{"id":72062,"date":"2020-03-01T14:51:13","date_gmt":"2020-03-01T11:51:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker"},"modified":"2020-03-03T16:14:00","modified_gmt":"2020-03-03T13:14:00","slug":"sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","title":{"rendered":"Modern\u00e9 rie\u0161enia na budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Informa\u010dn\u00e1 bezpe\u010dnos\u0165 sa oddelila od telekomunik\u00e1ci\u00ed ako samostatn\u00fd odbor so svojou \u0161pecifikou a vlastn\u00fdm vybaven\u00edm. No existuje m\u00e1lo zn\u00e1my trieda zariaden\u00ed, ktor\u00e1 stoj\u00ed na rozhran\u00ed telekomunik\u00e1ci\u00ed a infobezpe\u010dnosti \u2014 <strong>brokery sie\u0165ov\u00fdch paketov <\/strong>(Network Packet Broker), tie\u017e zn\u00e1me ako vyva\u017eova\u010de za\u0165a\u017eenia, \u0161pecializovan\u00e9\/monitorovacie prep\u00edna\u010de, agreg\u00e1tory prev\u00e1dzky, Security Delivery Platform, Network Visibility a podobne. A my, ako rusk\u00fd v\u00fdvoj\u00e1r a v\u00fdrobca t\u00fdchto zariaden\u00ed, ve\u013emi radi by sme o nich hovorili podrobnej\u0161ie.<\/p>\n<p><img decoding=\"async\" alt=\"Modern\u00e9 rie\u0161enia na budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/4df6859dbb9973439686aa5c4e6f256c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Oblas\u0165 pou\u017eitia a rie\u0161en\u00e9 \u00falohy<\/h3>\n<p>\nBrokery sie\u0165ov\u00fdch paketov \u2013 \u0161pecializovan\u00e9 zariadenia, ktor\u00e9 sa na\u0161li najv\u00e4\u010d\u0161ie uplatnenie v syst\u00e9moch informa\u010dnej bezpe\u010dnosti. Tento trieda zariaden\u00ed je pomerne nov\u00e1 a m\u00e1lo zn\u00e1ma v be\u017enej sie\u0165ovej infra\u0161trukt\u00fare v porovnan\u00ed s prep\u00edna\u010dmi, smerova\u010dmi a pod. Pionierom v v\u00fdvoji tohto typu zariaden\u00ed bola americk\u00e1 spolo\u010dnos\u0165 Gigamon. V s\u00fa\u010dasnosti sa na tomto trhu objavilo omnoho viac hr\u00e1\u010dov (vr\u00e1tane podobn\u00fdch rie\u0161en\u00ed od zn\u00e1meho v\u00fdrobcu testovac\u00edch komplexov \u2014 spolo\u010dnosti IXIA), ale o existencii t\u00fdchto zariaden\u00ed st\u00e1le vie len \u00fazky okruh profesion\u00e1lov. Ako bolo uveden\u00e9 vy\u0161\u0161ie, aj terminol\u00f3gia nie je jasn\u00e1: n\u00e1zvy sa pohybuj\u00fa od \u201esyst\u00e9mov zabezpe\u010denia transparentnosti siete\u201c a\u017e po jednoduch\u00e9 \u201evyva\u017eova\u010de\u201c.<\/p>\n<p>Pri v\u00fdvoji brokerov sie\u0165ov\u00fdch paketov sme narazili na to, \u017ee okrem anal\u00fdzy smerovania funkci\u00ed a testovania v laborat\u00f3ri\u00e1ch\/testovac\u00edch z\u00f3nach je tie\u017e potrebn\u00e9 paralelne vysvet\u013eova\u0165 potenci\u00e1lnym z\u00e1kazn\u00edkom o existencii takejto triedy vybavenia, preto\u017ee nie v\u0161etci o \u0148om vedia.