RU2586858C1 - Method of controlling data streams based on monitoring given consumer route and detection of event of destructive effect - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to a method of controlling data streams in networks based on fibre-optic transmission lines. Method involves determination of allowed routes for transmitting data streams, number of existing communication lines; number of communication nodes belonging to a distributed information system, a matrix; measuring variance of signals for each communication line, for which selected first communication line, a test sequence at preset speed transmitted test sequence; receiving a test sequence, a dispersion of a signal for communication line, storing signal value for communication line in matrix is repeated above action on determination of variance of signals for all existing communication lines; all possible routes between a given pair of users; variance of signal for each route; stored signal value for a route in a dynamic table; a route in accordance with requirements of consumer.

EFFECT: technical result is maintaining a given transmission route of data streams and detection of event of destructive actions by means of control based on monitoring objective, continuously existing and low-variable characteristics.

1 cl, 2 dwg

Description

The invention relates to the field of ensuring information security, and in particular to methods for managing data flows in distributed information FOTS, by monitoring fiber-optic transmission lines and can be used to control the route specified by the consumer and detect the fact of destructive impact.

Known "Network Switch", patent WO 2008077320, H04L 12/28, publ. 07/03/2008, which manages data flows in a computer network by switching network packets. In the network switch, to determine the destination port of the transmitted network packets, a correspondence table is used between the switch ports and the network addresses of network devices connected to them.

A disadvantage of the known device is the switching of data streams without regard to security requirements and access restrictions. In addition, in most switches, the correspondence table is filled in during operation, which leads to the possibility of overflowing this table and disrupting the normal operation of the network switch. It is also impossible to determine the fact of the destructive impact and the route node on which the safety event occurred.

Also, currently there are a number of data flow control systems based on the use of various firewalls (TW 243555, H04L 9/00; H04L 12/22; H04L 29/06; H04L 9/00; H04L 12/22; H04L 29/06 ; publ. 2005-11-11).

Firewalls in these systems are used to filter out unwanted network traffic, and the filtering rules are defined for the protocols of the transport and network layers of the open systems interconnection reference model (according to GOST Ρ ISO / IEC 7498-1-99 "Open Systems Interconnection. Basic Reference Model").

The main purpose of firewalls is to protect the network elements to which the firewall (protected network) is directly connected from attacks from other, external networks. Therefore, firewalls can be used to control access to resources and services of the protected network from the outside, but it is inconvenient to use to control access from the protected network to other networks and cannot be used to control user access to resources and servers within the same network. This drawback is aggravated by the fact that it is impossible to clearly determine from the filtering rules which network interactions can be carried out and which cannot, because it depends on the sequence of events. At the same time, the firewall uses data that can be easily changed (tampered with), replaced. If the intruder overcame the firewall, then the discovery of the fact of destructive impact and the place (node) becomes difficult.

The closest (adopted as a prototype) in technical essence to the proposed method is “Method and device for controlling data flows of a distributed information system” RU 2509425 H04L 9/32, G06F 21/60, published on 03/10/2014. The prototype method consists in the following actions : identify security events in the received data stream, analyze them in order to decide on the admissibility of the transmission of the data stream associated with this event, and, if the transmission of the data stream is permissible, transmit it as intended. When security events are detected in the received data stream, it is compared with allowed streams in accordance with the switching table, if they do not match, a response stream is generated to clarify the security event and transmitted for additional analysis, for which network addresses and port numbers are allocated from this stream in accordance with dynamic configuration table, compare their values with predefined parameters of the distributed information system, and if they coincide, form a new safe route soap has, which is assigned to the network nodes of the distributed information system of the new addresses and port numbers and then adjusted switching table and a dynamic table configuration, and forming a second response data stream at the network nodes do not coincide with the parameters dedicated network addresses and port numbers.

The disadvantage of the prototype method is the inability to determine the source of destructive software impacts, all the parameters by which the flow is controlled are not long-term and static and can be replaced, the relatively low security of the distributed information system, due to the fact that the control of data flows when safety events occur only by blocking them, which can lead to new implementations of unauthorized access by the violator already with th received information about security of distributed information system. It is also possible to replace the characteristics on the basis of which data flow is controlled.

