RU2586840C1 - Method of processing network traffic datagrams for hiding corresponding pairs of subscribers of information-telecommunication systems - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method provides forming of multiple trusted assemblies on rights of individual clients of communication operator, which is divided into r subsets, in the list of addresses the following data is registered: composition subsets for each of the corresponding pairs in the direction of transmission, a list of authorised IP addresses for each of the trusted nodes and subscribers of corresponding pairs. On the trusted units a traffic is generated, after extraction in the formed datagram of addresses of sender SA and recipient SB from a list of addresses one of number of authorised units allocated for this pair is selected, one of permitted IP addresses of sender and one of permitted IP address of the selected trusted node, the T number of intermediate trusted nodes is determining determined on a route of datagram transfer; IP address of the source and IP address of network datagram destination are selected as IP addresses of sender and the selected trusted node, the “option” field network datagram is populated with number of trusted intermediate nodes on a route of datagram transmission, after receiving a network datagram on a trusted node is checked the specified value T in the “option” field if T=0, then from a list of addresses one of the permitted IP addresses of the recipient and trusted node is selected, IP-address of the source and destination IP address are recorded into field “Source IP-address” and “Destination IP address” for network datagram; IP address selected for trusted node and recipient are transmitted over a communication channel as formed datagram.

EFFECT: high level of protection against unauthorised access at data exchange in a network.

3 cl, 4 dwg

Description

The invention relates to the field of methods and devices for protecting information in computer systems and networks and can be used to increase the security of the elements of a geographically distributed structure of macro enterprises, for example, such as large holdings, production associations, combines, trusts, syndicates, concerns, transnational corporations, etc. etc., when exchanging data through a public communications network.

Distributed systems are characterized by the fact that such attacks as “remote attacks” are applicable to them, since their components use open data transmission channels and the intruder can not only passively “listen” to the transmitted information, but also modify, delay, duplicate, delete the transmitted messages, it is unauthorized to use their details, i.e. carry out an active impact. [Shangin V.F. Protection of computer information. Effective methods and tools. - M.: DMK Press, 2010. - 544 p., Pp. 50-62, Vasilkov A.V., Vasilkov A.A., Vasilkov I.A. Information systems and their security. - M .: Forum, 2010. - 528 s, p. 26].

Any attack is preceded by a stage of preliminary informing (reconnaissance), which is aimed at collecting information necessary for choosing methods and means of further implementation of the attack. One of the main ways of collecting information is to analyze network traffic by intercepting transmitted data packets. For this, the intruder can use special software traffic analyzers, with which you can determine the existing information flows, the addressing scheme of the nodes, the types of network services used, etc. [Serdyuk V.A. Organization and technology of information security. Detection and prevention of information attacks in automated systems of enterprises. - M .: State. University - Higher School of Economics, 2011. - 572 p., Pp. 52-63].

The claimed technical solution expands the arsenal of means and methods of protecting information in computer systems and networks by the stage of preliminary informing (reconnaissance) by preventing (significant difficulty) determining existing information flows between elements of a distributed system, identifying its structure, which will increase the security of elements from remote attacks .

A known method of organizing a local computer network and firewall according to the patent of the Russian Federation No. 2214623, class. G06F 15/163, 15/173, published on 10/20/2003, namely, that the internal network is protected using a firewall, which is a set of hardware and software tools containing at least two network interfaces for exchanging bi-directional network flows packets between the network interfaces of the firewall and filtering the broadcast network packets in accordance with the specified filtering rules. In this case, the firewall is excluded from the number of network subscribers by setting up the firewall control program in which this program uses the network interfaces of the firewall to receive and transmit packets without assigning logical addresses to them, hides information about their physical addresses, and filtering rules are set using Using a separate management interface that is not connected to the network interfaces of the firewall.

However, the method has drawbacks in the possibility of sending network datagrams with a fake address of the sender of the network datagram, as well as the possibility of unimpeded interception and modification of the contents of network datagrams.

A known method of processing datagrams of network traffic to delimit access to information and computing resources of computer networks according to the patent of the Russian Federation No. 2314562, class G06F 21/22, published January 10, 2008, bull. No. 1. The method consists in the following actions: to protect computer networks, a gateway computer with a firewall is used, the firewall checks the network datagrams in accordance with the operator’s list of access rules to the computer network, writes notes in the datagram that correspond to the access rules, then transparently relay the correct datagrams , and on the recipient side it passes or blocks network datagrams in accordance with the notes indicated inside.

