{"id":104097,"date":"2022-05-20T15:36:43","date_gmt":"2022-05-20T13:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-otkryl-narabotki-svyazannye-s-zashhishhyonnym-setevym-protokolom-psp"},"modified":"2022-05-20T15:36:43","modified_gmt":"2022-05-20T13:36:45","slug":"google-otkryl-narabotki-svyazannye-s-zashhishhyonnym-setevym-protokolom-psp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/google-otkryl-narabotki-svyazannye-s-zashhishhyonnym-setevym-protokolom-psp","title":{"rendered":"Google avas \u00fclesannete, mis on seotud turvalise v\u00f5rgu protokolliga PSP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Google teatas PSP (PSP Security Protocol) protokolli spetsifikatsioonide ja viidatud rakenduse avamisest, mida kasutatakse andme keskuste vahelise liikluse kr\u00fcpteerimiseks. Protokoll kasutab IP-sarnast ESP (Encapsulating Security Payloads) liikluse kapseldamise arhitektuuri, tagades kr\u00fcpteerimise, kr\u00fcptograafilise terviklikkuse kontrolli ja allika autentimise. PSP teostuse kood on kirjutatud C keeles ja jagatakse Apache 2.0 litsentsi alusel. <\/p>\n

PSP erip\u00e4ra on protokolli optimeerimine arvutuste kiirendamiseks ja koormuse v\u00e4hendamiseks keskprotsessoril, viies kr\u00fcpteerimise ja dekr\u00fcpteerimise operatsioonid v\u00f5rkaartide poole (offload). Riistvaralise kiirenduse kasutamiseks on vajalikud spetsiaalsed v\u00f5rkaartid, mis on PSP-ga \u00fchilduvad. S\u00fcsteemidele, mille v\u00f5rkaartid ei toeta PSP-d, pakutakse SoftPSP tarkvaralist teostust. <\/p>\n

Andmete edastamiseks kasutatakse UDP protokolli. PSP-pakett algab IP-p\u00e4isega, millele j\u00e4rgneb UDP-p\u00e4is ja seej\u00e4rel PSP enda p\u00e4is, kus on teave kr\u00fcpteerimise ja autentimise kohta. J\u00e4rgmiseks lisatakse originaalse TCP\/UDP-paketi sisu, mis l\u00f5peb PSP l\u00f5ppplokiga koos kontrollsummaga terviklikkuse kinnitamiseks. PSP p\u00e4is, samuti kapseldatud paketi p\u00e4is ja andmed on alati autentitud, et kinnitada paketi ehtsust. Kapseldatud paketi andmed v\u00f5ivad olla kr\u00fcpteeritud, samas on lubatud ka valikuline kr\u00fcpteerimise rakendamine, j\u00e4ttes osa TCP-p\u00e4isest avatud (autentsuse kontrolli s\u00e4ilitamisega), n\u00e4iteks pakettide vaatamise v\u00f5imaldamiseks \u00fclemise v\u00f5rgu varustuses.

\"Google<\/center> <\/p>\n

PSP ei ole seotud teatud v\u00f5tmevahetusprotokolliga, pakub mitmeid pakettiformaate ja toetab erinevate kr\u00fcptoalgoritmide kasutamist. N\u00e4iteks toetatakse AES-GCM algoritmi kr\u00fcpteerimiseks ja autentimiseks ning AES-GMAC-i autentimiseks ilma otseteavet kr\u00fcpteerimata, n\u00e4iteks kui andmed ei ole v\u00e4\u00e4rtuslikud, kuid on oluline tagada, et need ei oleks edastamise k\u00e4igus muudetud ja et need on need, mis algselt saadeti. <\/p>\n

Erinevalt t\u00fc\u00fcpilistest VPN<\/a>-protokollidest rakendab PSP kr\u00fcpteerimist individuaalsete v\u00f5rgu\u00fchenduste tasemel, mitte kogu sidekanali tasemel, st PSP kasutab erinevate tunneliseeritud UDP- ja TCP-\u00fchenduste jaoks eraldi kr\u00fcpteerimisv\u00f5tmeid. Selline l\u00e4henemine v\u00f5imaldab saavutada rangemat liikluse isolatsiooni erinevate rakenduste ja t\u00f6\u00f6tlejate vahel, mis on oluline, kui \u00fchel serveris<\/a> rakendamisel ja teenustel on erinevad kasutajad. <\/p>\n

