RU16964U1 - DATA PACKAGE PROTECTION SYSTEM IN THE PROCESS OF THEIR TRANSFER IN THE ALLOCATED PROTECTED FRAGMENT OF THE GENERAL USE DATA TRANSFER WITH COMMUTATION OF PACKAGES FROM UNAUTHORIZED INFLUENCE - Google Patents

Description

A system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences.

The proposed utility model relates to computing, in particular to systems for ensuring the security of the data transfer process in public data networks with packet switching X.25, Frame Relay, etc.

Known public data networks with packet switching X.25, Frame Relay, etc., connecting users of information systems using hardware-software communications that protect the transmitted data from modification due to accidental interference, but do not provide protection against intentional unauthorized influences G. N. Ustinov. Fundamentals of information security of systems and data transmission networks, Moscow, SINTEG, 2000, pp. 26-56, .59,

Closest to the proposed technical solution is a public switched data network with packet switching, containing subscriber lines, packet switching centers, a network control center and communication lines connecting them. G.N. Ustinov. Fundamentals of information security of data transmission systems and networks, Moscow, SINTEG, 2000, p. 26, prototype.

The disadvantage of this network is the lack of mechanisms to protect the transmitted user data packets from distortion due to unauthorized influences during transmission

data packets on a public switched data network with packet switching and protecting the information sphere of a public switched data network with packet switching from remote unauthorized influences by information weapons.

The proposed utility model solves the technical problem of ensuring the reliability of the transmitted data packets with a dedicated protected fragment of a public data transmission network with packet switching and protecting the information sphere of a selected protected fragment of a public data transmission network with packet switching from remote unauthorized influences.

The stated technical problem is solved in that the system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences, including a dedicated protected fragment of a public data network with packet switching, containing subscriber lines, switching centers packages, the network control center and the communication lines connecting them, further comprises a security control center included in the control center network, and associated subscriber security servers, installed either at the output of the user terminal at the beginning of the subscriber line, or at the entrance to the port of the packet switching center of the selected protected fragment of the public data network with comm) packets at the end of the subscriber line of users of the selected protected fragment packet switched public data networks, with each security subscriber server containing a block

fc tJ-t //

receiving and extracting at the network level from the received data packet the contents of the data field, a block for receiving from the security control center and storing encryption keys for each pair of interacting subscriber security servers, a block for encrypting the contents of the data field of the data packet received from the user and forming for the part that is unchanged during transmission a data package of a simulation insert, a block for adding a simulation insert to a transmitted data packet with the formation of a converted data packet, a block transmitting the converted data packet, a receiving and isolating unit at the network level of the converted data packet, a decrypting block of the received transformed data packet and verifying the validity of the received value of the simulation insert, a unit for issuing the decrypted data packet to the user, an incoming data packet registration unit with a mark of the data packets received with the wrong the value of the simulation insert, the unit for generating and transmitting a message about the received packet with the incorrect value of the simulation insert to the control center security, which contains a block for generating and distributing encryption keys to subscriber security servers, a block for receiving messages about data packets received with the wrong value of the simulation insert, a decision block for localizing unauthorized influences and eliminating the consequences of unauthorized influences, and an interaction unit with a network control center data transmission of general use with packet switching, while the subscriber security server installed at the beginning of the subscriber research institutes, on the one hand is connected with the user terminal, on the other hand is associated with a subscriber line and subscriber security server.

installed at the end of the subscriber line, is connected on the one hand with the subscriber line, and on the other hand with the access port to the packet switching center of the selected protected fragment of the public data network with packet switching.

Such an implementation of the data packet protection system during their transmission in a dedicated protected fragment of a public data transmission network with comms: packets can be protected from unauthorized influences and this technical task can be solved by the data packets transmitted in the selected protected fragment of a data transmission network added to the protection system of general use with packet switching from unauthorized influences, a security control center and subscriber networks interacting with it security rovers that perform the functions of protecting data packets without changing the functions performed by the main components of a packet-switched public data network. When the selected protected fragment of the public data transfer network is transferred to the packet switching center with the packet switching of each data packet, the subscriber’s security server of the transmitting user encrypts the part of the data packet that is not changed during the transmission process and imitates the data in the received data packet data field in accordance with with the encryption algorithm used, for example, according to GOST 2814789, and the encryption key selected for this pair of interacting subscriber servers security measures, i.e. to the data packet of length k binary symbols transmitted to the packet switching center of the selected protected fragment of the data transmission network is formed

