“кра»нська   ђусский
DonNTU   Masters' portal

Abstract

Content

‚ведение

In today's world, information security is very important. And with the growing use of computer networks, in particular the Internet, the issue of security has become even more relevant. Enterprises need to provide secure access for employees to network resources at any time, for which a modern network security strategy must take into account a number of factors such as:

Security is named the first of the five main problems of the Internet in the action program of the new international initiative to build the Internet of the future. Today, the Internet is an effective, but at the same time unpredictable environment that contains many different threats and dangers. Among the risks to which a computer network is exposed: unauthorized access to network resources (for example, unauthorized reading of files) and prevention of attacks, the purpose of which is to disable certain services provided by the network. Preventing these risks is the goal of network security.

1. Relevance of the topic

The automation system of the admission committee is a whole complex of software. It allows you to simplify and automate the procedure for processing personal data of applicants at all stages of the admission commission, starting with the filing of the application and ending with the enrollment procedure, as well as optimizing the workflow. During the period of receipt, thousands and even tens of thousands of applicants submit their documents. The system stores the personal data of all these applicants. Among them, not only information about education, but also contact and passport data. It is therefore very important to ensure the integrity of personal data, as well as protect them from unauthorized access.

The system for automating the admission commission is based on the principle of a two-tier client-server architecture. The basic principle of the client-server technology is to divide the functions of the application into three groups:

The simplest application functions are performed by stored procedures on the server, and the more complex ones are implemented on the client directly in the application program. The client and server interact with each other on the Internet or on any other computer network using various network protocols. In our case, the HTTP protocol is the hypertext transfer protocol as the data transfer protocol.

Since during the work of the admission committee there is a constant data exchange between the server and t he client, it is very important to ensure the security of this exchange and protect the applicants' personal data from unauthorized access to them.

2. The purpose and objectives of the study, the planned results

The main goal of the work is to ensure the safety of data exchange and the work of the automation system of the selection committee.

To achieve this goal it is necessary to perform the following tasks:

  1. Analysis of possible attacks on the server side.
  2. Analysis of methods for intercepting data during client-server interaction.
  3. Analysis of existing encryption algorithms.
  4. Develop your own way to protect data in a client-server interaction.

The study aims to explore the way to ensure the security of data in the network.

The result of the work will be a proprietary algorithm for the secure transmission of data between the client and the server in the complex of the automation system of the selection committee.

3. Analysis of data interception methods in client-server communication

To intercept data during client-server interaction, this type of attack is used, such as the Mediator Attack (Man in the middle, MITM). The mediator attack, or the man-in-the-middle attack, is a type of attack in cryptography, when an attacker secretly retransmits and, if necessary, changes the connection between two parties who believe that they directly communicate with each other. This attack is aimed at circumventing mutual authentication, or lack thereof, and can succeed only if the attacker has the ability to impersonate himself at each endpoint or go unnoticed as an intermediate node. [3].

To conduct an attack of the MITM type, the following methods are used:

The easiest way to capture data is network sniffing. For sniffing Ethernet networks are usually used network cards, translated into listening mode. To listen to the network using special programs - network analyzers. An example of such a program is Wireshark [2].

The core of the ARP Cache Poisoning attack is a vulnerability in the ARP protocol. Unlike protocols such as DNS, which can be configured to accept only secure dynamic updates, devices using ARP will receive updates at any time. This property of the ARP protocol allows any device to send an ARP response packet to another node in order to require it to update the ARP cache. Sending an ARP response without generating any requests is called sending self-returning ARPs. If there are malicious intentions, the result of well-directed self-referencing ARP packets used in this way may be nodes that consider that they interact with one node, but in reality they interact with a cracker interceptor

To carry out a false routing attack, you need to prepare a false ICMP Redirect Host message in which you specify the final IP address of the route (the host address for which the route will be changed) and the IP address of the false router. Further, this message is transmitted to the attacked host on behalf of the router. For this purpose, the IP address of the router is indicated in the IP header in the sender address field [5]. There are 2 cases: in the first case, the attacker is in the same network segment as the target of the attack. Then, as the IP address of the new router, you specify either your IP address or any of the addresses of this subnet. In the second case, the attacker is in a different segment relative to the target of the attack. Then when sending a false ICMP Redirect message, the attacker himself will not be able to gain control over the traffic, since the address of the new router must be located within the subnet of the attacked host. In this case, access to the information transmitted via the communication channel will not work. But it also disrupts the host[6].

