RU2739151C1 - Method for masking structure of communication network - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to a method of masking a structure of a communication network. Method includes selecting masking message terminating nodes, monitoring of termination failures (faults) of masking message packets at the terminator node and adapting the masking communication path parameters to the communication network structure (parameters) change.

EFFECT: technical result consists in improvement of reliability of message packets delivery to receiving subscriber at high intensity of masking message packets.

3 cl, 10 dwg

Description

The invention relates to the field of infocommunications, namely to ensuring information security of digital communication systems, and, in particular, the claimed method for masking the structure of a communication network is intended for use in distributed communication networks based on a public communication network (for example, the Internet).

A known method of ensuring the correction of routes to network subscribers, implemented in the "Method of correcting routes in the data transmission network" by RF patent No. 2220190 IPC H04L 12/28, publ. 10.10.1998

The method consists in the fact that the search for routes of message delivery to the subscriber is carried out according to the network address of the switching node of its current binding. The choice of routes to the subscriber is carried out at the switching nodes according to the service correcting message containing the network addresses of the subscriber, the switching node and the correction attribute code "write", "erase".

The disadvantage of this method is the lack of adaptation to changes in the structure of the communication network. This is due to the fact that the adjustment is carried out in a decentralized manner and does not cover the entire communication network, but its individual local sections. The absence of parameters for choosing routes to the subscriber leads to a low quality of choice.

There is also known a method of ensuring the security of information circulating in a distributed telecommunications system when transmitting it through public communication channels, implemented in the "Distributed telecommunication system for the transmission of divided data, intended for their separate transmission and reception" by US patent No. 6912252 IPC H04L 12/56 ; H04L 12/28, publ. 08.11.2001

The method consists in performing the following actions: the original data from the sender is divided into N parts. Further, from their combinations, groups of intermediate data are formed. Then intermediate data is transmitted independently over N communication channels. Groups of intermediate data arriving via N communication channels are received from the recipient and the original data is restored.

The disadvantage of this method is the relatively low secrecy of communication and an increase in the likelihood of identifying the correspondent subjects as a result of the increase in the number of communication channels between correspondents. The presence of transit nodes of the network and communication channels of various types with a low level of security increases the need for an assortment of communication facilities and creates prerequisites for the interception of information exchange of network subscribers by malefactors.

It is also known "A method for choosing an expediently used route in a router for uniform distribution in a switching network" according to the application for invention of the Russian Federation No. 2004111798 IPC H04L 1/00, publ. May 10, 2005

The method takes into account the criteria for the quality of routes and information about the structure of the communication network, including the addresses of network nodes and the presence of communication between them. For the target network address, one route is selected in accordance with predetermined criteria for the quality of routes, and messages are transmitted along the selected route.

The disadvantage of this method is the relatively low secrecy of communication when using the selected route of information exchange of subscribers in the communication network. The presence of transit nodes of the network with a low level of security creates prerequisites for the interception of information exchange of network subscribers by attackers and reconstruction of distributed network traffic at some point on the Internet.

There is also known "A method for choosing a safe route in a communication network" by RF patent No. 2331158 IPC H04L 12/28, publ. 08/10/2008

The method provides for an increase in the secrecy of communication by specifying information about the structure of the communication network, initial data about the nodes and subscribers of the network, calculating the integrated security indicators of the network nodes, and on the basis of these data control the routes of information exchange of subscribers in the communication network and choosing the most secure route.

The disadvantage of this method is the low secrecy of the communication of network subscribers, due to the possibility of identifying message packets with respect to specific network users and, therefore, opening the structure of the distributed communication network, in case of compromise of the selected secure communication route of subscribers.

There is also known "A method for masking the structure of a communication network" by RF patent No. 2645292 IPC H04L 12/28, publ. 19.02.2018

The method provides for increased secrecy of communication and difficulty in identifying network subscribers by unauthorized subscribers due to continuous change of identifiers of network subscribers in transmitted message packets, transmission of message packets along all admissible communication routes and transmission of masking messages along masking communication routes.

The disadvantages of this method are the relatively high probability of overloading network subscribers with processing masking messages, due to the possibility of generating queues of message packets at the transmitting subscriber, busy with processing and transmitting masking messages to the communication network, and a deterioration in the timeliness of delivery of message packets to the receiving subscriber, which can lead to the loss of fragments message packets caused by the expiration of the maximum permissible time of their stay on the communication route. Retransmission of lost message packets leads to additional load on the communication network and subscribers, and retransmission of lost masking message packets can compromise the results of masking the structure of the communication network.

The closest analogue (prototype) in its technical essence to the claimed method is "Method of masking the structure of a communication network" according to RF patent No. 2682105 IPC H04L 12/28, publ. 03/14/2019

The closest analogue increases the secrecy of communication and makes it difficult to identify the structure of the communication network by unauthorized subscribers, and also eliminates a number of disadvantages of the analogs by dynamically changing the length of masking message packets and selecting masking messages for each masking route of communication of terminator nodes. In the prototype, a decrease in the waiting time in the queue of message packets at the transmitting subscriber is achieved, as well as an improvement in the indicator of the timeliness of delivery of message packets to the receiving subscriber.

The disadvantages of this prototype are the high probability of deterioration of the indicator of the timeliness of delivery of message packets to the receiving subscriber with a high intensity of packets of masking messages in cases of failures (refusals) of termination of packets of masking messages at the terminator node, which can be caused by the influence of random and deliberate interference, and a relatively low reliability of the choice nodes-terminators of masking messages, due to the lack of adaptation of the masking communication route to changes in the structure and parameters of the communication network.

The aim of the claimed invention is to develop a method for masking the structure of a communication network, which reduces the likelihood of deterioration of the indicator of the timeliness of delivery of message packets to the receiving subscriber with a high intensity of packets of masking messages by monitoring failures (failures) of termination of packets of masking messages at the terminator node, terminators of masking messages by adapting the parameters of the masking communication route to changes in the structure and parameters of the communication network.

среднего показателя безопасности маршрута, массив памяти

для хранения вычисленных значений максимально возможной длины MTU пакета сообщений, который может быть передан без фрагментации узлами сети связи, принадлежащими маскирующему маршруту связи

Затем вычисляют комплексный показатель безопасности

для каждого х-го узла сети связи.The specified technical result is achieved by the fact that in the known method of masking the structure of the communication network, which consists in the fact that for a communication network containing a set of X network nodes having IP _X addresses, initial data is pre-set containing information about the structure of the communication network, including a structural array [IP], the address of the security server IP _SB and the addresses of IP _a subscribers connected to the communication network. For each x-th node of the network, where x = 1,2, ..., X, set Y of security parameters and their values b _xy , where y = 1,2, ..., Y. Set a valid value

average route safety, memory array

for storing the calculated values of the maximum possible MTU length of a message packet that can be transmitted without fragmentation by the communication network nodes belonging to the masking communication route

Then a comprehensive safety index is calculated

for each x-th node of the communication network.

Adjacency matrix form vertices of a communication network, which is stored in the structural array [IP] network communication node addresses and IP addresses _CSS subscribers IP _a communication network, and information of a link between the nodes and the subscribers of the communication network.

After that, a set of possible communication routes between the i-th and j-th network subscribers is formed, where i = 1, 2,…, y = 1, 2,…, and i ≠ j in the form of N _ij trees of the communication network graph. Each n-th, where n = 1,2, ..., N _ij , the graph tree consists of z _n vertices, corresponding to the number of nodes in the communication network belonging to it.

как среднее арифметическое комплексных показателей безопасности

узлов сети, входящих в n-ый маршрут связи.For each of the N _ij possible communication routes, the average route safety index is calculated

as the arithmetic mean of complex safety indicators

network nodes included in the n-th communication route.

с предварительно заданным допустимым значением

Comparison of the mean values of route safety

with a predefined allowable value

формируют допустимые маршруты связи

и запоминают их. В противном случае, то есть если

то формируют маскирующие маршруты связи

и запоминают их.According to the comparison results, if

form valid communication routes

and remember them. Otherwise, that is, if

then form masking communication routes

and remember them.

