VPN<\/a> ose pa t\u00eb.<\/p>\nEnkriptimi i rrjetit n\u00eb nj\u00eb rrjet t\u00eb shp\u00ebrndar\u00eb Ethernet<\/i><\/p>\n
Vete pajisjet mund t\u00eb jen\u00eb ose t\u00eb specializuara<\/b> (t\u00eb destinuara ekskluzivisht p\u00ebr enkriptim), ose multifunksionale (hibrid\u00eb, konverguese<\/b>), q\u00eb do t\u00eb thot\u00eb q\u00eb ato gjithashtu kryejn\u00eb funksione t\u00eb tjera (p\u00ebr shembull, si nj\u00eb firewall ose ruter). Diferent vendor\u00eb klasifikojn\u00eb pajisjet e tyre n\u00eb klasa\/kategori t\u00eb ndryshme, por kjo nuk ka r\u00ebnd\u00ebsi \u2013 e r\u00ebnd\u00ebsishme \u00ebsht\u00eb n\u00ebse ato arrijn\u00eb t\u00eb kodifikojn\u00eb trafikun nd\u00ebr-sajtesh dhe cilat karakteristika kan\u00eb kur b\u00ebjn\u00eb k\u00ebt\u00eb.<\/p>\n
P\u00ebr \u00e7do rast, po ju kujtoj se \"kriptimi rrjetit\", \"kriptimi i trafikut\", \"kriptuesi\" \u2013 jan\u00eb terma joformale, megjithat\u00eb p\u00ebrdoren shpesh. N\u00eb aktet ligjore ruse (p\u00ebrfshir\u00eb ato q\u00eb futin GOST-et) ndoshta nuk do t'i gjeni kurr\u00eb.<\/p>\n
Nivellet e kriptimit dhe modet e transmetimit<\/h4>\n \nPara se t\u00eb fillojm\u00eb t\u00eb p\u00ebrshkruajm\u00eb vetit\u00eb q\u00eb do t\u00eb p\u00ebrdoren p\u00ebr vler\u00ebsim, \u00ebsht\u00eb e nevojshme t\u00eb kuptojm\u00eb nj\u00eb gj\u00eb t\u00eb r\u00ebnd\u00ebsishme, dometh\u00ebn\u00eb \"nivelin e kriptimit\". Kam v\u00ebn\u00eb re se ai p\u00ebrmendet shpesh si n\u00eb dokumentet zyrtare t\u00eb vendor\u00ebve (n\u00eb p\u00ebrshkrime, udh\u00ebzime, etj.), ashtu edhe n\u00eb diskutime joformale (n\u00eb negociata, n\u00eb trajnime). Pra, duket se t\u00eb gjith\u00eb e din\u00eb p\u00ebr \u00e7far\u00eb b\u00ebhet fjal\u00eb, por un\u00eb kam qen\u00eb d\u00ebshmitar i nj\u00eb ngat\u00ebrrimi t\u00eb caktuar.<\/p>\n
Pra, \u00e7far\u00eb \u00ebsht\u00eb \"niveli i kriptimit\"? \u00cbsht\u00eb e qart\u00eb se b\u00ebhet fjal\u00eb p\u00ebr numrin e nivelit t\u00eb modelit standard t\u00eb rrjetit OSI\/ISO, n\u00eb t\u00eb cilin ndodh kriptimi. Lexoni GOST R ISO 7498-2\u201399 \"Teknologjia e informacionit. Nd\u00ebrveprimi i sistemeve t\u00eb hapura. Modeli bazik standard. Pjesa 2. Arkitektura e mbrojtjes s\u00eb informacionit\". Nga ky dokument mund t\u00eb kuptohet se niveli i sh\u00ebrbimit t\u00eb konfidencialitetit (nj\u00eb nga mekanizmat p\u00ebr t\u00eb cilin p\u00ebrdoret p\u00ebr t\u00eb siguruar k\u00ebt\u00eb \u00ebsht\u00eb kriptimi) \u2013 \u00ebsht\u00eb niveli i protokollit, blloku sh\u00ebrbyes i t\u00eb dh\u00ebnave (\"ngarkesa e dobishme\", t\u00eb dh\u00ebnat e p\u00ebrdoruesit) t\u00eb cilit i n\u00ebnshtrohet kriptimi. Si\u00e7 shkruhet edhe n\u00eb standard, sh\u00ebrbimi mund t\u00eb ofrohet ose n\u00eb k\u00ebt\u00eb nivel, \"me forcat e tij\", ose p\u00ebrmes nivelit t\u00eb posht\u00ebm (k\u00ebshtu, p\u00ebr shembull, kjo zakonisht realizohet n\u00eb MACsec).<\/p>\n
N\u00eb praktik\u00eb, megjithat\u00eb, jan\u00eb t\u00eb mundshme dy moda transmetimi t\u00eb informacionit t\u00eb kriptuar n\u00ebp\u00ebr rrjet (n\u00eb t\u00eb mendjen sa shpejt vjen IPsec, por k\u00ebto moda treten edhe n\u00eb protokolle t\u00eb tjera). N\u00eb modin e transportit<\/b> (ndonj\u00ebher\u00eb e quajn\u00eb edhe native) kriptohet vet\u00ebm sh\u00ebrbimi<\/b> bloku t\u00eb dh\u00ebnash, nd\u00ebrsa titujt mbeten \"t\u00eb hapur\", t\u00eb paenkriptuar (ndonj\u00ebher\u00eb shtohen fusha shtes\u00eb me informacion sh\u00ebrbimi t\u00eb algoritmit t\u00eb enkriptimit, dhe fusha t\u00eb tjera modifikohen, p\u00ebrllogariten). N\u00eb modusin tunel<\/b> n\u00eb t\u00eb nj\u00ebjtin protokolar<\/b> bloku i t\u00eb dh\u00ebnave (dmth pakoja vet\u00eb) enkriptohet dhe inkapsulohet n\u00eb nj\u00eb blok sh\u00ebrbimi t\u00eb t\u00eb dh\u00ebnave t\u00eb t\u00eb nj\u00ebjtit ose m\u00eb t\u00eb lart\u00eb nivel, dmth ai rrethoh\u00ebt me tituj t\u00eb rinj.<\/p>\n
Niveli i enkriptimit n\u00eb vetvete n\u00eb kombinim me ndonj\u00eb mod t\u00eb transmetimit nuk \u00ebsht\u00eb as i mir\u00eb, as i keq, k\u00ebshtu q\u00eb nuk mund t\u00eb thuhet, p\u00ebr shembull, q\u00eb L3 n\u00eb modus transporti \u00ebsht\u00eb m\u00eb mir\u00eb se L2 n\u00eb modus tuneli. Thjesht nga ata varen shum\u00eb karakteristika, nga t\u00eb cilat vler\u00ebsohen pajisjet. P\u00ebr shembull, fleksibiliteti dhe kompatibiliteti. P\u00ebr t\u00eb punuar n\u00eb rrjetin L1 (p\u00ebr\u00e7imi i fluxit t\u00eb bit\u00ebve), L2 (nd\u00ebrrimi i kornizave) dhe L3 (routimi i pakove) n\u00eb modus transporti, nevojiten zgjidhje q\u00eb enkriptojn\u00eb n\u00eb t\u00eb nj\u00ebjtin ose m\u00eb t\u00eb lart\u00eb nivel (ndryshe do t\u00eb enkriptohet informacioni adresues, dhe t\u00eb dh\u00ebnat nuk do t\u00eb arrijn\u00eb n\u00eb destinacion), nd\u00ebrsa modus tuneli lejon t\u00eb tejkalohen k\u00ebto kufizime (n\u00eb t\u00eb v\u00ebrtet\u00eb, duke sakrifikuar karakteristika t\u00eb tjera t\u00eb r\u00ebnd\u00ebsishme).<\/p>\n
Modet e enkriptimit t\u00eb transportit dhe tunelit L2<\/i><\/p>\n
Tani, le t\u00eb kalojm\u00eb n\u00eb shqyrtimin e karakteristikave.<\/p>\n
