RU16963U1 - PROTECTION SYSTEM FOR DATA PACKAGES DURING THE TRANSFER OF THE PROTECTED PROTECTED FRAGMENT OF THE GENERAL USE DATA TRANSMISSION NETWORK WITH THE COMMUNICATION OF PACKAGES IMPLEMENTING ONLINE INTERNET PROTOCOL - Google Patents

Description

A system for protecting data packets during transmission in a dedicated protected fragment of a public data transmission network with packet switching that implements the Internet protocol from unauthorized influences.

The proposed utility model relates to computer technology, in particular to systems for ensuring the security of the data transfer process in public data transfer networks with packet switching that implement the Internet Protocol (IP protocol).

There are well-known public data networks with packet switching that implement the IP protocol, connecting users of information systems using hardware and software communications that provide some protection for the transmitted data from modification due to accidental interference, but do not provide protection against intentional unauthorized influences V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols. St. Petersburg, ed. Peter, 1999 p. 383-406, 530-539.

Closest to the proposed technical solution is a public switched data network with packet switching that implements the IP protocol and contains user communication lines, routers, a network control center and communication lines connecting them. V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols. St. Petersburg, ed. Peter, 1999 p. 524, prototype.

The disadvantage of this communication network is the lack of protection mechanisms for transmitted user data packets from accidental and intentional distortions due to unauthorized

MKIOOR 15/16

impacts in the process of transmitting data packets over a public switched data network with packet switching that implements the IP protocol and protecting the information sphere of a public data transmission network with packet switching from remote unauthorized influences by information weapons.

The proposed utility model solves the technical problem of ensuring the reliability of data packets transmitted by a secured protected fragment of a public data network with packet switching that implements the EP protocol, and protecting the information sphere of a secured protected fragment of a public data network with packet switching that implements IP protocol from remote unauthorized impacts.

The stated technical problem is solved in that the system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching that implements the IP protocol against unauthorized influences, including user lines, a dedicated protected fragment of a public data network with packet switching that implements the IP protocol, containing marshrutators, a network control center and communication lines connecting them, additionally contains a control center security included in the network control center and related subscriber security servers installed either at the output of the user terminal at the beginning of the user's communication line connecting the subscriber security server to the router port of the selected protected fragment of the public data network with packet switching, or at the input to the router port at the end of the user's communication line.

linking the subscriber security server with the user terminal, while each subscriber security server contains a block for receiving and extracting at the network level from the received data packet the contents of the data field, a block for receiving from the security control center and storing encryption keys for each pair of interacting subscriber security servers, an encryption block the contents of the data field of the data packet received from the user and the formation of a simulation part of the data packet that is unchanged during transmission inserts, a block for adding a simulated insert to an encrypted data packet, a block for correcting the header of the data packet and generating the converted data packet, a transmission unit for the converted data packet, a block for receiving and isolating the converted data packet at the network level, a decryption block for the received converted data packet and verifying the correctness of the received value simulation insertion, a block for issuing a decrypted data packet to a user, a block for registering incoming data packets with a mark of data packets, p persons with the wrong value of the simulation insert, the unit for generating and transmitting a message about the received packet with the incorrect value of the simulation insert to the security control center, which contains the block for generating and distributing encryption keys to the user security servers, the block for receiving messages about data packets received with the incorrect value of the simulation inserts, the decision-making block on the localization of unauthorized influences and the elimination of the consequences of unauthorized influences and the block action centered data network common control packet, the subscriber

the security server installed at the beginning of the user’s communication line connecting the subscriber security server with the router of the allocated protected fragment of the public data network with packet switching, on the one hand connected to the user terminal, and on the other hand connected to the user's communication line, and the subscriber security server installed at the end of the user's communication line connecting it with the user terminal is connected on the one hand with this user communication line, and on the other hand with Dedicated access mouth marschrutizatora protected fragment public data packet network implementing the IP protocol.