и запоминают их в массиве памяти

Calculate MTU values of each communication network node belonging to the masking communication route

and store them in a memory array

выбирают для каждого маскирующего маршрута связи узел-терминатор G^T IP-пакетов маскирующих сообщений и запоминают его. Затем считывают из массива памяти

значение MTU узла-терминатора G^T IP-пакетов маскирующих сообщений и запоминают его.After calculating the MTU values of each communication network node belonging to the masking communication route

for each masking communication route, a terminator node G ^{T of} IP packets of masking messages is selected and stored. Then read from the memory array

the MTU value of the terminator node G ^{T of the} IP packets of masking messages and store it.

и значениях MTU узлов-терминаторов G^T IP-пакетов маскирующих сообщений, отправляют сформированные сообщения о запомненных маскирующих маршрутах связи

, значениях MTU узлов-терминаторов G^T IP-пакетов маскирующих сообщений и принимают их i-ми абонентами сети связи.Then, messages are generated, including information about the stored masking communication routes

and MTU values of terminator nodes G ^{T of} IP packets of masking messages, send generated messages about stored masking communication routes

, the MTU values of the terminator nodes G ^{T of the} IP packets of masking messages and are received by the i-th subscribers of the communication network.

After that, masking messages are formed containing masking information, the masking messages are fragmented into F fragments. Then the length L _{f of} each f-th fragment is compared with the received MTU value of the terminator node G ^{T of the} IP packets of the masking messages.

If the length L _f f-th fragment is less than or equal to the received MTU value of the terminator node G ^{T of the} IP packets of masking messages, then the masking messages are defragmented to values of the length L _f fragments greater than the received MTU value of the terminator node.

Otherwise, that is, if the length L _f f-th fragment is greater than the received MTU value of the terminator node G ^{T of the} IP packets of masking messages, then the fragmentation of the IP packet of masking messages is prohibited during its transmission over the communication network. Then the generated masking messages are transmitted along masking communication routes

для хранения вычисленных значений длины

каждого маскирующего маршрута связи

, массив памяти

для хранения значения интенсивности

маскирующих сообщений, направленных отправителем получателю для каждого маскирующего маршрута связи

, массив памяти

для хранения значения интенсивности

маскирующих сообщений, не терминированных на узле-терминаторе и полученных принимающим абонентом для каждого маскирующего маршрута связи

, массив памяти

для хранения результатов вычисления коэффициента результативности терминации

маскирующих сообщений для каждого маскирующего маршрута связи

, значение допустимого коэффициента результативности терминации

маскирующих сообщений и массив памяти [T_ij] для хранения текущего значения астрономического времени и значения времени окончания

передачи маскирующих сообщений для каждого маскирующего маршрута связи

. После запоминания маскирующих маршрутов связи

, вычисляют длину

каждого маскирующего маршрута связи

и запоминают значение длины

каждого маскирующего маршрута связи в массиве памяти

. После запрета фрагментации IP-пакета маскирующих сообщений при его передаче по сети связи, запоминают в массиве памяти [T_ij] текущее значение Т^тек астрономического времени и значение времени окончания

передачи маскирующих сообщений для каждого маскирующего маршрута связи

. Затем, после передачи сформированных маскирующих сообщений по маскирующим маршрутам связи

, вычисляют значение интенсивности

IP-пакетов маскирующих сообщений, направленных i-м отправителем j-му получателю для каждого маскирующего маршрута связи

, запоминают значение интенсивности

IP-пакетов маскирующих сообщений в массиве памяти

The source data is additionally set to a memory array

for storing computed length values

each masking communication route

, memory array

to store the intensity value

masking messages directed by the sender to the recipient for each masking communication route

, memory array

to store the intensity value

masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

, memory array

for storing the results of calculating the termination performance coefficient

masking messages for each masking communication route

, the value of the permissible coefficient of effectiveness of termination

masking messages and a memory array [T _ij ] for storing the current astronomical time value and the end time value

transmission of masking messages for each masking communication route

... After memorizing masking communication routes

, calculate the length

each masking communication route

and store the length value

each masking communication route in the memory array

... After the prohibition of the fragmentation of the IP packet of masking messages during its transmission over the communication network, the current value of T ^tech astronomical time and the end time value are stored in the memory array [T _ij ]

transmission of masking messages for each masking communication route

... Then, after the transmission of the generated masking messages along masking communication routes

, calculate the value of the intensity

IP packets of masking messages sent by the i-th sender to the j-th recipient for each masking communication route

, store the intensity value

IP packet masking messages in memory array

IP-пакетов маскирующих сообщений, не терминированных на узле-терминаторе и полученных принимающим абонентом для каждого маскирующего маршрута связи

, далее запоминают значение интенсивности

IP-пакетов маскирующих сообщений в массиве памяти

. После этого вычисляют значение коэффициента результативности терминации

IP-пакетов маскирующих сообщений для каждого маскирующего маршрута связи

и запоминают значение коэффициента результативности

терминации IP-пакетов маскирующих сообщений в массиве памяти

. Далее сравнивают значения коэффициента результативности

терминации IP-пакетов маскирующих сообщений со значением допустимого коэффициента результативности

терминации IP-пакетов маскирующих сообщений.Calculate the intensity value

IP packets of masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

, then the value of the intensity is stored

IP packet masking messages in memory array

... After that, the value of the termination efficiency coefficient is calculated

IP packets of masking messages for each masking communication route

and remember the value of the coefficient of performance

termination of IP packets of masking messages in the memory array

... Next, the values of the performance coefficient are compared

termination of IP packets of masking messages with the value of the admissible performance factor

termination of IP packets of masking messages.

считывают значение длины

маскирующего маршрута связи

из массива памяти

уменьшают значение длины

на единицу. Далее формируют сообщение, включающее информацию об уменьшенном на единицу значении длины

маскирующего маршрута связи

. Отправляют сервером безопасности сформированное сообщение i-му абоненту сети связи и принимают сообщение i-м абонентом сети связи. Устанавливают i-м абонентом сети связи в служебном поле «Time То Live» заголовка IP-пакета маскирующих сообщений, передаваемых от отправителя, значение, равное уменьшенному на единицу значению длины

маскирующего маршрута связи

переходят к передаче маскирующих сообщений по маскирующим маршрутам связи

If

read the length value

communication masking route

from memory array

decrease the length value

per unit. Next, a message is formed, including information about the length value reduced by one

communication masking route

... The generated message is sent by the security server to the i-th subscriber of the communication network and the message is received by the i-th subscriber of the communication network. Set by the i-th subscriber of the communication network in the "Time To Live" service field of the header of the IP packet of masking messages transmitted from the sender, a value equal to the length value reduced by one

communication masking route

move on to transmission of masking messages along masking communication routes

переходят к передаче маскирующих сообщений по маскирующим маршрутам связи.Otherwise, that is, if

pass to the transmission of masking messages along masking communication routes.

передачи маскирующих сообщений для каждого маскирующего маршрута связи

Next, compare in the memory array [T _ij ] the current value of T ^tech astronomical time and the value of the end time

transmission of masking messages for each masking communication route

формируют отчет, содержащий информацию о значении коэффициента результативности терминации

IP-пакетов маскирующих сообщений для каждого маскирующего маршрута связи

. Противном случае, то есть если

изменяют исходные данные, содержащие информацию о структуре сети связи.If the condition is met

generate a report containing information on the value of the termination performance coefficient

IP packets of masking messages for each masking communication route

... Otherwise, that is, if

change the original data containing information about the structure of the communication network.

каждого маскирующего маршрута

суммируют количество узлов сети связи между i-м и j-м абонентами. Значение коэффициента результативности терминации

IP-пакетов маскирующих сообщений для каждого маскирующего маршрута связи

вычисляют по формуле

To calculate the length

each cloaking route

summarize the number of communication network nodes between the i-th and j-th subscribers. Termination efficiency coefficient value

IP packets of masking messages for each masking communication route

calculated by the formula

Thanks to the new set of essential features, it is possible to reduce the likelihood of deterioration of the indicator of the timeliness of delivery of message packets to the receiving subscriber at a high intensity of masking message packets by monitoring failures (failures) of termination of masking message packets at the terminator node, and increasing the reliability of the choice of masking message terminator nodes through adaptation parameters of the masking communication route to change the structure and parameters of the communication network.

