RU2648942C1 - System of protection of information from unauthorized access - Google Patents

Abstract

FIELD: information technology; cryptography.

SUBSTANCE: invention relates to the field of information security systems. System of protection against unauthorized access contains automated workstations (AWS) with an information security system (ISS), AWS user's workstation, Information Security Administrator (ISA) protection unit, Functional Server, Domain Controller Server (DCS), AWS ISA, cryptographic information protection means (CIPM), network firewalls, and the DCS consists of a security server, a security server database, a cryptographic protection device for information over the Ethernet protocol, a device for cryptographic protection of information via the IP protocol, the hardware-software module of the trusted download (HSMTD), access control unit.

EFFECT: technical result is to increase the degree of protection against unauthorized access.

4 cl, 12 dwg

Description

The invention relates to electrical engineering, and in particular to technical means of protection against unauthorized access to information in automated systems (AS), and in a single information space (EIP) ¹ ( ¹ Decree of the President of the Russian Federation No. 1390 of 07/01/94, "The concept of formation and development a single information space of Russia and relevant state information resources ”), and can be used to process confidential information.

A known system of protection against unauthorized access to information containing confidential information (RU 2443017, CL G06F 21/22, G06F 12/14, 2012). The system includes many automated workstations (AWS) of users and functional servers, at least one AWS of an information security administrator (ABI) and a server-domain controller in a computer network that are connected to each other via a network backbone, and a variety of user information protection systems from unauthorized access, each of which comprises ^two respective security agents (security Agent ² - unit responsible for automatic detection and registration of event information without in real time, notifies the security administrator of such events, can operate autonomously, automatically warn of a violation, block operation for the time of reconnecting or act according to the built-in algorithm.) and a user access sharing system connected to the control and data exchange bus of the corresponding workstation user or functional server. A system for protecting the administrator’s information from unauthorized access, comprising a security administrator-agent and a security administrator’s access sharing system connected to the control and data exchange bus of the information security administrator’s automated workstation, as well as a security server and security database connected to the server’s control and data exchange bus -controller domain, while AWS and functional servers, server-domain controller and AWS administrator information security containing hardware-software modules of trusted loading (APMDZ) installed on them, cryptographic protection devices for information transmitted over a local area network via Ethernet, and cryptographic protection devices for information transmitted over IP, which are connected to the control and data exchange buses of the corresponding workstation and functional servers, a domain controller server and a security administrator workstation, all cryptographic protection devices for information transmitted over a local area network over Ethernet ³ protocol ( ³ Ethernet - a protocol that defines wired connections and electrical signals at the physical level, frame format and media access control protocols at the EMVOS link layer.), and cryptographic protection devices for information transmitted over IP ⁴ ( ⁴ IP - protocol that ensures the transfer of data blocks (datagrams) from the sender to the receiver.) are connected to each other via a network backbone, and at least one workstation contains an app installed on it and connected to its control and data exchange bus Conversely, a software module trusted boot, encryption of storage media connected via USB (APMDZ with USB ^{5) (5} USB - serial interface to connect peripherals.), and hardware and software module trusted boot generating and checking digital signatures (APMDZ with EDS ⁶ ) ( ⁶ EDS - information in electronic form used to determine the person who signed the information.).

The disadvantage of this analogue is the relatively low level of system protection, which is manifested in the event of a compromised password or theft of a smart card.

Also known is a system for protecting information from unauthorized access to information containing confidential information (RU 2504835, CL G06F 21/62, G06F 12/14, G06F 21/31 2014). The system contains many AWP users and functional servers, at least one ABI AWP and a server-domain controller in a computer network, which are connected to each other via a network backbone. The system includes many systems for protecting user information from unauthorized access, each of which contains the corresponding security agents and a user access sharing system connected to the control and data exchange bus of the corresponding user workstation or functional server. The system of protection of administrator information from unauthorized access, which is part of it, containing the security administrator agent and the security administrator’s access sharing system connected to the control and data exchange bus of the corresponding information security administrator workstation. The System also contains a security server and a security database connected to the control and data exchange bus of the domain controller server. Workstation of users and functional servers, server-domain controller and workstation of information security administrator contain hardware-software modules of trusted download installed on them, devices for cryptographic protection of information transmitted over a local area network via Ethernet protocol, and devices for cryptographic protection of information transmitted over IP protocol that are connected to the control and data exchange buses of the corresponding workstations and functional servers, the server-controller domain and workstation security administrator. All devices for cryptographic protection of information transmitted over a local area network via Ethernet, and devices for cryptographic protection of information transmitted over IP, are connected to each other via a network backbone. At least one user workstation contains APMDZ with USB, APMDZ with digital signature installed on it and connected to its control and data exchange bus. AWP of users and AWP ABI contain means of enhanced authentication, which are connected respectively to the bus control and data exchange AWP of users and to the bus control and data exchange AWP ABI. Each system for protecting user information from unauthorized access and a system for protecting administrator information from unauthorized access contain a corresponding database of enhanced user authentication means and a database of enhanced security administrator authentication means connected respectively to the control and data exchange bus of the corresponding user workstation or functional server and to the bus management and data exchange AWM ABI. In addition, the network backbone has at least one gap, on each side of which one means of cryptographic protection of information (CIP) is included, transmitted through open communication channels through an uncontrolled territory.

The disadvantage of this analogue is also the relatively low level of security of the access system when exchanging with external information protection systems using different classification of credentials.

