RU2622842C1 - Method for masking the structure of telecommunication network - Google Patents

Abstract

FIELD: radio engineering, communication.

SUBSTANCE: method of masking the structure of telecommunication network comprises steps of presetting information about the structure of telecommunication network, initial data on nodes and subscribers of network, acceptable value of integrated route safety indicator, and calculating complex network security indicators of network nodes. The matrix of contiguity of network graph vertices and the set of possible communication routes between the network subscribers in form of graph trees are formed. Using the obtained results, the safest permissible routes in the telecommunication network from the set of all possible communication routes between subscribers is selected and safe routes to the network subscribers with continuous change in the identities of the network subscribers in the transmitted message packets is brought.

EFFECT: increase the communication security and the difficulty to identify the network subscribers by unauthorized subscribers by continuous change in the identities of network subscribers in the transmitted message packets and the transmission of message packets over all valid communication routes.

3 cl, 9 dwg

Description

The invention relates to the field of information communications, and in particular to ensuring information security of digital communication systems, and, in particular, the claimed method of masking the structure of a communication network is intended for use in distributed communication networks built on the basis of a public communication network (for example, the Internet).

There is a method of providing adjustment of routes to network subscribers, implemented in the "Method of adjusting routes in the data network" according to the patent of the Russian Federation No. 2220190, IPC H04L 12/28, publ. 10/10/1998

The method consists in the fact that the search for routes for delivering messages to the subscriber is carried out at the network address of the switching node of its current binding. The choice of routes to the subscriber is carried out on the switching nodes by the service corrective message containing the network addresses of the subscriber, the switching node and the code of the sign of adjustment “record”, “erase”.

The disadvantage of this method is the lack of adaptation to changes in the structure of the communication network. This is because the adjustment is decentralized and does not cover the entire communication network, but its individual local sections. The lack of options for selecting routes to the subscriber leads to poor quality selection.

There is also a method of ensuring the security of information circulating in a distributed telecommunication system when transmitting it over public communication channels, implemented in the "Distributed telecommunication system for transmitting shared data intended for their separate transmission and reception" according to US patent No. 6912252, IPC H04L 12 / 56; H04L 12/28, publ. 11/08/2001 g.

The method consists in the following actions: the source data from the sender is divided into N parts. Further, from their combinations, intermediate data groups are formed. Then, intermediate data is transmitted independently over N communication channels. The recipient receives groups of intermediate data arriving via N communication channels and restores the original data.

The disadvantage of this method is the relatively low secrecy of communication and an increase in the likelihood of identification of corresponding entities as a result of an increase in the number of communication channels between correspondents. The presence of transit network nodes and communication channels of various types with a low level of security increases the need for an assortment of communication tools and creates the prerequisites for cybercriminals to intercept the information exchange of network subscribers.

Also known is the "Method of choosing the expediently used route in the router for uniform distribution in the switching network" according to the application for the invention of the Russian Federation No. 2004111798, IPC H04L 1/00, publ. 05/10/2005

The method takes into account the criteria of the quality of routes and information about the structure of the communication network, including the addresses of the network nodes and the presence of communication between them. For the target network address, one route is selected in accordance with the predefined criteria for the quality of routes and messages are sent along the selected route.

The disadvantage of this prototype method is the relatively low secrecy of communication when using the selected route of information exchange of subscribers in the communication network. The presence of transit network nodes with a low level of security creates the prerequisites for cybercriminals to intercept the information exchange of network subscribers and reconstruct the traffic of a distributed network at some point on the Internet.

The closest analogue (prototype) in its technical essence to the claimed method is a method for masking the structure of a communication network implemented in the "Method for choosing a safe route in a communication network" according to RF patent No. 2311158, IPC H04L 12/28, publ. 08/10/2008

The closest analogue provides increased communication secrecy by setting information on the structure of the communication network, initial data on the nodes and subscribers of the network, calculating complex indicators of the safety of network nodes and, based on this data, managing the routes of information exchange of subscribers in the communication network and choosing the most secure route.