Performanca<\/h4>\n \nP\u00ebr enkriptimin n\u00eb rrjet, performanca \u00ebsht\u00eb nj\u00eb koncept kompleks, me shum\u00eb dimensione. Nganj\u00ebher\u00eb ndodh q\u00eb nj\u00eb model i caktuar, duke e kaluar n\u00eb nj\u00eb karakteristik\u00eb t\u00eb performanc\u00ebs, t\u00eb jet\u00eb m\u00eb pak i mir\u00eb n\u00eb nj\u00eb tjet\u00ebr. Prandaj, gjithmon\u00eb \u00ebsht\u00eb e dobishme t\u00eb shqyrtohen t\u00eb gjitha p\u00ebrb\u00ebr\u00ebsit e performanc\u00ebs s\u00eb enkriptimit dhe ndikimi i tyre n\u00eb performanc\u00ebn e rrjetit dhe aplikacioneve q\u00eb e p\u00ebrdorin at\u00eb. K\u00ebtu mund t\u00eb b\u00ebhet nj\u00eb analogji me nj\u00eb makin\u00eb, p\u00ebr t\u00eb cil\u00ebn \u00ebsht\u00eb e r\u00ebnd\u00ebsishme jo vet\u00ebm shpejt\u00ebsia maksimale, por edhe koha e accelerating p\u00ebr \"qind\", konsumimi i karburantit dhe k\u00ebshtu me radh\u00eb. Karakteristikave t\u00eb performanc\u00ebs shpesh u kushtohet v\u00ebmendje t\u00eb madhe nga kompanit\u00eb prodhuese dhe klient\u00ebt e tyre potencial\u00eb. Zakonisht, p\u00ebr performanc\u00ebn b\u00ebhet renditja n\u00eb linjat e pajisjeve t\u00eb enkriptimit t\u00eb prodhuesve.<\/p>\n
E qart\u00eb se performanca varet si nga kompleksiteti i operacioneve rrjet\u00ebsore dhe kriptografike q\u00eb kryhen n\u00eb pajisje (p\u00ebrfshir\u00eb se sa mir\u00eb k\u00ebto detyra i n\u00ebnshtrohen paralelizmit dhe pipeline), ashtu edhe nga performanca e harduerit dhe cil\u00ebsia e softuerit t\u00eb integruar. Prandaj, n\u00eb modelet m\u00eb t\u00eb avancuara p\u00ebrdoren harduer m\u00eb efikas, ndonj\u00ebher\u00eb ka mund\u00ebsi p\u00ebr ta pajisur at\u00eb me procesor\u00eb dhe module memorjeje shtes\u00eb. Ka disa qasje p\u00ebr realizimin e funksioneve kriptografike: n\u00eb procesorin qendror universale (CPU), n\u00eb mikro\u00e7ipin e specializuar t\u00eb porositur (ASIC) ose n\u00eb mikro\u00e7ipin e logjik\u00ebs programabile (FPGA). \u00c7do qasje ka avantazhet dhe disavantazhet e saj. P\u00ebr shembull, CPU mund t\u00eb b\u00ebhet<\/p>\n
p\u00ebr kriptimin<\/b> , \u00ebsht\u00eb logjike q\u00eb performanca e zgjidhjeve duhet t\u00eb matet n\u00eb t\u00eb nj\u00ebjtat sasi si p\u00ebr pajisjet e tjera rrjet\u00ebsore \u2013 kapacitetin, p\u00ebrqindjen e humbjes s\u00eb paketave dhe vones\u00ebn. K\u00ebto sasi jan\u00eb t\u00eb p\u00ebrcaktuara n\u00eb RFC 1242. Sa p\u00ebr variacionin e shpesh p\u00ebrmendur t\u00eb vones\u00ebs (jitter), n\u00eb k\u00ebt\u00eb RFC nuk \u00ebsht\u00eb shkruar asgj\u00eb. Si t\u00eb matim k\u00ebto sasi? Un\u00eb nuk kam gjetur ndonj\u00eb metodologji t\u00eb miratuar n\u00eb ndonj\u00eb standard (zyrtar ose jozyrtar si RFC) posa\u00e7\u00ebrisht p\u00ebr kriptimin rrjet\u00ebsor. Do t\u00eb ishte logjike t\u00eb p\u00ebrdorej metodologjia p\u00ebr pajisjet rrjet\u00ebsore q\u00eb \u00ebsht\u00eb e p\u00ebrcaktuar n\u00eb standardin RFC 2544. Shum\u00eb prodhues ndjekin at\u00eb \u2013 shum\u00eb, por jo t\u00eb gjith\u00eb. P\u00ebr shembull, ata ofrojn\u00eb trafik testues vet\u00ebm n\u00eb nj\u00eb drejtim n\u00eb vend t\u00eb t\u00eb dyjave, si\u00e7 parashikon t\u00eb rekomanduara<\/b> standardin. Megjithat\u00eb, nuk ka r\u00ebnd\u00ebsi.<\/p>\n
Matja e performanc\u00ebs s\u00eb pajisjeve t\u00eb enkriptimit rrjet\u00eb ka disa karakteristika t\u00eb ve\u00e7anta. S\u00eb pari, \u00ebsht\u00eb e nevojshme t\u00eb kryhen t\u00eb gjitha matjet p\u00ebr nj\u00eb \u00e7ift pajisjesh: ndon\u00ebse algoritm\u00ebt e enkriptimit jan\u00eb simetrik\u00eb, vonesat dhe humbjet e pakove gjat\u00eb enkriptimit dhe dekriptimit nuk do t\u00eb jen\u00eb patjet\u00ebr t\u00eb barabarta. S\u00eb dyti, ka kuptim t\u00eb matet sakt\u00ebsisht dyt\u00eb e ndikimit t\u00eb enkriptimit n\u00eb performanc\u00ebn p\u00ebrfundimtare t\u00eb rrjetit, duke krahasuar dy konfigurations: pa pajisje enkriptimi dhe me to. Ose, si\u00e7 \u00ebsht\u00eb rasti me pajisjet hibride q\u00eb kombinojn\u00eb disa funksione p\u00ebrve\u00e7 enkriptimit rrjet\u00eb, n\u00eb m\u00ebnyr\u00eb t\u00eb fikur dhe t\u00eb ndezur. Ky ndikim mund t\u00eb jet\u00eb i ndrysh\u00ebm dhe varet nga skema e lidhjes s\u00eb pajisjeve t\u00eb enkriptimit, nga m\u00ebnyrat e pun\u00ebs, madje edhe nga natyra e trafikut. N\u00eb ve\u00e7anti, shum\u00eb parametra t\u00eb performanc\u00ebs varen nga gjat\u00ebsia e pakove, prandaj p\u00ebr t\u00eb krahasuar performanc\u00ebn e zgjidhjeve t\u00eb ndryshme shpesh p\u00ebrdoren grafik\u00ebt e var\u00ebsis\u00eb s\u00eb k\u00ebtyre parametrave nga gjat\u00ebsia e pakove, ose p\u00ebrdoret IMIX \u2013 shp\u00ebrndarja e trafikut sipas gjat\u00ebsive t\u00eb pakove q\u00eb pasqyron p\u00ebraf\u00ebrsisht realitetin. N\u00ebse marrim p\u00ebr krahasim t\u00eb nj\u00ebjt\u00ebn konfiguracy themelore pa enkriptim, at\u00ebher\u00eb mund t\u00eb krahasojm\u00eb zgjidhjet p\u00ebr enkriptimin rrjet\u00eb, q\u00eb jan\u00eb realizuar n\u00eb m\u00ebnyra t\u00eb ndryshme, pa iu p\u00ebrkushtuar k\u00ebtyre dallimeve: L2 me L3, 'ruaj dhe d\u00ebrgo' (store-and-forward) me kalim t\u00eb plot\u00eb (cut-through), t\u00eb specializuara me t\u00eb konverguara, GOST me AES, e k\u00ebshtu me radh\u00eb.<\/p>\n
