VPN<\/a> ose pa t\u00eb.<\/p>\nEnkriptimi rrjetor n\u00eb nj\u00eb rrjet t\u00eb shp\u00ebrndar\u00eb Ethernet<\/i><\/p>\n
Pajisjet p\u00ebrkat\u00ebse mund t\u00eb jen\u00eb ose t\u00eb specializuara<\/b> (t\u00eb dizajnuar vet\u00ebm p\u00ebr enkriptim), ose multifunksionale (hibrid\u00eb, konvergjente<\/b>), dmth q\u00eb kryejn\u00eb gjithashtu funksione t\u00eb tjera (p.sh. p\u00ebrcaktuesi i rrjetit ose rrugulluesi). Furnizues t\u00eb ndrysh\u00ebm klasifikojn\u00eb pajisjet e tyre n\u00eb disa klasa\/kategorit\u00eb, por kjo nuk ka r\u00ebnd\u00ebsi \u2013 e r\u00ebnd\u00ebsishme \u00ebsht\u00eb n\u00ebse ato mund t\u00eb enkriptojn\u00eb trafikun nd\u00ebrmjet vendeve dhe cilat karakteristika kan\u00eb gjat\u00eb procesit.<\/p>\n
P\u00ebr \u00e7do rast, t\u00eb kujtoj se 'enkriptimi rrjetor', 'enkriptimi i trafikut', 'enkriptuesi' \u2013 jan\u00eb terma joformal\u00eb, megjithat\u00eb shpesh p\u00ebrdoren. N\u00eb aktet normative-ligjore ruse (p\u00ebrfshir\u00eb ato, me t\u00eb cilat futen GOST-et) p\u00ebr t\u00eb, ndoshta nuk do t'i takosh.<\/p>\n
Nivelet e enkriptimit dhe modet e transmetimit<\/h4>\n \nPara se p\u00ebrshkruhen karakteristikat q\u00eb do t\u00eb p\u00ebrdoren p\u00ebr vler\u00ebsim, \u00ebsht\u00eb e nevojshme t\u00eb kuptojm\u00eb nj\u00eb gj\u00eb t\u00eb r\u00ebnd\u00ebsishme, at\u00ebher\u00eb \"niveli i enkriptimit\". Kam v\u00ebn\u00eb re se shpesh p\u00ebrmendet si n\u00eb dokumentet zyrtare t\u00eb ofruesve (n\u00eb p\u00ebrshkrime, udh\u00ebzime, etj.), ashtu edhe n\u00eb diskutimet informale (n\u00eb negociata, n\u00eb trajnime). Pra, duket se t\u00eb gjith\u00eb e din\u00eb p\u00ebr \u00e7far\u00eb b\u00ebhet fjal\u00eb, por personalisht kam qen\u00eb d\u00ebshmitar i disa ngat\u00ebrrimeve.<\/p>\n
Pra, \u00e7far\u00eb \u00ebsht\u00eb \"niveli i enkriptimit\"? \u00cbsht\u00eb e qart\u00eb se flitet p\u00ebr numrin e nivelit t\u00eb modelit referues t\u00eb rrjetit OSI\/ISO, n\u00eb t\u00eb cilin ndodh enkriptimi. Le t\u00eb lexojm\u00eb GOST R ISO 7498-2\u201399 \"Teknologjia e informacionit. Nd\u00ebrveprimi i sistemeve t\u00eb hapura. Modeli baz\u00eb referues. Pjesa 2. Arkitektura e mbrojtjes s\u00eb informacionit\". Nga ky dokument mund t\u00eb kuptohet se niveli i sh\u00ebrbimit t\u00eb konfidencialitetit (nj\u00eb nga mekanizmat e sigurimit t\u00eb cilit \u00ebsht\u00eb enkriptimi) \u00ebsht\u00eb niveli i protokollit, blloku sh\u00ebrbim t\u00eb t\u00eb dh\u00ebnave (\"ngarkesa e dobishme\", t\u00eb dh\u00ebnat e p\u00ebrdoruesit) t\u00eb cilit enkriptohet. Si\u00e7 shkruhet gjithashtu n\u00eb standard, sh\u00ebrbimi mund t\u00eb sigurohet si n\u00eb k\u00ebt\u00eb nivel, \"me forcat e tij\", ashtu edhe me ndihm\u00ebn e nivelit t\u00eb posht\u00ebm (pik\u00ebrisht k\u00ebshtu, p\u00ebr shembull, zakonisht realizohet n\u00eb MACsec).<\/p>\n
N\u00eb praktik\u00eb, ka dy moda t\u00eb transmetimit t\u00eb informacionit t\u00eb enkriptuar p\u00ebrmes rrjetit (menj\u00ebher\u00eb m\u00eb vjen n\u00eb mendje IPsec, por k\u00ebto moda ndodhin dhe n\u00eb protokole t\u00eb tjera). N\u00eb modin transportues<\/b> (ndonj\u00ebher\u00eb quhet edhe native) enkriptohet vet\u00ebm blloku sh\u00ebrbim<\/b> i t\u00eb dh\u00ebnave, nd\u00ebrsa kokat mbeten \"t\u00eb hapura\", t\u00eb paenkriptuara (ndonj\u00ebher\u00eb shtohen fusha shtes\u00eb me informacion sh\u00ebrbimi t\u00eb algoritmit t\u00eb enkriptimit, nd\u00ebrsa fusha t\u00eb tjera modifikohen, rip\u00ebrllogarithen). N\u00eb modin tunel<\/b> nd\u00ebrsa e gjith\u00eb blloku protokoll<\/b> (dmth. paketa e vet) enkriptohet dhe inkapsulohet n\u00eb bllokun sh\u00ebrbim t\u00eb t\u00eb dh\u00ebnave t\u00eb t\u00eb nj\u00ebjtit ose nivel m\u00eb t\u00eb lart\u00eb, dmth. rrethsohet me kok\u00eb t\u00eb reja.<\/p>\n
Niveli i enkriptimit vet\u00eb, n\u00eb kombinim me nj\u00eb mod t\u00eb transmetimit, nuk \u00ebsht\u00eb as i mir\u00eb, as i keq, k\u00ebshtu q\u00eb nuk mund t\u00eb themi, p\u00ebr shembull, se L3 n\u00eb modin transportues \u00ebsht\u00eb m\u00eb i mir\u00eb se L2 n\u00eb modin tunel. Thjesht nga ata varen shum\u00eb karakteristika, me t\u00eb cilat vler\u00ebsohen pajisjet. P\u00ebr shembull, fleksibiliteti dhe kompatibiliteti. P\u00ebr t\u00eb funksionuar n\u00eb rrjetin L1 (rikthimi i fluxit t\u00eb bit\u00ebve), L2 (kalimi i kuadrove) dhe L3 (rrug\u00ebzimi i paketave) n\u00eb modin transportues nevojiten zgjidhje q\u00eb enkriptojn\u00eb n\u00eb t\u00eb nj\u00ebjtin ose n\u00eb nj\u00eb nivel m\u00eb t\u00eb lart\u00eb (ndryshe do t\u00eb enkriptohet informacioni adresues dhe t\u00eb dh\u00ebnat nuk do t\u00eb arrijn\u00eb n\u00eb destinacion), nd\u00ebrsa modin tunel lejon t\u00eb tejkalosh k\u00ebt\u00eb kufizim (n\u00eb t\u00eb v\u00ebrtet\u00eb, duke sakrifikuar disa karakteristika t\u00eb tjera t\u00eb r\u00ebnd\u00ebsishme).<\/p>\n
Modi transportues dhe tunel i enkriptimit L2<\/i><\/p>\n
Tani t\u00eb kalojm\u00eb n\u00eb shqyrtimin e karakteristikave.<\/p>\n