<\/p>\n<p>E\u0161te pred 15-20 rokmi bolo v sieti m\u00e1lo prev\u00e1dzky a i\u0161lo predov\u0161etk\u00fdm o m\u00e1lo v\u00fdznamn\u00e9 d\u00e1ta. No <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Jakob_Nielsen_(usability_consultant)#Contributions\">z\u00e1kon Nielsen<\/a><\/noindex> prakticky opakuje <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%97%D0%B0%D0%BA%D0%BE%D0%BD_%D0%9C%D1%83%D1%80%D0%B0\">z\u00e1kon Moore<\/a><\/noindex>: r\u00fdchlos\u0165 internetov\u00e9ho pripojenia sa ka\u017ed\u00fd rok zvy\u0161uje o 50 %. Objem prev\u00e1dzky tie\u017e neust\u00e1le rastie (na grafe je uveden\u00fd progn\u00f3za z roku 2017 od spolo\u010dnosti Cisco, zdroj Cisco Visual Networking Index: Forecast and Trends, 2017\u20132022):<\/p>\n<p><img decoding=\"async\" alt=\"Modern\u00e9 rie\u0161enia na budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/1f17d80ded705b9d06781fbd96219847.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nS rast\u00facou r\u00fdchlos\u0165ou narast\u00e1 aj d\u00f4le\u017eitos\u0165 cirkuluj\u00facich inform\u00e1ci\u00ed (\u010do zah\u0155\u0148a obchodn\u00e9 tajomstv\u00e1 a nepr\u00edjemne zn\u00e1me osobn\u00e9 \u00fadaje) a celkov\u00e1 funk\u010dnos\u0165 infra\u0161trukt\u00fary. <\/p>\n<p>Pr\u00edslu\u0161ne vznikol aj sektor informa\u010dnej bezpe\u010dnosti. Priemysel na to zareagoval vznikom cel\u00e9ho spektra zariaden\u00ed na h\u013abkov\u00fa anal\u00fdzu prev\u00e1dzky (DPI): od syst\u00e9mov na prevenciu DDOS-\u00fatokov po syst\u00e9my na spr\u00e1vu udalost\u00ed informa\u010dnej bezpe\u010dnosti, vr\u00e1tane IDS, IPS, DLP, NBA, SIEM, Antimailware a podobne. Zvy\u010dajne ka\u017ed\u00fd z t\u00fdchto prostriedkov je softv\u00e9r, ktor\u00fd sa in\u0161taluje na serverov\u00fa platformu. Ka\u017ed\u00fd program (analytick\u00fd prostriedok) je pritom in\u0161talovan\u00fd na svoju vlastn\u00fa serverov\u00fa platformu: v\u00fdrobcovia softv\u00e9ru s\u00fa r\u00f4zni a na anal\u00fdzu na L7 je potrebn\u00fdch ve\u013ea v\u00fdpo\u010dtov\u00fdch zdrojov.<\/p>\n<p>Pri zria\u010fovan\u00ed syst\u00e9mu informa\u010dnej bezpe\u010dnosti je potrebn\u00e9 vyrie\u0161i\u0165 mno\u017estvo z\u00e1kladn\u00fdch \u00faloh:<\/p>\n<ul>\n<li>ako pren\u00e1\u0161a\u0165 prev\u00e1dzku z infra\u0161trukt\u00fary na analytick\u00e9 syst\u00e9my? (p\u00f4vodne navrhnut\u00e9 SPAN porty v s\u00fa\u010dasnej infra\u0161trukt\u00fare nie s\u00fa dostato\u010dn\u00e9 ani po\u010dtom, ani v\u00fdkonom)<\/li>\n<li>ako rozde\u013eova\u0165 prev\u00e1dzku medzi r\u00f4zne analytick\u00e9 syst\u00e9my?<\/li>\n<li>ako \u0161k\u00e1lova\u0165 syst\u00e9my pri nedostatku v\u00fdkonu jedn\u00e9ho analyz\u00e1tora na spracovanie celkov\u00e9ho objemu prev\u00e1dzky, ktor\u00fd do\u0148 prich\u00e1dza?<\/li>\n<li>ako monitorova\u0165 rozhrania 40G\/100G (a v bl\u00edzkej bud\u00facnosti aj 200G\/400G), ke\u010f\u017ee analytick\u00e9 prostriedky v s\u00fa\u010dasnosti podporuj\u00fa len rozhrania 1G\/10G\/25G?<\/li>\n<\/ul>\n<p>\nA nasleduj\u00face sprievodn\u00e9 \u00falohy:<\/p>\n<ul>\n<li>ako minimalizova\u0165 nesmerovan\u00fd prev\u00e1dzku, ktor\u00e1 nepotrebuje spracovanie, ale dostane sa na analytick\u00e9 prostriedky a spotreb\u00fava ich zdroje?