Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
231
In most cases, both encryption and integrity control play a deeply
infrastructural role, remaining transparent to both applications and users. A
typical place for these security services is at the network and transport levels
of the implementation of the network protocol stack.
There are two main encryption methods:
1) symmetrical,
2) asymmetrical.
With symmetric encryption, the same key (kept secret) is used to both
encrypt and decrypt data. Very effective (fast and reliable) symmetric
encryption methods have been developed.
The main disadvantage of symmetric encryption is that the secret key
must be known to both the sender and the recipient. On the one hand, this
creates a new key distribution problem. On the other hand, the recipient,
based on the presence of an encrypted and decrypted message, cannot prove
that he received this message from a specific sender, since he could have
generated the same message himself.
Asymmetric methods use two keys. One of them, unclassified (it can
be published along with other public information about the user), is used for
encryption, the other (secret, known only to the recipient) is used for
decryption. The most popular of the asymmetric ones is the RSA method
(Rivest, Shamir, Adleman), based on operations with large (say, 100-digit)
prime numbers and their products.
A significant disadvantage of asymmetric encryption methods is their
low performance, so these methods must be combined with symmetric ones
(asymmetric methods are 3–4 orders of magnitude slower). Thus, to solve
the problem of effective encryption with the transfer of the secret key used
by the sender, the message is first symmetrically encrypted with a random
key, then this key is encrypted with the recipient’s public asymmetric key,
after which the message and the key are sent over the network [3].
232
Integrity control
Cryptographic methods make it possible to reliably control the
integrity of both individual pieces of data and their sets (such as a message
flow); determine the authenticity of the data source; guarantee the
impossibility of refusing committed actions — “non-repudiation”.
Cryptographic integrity control is based on two concepts:
• hash function;
• electronic digital signature (EDS).
A hash function is a hard-to-reversible data transformation (one-way
function), usually implemented by means of symmetric encryption with
block linking. The result of encryption of the last block (depending on all
previous ones) serves as the result of the hash function.
Let there be data whose integrity needs to be checked, a hash function
and the previously calculated result of its application to the original data (the
so-called digest). Let’s denote the hash function by h, the source data by T,
and the data being checked by T'. Data integrity control comes down to
checking the equality h(T') = h(T). If it is satisfied, it is considered that T' =
T. The coincidence of digests for different data is called a collision. In
principle, collisions are, of course, possible, since the power of the set of
digests is less than the power of the set of hashed data, but the fact that h is
a one-way function means that it is impossible to specially organize a
collision in an acceptable time.
6.4.5. Shielding
The mechanism for ensuring data integrity in information and
computer networks is shielding, which performs the functions of delimiting
information flows at the border of the protected network. On the one hand,
this increases the security of internal network objects by ignoring
unauthorized requests from the external environment. The above reduces
233
the vulnerability of internal objects because a third-party intruder must
overcome some protective barrier — a firewall, in which IS mechanisms are
configured especially carefully and strictly. On the other hand, shielding
allows you to control information flows emanating from the external
environment, which increases the confidentiality regime of the AS. In
addition to access control functions, shielding ensures registration of
information exchanges.
Shielding functions are performed by a firewall, which is understood
as a software or hardware-software system that controls information flows
entering and/or leaving the AS and provides protection for the AS by
filtering information. Information filtering consists of analyzing information
based on a set of criteria and making a decision on its distribution to/from
the AS.
In general, a firewall performs its functions by controlling all
information flows between two network segments or networks.
Firewalls are classified as follows:
1) external and internal, providing protection respectively from the
external network or protection between network segments;
2) according to the filtering level corresponding to the OSI/ISO
reference model.
Speaking about external and internal firewalls, the following should
be noted. External ones usually deal only with the TCP/IP protocol of the
Internet. For internal firewalls, multi-protocol may occur.
The operation of all firewalls is based on the use of information from
different levels of the OSI model (Table 6.4). In general, the higher the level
of the OSI model at which a firewall filters packets, the higher the level of
protection it provides.
Firewalls are divided into four types:
• firewalls with packet filtering;
• session level gateways;
• application level gateways;
• expert-level firewalls.
234
Table 6.4
Firewall types and ISO/OSI model levels
OSI Model Layer
Internet protocols
Firewall type
Applied
Telnet, FTP, DNS,
NFS, PING, SMTP,
HTTP
Application Gateway
Expert level firewall
Data Views
Session
TCP, UDP
Session Gateway
Transport
TCP, UDP
–
Network
IP, ICMP
Firewall with packet filtering
Duct
–
–
Physical
–
–
1. Packet-filtering firewalls are routers or server-based programs
configured to filter incoming and outgoing packets. Therefore, such screens
are sometimes called packet filters. Filtering is carried out by analyzing the
source and destination IP addresses, as well as the ports of incoming TCP
and UDP packets and comparing them with the configured rules table.
