EP1470685A1

EP1470685A1 - Secure network architecture

Info

Publication number: EP1470685A1
Application number: EP02754937A
Authority: EP
Inventors: Abolhassan Agha; Michael Höhre
Original assignee: Agha Abolhassan; Hohre Michael
Current assignee: Agha Abolhassan; HOEHRE, MICHAEL
Priority date: 2001-07-31
Filing date: 2002-07-25
Publication date: 2004-10-27
Also published as: DE10234562A1; WO2003015372A1; DE10234562B4

Abstract

The invention relates to a communication network, a corresponding communication method and a communication module. The communication network comprises a first server group, at least one second server group and a first communication path between the first and second server group. The aim of the invention is to provide a communication network, a communication method and a communication module for use in a communication network, which, in particular, significantly reduce the possibilities for misuse of the data of a user of a communication network. The above is achieved, whereby the first communication path comprises a connection module for establishing and maintaining a first communication connection and the communication module is embodied such as to permit the use of a service provided in the first server group by the second server group, but not the use of a service provided in the second server group by the first server group.

Description

Secure network architecture

The present invention relates to a communication network, a method for carrying out communication in the communication network and a communication module for use in the communication network.

A brief look at the classic Internet clearly shows its weaknesses, security deficiencies and architectural problems. All servers, workstations etc. or existing networks, which are permanently or temporarily (dynamically) connected to the Internet, are briefly referred to below as nodes. This results in the following simplified picture of the classic Internet: If you connect a node to the Internet, this node is basically connected to all other nodes on the Internet. In principle, each node can establish a connection with any other node. This is completely independent of whether the two nodes are in a service relationship that is desired by both node operators or not. This openness goes far beyond the actual communication benefits. Your abuse can only be restricted by self-protection measures of individual nodes or node groups against the rest of the network.

Since everyone can be reached by everyone and therefore also by potential attacks, and there is almost nothing at the network level that a node could rely on, there is only the possibility of comprehensive, node-specific self-protection. Theoretically, this would have to be constantly updated in real time using current attack techniques: a completely hopeless undertaking. Exactly considered, it is a construction problem that allows limitless communication globally and almost unregulated and refers security issues in the area of node-related isolated solutions (firewalls, intrusion detection systems etc.).

Protective measures differentiated based on the identity of the external node cannot be implemented since the identity of the external node cannot be trusted. In this way, node users can falsify the identity of the node (so-called IP address spoofing). In addition, nodes maliciously compromised by strangers can be used to disguise the identity or to use the compromised node as the starting point for an attack (e.g. for so-called distributed denial of service attacks).

Outside your own fortress in the form of firewalls, intrusion detection systems and the like. A. Protection mechanisms, there is nothing a node that provides services can rely on. The operators of attack-attractive nodes therefore try to protect their nodes with all-round armor. As already mentioned, this armor would always have to be updated theoretically in real time using the currently known attack techniques. With the ever shorter innovation cycles in the IT area and against the background of the creative and innovation potential to be found in the hacker environment, this is hardly possible anymore.

The security mechanisms used can therefore only moderate the problem. A use of language that can also recently be found in relevant literature on the subject of security, where strikingly often (and honestly) of mitigate and no longer of prevent. A security guarantee is in principle impossible.

It is therefore also clear that the Internet is unsuitable for the application service providing of business-critical applications, among other things, because, in relation to a closed private network, it can only take insufficient account of legitimate security concerns of the user or customer.

Here, the technical globalization of the Internet has left the corresponding processes of international legal regulations far behind. Regulations only exist from the technical operational environment in the form of so-called RFCs. Example RFC 2827: tries to restrict the falsification of source addresses. This RFC is classified in the Best Current Practice category and is therefore only a recommendation.

In order to remedy these problems, alternative security approaches based on the classic Internet have been developed. The key words at this point are: Public Key Infrastructures (PKI), Secure Socket Layer (SSL), Virtual Private Networks (VPN), IP See etc. In order to avoid a comprehensive differentiated discussion of the topic at this point, a practical solution should be used , which uses the essential technologies in combination, are selected as examples:

A respected German fixed network operator offers its large customers so-called intelligent networks e.g. to operate origin-dependent service numbers that the major customer can administer independently via the Internet. Misuse of the administration access would make it possible, e.g. to permanently connect the customer's entire call center infrastructure with the local telephone counseling - at the push of a button. Since this is a business-critical application, the provider tries to take this into account in the form of the following solution:

The provider issues a certificate to the major customer, which is sent to the major customer via diskette (ie beyond the Internet), and there in the browser of the Large customers must be installed. The certificate can only be activated by a password, which is also sent separately. The administration service is accessed via an encrypted connection of adequate key length. If you look at the chain consisting of browser, internet connection and administration server and assume that the technology used was implemented without errors (eg no starting points for buffer overflow attacks), there is not necessarily a reason to be concerned given this horizon.

As is well known, every chain is only as strong as its weakest link. For this purpose, the observation horizon is expanded slightly. If it is assumed that the fixed network operator has adequately secured the administration server, the opposite communication end point, the major customer's browser, is considered. Here, for example, there is a browser from Netscape® (as requested by the provider) on an operating system from Microsoft®. Placing a so-called trojan on this page, which extends the user interface functions of the operating system with external docking options (sometimes also referred to as remote maintenance software), could easily cause unpleasant surprises here, although the theoretical principle of certificate-based, encrypted communication between browser and administration server certainly does would be classified as safe. The probability of such an attack is multiplied by the number of nodes from which this server can be reached directly but also indirectly.

The present invention is therefore based on the object of providing a communication network, a communication method and a communication module for use in a communication network which does not have the above-mentioned disadvantages or at least to a lesser extent and in particular the possibilities of misuse of the data of users of a communication network significantly reduced.

This object is achieved by the communication network according to claim 1, the communication method according to claim 6 and the communication module

Claim 12 solved. The sub-claims contain further refinements of the Communication network or the communication process. A user is to be understood as a node here.