The claimed objects of the invention are illustrated by drawings, which show:

fig. 1 is an example of the structure of a distributed communication network, illustrating the reconstruction of the structure of a communication network by an intruder;

fig. 2 - the structure of the message packet and its IP-header;

fig. 3 - initial data to illustrate the order of calculations;

fig. 4 is a flowchart of a sequence of actions that implement the claimed method for masking the structure of a communication network;

fig. 5 - presentation of arrays of initial data;

fig. 6 - tables for calculating the integrated safety indicators of communication network nodes and average safety indicators of communication routes;

fig. 7 - selection of admissible and masking communication routes;

fig. 8 is an illustration of communication schemes between subscribers and a security server along three valid routes;

fig. 9 - the final scheme of subscriber communication, including admissible and masking routes, as well as a terminator node;

fig. 10 - evaluation of the effectiveness of the formulated technical result.

The claimed method is implemented as follows. In the general case, distributed communication networks (Fig. 1a) are built to connect subscribers of network 1 through a public communication network (for example, the Internet), which is a collection of physical communication lines (channels) 2 connecting X nodes of network 3 into a single infrastructure.

Various servers of digital communication systems can be available either to a dedicated set of subscribers, such as a security server 4, or be public servers 5 of a public communication network (for example, the Internet 6).

It is advisable to consider cases when the number of network nodes X is more than two. All infrastructure elements are identified by identifiers, which are used as network addresses (ZP addresses) in the most common family of TCP / IP protocols. If necessary, distributed information processing and (or) its transmission, subscribers connect to the public communications network.

The sets of addresses of subscribers connected to the communication network and addresses of network nodes do not intersect. For example, when subscribers use an e-mail service, the subscriber communication scheme includes subscribers 1 Ab _i and Abj (Fig.1b), an e-mail server 5 and communication channels between them 2. Subscribers 1 Ab _i and Abj and an e-mail server 5 use unique IP addresses.

When transmitting message packets over public communication networks to network subscribers, network nodes and communication lines (channels), information security requirements are imposed, characterizing the permissible values of the safety indicators of communication network elements.

In the case (Fig. 1a) compromise of the safe communication route of subscribers and the intruder 7 gaining unauthorized access to the elements of the communication network 2 and (or) 3, the subscriber communication scheme becomes available to the intruder. Hereinafter, the term "compromise of a secure communication route of subscribers" means an event associated with someone gaining unauthorized access to elements of a secure communication route - points of connection of subscribers to the communication network, transit nodes and communication lines.

The availability of the subscriber communication scheme to the intruder is due to the low secrecy of network subscribers using public IP addresses, and the possibility of identifying message packets with respect to specific network users and (or) communication nodes.

For example, in FIG. 1c, users User # 1 and User # 2 (see Fig. 1b) are grouped by the intruder into subscriber Ab _i 1 on the basis of their use of one IP address, since they are connected to the public communication network through one router (see Fig. 1a). The structures of the message packet and its IP header are known and are shown in FIG. 2. The use by subscribers to connect to the public communication network of one router unmasks their belonging to one communication center. At the same time, the intruder observes exactly two users grouped into subscriber Ab _i 1, since between subscribers Ab _i and Abj, in addition to the direct communication line, there is an alternative communication channel (shown in Fig. 1c with a dashed line), including the email server 5, which unmasked by the "From" and "To" fields of the header of the e-mail message sent by subscribers. The structure of the e-mail message header service fields is known and is described in the technical specifications (RFC, Request for Comments) of the Internet (see, for example, https://tools.ietf.org/html/rfc822).

Similar to that described in FIG. In 1 cases, it is believed that the intruder reconstructs (reveals) the structure of the communication network and can carry out destructive effects on all its elements, and the structure of the communication network itself has low secrecy of communication.

Reconstruction of the structure of the communication network occurs due to the publicity (openness) of the structure of message packets, where the addresses of the sender and recipient unmask network subscribers.

To mask the structure of the communication network, it is necessary to ensure the individual secrecy of subscribers, to control the routes of information exchange of subscribers in the public communication network and to transmit masking messages to mislead the attackers about the structure of the communication network. The transmission of masking messages can be carried out between subscribers Ab _i and Abj, as well as between fake subscribers Abf specially connected to the public communication network, with the help of which the structure of the communication network is distorted when it is reconstructed by an intruder. It is also possible to organize a masking exchange between subscribers Ab _i or Abj and false subscribers Abf 8, as shown in FIG. 1b with dotted lines.

The structure of the public communication network is dynamic and contains a large number of nodes, therefore, the tasks of evaluating security indicators, forming routes and servicing subscribers' requests for safe communication routes are assigned to a dedicated security server. The number of security servers depends on the size of the communication network and can be set, for example, in the ratio of 1 server to 7 .. 10 corresponding subscribers.

Consider a variant of the structure of a distributed communication network (Fig. 3), which is a combination of 5 network nodes 3, a security server 4 and network subscribers 1, united by physical communication lines 2.

FIG. 4 shows a block diagram of a sequence of actions that implement the claimed method of masking the structure of a communication network, in which the following designations are adopted:

SB - security server;

[IP] - structural array;

- массив памяти для хранения значения интенсивности

IP-пакетов маскирующих сообщений, направленных отправителем получателю для каждого маскирующего маршрута связи

- memory array for storing intensity values

IP packets of masking messages directed by the sender to the receiver for each masking communication route

- массив памяти для хранения значения интенсивности

IP-пакетов маскирующих сообщений, не терминированных на узле-терминаторе и полученных принимающим абонентом для каждого маскирующего маршрута связи

;

- memory array for storing intensity values

IP packets of masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

;

- массив памяти для хранения значения коэффициента результативности

терминации IP-пакетов маскирующих сообщений маскирующего маршрута связи

;

- an array of memory for storing the value of the performance coefficient

termination of IP packets masking messages masking communication route

;

- массив памяти для хранения вычисленных значений максимально возможной длины MTU IP-пакета сообщений, который может быть передан без фрагментации узлами сети связи;

- an array of memory for storing the calculated values of the maximum possible MTU length of the IP-packet of messages, which can be transmitted without fragmentation by the nodes of the communication network;

- массив памяти для хранения вычисленных значений длины

каждого маскирующего маршрута связи

;

- memory array for storing calculated length values

each masking communication route

;

передачи маскирующих сообщений для каждого маскирующего маршрута связи

;[T _ij ] - memory array for storing the current astronomical time value and the end time value

transmission of masking messages for each masking communication route

;

X is the number of nodes in the communication network;

Y is the number of taken into account security parameters of network nodes; b _xy is the value of the y-th security parameter of the x-th network node, where x = 1,2,…, X, y = 1,2,…, Y;

- комплексный показатель безопасности каждого х-го узла сети;

- a comprehensive indicator of the safety of each x-th node of the network;

- средний показатель безопасности маршрута связи между i-м и j-м абонентами сети;

is the average safety indicator of the communication route between the i-th and j-th network subscribers;

- допустимое значение среднего показателя безопасности маршрута связи между i-м и j-м абонентами сети;

- admissible value of the average indicator of the safety of the communication route between the i-th and j-th network subscribers;

N _ij is the number of trees in the communication network graph corresponding to the set of possible communication routes between the i-th and j-th network subscribers, where i = 1, 2,…, j = 1, 2,…, and i ≠ j;

- количество допустимых маршрутов между i-м и j-м абонентами сети;

- the number of admissible routes between the i-th and j-th network subscribers;

- количество маскирующих маршрутов между i-м и j-м абонентами сети;

- the number of masking routes between the i-th and j-th network subscribers;

L _f is the length of the f-th fragment of the masking message;

- длина маскирующего маршрута связи

;

- the length of the masking communication route

;

- значение коэффициента результативности терминации IP-пакетов маскирующих сообщений маскирующего маршрута связи

;

is the value of the efficiency factor for the termination of IP packets of masking messages of the masking communication route

;

- значение допустимого коэффициента результативности терминации IP-пакетов маскирующих сообщений маскирующего маршрута связи

;

is the value of the permissible coefficient of effectiveness of the termination of IP packets of masking messages of the masking communication route

;

G ^T - node-terminator of IP packets of masking messages.