These systems are easy to use, cheap, and have minimal impact on AS
performance. The main disadvantage is their vulnerability to IP spoofing —
replacing IP addresses. In addition, they are complex to configure: their
installation requires knowledge of network, transport and application
protocols.
2. Circuit-level gateways control the admissibility of a communication
session. They monitor the handshake between an authorized client and an
external host (and vice versa), determining whether the requested
communication session is valid. When filtering packets, a session layer
gateway relies on information contained in the TCP session layer packet
headers, i.e., it operates two layers higher than a packet filtering firewall. In
addition, these systems usually have network address translation functions,
which hide internal IP addresses, i.e., eliminate IP spoofing. However, since
systems only monitor packets at the session level, there is no control over
235
the contents of packets generated by various services. To eliminate this
drawback, application level gateways are used.
3. Application-level gateways inspect the contents of every packet
passing through the gateway and can filter certain types of commands or
information in the application-level protocols that they are tasked with
serving. This is a more advanced and reliable type of firewall that uses
application layer proxies or agents. Agents are compiled for specific Internet
services (HTTP, FTP, telnet, etc.) and are used to check network packets for
the presence of reliable data. However, application level gateways degrade
system performance due to reprocessing in the proxy. This is imperceptible
when working on the Internet due to the narrowness of communication
channels, but it is significant when working on an internal network —
Intranet. The disadvantages include the need (and therefore additional time
and economic costs) to develop new intermediary programs when
introducing a new Internet service.
4. Stateful inspection firewalls combine elements of all three
categories described above. Like packet filtering firewalls, they operate at
the network layer of the OSI model, filtering incoming and outgoing packets
based on inspection of IP addresses and port numbers. Expert-level firewalls
also act as a session-level gateway, determining whether packets belong to
the appropriate session. Finally, expert firewalls take on the role of an
application gateway, evaluating the contents of each packet according to the
organization’s security policy.
The specificity of these firewalls is that to ensure protection they
intercept and analyze each packet at the application level of the OSI model.
Instead of using application-specific middleware, expert firewalls use
specialized algorithms to recognize and process data at the application
level. These algorithms compare packets to known data patterns, which
should theoretically provide more efficient packet filtering.
Because expert-level firewalls allow direct communication between
an authorized client and an external host, they have less of a performance
impact than application-level gateways. The question remains controversial:
236
whether they provide less security to the AS compared to application-level
gateways or not [2].
6.4.6. Antivirus protection [15]
It is known that it is impossible to achieve 100 % protection of a PC
from computer viruses using separate software. Therefore, to reduce the
potential danger of introducing computer viruses and their spread through
the corporate network, an integrated approach is required, combining
various administrative measures, software and hardware anti-virus
protection, as well as backup and recovery tools. Focusing on software and
hardware, we can distinguish three main levels of anti-virus protection:
1. Search and destruction of known viruses.
2. Search and destruction of unknown viruses.
3. Blocking the manifestation of viruses.
When searching for and destroying known viruses, the most common
method is scanning. This method consists of identifying computer viruses
by their unique fragment of program code (signature, software strain). To
do this, a scanning database is created with code fragments of known
computer viruses. Virus detection is carried out by comparing computer
memory data with fixed codes in the scanning database. If a new virus code
is detected and identified, its signature can be entered into the scanning
database. Since the signature is known, it is possible to correctly restore
(disinfect) infected files and areas. It should be added that some systems do
not store the signatures themselves, but, for example, checksums or
signature prefixes.
Antivirus programs that detect known computer viruses are called
scanners or detectors. Programs that include functions for recovering
infected files are called polyphages (phages), doctors or disinfectors. An
example of a polyphage scanner is the familiar Aidstest program.
It is customary to divide scanners into the following:
• transit, periodically launched to identify and eliminate viruses;
237
• resident (permanently located in RAM), checking specified areas of
system memory when events associated with them occur (for example,
checking a file when it is copied or renamed).
The disadvantages of scanners include the fact that they can detect
viruses that have already penetrated computer systems, have been studied
and a signature has been determined for them. For scanners to operate
effectively, it is necessary to promptly update the scanning da tabase.
However, as the size of the scanning database and the number of different
types of viruses searched increases, the speed of anti-virus scanning
decreases. Of course, if the scanning time approaches the recovery time,
then the need for anti-virus control may become less relevant.
Some viruses (mutants and polymorphic) encode or modify their
program code. This makes it difficult or impossible to identify a signature
and, therefore, to detect viruses by scanning.
To identify these masquerading viruses, special methods are used.
These include the processor emulation method. The method involves
simulating the processor’s execution of a program and feeding the virus
fictitious control resources. The virus, deceived in this way and under the
control of the antivirus program, decrypts its code. The scanner then
compares the decrypted code with codes from its scanning database.
Search and destruction of unknown viruses
Identification and elimination of unknown viruses are necessary to
protect against viruses missed by the first level of anti-virus protection. The
most effective method is to monitor system integrity (change detection).