The disadvantage of this prototype is the low secrecy of network subscribers, due to the possibility of identifying message packets regarding specific network users and, therefore, opening the structure of a distributed communication network in case of compromise of the selected safe communication route of subscribers.

Hereinafter, the term “compromise of a safe communication route of subscribers” means an event related to someone gaining unauthorized access to elements of a secure communication route — points of connecting subscribers to a communication network, transit nodes and communication lines.

The aim of the claimed invention is to develop a method for masking the structure of the communication network, which provides increased communication secrecy and the difficulty of identifying network subscribers by unauthorized subscribers by continuously changing the identifiers of network subscribers in transmitted message packets and transmitting message packets on all valid communication routes.

Said technical result is achieved by that in the known masking communication network structure method, consists in the fact that for a communication network comprising a plurality of X network nodes having IP _X address, setting an initial data containing information about the structure of a communication network comprising a structural and identification arrays security server IP address of the _{security Council, and the} identifiers ID and IP addresses _and subscribers connected to the communication network. For each x-th node of the network, where x = 1, 2, ..., X is set, the set Y of security parameters and their values b _xy , where y = 1, 2, ..., Y. Then, a complex safety indicator k _{xΣ is calculated} for each x-th host.

Form a network connectivity matrix of vertices of the graph, which is stored in the structural array subscriber network node addresses and IP addresses of IP _{CSS and} networks, and information of a link between the nodes and the subscribers of the network.

The identifiers ID _a , _SB ID and the corresponding IP _a , IP _SB addresses of the network subscribers and the security server are stored in the identification array.

After that, a set of possible communication routes is formed between the ith and jth subscribers of the network, where i = 1, 2, ..., j = 1, 2, ..., and i ≠ j, in the form of N _ij trees of the communication network graph. Each n-th, where n = 1, 2, ..., N _ij , the graph tree consists of z _n vertices corresponding to the number of network nodes belonging to it.

как среднее арифметическое комплексных показателей безопасности

узлов сети, входящих в n-й маршрут связи. Формируют сообщения, включающие запомненные маршруты

между i-м и всеми j-ми абонентами, идентификаторы ID_aj и адреса IP_aj всех j-x абонентов, отправляют сформированные сообщения всем i-м абонентам сети, а для передачи сообщений между абонентами по идентификатору абонента-получателя сообщения ID_a выбирают его адрес IP_a и безопасный маршрут

. При подключении нового абонента к сети связи формируют сообщение, содержащее адрес узла сети IP_УС подключения нового абонента, его идентификатор ID_ан и адрес IP_ан. Сформированное сообщение отправляют на сервер безопасности, где его запоминают в структурном и идентификационном массивах. Затем в сервере безопасности выбирают безопасные маршруты связи между новым абонентом и всеми j-ми абонентами и запоминают их. После чего формируют сообщения, включающие информацию о запомненных безопасных маршрутах связи, и отправляют их всем абонентам сети.For each of the N _ij possible communication routes, the average security values are calculated

as the arithmetic mean of complex safety indicators

network nodes included in the nth communication route. Generate messages including remembered routes

between the i-th and all j-th subscribers, the identifiers ID _aj and IP _aj addresses of all jx subscribers send the generated messages to all the i-th network subscribers, and to transfer messages between the subscribers by the identifier of the recipient of the message ID _a, select its IP address _a and safe route

. When connecting a new subscriber to the communication network is formed message containing IP address of the network node _CSS connecting a new subscriber, his identifier ID and _an IP address of _an. The generated message is sent to the security server, where it is stored in the structural and identification arrays. Then, in the security server, secure communication routes between the new subscriber and all j-th subscribers are selected and stored. Then they generate messages that include information about stored secure communication routes, and send them to all network subscribers.

комплексного показателя безопасности маршрута. После вычисления для каждого из N_ij возможных маршрутов связи комплексных показателей безопасности маршрутов

, как средних показателей безопасности маршрутов

, сравнивают значения комплексных показателей безопасности маршрутов

с предварительно заданным допустимым значением

. Запоминают допустимые маршруты

со значениями комплексных показателей безопасности

.The input data additionally sets a valid value

a comprehensive indicator of route safety. After calculating for each of the N _ij possible communication routes, complex route safety metrics

as average route safety

, compare the values of complex route safety metrics

with predefined valid value

. Remember valid routes

with complex safety metrics

.