для хранения вычисленных значений максимально возможной длины MTU IP-пакета сообщений, который может быть передан без фрагментации узлами сети связи, принадлежащими маскирующему маршруту связи

, массив памяти

для хранения значения интенсивности

IP-пакетов маскирующих сообщений, направленных отправителем получателю для каждого маскирующего маршрута связи

, массив памяти

для хранения значения интенсивности

IP-пакетов маскирующих сообщений, не терминированных на узле-терминаторе и полученных принимающим абонентом для каждого маскирующего маршрута связи

, массив памяти

для хранения значения коэффициента результативности

терминации IP-пакетов маскирующих сообщений маскирующего маршрута связи

, массив памяти

для хранения вычисленных значений длины

каждого маскирующего маршрута связи

, массив памяти [T_ij] для хранения текущего значения Т^тек астрономического времени и значения времени окончания

передачи маскирующих сообщений для каждого маскирующего маршрута связи

.At the initial stage, the initial data is set in the security server (block 1 in Fig. 4), including the structural array [IP], the address of the security server IP _SB and the addresses of IP subscribers _a connected to the communication network, the memory array

for storing the calculated values of the maximum possible MTU length of an IP message packet that can be transmitted without fragmentation by the communication network nodes belonging to the masking communication route

, memory array

to store the intensity value

IP packets of masking messages directed by the sender to the receiver for each masking communication route

, memory array

to store the intensity value

IP packets of masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

, memory array

to store the value of the performance factor

termination of IP packets masking messages masking communication route

, memory array

for storing computed length values

each masking communication route

, a memory array [T _ij ] for storing the current value of T ^tech astronomical time and the end time value

transmission of masking messages for each masking communication route

...

среднего показателя безопасности маршрута. Перечисленные исходные данные представлены таблицами на фиг. 5.For each x-th node of the network, where x = 1,2, ..., X, set Y≥2 security parameters and their values b _xy , where y = 1,2, ..., Y. Set a valid value

average route safety. The listed raw data are presented in the tables in FIG. 5.

Structural array [IP] - array to store the security server address _Sa IP, IP _CSS node addresses and subscriber IP _a network, and information of a link between them (Figure 5a.) Having only two values, "1" - the presence of connection and "0" - its absence.

Security parameters of network nodes are determined, for example, in accordance with GOSTRISO / IEC 15408-2002 "Methods and means of ensuring security. Information Technology Security Assessment Criteria ". The values b _{x1 of the} parameter y = 1 of the security of the network nodes are determined, for example, by the characteristics of the equipment manufacturers of the network nodes, information about which can be obtained from the physical addresses of the network nodes. The physical addresses of the hosts are represented in hexadecimal notation, for example 00: 10: 5a: 3F: D4: E1, where the first three values determine the manufacturer (00: 01: e3-Siemens, 00: 10: 5a - 3Com, 00:03: ba-Sun).

An alternative way to determine the security parameters of the nodes is to obtain intelligence data from the attacker from the appropriate units.

For example, for DC 1 (x = 1 in Fig. 5a) whose physical address is 00: 01: e3: 3F: D4: E1, the first three values determine the manufacturer Siemens, which corresponds to the value of the security parameter b ₁₁ = 0.3. Similarly, the values b _{xy of the} parameter y = 1 of the security of the nodes of the US2-US5 network are determined, as well as the values b _{xy of} all given Y≥2 security parameters (Fig. 5b).

The other security parameters of a host can be considered the type of its equipment, the version of the software installed on it, whether the host belongs to a public or private organization, and other known information.

(бл. 2 на фиг. 4). Рассчитанные показатели представлены в таблице (фиг. 5в).For each x-th node of the network, according to the values b _{xy of} its security parameters, a complex security indicator is calculated

(block 2 in Fig. 4). The calculated indicators are presented in the table (Fig. 5c).

для каждого х-го узла сети вычисляют путем суммирования

, или перемножения

, или как среднее арифметическое значение

его параметров безопасности b_xy.Comprehensive safety indicator

for each x-th network node is calculated by summing

, or multiplication

, or as the arithmetic mean

its security parameters b _xy .

не влияет на результат выбора безопасного маршрута. Например, значения вычисленных комплексных показателей безопасности

для каждого х-го узла рассматриваемого варианта сети связи (фиг. 3) перечисленными способами при заданных значениях параметров безопасности b_xy узлов приведены в таблице (фиг. 6а).Basically a way of calculating

does not affect the result of choosing a safe route. For example, the values of the calculated integrated safety indicators

for each x-th node of the considered version of the communication network (Fig. 3) by the listed methods for the given values of the security parameters b _{xy of the} nodes are given in the table (Fig. 6a).

для каждого х-го узла сети, когда их задают бинарно - опасный узел, либо безопасный узел, в последнем случае полагая, что его безопасность доказана, но количественные значения показателей безопасности недоступны лицам, принимающим решение на выбор маршрута.In addition, a utilitarian approach to the determination of complex safety indicators is possible.

for each x-th node of the network, when they are assigned a binary dangerous node, or a safe node, in the latter case, assuming that its safety has been proven, but the quantitative values of safety indicators are not available to persons who make decisions on choosing a route.

Further formed adjacency matrix vertices network graph (bl. 3 in FIG. 4), which is stored in the structural array (FIG. 5a) addresses network nodes IP _CSS and addresses of subscribers IP _a network, and information of a link between the nodes and subscribers networks.

Methods for forming the adjacency matrices of the vertices of a graph are known (see, for example, Basaker R., Saati T. Finite graphs and networks. - M .: Nauka, 1973, 368 pp.). For the considered communication network graph, the vertex adjacency matrix has the form:

A set of possible communication routes between the i-th and j-th network subscribers is formed (block 4 in Fig. 4), where i = 1, 2, ..., j = 1,2, ..., and i ≠ j, in the form of N _ij trees of the communication network graph. Each n-th, where n = 1,2, ..., N _ij , the graph tree consists of z _n vertices corresponding to the number of network nodes. The order of formation of graph trees is known and described (see, for example, Christofides N. Graph theory: Algorithmic approach. Transl. From English. - M .: Mir, 1978, 432 p.).

где B_o=М×Н - преобразованная матрица смежности вершин графа сети связи, а М=М_р - 1, Н - соответственно число строк и столбцов матрицы, М_р - число строк исходной матрицы смежности, равное общему количеству узлов сети связи;

- транспонированная матрица к B_o. Удаляя одну строку матрицы В, получают матрицу B_o, а затем транспонированную к ней матрицу

. Порядок получения транспонированной матрицы известен и описан (см., например, Г. Корн, Т. Корн. Справочник по математике для научных работников и инженеров. - М.: Наука, 1977 г.).The total number N _{ij of} trees of the communication network graph between the i-th and j-th network subscribers can be determined by various methods. In the claimed method, the total number N _{ij of the} trees of the graph is found using the adjacency matrix by the formula:

where B _o = M × H is the transformed adjacency matrix of the vertices of the communication network graph, and M = M _p - 1, N is the number of rows and columns of the matrix, respectively, M _p is the number of rows of the original adjacency matrix, equal to the total number of nodes in the communication network;

is the transposed matrix to B _o . Removing one row of the matrix B, one obtains the matrix B _o , and then the matrix transposed to it

... The procedure for obtaining a transposed matrix is known and described (see, for example, G. Korn, T. Korn. Handbook of mathematics for scientists and engineers. - M .: Nauka, 1977).

