Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
41
One of the important conditions for ensuring the integrity of
information in the digital network is its duplication. The duplication strategy
is selected taking into account the importance of the information and the
complexity of data recovery.
The simplest method of integrity monitoring is the checksum method.
To exclude the possibility of making changes to a controlled file with
subsequent correction of the checksum, it is necessary to store the checksum
in encrypted form or use a secret algorithm for calculating the checksum.
However, a more acceptable method of monitoring the integrity of
information is to use a hash function, the value of which cannot be forged
without knowing the key, i.e., the use of cryptographic techniques.
To protect against computer viruses, you should follow the rules
outlined in the first section.
Due to the fact that the means of monitoring the integrity of programs
and data files stored in the digital data center must provide protection against
unauthorized changes, a digital (electronic) signature is one of the
mechanisms often used to solve this problem.
At the end of a regular letter or document, the executor or responsible
person usually puts his signature. Such an action has the following goals.
Firstly, the recipient has the opportunity to verify the authenticity of the
letter by comparing the signature with a sample he has. Secondly, a personal
signature is a legal guarantee of the authorship of the document. The last
aspect is especially important when concluding various types of trade
transactions, drawing up powers of attorney, obligations, etc.
If it is very difficult to forge a person’s signature on paper, and
establishing the authorship of a signature using modern forensic methods is
a technical detail, then with a digital signature the situation is different. Any
user can tamper with a bit string by simply copying it, or make illegal
corrections to a document without being noticed.
The most common message authentication model has five participants.
These are the sender A, the recipient B, the attacker C, the trusted party D
and the independent arbiter E. The task of the sender A is to generate and
send a message T to the recipient B. The task of the recipient B is to receive
42
the message T and establish its authenticity. The task of trusted party D is
the documented distribution of the necessary service information to
subscribers of the computer network, so that in the event of a dispute
between A and B regarding the authenticity of the message, submit the
necessary documents to arbitration. The task of the independent arbitrator E
is to resolve the dispute between subscribers A and B regarding the
authenticity of message T.
Let us list possible methods of deception (violation of the authenticity
of a message) provided that there is no cooperation between participants in
the model A, B, C.
Method A: sender A claims that he did not send message T to recipient
B, although in fact he did (substitution of the sent message or denial of
authorship).
Method B1: recipient B modifies the message T received from sender
A and declares that he received this modified message from sender A
(substitution of the received message).
Method B2: recipient B himself generates a message and declares that
he received it from sender A (imitation of a received message).
Method C1: attacker C distorts the message that sender A transmits to
recipient B (substitution of the transmitted message).
Method C2: attacker C generates and sends message T to recipient B
on behalf of sender A (imitation of the transmitted message).
Method C3: attacker C repeats a previously transmitted message that
sender D sent to recipient B (repeat of a previously transmitted message).
The term “digital signature” is used for methods that allow one to
establish the authenticity of the author of a message when there is doubt
about the authorship of that message. As already mentioned, a digital
signature is used in information systems in which there is no mutual trust of
the parties (financial systems, systems for monitoring compliance with
international treaties, etc.).
Protection against threats to the integrity of information at the content
level is in common practice considered protection against disinformation.
Even if an attacker does not have the opportunity to influence individual
43
components of the system located within the controlled zone, but if the
sources of information entering it are outside the system, it is always
possible to take control of them by the opposing party.
To successfully combat potential misinformation, you should:
• distinguish between facts and opinions;
• use duplicate information channels;
• exclude all unnecessary intermediate links, etc.
2.3. BUILDING A SYSTEM FOR PROTECTION AGAINST
THE THREAT OF INFORMATION ACCESS DENIAL
Since one of the main tasks of the AS is the timely provision of system
users with the necessary information (information, data, control actions,
etc.), the threat of denial of access to information in relation to the AS can
also be considered as a threat of denial of service or a threat of failure of
operation.
At the stage of AS operation, the availability of information in the
system is ensured by:
1) increasing the fault tolerance of the AS;
2) counteracting overloads and system freezes;
3) using a strictly defined set of programs;
4) special regulation of maintenance processes and modifications.
Availability of information is maintained by reserving hardware,
blocking erroneous actions of people, using reliable AS elements and faulttolerant systems. Deliberate threats to reboot system elements are also
eliminated. For this purpose, mechanisms are used to measure the intensity
of receipt of requests for execution and mechanisms to limit such requests.
It must be possible to determine the reasons for the sudden flow of requests
for the implementation of programs or the transfer of information.
In complex systems, it is almost impossible to avoid situations that
lead to freezes of systems or their fragments. As a result of hardware or
software failures, algorithmic errors made at the development stage,
operator errors in the system, program loops, unintended stops and other
44
situations occur, the way out of which is possible only by interrupting the
computing process and its subsequent restoration. At the operation stage,
statistics are maintained and such situations are analyzed. “Freezes” are
detected in a timely manner, and the computing process is restored.
Only authorized software should be used in a protected system.
Control of the software composition is carried out during scheduled
inspections by commissions and officials, the operator on duty according to
a specific plan, unknown to users.
