{"id":72062,"date":"2020-03-01T14:51:13","date_gmt":"2020-03-01T11:51:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker"},"modified":"2020-03-03T16:14:00","modified_gmt":"2020-03-03T13:14:00","slug":"sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","title":{"rendered":"Solu\u021bii moderne pentru construirea sistemelor de securitate informa\u021bional\u0103 \u2013 brokerii de pachete de re\u021bea (Network Packet Broker)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Securitatea informa\u021bional\u0103 s-a desprins de telecomunica\u021bii \u00eentr-o ramur\u0103 autonom\u0103, cu specificul \u0219i echipamentele sale. Dar exist\u0103 o clas\u0103 pu\u021bin cunoscut\u0103 de dispozitive, situate la intersec\u021bia dintre telecomunica\u021bii \u0219i securitatea informa\u021bional\u0103 \u2013 <strong>brokeri de pachete de re\u021bea <\/strong>(Network Packet Broker), cunoscu\u021bi \u0219i ca echilibratori de sarcin\u0103, comutatoare specializate\/monitorizare, agregatoare de trafic, Platform\u0103 de Livrare Securizat\u0103, Vizibilitate a Re\u021belei \u0219i a\u0219a mai departe. \u0218i noi, ca dezvoltator \u0219i produc\u0103tor rus de astfel de echipamente, ne dorim cu adev\u0103rat s\u0103 v\u0103 povestim mai multe despre ele.<\/p>\n<p><img decoding=\"async\" alt=\"Solu\u021bii moderne pentru construirea sistemelor de securitate informa\u021bional\u0103 \u2013 brokerii de pachete de re\u021bea (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/4df6859dbb9973439686aa5c4e6f256c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Domeniul de aplicare \u0219i problemele rezolvate<\/h3>\n<p>\nBrokerii de pachete de re\u021bea sunt dispozitive specializate, care au g\u0103sit cea mai mare aplica\u021bie \u00een sistemele de securitate informa\u021bional\u0103. Aceast\u0103 clas\u0103 de dispozitive este relativ nou\u0103 \u0219i pu\u021bin numeroas\u0103 \u00een infrastructura de re\u021bea acceptat\u0103, \u00een compara\u021bie cu comutatoarele, routerele etc. Pionier \u00een dezvoltarea acestui tip de dispozitive a fost compania american\u0103 Gigamon. \u00cen prezent, num\u0103rul juc\u0103torilor de pe aceast\u0103 pia\u021b\u0103 a crescut semnificativ (inclusiv solu\u021bii similare sunt oferite de cunoscutul produc\u0103tor de echipamente de testare \u2014 compania IXIA), dar existen\u021ba acestor dispozitive este \u00een continuare cunoscut\u0103 doar de un cerc restr\u00e2ns de profesioni\u0219ti. A\u0219a cum s-a men\u021bionat mai devreme, nici terminologia nu este clar definit\u0103: denumirile variaz\u0103 de la \u201esisteme de asigurare a transparen\u021bei re\u021belei\u201d p\u00e2n\u0103 la simpla \u201eechilibrare\u201d.<\/p>\n<p>Dezvolt\u00e2nd brokeri de pachete de re\u021bea, ne-am confruntat cu faptul c\u0103, pe l\u00e2ng\u0103 analiza orient\u0103rilor de dezvoltare a func\u021bionalit\u0103\u021bii \u0219i testarea \u00een laboratoare\/zones de testare, trebuie s\u0103 explic\u0103m \u00een paralel poten\u021bialilor consumatori existen\u021ba acestei clase de echipamente, deoarece nu toat\u0103 lumea \u0219tie despre ele.<\/p>\n<p>Cu 15-20 de ani \u00een urm\u0103, traficul din re\u021bea era sc\u0103zut \u0219i, \u00een cea mai mare parte, consta \u00een date nesemnificative. Dar <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Jakob_Nielsen_(usability_consultant)#Contributions\">legea lui Nielsen<\/a><\/noindex> se repet\u0103 practic <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%97%D0%B0%D0%BA%D0%BE%D0%BD_%D0%9C%D1%83%D1%80%D0%B0\">legea lui Moore<\/a><\/noindex>: viteza conexiunii la internet cre\u0219te anual cu 50%. Volumul de trafic cre\u0219te, de asemenea, constant (pe grafic este prezentat prognoza din 2017 realizat\u0103 de compania Cisco, sursa Cisco Visual Networking Index: Prognoze \u0219i Tendin\u021be, 2017\u20132022):<\/p>\n<p><img decoding=\"async\" alt=\"Solu\u021bii moderne pentru construirea sistemelor de securitate informa\u021bional\u0103 \u2013 brokerii de pachete de re\u021bea (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/1f17d80ded705b9d06781fbd96219847.