The disadvantage of this method is the low reliability of detection of forgery of computer addresses of the sender and recipient of network datagrams, due to the implementation of appropriate actions to detect spoofing only in a local secure network, while not taking into account the possibility of spoofing in an external network and, accordingly, the possibility of unauthorized entry into a protected information and computer network.

A known method of processing datagrams of network traffic to protect information and computer networks (the first option) according to patent RU No. 2472217, IPC G06F 21/22, published January 10, 2013, bull. No. 1. The method consists in the following: for the protection of computer networks, a gateway computer with a firewall installed on the communication channels of the protected network with other networks is used, a cryptographic key K is generated from the user and transmitted to the gateway computers of trusted nodes, when the network datagram is detected, the sender address is allocated SA, the recipient address SB, form the transmission route mj of the network datagram Pi over the external network between the protected computer networks as a sequence of addresses of trusted nodes S1, S2, ... SVj, then Write the route m _j in the Options field of the network datagram. A network datagram is formed with the address of the recipient SB and the address of the nearest trusted node SVj in accordance with the transmission path m _{j of the} network datagram Pi. The network datagram is encrypted using the cryptographic key K and the steps are repeated, starting from the formation of the network datagram and its encryption to the formation of the network datagram with the address S1 of the first trusted node and the sender address of SA. The generated secure network datagram D, which is received at the next trusted node, is transmitted over the communication channel of the external network. The network datagram is decrypted using the cryptographic key K and the values of the “Options” field of the received packet are written into the memory of the gateway computer. A new value of the "Options" field is formed taking into account the address of the next trusted node passed, which is recorded in the "Options" field of the transmitted packet. Moreover, the actions of transmitting, receiving, decrypting the network datagram, as well as generating and writing the values of the Options field, are repeated on each trusted node of the route m _j . The values specified in the Options field are compared with the values of the transmission route of the secure network datagram defined on the recipient node, and in case of a mismatch in the transmission route, they decide to block the network datagram.

Closest to the technical nature of the proposed method is a method of processing datagram network traffic to protect information and computer networks (second option) according to patent RU No. 2472217, IPC G06F 21/22, published January 10, 2013, bull. No. 1.

The method consists in the following actions:

use a gateway computer with a firewall installed on the communication channels of the protected network with other networks;

form a cryptographic key K for the user,

transmit it to the gateway computers of trusted nodes,

form an array M = (m ₁ , m ₂ , ... m _j , ... m _M ) for each trusted node of the transmission routes of network datagrams over an external network between secure computer networks in the form of a sequence of trusted nodes on the transmission path of a network datagram m _j = (S1, S2, ... Sr, ... SVj), where Vj is the number of the last trusted node on m _j , the route, on the transmission path of the network datagram;

form a list of addresses S1, S2, S3 ... trusted nodes;

remember it formed routes for all trusted addresses of recipients and senders;

in the generated datagram, the addresses of the sender SA and recipient SB are allocated;

choose one of the possible routes m _j ,

reading from the array M the value of the first trusted node on the transmission route of the network datagram corresponding to the values of the sender address SA, recipient address SB and the selected route number j;

write in the “Options” field of the network datagram Pi the address of the sender SA, the address of the recipient SB and the selected route number j;

form a network datagram with the address of the first trusted node of the recipient and the address of the sender SA;

encrypting the network datagram using the generated cryptographic key K;

transmit the generated secure network datagram D through the communication channel of the external network;

accept a secure network datagram D at the next trusted node;

the network datagram is decrypted using the cryptographic key K; the values of the "Options" field of the received packet are written into the memory of the gateway computer;

reading from the array M the value of the next trusted node Sr on the transmission route m _j of the network datagram corresponding to the values of the sender address SA, recipient address SB, and the specified route number j in the "Options"field;

form a new value for the "Options" field, taking into account the address of the trusted node passed, which is recorded in the "Options" field of the transmitted packet;

form a secure network datagram with the recipient address Sr and the sender address S _r-1 ;

repeat the steps from transmitting, receiving a secure network datagram and decrypting it using a cryptographic key K to transmitting the network datagram with the generated addresses of the recipient SB and the sender SVj through the communication channel;

the values specified in the "Options" field are compared with the values of the transmission route of the secure network datagram defined on the receiver's node;

in case of a mismatch in the transmission route, they decide to block the network datagram.

