RU2509425C1 - Method and apparatus for controlling distributed information system data streams - Google Patents

Abstract

FIELD: radio engineering, communication.

SUBSTANCE: apparatus includes a response stream generating unit, a network configuration control unit, a switching unit, a switching table control unit, a switching table storage unit, an event detecting unit, a dynamic network configuration table control unit.

EFFECT: high security of distributed information systems by changing permitted data transmission routes and performing further analysis of unauthorised access streams by controlling node parameters.

2 cl, 6 dwg

Description

The inventions are united by a single inventive concept and relate to the field of ensuring information security, namely, to methods and means of controlling data flows in secure distributed information systems in order to prevent unauthorized users from accessing network information resources and services through distributed control of established network connections.

A known method of firewalling implemented in the "Device and method of firewalling" patent TW 243555, H04L 9/00, publ. 11.11.2005. The method consists in filtering unwanted network traffic by defining filtering rules for the protocols of the transport and network layers of the reference model of the relationship of open systems.

The disadvantage of this method is the lack of direct communication between the protocols of the upper application level and the target functions of the information system, which complicates the verification of filtering rules. This drawback is aggravated by the fact that it is impossible to determine unambiguously from the filtering rules which network interactions can be carried out and which cannot, because it depends on the sequence of events. Therefore, the use of firewalls to control data flows in distributed information systems and to control access to network services and resources is impractical.

There is also known a method of detecting intrusions according to the patent US 7424744, G06F 11/00, publ. 09.09.2008, “System and method for detecting intrusions based on signatures”. The method consists in filtering received packets according to filtering rules and comparing their signatures with existing profiles.

The disadvantages of this method are the inability to control data streams and the implementation of partial filtering of data streams.

Known "Network switch" patent WO 2008077320, H04L 12/28, publ. 07/03/2008, which manages data flows in a computer network by switching network packets. In the network switch, to determine the destination port of the transmitted network packets, a correspondence table is used between the switch ports and the network addresses of network devices connected to them.

A disadvantage of the known device is the switching of data streams without regard to security requirements and access restrictions.

The well-known "Network switch with access control" patent WO 2008128085, H04L 12/28, publ. 10/23/2008, which transmits data streams in a computer network in accordance with network packet security rules.

A disadvantage of the known device is the inability to control data flows and access control to network services and resources at the application level.

Closest to the technical nature of the proposed method is the "Method of managing data streams of secure distributed information systems in an encrypted communication network" patent RU No. 2402881, IPC H04L 9/32, publ. 10/27/2010, bull. No. 30. The prototype method consists in the following actions: set the switching table that defines the correspondence between the ports of the connection device and the network addresses of the devices connected to it, control the switching of network connections using a dynamic switching table that determines the allowed routes for transmitting data streams, and identify security events in the transmitted data stream temporarily block the flow of data when security events are detected, analyze the detected event to decide whether The transmission capabilities of the data stream associated with this event change the dynamic switching table depending on the rules of an additionally defined security policy, block the stream or transmit it as intended depending on the resolution of the network interaction that the dynamic switching table implements by this data stream.

The disadvantage of the prototype method is the relatively low security of the distributed information system, due to the fact that the control of data flows when safety events occur is only by blocking them, which can lead to new attempts of unauthorized access by the intruder, taking into account the information received about the protection system of the distributed information system.

The closest in technical essence to the claimed device is "Means of controlling data flows of protected distributed information systems in an encrypted communication network" patent RU No. 2402881, IPC H04L 9/32, publ. 10/27/2010, bull. No. 30. The closest analogue (prototype) of data flow control of protected distributed information systems in an encrypted communication network contains a switching unit, a storage unit for the switching table (the specified unit is called a switching table in the prototype), which establishes a correspondence between the ports of the facility and the network addresses of devices connected to it; the tool further includes an event detection unit, a dynamic switching table control unit and an access control center comprising a security policy module and an access control unit; at the same time, a dynamic switching table is included in the switching unit, which determines the allowed data transfer routes on the basis of which network switching is carried out, an event detection unit connected to the dynamic switching table control unit, which, in turn, is connected to the access control center, is connected to the switching unit containing an event detection unit and a security policy module.