The construction of communication routes between subscribers based on the trees of the communication network graph ensures that all possible communication routes are found and that they are not closed, i.e. excludes closed routes unacceptable for message transmission. Thus, after performing the calculations, we obtain the total number N _{ij of} trees in the communication network graph between the i-th and j-th network subscribers, equal to 5.

(бл. 5 на фиг. 4) как среднее арифметическое комплексных показателей безопасности

узлов сети, входящих в n-ый маршрут связи

(см. фиг. 6б и фиг. 7).To substantiate and objectively select admissible and masking communication routes from the set of N _ij = 5 possible communication routes between the i-th and j-th network subscribers, the average safety indicators are calculated

(block 5 in Fig. 4) as the arithmetic mean of complex safety indicators

network nodes included in the n-th communication route

(see Fig. 6b and Fig. 7).

маршрутов связи сформированных между i-м и j-м абонентами сети (фиг. 7). Результаты сведены в таблицу (фиг.6б).Using the results obtained when calculating the integrated safety indicators of network nodes in different ways (Fig.6a), the average safety indicators were calculated

communication routes formed between the i-th and j-th network subscribers (Fig. 7). The results are tabulated (Fig.6b).

с предварительно заданным допустимым значением

(бл. 6 на фиг. 4). Те маршруты, значения средних показателей безопасности которых удовлетворяют условию

, запоминают как допустимые маршруты

(бл. 7 на фиг. 4).Next, the values of the average safety indicators of routes are compared

with a predefined allowable value

(block 6 in Fig. 4). Those routes, the values of the average safety indicators of which satisfy the condition

are remembered as valid routes

(block 7 in Fig. 4).

Из полученных результатов, приведенных на фиг. 6 и 7 следует, что первый, второй и третий маршруты n=1,2,3 имеют значения среднего показателя безопасности

удовлетворяющие этому требованию, и они выделены полужирным шрифтом. При анализе полученных расчетов средних показателей безопасности маршрутов выявлено что, способ вычисления

не влияет на результат выбора безопасного маршрута. Таким образом и формируют множество допустимых маршрутов между всеми абонентами сети.For example, let the value

From the results obtained, shown in FIG. 6 and 7 it follows that the first, second and third routes n = 1,2,3 have the values of the average safety index

satisfying this requirement, and they are in bold. When analyzing the obtained calculations of the average safety indicators of routes, it was revealed that the calculation method

does not affect the result of choosing a safe route. Thus, they form a set of valid routes between all network subscribers.

с предварительно заданным допустимым значением

выявляют те маршруты, что удовлетворяют условию

, то такие маршруты запоминают как маскирующие

маршруты (бл. 8 на фиг. 4). При заданном

из полученныхIn the event that, based on the results of comparing complex indicators of route safety

with a predefined allowable value

identify routes that satisfy the condition

, then such routes are remembered as masking

routes (block 8 in fig. 4). For a given

from received

. Их запоминают как маскирующие

, и используют для последующей передачи по ним маскирующих (ложных) сообщений и введения нарушителей в заблуждение относительно структуры сети связи.the results shown in FIG. 6 and 7 it follows that the fourth and fifth routes n = 4.5 have values of the average safety index that satisfy the condition

... They are remembered as disguises

, and are used for the subsequent transmission of masking (false) messages and misleading the offenders regarding the structure of the communication network.

с предварительно заданным допустимым значением

маршруты, что удовлетворяют условию

не выявлены, то для выбора маскирующих маршрутов необходимо снизить требования к допустимому значению среднего показателя безопасности маршрута связи между i-м и j-м абонентами сети.In the event that, based on the results of comparing complex indicators of route safety

with a predefined allowable value

routes that satisfy the condition

are not identified, then for the choice of masking routes it is necessary to reduce the requirements for the admissible value of the average safety indicator of the communication route between the i-th and j-th network subscribers.

Well-known routing protocols, such as RIP, OSPF, NLSP, BGP, are designed to transfer user information with source specified routing and provide a way to exchange information along a given route (see, for example, Olifer V.G. and Olifer N.A. "Computer networks. Principles, technologies, protocols.", study for universities, 5th ed .; - SPb .: Peter, 2015). Thus, subscribers have the ability to send messages exactly along a given route.

каждого маскирующего маршрута

посредством суммирования количества узлов сети связи между i-м и j-м абонентами и запоминают вычисленные значения в массиве памяти

(бл. 9 на фиг. 4).Calculate the length

each cloaking route

by summing the number of communication network nodes between the i-th and j-th subscribers and store the calculated values in the memory array

(block 9 in Fig. 4).

каждого маскирующего маршрута

вычисляют (бл. 10 на фиг. 4) значения MTU каждого узла сети, принадлежащего маскирующему маршруту

и запоминают их в массиве памяти

(бл. 11 на фиг. 4). В каждом канале сети связи (определяют по передающему интерфейсу узла сети - маршрутизатора) есть максимальный размер передаваемого блока данных (MTU, Maximum Transmission Unit). MTU - это максимально возможная длина дейтаграммы, которую та или иная технология может поместить в поле данных своей единицы передачи [Олифер В.Г., Олифер Н.А. Компьютерные сети. Принципы, технологии, протоколы: учебник для вузов. - СПб.: Питер, 2003. - 864 с.: ил.]. Передача между узлами сети пакетов сообщений с длиной, большей MTU, без фрагментации невозможна. Значение MTU определяется стандартом соответствующего протокола, но может быть переопределено автоматически для определенного потока.After calculating the length

each cloaking route

calculate (block 10 in Fig. 4) the MTU values of each network node belonging to the masking route

and store them in a memory array

(block 11 in Fig. 4). Each channel of the communication network (determined by the transmitting interface of the network node - router) has a maximum size of the transmitted data unit (MTU, Maximum Transmission Unit). MTU is the maximum possible datagram length that a particular technology can place in the data field of its transmission unit [Olifer V.G., Olifer N.A. Computer networks. Principles, technologies, protocols: a textbook for universities. - SPb .: Peter, 2003. - 864 p .: ill.]. Transmission between network nodes of message packets with a length exceeding the MTU is impossible without fragmentation. The MTU value is determined by the standard of the corresponding protocol, but can be overridden automatically for a specific stream.

The Path MTU Discovery procedure is used to calculate the MTU value of each host belonging to the masking route, as described, for example, in the Internet technical specifications (RFC, Request for Comments) (see, for example, https: //tools.ietf. org / html / rfc1191). Another option for calculating the MTU value of each network node belonging to the masking route is to use the procedure for establishing a connection with each network node, for which each network node 7XUL is sent message packets with the SYN flag set in the FLAGS service field in the TCP message packet header (see, for example, https://tools.ietf.org/html/rfc4413). After that, a response message packet containing the Maximum Segment Size segment of the options field of the TCP-message packet header is received, its value is read, and the value of the IP-message packet header length is added to this value. As the value of the Maximum Segment Size, the subscriber records the maximum allowable length of data that he is ready to receive, and for the fragment of masking messages, the user sets this value relatively small so that it is less than any MTU along the masking route between the sending and receiving sides.

The calculated MTU values of each network node are presented in the table (Fig.5 d).

To transmit masking (false) messages and mislead the intruders about the structure of the communication network, for each masking communication route G ^T, a terminator node G ^{T of} IP packets of masking messages is selected and stored (block 12 in Fig. 4).

The term "node-terminator of masking messages" means a network node belonging to the masking communication route, which stops further transmission of packets of masking messages if the length of the g-th message fragment is greater than that received at the terminator node

MTU values. When comparing the length of L _f f-th message fragment with the received MTU value of the terminator node G ^{T of} IP packets of masking messages, the length of the service part of the message packet is taken into account, which is added to each message packet during transmission to the addressee.