, где

.Form M _ij pairs of additional identifiers for network subscribers

where

.

A set of L possible valid communication routes is formed between each pair of identifiers of network subscribers, where L = M _ij +1, and the generated L routes are stored.

абонентам сети в соответствии с управляющей информацией, содержащейся в принятых сообщениях.After sending the generated messages to all i-th network subscribers, they are received by their network subscribers and M _ij pairs of additional identifiers are assigned

subscribers of the network in accordance with the control information contained in the received messages.

Fragment the outgoing message into L fragments. In this case, the number of fragments is chosen equal to the number of pairs of identifiers: (L = M _ij +1) and message fragments are transmitted along L possible valid communication routes.

Thanks to the new set of essential features, masking of the communication network structure is ensured, and due to the continuous change of the network subscriber identifiers in the transmitted message packets and transmission of message packets along all valid communication routes, losses during compromise of the subscribers' secure communication routes are significantly reduced and, therefore, communication secrecy is increased while ensuring information security of digital communication systems.

The claimed objects of the invention are illustrated by drawings, which show:

FIG. 1 is an example of a structure of a distributed communication network;

FIG. 2 - structure of the message packet and its IP header;

FIG. 3 - source data to illustrate the calculation procedure;

FIG. 4 is a block diagram of a sequence of actions that implement the claimed method of masking the structure of a communication network;

FIG. 5 - access matrix and matching arrays;

FIG. 6 - selection of valid communication routes;

FIG. 7 - tables for calculating average route safety indicators and selecting valid routes;

FIG. 8 is an illustration of communication schemes of subscribers and the security server along valid routes;

FIG. 9 is a drawing showing masking results of a communication network structure.

The claimed method is implemented as follows. In the general case, distributed communication networks (Fig. 1a) are built to connect subscribers of network 1 through a public communication network (for example, the Internet), which is a set of physical communication lines (channels) 2 connecting X nodes of network 3 into a single infrastructure. Various servers of digital communication systems can be accessed from a dedicated set of subscribers, such as a security server 4, or can be public servers 5 of a public communication network (for example, the Internet 6).

It is advisable to consider cases when the number of network nodes X is greater than or equal to two. All infrastructure elements are identified by identifiers, which are used in the most common TCP / IP protocol family by network addresses (IP addresses). If necessary, distributed processing of information and (or) its transmission, subscribers connect to the communication network.

Many addresses of subscribers connected to the communication network and addresses of network nodes do not intersect. For example, when using email service by subscribers, the communication scheme of subscribers includes subscribers 1 Ab _i and Abj (Fig. 1b), email server 5 and communication channels between them 2. Subscribers 1 Ab _i and Abj and email server 5 use unique IP addresses

When transmitting message packets over public communication networks, network subscribers, network nodes and communication lines (channels) are subject to information security requirements that characterize the acceptable values of security indicators for communication network elements.

If the intruder receives unauthorized access to the elements of the communication network (Fig. 1a), the communication scheme of the subscribers becomes available to the violator.

The availability of the subscriber’s communication scheme to the intruder is determined by the low secrecy of network subscribers using open IP addresses and the possibility of identifying message packets from them regarding specific network users and (or) communication nodes.

For example, in FIG. 1c, users User No. 1 and User No. 2 are grouped by the intruder into subscriber Ab _i 1 based on their use of one IP address, since they are connected to the public communication network through one router (see Fig. 1a). The structures of the message packet and its IP header are known and shown in FIG. 2. The use by subscribers of one router to connect to a public communication network unmasks their belonging to one communication node. At the same time, the intruder observes exactly two users grouped into the subscriber Ab _i 1, since between the subscribers Ab _i and Abj, in addition to the direct communication line, there is an alternative communication channel (shown in dashed line in Fig. 1c), including the email server 5, which it is unmasked by the “From” and “To” fields of the email header sent by subscribers. The structure of the service fields of the email header is known and described in the technical specifications (RFC, Request for Comments) of the Internet (see, for example, https://tools.ietf.org/html/rfc822).