The present invention is based on the following idea:

Electronically stored data are usually stored on a data carrier (hard disk, CD, chip card, memory, etc.). The data is accessed by a program that controls a read / write device suitable for the respective storage medium. Such a program is usually integrated into an operating system that enables potential users to access the data in the form of so-called services. For example, a user of a computer in a so-called network-transparent file system can access his local data, i.e. use the data stored on his computer in the same way as data that is actually stored on another computer. The data of the remote computer are accessed by the operating system of the local computer using the corresponding services of the operating system of the remote computer on the basis of a communication protocol. The authorization to use the service on the remote computer is based on an identification of the requesting user or his computer. In such a system, unauthorized use of a service can take place on the remote computer by pretending the remote computer to have an incorrect identity.

The invention now provides according to claim 1, already at the network level to provide a communication module in the communication path (in the communication line) between a first server or a first server group and a second server or a second server group that only uses one in which allows the first server or the first server group existing service by the second server or the second server group, but not the use of a service existing in the second server or the second server group by the first server or the first server group.

According to claim 6, the invention provides a communication method for carrying out communication in a communication according to the invention. To provide onsnetzwerk, which is characterized in that the server groups exchange data via the or the communication channels and that the communication module decides on the authorization to access the service of a server group.

According to claim 12, the invention provides to create a communication module for use in a communication network according to the invention. The communication module is characterized in that it comprises a communication protocol that includes the identification of servers or server groups.

In this way, only directed relationships between servers or server groups are permitted at the network level. This makes it possible to only allow and establish desired service relationships. The identification of a server or a server group in the network used in this context is linked to a physical access feature, for example a dedicated line or a hardware identification that cannot be manipulated by software.

The invention offers the possibility of reducing misuse of the data of users of a data processing network by orders of magnitude, in particular if the connection establishment between a data processing infrastructure or server group; and an access-authorized node takes place exclusively at the instigation of the access-authorized node. In this way, it is prevented in a simple manner that a connection can be established between the first access-authorized node and a second access-authorized node via the data processing infrastructure without the other node having to do anything, via which an attack on the data of the other node could take place.

According to the invention it can therefore be provided that in a communication network, in particular in its communication path or communication line, an access module to enable access to an internal data processing infrastructure of the data processing center by an external user and the output of data from the internal data processing infrastructure to the user is available. The access module is designed such that a connection between the external user and the data processing infrastructure can only be initiated by the external user.

The authorization of the individual nodes can be obtained in a known manner via corresponding usage contracts, the conclusion of which is usually followed by a corresponding check or identification of the node operator of the respective node.

The invention makes it possible to restructure the classic Internet in the direction of an infrastructure which is structured based on service relationships and is hereinafter referred to as Application Service Infrastructure (ASI) on the basis of a network architecture which has been optimized in terms of security. The concept of application service providing, which is restricted by the business area, has to be interpreted broadly: An application service provider is therefore a person or organization that provides one or more services for another person or organization on the basis of a communication network. Perhaps the simplest example would be to publish a private homepage.

In the context of the use of services within the framework of an Application Service Infrastructure (ASI), the following functional roles can be differentiated:

- Application Service User (ASU): the actual user of the service,

- Application Service Customer (ASC): the operator of an access-authorized node concluding the service contract as the parent organization etc. of the Application Service User (ASU),

- Application Service Provider (ASP): the provider of a specific service.

The application service does not necessarily have to be provided by the operator of a data processing center. Rather can if necessary, another functional role can be identified, namely that of a so-called

- Application Service Infrastructure Provider (ASIP), which provides and operates the infrastructure, especially the data processing center.

In other words, it can also be provided that not only the Application Service User (ASU) come into question as the operator of an access-authorized node, but also the Application Service Provider (ASP). The Application Service Providers (ASP) provide a service in the data processing center and administer it as an external user of the data processing center via the connection to the data processing center. The separation of Application Service Provider (ASP) and Application Service Infrastructure Provider (ASIP) makes it possible to distribute the responsibility for the provision of applications (applications) to different companies and to separate them from the core responsibility for the infrastructure. The Application Service Infrastructure Provider (ASIP) can therefore focus on the further development of the infrastructure and a few services that can be operated in a standardized manner for all customers, such as Secure Internet access in the form of a so-called Secure Internet Gateway.

In return, the inclusion of various companies that already have the core competence of complex applications as Application Service Providers (ASP) enables faster growth of the service offering, which ultimately increases the attractiveness of the entire infrastructure for potential new users. At the same time, as the number of users increases, the attractiveness of the infrastructure for potential new Application Service Providers (ASP) increases. This creates a snowball effect that enables a more dynamic business model than is the case in the classic application service providing model with a provider that provides all services.

The data processing infrastructure can comprise a single access area or infrastructure area as a data processing structure, for example a single server or the like, to which the access-authorized nodes can access. However, the data processing structure can also as a network, similar to a LAN (Local Area Network). In order to be able to offer different services to different node operators, the data processing infrastructure preferably comprises several data processing structures (access areas, infrastructure areas). In this case, at least one access-restricted first data processing structure is preferably provided, the access module or a connection setup controller present in the access module then being designed to establish a connection between a node and the first data processing structure only in the case of an authorization of the node assigned to the first data processing structure in order to provide access only to appropriately authorized nodes to grant the first data processing structure or the services provided there.

If an application service provider (ASP) wants to administer a service made available in the data processing center via a connection to the data processing center, it can also be provided that at least one server is assigned two data processing structures, one of which provides the service and the other as administration access for the application service Provider (ASP) serves.

More preferably, several such first data processing structures or infrastructure areas are provided. The Application Service User (ASU) of the Application Service Customer (ASC) can then use the services of one or more Application Service Providers (ASP), which make them available in different first infrastructure areas of the data processing infrastructure, also referred to here as network safes.

Optionally, the Application Service Customer (ASC) can position so-called private services in the Application Service Infrastructure. Private services can e.g. B. have the character of a private network and can only be used by the Application Service Customer (ASC) himself or his Application Service User (ASU). In addition, the Application Service User (ASU) of the Application Service Customer (ASC) only has access to the services for which the Application Service Customer (ASC) has concluded a usage contract with the respective Application Service Provider (ASP). Only the Application Service User (ASU) of the Application Service Customer (ASC) can initiate a connection to a service node, ie to the data processing infrastructure or to a corresponding first infrastructure area of the same. The reverse direction is not possible. Thanks to the invention, the use of a service node by an Application Service User (ASU) of the Application Service Customer (ASC) is a directional relationship, ie it is guaranteed that the operator of the service node, conversely, does not have access to the customer's local IT infrastructure.