The closest in its technical essence to the claimed is a system for protecting information from unauthorized access, according to the patent (RU 2571372, CL G06F 21/00, G06F 12/14, 2015). The system contains many AWP users and functional servers, at least one ABI AWP and a server-domain controller in a computer network, connected to each other via a network backbone. The system also includes many systems for protecting user information from unauthorized access, each of which contains the corresponding security agents and a user access sharing system connected to the control and data exchange bus of the corresponding user workstation or functional server. The system includes a system for protecting administrator information from unauthorized access, comprising a security administrator agent and a security administrator access sharing system connected to the control and data exchange bus of the corresponding automated workstation of the information security administrator. The system also includes a security server and a security database connected to the control and data exchange bus of the domain controller server (ACS). AWS and functional servers, the domain controller server and the workstation of the information security administrator contain the hardware and software trusted boot modules installed on them, an exchange system with external information protection systems, cryptographic information protection devices transmitted over the local area network via Ethernet, and devices for cryptographic protection of information transmitted over IP are connected to the control and data exchange buses of the corresponding automation GOVERNMENTAL jobs and functional server, the domain controller server and automated desktop security administrator's workstation. All devices for cryptographic protection of information transmitted over a local area network over Ethernet, and devices for protecting information transmitted over IP, are connected to each other via a network backbone. At least one automated workstation contains a trusted boot hardware and software module installed on it and connected to its control and data exchange bus that encrypts storage media connected via USB and a trusted boot hardware and software module that generates and verifies electronic digital signature. Workstation of users and workstation of information security administrators contain enhanced authentication tools that are connected respectively to the control buses and data exchange of workstations and to the control bus and data exchange of workstations of information security administrators. Each system for protecting user information from unauthorized access and the system for protecting administrator information from unauthorized access contain a corresponding database of enhanced user authentication means and a database of enhanced security administrator authentication means connected respectively to the control and data exchange bus of the corresponding user workstation or functional server, and with bus control and data exchange ochego place information security administrator. The network backbone has at least one gap, on each side of which one means of cryptographic protection of information transmitted through open communication channels through an uncontrolled territory is included. Workstations of users and functional servers contain exchange systems with external information protection systems, which are connected respectively to the control buses and data exchange of workstations and to the control bus and data exchange of functional servers.

However, the closest analogue: the system for protecting information from unauthorized access also has a low level of protection for workstations against distributed network denial of service attacks. In addition, the disadvantage of the known system is the relatively low security of information transmitted to third-party subscribers using role-based access models inherent in modern automated systems.

The aim of the invention is to develop a system for protecting information from unauthorized access, providing higher protection against unauthorized access when implementing distributed network denial of service attacks on the workstation of the system, as well as when transmitting information to subscribers using a role-based access model.

This goal is achieved by the fact that the known information protection system against unauthorized access (see Fig. 1), including a set of workstations containing the first workstation with SZI 1, the second workstation with SZI 2 and the third workstation with SZI 3, the first workstation of user 4, the second AWP of user 5, protection block ABI 7, functional server 9, SKD 8, AWP ABI 6, the first SKZI 10 and the second SKZI 11, connected to each other via an open channel through uncontrolled territory 12, the first 1.5, the second 1.6, the third 1.7 and fourth 1.8 inputs / outputs of the first workstation with SZI 1 connected respectively to the first 4.9, second 4.10, third 4.11 and fourth 4.12 inputs / outputs of AWP 4, and the fifth 4.13 and sixth 4.14 inputs / outputs of AWP 4 are connected to the network trunk 13, in addition, the first 2.5, second 2.6, third 2.7 and fourth 2.8 inputs / the outputs of the second workstation with SZI 2 are connected respectively to the first 9.6, second 9.7, third 9.8 and fourth 9.9 inputs / outputs of the functional server 9, the fifth 9.10 and sixth 9.11 the inputs / outputs of which are connected to the network backbone 13, the first 7.4, the second 7.5 and the third 7.6 inputs / outputs of the ABI 7 protection system are connected respectively to the first 6.6, second 6.7 and Network 6.8 I / O AWM ABI 6, the fourth 6.9 and fifth 6.10 I / O which is connected to the network trunk 13, the first 8.8 and second 8.9 inputs / outputs SKD 8 are connected to the network trunk 13, the first 5.13 and second 5.14 outputs of the AWP 5 are connected to network trunk 13, and the third 5.9, fourth 5.10, fifth 5.11 and sixth 5.12, the inputs / outputs of the AWP 5 are connected respectively to the first 3.5, second 3.6, third 3.7 and fourth 3.8 inputs / outputs of the AWP with SZIZ, which is additionally connected to the network trunk 13 before the input of the first cryptographic information protection system 10 includes the first ITU 14 firewall and the second ITU 15 is connected to the network backbone 13 after the second cryptographic information protection system 11, and ACS 8 consists of a security server 8.1, a security server database 8.2, a cryptographic information protection device using Ethernet 8.3 protocol, a cryptographic information protection device using IP 8.4 protocol, and a trusted hardware-software module boot (APMDZ) 8.5, access control control unit 8.6, the inputs / outputs of which are connected to the control and data exchange bus 8.7 ACS, and the inputs / outputs of the cryptographic information protection device via Ethernet 8.3 and a device for cryptographic protection of information using IP 8.4 is the first and second output of ACS 8.

The first workstation of user 4 consists of a cryptographic information protection device using Ethernet 4.1 protocol, a cryptographic information protection device using IP 4.2 protocol, APMDZ 4.3, APMDZ using encryption of storage media connected via USB (APMDZ with USB) 4.4, and APMDZ with generation and verification electronic digital signature (APMDZ with EDS) 4.5, means 4.6 enhanced authentication, block 4.7 exchange with external information protection systems, the inputs / outputs of which are connected to the bus 4.8 control and data exchange AWP, and inputs / you ode 4.13, 4.14 are first and second inputs / outputs of the first workstation 4, and its third 4.9 4.10 The fourth, fifth and sixth 4.11 4.12 inputs / outputs connected to the bus 4.8 management and exchange data APM.

The second workstation of user 5 consists of a cryptographic information protection device using Ethernet 5.1 protocol, a cryptographic information protection device using IP 5.2 protocol, APMDZ 5.3, APMDZ with USB 5.4, APMDZ with digital signature 5.5, enhanced authentication tool 5.6, and block 5.7 for exchanging with external information protection systems the inputs / outputs of which are connected to the control and data exchange bus 5.8, the inputs / outputs 5.13, 5.14 being the first and second inputs / outputs of the second workstation of user 5, and his third 5.9, fourth 5.10, fifth 5.11 and sixth 5.12 inputs / outputs connected to tire e management and data exchange AWP 5.8.

AWI ABI 6 consists of a cryptographic information protection device using Ethernet 6.1 protocol, a cryptographic information protection device using IP 6.2 protocol, APMDZ 6.3, enhanced authentication means 6.4, the inputs / outputs of which are connected to the control and data exchange bus 6.5, and the inputs / outputs 6.9, 6.10 are the first and second inputs / outputs of the ABI6 AWP, and its third 6.6, fourth 6.7 and fifth 6.8 inputs / outputs are the first 7.4, second 7.5 and third 7.6 inputs / outputs of the ABI 7 protection block.

