DPI (kuwunika kwa SSL) kumatsutsana ndi zolemba, koma makampani akuzitsatira

Chain of trust. CC BY-SA 4.0 Yanpas

Kuyang'anira magalimoto a SSL (SSL/TLS decryption, SSL kapena DPI kusanthula) ikukhala nkhani yotentha kwambiri pamakampani. Lingaliro la decrypting traffic likuwoneka kuti likutsutsana ndi lingaliro lenileni la cryptography. Komabe, chowonadi ndi chowona: makampani ochulukirachulukira akugwiritsa ntchito matekinoloje a DPI, akufotokozera izi ndikufunika kowunika zomwe zili pa pulogalamu yaumbanda, kutayikira kwa data, ndi zina zambiri.

Chabwino, ngati tivomereza mfundo yakuti teknoloji yotereyi iyenera kukhazikitsidwa, ndiye kuti tiyenera kulingalira njira zochitira izi m'njira yotetezeka komanso yoyendetsedwa bwino kwambiri. Osadalira ziphaso zimenezo, mwachitsanzo, zomwe DPI system supplier amakupatsani.

Pali gawo limodzi la kukhazikitsa lomwe si aliyense akudziwa. Ndipotu anthu ambiri amadabwa kwambiri akamva zimenezi. Uwu ndi bungwe la certification lachinsinsi (CA). Imapanga ziphaso kuti zisinthidwe ndikulembanso kuchuluka kwa magalimoto.

M'malo modalira ziphaso zodzilembera nokha kapena satifiketi kuchokera ku zida za DPI, mutha kugwiritsa ntchito CA yodzipatulira kuchokera kwa satifiketi ya chipani chachitatu monga GlobalSign. Koma choyamba, tiyeni tione mwachidule vuto lenilenilo.

Kodi kuyang'ana kwa SSL ndi chiyani ndipo chifukwa chiyani kumagwiritsidwa ntchito?

Mawebusayiti ochulukirachulukira akusamukira ku HTTPS. Mwachitsanzo, malinga ndi Ziwerengero za Chrome, kumayambiriro kwa Seputembala 2019, gawo la magalimoto obisika ku Russia linafika 83%.

Tsoka ilo, kubisa kwa magalimoto kumagwiritsidwa ntchito kwambiri ndi omwe akuwukira, makamaka popeza Let's Encrypt timagawira masatifiketi aulere a SSL aulere m'njira yokhayo. Chifukwa chake, HTTPS imagwiritsidwa ntchito paliponse - ndipo zotchingira mu adilesi ya asakatuli zasiya kukhala chizindikiro chodalirika chachitetezo.

Opanga mayankho a DPI amalimbikitsa malonda awo kuchokera m'malo awa. Amaphatikizidwa pakati pa ogwiritsa ntchito (mwachitsanzo, antchito anu akusakatula intaneti) ndi intaneti, ndikusefa magalimoto oyipa. Pali zinthu zingapo zotere pamsika masiku ano, koma njira zake ndizofanana. Magalimoto a HTTPS amadutsa pachida chowunikira pomwe amasinthidwa ndikuwunika ngati pulogalamu yaumbanda.

Chitsimikizocho chikamaliza, chipangizocho chimapanga gawo latsopano la SSL ndi kasitomala womaliza kuti asinthe ndikulembanso zomwe zili.

Momwe njira yochepetsera / kubisanso imagwirira ntchito

Kuti chipangizo chowunikira cha SSL chisanduke ndikulembanso mapaketi musanawatumize kwa ogwiritsa ntchito, chikuyenera kutulutsa ziphaso za SSL powuluka. Izi zikutanthauza kuti iyenera kukhala ndi satifiketi ya CA yoyikidwa.

Ndikofunikira kwa kampaniyo (kapena aliyense wapakati) kuti ziphaso za SSL izi zimadaliridwa ndi osatsegula (ie, musayambitse mauthenga ochenjeza owopsa ngati omwe ali pansipa). Chifukwa chake unyolo wa CA (kapena maudindo) uyenera kukhala mu sitolo yodalirika ya osatsegula. Chifukwa ziphasozi sizinaperekedwe kuchokera kwa akuluakulu a satifiketi odalirika pagulu, muyenera kugawa pamanja gawo la CA kwa makasitomala onse.