The purpose of the claimed technical solutions is to develop a method for monitoring a given route for transmitting data streams and detecting the fact of destructive effects, by controlling, based on monitoring objective, long-term and difficult to change characteristics.

The technical result of the claimed method is:

preservation of a given route of transmission of data streams and detection of the fact of destructive effects, through management, based on the control of objective, long-term and difficult to change characteristics.

The technical result is achieved by the fact that:

сигнала для линии связи, запоминают значение

сигнала для линии связи в матрицу М, повторяют вышеперечисленные действия по определению дисперсии сигналов для всех существующих линий связи; формируют все возможные маршруты между заданной парой абонентов; рассчитывают дисперсию τ_м сигнала для каждого маршрута; запоминают значение τ_м сигнала для маршрута в динамическую таблицу L; формируют маршрут в соответствии с требованиями, предъявляемыми потребителем; если маршрут разрешен, передают поток данных; если маршрут запрещен, блокируют поток данных, при необходимости вносят изменения в динамическую таблицу коммутации. Измеряют дисперсию сигнала τ_мр на заданном маршруте; если τ_м-τ_мр≤Δε принимают поток данных, иначе осуществляют выявление событий безопасности в передаваемом потоке данных, для чего увеличивают значение счетчика l на единицу; находят маршрут с дисперсией сигнала, равной дисперсии τ_мр сигнала на маршруте, для чего сравнивают значения дисперсий τ_мр и τ_м сигналов; предупреждают потребителя о факте смены заказанного маршрута; восстанавливают вышедший из строя элемент; делают вывод о наличии события безопасности, при необходимости вносят изменения в динамическую таблицу коммутации.determine the allowed transmission routes of data streams, set the number of existing communication lines x; the number of communication nodes belonging to the distributed information system N, the matrix M [K; 2]; measuring the dispersion of signals for each communication line, for which a first communication line is selected, a test sequence is generated, a test sequence is transmitted at a given speed; take the test sequence, evaluate the variance

signal for the communication line, remember the value

signal for the communication line in the matrix M, repeat the above steps to determine the dispersion of the signals for all existing communication lines; form all possible routes between a given pair of subscribers; calculate the variance of τ _m signal for each route; remember the value of τ _m signal for the route in the dynamic table L; form a route in accordance with the requirements of the consumer; if the route is allowed, transmit the data stream; if the route is prohibited, block the data flow, if necessary, make changes to the dynamic switching table. Measure the variance of the signal τ _Mr on a given route; if _m -τ τ _mr ≤Δε receiving a data stream, otherwise carry identification security events in the transmitted data stream, which increases the value of counter l unit; find a route with a dispersion of the signal equal to the variance of τ _mp signal on the route, for which they compare the variances of τ _mp and τ _m signals; warn the consumer about the fact of changing the ordered route; restore a failed element; conclude that there is a security event; if necessary, make changes to the dynamic switching table.

Thanks to the new set of essential features in the claimed method, the indicated technical result is achieved by taking into account the dispersion of the signal both on individual fiber-optic communication lines and on the composite routes of the data flow.

The claimed method is illustrated by drawings:

FIG. 1. - block diagram of a distributed data system data flow control algorithm

FIG. 2. - version of the graph of a distributed information system

The implementation of the claimed method can be explained using the flowchart shown in FIG. 1 and the layout of the distributed information system shown in FIG. 2.

In the presented version of the graph of a distributed information system (Fig. 2): nodes A (source) and B (receiver) are protected network elements and the probability of a security event (the fact of destructive impact) on them is small. Nodes V ₁ -V ₆ are elements of a public communications network (MTSP) and are subject to destructive influences.

Fiber-optic transmission system (FOTS) - a transmission system in which all types of signals are transmitted via optical cable (GOST 26599-85 Fiber-optic transmission systems. Terms and definitions).

