be approved and intercepted, and parameters such as survival time and prohibited duplication are added to the external file to prevent secondary transmission. Figure 2 The application discloses a zero-trust-based internal network data leakage prevention method, which recognizes the mainboard information of a terminal device through a desk-tube module, binds a hardware source, disables unauthorized external transmission channels and non-whitelist software, and physically blocks leakage from the source; the dynamic isolation channel of the terminal state is continuously verified by a security center in combination with whitelist website restriction to ensure minimum access permission; SMTP protocol is forced to be approved and intercepted, and parameters such as survival time and prohibited duplication are added to the external file to prevent secondary transmission. DETAILED DESCRIPTION

[0021] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will be combined with the accompanying drawings for clear and complete description of the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative work are within the scope of protection of the present application.

[0023] It should be noted that, in this document, the terms "comprise", "comprising", or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or apparatus that includes a list of elements not only includes those elements, but also includes other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, the element defined by the statement "comprises a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0024] It should be noted that the devices and methods disclosed in the embodiments herein can also be implemented in other ways. The device embodiments described above are only illustrative, for example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architecture, function and operation of the devices, methods and computer program products according to the embodiments herein. In this regard, each block in the flowchart or block diagram can represent a module, program segment or part of code, which includes one or more executable instructions for implementing the specified logical function, and which includes one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from that shown in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0025] In addition, each functional module in each embodiment herein can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0026] The application discloses a zero-trust-based internal network data leakage prevention method, which comprises the following steps: S1, recognizing the mainboard information of the terminal device through a desk pipe module, disabling the installation of all unauthorized software, allowing only the installation of preset internal whitelist software, and disabling the installation of non-whitelist software of all unauthorized data transmission channels; S2, based on the access control of the desk pipe module, isolating the internal network from the external network through a network isolation module, and establishing an isolation wall between the internal network and the external network; the client end of the network isolation module is deployed on the trusted terminal and is bound with the trusted account, the gateway end verifies the user authority through a security center, and the security center continuously monitors and verifies the trusted state of the trusted terminal; S3, based on the isolated channel between the internal network and the external network, limiting the internal network traffic to only access the whitelist website through a traffic control module, and allowing the external traffic to be transmitted only through the enterprise- authenticated safe mailbox; S4, based on the request transmitted through the SMTP protocol of the safe mailbox, intercepting through an external transmission approval module, allowing the mail to be externally transmitted only after the approval and setting the file external transmission parameters; finally, realizing the single control of the external transmission channel of the internal network data and the blocking of the leakage behavior, and continuously monitoring the externally transmitted mail.

[0027] When the internal network accesses the external network, if no control is added, the staff may inadvertently send the file containing the business secret to the irrelevant personnel, or copy the customer data, financial data and the like without permission and take them away, so that the business secret loses the competitive advantage and brings huge economic loss to the enterprise. In the traditional method for dividing different networks based on the zero-trust architecture, the data may still be leaked by the personnel with the internal permission through various channels, and the leakage behavior cannot be timely blocked and the data cannot be prevented from being leaked due to negligence. In the zero-trust-based internal network data leakage prevention method provided by the application, the above problems can be solved by controlling the transmission channel of the file data, the network traffic control, the log auditing and the watermark reminding.

[0028] In some embodiments, the zero-trust-based internal network data leakage prevention method can control the transmission channel of the internal network data to the outside, effectively and timely prevent the internal leakage behavior, and prevent the unauthorized personnel from accessing and spreading.

[0029] Further, the zero-trust-based internal network data leakage prevention method of the present application is not limited by the hierarchical division of network architecture, and supports mainstream operating systems such as Windows, macOS, Android, iOS, etc. In the actual disclosure, in addition to the method of sending and approving externally to control data transmission means, the internal network data leakage prevention method of the present application also includes software installation disabling, mobile storage medium disabling, non-whitelist website access restriction, file encryption, etc.

[0030] The present application also provides a zero-trust-based internal network data leakage prevention system, which comprises a desktop management module, a network isolation module, a traffic control module and an external sending approval module, wherein: The desktop management module is used to identify the mainboard information of the terminal device through the desktop management module, disable the installation of all unauthorized software, and only allow the installation of pre-set internal whitelist software, and disable the installation of non-whitelist software for all unauthorized data transmission channels. The network isolation module is used for access control based on the desktop management module, and the internal network and the external network are isolated through the network isolation module, and an isolation wall between the internal network and the external network is established. The client of the network isolation module is deployed on the trusted terminal and is bound to the trusted account, and the gateway end verifies the user authority through the security center, and the security center continuously monitors and verifies the trusted state of the trusted terminal. The traffic control module is used to limit the internal network traffic to only access the whitelist website through the traffic control module, and the external traffic is only allowed to be transmitted through the enterprise- authenticated secure mailbox. The external sending approval module is used to intercept the request based on the SMTP protocol transmission of the secure mailbox through the external sending approval module, and only allows the external sending of the email after the approval and sets the file external sending parameters. Finally, the single control of the external transmission channel of the internal network data and the blocking of the leakage behavior are realized, and the externally sent email is continuously monitored.