The same applies to the relationship of individual customers, i.e. H. Application Service Customer (ASC) among one another: According to the invention, it is ensured here that two Application Service Customer (ASC) who use the same service cannot mutually access the local IT infrastructure of the other Application Service Customer (ASC).

A basic idea of the invention is accordingly to provide services in separate rooms to the user. These rooms are formed by the first infrastructure areas (data processing structures), which are also referred to below as network safes. A network safe only connects servers or the like, which together provide a service and are in a relationship of trust with each other. The services provided by a network safe can only be used by authorized nodes or node groups, with the private resources of the nodes or node groups being protected against mutual access.

In the long term, the invention makes it possible to replace the previous approach of the almost unlimitedly open but security-deficient Internet, as well as the approach of completely closed networks, with a secure, standardized and flexible structure according to the invention that is based on explicit service relationships.

In preferred variants of the invention it is provided that the nodes are connected to the data processing infrastructure via a communication line exclusively assigned to the respective node and the Control of the establishment of the connection with the first infrastructure area is based on the respective assigned communication line.

In the network architecture according to the invention or the data processing center according to the invention, this is achieved in that for at least a number of communication lines assigned exclusively to a node in each case, an interface device of the data processing infrastructure assigned exclusively to the respective communication line is provided and a connection establishment control for access-based control of the connection establishment to the first infrastructure area in Dependence on the interface device is formed. In other words, only connections to the first infrastructure area are established via the connection establishment control, which are made via the communication lines or interface devices permanently assigned to them, which are assigned in a predetermined manner in accordance with access-authorized nodes. The assignment can only be modified by the operator of the data processing center or at his request.

The local IT infrastructures of the application service customer (ASC) in question are preferably connected in a dedicated manner to the data processing center, also referred to below as the network operation center (NOC), which provides the application service infrastructure (ASI), that is to say the data processing infrastructure. Dedicated connection here means that the local structures of the Application Service Customer (ASC) are provided with identification that cannot be manipulated by software. Dedicated lines are, for example, dedicated lines or connections with other physically anchored identification mechanisms. If several Network Operation Centers (NOC) are provided, the local IT infrastructures of the relevant Application Service Customer (ASC) are connected to the closest Network Operation Centers (NOC).

In this way, an assignment of the access authorization to a physical access to the data processing infrastructure is advantageously achieved, as a result of which the possibilities of attack and manipulation are increased by several sizes. Reduce orders of magnitude, as this would require actual access to the hardware on site.

In this way, the security problems existing at the network level in the classic Internet can be overcome in a simple manner, which result almost exclusively from the fact that the security mechanisms are based on the content of one or more data packets. As is known, such data packets can be generated and manipulated almost arbitrarily by appropriate software. In contrast, the security mechanisms of this preferred variant of the invention are based on simple chains, the first link of which is always anchored to the physical access path of a packet. Attacks on such anchored security mechanisms require, as mentioned, the attacker's direct personal access to the physical infrastructure on site. The number of potential attackers is thus reduced by several orders of magnitude compared to the classic Internet.

The check as to whether a connection set-up via a specific communication line is permitted or not can be carried out using simple lists which the connection set-up controller accesses and in which the access lines authorized for access for the respective first infrastructure area are stored.

As mentioned, the communication line is preferably a secure connection between the respective access-authorized node and the data processing center, for example a dedicated line or the like, which is not easily accessible for attacks or manipulation.

However, the invention can also be used in connection with other, less manipulation-proof communication lines, provided that an identification feature for the node that cannot be manipulated by software is present. The term communication line is intended not only to include a physical line, but also to include communication connections which establish communication at least in sections in some other way, for example radio-based. The advantages of the invention, in particular the Manipulation options can also be achieved here, albeit possibly to a lesser extent or with greater effort.

Provision can therefore also be made for the communication line to the data processing center to be radio-based at least in sections, as can be the case, for example, when accessing the data processing infrastructure from a mobile node.

With such an at least partially radio-based access (via GSM etc.) to the data processing infrastructure, despite a not inconsiderable effort, e.g. would be required to attack a GSM connection or to simulate an incorrect identity of the endpoint, but still uses a medium that is accessible to an attacker anonymously and without direct access to physical infrastructures. The use of fast frequency shift keying or encryption does not change this, since these forms of identification can also be manipulated by software. The fact that the size of a GSM cell is limited, which would make it easier for an attacker to locate it, does not lead to identification that cannot be manipulated by software.

The same applies to so-called landline-based access with an unidentifiable endpoint, e.g. B. access via modem based on an analog telephone connection to the access-authorized node. Here, too, there is usually no dedicated, i.e. H. verifiable connection path.

The invention does not offer any new solutions at this point. Existing so-called dial-in solutions must first be assessed from a security perspective. The selected solution is then to be integrated in a structurally harmonious manner. However, the operation of dial-in solutions in the context of a network architecture according to the invention also creates additional security here compared to a conventional infrastructure, in which a connection to the entire network may be established. In the network architecture according to the invention, the connected node is still only connected to the network safe (s) (first infrastructure areas) that have been released, but never to the entire network. Preferred variants of such dial-in solutions that can be implemented on their own or in combination can look as follows:

There are basically no anonymous dial-in options. When establishing a connection, the user in question must at least use a strong authentication procedure (e.g. based on RSA

Secure ID token). The network connection established after successful authentication is always encrypted.

- Connections are established in the so-called call-back procedure, in which the corresponding numbers or area codes are released for the user.

The dial-in server permanently assigns the source address of a dial-in connection to the user. The address ranges used can be distinguished from the address ranges of dedicated connections, so that more stringent security rules based on them can be used in the further course.

The mutual protection of various nodes connected to the infrastructure via dial-in is ensured by appropriate filtering and routing mechanisms.

