RU16961U1 - SYSTEM OF PROTECTION OF DATA PACKAGES DURING THE TRANSFER OF THESE DIVIDED PROTECTED FRAGMENT OF THE GENERAL USE DATA TRANSFER NETWORK WITH THE COMMUNICATION OF PACKAGES IMPLEMENTING THE IP PROTOCOL FROM THE RESPONSE - Google Patents

Description

2000126634

llillPPPPW MKHG06F15 / 16

A system for protecting data packets during transmission in a dedicated protected fragment of a public data transmission network with packet switching that implements the IP protocol against unauthorized influences.

The proposed utility model relates to computer technology, in particular to security systems for the process of data transfer in public switched data networks, packets that implement the IP protocol.

There are known packet-switched public data networks that implement the IP protocol, connecting users of information systems using hardware and software communications that provide some protection for the transmitted data from modification due to random interference, but do not provide protection against intentional unauthorized influences by V.G. Olifer, N.A. Olifer. Computer networks. Principles, technologies, protocols. St. Petersburg, ed. Peter, 1999 p. 383-406, 530-539.

Closest to the proposed technical solution is a packet-switched public data network implementing the DP protocol and containing user communication lines, routers, a network control center, and communication lines connecting them. V.G. Olifer, P.A. Olifer. Computer networks. Principles, technologies, protocols. St. Petersburg, ed. Peter, 1999 p. 524, prototype.

The disadvantage of this communication network is the lack of mechanisms in it from unauthorized access to the data transmission services it provides, protection of transmitted packets

user data from accidental and intentional distortions due to unauthorized influences in the process of transmitting data packets over a public data network with packet switching and protecting the information sphere of a public data network with packet switching from remote unauthorized influences with information weapons.

The proposed utility model solves the technical problem of ensuring the reliability of data packets transmitted by a dedicated protected fragment of a public data transmission network with packet switching, protecting the information sphere of a selected protected fragment of a public data transmission network with comms: packet protection from remote unauthorized influences, protecting a selected protected fragment of a transmission network public data with packet switching from unauthorized access to those provided in a dedicated protected fragment of this network, data transmission services and localization of sections of a dedicated protected fragment of a public data transmission network with packet bundling (subscriber line or a section between subscriber lines) exposed to the intruder.

The stated technical problem is solved in that the system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching that implements IP protocol from unauthorized influences, including user communication lines, a dedicated protected fragment of a public data network with packet switching that implements IP, containing routers, a network control center

and the communication lines connecting them, further comprises a security control center included in the network control center, and associated security subscriber servers installed either at the output of the user terminal at the beginning of the user communication line, as well as network security servers installed at the end of the communication line a user at the entrance to the ports of the router of the selected protected fragment of the public data network with packet switching, while each subscriber security server contains a block receiving and extracting at the network level from the received data packet the contents of the data field, a block for receiving from the security control center and storing encryption keys for interaction of the subscriber server with all network security servers, a block for encrypting the contents of the data field of the data packet received from the user and generating for the process unchanged transmission of a part of the data packet of the simulation insert, the block of adding the simulation insert to the encrypted data packet, the block correction of the header of the data packet and generating a converted data packet, a transmitting data packet transmitting unit, a converted data packet receiving and isolating unit at a network level, a decrypting received data packet decoding unit and verifying the validity of a received simulation insert, a decrypted data packet issuing unit to a user, an incoming data packet registration unit with a mark data packets received with the wrong icon with a simulated insert, the block of formation and transmission of messages about the received packet with the wrong lnym value simulation insertion into security management center which comprises forming unit and

 r

distribution of encryption keys, a unit for receiving messages about data packets received with the wrong value of the simulation insert, a decision making unit for localizing unauthorized influences and eliminating the consequences of unauthorized influences, and an interaction unit with a control center for a public data network with packet switching, with each network server security contains a block receiving from the security management center and storing encryption keys for interaction with each subscriber a security server, a unit for receiving and allocating a converted data packet at the network level, a block buffer for placing the received converted data packet, a decryption block for the received converted data packet and verifying the correctness of the received value of the simulation insert in accordance with the algorithm and encryption key corresponding to the address of the sending subscriber server security, the unit for determining the address of the receiving user and forming in accordance with it either a command to issue contained in b oxy buffer of the data packet to the router, or commands to encrypt and form a simulated insert of the received and decrypted data packet for issuing it to the subscriber security server of the receiving user, the transmission unit of the converted data packet from the buffer block to the router, the encryption block of the contents of the received and decrypted data field data packet in accordance with the encryption key of the network security server with the subscriber server of the receiving user security received from the center at systematic way safety and forming simulation inserts unaltered during transmission part

1 J} th fiQ-C

a data packet, a block for adding a simulation insert to an encrypted data packet, a block for correcting the header of the data packet and generating the converted data packet, a block for transmitting the converted data packet to the subscriber server of the receiving user, a block for registering incoming data packets with a mark of the data packets received with the wrong value of the simulation inserts, the unit for generating and transmitting messages about the received packet with the wrong value of the simulation insert to the security control center Yu.