Thanks to this new set of essential features, the claimed system ensures the structure of a unified access control system. The unified system expresses the discretionary and credential models using the role model of access control, which provides a high level of system security when a password is compromised or a smart card is stolen, when exchanging with external information protection systems using different classification of credentials and access models in case of distributed network failure attacks in service.

The claimed system is illustrated by drawings, which show:

in FIG. 1 - presents a structural diagram of the claimed system for protecting information from unauthorized access;

in FIG. 2 is a diagram of a first workstation with an information security system;

in FIG. 3 is a diagram of a second workstation with an information security system;

in FIG. 4 - presents a diagram of a third workstation with an information security system;

in FIG. 5 is a diagram of a first workstation;

in FIG. 6 is a diagram of a second workstation;

in FIG. 7 is a diagram of an automated workstation of an information security administrator;

in FIG. 8 is a diagram of an information security administrator protection block;

in FIG. 9 is a diagram of a domain controller server;

in FIG. 10 is a diagram of a functional server;

in FIG. 11 - shows a diagram of connecting devices to a network backbone.

in FIG. 12 is a diagram of the probability of unauthorized access versus the number of entities of the access control model.

The claimed system shown in FIG. 1, consists of a set of workstations: the first workstation with SZI 1, the second workstation with SZI 2 and the third workstation with SZI 3, the first workstation of user 4, the second workstation of user 5, protection block ABI 7, functional server 9, ACS 8, workstation ABI 6 , the first cryptographic information protection system 10 and the second cryptographic information protection device 11 connected to each other through an open channel through uncontrolled territory 12. The first 1.5, second 1.6, third 1.7 and fourth 1.8 inputs / outputs of the first workstation with SZI 1 are connected respectively to the first 4.9, second 4.10, third 4.11 and fourth 4.12 input / output of AWP 4. Fifth 4.13 and sixth 4.14 inputs / outputs of AWP 4 are connected to the network Highway 13. The first 2.5, second 2.6, third 2.7 and fourth 2.8 inputs / outputs of the second workstation with SZI 2 are connected respectively to the first 9.6, second 9.7, third 9.8 and fourth 9.9 input / output of functional server 9, and the fifth 9.10 and sixth 9.11 the inputs / outputs of which are connected to the network backbone 13. The first 7.4, second 7.5 and third 7.6 inputs / outputs of the ABI 7 protection unit are connected respectively to the first 6.6, second 6.7 and third 6.8 input / output of the ABI AWP 6, fourth 6.9 and fifth 6.10 inputs / the outputs of which are connected to the network backbone 13. The first 8.8 and second 8.9 inputs / outputs ACS 8 odes are connected to the network trunk 13. The first 5.13 and second 5.14 outputs of the workstation 5 are connected to the network 13, and the third 5.9, fourth 5.10, fifth 5.11 and sixth 5.12 inputs / outputs of the workstation 5 are connected respectively to the first 3.5, second 3.6, the third 3.7 and the fourth 3.8 input / output of the workstation with SZI 3. Additionally, the first firewall (ITU) 14 is included in the network backbone 13 before the entrance of the first SKZI 14. The second ITU 15 is connected to the network 13 after the second SKZI 11. SKD 8 consists of a server security 8.1, security server database 8.2, device CTBA cryptographic protection information transmitted via Ethernet 8.3 protocol, devices cryptographic protection of the information transmitted by protocol IP 8.4, 8.5 APMDZ, enclosure management access unit 8.6, the inputs / outputs of which are connected to the control bus and the data exchange DLE 8.7. The inputs / outputs of the cryptographic information protection device using Ethernet 8.3 protocol and the cryptographic information protection device using IP 8.4 protocol are the first and second output of ACS 8.

The system for protecting information from unauthorized access to confidential information (see Fig. 1), designed to organize a secure exchange between information processes in the EIP, contains a set of AWP with SZI 1, AWP with SZI 2, and AWP with SZI 3, connected by a control and exchange bus data from the workstation of user 4, the workstation of user 5 and functional servers 9 in a computer network, connected to each other via a network backbone 13 to which a server-controller 8 of the domain is connected. The system also contains at least one AWI ABI 6 connected to a network backbone 13, having an internal control and data exchange bus 6.5, and at least one ABI protection unit 7.

The first workstation with SZI 1 (see Fig. 2) is intended for operational management of information and computing needs, implementation of information technology, ease of access to information, its protection against unauthorized access at the user's workplace, processing of critical information, it consists of an agent security 1.1., user access sharing schemes 1.2, enhanced audit tools database 1.3, data exchange databases with external information protection systems 1.4, with its first 1.5, second 1.6, third 1.7 and four fourth 1.8 inputs / outputs, connected, respectively, to the third 4.9, fourth 4.10, fifth 4.11 and sixth 4.12 inputs / outputs AWP 4

The second workstation with SZI 2 (see Fig. 3) is intended for operational management of information and computing needs, implementation of information technology, ease of access to information, its protection against unauthorized access at the user's workplace, processing of critical information, it consists of an agent security 2.1., user access sharing schemes 2.2, enhanced audit tools database 2.3, data exchange databases with external information protection systems 2.4, with its first 2.5, second 2.6, third 2.7 and four the second 2.8 inputs / outputs are connected, respectively, to the third 9.6, fourth 9.7, fifth 9.8 and sixth 9.9 inputs / outputs of the functional server 9

The third automated workstation 3 with an information protection system (see Fig. 4) is intended for the operational management of information and computing needs, the implementation of information technology, ease of access to information, its protection against unauthorized access at the user's workplace, processing of critical information, it consists of a security agent 3.1., a user access sharing scheme 3.2, a database of enhanced audit tools 3.3, a database exchange with external security systems inf formations 3.4, with its first 3.5, second 3.6, third 3.7 and fourth 3.8 inputs / outputs, connected, respectively, to the third 5.9, fourth 5.10, fifth 5.11 and sixth 5.12 inputs / outputs of functional server 9

The first automated workstation 4 of the user (see Fig. 5) is intended for the operational management of information and computing needs, the implementation of providing information technology, ease of access to information, and its protection against unauthorized access at the user's workplace. It consists of a device 4.1 of cryptographic protection of information transmitted over a local area network via Ethernet, device 4.2 of cryptographic protection of information transmitted over a local area network via IP, a hardware-software trusted boot module 4.3, and APMDZ encrypting storage media connected via USB 4.4 interface, APMDZ, which generates and verifies electronic digital signature 4.5, means of enhanced authentication 4.6, means of exchange with external security systems and formations 4.7, control and data exchange buses AWP 4.8, with its first 4.13 and second 4.14 inputs / outputs connected to the network trunk 13, and its third 4.9, fourth 4.10, fifth 4.11 and sixth 4.12 inputs / outputs connected to the control and data exchange bus AWP 4.8.

