RU39416U1 - DEVICE FOR CONTROL OF INTEGRITY AND PRIVACY OF NETWORK FRAME - Google Patents

Abstract

The proposed device relates to the field of computer technology, and in particular to systems for protecting information from unauthorized access. One of the main threats to unauthorized access to information transmitted over a local area network (LAN) is the misuse of protocol analyzers. Protocol analyzers are connected to the LAN as well as workstations and have the ability to copy all network traffic. A feature that makes it difficult to counter the malicious use of protocol analyzers is their passivity with respect to the distribution environment. The methods used to protect information from unauthorized access in the LAN distribution environment are mainly based on the cryptographic protection of files and packages intended for transmission. The proposed device provides an additional service in ensuring the security of information during network exchange. The technical solution is based on the principle of calculating the network frame checksum using the CRC-32 algorithm with a variable polynomial value. The polynomial value is changed by the proposed device at legitimate LAN workstations at the set moments of synchronized system time according to a single rule. Moreover, the network frame integrity control scheme is additionally used to ensure the confidentiality of information. The network frame is transmitted over the LAN distribution environment with a checksum value different from that which can be calculated on an illegitimate workstation using a standard

Description

The proposed device relates to the field of computer technology, and in particular to systems for protecting information from unauthorized access.

One of the common tools used for unauthorized access to information transmitted over a local area network is a protocol analyzer. The protocol analyzer is a software and hardware tool that connects to the local area network distribution environment and is designed to localize malfunctions and abnormal operating modes of network equipment by intercepting and analyzing the network graph. Most well-known protocol analyzers have the ability to copy both the entire network diagram and network frames that meet the specified filtering criteria, as well as buffer captured network frames, visualize and analyze them to restore the original information (files).

The unlawful use of protocol analyzers is a real threat to the confidentiality of information transmitted over a local area network. The protocol analyzer is connected to the network as well as the workstation. The difference is that if a regular network workstation is able to receive only broadcast network frames, or network frames addressed directly to it, then the protocol analyzer is able to copy the entire network diagram of the local area network distribution environment. For this, in analyzers

protocols, network adapters are used that support the promiscuous mode of network frames at the hardware or software level.

Network Monitor protocol analyzers manufactured by Microsoft, WinPcap, ScoopLm, WinDump, THC-parasite, SpyNet, Sniffer Pro LAN, Sniffer Basic, Packet Tracer, Iris, Hoppa Analyzer, CommView, ASniffer are currently the most widely used.

The methods used to protect information from unauthorized access in the distribution environment of a local area network (see, for example, A.V.Sokolov, O.M. Stepanyuk "Protection against computer terrorism", Reference manual - St. Petersburg: BHV - Petersburg: Arlet, 2002 ) are based mainly on the use of cryptographic information protection.

A feature of protocol analyzers, which greatly complicates the counteraction to their malicious use, is their passivity with respect to the signal propagation environment. To detect an illegitimate analyzer in a local area network, special monitoring tools are used (see, for example, John Chirillo "Protection against hackers" - St. Petersburg: publishing house "Peter", 2002, p.249). However, if you uninstall all standard protocols of the network level and higher on an illegitimate workstation, the protocol analyzer installed on this station will work only in the mode of intercepting and accumulating intercepted network frames at the channel level. Moreover, the analyzer during its operation will not respond to control network frames at the network level. In this case, special control software is not able to detect an illegitimate protocol analyzer.

To ensure network exchange in a local Ethernet computer network, network adapters that support IEEE 802.2 and 802.3 standards are used (see, for example, V.G. Olifer, N.A. Olifer, "Computer Networks.

