RU2631971C1 - Method of identifying logical connection in infocommunication network providing anonymous access - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: communication network parameters are set and alternative message packet routes are allocated for each pair of alternative connections to the subscriber's communication network, the alternative message packet routes are stored for each subscriber's connection option. In this case, after the parameters of the communication network are set, the intensity of the input stream arriving at the individual nodes characterized by the identifiers is measured, and then the alternative message packet routes are allocated, and after the alternative message packet routes are stored, the flow rate between the adjacent nodes is calculated, and then the alternative routes are ranked by the intensity value and the first and last nodes of the route with the highest flow intensity are chosed, which identify the logical connection in the infocommunication network.

EFFECT: identification of a logical connection in the infocommunication network providing anonymous access.

2 dwg, 8 tbl

Description

The invention relates to the field of computer security and can be used to localize an information security violator using anonymization tools.

The invention is known "Method for the analysis and detection of malicious intermediate nodes in the network" according to patent RU No. 2495486 G06F 21/00, publ. 10.10.2013, which consists in blocking the intermediate nodes of the attacker by examining the connections between network nodes, constructing a graph of connections between network nodes and automatically analyzing changes in connections between nodes. The disadvantage of this method is the impossibility of using it if an attacker uses infocommunication networks that provide anonymous access.

Also known is the invention "A method for the comparative evaluation of communication network structures" according to patent RU No. 2460123 G06F 13/00, publ. 08/27/2012, which consists in the fact that the topological diagram of the communication network sets alternative options for connecting subscribers to the communication network, calculates the availability indicator of the nodes of the communication network, taking into account the time to reach the critical ratio of “dangerous” and “safe” nodes for each connection option to the subscriber’s communication network and the connectivity of adjacent “dangerous” nodes forming chains that exclude exchange between subscribers, rank alternative options for connecting subscribers to the communication network by the number of “dissecting” nodes communication networks and choose a reliable option for connecting subscribers to the communication network.

A disadvantage of the known prototype method is the impossibility of its application to solve the problem of identifying a logical connection in infocommunication networks, characterized by the uncertainty of structural and topological characteristics associated with the use of anonymization tools for access to information resources.

By identifying a logical connection in a network that provides anonymous access, we mean identifying the input and output nodes of this network used by the intruder.

The proposed method expands the scope of the prototype method by introducing additional procedures and partial changes in the relationships in the logic of the previous prior art.

The objective of the invention is to create a method for identifying a logical connection in an infocommunication network that provides anonymous access, based on an analysis of information gravitation coefficients characterizing the intensity of interaction between nodes, which allows to achieve a technical result: providing identification of a logical connection in an infocommunication network that provides anonymous access.

The problem is solved by setting the parameters of the communication network and allocating alternative transmission routes for message packets for each pair of alternative connections to the communication network of subscribers, remembering alternative transmission routes of message packets for each connection option of subscribers, according to the invention, it is supplemented by the fact that after setting the network parameters communication, measure the intensity of the input stream coming to individual nodes and then allocate alternative routes for the transmission of message packets, and after I remember t alternative routes for the transmission of message packets, calculate the flow rate between neighboring nodes, and then rank alternative routes according to the intensity value and select the first and last nodes of the routes.

The analysis of the prior art by the applicant made it possible to establish that there are no analogs characterized by sets of features identical to all the features of the claimed method. Therefore, the claimed invention meets the condition of patentability "Novelty." Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the claimed invention from the prototype have shown that it does not follow explicitly from the prior art. From the prior art determined by the applicant, the influence of the provided by the essential features of the claimed invention on the achievement of the specified technical result is not known. Therefore, the claimed invention meets the condition of patentability "Inventive step".

The claimed technical solution is illustrated by drawings, which show:

FIG. 1 is a flowchart of an algorithm that implements the claimed method for identifying a logical connection in an infocommunication network that provides anonymous access;

FIG. 2 is a diagram of an infocommunication network with the indicated initial parameters.

A method for identifying a logical connection in an infocommunication network providing anonymous access can be implemented by the sequence of operations shown in FIG. one.

At the initial stage, the parameters of the infocommunication network are set (block 1, Fig. 1), which are:

- the number of nodes forming a network with anonymization, N;

- IP addresses of nodes;

is the distance between the nodes, L.

In FIG. 2 shows an example of a network with initial parameters.

Next, the measured intensity of the input flows (the number of packets per unit time) arriving at the nodes of the network (block 2, Fig. 1).

At the next stage, alternative routes for transmitting message packets between subscribers (block 3, Fig. 1), the nodes of which are characterized by identifiers, are extracted from the formed topological network diagram. For each pair of alternative connections to the network of corresponding subscribers, there is a finite set of alternatives of routes for message packets between them. The set of alternative routes for the transmission of message packets in the network between the corresponding subscribers makes up the logical structure of the network.