The second workstation of user 5 (see Fig. 6) is intended for the operational management of information and computing needs, the implementation of providing information technology, ease of access to information, and its protection against unauthorized access at the user's workplace. It consists of a device 5.1 cryptographic protection of information transmitted over a local area network via Ethernet, device 5.2 cryptographic protection of information transmitted over a local area network via IP, APMDZ 5.3, APMDZ with USB 5.4, APMDZ with digital signature 5.5, enhanced authentication 5.6 , means of exchange with external information protection systems 5.7, control and data exchange buses AWP 5.8, with its first 5.13 and second 5.14 inputs / outputs connected to the network trunk 13, and its third 5.9, fourth 5.10, fifth 5.11 and sixth 5.12 inputs / outputs are connected to the control and data exchange bus AWP 5.8.

AWI ABI 6 (see Fig. 7) is intended for centralized administration of automated systems: managing protected resources, controlling user access to the system (auditing user actions in the system), conducting integrity monitoring on managed devices, testing information security tools on managed devices, backup copying and restoring information, creating a log of information security events, preventing unauthorized access to protected information Discount resources and devices. It consists of a device 6.1 for cryptographic protection of information transmitted over a local area network via Ethernet, a device 6.2 for cryptographic protection of information transmitted over a local area network over IP, APMDZ 6.3, enhanced authentication means 6.4, control and data exchange buses 6.5 and its first 6.9, the second, 6.10 inputs / outputs are connected to the network backbone 13, and its third 6.6, fourth 6.7 and fifth 6.8 are connected respectively to the first 7.4, second, 7.5 and third 7.6 input / output of the 7 ABI protection block.

The protection block 7 ABI (see Fig. 8) is designed to ensure the safe operation of AWP 6 ABI, to differentiate access to AS resources, to strengthen security administrator authentication, it consists of a security administrator agent 7.1, scheme 7.2 for restricting access to a security administrator, database 7.3 of the tools enhanced security administrator authentication, with its first 7.4, second 7.5, and third 7.6 inputs / outputs connected respectively to the third 6.6, fourth 6.7, and fifth 6.8 input / output of AWP 6 ABI.

The server-controller 8 of the domain (see Fig. 9) is designed to ensure the smooth operation of critical authentication and authorization services and are constantly in operation. It consists of a security server 8.1, a security server database 8.2, a device 8.3 for cryptographic protection of information transmitted over a local area network via Ethernet, a device 8.4 for cryptographic protection of information transmitted over a local area network over IP, APMDZ 8.5, and a differentiation control system 8.6 access, control bus 8.7 and data exchange with its first 8.8 and second 8.9 outputs / outputs connected to the network backbone 13.

Functional 9 server (see Fig. 10) is designed for exchanging information with remote information protection systems; it consists of a device 9.1 for cryptographic protection of information transmitted over a local area network via Ethernet, a device 9.2 for cryptographic protection of information transmitted over a local area network IP protocol, APMDZ 9.3, means of exchange 9.4 with external information protection systems, control buses 9.5 and data exchanges, with its first 9.10 and second 9.11 inputs / outputs connected to the network trunk 13, and the third 9.6, fourth 9.7, fifth 9.8 and sixth 9.9. are connected respectively to the first 2.5, second 2.6, third 2.7 and fourth 2.8 input / output of the second AWP with SZI 2.

The network 13 backbone (see Fig. 11) is intended for the exchange of information between all devices of the local computer network, including through an uncontrolled territory via open communication channels. The first 10 and second 11 means of cryptographic protection of information are connected to the network backbone, at the places of breaking and transmitting information via open 12 communication channels through an uncontrolled territory, on each side after the breaking, then the first ITU 14 and the second ITU 15.

The security system can include several AWP 6 ABIs and several, respectively, control and exchange data for security administrator 7.1 agents, security administrators 7.1 schemes, security administrator access control schemes 7.2, and security administrator enhanced authentication databases 7.3. In this case, each of the information security administrators can quickly monitor the operation of users on the network.

The claimed system of protecting information from unauthorized access, works as follows.

The security agents 1.1, 2.1, 3.1, which are part of the workstation with SZI 1, the workstation with SZI 2, the workstation with SZI 3, are included in the security protection blocks 7 from the unauthorized access of the security agent-administrators 7.1, as well as the server 8.1 included in the access control system 8 security and security database 8.2 form a system for monitoring and managing profiles.

Included in the workstation with SZI 1, the workstation with SZI 2, the workstation with SZI 3, user access separation circuits 1.2, 2.2, 3.2, which are part of the ABI protection block 7 of the security administrator’s access separation scheme 7.2, as well as the access control system 8.6 included ACS 8 form a system of access control.

Included in the workstation with SZI 1, the workstation with SZI 2, the workstation with SZI 3 databases 1.3, 2.3, 3.3 of the enhanced user authentication means data, as well as the security administrator’s database 7.3 of the enhanced security authentication data of the security administrator form an additional protection system information.

The profile control and management system performs the following functions:

Manage security profiles for users, user groups, and computers

differentiation of user access to the functions of any file manager program;

determining the list of applications allowed to run (providing a closed software environment) by creating a user menu in the program - file manager and controlling the launch of unauthorized applications;

monitoring the status of computers on the network, collecting work statistics (start time, continuous operation time);

control of the session of interactive users and network users who gained access to shared resources;

logging the actions of the information security administrator and users;

differentiation of powers of information security administrators on AWP 6 ABI (operator, administrator);

notification of the security administrator of information about unauthorized access attempts, violations of the integrated system for protecting information from unauthorized access and other critical network situations.