When specialists from other organizations arrive, for example, to carry
out modifications, in addition to the usual check of persons admitted to the
site, the instruments and devices that were delivered to perform the work
must be checked for the absence of bookmarks.
Thus, the reliability of the functioning of the DCS can be reduced to
the reliability of the functioning of the software included in its composition.
And there are two main approaches to ensuring the protection of DCS
software from the threat of failure of operation — fault prevention (fault
avoidance) and fault tolerance. Fault tolerance ensures that remaining
software errors are detected during program execution. Fault prevention is
associated with analyzing the nature of errors that occur at different phases
of software development and the reasons for their occurrence.
Considering the protection of digital information systems, we will
define two more levels: the presentation level and the information content
level.
At the level of information presentation, protection from the threat of
denial of access to information (protection of semantic analysis) can be
considered as opposition to the comparison of used syntactic structures
(words of a certain alphabet, symbols, etc.) with certain semantic content.
In relation to DCS, the task of protecting against threats to information
availability can be considered as using programs to process a data file that
ensure reproduction of data in the form in which they were recorded.
At the content level, protection of information from threats to
accessibility is ensured by protecting the relevance of information or
legalizing the information or data received. In relation to the DCS,
45
protecting the content of information from the threat of blocking access
(failure to function) means the legal validity of the processing and use of
information stored in the DCS.
2.4. BUILDING PROTECTION SYSTEMS AGAINST
THE THREAT OF DISCLOSURE
OF INFORMATION SYSTEM PARAMETERS
Methods of protection against the threat of disclosure of information
system parameters, in principle, do not differ from the methods discussed
above for protecting information confidentiality. The purpose of this section
is to give an idea of those DCS parameters, the disclosure of which will
allow an attacker to further implement the main types of threats: violating
the confidentiality of information, violating the integrity of information and
blocking access to information.
To carry out unauthorized access, the attacker does not use any
hardware or software that is not part of the system. He carries out UA using:
• knowledge about the DCS and the ability to work with it;
• information about the information security system;
• failures, failures of hardware and software;
• errors, negligence of service personnel and users.
There are five non-standard research methods that an attacker can use
to obtain the information he needs:
1) interactive manuals and program models;
2) analysis of the found CSM;
3) digging in the recycle bin;
4) study of “photographs”;
5) “sniffing”.
Let’s take a closer look at the first two.
Conversational tutorials and program models. Manuals and model
programs are often used to teach how to operate a computer system. These
programs simulate computer screens as a user would see them while actually
46
working on the Internet. Manuals and models differ from actual work in that
they inform the user of standard methods of communicating with the system
and sometimes even show him the special parts required for the work. If the
user has not completed the training course, he is usually given a collection
of exercises for working with a lightweight version of the real system, and,
as a rule, it is issued along with a rich set of various cheat sheets.
Manuals and models give new users hands-on experience with the
software they will be using and familiarize them with its features and
purposes. Such programs are very often used for educational purposes
instead of a real system or as an addition to it. There are several reasons for
this. What if the system is still being implemented or is undergoing an
update? Or maybe it’s too expensive to train a newbie on a “live” system —
you never know. Models solve such problems, since they can be installed
on any computer.
Model programs can be obtained from public, specialized, and even
scientific libraries. You can also order one from the manufacturer, writing
to him that you are going to pay well for his product. Flattery, lies, pressure
on the producer’s sense of superiority, and then, as if by chance, the
question: do the good gentlemen, by any chance, have some kind of
“demonstration”? It is possible that you will be able to obtain such a
program from a friendly employee of the company’s computer department.
Analysis of the found CSM. Let the attacker gain access to CSM with
confidential information. In order to gain access to the content of
information, in general, he must provide:
• reading from the CSM the information stored on it;
• gaining access to the contents of a logical unit of information storage
(file);
• playback of file contents in normal mode;
• expert assessment of read and reproduced information.
When an attacker carries out activities aimed at obtaining information
from the CSM (usually a floppy or hard magnetic disk), he needs to solve
the following problems:
1. Diagnostics of the media condition, including receiving:
47
• media format elements required for a specific OS;
• signs of tools for preparing the media for use;
• characteristics of information distribution over the working surface
of the medium;
• signs of deleted, residual and hidden information;
• data on bad sectors and unreadable areas;
• signs of non-standard media formatting.
2. Prevention of the carrier’s condition (identification of the reasons
that led to a particular state of the carrier).
3. Restoring the working condition of the media.
4. Restoring, copying and converting information on storage media.
As already noted, a necessary condition for reading information from
CSM is the presence of hardware, software and organizational components
of physical access.
To select a drive, configure the software and access the contents of the
CSM, it is necessary to identify its type. For this purpose, the primary
characteristics of the carrier are used:
• appearance of this media;
• information about the media type;
• characteristics of this media.
Based on the described possible actions of an attacker, it is necessary
to create appropriate protective measures against reconnaissance of system
parameters, namely, to prevent a potential adversary from obtaining the
above information during operation of the AS.
