Search

The paper is devoted to the actual problem of compression of processed and transmitted data, as well as of the data storage and protection. The analysis and features of data compression methods are presented. The method of universal coding by triples of binary sets (CT) is considered. The method is intended for lossless compression of binary data under conditions of unknown message source statistics. The method is based on dividing the original sequence of binary data into blocks of length n . Based on the analysis of the contents of the n–block, three parameters are assigned to each block: the number of units in the block, the sum of the unit position numbers, and the number of this particular combination in the corresponding prefix class. Approaches to reducing the complexity of procedures for calculating the parameters of CT are considered. A tabular algorithm for calculating coefficients and an algorithm for filling table rows using a recursive relation for elements of sets and an estimate of the amount of memory for storing tables as well as the ways to reduce the memory capacity are presented. The dependence of the bit width of the QT codewords on the bit width of n -blocks is considered. The approaches and features of the use of coding by triplets for information protection are analyzed.

The paper presents the results of simulation modeling of the dynamics of the implementation of a network attack in its conflict interaction with the information protection system from unauthorized access of an automated system in the form of quantitative values of the probabilistic and time characteristics of the attack. The aim of simulation modeling is to identify the possibility of using the results obtained in calculating the implementation probability and conducting an accurate quantitative assessment of the risk of network attacks on the information resource of automated systems operated in a protected version at the objects of Informatization of internal Affairs bodies. A generalized formal model of the functioning of a destabilizing influence is presented and a Petri-Markov network is constructed that reflects the dynamics of the information conflict, taking into account the differences in the capabilities of the conflicting parties. A simulation model describing the mechanism of information conflict "Network attack – protection system" was developed, and simulation was performed using the "CPN Tools" software environment. The results of simulation modeling are presented in the form of time statistics of the process of implementing a network attack in the dynamics of conflict interaction with the protection system. The average implementation times of typical network attacks on the information resource of protected automated systems of internal Affairs bodies, obtained by simulating these attacks using the Petri-Markov network in the "CPN Tools" software environment, are given. The prospects of using the results obtained to improve the real security of automated systems in their development and operation at the objects of Informatization of internal Affairs bodies are outlined.

Цель статьи – комплексный анализ вопросов технологической независимости и информационной безопасности вычислительных систем. Применение системного подхода предполагает анализ технологий защиты на всех уровнях архитектуры и их взаимодействие между собой. Рассматриваются аппаратные технологии защиты на уровне процессора и системы команд. Аппаратная поддержка виртуализации, которая обеспечивает поддержку со стороны аппаратного обеспечения такой функции как виртуализация операционных систем, становится необходимой функцией защиты и не уступает в важности уже классическим функциям: управление доступом, идентификация, аутентификация, аудит и контроль безопасности. Помимо аппаратной поддержки виртуализации рассмотрены реализации в современных процессорах группы технологий аппаратной поддержки обособленной доверенной среды. Проведен анализ возможности использования аппаратных технологий защиты злоумышленниками для вредоносных воздействий. По результатам исследований предложен подход по созданию отечественной защищенной архитектуры средств вычислительной техники (СВТ) с использованием зарубежных аппаратных технологий защиты. При этом импортозамещение не должно сводиться исключительно к репликации зарубежных решений, т.к. зарубежные СВТ содержат массу недокументированных возможностей и, как следствие, несут угрозу информационной безопасности.

This paper describes the methodology for comprehensive assessment of the vulnerability of critical information infrastructure (CII) and its critical elements at hazardous production facilities, including those of the fuel and energy production. The elements of CII at such enterprises, first of all, include automated control systems for technological processes. The smooth operation of complex technological and production processes based on critical elements depends on the normal functioning of the CII. Therefore, the assessment of vulnerabilities in the information security system, as well as the study of the security system stability at the facilities as a whole, will allow taking preventive measures against various types of threats. The following methods were used in this study. Methods of system analysis (decomposition and synthesis): when assessing the resilience of an information system as a whole, its hierarchical structure is considered using the example of a graph with possible structural connections of the components (assets) of the system. Four types of asset relationships are considered (their complete independence, weak dependence, strong dependence, feedback). Assessing the resilience of the system as a whole is based on calculating the resilience of its paired assets and information technology of recurrent recalculation when new components are connected. The method of simulation modeling, in particular, for modeling the impact of information security risks on CII in conditions of incomplete and ambiguous data on their components, logical and probabilistic methods - for assessing the impact of risks both on the components (assets) of the information system, and the system as a whole, taking into account the hierarchical relationship of these assets. The Monte Carlo method was used to assess the impact of the basic threat of "technical impact" (information security and physical protection systems) on the security risks of production facilities. The implementation of measures to assess the resilience of information systems and the security systems stability is focused on critical objects in medicine, education, industry, and public administration.

В статье описывается разработанная авторами виртуальная лабораторная среда для обучения навыкам тестирования на проникновение с обоснованием принятых проектных решений, а также результаты проведенного исследования применимости разработанной виртуальной лабораторной среды для обучения навыкам тестирования на проникновение в учебном процессе по направлению подготовки 10.03.01 «Информационная безопасность». Показано, что виртуальная лабораторная среда для обучения навыкам тестирования на проникновение вполне может быть реализована с использованием программного обеспечения с открытым исходным кодом. Реализованная программная среда предъявляет достаточно умеренные требования к аппаратной платформе (конкретизированные в тексте статьи), на которой она должна выполняться. Проведенное исследование применимости показало, что разработанная виртуальная лабораторная среда может быть использована в учебном процессе с применением дистанционных образовательных технологий и позволяет сформировать у студентов практические навыки использования методов тестирования на проникновение на примерах объектов различных уровней сложности.

