{"id":38110,"date":"2019-10-31T22:21:42","date_gmt":"2019-10-31T19:21:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dpi-inspektsiya-ssl-protivorechit-smyslu-kriptografii-no-kompanii-eyo-vnedryayut\/"},"modified":"2019-10-31T22:21:42","modified_gmt":"2019-10-31T19:21:42","slug":"dpi-inspektsiya-ssl-protivorechit-smyslu-kriptografii-no-kompanii-eyo-vnedryayut","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dpi-inspektsiya-ssl-protivorechit-smyslu-kriptografii-no-kompanii-eyo-vnedryayut","title":{"rendered":"DPI (inspektimi SSL) bie ndesh me vet\u00eb kuptimin e kriptografis\u00eb, por kompanit\u00eb po e zbatojn\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"DPI
\nZgjidhja e besueshm\u00ebris\u00eb. CC BY-SA 4.0 Yanpas<\/a><\/noindex><\/i><\/p>\n

Inspektimi i trafikut SSL (dekriptim SSL\/TLS, analiza SSL ose DPI) po b\u00ebhet gjithnj\u00eb e pi\u00f9 nj\u00eb tem\u00eb e nxeht\u00eb diskutimi n\u00eb sektorin korporativ. Ideja e dekriptimit t\u00eb trafikut duket se \u00ebsht\u00eb n\u00eb kund\u00ebrshtim me konceptin e kriptografis\u00eb. Sidoqoft\u00eb, fakti \u00ebsht\u00eb se gjithnj\u00eb e m\u00eb shum\u00eb kompani po p\u00ebrdorin teknologjit\u00eb DPI, duke e shpjeguar k\u00ebt\u00eb si nj\u00eb nevoj\u00eb p\u00ebr t\u00eb kontrolluar p\u00ebrmbajtjen p\u00ebr malware, shp\u00ebrndarje t\u00eb t\u00eb dh\u00ebnave, etj.<\/p>\n

N\u00ebse pranojm\u00eb si fakt se \u00ebsht\u00eb e nevojshme t\u00eb implementohet nj\u00eb teknologji t\u00eb till\u00eb, duhet s\u00eb paku t\u00eb shqyrtojm\u00eb m\u00ebnyrat p\u00ebr ta b\u00ebr\u00eb k\u00ebt\u00eb n\u00eb nj\u00eb m\u00ebnyr\u00eb sa m\u00eb t\u00eb sigurt dhe t\u00eb menaxhueshme. S\u00eb paku, mos u mb\u00ebshtetni n\u00eb ato certifikata, p\u00ebr shembull, q\u00eb ju jep furnizuesi i sistemit DPI.<\/p>\n

Ka nj\u00eb aspekt t\u00eb implementimit, p\u00ebr t\u00eb cilin nuk e din\u00eb t\u00eb gjith\u00eb. N\u00eb t\u00eb v\u00ebrtet\u00eb, shum\u00eb e gjejn\u00eb befasuese kur e d\u00ebgjojn\u00eb k\u00ebt\u00eb. Ky \u00ebsht\u00eb nj\u00eb qend\u00ebr e specializuar e certifikimit (QSC). Ajo gjeneron certifikata p\u00ebr dekriptimin dhe enkriptimin e p\u00ebrs\u00ebritur t\u00eb trafikut.
\n<\/a><\/noindex>
\nP\u00ebrve\u00e7 se t\u00eb mb\u00ebshteteni n\u00eb certifikata t\u00eb vet\u00eb-n\u00ebnshkruara ose certifikata nga pajisjet DPI, mund t\u00eb p\u00ebrdorni nj\u00eb QSC t\u00eb dedikuar nga nj\u00eb qend\u00ebr e jashtme certifikimi, si GlobalSign. Por s\u00eb pari, le t\u00eb b\u00ebjm\u00eb nj\u00eb shqyrtim t\u00eb vog\u00ebl t\u00eb vet\u00eb problemit.<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb inspektimi SSL dhe pse p\u00ebrdoret ai?<\/h2>\n

\nGjithnj\u00eb e m\u00eb shum\u00eb faqet publike po kalojn\u00eb n\u00eb HTTPS. P\u00ebr shembull, sipas statistikave t\u00eb Chrome<\/a><\/noindex>, n\u00eb fillim t\u00eb shtatorit 2019, pjesa e trafikut t\u00eb enkriptuar n\u00eb Rusi arriti n\u00eb 83%.<\/p>\n

\"DPI<\/a><\/noindex><\/p>\n

Fatkeq\u00ebsisht, kriptimi i trafikut p\u00ebrdoret gjithnj\u00eb e m\u00eb shum\u00eb edhe nga sulmuesit, sidomos tani q\u00eb Let’s Encrypt shp\u00ebrndan mij\u00ebra certifikata SSL falas n\u00eb nj\u00eb m\u00ebnyr\u00eb automatike. K\u00ebshtu, HTTPS p\u00ebrdoret kudo \u2014 dhe ikona e \u00e7el\u00ebsit n\u00eb shiritin e adres\u00ebs s\u00eb shfletuesit nuk \u00ebsht\u00eb m\u00eb nj\u00eb indikator i besuesh\u00ebm i siguris\u00eb.<\/p>\n