The profile control and management system implements the functions of differentiating access to applications (programs) running on user workstation 4, user workstation 5 and functional servers 9, registering protection events (audit), monitoring the integrity of program files and data, and protecting against I / O on disposable carrier. The input data for the control and management system for profiles are: information on the composition of registered users in the central database 8.2 of the ACS security server 8 data of the automated system (on the domain controller), entries in system and security logs in the AWP of user 4, AWP of user 5 or the functional server 9 and information security administrator commands.

The output data of the control and profile management system are protocols of actions of administrators on AWP 6 ABI and events-attempts of unauthorized access to information, integrity control, work with external media in an automated system, information about the status of computers, services, applications and security policy settings.

The profile control and management system uses an object ideology, i.e. the entire structure of the computer network and control information is presented as control objects. All devices operate with control objects. All management objects are stored in the database 8.2 of the security server of the server-controller 8 of the domain.

The database 8.2 of the security server of the server-controller 8 of the domain contains the main root management object, which contains such management objects as domains or workgroups of the base operating system, which in turn contain such objects as computers, user applications, user profiles, profiles user groups, security profiles, and devices (drives, ports, etc.).

Each control object characterizes the basic attributes and its specific set of additional attributes, access and control methods for this control object.

Security server 8.1 ACS 8 provides synchronization of management objects with security agents 1.1, 2.1, 3.1, security administrators 7.1 and other security servers: establishing logical connections with security agents 1.1, 2.1, 3.1 and security administrators 7.1, checking for logical connections with agents 1.1, 2.1, 3.1 security and 7.1 security administrators, receiving and processing requests from the 7.1 security administrator agent to add exception management objects to the database x profiles and modification of their attributes, receiving and processing requests from 7.1 security administrators agents for receiving a user profile and the composition of applications available to them, generating answers to these requests, receiving and processing messages from security agents 1.1, 2.1, 3.1 and 7.1 security administrators agents, upon the occurrence of events - attempts of unauthorized access to information in the system logs of security agents 1.1, 2.1, 3.1, maintaining a protocol of actions of security administrators on AWP 6 ABI regarding control and management ia profiles.

Logical connections are established between security server SKD 8, security agents 1.1, 2.1, 3.1 and security administrators 7.1. Each established logical connection has its own identifier, which allows the security server 8.1 to determine with which security agents 1.1, 2.1, 3.1 or security administrators 7.1 the information is exchanged. Upon successful connection establishment, an identifier is assigned to it, and a corresponding message is sent to security agents 1.1, 2.1, 3.1 or security administrators 7.1.

Security server 8.1 SKD 8 checks for logical connections with security agents 1.1, 2.1, 3.1 and security administrators 7.1 by timer. A request to disconnect from the security server 8.1 is sent by the security agents 1.1, 2.1, 3.1 or security administrators 7.1. In this case, the connection is deleted from the database 8.2 of the security server of the server-controller 8 of the domain.

After the connection is established, the security server 8.1 of the server-controller of the domain 8, security agents 1.1, 2.1, 3.1 and security administrators 7.1 exchange messages containing requests and responses.

Security agents 1.1, 2.1, 3.1 send the following types of requests to the security server 8.1 of the domain controller 8 domain: information about the base operating system, to disconnect, to check the connection, to list user applications, to obtain a user profile, to process an event on a computer, to receive computer devices, to receive a list of files for verification.

At the same time, security agents 1.1, 2.1, 3.1 transmit information about the computer, the current user and events, and the security server 8.1 of the server-controller of the 8 domain transmits information about profiles, the composition of applications, scanned files and devices to security agents 1.1, 2.1, 3.1.

Agents 7.1 security administrators send ACS 8 security server 8.1 the following types of requests: to register a connection, to transfer domains, to add a domain, to remove a domain, to transfer computers to a domain, to add a computer, to remove a computer, to transfer domain applications, to add applications, to delete an application, to list domain users, to add a user, to delete a user, to change the state of a computer in the database, to change user properties, to change changing computer properties, changing the properties of a domain, changing the properties of an application, remotely controlling a computer, listing user groups, adding a user group, deleting a user group, changing the properties of a user group, writing an administrator log, reading a log administrator, to receive a list of running applications, to complete the application, to clear the administrator’s protocol, to clear alarms, to set properties for a group of users, n reading the event log, listing security profiles, adding a security profile, deleting a security profile, changing properties of a security profile, listing devices, changing device properties, adding a device, deleting a device, changing a list of files to scan, cleaning the event log, obtaining the properties of the HDD, reading the archive, event log, reading the archive of the work log.

Security server 8.1 SKD 8 polls the status of security agents 1.1, 2.1, 3.1 (on the composition of running applications, the current user), and also reboots, shuts down computers, logs out, starts / stops applications.

Security server 8.1 SKD 8 transmits to agent-administrator 7.1 security requests about the status of computers of security agents, the composition of running applications, application startup, and events that have occurred.

Security agent 1.1, 2.1, 3.1 performs the following functions: monitoring the state of the user's workstation or functional server, monitoring the session state of the interactive user, setting up the user's working environment and setting restrictions, monitoring the state of applications and processes, monitoring the contents of system logs, executing commands on behalf of the security administrator (rebooting, starting / stopping applications, locking the system).

The security agent 1.1, 2.1, 3.1 establishes a connection (registration) with the security server 8.1 and then periodically sends the security server 8.1 of the server-controller of the domain 8 a request to check for a connection and processes the response. Interaction with security server 8.1 ACS 8 after establishing a logical connection is based on a request-response mechanism.

Security agent 1.1, 2.1, 3.1 is responsible for monitoring the events of attempts of unauthorized access to information, collecting statistical information (username, start and end time of a user’s session, time to turn on and off a computer, etc.), information about the status of tasks and running processes, integrity control of files on the user's workstation or functional server.

The security agent 1.1, 2.1, 3.1 executes control commands received from the administrative agent 7.1 through the ACS 8 security server 8.1 over the network and transmits the ACS 8 security server 8.1 information about the computer, about the current user, profiles, application composition, and the results of integrity checks of the audited files and about events-attempts of unauthorized access to information.

Security agent 1.1, 2.1, 3.1, after establishing a logical connection with security server 8.1, receives a message from it with the computer system policy. Security server 8.1 receives information about the type of underlying operating system.