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nOdat\u0103 cu viteza, importan\u021ba informa\u021biilor circulante (care includ at\u00e2t secrete comerciale, c\u00e2t \u0219i celebrele date personale) \u0219i, \u00een general, func\u021bionalitatea infrastructurii cresc. <\/p>\n<p>Prin urmare, a ap\u0103rut \u0219i industria securit\u0103\u021bii informa\u021bionale. Industria a r\u0103spuns la aceasta prin apari\u021bia unui \u00eentreg spectru de dispozitive de analiz\u0103 profund\u0103 a traficului (DPI): de la sisteme de prevenire a atacurilor DDOS la sisteme de gestionare a evenimentelor de securitate informa\u021bional\u0103, inclusiv IDS, IPS, DLP, NBA, SIEM, Antimailware \u0219i altele. De obicei, fiecare dintre aceste instrumente este un software care se instaleaz\u0103 pe o platform\u0103 server. Mai mult, fiecare program (instrument de analiz\u0103) se instaleaz\u0103 pe platforma sa server: produc\u0103torii de software sunt diferi\u021bi \u0219i, de asemenea, resursele de calcul necesare pentru analiza la L7 sunt mari.<\/p>\n<p>Atunci c\u00e2nd se construie\u0219te un sistem de securitate informa\u021bional\u0103, trebuie rezolvate o serie de sarcini de baz\u0103:<\/p>\n<ul>\n<li>cum se va transmite traficul din infrastructur\u0103 c\u0103tre sistemele de analiz\u0103? (ini\u021bial, porturile SPAN concepute pentru acest lucru nu sunt suficiente nici ca num\u0103r, nici ca performan\u021b\u0103 \u00een infrastructura modern\u0103)<\/li>\n<li>cum se va distribui traficul \u00eentre diversele sisteme de analiz\u0103?<\/li>\n<li>cum se va scala sistemele \u00een condi\u021biile \u00een care un singur exemplu de analizator nu are suficient\u0103 performan\u021b\u0103 pentru a procesa \u00eentreaga cantitate de trafic care \u00eei este direc\u021bionat\u0103?<\/li>\n<li>cum se va monitoriza interfe\u021bele 40G\/100G (iar \u00een viitorul apropiat \u0219i 200G\/400G), av\u00e2nd \u00een vedere c\u0103 instrumentele de analiz\u0103 sprijin\u0103 \u00een prezent doar interfe\u021bele 1G\/10G\/25G?<\/li>\n<\/ul>\n<p>\n\u0218i urm\u0103toarele sarcini conexe:<\/p>\n<ul>\n<li>cum se va minimiza traficul non-\u021bint\u0103, care nu necesit\u0103 procesare, dar ajunge la instrumentele de analiz\u0103 \u0219i le consum\u0103 resursele?<\/li>\n<li>cum se vor procesa pachetele \u00eencapsulate \u0219i pachetele cu etichete de echipament, prepararea c\u0103rora pentru analiz\u0103 se dovede\u0219te a fi fie resursiv\u0103, fie complet imposibil\u0103?<\/li>\n<li>cum se va exclude din analiz\u0103 o parte a traficului care nu este reglementat\u0103 de politica de securitate (de exemplu, traficul directorului)?<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Solu\u021bii moderne pentru construirea sistemelor de securitate informa\u021bional\u0103 \u2013 brokerii de pachete de re\u021bea (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/21453d662b8507eb2479065c9f879a87.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nDup\u0103 cum se \u0219tie, cererea genereaz\u0103 ofert\u0103, \u00een r\u0103spuns la aceste nevoi, brokerii de pachete de re\u021bea au \u00eenceput s\u0103 se dezvolte.