Nga k\u00ebto pozita, prodhuesit e zgjidhjeve DPI promovojn\u00eb produktet e tyre. Ato implementohen midis p\u00ebrdoruesve p\u00ebrfundimtar\u00eb (dmth punonj\u00ebsit tuaj q\u00eb shfletojn\u00eb faqet e internetit) dhe Internetit, duke filtruar trafikun e d\u00ebmsh\u00ebm. Deri m\u00eb sot, n\u00eb treg ekzistojn\u00eb disa t\u00eb tilla produkte, por proceset n\u00eb thelb jan\u00eb t\u00eb nj\u00ebjta. Trafiku HTTPS kalon p\u00ebrmes nj\u00eb pajisjeje kontrolli, ku dekriptohet dhe kontrollohet p\u00ebr pranin\u00eb e malware.<\/p>\n

Pasi p\u00ebrfundimit t\u00eb kontrolleve, pajisja krijon nj\u00eb SSL-session t\u00eb ri me klientin p\u00ebr t\u00eb dekoduar dhe rikoduar p\u00ebrmbajtjen.<\/p>\n

Si funksionon procesi i dekodimit\/rikodimit<\/h2>\n

\nP\u00ebr t\u00eb dekoduar dhe rikoduar paketat p\u00ebrpara se t'i d\u00ebrgoj\u00eb te p\u00ebrdoruesit e fundit, pajisja e inspektimit SSL duhet t\u00eb jet\u00eb e aft\u00eb t\u00eb l\u00ebshoj\u00eb certifikata SSL n\u00eb flutur. Kjo do t\u00eb thot\u00eb se duhet t\u00eb ket\u00eb nj\u00eb certifikat\u00eb CA t\u00eb instaluar.<\/p>\n

P\u00ebr kompanin\u00eb (ose ndonj\u00eb person n\u00eb mes) \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb k\u00ebto certifikata SSL t\u00eb jen\u00eb t\u00eb besueshme n\u00eb shfletuesit (dmth. t\u00eb mos shkaktojn\u00eb mesazhe t\u00eb frikshme paralajm\u00ebruese si ai i m\u00ebposht\u00ebm). Prandaj, zinxhiri CA (ose hierarkia) duhet t\u00eb jet\u00eb n\u00eb magazin\u00ebn e besueshm\u00ebris\u00eb s\u00eb shfletuesit. Pasiq\u00eb k\u00ebto certifikata nuk l\u00ebshohen nga qendrat e certifikimit t\u00eb besueshme publike, \u00ebsht\u00eb e nevojshme t\u00eb transmetohet manualisht hierarkit\u00eb CA te t\u00eb gjith\u00eb klient\u00ebt e fundit.<\/p>\n

\"DPI
\nMesazhi paralajm\u00ebrues p\u00ebr nj\u00eb certifikat\u00eb me n\u00ebnshkrim t\u00eb vet\u00eb-krijuar n\u00eb Chrome. Burimi: BadSSL.com<\/a><\/noindex><\/i><\/p>\n

N\u00eb kompjuter\u00ebt me Windows, mund t\u00eb p\u00ebrfshihet Active Directory dhe politikat grupore, por p\u00ebr pajisjet mobile procedura \u00ebsht\u00eb m\u00eb e komplikuar.<\/p>\n

Situata b\u00ebhet edhe m\u00eb e komplikuar kur duhet t\u00eb mb\u00ebshteten edhe certifikatat thelb\u00ebsore t\u00eb tjera n\u00eb mjedisin e korporat\u00ebs, p\u00ebr shembull, nga Microsoft ose bazuar n\u00eb OpenSSL. P\u00ebrve\u00e7 k\u00ebsaj, duhet mbrojtja dhe menaxhimi i \u00e7el\u00ebsit sekret, n\u00eb m\u00ebnyr\u00eb q\u00eb asnj\u00eb nga \u00e7el\u00ebsat t\u00eb mos skadoj\u00eb papritur.<\/p>\n

Zgjidhja m\u00eb e mir\u00eb: nj\u00eb certifikat\u00eb thelb\u00ebsore private dhe e dedikuar nga nj\u00eb CA e tret\u00eb<\/h2>\n

\nN\u00ebse menaxhimi i disa \u00e7el\u00ebsave ose certifikatat e n\u00ebnshkruara vet\u00eb nuk jan\u00eb t\u00ebrheq\u00ebse, ka nj\u00eb opsion tjet\u00ebr: mund t\u00eb mb\u00ebshteteni n\u00eb nj\u00eb CA t\u00eb tret\u00eb. N\u00eb k\u00ebt\u00eb rast, certifikatat l\u00ebshohen nga nj\u00eb<\/b> qend\u00ebr besimi private, e cila \u00ebsht\u00eb e lidhur n\u00eb zinxhirin e besueshm\u00ebris\u00eb me nj\u00eb CA t\u00eb dedikuar dhe private t\u00eb krijuar posa\u00e7\u00ebrisht p\u00ebr kompanin\u00eb.<\/p>\n