Fiber-optic transmission line (FOCL) - a set of linear paths of fiber-optic transmission systems having a common optical cable, linear structures and devices for their maintenance within the service devices (GOST 26599-85 Fiber-optic transmission systems. Terms and definitions).

An information security event is the identified occurrence of a certain state of a system, service or network, indicating a possible violation of the IS policy or the failure of protective measures, or the occurrence of a previously unknown situation that may be related to security.

Information security incident Information security incident is an event resulting from one or more undesirable or unexpected IS events that have a significant chance of compromising a business transaction and creating an IS threat (examples of IS incidents are given in section 6. Denial of service, unauthorized access, information gathering) . [GOST Ρ ISO / IEC 18044-2007]

An information security event is the state of a system, service or network, which indicates a possible violation of an existing security policy, or a previously unknown situation that may be related to security (standard ISO / IEC TR 18044: 2004)

Safety events also include the accidental or intentional change of a data flow transmission route ordered by a consumer.

The proposed method allows to determine both the fact of a change in the route ordered by the user, and the fact of the occurrence of a destructive effect.

In block 1 (Fig. 1) enter data. The source data are:

- x - the number of communication lines belonging to a distributed information system;

- N - the number of communication nodes belonging to a distributed information system;

сигналов при заданной скорости.- a matrix M of dimension [x; 2]. In this matrix, the dispersion number will be assigned to the communication line number

signals at a given speed.

- dynamic switching table. The table sets the allowed routes for transmitting data streams.

- table L [K; 2]. The table sets all possible routes for transmitting data streams and, after measurement, the dispersion of τ _m signals at a given speed is entered in accordance with each route. In this case, the routes are ranked from the minimum value of the dispersion of the signal in increasing order to the maximum.

- Δε permissible measurement error. The error of the equipment for measuring signal dispersion is less than the permissible error.

In block 2, the first communication line that is part of the FOTS is selected. Counter i is set to 1.

In block 3, in any predetermined combination (for example 0101 ... 0101), a test sequence consisting of n bits is generated.

Characteristics of the test sequence are known on the receiving and transmitting side. The fiber medium of the optical transmission line is isotropic, i.e. the properties of the medium in the forward and reverse direction are identical.

In block 4, on the transmitting side, a generated test sequence consisting of n pulses is fed to the input of the fiber optic communication line at a predetermined speed.

In block 5, on the receiving side (output of the optical fiber communication line), the transmitted test sequence is received.

сигнала при заданной скорости для каждой линии связи. Для чего измеряют характеристики (параметры) каждого импульса, из полученной на приемной стороне, тестовой последовательности.In block 6 evaluate the variance

signal at a given speed for each communication line. Why measure the characteristics (parameters) of each pulse from the test sequence received at the receiving side.

An optical fiber produced by different manufacturers or by one manufacturer at different times has differences in physical properties, and the lines have different lengths, which together determines the value of signal dispersion. Pulses of light propagate through the optical fiber “spread out”. Dispersion — pulse broadening — has the dimension of time and is defined as the quadratic difference of the pulse durations at the output and input of the fiber of length L, obtained at half the pulse height (amplitude) (Physical fundamentals of optical communication. Electronic textbook. Yu. M. Noikin, P.V. Makhno; Southern Federal University. Faculty of Physics; Rostov-on-Don, 2011):

To increase the accuracy of measurements, the arithmetic mean broadening of the set of pulses is used. (Handbook of Elementary Mathematics M.Ya. Vygodsky. “Section 45 Average Values” by Elista 1996, 416 pp.) By the formula:

The obtained signal dispersion value is entered into the dynamic matrix M and stored (block 7).

In block 8, check the value of counter i

If the condition i = N is fulfilled (i.e., all lines are assigned a signal dispersion value at a given speed), we proceed to block 10.

Otherwise, increase the value of counter i by one.

In block 9, increase the value of counter i by one.

In block 10, all possible routes (K) are constructed between a given pair of subscribers.

In block 11, the dispersion of the signal τ _{m is} calculated for each composite (from several communication lines) route. With the known route of the information flow and the variance of the signals on each line included in the route, you can calculate the total variance of the signal generated route.