<\/p>\n<h3>Descriere general\u0103 a brokerilor de pachete de re\u021bea<\/h3>\n<p>\nBrokerele de pachete de re\u021bea func\u021bioneaz\u0103 la nivel de pachete, fiind asem\u0103n\u0103toare comutatoarelor obi\u0219nuite. Principalul diferen\u021bei fa\u021b\u0103 de comutatoare este c\u0103 regulile de distribuire \u0219i agregare a traficului \u00een brokerii de pachete de re\u021bea sunt complet determinate de set\u0103rile individuale. \u00cen brokerii de pachete de re\u021bea nu exist\u0103 standarde pentru construirea tabelelor de redirec\u021bionare (tabele MAC) \u0219i protocoalele de schimb cu alte comutatoare (de tip STP), astfel \u00eenc\u00e2t gama posibilelor set\u0103ri \u0219i a c\u00e2mpurilor \u00een\u021belese este mult mai larg\u0103. Brokerul poate distribui uniform traficul din unul sau mai multe porturi de intrare pe o gam\u0103 de porturi de ie\u0219ire, cu func\u021bia de \u00eenc\u0103rcare uniform\u0103 la ie\u0219ire. Se pot stabili reguli pentru copiere, filtrare, clasificare, deduplicare \u0219i modificare a traficului. Aceste reguli pot fi aplicate diferitelor grupuri de porturi de intrare ale brokerului de pachete de re\u021bea \u0219i pot fi aplicate succesiv \u00een cadrul dispozitivului. Un avantaj important al brokerului de pachete este capacitatea de a procesa traficul la viteza maxim\u0103 a fluxului \u0219i de a men\u021bine integritatea sesiunilor (\u00een cazul echilibr\u0103rii traficului asupra mai multor sisteme DPI de acela\u0219i tip).<\/p>\n<p>Men\u021binerea integrit\u0103\u021bii sesiunilor presupune transmiterea tuturor pachetelor unei sesiuni de nivel de transport (TCP\/UDP\/SCTP) printr-un singur port. Acest lucru este important deoarece sistemele DPI (de obicei, software care ruleaz\u0103 pe un server conectat la portul de ie\u0219ire al brokerului de pachete) analizeaz\u0103 con\u021binutul traficului la nivel de aplica\u021bie, iar toate pachetele trimise\/primite de o aplica\u021bie trebuie s\u0103 ajung\u0103 la aceea\u0219i instan\u021b\u0103 a analizorului. Dac\u0103 pachetele dintr-o sesiune sunt pierdute sau distribuite \u00eentre diferite dispozitive DPI, fiecare dispozitiv DPI se va afla \u00eentr-o situa\u021bie similar\u0103 citirii unui text fragmentat, v\u0103z\u00e2nd doar cuvinte separate. Cel mai probabil, textul nu va fi \u00een\u021beles.<\/p>\n<p>Astfel, fiind orienta\u021bi spre sistemele de securitate informational\u0103, brokerii de pachete de re\u021bea dispun de func\u021bionalit\u0103\u021bi care ajut\u0103 la conectarea complexelor software DPI la re\u021belele de telecomunica\u021bii de mare vitez\u0103 \u0219i la reducerea sarcinii asupra acestora: efectueaz\u0103 filtrare prealabil\u0103, clasificare \u0219i preg\u0103tire a traficului pentru simplificarea proces\u0103rii ulterioare. <\/p>\n<p>\u00cen plus, deoarece brokerii de pachete de re\u021bea ofer\u0103 o gam\u0103 larg\u0103 de statistici \u0219i sunt adesea conecta\u021bi la diverse puncte ale re\u021belei, ei \u00ee\u0219i g\u0103sesc locul \u0219i \u00een diagnosticul problemelor de func\u021bionare ale infrastructurii de re\u021bea.<\/p>\n<h3>Func\u021bii de baz\u0103 ale brokerilor de pachete de re\u021bea<\/h3>\n<p>\nNumele \u201eswitchuri specializate\/monitorizare\u201d provine din scopul lor de baz\u0103: de a colecta traficul din infrastructur\u0103 (de obicei cu ajutorul divizoarelor optice pasive TAP \u0219i\/sau porturilor SPAN) \u0219i de a-l distribui \u00eentre instrumentele de analiz\u0103. Traficul este oglindit (duplicat) \u00eentre diferitele sisteme, iar \u00eentre sistemele omogene este echilibrat. Func\u021biile de baz\u0103 includ, de obicei, filtrarea pe c\u00e2mpuri p\u00e2n\u0103 la L4 (MAC, IP, port TCP\/UDP etc.) \u0219i agregarea mai multor canale slab \u00eenc\u0103rcate \u00eentr-unul (de exemplu, pentru procesarea pe un singur sistem DPI). <\/p>\n<p>Aceast\u0103 func\u021bionalitate asigur\u0103 solu\u021bionarea sarcinii de baz\u0103 - conectarea sistemelor DPI la infrastructura de re\u021bea. Brokerii de la diferi\u021bi produc\u0103tori, care se limiteaz\u0103 la func\u021bionalit\u0103\u021bi de baz\u0103, ofer\u0103 procesarea a p\u00e2n\u0103 la 32 de interfe\u021be 100G pe 1U (mai multe interfe\u021be fizic nu pot fi amplasate pe panoul frontal de 1U). Cu toate acestea, ei nu permit reducerea \u00eenc\u0103rc\u0103rii pe instrumentele de analiz\u0103, iar pentru infrastructuri complexe nu pot \u00eendeplini chiar cerin\u021bele