Similar to that described in FIG. In 1 cases, it is believed that the intruder reconstructs (opens) the structure of the communication network and can carry out destructive effects on all its elements.

The reconstruction of the communication network structure occurs due to the fame (openness) of the message packet structure, where the addresses of the sender and receiver unmask the network subscribers.

To mask the structure of the communication network, it is necessary to provide individual stealth of subscribers and manage the routes of information exchange of subscribers in the public communication network. The structure of the public communication network is dynamic and contains a large number of nodes, therefore, the tasks of evaluating security indicators, forming routes and servicing subscribers' requests for safe communication routes are assigned to a dedicated security server. The number of security servers depends on the size of the communication network and can be set, for example, in the ratio of 1 server to 7 ... 10 corresponding subscribers.

Let us consider a variant of the structure of a distributed communication network (Fig. 3), which is a combination of 5 nodes of network 1, security server 2, and subscribers of network 3 connected by physical communication lines 4.

In FIG. 4 presents a block diagram of a sequence of actions that implement the claimed method of masking the structure of the communication network, in which the following notation:

{IP} - structural array;

{ID} - identification array;

IP _SB - network address of the security server;

ID _a - subscriber identifier;

IP _a - network address of the subscriber;

Y is the number of considered host security parameters;

b _xy is the value of the y-th security parameter of the x-th network node, where x = 1, 2, ..., X, y = 1, 2, ..., Y;

k _xΣ is a comprehensive security measure for each x-th network node;

N _ij is the number of trees in the graph of the communication network corresponding to the set of possible communication routes between the i-th and j-th subscribers of the network, where i = 1, 2, ..., j = 1, 2, ..., and i ≠ j;

- средний показатель безопасности маршрута связи между i-м и j-м абонентами сети;

- the average indicator of the security of the communication route between the i-th and j-th network subscribers;

- безопасный маршрут связи между i-м и j-м абонентами сети;

- a secure communication route between the i-th and j-th network subscribers;

z _n is the number of vertices of the nth tree of the graph, where n = 1, 2, ..., N _ij , corresponding to the number of network nodes belonging to it;

SB - Security Server.

At the initial stage, in the security server (in Fig. 4 - SB) initial data is set (bl. 1 in Fig. 4), including structural {IP} and identification {ID} arrays, address of the security server IP _SB , IDs _a and addresses IP _a subscribers connected to the communication network, as well as for each x-th network node, where x = 1, 2, ..., X, Y≥2 security parameters and their values b _xy , where y = 1, 2, ..., Y, which are summarized in the table (Fig. 5B). Structural array {IP} - array to store the security server address IP _SC, IP node addresses _CSS and subscriber IP _a network, and information of a link between them (Figure 5a.) Having only two values, "1" - the presence of communication and "0" - its absence. Identification array {ID} is an array for storing the identifiers of the security server ID _SB , subscribers ID _{a of} the communication network and the corresponding addresses of subscribers of the network IP _a and the security server IP _SB (Fig. 5b). The security parameters of network nodes are determined, for example, in accordance with GOST R ISO / IEC 15408-2002 “Methods and means of ensuring security. Information Technology Security Assessment Criteria. ”

Values b _{x1 of the} parameter y = 1 of the security of the network nodes are determined, for example, by the characteristics of the equipment manufacturers of the network nodes, information about which can be obtained from the physical addresses of the network nodes. The physical addresses of network nodes are represented in hexadecimal notation, for example 00: 10: 5a: 3F: D4: E1, where the first three values determine the manufacturer (00: 01: е3 - Siemens, 00: 10: 5a - 3Com, 00:03: ba - Sun).

For example, for US1 (x = 1 in Fig. 5a) whose physical address is 00: 01: e3: 3F: D4: E1, the first three values determine the manufacturer Siemens, which corresponds to the value of the security parameter b ₁₁ = 0.3. Similarly, the values b _{x1 of the} parameter y = 1 of the security of the network nodes US2-US5 are determined, as well as the values of b _{xy of} all the given Y≥2 security parameters (Fig. 5a).

