RU2580815C2 - Method for centralised control of access of control systems to active network equipment in distributed computer systems and system therefor - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to information security. A method for centralised control of access of control systems to active network equipment in distributed computer systems, the method comprising authorising user accounts; retrieving discretionary access rights of user accounts that have successfully undergone the authorisation procedure; comparing discretionary access rights requested by authorised user accounts with previously retrieved user accounts; retrieving mandatory labels of user accounts and the active network equipment; comparing the mandatory labels of user accounts and the active network equipment; authorising security manager accounts; generating an enable or disable signal for changing security parameters of the distributed computer system.

EFFECT: improved security of active network equipment.

3 cl, 2 dwg

Description

The invention relates to computer technology, namely to information computer systems and networks, and can be used to ensure the confidentiality of data processed in such systems, in particular in distributed computing systems.

The relevance of centralized control of access of control systems to active network equipment in distributed computing systems is determined by the need to automate the process of controlling active network equipment in distributed computing systems and to ensure the confidentiality of data processed in such systems by restricting access to control systems, the transmission of signals from which are initiated by user accounts and security administrators, to an active network equipped th.

Under the control system refers to a combination of hardware (hardware) and software designed to maintain or improve the operation of the control object [F. Voroisky Informatics. Encyclopedic dictionary-reference: introduction to modern information and telecommunication technologies in terms and facts. - M .: FIZMATLIT, 2006. - 768 p.]. Modern distributed computing systems are built on the basis of a large number of active network equipment - switches, routers, network gateways and servers. The distributed nature of large computing systems and the presence of a large number of different network devices makes it extremely difficult to manage them manually. Therefore, the control system for active network equipment is a hardware-software complex that performs the functions of monitoring, control and error handling that arise during such management.

A known method of centralized access control that implements a discretionary access control mechanism is that the administrator assigns access rights to objects to access subjects, and when a subject requests access to an object, in order to analyze its authorization, access rights to an object are requested by the subject’s name, by which access is requested, the access control of the subject in the formation of access rights to objects is set by one of the two policies of access control of the subject - permissive (the main Litika) and prohibitive, formed in a certain way [The way to set and process access rights by a discretionary mechanism for controlling access to resources / A. Scheglov. Application: 2004108526/09, 03/22/2004. Application publication date: 09/27/2005].

The disadvantage of this technical solution is the lack of control of data flows between subjects and access objects, which is implemented through a mandatory access control mechanism. This allows the attacker to carry out attacks on the protected system by introducing malware into its structure, which leads to a violation of the security of the controlled active network equipment.

A known method of centralized access control that implements a mandatory access control mechanism, which consists in the fact that

differentiation of access to the included object by writing and reading is carried out on the basis of the specified differentiations for all inclusive (this object) objects in the hierarchy level,

the requested access to the included object is allowed only if it is allowed to be included (to which access is requested) by all objects of the hierarchy including it,

the markup of objects consists in the fact that the enclosing object is assigned a security label that exceeds (having a smaller category) security labels of all objects included in it,

if the labels of included objects coincide with the labels assigned to users, otherwise, the inclusion object is assigned a security label that matches (having the same category) with a larger security label of objects included in it, while security labels of the same hierarchy level (included in one object) can to differ [A method for processing and assigning security labels by a mandatory (authoritative) mechanism for delimiting access rights to hierarchical objects / Shcheglov A.Yu. Application: 2004108590/09, 03/22/2004. Application publication date: 09/27/2005].

The disadvantage of this technical solution is the lack of discretionary access control of user accounts, which does not allow you to set access rules for each object and subject of access and thereby complicates the administration of such a system.

The closest technical solution is a method that uses a centralized access control mechanism and consists in

authorization of user accounts by providing signals corresponding to the user credentials (name and password) of users, and their comparison with the stored reference values of the corresponding signals;

extracting discretionary access rights of user accounts that have successfully passed the authorization procedure;

comparing discretionary access rights and requested access settings for user accounts;

Defining discretionary access rights for user accounts by the security administrator. The system for implementing this method includes a user authorization block, a block for differentiating access rights, a block for storing access rights [Hillay V. Secrets of Windows NT Server 4.0. - K. Dialectics, 1997, p.14-15].

A disadvantage of the known technical solution is the lack of a mechanism for monitoring signals from the accounts of security administrators in the application of this technical solution to control access to active network equipment in a distributed computing system. This allows security administrator accounts to gain unlimited network access to active network equipment, which leads to security breaches caused by intruders.

The objective of the invention is to create a method and system for controlling access of control systems to active network equipment in distributed computing systems with security features from an internal intruder.