[0031] As shown in Figure 1 The internal network data leakage prevention system of the present application can be divided into four levels, namely the access layer, the environment layer, the data layer and the foundation layer. Based on the zero-trust architecture, all personnel are considered untrusted, and all terminal running logs and terminal behavior logs are recorded in real time through the strategy. Based on the zero-trust, the user identity, practice and device state are controlled. The dynamic security architecture is centered on people, and the application authorization and control are applied in all scenarios, covering the security control strategy of internal and external applications, desktop control, virtual applications and protocol interception. The user can conveniently access in any device and any location while ensuring the security of any application and data. Based on the visitor identity, fine-grained authorization and control can be performed, the context state is monitored and dynamic strategy adjustment is performed to prevent data leakage.

[0032] In the anti-leakage system of the application, the computer host mainboard device is first recognized by the desk pipe module in the anti-leakage system, all host mobile storage media, Bluetooth, WiFi, optical drive, USB file transmission and all other ways that can directly or indirectly transmit files out are disabled, only wired network form is reserved for file transmission, and unauthorized ways of directly obtaining internal network data are blocked. At the same time, the desk pipe module disables all software installation and only allows internal whitelist software installation to prevent transmission through some unknown software. The method of the application can effectively control the way of internal network data file transmission, and screen watermarking and printing document watermarking are used to improve the awareness of personnel anti-leakage, achieve internal network data file protection and prevent unauthorized personnel access. For the case of a large number of internal network computers, the application only needs to issue a control platform to achieve good effect and convenient operation. The application improves the internal network data file leakage problem through real-time control and safety supervision, and has practical significance.

[0033] As shown in Figure 2 The whole process of the file transmission to the Internet is shown in the figure. After the anti-leakage system is deployed on the controlled terminal computer, the system will automatically take over the control center of the computer, identify and control the main control device and peripheral device in real time, count the software and hardware assets, disable the mobile storage medium and disable the external network to access the whitelist website. Before initiating the transmission operation, the user needs to pass through the login verification and account verification double identity verification to ensure the legality of the operator. The device control and network isolation are synchronized to take effect, only authorized devices are allowed to access the network, non-authorized terminal access is limited, and the risk of leakage is reduced from the source. At the same time, a watermark is added to track the source of leakage through visual identification. For emails that do not pass the transmission approval, the transmission approval control module of the anti-leakage system will intercept the protocol, block and warn high-risk transmission protocols, and strengthen the transmission compliance. The system automatically records the whole process of operation in the audit record, covering file operation, user behavior and network activity, providing a basis for subsequent tracing, forming a closed-loop protection system of pre-prevention, in-control and post-audit, ensuring compliance and traceability. The process balances efficiency and safety through multi-level technology and management measures, effectively balances business needs and data anti-leakage requirements.

[0034] The application separates the internal network and the external network by the network isolation module in the internal network data leakage prevention system as a partition wall. The network isolation module is divided into a client and a gateway end. The client is installed in a trusted terminal, and the user is allowed to log in by binding the client trusted account. The gateway end obtains the corresponding rights and resources of the user by the security center verification. The security center continuously judges the trusted state of the terminal, including the network IP and the address, the security state, the logged-in user, etc. The network isolation module isolates the internal network and the external network. Only when the file needs to be sent out, the external network needs to be switched to, and the file is sent out through the external mailbox approval and the trace is left. The traffic control module is deployed and installed in the boundary area of the network architecture, and is used for controlling the access right of the internal traffic to the outside world. Generally, the white list website is set, the IP destination and the accessed server address of the website are identified by packet capture, and the exclusion method is used to prohibit the non-permitted website from reaching the external network through the boundary area. Similarly, if the external traffic needs to access the internal network resource, the traffic is verified to be safe and reliable and in the white list. Through the limitation of the traffic control module, the only way for the internal network to send out is the enterprise certified secure mailbox method.

[0035] The application blocks the SMTP protocol of the external approval module, and continuously monitors the external email. Only the approved email is allowed to be sent. The external approval module is divided into an application end and an approval end. The ordinary user logs in the application end of the external approval module. When the file needs to be sent out, the application end is filled in and the target email and the sent file are specified. The approval person can check the application status in the approval end. After checking that the target email and the sent file are correct, the sending is agreed, and the email can be sent out. Otherwise, the SMTP request is intercepted by the module to prevent the email from being sent. After the approval, the file sending parameters can be set through the key management, including the file survival time, whether to allow copying, printing, and screenshot operation.