As the other security parameters of the network node, one can consider the type of equipment, the version of the software installed on it, the ownership of the node of a state or private organization, and other known information.

For each x-th node of the network, the complex safety _factor k _{xΣ is} calculated from the values of b _{xy of} its security parameters ( _block 2 in Fig. 4). The calculated indicators are presented in the table (Fig. 5g).

, или перемножения

, или как среднее арифметическое значение

его параметров безопасности b_xy.The complex safety indicator k _xΣ for each _xth network node is calculated by summing

, or multiplication

, or as the arithmetic mean

its security settings b _xy .

Fundamentally, the method of calculating k _xΣ does not affect the result of choosing a safe route. For example, the values of the calculated complex security indicators k _xΣ for each x-th node of the considered variant of the communication network (Fig. 3) by the listed methods for the given values of the security parameters b _xy nodes are shown in the table (Fig. 7a).

Further formed adjacency matrix network of vertices (bl. 3 in FIG. 4), which is stored in the structural array (FIG. 5a) addresses network nodes IP _CSS and addresses of subscribers IP _a network and information about a link between the nodes and subscribers network.

Methods of generating adjacency matrices of graph vertices are known (see, for example, Finite graphs and networks. Basaker R., Saati T., M, 1973, 368 pp.). For the considered graph of the communication network, the adjacency matrix of the vertices has the form:

After that, the identifiers ID _a , _SB ID and the corresponding IP _a , IP _SB addresses of network subscribers and the security server are stored in the identification array (Fig. 5b).

A set of possible communication routes is formed between the ith and jth subscribers of the network (bl. 4 in Fig. 4), where i = 1, 2, ..., j = 1, 2, ..., and i ≠ j, in the form N _ij trees graph communication network. Each n-th, where n = 1, 2, ..., N _ij , the graph tree consists of z _n vertices corresponding to the number of network nodes. The order of formation of graph trees is known and described; see, for example, Christofides N. Graph Theory: Algorithmic Approach. Per. from English - M .: Mir, 1978.- 432 p.

The total number N _ij trees of the graph of the communication network between the i-th and j-th subscribers of the network can be determined by various methods. In the claimed method, the total number N _ij of graph trees is found using the adjacency matrix.

. Порядок получения транспонированной матрицы известен и описан (см., например, Г. Корн, Т. Корн. Справочник по математике для научных работников и инженеров. - М.: Наука, 1977 г.).Removing one row of the matrix B, we obtain the matrix B _о , and then the matrix transposed to it

. The procedure for obtaining a transposed matrix is known and described (see, for example, G. Korn, T. Korn. Handbook of mathematics for scientists and engineers. - M .: Nauka, 1977).

The construction of communication routes between subscribers based on the trees of the graph of the communication network ensures the finding of all possible communication routes and their openness, i.e. eliminates closed routes unacceptable for messaging. Thus, after calculations, we obtain the total number N _{ij of} trees of the graph of the communication network between the i-th and j-th subscribers of the network equal to 5.

(бл. 5 на фиг. 4) как среднее арифметическое комплексных показателей безопасности

узлов сети, входящих в n-й маршрут связи

.To justify and objectively choose a safe communication route from the set N _ij = 5 possible communication routes between the i-th and j-th network subscribers, average safety indicators are calculated

(bl. 5 in Fig. 4) as the arithmetic mean of complex safety indicators

network nodes included in the nth communication route

.

маршрутов связи, сформированных между i-м и j-м абонентами сети (фиг. 6а). Результаты сведены в таблицу (фиг. 7б).Using the results obtained when calculating the complex indicators of the security of network nodes in different ways (Fig. 7a), average safety indicators are calculated

communication routes formed between the i-th and j-th network subscribers (Fig. 6a). The results are tabulated (Fig. 7b).

