RU2635269C1 - Complex of hardware and software creating protected cloud environment with autonomous full-function logical control infrastructure with biometric-neural network identification of users and with audit of connected hardware - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: complex of hardware and software, that creates a protected cloud environment with an autonomous full-function logical control infrastructure with biometric-neural network user identification and with the audit of the hardware used, contains server and network equipment, an administrator workstation, a large data storage, a secure access point, a security module, a trust module, a biometric-neural network computing module, and a mobile PC providing protection from theft and unauthorized access.

EFFECT: increase in the information security of cloud services.

8 cl, 2 dwg

Description

The invention relates to the field of information security, and in particular to software and hardware tools for ensuring information security, and can be used to eliminate the entire wide range of information security threats to telecommunication systems of government, organizations, state corporations and departments of the Russian Federation, organized on the basis of a global network Internet, from foreign management and controlling companies.

In the future, when characterizing the developed technical solution, the following terms will be used:

- a security module, which is a microelectronic chip or an embedded microelectronic module, designed to perform functions in accordance with the international recommendations of TCG (Trusted Computing Group), but based on domestic algorithms and safety standards, as well as an expanded set of functions required by domestic information security guidelines ;

- A trust module (specialized trusted storage medium) designed to perform functions in accordance with TCG international recommendations. An analogue of the trust module can be recognized as the Personal Secret software and hardware complex (PAC), http://www.okbsapr.ru/korobov_2010_1.html);

- module of trusted biometric-neural network computing (fingerprint), which is a small USB module that is connected between the fingerprint scanner (graphic tablet) and a desktop computer, laptop. PAC “Accord-Win32”, http://www.accord.ru/bio.html) can be recognized as an analogue of the module of trusted biometric-neural network computing.

Technologies of cloud services and mechanisms for accessing them through personal accounts are currently used by many enterprises and organizations. Moreover, the vast majority of services are organized on server platforms located abroad, and access protection to them is based only on logins and passwords issued to the client upon registration by the resource owner. An example is cloud solutions from Microsoft or Amazon, Google, etc.

These solutions are closely related to the concept of PaaS (Platformas and Service - platform as a service). One type of PaaS solution is associated with distributed computing technologies that are used in the infrastructure of Internet giants such as Google (GFS file system (Google File System), BigTable database) and Yahoo (Hadoop). The first significant proposal in this area was the Google Arp Engine system. With its appearance, third-party developers were able to host web applications on the Google infrastructure that can scale and serve millions of web users no worse than applications from Google itself. However, in return, developers should abandon some tools. In particular, the Google Arp Engine does not have a relational database management system (DBMS) and does not support the standard structured query language (SQL) syntax, but instead uses its own Big Table database with Graph Query Language (GQL) syntax.

Salesforce.com went the other way: its proposed online CRM platform was designed in such a way as to provide customers with the maximum opportunities for refinement and adaptation, which is quite enough to create completely independent applications. The result of its activities is the Force.com PaaS platform.

The fundamental difference between the approaches of Google and Salesforce.com is underlined by the Force.com for GoogleAppEngine set of programming interfaces. This tool allows Google Arp Engine developers to access the Force.com infrastructure in their applications. Thus, Force.com and the Google Arp Engine only theoretically allow us to solve the same problems - in practice, these systems are focused on two different market segments (in the first case, corporate users of Salesforce.com, in the second, developers focused on technologies from Google) and at the current stage practically do not compete with each other.

Another development option for the PaaS platform is associated with Microsoft. For her, the WindowsAzure PaaS system is a natural stage in the development of server technologies such as WindowsServer, the Hyper-V virtualization system, and SQL Server. Azure provides an integrated set of application services for developing, hosting, managing and scaling applications using the Microsoft data center infrastructure. For this reason, WindowsAzure is not an infrastructure, but a platform - Platform as a Service (PaaS) solution.

The hardware resources of all these solutions are located abroad, which, subject to the Federal Law Federal Law No. 152 “On Personal Data”, imposes serious restrictions on the possibility of their use. There are hybrid solutions.

Hybrid "clouds" are such an implementation of cloud computing, in which part of the system is placed in a public "cloud", i.e. based on a cloud provider, and some in a private "cloud", i.e. on servers owned by the company itself. In fact, a hybrid “cloud” is not an independent type of cloud deployments, but only indicates the close integration of public and private cloud systems. For example, such integration is possible when transferring a backup system to a public “cloud” or vice versa - when backing up data from a public “cloud” to local servers.