The check as to whether a connection is established or not can be carried out for all access variants on the basis of any criteria that enable an unambiguous assignment to a specific communication line. For example, it can be provided that when an attempt is made to establish a connection to a first infrastructure area via a specific communication line by a device assigned to the communication line, a corresponding identification feature is passed on to the connection establishment control, on the basis of which the latter decides whether the connection is established or not.

In the case of preferred, particularly simple, and to be implemented variants of the invention, it is provided that the via a communication line data arriving from a node in the data processing center are provided with an identification feature uniquely assigned to the communication line. The connection establishment with the first infrastructure area is then controlled as a function of this identification feature.

In the network architecture according to the invention or the data processing center according to the invention, this is achieved in a simple manner by providing at least one identification device assigned to the respective communication line, which is used to identify data arriving in the data processing center with an identification feature clearly assigned to the communication line. The connection establishment control is then designed to control the connection establishment with the first infrastructure area depending on the identification feature. If there are several infrastructure areas, several identification features can be assigned accordingly.

In this variant, no additional sensors or the like are required; instead, the corresponding identification feature only has to be read out with devices which are generally present anyway and a decision is made on the basis of this identification feature whether the connection is to be established or not.

In the case of a simply constructed variant of the network architecture according to the invention or of the data processing center according to the invention, the identification device in question is assigned to an interface. For example, the marking device can be part of such an interface.

The identification feature can be assigned to the data in any manner. It is preferably carried out by means of a so-called network address translation (NAT), in particular a source network address translation (S-NAT), or a connection tracking module, which is preferably implemented in the network architecture according to the invention or the data processing center according to the invention in that the identification device is designed to assign the identification feature by means of Network Address Translation (NAT). As a result, the following requirements or advantages are achieved in a simple manner:

- The Application Service Customer (ASC) receives a source address that is clearly assigned to it and cannot be manipulated by software, which is thus used as the starting point for further access decisions.

The address space of the data processing center, i.e. the Network Operation Center (NOC), can be managed completely independently of the address space of the connected node or LAN.

In principle, there are no direct connections between different network safes. H. between the first infrastructure areas. In an embodiment of the network architecture or data processing center according to the invention, however, it can be provided that the data processing infrastructure comprises at least two first infrastructure areas (data processing structures) and at least one connection in the form of a second infrastructure area between the first infrastructure areas, via which the first infrastructure areas are connected , for example to administer the first infrastructure area with the help of a further first infrastructure area. The second infrastructure area can be a server, for example, which is connected to at least two first infrastructure areas. With regard to services provided cooperatively by various Application Service Providers (ASP), e.g. in the business-to-business (B2B) environment, there is the possibility that e.g. B. a server or the like through separate network interfaces with several first infrastructure areas, d. H. Network Safes. Misuse of the second infrastructure area or the server, as a general router between the network safes to which it is connected, is prevented by the aforementioned communication restrictions.

In order to achieve a network architecture that can be used as broadly and inexpensively as possible, a number of data processing centers that can be connected to one another via secure communication connections and at least one synchronization device are preferably provided, via which the data processing centers can be synchronized, so that in several data processing centers there are synchronized first infrastructure areas, ie network safes. This makes it possible, for example, to provide services for Application Service Customers (ASC) whose Application Service Users (ASU) are located at different locations. Thanks to the synchronization of the data processing centers, they can then access the nearest data processing center in a cost-effective manner.

In the long term, it must be taken into account here or it can be taken into account that a network safe can also be assigned to different network operation centers (NOC), H. Data processing centers, different operators can be distributed, so that here, too, higher-level organizational structures comparable to the classic Internet must exist or be provided, which are responsible for the administration of the address space.

The invention makes it possible to migrate to an alternative network architecture which, based on the weaknesses in the architecture of the classic Internet mentioned at the outset, primarily meets the following requirements:

The foundations of the network architecture or data processing center according to the invention are already designed such that in principle only the nodes can use the data processing infrastructure or the same areas of the data processing infrastructure, the node operators of which are in a desired service relationship with one another. The term service relationship is to be understood as a directional connection, so that private resources of all parties involved in the context of a service relationship are adequately protected. Example: User A uses a service from provider B; However, the private resources of user A are protected from access by provider B. The same applies in general to different users: Even if user A and user C use the same service, your private resources are mutually protected against unauthorized access, in particular by each other.

The properties of the network architecture or data processing center according to the invention assured of a user with regard to access security can advantageously be certified by a trustworthy external institution and monitored regularly. The network architecture or data processing center according to the invention must be operated in an audit-proof manner, not least from the aforementioned aspect.

In advantageous variants of the invention, the starting point of service use can already be assigned to a user or user group in a manipulation-proof manner at the network level.

With the invention, the alternative architecture can be set up and operated parallel to the classic Internet. It enables secure and controlled communication with the classic Internet, provided that a Secure Internet Gateway is available in the form of its own network safe. It also enables a gradual migration based on the classic Internet, since it does not have to be set up independently and ad hoc. The migration can initially be enforced in security or business-critical service infrastructures, since there is a high need for protection here.

There is also the option of reusing existing network infrastructure components as part of the alternative architecture, so that migration is not prevented or slowed down by a disproportionately high investment.

The alternative architecture to the classic Internet is sufficiently flexible with regard to changing requirements. In addition, at least in the medium term, it is also open to the integration of the business-to-consumer (B2C) and the consumer-to-consumer area.

The above statements concentrate on the description of the innovative basic ideas of the invention, in particular thus essentially on the representation of the basic model of the network architecture according to the invention. In addition to this basic model, other components and organizational structures are required for the successful operation of a corresponding Network Operation Center (NOC). Here, the wheel does not have to be reinvented and appropriate state-of-the-art techniques can be used so that only briefly should be discussed here. It goes without saying that the external data traffic, ie the data traffic between the customer and the Network Operation Center (NOC) and the data traffic between different Network Operation Centers (NOC) should generally be encrypted. In the same way, since security-critical centralized structures are generally involved, the infrastructure must be designed redundantly.

For the high-quality operation of a network architecture, distinctive components are required, which are generally summarized under the abbreviation FCAPS: Fault Management (F), Configuration Management (C), Accounting (A) or, as a result, also the so-called billing, performance Monitoring (P), Security Management (S).