Principles, technologies, protocols: textbook for universities. 2nd edition "- St. Petersburg: publishing house" Peter ", 2003). These standards imply integrity control of network frames transmitted in the distribution environment of a local area network using a checksum calculated using the Cyclic Redundancy algorithm of 32-bit cyclic redundancy coding Code (CRC-32) with a polynomial value of degree 32 equal to G (x) = x ³² + x ²⁶ + x ²³ + x ²² + x ¹⁶ + x ¹² + x ¹¹ + x ¹⁰ + x ⁸ + x ⁷ + x ⁵ + x ⁴ + x ² + x + 1. In cases where the checksum calculated for the network frame received in the corresponding adapter by the network adapter does not match value corresponds to the checksum value located in the Frame Check Sequence field of the network frame, the latter is marked by the network adapter as failed and is not transmitted for further processing to the network layer communication protocols. Information that the network frame is rejected is transmitted to the channel layer protocols by transmitting the network status word frame, which is formed by the network adapter in the corresponding register.

Network adapters serve the interface between network protocol protocols and the distribution environment and use both software and firmware control. When exchanging network frames between programs that implement network protocols and network adapters, the latter mainly use software control from operating system drivers. When exchanging network frames between the distribution medium and network adapters, the latter mainly use microprogram control from their own control circuits located in network adapters. Both software and firmware management of network adapters can be intercepted, which is used in the proposed device in order to implement an additional function of ensuring information security.

The purpose of the developed device is to prevent unauthorized copying and modification of network frames in the distribution environment of the local area network, the collection of network packets, segments and files from unauthorized intercepted in the network distribution environment.

This goal is achieved by the fact that when calculating the checksum of the network frame using the CRC-32 algorithm, a dynamic change in the value of a polynomial of degree 32 is used. The specified change is carried out by the proposed device on legitimate workstations of the local computer network at set times of synchronized system time according to a single rule. Before transmitting the network frame, the device calculates the checksum using the current value of the polynomial. When receiving a network frame from a distribution medium, the device calculates a checksum for the received network frame using the current polynomial value. The device takes into account the possibility of changing the polynomial value during the transmission of a network frame over a distribution network. For this, it is possible to check the checksum for the received network frame against the previous polynomial value. The device checks the integrity and legitimacy of the received network frame by checking the identity obtained in the network frame and calculated for the network frame checksums. The transmission of the network frame to the MAC sublayer of the data link layer is carried out by the device in case of coincidence of the checksums. If the checksums do not match, the device generates a sign of a bad frame, which blocks the transmission of the network frame to the MAC sublayer of the data link layer.

The proposed device provides active opposition to unauthorized copying of a network frame from the distribution environment of a local area network. This security function is provided in that the transmission of the network frame is carried out by

the distribution environment of a local computer network with a checksum value that does not correspond to that which will be calculated on an illegitimate workstation of a local computer network that uses the standard value of the polynomial G (x) = x ³² + x ²⁶ + x ²³ + x ²² in calculating the network frame checksum + x ¹⁶ + x ¹² + x ¹¹ + x ¹⁰ + x ⁸ + x ⁷ + x ⁵ + x ⁴ + x ² + x + 1. As a result of this, if an unauthorized interception is attempted, the network frame will be identified at the illegitimate station as failed and will not be considered as an interception object.

The device indirectly verifies that the network frame checksum is calculated using the polynomial generated according to the established rules at a legitimate station, which ensures timely detection of the fact of modification of network frames and blocking the transmission of unauthorized modified network frames from the physical layer to the MAC sublayer of the data link layer.

The above information protection mechanism, implemented in the proposed device, in known means and systems for protecting information from unauthorized access in a local area network is not applied, which allows us to conclude that the claimed technical solution meets the criterion of "novelty."

The proposed device implements an algorithm for monitoring the integrity of a network frame established by the IEEE 802.3 (Ethernet) standard in addition to ensure the confidentiality of information transmitted over a distribution medium. An attacker’s knowledge of the rules by which the polynomial values are formed, as well as the availability of a sample of the proposed device at his disposal, are not sufficient conditions for the implementation of unauthorized access to information through the local area network distribution environment. A prerequisite is the synchronization of system time on an illegitimate station and on a LAN server. When trying to synchronize an illegitimate station can be detected by special software

control, which will allow the security administrator to take adequate organizational countermeasures.