There are solutions that allow simultaneous monitoring of computing resources located both inside the company and on a third-party site, for example, CloudKick from Rackspace. Another option for using a hybrid “cloud” involves installing applications on the company's internal servers with the lease of additional capacity in a “cloud” of a third-party provider in case of an unexpected increase in load.

Many Russian companies providing cloud services also rent foreign data centers and servers. An example is cloud solutions from 1C. Even if the equipment is located on the territory of the Russian Federation, the virtualization tools used are foreign software products: Microsoft (WindowsAzurePack), VMware (vCloudSuite), etc.

Access to your personal account, and therefore to the entire package of services that are available for this client, is in existing domestic and foreign solutions abstracted from the person’s immediate identity, and is provided not to the actual owner of the account, but to the bearer of the login and password.

A particular solution for reliable identification and authorization of technical means, with remote access to the cloud from the workstation, is specified in the international specifications: “TCG: TNC - TrustedNetworkConnect”. To implement the appropriate protocols in the network infrastructure, an architectural superstructure is created, the requirements for which are regulated by international specifications. However, at the moment, only a few and exclusively foreign manufacturers of network equipment follow these specifications: Juniper, Cisco.

Even this solution can be effectively applied only on the machine-machine interface and does not solve the problem under consideration on the man-machine or man-cloud interfaces. If there is a client person behind the workstation claiming access rights to the resource (for example, through a personal account), then his identity remains indirect, and access is conditionally personalized.

An effective solution to this problem is possible only on the basis of biometric identification technologies for a person according to his individual parameters. Within the framework of this project, a solution is proposed for the first time not only among domestic organizations, but also at the global level.

Work in the field of using biometric protective equipment has been carried out abroad for more than 20 years. The average annual rate of development of biometrics is 40%, which is a very high indicator. At present, biometric information access control systems are gaining more and more popularity in banks, companies involved in ensuring security in telecommunication networks, in information departments of companies, etc. Similar systems appeared on the Russian market thanks to the firms Identix, SAC Technologies, Eyedentify, Biometricldentificationlnc., RecognitionSystems, Trans-Ameritech, BioLink, Sonda, Elsys, Advance "," AAM Systems, "Half Band, Mask."

All of the above technologies pose a risk of loss / theft of the base of biometric templates due to the fact that they are made in accordance with international standards that do not provide mechanisms for protection against compromise. This fundamental drawback will be eliminated in the framework of the proposed technical solution through the placement of biometric data in protected neural network containers. Each neural network container is opened only upon presentation of the user image and does not need additional encryption on a shared key.

During the search for patent and scientific and technical literature, no source of information was identified that could be used as the closest analogue of the developed technical solution.

The closest analogue to organizing a closed environment inside public networks including the Internet are VPN solutions that are offered by many manufacturers of network equipment: Cisco, D-Link, Mikrotik, Junipera etc. However, a VPN network cannot be considered as a full-fledged cloud, since it initially does not imply the availability of services and logical infrastructure. Also, classic VPN solutions do not use trusted computing technology, not to mention biometric user identification.

Network Coordination Centre) и контролируемого из Амстердама.There are solutions built on top of the VPN. The most ambitious example in Russia is the system of interagency electronic interaction developed in the framework of the e-government program. However, due to specific tasks, it is closely integrated with the global Internet and does not provide a sufficient degree of isolation, independence and protection from external and internal attacks, which does not allow their use in services, departments and divisions of the Russian Federation, where secret information circulates. SMEV is being built within the segment of the Internet network RSNet (RussianStateNetwork), registered in RIPE NCC (

Network Coordination Center) and controlled from Amsterdam.

Some foreign solutions offered by Internet giants (Google, Microsoft, Oracle, etc.) can be considered as close analogues, but they cannot be used in the Russian Federation due to the fact that the entire physical infrastructure (servers, data storage systems) is located outside of Russia.

An analogue of the developed system in terms of biometrics is the system of international biometric passports. This system cannot be used by e-government and distance education, as it contains openly stored biometric user templates. This contradicts Federal Law No. 152 “On Personal Data”. Only in the case when all personal biometric data will be placed in secure neural network containers (made in accordance with GOST P 52633.4-2012), the developed remote biometric authorization technology will be able to satisfy Federal Law No. 152 “On Personal Data” and be applied by electronic government.

In addition, the usual certification centers for generating public key certificates, which are not able to provide biometric registration and authentication services, are analogous.

