RU113442U1 - AUTOMATED PROTECTED INFORMATION MANAGEMENT SYSTEM IN A TERRITORALLY DISTRIBUTED APPLIED MANAGEMENT SYSTEM - Google Patents

Abstract

 1. An automated information security management system in a geographically distributed application management system containing objects of a distributed management system; information exchange transport network; typical information protection units, an automated control center for information security of a distributed system (NCC), characterized in that it additionally contains updated models of the violator’s actions and counteraction to them, and each object of the territorial control system includes information protection means (SRZI) containing integrated sensors for implementing control actions (SRV) from TsUS. ! 2. The automated information security management system according to claim 1, characterized in that it additionally contains at least one redundant automated information security management center for a distributed system (TsUS-R) subordinate to the TsUS, and the information protection means (SRZI) contain built-in sensors for implementing managers impacts (SRV) from TsUS-R according to the subordination of objects. ! 3. The automated information security management system according to claim 1, characterized in that it contains at least one territorial automated information security management center for a distributed system (CUST), subordinate to the CSC, and the information protection means (SRSI) contain built-in sensors for implementing control actions (SRV) ) from TSUST according to the subordination of objects. ! 4. The automated information security management system according to claim 2, characterized in that it contains at least one territorial automated information security management center

Description

The inventive utility model relates to the field of information security management in distributed control systems. The system is applicable both for IP networks and for networks with other data transfer protocols.

There is a known system for the safe processing of information, containing two main units providing the exchange and processing of information of various privacy levels: a security management unit and a data management unit of various privacy levels (RF patent No. 85707 for the utility model “A model for the secure processing of information of various privacy levels in information and telecommunications systems ", publ. 10.08.2009, IPC G06F 17/40 G06N 7/06). The disadvantages of this system include the lack of the ability to use unprotected public communication channels for organizing a distributed exchange of information of limited access and containing information constituting a state secret, as well as the lack of a unified center for managing information security and software and hardware to ensure its protection.

Known for the closest set of essential features and taken as a prototype information and telecommunication system that provides the creation of a secure transport environment and communication channels for local and territorial separated automated information systems of various security classes. A known system contains objects of a distributed system; a distributed information exchange transport network; automated center for information security management of a distributed system; information protection tools, WEB center (RF patent No. 91494 for the utility model “Model for building a secure Internet”, published on 02/10/2010, IPC 7 H04L 9/00). The known system allows the use of public channels for transmitting limited access information and contains a single center for managing information security and software and hardware to ensure its protection. However, the known system does not take into account information about the actions of violators to counteract the exchange of information in the main control system and does not provide prompt targeted countermeasures to the violator by available means on the basis of identified signs of exposure and does not provide for automated isolation of a compromised system object and its return to the system when compromise is removed.

The task to which the claimed utility model is directed is to create a system with a high degree of information security in a geographically distributed management system.

The technical result achieved as a result of solving the problem is to ensure the operational adaptation of the parameters of the protection mechanisms to identified threats or regular changes in the structure of the system as a whole and to increase the reliability of the system.

The claimed technical result is achieved in that the automated information security management system in a geographically distributed application management system contains objects of a distributed management system; information exchange transport network; typical blocks of information protection; automated center for information security management of a distributed system (NCC); updated models of actions of the violator and counteraction to them, and each object of the territorial control system includes information protection tools (SRZI), containing built-in sensors for the implementation of control actions (SRV) from the central control center.

It is preferable that the automated information security management system additionally contains at least one redundant automated information security management center for a distributed system (TsUS-R), subordinate to the TsUS, and the information protection means (SRZI) contain built-in sensors for implementing control actions (SRV) from TsUS-R according to the subordination of objects.

It is also preferable that the automated information security management system contains at least one territorial automated information security management center for a distributed system (CUST), subordinate to the CMS, and the information protection means (CIR) contain integrated sensors for the implementation of control actions (SRV) from the CUST, according to the subordination of objects.

It is also preferable that the automated information security management system additionally contains at least one redundant territorial automated distributed information security information management center (CUST-R) subordinate to the CMS, and the information security tools (SRSI) contain built-in sensors for implementing control actions (SRV) from TSUST-R, according to the subordination of objects.

Preferably, the TsUS, TsUS-R, TsUST, TsUST-R were made in the form of software and hardware systems connected to the transport network; models of actions of the violator and counteractions to them were performed in the form of databases; Each SRSI was made in the form of a serviced or maintenance-free software and hardware complex, and SRVs were made in the form of a software complex.

Preferably, typical information protection units include, but are not limited to, a cryptographic protection unit for ensuring the confidentiality and integrity of information, a firewall unit, an attack detection system unit, an authentication unit.