The disadvantage of the prototype tool is the relatively low security of the distributed information system, due to the fact that the control of data flows when security events occur is only possible by blocking them, which can lead to new unauthorized access by the intruder, taking into account the information received about the protection system of the distributed information system.

The purpose of the claimed technical solutions is to develop a method and device for managing data flows of a distributed information system, which increase the security of distributed information systems by changing the allowed routes for transmitting data flows and performing additional analysis of unauthorized access flows by controlling the parameters (addresses and ports) of nodes, as well as introducing nodes of additional analysis.

In the claimed method, the goal is achieved by the fact that in the known method of managing data flows of protected distributed information systems, namely, in a distributed information system containing an analysis node, an analysis unit and an access control center, a switching table is predetermined that defines the correspondence between the connection ports to the network and network addresses of network nodes connected to the network, and also set the parameters of the distributed information system, identify security events in the received data stream, analyze them in order to decide on the admissibility of the data stream transmission associated with this event, and, if the data stream is permissible, it is transmitted as intended, in addition, a dynamic configuration table of the distributed information system is defined that determines the order of change of the parameters included in it network nodes. In addition, when detecting security events in a received data stream, it is compared with allowed streams in accordance with the switching table, and if they do not match, a response stream is generated to clarify the security event. Then it is transmitted for additional analysis, for which network addresses and port numbers are extracted from this stream in accordance with the dynamic configuration table and their values are compared with predefined parameters of the distributed information system. When they coincide, they form a new secure transmission route, for which they assign new addresses and port numbers to the network nodes of the distributed information systems. Then correct the switching table and the dynamic configuration table. If the parameters of the network nodes do not match, a repeated response data stream is formed with the allocated network addresses and port numbers.

The goal in the claimed device is achieved by the fact that in the known device for managing data flows of protected distributed information systems containing a switching unit, a storage unit for a switching table that defines the correspondence between network connection ports and network addresses of network nodes connected to a network, an event detection unit, a unit control table switching, the first information input of the switching unit is the input of the data stream of the device, and the first information output of the switching unit and connected to network nodes, the second control output of the switching unit is connected to an event detecting unit, the output of which is connected to the control input of the switching table control unit, the output of which is connected to the control input of the switching table storage unit, and the output of which is connected to the second information input of the switching unit, additionally introduced a network configuration management module, consisting of a unit for comparing parameters, a unit for generating signals of network configuration changes and a dynamic memory unit network configuration table, a module for generating a response stream, consisting of a block for transmitting a response stream, a unit for reading addresses and ports, a control unit for a dynamic table of a network configuration that determines the procedure for changing the parameters of network nodes. The first information input of the parameter comparison unit is connected to the information output of the switching unit, and the second information input is connected to the information output of the storage unit of the dynamic network configuration table. The first and second control outputs of the parameter comparison unit are connected to the control inputs of the switching unit and the signal generating unit of the network configuration changes, respectively. The second information input of the network configuration change signal generation unit is connected to the information output of the storage unit of the dynamic network configuration table, and the information output of the network configuration change signal generation unit is connected to network nodes. The control input of the control unit of the dynamic network configuration table is connected to the control output of the event detection unit, the control output of the control unit of the dynamic network configuration table is connected to the input of the storage unit of the dynamic network configuration table, the information output of which is connected to the information input of the address and port reading unit, the information output of which connected to the transmission block of the response stream, the information output of which is the output of the response data stream roystva.

Thanks to the new set of essential features in the claimed method and device, the specified technical result is achieved by changing the allowed routes for transmitting data streams and performing additional analysis of unauthorized access flows by controlling the parameters (addresses and ports) of the nodes, as well as introducing additional analysis nodes.