Performanca<\/h4>\n \nP\u00ebr kriptimin rrjetor, performanca \u00ebsht\u00eb nj\u00eb koncept kompleks dhe shum\u00ebdimensionale. Ka raste kur nj\u00eb model i caktuar, duke e kaluar n\u00eb nj\u00eb karakteristik\u00eb t\u00eb performanc\u00ebs, p\u00ebrfundon se \u00ebsht\u00eb m\u00eb i dob\u00ebt n\u00eb nj\u00eb tjet\u00ebr. Prandaj, \u00ebsht\u00eb gjithmon\u00eb e dobishme t\u00eb shqyrtohen t\u00eb gjitha komponent\u00ebt e performanc\u00ebs s\u00eb kriptimit dhe ndikimi i tyre n\u00eb performanc\u00ebn e rrjetit dhe aplikacioneve q\u00eb e p\u00ebrdorin at\u00eb. K\u00ebtu mund t\u00eb b\u00ebjm\u00eb nj\u00eb analogji me nj\u00eb makin\u00eb, p\u00ebr t\u00eb cil\u00ebn nuk \u00ebsht\u00eb vet\u00ebm e r\u00ebnd\u00ebsishme shpejt\u00ebsia maksimale, por edhe koha e akselerimit deri n\u00eb \"qind\" dhe konsumi i karburantit, etj. Karakteristikave t\u00eb performanc\u00ebs, prodhuesit dhe klient\u00ebt e mundsh\u00ebm u kushtojn\u00eb shum\u00eb r\u00ebnd\u00ebsi. Zakonisht, renditja n\u00eb linjat e pajisjeve t\u00eb kriptimit bazohet n\u00eb performanc\u00eb.<\/p>\n
\u00cbsht\u00eb e qart\u00eb se performanca varet si nga kompleksiteti i operacioneve rrjetore dhe kriptografike q\u00eb kryhen n\u00eb pajisje (duke p\u00ebrfshir\u00eb edhe sa mir\u00eb k\u00ebto detyra mund t\u00eb paralelizohen dhe t\u00eb konvejojn\u00eb), ashtu edhe nga performanca e pajisjeve dhe cil\u00ebsia e softuerit t\u00eb integruar. Prandaj, n\u00eb modelet e larta p\u00ebrdoren pajisje m\u00eb t\u00eb avancuara, ndonj\u00ebher\u00eb ka mund\u00ebsi p\u00ebr t'i pajisur ato me procesor\u00eb dhe module memorjeje shtes\u00eb. Ka disa afroa p\u00ebr implementimin e funksioneve kriptografike: n\u00eb nj\u00eb procesor qendror universale (CPU), nj\u00eb qark t\u00eb integruar t\u00eb personalizuar (ASIC) ose n\u00eb nj\u00eb qark t\u00eb integruar t\u00eb programuesh\u00ebm (FPGA). \u00c7do qasje ka avantazhet dhe disavantazhet e veta. P\u00ebr shembull, CPU mund t\u00eb b\u00ebhet \"gryk\u00eb shishe\" p\u00ebr kriptimin, sidomos n\u00ebse procesori nuk ka instruksione t\u00eb specializuara p\u00ebr t\u00eb mb\u00ebshtetur algoritmin e kriptimit (apo n\u00ebse ato nuk p\u00ebrdoren). Qarku t\u00eb integruar t\u00eb specializuar ndonj\u00ebher\u00eb i mungon fleksibiliteti; \"rikodimi\" i tyre p\u00ebr t\u00eb rritur performanc\u00ebn, p\u00ebr t\u00eb shtuar funksione t\u00eb reja, ose p\u00ebr t\u00eb eliminuar dob\u00ebsit\u00eb nuk \u00ebsht\u00eb gjithmon\u00eb i mundur. P\u00ebrve\u00e7 k\u00ebsaj, \u00ebsht\u00eb e kostoja vet\u00ebm p\u00ebr sasi t\u00eb m\u00ebdha prodhimi. Kjo \u00ebsht\u00eb arsyeja pse \"mesatarja e art\u00eb\" \u00ebsht\u00eb b\u00ebr\u00eb kaq popullore \u2013 p\u00ebrdorimi i FPGA (n\u00eb rusisht PLIS). Pik\u00ebrisht n\u00eb PLIS jan\u00eb realizuar t\u00eb ashtuquajturit kriptoakselerator\u00eb \u2013 module t\u00eb specializuara hardueri t\u00eb mb\u00ebshtetjes p\u00ebr operacione kriptografike, t\u00eb integruara ose t\u00eb lidhura.<\/p>\n
Duke pasur parasysh se b\u00ebhet fjal\u00eb p\u00ebr rrjetin<\/b> n\u00eb enkriptim, \u00ebsht\u00eb logjike q\u00eb performanca e zgjidhjeve duhet t\u00eb matet n\u00eb t\u00eb nj\u00ebjt\u00ebn shif\u00ebr si p\u00ebr pajisjet e tjera t\u00eb rrjetit \u2013 kapacitetin, p\u00ebrqindjen e humbjes s\u00eb frame-ve dhe vones\u00ebn. K\u00ebto parametra jan\u00eb t\u00eb p\u00ebrcaktuar n\u00eb RFC 1242. P\u00ebrve\u00e7 k\u00ebsaj, p\u00ebr variacionin e p\u00ebrmendur shpesh t\u00eb vones\u00ebs (jitter) n\u00eb k\u00ebt\u00eb RFC nuk \u00ebsht\u00eb shkruar asgj\u00eb. Si t\u00eb masim k\u00ebto parametra? Nuk kam gjetur ndonj\u00eb metodologji t\u00eb miratuar n\u00eb ndonj\u00eb standard (zyrtar ose jozyrtar, si RFC) t\u00eb posa\u00e7\u00ebm p\u00ebr enkriptimin n\u00eb rrjet. Do t\u00eb ishte logjike t\u00eb p\u00ebrdoret metodologjia p\u00ebr pajisjet e rrjetit, e cila \u00ebsht\u00eb e p\u00ebrcaktuar n\u00eb standardin RFC 2544. Shum\u00eb furnizues e ndjekin at\u00eb \u2013 shum\u00eb, por jo t\u00eb gjith\u00eb. P\u00ebr shembull, ata d\u00ebrgojn\u00eb trafik testimi vet\u00ebm n\u00eb nj\u00eb drejtim n\u00eb vend q\u00eb n\u00eb t\u00eb dyja, si konsiderohet<\/b> standardi. Mir\u00eb, le t\u00eb shohim.<\/p>\n
Matja e performanc\u00ebs s\u00eb pajisjeve t\u00eb enkriptimit n\u00eb rrjet megjithat\u00eb ka disa ve\u00e7ori. S\u00eb pari, \u00ebsht\u00eb e sakt\u00eb t\u00eb b\u00ebhen t\u00eb gjitha matjet p\u00ebr nj\u00eb \u00e7ift pajisjesh: ndon\u00ebse algoritmet e enkriptimit jan\u00eb simetrike, vonesat dhe humbjet e paketeve gjat\u00eb enkriptimit dhe dekriptimit nuk do t\u00eb jen\u00eb domosdoshm\u00ebrisht t\u00eb barabarta. S\u00eb dyti, ka kuptim t\u00eb matim sakt\u00ebsisht dyt\u00ebn, ndikimin e enkriptimit ne rrjet n\u00eb performanc\u00ebn p\u00ebrfundimtare t\u00eb rrjetit, duke krahasuar dy konfiguracione: pa pajisjet e enkriptimit dhe me to. Ose, si n\u00eb rastin e pajisjeve hibride q\u00eb kombinojn\u00eb disa funksione p\u00ebrve\u00e7 enkriptimit rrjet, me enkriptimin t\u00eb \u00e7aktivizuar dhe t\u00eb aktivizuar. Ky ndikim mund t\u00eb jet\u00eb i ndrysh\u00ebm dhe t\u00eb varet nga skema e lidhjes s\u00eb pajisjeve t\u00eb enkriptimit, nga modet e pun\u00ebs, p\u00ebrfundimisht nga karakteri i trafikut. N\u00eb ve\u00e7anti, shum\u00eb parametra t\u00eb performanc\u00ebs varen nga gjat\u00ebsia e paketave, prandaj