At the moment, there are no analogues abroad and in Russia that allow you to remotely control a person’s biometrics, keeping all his personal data secret. The novelty lies in the fact that the proposed technology is able to maintain the secret of the biometrics used by a particular person. The threat of theft of personal biometric data bases disappears. Automata recognize a person; it is impossible to extract human biometric data from the automaton’s memory. The owner of biometrics uses his rights, and the attacker can not use other people's data or even want to find the person who is their master.

The combination of cloud technologies, technology of trusted computing (information security technology) and biometric identification of a person (technology of trusted authorization) in a single product is a qualitatively new property that distinguishes the products being created from all analogues available on the world market.

An example of the application of this technical solution can be the creation of a completely closed cloud environment designed to create secure electronic document management systems and use in organizations with high requirements for information security (Social Insurance Fund, Pension Fund, Federal Migration Service, notary office, legal proceedings, electronic trading platforms, science, municipality, institutions of higher and secondary education, banks, medical institutions, etc.)

The technical problem solved by the developed hardware-software complex is to create a secure and trusted cloud environment in Russia that uses only the transport level of the Russian segment of the Internet and is not dependent on foreign regulators and information resources.

The technical result achieved by the implementation of the developed technical solution consists in creating a fully enclosed information cloud space by combining well-known cloud technologies with trusted computing technology and a trusted network connection with individual human biometric characteristics.

To achieve the specified technical result, it is proposed to use the hardware-software complex of the developed architecture. The developed hardware and software complex that creates a secure cloud environment with an autonomous full-featured logical management infrastructure with biometric-neural network identification of users and with the audit of used technical means contains at least a complex of technical means, including server hardware, network equipment designed to organize closed secure information environment, for auditing plug-in hardware and access to it stationary and mobile administrator’s clients, the administrator’s workstation, a large volume of information storage intended for creating network and system resources, at least one user’s workstation, each of the user's workstations contains a desktop computer protected from unauthorized access, as well as information theft managed and a secure access point that provides access to the cloud and is a gateway that separates a closed multiservice environment from an external network, additionally equipped with a security module In addition, the complex contains a mobile PC (personal electronic computer), which protects data from theft and unauthorized access, which can be a tablet (laptop), as well as a software module, as well as a trust module, a trusted biometric-neural network computing module. software designed to perform trusted computing control functions with the extension of standard TCG functions due to biometric control of the operators' identities in addition to the control of hardware and software mnyh funds.

A security module is typically a microelectronic chip or an embedded microelectronic module.

A trust module is typically a secure storage medium.

The trusted biometric-neuro-network computing module preferably comprises a small-sized USB module installed between a fingerprint scanner and a desktop computer,

Personal biometric data is mainly placed in secure neural network containers made in accordance with GOST P 52633.4-2012.

Typically, each neural network container is capable of disclosure only upon presentation of a user image without additional encryption on a shared key.

The hardware-software complex may have a private deployment model.

Usually the complex is isolated from the global Internet.

The scheme of the developed complex is presented in FIG. one

The security module (Fig. 2) is a microelectronic chip or an embedded microelectronic module and is designed to perform specified functions according to international recommendations of TCG, but based on domestic algorithms and safety standards, as well as an expanded set of functions required by domestic guidance documents in the field of information security. The security module is used as part of customer jobs on the basis of a personal computer (mobile personal computer). The security module has the following characteristics (as a security module, the controller manufactured by the Design Bureau "CAD" "Accord-5.5", http://www.accord.ru/accord55.html can be used).

3. The trust module (specialized trusted storage medium) is designed to perform the specified functions in accordance with the international recommendations of TCG. The trust module is used as part of customer jobs based on personal computers (mobile personal computers). The trust module has the following characteristics (the “Personal Secret” software and hardware complex (PAC) can be used as the trust module, http://www.okbsapr.ru/korobov_2010_1.html):

The trusted biometric-neural network computing module (fingerprint) includes a small-sized USB module that is connected between the fingerprint drawing scanner (graphic tablet) and a desktop computer, laptop (Accord-Win32 PAK can be used as a trusted biometric-neural network computing module , http://www.accord.ru/bio.html). All cryptographic operations and operations of neural network recognition of biometric images are carried out inside the trusted computing module and is a neural network container (protected table of a trained neural network) performed in accordance with GOST P 52633.4-2012. Each neural network container is opened only upon presentation of the user image and does not need additional encryption on a shared key. The module is designed to perform biometric-neural network authentication transformations in the trusted computing environment of the USB module. The module is used as part of customer jobs on the basis of a personal computer (mobile personal computer).