The claimed method is illustrated by drawings, which show:

figure 1 - diagram of a distributed information system (RIS);

figure 2 is a diagram explaining the formation of network addresses in the data stream depending on security events;

figure 3 is a diagram explaining the formation of a safe route depending on security events;

4 is a header structure of TCP message packets;

figure 5 is a flowchart of a method for controlling data streams of a distributed information system;

6 is a structural diagram of a data flow control device.

The implementation of the claimed method can be explained on the diagram of distributed information systems, shown in figure 1.

Distributed information system 2 is connected to an external network through an analysis unit. In general, distributed information system 2 is a collection of network nodes 2.1 ₁ -2.1 _N (routers, hubs, switches, PCs) [V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols (3rd edition). - SPb. - 2009, p. 57], access control center 3, analysis unit 4, additional analysis unit 5, united by physical communication lines. All these elements have identifiers, for which network addresses (IP addresses) are used in the most common TCP / IP protocol stack. An external network is represented by a set of routers that transport information flows from one RIS to another. An information stream, or data stream, is called a continuous sequence of data united by a set of common features that distinguish them from the general network traffic [V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols (3rd edition). - SPb. - 2009, p. 65].

In addition, the access control center 3 processes the security event upon receipt of a notification from the analysis unit 4 about the presence of a security event in the information flow. A security event is understood as an operation or action performed by a user or a program, leading to a change in data flows in a distributed information system. A security event is the identified occurrence of a certain state of a system, service or network, indicating a possible violation of security policy or a failure of protective measures, or the occurrence of a previously unknown situation that may be related to security [GOST R ISO / IEC 18044-2007, Information technology. Security methods and tools. Information Security Incident Management, p.2].

Next, the analysis unit 4 performs the change of the dynamic switching table in accordance with the system-wide security policy and sends the illegitimate information stream to the additional analysis node 5. The additional analysis node 5 changes the dynamic configuration table and generates a response information stream.

The structure of message packets is known, as is the principle of packet transmission in computer networks. For example, figure 2 shows the header structure of the TCP message packets, where the fields are highlighted: source ports and receiver ports of the message packet [RFC-793, Transmission Control Protocol 1981, September, pp. 8-12]. Packets arriving at the transport layer are organized by the operating system in the form of multiple queues to the entry points of various application processes. In TCP / IP terminology, system queues are called ports. For unambiguous identification of ports, port numbers are assigned to them.

Port numbers are used to address applications, if the processes are popular public services, such as FTP, telnet, HTTP, TFTP, DNS, etc., then they are assigned standard, assigned numbers, also called port numbers (Figure 2) . For some applications, port numbers are assigned by the operating system locally in response to a request from the application [V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols (3rd edition). - SPb. - 2009, p. 653].

When an information stream passes through an external network, it is routed from a source to a recipient in accordance with the destination IP address. A pair consisting of a network number and a node number is a network address. In TCP / IP technology, a network address is called an IP address [V. G. Olifer, N. A. Olifer. Computer networks. Principles, technologies, protocols (3rd edition). - SPb. - 2009, p. 653].

Figure 5 presents a block diagram of a sequence of actions that implement the algorithm of the method of controlling data flows FIG.

Initially, a switching table M and a dynamic configuration table K are formed according to the system-wide security policy (block 1, FIG. 5). In the switching table, the local or global sign (s) of the stream (for example, destination address) is assigned the port number to which the network node must transmit data related to this stream [V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols (3rd edition). - SPb. - 2009, p. 69]. The dynamic configuration table includes two tables, and in the first table the security event numbers are assigned the values of the addresses of network nodes and port numbers (Fig. 3), and in the second table, a safe route is formed to the required network node in accordance with the number of security events (Fig. four). After the switching table M and the dynamic configuration table K are generated, IP packets of the data stream P are received (block 2, FIG. 5).