A comparative analysis of the claimed utility model with the prototype showed that in all cases it is different from the well-known, closest technical solution:

- the presence of updated models of actions of the violator and counteraction to them,

- the presence at each object of a distributed control system of information protection tools containing built-in sensors for the implementation of control actions (SRV) from the central control center.

In some cases, the implementation of the claimed utility model differs from the well-known, closest technical solution:

- the presence of at least one backup automated center for managing information security of a distributed system (TsUS-R), subordinate to the NCC, and the implementation of information protection tools (SRZI), containing built-in sensors for the implementation of control actions (SRV) from the TsUS-R according to the subordination of objects;

- the presence of at least one territorial automated control center for information security of a distributed system (CUST), subordinate to the CSC, and the implementation of information security tools (SRZI), containing built-in sensors for the implementation of control actions (SRV) from the CUST according to the subordination of objects;

- the presence of at least one backup territorial automated control center for information security of a distributed system (CUST-R), subordinate to the CSC, and the implementation of information security tools (SRZI), containing built-in sensors for the implementation of control actions (SRV) from CUST-R according to the subordination of objects ;

- the implementation of the central control center, central control center-R, central control center, central control center-in the form of software and hardware systems connected to the transport network; patterns of actions of the violator and counteraction to them - in the form of databases; each SRZI - in the form of a serviced or unattended software and hardware complex, and SRV - in the form of a software complex;

- the implementation of typical information protection blocks, including, but not limited to, a cryptographic protection block to ensure confidentiality and integrity of information, a firewall block, an attack detection system block, an authentication block.

Information security management is understood as the entire set of tasks for maintaining the functioning of the security system with the specified information protection parameters in the given conditions of the intruder. At the same time, an intruder is understood as a set of predetermined unauthorized actions aimed at overcoming protection with the aim of accessing the protected information or its deliberate distortion. Systems and means of protection directly interact with the application system and its means, the information of which is protected, and must take into account both quantitatively and qualitatively the characteristics of the application system.

Obviously, the possibilities of any protection system are not unlimited, and the system can withstand only a very specific impact of the intruder, both in quantitative indicators and in quality. Thus, one of the key characteristics of an information security system (ISS) is its ability to withstand the well-defined, predetermined actions of an intruder. The presence in the automated information protection management system of updated models of the violator’s actions and counteraction to them; the presence at each object of the territorial control system of information protection tools (SRZI) containing built-in sensors for the implementation of control actions (SRV) allows you to develop a formalized model of the violator’s actions on the basis of a priori data, systematically update it based on current data on the identified impacts and organize the management of information security measures as software reaction according to the specified model to the identified effects, providing adaptation of defense mechanisms to the effects of the intruder.

The hierarchical structure of the automated information security management system and the availability of territorial automated information security management centers for a distributed system allows adaptively changing its parameters.

The presence of redundant automated centers for managing information security of a distributed system (TsUS-R) and territorial automated centers for managing information security of a distributed system (TsUST-R) subordinate to the central control system increase the reliability of the system, ensuring its high survivability.

The inventive utility model is illustrated by the circuit drawings shown in figures 1, 2.

Figure 1 is a structural diagram of an automated information security management system in a geographically distributed management system.

Figure 2 presents the structural diagram of an automated information security management system with a significant number of objects in a distributed system and / or their significant territorial distance from the NCC.

An automated information security management system in a geographically distributed application management system contains objects 1 of a distributed management system; transport network 2 exchange of information; typical information protection blocks (not shown in the drawing), updated models of the violator's actions and counteractions to them (not shown in the drawing). An automated information security management center for a distributed system (DCC) 3 is connected to transport network 2. Each object 1 of the territorial control system includes information protection means (SRIS) 4 containing integrated sensors for implementing control actions (SRV) 5 from the central control system 3. In a preferred embodiment for high survivability of the distributed system, the automated information protection management system additionally contains at least one redundant automated control center and information security distributed system (TsUS-R) 6, subordinate to the central control center 3. The central control center 3 and central control center-6 can be software and hardware systems that are connected to transport network 2, for example, via TCP / IP. With a significant number of objects 1 in the distributed system and / or their significant territorial distance from the central control center 3. These objects are divided into territorial clusters 7 in accordance with the functional features of the application system and information protection, and in each cluster 7 it manages its territorial automated information security management center distributed system (CUST) 8. The term "cluster" refers to the combination of several homogeneous elements of the applied control system, which can be matrivatsya as an independent unit, has certain properties. In a preferred embodiment, to increase the reliability of management, cluster 7 contains a backup territorial automated center for managing information security of a distributed system (CUST-R) 9. At the same time, information protection means (SRIS) 4 include built-in sensors for implementing control actions (SRV) 5 from TsUS-R 6, TSUST 8, TSUST-R 9, according to the subordination of objects. TsUS 3, TsUS-R 6, TsUST 8, TsUST-R 9 are made in the form of software and hardware systems connected to the transport network; models of the actions of the violator and counteractions to them are made in the form of databases each of SRZI 4 is made in the form of a serviced or unattended software and hardware complex, and SRV 5 is made in the form of a software complex. Preferably, typical information protection blocks include, but are not limited to, a cryptographic protection block to ensure confidentiality and integrity of information, a firewall, blocks of an attack detection system, authentication blocks, blocks of a trusted download module, and other blocks of information protection against unauthorized access (in the drawing, shown).