p\u00ebr krahasimin e performanc\u00ebs s\u00eb zgjidhjeve t\u00eb ndryshme shpesh p\u00ebrdoren grafik\u00ebt e var\u00ebsis\u00eb s\u00eb k\u00ebtyre parametrave nga gjat\u00ebsia e paketave, ose p\u00ebrdorim IMIX \u2013 shp\u00ebrndarjen e trafikut sipas gjat\u00ebsive t\u00eb paketave, q\u00eb pasqyron n\u00eb m\u00ebnyr\u00eb t\u00eb p\u00ebraf\u00ebrt realitetin. N\u00ebse marrim p\u00ebr krahasim t\u00eb nj\u00ebjt\u00ebn konfiguracion baz\u00eb pa enkriptim, at\u00ebher\u00eb mund t\u00eb krahasojm\u00eb zgjidhjet p\u00ebr enkriptimin n\u00eb rrjet, t\u00eb implementuara n\u00eb m\u00ebnyra t\u00eb ndryshme, pa u p\u00ebrfshir\u00eb n\u00eb k\u00ebto dallime: L2 me L3, \"ruaj dhe d\u00ebrgo\" me \"prerje\", t\u00eb specializuara me ato konvergente, GOST me AES dhe k\u00ebshtu me radh\u00eb.<\/p>\n
Skema e lidhjes p\u00ebr testimin e performanc\u00ebs<\/i><\/p>\n
Karakteristika e par\u00eb q\u00eb t\u00ebrheq v\u00ebmendjen \u00ebsht\u00eb \"shpejt\u00ebsia\" e pajisjes s\u00eb enkriptimit, pra kapaciteti<\/b> (bandwidth) i interfeceteve t\u00eb saj rrjet, shpejt\u00ebsia e rrjedh\u00ebs s\u00eb bit\u00ebve. Ajo p\u00ebrcaktohet nga standardet rrjetore q\u00eb mbahen nga interfecetet. P\u00ebr Ethernet, numrat e zakonsh\u00ebm jan\u00eb 1 Gbit\/s dhe 10 Gbit\/s. Por, si\u00e7 e dim\u00eb, n\u00eb \u00e7do rrjet, kapaciteti maksimal teorik i transmetimit<\/b> (throughput) n\u00eb \u00e7do nivel t\u00eb saj gjithmon\u00eb \u00ebsht\u00eb m\u00eb i ul\u00ebt se lart\u00ebsia e kanaleve: pjesa e lart\u00ebsis\u00eb \"hahet\" nga intervalet nd\u00ebrframe, titujt sh\u00ebrbim etj. N\u00ebse pajisja \u00ebsht\u00eb n\u00eb gjendje t\u00eb pranoj\u00eb, p\u00ebrpunoj\u00eb (n\u00eb rastin ton\u00eb, t\u00eb kodoj\u00eb ose t\u00eb dekodoj\u00eb) dhe t\u00eb transmetoj\u00eb trafikun me shpejt\u00ebsi t\u00eb plot\u00eb, pra me kapacitetin maksimal teorik p\u00ebr k\u00ebt\u00eb nivel t\u00eb modelit t\u00eb rrjetit, at\u00ebher\u00eb thuhet se ajo punon me shpejt\u00ebsin\u00eb e linj\u00ebs<\/b>. P\u00ebr k\u00ebt\u00eb duhet q\u00eb pajisja t\u00eb mos humbas\u00eb, t\u00eb mos heq\u00eb paketa, pavar\u00ebsisht nga madh\u00ebsia e tyre dhe frekuenca e ndjekjes s\u00eb tyre. N\u00ebse pajisja e enkriptimit nuk mb\u00ebshtet pun\u00ebn me shpejt\u00ebsin\u00eb e linj\u00ebs, at\u00ebher\u00eb zakonisht tregohet kapaciteti i saj maksimal n\u00eb t\u00eb nj\u00ebjt\u00ebn gigabit\u00eb n\u00eb sekond\u00eb (ndonj\u00ebher\u00eb duke p\u00ebrcaktuar gjat\u00ebsi paketash \u2013 sa m\u00eb t\u00eb vogla t\u00eb jen\u00eb paketat, aq m\u00eb shpesh \u00ebsht\u00eb zakonisht kapaciteti). \u00cbsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se kapaciteti maksimal \u00ebsht\u00eb maksimal pa humbje<\/b> (edhe n\u00ebse pajisja mund t\u00eb \"kaloj\u00eb\" trafikun p\u00ebrmes saj me shpejt\u00ebsi m\u00eb t\u00eb madhe, por duke humbur disa paketa). P\u00ebr m\u00eb tep\u00ebr, duhet t\u00eb kushtohet v\u00ebmendje q\u00eb disa furnizues matnin kapacitetin e p\u00ebrgjithsh\u00ebm midis t\u00eb gjith\u00eb \u00e7ifteve t\u00eb porteve, k\u00ebshtu q\u00eb k\u00ebto numra pak thon\u00eb, n\u00ebse t\u00eb gjith\u00eb trafiku i enkriptuar kalon p\u00ebrmes nj\u00eb porte t\u00eb vetme.<\/p>\n
Kurse ku \u00ebsht\u00eb ve\u00e7an\u00ebrisht e r\u00ebnd\u00ebsishme t\u00eb punosh me shpejt\u00ebsin\u00eb e linj\u00ebs (ose, ndryshe, pa humbje paketash)? N\u00eb kanale me kapacitet t\u00eb lart\u00eb dhe vonesa t\u00eb m\u00ebdha (p\u00ebr shembull, satelitore), ku p\u00ebr t\u00eb mbajtur shpejt\u00ebsin\u00eb e lart\u00eb t\u00eb transmetimit duhet t\u00eb vendos\u00ebsh nj\u00eb madh\u00ebsi t\u00eb madhe t\u00eb dritares TCP, dhe ku humbjet e paketave ndjesh\u00ebm ulin performanc\u00ebn e rrjetit.<\/p>\n
Por jo gjith\u00eb kapaciteti p\u00ebrdoret p\u00ebr t\u00eb transmetuar t\u00eb dh\u00ebna t\u00eb dobishme. Duhet t\u00eb merret parasysh e ashtuquajtura shpenzime<\/b> kapaciteti i (ngarkesave) kalon. Ky \u00ebsht\u00eb nj\u00eb pjes\u00eb e kapacitetit t\u00eb pajisjes s\u00eb enkriptimit (n\u00eb p\u00ebrqindje ose n\u00eb byte p\u00ebr paket\u00eb), e cila n\u00eb t\u00eb v\u00ebrtet\u00eb humbet (nuk mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb transferuar t\u00eb dh\u00ebna aplikacionesh). Ngarkesat shfaqen, s\u00eb pari, p\u00ebr shkak t\u00eb rritjes s\u00eb madh\u00ebsis\u00eb (shtesave, 'mbushjes') s\u00eb fush\u00ebs s\u00eb t\u00eb dh\u00ebnave n\u00eb paketat e rrjetit t\u00eb enkriptuara (varet nga algoritmi i enkriptimit dhe m\u00ebnyra e tij e funksionimit). S\u00eb dyti, p\u00ebr shkak t\u00eb rritjes s\u00eb gjat\u00ebsi t\u00eb kapitujve t\u00eb paketes (modi tunel, shtes\u00eb sh\u00ebrbimi t\u00eb protokollit t\u00eb enkriptimit, imitoshtes\u00eb etj., n\u00eb var\u00ebsi t\u00eb protokollit dhe m\u00ebnyr\u00ebs s\u00eb funksionimit t\u00eb enkriptimit dhe m\u00ebnyr\u00ebs s\u00eb transmetimit) \u2013 zakonisht, k\u00ebto kostot jan\u00eb m\u00eb t\u00eb dukshme dhe mbi to p\u00ebrqendrohen v\u00ebmendja kryesore. S\u00eb treti, p\u00ebr shkak t\u00eb fragmentimit t\u00eb paketeve kur tejkalon madh\u00ebsin\u00eb maksimale t\u00eb bllokut t\u00eb t\u00eb dh\u00ebnave (MTU) (n\u00ebse rrjeti \u00ebsht\u00eb n\u00eb gjendje t\u00eb ndan\u00eb paket\u00ebn e tep\u00ebrt MTU n\u00eb dy, duke dyfishuar kapitujt e saj). S\u00eb kat\u00ebrti, p\u00ebr shkak t\u00eb shfaqjes n\u00eb rrjet t\u00eb trafikut shtes\u00eb sh\u00ebrbimi (kontroll) midis pajisjeve t\u00eb enkriptimit (p\u00ebr shk\u00ebmbimin e \u00e7el\u00ebsave, vendosjen e tunel\u00ebve etj.). Ngarkesat e ulta jan\u00eb t\u00eb r\u00ebnd\u00ebsishme aty ku kapaciteti i kanalit \u00ebsht\u00eb i kufizuar. Kjo shfaqet ve\u00e7an\u00ebrisht n\u00eb trafikun e paketave t\u00eb vogla, p\u00ebr shembull, vokal \u2013 aty ngarkesat mund t\u00eb 'han\u00eb' m\u00eb shum\u00eb se gjysm\u00ebn e shpejt\u00ebsis\u00eb s\u00eb kanalit!<\/p>\n