If the available machine media was correctly identified by the attacker
and a drive was selected for it, then with a high probability he will know the
format of the original media, or this format will be automatically identified
by the operating system that allows work with the drive for this media. For
example, regular 3,5" floppy disks are typically formatted in the IBM
standard (MS DOS) at 1,44 MB or 720 KB, or in the Apple Macintosh
standard at 1,44 MB or 720 KB.
However, it is possible to introduce arbitrary non-standard methods of
media marking, which can be used not only for ease of use, but also for the
48
purpose of protecting stored information. Then a potential attacker will have
to deal with a sequence of 0 and 1. In this case, classification of service,
content, residual and hidden information will be required. In its meaning,
this work is close to a fairly deep cryptanalysis. We also cannot rule out the
use of more sophisticated cryptographic algorithms when encrypting the
entire contents of the media, including service areas.
The procedure for determining the media format at the logical level
involves:
• determination of the number and size of clusters;
• highlighting the file allocation table;
• allocation of the root directory.
The main criterion for whether logical access has been achieved or not
is the ability of the attacker to allocate each file on the machine media
available to him. Currently, due to the use of a limited number of types of
operating systems and an even smaller number of ways to place files on
media, this task can be considered solved for an attacker. At the same time,
for individual particularly critical systems (if sufficient funds are available),
the issue of developing a unique subsystem for interaction with the carrier
can be considered.
If an attacker has a file, then he knows its name with extension,
creation date, size, status (read-only, etc.). Taking into account the fact that
there are different types of information (text, graphic images, audio and
video signals, software modules, etc.), as well as different ways of
presenting it, file design standards (formats) have been developed and are
actively used. The list of such formats is very wide. Their diversity is
explained primarily by the large number of relevant software products. It is
not always possible to know in advance what format the file is prepared in.
However, for each type of information presented in the file, for each format,
there are characteristic features. Thus, the task of identifying the meaning
of the contents of a file involves determining the software tool with which
this file was prepared, including the cryptographic information protection
tools used to encrypt it.
49
If cryptographic security measures are used, an attacker can use
cryptographic analysis.
A separate area of protecting a DCS is hiding the logic of its operation
and its protective functions, implemented in software or hardware and
software. This is due to the fact that most attacks by attackers on security
systems and the information they protect include, as a mandatory step,
studying the logic of security and functional mechanisms. In turn, the study
of the AS programs’ logic is divided into three stages:
1) allocation of clean program code;
2) disassembly;
3) semantic analysis.
An attacker may need to extract pure program code for the following
reasons:
• special measures have been taken to prevent research into this code;
• measures have been taken aimed at converting the code into another
form that does not pursue the implementation of countermeasures; most
often this is archiving or encoding the source program code.
Disassembly is the process of translating a program from executable
or object code into assembly language. The disassembly problem is
practically solved. Currently, for almost all operating systems there are
many good disassemblers that can handle standard code almost 100 %.
Disassembled text can be considered completely correct if reassembling
results in the original code. Likewise, code is considered to contain no
special anti-exploration techniques if the disassembler receives completely
correct text. Using the disassembly stage, you can check the quality of the
clean code stage: if the disassembler does not generate completely correct
code, then that stage was not completed.
Semantic analysis of a program is the study of a program by
examinating the meaning of its constituent functions (procedures) in the
aspect of the computer’s operating environment. This stage is the final one
and allows you to restore the logic of the program without the source code.
In this case, all the information obtained at the previous stages is used,
50
which, as already noted, can be considered correct only with some
probability, and false facts or conclusions cannot be excluded at all.
Semantic analysis is applied to the resulting assembler program texts
and consists of finding and highlighting control structures such as loops,
subroutines, etc., and basic data structures. In this case, the input and output
data are determined, and the logic of the transformations carried out with
them is reconstructed.
The simplest method of protecting executable program code is to
modify it. The most primitive way to modify code (in terms of complexity
of implementation and reliability) is to package it using one of the standard
packaging programs: PkUte, Diet, etc. Such protection is unreliable, but
nevertheless allows you to hide the true executable code and the text
messages contained in it strings and other information, especially if
additional security measures are taken after recoding, such as erasing the
packer identifier and other information characterizing the packaging
method.
A more reliable method is to use custom packers. If in the previous
case, with a successful determination of the packaging method, the
executable code can be “unwrapped” using a ready-made tool, then with an
unknown packer, this operation will require a preliminary analysis of the
executable code of the subroutine that unpacks the program when it starts.
A much more effective method is to encrypt the program body and
data. Since the purpose of this protection mechanism is to ensure the
program operates in normal mode and prevent access to the true executable
code in all other cases, it is advisable to select system parameters and time
characteristics of its operation that correspond specifically to this mode
(memory location picture, values) as the key to the cipher. system variables,
video adapter operating mode, interaction with the timer).
In addition, the modification may not affect the entire code, but only
concern individual commands (control transfer commands, interrupt calls or
their parameters are most preferable), as well as small fragments of code
that play a key role.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]