[0036] The application is described with reference to the flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can also be stored in the computer readable storage medium to guide the computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer readable storage medium produce the products including the instruction device, which realizes the functions specified in one or more flows or blocks in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.

[0037] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 Figure 1

[0038] Finally, it should be noted that the above-described embodiments are merely possible implementations of the present application, but are not in any way intended to limit the present application; anyone with ordinary skill in the art can easily implement the present application according to the description and the above description, and any equivalent changes, modifications and evolutions made by using the above disclosed technical content are equivalent embodiments of the present application; at the same time, any equivalent changes, modifications and evolutions made to the above embodiments according to the essence of the present application are still within the protection scope of the technical solutions of the present application.​​

Claims

1. A zero-trust-based method for preventing data leakage in intranets, characterized in that, Includes the following steps: S1. Identify the motherboard information of the terminal device through the desktop management module, disable the installation of all unauthorized software, allow the installation of only preset internal whitelist software, and disable the installation of non-whitelist software through all unauthorized data transmission channels. S2. Access control based on the desktop management module isolates the internal network from the external network through the network isolation module and establishes a firewall between the internal network and the external network; the client of the network isolation module is deployed on the authorized terminal and bound to the authorized account, and the gateway verifies user permissions through the security center, which continuously monitors and verifies the trusted status of the authorized terminal; S3. Based on the isolation channel between the internal network and the external network, the traffic control module restricts internal network traffic to access only whitelisted websites, and outgoing traffic is only allowed to be transmitted through enterprise-certified secure email addresses. S4. Requests transmitted based on the secure email SMTP protocol are intercepted by the outbound approval module. Only after approval is granted are emails allowed to be sent out and file outbound parameters are set. Ultimately, this achieves single-channel control over the external transmission of internal network data and blocks leakage behavior, while continuously monitoring outbound emails.

2. The method for preventing data leakage in an intranet based on zero trust as described in claim 1, characterized in that, In S1, disabling the installation of non-whitelisted software through all unauthorized data transfer channels includes: removable storage media, Bluetooth, WiFi, optical drives, and USB file transfer functions.

3. The method for preventing data leakage in an intranet based on zero trust as described in claim 1, characterized in that, In S2, the network isolation module includes: a client deployed on the terminal and a gateway deployed at the network boundary; the trusted status specifically includes: network IP and physical address, device security status, logged-in user identity, and number of devices bound.

4. The method for preventing data leakage in an intranet based on zero trust as described in claim 1, characterized in that, In S3, the traffic control module restricts intranet traffic to access only whitelisted websites, and outgoing traffic is only allowed to be transmitted through enterprise-certified secure email addresses. Specifically, this includes: packet capture to identify the target IP address and URL, and prohibiting traffic from non-whitelisted websites from passing through the boundary area.

5. The method for preventing data leakage in an intranet based on zero trust as described in claim 1, characterized in that, In S3, when external traffic accesses internal network resources, it is necessary to verify the security of the external traffic and the legitimacy of the whitelist.

6. The method for preventing data leakage in an intranet based on zero trust as described in claim 1, characterized in that, In S4, the outbound approval module includes an application end and an approval end; users submit outbound applications through the application end, and the approval end authorizes the sending after checking the content of the target email and file; after approval, the entire process operation log is recorded to the audit log, which covers file operations, user behavior and network activities.

7. The method for preventing data leakage in an intranet based on zero trust as described in claim 1, characterized in that, In S4, setting file outgoing parameters includes: managing the configuration file's lifespan via key management, prohibiting copying, and prohibiting printing.

8. The system upon which the zero-trust-based intranet data leakage prevention method according to any one of claims 1-7 is based is characterized in that, The system includes a desktop management module, a network isolation module, a traffic control module, and an outbound approval module, wherein: Desktop Management Module: Used to identify the motherboard information of terminal devices, disable the installation of all unauthorized software, allow the installation of only preset internal whitelisted software, and disable the installation of non-whitelisted software through all unauthorized data transmission channels; Network isolation module: Used for access control based on the desktop management module. It isolates the internal network from the external network and establishes a firewall between the internal and external networks. The client of the network isolation module is deployed on the authorized terminal and bound to the authorized account. The gateway verifies user permissions through the security center. The security center continuously monitors and verifies the trusted status of the authorized terminal. Traffic control module: Used to isolate the internal network and external network. The traffic control module restricts internal network traffic to access only whitelisted websites, and outgoing traffic is only allowed to be transmitted through enterprise-certified secure email addresses. Outbound approval module: Requests transmitted via the secure email SMTP protocol are intercepted by the outbound approval module. Only after approval is granted are emails allowed to be sent out and file outbound parameters are set. Ultimately, this achieves single-channel control over the external transmission of internal network data and blocks leakage, while continuously monitoring outbound emails.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the zero-trust-based intranet data leakage prevention method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the zero-trust-based intranet data leakage prevention method as described in any one of claims 1-7.

Images