<\/li>\n<li>ako spracov\u00e1va\u0165 zabalene pakety a pakety so slu\u017eobn\u00fdmi \u0161t\u00edtkami zariadenia, ktor\u00fdch pr\u00edprava na anal\u00fdzu sa ukazuje ako n\u00e1ro\u010dn\u00e1 na zdroje alebo v\u00f4bec nerealizovate\u013en\u00e1?<\/li>\n<li>ako vyl\u00fa\u010di\u0165 z anal\u00fdzy \u010das\u0165 prev\u00e1dzky, ktor\u00e1 nepodlieha regul\u00e1cii bezpe\u010dnostnou politikou (napr\u00edklad prev\u00e1dzka riadite\u013ea).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Modern\u00e9 rie\u0161enia na budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/21453d662b8507eb2479065c9f879a87.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nAko je zn\u00e1me, dopyt vytv\u00e1ra ponuku, v odpovedi na tieto potreby sa za\u010dali rozv\u00edja\u0165 makl\u00e9ri sie\u0165ov\u00fdch bal\u00edkov.<\/p>\n<h3>V\u0161eobecn\u00fd popis makl\u00e9rov sie\u0165ov\u00fdch bal\u00edkov<\/h3>\n<p>\nBrokery paketov\u00fdch dat pracuj\u00ed na \u00farovni paket\u016f a v tomto ohledu jsou podobn\u00e9 b\u011b\u017en\u00fdm p\u0159ep\u00edna\u010d\u016fm. Hlavn\u00edm rozd\u00edlem oproti p\u0159ep\u00edna\u010d\u016fm je, \u017ee pravidla pro rozd\u011blen\u00ed a agregaci traffiku u broker\u016f paketov\u00fdch dat jsou zcela ur\u010dena nastaven\u00edm. U broker\u016f paketov\u00fdch dat neexistuj\u00ed standardy pro sestavov\u00e1n\u00ed sm\u011brovac\u00edch tabulek (MAC tabulek) a protokoly pro v\u00fdm\u011bnu s jin\u00fdmi p\u0159ep\u00edna\u010di (jako STP), proto je rozsah mo\u017en\u00fdch nastaven\u00ed a ch\u00e1pan\u00fdch pol\u00ed mnohem \u0161ir\u0161\u00ed. Broker m\u016f\u017ee rovnom\u011brn\u011b rozd\u011blit traffik z jednoho nebo v\u00edce vstupn\u00edch port\u016f na ur\u010den\u00fd rozsah v\u00fdstupn\u00edch port\u016f s funkc\u00ed rovnom\u011brn\u00e9ho zat\u00ed\u017een\u00ed na v\u00fdstupu. Lze stanovit pravidla pro kop\u00edrov\u00e1n\u00ed, filtrov\u00e1n\u00ed, klasifikaci, deduplikaci a modifikaci traffiku. Tato pravidla lze aplikovat na r\u016fzn\u00e9 skupiny vstupn\u00edch port\u016f brokera paketov\u00fdch dat a tak\u00e9 je aplikovat sekven\u010dn\u011b za sebou v samotn\u00e9m za\u0159\u00edzen\u00ed. D\u016fle\u017eitou v\u00fdhodou paketov\u00e9ho brokera je mo\u017enost zpracov\u00e1n\u00ed traffiku plnou rychlost\u00ed toku a zachov\u00e1n\u00ed integrity relac\u00ed (v p\u0159\u00edpad\u011b vyva\u017eov\u00e1n\u00ed traffiku na n\u011bkolik homogenn\u00edch syst\u00e9m\u016f DPI).<\/p>\n<p>Zachov\u00e1n\u00ed integrity relac\u00ed spo\u010d\u00edv\u00e1 v p\u0159en\u00e1\u0161en\u00ed v\u0161ech paket\u016f relace transportn\u00ed \u00farovn\u011b (TCP\/UDP\/SCTP) na jeden port. To je d\u016fle\u017eit\u00e9, proto\u017ee syst\u00e9my DPI (obvykle je to software b\u011b\u017e\u00edc\u00ed na serveru p\u0159ipojen\u00e9m k v\u00fdstupn\u00edmu portu paketov\u00e9ho brokera) analyzuj\u00ed obsah traffiku na \u00farovni aplikac\u00ed, a v\u0161echny pakety odes\u00edlan\u00e9\/p\u0159ij\u00edman\u00e9 jednou aplikac\u00ed mus\u00ed sm\u011b\u0159ovat na stejn\u00fd instanci analyz\u00e1toru. Pokud jsou pakety jedn\u00e9 relace ztraceny nebo rozd\u011bleny mezi r\u016fzn\u00e1 za\u0159\u00edzen\u00ed DPI, ka\u017ed\u00e9 jednotliv\u00e9 za\u0159\u00edzen\u00ed DPI se ocitne v situaci podobn\u00e9 \u010dten\u00ed ne\u00fapln\u00e9ho textu, sp\u00ed\u0161e ne\u017e jednotliv\u00fdch slov z n\u011bj. A pravd\u011bpodobn\u011b text nebude pochopen.