RU191373U1 - MULTI-SERVICE ROUTER WITH MASKING INFORMATION DIRECTIONS - Google Patents

Abstract

A multi-service router with masking of information directions is designed to build data transmission systems and routed networks with message packet switching and can be used to implement secure (secure) information exchange through public communication networks such as the Internet. The technical result is to ensure the security and secrecy of the communication channel on the Internet by complicating the procedure for determining addresses and identifying the relationships of remote segments of a distributed data transmission system when analyzing traffic at some point on the Internet by continuously changing the addresses of the external interfaces of routers that provide output sender and recipient of message packets to the Internet, which makes it almost impossible to identify them, id Identification and opening of the structure of a distributed data transmission system. Ensuring the noise immunity of the device under conditions of intentional and unintentional interference, which lead to packet loss during transmission, is provided by continuously determining the current time and issuing signals to synchronize the data transfer process between routers that vary the addresses of their external interfaces. The specified technical result is achieved by the fact that in the device locally or remotely initialize the masking module information directions. Initialization of the module consists in obtaining, decoding, and applying the device configuration information containing matrixes of connectivity of masked information directions by MAC addresses and IP addresses, and the value of the time parameter for their change. The decoded matrix of connections of the masked information directions by MAC addresses and IP addresses is stored respectively in the block for changing the parameters of the data link layer (M4C addresses) and in the block for changing the parameters of the network layer (IP addresses). These matrices are pointers for varying the addresses of the external interfaces of the router selected for organizing masking information directions, and their connectivity, that is, the masking logic, is available for reading from the ternary associative memory. 2 ill.

Description

The proposed utility model relates to the field of data transmission systems and routed networks with message packet switching, in particular, to modular scalable structures for building fast Ethernet routers, and can be used to implement secure (secure) information exchange through public communication networks, such as The Internet.

The known analogue "Protection system for connected computer networks" according to the patent of the Russian Federation No. 2152691 IPC G06F 12/14, publ. 07/10/2000, consisting in the fact that the device contains a first network motherboard and a second network motherboard, each of these first and second network motherboards has a network interface adapter for exchanging with the specified first and second computer networks, respectively, each of these The network motherboard additionally has a transfer adapter for exchanging with the transfer adapter of another network motherboard, these transfer adapters are paired and identical, each of the network motherboards has network software to prevent the transfer of information about routing services between network interface adapters and the transfer adapter of each of the network motherboards, each network motherboard additionally contains protocol conversion software that impedes the passage of top-level protocol information and information about the source address and destination address between the specified network interface adapter and the specified transfer adapter of each network motherboard, etc. than at least one of the network motherboard has intermediate software application programming interface to provide application level tasks sharing services of computers connected to the at least one network motherboard.

The disadvantage of this device is the low secrecy of information areas when organizing communication between computer networks through public communication networks, such as the Internet.

A device for protecting a communication channel of a computer network according to the patent of the Russian Federation No. 2306599, IPC G06F 21/00, publ. September 10, 2007, which consists in the fact that the device contains a local security segment (LSS), the first and second inputs / outputs of which are connected respectively to a LAN and a router connected to the Internet, and containing an address base storage unit (BBCA), a processor , coding / decoding unit (CD), information input and output, the “password” and “conversion type” inputs of which are connected to the corresponding processor ports, an address selection unit (BVA), an operational storage unit for current addresses (BOHTA) are additionally introduced in the LSZ, first and second etevoy adapter (CA). The control input of the BVA is connected to the “address” port of the processor, and the x-bit output of the address selection block is connected to the x-bit input of the BHBA. In BHBA, the m-bit output is connected to the m-bit input of BOHTA. The control input and m-bit output of BOHTA are connected respectively to the port "request the current address" and the m-bit port "current address" of the processor. In the first SA, n-bit output and input are connected respectively to the n-bit input “source packet” and output “source packet” of the processor. Moreover, the output of the "local area network" of the first CA is the first input / output of the LSZ. In the second C A, the p-bit input and output are connected respectively to the p-bit output and the “information / notification” input of the processor, and the t-bit processor control port is connected to the t-bit control input of the second CA. The “Internet” output of the second CA is the second input / output of the LSZ.

The disadvantages of this device are the narrow scope and relatively low noise immunity. The narrow scope is due to the lack of support for routing protocols and, as a consequence, the inability to use the device for information exchange through public communication networks such as the Internet, without an additional router. Relatively low noise immunity is due to the fact that the presence of intentional and unintentional interference in data transmission networks leads to packet loss during transmission, which leads to interruptions in the process of receiving and transmitting message packets in the process of changing address information.