Целью написания статьи является рассмотрение вопросов связанных с обеспечением безопасности информации информационных систем (ИС). Актуальность работы обусловлена, прежде всего, тем, что число кибератак на различные сферы экономики российского государства не уменьшается, а с каждым годом продолжает расти. Наблюдается растущий интерес к информации, циркулирующей в государственных органах управления (всех уровней) и государственных информационных систем (ГИС). Порой важные стратегические (государственные) задачи зачастую приходится отодвигать на «задний» план перед необходимостью решения срочных (важных сиюминутных) тактических задач. ГИС это неотъемлемая часть достаточно сложной системы управления, а (само) управление (фактически) становится ситуационным, а значит, и роль структур государственного управления, и ГИС, в этих условиях не утратила своей актуальности. Предметом исследования в работе является обеспечение безопасности ГИС в условиях неопределенности. Для достижения поставленной цели в работе проводится анализ нормативно правовых актов Российской Федерации. ГИС рассмотрены, как объекты компьютерных атак в условиях неопределенности. Разработана методика категорирования ГИС. В статье рассмотрены основные определения, аргументы и приведены источники, подтверждающие важность оценки угроз безопасности информации ГИС. В результате проведенных в работе исследований подтверждены возрастающая значимость защиты и актуальность разработки методики по оценке угроз безопасности информации. Вывод: правильно поставленная работа (с исходными данными) для проведения исследования в условиях высокой степени их неопределенности является ключевым моментом в решении любых задач, связанных с обеспечением информационной безопасности, в том числе и ГИС. Результаты исследования могут быть использованы при разработке методики оценки угроз безопасности государственных информационных систем.

В статье представлены результаты анализа и синтеза научно-технической литературы, нормативных актов, стандартов в области обеспечения информационной безопасности информационных систем (ИС), использующих сторонние сервисы аутентификации пользователей. Вводится контекст рассматриваемой ИС. Описываются уязвимости, возникающие при аутентификации пользователей с использованием службы каталогов Active Directory. На основе функциональных особенностей клиентского приложения, входящего в ИС, проводится построение концептуальной модели угроз информационной безопасности ИС, которая применяется для выявления и исследования возможных атак на процесс аутентификации пользователей. В результате выявления критических мест безопасности системы, формируются основные требования, соблюдение которых позволит повысить состояние защищенности систем, а именно: необходимость обеспечения подлинности и целостности ЭВМ, принимающих участие в процессе аутентификации пользователей в приложении, необходимость обеспечения конфиденциальности передаваемых и хранимых аутентифицирующих данных пользователей. Результаты данной работы позволяют обезопасить процесс аутентификации с использованием технологии Active Directory, а также проводить дальнейшие исследования в области аутентификации пользователей в распределенных системах. Проведенный анализ позволяет сделать вывод о безопасности применения предложенного способа аутентификации при соблюдении выявленных требований.

The paper is devoted to the actual problem of ensuring privacy during performing transactions in distributed ledgers. We discuss various aspects of transaction privacy, as well as the specifics of setting the problem for distributed ledgers with two main models for representing participants' balances: the UTXO-model and the account model. Based on these results, we outline definitions and consider security properties of the main cryptographic primitives used for preserving the privacy of transactions: mixers, ring signatures, homomorphic encryption, and zero-knowledge proofs. We analyze well-known solutions for distributed ledgers based on the UTXO-model, such as Zcash, Monero, Zcoin, Dash, CoinShuffle, Verge, Grin, and others, as well as for systems based on the account model: DSC, Zether, Zeth, BlockMaze. Based on the comparison of advantages, disadvantages, and limitations for existing solutions, conclusions are drawn about the future development of distributed ledgers that ensure the privacy of transactions, and new research tasks are outlined.

The paper presents a method for testing ADC, intended for measurement the basic parameters of converters by histogram test (or code density test). This method is ideally suited for modern wide bandwidth high precision ADCs and is universally accepted, especially with the proliferation of standard PC-based software and ADC manufacturer’s evaluation boards. The histogram and Fast Fourier transform (FFT) tests use essentially the same hardware, both are normally part of a comprehensive ADC test plan [1]. Modular Instrumentation System PXI of NI and Signal Generator SMA100B (ROHDE & SCHWARZ) were used as test equipment for the tests. The basic static and dynamic parameters of the ADC AD7888 were calculated using this method. The degradation of the main parameters of the ADC AD7888 under the influence of the absorbed dose at the «RIK-0401» x-ray unit is presented in the paper.

Статья посвящена проблеме подделки электронных устройств. Постоянно растущие требования к характеристикам и функциональным возможностям изделий электронной компонентной базы (ЭКБ), применяющимся в ответственной аппаратуре (космических аппаратах, технике двойного и специального назначения, транспорте и т.д.), приводят к применению продукции коммерческой категории качества иностранного производства. Таким образом, возникает риск применения ЭКБ контрафактного происхождения, что определяет необходимость проводить испытания и исследования, подтверждающие аутентичность изделий. Но даже применение всего арсенала методов исследований не гарантирует 100% достоверности результата, подтверждающего аутентичность изделия. Кроме того, глобальная тенденция заключается в том, что количество поддельных микросхем (и не только микросхем) увеличивается, но эффективность методов обнаружения падает. Одним из методов борьбы с контрафакцией является маркировка подлинных компонентов. И самый безопасный для маркировки метод, основанный на физически неклонируемых функциях (ФНФ) т.е. таких свойств изделия, которые невозможно воспроизвести в следствие естественного разброса характеристик паразитных структур, неопределенности результатов случайных процессов технологии производства. Распределение амплитуд ионизационных откликов и радиационная деградация параметров по мере накопления поглощенной дозы является одной из таких ФНФ т.к. обладает нужными свойствами: невозможностью воспроизведения с одной стороны, и однородностью результатов в рамках одной партии микросхем или транзисторов с другой стороны. Поэтому предлагается использовать различные признаки ухудшения радиационного поведения в качестве ФНФ. Несколько примеров такого использования представлены в статье.

In this work, the effect of the irradiation intensity on the radiation hardness of CMOS integrated circuits (ICs) was studied. We investigated 3 types of ICs manufactured according to design rules from 0.8 to 3 microns, and used in various information transmission systems: 1586IN4, HEF4093BT and MC14504B. The U-31/33 accelerator of electrons has been used for the study in both gamma-ray mode (for moderate intensity) and pulse electron generation mode (for high intensity). As a result, it was revealed that an increase in the intensity of exposure by 4 orders of magnitude might result in a radiation hardness decrease up to factor of 30. This circumstance has to be taken into account when testing CMOS ICs for radiation hardness to high intensity effects. The obtained experimental data confirm theoretical understanding of the influence of increased irradiation intensity on the dose hardness of CMOS ICs.

Particular definitions of the concept of "Knowledge Graph" (knowledge network) are considered, and a generalizing author's definition of the concept of "knowledge networks" is given. The position of the knowledge network in the General context of network science is revealed. Real-world examples show how network (graph) data models can be effectively used in the subject area of preliminary investigation. The levels of implementation and the main advantages of the concept are discussed.