Then, they verify the received data stream P in the analysis unit to resolve the requested interaction with the RIS network node according to the switching table (blocks 3, FIG. 5). If the transmission of the data stream P is allowed by the switching table, then it is transmitted according to the purpose according to the switching table to the requested RIS network node (block 4, FIG. 5). If the switching table does not allow the transmission of the data stream P to the requested network node, then the analysis unit 4 transfers the data stream P to the additional analysis node 5, where the network addresses S and port numbers R and are allocated from the data stream P (block 5-6, FIG. 5 )

Next, on the additional analysis node, they check for the presence in the RIS of the network addresses S allocated from the information stream P and the corresponding port numbers R (block 6-7, FIG. 5). If the network addresses S and the corresponding port numbers R exist in the FIG, then for these nodes, in accordance with the number of the security event, new network addresses and port numbers are determined according to the dynamic configuration table K (block 8, Fig. 5). Next, new parameters S, R are assigned to the nodes of the FIG network (block 9, FIG. 5). After that, a secure route is formed according to the configuration table K (Figure 4), for which each communication node RIS, depending on the number of security events, determines the corresponding transmission route L of the information stream (block 10, Figure 5). 1, the initial route 52, S3, S4 of information flow transmission in the absence of security events is shown in bold, and the new secure route is shown by the dashed line and includes network nodes S1, S6, S7.

Next, changes are made to the dynamic configuration table K and the switching table M (blocks 11-12 of Fig. 5) by first changing the used network addresses S and the corresponding port numbers R to new ones and secondly, deleting the network configuration options used from the first table . Then, a response stream F is generated to clarify the security event.

The method for managing data flows of a distributed information system described above is implemented using a data flow control device of a distributed information system.

The device, the structural diagram of which is shown in Fig.6, consists of interconnected switching unit (BC) 4, the memory unit of the switching table (BZTK) 3, which determines the correspondence between the ports of the network connection and the network addresses of network nodes connected to the network, the control module network configuration (MUKS) 2, consisting of a unit for storing a dynamic table of network configuration (BZDTK) 2.1, which determines the order of changing the parameters of network nodes, a unit for comparing parameters (BSP) 2.2, a unit for generating signals of configuration changes network network (BFSIKS) 2.3, an event detection unit (BDS) 5, a switching table control unit (BUTC) 7, a dynamic network configuration table control unit (BUDTKS) 6, a response stream generation module (MFOP) 1, consisting of an address reading unit and Ports (BSAP) 1.2, Response Stream Transmission Unit (BPOS) 1.1.

The first information input of BK 4 is the input of the data stream of the device, and the first information output of BK 4 is connected to network nodes, the second control output of BK 4 is connected to BDS 5, the output of which is connected to the control input of BUTK 7, the output of which is connected to the control input of BZTK 3, and the output of which is connected to the second information input of BC 4. The first information input of BSP 2.2 is connected to the information output of BC 4, and the second information input of BSP 2.2 is connected to the information output of BZDTKS 2.1. The first and second control outputs of the BSP 2.2 are connected to the control inputs of the BC 4 and BFSIKS 2.3, respectively. The second information input BFSIX 2.3 is connected to the information output of the BZDTK 2.1, and the information output BFSICS 2.3 is connected to the nodes of the network 2.1 ₁ - 2.1 _N. The control input of the BUDTKS 6 is connected to the control output of the BDS 5, the control output of the BUDTKS 6 is connected to the input of the BZDTKS 2.1, the information output of which is connected to the information input of the BSAP 1.2, the information output of which is connected to the BPO 1.1, the information output of which is the output of the response data stream of the device.

MOPOP 1 is designed to generate a response flow to the information flow that caused the security event. MFOP 1 consists of BOPO 1.1 and BSAP 1.2.

BSAP 1.2 is designed to receive data on current network addresses and port numbers recorded during a security event. BSAP 1.2 can be implemented in the form of a selection block described in patent RU No. 2313128, IPC G06F 17/30, publ. December 20, 2007, bull. Number 35.