The disadvantages of the above methods are:

high technical complexity of trusted nodes (trusted nodes perform both routing and cryptographic functions),

high computational load on trusted nodes (decryption and processing of each datagram on each trusted node along the transmission route are performed),

high computational load on the end nodes (during the formation of the network datagram, encapsulation and encryption of each packet are performed j times, where j is the number of trusted nodes on the transmission route),

a large length of a secure network datagram (due to the inclusion of j headers, where j is the number of trusted nodes on the transmission route), which increases the load on the network,

narrow applicability due to restrictions on the Options field. [RFC 791 - IP Protocol. Electronic resource. URL: http://rfc2.ru/791.rfc. Date of appeal 01.10.2014],

high probability of compromising the key (the same key K is transmitted to all trusted nodes).

The technical result of the claimed method is to eliminate the disadvantages of the prototype while maintaining its advantages, as well as expanding the functionality by hiding the corresponding pairs of subscribers, preventing (significant difficulty) determining the existing information flows between the elements of a distributed system, identifying its structure, which will increase their protection from remote attacks.

In the claimed invention, the goal is achieved by the fact that in the known method for protecting computer networks using a gateway computer with a firewall installed on the communication channels of the protected network with other networks, form a list of addresses S1, S2, S3 ... trusted nodes, highlighted in the generated datagram addresses of the sender SA and recipient SB, form a network datagram with the address of the first trusted node of the recipient and the address of the sender SA, transmit the generated secure network datagram via the external network channel mu D, receive a secure network datagram D on the next trusted node, write the values of the Options field of the received datagram to the gateway computer memory, form a new value for the Options field, form a secure network datagram, and additionally form a lot of trusted nodes {M} on the right individual customers of a telecom operator, randomly divide the set {M} into r subsets {M _r ′}, remember the composition of the resulting subsets, randomly select one of them for each direction broadcasts, in the address list, remember the composition of the subsets {M _r ′} (conditional numbers of trusted nodes) for each of the corresponding pairs in a given direction of transmission, a list of allowed IP addresses for each of the trusted nodes and subscribers of the corresponding pairs, generate traffic on the trusted nodes, typical for end users of this network segment, after highlighting in the generated datagram the addresses of the sender SA and recipient SB from the list of addresses randomly select one of the numbers of trusted nodes allocated For this correspondent pair in a given direction of transmission, one of the allowed IP addresses of the sender and one of the allowed IP addresses of the selected trusted node, randomly determine the number T of intermediate trusted nodes on the transmission route of the datagram, write in the "IP address of the source" field and the “destination IP address” of the network datagram, the selected IP addresses of the sender of the SA and the selected trusted node record in the “Options” field of the network datagram the number of intermediate trusted nodes on the action transfer route After receiving a network datagram on a trusted host, the value of the number T of intermediate trusted nodes on the datagram’s transmission route is checked in the Options field, if T = 0, then one of the allowed IP addresses of the recipient and trusted host is randomly selected from the address list, write in the field “Source IP Address” and “Destination IP Address” of the network datagram the selected IP addresses of the trusted node and recipient SB and transmit the generated datagram through the communication channel, if T ≠ 0, then reduce the value of T by 1 from the list of addresses after one of the allowed IP addresses of the selected trusted node (to fill in the “Destination IP address” field of the network datagram) and one of its allowed IP addresses (to fill in the “IP address” field) source ”of the network datagram), form a new value for the“ Options ”field, taking into account the calculated number T of intermediate trusted nodes on the data transfer route of the datagram, form a secure network datagram with the selected IP addresses of trusted nodes, repeat the action starting with transmitting, receiving a secure network datagram, checking the T value, selecting trusted nodes, generating new IP addresses until the T value becomes 0. A new set of essential features allows us to achieve the indicated technical result due to the absence in the header packets at the same time the address of the sender and receiver and the random transmission of packets between trusted nodes of the information and telecommunication system, which allows to prevent (significantly complicate) the definition of general information flows between elements of a distributed system, revealing its structure.

The claimed method is illustrated by drawings, in which:

in FIG. 1 is a diagram explaining the construction of the network in question;

in FIG. 2 is a flowchart of a network traffic datagram processing algorithm for hiding the corresponding pairs of subscribers of information and telecommunication systems;

in FIG. 3 is a variant of the address list for the corresponding pair SA-SB;

in FIG. 4 - IP packet header format (IPν4 version).

The implementation of the claimed method is illustrated as follows.

As a public data transmission network (Fig. 1), we consider a set of telecommunication nodes and channels specially created for organizing communications between certain points in order to ensure data transmission between them [Rules for connecting telecommunication networks and their interaction (approved by the decree of the Government of the Russian Federation of 28 March 2005 N 161). Electronic resource. URL: http://base.garant.ru/188008. Date of appeal 02.10.2014].