<\/p>\n<p>Tak\u017ee, zam\u011b\u0159eni na syst\u00e9my informa\u010dn\u00ed bezpe\u010dnosti, broke\u0159i paketov\u00fdch dat maj\u00ed funk\u010dnost, kter\u00e1 pom\u00e1h\u00e1 p\u0159ipojit softwarov\u00e9 komplexy DPI k vysokorychlostn\u00edm telekomunika\u010dn\u00edm s\u00edt\u00edm a sn\u00ed\u017eit tak z\u00e1t\u011b\u017e na n\u011b: prov\u00e1d\u011bj\u00ed p\u0159edb\u011b\u017en\u00e9 filtrov\u00e1n\u00ed, klasifikaci a p\u0159\u00edpravu traffiku pro zjednodu\u0161en\u00ed n\u00e1sledn\u00e9ho zpracov\u00e1n\u00ed. <\/p>\n<p>Okrem toho, ke\u010f\u017ee brokery sie\u0165ov\u00fdch paketov poskytuj\u00fa \u0161irok\u00e9 spektrum \u0161tatist\u00edk a \u010dasto s\u00fa pripojen\u00e9 k r\u00f4znym bodom siete, nach\u00e1dzaj\u00fa svoje miesto aj pri diagnostike probl\u00e9mov s fungovan\u00edm samotnej sie\u0165ovej infra\u0161trukt\u00fary.<\/p>\n<h3>Z\u00e1kladn\u00e9 funkcie brokerov sie\u0165ov\u00fdch paketov<\/h3>\n<p>\nN\u00e1zov \u201e\u0161pecializovan\u00e9\/monitorovacie switche\u201c vznikol od z\u00e1kladn\u00e9ho ur\u010denia: zbiera\u0165 prenos z infra\u0161trukt\u00fary (zvy\u010dajne pomocou pas\u00edvnych optick\u00fdch odbo\u010dova\u010dov TAP a\/alebo SPAN portov) a rozde\u013eova\u0165 ho medzi analytick\u00e9 prostriedky. Medzi r\u00f4znymi syst\u00e9mami sa prem\u00e1vka zrkadl\u00ed (duplikuje), medzi rovnak\u00fdmi sa vyva\u017euje. Z\u00e1kladn\u00e9 funkcie zvy\u010dajne zah\u0155\u0148aj\u00fa filtr\u00e1ciu pod\u013ea pol\u00ed a\u017e do L4 (MAC, IP, TCP\/UDP port at\u010f.) a agreg\u00e1ciu viacer\u00fdch slab\u0161ie vy\u0165a\u017een\u00fdch kan\u00e1lov do jedn\u00e9ho (napr\u00edklad pre spracovanie na jednom syst\u00e9me DPI). <\/p>\n<p>Tento funk\u010dn\u00fd prvok zabezpe\u010duje rie\u0161enie z\u00e1kladnej \u00falohy \u2014 pripojenie syst\u00e9mov DPI k sie\u0165ovej infra\u0161trukt\u00fare. Brokery r\u00f4znych v\u00fdrobcov, ktor\u00e9 sa obmedzuj\u00fa na z\u00e1kladn\u00fa funkcionalitu, umo\u017e\u0148uj\u00fa spracovanie a\u017e 32 100G rozhran\u00ed na 1U (viac rozhran\u00ed sa fyzicky nezmest\u00ed na predn\u00fd panel 1U). Av\u0161ak nedok\u00e1\u017eu zn\u00ed\u017ei\u0165 za\u0165a\u017eenie analytick\u00fdch prostriedkov a pre zlo\u017eit\u00fa infra\u0161trukt\u00faru nemus\u00ed by\u0165 mo\u017en\u00e9 ani splnenie po\u017eiadaviek na z\u00e1kladn\u00fa funkciu: rel\u00e1cia rozdelen\u00e1 medzi nieko\u013eko tunelov (alebo vybaven\u00e1 MPLS zna\u010dkami) m\u00f4\u017ee by\u0165 nevyv\u00e1\u017een\u00e1 medzi r\u00f4znymi in\u0161tanciami analyz\u00e1tora a celkovo vypadn\u00fa\u0165 z anal\u00fdzy. <\/p>\n<p>Okrem