RU2646339C2 - Method for processing information messages of telecommunication networks - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method for processing information messages of telecommunication networks is disclosed, comprising analysis of information messages by predefined parameters with selection of identification characteristics, wherein templates that represent a description of permitted interactions of telecommunication networks and contain an enumeration of allowed values for the information message parameters are created, the information message is examined for compliance with the template, and if the values of the information message parameters match the allowable values of the template parameters, a decision on the admissibility of transmitting information message to the next stages of information message processing is made, the algorithm of information message processing is defined at the mentioned stages. Possible processes of the information message processing at the specified stages are the reformatting of the information message, sending the information message to the recipient and forming a new information message based on the primary one.

EFFECT: excluding unauthorized information interactions between telecommunication networks, providing possibility of message reformatting during broadcast to another network, providing possibility of the message delivery to the target recipient after reformatting, and ensuring only authorized access to resources of closed computer network.

1 cl

Description

The invention relates to computer technology and can be used for controlled interaction of various telecommunication networks with each other, as well as making decisions and executing predefined algorithms based on the results of analysis of compliance of information received from one of the telecommunication networks with established templates.

Information message (IP) means: command, request, e-mail message.

Any IP consists of a header and a message body. The message body contains the target (intended for the recipient) information.

The scope of the invention

1. Multi-user automated systems, implying the delimitation of users by the level of access to protected information.

2. The functions of a managed interface for the information interaction of various telecommunication networks, including:

- control over the content of informational messages;

- verification of IP formats accepted in networks;

- differentiation of access to data of various levels of confidentiality;

- transformation of the IP of the primary network, with permitted forms and destinations, to the form used in the secondary network and vice versa.

Currently, there are various ways of identifying objects according to certain characteristics - the sender address, recipient address, message size, type of information.

In known methods of identification:

- message analysis is not used for the totality of identification features - the format and the given set of acceptable values;

- it is not intended to select a message processing algorithm depending on the result of the analysis of message attributes.

The proposed method for analyzing messages involves the use of local databases containing tables of message attributes with categories:

- signs to the sender's address: “only from”, “from all but”, “from all”;

- signs at the address of the recipient: “for anyone”, “only for”, “for all but”;

- signs by type of message, for example, “text only”, “text only, containing only numbers”, “video only”, “any” and so on;

- signs according to the size of the message: “no more”, “no less”, “no less and no more”;

- message syntax;

- finding the values of the transmitted parameters within certain limits;

- other signs due to the problem being solved.

After the analysis, decisions can be made on the delivery of the message to the recipient, on the refusal to deliver the message, on reformatting the message, on the formation of a new message based on the received message.

As an analogue, application US 2013/0198798 A1, “E-MAIL FIREWALL WITH POLICY-BASED CRYPTOSECURITY” (similar to the subscript translation “INTERNET E-MAIL SCREEN WITH ENCRYPTION POLICY”) can be used.

However, this application deals exclusively with “e-mail messages”, about the organization of a centralized exchange of mail messages entering / outgoing to / from an organization protected by a local information network by decrypting / encrypting them. In the text D1, it is the encryption / decryption process that is called “reformatting”. Paragraph 0043 provides an example of the use of a mail security tool.

The proposed method is much wider - it covers all the allowed interactions of telecommunication networks, without reference to specific protocols.

Reformatting the information message in the proposed method does not solely mean encryption / decryption, but may mean using a different protocol, adding / deleting part of the message, and other methods. The formation of a new message on the basis of the primary one expands the scope of the method - it is possible to change the recipient address, change the sender address, reduce the message to the command level (1 byte) and others, that is, the proposed method is not limited to processing only "email messages" - it covers all allowed interaction of telecommunication networks, without reference to specific protocols.

The objective of the invention is the elimination of unauthorized information interactions between telecommunication networks (TS) (various sectors of the same network), the possibility of reformatting (decoding and converting to a different type) of the message when broadcasting to another network, and the possibility of delivering the message to the target recipient after reformatting. This increases the security of telecommunication networks. In this case, only those interactions between vehicles that are explicitly allowed can be allowed.

The problem is solved in that the method of processing informational messages of telecommunication networks involves analyzing informational messages with identifying identification features, first creating templates representing descriptions of allowed interactions of telecommunication networks and listing the acceptable values for the parameters of the informational message, checking the informational message for compliance with the template and if the values of the parameters of the informational message coincide with The values of the template parameters make a decision on the admissibility of transmitting the information message to the next stages of processing the information message and determine the algorithm for processing the information message at the indicated stages, and the possible processes for processing the information message at the indicated stages are reformatting the information message, forwarding the information message to the recipient, and generating a new information message based on the primary.