simulation insertion of length m of binary symbols, as a result of which a transformed binary symbol length data packet is generated. In the subscriber security server of the receiving user at the network level, in accordance with the decryption algorithm, for example, according to GOST 28147-89, the transformed data packet received from the packet switching center is decrypted and the value of the simulation insert contained in the received converted data packet is verified and issued if the correct value of the simulation insert of the decrypted data packet to the user; if the simulation value is incorrect, the received converted data packet is erased. Data packets received at the network level are registered with the mark of the data packet simulation insertion that has not passed the correctness control, a message about the failed data packet is generated, which is transmitted to the security control center, while the transmitted message is protected by the selected protection protocol from being rejected. The distribution of encryption keys for each pair of subscriber security servers that interact during the transfer of a data packet in a dedicated protected fragment of a public data network with packet switching when using a single-key encryption system is organized by the security control center either using manual mode based on smart cards, or using a secure protocol for the interaction of the security control center with subscriber security servers via communication channels, aryadu with the security management center, together with a network management center and other organizational network structures

public data transmission with packet packages solves the problems of localizing unauthorized influences and eliminating their consequences on the basis of information received from subscriber security servers.

Thus, the security protocol implemented by the subscriber security servers, as well as the functions that ensure the implementation of the implemented security protocol, allow you to detect the modification of the transmitted data packets and, together with the Security Control Center and the network control center, provide the specified reliability and reliability of the delivery of the transmitted data packets to the user with a dedicated protected fragment of a public data network with packet switching and protecting the information sphere of this fragment from remote unauthorized influences. The guaranteed reliability of each transmitted data packet with a highlighted protected fragment of a public switched data network with packet switching is determined by the probability value of the occurrence of an undetectable

the subscriber security server distorted data fields in each data packet due to unauthorized

impact equal to „-„

Jt then 2

The essence of the proposed technical solution is illustrated by the scheme for two interacting subscriber security servers, shown in FIG. 1. The system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences contains subscriber lines 1 and 2, connecting respectively

user terminals 3 and 4 s through subscriber security servers 5 and 6, installed at the beginning of subscriber lines 1 and 2, with a packet switching center 7 of a dedicated protected fragment 8 of a public data network with packet switching, containing a network control center 9 and a security control center 10, while the subscriber security servers 5 and 6 respectively contain blocks 11 and 12 for receiving and extracting at the network level from the received data packet the contents of the data field, blocks 13 and 14 for receiving from the control center without passivity 10 and storage of encryption keys for each pair of interacting users, blocks 15 and 16 of the encryption of the contents of the data field of the data packet received from the user and the formation of the simulation insert unchanged during transmission of the data packet, blocks 17 and 18 of adding the simulation insert to the transmitted data packet with the formation of the converted data packet, blocks 19 and 20 of the transmission of the converted data packet, blocks 21 and 22 of reception and allocation at the network level of the converted data packet, blocks 23 and 24 of the races marking the converted data packet and verifying the validity of the received value of the simulation insert, blocks 25 and 26 for issuing the decrypted data packet to the user, blocks 27 and 28 for registering incoming data packets with a mark of the data packets received with the incorrect value of the simulation insert, blocks 29 and 3. the received data packet with the wrong value of the simulation insert in the security control center 10, which contains the block 31 of the formation and distribution of subscriber servers securely STI keys schifrovaniya unit 32 receiving the data packet message with an invalid value

simulation insert, block 33 making decisions on the localization of unauthorized influences and eliminating the consequences of unauthorized influences and block 34 interacting with the control center of the network 9 for transmitting public data with packet switching.

In FIG. 2 shows a diagram of a system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences, which differs from the circuit shown in FIG. 1 only in that the subscriber security servers 5 and 6 are installed at the end of the subscriber lines 1 and 2 directly at the ports of the respective packet switching centers 7 of the dedicated protected fragment 8 of the public switched data network with packet switching.

The proposed system for protecting data packets during transmission in a dedicated protected fragment of a packet-switched data network is as follows.