An automated information security management system in a geographically distributed application management system works as follows.

NCC 3 and NCC-R 6 provide the formation, bringing up to NDC 8, CUST-R 9 initial values and tables (matrices) for all blocks of the information protection system, and also receive data from them about the functioning of these services to generate subsequent control commands. For example, this is a cryptographic unit to ensure the confidentiality and integrity of information, a firewall unit, an attack detection system unit, an authentication unit, etc. Each unit has a response plan for detected intruder attacks. The set of plans covers the whole set of actions of the intruder based on his formal model. The formal model of the intruder’s actions and counteraction to them is made in the context of the functions of the information protection unit with the reaction plan and can be performed in the form of one or more databases. The structure of each object 1 of a distributed system includes a means of information protection SRZI 4, each of which ensures the detection of one or a number of information threats (threat sensors), as well as the implementation of one or a number of protection mechanisms. Threats can include unauthorized access to information, the imposition of false information, etc., and, for example, cryptographic protection using symmetric and asymmetric encryption algorithms, imitation protection, information filtering according to a number of criteria, etc. can be implemented as security mechanisms. P. SRZI 4 can be performed in the form of a serviced or unattended software and hardware complex.

The composition of each information protection tool SRZI 4 includes a sensor for implementing control actions of SRV 5, which provides control of the protection mechanisms of this SRZI 4 from the central control center, which is subordinate to SRZI 4. Each central control center, central control center, remote control center, central control center receives from SRV 5 of each slave SRZI 4 information on the status of the parameters of the protection mechanisms, for example, magazines with the analysis of service fields of received information packets, the results of decryption of packets, their imitation protection, state logs, including logs about authorized and / or unauthorized actions, and / or messages about unauthorized access to SRZI 4, etc. SRV 5 can be made in the form of a software package.

The claimed automated information protection management system in a geographically distributed application management system is characterized by a high degree of reliability, it allows developing a formalized model of the violator’s actions on the basis of a priori data, systematically updating it based on current data on the identified effects, and organizing the management of the information protection system as a programmatic response according to the specified model on identified impacts, providing adaptation of protection mechanisms to impacts th offender, allowing you to change the parameters of the system as a whole.

Claims (7)

1. An automated information security management system in a geographically distributed application management system containing objects of a distributed management system; information exchange transport network; typical information protection units, an automated control center for information security of a distributed system (NCC), characterized in that it additionally contains updated models of the violator’s actions and counteraction to them, and each object of the territorial control system includes information protection means (SRZI) containing integrated sensors for implementing control actions (SRV) from TsUS. 2. The automated information security management system according to claim 1, characterized in that it additionally contains at least one redundant automated distributed information security management center (DCS-R) subordinate to the DCC, and the information protection tools (SRSI) contain built-in sensors for implementing managers impacts (SRV) from TsUS-R according to the subordination of objects. 3. The automated information security management system according to claim 1, characterized in that it contains at least one territorial automated information security management center for a distributed system (CUST), subordinate to the CSC, and the information protection means (SRSI) contain built-in sensors for implementing control actions (SRV) ) from TSUST according to the subordination of objects. 4. The automated information security management system according to claim 2, characterized in that it contains at least one territorial automated information security management center for a distributed system (CUST), subordinate to the CSC, and the information protection means (CIR) contain built-in sensors for implementing control actions (SRV) ) from TSUST according to the subordination of objects 5. The automated information security management system according to claim 4, characterized in that it additionally contains at least one redundant territorial automated information security management center for a distributed system (CUST-R) subordinate to the CMS, while the information protection means (SRSI) contain built-in sensors implementation of control actions (SRV) from TSUST-R according to the subordination of objects. 6. An automated information security management system according to any one of claims 1 to 5, characterized in that the central control center, central control center, the central control center, the universal control center are made in the form of software and hardware systems connected to the transport network; models of the actions of the violator and counteractions to them are made in the form of databases; each SRSI is made in the form of a serviced or maintenance-free software and hardware complex, and SRV is made in the form of a software complex. 7. An automated information protection management system according to any one of claims 1 to 5, characterized in that typical information protection units include, but are not limited to, a cryptographic protection unit to ensure confidentiality and integrity of information, a firewall unit, an attack detection system unit, an authentication unit .