This embodiment of the data packet protection system during transmission in a dedicated protected fragment of a public data transmission network with packet switching from unauthorized influences allows solving the technical problem due to the additional data packets transmitted in the selected protected fragment of a public data transmission network that have been protected with packet switching from unauthorized influences, a security control center and subscriber networks interacting with it Verov security and network security servers that perform data protection packages function without changing the functions performed by the main components of public data packet network.

When a selected protected fragment of a public data transmission network with packet switching of each data packet is transmitted to the network security server by the subscriber server of the transmitting user, the part of the data packet that is unchanged during transmission is encrypted using the data contained in the data field of the received data packet,

 ) IW / UC-

a simulation insert is formed in accordance with the encryption algorithm used, for example, according to GOST 28147-89, and the encryption key received from the security control center for the interaction of this subscriber security server with all network security servers of the selected wired fragment of the data transmission network, i.e. to the encrypted data packet of length k binary characters transmitted to the network security server, the generated simulation insert of length m of binary characters is added and the packet header data is corrected, as a result of which a converted data packet of length of binary characters is generated, which enters the network security server installed at the entrance to the access port a router for a dedicated protected fragment of a public switched packet data network that provides additional security from unauthorized access to the router port of the allocated protected fragment of the public data network with packet switching by verifying the authenticity of the received converted data packet by decrypting the received data packet, fixing the transmitting address; its user and verifying the correctness of the simulation insert contained in the converted data packet in accordance with encryption key “network security servers - transmitting subscriber security server obtained from prices ra security management, thus in case of positive verification simulation insert received transformed data packet contained in the buffer unit is transferred to the router selected zashdschaemogo fragment data transmission network with packet switching, in the case of

/M2.fc.

the negative result of the simulation insert check, the converted data packet contained in the buffer block of the network security server is erased.

From the router, a message containing the converted data packet is transmitted to the network security server of the receiving user, where the converted data packet is allocated at the network level, which is decrypted to verify that the simulation insert contained in it is in accordance with the address of the transmitting user and the encryption key “network security servers - the transmitting subscriber security server and, if inserted correctly, the received data field of the decrypted data packet is explicit it is encrypted, but already on the encryption key for the pair “network security servers, the receiving subscriber security server with the formation of a new simulation insert for the immutable part of the data packet, the simulation insert is added to the encrypted data packet, the header data of the data packet is corrected, and the converted data packet is formed, which transmitted to the subscriber server security of the receiving user. If the simulation insert is checked negatively, the received data packet is erased and the network security server generates and transmits to the security control center a message about the received data packet with the information insert that did not pass control.

In the subscriber security server of the receiving user at the network level in accordance with the decryption algorithm used and the encryption key for the pair "network security servers - receiving subscriber server

1

the security received from the security control center, the transformed data packet received from the network security server is decrypted and the value of the simulation insert contained in the received converted data packet is verified and, if the simulation value is correct, the decrypted data packet is inserted without the simulation packet inserted to the user; if the simulation value is incorrect, the received converted data packet is erased. Data packets received by subscriber and network security servers are registered with a mark of data packets that have not passed the verification of the value of the simulation insert, messages are also generated about the data packet with the verification value of the simulation insert that is transmitted to the security control center, while the transmitted message is protected by the selected protocol of protection against its inadmissibility. Distribution of encryption keys between subscriber and network security servers in a selected protected fragment of a public data network with packet switching using a single-key encryption system is organized by the security control center either using manual mode based on smart cards or using the protected protocol of the security control center interaction with subscriber and network security servers via communication channels, along with this a security control center with jointly with the network control center and other organizational strztsturami public data packet-switched network solves the problem of localization of unauthorized actions and response to

based on information received from subscriber and network security servers.

The generation of encryption keys by the security control center when using an encryption system with symmetric keys occurs for the following pairs of interacting servers: “i-th - subscriber security server - all network security servers, i.e. all network security servers have the same encryption keys for interaction with this i-th subscriber security server.