с предварительно заданным допустимым значением

(бл. 6 на фиг. 4). Если значения комплексных показателей безопасности маршрутов удовлетворяют условию:

, то запоминают допустимые маршруты

(бл. 7 на фиг. 4). При сравнении могут быть найдены несколько маршрутов с равными средними показателями безопасности, при этом при передаче сообщений приоритет отдается самому короткому маршруту с наименьшим количеством входящих в него узлов z_n.Next, the values of the comprehensive route safety metrics are compared.

with predefined valid value

(bl. 6 in Fig. 4). If the values of the complex route safety metrics satisfy the condition:

then remember the valid routes

(bl. 7 in Fig. 4). When comparing, several routes with equal average safety indices can be found, while when sending messages, priority is given to the shortest route with the least number of nodes z _n included in it.

из полученных результатов, приведенных на фиг. 6а следует, что первый, второй и третий маршруты n=1, 2, 3 имеют значения среднего показателя безопасности,

удовлетворяющие этому требованию и они выделены полужирным шрифтом. При анализе полученных расчетов средних показателей безопасности маршрутов выявлено, что способ вычисления k_xΣ не влияет на результат выбора безопасного маршрута. Таким образом, формируют множество допустимых маршрутов между всеми абонентами сети.Given

from the results shown in FIG. 6a it follows that the first, second and third routes n = 1, 2, 3 have values of an average safety indicator,

satisfying this requirement and they are in bold. When analyzing the obtained calculations of average route safety indicators, it was revealed that the method of calculating k _xΣ does not affect the result of choosing a safe route. Thus, many valid routes are formed between all network subscribers.

, где

, формируют совокупность возможных допустимых маршрутов связи L между каждой парой идентификаторов абонентов сети, где L=M_ij+1, и запоминают сформированные L маршруты (бл. 8, 9, 10 на фиг. 4).Then form M _ij pairs of additional identifiers for network subscribers

where

form a set of possible valid communication routes L between each pair of identifiers of network subscribers, where L = M _ij +1, and remember the generated L routes (blocs 8, 9, 10 in Fig. 4).

Next, messages are generated that include the stored L valid routes between the i-th and all j-th subscribers, identifiers ID _aj and IP _aj addresses of all j-th subscribers (block 11 in Fig. 4). After that, the generated messages are sent to all i-th network subscribers (bl. 12 in Fig. 4). Thus, each subscriber of the network is notified of the valid routes to all other subscribers.

к нему, после чего передают сообщение абоненту-получателю по заданному маршруту. Известные протоколы маршрутизации (routing protocols), такие как RIP, OSPF, NLSP, BGP, предназначены для передачи пользовательской информации и обеспечивают в способе маршрутизации от источника (source specified routing) обмен информацией по заданному маршруту (см., например, Олифер В.Г. и Олифер Н.А. «Компьютерные сети. Принципы, технологии, протоколы», уч. для Вузов, 5-е изд. - СПб.: Питер, 2016). Таким образом, у абонентов имеется возможность передачи сообщений именно по заданному безопасному маршруту.To send messages between subscribers using the ID of the recipient of the message ID _a, select his IP address _a and a valid route

to him, after which they transmit the message to the subscriber-recipient along the specified route. Known routing protocols, such as RIP, OSPF, NLSP, BGP, are designed to transmit user information and provide a way to route from the source (source specified routing) exchange of information on a given route (see, for example, Olifer V.G. . and Olifer N.A. “Computer Networks. Principles, Technologies, Protocols”, studies for Universities, 5th ed. - St. Petersburg: Peter, 2016). Thus, subscribers have the opportunity to send messages exactly on a given safe route.

абонентам сети в соответствии с управляющей информацией, содержащейся в принятых сообщениях (бл. 13, 14 на фиг. 4). Далее фрагментируют исходящее сообщение на L фрагментов, при этом количество фрагментов выбирают равным количеству пар идентификаторов: (L=M_ij+1) и передают фрагменты сообщения по L возможным допустимым маршрутам связи (бл. 15, 16 на фиг. 4).Then, after sending the generated messages to all i-th network subscribers, they are received by their network subscribers, M _ij pairs of additional identifiers are assigned

subscribers of the network in accordance with the control information contained in the received messages (bl. 13, 14 in Fig. 4). Next, the outgoing message is fragmented into L fragments, while the number of fragments is chosen equal to the number of identifier pairs: (L = M _ij +1) and message fragments are transmitted along L possible valid communication routes (blocks 15, 16 in Fig. 4).

