Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
31
In this case, imagination can come up with the most plausible reasons why
an employee “simply needs” to say the password out loud. The most
unpleasant thing about this scheme is that if the reason for requesting a
password is invented, which is called “smartly,” then the employee will call
the information security service again only after a week, a month, if this
happens at all. In addition, this scheme can be carried out without a phone
call — via e-mail, which was repeatedly carried out allegedly on behalf of
mail and Web servers on the Internet [13].
As software preventive measures, screen savers with a password are
used, which appear after 5–10 minutes of inactivity, and automatic
shutdown of the client after the same period of time.
32
CHAPTER 2. METHODOLOGY FOR BUILDING
DCS PROTECTION SYSTEMS
2.1. BUILDING A SYSTEM FOR PROTECTION AGAINST
THE THREAT OF VIOLATION
OF CONFIDENTIALITY INFORMATION
The functioning of an integrated information security system depends
not only on the characteristics of the created system, but also on the
effectiveness of its use at the stage of operation of the digital data center.
The main stages of operation are the maximum use of the capabilities
inherent in the system during construction and the improvement of its
protective functions in accordance with changing conditions.
The process of operating the DCS can be divided into using the system
for its intended purpose, directly related to the protection of information in
the DCS, and technical operation. Intended use involves organizing access
to DCS resources and ensuring their integrity.
Organization of access to resources refers to the entire set of measures
that are carried out during the operation of the system to prevent
unauthorized influence on hardware and software, as well as information.
Organizing access to resources involves:
1) delimitation of the rights of users and service personnel to access
DCS resources in accordance with the functional responsibilities of
officials;
2) organization of work with confidential information resources at the
facility;
3) protection from technical intelligence means;
4) security of the facility;
5) operation of the access control system.
The access control system is one of the main components of the
automated system in a secure design. The following components can be
distinguished in this system:
33
• means of authentication of the access subject;
• means of restricting access to technical devices of the AS;
• means of restricting access to programs and data;
• means of blocking unauthorized actions;
• means of event registration;
• duty operator of the access control system.
According to the governing documents of the State Technical
Commission, unauthorized access to information (UAI) will be understood
as access to information that violates the established rules of access control
and is carried out using standard AS means. UA can be accidental or
intentional.
Several general categories of methods of protection against nonintrusive activity can be distinguished, in particular [13]:
• organizational;
• technological;
• legal.
The first category includes measures and activities regulated by the
internal instructions of the organization operating the information system.
An example of such protection is the assignment of security classifications
to documents and materials stored in a separate room and control of
employee access to them. The second category consists of security
mechanisms implemented on the basis of software and hardware, for
example, identification and authentication systems or security alarms. The
last category includes measures to monitor the implementation of
regulations of national importance, mechanisms for developing and
improving the regulatory framework governing information security issues.
Let us consider in more detail such interrelated methods of protection
against unauthorized access as identification, authentication and the
cryptographic transformation of information used in their implementation.
Identification is the assignment of identifiers to users (the concept of
identifier will be defined below) and verification of the presented identifiers
against the list of assigned ones.
34
Authentication is a verification of the user’s ownership of the
identifier presented to him. Authentication is often also called confirmation
or authentication.
By security (resilience) of an identification and authentication
system we mean the degree of guarantees it provides that an attacker is not
able to pass authentication on behalf of another user.
There are three groups of authentication methods based on the
availability of each user:
1) an individual object of a given type;
2) knowledge of some information known only to him and the
verifying party;
3) individual biometric characteristics.
The first group includes authentication methods using IDs, passes,
magnetic cards and other wearable devices, which are widely used to control
access to premises, and are also part of hardware and software systems for
protecting against unauthorized access to computer equipment.
The second group includes authentication methods that use passwords.
For economic reasons, they are included as basic means of protection in
many software and hardware information security systems. All modern
operating systems and many applications have built-in password protection
mechanisms.
The last group consists of authentication methods based on the use of
equipment for measuring and comparing specified individual characteristics
of the user with a standard: voice timbre, fingerprints, iris structure, etc.
If the authentication procedure involves only two parties
authenticating each other, this procedure is called direct password
authentication. If not only these parties, but also other auxiliary ones,
participate in the authentication process, we speak of authentication with the
participation of a trusted party (trusted third party authentication). In this
case, the third party is called an authentication server or an arbitrator [13].