A mobile PC in the form of a tablet (laptop) provides data protection from theft and unauthorized access and is designed to provide mobile user access to a portal with informational cloud services. Variant of execution - tablet (laptop). Access to the portal’s multiservice environment - via 3G wireless channels (HSDPA, HSUPA, UMTS), EDGE, GPRS, LTE, 4G. Power: autonomous, from built-in power sources. Access authorization - biometric. A personal computer is used as part of the created complex and is used on users' mobile workstations.

PC, protected from information theft, is designed to provide user access to the portal with information cloud services. The personal computer used as part of the created complex is intended for use at users' workplaces. An option is a desktop computer. Internet access: wireless 3G (HSDPA, HSUPA, UMTS), EDGE, GPRS, LTE; wired - Ethernet (100BASE-TX). Access authorization - biometric.

The software (software) is designed to perform the functions of trusted computing control with the extension of the standard TCG functions due to the biometric control of the identity of operators in addition to the control of hardware and software (software used from the PAK Accord-Win32 software, http: // www.accord.ru/bio.html). The software processes data from standard biometric data scanners (fingerprint). The software is used as part of client workstations based on a personal computer (mobile personal computer), for example, a desktop computer, laptop, tablet computer operating under OC Windows or OC Linux (OS versions are specified upon delivery).

To access the cloud, use a managed and secure access point (UTTD) (Cisco W API 21 Wireless-N Access Point with a single configuration point, http://www.cisco.com/c/en/us/products/collateral/wireless/ wap121-wireless-n-access-point-single-point-setup / c78-697404_data_sheet.html) is a gateway that separates a closed multiservice environment from an external network. With its small dimensions, the UZTD incorporates both wired (Ethernet, fiber) and wireless (Wi-Fi) interfaces, allowing access to the multiservice environment from both stationary and mobile objects.

(в качестве символьного обозначения домена первого уровня

могут быть использованы любые аббревиатуры, также как привычная .ru, так и любая другая .aa, .bb и прочие).Thanks to the autonomous reproduction of the entire logical infrastructure of the Internet, work in a multiservice environment is similar to work in the global Internet. Access to electronic resources, made in the form of web applications, is carried out through a regular browser. However, no additional software or plug-ins are installed on the client hardware. In the address bar, the usual letter addresses are entered, the e-mail has a familiar format:

(as a symbol of the first level domain

any abbreviations can be used, as well as the usual .ru, as well as any other .aa, .bb and others).

To establish connections in the range of “gray” IP addresses on servers, the entire logical infrastructure of the Internet is duplicated (DNS servers, time servers, IP address allocation processes, etc.), which makes it possible to use standard Internet technologies inside a closed data transmission medium . This approach simplifies both low-level data exchange, for example, through the use of the guaranteed message delivery service according to the “publish-subscribe” principle, as well as high-level access to structured data (databases, network resources).

The functioning of mobile and stationary objects in the segment is carried out in the dynamic ("gray") addresses of any local operators. In this case, the IP addresses of network objects will be in the total number of dynamic addresses that are provided to all users of cellular networks and the Internet.

Unlike the global Internet, where point-to-point communication is possible only for any pair from the range of white IP addresses, in the created multi-service environment, the cryptographic subsystem has the ability to organize a hierarchical structure of subnets according to the senior-subordinate principle. Moreover, the internal IP addresses do not change when changing external addresses (providers) or the way the UTTD accesses the network (Ethernet / 4G / Wi-Fi), which is especially true when using the global Internet as a transport medium.

Data transmitted over communication channels is identical to standard VPN traffic.

The use of modern telecommunication technologies in the implementation of the system project under consideration will ensure the possibility of functioning in a single secure information field:

- complexes of remote access to system resources:

a) to databases;

b) to the bases of navigation information;

c) to the bases of audio and video information;

d) to remote automated control services of electronic document management systems with digital signature;

- e-mail and instant messaging systems, including digitally signed;

- data transmission systems and telemetric information;

- systems for the exchange of audio, video information (including high-resolution video);

- various heterogeneous communication networks and radio networks;

- navigation and positioning systems;

- cellular communication systems.

At the same time, access to a unified information environment both from the side of interfaced systems and from individual correspondents can be carried out in secure modes with wired and wireless (mobile) access, including remote access modes over broadband radio channels.

Such systemic solutions will allow, when solving pairing problems in a single information environment of heterogeneous systems and special communication networks, to abstract from the implementation of pairing protocols and interfaces in each specific case and focus on solving common pairing system problems, considering them simultaneously, in conjunction with information security tasks. In addition, a service-oriented architecture will allow the use of the same unified system approaches for the implementation of system services and services, taking into account modern security requirements.