Such an embodiment of the system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching that implements the IP protocol from unauthorized influences allows us to solve the technical problem by additionally introducing data packets transmitted in a dedicated protected fragment into the protection system public data networks with packet switching from unauthorized influences, security control center and interoperability subscriber security servers with it, performing the functions of protecting data packets; changing the functions performed by the main components of a packet-switched public data network. When a selected protected fragment of a public data transfer network is transmitted to the router with packet switching of each data packet, the security of the transmitting user is encrypted unchanged during the process

transmission part of the data packet and according to the data contained in the data field of the received data packet, a simulation insert is formed in accordance with the encryption algorithm used, for example, according to GOST 28147-89, and the encryption key selected for this pair of interacting subscriber security servers, i.e. . to the data packet of length k of binary symbols transmitted to the packet switching center of the selected protected fragment of the data transmission network, a generated simulation insert of length m of binary symbols is added and the header of the data packet is adjusted, as a result of which a converted data packet of length of binary characters is formed. In the subscriber security server of the receiving user at the network level, in accordance with the decryption algorithm, for example, according to GOST 28147-89, the transformed data packet received from the router is decrypted and the value of the simulation insert contained in the received converted data packet is verified and issued if it is correct the values of the simulation insert of the decrypted data packet to the user; if the simulation value is incorrect, the received converted data packet is erased. Data packets received at the network level are registered with the mark of the data packet simulation insertion that has not passed the correctness control, a message is generated about the failed data packet verification, which is transmitted to the security control center, while the transmitted message is protected by the selected protection protocol from its non-acceptance. Distribution of encryption keys for each pair of subscriber security servers that interact during the transfer of a data packet to

a selected protected fragment of a public data network with packet switching, when using a single-key encryption system, it is organized by the security control center either using manual mode based on smart cards or using the protected protocol for the security control center to interact with subscriber security servers via communication channels, along with with this, the security management center in conjunction with the network management center and other organizational structures of the transmission network yes GOVERNMENTAL public packet-switched reschaet task of tampering localization and liquidation of their consequences on the basis of information received from the subscriber server security.

Thus, the security protocol implemented by the subscriber security servers, as well as the functions that ensure the implementation of the implemented security protocol, allow you to detect the modification of the transmitted data packets and, together with the security control center and the network control center, provide the specified reliability and reliability of the delivery of the transmitted data packets to the user with dedicated protected fragment of a public data network with packet switching and protecting the information sphere of this fragment from remote unauthorized influences. The guaranteed reliability of each transmitted data packet with a highlighted protected fragment of a public switched data network with packet switching is determined by the probability value of the occurrence of an undetectable

each data packet due to unauthorized

1 exposure equal to „-„

g 2

The essence of the proposed technical solution is illustrated by the scheme for two interacting subscriber security servers, shown in FIG. 1. The system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences that implements the IP protocol contains communication lines 1 and 2 of the user, connecting respectively the user terminals 3 and 4 with the routers 5 of the dedicated protected fragment 6 of a public switched data network, containing a network control center 7, a security control center 8, and at the input of each communication line Caller 1 and 2, at the output of the user terminal, security subscriber servers 9 and 10, respectively, are installed; content blocks Ni 12 receive and extract the contents of the data field from the simple data packet from the simple data packet; blocks 13 and 14 receive from the security control center 8 and store encryption keys for each pair of interacting users, blocks 15 and 16 encrypt the contents of the data field of the data packet received from the user and formulate insertion, blocks 17 and 18 add simulation insert to the transmitted data packet, blocks 19 and 20 of the correction of the header and the formation of the converted data packet, blocks 21 and 22 of the transmission of the converted data packet, blocks 23 and 24 of the reception and allocation

at the network level of the converted data packet, blocks 25 and 26 for decrypting the converted data packet and verifying the validity of the received value of the simulation insert, blocks 27 and 28 for issuing the decrypted data packet to the user, blocks 29 and 30 for registering incoming data packets with the mark of the data packets received with the wrong value simulation inserts, blocks 31 and 32 for generating and transmitting a message about the received data packet with the wrong value for simulation inserts to the security control center 8, which contains block 33 generating and distributing encryption keys to the user security servers, block 34 for receiving data packets with the wrong value of the simulation insert, block 35 for making decisions on localizing unauthorized influences and eliminating the consequences of unauthorized influences, and block 36 for interacting with the general data transmission network control center 7 with packet switching.

In FIG. 2 shows a diagram of a system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences, different from the circuit shown in FIG. 1 only in that the subscriber security servers 9 and 10 are installed at the end of the communication lines 1 and 2 of the users directly at the ports of the corresponding routers 5 of the allocated protected fragment 6 of the public data network with packet switching.

The proposed system for protecting data packets during transmission in a dedicated protected fragment of a packet-switched data network is as follows.