Based on various security aspects, these components should be operated on the basis of a separate, so-called out-of-band management network. A possible reference architecture can be found in the publication "Cisco SAFE: Security Blueprint for Enterprise Network Security" by CISCO Systems Inc.

In addition, it is provided to operate the user interface for the management of the network architecture according to the invention essentially as a front end of a management database specific for the network architecture according to the invention. Protocol and configuration data are only exchanged via the database. Device- or operating system-specific backends are used to transfer the configuration data to the corresponding devices or servers.

This approach aims to minimize the possibility of administration errors through the front end and to maximize device and operating system independence through the back end. In addition, such an intermediate layer would facilitate the coupling of the management network to the ERP system of the Application Service Infrastructure Provider (ASIP).

To restructure the customer's local installation, it also makes sense to provide the customer with an Application Service Customer (ASC) or an Application tion service provider (ASP) to support the changeover to the corresponding end devices. By means of 'thin client' technology, the costs of the local installation of the customer can be reduced further by lowering the 'total cost of ownership' (TCO). As an added benefit, the improved virus resistance of this technology increases the security of the local installation.

Further preferred refinements of the invention result from the subclaims or the description below of preferred exemplary embodiments, which refers to the attached drawings. Show it:

FIG. 1 shows a schematic block diagram of a preferred variant of the network architecture according to the invention;

FIG. 2 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention;

FIG. 3 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention;

FIG. 4 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention;

FIG. 5 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention;

FIG. 6 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention;

FIG. 7 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention;

FIG. 8 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention; FIG. 9 shows a schematic block diagram of a preferred variant of the data processing center according to the invention;

FIG. 10 shows a schematic block diagram of a preferred variant of a detail of the data processing center from FIG. 9.

FIG. 1 shows a schematic block diagram of a preferred variant of the network architecture according to the invention, in which the method according to the invention is used. The network architecture comprises a data processing center 1, hereinafter referred to as a network operation center (NOC), which has a data processing infrastructure 2 which can be connected to the nodes 4 of a data processing network via communication lines in the form of dedicated lines 3.

The nodes 4 are entitled to access the Network Operation Center (NOC) 1 as a result of corresponding usage contracts. In the example shown, the nodes 4 are formed by so-called local area networks (LAN). However, it is understood that in the simplest case, a node can also be a single computer.

The data processing infrastructure 2, which is also referred to below as the Application Service Infrastructure (ASI), represents an infrastructure via which one or more so-called Application Service Providers (ASP) determined one or more so-called Application Service Customers (ASC) Services, i.e. H. To provide services, for example in the form of certain applications or the like. The operator of the Network Operation Center (NOC) 1 is referred to as the Application Service Infrastructure Provider (ASIP) because it provides the necessary infrastructure. Of course, it can also be provided that the Application Service Infrastructure Provider (ASIP) itself also operates as an Application Service Provider (ASP), i. H. not just the infrastructure, but certain services.

The Application Service Infrastructure (ASI) 2 has a number of separate first infrastructure areas in the form of so-called network safes 5. The network safes 5 have no direct connections to one another, which is indicated in FIG. 1 by the crossed arrows 6.

In these network safes 5, which are separate from one another, the application service customer (ASC) who is authorized to access on the basis of user contracts, ie. H. certain services are provided to the operator of a node 4, which is authorized to access the corresponding Network Safe 5, by an Application Service Provider (ASP). If the Application Service Provider (ASP) is an external provider, i. H. not for the Application Service Infrastructure Provider (ASIP) as the operator of the Network Operation Center (NOC) 1, the Application Service Provider (ASP) also uses at least one access-enabled node 4 operated by it and a Network Safe 5 for the service to provide.

A Network Safe 5 connects only servers that provide a service together and are in a relationship of trust. As mentioned, the services provided by a network safe 5 can only be used by authorized nodes 4, the private resources of the nodes 4 being protected against mutual access, as will be explained further below.

A Network Safe 5 is in principle comparable to a Local Area Network (LAN), but for which the additional standardized communication restrictions explained below and guaranteed by the operator of the Network Operation Center (NOC) 1 apply:

The Application Service Infrastructure (ASI) 2 has a connection setup controller in the form of a so-called Application Service Infrastructure Access Router (ASI-AR) 7 for authorization-based control of the connection setup between the nodes 4 and the network safes 5.

The Application Service Infrastructure Access Router (ASI-AR) 7 is designed in such a way that connections between a specific node 4 and a specific network safe 5 are only established when this specific node 4 is initiated. This ensures that none of the network work safes 5 can be misused as routers in order to establish a connection between a first node 4.1 and a second node 4.2 without causing the respective other node. This is indicated in FIG. 1 by the crossed double arrows 8 and ultimately means that the private resources of the respective node 4 are protected against unauthorized access by others via the network operation center (NOC) 1 according to the invention.

The access scheme of the nodes 4 to the network safes 5, with which the Application Service Infrastructure Access Router (ASI-AR) 7 works, is represented in FIG. 1 by points 9, which connect horizontal and vertical lines 10 and 11 to one another in accordance with the respectively permitted service relationships :

The horizontal lines 10 symbolize the connections to the network safes 5, in which the servers are grouped which maintain a trust relationship within the scope of the provision of a service. Servers of a network safe 5 can communicate with one another without restriction.

Provided that the respective service is provided exclusively by exactly one server, only this server is located within the corresponding network safe 5.

- The vertical lines 11 symbolize the access routes starting from the local infrastructures of the Application Service Customer (ASC), that is from the

Nodes 4.

If a usage contract exists between an Application Service Provider (ASP) and an Application Service Customer (ASC) for the use of a certain service, the corresponding access path is connected to the respective network safe 5 of the service. The underlying access restrictions are - as will be explained in more detail below - represented on the basis of the source address of the Application Service Customer (ASC) by so-called access lists, which are stored in a memory 12 to which the Application Service Infrastructure Access Router (ASI- AR) 7 accesses. Access from a node 4, for example by the Application Service User (ASU) of an Application Service Customer (ASC) from a LAN of the Application Service Customer (ASC), to the Network Operation Center (NOC) 1 takes place exclusively via a dedicated access path, namely via dedicated lines 3.