BPOP 1.1 is intended for the formation of packets that make up the response stream. BPOP 1.1 can be implemented as a digital-to-analog converter, described in the literature [Veniaminov V.N., Lebedev O.N. and other microcircuits and their application. Handbook, 3rd ed. M., "Radio and Communications", 1989 - 167 p.].

MUKS 2 is designed to control information flows and change transmission routes by controlling the parameters of nodes. MUKS 2 consists of BZDTKS 2.1, BSP 2.2 and BFSIKS 2.3.

BZDTKS 2.1 is designed to record data on the procedure for changing the parameters of network nodes. BZDTKS 2.1 can be implemented using permanent storage devices described in the literature [Veniaminov VN, Lebedev ON and other microcircuits and their application. Handbook, 3rd ed. M., "Radio and Communications", 1989 - 152, 159 pp.].

BSP 2.2 is designed to compare the parameters of the incoming data stream with those existing in the FIG. BSP 2.2 can be implemented on comparison devices known and widely covered in the literature [Veniaminov VN, Lebedev ON and other microcircuits and their application. Handbook, 3rd ed. M., "Radio and Communications", 1989 - 235 p.].

BFSIKS 2.3 is designed to convert data on changed network addresses and port numbers and transfer them to the nodes of a distributed information system. BFSIKS 2.3 can be implemented as a digital-to-analog converter described in the literature [Veniaminov VN, Lebedev ON and other microcircuits and their application. Handbook, 3rd ed. M., "Radio and Communications", 1989 - 167 p.].

BZTK 3 is intended for recording correspondence data between network connection ports and network addresses of network nodes connected to the network. BZTK 3 can be implemented using read-only memory devices described in the literature [Veniaminov V.N., Lebedev O.N. and other microcircuits and their application. Handbook, 3rd ed. M., "Radio and Communications", 1989 - 152,159 p.].

BC 4 is designed to control information flows in accordance with the switching table, which determines the correspondence between the network connection ports and the network addresses of network nodes connected to the network, and the dynamic network configuration table, which determines the order in which the parameters of the network nodes included in it are changed. BK 4 can be implemented as a selection block described in patent RU No. 2313128, IPC G06F 17/30, publ. December 20, 2007, bull. Number 35.

BDS 5 is designed to record a security event. BDS 5 can be implemented in the form of indicating devices, well-known and widely covered in the literature (Veniaminov V.N. et al. Microcircuits and their application. Reference manual, 3rd ed. M., Radio and Communication, 1989 - 235 p.).

BUDTKS 6 is designed to change the data recorded in BZDTKS 2.1 by prohibiting the transmission of information flows along routes consisting of network addresses and the corresponding port numbers that were determined when the security event was recorded. BUDTKS 6 can be implemented in the form of microprocessors (memory management devices), well-known and widely covered in the literature (Veniaminov V.N. et al. Chips and their application. Reference manual, 3rd ed. M., “Radio and communications” , 1989 - 161-165 s.).

BUTK 7 is designed to change the data recorded in the BZTK 3 by prohibiting the use of network addresses and the corresponding port numbers that were determined when the security event was recorded. BUTK 7 can be implemented in the form of microprocessors (memory management devices), well-known and widely covered in the literature (Veniaminov VN et al. Chips and their application. Reference manual, 3rd ed. M., “Radio and communication” , 1989 - 161-165 s.).