The most common authentication methods are based on the use of
multiple or one-time passwords. Due to their widespread use and ease of
implementation, password schemes are often the first target of attack by
35
attackers. These methods include the following types of authentication
methods:
1) by a stored copy of the password or its condensation (plaintext-
equivalent);
2) by some verification value (verifier-based);
3) without directly transmitting password information to the relying
party (zero-knowledge);
4) using a password to obtain a cryptographic key.
The first type of methods includes authentication systems that require
both parties to have a copy of the password or a reduced version of it. To
organize such systems, it is necessary to create and maintain a database
containing passwords or password reconciliations of all users. Their
weakness is that an attacker’s acquisition of this database allows him to
authenticate as any user.
The methods that make up the second type provide a higher degree of
security for the password system, since the verification values, although
they depend on passwords, cannot be directly used by an attacker for
authentication.
Finally, authentication without providing any password information to
the relying party provides the greatest degree of security. This method
guarantees security even if the operation of the relying party is disrupted
(for example, a Trojan horse is introduced into the system registration
program).
A special approach to authentication technology is cryptographic
authentication protocols. Such protocols describe the sequence of actions
that the parties must perform for mutual authentication; in addition, these
actions are usually combined with the generation and distribution of
cryptographic keys to encrypt subsequent information exchanges. The
correctness of authentication protocols follows from the properties of the
mathematical and cryptographic transformations involved in them and can
be strictly proven.
Conventional password systems are simpler and cheaper to
implement, but less secure than systems with cryptographic protocols. The
36
latter provide more reliable protection and additionally solve the problem of
key distribution. However, the technologies they use may be subject to legal
restrictions.
For a more detailed consideration of the principles of constructing
password systems, we will formulate several basic definitions.
User ID is a certain unique amount of information that allows you to
distinguish between individual users of a password system (identify them).
Often the identifier is also called the username or user account name.
User password is a certain secret amount of information known only
to the user and the password system, which can be remembered by the user
and presented to complete the authentication procedure. A one-time
password allows the user to authenticate once. A reusable password can be
used for authentication repeatedly.
A user account is a combination of his identifier and his password.
The password system user database contains the accounts of all users
of a given password system.
By password system we mean a hardware and software complex that
implements systems for identifying and authenticating AS users based on
one-time or multiple-use passwords. As a rule, such a complex operates in
conjunction with access control and event registration subsystems. In some
cases, a password system can perform a number of additional functions, in
particular the generation and distribution of short-term (session)
cryptographic keys.
The main components of a password system are:
1) user interface;
2) administrator interface;
3) interface module with other security subsystems;
4) account database.
The following are the types of security threats to password systems.
1. Disclosure of account parameters through:
• selection in interactive mode;
• peeping;
• intentional transfer of a password by its owner to another person;
37
• capturing the password system database (if passwords are not stored
in the database in clear text, recovery may require guessing or decryption);
• interception of password information transmitted over the network;
• storing the password in an accessible place.
2. Interference with the functioning of password system components
through:
• introduction of software bookmarks;
• detection and use of errors made at the development stage;
• disabling the password system.
Some of the listed types of threats are associated with the presence of
the so-called human factor, which manifests itself in the fact that the user can:
• choose a password that is easy to remember and also easy to guess;
• write down a password that is difficult to remember and put it in an
accessible place;
• enter the password so that others can see it;
• transfer the password to another person intentionally or under the
influence of error.
Next, we will consider cryptographic protection methods, which are
currently basic for ensuring reliable authentication of parties to information
exchange, protecting information in the transport subsystem of a digital
network, confirming the integrity of digital network objects, etc.
Cryptographic information protection tools (CIPT) include hardware,
firmware and software that implement cryptographic algorithms for
converting information for the purpose of:
• protection of information during its processing, storage and
transmission through the AS transport environment;
• ensuring the reliability and integrity of information (including the use
of digital signature algorithms) during its processing, storage and
transmission through the transport environment of the DCS;
• generating information used to identify and authenticate subjects,
users and devices;
• generation of information used to protect the authenticating elements
of a secure DСS during their generation, storage, processing and
transmission.