A communication node is an integral part of communication networks intended for combining and distributing message flows [Big Encyclopedic Dictionary / Ch. ed. A.M. Prokhorov. Ed. 2nd, rev. and add. M .; Publishing house "Big Russian Encyclopedia, Scientific Publishing House, 2000. - 1456 p.].

To implement the proposed method, a plurality of trusted nodes {M} are formed, which act as individual clients of the telecommunications operator (block 2, Fig. 2), on which traffic is generated that is typical for end users of a given network segment. The number of end users significantly exceeds the number of telecommunication nodes, which reduces the likelihood of a trusted node being found by an attacker [E. Wentzel Probability theory. - M .: KNORUS, 2010 - 664 p., Pp. 27-28]:

where R _nd - the probability of finding a trusted site by an attacker,

N _du - the number of trusted nodes,

N is the total number of terminal users in the network:

where N _op - the number of terminal users in the network.

In order to simulate the work of end users of the network, average statistical data on the type, volume and daily intensity of the traffic of users of the network segment in which the operation of the trusted node is supposed to be pre-collected.

Next, the set of trusted nodes {M} is divided into r disjoint subsets {M _r } (bl. 3 of Fig. 2) in any way, and

where N _kp is the number of corresponding pairs of subscribers, since for each direction of transmission (from subscriber SA to subscriber SB (SA-SB) and from subscriber SB to subscriber SA (SB-SA)), a random subset of trusted nodes is selected.

Partitioning a set is the division of the set {M} into parts (subsets), in which each element falls into some of the parts and no two parts have common elements [G. Choquet Geometry. - M.: “World”, 1970 - 242 p., P. 232].

Moreover, the number of such partitions is determined by the following relation (Stirling numbers of the second kind):

where S (n, m) is the number of partitions of the set of n elements into m disjoint subsets [Sigal I.Kh., Ivanova A.P. Introduction to discrete programming: models and computational algorithms. - M .: FIZMATLIT, 2003. - 240 p., P. 37]. The number of elements with such a partition in the resulting subsets can be different.

The number N (M _k (A)) of all k-element subsets of A from n elements is determined by the following relation [A. Semenov Four lectures on combinatorics: guidelines. - Ulyanovsk: UlSTU, 2005. - 20 p., P. 10]:

The number of elements with such a partition in all the resulting subsets is the same.

The composition of the subsets obtained is stored, one of them is randomly selected (blocks 3, 4 of Fig. 2) for each of the transmission directions (from subscriber SA to subscriber SB (SA-SB) and from subscriber SB to subscriber SA (SB-SA) )

In FIG. 1 shows an offset pair of subscribers SA, SB. The selected subset of trusted nodes in the SA-SB transmission direction is grayed out. These are the trusted nodes M1, M3, M9, M12. The selected subset of trusted nodes in the SB-SA transmission direction is highlighted in black. These are the trusted nodes M4, M6, M7, M10.

Each subscriber of corresponding pairs and trusted nodes are assigned i IP-addresses.

Thus, an address list is formed (FIG. 3), in which for each of the corresponding pairs the following is stored:

- the composition of a randomly selected subset (conditional numbers of trusted nodes) for each direction of transmission,

- a list of allowed IP addresses for subscribers of corresponding pairs and trusted nodes.

When transmitting the datagram from the subscriber SA to the subscriber pair SB on the gateway computer installed on the communication channel of the protected network with other networks, the sender address SA and the recipient address SB (block 7 of Fig. 2) of the network datagram Pi are allocated, where i = 1, 2, 3, ...

When packets are transmitted over the network, intermediate routers route them according to the address information (Fig. 4) available in the packet header [the rules for presenting the packet header are determined by GOST R ISO / IEC 7498-1-99. "Information technology. Interconnection of open systems. The basic reference model. Part 1. The basic model ”, p. 13].

From the list of addresses, according to random law, one of the numbers of trusted nodes allocated for a given corresponding pair in this direction of transmission is selected, one of the allowed IP addresses of the sender and one of the allowed IP addresses of the selected trusted node. Record in the field “Source IP Address” and “Destination IP Address” of the network datagram the selected IP addresses of the sender SA and the selected trusted node (Blocks 8, 10 of FIG. 2).

According to a random law, the number T of intermediate trusted nodes on the transmission route of the datagram is determined. Moreover, the value of T should not exceed the number of elements in the subset assigned to this offset pair. Write this value in the "Options" field of the network datagram (bl. 9, 10 of Fig. 2).

The "Options" field is optional and has a variable length (Fig. 4).

Option support should be implemented in all IP modules (nodes and routers) [RFC 791, Internet Protocol, 1981, September, pp. 14-22].