Kapaciteti i Kalimit<\/i><\/p>\n
S\u00eb fundi, ka edhe von\u00ebn\u00eb e propozuar<\/b> \u2013 dallimi (n\u00eb pjes\u00eb t\u00eb sekond\u00ebs) i vones\u00ebs rrjetore (koha e kalimit t\u00eb t\u00eb dh\u00ebnave nga hyrja n\u00eb rrjet deri n\u00eb daljen e saj) midis transmetimit t\u00eb t\u00eb dh\u00ebnave pa enkriptim rrjeti dhe me t\u00eb. N\u00eb p\u00ebrgjith\u00ebsi, sa m\u00eb e vog\u00ebl t\u00eb jet\u00eb vonesa (\u201clatenca\u201d) e rrjetit, aq m\u00eb kritik b\u00ebhet vonesa e sjell\u00eb nga pajisjet e enkriptimit. Vonesa e sjell\u00eb vjen nga vet\u00eb operacioni i enkriptimit (varet nga algoritmi i enkriptimit, gjat\u00ebsia e bllokut dhe modeli i funksionimit t\u00eb enkriptimit, si dhe nga cil\u00ebsia e implementimit t\u00eb tij n\u00eb softuer), si dhe procesimi i paket\u00ebs rrjetore n\u00eb pajisje. Vonesa e sjell\u00eb varet si nga modeli i p\u00ebrpunimit t\u00eb paketave (p\u00ebrmes ose \u201cruaje-dhe-transmeto\u201d), ashtu dhe nga performanca e platform\u00ebs (implementimi \u201charduerik\u201d n\u00eb FPGA ose ASIC, zakonisht \u00ebsht\u00eb m\u00eb i shpejt\u00eb se \u201csoftuerik\u201d n\u00eb CPU). Enkriptimi L2 pothuajse gjithmon\u00eb dallon me vones\u00eb m\u00eb t\u00eb vog\u00ebl krahasuar me enkriptimin n\u00eb L3 ose L4: kjo ndikon nga fakti se pajisjet q\u00eb enkriptojn\u00eb n\u00eb L3\/L4 shpesh funksionojn\u00eb si konvergjente. P\u00ebr shembull, n\u00eb enkriptuesit e shpejt\u00eb Ethernet, t\u00eb implementuar n\u00eb FPGA dhe q\u00eb enkriptojn\u00eb n\u00eb L2, vonesa p\u00ebr shkak t\u00eb operacionit t\u00eb enkriptimit \u00ebsht\u00eb pothuajse e pap\u00ebrfillshme \u2013 ndonj\u00ebher\u00eb, kur aktivizohet enkriptimi n\u00eb nj\u00eb \u00e7ift pajisjesh, vonesa totale e sjell\u00eb prej tyre madje zvog\u00eblohet! Vonesa e vog\u00ebl \u00ebsht\u00eb e r\u00ebnd\u00ebsishme atje ku p\u00ebrputhet me vonesat totale n\u00eb kanal, duke p\u00ebrfshir\u00eb vones\u00ebn e p\u00ebrhapjes s\u00eb sinjalit, e cila \u00ebsht\u00eb rreth 5 \u03bcs p\u00ebr kilometrin. Pra, mund t\u00eb thuhet se p\u00ebr rrjetet e shkall\u00ebs qytetare (disa dhjet\u00ebra kilometra n\u00eb diamet\u00ebr) mikrosekondat mund t\u00eb vendosin shum\u00eb. P\u00ebr shembull, p\u00ebr riprodhimin sinhron t\u00eb bazave t\u00eb t\u00eb dh\u00ebnave, tregtin\u00eb me frekuenc\u00eb t\u00eb lart\u00eb, po ashtu dhe blockchain-in.<\/p>\n
Vonesa e sjell\u00eb<\/i><\/p>\nShkall\u00ebzueshm\u00ebria<\/h4>\n
\nRrjetet e m\u00ebdha t\u00eb shp\u00ebrndara mund t\u00eb p\u00ebrfshijn\u00eb mij\u00ebra nodet dhe pajisje rrjetesh, qindra segmente t\u00eb rrjeteve lokale. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb zgjidhjet p\u00ebr enkriptim t\u00eb mos vendosin kufizime shtes\u00eb n\u00eb madh\u00ebsin\u00eb dhe topologjin\u00eb e rrjetit t\u00eb shp\u00ebrndar\u00eb. Kjo i p\u00ebrket m\u00eb s\u00eb shumti numrit maksimal t\u00eb adresave t\u00eb nod\u00ebve dhe rrjeteve. Mund t\u00eb hasen k\u00ebto kufizime, p\u00ebr shembull, gjat\u00eb implementimit t\u00eb nj\u00eb topologjie shum\u00ebpik\u00ebshe t\u00eb rrjetit t\u00eb mbrojtur nga enkriptimi (me lidhje t\u00eb pavarura t\u00eb mbrojtura, ose tunele) ose enkriptimit selektiv (p\u00ebr shembull, sipas numrit t\u00eb protokollit ose VLAN). N\u00ebse n\u00eb k\u00ebt\u00eb rast adresat rrjetore (MAC, IP, VLAN ID) p\u00ebrdoren si \u00e7el\u00ebsa n\u00eb tabel\u00eb, numri i rreshtave n\u00eb t\u00eb cil\u00ebn \u00ebsht\u00eb i kufizuar, k\u00ebtu dhe shfaqen k\u00ebto kufizime.<\/p>\n
P\u00ebr m\u00eb tep\u00ebr, rrjetet e m\u00ebdha shpesh kan\u00eb disa nivele strukturore, duke p\u00ebrfshir\u00eb rrjetin themelor, n\u00eb secilin prej t\u00eb cilave zbatohet nj\u00eb sistem adresimi dhe nj\u00eb politik\u00eb rrug\u00ebzimi e ndryshme. P\u00ebr t\u00eb realizuar nj\u00eb qasje t\u00eb till\u00eb, shpesh p\u00ebrdoren formate t\u00eb ve\u00e7anta kornizash (si Q-in-Q ose MAC-in-MAC) dhe protokolle p\u00ebr p\u00ebrcaktimin e rrug\u00ebve. P\u00ebr t\u00eb mos penguar nd\u00ebrtimin e k\u00ebtyre rrjeteve, pajisjet e enkriptimit duhet t\u00eb menaxhojn\u00eb k\u00ebto korniza n\u00eb m\u00ebnyr\u00eb t\u00eb sakt\u00eb (dometh\u00ebn\u00eb, n\u00eb k\u00ebt\u00eb aspekt, shkall\u00ebzueshm\u00ebria do t\u00eb thot\u00eb kompativitet - p\u00ebr t\u00eb cilin do t\u00eb flasim m\u00eb posht\u00eb).<\/p>\n