pentru func\u021bia de baz\u0103: o sesiune distribuit\u0103 pe mai multe tuneluri (sau dotat\u0103 cu etichete MPLS) poate deveni dezechilibrat\u0103 \u00eentre diferite instan\u021be ale analizatorului \u0219i astfel poate ie\u0219i din analiza. <\/p>\n<p>Pe l\u00e2ng\u0103 ad\u0103ugarea interfe\u021belor 40\/100G \u0219i, ca urmare, cre\u0219terea performan\u021bei, brokerii de pachete de re\u021bea se dezvolt\u0103 activ \u00een direc\u021bia oferirii de posibilit\u0103\u021bi complet noi: de la echilibrarea \u00een func\u021bie de capetele \u00eencorporate ale tunelurilor p\u00e2n\u0103 la decriptarea traficului. Din p\u0103cate, astfel de modele nu pot rivaliza cu performan\u021ba \u00een terabi\u021bi, dar permit construirea unei sisteme de securitate informa\u021bional\u0103 cu adev\u0103rat de calitate \u0219i tehnic \u201efrumoas\u0103\u201d, \u00een care fiecare instrument de analiz\u0103 prime\u0219te garantat doar informa\u021biile necesare \u00een cea mai potrivit\u0103 form\u0103 pentru analiz\u0103.<\/p>\n<h3>Func\u021bii extinse ale brokerilor de pachete de re\u021bea<\/h3>\n<p>\n<img decoding=\"async\" alt=\"Solu\u021bii moderne pentru construirea sistemelor de securitate informa\u021bional\u0103 \u2013 brokerii de pachete de re\u021bea (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/874e5b6372a2e532d86966d1c7fe4ba1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<strong>1.<\/strong> Men\u021bionat\u0103 mai sus <strong>echilibrarea \u00een func\u021bie de capetele \u00eencorporate \u00een traficul tunelat.<\/strong><\/p>\n<p>De ce este important? S\u0103 analiz\u0103m 3 aspecte care pot fi critice, \u00eempreun\u0103 sau separat:<\/p>\n<ul>\n<li>asigurarea echilibr\u0103rii uniforme atunci c\u00e2nd exist\u0103 un num\u0103r mic de tuneluri. \u00cen cazul \u00een care la punctul de conectare al sistemelor de securitate informa\u021bional\u0103 exist\u0103 doar 2 tuneluri, acestea nu pot fi dezactivate pe cap al externelor pe 3 platforme server, p\u0103str\u00e2nd sesiunea. \u00cen acest caz, traficul din re\u021bea este transmis inegal, iar direc\u021bia fiec\u0103rui tunel c\u0103tre un mediu de procesare separat va necesita o performan\u021b\u0103 redundant\u0103;<\/li>\n<li>asigurarea integrit\u0103\u021bii sesiunilor \u0219i fluxurilor protocoalelor multisessionale (de exemplu, FTP \u0219i VoIP), a c\u0103ror pachete ajung \u00een tuneluri diferite. Complexitatea infrastructurii de re\u021bea cre\u0219te constant: redundan\u021b\u0103, virtualizare, simplificare a administr\u0103rii etc. Pe de o parte, acest lucru cre\u0219te fiabilitatea \u00een ceea ce prive\u0219te transmisia datelor, pe de alt\u0103 parte, \u00eengreuneaz\u0103 func\u021bionarea sistemelor de securitate informa\u021bional\u0103. Chiar \u0219i cu performan\u021ba suficient\u0103 a analizatorilor pentru a gestiona canalul dedicat cu tuneluri, problema se dovede\u0219te a fi nerezolvabil\u0103, deoarece o parte din pachetele sesiunii utilizatorului sunt transmise printr-un alt canal. De\u0219i \u00een unele infrastructuri se \u00eencearc\u0103 \u00eenc\u0103 men\u021binerea integrit\u0103\u021bii sesiunilor, protocoalele multisessionale pot urma c\u0103i complet diferite;<\/li>\n<li>echilibrarea \u00een prezen\u021ba MPLS, VLAN, etichete individuale ale echipamentului etc. Nu exact tuneluri, dar totu\u0219i echipamentele cu func\u021bionalitate de baz\u0103 pot interpreta acest trafic nu ca IP \u0219i echilibra pe baza adreselor MAC, din nou perturb\u00e2nd uniformitatea echilibr\u0103rii sau integritatea sesiunilor.<\/li>\n<\/ul>\n<p>\nBrokerul de pachete de re\u021bea analizeaz\u0103 anteturile externe \u0219i str\u0103bate secven\u021bial pointerii p\u00e2n\u0103 la cel mai \u00eenvelit antet IP \u0219i echilibreaz\u0103 deja pe baza acestuia. Ca rezultat, num\u0103rul fluxurilor devine semnificativ mai mare (\u00een consecin\u021b\u0103, se poate realiza o echilibrare mai uniform\u0103 \u0219i pe un num\u0103r mai mare de platforme), iar sistemul DPI prime\u0219te toate pachetele sesiunii \u0219i toate sesiunile \u00eenrudite ale protocoalelor multisessionale.