The specified property allows us to conclude that the proposed technical solution meets the criterion of "inventive step".

The principle of operation of the proposed device is illustrated in graphic materials, where figure 1 shows a block diagram of the device.

In figure 1 is indicated:

1 - network adapter, which includes:

2 - network frame status register;

3 - network frame buffer;

4 - a device for monitoring the integrity and confidentiality of a network frame, including:

5 - block analysis of the conditions for changing the polynomial;

6 - delay line;

7 - polynomial former;

8 - polynomial register;

9 - additional register of the polynomial;

10 - polynomial selector;

11 - control unit;

12 is a block checksum calculation, including:

13 - shift register accumulation of the checksum;

14 - shift data register;

15 - adder;

16 is a comparison diagram.

The proposed device has the following functional relationships. The integrity and confidentiality control device of the network frame 4 is connected by a hinged installation to the network adapter 1, which includes the status register of the network frame 2 and the buffer of the network frame 3.

The unit for analyzing the conditions for changing polynomial 5 through sequentially connected generator of polynomial 7, register of polynomial 8, selector of polynomial 10, adder 15, shift register accumulating checksum 13, comparison circuit 16 and control unit 11 is connected to the selector of polynomial 10, through delay line 6, register polynomial 8 with an additional register of polynomial 9, and through the last one with one of the inputs of the selector of polynomial 10. The output of the control unit 11 through a sequentially connected shift data register 14, shift register accumulation of checksum 13 is connected to the input of the adder 15. The network frame buffer 3 of the network adapter 1 is connected to the inputs of the shift data register 14, control unit 11, comparison circuit 16. One of the outputs of the shift accumulation register of the checksum 13 is connected to the buffer input of the network frame 3 of the network adapter 1. One of the outputs of the control unit 11 is connected to the input of the status register of the network frame 2 of the network adapter 1.

Device integrity and confidentiality of the network frame 4 operates as follows.

The unit for analyzing the conditions for changing the polynomial 5 verifies the fulfillment of the conditions for changing the polynomial, determined by the security administrator and depending on the state of the device. The unit for analyzing the conditions for changing polynomial 5 operates in two modes.

The first mode of operation of the unit for analyzing the conditions for changing polynomial 5 is set automatically when the device is initialized. The duration of the unit for analyzing the conditions for changing polynomial 5 in the first mode is set in the device settings and can take a value from one to thirty minutes. A specific value is set by the security administrator when configuring the device based on an analysis of the time required to load operating systems and synchronize system time on workstations and the LAN server.

In the first operating mode, the polynomial change condition analysis block 5 blocks the polynomial 7 former, as a result of which the polynomial register 8 contains the constant 04C11DB7 _16cc , which corresponds to the standard degree polynomial 32 for Ethernet protocols:

G (x) = x ³² + x ²⁶ + x ²³ + x ²² + x ¹⁶ + x ¹² + x ¹¹ + x ¹⁰ + x ⁸ + x ⁷ + x ⁵ + x ⁴ + x ² + x + 1.

The second mode of operation of the unit for analyzing the conditions for changing the polynomial 5 is set automatically after the time set for the first mode. The unit for analyzing the conditions for changing polynomial 5 in the second mode is carried out until the device is turned off or initialized.

In the second mode of operation, the unit for analyzing the conditions for changing the polynomial 5 after the time interval specified in the device parameters has expired and provided that the device is not busy calculating the checksum of the network frame, generates a polynomial change signal. The value of the specified time interval is selected by the security administrator when configuring the device and can take values from one to sixty minutes. If, at the end of the set time interval, the device is busy calculating the checksum of the network frame, the polynomial change signal is generated after completion of the current frame processing. From the output of the block for analyzing the conditions for changing polynomial 5, the signal for changing the polynomial is fed to the input of the shaper of polynomial 7, to the input of recording control of the register of polynomial 8, and, through the delay line 6, to the input of recording control of the additional register of polynomial 9.