Fleksibiliteti<\/h4>\n \nK\u00ebtu b\u00ebhet fjal\u00eb p\u00ebr mb\u00ebshtetje t\u00eb konfiguracioneve t\u00eb ndryshme, skemave t\u00eb lidhjeve, topologjive dhe t\u00eb tjera. P\u00ebr shembull, p\u00ebr rrjetet e nd\u00ebrlidhura bazuar n\u00eb teknologjin\u00eb Carrier Ethernet, kjo do t\u00eb thot\u00eb mb\u00ebshtetje p\u00ebr lloje t\u00eb ndryshme t\u00eb lidhjeve virtuale (E-Line, E-LAN, E-Tree), lloje t\u00eb ndryshme sh\u00ebrbimesh (si sipas porteve ashtu edhe sipas VLAN) dhe teknologji t\u00eb ndryshme transporti (t\u00eb cilat jan\u00eb p\u00ebrmendur m\u00eb lart). K\u00ebshtu q\u00eb pajisja duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb operoj\u00eb si n\u00eb modin lineare (\"pik\u00eb n\u00eb pik\u00eb\"), ashtu edhe n\u00eb modalitete multi-pik\u00eb, t\u00eb krijoj\u00eb tunel t\u00eb ve\u00e7ant\u00eb p\u00ebr VLAN t\u00eb ndryshme, dhe t\u00eb lejoj\u00eb shp\u00ebrndarjen e pakove n\u00eb rend t\u00eb \u00e7rregullt brenda kanaleve t\u00eb mbrojtura. Mund\u00ebsia p\u00ebr t\u00eb zgjedhur m\u00ebnyra t\u00eb ndryshme funksionimi t\u00eb enkriptimit (duke p\u00ebrfshir\u00eb autentikimin e p\u00ebrmbajtjes ose pa t\u00eb) dhe m\u00ebnyra t\u00eb ndryshme t\u00eb transmetimit t\u00eb paketave lejon q\u00eb t\u00eb sigurohet nj\u00eb balanc\u00eb midis q\u00ebndrueshm\u00ebris\u00eb dhe performanc\u00ebs n\u00eb var\u00ebsi t\u00eb kushteve aktuale.<\/p>\n
Po ashtu, mb\u00ebshtetja p\u00ebr rrjetet private \u00ebsht\u00eb e r\u00ebnd\u00ebsishme, pajisjet e t\u00eb cilave i p\u00ebrkasin nj\u00eb organizate (ose jan\u00eb t\u00eb qira nga ajo), dhe ato operatorike, segmente t\u00eb ndryshme t\u00eb t\u00eb cilave jan\u00eb n\u00eb menaxhimin e kompanive t\u00eb ndryshme. \u00cbsht\u00eb mir\u00eb q\u00eb zgjidhja t\u00eb lejoj\u00eb menaxhimin si nga forcat e brendshme ashtu edhe nga nj\u00eb organizat\u00eb e jashtme (sip\u00ebr modelit t\u00eb sh\u00ebrbimit t\u00eb menaxhuar). N\u00eb rrjetet operatore, nj\u00eb funksion tjet\u00ebr i r\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb mb\u00ebshtetja p\u00ebr multi-tenanc\u00ebn (p\u00ebrdorim t\u00eb p\u00ebrbashk\u00ebt nga klient\u00eb t\u00eb ndrysh\u00ebm) n\u00eb form\u00ebn e izolimit kriptografik t\u00eb klient\u00ebve t\u00eb ve\u00e7ant\u00eb (abonent\u00ebve), ai trafiku i t\u00eb cil\u00ebve kalon p\u00ebrmes t\u00eb nj\u00ebjtit grup pajisjesh enkriptimi. Si rregull, kjo k\u00ebrkon p\u00ebrdorimin e grupeve t\u00eb ve\u00e7anta t\u00eb \u00e7el\u00ebsave dhe certifikatave p\u00ebr \u00e7do klient.<\/p>\n
N\u00ebse pajisja blihen p\u00ebr ndonj\u00eb skenar t\u00eb caktuar, at\u00ebher\u00eb t\u00eb gjitha k\u00ebto mund\u00ebsi mund t\u00eb mos jen\u00eb shum\u00eb t\u00eb r\u00ebnd\u00ebsishme - thjesht duhet t\u00eb siguroheni se pajisja mb\u00ebshtet at\u00eb q\u00eb \u00ebsht\u00eb e nevojshme tani. Por n\u00ebse zgjidhja blihet \"p\u00ebr t'u rritur\", p\u00ebr t\u00eb mb\u00ebshtetur edhe skenar\u00ebt e ardhsh\u00ebm, dhe zgjidhet si \"standardi i korporat\u00ebs\", at\u00ebher\u00eb fleksibiliteti s'ka p\u00ebr t\u00eb qen\u00eb i tep\u00ebrt - ve\u00e7an\u00ebrisht duke pasur parasysh kufizimet n\u00eb nd\u00ebrobaritetin e pajisjeve t\u00eb prodhuesve t\u00eb ndrysh\u00ebm (p\u00ebr k\u00ebt\u00eb do t\u00eb flasim pak m\u00eb posht\u00eb).<\/p>\n
Thjesht\u00ebsia dhe leht\u00ebsia<\/h4>\n \nKomoditeti i sh\u00ebrbimit \u00ebsht\u00eb nj\u00eb koncept multifaktorial. Mund t\u00eb thuhet se jan\u00eb shpenzimet e p\u00ebrgjithshme t\u00eb koh\u00ebs p\u00ebr specialist\u00ebt e kualifikimeve t\u00eb caktuara q\u00eb nevojiten p\u00ebr mb\u00ebshtetje t\u00eb zgjidhjes n\u00eb etapa t\u00eb ndryshme t\u00eb ciklit t\u00eb saj jet\u00ebsor. N\u00ebse nuk ka shpenzime, dhe instalimi, konfigurimi, funksionimi jan\u00eb plot\u00ebsisht automatike, at\u00ebher\u00eb shpenzimet jan\u00eb zero dhe komoditeti \u00ebsht\u00eb absolut. Sigurisht, n\u00eb bot\u00ebn reale kjo nuk ndodh. Nj\u00eb afrim i arsyesh\u00ebm \u00ebsht\u00eb modeli \u00abnyje n\u00eb tel\u00bb<\/b> (bump-in-the-wire), ose lidhje transparente, ku shtimi dhe shk\u00ebputja e pajisjeve t\u00eb enkriptimit nuk k\u00ebrkon as ndryshime manuale, as automatike n\u00eb konfigurimin e rrjetit. Kjo e thjeshton mb\u00ebshtetje zgjidhjes: mund t\u00eb ndihesh n\u00eb qet\u00ebsi duke aktivizuar ose \u00e7aktivizuar funksionin e enkriptimit, dhe kur \u00ebsht\u00eb e nevojshme thjesht ta \"e shoh\u00ebsh\" pajisjen me nj\u00eb kabllo rrjeti (pra, t\u00eb lidh\u00ebsh direkt portet e pajisjeve rrjet\u00ebrore t\u00eb cilat ishin lidhur me t\u00eb). Megjithat\u00eb, ka nj\u00eb disavantazh \u2013 nj\u00eb sulmues mund ta b\u00ebj\u00eb t\u00eb nj\u00ebjt\u00ebn gj\u00eb. P\u00ebr t\u00eb zbatuar parimin e \"nyj\u00ebs n\u00eb tel\" duhet t\u00eb merret parasysh trafiku jo vet\u00ebm nga shtresa e t\u00eb dh\u00ebnave<\/b>, por edhe nga shtresat e kontrollit dhe menaxhimit<\/b> \u2013 pajisjet duhet t\u00eb jen\u00eb t\u00eb padukshme p\u00ebr ta. Prandaj, ky trafik mund t\u00eb enkriptohet vet\u00ebm kur n\u00eb rrjet midis pajisjeve t\u00eb enkriptimit nuk ka marr\u00ebs t\u00eb k\u00ebtij lloji t\u00eb trafik, pasi n\u00ebse ai refuzohet apo enkriptohet, konfigurimi i rrjetit mund t\u00eb ndryshoj\u00eb gjat\u00eb aktivizimit\/zgjidhjes s\u00eb enkriptimit. Pajisja e enkriptimit mund t\u00eb jet\u00eb e padukshme edhe p\u00ebr sinjalizimin n\u00eb nivelin fizik. Sakt\u00ebsisht, n\u00eb rast humbjeje t\u00eb sinjalit, ajo duhet t\u00eb p\u00ebrcjell\u00eb k\u00ebt\u00eb humbje (pra, t\u00eb ndaloj\u00eb transmetuesit e saj) prapa dhe p\u00ebrpara (\u00abp\u00ebr vete\u00bb) drejt sinjalit.<\/p>\n