\"DPI<\/a><\/noindex>
\nArkitektura e thjeshtuar p\u00ebr certifikatat e thelb\u00ebsoreve t\u00eb klient\u00ebve t\u00eb dedikuar<\/i><\/p>\n

Ky ky\u00e7je eliminon disa nga problemet e p\u00ebrmendura m\u00eb par\u00eb: s\u00eb paku zvog\u00eblon numrin e rr\u00ebnj\u00ebve q\u00eb duhet t\u00eb menaxhohen. K\u00ebtu mund t\u00eb p\u00ebrdoret vet\u00ebm nj\u00eb qend\u00ebr rr\u00ebnj\u00eb private p\u00ebr t\u00eb gjitha nevojat e brendshme t\u00eb PKI me \u00e7do num\u00ebr t\u00eb qendrave t\u00eb mesme t\u00eb certifikimit. P\u00ebr shembull, n\u00eb diagramin e m\u00ebsip\u00ebrm tregohet nj\u00eb hierarki me shum\u00eb nivele, n\u00eb t\u00eb cil\u00ebn nj\u00ebra nga qendrat e mesme t\u00eb certifikimit p\u00ebrdoret p\u00ebr verifikimin\/dekriptimin e SSL, nd\u00ebrsa tjetra p\u00ebr kompjuter\u00ebt e brendsh\u00ebm (laptop\u00ebt, server\u00ebt, kompjuter\u00ebt desktop, etj.).<\/p>\n

N\u00eb k\u00ebt\u00eb skem\u00eb nuk \u00ebsht\u00eb e nevojshme t\u00eb vendosni CA n\u00eb t\u00eb gjith\u00eb klient\u00ebt, sepse CA e nivelit t\u00eb lart\u00eb vendoset te GlobalSign, q\u00eb zgjidh problemet me mbrojtjen e \u00e7el\u00ebsit t\u00eb mbyllur dhe me afatin e skadimit.<\/p>\n

Nj\u00eb tjet\u00ebr avantazh i k\u00ebtij qasje \u00ebsht\u00eb mund\u00ebsia p\u00ebr t\u00eb revokuar qendr\u00ebn e certifikimit SSL p\u00ebr \u00e7do arsye. N\u00eb vend t\u00eb saj, thjesht krijohet nj\u00eb e re, q\u00eb lidhet me rr\u00ebnj\u00ebn tuaj private origjinale, dhe mund t\u00eb p\u00ebrdoret menj\u00ebher\u00eb.<\/p>\n

Pavar\u00ebsisht t\u00eb gjitha kund\u00ebrshtimeve, bizneset gjithnj\u00eb e m\u00eb shum\u00eb po implementojn\u00eb inspektimin e SSL t\u00eb trafikut si nj\u00eb pjes\u00eb e infrastruktur\u00ebs s\u00eb brendshme ose private PKI. Opsione t\u00eb tjera p\u00ebr p\u00ebrdorimin e PKI private jan\u00eb l\u00ebshimi i certifikatave p\u00ebr autentifikimin e pajisjeve apo p\u00ebrdoruesve, SSL p\u00ebr server\u00ebt e brendsh\u00ebm, si dhe konfigurime t\u00eb ndryshme q\u00eb nuk lejohet n\u00eb certifikatat e besuara publike n\u00eb p\u00ebrputhje me k\u00ebrkesat e CA\/Browser Forum.<\/p>\n

Shfletuesit jan\u00eb duke u kund\u00ebrv\u00ebn\u00eb<\/h2>\n

\nDuhet t\u00eb theksohet se zhvilluesit e shfletuesve po p\u00ebrpiqen t\u00eb kund\u00ebrshtojn\u00eb k\u00ebt\u00eb tendenc\u00eb dhe t\u00eb mbrojn\u00eb p\u00ebrdoruesit p\u00ebrfundimtar\u00eb nga MiTM. P\u00ebr shembull, disa dit\u00eb m\u00eb par\u00eb Mozilla mori vendim<\/a><\/noindex> do t\u00eb p\u00ebrfshij\u00eb si parazgjedhje protokollin DoH (DNS-over-HTTPS) n\u00eb nj\u00eb nga versionet e ardhshme t\u00eb shfletuesit Firefox. Protokolli DoH fsheh k\u00ebrkesat DNS nga sistemi DPI, duke e b\u00ebr\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb inspektimin e SSL.<\/p>\n

P\u00ebr planet e ngjashme m\u00eb 10 Shtator 2019, njoftoi<\/a><\/noindex> kompania Google p\u00ebr shfletuesin Chrome.<\/p>\n

\"DPI<\/a><\/noindex><\/p>\n

Vet\u00ebm p\u00ebrdoruesit e regjistruar mund t\u00eb marrin pjes\u00eb n\u00eb anket\u00eb. Hyni<\/a><\/noindex>, ju lutem.<\/p>\n

A mendoni se kompania ka t\u00eb drejt\u00eb t\u00eb inspektoj\u00eb trafikun SSL t\u00eb punonj\u00ebsve t\u00eb saj?<\/h2>\n