The development of the technological process in electronics has led to the problem of single event upsets (SEU) in microchips when exposed to neutrons causing loss of information and errors. To evaluate sensitivity of CMOS VLSI to SEU caused by neutrons we propose BGR method. To test this approach we apply BGR method to the data obtained by irradiation of several types of ICs:Artix and Spartan FPGAs (Xilinx) and STM32 microcontroller (ST Microelectronics). Test setup was built using modular devices by National Instruments. In this study, we also consider the areas for which neutron influence evaluation is relevant and present an overview of the available data on neutron induced SEU in CMOS chips. A description of the BGR method and experimental results are given.

The aim of the study is to develop a methodology for determining critical processes in order to simplify the activities of critical information infrastructure (CII) entities for categorizing information infrastructure objects on the example of the chemical industry. The actuality of the problems under consideration is based on the fact that the number of cyber attacks in various areas of state activity, including significant objects (ZO) of CII, is not decreasing. To protect the national information resources of the Russian Federation in 2017, the actions have been chosen in the direction of protecting CII objects with the adoption of the Federal law "on the security of critical information infrastructure of the Russian Federation", which defined important directions of the Russian state policy in the information sphere for the next decade. Thus during its implementation, many subjects of critical information infrastructure have already had to face difficulties of various levels. The paper analyzes some fragments of solving the tasks set in the development of methods for determining critical processes at information infrastructure facilities, the sustainable functioning of which is regulated by a number of fundamental regulatory legal documents of the Russian Federation. In the course of the study, some features of determining critical processes at CII facilities, for example, in the chemical industry, were established. These features were later used in the development of a unique methodology for determining critical processes in the information infrastructure.

Handwritten signature is one of the most common methods of biometric authentication, where static and dynamic signature characteristics are used to confirm the user's identity. The existing developments are based on various technologies, such as the neural network, the hidden Markov model, and machine learning algorithms. This topic is rapidly developing, new approaches and algorithms for solving the problem improve the accuracy of verification and learning speed. The purpose of this study is to analyze existing approaches to the signature verification. The most promising algorithm will be used as the basis for the developed authentication system based on a handwritten signature.

Today, virtualization is widely used to provide scalable resources. Since this technology means sharing resources using some abstract layer, the placement and processing of information of various access levels in such systems poses a security risk. To solve this problem, it is necessary to create additional systems for monitoring the integrity of the virtual infrastructure. Objective of the article: to isolate the components of VMs created on the basis of the KVM hypervisor for which integrity monitoring is necessary, describe existing methods for ensuring integrity monitoring and choose the best one for use in centralized systems. Research methods are plausible reasoning method, system analysis, formalization. The article identifies the components of virtual machines created on the basis of the KVM hypervisor for which integrity control is required, and existing methods for ensuring integrity control are described. The result of the article was the determination of the best method for use in centralized systems.

The IEC 62443 standard is the main document describing the requirements for building secure industrial control systems. However, a number of aspects are not properly described or not sufficiently detailed in the standard, and require additional detail for a proper implementation. In particular, the paper highlights main stages of secure industrial control systems architecture development. Secure architecture development approach is based on the “zones and conduits” concept and includes detailed description of inventory stage and zones and conduits determination. Considering that emergency shutdown systems (safety systems) are the key element preventing assets from major accidents, special attention is paid to its integration with control systems. Several integration methods are described with its advantages and disadvantages noted. Recommendations for the practical implementation of the proposed methodology are given.

Целью статьи является разработка предложений по формированию нормативного поля систем защиты от фальсификаций и контрафактной продукции, однозначно понимаемого набора терминов, сокращений и определений на основе гармонизированных отечественных и зарубежных стандартов в этой области. В программе цифровизации экономик развитых стран выделяется относительно новое направление развития так называемых киберфизических систем управления, в частности, промышленными технологическими процессами, что мотивирует постановку нетрадиционных задач по обеспечению безопасности критически важных объектов информационной инфраструктуры. Очевидной угрозой потери устойчивости технологических процессов является использование контрафактной элементной базы в условиях наблюдаемого общего увеличения доли контрафактной продукции, в том числе и в изделиях электронной компонентной базы. Поэтому появляется объективный запрос на системное решение проблемы выявления контрафакта не только с позиций охраны объектов интеллектуальной собственности, но и в аспекте обеспечения промышленной безопасности в ходе сертификации соответствующих технических решений. Учитывая, что для испытательных центров и лабораторий такая постановка связана с организацией достаточно нового вида деятельности в условиях недостаточности соответствующей нормативной базы. В работе проведен обзор зарубежных нормативных документов, определяющих методы и средства выявления контрафакта в радиоизделиях, который может быть использован в качестве начальной основы для формирования отечественной нормативной базы.

The paper is devoted to the recent scientific problem of privacy-preserving machine learning. The problem actuality is determined by the growing need to use machine learning for personal data, as well as for data that make up commercial, medical, financial and other types of information protected by law. The aim of the study is to systematize the security models of machine learning, to identify algorithmic tools that can be used to ensure the privacy of the learning process and application of models, as well as to analyze the privacy-preserving machine learning systems. The paper presents the major concepts and definitions related to machine learning, provides a systematization of machine learning problems and methods of their solution, and pays attention to the modern and promising areas of development of machine learning. Among the tasks of machine learning are those for which it is important to ensure the privacy of data from training, test and work samples. Special cryptographic methods and protocols are correlated to the problems solved. A brief description of the known privacy-preserving machine learning systems is given. The machine learning methods supported by these systems, as well as the type of adversary that the system can resist, and the cryptographic primitives used for the implementation are described in the paper. Unsolved problems in the field of privacy-preserving machine learning and prospects for the development of this scientific field are considered.

Speech-like signals (SLS), along with the original speech, are actively used in security, communication and control systems, increasingly replacing the latter one in them. The aim of the work is to refine the modeling tools for the formation of speech-like signals with specified characteristics in the construction of effective systems for processing and protection of acoustic (speech) information. Methods.Methods of formation of speech-like signals on the given images of their spectrograms with separate or joint processing of their harmonic and formant structures corresponding to the system model of SLS chosen for a specific application are considered. Results.It is proposed in various applications to consider SLS as a complex of real models of direct, indirect and conditional similarity of the system display of the original speech. Summary.The main areas of application of such system models of SLS are considered. The possibilities and prospects of using SLS for transmission of graphic information in speech communication channels, including biometric characteristics of legitimate remote users of protected information resources, are estimated.