<\/p>\n<p><strong>2. Modificarea traficului.<\/strong><br \/>\nUna dintre cele mai extinse \u00een ceea ce prive\u0219te func\u021bionalit\u0103\u021bile sale, num\u0103rul subfunc\u021biilor \u0219i variantele de aplicare este vast:<\/p>\n<ul>\n<li>eliminarea payload-ului, \u00een acest caz, doar anteturile pachetelor sunt transmise c\u0103tre instrumentul de analiz\u0103. Acest lucru este relevant pentru instrumentele de analiz\u0103 sau pentru tipurile de trafic \u00een care con\u021binutul pachetelor nu conteaz\u0103 sau nu poate fi analizat. De exemplu, pentru traficul criptat, datele parametrice de schimb (cine, cu cine, c\u00e2nd \u0219i c\u00e2t) pot fi interesante, iar payload-ul este de fapt gunoi care ocup\u0103 canalul \u0219i resursele de calcul ale analizatorului. Pot exista varia\u021bii \u00een care payload-ul este t\u0103iat, \u00eencep\u00e2nd de la un offset prestabilit \u2013 aceasta ofer\u0103 un spa\u021biu suplimentar instrumentelor de analiz\u0103;<\/li>\n<li>detunneling, \u0219i anume eliminarea anteturilor care marcheaz\u0103 \u0219i identific\u0103 tunelurile. Scopul este de a reduce sarcina asupra instrumentelor de analiz\u0103 \u0219i de a cre\u0219te eficien\u021ba acestora. Detunneling-ul poate fi realizat pe baza unui offset fix sau prin analiza dinamic\u0103 a anteturilor \u0219i determinarea offset-ului pentru fiecare pachet;<\/li>\n<li>eliminarea anumitor anteturi ale pachetelor: etichete MPLS, VLAN, c\u00e2mpuri specifice echipamentului ter\u021b;<\/li>\n<li>mascarea unor p\u0103r\u021bi ale anteturilor, de exemplu, mascarea adreselor IP pentru a asigura anonimizarea traficului;<\/li>\n<li>ad\u0103ugarea de informa\u021bii de control \u00een pachet: timestamp-uri, port de intrare, etichete de clas\u0103 a traficului etc.<\/li>\n<\/ul>\n<p>\n<strong>3. Deduplicare<\/strong> \u2013 cur\u0103\u021barea de pachetele de trafic repetitive transmise c\u0103tre instrumentele de analiz\u0103. Pachetele repetitive apar de cele mai multe ori din caracteristicile conexiunii la infrastructur\u0103 \u2013 traficul poate trece prin mai multe puncte de analiz\u0103 \u0219i este oglindit de fiecare dintre acestea. De asemenea, este \u00eent\u00e2lnit\u0103 retrimiterea pachetelor TCP care nu au ajuns, dar dac\u0103 acestea sunt multe, atunci sunt mai degrab\u0103 probleme legate de monitorizarea calit\u0103\u021bii re\u021belei, nu de securitatea informa\u021bional\u0103 din aceasta.<\/p>\n<p><strong>4. Func\u021bii avansate de filtrare <\/strong>\u2013 de la c\u0103utarea unor valori specifice pe un offset dat p\u00e2n\u0103 la analiza pe baz\u0103 de semn\u0103tur\u0103 pe \u00eentregul pachet.<\/p>\n<p><strong>5. Generarea NetFlow\/IPFIX<\/strong> \u2013 colectarea unei game extinse de statistici legate de traficul care trece \u0219i transmiterea acestuia c\u0103tre instrumentele de analiz\u0103.<\/p>\n<p><strong>6. Decriptarea traficului SSL,<\/strong> func\u021bioneaz\u0103 cu condi\u021bia ca certificatul \u0219i cheile s\u0103 fie \u00eenc\u0103rcate anterior \u00een brokerul de pachete de re\u021bea. Cu toate acestea, aceasta permite o desc\u0103rcare semnificativ\u0103 a instrumentelor de analiz\u0103. <\/p>\n<p>Exist\u0103 \u00eenc\u0103 multe func\u021bii, utile \u0219i de marketing, dar cele principale, cred, sunt enumerate.