When a user logs on to the system, the security agent 1.1, 2.1, 3.1 sends information about the user (user name, session start time) to the security server 8.1 ACS 8. Security server 8.1 ACS 8 transmits system policy information to the user. When installing the system policy of the computer and the user, the security agent 1.1, 2.1, 3.1 changes the values in the registry. Further, the security agent 1.1, 2.1, 3.1 generates and sends to the security server 8.1 ACS 8 requests for listing user applications, for obtaining a profile, for receiving computer devices and a list of files for verification.

User applications include the main executable modules launched through the user menu, and auxiliary executable modules launched from the main applications.

Responses from SKD 8 security server 8.1 are processed by the security agent 1.1, 2.1, 3.1, the user profile is set in the registry, the composition of the main applications available to him in the user menu, and the composition of the auxiliary applications launched from the main applications. Security agent 1.1, 2.1, 3.1 performs integrity control by calculating checksums of information protection system files, system and user files and comparing them with the corresponding reference values.

The integrity control function allows you to detect any change (deletion, addition, replacement) of the file data and the file structure as a whole. Integrity control is performed by calculating the insert.

When changing the checksums of the files or the absence of any file, a message is generated for the security server 8.1 of the server-controller 8 domain integrity violation. Security agent 1.1, 2.1, 3.1 exercises control over the processes running in the system. Information about process files is collected, process windows are searched, and information about processes is transmitted to security server 8.1 ACS 8.

The processes start and stop upon request from the security server 8.1, ACS 8, which is formed in turn by the command of the security administrator 7.1 agent. Security agent 1.1, 2.1, 3.1 monitors system events by monitoring the contents of system logs and when events occur, attempts to unauthorized access to information and other critical events, sends messages about their occurrence to security server 8.1 ACS 8.

Security agent 1.1, 2.1, 3.1 controls the launch of all applications and determines whether the primary or secondary application is allowed to run. If not, then the application does not start, and the security server 8.1 ACS 8 receives a message about the event-attempt of unauthorized access to information.

In addition, the security agent 1.1, 2.1, 3.1 performs monitoring of messages about the beginning of the work of the access control scheme. Upon successful start of the access control system, the corresponding settings are saved in the registry. Otherwise, the settings of the access control scheme in the registry are restored and the computer is restarted. If the recovery does not lead to the successful launch of the access control scheme, an entry is created for the administrator about the failed system recovery and the initialization of the security agent 1.1, 2.1, 3.1 is blocked.

Security agent 1.1, 2.1, 3.1 monitors the installation of external storage media according to messages from the file system monitor about mounting the volume. Next, the security agent 1.1, 2.1, 3.1 generates a request for the security profile (descriptor) of the device to the security server 8.1 ACS 8. After receiving the security profile of the access control scheme, it controls access of the user working on the computer to the device.

When access is granted, operations with an external storage medium are performed. After that, access to the device is closed. When copying to the medium, the fact of copying is transmitted to the security server 8.1 ACS 8. The security server transmits the facts of operations with the information carrier, including events-attempts of unauthorized access to information, to the automated workstation ABI 6 in the registration log.

Security agent-administrator 7.1 performs the following functions: maintaining a security server database (creating, changing, deleting objects), monitoring the status of objects (computers, applications), managing a computer and user sessions, logging the actions of administrators and operators, displaying and printing protocols of actions of administrators and operators. Agent administrator 7.1 security is the main module for implementing control functions, setting basic parameters and monitoring events on the network.

Agent-administrator 7.1 security interacts with security server 8.1 ACS 8. The exchange includes control and configuration information about tasks, processes and events on AWP 4, AWP 5 users or functional servers 9.

The display of information and the user interface are carried out in graphical form. When you enable the security administrator 7.1, the process of establishing a connection (registration) with the security server 8.1 is initialized. The security administrative agent 7.1 generates a request for registration (establishment) of a connection with the security server 8.1 of the domain controller 8 and processes the response.

Periodically, the security agent 7.1 will send a request to the security server 8.1 to check for a connection and process the response. The interaction of the security administrator 7.1 agent with the security server 8.1 ACS 8 after establishing a logical connection is mainly carried out on the basis of a request-response mechanism.

The 7.1 administrative agent implements the following groups of functions.

The group of functions for working with objects of the database 8.2 of the security server 8.1 of the server 8 domain controller 8 allows the agent administrator 7.1 to generate requests for the security server 8.1 of the server controller 8 domain to receive a list of objects, to add, delete and change properties of objects (domains, computers , users, user groups, applications, security profiles). Requests are generated by the command of the security administrator 7.1 through the graphical interface and the responses received are processed.

The RAM stores information about the composition and condition of the managed objects, their attributes and parameters, similar to the information in the database 8.2 of the security server of the server-controller 8 domain.

Upon receipt of a response from the security server 8.1, the state of the data base 8.2 of the ACS 8 in the RAM of the AWP 6 ABI changes. Storing objects in RAM allows you to increase the speed of operations for graphically displaying the state of objects. For example, for a computer, this group of functions includes: requests / responses for obtaining a list of domain computers, for adding a computer, deleting a computer, changing computer properties.

The group of functions for working with the protocol (log) of events allows you to process requests / responses to view and clear the protocol of events, to receive an archive of the protocol of events.

The group of functions for working with the protocol (log) of the administrator

information security allows you to process requests / responses to view and clear the protocol of work of the administrator 7.1 security information, to obtain the archive of the protocol of work of the administrator 7.1 security information.

A group of computer management functions provides the formation of requests to the security server 8.1 of the server of the domain controller 8 of the domain and the processing of responses to receive information, a list of running applications, remote reboot, shutdown the computer or exit the system, remotely launch the application, generate requests for remote completion of the application, to receive information about the current computer user.

A group of functions for processing requests from the security server 8.1 of the server-controller 8 of the domain about the state of the objects provides the processing and display of information about changes in the status of computers, launching applications by users, events-attempts of unauthorized access to information.

The integrity control group of functions is designed to formulate requests to the security server 8.1 of the server-controller 8 of the domain and process responses to receive or modify the list of files to check checksums for domain computers.

The access control system is a mandatory access model built into the basic operating system of the security system, which implies the existence of hierarchical attributes and non-hierarchical attributes (access categories) for each subject and access object.