prid\u00e1vania rozhran\u00ed 40\/100G a, ako d\u00f4sledok, zvy\u0161ovania v\u00fdkonu sa brokery sie\u0165ov\u00fdch paketov akt\u00edvne rozv\u00edjaj\u00fa v oblasti poskytovania principi\u00e1lne nov\u00fdch funkci\u00ed: od vyva\u017eovania pod\u013ea vn\u00fatorn\u00fdch hlavi\u010diek tunelov po de\u0161ifrovanie prenosu. Bohu\u017eia\u013e, tak\u00e9 modely nem\u00f4\u017eu by\u0165 hrd\u00e9 na v\u00fdkon v terabitoch, ale umo\u017e\u0148uj\u00fa vytvori\u0165 skuto\u010dne kvalitn\u00fd a technicky \u201ekr\u00e1sny\u201c syst\u00e9m informa\u010dnej bezpe\u010dnosti, v ktorom ka\u017ed\u00fd analytick\u00fd prostriedok zaru\u010dene dost\u00e1va len nevyhnutn\u00e9 inform\u00e1cie v najvhodnej\u0161ej forme na anal\u00fdzu.<\/p>\n<h3>Roz\u0161\u00edren\u00e9 funkcie brokerov sie\u0165ov\u00fdch paketov<\/h3>\n<p>\n<img decoding=\"async\" alt=\"Modern\u00e9 rie\u0161enia na budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/874e5b6372a2e532d86966d1c7fe4ba1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<strong>1.<\/strong> Spomenut\u00e9 vy\u0161\u0161ie <strong>vyva\u017eovanie pod\u013ea vn\u00fatorn\u00fdch hlavi\u010diek v tunelovanom prenosu.<\/strong><\/p>\n<p>Pre\u010do je to d\u00f4le\u017eit\u00e9? Pozrime sa na 3 aspekty, ktor\u00e9 m\u00f4\u017eu by\u0165 kritick\u00e9 samostatne alebo spolu:<\/p>\n<ul>\n<li>zabezpe\u010denie rovnomernosti vyva\u017eovania pri malom po\u010dte tunelov. Ak s\u00fa na pripojovacom bode syst\u00e9mov informa\u010dnej bezpe\u010dnosti iba 2 tunely, nebude mo\u017en\u00e9 ich vyv\u00e1\u017ei\u0165 na 3 serverov\u00e9 platformy s uchovan\u00edm rel\u00e1cie. V tomto pr\u00edpade sa prev\u00e1dzka v sieti pren\u00e1\u0161a nerovnomerne a smerovanie ka\u017ed\u00e9ho tunela do samostatn\u00e9ho spracovate\u013ea si vy\u017eaduje nadbyto\u010dn\u00fa v\u00fdkonnos\u0165 posledn\u00e9ho;<\/li>\n<li>zabezpe\u010denie integrity rel\u00e1ci\u00ed a tokov multisession protokolov (napr\u00edklad FTP a VoIP), ktor\u00fdch pakety sa ocitli v r\u00f4znych tuneloch. Zlo\u017eitosti sie\u0165ovej infra\u0161trukt\u00fary neust\u00e1le rast\u00fa: z\u00e1lohovanie, virtualiz\u00e1cia, zjednodu\u0161enie administrat\u00edvy a tak \u010falej. Na jednej strane to zvy\u0161uje spo\u013eahlivos\u0165 z poh\u013eadu prenosu d\u00e1t, na druhej strane komplikuje pr\u00e1cu syst\u00e9mov informa\u010dnej bezpe\u010dnosti. Aj pri dostato\u010dnej v\u00fdkonnosti analyz\u00e1torov na spracovanie vyhraden\u00e9ho kan\u00e1la s tunelmi, sa probl\u00e9m ukazuje ako nevyrie\u0161ite\u013en\u00fd, preto\u017ee \u010das\u0165 paketov pou\u017e\u00edvate\u013eskej rel\u00e1cie sa pren\u00e1\u0161a cez in\u00fd kan\u00e1l. A hoci o integrite rel\u00e1ci\u00ed v niektor\u00fdch infrastruktur\u00e1ch sa e\u0161te sna\u017eia postara\u0165, multisession protokoly m\u00f4\u017eu \u00eds\u0165 \u00faplne r\u00f4znymi cestami;<\/li>\n<li>vyva\u017eovanie pri existencii MPLS, VLAN, individu\u00e1lnych zna\u010diek zariaden\u00ed at\u010f. Nie celkom tunely, ale aj tak zariadenia s z\u00e1kladnou funk\u010dnos\u0165ou m\u00f4\u017eu tento prenos ch\u00e1pa\u0165 nie ako IP a vyva\u017eova\u0165 na z\u00e1klade MAC adries, op\u00e4\u0165 naru\u0161uj\u00fac rovnomernos\u0165 vyva\u017eovania alebo integritu rel\u00e1ci\u00ed.