The Application Service Infrastructure Access Router (ASI-AR) 7 is designed for access-based control of the connection establishment depending on the dedicated line 3, via which the connection establishment is initiated. For this purpose, the Application Service Infrastructure Access Router (ASI-AR) 7 detects which leased line 3 is used to initiate the connection and establishes the connection with those network safes 5 which are assigned to this leased line 3 by the access lists mentioned above.

To accomplish this, a so-called (source) network address translation (NAT) is bound to each dedicated access path in the form of a dedicated line 3. In the example shown in FIG. 1, this takes place in the area of an identification device assigned to the respective dedicated line 3, which is part of an interface device 13 of the Network Operation Center (NOC) 1 assigned to the respective dedicated line 3.

With this network address translation (NAT), incoming data packets are accompanied by an identifier in the form of a source address which is uniquely assigned to the respective dedicated line 3. Depending on this source address and thus on the associated dedicated line 3 or interface device 13, the Application Service Infrastructure Access Router (ASI-AR) 7 decides on the connection establishment to the network safes 5. This fulfills the following requirements:

The operator of each node 4 receives a source address which is clearly assigned to it and cannot be manipulated by software and which is used as the starting point for further access decisions. - The address space of the Network Operation Center (NOC) can be managed completely independently of the address space of the connected node 4.

The access path of node 4 to the Network Operation Center (NOC) thus becomes a directed, non-transitive usage relationship, i.e. Neither servers from a Network Safe 5 nor nodes 4 from different LAN environments can mutually access private infrastructures.

The addressing scheme used in the figures was based on IP V4 for didactic reasons and was also greatly simplified: the network masks used to subdivide certain network areas always end at 8-bit boundaries; Implications of redundant structures are ignored.

Since the network architecture according to the invention does not maintain a direct connection to the classic Internet in the shown, private addresses in accordance with RFC 1918 are used. The examples are limited to the use of the network 10. *. *. * Where each asterisk always marks a variable 8-bit part starting at an 8-bit boundary. The classic notation 10.0.0.0 / 255.0.0.0 is not used in the following because it is too long. The newer notation 10.0.0.0 / 24 is not used, because it means that netmasks in which the set part is not continuously connected, e.g. 10Λ5. * Cannot be displayed.

In the long term, as already mentioned above, it has to be taken into account that a Network Safe 5 can also be distributed to different Network Operation Centers (NOC) from different operators, so that here too there must be higher-level organizational structures comparable to the classic Internet that are responsible for managing the address space would.

The address space used in the examples is divided into individual network areas as follows: 10.n. *. * Is the address space of the entire Network Operation Center (NOC) No. n; In the figures with only one network operation center (NOC), a network operation center (NOC) with the number 1 is assumed.

10Λ0. * Is the address space of all access network areas, i.e. H. node 4;

10. *. S. * With s> 1 is the address space of the network safe s; All servers connected to Network Safe No. 3 in Network Operation Center (NOC) No. 1 thus receive an address from the range 10.1.3. * (In FIG. 1, these are all servers connected to Network Safe 5.3);

- The address spaces of the connected Application Service Customers (ASC) are arbitrary. Both official IP addresses of the classic Internet and private addresses can be used here.

As mentioned, the connection points 9 of the vertical access lines 11 with the horizontal service lines 10 each mark an access connection or permission for the respective service user or user group with respect to the service of the respective network safe 5.

FIG. 2 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention, which corresponds to a supplemented network architecture from FIG. 1. Identical components were therefore identified with identical reference numbers.

In FIG. 2, the network safes 5 have been supplemented by a simplified, representative server configuration. The Network Safe S1 is used by Application Service Customer ASC1, which operates node 4.1, as a private network. The server 14 connected to this network could, for example, provide cross-location intranet functionality for the Application Service Customer ASC1. The server 14 is administered by the Application Service Customer ASC1 itself. Network Safe S2 and S3 have an analogous meaning: The connected servers 15 and 16 house the private services of Application Service Customer ASC2 and Application Service Provider ASP1, which operate nodes 4.2 and 4.3, respectively.

In addition, the application service provider ASP1 provides a service to the application service customer ASC1 and the application service customer ASC2 on second infrastructure areas in the form of separate servers 17 and 18 in the network safes S4 and S5. The servers 17 and 18 are administered by the Application Service Provider ASP1 on the basis of Network Safe S6. The servers 17 and 18 connect the two network safes S4 and S6 or S5 and S6 as second infrastructure areas.

It is assumed that the application in combination with the operating system may be able to provide the administration services only on the network interface connected to Network Safe S6.

The properties of the network architecture according to the invention explained with reference to FIGS. 1 and 2 can be described again as follows. As mentioned, a basic idea is to provide services to the user in separate rooms. These rooms are formed by the Network Safes 5. A Network Safe 5 connects only the servers that provide a service together and are in a relationship of trust with each other. The services provided by a network safe 5 can only be used by authorized nodes 4, the private resources of the nodes 4 being protected against mutual access. A Network Safe 5 is in principle comparable to a Local Area Network (LAN), but for which additional standardized communication restrictions that are guaranteed by the operator of the data processing infrastructure apply:

A network safe 5 only accepts data packets which contain, as the source address, the address of the network interface 13 of a node 4 which is authorized to access the relevant network safe 5. The data packets leaving a Network Safe 5 must contain the address of another server in the same Network Operation Center (NOC) or the address of an access-authorized node as the destination address.

In principle, there are no direct connections between different network safes. With regard to services provided cooperatively by various Application Service Providers (ASP), e.g. In the business-to-business (B2B) environment, there is the possibility that a server is connected to several network safes through separate network interfaces. The misuse of the server as a general router between the network safes 5 to which it is connected is prevented by the aforementioned communication restrictions.

Basically, only nodes 4 can access a network safe 5 whose node operators are authorized to use the service of the respective network safe 5. This usage relationship is a directional relationship, i.e. Even if the node 4 of the service user would also provide a service, this can neither be used by the server of the network safe 5 nor by another node 4.

At the network level, the security problems in the classic Internet result almost exclusively from the fact that the security mechanisms were based on the content of one or more data packets. However, data packets can be generated and manipulated by software in almost any way.