Po ashtu, mb\u00ebshtetje e r\u00ebnd\u00ebsishme \u00ebsht\u00eb ndarja e fuqive midis departamenteve t\u00eb Siguris\u00eb s\u00eb Informacionit dhe IT, n\u00eb ve\u00e7anti, departamentin e rrjetit. Zgjidhja p\u00ebr enkriptim duhet t\u00eb mb\u00ebshtes\u00eb modelin e pranuar t\u00eb menaxhimit t\u00eb aksesit dhe auditimit n\u00eb organizat\u00eb. Duhet t\u00eb minimizohet nevoja p\u00ebr nd\u00ebrveprim midis departamenteve t\u00eb ndryshme p\u00ebr t\u00eb realizuar operacione rutin\u00eb. Prandaj, avantazhi n\u00eb aspektin e komoditetit \u00ebsht\u00eb te pajisjet specialistike, t\u00eb cilat mb\u00ebshtesin ekskluzivisht funksionet e enkriptimit dhe jan\u00eb sa m\u00eb transparente p\u00ebr operacionet rrjet. Th\u00ebn\u00eb ndryshe, punonj\u00ebsit e sh\u00ebrbimit t\u00eb Siguris\u00eb s\u00eb Informacionit nuk duhet t\u00eb ken\u00eb arsye p\u00ebr t'u drejtuar te \"rrjetist\u00ebt\" p\u00ebr t\u00eb ndryshuar cil\u00ebsimet e rrjetit. Po ashtu, ata nuk duhet t\u00eb ken\u00eb nevoj\u00eb p\u00ebr t\u00eb ndryshuar cil\u00ebsimet e enkriptimit gjat\u00eb mb\u00ebshtetjes s\u00eb rrjetit.<\/p>\n
Nj\u00eb faktor tjet\u00ebr \u00ebsht\u00eb mund\u00ebsit\u00eb dhe leht\u00ebsia e mjeteve t\u00eb menaxhimit. Ato duhet t\u00eb jen\u00eb t\u00eb qarta, logjike, t\u00eb sigurojn\u00eb import-export t\u00eb cil\u00ebsimeve, automatizim etj. Duhet t\u00eb kushtohet v\u00ebmendje t\u00eb ve\u00e7ant\u00eb se cilat mund\u00ebsi menaxhimi jan\u00eb n\u00eb dispozicion (zakonisht \u00ebsht\u00eb nj\u00eb ambient i brendsh\u00ebm menaxhimi, nd\u00ebrfaqe web dhe linj\u00eb komande) dhe me \u00e7far\u00eb grumbulli funksionesh \u00e7do nj\u00ebra prej tyre ofron (ka kufizime). Nj\u00eb funksion i r\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb mb\u00ebshtetje jasht\u00ebband\u00ebs<\/b> (out-of-band) menaxhimi, q\u00eb do t\u00eb thot\u00eb p\u00ebrmes nj\u00eb rrjeti t\u00eb dedikuar menaxhimi, dhe n\u00ebband\u00ebs<\/b> (in-band) menaxhimi, q\u00eb do t\u00eb thot\u00eb p\u00ebrmes rrjetit t\u00eb p\u00ebrbashk\u00ebt, p\u00ebrmes t\u00eb cilit transmetohet trafiku i dobish\u00ebm. Mjetet e menaxhimit duhet t\u00eb sinjalizojn\u00eb p\u00ebr t\u00eb gjitha situatat jasht\u00ebzakonshme, p\u00ebrfshir\u00eb incidentet e siguris\u00eb informatike. Operacionet rutin\u00eb dhe t\u00eb p\u00ebrs\u00ebritura duhet t\u00eb kryhen automatikisht. Para s\u00eb gjithash, kjo i referohet menaxhimit t\u00eb \u00e7el\u00ebsave. Ata duhet t\u00eb krijohen\/ndahen automatikisht. Mb\u00ebshtetja PKI \u00ebsht\u00eb nj\u00eb avantazh i madh.<\/p>\nP\u00ebrputhshm\u00ebria<\/h4>\n
\nDometh\u00ebn\u00eb, kompatibiliteti i pajisjes me standardet e rrjetit. K\u00ebtu nuk b\u00ebhet fjal\u00eb vet\u00ebm p\u00ebr standardet industriale, t\u00eb pranuara nga organizatat autoritative si IEEE, por edhe p\u00ebr protokollet e markave kryesore n\u00eb industri, si Cisco, p\u00ebr shembull. Ka dy m\u00ebnyra themelore p\u00ebr t\u00eb siguruar p\u00ebrputhshm\u00ebri: ose p\u00ebrmes trash\u00ebsis\u00eb<\/b>, ose p\u00ebrmes mb\u00ebshtetjes eksplicite<\/b> t\u00eb protokolleve (kur pajisja e enkriptimit b\u00ebhet p\u00ebr nj\u00eb protokoll nj\u00eb nga nyjet e rrjetit dhe p\u00ebrpunon trafikun kontrollues t\u00eb atij protokolli). Nga plot\u00ebsia dhe korrekt\u00ebsia e implementimit t\u00eb protokolleve kontrolluese varet p\u00ebrputhshm\u00ebria me rrjetet. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme mb\u00ebshtetja e varianteve t\u00eb ndryshme t\u00eb nivelit PHY (shpejtat, mediat e transmetimit, skemat e kodimit), kadro Ethernet t\u00eb formateve t\u00eb ndryshme me \u00e7do MTU, dhe protokolleve t\u00eb sh\u00ebrbimit L3 (p\u00ebrpara familjes TCP\/IP).<\/p>\n
Trash\u00ebsia sigurohet p\u00ebrmes mekanizmave t\u00eb mutacionit (ndryshimi temporal i p\u00ebrmbajtjes s\u00eb kokave t\u00eb hapura n\u00eb trafikun midis enkriptuesve), kalimit (kur paketa t\u00eb ve\u00e7anta mbeten t\u00eb paenkriptuara) dhe t\u00ebrheqjes s\u00eb fillimit t\u00eb enkriptimit (kur fushat zakonisht t\u00eb enkriptuara t\u00eb paketa nuk enkriptohen).<\/p>\n
Si sigurohet trash\u00ebsia<\/i><\/p>\n
Prandaj gjithmon\u00eb sqaroni se si sigurohet mb\u00ebshtetja p\u00ebr nj\u00eb protokoll t\u00eb caktuar. Shpesh, mb\u00ebshtetja n\u00eb m\u00ebnyr\u00eb transparente \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme dhe m\u00eb e besueshme.<\/p>\n
Interoperabiliteti<\/h4>\n \nKjo \u00ebsht\u00eb gjithashtu p\u00ebrputhshm\u00ebri, por n\u00eb nj\u00eb kuptim tjet\u00ebr, pra mund\u00ebsia e bashk\u00ebpunimit me modele t\u00eb tjera pajisjesh enkriptimi, p\u00ebrfshir\u00eb edhe t\u00eb tjera prodhuese. K\u00ebtu varet shum\u00eb nga gjendja e standardizimit t\u00eb protokolleve t\u00eb enkriptimit. N\u00eb L1 standardet e nj\u00ebanshme t\u00eb enkriptimit thjesht nuk ekzistojn\u00eb.<\/p>\n