Thus, the security protocol implemented by the subscriber security servers and network security servers, as well as the functions that ensure the implementation of the proposed security protocol, make it possible to detect a modification of the transmitted data packets and, together with the security control center and the network control center, ensure the specified reliability and reliability of delivery of the transmitted data to the user data packets with a highlighted protected fragment of a public switched data network with packet switching, protection info mation scope of this fragment from remote tampering and protect against unauthorized access to data networks and detecting areas selected protected fragment of the network, where there has been tampering. Guaranteed reliability of each transmitted data packet with a highlighted protected fragment of a public switched data network with packet switching is determined by the probability value

(1Y /

occurrence of a data field distortion in the data packet that is not detected by subscriber or network security servers due to unauthorized exposure equal to p - „

The essence of the proposed technical solution is illustrated by the protection system diagram for two interacting users, shown in FIG. 1. The system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching that implements the IP protocol from unauthorized influences contains communication lines 1 and 2 of the user, connecting user terminals 3 and 4, respectively, through subscriber security servers 5 and 6, installed at the beginning of subscriber lines, with network security servers 7 and 8, installed at the end of user lines 1 and 2 and connected to the ports of routers 9 of dedicated protection of the fragment 10 of a public switched data network using IP protocol that includes a network control center 11 and a security control center 12, while the subscriber security servers 5 and 6 respectively comprise reception and allocation blocks 13 and 14 at the network level from the received packet data content of the data field, blocks 15 and 16 from the security control center 12 and the storage of the encryption keys, blocks 17 and 18 to encrypt the contents of the data field of the data packet received from the user and generating removed during the transmission of part of the data packet of the simulation insert, blocks 19 and 20 of adding the simulation insert to the transmitted data packet with the formation of the converted data packet, blocks 21 and 22

1

-g 2

correction of the header and the formation of the converted data packet, blocks 23 and 24 of transmitting the converted data packet, blocks 25 and 26 of receiving and allocating the converted data packet at the network level, blocks 27 and 28 of decrypting the converted data packet and verifying the correctness of the received value of the simulation insert, blocks 29 and 30 issuing the decrypted data packet to the user, blocks 31 and 32 of registering incoming data packets with a mark of data packets received with the wrong value of the simulation insert, blocks 33 and 34 of the formation and transmitting a message about the received data packet with the wrong value of the simulation insert to the security control center 12, which contains the block 35 for generating and distributing encryption keys to the user security servers, the block 36 for receiving messages about data packets with the incorrect simulation value, the decision making block 37 localization of unauthorized influences and liquidation of consequences of unauthorized influences and unit 38 of interaction with the network control center 11, network security servers and 7 and 8, respectively, contain blocks 39 and 40 for receiving from the security control center 12 and storing encryption keys, blocks 41 and 42 for receiving and allocating the converted data packet at the network level, block buffers 43 and 44 for storing the received converted data packet, blocks 45 and 46 decrypting the received converted data packet and verifying the correctness of the received value of the simulation insert in accordance with the key and encryption algorithm used, blocks 47 and 48 determine the address of the receiving user and the formation in accordance with it, either a command to issue the data packet contained in block buffers 43 and 44 in

(- /

router 9, or commands to reencrypt the received data packet, blocks 49 and 50 of transmitting the converted data packet from the buffer blocks 43 and 44 to router 9, encryption blocks 51 and 52 of the contents of the data field of the received and decrypted data packet in accordance with the encryption key and generation simulation insert for the part of the data packet that is not changed during the transmission, blocks 53 and 54 of adding the simulation insert to the encrypted data packet, blocks 55 and 56 of the header correction of the data packet and the formation of the converted data packet, blocks 57 and 58 for transmitting the converted packet, blocks 59 and 60 for registering incoming data packets with the mark of data packets received with the wrong value of the simulation insert, blocks 61 and 62 for generating and transmitting messages about the received packet with

Incorrect value for simulation insert in security control center 12.

The proposed system sewn up data packets during their transmission in a dedicated protected fragment of a packet-switched data transmission network operates as follows.

When a data packet is transferred from user 3 to user 4, block 13 of the subscriber security server 5 receives and extracts the contents of the data field from the received data packet at the network level, block 15 receives encryption keys from block 35 of the security control center 12, block 17 selects the key from block 15 encryption for interaction with the network security server 7 and in accordance with it and the encryption algorithm, for example, according to GOST 28147-89, encrypts the contents of the data field of the received data packet and forms for unchanged during transmission parts of a data packet

Glo / 3

simulation insert, block 19 adds a simulation insert to a non-transmittable data packet, block 21 corrects the packet header and generates a converted data packet, block 23 transmits the converted data packet to block 41 of the network security server 7, from which the converted data packet is transmitted to block buffer 43, block 45 decrypts the received converted data packet and verifies the correctness of the received value of the simulation insert in accordance with the encryption key received by block 39 from the security control center View 12, with a negative result of checking the correctness of the received value of the simulation insert contained in the block buffer 43, the data packet is erased. If the received value of the simulation insert is correct, block 49 transmits the converted packet from buffer 43 to router 9, block 59 registers incoming data packets with a mark of data packets received with the wrong value of the simulation insert, and block 61 generates and transmits a message about the received data packet with the wrong value of the simulation insert in