The technical result of the proposed solution is to increase the security of active network equipment through the implementation of a mechanism for monitoring signals from active network equipment control systems, the transmission of which is initiated by the accounts of security administrators in distributed computing systems and reducing the time and resource costs of restoring the performance of distributed computing systems after failures caused by network access of security violators, due to use of mechanisms of discretionary and mandatory access control of control systems to active network equipment.

The solution of the technical problem is provided by the fact that in the method of centralized access control of control systems to active network equipment in distributed computing systems

authorize user accounts by providing signals corresponding to the credentials (name and password) from active network equipment control systems and comparing them with the stored reference values of the corresponding signals;

extract discretionary access rights of user accounts that have successfully passed the authorization procedure;

compare discretionary access rights requested by authorized user accounts with previously extracted ones;

retrieving credentials for user accounts and active network equipment access is requested;

comparing the credentials of user accounts and active network equipment, access to which is requested;

authorize the accounts of security administrators upon receipt of a signal from the control system of active network equipment containing a request to change discretionary access rights and / or credentials of user accounts and active network equipment by providing signals corresponding to the credentials (name and password) from systems management of active network equipment and their comparison with the stored reference values of the corresponding signals;

generate a signal of permission or prohibition to change the security settings of a distributed computing system.

The system for implementing this method includes a user authorization block; block of access rights differentiation; access rights storage unit; storage unit credentials; security administrators authorization unit, while the output of the user authorization unit is connected to the input of the access rights delimiting unit, the output of the security administrators authorization unit is connected to the corresponding inputs of the access rights storage unit and the credential storage unit, the outputs of which are connected respectively to the inputs of discretionary access rights and credential labels block differentiation of access rights.

New significant features of the system: the presence of a storage unit for credentials, a security administrators authorization unit.

New significant features of the method:

retrieving credentials for user accounts and active network equipment access is requested;

comparing the credentials of user accounts and active network equipment, access to which is requested;

authorize the accounts of security administrators upon receipt of a signal from the control system of active network equipment containing a request to change discretionary access rights and / or credentials of user accounts and active network equipment by providing signals corresponding to the credentials (name and password) from systems management of active network equipment and their comparison with the stored reference values of the corresponding signals.

generate a signal of permission or prohibition to change the security settings of a distributed computing system.

The listed new essential features of the method and system for its implementation in conjunction with the known ones allow to obtain a technical result in all cases to which the requested amount of legal protection applies.

The proposed method and device for its implementation form a single inventive concept, the essence of which lies in the additionally introduced verification of credentials of user accounts access to controlled active network equipment specified by credentials, and separate authorization of user accounts and security administrators.

The possibility of using the proposed method and system in distributed computing systems, the popularity of the means and methods by which it is possible to implement the invention in the described form, allows us to conclude that it meets the criterion of "industrial applicability".

The analysis of the prior art did not reveal a technical solution, which is characterized by all the features of the invention, expressed by the formula, which indicates that the proposed technical solution meets the criterion of "novelty."

The centralized combination of discretionary and mandatory access control is well known. However, the proposed technical solution provides additional control over the actions of user accounts that are security administrators, thereby eliminating the possibility of attacks on the system by network access from internal violators with security administrator accounts. The use of this approach, based on the separation of authority between accounts at the level of managing active network equipment and administering the security of distributed computing systems, is not known from the prior art. The present invention meets the condition of an inventive step, because based on the addition of a well-known technical solution to the security administrators authorization blocks and storage of credentials, the claimed technical result is achieved due to the relationship of additional and known actions performed on tangible objects in the method and the totality of additionally entered blocks and the corresponding functional connections in the system.

The invention is illustrated using figures 1, 2. Figure 1 shows a diagram of a method for centralized access control of user accounts to active network equipment in distributed computing systems. Figure 2 shows a modular diagram of a system that implements this method.

The method is implemented as follows. Upon receipt of a signal from the control system containing a request for access to the controlled active network equipment, the user account that initiated the request is authorized by matching the credentials provided by the user (name and password) with the stored reference values.

If the credentials provided by the user coincide with the stored reference values, the discretionary access rights of the user account that successfully passed the authorization procedure to the active network equipment that was accessed are retrieved from the access rights storage unit in which the discretionary access rights of user accounts are stored requested.

Then, the requested discretionary access rights and the discretionary access rights set for this user account are compared from the following set of discretionary access rights: connection to the controlled active network equipment via the Telnet, SSH, FTP or SFTP network protocol, scanning of network ports of the controlled active network equipment, monitoring integrity of active network equipment.

If the discretionary access rights set for this user account are consistent with those requested, extract the credentials of the user account and the active network equipment that is being accessed, which consist of a security level representing a natural number and an unordered set of categories, each element of which represents a word.