The choice of a terminator node G ^{T of} IP packets of masking messages is necessary in order to improve the indicator of the timeliness of delivery of message packets to the receiving subscriber. This is achieved by the fact that packets of masking messages will not be delivered to the receiving subscriber (if it is not false - see Abf 8 of Fig. 1b), but will be destroyed at the terminator node. For example, for the structure shown in FIG. 1a, if packets of masking messages are transmitted between subscribers Abj and Abi along a masking route through the nodes of the network US3, US4 and US1, then the intruder will intercept by protocol analyzers 7 packets of masking messages from US4 and the communication channel (line) between US3 and US4, and packets of masking messages will be destroyed on the US1 selected as the terminator node. As a result, the receiving subscriber Abi will not be overloaded with masking messages, and the indicator of the timely delivery of constructive (non-masking) messages to him will be improved.

In the event that the receiving subscriber is false, then the receiving subscriber is selected as the terminator node G ^{T of the} IP packets of masking messages.

значение MTU узла-терминатора G^T IP-пакетов маскирующих сообщений.Then read and store (block 13 in Fig. 4) from the memory array

the MTU value of the terminator node G ^{T of} IP packets of masking messages.

и значениях MTU узлов-терминаторов G^T IP-пакетов маскирующих сообщений, отправляют сформированные сообщения абонентам сети (бл. 14 на фиг. 4) и принимают их i-ми абонентами сети (бл. 15 на фиг. 4).Next, messages are generated, including information about the stored masking communication routes

and MTU values of terminator nodes G ^{T of} IP packets of masking messages, the generated messages are sent to network subscribers (block 14 in Fig. 4) and received by the i-th network subscribers (block 15 in Fig. 4).

Thus, each network subscriber is notified of the masking routes to all other subscribers, as well as the MTU values that must be set for the masking messages so that they are destroyed at the selected terminator node of each masking route.

Then, after sending the generated messages to all i-th network subscribers, and receiving messages by the network subscribers, masking messages are generated (block 16 in Fig. 4).

To generate masking messages, false initial data packets are generated, in the information part of which a random or arbitrary digital sequence is written (a random sequence of signals logical "0" and logical "1").

After the formation of masking messages containing masking information, the masking messages are fragmented (block 17 in Fig. 4) into F fragments. Fragmentation of masking messages is necessary to reduce the average time spent in the queue of constructive (non-masking) packets, which have a higher priority when sent to the network. However, fragmented masking messages can be shorter than the MTU of the terminator node. To eliminate this contradiction, it is necessary to compare (block 18 in Fig. 4) the length L _{f of} each f-th fragment with the received MTU value of the terminator node G ^{T of} IP packets of masking messages. The comparison is necessary in order to determine whether the masking message packet will be destroyed at the terminator node. When comparing the length L _{f of} each f-th fragment with the received MTU value of the terminator node G ^{T of} IP packets of masking messages, the length of the service part of the message packet is taken into account, which is added during transmission to the addressee to each message packet. And if the length L _f f-th fragment is greater than the received MTU value of the terminator node G ^{T of the} IP packets of masking messages, then the fragmentation of the IP packet of masking messages is prohibited during its transmission over the communication network (block 20 in Fig. 4) when it is transmitted over a communication network. To prohibit fragmentation of an IP packet of messages during its transmission over a communication network, the value of the DF (Do not Fragment) flag in the header of the IP packet of messages is set to one. Setting this flag to one means the prohibition of fragmentation (see, for example, https://tools.ietf.org/html/rfc791) on the terminator node, which leads to the prohibition of relaying the message packet beyond the terminator node.

Otherwise, that is, if the length L _f f-th fragment is less than or equal to the received MTU value of the terminator node G of the masking messages, then defragment the masking messages to values of the length L _f fragments greater than the received MTU value of the terminator node (block 19 in Fig. 4), for which two or more fragments of masking messages are combined together. Thus, by dynamically changing the length of the masking message packets, a decrease in the average waiting time in the queue of message packets at the transmitting subscriber is achieved.

передачи маскирующих сообщений для каждого маскирующего маршрута связи

(бл. 21 на фиг. 4) и передают сформированные маскирующие сообщения по маскирующим маршрутам связи

(бл. 22 на фиг. 4). Запоминание значений астрономического времени и времени окончания передачи маскирующих сообщений требуется для вычисления интенсивностей

и

необходимых для вычисления коэффициента результативности терминации

IP-пакетов маскирующих сообщений.Then, the current values of T ^tech astronomical time and the end time values are stored in the memory array [T _ij ]

transmission of masking messages for each masking communication route

(block 21 in Fig. 4) and transmit the generated masking messages along masking communication routes

(block 22 in Fig. 4). Memorizing the values of the astronomical time and the end time of transmission of masking messages is required to calculate the intensities

and

required to calculate the termination performance coefficient

IP packet masking messages.

, вычисляют значение интенсивности

IP-пакетов маскирующих сообщений, направленных i-м отправителем j-му получателю для каждого маскирующего маршрута связи

(бл. 23 на фиг. 4), запоминают значение интенсивности

IP-пакетов маскирующих сообщений в массиве памяти

(бл. 24 на фиг. 4).Then, after the transmission of the generated masking messages along masking communication routes

, calculate the value of the intensity

IP packets of masking messages sent by the i-th sender to the j-th recipient for each masking communication route

(block 23 in Fig. 4), store the value of the intensity

IP packet masking messages in memory array

(block 24 in Fig. 4).

IP-пакетов маскирующих сообщений, не терминированных на узле-терминаторе и полученных принимающим абонентом для каждого маскирующего маршрута связи

(бл. 25 на фиг. 4), далее запоминают значение интенсивности

IP-пакетов маскирующих сообщений в массиве памяти

(бл. 26 на фиг. 4).Calculate the intensity value

IP packets of masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

(block 25 in Fig. 4), then the intensity value is stored

IP packet masking messages in memory array

(block 26 in Fig. 4).

может быть вызвано неверным выбором значений MTU IP-пакетов маскирующих сообщений или отказами (сбоями) их терминации на узле-терминаторе. Кратковременные или систематические отказы (сбои) терминации могут быть вызваны следующими причинами:Nonzero value

can be caused by an incorrect choice of MTU values of IP packets of masking messages or refusals (failures) of their termination at the terminator node. Short-term or systematic termination failures (failures) can be caused by the following reasons:

the impact of random (unintentional) interference, such as natural and man-made factors, leading to failures (failures) of termination of masking messages at the terminator node;

targeted destructive influences

attackers on the elements of the public communication network, leading to a change in the values of the security indicators of the nodes of the communication network and failures (failures) of termination of masking messages at the terminator node;

a decrease in the reliability of the choice of terminator nodes for masking messages caused by a change in the masking route by a communication operator of a public communication network or scaling of the communication network structure (the appearance of new subscribers).

IP-пакетов маскирующих сообщений для каждого маскирующего маршрута связи

(бл. 27 на фиг. 4) и запоминают значение коэффициента результативности терминации

IP-пакетов маскирующих сообщений в массиве памяти

(бл. 28 на фиг. 4). Значение коэффициента результативности терминации

IP-пакетов маскирующих сообщений для каждого маскирующего маршрута связи

вычисляют по формуле

To ensure a decrease in the likelihood of deterioration of the indicator of the timeliness of delivery of message packets to the receiving subscriber at a high intensity of packets of masking messages after monitoring failures (refusals) of termination of packets of masking messages, the termination efficiency coefficient is calculated at the terminator node

IP packets of masking messages for each masking communication route

(block 27 in Fig. 4) and store the value of the termination efficiency coefficient

IP packet masking messages in memory array

(block 28 in Fig. 4). Termination efficiency coefficient value

IP packets of masking messages for each masking communication route

calculated by the formula

IP-пакетов маскирующих сообщений со значением допустимого коэффициента результативности терминации

IP-пакетов маскирующих сообщений (бл. 29 на фиг. 4).Next, the values of the termination performance coefficient are compared

IP packets of masking messages with the value of the permissible termination performance factor

IP packets of masking messages (block 29 in FIG. 4).

считывают значение длины

маскирующего маршрута связи

из массива памяти

(бл. 30 на фиг. 4), уменьшают значение длины

на единицу (бл. 31 на фиг. 4).If

read the length value

communication masking route

from memory array

(block 30 in Fig. 4), reduce the length

per unit (block 31 in Fig. 4).