Chenjezo la satifiketi yodzisayina yokha mu Chrome. Gwero: BadSSL.com

Pamakompyuta a Windows, mutha kugwiritsa ntchito Active Directory ndi Group Policies, koma pazida zam'manja momwemo ndizovuta kwambiri.

Zinthu zimakhala zovuta kwambiri ngati mukufuna kuthandizira zikalata zina zamabizinesi, mwachitsanzo, kuchokera ku Microsoft, kapena kutengera OpenSSL. Kuphatikizanso chitetezo ndi kasamalidwe ka makiyi achinsinsi kuti makiyi aliwonse asathe mwadzidzidzi.

Njira yabwino: satifiketi yachinsinsi, yodzipatulira yochokera kwa munthu wina wa CA

Ngati kuyang'anira mizu ingapo kapena ziphaso zodzilembera nokha sikusangalatsa, pali njira ina: kudalira CA yachitatu. Pankhaniyi, satifiketi amaperekedwa kuchokera payekha CA yomwe imalumikizidwa ndi chikhulupiliro chodzipatulira, chachinsinsi cha CA chopangidwira kampaniyo.

Zomangamanga zophweka zamasitifiketi odzipatulira a kasitomala

Kukonzekera uku kumathetsa mavuto ena omwe tawatchula kale: osachepera amachepetsa chiwerengero cha mizu yomwe imayenera kuyang'aniridwa. Apa mutha kugwiritsa ntchito mizu imodzi yokha pazosowa zonse zamkati za PKI, ndi ma CA angapo apakatikati. Mwachitsanzo, chithunzi pamwambapa chikuwonetsa maulamuliro amitundu yambiri pomwe imodzi mwa ma CA apakati imagwiritsidwa ntchito potsimikizira / kumasulira kwa SSL ndipo ina imagwiritsidwa ntchito pamakompyuta amkati (ma laputopu, maseva, ma desktops, ndi zina).

Pamapangidwe awa, palibe chifukwa chochitira CA kwa makasitomala onse chifukwa CA yapamwamba kwambiri imayendetsedwa ndi GlobalSign, yomwe imathetsa chitetezo chachinsinsi chachinsinsi komanso zovuta zakutha.

Ubwino wina wa njirayi ndikutha kubweza olamulira a SSL pazifukwa zilizonse. M'malo mwake, chatsopano chimangopangidwa, chomwe chimamangiriridwa ku mizu yanu yachinsinsi, ndipo mukhoza kuchigwiritsa ntchito nthawi yomweyo.

Ngakhale pali mikangano yonse, mabizinesi akuchulukirachulukira pakuwunika kwa magalimoto a SSL monga gawo lazinthu zawo zamkati kapena zachinsinsi za PKI. Ntchito zina za PKI yachinsinsi zimaphatikizapo kupereka ziphaso za chipangizo kapena kutsimikizika kwa wogwiritsa ntchito, SSL ya maseva amkati, ndi masinthidwe osiyanasiyana omwe saloledwa mu ziphaso zodalirika za anthu monga momwe CA/Browser Forum imafunira.

Osakatuli akulimbana nawo

Tiyenera kuzindikira kuti okonza asakatuli akuyesera kuthana ndi izi ndikuteteza ogwiritsa ntchito kumapeto kwa MiTM. Mwachitsanzo, masiku angapo apitawo Mozilla adapanga chisankho Yambitsani protocol ya DoH (DNS-over-HTTPS) mwachisawawa mumitundu ina yakusakatula mu Firefox. Protocol ya DoH imabisa mafunso a DNS ku dongosolo la DPI, zomwe zimapangitsa kuyang'ana kwa SSL kukhala kovuta.

Za mapulani ofanana pa Seputembara 10, 2019 adalengeza Google ya msakatuli wa Chrome.

Ogwiritsa ntchito olembetsedwa okha ndi omwe angatenge nawo gawo pa kafukufukuyu. Lowani muakauntichonde.

Kodi mukuganiza kuti kampani ili ndi ufulu wowunika kuchuluka kwa anthu ogwira ntchito ku SSL?

• Inde, ndi chilolezo chawo

• Ayi, kupempha chilolezo chotere ndikoletsedwa komanso/kapena kosayenera

Ogwiritsa ntchito 122 adavota. Ogwiritsa 15 adakana.

Source: www.habr.com