When a new subscriber is connected (in Fig. 3 - Ab n) to the communication network, they form a message with the address of the network node US 4 IP _U4 to which he is connected, his ID ID _en and IP _en address (Blocks 17 and 18 in FIG. . four). The generated message is sent to the security server, where it is stored in the structural and identification arrays (blocks 19 and 20 in Fig. 4), thus supplementing (updating) information on the structure of the communication network and the network subscribers.

между новым абонентом и всеми j-ми абонентами и запоминают их (бл. 21 и 22 на фиг. 4). Формируют сообщение, включающее информацию о запомненных безопасных маршрутах связи ко всем j-ым абонентам сети и отправляют его новому абоненту. Формируют сообщения, включающие информацию о запомненных безопасных маршрутах связи от каждого j-ого абонента сети к новому абоненту, и отправляют их j-ым абонентам сети (бл. 23, 24 на фиг. 4). Таким образом, нового абонента сети уведомляют о безопасных маршрутах ко всем абонентам сети, а остальных абонентов уведомляют о безопасных маршрутах к новому абоненту.In the security server, similar to the method described above, secure communication routes are selected

between the new subscriber and all j-th subscribers and remember them (bl. 21 and 22 in Fig. 4). A message is generated that includes information about the stored secure communication routes to all j-th subscribers of the network and sent to a new subscriber. Messages are generated that include information on stored secure communication routes from each j-th network subscriber to a new subscriber, and sent to the j-th network subscribers (blocks 23, 24 in Fig. 4). Thus, the new network subscriber is notified of safe routes to all subscribers of the network, and the remaining subscribers are notified of safe routes to the new subscriber.

In FIG. 8 is an illustration of communication schemes of subscribers and a security server along three valid routes selected using the described method. The structure of a real public communication network is dynamic and contains a huge number of nodes, therefore the tasks of evaluating security indicators, forming routes and servicing subscribers' requests for safe communication routes are assigned to a dedicated server or several security servers.

A drawing representing the masking results of the communication network structure is shown in FIG. 9. In the case when, in the analysis of connectivity, 3 subscribers and 3 communication channels between them are detected (Fig. 9a), the structure can be defined as “fully connected”.

The set L of possible valid communication routes between each pair of identifiers of network subscribers is presented in the form of a table of data on valid routes (Fig. 9b).

In the case when the analysis of the connectivity of the structure of the communication network shows, for example, 12 subscribers and 6 communication channels between them (Fig. 9c), the structure is defined as “incoherent”.

узлов, входящих в сформированные маршруты связи, дают основание для объективной оценки выбранных допустимых и безопасных маршрутов связи между абонентами сети и позволяют учитывать необходимые и достаточные условия для выбора допустимого и безопасного маршрута в сети связи. Из проведенных расчетов комплексных показателей безопасности

узлов сети с учетом их параметров безопасности b_xy и моделирования заявленного алгоритма действий маскирования структуры сети связи, достигается исключение транзитных узлов сети, обладающих низким уровнем безопасности, который указывает на высокую вероятность несанкционированного перехвата передаваемых абонентами сообщений. Выбранные маршруты связи между i-м и j-м абонентами проходят через транзитные узлы сети, обладающие максимально высокими уровнями безопасности, что снижает вероятность перехвата злоумышленниками информационного обмена абонентов сети.Computed Comprehensive Security Indicators

nodes included in the formed communication routes provide the basis for an objective assessment of the selected acceptable and safe communication routes between network subscribers and allow you to take into account the necessary and sufficient conditions for choosing an acceptable and safe route in the communication network. From the calculations of complex safety indicators

network nodes taking into account their security parameters b _xy and modeling the claimed algorithm for masking the communication network structure, exclusion of transit network nodes having a low level of security, which indicates a high probability of unauthorized interception of messages transmitted by subscribers. The selected communication routes between the i-th and j-th subscribers pass through the transit nodes of the network with the highest security levels, which reduces the likelihood of cybercriminals intercepting the information exchange of network subscribers.