Skema e lidhjes p\u00ebr testimin e performanc\u00ebs<\/i><\/p>\n
Karakteristika e par\u00eb n\u00eb t\u00eb cil\u00ebn fokusohet \u00ebsht\u00eb 'shpejt\u00ebsia' e pajisjes s\u00eb enkriptimit, q\u00eb do t\u00eb thot\u00eb gjer\u00ebsia e band\u00ebs<\/b> (bandwidth) e nd\u00ebrfaqeve t\u00eb saj rrjet\u00eb, shpejt\u00ebsia e rrjedh\u00ebs s\u00eb bit\u00ebve. Ajo p\u00ebrcaktohet nga standartet rrjet\u00eb q\u00eb mb\u00ebshteten nga nd\u00ebrfaqet. P\u00ebr Ethernet, numrat e zakonsh\u00ebm jan\u00eb 1 Gbit\/s dhe 10 Gbit\/s. Por, si\u00e7 e dim\u00eb, n\u00eb \u00e7do rrjet, kapaciteti maksimal teorik i kalimit<\/b> kapaciteti n\u00eb \u00e7do nga nivelet e saj \u00ebsht\u00eb gjithmon\u00eb m\u00eb i ul\u00ebt se gjer\u00ebsia e kanalit: nj\u00eb pjes\u00eb e gjer\u00ebsis\u00eb \"humbet\" p\u00ebr shkak t\u00eb intervaleve midis kornizave, titujve sh\u00ebrbimi dhe k\u00ebshtu me radh\u00eb. N\u00ebse pajisja \u00ebsht\u00eb n\u00eb gjendje t\u00eb pranoj\u00eb, p\u00ebrpunoj\u00eb (n\u00eb rastin ton\u00eb t\u00eb enkriptoj\u00eb ose dekriptoj\u00eb) dhe transferoj\u00eb trafik me shpejt\u00ebsin\u00eb e plot\u00eb t\u00eb interfesit rrjetor, pra me kapacitetin maksimal teorik p\u00ebr k\u00ebt\u00eb nivel t\u00eb modelit rrjetor, at\u00ebher\u00eb thuhet se ajo funksionon me shpejt\u00ebsi t\u00eb linj\u00ebs<\/b>. P\u00ebr k\u00ebt\u00eb, \u00ebsht\u00eb e nevojshme q\u00eb pajisja t\u00eb mos humbas\u00eb, t\u00eb mos p\u00ebrjashtoj\u00eb paketa pavar\u00ebsisht nga madh\u00ebsia e tyre dhe frekuencat e ndjekjes s\u00eb tyre. N\u00ebse pajisja e enkriptimeve nuk mb\u00ebshtet pun\u00ebn me shpejt\u00ebsin\u00eb e linj\u00ebs, zakonisht tregohet kapaciteti i saj maksimal n\u00eb gigabite p\u00ebr sekond\u00eb (ndonj\u00ebher\u00eb me shkruarjen e madh\u00ebsive t\u00eb paketimeve - sa m\u00eb t\u00eb shkurtra t\u00eb jen\u00eb paketat, aq m\u00eb e ul\u00ebt \u00ebsht\u00eb zakonisht kapaciteti). \u00cbsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se kapaciteti maksimal \u00ebsht\u00eb maksimali pa humbje<\/b> (edhe n\u00ebse pajisja mund \"t\u00eb kaloj\u00eb\" trafik p\u00ebrmes saj me shpejt\u00ebsi m\u00eb t\u00eb madhe, por humb nj\u00eb pjes\u00eb t\u00eb paketave n\u00eb k\u00ebt\u00eb proces). P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb e nevojshme t\u00eb kihet parasysh se disa ofrues t\u00eb sh\u00ebrbimeve masin kapacitetin e p\u00ebrgjithsh\u00ebm midis t\u00eb gjitha \u00e7iftave t\u00eb porteve, k\u00ebshtu q\u00eb k\u00ebto numra t\u00eb kan\u00eb pak vler\u00eb n\u00ebse e gjith\u00eb trafiku i enkriptuar kalon p\u00ebrmes nj\u00eb porti t\u00eb vet\u00ebm.<\/p>\n
Ku \u00ebsht\u00eb ve\u00e7an\u00ebrisht e r\u00ebnd\u00ebsishme t\u00eb funksionoj\u00eb me shpejt\u00ebsi t\u00eb linj\u00ebs (ndryshe, pa humbje paketash)? N\u00eb kanale me gjer\u00ebsi t\u00eb madhe dhe vonesa t\u00eb larta (p.sh., satelitore), ku p\u00ebr t\u00eb ruajtur shpejt\u00ebsin\u00eb e lart\u00eb t\u00eb transferimit duhet t\u00eb vendoset nj\u00eb madh\u00ebsi e madhe e dritares TCP, dhe ku humbjet e paketave e ulin duksh\u00ebm performanc\u00ebn e rrjetit.<\/p>\n
Por jo t\u00eb gjith\u00eb kapaciteti p\u00ebrdoret p\u00ebr transferimin e t\u00eb dh\u00ebnave t\u00eb dobishme. \u00cbsht\u00eb e nevojshme t\u00eb merren parasysh t\u00eb ashtuquajturat shpenzime shtes\u00eb<\/b> (overhead) kapacitetit. Ky \u00ebsht\u00eb nj\u00eb pjes\u00eb e kapacitetit t\u00eb pajisjes s\u00eb enkriptimit (n\u00eb p\u00ebrqindje ose n\u00eb byte p\u00ebr paket\u00eb), e cila humbet efektivisht (nuk mund t\u00eb p\u00ebrdoret p\u00ebr transmetimin e t\u00eb dh\u00ebnave t\u00eb aplikacioneve). Ndalimet ndodhin, s\u00eb pari, p\u00ebr shkak t\u00eb rritjes s\u00eb madh\u00ebsis\u00eb (shtesave, \u00abmbushjes\u00bb) t\u00eb fush\u00ebs s\u00eb t\u00eb dh\u00ebnave n\u00eb paketat rrjet\u00ebsore t\u00eb enkriptuara (varet nga algoritmi i enkriptimit dhe m\u00ebnyra e funksionimit t\u00eb tij). S\u00eb dyti, p\u00ebr shkak t\u00eb rritjes s\u00eb gjat\u00ebsi t\u00eb kryefjal\u00ebve t\u00eb paketave (modi tunel, injeksionet e sh\u00ebrbimit t\u00eb protokollit t\u00eb enkriptimit, injeksionet e kontrollit etj. sipas protokollit dhe m\u00ebnyr\u00ebs s\u00eb funksionimit t\u00eb enkriptuesit dhe m\u00ebnyr\u00ebs s\u00eb transmetimit) - zakonisht k\u00ebto ndalesa jan\u00eb m\u00eb t\u00eb r\u00ebnd\u00ebsishme dhe atyre u kushtohet v\u00ebmendje n\u00eb radh\u00eb t\u00eb par\u00eb. S\u00eb treti, p\u00ebr shkak t\u00eb fragmentimit t\u00eb paketave kur tejkalohet madh\u00ebsia maksimale e bllokut t\u00eb t\u00eb dh\u00ebnave (MTU) (n\u00ebse rrjeti mund t\u00eb thyej\u00eb nj\u00eb paket\u00eb q\u00eb tejkalon MTU-n\u00eb n\u00eb dy, duke dyfishuar kryefjal\u00ebt e saj). S\u00eb kat\u00ebrti, p\u00ebr shkak t\u00eb paraqitjes n\u00eb rrjet t\u00eb trafikut t\u00eb dhomave s\u00eb sh\u00ebrbimit shtes\u00eb (kontroll) midis pajisjeve t\u00eb enkriptimit (p\u00ebr shk\u00ebmbimin e \u00e7el\u00ebsave, p\u00ebr t\u00eb vendosur tunel\u00ebt etj.). Ndalimet e ul\u00ebta jan\u00eb t\u00eb r\u00ebnd\u00ebsishme atje ku kapaciteti i kanalit \u00ebsht\u00eb i kufizuar. Kjo manifestohet ve\u00e7an\u00ebrisht n\u00eb trafikun e paketave t\u00eb vogla, p\u00ebr shembull, n\u00eb at\u00eb t\u00eb z\u00ebrit - aty ndalimet mund t\u00eb \u00abhan\u00eb\u00bb m\u00eb shum\u00eb se gjysma e shpejt\u00ebsis\u00eb s\u00eb kanalit!<\/p>\n