<\/li>\n<\/ul>\n<p>\nBroker sie\u0165ov\u00fdch paketov analyzuje vonkaj\u0161ie hlavi\u010dky a postupne prech\u00e1dza ukazovate\u013emi a\u017e k najvn\u00fatornej\u0161ej IP hlavi\u010dke a vyva\u017euje u\u017e pod\u013ea nej. Ako v\u00fdsledok \u2013 tokov sa st\u00e1va v\u00fdrazne viac (pod\u013ea toho je mo\u017en\u00e9 vyv\u00e1\u017ei\u0165 rovnomernej\u0161ie a na viac platforiem), a syst\u00e9m DPI dost\u00e1va v\u0161etky pakety rel\u00e1cie a v\u0161etky s\u00favisiace rel\u00e1cie multisession protokolov.<\/p>\n<p><strong>2. Modifik\u00e1cia prenosu.<\/strong><br \/>\nJedna z naj\u0161ir\u0161\u00edch funkci\u00ed, mno\u017estvo podfunkci\u00ed a variantov ich aplik\u00e1cie je nespo\u010detn\u00e9:<\/p>\n<ul>\n<li>odstr\u00e1nenie payloadu, v takom pr\u00edpade s\u00fa na analytick\u00e9 prostriedky posielan\u00e9 iba hlavi\u010dky paketov. To je relevantn\u00e9 pre analytick\u00e9 n\u00e1stroje alebo pre typy prev\u00e1dzky, kde obsah paketov bu\u010f nehr\u00e1 rolu, alebo nie je analyzovate\u013en\u00fd. Napr\u00edklad pre \u0161ifrovan\u00fa prev\u00e1dzku m\u00f4\u017eu by\u0165 zauj\u00edmav\u00e9 parametrick\u00e9 \u00fadaje o v\u00fdmene (kto, s k\u00fdm, kedy a ko\u013eko), zatia\u013e \u010do payload je v podstate odpad, ktor\u00fd zaber\u00e1 kan\u00e1l a v\u00fdpo\u010dtov\u00e9 zdroje analytika. Existuj\u00fa vari\u00e1cie, ke\u010f je payload orezan\u00fd, po\u010dn\u00fac dan\u00fdm posunom \u2013 to poskytuje \u010fal\u0161\u00ed priestor pre analytick\u00e9 n\u00e1stroje;<\/li>\n<li>detunneling, a to najm\u00e4 odstr\u00e1nenie hlavi\u010diek, ktor\u00e9 ozna\u010duj\u00fa a identifikuj\u00fa tunely. Cie\u013eom je zn\u00ed\u017eenie z\u00e1\u0165a\u017ee na analytick\u00e9 prostriedky a zv\u00fd\u0161enie ich efektivity. Detunneling m\u00f4\u017ee by\u0165 vykonan\u00fd na z\u00e1klade fixn\u00e9ho posunu alebo s dynamickou anal\u00fdzou hlavi\u010diek a ur\u010den\u00edm posunu pre ka\u017ed\u00fd paket;<\/li>\n<li>odstr\u00e1nenie \u010dasti hlavi\u010diek paketov: MPLS-ozna\u010den\u00ed, VLAN, \u0161pecifick\u00fdch pol\u00ed extern\u00e9ho hardv\u00e9ru;<\/li>\n<li>maskovanie \u010dasti hlavi\u010diek, napr\u00edklad maskovanie IP adries na zabezpe\u010denie anonymiz\u00e1cie prev\u00e1dzky;<\/li>\n<li>pridanie do paketu servisn\u00fdch inform\u00e1ci\u00ed: \u010dasov\u00e9 pe\u010diatky, vstupn\u00fd port, ozna\u010denia triedy prev\u00e1dzky at\u010f.<\/li>\n<\/ul>\n<p>\n<strong>3. Deduplicit\u00e1cia<\/strong> \u2013 \u010distenie od opakuj\u00facich sa paketov prev\u00e1dzky, ktor\u00e1 sa pren\u00e1\u0161a na analytick\u00e9 prostriedky. Opakuj\u00face sa pakety sa naj\u010dastej\u0161ie vyskytuj\u00fa kv\u00f4li \u0161pecifik\u00e1m pripojenia k infra\u0161trukt\u00fare \u2013 prev\u00e1dzka m\u00f4\u017ee prech\u00e1dza\u0165 cez nieko\u013eko analytick\u00fdch bodov a zrkadli\u0165 sa z ka\u017ed\u00e9ho z nich. Taktie\u017e sa vyskytuje op\u00e4tovn\u00e9 odosielanie nedoru\u010den\u00fdch TCP-paketov, ale ak ich je ve\u013ea, s\u00fa to sk\u00f4r ot\u00e1zky monitorovania kvality siete, nie bezpe\u010dnosti inform\u00e1ci\u00ed v nej.