Thus, in the considered method, by setting information about the structure of the communication network, initial data on the nodes and subscribers of the network, and calculating complex indicators of the security of the nodes of the network, the selection of acceptable and safe routes in the communication network is made from the totality of all possible communication routes between subscribers and bringing acceptable and a safe route to network subscribers, which ensures the achievement of the formulated technical result - increased communication secrecy and the difficulty of identifying non-network subscribers onirovannymi subscribers due to the continuous changes in the network subscriber identifier in the transmitted message packets and transmitting message packets for all valid routes of communication.

Claims (5)

1. A method for masking the communication network structure, comprising the steps that a communication network comprising a plurality of network nodes X having IP _X address, setting an initial data containing information about the structure of a communication network comprising the identification and structural arrays, address security server IP _SB , identifiers ID _a and IP _a addresses of subscribers connected to the communication network are set for each x-th network node, where x = 1, 2, ..., X, the set Y of security parameters and their values b _xy , where y = 1, 2, ..., Y, calculate the complex indicator safely STI k _xΣ for every xth network node adjacency matrix forming a network graph vertices, which are stored in the structural array network node addresses and IP addresses of subscribers _CSS IP _a network, and information of a link between the nodes and the subscribers of the network, and the identifiers ID _a , _SB ID and the corresponding IP _a , IP _SB addresses of the network subscribers and the security server are stored in the identification array, after which they form the set of possible communication routes between the i-th and j-th network subscribers, where i = 1, 2, ..., j = 1, 2, ..., and i ≠ j, in the form of N _ij trees of the graph of the communication network, each e n-th, where n = 1, 2, ..., N _ij , the graph tree consists of z _n vertices corresponding to the number of network nodes belonging to it, then for each of the N _ij possible communication routes average safety indices are calculated

as the arithmetic mean of complex safety indicators

network nodes included in the nth communication route, and form messages including stored routes

between the i-th and all j-th subscribers, the identifiers ID _{a j} and the IP _{a j} addresses of all jx subscribers send the generated messages to all the i-th network subscribers, and to send messages between the subscribers by the identifier of the recipient of the message ID _a, select it IP _a and secure route

, Wherein when a new subscriber to the communication network is formed message containing the address of the node IP _CSS connect a new subscriber, his identifier ID _{and n} and address IP _MR then sends the generated message to the security server, where it is stored in the structural and identification arrays , then, in the security server, select secure communication routes between the new subscriber and all j-subscribers and store them, after which they generate messages that include information about the stored safe communication routes, and send t them to all network subscribers, characterized in that in addition to the initial data set an acceptable value

a comprehensive route safety indicator, after calculating for each of the N _ij possible communication routes, the complex route safety indicators

as average route safety

, compare the values of complex route safety metrics

with predefined valid value

remember valid routes

with complex safety metrics

form M _ij pairs of additional identifiers for network subscribers

where

form a set of L possible permissible communication routes between each pair of identifiers of network subscribers, where L = M _ij +1, and remember the generated L routes, then send the generated messages to all i-th network subscribers, receive them by network subscribers, assign M _ij pairs of additional identifiers

subscribers of the network, in accordance with the control information contained in the received messages, fragment the outgoing message into L fragments, while the number of fragments is chosen equal to the number of pairs of identifiers: (L = M _ij +1) and message fragments are transmitted along L possible valid communication routes. 2. The method according to p. 1, characterized in that the complex security indicator k _x∑ for each x-th network node is calculated by summing, or multiplying, or as the arithmetic average of its security parameters b _xy . 3. The method according to p. 1, characterized in that the number N _{ij of} trees of the graph of the communication network between the i-th and j-th subscribers of the network is calculated by the formula:

where B _o = M × K is the transformed adjacency matrix of the vertices of the graph of the communication network, and M = M _p -1, K is the number of rows and columns of the matrix, M _p is the number of rows of the original adjacency matrix, equal to the total number of nodes in the communication network;

is the transposed matrix to B _o .

Images