The article analyzes the regulatory documentation governing the creation of automated systems in secure execution, as well as open literature on the problems of designing automated systems in secure execution, their optimization and the development of mathematical models of these systems. Based on the analysis of these sources, an algorithm has been developed that represents the process of creating automated systems in a secure execution in the form of a set of interconnected and time-ordered stages that include the necessary work to create automated systems of the specified type. The creation of automated systems in secure execution in accordance with the algorithm developed in the article will allow us to investigate the automated system being created in secure execution in the time range, reduce the likelihood of errors by developers, resulting in a reduction in time and financial costs, as well as high resistance to security threats to information created as a result system.

The paper is devoted to the problem of using distributed ledgers as a tool to ensure trust among business process participants. The purpose of the paper is to offer a systematic review of the applied aspects of modern distributed ledger technologies, based on the experience of studying the technical and algorithmic concepts of the most famous and popular blockchain platforms. We analyze the main ideas underlying distributed ledgers, discuss in general the architecture of distributed ledger platforms, and classify existing systems. The principles of operation and features of permissionless and permissioned blockchain platforms are considered. An overview of the scope and capabilities of distributed ledgers from the perspective of a potential consumer of this technology is given. The actual problems of distributed ledgers are analyzed. Predictions are made about promising and unpromising applications of distributed registry systems. It is concluded that distributed ledger technologies, as an attempt to create a universal tool to solve the problem of trust in the remote implementation of business relations, have great potential for growth. However, they are characterized by a number of unresolved problems related to improving throughput and ensuring the business partners’ privacy.

Цель статьи – на основе анализа положений Окинавской хартии «Глобального информационного общества», решений Конгрессов ООН по предупреждению преступности и уголовному правосудию, а также соответствующих резолюций Генассамблеи ООН установить состояние организационного и нормативно-правового обеспечения противодействия кибервызовам и угрозам, а также киберпреступности в глобальном информационном пространстве. Об актуальности рассмотрения данной темы свидетельствует возрастающий уровень кибевызовов и угроз, рост их масштабности. Так, спецслужбами России в ходе проведения Чемпионата мира по футболу (2018 г.) было отражено около 25 млн различного рода кибератак. Выводы: Рассмотренные в статье вопросы и внесенные предложения по дальнейшему развитию норм международного права, особенно касающиеся разработки технологий искусственного интеллекта, а также использования робототехники, полагаем, могут быть учтены и найти отражение в проекте Конвенции ООН по информационной безопасности.

In modern conditions, it can be stated that the classical methods of information and technological security related to the formulation of security policy for the developed and implemented information system lose value and efficiency, because they lag behind the development of information technology itself, do not fit into the speed of software updates and changing user needs. To solve these problems, the concept of the business process as a target function implemented by the information (computer) system is considered, the concept of correctness ("health") of the business process is introduced. Based on the subject-object model of a computer system, a mathematical model of a healthy business process as a trajectory or a family of desirable trajectories in the state of an information system is proposed. Based on this model, we propose consistent practical implementation of the platform to ensure the health of the business process as a set of interface that displays indicators of the health of the business process, reports, alerts, predicates (predictors or extrapolators in the form of formal expressions), the correlator – the core of the platform that controls the logic and contains information models, patterns (sample trajectories), the rules of response to events, the database storage of the business process and the connector that normalizes the data of the business process. From the point of view of the system-analytical approach, this platform is an information-analytical system that forms a new property – the health of the business process, aimed at reducing resource losses by identifying and preventing violations (in particular, cybercrime and fraud) at the process level, as well as the formation of the control environment of the business process. There is also a practical example of ensuring the health of the business process for the logistics system. Thus, a new universal methodological approach to assessing and ensuring the correct functioning of business processes on the basis of a new paradigm of trust (correctness) of the subject-object model of the business process and the concept of health of the business process is proposed, the concept of a platform for ensuring the health of the business process is proposed. The results of the work can be widely used for the design and evaluation of systems of technological and financial profile.

The article considers the program of professional development that allows to gain the necessary knowledge and abilities in the field of safety of the critical information infrastructure (CII). This program explains actions of public authorities, institutions and other organizations for fulfilling the requirements of the Federal law of July 26, 2017 No. 187 “About safety of critical information infrastructure of the Russian Federation”. The purpose of the article is to describe the features of implementation of the offered program for advanced training. The structure of the program, the form and types of advanced training, structure of the final assessment, types of qualification documents are given. The article also describes the educational requirements for students entering and features of teaching the program and interaction with students within a course. Special attention is paid to the practical issues contained in the program related to the organization of secure network communication between elements of the critical information infrastructure using “m-TrusT” microcomputers. As a result of successful mastering of the program, students receive standard certificates and with information obtained on the course could organize works on categorization of the objects of the CII’s and fulfill the requirements of Federal Law No. 187 for them.

Based on the developed network ontology of the subject area "Preliminary investigation" a conceptual model of the information and analytical decision support system is proposed as a response to the challenge of the increasing need for the analysis of "big data" in the course of a crime investigation. It is demonstrated the importance of automated collection and processing of a variety of information obtained during the individual investigations based on the analysis of network interaction of persons involved in 12 criminal cases.

The program of digitalization of the economies of developed countries highlights a relatively new direction of development of the so-called cyberphysical control systems, in particular, industrial technological processes, which motivates the formulation of non-traditional tasks to ensure the security of critical information infrastructure. The obvious threat of loss of stability of technological processes is the use of counterfeit components in a view of the observed overall increase in a volume of counterfeit products, including electronic components. Therefore, there is a clear request for a systematic solution to the problem of detecting counterfeit not only from the standpoint of the protection of intellectual property, but also in the aspect of industrial safety during the certification of appropriate technical solutions. Considering that for testing centers and laboratories this statement implies the organization of rather new type of activity under conditions of insufficiency of the corresponding regulatory base. The paper reviews the foreign normative documents defining the methods and means of detecting counterfeit in radio electronics, which can be used as the initial basis for the formation of the domestic regulatory framework