It seems promising to use domestic hardware of the TPM trusted module in the multiservice environment hardware. In relation to the tasks of organizing a trusted data transmission medium, the TPM module performs such tasks as:

- storage of the electronic fingerprint of the system;

- audit of client configuration;

- the appointment and application of security policies before establishing communication with a closed environment;

- checking that the client fulfills the necessary criteria for access to a secure environment.

The use of the TPM module will make it possible to exclude access to the protected multiservice environment from the device with a modified system configuration produced by malware or by the user.

A fundamentally important characteristic of the considered system solutions is that any medium with packet-switched data can be used as a transport medium for implementation, while the global Internet can be considered only as a special, but most characteristic case.

The essence of the technology is that information security mechanisms descend to the lowest level of hardware platforms and serve as the foundation for building a hierarchical trusted computing environment on their basis up to user applications.

The technology targets as part of computer technology (SVT) are achieved by introducing on the hardware platform or even directly into the computer core the central processor (CPU), a specialized information security agent that is provided to help the CPU to solve specialized information security problems. At the level of network and infrastructure solutions, cloud technologies, on virtual and mobile platforms, technology targets are achieved through special architectural solutions and the corresponding numerous protocols.

Information security agents are implemented in the form of a specialized microelectronic chip or an embedded microelectronic module called TPM.

In the SVT firmware environment, the TPM module performs the following tasks:

- monitoring the integrity and predetermined configuration of the platform, as well as the composition of peripheral hardware connected to it;

- authentication of the platform on which the TPM module is installed (platform authentication);

- BIOS integrity monitoring;

- integrity control and a given configuration of the software environment, including the operating system;

- user authentication (authentication can be single-factor or multi-factor);

- dynamic integrity control and authorized launch of programs, including operating system programs and user applications;

- generation and storage with protection against unauthorized access (NSD) of encryption keys and keys of electronic digital signature (EDS);

- storage with protection against unauthorized access of critical data about the platform and its software environment coming from the BIOS, from the OS, as well as user data having limited distribution;

- Performing the functions of a hardware cryptographic services provider (crit provider) for the OS and user applications.

The proposed technical solution can be partially attributed to the category of SaaS (Software-as-a-Service) - software as a service. The difference is that the user is not only provided with access to cloud services, along with the usual work on the Internet. In this case, the user is given the opportunity to use the services, if only he is already in the closed space of the cloud, which does not have access to the open Internet and vice versa. Closedness of the proposed cloud architecture is achieved in addition to classical cryptographic approaches by a combination with technology of trusted computing and biometric-neural network identification. Duplication of system and application services of the global Internet inside a protected cloud makes the user’s work similar to working on the Internet and does not require additional skills.

Claims (8)

1. A hardware-software complex that creates a secure cloud environment with an autonomous full-featured logical management infrastructure with biometric-neural network identification of users and with an audit of the technical means used, characterized in that it contains at least a complex of technical means, and a complex of technical means includes server equipment, network equipment designed to organize a closed secure information environment, for auditing connected technologies tools and access to it for stationary and mobile clients by the administrator, administrator’s workstation, large-scale information storage intended for creating network and system resources, at least one user’s workstation, each user’s workstation contains a desktop computer protected from unauthorized access, as well as information theft, a managed and secure access point that provides access to the cloud and is a gateway that separates a closed multiservice environment from the network, additionally equipped with a security module, a trust module, a module of trusted biometric-neural network computing, in addition, the complex contains a mobile PC that protects data from theft and unauthorized access, as well as software designed to perform trusted computing control functions with the extension of standard TCG functions through biometric control of the identity of operators in addition to the control of hardware and software. 2. The hardware and software complex of claim 1, wherein the security module is a microelectronic chip or an embedded microelectronic module. 3. The complex of hardware and software according to claim 1, characterized in that the trust module is a secure storage medium. 4. The hardware and software complex according to claim 1, characterized in that the trusted biometric-neural network computing module contains a small-sized USB module installed between the fingerprint scanner and the desktop computer. 5. The hardware and software complex according to claim 1, characterized in that the personal biometric data is placed in secure neural network containers made in accordance with GOST R 52633.4-2012. 6. The hardware-software complex according to claim 5, characterized in that each neural network container is capable of being disclosed only upon presentation of a user image without additional encryption on a shared key. 7. The complex of hardware and software tools under item 1, characterized in that it has a private deployment model. 8. The complex of hardware and software tools under item 1, characterized in that it is isolated from the global Internet.

Images