The closest technical solution adopted for the prototype is the utility model "Multiservice Router", according to the patent of the Russian Federation No. 186859, IPC H06L 12/701 (2013.01), publ. 02/06/2019 Bull. Number 4. The prototype relates to data transmission systems, in particular to a modular, scalable structure for building routers of fast Ethernet networks. A multiservice router comprises a switching unit and a route processor, interconnected by the first inputs / outputs, a ternary associative memory, the output of which is connected to the third input of the route processor; a first processor module, the first input / output of which is connected to the third input / output of the switching unit; a second processor module, the first input / output of which is connected to the second input / output of the switching unit; a high-speed packet data processing module with a non-blocking high-speed FPGA-based switching matrix, the first output of which is connected to the second input of the first processor module, the second output to the second input of the second processor module, and the third output to the second input of the route processor; the first COM port, the input / output of which is connected to the third input / output of the first processor module; a second COM port, the input / output of which is connected to the third input / output of the second processor module; the first Ethernet port, the input / output of which is connected to the fourth input / output of the first processor module; a second Ethernet port, the input / output of which is connected to the fourth input / output of the second processor module; N SFP modules, the inputs / outputs of which are connected, respectively, with N inputs / outputs of the route processor; a synchronization module, the first output of which is connected to the fifth input of a high-speed packet data processing module with a non-blocking high-speed FPGA switching matrix (FPGA), and the second output is connected to the fourth input of a high-speed packet data processing module with a non-blocking high-speed FPGA switching matrix (FPGA) .

This prototype supports routing protocols, provides reliable and continuous determination of the current time and the issuance of signals synchronized with the assigned system time scale, thereby achieving the ability to synchronize devices. By filtering network packets and converting (translating) network addresses, the device allows you to hide the IP addresses of subscribers of subnets from each other.

The disadvantage of the prototype device is the relatively low security and secrecy of the communication channel. This drawback is due to the fact that the communication channels of the remote segments of the data transmission system connected by such devices via the Internet are easily distinguished by analyzing traffic at some point on the Internet, since they are characterized by a high rate of exchange of message packets with the same addresses of the external interfaces of the routers. In this case, it is possible to determine the addresses of the remote segments of the data transmission system and the disclosure of the structure of a distributed data transmission system. Such information is enough to disrupt information exchange, or to carry out destructive influences with respect to a distributed data transmission system, in particular, to the device itself.

The purpose of the proposed utility model is to ensure the security and secrecy of the communication channel on the Internet by complicating the procedure for determining addresses and identifying the relationships of remote segments of a distributed data transmission system when analyzing traffic at some point on the Internet by continuously changing the addresses of the external interfaces of routers in transmitted message packets, providing the sender and receiver of message packets to the Internet, which makes it almost impossible to determine division, identification and opening of the structure of a distributed data transmission system. To ensure the noise immunity of the device under conditions of intentional and unintentional interference, which lead to packet loss during transmission, it is necessary to continuously determine the current time and issue signals to synchronize the data transfer process between routers that vary the addresses of their external interfaces.

This goal is achieved in that in a device containing a switching unit and a route processor, interconnected by the first inputs / outputs, a ternary associative memory, the first output of which is connected to the third input of the route processor, a processor module, the first input / output of which is with the second input / output of the switching unit, a high-speed packet data processing module with a non-blocking high-speed FPGA-based switching matrix, the first output of which is connected to the second input processor module, the third output - with the second input of the route processor; COM port, the input / output of which is connected to the third input / output of the processor module; Ethernet port, the input / output of which is connected to the fourth input / output of the processor module; TV SPF modules, the inputs / outputs of which are connected, respectively, with N inputs / outputs of the route processor; a synchronization module, the first output of which is connected to the fifth input of a module with a non-blocking high-speed FPGA switching matrix (FPGA), and the second output - with a fourth input with a non-blocking high-speed FPGA switching matrix, an additional masking module has been introduced; unit for changing the parameters of the data link layer (M4C addresses); unit for changing network layer parameters (IP addresses). The first input of the information direction masking module is connected to the fifth output of the processor module. The second output of the information direction masking module is connected to the second input of the channel level parameter change unit (MAC addresses), the first output of which is connected to the second input of the ternary associative memory. The third output of the information direction masking module is connected to the second input of the network layer parameter changing unit (IP addresses), the first output of which is connected to the third input of the ternary associative memory. The fourth input of the information direction masking module is connected to the second output of the high-speed packet data processing module with a non-blocking high-speed FPGA-based switching matrix.

All elements of a multiservice router with masking of information directions are made using digital technologies.