The claimed device operates as follows, the first input of the BC 4 receives a data stream, which, through the appropriate control action, transfers to its first output, which is connected to the network nodes. The second output of BK 4 is connected to BDS 5, the output of which is connected to BUTK 7, from the output of which commands are issued to the input of BZTK 3 to change it, and the second and third inputs from BZTK 3 and BZDTKS 2.1 respectively receive data determining the correspondence between the connection ports to the network and network addresses of network nodes connected to the network, as well as determining the order of changing the parameters of network nodes, after comparison, control actions are issued to the first and second outputs, which are connected to BC 4 and BFSIKS 2.3, respectively. The second output of BFSIKS 2.3 is connected to BZDTKS 2.1, and its output is connected to network nodes, from which changes in the parameters of network nodes recorded in BZDTKS 2.1 are transmitted. According to the control action of the BSP 2.2, the control action is detected at the input of the BUDTKS 6 from the BDS 5, according to which a control action is taken from the output of the BUDTKS 6 to the input of the BZDTKS 2.1 to form a new safe transmission route, the output of the BZDTKS 2.1 is connected to the BSAP 1.2, with whom he reads out the selected network addresses and port numbers, the output of which is connected to the BPO 1.1, from the output of which a response data stream is transmitted using the received current network addresses and port numbers.

Thus, the claimed method and device by changing the allowed routes for transmitting data streams and performing additional analysis of unauthorized access flows by controlling the parameters (addresses and ports) of the nodes, as well as introducing additional analysis nodes, can provide increased security for distributed information systems.

Claims (2)

1. The method of managing data flows of a distributed information system, which consists in the fact that in a distributed information system containing an additional analysis node, an analysis unit and an access control center, a switching table is preliminarily defined that defines the correspondence between the network connection ports and the network addresses connected to the network network nodes, and also set the parameters of a distributed information system, identify security events in the received data stream, analyze them in order to make decisions about the admissibility of transmitting the data stream associated with this event, and, if the transmission of the data stream is permissible, transmit it as intended, characterized in that it additionally sets up a dynamic configuration table of a distributed information system that determines the order in which the parameters of the network nodes included in it, detection of security events in the received data stream, compare it with the allowed flows in accordance with the switching table, if they do not match, a response stream is generated to clarify the security event and send it for additional analysis, for which network addresses and port numbers are extracted from this stream in accordance with the dynamic configuration table, their values are compared with the predefined parameters of the distributed information system, and if they coincide, they form a new secure transmission route, for which they are assigned network nodes of a distributed information system with new addresses and port numbers, after which they correct the switching table and the dynamic configuration table, and if there is a mismatch parameters of network nodes forming a second response data stream with the selected network addresses and port numbers. 2. The data flow control device of a distributed information system, comprising a switching unit, a memory unit for a switching table that defines the correspondence between network connection ports and network addresses of network nodes connected to a network, an event detection unit, a switching table control unit, the first information input of the switching unit is the input of the device data stream, and the first information output of the switching unit is connected to network nodes, the second control output of the switching unit is connected to the block m event detection, the output of which is connected to the control input of the control unit of the switching table, the output of which is connected to the control input of the storage unit of the switching table, and the output of which is connected to the second information input of the switching unit, characterized in that a network configuration control module is additionally introduced, consisting of a unit for comparing parameters, a unit for generating signals of network configuration changes and a unit for storing a dynamic network configuration table, a response generating unit a flow consisting of a response flow transmission unit, an address and port reading unit, a control unit for a dynamic network configuration table defining a procedure for changing parameters of network nodes, the first information input of the parameter comparison unit is connected to the information output of the switching unit, and the second information input is connected to the information output unit for storing a dynamic table of network configuration, the first and second control outputs of the parameter comparison unit are connected to control inputs, respectively but the switching unit and the network configuration change signal generating unit, the second information input of the network configuration changing signal generating unit is connected to the information output of the storage unit of the dynamic network configuration table, and the information output of the network configuration changing signal generating unit is connected to network nodes, the control input of the dynamic control unit network configuration table is connected to the control output of the event detection unit, the control output of the dynamics control unit eskoy network configuration table connected to the input unit dynamic table storing network configuration information output of which is connected to data input of the read addresses and ports, information output of which is connected with the response unit transmitting the stream data output which is the output data stream of the response unit.

Images