<\/p>\n<p><strong>4. Roz\u0161\u00edren\u00e9 funkcie filtr\u00e1cie <\/strong>\u2013 od vyh\u013ead\u00e1vania konkr\u00e9tnych hodn\u00f4t pod\u013ea dan\u00e9ho posunu po signat\u00farnu anal\u00fdzu cel\u00e9ho paketu.<\/p>\n<p><strong>5. Gener\u00e1cia NetFlow\/IPFIX<\/strong> \u2013 zber \u0161irok\u00e9ho spektra \u0161tatist\u00edk o prech\u00e1dzaj\u00facej prev\u00e1dzke a jej pren\u00e1\u0161anie na analytick\u00e9 prostriedky.<\/p>\n<p><strong>6. De\u0161ifrovanie SSL-prev\u00e1dzky,<\/strong> funguje za podmienky predch\u00e1dzaj\u00faceho na\u010d\u00edtania certifik\u00e1tu a k\u013e\u00fa\u010dov do sprostredkovate\u013ea sie\u0165ov\u00fdch paketov. Napriek tomu to umo\u017e\u0148uje v\u00fdrazne u\u013eah\u010di\u0165 analytick\u00e9 prostriedky. <\/p>\n<p>E\u0161te existuje mno\u017estvo funkci\u00ed, ktor\u00e9 s\u00fa u\u017eito\u010dn\u00e9 a marketingov\u00e9, ale z\u00e1kladn\u00e9 s\u00fa, mysl\u00edm, uveden\u00e9.<\/p>\n<p>Rozvoj syst\u00e9mov detekcie (vniknut\u00ed, DDOS \u00fatokov) do syst\u00e9mov ich prevencie, ako aj zavedenie akt\u00edvnych prostriedkov DPI si vy\u017eiadalo zmenu sch\u00e9my zapojenia z pas\u00edvnej (cez TAP alebo SPAN porty) na akt\u00edvnu (\"v roztrhnut\u00ed\"). T\u00e1to okolnos\u0165 zv\u00fd\u0161ila po\u017eiadavky na spo\u013eahlivos\u0165 (preto\u017ee porucha v takom pr\u00edpade vedie k naru\u0161eniu funk\u010dnosti celej siete, a nie len k strate kontroly nad informa\u010dnou bezpe\u010dnos\u0165ou) a viedla k v\u00fdmene optick\u00fdch odbo\u010diek za optick\u00e9 bypass (aby sa vyrie\u0161il probl\u00e9m z\u00e1vislosti funk\u010dnosti siete od funk\u010dnosti syst\u00e9mov informa\u010dnej bezpe\u010dnosti), av\u0161ak z\u00e1kladn\u00e1 funkcia a po\u017eiadavky na \u0148u zostali rovnak\u00e9. <\/p>\n<p>Vyvinuli sme brokerov sie\u0165ov\u00fdch paketov DS Integrity s rozhraniami 100G, 40G a 10G od kon\u0161trukcie a sch\u00e9matiky po zabudovan\u00fd softv\u00e9r. Navy\u0161e na rozdiel od in\u00fdch brokerov paketov s\u00fa funkcie modifik\u00e1cie a vyv\u00e1\u017eenia pod\u013ea vlo\u017een\u00fdch hlavi\u010diek tunelov u n\u00e1s realizovan\u00e9 hardv\u00e9rovo, pri pln\u00fdch r\u00fdchlostiach portov.<\/p>\n<p><img decoding=\"async\" alt=\"Modern\u00e9 rie\u0161enia na budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker)\" src=\"\/wp-content\/uploads\/2020\/03\/a7f08a061eb707ef8264158b6d1362bc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsol\/blog\/490252\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c. \u041d\u043e \u0435\u0441\u0442\u044c \u043c\u0430\u043b\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043d\u0430 \u0441\u0442\u044b\u043a\u0435 