When a polynomial change signal arrives at the recording control input of additional register 9, the 32-bit value of the register of polynomial 8 is copied to the 32-bit additional register of polynomial 9.

When a polynomial change signal arrives at the input of the polynomial 7 former, the latter generates a 32-bit constant, which is a derivative of the value of the current system time and a new value

polynomial. The formed constant on the 32-bit output bus of the shaper of polynomial 7 goes to the inputs of the register of polynomial 8.

The new polynomial value is written from the polynomial shaper 7 to the polynomial 8 register by the polynomial change signal coming from the output of the block for analyzing the conditions for changing the polynomial 5 through the delay line 6 to the control input of the register of the polynomial 8. The delay line 6 provides the delay necessary to generate a new value polynomial shaper of polynomial 7, as well as to transfer the old value of the polynomial from the register of polynomial 8 to the additional register of polynomial 9.

From the outputs of the register of polynomial 8 and the additional register of polynomial 9, the information corresponding to the new and old value of the polynomial is fed to the inputs of the polynomial selector 10. The switching of inputs of the selector of the polynomial 10 with its output is controlled by the control unit 11. By default, the control unit 11 determines the transfer to the output selector polynomial 10 information from the input, taking the new value of the polynomial. The transfer of the old polynomial value to the output of the polynomial selector 10 is set by the control unit 11 only if the mismatch of the calculated checksum value for the network frame received from the LAN propagation medium is detected last and the process of calculating the network frame checksum is performed a second time.

From the output of the polynomial selector 10, the polynomial via a 32-bit bus goes to the first input of the adder 15 of the checksum calculation unit 12. The second input of the adder 15 receives the 32 least significant bits of the 33-bit shift register for accumulating the checksum 13.

The checksum calculation unit 12 provides the CRC-32 algorithm for calculating the network frame checksum with the polynomial value obtained from the polynomial selector 10. The control unit 11 provides synchronization of all nodes of the device and generation of control signals and

timing for the checksum calculation unit 12. The control unit 11 takes control from the network adapter 1 when receiving a network frame from a LAN distribution medium, as well as when preparing a network frame for transmission to a distribution medium.

Before the start of a zero clock cycle of the checksum calculation unit 12, the control unit 11 blocks the transmission bus of the polynomial shift signal from the polynomial change condition analysis unit 5 and initiates the reset shift register accumulation of the checksum 13 and 1514-byte shift data register 14.

A network frame intended for transmission over a LAN distribution medium, or received from a LAN distribution medium, is located in the buffer of the network frame 3 of the network adapter 1.

At the zero clock cycle of the checksum calculation unit 12, the network adapter 3 is transferred from the network frame 3 buffer to the data shift register 14 of the network frame fragment, which includes all fields starting from the Destination Address field and ending with the data field inclusive. In this case, the filling of the shift data register 14 is carried out from the higher digits. In the same cycle, the value of the network frame length field is transmitted to the control unit 11, which is used to calculate the number of subsequent cycles for calculating the checksum. To calculate the checksum, the control unit 11 sets the value of the internal clock counter equal to the value 32 larger than the bit size of the network frame fragment copied from the network frame buffer 3 of the network adapter 1 into the shift data register 14.

Each subsequent clock cycle of the checksum calculation unit 12 begins with a check by the control unit 11 of the value of the highest order of the shift register of the accumulation of the checksum 13.

In the case when the high order bit of the shift accumulation register of the checksum 13 has a zero value, the control unit 11 initiates a shift of the information of the shift register of the accumulation of the checksum

sum 13 and shift data register 14 one bit to the left. In this case, the highest bit of the shift register of the accumulation of the checksum 13 is lost, the highest bit of the shift register of the data 14 is transferred to the lowest bit of the shift register of accumulation of the checksum 13, the least significant bit of the shift register of data 14 is filled with zero. This completes the work of the beat.