<\/p>\n<p>Dezvoltarea sistemelor de detec\u021bie (a atacurilor prin intruziune, DDOS) \u0219i a sistemelor de prevenire, precum \u0219i implementarea de solu\u021bii active DPI a necesitat schimbarea schemei de includere dintr-o abordare pasiv\u0103 (prin TAP sau porturi SPAN) \u00eentr-una activ\u0103 (\u00een \u201ebre\u0219\u0103\u201d). Aceast\u0103 situa\u021bie a crescut cerin\u021bele de fiabilitate (deoarece o defec\u021biune \u00een acest caz duce la \u00eentreruperea func\u021bionalit\u0103\u021bii \u00eentregii re\u021bele, nu doar la pierderea controlului asupra securit\u0103\u021bii informa\u021biei) \u0219i a dus la \u00eenlocuirea ramificatoarelor optice cu bypass-uri optice (pentru a rezolva problema dependen\u021bei func\u021bionalit\u0103\u021bii re\u021belei de func\u021bionalitatea sistemelor de securitate a informa\u021biei), \u00eens\u0103 func\u021bionalitatea de baz\u0103 \u0219i cerin\u021bele acesteia au r\u0103mas neschimbate. <\/p>\n<p>Am dezvoltat Brokeri de pachete de re\u021bea DS Integrity cu interfe\u021be de 100G, 40G \u0219i 10G, de la construc\u021bie \u0219i proiectare la software integrat. Spre deosebire de al\u021bi brokeri de pachete, func\u021biile de modificare \u0219i echilibrare pe capetele de tunnel sunt implementate hardware, la viteza maxim\u0103 a porturilor.<\/p>\n<p><img decoding=\"async\" alt=\"Solu\u021bii moderne pentru construirea sistemelor de securitate informa\u021bional\u0103 \u2013 brokerii de pachete de re\u021bea (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/a7f08a061eb707ef8264158b6d1362bc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsol\/blog\/490252\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c. \u041d\u043e \u0435\u0441\u0442\u044c \u043c\u0430\u043b\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043d\u0430 \u0441\u0442\u044b\u043a\u0435 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u0430 \u0438 \u0438\u043d\u0444\u043e\u0431\u0435\u0437\u0430 \u2013 \u0431\u0440\u043e\u043a\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (Network Packet Broker), \u043e\u043d\u0438 \u0436\u0435 \u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435\/\u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0430\u0433\u0440\u0435\u0433\u0430\u0442\u043e\u0440\u044b \u0442\u0440\u0430\u0444\u0438\u043a\u0430, Security Delivery Platform, Network Visibility \u0438 \u0442\u0430\u043a \u0434\u0430\u043b\u0435\u0435. \u0418 \u043d\u0430\u043c, \u043a\u0430\u043a \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c\u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0443 \u0438 \u0438\u0437\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0435\u043b\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":72063,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-72062","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0431\u0440\u043e\u043a\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (Network Packet Broker) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-01T11:51:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Solu\u021bii moderne pentru construc\u021bia sistemelor de securitate a informa\u021biei \u2014 brokeri de pachete de re\u021bea (Network Packet Broker) | ProHoster","description":"Securitatea informa\u021bional\u0103 s-a desprins de telecomunica\u021bii pentru a deveni o ramur\u0103 de sine st\u0103t\u0103toare, cu specificitatea \u0219i echipamentele sale.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0431\u0440\u043e\u043a\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (Network Packet Broker) | ProHoster","og:description":"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T11:51:13+00:00","article:modified_time":"2020-03-03T13:14:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72062","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-04 07:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/72062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=72062"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/72062\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/72063"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=72062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=72062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=72062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}