Kapaciteti<\/i><\/p>\n
Fundit, ka ende vonese e sjell\u00eb<\/b> \u2013 ndryshimi (n\u00eb pjes\u00ebt e sekond\u00ebs) n\u00eb vones\u00ebn rrjetore (koha e kalimit t\u00eb t\u00eb dh\u00ebnave nga hyrja n\u00eb rrjet deri te dalja e saj) midis transmetimit t\u00eb t\u00eb dh\u00ebnave pa enkriptim rrjetor dhe me t\u00eb. N\u00eb p\u00ebrgjith\u00ebsi, sa m\u00eb e vog\u00ebl t\u00eb jet\u00eb vonesa (\u201clatenc\u00eb\u201d) e rrjetit, aq m\u00eb kritike b\u00ebhet vonesa e sjell\u00eb nga pajisjet e enkriptimit. Vonesa vjen si nga operacioni i enkriptimit (varet nga algoritmi i enkriptimit, gjat\u00ebsia e bllokut dhe m\u00ebnyra e funksionimit t\u00eb enkriptimit, si dhe nga cil\u00ebsia e realizimit t\u00eb tij n\u00eb softuer), ashtu edhe nga p\u00ebrpunimi i paketave rrjetore n\u00eb pajisje. Vonesa q\u00eb sjellin varet nga m\u00ebnyra e p\u00ebrpunimit t\u00eb paketave (n\u00eb kalim t\u00eb plot\u00eb ose \u201cruaj dhe d\u00ebrgo\u201d) si dhe nga performanca e platform\u00ebs (\u201crealizimi harduerik\u201d n\u00eb FPGA ose ASIC, zakonisht \u00ebsht\u00eb m\u00eb i shpejt\u00eb se \u201crealizimi softuerik\u201d n\u00eb CPU). Enkriptimi L2 pothuajse gjithmon\u00eb ndikon me nj\u00eb vones\u00eb t\u00eb vog\u00ebl n\u00eb krahasim me enkriptimin n\u00eb L3 ose L4: ndikon fakti se pajisjet q\u00eb enkriptojn\u00eb n\u00eb L3\/L4 shpesh realizohen konvergjente. P\u00ebr shembull, me enkriptuesit e Ethernet me shpejt\u00ebsi t\u00eb lart\u00eb, t\u00eb realizuar n\u00eb FPGA dhe q\u00eb enkriptojn\u00eb n\u00eb L2, vonesa p\u00ebr shkak t\u00eb operacionit t\u00eb enkriptimit \u00ebsht\u00eb ndjesh\u00ebm e vog\u00ebl \u2013 ndonj\u00ebher\u00eb kur aktivizohet enkriptimi n\u00eb nj\u00eb \u00e7ift pajisjesh, vonesa e tyre e p\u00ebrgjithshme madje ulet! Vonesa e vog\u00ebl \u00ebsht\u00eb e r\u00ebnd\u00ebsishme atje ku \u00ebsht\u00eb e krahasueshme me vonesat totale n\u00eb kanal, duke p\u00ebrfshir\u00eb vones\u00ebn e p\u00ebrhapjes s\u00eb sinjalit, e cila \u00ebsht\u00eb rreth 5 \u00b5s p\u00ebr kilometrin. Pra, mund t\u00eb thuhet se p\u00ebr rrjetet e shkall\u00ebs qytetare (dhjet\u00ebra kilometra n\u00eb diamet\u00ebr) mikrosekonat mund t\u00eb jen\u00eb vendimtare. P\u00ebr shembull, p\u00ebr replikimin sinkron t\u00eb bazave t\u00eb t\u00eb dh\u00ebnave, tregtimin me frekuenc\u00eb t\u00eb lart\u00eb, t\u00eb nj\u00ebjtin blockchain.<\/p>\n
Vonesa e sjell\u00eb<\/i><\/p>\nShkall\u00ebzueshm\u00ebria<\/h4>\n
\nRrjet e m\u00ebdha t\u00eb shp\u00ebrndara mund t\u00eb p\u00ebrfshijn\u00eb mij\u00ebra nyje dhe pajisje rrjeti, qindra segmente t\u00eb rrjeteve t\u00eb lokalizuara. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb zgjidhjet p\u00ebr enkriptimin t\u00eb mos vendosin kufizime shtes\u00eb p\u00ebr madh\u00ebsin\u00eb dhe topologjin\u00eb e rrjetit t\u00eb shp\u00ebrndar\u00eb. Kjo lidhet kryesisht me numrin maksimal t\u00eb adresave t\u00eb nyjeve dhe rrjeteve. Kufizime t\u00eb till\u00eb mund t\u00eb hasen, p\u00ebr shembull, gjat\u00eb zbatimit t\u00eb topologjis\u00eb shum\u00ebpik\u00ebshe t\u00eb rrjetit t\u00eb mbrojtur me enkriptim (me lidhje t\u00eb mbrojtura t\u00eb pavarura, ose tunele) ose enkriptim selektiv (p\u00ebr shembull, sipas numrit t\u00eb protokollit ose VLAN). N\u00ebse adresat rrjetore (MAC, IP, VLAN ID) p\u00ebrdoren si \u00e7el\u00ebsa n\u00eb nj\u00eb tabel\u00eb, numri i rreshtave t\u00eb cil\u00ebs i n\u00ebnshtrohet kufizimeve, at\u00ebher\u00eb k\u00ebto kufizime b\u00ebhen evidente.<\/p>\n
P\u00ebr m\u00eb tep\u00ebr, rrjetet e m\u00ebdha shpesh kan\u00eb disa nivele strukturore, duke p\u00ebrfshir\u00eb nj\u00eb rrjet mb\u00ebshtet\u00ebs, \u00e7do nj\u00eb nga t\u00eb cilat implementon skem\u00ebn e saj t\u00eb adresimit dhe politik\u00ebn e saj t\u00eb routing-ut. P\u00ebr t\u00eb zbatuar nj\u00eb qasje t\u00eb till\u00eb, shpesh p\u00ebrdoren formate t\u00eb ve\u00e7anta t\u00eb kadrove (si Q-in-Q ose MAC-in-MAC) dhe protokolle rutimi. P\u00ebr t\u00eb mos penguar nd\u00ebrtimin e till\u00eb t\u00eb rrjetit, pajisjet e enkriptimit duhet t\u00eb p\u00ebrballen qart\u00eb me k\u00ebto kadra (dometh\u00ebn\u00eb, n\u00eb k\u00ebt\u00eb kuptim, shkall\u00ebzimi do t\u00eb thot\u00eb kompatibilitet \u2013 p\u00ebr t\u00eb cilin do t\u00eb flasim m\u00eb posht\u00eb).<\/p>\n