ICMP Redirect Attack Scheme

Figure 1 Р ICMP Redirect Attack Scheme
(animation: 5 frames, looped repetition, 157 KB)

The most sophisticated interception attack of network traffic should be considered a TCP connection capture (TCP hijacking), when a hacker intercepts the current communication session with the host by generating and sending TCP packets to the attacked host. Further, using the TCP protocol's capabilities for restoring an interrupted TCP connection, the hacker intercepts the interrupted communication session and continues it instead of the disconnected client. To identify a TCP packet, there are two 32-bit identifiers in the TCP header, which also play the role of a packet counter, the Sequence Number and Acknowledgment Number. In case if host A wants to establish a TCP connection with host B, the so-called occurs. "Triple handshake", during which hosts exchange the following packets:

Having considered the connection setup scheme described above, you can see that the only identifiers by which the end host can distinguish between TCP subscribers and TCP connections are the Sequence Number and Acknowledge Number fields. Thus, if an attacker determines the ISSa and ISSb values for a given connection, then it will be able to form a false TCP packet that will be received and processed by the end host[7].

4. Analysis of existing encryption algorithms

Encryption is used to store important information in unreliable sources and transfer it over unprotected communication channels.

Encryption is a reversible transformation of information for the purpose of hiding from unauthorized persons, with providing, at the same time, authorized users access to it. An important feature of any encryption algorithm is the use of a key that confirms the choice of a specific conversion from the set of possible ones for a given algorithm. Users are authorized if they possess a certain authentic key. In general, encryption consists of two components - encryption and decryption.

Encryption provides three security states for information:

In order to read the encrypted information, the receiving party needs a key and a decoder (a device that implements the decryption algorithm). The idea of encryption is that an attacker, by intercepting encrypted data and without having a key for them, can neither read nor change the transmitted information. However, with the development of cryptanalysis, techniques have emerged that allow decrypting the closed text without a key. They are based on the mathematical analysis of the transmitted data.

There are three basic encryption methods used in most systems today: hashing, symmetric, and asymmetric encryption.

1 Hashing

A hashing technique uses an algorithm known as a hash function to generate a special string from the data, known as a hash. In the general case (according to the Dirichlet principle) there is no one-to-one correspondence between the hash code (output data) and the source (input) data. The values returned by the hash function (output) are less diverse than the values of the input array (input data). The case in which the hash function converts several different messages into identical bulletins is called a "collision". The likelihood of collisions is used to assess the quality of hash functions.

A "good" hash function must satisfy two properties:

An ideal hash function is a function that maps each key from the set S to a set of integer numbers without collisions. In mathematics, such a transformation is called an injective mapping. Consider popular hashing algorithms.

Algorithms CRC16 / 32 (Cyclic Redundancy Code) - checksum (not a cryptographic transformation). The CRC algorithm is based on the properties of division with the remainder of binary polynomials. The CRC value is essentially the remainder of dividing a polynomial corresponding to the input data into some fixed generator polynomial. There are many standardized generator polynomials with good mathematical and correlation properties (minimal number of collisions, ease of calculation)[8].

Algorithms MD2 / 4/5/6. They are the work of Ron Rayvest, one of the authors of the RSA algorithm. At the moment, this hash function is not recommended for use, since there are ways to find collisions with acceptable computational complexity.

SHA Rule Algorithms Algorithms that are now widespread. There is an active transition from SHA-1 to the standards version of SHA-2. SHA-2 is the collective name of the SHA224, SHA256, SHA384 and SHA512 algorithms. SHA224 and SHA384 are essentially analogous to SHA256 and SHA512, respectively, only after calculating the convolution of the information in it is discarded. It is worth using them only to ensure compatibility with equipment of old models[9].

Bcrypt is an adaptive cryptographic hash key generation function used for securely storing passwords. To protect against attacks using rainbow tables, bcrypt uses salt (salt); in addition, the function is adaptive, its operation time is easily adjusted and it can be slowed down to complicate the brute force attack.