Determine the dispersion of the signal along the route of the information flow along the FOTS section, which consists of several fiber-optic communication lines according to the formula (Fundamentals of the design of digital optoelectronic communication systems A. A. Verbovetsky; Moscow, 2000, 160 pages):

where τ _m is the calculated variance of the signals of the composite route along which the data stream should go;

τ _i is the measured value of the dispersion of the signals of the line included in the composite section of the FOTS;

i is the number of lines included in the composite FOTS section along which the data stream passes.

After that, the obtained values are ranked from the minimum τ _m values to the maximum and are entered in the dynamic table K, respectively, the communication lines.

In block 12, the information flow transmission route is formed in accordance with the requirements of the consumer, giving preference to routes with minimal signal dispersion.

In block 13, according to the dynamic switching table, they verify compliance with the allowed data transmission routes — a real-formed route.

If the conditions are met, a data stream is transmitted.

Otherwise, reorganization of the route is carried out (traffic route control).

At block 14, a data stream is transmitted.

In block 15 measure τ _Mr - the real dispersion of the signals along the route of the data stream.

In block 16 verify the fulfillment of the conditions:

τ _m −τ _mr ≤Δε

If the condition is met, a signal data stream is received (block 17).

Otherwise, increment the counter l by one.

In block 18, the counter l is incremented by one.

l is the number of the constructed communication route.

In block 19, the fulfillment of the condition l = K + 1 is checked.

If the conditions are met, go to block 25.

Otherwise, go to block 20.

In block 20, verify the fulfillment of the condition:

τ _m −τ _mr ≤Δε

If the conditions are met, they warn the consumer about the fact of a security event (data transfer along an unauthorized route).

Otherwise, increment the counter l by one.

In block 22, the signaling from the network elements on the ordered data transmission route is checked. If an element failure alarm on the network is triggered, then it is considered that a technological failure has occurred and the failed network element is restored on the allowed data transfer route. Otherwise, the transmission of the data stream is blocked (block 23).

The alarm system is described in Samuilov K.E. 7 is a key element of modern digital communications networks. URL: http://www.osp.ru/nets/1996/07/141824/ date of access 14.10.14.

In block 24 Restore the failed network element on the permitted data path.

In block 25 they conclude that a security event occurred on the route (node or line).

In block 26, if necessary, changes are made to the dynamic switching table, which prohibits the construction of routes using these nodes (lines) of communication.

Thus, by comparing data on previously known signal dispersions both on individual fiber optic communication lines of the composite route and by changing the total dispersion of the signal of the composite route of the data flow, the technical result is achieved.

Claims (1)

A method of controlling data flows based on monitoring a route specified by a consumer and detecting a destructive effect, which consists in controlling the switching of network connections using a dynamic switching table that determines the allowed routes for transmitting data flows depending on whether the dynamic switching table allows network interaction , which is implemented by this data stream, the stream is either transmitted as intended or blocked, event detection security in the transmitted data stream, if necessary, make changes to the dynamic switching table, characterized in that it additionally sets the number of existing communication lines x; the number of communication nodes belonging to the distributed information system N, the matrix M [K; 2]; measuring the dispersion of signals for each communication line, for which a first communication line is selected, a test sequence is generated, a test sequence is transmitted at a given speed; take the test sequence, evaluate the variance

signal for the communication line, remember the value

signal for the communication line in the matrix M, repeat the above steps to determine the dispersion of the signals for all existing communication lines; form all possible routes between a given pair of subscribers; calculate the variance of τ _m signal for each route; remember the value of τ _m signal for the route in the dynamic table L; form a route in accordance with the requirements of the consumer; if the route is allowed, transmit the data stream; measure the variance of the signal τ _Mr on a given route; if _m -τ τ _mr ≤Δε, then receiving a data stream, or increasing the value of l counter by one; find a route with a dispersion of the signal equal to the variance of τ _mp signal on the route, for which they compare the variances of τ _mp and τ _m signals; warn the consumer about the fact of changing the ordered route; restore a failed element; conclude that there is a security event.

Images