This method consists of checking and comparing the current parameters of
a computer system with reference ones corresponding to its uninfected state.
It is clear that integrity control is not the exclusive prerogative of the antivirus protection system. It ensures the security of an information resource
from unauthorized modifications and deletion as a result of various types of
illegitimate influences, failures and failures of the system and environment.
238
To implement these functions, programs called auditors are used. The
auditor’s work consists of two stages: recording the reference characteristics
of the computing system (mainly the disk) and periodically comparing them
with the current characteristics. Commonly monitored characteristics are
checksum, length, time, read-only attribute of files, directory tree, failed
clusters, disk boot sectors. In network systems, average statistical
parameters of the functioning of subsystems (in particular, the historical
profile of network traffic) can be accumulated, which are compared with the
current ones.
Auditors, like scanners, are divided into transit and resident.
The disadvantages of auditors — primarily residents, include all sorts
of inconveniences and difficulties they create in the user’s work. For
example, many changes in system parameters are caused not by viruses, but
by the operation of system programs or the actions of the user programmer.
For the same reason, auditors do not use text files that are constantly
changing to control contamination. Thus, some balance must be maintained
between usability and control of system integrity.
Auditors provide a high level of detection of unknown computer
viruses, but they do not always provide correct treatment of infected files.
To treat infected files with unknown viruses, the standard characteristics of
the files and the expected methods of infection are usually used.
In addition, auditors do not detect infected files that are created or
copied into the system.
A type of system integrity monitoring is a software self-monitoring
method called vaccination. The idea of the method is to attach a module
(vaccine) to the protected program that controls the characteristics of the
program, usually its checksum.
In addition to statistical integrity monitoring methods, heuristic
methods are used to identify unknown and masquerading viruses. They
allow you to identify, based on known characteristics (defined in the system
knowledge base), some camouflaged or new modified viruses of known
types. An example of a virus sign is code that installs a resident module in
memory, changes interrupt table parameters, etc. A software module that
239
implements a heuristic method for detecting viruses is called a heuristic
analyzer.
The disadvantages of heuristic analyzers include errors of the 1st and
2nd types: false positives and missed viruses. The ratio of these errors
depends on the level of heuristics.
It is understood that if a signature for a computer virus detected by a
heuristic analyzer is not in the scanning database, then the treatment of
infected data may not be correct.
Blocking the manifestation of viruses
Blocking the manifestation of viruses is designed to protect against
destructive actions and reproduction of computer viruses that have managed
to overcome the first two levels of protection. The methods are based on
intercepting functions characteristic of viruses. There are two known types
of these antivirus agents:
1) filter programs;
2) hardware controls.
Filter programs, also called resident watchmen and monitors, reside
permanently in RAM and intercept specified interrupts in order to monitor
suspicious activities. At the same time, they can block “dangerous” actions
or issue a request to the user.
Actions subject to control can be the following: modification of the
master boot record (MBR) and boot records of logical disks and floppy disk,
writing to an absolute address, low-level formatting of a disk, leaving a
resident module in RAM, etc. Like auditors, filters are often “intrusive” and
create certain inconveniences in the user’s work.
Built-in PC hardware provides modification control to the system boot
loader and hard disk partition table located in the disk’s master boot sector
(MBS). Enabling these features on a PC is done using the Setup program
located in ROM. It should be noted that the Setup program can be bypassed
in the case of replacing boot sectors by directly accessing the I/O ports of
the hard drive and floppy drive controllers.
240
The most complete protection against viruses can be provided using
special hardware protection controllers. Such a controller connects to the
ISA board of the PC and at the hardware level controls all access to the
computer's disk subsystem. This prevents viruses from camouflaging
themselves. The controller can be configured to monitor individual files,
logical partitions, dangerous operations, etc. In addition, the controllers can
provide various additional security functions, such as access control and
encryption.
The disadvantages of these controllers, like ISA boards, include the
lack of an auto-configuration system and, as a result, the possibility of
conflicts with some system programs, including anti-virus programs [3].
6.5. SECURITY MODEL OF AN ENTERPRISE
INFORMATION NETWORK
This section will consider one of the possible options for building a
secure enterprise information network based on computer equipment and
software.
The computer network of a small/medium business includes several
local networks, united into a single organizational network and functioning
as a single whole. Typically, a network includes various types of switching
equipment, such as a router, hosts, switches, network cards, etc., as well as
all kinds of services and programs.
From the previous section we know that a firewall serves as the first
line of defense for a network against threats from the Internet. In general,
there are two options for connecting the screen to the network; these options
are shown in Fig. 6.8.
The simplest solution is in which the firewall simply shields the local
network from the global network (Fig. 6.8, a). At the same time, public
services (WWW, FTP, e-mail) are protected by a firewall. Much attention
must be paid to preventing penetration into protected local network stations
using easily accessible public servers.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]