The generated network datagram D is transmitted via the external network communication channel (bl. 12 of Fig. 2), the network datagram D is received at the next trusted node (bl. 13 of Fig. 2).

The values of the "Options" field of the received datagram are written into memory. Check the value of the number T of intermediate trusted nodes on the transmission route of the datagram, (bl. 14, 15 of Fig. 2).

If the value of T is 0, then one of the allowed IP addresses of the trusted node and the recipient is selected from the list of addresses according to a random law, which are written in the field “Source IP Address” and “Destination IP Address” SB (blocks 16, 17 of FIG. . 2) and transmit the formed datagram through the communication channel.

If the value of T is not equal to 0, then reduce it by one. The obtained value is recorded in the "Options" field of the generated network datagram.

Next, from a list of addresses, according to random law, one of the trusted node numbers of the same subset is selected, one of the allowed IP addresses of the selected trusted node (to fill in the “Destination IP address” field of the network datagram) and one of its allowed IP addresses (to fill field "Source IP Address" of the network datagram). Form a network datagram with the selected ZP addresses of trusted nodes.

The steps are repeated, starting from transmitting, receiving a network datagram, checking the value of T, selecting trusted nodes, generating new IP addresses until the value of T becomes 0.

Thus, due to the absence in the packet header of both the sender and receiver addresses and the random transmission of packets between trusted nodes, it is possible to prevent (significant difficulty) the determination of existing information flows between elements of a distributed system and the identification of its structure, which will increase their protection against remote attacks. The technical result is achieved.

Claims (3)

1. A method of processing datagrams of network traffic to hide the corresponding pairs of subscribers of information and telecommunication systems, which consists in using a gateway computer with a firewall installed on the communication channels of the protected network with other networks, forming a list of addresses S1, S2, S3 ... trusted nodes, allocate the addresses of the sender SA and recipient SB in the generated datagram, form the network datagram with the address of the first trusted node of the recipient and the address of the sender SA, transmit via the external network communication channel formed a secure network datagram D, receive a secure network datagram D on the next trusted node, write the values of the "Options" field of the received datagram to the gateway computer memory, form a new value for the "Options" field, form a secure network datagram, characterized in that it forms a lot of trusted nodes {M} on the rights of individual clients operator, randomly divide the set {M} to {M _r '} _r subsets, storing obtained composition subsets randomly selected n one of them for each of the transmission directions in the address list stored composition subsets {M _r '} (conventional numbers of trusted nodes) for each of corresponding pairs in a predetermined transfer direction, a list of permitted IP-addresses for each of the trusted nodes and the subscribers of corresponding pairs , the trusted nodes generate traffic that is typical for end users of a given network segment, after selecting in the generated datagram the addresses of the sender SA and recipient SB from a list of addresses, according to a random law, select one of the numbers of trusted nodes allocated for this corresponding pair in a given direction of transmission, one of the allowed IP addresses of the sender and one of the allowed IP addresses of the selected trusted node, randomly determine the number T of intermediate trusted nodes on the transmission route of the datagram, write to field “source IP address” and “destination IP address” of the network datagram, the selected IP addresses of the sender SA and the selected trusted node are recorded in the “Options” field of the network datagram, the number of intermediate x trusted nodes on
the datagram’s transmission route, after receiving the network datagram on a trusted node, check the value of the number T of intermediate trusted nodes on the datagram’s transmission route in the “Options” field, if T = 0, then randomly select one of the allowed recipient and trusted IP addresses from the list of addresses node, write in the field “Source IP address” and “Destination IP address” of the network datagram the selected IP addresses of the trusted node and recipient SB and transmit the generated datagram through the communication channel, if T ≠ 0, then reduce the value of T by 1, and randomly select one of the trusted node numbers of the same subset, one of the allowed IP addresses of the selected trusted node (to fill in the “Destination IP address” field of the network datagram) and one of its allowed IP addresses (to fill in the “ The source IP address of the network datagram), form a new value for the Options field, taking into account the calculated number T of intermediate trusted nodes on the datagram's transmission route, form a secure network datagram with the selected trusted IP addresses evil, repeat the steps, starting with sending, receiving a secure network datagram, checking the value of T, selecting trusted nodes, generating new IP addresses until the value of T becomes 0. 2. The method according to claim 1, characterized in that the set {M} is divided into r subsets {M _r ′} according to a random law at time intervals ΔT _i . 3. The method according to claim 1, characterized in that the lists of allowed addresses for trusted nodes and subscribers of the corresponding pair are changed at time intervals ΔT _k .

Images