P\u00ebr enkriptimin L2 n\u00eb rrjetet Ethernet ekziston standardi 802.1ae (MACsec), por ai nuk p\u00ebrdor enkriptim t\u00eb plot\u00eb<\/b> (end-to-end), por mesportesh<\/b>, encryptioni \u00abhop-by-hop\u00bb, dhe n\u00eb redaktimin e saj fillestar ishte e pap\u00ebrshtatshme p\u00ebr p\u00ebrdorim n\u00eb rrjeta t\u00eb shp\u00ebrndara, prandaj u shfaq\u00ebn zgjerimet e saj t\u00eb mark\u00ebs q\u00eb tejkalojn\u00eb k\u00ebt\u00eb kufizim (sigurisht, n\u00eb kosto t\u00eb interoperabilitetit me pajisje t\u00eb prodhuesve t\u00eb tjer\u00eb). Megjithat\u00eb, n\u00eb vitin 2018, u shtua mb\u00ebshtetje p\u00ebr rrjetet e shp\u00ebrndara n\u00eb standardin 802.1ae, por mb\u00ebshtetje p\u00ebr grupet e algoritmeve t\u00eb enkriptimit GOST ende nuk ka. Prandaj, protokollet e enkriptimit L2 t\u00eb mark\u00ebs, n\u00eb p\u00ebrgjith\u00ebsi, karakterizohen nga efikasitet m\u00eb i madh (n\u00eb ve\u00e7anti, nj\u00eb ngarkes\u00eb m\u00eb t\u00eb ul\u00ebt t\u00eb band\u00ebs) dhe fleksibilitet (mund\u00ebsia p\u00ebr t\u00eb ndryshuar algoritmet dhe modet e enkriptimit).<\/p>\n
N\u00eb nivele m\u00eb t\u00eb larta (L3 dhe L4) ka standarde t\u00eb njohura, p\u00ebrpar\u00ebsisht IPsec dhe TLS, por as k\u00ebtu nuk \u00ebsht\u00eb kaq e thjesht\u00eb. Problemi \u00ebsht\u00eb se secili nga k\u00ebto standarte \u00ebsht\u00eb nj\u00eb grup protokollesh, secili me versione t\u00eb ndryshme dhe me zgjerime t\u00eb detyrueshme ose t\u00eb opcionale p\u00ebr implementim. P\u00ebr m\u00eb tep\u00ebr, disa prodhues preferojn\u00eb t\u00eb aplikojn\u00eb protokollet e tyre t\u00eb enkriptimit edhe n\u00eb L3\/L4. Prandaj, n\u00eb shumic\u00ebn e rasteve nuk vlen t\u00eb pritet interoperabiliteti i plot\u00eb, por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb t\u00eb pakt\u00ebn t\u00eb sigurohet nd\u00ebrlidhje midis modeleve t\u00eb ndryshme dhe gjeneratave t\u00eb ndryshme t\u00eb nj\u00eb prodhuesi.<\/p>\n
Besueshm\u00ebria<\/h4>\n \nP\u00ebr t\u00eb krahasuar zgjidhje t\u00eb ndryshme, mund t\u00eb p\u00ebrdorni ose koh\u00ebn mesatare t\u00eb pun\u00ebs deri n\u00eb d\u00ebshtim, ose koeficientin e gatishm\u00ebris\u00eb. N\u00ebse k\u00ebto numra nuk jan\u00eb t\u00eb pranish\u00ebm (ose nuk besohen), at\u00ebher\u00eb mund t\u00eb kryhet nj\u00eb krahasim cil\u00ebsor. Avantazhi do t\u00eb jet\u00eb p\u00ebr pajisjet me menaxhim t\u00eb leht\u00eb (m\u00eb pak rrezik gabimesh n\u00eb konfigurim), p\u00ebr enkripta t\u00eb specializuara (p\u00ebr t\u00eb nj\u00ebjt\u00ebn arsye), si dhe p\u00ebr zgjidhjet me koh\u00eb minimale t\u00eb zbardhjes dhe eliminimit t\u00eb d\u00ebshtimit, p\u00ebrfshir\u00eb mjetet p\u00ebr \u201crezervimin e nxeht\u00eb\u201d t\u00eb nyjeve dhe pajisjeve komplet.<\/p>\n
\u00c7mimi<\/h4>\n \nSa i p\u00ebrket kostos, si p\u00ebr shumic\u00ebn e zgjidhjeve IT, \u00ebsht\u00eb e arsyeshme t\u00eb krahasohet kostoja totale e pron\u00ebsis\u00eb. P\u00ebr llogaritjen e saj nuk \u00ebsht\u00eb e nevojshme t\u00eb shpikni biciklet\u00ebn, por mund t\u00eb p\u00ebrdorni \u00e7do metodologji t\u00eb p\u00ebrshtatshme (p.sh., nga Gartner) dhe \u00e7do kalkulator (p.sh., at\u00eb q\u00eb tashm\u00eb po p\u00ebrdoret n\u00eb organizat\u00eb p\u00ebr llogaritjen e TCO). \u00cbsht\u00eb e qart\u00eb se p\u00ebr zgjidhjen e enkriptimit t\u00eb rrjetit, kostoja totale e pron\u00ebsis\u00eb p\u00ebrfshin shpenzimet<\/b> e drejtp\u00ebrdrejta p\u00ebr blerjen ose qiran\u00eb e zgjidhjes vet\u00eb, p\u00ebr infrastruktur\u00ebn p\u00ebr vendosjen e pajisjeve dhe shpenzimet p\u00ebr implementimin, administrimin dhe mb\u00ebshtetje (pa marr\u00eb parasysh, n\u00eb forcat e tyre ose si sh\u00ebrbime nga nj\u00eb organizat\u00eb tjet\u00ebr), si dhe shpenzimet e t\u00ebrthorta<\/b> kostove nga ndalesa e zgjidhjes (t\u00eb shkatuara nga humbjet e produktivitetit t\u00eb p\u00ebrdoruesve t\u00eb fundit). Mbase ka vet\u00ebm nj\u00eb nuanc\u00eb. Ndikimi i performanc\u00ebs s\u00eb zgjidhjes mund t\u00eb llogaritet n\u00eb m\u00ebnyra t\u00eb ndryshme: si kostot indirekte, t\u00eb shkaktuara nga r\u00ebnia e produktivitetit, ose si kostot \"virtuale\" t\u00eb drejtp\u00ebrdrejta p\u00ebr blerjen\/modifikimin dhe mir\u00ebmbajtjen e mjeteve rrjetore, q\u00eb kompensojn\u00eb r\u00ebnien e performanc\u00ebs s\u00eb rrjetit si pasoj\u00eb e zbatimit t\u00eb kriptimit. N\u00eb \u00e7do rast, kostot q\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb llogariten me sakt\u00ebsi t\u00eb mjaftueshme \u00ebsht\u00eb m\u00eb mir\u00eb \"ta nxjerrim jasht\u00eb llogaritjes\": k\u00ebshtu do t\u00eb ket\u00eb m\u00eb shum\u00eb besim n\u00eb vler\u00ebn p\u00ebrfundimtare. Dhe, si zakonisht, n\u00eb \u00e7do rast, krahasimi i disa pajisjeve sipas TCO ka kuptim t\u00eb b\u00ebhet p\u00ebr nj\u00eb skenar konkret t\u00eb p\u00ebrdorimit t\u00eb tyre \u2013 reale ose tipike.<\/p>\nQ\u00ebndrueshm\u00ebria<\/h4>\n