In the case when the highest bit of the shift register of accumulation of the checksum 13 has a single value, the control unit 11 initiates the sequential execution of the following operations: bitwise addition modulo 2 in the adder 15, transferring the 32-bit result of addition to the lower bits of the shift register of accumulation of the checksum 13 , shifting the information of the shift register of the accumulation of the checksum 13 and the shift register of the data 14 by one bit to the left. When performing the last specified operation, the highest bit of the shift register of the accumulation of the checksum 13 is lost, the highest bit of the shift register of the data 14 is transferred to the lowest bit of the shift register of accumulation of the checksum 13, the least significant bit of the shift register of data 14 is filled with zero. This completes the work of the beat.

After completing the last check sum cycle in the lower 32 bits of the shift accumulation register of the checksum 13, the network frame checksum is found.

After calculating the checksum, the operation of the device depends on whether the network frame is received from the LAN distribution environment or is intended for transmission to the distribution environment.

In the case when the network frame is intended for transmission to the distribution medium, the control unit 11 initiates the sequential execution of the following operations: transfer of the lower 32 bits of the shift register of accumulation of the checksum 13 to the buffer of the network frame 3 of the network adapter 1 at the location of the network checksum field

frame (Frame Check Sequence); unlocking the bus for transmitting the polynomial change signal from the block for analyzing the conditions for changing the polynomial 5; returning control to the network adapter 1.

In the case when the network frame is received from the local area network distribution medium, the control unit 11 initiates the sequential execution of the following operations: transferring the lower 32 bits of the shift register of the accumulation of the checksum 13 to the first input of the comparison circuit 16; transfer of 32 bits of the Checksum field (Frame Check Sequence) from the buffer of the network frame 3 of the network adapter 1 to the second input of the comparison circuit 16; analysis of the comparison result. If the checksums are identical, then the control unit 11 unlocks the polynomial change signal transmission bus from the polynomial change condition analysis unit 5 and returns control to the network adapter 1. If the checksums do not match, the control unit 11 switches the output of the polynomial 10 selector to the polynomial value from additional register of polynomial 9 and repeats the procedure for calculating the checksum. If the checksums also do not match during the recalculation, the control unit 11 transmits a sign of a bad reception of the frame to the input of the status register of the network frame 2 of the network adapter 1, removes the block from the transmission bus of the polynomial change signal from the polynomial change condition analysis unit 5 and returns control to the network adapter 1 .

Claims (1)

Integrity and confidentiality control device for a network frame connected to an IEEE 802.3 (Ethernet) network adapter, which includes a network frame buffer and a network frame status register, characterized in that it also includes an analysis unit for changing polynomial conditions, a delay line, a shaper polynomial, register of polynomial, additional register of polynomial, polynomial selector, control unit, checksum calculation unit, consisting of a shift register for accumulating a checksum, a shift register for data, adder, comparison circuit, and the output of the block for analyzing the conditions for changing the polynomial sequentially through the polynomial shaper, polynomial register, polynomial selector, adder, shift accumulation register of the checksum, the comparison circuit is connected to the input of the control unit, one of the outputs of the latter is connected to the input of the polynomial selector , the second input of which through the delay line, the polynomial register is connected in series, the additional polynomial register is connected to the output of the analysis unit of the conditions for changing the polynomial, and the last output о is also connected to the second input of the additional register, while the second output of the control unit is connected via a shift data register, the shift accumulation register of the checksum is connected to the second input of the adder, the third output of the control unit is connected to the input of the status register of the network frame of the network adapter, network buffer outputs the frame of the network adapter is connected to the inputs of the shift data register, the comparison circuit, and the control unit, and one of the outputs of the shift register of accumulation of the control sum is connected to the input of the network adapter frame buffer.