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u0430 \u0438 \u0438\u043d\u0444\u043e\u0431\u0435\u0437\u0430 \u2013 \u0431\u0440\u043e\u043a\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (Network Packet Broker), \u043e\u043d\u0438 \u0436\u0435 \u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0438 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435\/\u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0430\u0433\u0440\u0435\u0433\u0430\u0442\u043e\u0440\u044b \u0442\u0440\u0430\u0444\u0438\u043a\u0430, Security Delivery Platform, Network Visibility \u0438 \u0442\u0430\u043a \u0434\u0430\u043b\u0435\u0435. \u0418 \u043d\u0430\u043c, \u043a\u0430\u043a \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c\u0443 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0443 \u0438 \u0438\u0437\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0435\u043b\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":72063,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-72062","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0431\u0440\u043e\u043a\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (Network Packet Broker) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-01T11:51:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Modern\u00e9 rie\u0161enia pre budovanie syst\u00e9mov informa\u010dnej bezpe\u010dnosti \u2014 brokery sie\u0165ov\u00fdch paketov (Network Packet Broker) | ProHoster","description":"Informa\u010dn\u00e1 bezpe\u010dnos\u0165 sa oddelila od telekomunik\u00e1ci\u00ed na samostatn\u00fd sektor so svojou \u0161pecifikou a svoj\u00edm vybaven\u00edm.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2014 \u0431\u0440\u043e\u043a\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (Network Packet Broker) | ProHoster","og:description":"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c \u043e\u0442 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 \u0432 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043e\u0442\u0440\u0430\u0441\u043b\u044c \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u043e\u0439 \u0438 \u0441\u0432\u043e\u0438\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/sovremennye-resheniya-dlya-postroeniya-sistem-informaczionnoj-bezopasnosti-brokery-setevyh-paketov-network-packet-broker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-01T11:51:13+00:00","article:modified_time":"2020-03-03T13:14:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"72062","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:51:22","updated":"2022-10-04 07:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/72062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=72062"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/72062\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/72063"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=72062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=72062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=72062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}