Google'is kasutatakse PSP protokolli nii ettev\u00f5tte sisekommunikatsioonide kaitsmiseks kui ka Google Cloudi klientide liikluse kaitsmiseks. Protokoll on algselt kavandatud t\u00f5husaks t\u00f6\u00f6ks Google'i tasemel infrastruktuurides ja peab tagama riistvaralise kr\u00fcpteerimise kiirendamise olukordades, kus on miljoneid aktiivseid v\u00f5rgu\u00fchendusi ja sadu tuhandeid uusi \u00fchendusi sekundis. <\/p>\n

Toimib kaks t\u00f6\u00f6re\u017eiimi \u2014 \u00abstateful\u00bb ja \u00abstateless\u00bb. Re\u017eiimis \u00abstateless\u00bb edastatakse kr\u00fcpteerimise v\u00f5tmed v\u00f5rkaartmele paketi deskriptoris ning dekr\u00fcpteerimiseks t\u00f5mmatakse need paketi SPI (Security Parameter Index) v\u00e4ljadest, kasutades meistriklahvi (256-bit AES, mis salvestatakse v\u00f5rkaartme m\u00e4lu ja asendatakse iga 24 tunni j\u00e4rel), mis v\u00f5imaldab s\u00e4\u00e4sta v\u00f5rkaartme m\u00e4lu ja minimeerida shifreeritud \u00fchenduste olekuinfo, mis salvestatakse seadme k\u00fclge. Re\u017eiimis \u00abstateful\u00bb salvestatakse v\u00f5tmed iga \u00fchenduse jaoks v\u00f5rkaartme spetsiaalses tabelis, sarnaselt sellele, kuidas IPsec-i riistvaraline kiirus on rakendatud.

\"Google<\/center> <\/p>\n

PSP pakub ainulaadset kombinatsiooni TLS ja IPsec\/VPN protokollide v\u00f5imalustest. TLS sobis Google'ile individuaalsete \u00fchenduste tasandi kaitse osas, kuid polnud piisavalt paindlik riistvara kiirendamiseks ja ei toetanud UDP-d. IPsec tagas protokollidest s\u00f5ltumatuse ja toetas h\u00e4sti riistvara kiirendust, kuid ei toetanud v\u00f5tmete sidumist \u00fcksikute \u00fchendustega, oli kavandatud vaid v\u00e4ikese arvu tunnelite loomiseks ja oli skalatsiooni probleemidega, kuna kogu kr\u00fcpteerimise oleku hoidmine toimus tabelites, mis asusid v\u00f5rkaartide m\u00e4lus (n\u00e4iteks 10 miljoni \u00fchenduse t\u00f6\u00f6tlemiseks on vaja 5 GB m\u00e4lu). <\/p>\n

PSP puhul v\u00f5ib kr\u00fcpteerimise oleku teave (v\u00f5tmed, initsialiseerimise vektorid, j\u00e4rjestusnumbrid jne) edastada paketi TX-deskriptoris v\u00f5i m\u00e4lun\u00e4idiku kujul, mitte v\u00f5tma v\u00f5rkaartide m\u00e4lu. Google'i andmetel kulus varem RPC-liiklus kr\u00fcpteerimisele ettev\u00f5tte infrastruktuuris umbes 0.7% arvutusv\u00f5imsusest ja suures koguses m\u00e4lu. PSP rakendamine riistvara kiirenduse kaasamise kaudu v\u00f5imaldas selle n\u00e4itaja v\u00e4hendada 0.2% -ni.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 \u0438 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 PSP (PSP Security Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u0435\u0436\u0434\u0443 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u043e\u0445\u043e\u0436\u0443\u044e \u043d\u0430 IPsec ESP (Encapsulating Security Payloads) \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443 \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u0432\u0435\u0440\u0445 IP, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430. \u041a\u043e\u0434 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 PSP \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104098,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104097","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google avalikustas PSP-ga seotud arendused, mis k\u00e4sitlevad turvalist v\u00f5rguprotokolli | ProHoster","description":"Google kuulutas v\u00e4lja PSP (PSP Security Protocol) protokolli spetsifikatsioonid ja referentsrakenduse, mida kasutatakse andmekeskuste vahelise liikluse kr\u00fcpteerimiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/google-otkryl-narabotki-svyazannye-s-zashhishhyonnym-setevym-protokolom-psp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u0442\u043a\u0440\u044b\u043b \u043d\u0430\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c PSP | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 \u0438 \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 PSP (PSP Security Protocol), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u0435\u0436\u0434\u0443 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/google-otkryl-narabotki-svyazannye-s-zashhishhyonnym-setevym-protokolom-psp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-20T13:36:45+00:00","article:modified_time":"2022-05-20T13:36:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104097","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:25:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-20 13:36:51","updated":"2026-02-09 22:25:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=104097"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104097\/revisions"}],"predecessor-version":[{"id":159990,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/104097\/revisions\/159990"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/104098"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=104097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=104097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=104097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}