Then, the credential label of the active network equipment is compared with the credential label of the user account by comparing the security levels of the active network equipment and this user account, as well as comparing the sets of categories of active network equipment and this user account. Comparison of security levels is performed on the halves of the comparison of integers. Comparison of sets of categories is performed according to the rules of comparison of sets.

If the security level of the user account is greater than or equal to the security level of the active network equipment, and the many categories of the user account include many categories of active network equipment, an access permission signal is generated for the active network equipment. Otherwise, a denial of access to active network equipment is generated.

Upon receipt of a signal from the active network equipment management system containing a request to change discretionary access rights and / or credentials of user accounts and active network equipment, the security administrator account is authorized by providing signals corresponding to the credentials (name and password) from control systems for active network equipment and their comparison with the stored reference values of the corresponding signals.

If the provided credentials match the stored reference values, a permission signal is generated to change the security settings, allowing you to set or change existing discretionary access rights for user accounts or credential labels for user accounts and active network equipment. If the provided credentials do not match the stored reference values, a prohibition signal is generated to change the security settings of the distributed computing system.

To automate the method of centralized control of access of control systems to active network equipment in distributed computing systems, a system is used (Fig. 2), which consists of a user authorization unit (1), an access rights delimitation unit (2), an access rights storage unit (3), a storage unit for credentials (4), a block for authorization of security administrators (5).

The system operates as follows. Upon receipt of a signal from the control system containing a request for access to the controlled active network equipment, the user account is authorized, which is carried out by the user authorization unit, the authorization parameters — the user name and password, the authorization unit retrieves from its local database. The credentials specified in the request are compared with the credentials retrieved from the database. If they coincide, the requested access parameters are transferred to the access rights delimitation block. Next, along with a comparison of the discretionary access rights of user accounts, credentials are set and compared by comparing credentials for user accounts and the active network equipment access to which is requested. Credential tags are generated by the security administrator from the output of the security administrators authorization block (after authorization of the security administrator) and are stored in the credential storage unit. When a user requests access to active network equipment, access parameters (a set of discretionary access rights, credentials for the account of the user who requested the resource (security level and category list) and the active list are received from the access rights block and the credential storage unit) network equipment, access to which is requested, the unit compares the request with the access parameters and generates (or not) an access permission signal for the user account. a special class of signals from the control system that contain a request for changing security settings that are processed by the security administrators authorization unit, in this case, access is requested not to active network equipment, but to security settings (user accounts, discretionary access rights, credential labels of accounts users and the most active network equipment, categories included in the credentials) of a distributed computing system. After passing the authorization procedure for the security administrator (similar to the procedure for authorizing user accounts), the discretionary access rights of user accounts are entered into the storage block of the access rights, credentials of the credentials label are entered credentials of user accounts and the most active network equipment.

Let us consider an example of the implementation of the proposed technical solution when performing verification of access rights of control systems in a distributed computing system that includes ACO1 and ACO2 network switches that make up a lot of controlled active network equipment.

The database containing user credentials contains the following identification parameters: username - user1, password - user1, username - user2, password - user2. The database containing the credentials of security administrators contains the following identification parameters: username - admin, password - admin.

At the time the system starts operating, the access discretion block contains the following discretionary access rights (intersection of the corresponding rows and columns):

ACO1 ACO2 user1 Network Port Scan Performing Integrity Control user2 - Telnet Connection

The credential storage unit contains the following information:

Security level Category List user1 2 {switches, web servers} user2 one {web servers} ACO1 one {switches} ACO2 2 {switches}

The control system receives a signal containing a request for the user1 user account to access ACO1 with the following access parameters: requested discretionary access rights: scan network ports; credentials: username is user1, password is user1. The credentials specified in the request are compared with the credentials stored in the local database. Since there is a corresponding row in the database, i.e. the submitted credentials coincide with those stored in the system, the access parameters requested by the user account are transferred to the access rights delimitation unit.

The discretionary access rights of the user1 user account that has successfully passed the authorization procedure to ACO1: network port scan are extracted from the access rights delimitation block. Since the requested discretionary access rights are the same as the discretionary access rights stored by the user1 user account, credential matching is performed.

The security level of user account user1 (2) exceeds the security level ACO1 (1), and the many categories of user account user1 ({switches, web servers}) include many categories of ACO1 ({switches}). Therefore, the system generates an access permission signal to ACO1.