The basic principle of the security system of the base operating system is the concentration of central procedures for checking access rights in the security monitor, which is an integral part of the core of the base operating system. The security monitor functions are called by the object manager of the base operating system when accessing any system object in order to confirm the authority of the contacting entity. In this case, all the information necessary for the analysis of the security attributes of the subject and access object is transmitted to the security monitor.

The main method for changing the security system of the base operating system in the proposed access control system is to intercept the function of checking access rights in the monitor without danger and supplement security descriptors of objects and access subjects with mandatory attributes without violating the internal structure of descriptors. In this case, the descriptor is compared to the object, its storage and access restriction to it are realized by standard functions of the base operating system.

In the security descriptor of the access subject (access token, Token), credentials are entered at the stage of user registration in the system and are located in specially marked elements of the list of groups to which the user belongs.

These attributes consist of the level of confidentiality represented by the security identifier (SID) predefined when creating the system, and several access categories, each of which is represented by the security identifier of user groups defined in the security agency. This information is stored in the database 8.2 of the security system ACS 8 of the base operating system, while each user of the system has several entries in the database 8.2 of the ACS 8: a base record containing the standard user attributes in the base operating system, and one record for each neck secrecy, which the user is allowed to work with, containing a list of categories for the corresponding neck and user.

In the security descriptor (Security descriptor) of the access object (Security Descriptor), credentials are entered in the Discretionary Access Control List (DACL) in the form of specially marked elements (Access Control Element, ACE), while the security identifiers of these elements correspond to those described above . The storage of security descriptors of access objects is assigned to schemes 1.2, 2.2, 3.2 for sharing access for users and to scheme 7.2 for sharing access for the security administrator.

The access control system implements an access control verification algorithm created on the basis of the standard security monitor algorithm and supplemented by checking the credential attributes of the object and subject. The processing of the mandatory attributes of the subject and object is carried out according to the following rules:

The subject has access to the object if all the access categories listed in the security descriptor (security descriptor) of the object are included in the subject's access token.

The subject has access to read and change the object, if the secrecy of the object has a value of no more than the secrecy of the subject.

If the secrecy of an object is greater than the secrecy of the subject and the object is containerized (contains other objects), the subject has access to add subobjects to the object.

If access is permitted in accordance only with the mandatory rules of access control, but is not allowed for discretionary (or vice versa), Access is denied.

Access control system 8.6 ACS 8 is an addition to the basic operating system and provides interaction with automated systems within a single information space by bringing the Mandatory Access Control (MAC) or Discretional Access Control (DAC) model into a single role access models (Role Based Access Control - RBAC) ⁷ ( ⁷ (Sandhu, Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies ACM Transactions on Information and System Security, Vol.3, No. 2, May 2000.) Hardware software modules 4.3, 9.3, 6.3, 5.3, 8.5 trusted zag narrow, hardware and software modules 4.4, 5.4 trusted boot, encrypting storage media connected via USB, and hardware and software modules 4.5, 5.5 trusted boot, generating and verifying electronic digital signature, provide integrity control of the file system AWP user 4, AWP user 5 and functional servers 9, as well as the procedure for downloading software to them in accordance with the selected level of access to information.

Devices 4.1, 9.1, 6.1, 5.1, 8.3 cryptographic protection of information transmitted over a local area network via Ethernet, and devices 4.2, 9.2, 6.2, 5.2, 5.2, cryptographic protection of information transmitted over IP, provide encryption of information transmitted over a network line 13 between the AWP of user 4, AWP of user 5, functional servers 9, ACS 8 and AWP 6 ABI.

SKZI 10, SKZI 11 transmitted over open communication channels, provides encryption of information when it is transmitted through areas outside the controlled zone 12.

The system of additional information protection is a supplement to the modified security system built into the base operating system, which implements an access control verification algorithm based on the standard security monitor algorithm and supplemented by checking the credential attributes of the object and subject.

The system of additional information protection when a user logs into the system implements an additional authentication algorithm using enhanced authentication tools 4.6, 5.6, 6.4 (biometric sensors, key carriers, smartcard readers, etc.).

To do this, add to the standard elements of the modified security system a “library for expanding the basic system of user identification and authentication”, the storage of authentication data for which is assigned to databases 1.3, 2.3, 3.3 of the means of enhanced user authentication and database 7.3 of the means of enhanced authentication of the security administrator.

When a user logs on to the system, the corresponding security agent 1.3 and the security administrator administrator 7.1 use the data from the enhanced user authentication tools stored in the corresponding database 1.3, 2.3, 3.3 and the security administrator’s enhanced authentication tool database 7.3 to check if additional security devices are installed and allowed to run information protection systems (means 4.6, 5.6, 6.4 of strong authentication), and if the result is positive, they issue commands for checking authentication information to means 4.6, 5.6, 6.4 of enhanced authentication (biometric sensors, key carriers, smart card readers, etc.).

After successful authentication of the user by means of 4.6, 5.6, 6.4 strong authentication, information about the user is transferred to the control and management system profiles for further regular work.

Ease of use of means 4.6, 5.6, 6.4 of enhanced authentication is due to the fact that the user does not need to remember complex passwords, because technical means 4.6, 5.6, 6.4 of enhanced authentication are used (biometric sensors, key carriers, smart card readers, etc.).

Means 4.7, 5.7, 9.4 of exchanging with external information protection systems transfer files between information protection systems while preserving the credentials of the transferred files.

To carry out the exchange of information, an external information protection system should also contain means 4.7, 5.7, 9.4 of an exchange with external information protection systems.

Since the classification of credentials in different information protection systems may vary, credential file labels of one information protection system may not be applicable in another information protection system. To preserve the credentials of the transferred files, means of exchange 4.7, 5.7, 9.4 with external information protection systems transforms the credentials of the transferred files to the form used in the external information protection system. The conversion is performed in accordance with the set of rules contained in the database 1.4, 2.4, 3.4 of the data exchange system with external protection systems.

The rules are a set of correspondence labels of security categories of access categories of an information protection system against unauthorized access to confidential information, privacy labels and access categories of one or more external information protection systems.

Information transfer is performed as follows - the credential mark of the file being sent is read and converted in accordance with the rules specified in the database 1.4, 2.4, 3.4 of the data exchange system with external protection systems. The file and its converted label are sent and saved to an external information protection system.