\nDhe karakteristika e fundit \u2013 \u00ebsht\u00eb q\u00ebndrueshm\u00ebria e zgjidhjes. N\u00eb shumic\u00ebn e rasteve, q\u00ebndrueshm\u00ebria mund t\u00eb vler\u00ebsohet vet\u00ebm cil\u00ebsisht, duke krahasuar zgjidhje t\u00eb ndryshme midis tyre. Duhet t\u00eb kemi parasysh se pajisjet e kriptimit jo vet\u00ebm q\u00eb jan\u00eb mjete, por edhe objekte mbrojtjeje. Ato mund t\u00eb jen\u00eb t\u00eb ekspozuara ndaj k\u00ebrc\u00ebnimeve t\u00eb ndryshme. N\u00eb plan t\u00eb par\u00eb jan\u00eb k\u00ebrc\u00ebnimet e shkeljes s\u00eb konfidencialitetit, riprodhimit dhe modifikimit t\u00eb mesazheve. K\u00ebto k\u00ebrc\u00ebnime mund t\u00eb realizohen p\u00ebrmes dob\u00ebsive t\u00eb algoritmit t\u00eb kriptimit ose t\u00eb m\u00ebnyrave t\u00eb tij t\u00eb veprimit, p\u00ebrmes dob\u00ebsive n\u00eb protokollet e kriptimit (duke p\u00ebrfshir\u00eb edhe fazat e vendosjes s\u00eb lidhjes dhe krijimit\/shp\u00ebrndarjes s\u00eb \u00e7el\u00ebsave). Avantazhi do t\u00eb jet\u00eb p\u00ebr zgjidhjet q\u00eb lejojn\u00eb nd\u00ebrrimin e algoritmit t\u00eb kriptimit ose kalimin n\u00eb modin e kriptimit (edhe p\u00ebrmes p\u00ebrdit\u00ebsimit t\u00eb softuerit), p\u00ebr zgjidhjet q\u00eb ofrojn\u00eb kriptim sa m\u00eb t\u00eb plot\u00eb, duke fshehur nga sulmuesi jo vet\u00ebm t\u00eb dh\u00ebnat e p\u00ebrdoruesve, por edhe informacionin sh\u00ebrbimor si adresat, si dhe p\u00ebr ata zgjidhje q\u00eb jo vet\u00ebm q\u00eb kriptojn\u00eb, por gjithashtu mbrojn\u00eb mesazhet nga riprodhimi dhe modifikimi. P\u00ebr t\u00eb gjith\u00eb algoritm\u00ebt modern\u00eb t\u00eb kriptimit, n\u00ebnshkrimit elektronik, krijimit t\u00eb \u00e7el\u00ebsave dhe t\u00eb tjerave, q\u00eb jan\u00eb t\u00eb konsoliduara n\u00eb standarde, q\u00ebndrueshm\u00ebria mund t\u00eb merret si e nj\u00ebjt\u00eb (p\u00ebrndryshe, thjesht mund t\u00eb humbim n\u00eb err\u00ebsir\u00ebn e kriptografis\u00eb). A duhet patjet\u00ebr t\u00eb jen\u00eb algoritme GOST? K\u00ebtu \u00ebsht\u00eb e thjesht\u00eb: n\u00ebse skenari i p\u00ebrdorimit k\u00ebrkon certifikim nga FSB p\u00ebr SKZI (dhe n\u00eb Rusi kjo \u00ebsht\u00eb shpesh e till\u00eb), p\u00ebr shumic\u00ebn e skenar\u00ebve t\u00eb kriptimit n\u00eb rrjet, at\u00ebher\u00eb zgjidhim vet\u00ebm mes atyre q\u00eb jan\u00eb t\u00eb certifikuar. N\u00ebse jo \u2013 at\u00ebher\u00eb nuk ka kuptim t\u00eb p\u00ebrjashtojm\u00eb pajisjet pa certifikata nga shqyrtimi.<\/p>\n
K\u00ebrc\u00ebnimi tjet\u00ebr \u2013 ky k\u00ebrc\u00ebnim \u00ebsht\u00eb thyerja, akses i paautorizuar n\u00eb pajisje (duke p\u00ebrfshir\u00eb edhe p\u00ebrmes aksesit fizik nga jasht\u00eb dhe brenda struktur\u00ebs). K\u00ebrc\u00ebnimi mund t\u00eb realizohet p\u00ebrmes
Finally, another type of threat is configuration and operational errors, purely the human factor. Here, the advantage of specialized encryptors over convergent solutions, which are often aimed at seasoned \"networkers,\" comes into play and can pose challenges for \"ordinary\" generalists in information security.<\/p>\n
T\u00eb p\u00ebrmbledhim<\/h4>\n \nIn principle, an integral metric could be proposed for comparing different devices, something like<\/p>\n
$$display$$K_j=\u2211p_i r_{ij}$$display$$<\/p>\n
\nwhere p \u2013 is the weight of the metric, and r \u2013 is the rank of the device according to this metric, with any of the aforementioned characteristics being able to be broken down into \"atomic\" metrics. Such a formula could be useful, for instance, when comparing tender proposals according to previously agreed rules. However, a simple table like<\/p>\n
Specifikimi
Kapaciteti i Kalimit
+++<\/p>\n
Overhead Costs
+++<\/p>\n
Vonesa
++<\/p>\n
Shkall\u00ebzueshm\u00ebria
+++<\/p>\n
Fleksibiliteti
+<\/p>\n
Interoperabiliteti
+<\/p>\n
P\u00ebrputhshm\u00ebria
+++<\/p>\n
Thjesht\u00ebsia dhe leht\u00ebsia
++<\/p>\n
Q\u00ebndrueshm\u00ebria
++<\/p>\n
\u00c7mimi
+<\/p>\n
Q\u00ebndrueshm\u00ebria
+++<\/p>\n
\nI will be happy to answer any questions and constructive critical remarks.habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u042d\u0442\u043e\u0442 \u043e\u0431\u0437\u043e\u0440 (\u0438\u043b\u0438, \u0435\u0441\u043b\u0438 \u0445\u043e\u0442\u0438\u0442\u0435, \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f) \u044f \u043d\u0430\u043f\u0438\u0441\u0430\u043b, \u043a\u043e\u0433\u0434\u0430 \u043c\u043d\u0435 \u043f\u043e\u0440\u0443\u0447\u0438\u043b\u0438 \u0441\u0440\u0430\u0432\u043d\u0438\u0442\u044c \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435 \u044d\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u043b\u0438 \u043a \u0440\u0430\u0437\u043d\u044b\u043c \u043a\u043b\u0430\u0441\u0441\u0430\u043c. \u041f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u0445 \u0432\u0441\u0435\u0445 \u044d\u0442\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u00ab\u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0442\u00bb \u0434\u043b\u044f \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f. \u042f \u0431\u0443\u0434\u0443 \u0440\u0430\u0434, \u0435\u0441\u043b\u0438 \u043c\u043e\u0439 \u043e\u0431\u0437\u043e\u0440 \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u043a\u043e\u043c\u0443-\u0442\u043e: \u0420\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52834","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t