Comparison with the prototype shows that the inventive device is characterized by the presence of new units and their connections between them. Thus, the claimed device meets the criterion of "novelty."

The introduction of these new elements in this connection with other elements leads to a change in the transmitted message packets of the addresses of the external interfaces of the routers, which provide the sender and receiver of message packets to the Internet, which makes it almost impossible to determine, identify and open the structure of the distributed data transmission system. This confirms the conformity of the technical solution to the criterion of "significant differences".

The claimed utility model is illustrated by drawings:

FIG. 1 is a block diagram of a multiservice router with masking information directions;

FIG. 2 is an illustration of the principle of masking information directions by varying the IP addresses of the interfaces of a multiservice router.

The device operates as follows. Routing in data networks is the process of determining the route of message packets in data networks. There are static routes that are defined administratively, and dynamic routes that are calculated using routing algorithms, based on information about the topology and network status obtained using routing protocols (from other routers).

Internet routing is based on the TCP / IP family of protocols. In the case of routing IP packets, the router, which transmits message packets of corresponding subscribers to the public communication network, implements network address translation - NAT (from the Network Address Translation) - a mechanism for dynamically replacing IP addresses passing through it to the public communication network message packets to the IP address of its external interface.

In the data networks of telecom operators, it is possible to route not only IP packets, but also Ethernet frames by organizing data link-level virtual private networks (from the English Virtual Private Networks) (the so-called Layer 2 Virtual Private Networks, L2VPN). For this, the mechanism of multi-protocol label switching is MPLS (from the English multiprotocol label switching), which consists in transferring data from one network node to another using labels. MPLS is a scalable and protocol independent data transfer mechanism. The decision to transfer the data packet to another network node is carried out only on the basis of the value of the assigned label without the need to analyze the data packet itself. Due to this, it is possible to create an “end-to-end” virtual channel independent of the transmission medium and the used data transfer protocols.

The routing function of message packets in the device is performed by a specialized route processor (1), in which the software performs analysis of the contents of the message packet, translation of network addresses, and direction to the desired interface (9) in accordance with the routing table, which is formed by the processor module (5). Local configuration of the device is carried out through the COM port (8) and Ethernet port (7), connected directly to the processor module (5). To switch N SFP modules (9) to the route processor, a switching unit (RSG switch) is used, see block 2 in FIG. 1. SFP (from the Small Form-factor Pluggable) is an industry standard for modular compact transceivers (transceivers) used to connect a network device card (in particular, a router) to a cable line (optical fiber or unshielded twisted pair cable) and matching electrical interface parameters (interface).

The routing table is formed during device initialization using static or dynamic routing using the processor module (5). The generated table is stored in the ternary associative memory (4) used in the device to increase its speed when searching in the routing table. Upon receipt of the message packet through the SFP module (9), the route processor (1) analyzes the header of the message packet, and according to the results of the analysis, if a service message packet is found, sends it to the processor module (5) through the high-speed packet data processing module (3) with non-blocking high-speed switching matrix based on programmable logic integrated circuits, FPGA, or FPGA (from the English Field-Programmable Gate Array), user-programmable gate arrays.

Otherwise, that is, in case of detection of a transit (non-service message packet), the route processor (1) searches for routing information in the routing table stored in the ternary associative memory (4), and, based on the search results, broadcasts the message packet through the corresponding SFP module (9) to the network.

The synchronization module (6) is designed to provide noise immunity of the device under conditions of intentional and unintentional interference, by providing continuous determination of the current time and outputting 10 MHz and 1 Hz signals to the module (3) of high-speed processing of packet data with a non-blocking high-speed FPGA switching matrix (FPGA) )

To activate the information masking functions in the device, the information direction masking module is initialized (10). Initialization can be carried out locally, transmitting control information via the COM port (8) and Ethernet port (7) via the processor module (5), the fifth output (5.5) of which is connected to the first input (12.1) of the information direction masking module (10), or remotely transmitting service message packets received by the SFP module (9) through a route processor (1) and a high-speed packet data processing module (3) with a non-blocking high-speed FPGA-based switching matrix, the output (3.2) of which is connected to the input (10.4) of the module mask tion of information areas (10). The initialization of the information direction masking module (10) consists in obtaining, decoding, and applying the device configuration information containing matrixes of connected information direction masked by M4C addresses and IP addresses, and the value of the time parameter for their change (in practice, the value of this parameter is selected in the range from 1 to 10 seconds).