маскирующего маршрута связи

(бл. 32 на фиг. 4). Отправляют сервером безопасности сформированное сообщение i-му абоненту сети связи (бл. 33 на фиг. 4) и принимают сообщение, включающее информацию об уменьшенном на единицу значении длины

маскирующего маршрута связи

i-м абонентом сети связи (бл. 34 на фиг. 4). Устанавливают i-м абонентом сети связи в служебном поле «Time То Live» заголовка IP-пакета маскирующих сообщений, передаваемых от отправителя, значение, равное уменьшенному на единицу значению длины

маскирующего маршрута связи

(бл. 35 на фиг. 4). При использовании интернет-протокола 6 версии (IPν6) для передачи маскирующих сообщений используется служебное поле «Нор Limit», означающее количество ретрансляций IP-пакета на его пути следования от отправителя к получателю, значение которого устанавливают равное уменьшенному на единицу значению длины маскирующего маршрута связи.Next, a message is formed, including information about the length value reduced by one

communication masking route

(block 32 in Fig. 4). The security server sends the generated message to the i-th subscriber of the communication network (block 33 in Fig. 4) and receives a message including information about the length value reduced by one

communication masking route

i-th subscriber of the communication network (block 34 in Fig. 4). Set by the i-th subscriber of the communication network in the "Time To Live" service field of the header of the IP packet of masking messages transmitted from the sender, a value equal to the length value reduced by one

communication masking route

(block 35 in Fig. 4). When using Internet protocol version 6 (IPν6), the service field "Nor Limit" is used to transmit masking messages, which means the number of retransmissions of an IP packet on its path from the sender to the recipient, the value of which is set equal to the value of the masking route length reduced by one.

(бл. 36 на фиг. 4).Next, proceed to the transmission of masking messages along masking communication routes

(block 36 in Fig. 4).

переходят к передаче маскирующих сообщений по маскирующим маршрутам связи (бл. 36 на фиг. 4).Otherwise, that is, if

proceed to the transmission of masking messages along masking communication routes (block 36 in Fig. 4).

передачи маскирующих сообщений для каждого маскирующего маршрута связи

(бл. 37 на фиг. 4).Next, compare in the memory array [T _ij ] the current value of T ^tech astronomical time and the value of the end time

transmission of masking messages for each masking communication route

(block 37 in Fig. 4).

формируют отчет, содержащий информацию о значении коэффициента результативности терминации

IP-пакетов маскирующих сообщений для каждого маскирующего маршрута связи

(бл. 38 на фиг. 4). Противном случае, то есть, если

изменяют исходные данные, содержащие информацию о структуре сети связи. Для внесения изменений в исходные данные, содержащие информацию о структуре сети связи, переходят к бл. 1 на фиг. 4.If the condition is met

generate a report containing information on the value of the termination performance coefficient

IP packets of masking messages for each masking communication route

(block 38 in Fig. 4). Otherwise, that is, if

change the original data containing information about the structure of the communication network. To make changes to the original data containing information about the structure of the communication network, go to bl. 1 in FIG. 4.

FIG. 8 shows an illustration of the communication schemes of subscribers and the security server along three valid routes n = 1,2,3, selected using the described method.

FIG. 9 shows the final communication scheme of subscribers 1 Ab i and Ab j. Masking routes 5 are marked with a dashed line n = 4.5. Valid routes 2 are shown with a solid line. The most probable finding of the intruder and the compromise of the communication route - on routes with an average safety index below the permissible value

узлов и средних показателей безопасности маршрутов

дают основание для объективного выбора допустимых и маскирующих маршрутов связи между абонентами сети. В результате расчетов и маскирования структуры сети связи достигают исключение транзитных узлов сети, обладающих низким уровнем безопасности, который указывает на высокую вероятность несанкционированного перехвата передаваемых абонентами сообщений на маршруте, включающем, например, УС4, УС5. При передаче пакетов маскирующих сообщений между ложным Абf 8 абонентом и абонентом Абj по маскирующему маршруту №5 (n=5 на фиг. 7), в качестве узла-терминатора G^T IP-пакетов маскирующих сообщений выбирают, например УСЗ, учитывая MTU канала связи между УСЗ и Аб/. Выбранные допустимые маршруты связи между i-м и j-м абонентами проходят через транзитные узлы сети, обладающие максимально высокими уровнями безопасности, что снижает вероятность перехвата злоумышленниками информационного обмена абонентов сети.Calculation of comprehensive safety indicators

nodes and average safety indicators of routes

provide a basis for an objective choice of acceptable and masking communication routes between network subscribers. As a result of calculations and masking the structure of the communication network, the elimination of transit network nodes with a low level of security is achieved, which indicates a high probability of unauthorized interception of messages transmitted by subscribers on a route including, for example, US4, US5. When transmitting packets of masking messages between the false Abf 8 subscriber and the subscriber Abj along the masking route No. 5 (n = 5 in Fig. 7), as the terminator node G ^{T of} IP packets of masking messages, for example, HSS is selected, taking into account the MTU of the communication channel between HSS and Ab /. The selected admissible communication routes between the i-th and j-th subscribers pass through transit nodes of the network with the highest levels of security, which reduces the likelihood of interception of information exchange of network subscribers by attackers.

The effectiveness of the formulated technical result was tested by mathematical modeling of the monitoring processes of failures (failures) of terminating packets of masking messages at the terminator node and adapting the parameters of the masking communication route by controlling the values of the "Time To Live" service field of the IP packet header of masking messages.

FIG. 10a shows a labeled state graph of the simulated system. The following lists the necessary for mathematical modeling of the state S ₁ - S ₅ for monitoring failures (failures) of the termination of packets of masking messages at the terminator node and adapting the parameters of the masking communication route:

IP-пакетов маскирующих сообщений;S ₁ - calculation of the termination efficiency coefficient

IP packets of masking messages;

маскирующего маршрута связи

S ₂ - generation of a message including information about the length value reduced by one

communication masking route

S ₃ - scaling of the structure of the communication network caused by the emergence of new subscribers;

S ₄ - change in the values of security indicators of communication network nodes and failures (failures) of termination of masking messages at the terminator node as a result of targeted destructive actions of intruders;

S ₅ - change of the masking route by the communication operator of the public communication network, the impact of random (unintentional) interference.

The moments of possible transitions of the simulated communication network during the implementation of masking exchange from state to state are uncertain, random and occur under the action of events, characterized by their intensities λ, which are an important characteristic of event flows and characterize the average number of events per unit time. When constructing and using a mathematical model, the following event intensities are set:

маскирующего маршрута связи

λ ₁₂ is the intensity of requests for the formation of a message, including information about the length value reduced by one

communication masking route

IP-пакетов маскирующих сообщений;λ ₂₁ is the intensity of applications for calculating the termination performance coefficient

IP packets of masking messages;

λ ₂₃ is the intensity of requests for scaling the structure of the communication network caused by the appearance of new subscribers;

λ ₂₄ - the intensity of targeted destructive effects of intruders;

λ ₂₅ - the intensity of the impact of random (unintentional) interference;

при масштабировании структуры сети связи;λ ₃₁ - the intensity of applications for calculating the termination performance coefficient

when scaling the structure of the communication network;

при целенаправленных деструктивных воздействий злоумышленников;λ ₄₁ - the intensity of applications for calculating the termination performance coefficient

with targeted destructive actions of intruders;

при воздействии случайных (непреднамеренных) помех.λ ₅₁ is the intensity of applications for calculating the termination performance coefficient

when exposed to accidental (unintentional) interference.

According to the marked-up graph of states (Fig. 10a) according to the rules set forth in the book by ES Wentzel, Operations Research: Problems, Principles, Methodology. - 2nd ed., Erased. - M .: Science. Ch. ed. physical-mat. lit., 1988. - 208 p., Kolmogorov's equations are composed - differential equations with unknown functions p _i (t):

The procedure for solving such equations is known, and is described, for example, in the book Verzhbitsky V.M., Fundamentals of Numerical Methods: Textbook for Universities / V.M. Verzhbitsky. - M .: Higher. School., 2002 .-- 840 p. In the process of solving, the approximate values of р _{i are} calculated for the given values of the intensities of events λ _ij = const (Markov homogeneous process), which makes it possible to obtain a numerical table of the sought solutions p (t) at a certain interval t∈ [t ₀ , t ₁ ]. mathematical package

programming "MathCAD 15".