When a data packet is transferred from user 3 to user 4, the block And of the subscriber security server 9 receives and extracts the contents of the data field from the received data packet at the network level, block 13 from the block 33 of the security control center 8 encryption keys for all pairs interacting with this subscriber security server subscriber security servers, block 15 selects from the block 13 an encryption key for interacting with: a pair of subscriber security servers 9 and 10 and, in accordance with it, an encryption algorithm, for example, according to GOST 28147-89, encrypts the contents of the data field of the received data packet and forms a simulation insert for the part of the data packet that is unchanged during transmission; block 17 adds a simulation insert to the transmitted data packet; block 19 adjusts the header of the data packet and generates the converted data packet, block 21 transmits the converted data packet to router 5 of the allocated protected fragment 6 of the packet-switched public data network, from where the converted data packet arrives at the subscriber security rover 10 of user 4. Block 24 of the subscriber security server 10 receives and allocates the converted data packet at the network level, block 26, in accordance with the encryption key obtained from block 14 and the decryption algorithm, for example, according to GOST 28147-89, decrypts the received converted data packet and checks the correctness of the received simulation insert, and block 28, with the correct value of the simulation insert, issues the received data packet without the simulation insert to user 4. When fixing the wrong value, they Iterative insertion in the received data packet the data packet is erased. Block 30

registers incoming data packets with the mark of data packets received with the wrong value of the simulation insert, block 32 generates and transmits a message about the received data packet with the wrong value of the simulation insert to block 34 of the security control center 8, block 35 of which together with the center 7 of the network control and others Organizational structures decide on the localization of unauthorized influences and the elimination of their consequences.

Shown in FIG. 2 circuit protection system

tjnpou, cece and re-edtschts BJ

. data packets in a dedicated protected fragment of a public data network with packet switching from unauthorized influences works in a similar way.

The proposed protection system. , packages

(/ process. € ёреЭаУб / у given the selected protected fragment of the transmission network

public data with packet switching from unauthorized influences when installing subscriber security servers at the output of the user terminal at the beginning of the user's communication lines with a highlighted protected fragment of the public switched packet data network includes the user and communication lines in the protection circuit, i.e. the protection area of the selected protected fragment of the public data transmission network with packet switching is expanded, while the subscriber security servers should be installed at the request of users of the selected protected fragment of the public data transmission network with packet switching in the protected territory of users.

Claims (1)

A system for protecting data packets during transmission in a dedicated protected fragment of a public switched data network with IP switching protocol, from unauthorized influences, including user lines, a dedicated protected fragment of a public switched data network with IP switching, comprising routers, a network control center and communication lines connecting them, characterized in that it further comprises a center included in the network control center security management and related subscriber security servers installed either at the output of the user terminal at the beginning of the user's communication line connecting the subscriber security server to the router port of the allocated protected fragment of the public data network with packet switching, or at the entrance to the router port at the end of the line a user linking the subscriber security server to the user terminal, wherein each subscriber security server contains a block volume and selection at the network level from the received data packet of the contents of the data field, a block for receiving from the security control center and storing encryption keys for each pair of interacting subscriber security servers, a block for encrypting the contents of the data field of the data packet received from the user and generating for the part that is unchanged during transmission data package of a simulation insert, a block for adding a simulation insert to an encrypted data packet, a block for correcting a header of a data packet and generating a pre a data packet transformed, a transformed data packet transmission unit, a transformed data packet reception and isolation unit at a network level, a decrypted received data packet decryption unit and a validation of a received value of a simulation insert, a decrypted data packet output unit to a user, an incoming data packet registration unit with packet marking data received with the wrong value of the simulation insert, the block forming and transmitting messages about the received packet with the wrong value an imitation insert to the security control center, which contains a block for generating and distributing encryption keys to subscriber security servers, a block for receiving messages about data packets received with an incorrect imitation inset, a decision block for localizing unauthorized influences and eliminating the consequences of unauthorized influences, and an interaction unit with a packet switched public data network control center, wherein the subscriber security server, established at the beginning of the user’s communication line connecting the subscriber security server with the router of the selected protected fragment of the public data network with packet switching, on the one hand connected to the user terminal, and on the other hand connected to the user’s communication line, and the subscriber security server installed in the end of the user's communication line connecting it with the user terminal is connected on the one hand with this user communication line, and on the other hand with the access port mash protected fragment selected public data packet network implementing the IP protocol.