The method includes several sequential processing processes:

- identification of an information message by a set of parameters, checking its correctness, making a decision on a further processing algorithm, reformatting a message, forwarding a message, sending a message to one of the telecommunication networks. They also use data depending on the current state to identify the message, to replenish the local database, to detect the message, to diagnose errors.

For analysis, templates are introduced into the local database that are used to compare the received message with them and, based on the results of comparison, decide on the message processing algorithm. The order of the processes may vary. Descriptions of allowed interactions (templates) are formulated for a certain period of time and can be changed.

Each message has a set of parameters A. Ai = (Ai1, ... Ain). For each parameter, the set of permissible values of B (A) can be determined. Bj (Ai) = (Bj1 (Ai), ... Bjm (Ai)). Each template C contains an enumeration of valid parameter values (each or some). Ci = (Ai, Bj (Ai)).

The first process is to verify that the IC matches the pattern C. If the values of the parameters A match the pattern C, a decision is made on whether it can be transferred to the next processing steps and their algorithm is determined.

Possible IP processing processes in the following steps:

- reformatting the message;

- transfer of IP to the recipient;

- the formation of a new IP based on the primary.

The proposed method, using a unique series of previously known techniques, gives the systems a new quality - the ability to provide controlled access to telecommunication networks protected from unauthorized access, in which data with a different level of confidentiality is processed, based on an integrated analysis of information messages circulating in networks that are supposed to be transmitted to network.

An example implementation of the method

The proposed example is based on the use of templates containing signs of messages with categories:

- sign “message of a fixed form” “from source A” “for recipient B”;

- the message contains a string of the form “AAAA BBBB CCCX XXX”;

- the meanings A, B, C are alphabetic inherent only in the Latin alphabet;

- the value XXX is a numeric value ranging from "013" to "132".

After the analysis, decisions can be made on the delivery of the message to the recipient, on the refusal to deliver the message, on reformatting the message, on the formation of a new message based on the received message.

Unlike the known methods of protection, the claimed method does not set itself the task of developing an adaptive method of protecting the network from unauthorized access, but focuses on a multi-level security system and the fundamental lack of direct access from an open network to a secure one. Those. The information filtering used does not play the role of a repeater, but an analyzer and interpreter of information coming from an external network.

User interaction is carried out only by transmitting standardized messages. Each message consists of a header and a command with parameters. The header contains the internal names of the sender and recipient of messages, the list of which is known in advance. A command is defined by its code and a set of inherent parameters (numeric, string, and binary data). The format of all commands and data is fixed and known in advance. In addition, it is possible to specify a list of valid commands for each type of user (role).

When a new message is received, the names of the sender and the recipient are checked in the list of valid names. If there is no name in the list, the message is ignored. Then, the actual IP address of the sender and its presence in the list of allowed addresses for this sender are checked. In the absence of such an address, the message does not go further.

Then the syntax of the command and its parameters is analyzed. If the command has the wrong format, then it is rejected. Finally, if all the above criteria are met, the message satisfies. Checks the availability of this command (code) to the existing roles of the sender and recipient. If successful, the message is processed and then transmitted to the secure network in the form of a command, signal, message or SQL query, depending on the type of recipient in the secure network. Moreover, even the theoretical possibility of direct transmission of network packets from an open system to a protected one, bypassing the analysis and interpretation unit, is excluded, since open and protected networks are connected to different network adapters that do not have a direct hardware-software connection.

Thus, the technical result is to provide only authorized access to the resources of a closed computing network. Any unauthorized message will be stopped and will not be able to harm the computing facilities of the secure network.

Claims (1)

A method for processing informational messages of telecommunication networks, including analyzing informational messages according to predetermined parameters with identifying identification features, characterized in that they create templates representing descriptions of allowed interactions of telecommunication networks and listing the acceptable values for the parameters of the informational message, checking the informational message for compliance with the template and if the values of the parameters of the information message coincide with the stimulus values of the template parameters make a decision on the admissibility of transmitting the information message to the next stages of processing the information message, determine the algorithm for processing the information message at the indicated stages, while the possible processes for processing the information message at the indicated stages are reformatting the information message, forwarding the information message to the recipient, and generating a new information messages based on the primary.