We study the “Limonnik-3” authenticated key exchange protocol which is a part of Standardization recommendations R 1323565.1.004-2017 “Authenticated key agreement schemes based on public keys”, officially adopted in Russia in 2017, alongside with the “Echinacea” family of protocols. The protocol uses standardized cryptographic solutions, but does not require digital signature as a primitive, allows two parties to use distinct elliptic curves. The paper describes the protocol the “Limonnik-3”, studies its design rationale, basic requirements used at the stage of protocol design, its cryptographic properties and efficiency. Provided that proposed in the paper parameters and algorithms are used, security against known classes of attacks, including secret key recovery, reduced to the elliptic curve discrete logarithm problem, KCI- and UKS-attacks, is demonstrated. A formal security proof in a modified Canetti-Krawczyk model is deduced, provided that the gap decision Diffie-Hellman problem, connected to the discrete logarithm in the group of points of an elliptic curve, is computationally hard. Automated verification of the protocols shows its security and absence of possible vectors of attack. A brief overview of post-quantum prospectives of the protocol is given. Thus, the paper shows that “Limonnik-3” is a robust and secure cryptographic solution, which satisfies all of the requirements that apply to the modern key exchange protocols.

This study deals with the mechanism of protection of static (fixed) images, based on the permutation of image points (IP), inscribed in the edges of a regular hexagonal pyramid. In contrast to the classical methods of generating permutations, in which the elementary permutation operation is a permutation of two elements, in the proposed method the elementary operation is parametric, i.e. depends on the input parameters of the algorithm, and can affect the permutation of more than two IP. In the previous paper the rotation of hexagon was chosen as elementary permutation. In the present paper several possible modifications of the elementary permutation are considered, and on the basis of the analysis (criterion) of the number of realizable permutations of the initial sequence of IP (SIP) the most acceptable type of modification for the elementary permutation was chosen. The mechanism of protection of static (fixed) images using the permutation is proposed. The analysis of the persistence of this protection mechanism from attacks such as «brute force» is given, and an option that uses the redundancy of the graphical presentation is proposed. Applied analysis of given mechanism has demonstrated its ability to withstand modern cryptanalytic attacks in the application of quantum computing.

The aim of this work is to simplify the activities of categorization of critical information infrastructure (CII) for educational organizations engaged in research activities in the framework of the implementation of the adopted legislation. In the field of critical information security, the regulatory and legislative framework is still being improved in accordance with the Federal law "On the security of critical information infrastructure of the Russian Federation" dated 26.07.2017 No. 187-FZ, imposing new requirements on the subjects of CII. The educational sphere is absent in this norm, as well as the automated information systems of support of administrative processes of management, and also ensuring educational process are excluded from the list of objects of CII respectively. However, the above list contains an indication of the sphere of science, and if any higher education institution is involved in research activities, it becomes the subject of this legislation, which imposes the obligation to carry out a number of organizational and technical measures to ensure the safety of CII facilities. The paper details the minimum procedures for categorization of a certain list of CII for the institutions involved in scientific research.

To meet the reliability requirements the visual information transmitted over the radio lines over noisy background must be protected using cryptographic protection methods. That is why an agreed application of processing and protection of visual information has been proposed, which consists in maintaining natural redundancy of visual information in the process of compression and in the subsequent use for protection against the mistakes arising in the radio line. The conceptually new approach to consideration of cryptographic information security subsystem not as a part of the information processing closed system, which is isolated and indifferent with respect to above and below levels, but rather as an element of a complex processing and information security system is suggested. A combination of the image blocks permutation and a cipher gamma superimposing is considered as a mechanism of cryptographic protection of visual information. Such combination of classical cryptographic algorithms does not multiply the errors, while the distortions of the separate bits arising by the influence of interference in the radio line are eliminated due to natural redundancy of visual information and noise-immune coding. A software tool has been developed to carry out a correlation analysis of the combined cryptoprotection method stability and the qualitative assessment of its use. A block diagram of the algorithm for synthesizing the parameter of noise-immune encoding and a software tool performing a complete enumeration of the algorithm parameters are developed. A distinctive feature of the software is the ability to obtain statistical data for solving optimization problems to increase the efficiency of the passage of visual information and therefore to increase its reliability. As an example, the parameter values of the optimal noise-immune code for an image frame of 200 KB are provided.

The paper presents a method for detecting network traffic anomalies taking into account its self-similar structure. It is assumed that network traffic is a self-similar structure and is modeled by fractal Brownian motion. Existing methods of detecting network anomalies are studied. The result of scientific work is a new method for detecting network traffic anomalies. This method is based on a semi-controlled method of anomaly detection, which allows the process to be almost autonomous from human intervention. In addition, the method can be classified as a group of statistical methods, which makes it quite easy to implement. In contrast to the existing methods, this method uses samples of optimal volumes obtained in the minimum but sufficient time. This anomaly detection algorithm consists of two parts: calculation of samples (reference values) and comparison of the received traffic with the standard (analysis of network traffic anomalies). The calculation of standards is based on the calculation of the values of the self-similarity parameter (Hurst parameter) for some indicators from the package headers. The algorithm of anomaly search underlying the method can be used both to search for incoming anomalies (network attacks) and to search for anomalies in outgoing traffic (DLP-system).

Voice communication has been and remains one of the main ways of human communication and human-machine exchange. Today a construction of new perspective systems of processing and protection of speech information is impossible without modeling of effective mechanisms of speech transformation, creation of speech-like signals with the set properties.For this purpose a unique approach is proposed which deals with transformation of a halftone image of a speech signal spectrogram into a binary one, its subsequent modification in order to solve the problems of protection and processing of speech information, and the possibility of a reverse transition to a halftone image and subsequent synthesis of a new speech-like signal with the desired properties.An improvement of the model of speech formation, making use of the properties of auditory perception and taking into account the features of the formation of binary spectrograms can significantly reduce the amount of speech information without losing its semantic content and recognition and provide an opportunity to use a rich and well-tested arsenal of ways to recognize and process binary and halftone images and a number of other important advantages.The prospects of using image analysis-synthesis technologies in relation to narrow-band sonograms and other kind of images while solving the problems of acoustic steganography, digital noise cleaning and reconstruction of distorted phonograms, audio labeling of significant information, speech compression and restoration are also evaluated.