Fleksibiliteti<\/h4>\n \nK\u00ebtu b\u00ebhet fjal\u00eb p\u00ebr mb\u00ebshtetje t\u00eb konfiguracioneve t\u00eb ndryshme, skemave t\u00eb lidhjes, topologjive dhe m\u00eb shum\u00eb. P\u00ebr shembull, p\u00ebr rrjetet e kaluar me teknologjit\u00eb Carrier Ethernet, kjo do t\u00eb thot\u00eb mb\u00ebshtetje p\u00ebr lloje t\u00eb ndryshme t\u00eb lidhjeve virtuale (E-Line, E-LAN, E-Tree), lloje t\u00eb ndryshme sh\u00ebrbimesh (si p\u00ebr portet ashtu edhe p\u00ebr VLAN) dhe teknologji t\u00eb ndryshme transporti (t\u00eb cilat jan\u00eb p\u00ebrmendur m\u00eb lart). Dometh\u00ebn\u00eb, pajisja duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb punoj\u00eb si n\u00eb modin linear (<\/p>\n
Po ashtu \u00ebsht\u00eb i r\u00ebnd\u00ebsish\u00ebm mb\u00ebshtetja e rrjeteve private, pajisjet e t\u00eb cilave i p\u00ebrkasin nj\u00eb organizate (ose jan\u00eb sip\u00ebrmarr\u00ebse nga ajo), dhe ato operatorike, segmentet e t\u00eb cilave jan\u00eb n\u00ebn menaxhimin e kompanive t\u00eb ndryshme. \u00cbsht\u00eb mir\u00eb n\u00ebse zgjidhja lejon menaxhimin si nga forcat e veta, ashtu edhe nga nj\u00eb organizat\u00eb e tret\u00eb (n\u00eb modelin e sh\u00ebrbimit t\u00eb menaxhuar). N\u00eb rrjetet operatorike, nj\u00eb funksion tjet\u00ebr i r\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb mb\u00ebshtetja e multi-tenant\u00ebs (p\u00ebrdorimi i p\u00ebrbashk\u00ebt nga klient\u00eb t\u00eb ndrysh\u00ebm) n\u00eb form\u00ebn e izolimit kriptografik t\u00eb klient\u00ebve t\u00eb ve\u00e7ant\u00eb (abonent\u00ebve), t\u00eb cil\u00ebt kan\u00eb trafikun e tyre q\u00eb kalon p\u00ebrmes nj\u00eb grupi t\u00eb nj\u00ebjt\u00eb pajisjesh p\u00ebr kriptim. N\u00eb p\u00ebrgjith\u00ebsi, kjo k\u00ebrkon p\u00ebrdorimin e grupeve t\u00eb ve\u00e7anta t\u00eb \u00e7el\u00ebsave dhe certifikat\u00ebve p\u00ebr \u00e7do klient.<\/p>\n
N\u00ebse pajisja blihet p\u00ebr nj\u00eb skenar t\u00eb caktuar, at\u00ebher\u00eb t\u00eb gjitha k\u00ebto mund\u00ebsi mund dhe t\u00eb mos jen\u00eb shum\u00eb t\u00eb r\u00ebnd\u00ebsishme \u2013 duhet vet\u00ebm t\u00eb sigurohemi q\u00eb pajisja mb\u00ebshtet at\u00eb q\u00eb nevojitet tani. Por n\u00ebse zgjidhja blihet \"n\u00eb rritje\", p\u00ebr t\u00eb mb\u00ebshtetur gjithashtu skenar\u00ebt e ardhsh\u00ebm, dhe zgjidhet si \"standard korporate\", at\u00ebher\u00eb fleksibiliteti nuk do t\u00eb ishte i tep\u00ebrt \u2013 ve\u00e7an\u00ebrisht duke marr\u00eb parasysh kufizimet e nd\u00ebrveprueshm\u00ebris\u00eb s\u00eb pajisjeve nga ofrues t\u00eb ndrysh\u00ebm (p\u00ebr k\u00ebt\u00eb pak m\u00eb posht\u00eb).<\/p>\n
Thjesht\u00ebsia dhe komforti<\/h4>\n \nK\u00ebndv\u00ebshtrimi i sh\u00ebrbimit \u00ebsht\u00eb gjithashtu nj\u00eb koncept multifaktorial. N\u00eb m\u00ebnyr\u00eb t\u00eb p\u00ebraf\u00ebrt, mund t\u00eb thuhet se \u00ebsht\u00eb shuma e koh\u00ebs q\u00eb specialist\u00ebt e caktuar, me kualifikime t\u00eb ve\u00e7anta, nevojiten p\u00ebr t\u00eb mb\u00ebshtetur zgjidhjen n\u00eb faza t\u00eb ndryshme t\u00eb ciklit t\u00eb saj t\u00eb jet\u00ebs. N\u00ebse nuk ka shpenzime, dhe instalimi, konfigurimi, p\u00ebrdorimi jan\u00eb t\u00ebr\u00ebsisht automatike, at\u00ebher\u00eb shpenzimet jan\u00eb zero, dhe komoditeti \u00ebsht\u00eb absolut. Sigurisht, n\u00eb bot\u00ebn e v\u00ebrtet\u00eb nuk ndodhin gj\u00ebra t\u00eb tilla. Nj\u00eb afrim i arsyesh\u00ebm \u00ebsht\u00eb modeli \"nyje n\u00eb tel\"<\/b> (bump-in-the-wire), ose lidhje t\u00eb transparenc\u00ebs, ku shtimi dhe largimi i pajisjeve t\u00eb enkriptimit nuk k\u00ebrkon as ndryshime manuale, as automatike n\u00eb konfigurimin e rrjetit. Kjo e thjeshton mb\u00ebshtetje p\u00ebr zgjidhjen: mund t\u00eb aktivizoni ose \u00e7aktivizoni qet\u00ebsisht funksionin e enkriptimit, dhe kur \u00ebsht\u00eb e nevojshme, thjesht t\u00eb \"kallosh\" pajisjen me nj\u00eb kabllo rrjeti (dometh\u00ebn\u00eb, t\u00eb lidhni drejtp\u00ebrdrejt ato porte t\u00eb pajisjeve t\u00eb rrjetit me t\u00eb cilat ishte lidhur). Megjithat\u00eb, ka dhe nj\u00eb minus \u2013 t\u00eb nj\u00ebjt\u00ebn gj\u00eb mund ta b\u00ebj\u00eb edhe nj\u00eb shkel\u00ebs. P\u00ebr t\u00eb realizuar parimin \"nyje n\u00eb tel\" duhet t\u00eb merret parasysh trafiku jo vet\u00ebm shtresa e t\u00eb dh\u00ebnave<\/b>, por edhe shtresat e kontrollit dhe menaxhimit<\/b> \u2013 pajisjet duhet t\u00eb jen\u00eb t\u00eb p\u00ebrshtatshme p\u00ebr to. Prandaj, ky trafik mund t\u00eb enkriptohet vet\u00ebm kur n\u00eb rrjet, midis pajisjeve t\u00eb enkriptimit, nuk ka marr\u00ebs t\u00eb k\u00ebtij lloji t\u00eb trafikut, pasi n\u00ebse ai hidhet posht\u00eb ose enkriptohet, konfigurimi i rrjetit mund t\u00eb ndryshohet gjat\u00eb aktivizimit ose \u00e7aktivizimit t\u00eb enkriptimit. Pajisja e enkriptimit mund t\u00eb jet\u00eb edhe transparente p\u00ebr sinjalizimin n\u00eb nivelin fizik. N\u00eb ve\u00e7anti, n\u00eb rastin e humbjes s\u00eb sinjalit, ajo duhet t\u00eb transmetoj\u00eb k\u00ebt\u00eb humbje (dometh\u00ebn\u00eb t\u00eb \u00e7aktivizoj\u00eb transmetuesit e saj) mbrapa dhe p\u00ebrpara (\"p\u00ebr vete\") drejt sinjalit.<\/p>\n