In contrast to the classic Internet, in which the security mechanisms are based on the content of one or more data packets that can be manipulated and manipulated by software, the security mechanisms of the network architecture described are based on simple chains, the first link of which is always anchored to the physical access path of a packet ,

The filter chains of the Network Safes 5 are explicitly linked to the server ports and the output port of the Network Safes 5. The Network Operation Center (NOC) is accessed via a physical-level access path, namely dedicated lines 3. The dedicated access path is accessed clearly bound a source address that automatically receives all data packets that reach the Network Operation Center (NOC) in this way.

Attacks on such anchored security mechanisms require the attacker to have direct personal access to the physical infrastructure on site. The number of potential attackers is thus reduced by several orders of magnitude compared to the classic Internet.

FIG. 3 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention, which corresponds to a first application scenario of the network architecture from FIG. 2. Identical components have been identified with identical reference numbers.

The first application scenario from FIG. 3 is a simplification of the server constellation from FIG. 2. Application service provider ASP1 makes its application available on a server 19 which is shared by the application service customers ASC1 and ASC2. The server is administered using the same Network Safe S4. Application Service Customer ASC1 and ASC2 in turn operate private servers 14 and 15 in Network Safe S1 and S2.

It should be emphasized that, analogously to this application scenario, all classic applications can be operated in application service providing which are not designed for such an application at all, i.e. they do not have to be partitionable or multi-client capable. Nevertheless, reciprocal security concerns of the Application Service Customer (ASC) regarding the protection of your data are preserved.

With regard to the administration of the server 19, however, a security aspect resulting from the simplification must be taken into account: If the application made available in combination with the operating system is not able to do so, administration privileges only depend on that of the application service provider To assign the ASP1 assigned source address, service users can try to gain administrative privileges by they log on as administrator. In any case, the damage remains limited to server 19.

If this privilege release depending on the source address is possible, this solution with regard to administration is just as secure as the use of a separate network safe for management, since the source address cannot be manipulated by a service user at this point.

In a preferred application scenario, the server 19 is therefore operated IP-based with completely separate client data via the operating system and / or databases. To implement the access restrictions, devices such as firewalls, a so-called trusted operating system or, as mentioned, an application with IP-based privilege restrictions can be used.

FIG. 4 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention, which corresponds to a second application scenario in the form of a refinement of the network architecture from FIG. 2. Identical components have therefore been identified with identical reference numbers.

In the second application scenario from FIG. 4, the Network Safe S6 is additionally used to supply the application, which is provided on the servers 17 and 18 as described for FIG. 2, with database services. For this purpose, a first database server 20 connected to the Network Safe S6 is available for the Application Service Customer ASC1 and a second database server 21 connected to the Network Safe S6 for the Application Service Customer ASC2.

Hiding database services from direct access by service users is a common concept in modern multi-tier architectures. The network architecture according to the invention here offers the possibility of implementing this concept flexibly and scalably in a centralized infrastructure. Terminal servers can of course also be integrated into the infrastructure in an analogous manner. FIG. 5 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention, which corresponds to a third application scenario in the form of a modification of the network architecture described in relation to FIG. Identical components were identified with identical reference numbers.

In this application scenario, the application service provider ASP1 provides a service for the application service customers ASC1 to ASC5 on a server 22 which is connected to the network safes S7 and S8. The nodes 4 of the Application Service Customer ASC1 to ASC5 are connected to the Network Safe S7 and access the server 22 via this, while the Application Service Provider ASP1 unregisters the service via the Network Safe S8 in a manner that is already the case Figure 2 has been described.

In this application scenario, the server 22 is operated IP-based via the operating system and / or databases with completely separate client data for the application service customers ASC1 to ASC5. In order to implement the necessary mutual access restrictions, devices such as firewalls, a so-called trusted operating system or, as already mentioned above, an application with IP-based privilege restrictions can also be used here.

FIG. 6 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention, which corresponds to a fourth application scenario in the form of an addition to the network architecture described in FIG. 2, so that only the addition is to be dealt with. Identical components have been identified with identical reference numbers.

In FIG. 6, a second application service provider ASP2 makes another service available to application service customer ASC1 and application service customer ASC2 on separate servers 23 and 24 in network safes S9 and S10. The servers 23 and 24 are administered by the second application service provider ASP2 starting from Network Safe S11. It is also assumed here that the application in combination with the operating system may be able to provide the administration services only on the network interface connected to Network Safe S11.

Individual variants of the network architecture according to the invention have been described above. It goes without saying that these variants described above can also be used in any combination or mixed form.

FIG. 7 shows a schematic block diagram of a further preferred variant of the network architecture according to the invention. This is an extension of the basic model shown in FIG. 2 to two network operation centers (NOC) 1.1 and 1.2, the network operation center (NOC) 1.1 corresponding to the network operation center (NOC) 1 from FIG. 2 ,

The contents of the Network Safes 5.1 and 5.2 and the servers 17.1 and 17.2 or 18.1 and 18.2 are each synchronized with each other, so that the Application Service Customer ASC1 and ASC2 or the Application Service Provider ASP1 in both Network Operation Centers (NOC) 1.1 and 1.2 the same data is available.

The Application Service Customer ASC1 or ASC2 access the respective Network Operation Center (NOC) 1.1 or 1.2 from different access points 4.1.1 and 4.1.2 or 4.2.1 and 4.2.2. The same applies to the Application Service Provider ASP1, which accesses the first Network Operation Center (NOC) 1.1 from node 4.3.1 and the second Network Operation Center (NOC) 1.2 from node 4.3.2.

The expansion of the basic model to several network operation centers takes place via dedicated, correspondingly tamper-proof communication connections of the participating network operation centers (NOC) 1.1 and 1.2, which are implemented in the form of dedicated lines 25. The distribution of a network safe Several Network Operation Centers (NOC) are carried out by appropriate routers, not shown in FIG. 7, ie synchronization devices, that is to say on OSI Network Layer 3.

As already shown above, the operation of each Network Operation Center (NOC) should be externally certified in accordance with the communication restrictions mentioned and operated in an audit-proof manner in accordance with the relevant organizational rules. In this way it can be excluded that data packets are manipulated by attack software within the infrastructure, which enables the use of conventional layer 3 technology at this point.