Due to the increasing complexity of information systems, information security threats associated with the presence of software vulnerabilities used in the information infrastructure systems become relevant. Today in order to protect against this type of threat one usually applies a range of measures implemented in the operation and maintenance of the software. At the same time, to ensure the required level of data protection, it is necessary to implement measures aimed at preventing vulnerabilities during the software life cycle. Secure software development is the basis for trust in information and communication technologies in the context of modern cyber threats. The aim of this paper is to summarize and analyze the problems of creating trusted software used in critical information infrastructure, and to find possible ways to solve them. The organizational and methodological aspects of the creation of trusted software used in critical information infrastructure are discussed, and the main problems, strategies and technologies to ensure the trust for various software components are described. The issue of trust for tools, system-wide and special software is still open both in methodological and organizational terms. To solve these problems, it is necessary to have a long-term state policy, development and clarification of legal documents that define common approaches and specific ways to ensure the reliability and security of the software used in critical information infrastructure, taking into account the actual conditions of their operation.

Since the advent of the Internet, the blockchain technology (BT) has been recognized as one of the most explosive innovations of the early 21st century, capable of changing both financial and non-financial applications. The paper presents various interpretations of the blockchain, illustrates the process of inclusion of a new block into it, briefly discusses the issues of standardization of this new technology by organizations such as ISO and NIST, as well as introduces the basic BT notion for a transaction. The main task of this article is to give a generalized idea of the composition and structure of blocks of the blockchain, taking into account the identifier and the hash connecting each new block with its predecessor. It also provides an example of accounting and saving in a holistic and chronological form transactions in the blockchain for the case of its use in managing information security incidents in computer networks. The presented results can be extended to any subject area in which it is possible and reasonable to create a blockchain. In conclusion, the directions of subsequent research in this area are determined.

В работе приведено исследование возможности применения технологий распределенного реестра в управлении различными бизнес-процессами, опирающимися на системы электронного документооборота. В сфере финансов и торговли разновидность технологии распределенного реестра – блокчейн – уже представлена как реальная альтернатива существующей инфраструктуре, однако опыта создания и внедрения таких решений в системы электронного документооборота на данный момент недостаточно. Предложенная ранее авторами модель гибридного документооборота имеет ряд преимуществ над привычной схемой информационного обмена, так как сочетает равную защиту документа в аналоговой и цифровой форме с применением криптографических и биометрических методов. Схема гибридного документооборота на базе технологий распределенного реестра обеспечивает децентрализованное хранение информации, фиксированный объем хранимых и передаваемых пользователями блоков данных, выработку криптографических ключей с применением биометрических образов допущенных к работе пользователей и идентификацию субъектов, производивших различные действия с документом независимо от типа его носителя. В работе рассмотрены возможные проблемы информационного взаимодействия, с которыми общество может столкнуться при разработке и внедрении схемы гибридного документооборота.

For the implementation of the Master’s program “Business Continuity and Information Security Maintenance” in the field of specialty 10.04.01 “Information Security”, a software shell of the educational laboratory complex (ELC) designed to study the “Man in the middle” network attacks has been developed in the NRNU MEPhI. In the framework of the ELC four basic attacks of this type are modeled: UDP Hijacking, Session Hijacking, TCP Hijacking and Bucket brigade attack. The paper presents two ELC applications: the instructor’s application and the student’s application. To assess the students’ knowledge after performing laboratory work, the “Testing” module for assessing progress testing has been created, which includes questions for testing using the ELC software shell. Methodical instructions on performance of laboratory work have been written. Within the framework of the “Protected Information Systems” discipline of the Information Security of Banking Systems Department of the NNIU MEPhI, implementing the above-mentioned Mastre’s program, a successful approbation of the developed ELC has been carried out. In conclusion the ways to further improvement of the ELC are suggested.

Тенденции развития глобального информационного общества свидетельствуют о возрастании потребности в специалистах, обладающих высокой информационной культурой, в том числе обладающих знаниями и навыками обеспечения информационной безопасности. В Доктрине информационной безопасности Российской Федерации развитие и совершенствование системы соответствующей подготовки кадров заявлено в качестве одного из первоочередных мероприятий по реализации государственной политики в области формирования цифровой экономики. Подготовка кадров в данном случае должна предусматривать два направления – профессиональное и массовое обучение. В свою очередь, профессиональное обучение может быть основным и дополнительным. Основная цель массового обучения – формирование в обществе культуры информационной безопасности, недостаточный уровень которой отмечен в Доктрине информационной безопасности как одна из основных информационных угроз. Исходя из этого, в статье рассматриваются все актуальные сегодня проблемы как профессионального, так и массового обучения. При этом подчеркивается важность реализации парадигмы непрерывного образования (образования в течение всей жизни). Таким образом, основная цель данной статьи заключается в раскрытии важнейших проблем обеспечения непрерывного процесса формирования современной культуры информационной безопасности с использованием возможностей всех звеньев образовательной системы.

The majority of the network infrastructures of government agencies and private enterprises operate on the basis of a TCP/IP protocol stack, which has significant vulnerabilities. For illustrative purposes, it is worth mentioning the lack of verification of the interaction subject authenticity in the basic protocols and technologies of this stack. Some of the TCP/IP stack vulnerabilities can be eliminated by the intelligent functions of managed network devices: from access profiling to traffic segmentation. Complex firewalls, which include intrusion detection and prevention systems, are also an important element of the network protection. Methods of signature, heuristic, behavioral, self-similar, predictable and other approaches for analyzing network traffic and identifying network threats are further being developed by Russian and foreign scientists. However, the proposed solutions do not give an unambiguous result when using overlay technologies and cryptographic protocols. Also, due attention is not being paid to the processing, analysis of network traffic and logs of Windows/Linux operating systems and applications. The aim of this work was the research, development and software implementation of a distributed system for collecting, processing and analyzing security information events of an enterprise network infrastructure. The key task was to ensure objective monitoring of network information security. An additional task was to ensure the monitoring of the activity of users of personal computers running Windows and Linux operating systems. In order to address this challenge, a concept for complex processing of computer network traffic and security information events both on the server and on the client sides was developed. An original signature and statistical method of compiling the knowledge base system by testing and simulating known network and local attacks with tracking the response of operating systems and applications in a virtualization environment is reviewed. The approach to performing the automated analysis of correlating events with the use of deep packets inspection (DPI) and monitoring of users' local activity is described. The reviewed solution was successfully tested and used as one of the modules for providing network information security of the system for intelligent adaptive enterprise network infrastructure management, designed by author.

