Method for realizing network micro-isolation based on zero-trust idea

Abstract

The invention discloses a method for realizing network micro-isolation based on a zero-trust idea, and relates to the technical field of IT networks and security. The method specifically comprises the following steps: component design: comprising four components, namely a client, a relay, a server and a controller; according to the invention, the isolated minimum network area can be configured on demand and can be simplified to a client and a server which are connected with the same network in a minimum unit, the client and the server are in peer-to-peer design, roles can be converted on demand, uniform configuration can be carried out on the controller, the client can be converted into the server, the server can also be converted into the client, and the user experience is improved. And fine-grained access control based on the user identity and the equipment identity is supported, so that higher security guarantee is provided. However, the current mainstream method can only provide IP and port-level network ACL configuration, cannot go deep into the isolation of a client and a minimum unit, and is difficult to cope with the fine-grained network isolation requirement under the same network segment, so that the internal network is very easy to be transversely permeated once being lost.

Images