The probabilistic and temporal characteristics describing the states of the modeled process are determined by the values of the event intensities λ _ij , depending on the following conditions of operation (situations) of the communication network.

Situation No. 1 - the intensity of scaling of the structure of the communication network and targeted destructive effects of intruders are minimal, λ ₃₁ = λ ₄₁ = min, the intensity of the impact of random (unintentional) interference is constant, λ ₅₁ = const.

The results of calculating the dependence of the probabilities of states on time for the values of the intensities of events corresponding to situation No. 1 are presented in Fig. 10b. After establishing a stationary mode in the simulated system, the final probability of the system being in state S _{1 is} maximum, the regular impact of random (unintentional) interference after the initial burst p ₂ (t), characterizing the need to adapt the parameters of the masking communication route by controlling the values of the service field “Time To Live »The IP packet header of the masking messages does not lead to the dominance of destabilizing factors.

Situation No. 2 - the intensity of scaling of the communication network structure is constant, λ ₃₁ = const, the intensity of targeted destructive actions of intruders is minimal, λ ₄₁ = min, the intensity of the impact of random (unintentional) interference is maximum, λ ₅₁ = max.

The results of calculating the dependence of the probabilities of states on time for the values of the intensities of events corresponding to situation No. 2 are presented in Fig. 10c. After establishing a stationary mode in the simulated system, the final probability of the system being in the S ₂ state significantly increases, which characterizes the adaptation of the parameters of the masking communication route. The final probability of finding the system in state S _{1 is} minimal. A decrease in the intensity of the impact of random (unintentional) interference λ ₅₁ → min leads to an increase in the final probability of the system being in the S ₁ state, that is, to its adaptation due to the control of the values of the "Time To Live" service field of the IP packet header of masking messages. The deterioration of the indicator of the timeliness of delivery of message packets to the receiving subscriber at a high intensity of packets of masking messages is eliminated by monitoring failures (refusals) of terminating packets of masking messages at the terminator node.

Thus, in the considered method, due to monitoring of failures (failures) in the termination of packets of masking messages at the terminator node and adapting the parameters of the masking communication route to changes in the structure (parameters) of the communication network, the indicator of the timeliness of delivery of message packets to the receiving subscriber is improved at a high intensity of packets of masking messages and increasing the reliability of the choice of masking message terminator nodes.

Claims (3)

1. A method of masking the structure of a communication network, which consists in the fact that for a communication network containing a set of X nodes of a communication network having IP _X addresses, initial data is pre-set containing information about the structure of a communication network, including a structural array [IP], an address security server IP _SB and the addresses of subscribers IP _a connected to the communication network, set for each x-th node of the communication network, where x = 1, 2, ..., X, the set of Y security parameters and their values b _xy , where y = 1 , 2, ..., Y, valid value

average safety indicator of the communication route, memory array

for storing the calculated values of the maximum possible MTU length of a message packet that can be transmitted without fragmentation by the communication network nodes belonging to the masking communication route

, calculate the integrated safety index

for each x-th node communication network formed adjacency matrix communications network vertices, which are stored in the structural array [IP] network node addresses communication IP _CSS and addresses of subscribers of the network connection IP _a network, and information of a link between nodes, and subscribers of the communication network, after which they form a set of possible communication routes between the i-th and j-th subscribers of the communication network, where i = 1, 2, ..., j = 1, 2, ... and i ≠ j, in the form of N _ij trees of the graph communication networks, and each n-th, where n = 1, 2, ..., N _ij , the graph tree consists of z _n vertices corresponding to the number of communication network nodes belonging to it, then for each of the N _ij possible communication routes, the average safety index is calculated

communication route as the arithmetic mean of complex safety indicators

communication network nodes included in the n-th communication route compare the values of the average safety indicators

communication routes with a predefined allowable value

, according to the results of comparison if

form valid communication routes

and remember them, otherwise, that is, if

form masking communication routes

and store them, calculate the MTU values of each node of the communication network belonging to the masking communication route

, and store them in a memory array, choose for

of each masking communication route, the terminator node G ^{T of the} IP packets of masking messages and store it, read from the memory array

the MTU value of the terminator node G ^{T of} IP packets of masking messages and remember it, form messages that include information about the stored masking communication routes

and MTU values of terminator nodes G ^{T of} IP packets of masking messages, send generated messages about stored masking communication routes

, the MTU values of the terminator nodes G ^{T of} IP packets of masking messages and are received by the i-th communication network subscribers, form masking messages containing masking information, fragment masking messages into F fragments, compare the length L _{f of} each f-th fragment with the received value MTU of the terminator node G ^{T of} IP packets of masking messages, and if the length L _f f-th fragment is less than or equal to the received MTU of the terminator node G ^{T of} IP packets of masking messages, defragment the masking messages to values of length L _f fragments greater than the accepted MTU value of the terminator node, otherwise, that is, if the length L _f f-th fragment is greater than the accepted MTU value of the terminator node G ^{T of the} IP packets of masking messages, the fragmentation of the IP packet of messages during its transmission over the communication network is prohibited , then the generated masking messages are transmitted along masking communication routes

characterized in that, in addition to the initial data, a memory array is set

for storing computed length values

each masking communication route

memory array

to store the intensity value

masking messages directed by the sender to the recipient for each masking communication route

memory array

to store the intensity value

masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

memory array

for storing the results of calculating the termination performance coefficient

masking messages for each masking communication route

, the value of the permissible coefficient of effectiveness of termination

masking messages and a memory array [T _ij ] for storing the current value of T ^tech astronomical time and the end time

transmission of masking messages for each masking communication route

, and after memorizing masking communication routes

calculate the length

each masking communication route

, store the length value

of each masking communication route to a memory array

, and after the prohibition of the fragmentation of the IP-packet of messages during its transmission over the communication network, the current value of T ^tech astronomical time and the end time value are stored in the memory array [T _ij ]

transmission of masking messages for each masking communication route

, then, after transmission of the generated masking messages along masking communication routes

, calculate the value of the intensity

IP packets of masking messages sent by the i-th sender to the j-th recipient for each masking communication route

, store the intensity value

IP packet masking messages in memory array

calculate the intensity value

IP packets of masking messages not terminated at the terminator node and received by the receiving subscriber for each masking communication route

, store the intensity value

IP packet masking messages in memory array

calculate the value of the termination efficiency coefficient

IP packets of masking messages for each masking communication route

memorize the value of the termination efficiency coefficient

IP packet masking messages in memory array

compare the values of the termination performance coefficient

IP packets of masking messages with the value of the permissible termination performance factor

IP packets of masking messages, and if

read the length value

communication masking route

from memory array

decrease the length value

per unit, a message is formed, including information about the length value reduced by one

communication masking route

the security server sends the generated message to the i-th subscriber of the communication network, receives the message by the i-th subscriber of the communication network, sets the i-th subscriber of the communication network in the "Time To Live" service field of the header of the IP packet of masking messages transmitted from the sender, a value equal to reduced by one length value

communication masking route

move on to transmission of masking messages along masking communication routes

otherwise, that is, if

pass to the transmission of masking messages along masking communication routes, compare in the memory array [T _ij ] the current value of T ^tech astronomical time and the end time value

transmission of masking messages for each masking communication route

and under the condition

generate a report containing information on the value of the termination performance coefficient

IP packets of masking messages for each masking communication route

, otherwise, that is, if

change the original data containing information about the structure of the communication network. 2. The method according to claim 1, characterized in that for calculating the length

each cloaking route

summarize the number of communication network nodes between the i-th and j-th subscribers. 3. The method according to claim 1, characterized in that the value of the termination efficiency coefficient

IP packets of masking messages for each masking communication route

calculated by the formula

Images