Spear phishing is one of the social engineering techniques. In case of spear phishing the email text is compiled taking into account the knowledge about a particular company and rather often about the employee using sociology and psychology in such a way that cause the desire to open the attached file or to click on the link. The main difficulty of protection against such e-mails is that the methods of automated analysis do not guarantee its detection, as modern cyber criminals use new text formulations, zero-day vulnerabilities, as well as automation tools to inject exploits into files, which reduces the effectiveness of signature analysis of anti-virus programs. Each of the existing detection technologies alone does not provide protection against spear phishing. However, the combination of technologies (spam filtering, firewalls, anti-viruses), with the mandatory organizational measures, including training and testing of personnel, allows to protect the external information perimeter of the company from the spear phishing. The paper presents a detailed analysis of the technology of spear phishing implemented by two typical methods: the launch of the exploit when clicking on the link and when one runs an executable file. An overview of the vulnerability used in 2016-2017 for the attacks is presented. Modern technologies of protection and their comparative analysis are given. It is noted that each of the technologies used separately does not allow an effective protection against spear phishing. On the basis of comparative analysis and analysis of modern information threats the most effective modern methods of protection are proposed.

In a modern information society the problem of the control of use of the property rights to digital information resources becomes more and more actual. One of the most effective ways of the decision of this problem is use of digital watermarks - digital labels, not visible without the special software and a confidential key. A digital watermark - the technology created for protection of copyrights to multimedia files. It can be the text or a logo unequivocally identifying the author of a file. Digital watermarks are applied in coding and decoding of the acoustic information, in technologies of search and definition of illegal copies of audio materials. In the given work research of algorithms of embedding of digital watermarks in images was conducted. In practice more often the others for embedding of digital watermarks in images are used by the algorithms based on discrete cosine transformation. In article research which allows to conclude is resulted that the method of Koch is the most effective for protection of copyrights by introduction digital watermarks in the image. The analysis of lacks of a method is carried out. Owing to double application discrete cosine transformation to the image at introduction and extraction digital watermarks, and also applications of the return discrete cosine transformation for return to integer matrixes of pixels after introduction the parity of factors of a frequency matrix can be broken, and it is inadmissible, as the result of work of algorithm directly depends on it. Avoid occurrence of the given problem during embedding of bit digital watermarks it is offered to spend correction of values of factors of a frequency matrix. The algorithm of realization of a method of Koch is resulted and its modernization for embedding of digital watermarks is proved. The way and algorithm of return transformation is described. Results of research about dependence of value of factor of force of embedding e from brightness of the image-container and built in digital watermark are resulted the size.

Блокчейн-технология (БЧ-технология) представляет неизменяемые распределённые системы цифровых реестров без центрального хранилища/репозитария, как правило, не имеющие единого центра управления. В настоящее время существует большой ажиотаж вокруг использования БЧ-технологии, хотя сама технология, с одной стороны, многим ещё не совсем понятна, а с другой (и это главное) – не нова. Поверхностное представление о БЧ-технологии как о феномене с «волшебными свойствами» приводит к многочисленным прогнозам о возможности революционных преобразований на основе её применения целых отраслей экономики и прежде всего в кредитно-финансовой сфере (КФС). В связи с этим в настоящей статье представлены систематизированный анализ, история возникновения БЧ-технологии, ведущая своё начало с международных стандартов ISO 7498-2 от 1989 года и ITU-T Х.800 от 1991 года. Дано краткое неформальное определение БЧ-технологии, рассмотрены ее основные принципы и компоненты, среди которых криптографические однонаправленные функции (ОНФ), транзакции, адреса и их извлечение, реестры, блоки, операции с последовательностями блоков. Представление БЧ-технологии как последовательности блоков, связанных на основе известных способов обеспечения целостности данных с использованием ассиметричной криптографии, позволяет сделать вывод о возможности только эволюционного развития ее применений, хотя и быстрыми темпами в масштабе реального времени, что является характерной особенностью современного этапа становления и всех остальных разновидностей IT-технологий. В заключение обращено внимание на необходимость проведения дополнительных исследований оценки защищённости и надёжности БЧ-технологии в аспекте оценки перспектив её применения в конкретных бизнес-приложениях и системах критической информационной инфраструктуры.

The paper is devoted to the forthcoming textbook on the course "Fundamentals of scientific research" at the Department of information security of the DREC MIPT. The textbook is a combination of lectures with the anthology and includes, in addition to the author's text, extensive fragments of scientific works from XX-XXI centuries. The backgrounds of this approach, the composition of the book and a summary of the sections are given as well. Emphasis here is made primarily on what texts and in what keys are offered in the textbook. In the author's opinion the main didactic task of the course is to demonstrate to students the huge heuristic potential of the broad research erudition. It is obvious that understanding of direct relation of a concrete result to the cultural background is highly important. Once the students understand that the result will not be obtained without this background, or will be obtained but with a delay and in rather difficult way, they likely gain an idea of importance of the broad erudition. To solve the didactic task one demonstrates the parallels between the Grenander’s theory of images, chemistry, phonology and control of the integrity of virtual infrastructure; linguistics and circuitry; physiology and research of new computer architecture. Both positive and negative examples are given. As it is well known, the bad examples imply stronger emotional impression, they are more likely to impress students and will be well remembered by them. This paper is an invitation to discuss the appropriateness of the approach to teach the information protection specialists the "Fundamentals of scientific research" course by emphasizing not only the specific features of this rather special subject area, but rather its general scientific backgrounds.

Одним из основных направлений обеспечения безопасности киберфизических систем является создание и внедрение технологий, гарантировано устойчивых к различным видам внешних воздействий. Ключевым аспектом создания таких устойчивых технических устройств является применение в разработках стойкой к внешним воздействующим факторам (ВВФ) элементной компонентной базы (ЭКБ). Актуальность данной проблемы определяется, в частности, ростом доли контрафактной продукции в электронике как международного тренда, определяющего необходимость идентифицировать изделия, предназначенные для ответственных применений. Помимо выявления контрафакта, идентификация изделий элементной компонентной базы необходима для достоверной и информативной оценки стойкости к внешним воздействующим факторам. Одной из основных задач методики оценки стойкости - установить эффективный баланс между достоверностью результатов тестирования и трудоемкостью процедуры. Трудности оптимизации заключены в основном в количестве разрушенных образцов, необходимом объеме собираемой информации, обеспечении выявления контрафакта. В работе представлена эффективная процедура идентификации, совмещающая «разрушающие» и «неразрушающие» виды проверок, выявление контрафакта, неоднородности выборки, подозрительных изделий. Усовершенствована процедура идентификации образцов выборок для проведения испытаний. Приведены примеры экспериментально выявленных случаев контрафакта. Показана необходимость идентификации для обеспечения достоверности и информативности результатов испытаний. Также приведены дополнительные преимущества от получаемой в ходе процедуры информации при оптимальной реализации.