Po ashtu, e r\u00ebnd\u00ebsishme \u00ebsht\u00eb mb\u00ebshtetja n\u00eb ndarjen e pushteteve mes departamenteve t\u00eb Siguris\u00eb s\u00eb Informacionit dhe IT-s\u00eb, ve\u00e7an\u00ebrisht departamentit t\u00eb rrjetit. Zgjidhja p\u00ebr enkriptimin duhet t\u00eb mb\u00ebshtes\u00eb modelin e menaxhimit t\u00eb qasjes dhe auditimit t\u00eb pranuar n\u00eb organizat\u00eb. Duhet t\u00eb minimalizohet nevoja p\u00ebr nd\u00ebrveprime midis departamenteve t\u00eb ndryshme p\u00ebr t\u00eb kryer operacione rutin\u00eb. K\u00ebshtu, avantazhi n\u00eb aspektin e leht\u00ebsis\u00eb \u00ebsht\u00eb te pajisjet e specializuara, q\u00eb mb\u00ebshtesin ekskluzivisht funksionet e enkriptimit dhe jan\u00eb sa m\u00eb transparente p\u00ebr operacionet e rrjetit. Thjesht, punonj\u00ebsit e sh\u00ebrbimit t\u00eb Siguris\u00eb s\u00eb Informacionit nuk duhet t\u00eb ken\u00eb arsye p\u00ebr t'u drejtuar te \"rrjetist\u00ebt\" p\u00ebr t\u00eb ndryshuar paramet\u00ebrat e rrjetit. Dhe ata, nga ana tjet\u00ebr, nuk duhet t\u00eb ken\u00eb nevoj\u00eb p\u00ebr t\u00eb ndryshuar parametrat e enkriptimit gjat\u00eb mir\u00ebmbajtjes s\u00eb rrjetit.<\/p>\n
Nj\u00eb faktor tjet\u00ebr \u00ebsht\u00eb mund\u00ebsit\u00eb dhe leht\u00ebsit\u00eb e mjeteve t\u00eb menaxhimit. Ato duhet t\u00eb jen\u00eb vizuale, logjike, t\u00eb mund\u00ebsojn\u00eb import-export t\u00eb cil\u00ebsimeve, automatizimin dhe k\u00ebshtu me radh\u00eb. Duhet menj\u00ebher\u00eb t\u00eb v\u00ebm\u00eb re se \u00e7far\u00eb opsionesh menaxhimi jan\u00eb n\u00eb dispozicion (zakonisht \u00ebsht\u00eb nj\u00eb ambient menaxhimi i vet\u00eb, nd\u00ebrfaqe web dhe linj\u00eb urdhrash) dhe me cilin grup funksionesh n\u00eb secilin prej tyre (ndodhin kufizime). Nj\u00eb funksion i r\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb mb\u00ebshtetje menaxhimit<\/b> (out-of-band), q\u00eb do t\u00eb thot\u00eb p\u00ebrmes nj\u00eb rrjete t\u00eb dedikuar p\u00ebr menaxhim, dhe menaxhimit<\/b> (in-band), q\u00eb do t\u00eb thot\u00eb p\u00ebrmes rrjetit t\u00eb p\u00ebrbashk\u00ebt, i cili transmeton trafik t\u00eb dobish\u00ebm. Mjetet e menaxhimit duhet t\u00eb sinjalizojn\u00eb p\u00ebr t\u00eb gjitha situatat jasht\u00ebzakonshme, p\u00ebrfshir\u00eb incidentet e siguris\u00eb. Operacionet rutinore, t\u00eb p\u00ebrs\u00ebritura duhet t\u00eb kryhen automatikisht. Kjo lidhet kryesisht me menaxhimin e \u00e7el\u00ebsave. Ata duhet t\u00eb gjenerohen \/ shp\u00ebrndahen automatikisht. Mb\u00ebshtetja PKI \u00ebsht\u00eb nj\u00eb avantazh i madh.<\/p>\nP\u00ebrputhshm\u00ebri<\/h4>\n
\nPra, \u00ebsht\u00eb kompatibiliteti i pajisjes me standardet rrjet\u00eb. Dhe k\u00ebtu nuk jan\u00eb vet\u00ebm standardet industriale t\u00eb pranuara nga organizata autoritative si IEEE, por edhe protokollet mark\u00eb t\u00eb lider\u00ebve t\u00eb industris\u00eb, si Cisco. Ka dy m\u00ebnyra themelore p\u00ebr t\u00eb siguruar kompatibilitetin: ose p\u00ebrmes transparenc\u00ebs<\/b>, ose p\u00ebrmes mb\u00ebshtetjes eksplicite<\/b> t\u00eb protokolleve (kur pajisja e enkriptimit b\u00ebhet p\u00ebr nj\u00eb protokoll nj\u00eb nga nyjet e rrjetit dhe p\u00ebrpunon trafik kontrolli t\u00eb k\u00ebtij protokolli). Nga plot\u00ebsia dhe sakt\u00ebsia e realizimit t\u00eb protokolleve t\u00eb kontrollit varet kompatibiliteti me rrjetet. Mb\u00ebshtetja e opsioneve t\u00eb ndryshme t\u00eb nivelit PHY \u00ebsht\u00eb e r\u00ebnd\u00ebsishme (shpejt\u00ebsit\u00eb, mjetet e transmetimit, skemat e kodimit), kornizat Ethernet t\u00eb formateve t\u00eb ndryshme me \u00e7do MTU, protokollet sh\u00ebrbimore t\u00eb L3 (ve\u00e7an\u00ebrisht familja TCP\/IP).<\/p>\n
Transparenca sigurohet p\u00ebrmes mekanizmave t\u00eb mutacionit (ndryshimi temporary i p\u00ebrmbajtjes s\u00eb titujve t\u00eb hapur n\u00eb trafik midis enkriptuesve), kalimit (kur paketa t\u00eb caktuara mbeten t\u00eb paenkriptuara) dhe t\u00ebrheqjes s\u00eb fillimit t\u00eb enkriptimit (kur fushat q\u00eb zakonisht enkriptohen nuk enkriptohen).<\/p>\n
Si sigurohet transparenca<\/i><\/p>\n
Prandaj, gjithmon\u00eb specifikoni se si sigurohet mb\u00ebshtetja p\u00ebr nj\u00eb protokoll t\u00eb caktuar. Shpesh, mb\u00ebshtetja n\u00eb nj\u00eb m\u00ebnyr\u00eb transparente \u00ebsht\u00eb m\u00eb e leht\u00eb dhe m\u00eb e sigurt.<\/p>\n
Interoperabiliteti<\/h4>\n \nKjo \u00ebsht\u00eb gjithashtu nj\u00eb form\u00eb e pajtueshm\u00ebris\u00eb, por n\u00eb nj\u00eb kuptim tjet\u00ebr, konkretisht mund\u00ebsia e bashk\u00ebpunimit me modele t\u00eb tjera t\u00eb pajisjeve t\u00eb enkriptimit, p\u00ebrfshir\u00eb ato nga prodhues t\u00eb ndrysh\u00ebm. Shum\u00eb varet nga gjendja e standardizimit t\u00eb protokolleve t\u00eb enkriptimit. Nuk ka standarde t\u00eb pranuara t\u00eb enkriptimit n\u00eb L1.<\/p>\n