When a data packet is transmitted from user 3 to user 4, block 11 of the subscriber security server 5 receives and extracts the contents of the data field from the received data packet at the network level, block 13 receives encryption keys from block 31 of the security control center 7 for all pairs interacting with this subscriber server security of subscriber security servers, block 15 selects from block 13 an encryption key for an interacting pair of subscriber security servers 5 and 6 and in accordance with it and with the encryption algorithm, an example, according to GOST 28147-89, encrypts the contents of the data field of the received data packet and generates for the part of the data packet that is unchanged during transmission

J / 2i 39 simulation insert, block 17 adds a simulation insert to the transmitted data packet with the formation of the converted data packet, block 19 transmits the converted data packet to the packet switching center 7 of the dedicated protected fragment 8 of the public switched data network with packet switching, from where the converted data packet arrives to the subscriber security server 6 of user 4. Block 22 of the subscriber security server 6 receives and allocates the converted data packet at the network level, block 24, respectively With the encryption key obtained from block 14 and the decryption algorithm, for example, according to GOST 28147-89, it decrypts the received converted data packet and checks the correctness of the received simulation insert, and block 26, with the correct value of the simulation insert, gives the received data packet without simulation insert to user 4 . When fixing the wrong value of the simulation insert in the received data packet, the data packet is erased, block 28 registers the incoming data packets with a mark of the data packets received from the wrong m value of the simulation insert, block 30 generates and transmits a message about the received data packet with the incorrect value of the simulation insert to block 32 of the security control center 10, block 33 of which, together with the network control center 9 and other organizational structures, decides to localize unauthorized influences and eliminate them consequences.

Shown in FIG. 2 circuit protection system

J3, esse of their data packets in the selected protected fragment

from unauthorized influences works in a similar way.

Proposed package protection system

, In the process of ch. Er & dlc, a given protected fragment of the transmission network

public data with packet switching from unauthorized influences when installing subscriber security servers at the output of the user terminal at the beginning of subscriber lines of the allocated protected fragment of the public data network with packet switching includes subscriber lines, i.e. the scope of protection of the selected protected fragment of the public data transmission network with it is expanding (package identification, in this case, the subscriber security servers are installed at the request of users of the selected protected fragment of the public data transmission network with packet switching in the protected territory of users.

Claims (1)

A system for protecting data packets during transmission in a dedicated protected fragment of a public data network with packet switching from unauthorized influences, including a dedicated protected fragment of a public data network with packet switching, containing subscriber lines, packet switching centers, a network control center and lines communications connecting them, characterized in that it further comprises a security control center included in the network control center, and associated with Bondent security servers installed either at the output of the user terminal at the beginning of the subscriber line, or at the entrance to the port of the packet switching center of the dedicated protected fragment of the public data network with packet switching at the end of the subscriber line of the dedicated protected fragment of the public data network with packet switching, in addition, each subscriber security server contains a block for receiving and isolating at the network level from the received data packet the contents of the data field, block radiation from the security management center and storing encryption keys for each pair of interacting subscriber security servers, a block for encrypting the contents of the data field of the data packet received from the user and generating a simulation insert unchanged during transmission of the data packet, a block for adding the simulation insert to the encrypted data packet with the formation the converted data packet, the transmission unit of the converted data packet, the reception and allocation unit at the network layer is converted of the data packet, the decryption unit of the received transformed data packet and verifying the correctness of the received value of the simulation insert, the issuing unit of the decrypted data packet to the user, the registration block of incoming data packets with the mark of the data packets received with the incorrect value of the simulation insert, the block of generation and transmission of a message about the received packet with the wrong value of the simulation insert in the security control center, which contains the block for the formation and distribution of subscriber servers security of encryption keys, a unit for receiving messages about data packets received with the wrong value of the simulation insert, a decision-making unit for localizing unauthorized influences and eliminating the consequences of unauthorized influences, and an interaction unit with a control center for a public data network with packet switching, while a subscriber security server installed at the beginning of the subscriber line, on the one hand connected to the user terminal, and on the other hand connected to the subscriber iniey and subscriber security server installed at the end of the subscriber line, is connected on one side to the subscriber line, and on the other side of the port access to the packet switching center dedicated protected fragment public data packet network.