Nowadays one should not underestimate importance of informational technologies across all fields of humans’ life. Computational technologies and tools became crucial parts of any human activity. However, since information is becoming a strategic resource, it is necessary to ensure its security by all means. A large number of contemporary studies have been carried on in the field of informational security. Recently, multidimensional information technologies have become popular for data analysis and processing. This has led to a contradiction between ever growing demand of multidimensional data processing systems and inability to properly secure such system due to insufficient research within this field. As a result, sensitive multidimensional data cannot be securely processed due to lack of proper secure systems able to ensure appropriate level of informational security. Authors decided to develop such system. The paper proposes architecture of multidimensional data management system capable of secure information management built up as a multidimensional hypercube. Proposed architecture consists of a description of main system components, a description of task performed by those components and principles of their communication. The paper describes a way to build a system which ensures safe read/write operations for confidential information organized as multidimensional hypercube. The proposed solution allows secure processing of sensitive multidimensional data and therefore extending the area where such systems can be used.

The paper describes cryptographic transformation for mutual authentication and creation of the fiscal sign key. This transformation based on using block encryption cipher named «Kuznetchik», described in the national standard of the Russian Federation GOST R 34.12-2015 and realized in gamma generation mode as it is described in the another national standard of the Russian Federation GOST R 34.13-2015. The function of the integrity protection (authentication code) is defined by the recommendation for standardization R 50.1.113–2016. The solution proposed in this paper is aimed for an authentication and integrity control of fiscal data transmitted through communication channels between fiscal storage devices and fiscal data operators, as well as between the fiscal data operators and the authorized agency. Formats of transmitted fiscal data, methods of transmission and mechanisms to ensure the confidentiality of transmitted fiscal data determined by the authorized agency of the Federal Executive power. The article gives a short description of the protocol model, a formal analysis of passive attacks in the assumption that the cryptographic properties of the protocol depends on the feature of cryptographic transformations used, which are standardized solutions regulated by national standards, or national recommendations for standardization. Since the cryptographic transformations could not be compromised by the intruder we can conclude that the intruder also can not compromise the fiscal signs protection protocol.

The analysis of the training system for specialists working in the field of information security plays an important role to improve staffing in the field of information security in the Russian Federation in the context of new challenges and threats in the information sphere. The article presents the results of analysis and summarizes the data on state of the system of training, retraining and advanced training provided for information security experts. The presented analytical materials are taking into account the results of the data analysis about the security specialists working in Federal Executive authorities (Federal authorities), regional executive authorities, local governmental bodies and their subordinate organizations, corporations, and organizations of licensees of the FSTEC of Russia. The presented analytical materials can be used for development of proposals in order to improve the national system of training, professional retraining and advanced training of information security specialists, as well as for development of control indicators for the admission of persons to the training in the field of information security at the expense of the Federal budget allocations.

This article addresses the problem of security threats while working with web portals built on the Open Journal Systems platform. The Open Journal Systems (OJS) platform was originally developed as part of the Public Knowledge Project and it is one of the most popular open-source platforms for web journals today. Based on the data available in the Public Knowledge Project, there were more than 10,000 active journals using the open journal systems platform by the end of 2016. A migration of a journal to such advanced and complex platform helps to handle the entire workflow over a single web portal. Therefore it is an important move and only peer-reviewed journals that are part of Russian and Worldwide citation systems go for it. At the same time the problem of keeping privacy for a manuscript before it is published is very important for these journals and for authors who submit it to the journal. The paper describes the most common threats for the web portals on the OJS platform as well as a particular model of the security threats, and suggests the measures that could help to neutralize these threats.

In the current year, Russia entered a three-year transitional period for the implementation of professional standards designed to replace the traditional regulations of the Unified Qualification Handbook (UQH) for the positions of executives, specialists and employees. Several professional standards have been approved for the field of staffing of information security. However, from the higher school point of view, the existing variety of approved professional standards can hardly be used as a normative basis for the improvement and development of the existing system of educational standards in the information security area, although such an obvious conceptual task was set in the framework of the transition from UQH to professional standards. This paper analyses foreign experience in solving this problem using rather impressive example of the United States. A systematic study of the labor (personnel) resources structure in the cybersecurity field was carried on within the framework of the national initiative for cybersecurity education, which is proposed as a fundamental reference resource. That resource can be used to guide the various category users, including educational organizations, to solve their tasks of providing labor resources in the field of cybersecurity. The cybersecurity workforce framework (CWF) components include such categories as specialty areas, work roles, knowledge, skills, abilities and tasks (performed for any kind of work). The paper analyzes the presented CWF, its content, as well as its important role in harmonizing the Russian educational standards in the field of cybersecurity.

A determination of real attenuation of information signal's radiation on a way from the source to a possible location of intelligence devices is considered to be the most difficult operation while assessing information security against leakage of electromagnetic emanation. In this context the problem of automation of this kind of measurement is of great interest. It takes considerable effort and time to measure the attenuation by existing automated systems. That is why the measurements are generally taken within the limited range of frequencies only. Along with that, a spectre of a single information impulse has a leaf-structure and is solid on every frequency leaf. So electromagnetic field intensity attenuation measurement carried on the some preselected frequencies is not able to represent the complete attenuation characteristics. The measurements of attenuation in the whole informative signal spectre within the given frequency range requires a few thousand measurements, which makes the current method ineffective and time consuming. The relevant specialized automatized measurement systems of security verification has active protection system noise measurement mode, which can be used to measure the real attenuation. In this article a rather exact method of real attenuation of informative signal of video subsystem of electron-ray tube monitor measurement is described and confirmed in experiment. The measurements were made using specialized automatized system “Sigurd” and video subsystem informative signal noise generator. The described method allows a significant reduction of the time needed for specialized investigations of security verification on electromagnetic emanation.