FIG. 8 illustrates, as an extension of the variant from FIG. 7, the possibility of synchronizing n network operation centers NOC1 to NOCn, in particular their network safes 5.1 to 5.n, with n being an arbitrary integer.

Examples were set out in FIGS. 7 and 8 in which all the infrastructure areas of the Network Operation Center (NOC) are synchronized with one another. However, it goes without saying that, in the case of other variants, it can also be provided that, depending on the usage situation or access situation to the network operation centers (NOC), only individual network safes or servers connecting them etc. are syncronized over several network operation centers (NOC). are chronized or distributed. It may be enough for an Application Service Customer (ASC) or an Application Service Provider (ASP) if a Network Safe is only available to them in a correspondingly smaller number of Network Operation Centers (NOC).

For example, if an Application Service Customer (ASC) operates only one node, a single Network Operation Center (NOC) that it can access can suffice. It may also be sufficient that an Application Service Provider (ASP) only administers the associated Network Operation Center (NOC) and thus services via a single node, which, however, can still be distributed across several Network Operation Centers (NOC). FIG. 9 shows a schematic block diagram of a preferred example of a technical implementation of the core architecture of the Network Operation Center (NOC) 1 from FIG. 1.

With regard to medium scalability, a modular multilayer switch Catalyst 6506 from CISCO Systems Inc. is assumed as the first core component 26. In the access area, a connection of the customers by X.21 dedicated lines 3 was assumed. For the Application Service Infrastructure Access Router (ASI-AR) 7 on the part of the Network Operation Center (NOC) 1 there is a multifunctional high-performance router CISCO 7206 VXR as second core component 27 and a CISCO 2610 with the corresponding X.21 as third core component 28 Adapters for use. The entire access area, especially the customer-side router 28, is the responsibility of the operator of the Network Operation Center (NOC) 1.

The dial-in area, via which a mobile user 29 can dial in via a telecommunications network 30, is covered by a component 31 in the form of a modular multiservice router CISCO 3620. In addition, there are various smaller components and a terminal server for tamper-proof coupling of the devices to the out-of-band management network, but these are not shown in FIG. 9. The router of the dial-in area uses the authentication server (ACE / KEON), which is shown in connection with the Secure Internet Gateway described with reference to FIG.

An Internet service server 32, a Unix firewall 33, a virus scanner 35 and a security server 36 are also available as further components, which are connected to the first core component 26.

The communication restrictions mentioned above are essentially realized from a combination of VLAN and IOS-based access lists.

The network safes 5 are implemented as so-called virtual LANs (in the terminology of the company CISCO Systems Inc. for short VLANs), which are connected to the first core component 26. A respective application server 36 is connected to the network safes 5. The original idea was to use virtual LANs (VLANs) of this kind across locations to implement the network safes. However, such an implementation would have had the following disadvantages: In the case of network safes that would have been equipped with two servers at different locations, the router would not have been able to react to a connection failure between the two locations despite the so-called auto-state feature. In July 2000, the SANS Institute also identified security deficiencies in the implementation of cross-switch (or router) VLANs (see "http://www.sans.org/newlook/resources/IDFAQ/vlan.htm").

The use of VLANs is therefore limited to the implementation of network safes within a network operation center (NOC). The cross-location realization of network safes takes place, as already shown above, with conventional routing techniques.

FIG. 10 shows a preferred exemplary embodiment for a so-called Secure Internet Gateway 37, which has the task of connecting the network architecture according to the invention in a controlled and secure manner to the classic Internet. Here too, state-of-the-art technology is used, but with the highest priority in terms of security. For security reasons, no direct connection is generally possible between the network architecture according to the invention and the classic Internet. The connections are made exclusively via so-called application level gateways, which are protected by a multi-level firewall concept. To prevent the unnoticed connection from being established by so-called Trojans, the WEB proxies are generally used by means of authentication.

The services provided by the Secure Internet Gateway 37 are used in the form of a separate network safe. The customer, i.e. the relevant Application Service Customer (ASC) or Application Service Provider (ASP), can thus freely decide whether they want to use this form of connection with the classic Internet.

Claims

claims

1. Communication network with a first server group, at least one second server group and a first communication path between the first and the second server group,

characterized in that

the first communication path comprises a connection module for establishing and maintaining a first communication connection and

the connection module is designed in such a way that it enables the second server group to use a service available in the first server group, but not the first server group to use a service available in the second server group.

2. Communication network according to claim 1, characterized in that at least a third server group and a communication path between the first and the third server group is present,

that the connection module building and maintaining one

Allows communication link between the first server group and the third server group, and

that the connection module is designed in such a way that it enables the use of a service available in the first server group by the second and third server groups, but not the use of a service available in the second or third server group by one of the two other server groups.

3. Communication network according to one of claims 1 or 2, characterized in that the server groups are assigned identifications that are not to be manipulated by software.

4. Communication network according to claim 3, characterized in that the communication module comprises a test module for checking the identification of a server group.

5. Communication network according to one of claims 1 to 4, characterized in that each server group contains exactly one server.

6. Communication method for carrying out communication in a communication network according to one of claims 1 to 5, characterized in that the server groups exchange data via the communication path (s) and that the communication module decides on the authorization to access the service of a server group.

7. Communication method according to claim 6, characterized in that the data of the respective sending server group is given the identification of this server group and that the communication module carries out a check of the identification and decides on the basis of the identification of the authorization to access the service of a server group.

8. Communication method according to claim 6 or 7, characterized in that the communication module uses "source network address translation (S-NAT)" when accessing the service of the first server.

9. Communication method according to claim 6 or 7, characterized in that the communication module uses a "connection tracking module" when accessing the service of the first server.

10. Communication method according to one of claims 6 to 9, characterized in that the communication module only allows the transmission of data with verified server identifications.

1 1. Communication method according to claim 10, characterized in that the verification of the server identifications is based on the servers assigned dedicated access paths.

12. Communication module for use in a communication network according to one of claims 1 to 5, characterized in that it is a Communication protocol includes that identifies servers or server groups.