P\u00ebr enkriptimin L2 n\u00eb rrjetet Ethernet ekziston standardi 802.1ae (MACsec), por ai nuk p\u00ebrdor enkriptim<\/b> (end-to-end), por enkriptim<\/b>, \"mesportor\" (hop-by-hop), dhe n\u00eb redaksin\u00eb e tij fillestare \u00ebsht\u00eb i pap\u00ebrshtatsh\u00ebm p\u00ebr tu p\u00ebrdorur n\u00eb rrjetet e shp\u00ebrndara, ndaj jan\u00eb shfaqur zgjerime t\u00eb mark\u00ebs s\u00eb tij q\u00eb e kalojn\u00eb k\u00ebt\u00eb kufizim (sigurisht, me kosto t\u00eb nd\u00ebrveprueshm\u00ebris\u00eb me pajisjet e prodhuesve t\u00eb tjer\u00eb). Megjithat\u00eb, n\u00eb vitin 2018, u shtua mb\u00ebshtetje p\u00ebr rrjetet e shp\u00ebrndara n\u00eb standardin 802.1ae, por mb\u00ebshtetje p\u00ebr setet e algoritmeve t\u00eb enkriptimit GOST ende nuk ka. Prandaj, protokollet e enkriptimit L2 t\u00eb mark\u00ebs, si rrule, zakonisht dallohen p\u00ebr efikasitetin m\u00eb t\u00eb madh (n\u00eb ve\u00e7anti, p\u00ebr shpenzime m\u00eb t\u00eb ul\u00ebta t\u00eb band\u00eb) dhe fleksibilitetin (mund\u00ebsia p\u00ebr t\u00eb ndryshuar algoritmet dhe modalitetet e enkriptimit).<\/p>\n
N\u00eb nivele m\u00eb t\u00eb larta (L3 dhe L4) ekzistojn\u00eb standarde t\u00eb pranuara, kryesisht IPsec dhe TLS, por as k\u00ebtu nuk \u00ebsht\u00eb kaq e leht\u00eb. \u00c7\u00ebshtja \u00ebsht\u00eb se secili nga k\u00ebto standarde \u00ebsht\u00eb nj\u00eb grup protokollesh, secili me versione t\u00eb ndryshme dhe zgjerime t\u00eb detyrueshme ose opsionale p\u00ebr implementim. P\u00ebr m\u00eb tep\u00ebr, disa prodhues preferojn\u00eb t\u00eb aplikojn\u00eb protokollet e tyre t\u00eb enkriptimit edhe n\u00eb L3\/L4. Prandaj, n\u00eb shumic\u00ebn e rasteve, nuk \u00ebsht\u00eb e arsyeshme t\u00eb pritet nd\u00ebrveprueshm\u00ebri e plot\u00eb, por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb t\u00eb sigurohet t\u00eb pakt\u00ebn nd\u00ebrveprimi midis modeleve t\u00eb ndryshme dhe gjeneratave t\u00eb ndryshme t\u00eb nj\u00eb prodhuesi.<\/p>\n
Besueshm\u00ebria<\/h4>\n \nP\u00ebr t\u00eb krahasuar zgjidhje t\u00eb ndryshme, mund t\u00eb p\u00ebrdoret ose koha mesatare e funksionimit para d\u00ebshtimit, ose koeficienti i gatishm\u00ebris\u00eb. N\u00ebse nuk ka k\u00ebto numra (ose fonde q\u00eb iu jepet besim), at\u00ebher\u00eb mund t\u00eb b\u00ebni nj\u00eb krahasim cil\u00ebsor. Avantazhi do t\u00eb jet\u00eb p\u00ebr pajisjet me menaxhim t\u00eb leht\u00eb (m\u00eb pak rrezik gabimesh n\u00eb konfigurim), p\u00ebr enkriptuesit e specializuar (p\u00ebr t\u00eb nj\u00ebjt\u00ebn arsye), si dhe p\u00ebr zgjidhjet me koh\u00eb minimale t\u00eb zbardhjes dhe eliminimit t\u00eb d\u00ebshtimit, p\u00ebrfshir\u00eb mjete p\u00ebr \"rezervim t\u00eb nxeht\u00eb\" t\u00eb ndodhave dhe pajisjeve n\u00eb t\u00ebr\u00ebsi.<\/p>\n
\u00c7mimi<\/h4>\n \nSa i \u00e7\u00ebshtjes s\u00eb kostove, si n\u00eb shumic\u00ebn e zgjidhjeve IT, \u00ebsht\u00eb e arsyeshme t\u00eb krahasohet shuma totale e kostos s\u00eb pron\u00ebs. P\u00ebr llogaritjen e saj, nuk \u00ebsht\u00eb e nevojshme t\u00eb shpikni rrota t\u00eb reja, por mund t\u00eb p\u00ebrdorni ndonj\u00eb metodologji t\u00eb p\u00ebrshtatshme (p\u00ebr shembull, nga Gartner) dhe \u00e7do kalkulator (p\u00ebr shembull, at\u00eb q\u00eb tashm\u00eb p\u00ebrdoret n\u00eb organizat\u00eb p\u00ebr llogaritjen e TCO). \u00cbsht\u00eb e qart\u00eb se p\u00ebr zgjidhjen e enkriptimit t\u00eb rrjetit, shuma totale e kostos s\u00eb pron\u00ebs p\u00ebrb\u00ebhet nga kostot<\/b> e drejtp\u00ebrdrejta p\u00ebr blerjen ose qiradh\u00ebnien e zgjidhjes vet\u00eb, p\u00ebr infrastruktur\u00ebn p\u00ebr vendosjen e pajisjeve dhe shpenzimet p\u00ebr implementimin, administrimin dhe mb\u00ebshtetje, qoft\u00eb me forcat e veta apo si sh\u00ebrbime t\u00eb jashtme, si dhe nga kostot<\/b> e t\u00ebrthorta nga ndalimet e zgjidhjes (t\u00eb shkaktuara nga humbja e produktivitetit t\u00eb p\u00ebrdoruesve t\u00eb fundit). Ndoshta ka vet\u00ebm nj\u00eb nuanc\u00eb. Ndikimi i performanc\u00ebs s\u00eb zgjidhjes mund t\u00eb merren n\u00eb konsiderat\u00eb n\u00eb m\u00ebnyra t\u00eb ndryshme: ose si kostot e t\u00ebrthorta, t\u00eb shkaktuara nga r\u00ebnia e produktivitetit, ose si shpenzime \"virtuale\" t\u00eb drejtp\u00ebrdrejta p\u00ebr blerjen \/ modernizimin dhe mir\u00ebmbajtjen e mjeteve rrjetore q\u00eb kompensojn\u00eb r\u00ebnien e performanc\u00ebs s\u00eb rrjetit p\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb enkriptimit. N\u00eb \u00e7do rast, shpenzimet q\u00eb jan\u00eb t\u00eb v\u00ebshtira p\u00ebr t'u llogaritur me sakt\u00ebsi t\u00eb mjaftueshme, \u00ebsht\u00eb m\u00eb mir\u00eb \"t'i nxjerrim jasht\u00eb llogaritjes\": k\u00ebshtu do t\u00eb ket\u00eb m\u00eb shum\u00eb besim n\u00eb vler\u00ebn p\u00ebrfundimtare. Dhe, si\u00e7 ndodh zakonisht, n\u00eb \u00e7do rast krahasimi i pajisjeve t\u00eb ndryshme sipas TCO ka kuptim t\u00eb b\u00ebhet p\u00ebr nj\u00eb skenar t\u00eb ve\u00e7ant\u00eb t\u00eb p\u00ebrdorimit t\u00eb tyre \u2013 real ose tipik.<\/p>\nQ\u00ebndrueshm\u00ebria<\/h4>\n