38
Let us note several significant features of cryptographic
transformation:
1) CIPT implements some algorithm for converting information
(encryption, electronic digital signature, integrity control, etc.);
2) the input and output arguments of the cryptographic transformation
are present in the AS in some material form (DCS objects);
3) CIPT uses some confidential information (keys) to operate;
4) the cryptographic transformation algorithm is implemented in the
form of some material object that interacts with the environment (including
subjects and objects of the protected digital network).
As a result, the role of CIPT in a secure data center is the
transformation of objects.
The following points are essential:
1. CIPT exchanges information with the external environment,
namely: keys and plaintext during encryption are entered into it.
2. In the case of a hardware implementation, CIPT uses an elemental
base of limited reliability (i.e., malfunctions or failures are possible in the
parts that make up the CIPT).
3. CIPT in the case of software implementation is executed on a
processor of limited reliability and in a software environment containing
third-party programs that can affect various stages of its operation.
4. CIPT is stored on a tangible medium (in the case of software
implementation) and may be intentionally or accidentally distorted during
storage.
5. CIPT interacts with the external environment indirectly (powered
by the electrical network, emitting electromagnetic fields, etc.).
6. CIPT is manufactured and/or used by a person who can make errors
(intentional or accidental) during development and operation.
The developer, intentionally or unintentionally, can introduce certain
properties into the program (for example, the ability to switch to debug
mode with some information displayed on the screen or external media). A
person using a security program may decide that the program is
“inconvenient” for him and use it incorrectly (entering short keys or
39
repeating the same key to encrypt different messages). The same point
applies to hardware security.
In this regard, in addition to built-in control over the user, it is
necessary to monitor the correct development and use of security measures
using organizational measures.
The correct functioning of the technical means of the AS, within the
framework of which CIPT is implemented, is defined as compliance with
the execution of elementary instructions (commands) as described in the
documentation. Repair and maintenance of CIPT should also not lead to
deterioration of the properties of CIPF in terms of reliability parameters.
Let’s consider the requirements for the development, production and
operation environments of CIPT. The hardware on which software or
hardware-software CIPFs are implemented, and the hardware-software
environment (hardware-software environment) in which CIPFs are
developed, manufactured and operated, should not have explicit or hidden
functionality that allows:
• modify or change the algorithm of operation of CIPT during their
development, manufacture and operation;
• modify or change information or control flows and processes
associated with the functioning of CIPT;
• access (read and modify) unauthorized persons (or processes
controlled by them) to keys and identification and authentication
information;
• gain access to confidential CIPT information.
The composition and purpose of software and hardware must be fixed
and unchanged for the entire time specified in the conclusion on the
possibility of use.
There are two possible approaches to the process of cryptographic
protection (mainly encryption) of DCS objects: preliminary and dynamic
(“transparent”).
Preliminary encryption consists of encrypting a file with a certain
program (subject), and then decrypting it with the same or another subject
(for decryption, the same or another (specifically for decryption) program
40
can be used). Next, the decrypted array is directly used by the user’s
application program. This approach has a number of disadvantages,
although it is used quite widely.
Principal disadvantages of the pre-encryption method:
1) the need for an additional resource to work with an encrypted object
(disk space in case of decryption into a file with a different name or time);
2) the potential possibility of access by active subjects of the DCS to
the decrypted file (during its existence);
3) the need for the task of guaranteed destruction of the decrypted file
after its use.
The essence of dynamic encryption of DCS objects is as follows. The
entire file is encrypted (similar to preliminary encryption).
Then, using special mechanisms that ensure modification of the
functions of the DCS software that performs access to objects, work is
carried out with the encrypted object. In this case, only that part of the object
that is currently used by the application program is decrypted. When writing
from the application program, the recorded part of the object is encrypted.
This approach makes it possible to use the computing resources of the
DCS as economically as possible, since only that part of the object that is
directly needed by the application program is decrypted. In addition, on
external media, information is always stored in encrypted form, which is
extremely valuable from the point of view of the inability to access it.
Dynamic encryption is therefore advisable to protect shared remote or
distributed AS objects.
2.2. BUILDING A SYSTEM FOR PROTECTION AGAINST
THE THREAT OF INTEGRITY VIOLATION
At the stage of operation of the DCS, the integrity of information in
the system is ensured by:
1) duplication of information;
2) monitoring the integrity of information in the DCS;
3) special regulation of maintenance processes;
4) implementation of a set of anti-virus measures.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]