block 36j

security control center 12. From the router 9, the converted data packet at the network level enters the block 42 for receiving and allocating at the network level the converted data packet of the network security server 8, from which the converted data packet arrives at block 46, where the received converted data packet is decrypted and checking the correctness of the simulation insert in accordance with the key and the encryption algorithm used; in the case of an incorrect value of the simulation insertion, the received data packet it is erased, and in the case of the correct value of the simulation insert and the block 4 establishes the address of the subscriber server

security, as a user of a data packet, the content of the data field of the received and decrypted data packet in block 52 is encrypted and a simulation insert is formed for the part of the data packet that is unchanged during transmission in accordance with the encryption key for the pair “network security servers-subscriber security server of the receiving user 4, block 54 adds a simulation insert to the encrypted data packet, block 56 adjusts the header of the data packet and generates the converted data packet, and block 58 transmits the transform ovanny packet data to the subscriber security server 6 receives the user 4, the unit 60 detects incoming data packets marked data packets received with an incorrect value simulation inserts, and block 62 generates and transmits a message of the received packet with

Incorrect value of simulation insert in safety management 12.

Block 26 of the subscriber security server 6 receives and allocates the converted data packet at the network level, block 28, in accordance with the encryption key obtained from block 16 and the decryption algorithm used, for example, according to GOST 28147-89, decrypts the received converted data packet and verifies the correctness of the received simulation insert, and block 30, with the correct value of the simulation insert, returns the received data packet without the simulation insert to user 4. When fixing the incorrect value of the simulation insert in p The received data packet is erased, the block 32 registers the incoming data packets with the mark of the data packets received with the wrong value of the simulation insert, the block 34 generates and transmits a message about the received data packet with

Ly.GSh

froK 36 /

 incorrect value of the simulation insert in block 36 of the security control center 12, block 37 of which, together with the network control center 11 and other organizational structures, makes a decision on the localization of unauthorized influences and the elimination of their consequences.

Claims (1)

A system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching that implements IP protocol from unauthorized influences, including user communication lines, a dedicated protected fragment of a public data network with packet switching that implements IP protocol, comprising routers, a network control center and communication lines connecting them, characterized in that the proposed data packet protection system further comprises a security management center included in the network control center and related subscriber security servers installed at the output of the user terminal at the beginning of the user's communication line, as well as network security servers installed at the end of the user communication line at the entrance to the router ports of the selected protected network fragment packet-switched public data communications, with each security subscriber server containing a receiving and isolating unit at the network level from the received packet yes the content of the data field, the block for receiving from the security control center and storing the encryption keys for interaction of the subscriber security server with all network security servers, the block for encrypting the contents of the data field of the data packet received from the user and the formation of a simulation insert that is unchanged during transmission of the data packet, block adding a simulation insert to the encrypted data packet, a block for correcting the header of the data packet and the formation of the converted data packet, bl ok transmission of the converted data packet, a unit for receiving and isolating the converted data packet at the network level, a decryption unit for the received converted data packet and verifying the validity of the received value of the simulation insert, a unit for issuing the decrypted data packet to the user, a block for registering incoming data packets with a mark of data packets received from the wrong value of the simulation insert, the block forming and transmitting messages about the received packet with the wrong value of the simulation insert in the center of security board, which contains a block for generating and distributing encryption keys, a block for receiving messages about data packets received with the wrong value of the simulation insert, a decision block for localizing unauthorized influences and eliminating the consequences of unauthorized influences, and a unit for interacting with the control center of the public data transmission network with packet switching, while each network security server contains a receiving unit from the security control center and stores encryption keys for interacting with each subscriber security server, a unit for receiving and allocating a converted data packet at the network level, a block buffer for placing the received converted data packet, a decryption block for the received converted data packet and verifying the correctness of the received value of the simulation insert in accordance with the algorithm and the encryption key corresponding to the address of the sending subscriber security server, the block of determining the address of the receiving user and the formation in accordance with it, either a command to issue the data packet contained in the buffer block to the router, or commands to encrypt and form a simulation insert of the received and decrypted data packet to issue it to the receiving user’s security server, the transmission unit of the converted data packet from the block buffer to the router, the encryption block of the contents of the data field of the received and decrypted data packet in accordance with the encryption key of the network security server with the subscriber server the security of the receiving user received from the security control center and the formation of the simulation insert for the part of the data packet that is unchanged during the transfer, the block of adding the simulation insert to the encrypted data packet, the block for the header correction of the data packet and the formation of the converted data packet, the transmission unit of the converted data packet to the subscriber security server of the receiving user, block registering incoming data packets with a mark of data packets received with the wrong the beginning of the simulation insert, the block forming and transmitting messages about the received packet with the wrong value of the simulation insert to the security control center.