\nDhe karakteristika e fundit \u00ebsht\u00eb q\u00ebndrueshm\u00ebria e zgjidhjes. N\u00eb shumic\u00ebn e rasteve, q\u00ebndrueshm\u00ebria mund t\u00eb vler\u00ebsohet vet\u00ebm n\u00eb m\u00ebnyr\u00eb cil\u00ebsore, duke krahasuar zgjidhje t\u00eb ndryshme midis tyre. Duhet t\u00eb mbajm\u00eb mend se pajisjet e enkriptimit jan\u00eb jo vet\u00ebm mjete, por edhe objekte mbrojtjeje. Ato mund t\u00eb jen\u00eb t\u00eb ndjeshme ndaj k\u00ebrc\u00ebnimeve t\u00eb ndryshme. N\u00eb planin e par\u00eb jan\u00eb k\u00ebrc\u00ebnimet e shkeljes s\u00eb privat\u00ebsis\u00eb, riprodhimit dhe modifikimit t\u00eb mesazheve. K\u00ebto k\u00ebrc\u00ebnime mund t\u00eb realizohen p\u00ebrmes dob\u00ebsive t\u00eb enkriptimit ose t\u00eb m\u00ebnyrave t\u00eb tij t\u00eb ve\u00e7anta, p\u00ebrmes dob\u00ebsive n\u00eb protokollet e enkriptimit (duke p\u00ebrfshir\u00eb fazat e krijimit t\u00eb lidhjeve dhe prodhimin\/p\u00ebrhapjen e \u00e7el\u00ebsave). Avantazhi do t\u00eb jet\u00eb tek zgjidhjet q\u00eb lejojn\u00eb ndryshimin e algoritmit t\u00eb enkriptimit ose kalimin n\u00eb modin e enkriptimit (t\u00eb pakt\u00ebn p\u00ebrmes azhurnimit t\u00eb software-it t\u00eb integruar), tek zgjidhjet q\u00eb ofrojn\u00eb enkriptim maksimal, duke fshehur nga sulmuesit jo vet\u00ebm t\u00eb dh\u00ebnat e p\u00ebrdoruesve, por edhe informacionin adresor dhe informacionin tjet\u00ebr sh\u00ebrbimor, si dhe tek ato zgjidhje q\u00eb jo vet\u00ebm enkriptojn\u00eb, por edhe mbrojn\u00eb mesazhet nga riprodhimi dhe modifikimi. P\u00ebr t\u00eb gjith\u00eb algoritmet moderne t\u00eb enkriptimit, n\u00ebnshkrimit elektronik, krijimit t\u00eb \u00e7el\u00ebsave dhe t\u00eb tjer\u00ebve, q\u00eb jan\u00eb t\u00eb njohur n\u00eb standarde, q\u00ebndrueshm\u00ebria mund t\u00eb merret e nj\u00ebjt\u00eb (ndryshe, mund t\u00eb humbas\u00ebsh n\u00eb thell\u00ebsit\u00eb e kriptografis\u00eb). A duhet t\u00eb jen\u00eb domosdoshm\u00ebrisht algoritme GOST? K\u00ebtu \u00ebsht\u00eb e thjesht\u00eb: n\u00ebse skenari i p\u00ebrdorimit k\u00ebrkon certifikimin e FSB p\u00ebr SKZI (dhe n\u00eb Rusi kjo \u00ebsht\u00eb shpesh ashtu), p\u00ebr shumic\u00ebn e skenar\u00ebve t\u00eb enkriptimit n\u00eb rrjet \u00ebsht\u00eb k\u00ebshtu), at\u00ebher\u00eb zgjedhim vet\u00ebm midis atyre t\u00eb certifikuara. N\u00ebse jo, at\u00ebher\u00eb nuk ka asnj\u00eb kuptim t\u00eb p\u00ebrjashtohen pajisjet pa certifikata nga shqyrtimi.<\/p>\n
K\u00ebrc\u00ebnimi tjet\u00ebr \u00ebsht\u00eb k\u00ebrc\u00ebnimi i hackimit, qasja e paautorizuar n\u00eb pajisje (duke p\u00ebrfshir\u00eb aksesin fizik nga jasht\u00eb dhe brenda kutis\u00eb). K\u00ebrc\u00ebnimi mund t\u00eb realizohet p\u00ebrmes
N\u00eb fund, nj\u00eb tjet\u00ebr lloj k\u00ebrc\u00ebnimi jan\u00eb gabimet gjat\u00eb konfigurimit dhe operimit, faktori njer\u00ebzor n\u00eb form\u00ebn m\u00eb t\u00eb past\u00ebr. K\u00ebtu shfaqet nj\u00eb avantazh i tjet\u00ebr p\u00ebr enkriptuesit e specializuar n\u00eb krahasim me zgjidhjet konvergjente, t\u00eb cilat shpesh jan\u00eb t\u00eb orientuara ndaj \"rrjetar\u00ebve\" t\u00eb avancuar, dhe mund t\u00eb shkaktojn\u00eb v\u00ebshtir\u00ebsi p\u00ebr specialist\u00ebt \"e zakonsh\u00ebm\", t\u00eb gjer\u00eb n\u00eb fush\u00ebn e siguris\u00eb s\u00eb informacionit.<\/p>\n
P\u00ebrmbledhje<\/h4>\n \nN\u00eb parim, k\u00ebtu mund t\u00eb propozoni nj\u00eb tregues t\u00eb integruar p\u00ebr krahasimin e pajisjeve t\u00eb ndryshme, di\u00e7ka si<\/p>\n
$$display$$K_j=\u2211p_i r_{ij}$$display$$<\/p>\n
\nku p \u00ebsht\u00eb pesh\u00eb e treguesit dhe r \u00ebsht\u00eb rendi i pajisjes sipas k\u00ebtij treguesi, duke ndar\u00eb \u00e7do karakteristik\u00eb t\u00eb p\u00ebrmendur m\u00eb lart n\u00eb tregues \"atomar\". Kjo formul\u00eb mund t\u00eb jet\u00eb e dobishme, p\u00ebr shembull, gjat\u00eb krahasimit t\u00eb ofertave t\u00eb tender\u00ebve sipas rregullave t\u00eb parapara. Por mund t\u00eb largohemi dhe me nj\u00eb tabel\u00eb t\u00eb thjesht\u00eb si<\/p>\n
Karakteristika
Kapaciteti
+++<\/p>\n
Shpenzimet e operimit
+++<\/p>\n
Vonesa
++<\/p>\n
Shkall\u00ebzueshm\u00ebria
+++<\/p>\n
Fleksibiliteti
+<\/p>\n
Interoperabiliteti
+<\/p>\n
P\u00ebrputhshm\u00ebri
+++<\/p>\n
Thjesht\u00ebsia dhe komforti
++<\/p>\n
Q\u00ebndrueshm\u00ebri
++<\/p>\n
\u00c7mimi
+<\/p>\n
Q\u00ebndrueshm\u00ebria
+++<\/p>\n
\nDo t\u00eb isha i lumtur t\u00eb p\u00ebrgjigjem n\u00eb pyetje dhe n\u00eb v\u00ebrejtjet kritike konstruktive.habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u042d\u0442\u043e\u0442 \u043e\u0431\u0437\u043e\u0440 (\u0438\u043b\u0438, \u0435\u0441\u043b\u0438 \u0445\u043e\u0442\u0438\u0442\u0435, \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f) \u044f \u043d\u0430\u043f\u0438\u0441\u0430\u043b, \u043a\u043e\u0433\u0434\u0430 \u043c\u043d\u0435 \u043f\u043e\u0440\u0443\u0447\u0438\u043b\u0438 \u0441\u0440\u0430\u0432\u043d\u0438\u0442\u044c \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435 \u044d\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u043b\u0438 \u043a \u0440\u0430\u0437\u043d\u044b\u043c \u043a\u043b\u0430\u0441\u0441\u0430\u043c. \u041f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u0445 \u0432\u0441\u0435\u0445 \u044d\u0442\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0442\u00bb \u0434\u043b\u044f \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f. \u042f \u0431\u0443\u0434\u0443 \u0440\u0430\u0434, \u0435\u0441\u043b\u0438 \u043c\u043e\u0439 \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u043a\u043e\u043c\u0443-\u0442\u043e: \u0420\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52834","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t