Alternative routes for transmitting message packets for each connection option of subscribers and subscriber identifiers are stored in memory arrays allocated for this (block 4, Fig. 1).

After all the alternative routes are highlighted, the flow rate between adjacent nodes is calculated (block 5, Fig. 1).

To calculate the intensity, expression 1 is used

where K _ij is the information gravity coefficient between the ith and jth nodes.

The intensity of the flow γ _ij coming from the ith node to the jth, in the most general case, is a function of the intensity of the input stream γ _i [Nazarov A.N. Models and methods for calculating the structural network parameters of networks. - M .: Hotline-Telecom, 2002. - 256 p.].

The information gravity coefficient between the ith and jth nodes is calculated using expression 2

- коэффициент информационного тяготения по нагрузке;Where

- coefficient of informational gravitation on the load;

- коэффициент информационного тяготения по расстоянию.

- information gravity coefficient over distance.

Expression 3 is used in the calculation of the coefficient of information gravitation by load

The source data for calculating the distances between the objects is an array with the geographical coordinates of the objects in degrees. The calculation results are entered into the matrix of mutual distances between objects and are used to calculate information gravitation over distance using expression 4

where r _ij is the distance between the ith and jth nodes.

As a result, a matrix of information gravitations is formed, in which the intensity of flows is indicated at the intersection of columns and rows for each pair of nodes.

Next, based on the intensity values, all routes are ranked (block 6, Fig. 1). Ranking can be done, for example, by the method of bubble sorting [Levitin A.V. Chapter 3. The brute force method: Bubble sort // Algorithms. Introduction to development and analysis. - M .: Williams, 2006 .-- S. 144-146. - 576 p.].

The conducted ranking allows at the final stage to select the first and last node (source and drain) of the logical connection route in the infocommunication network that provides anonymous access.

Consider an example implementation of the described method.

We will consider the identification of a logical connection in an infocommunication network that provides anonymous access, using the TOR technology as an example (abbr. From The Onion Router). A feature of this infocommunication network is the construction of a chain (route) of 3 nodes to ensure anonymous access [Kevin Bauer, Joshua Juen, Nikita Borisov, Dirk Grunwald, Douglas Sicker, Damon McCoy. On the Optimal Path Length for Tor. - USA: University of Colorado at Boulder, University of Illinois at Urbana-Champaign, University of California at San Diego. - 17 p.]. As the source data, we use the parameters of the infocommunication network, presented in table 1

Suppose that as a result of measurements of the intensities of the input flows, the values shown in Table 2 were obtained.

For this example, we determine the possible transmission routes of data packets in the infocommunication network. Because TOR technology for transmission involves the interaction of only three nodes, for an infocommunication network consisting of five nodes, it is possible to identify 60 alternative routes, a list of which is presented in Table 3.

Since the entire set of selected routes includes the interaction of nodes of the type "each with each", further calculations are carried out for all pairs of interacting nodes.

Using expression 4, the calculation of information gravity coefficients by distance for each pair of network nodes is performed. The calculation results are presented in table 4.

Similarly, the calculation of the coefficients of informational gravitation on the load using the expression 3. The resulting coefficients are presented in table 5.

Based on the obtained coefficients and using expression 2, information gravity coefficients are calculated (table 5). The resulting matrix is presented in table 6.

The calculation of the intensity of the flows coming from the i-th node to the j-th one is made according to expression 1. The calculation results are presented in table 7.

The obtained values of the intensity of flows between nodes allow ranking the routes shown in Table 3 by the value of the intensity of flows using the bubble sorting method. Table 8 presents the ranking results.

Based on the ranking results at the final stage, we select the first and last node of the route 4-> 5-> 2. Thus, in the calculation example, the logical connection in the infocommunication network will pass through the nodes 4.2.

Thanks to a new set of essential features, due to the introduction of new procedures and the relationships between them, it becomes possible to identify logical connections in networks that provide anonymous access. The proposed method can be used in subsystems that provide protection of information resources.

Claims (1)

A method for identifying a logical connection in an infocommunication network that provides anonymous access, which consists in setting the parameters of the communication network and identifying alternative routes for transmitting message packets for each pair of alternative connections to the communication network of subscribers, remembering alternative routes for transmitting message packets for each connection variant of subscribers, characterized in that after the parameters of the communication network are set, the intensities of the input stream entering the individual nodes are measured, the character ceterized by identifiers, and then select alternative transmission routes for message packets, and after remembering alternative transmission routes for message packets, calculate the flow rate between neighboring nodes, and then rank alternative routes by the intensity value and select the first and last route nodes with the highest flow rate, which identify the logical connection in the infocommunication network.

Images