Matrices of masked information directions decoded by the information direction masking module (10) for the M4 C addresses and IP addresses are stored in the block (11), respectively, of the change in the data link layer parameters (M4C addresses), the input (11.2) of which is connected to the output (10.2) module for masking information directions (10), and in block (12) changing the parameters of the network layer (IP addresses), the input (12.2) of which is connected to the output (10.3) of the module for masking information directions (10). These matrices are pointers for varying the addresses of the external (external) interface (s) of the router selected (selected) for organizing masking information directions, and their connectivity, that is, the logic of masking information directions, is available for reading from the ternary associative memory (4), input (4.2) which is connected to the output (11.1) of the block (11) changing the parameters of the data link layer (MAC addresses), and the input (4.3) is connected to the output (12.1) of the block (12) changing the parameters of the network layer (IP addresses). The information direction masking module (10), the block (11) for changing the parameters of the data link layer (MAC addresses) and the block (12) for changing the parameters of the network layer (IP addresses) can be implemented using Soft microprocessors and (or) memory chips, for example such as EEPROM (from the English Electrically Erasable Programmable Read-Only Memory) - an electrically erasable reprogrammable read-only memory device, or flash memory.

For routers in which the masking of information directions module (10) is missing or not initialized, as well as for software analyzing the availability of network interfaces, or analyzing the traffic of message packets at some point in the public communication network, a masked information direction will be presented (“look” ) as a set of changing information directions (MAC- and (or) IP-addresses) in accordance with the set value of the parameter of their change. An illustration of the principle of masking information directions by varying the IP addresses of the interfaces of a multiservice router is shown in FIG. 2. FIG. 2a illustrates an example of an unmasked information direction between router interfaces with IP addresses 213.196.77.15 and 210.196.76.18. Suppose that when masking is initialized, each of the interacting routers performs masking of one interface — with IP addresses 213.196.77.15 and 210.196.76.18, respectively (see Fig. 2, a). Let the configuration file set the masking redundancy for each IP address equal to four, and the value of the time parameter for their change is 1 second. The matrix of connections of masked information directions by IP addresses is presented in FIG. 2, b. Then, after approximately 10 seconds, the ideal observer, instead of one information direction, “sees” the 10 information directions shown in FIG. 2, c.

Thus, thanks to a new set of essential features in the claimed utility model, the security and secrecy of the communication channel on the Internet is ensured by complicating the procedure for determining addresses and identifying the relationships of remote segments of a distributed data transmission system when analyzing traffic at some point on the Internet by continuously changing the transmitted message packets of addresses of external interfaces of routers providing the output of the sender and recipient of message packets in It is the Internet, making it virtually impossible to their definition, identification and dissection of the distributed data communication system structure. To ensure the noise immunity of the device under conditions of intentional and unintentional interference, which lead to packet loss during transmission, the current time is continuously determined and signals are generated to synchronize the data transfer process between routers that vary the addresses of their external interfaces.

A multiservice router with masking information directions is industrially applicable, since it can be implemented on the basis of an industrial computer, which allows the use of freely distributed Linux family software (for example, VyOS) for building routers, and allows the installation of a wide range of additional expansion cards.

Claims (2)

1. A multiservice router with masking information directions, comprising a switching unit and a route processor connected by first inputs / outputs, a ternary associative memory, the first output of which is connected to the third input of the route processor, a processor module, the first input / output of which is connected to the second input / output of the switching unit, a high-speed packet data processing module with a non-blocking high-speed FPGA-based switching matrix, the first output of which is Inonii to the second input of the processor module, the third output - to a second input of the routing processors; COM port, the input / output of which is connected to the third input / output of the processor module; Ethernet port, the input / output of which is connected to the fourth input / output of the processor module; N SPF modules, the inputs / outputs of which are connected, respectively, with N inputs / outputs of the route processor; synchronization module, the first output of which is connected to the fifth input of the module with a non-blocking high-speed switching matrix based on FPGAs (FPGA), and the second output - with the fourth input of a module with a non-blocking high-speed switching matrix based on FPGAs (FPGA), characterized in that it is additionally introduced module for masking information areas; block changing the parameters of the data link layer (MAC addresses); unit for changing network layer parameters (IP addresses); the first input of the information direction masking module is connected to the fifth output of the processor module; the second output of the information direction masking module is connected to the second input of the channel level parameter change module (MAC addresses), the first output of which is connected to the second input of the ternary associative memory; the third output of the information direction masking module is connected to the second input of the network layer parameter changing unit (IP addresses), the first output of which is connected to the third input of the ternary associative memory; the fourth input of the information direction masking module is connected to the second output of the high-speed packet data processing module with a non-blocking high-speed FPGA-based switching matrix.  2. A multi-service router with masking of information directions according to claim 1, characterized in that all its elements are made using digital technologies.

Images