2 Symmetric encryption

Symmetric cryptosystems (also symmetric encryption, symmetric ciphers) (eng. Symmetric-key algorithm) is an encryption method in which the same cryptographic key is used for encryption and decryption. Before the invention of asymmetric encryption schemes, symmetric encryption was the only method that existed. The algorithm key must be kept secret by both parties. The encryption algorithm is chosen by the parties prior to the exchange of messages. Keeping the key in privacy is an important task for establishing and maintaining a secure communication channel. In this regard, there is a problem of the initial transfer of the key (key synchronization). In addition, there are crypto-attack methods that allow one way or another to decrypt information without having a key, or by intercepting it during the coordination phase. In general, these moments are a problem of cryptographic security of a specific encryption algorithm and are an argument when choosing a specific algorithm. Symmetric, and more specifically, alphabetic encryption algorithms were among the first algorithms. Later, asymmetric encryption was invented, in which the keys of the interlocutors are different

3 Asymmetric encryption

In systems with a public key, two keys are used - public and private, linked in a certain mathematical way with each other. The public key is transmitted over the public (that is, unsecured, available for monitoring) channel and is used to encrypt the message and verify the digital signature. The secret key is used to decrypt the message and to generate the EDS.

Asymmetric encryption scheme

Figure 2 Р Asymmetric encryption scheme

This scheme solves the problem of symmetric schemes associated with the initial transfer of a key to another party. If in symmetric schemes an attacker intercepts the key, he will be able to both "listen" and make edits to the transmitted information. In asymmetric systems, the public key is transmitted to the other side, which allows you to encrypt, but not decrypt, information. This solves the problem of symmetric systems associated with the synchronization of keys.

The advantages of asymmetric ciphers over symmetric:

Disadvantages of asymmetric encryption algorithm in comparison with symmetric:

Public key cryptographic systems are now widely used in various network protocols, in particular, in TLS protocols and its predecessor SSL (underlying HTTPS) in SSH.

Conclusion

As a result of research work, materials on issues related to the topic of master's work were collected and studied.

The possibility of an attack on a client-server connection with the help of a Mediator Attack, as well as possible methods for conducting it, was considered.

Methods for data encryption were considered, 3 main methods of data encryption were considered. Analyzed their relevance

Bibliography

  1. Перехват сетевых данных [Электронный ресурс]. — Режим доступа: http://alex-shtilev.narod.ru/diplom/glava16.html. — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  2. Захват сетевых пакетов с помощью программы Wireshark [Электронный ресурс]. — Режим доступа: https://help.keenetic.com/hc/ru/articles/213965969-Захват-сетевых-пакетов-с-помощью-программы-Wireshark. — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  3. Атака посредника [Электронный ресурс]. — Режим доступа: https://ru.wikipedia.org/wiki/Атака_посредника. — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  4. Understanding Man-in-the-Middle Attacks - ARP Cache Poisoning (Part 1) [Электронный ресурс]. — Режим доступа: http://techgenix.com/Understanding-Man-in-the-Middle-Attacks-ARP-Part1/ . — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  5. Навязывание хосту ложного маршрута с использованием протокола ICMP с целью создания в сети Internet ложного маршрутизатора [Электронный ресурс]. — Режим доступа: http://citforum.ru/internet/attack/c44.shtml . — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  6. Understanding ICMP Redirect Messages [Электронный ресурс]. — Режим доступа: https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/nx-os-software/213841-understanding-icmp-redirect-messages.html . — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  7. TCP hijacking [Электронный ресурс]. — Режим доступа: https://ru.wikipedia.org/wiki/TCP_hijacking . — Заглавие с экрана. — (Дата обращения: 06.04.2019).
  8. Брюс Шнайер, Прикладная криптография, 2-е изд. 2012. — 815 с.
  9. Алфёров А.П., Зубов А.Ю., Кузьмин А.С., Черемушкин А.В. Основы криптографии , 2-е изд., испр. и доп. — М.. Гелиос АРВ, 2002. — 480 с., ил
  10. Шифрование [Электронный ресурс]. — Режим доступа: https://ru.wikipedia.org/wiki/Шифрование . — Заглавие с экрана. — (Дата обращения: 06.04.2019).