File transfer in the opposite direction is similar.

Using the proposed system for protecting information from unauthorized access to confidential information, the possibility of a secure exchange of information with external information protection systems using different classification of credentials is achieved by converting credentials in the exchange process to classify an external information protection system when transferring files to an external system information protection and reverse conversion when receiving files from an external system.

Increasing information security during the implementation of distributed network denial of service attacks on automated systems by expressing the discretionary and credential access models used in the closest to the proposed system through the role-based access model and implementing a single access differentiation scheme based on the role model was evaluated by modeling the role scheme access control based on experimentally generated credential and discretionary access matrices. During the simulation, the number of access subjects and objects was a constant; many possible access operations were determined by the capabilities of the Astra Linux SE operating system. The probability of unauthorized access to information when applied to solve the problem of heterogeneous access models was evaluated in accordance with the expression:

P _NSD = 1- (1-p) ^Nc ,

Where:

p is the conditional probability of the implementation of the NSD as a result of using one entity (access rule) of the access model;

Nc is the number of entities in the access model.

The simulation results are presented in FIG. 12. During the simulation, the maximum permissible level of probability of unauthorized access was determined on the basis of the main technical requirements for information security in automated systems for special purposes.

The nature of the dependencies R of the _NSD shows that the use of a role-based access control scheme for the automated systems participating in the information exchange reduces the dimensionality of the access control task by determining a near-optimal set of roles and, accordingly, model entities, as well as eliminating conflicting access rights of interacting security systems, which provides increased information security from unauthorized access.

Claims (4)

1. Information protection system against unauthorized access, including the first automated workstation (AWS) with information security system (SZI) 1, the second AWP with SZI 2 and the third AWP with SZI 3, the first AWP of user 4, the second AWP of user 5, protection unit Information Security Administrator (ABI) 7, functional server 9, domain controller server (ACS) 8, AWM ABI 6, the first cryptographic information protection tool (CIP) 10 and the second cryptographic information protection device 11 connected to each other via an open channel through an uncontrolled territory 12, and the first 1.5, second 1.6, third 1.7 and fourth 1.8 inputs / outputs of the first workstation with SZI 1 are connected respectively to the first 4.9, second 4.10, third 4.11 and fourth 4.12 inputs / outputs of workstation 4, and the fifth 4.13 and sixth 4.14 inputs / outputs of workstation 4 are connected to the network backbone 13, in addition, the first 2.5, second 2.6, third 2.7 and fourth 2.8 inputs / outputs of the second workstation with SZI 2 are connected respectively to the first 9.6, second 9.7, third 9.8 and fourth 9.9 inputs / outputs of the functional server 9, fifth 9.10 and the sixth 9.11, the inputs / outputs of which are connected to the network trunk 13, the first 7.4, the second 7.5 and the third 7.6 inputs / outputs of the ABI 7 protection system are connected respectively to the first 6.6, second 6.7 and third 6.8 inputs / outputs of the AWI 6 automated workstation, the fourth 6.9 and fifth 6.10 inputs / outputs of which are connected to the network trunk 13, the first 8.8 and second 8.9 inputs / outputs ACS 8 are connected to the network trunk 13, the first 5.13 and second 5.14 outputs of the AWP 5 are connected to the network trunk 13, and the third 5.9, fourth 5.10, fifth 5.11 and sixth 5.12 inputs / outputs of the AWP 5 are connected respectively to the first 3.5, second 3.6, third 3.7 and the fourth 3.8 inputs / outputs AWP with SZI 3, characterized in that In addition, the first firewall (ITU) 14 is included in the network highway 13 before the entrance of the first CPSI 10, and the second ITU 15 is connected to the network highway 13 after the second CPSI 11, where the ACS 8 consists of a security server 8.1, a database of the security server 8.2, and a cryptographic device protection of information via Ethernet 8.3, devices of cryptographic protection of information according to IP 8.4, hardware-software module of trusted boot (APMDZ) 8.5, access control control unit 8.6, the inputs / outputs of which are connected to the control bus 8.7 tions and data exchange DLE 8, and input / output devices for cryptographic protection of Ethernet protocol data unit 8.3 and cryptographic protection protocol IP 8.4 are the first and second output SKD 8. 2. The security system according to claim 1, characterized in that the first AWP of user 4 consists of a cryptographic information protection device using Ethernet 4.1 protocol, a cryptographic information protection device using IP 4.2 protocol, APMDZ 4.3, APMDZ using encryption of storage media connected via the interface USB 4.4, APMDZ with the generation and verification of electronic digital signatures (EDS) 4.5, means 4.6 enhanced authentication, block 4.7 exchange with external information protection systems, the inputs / outputs of which are connected to the bus 4.8 control and exchange AWP data, and the inputs / outputs 4.13, 4.14 are the first and second inputs / outputs of the first AWP of user 4, and his third 4.9, fourth 4.10, fifth 4.11 and sixth 4.12 inputs / outputs are connected to the workstation control and communication bus 4.8. 3. The information protection system according to claim 1, characterized in that the second AWP of user 5 consists of a cryptographic information protection device using Ethernet 5.1 protocol, a cryptographic information protection device using IP 5.2 protocol, APMDZ 5.3, APMDZ with USB 5.4, and APMDZ with digital signature 5.5 , means of enhanced authentication 5.6, block 5.7 exchange with external information protection systems, the inputs / outputs of which are connected to the control and data exchange bus 5.8, the inputs / outputs 5.13, 5.14 being the first and second inputs / outputs of the second workstation of user 5, and his third 5.9 Thursday rty 5.10, fifth and sixth 5.11 5.12 inputs / outputs connected to the control bus and the data exchange APM 5.8. 4. The security system according to claim 1, characterized in that the ABI 6 workstation consists of a cryptographic information protection device using Ethernet 6.1 protocol, a cryptographic information protection device using IP 6.2 protocol, APMDZ 6.3, enhanced authentication means 6.4, the inputs / outputs of which are connected to the control and data exchange bus 6.5, with the inputs / outputs 6.9, 6.10 being the first and second inputs / outputs of the AWI AWP 6, and its third 6.6, fourth 6.7 and fifth 6.8 inputs / outputs, respectively, the first 7.4, second 7.5 and third 7.6 inputs / outputs ABI protection unit 7.

Images