Then, from the control system side, a signal is received containing a request for the user2 user account to access ACO2 with the following access parameters: requested discretionary access rights: integrity control, credentials: username - user2, password - user2. The credentials specified in the request are compared with the credentials stored in the local database. Since there is a corresponding row in the database, i.e. the submitted credentials coincide with those stored in the system, the access parameters requested by the user account are transferred to the access rights delimitation unit.

The discretionary access rights of the user2 user account that has successfully passed the authorization procedure to ACO2: Telnet connection are extracted from the access rights delimitation block. Since the requested discretionary access rights do not match the stored discretionary access rights of the user2 user account, the system generates a signal to deny access to ACO2.

Next, the control system receives a signal containing a request for the user2 user account to access ACO2 with the following access parameters: discretionary access rights: Telnet connection, credentials: username - user2, password - user2. The credentials specified in the request are compared with the credentials stored in the local database. Since there is a corresponding row in the database, i.e. the submitted credentials coincide with those stored in the system, the access parameters requested by the user account are transferred to the access rights delimitation unit.

The discretionary access rights of the user2 user account that has successfully passed the authorization procedure to ACO2: Telnet connection are extracted from the access rights delimitation block. Because the requested discretionary permissions are the same as the discretionary permissions of the user2 user account, credential matching is performed.

The security level of user account user2 (1) does not exceed the security level of ACO2 (2), and many categories of user account user2 ({web servers}) do not include many categories of ACO2 ({switches}). Consequently, the system generates a signal to deny access to ACO2.

Next, the control system receives a signal containing a request for the security admin account admin admin access to change the discretionary access rights of the user2 user account, providing the following access parameters: discretionary access rights of the user2 user account to ACO2: integrity control, Telnet connection; credentials: username is admin, password is admin. The credentials specified in the request are compared with the credentials stored in the local database. Since there is a corresponding row in the database, i.e. the presented credentials coincide with those stored in the system, generate a permission signal for changing the security settings of the distributed computing system, and these discretionary access rights are transferred for storage to the storage unit for access rights.

The use of this invention in existing implementations of distributed computing systems will increase the security of active network equipment through the implementation of a mechanism for monitoring signals from active network equipment control systems, the transmission of which is initiated by the accounts of security administrators, in distributed computing systems, and reduce time and resource costs to restore the performance of distributed computing systems after failures caused by actions of security violators, through the use of discretionary and mandatory monitoring mechanisms for access of control systems to active network equipment.

Claims (3)

1. The method of centralized access control of control systems to active network equipment in distributed computing systems, which consists in the fact that
authorize user accounts by providing signals corresponding to user credentials from active network equipment control systems and comparing them with the stored reference values of the corresponding signals;
extract discretionary access rights of user accounts that have successfully passed the authorization procedure;
compare discretionary access rights requested by authorized user accounts with previously extracted ones;
characterized in that it further
retrieving credentials for user accounts and active network equipment access is requested;
comparing the credentials of user accounts and active network equipment, access to which is requested;
authorize the accounts of security administrators upon receipt of a signal from the control system of active network equipment containing a request to change discretionary access rights and / or credentials of user accounts and active network equipment by providing signals corresponding to the credentials of security administrators from active network management systems equipment and their comparison with the stored reference values of the corresponding signals.
generate a signal of permission or prohibition to change the security settings of a distributed computing system. 2. The system for implementing the method according to claim 1, including
a user authorization unit that authorizes user accounts by providing signals corresponding to user credentials from active network equipment control systems and comparing them with stored reference values of the corresponding signals;
the access control differentiation unit, which extracts the discretionary access rights of user accounts that have successfully passed the authorization procedure, compares the discretionary access rights requested by authorized user accounts with previously extracted ones, extracts the credentials of user accounts and active network equipment, access to which is requested , compares the credentials of user accounts and active network equipment, access to which is requested It generates an enable or disable signal for changing the security settings of a distributed computing system;
an access rights storage unit that stores discretionary access rights of user accounts; characterized in that it further comprises
a credential label storage unit that stores credential labels of user accounts and active network equipment;
a security administrators authorization unit that authorizes security administrators' accounts upon receipt of a signal from an active network equipment management system containing a request to change discretionary access rights and / or credential labels of user accounts and active network equipment by providing signals corresponding to the credentials of security administrators , from the control system of active network equipment and their comparison with the stored reference values mi appropriate signals;
wherein the output of the user authorization unit is connected to the input of the access parameters of the access rights delimitation unit; the output of the authorization block of the security administrators is connected to the corresponding inputs of the storage unit for access rights and the storage unit for credentials, the outputs of which are connected respectively to the inputs of discretionary access rights and credentials for the block for differentiating access rights. 3. The method according to p. 1, characterized in that the mandatory tags of the active network equipment, access to which is requested, consists of a security level and a list of categories.

Images