Method of protection of information systems

Abstract

FIELD: computer technology.SUBSTANCE: method for protecting information systems is claimed in which: in the event of an unsuccessful attempt by an attacker to guess the username and password of an authorized client of the information system service, response message packets are transmitted with excessive fragmentation and a reduction in the transmission speed of the transmitted fragments, thereby simulating a communication channel with unsatisfactory quality.EFFECT: increasing the effectiveness of protection by simulating a communication channel with unsatisfactory quality when interacting with an intruder.3 cl, 4 dwg

Description

[0001] The invention relates to telecommunications and can be used in attack detection systems for the purpose of promptly identifying and countering unauthorized influences in information systems, in particular in an Internet-type data transmission network based on the TCP / IP (Transmission Control Protocol / Internet Protocol) family of communication protocols.

[0002] A known method for protecting information systems is described in the article "SMB Security Hardening" (URL: https: / / learn.microsoft.com / en-us / windows-server / storage / file-server / smb-security-hardening). This known method includes the following sequence of actions. The identifiers of authorized SMB clients are specified, which are a unique username and password. The identifiers of authorized SMB clients are stored in the memory arrays of the SMB server. The SMB client sends a command to the SMB server containing the SMB client identifiers for authorization and use of the SMB server's information resources. The SMB client identifiers are extracted from the received command and compared with the identifiers of authorized SMB clients. If they match, the SMB client is granted access to use the SMB server's information resources. Otherwise, the SMB server sends a response message about an authorization error to the SMB client.

[0003] The disadvantage of this method is the relatively low effectiveness of protection, which is due to the lack of consideration of the attacker's ability to implement a network attack "brute force" based on password selection (brute force attack), described, for example, in the article "Password Cracking: SMB" URL: https: / / www.hackingarticles.in / smb-password-cracking, which allows him, after multiple iterations of selecting the username and password, to carry out successful authorization and subsequent unauthorized use of SMB server resources.

[0004] The closest in its technical essence to the declared method is the method of protecting information systems from brute force attacks, described in the specification "[MS-SMB2]: Server Message Block (SMB) Protocol Versions 2 and 3" (see, for example, URL: https: / / learn.microsoft.com / en-us / openspecs / windows_protocols / ms-smb2 / 5606ad47-5ee0-437a-817e-70c366052962). The prototype method includes the following sequence of actions. Identifiers of authorized SMB clients are specified, which are a unique username and password. Identifiers of authorized SMB clients are stored in the memory arrays of the SMB server. In the event of an unsuccessful authorization attempt due to entering an incorrect username or password, a delay time of 2 seconds is set before the next attempt to authorize SMB clients on the SMB server and stored in the SMB server memory array.The SMB client sends a command to the SMB server to authorize and use the SMB server's information resources. This command contains the SMB client identifiers, such as the username and password. The SMB client identifiers are extracted from the received command and compared with the identifiers of authorized SMB clients. If they match, the SMB client is granted access to the SMB server's information resources. Otherwise, the SMB server sends an authorization error response message to the SMB client. After a 2-second delay, the SMB client is granted another authorization attempt on the SMB server.

[0005] The well-known prototype method provides higher protection efficiency compared to similar methods by delaying response messages to attacker commands for a specified time, which reduces the effectiveness of brute force computer attacks based on password guessing (brute force attack).

[0006] A disadvantage of the prototype method is its relatively low protection effectiveness, which is due to the fact that brute-force attacks against usernames and passwords are prevented by introducing a short, fixed-time delay before each subsequent authorization attempt in the event of an unsuccessful attempt. This allows the attacker to make new unauthorized access attempts at short intervals, taking into account previously obtained information about the information system. Furthermore, the delay in sending response messages to the attacker's commands is implemented at fixed intervals, which can lead to the compromise of the security measures used, as well as their bypass if the attacker sets short timeout values ​​for waiting for response messages from the SMB server, shorter than those specified in the prototype method.

[0007] The objective of the proposed technical solution is to develop a method for protecting information systems that increases protection effectiveness by reducing an attacker's ability to guess the names and passwords of authorized SMB clients, as well as to compromise and bypass information system security. This reduction in attacker ability to guess the names and passwords of authorized SMB clients is achieved by simulating a poor-quality communication channel, significantly increasing the time required to conduct password bruteforce attacks. This is achieved by sending a fragmented authorization error response message to an SMB client that has failed successful authorization, with fragments sent at short delay intervals.The ability of an attacker to compromise information system security tools and bypass them is reduced by not blocking the TCP connection with an SMB client that has not successfully completed authorization, and by sending fragments of the response message at short delay intervals that are shorter than the timeout values ​​set by the attacker for waiting for a response message from the SMB server.

[0008] The stated goal is achieved by pre-defining N≥1 reference identifiers of authorized SMB clients in a known method of protecting information systems. Then, t is specified зaд- the delay time after which the SMB client is given the opportunity to attempt another authorization attempt if a previous attempt on the SMB server was unsuccessful. W is also specified - a memory array for storing the reference identifiers of authorized SMB clients. After this, a TCP connection is established between the SMB server and the SMB client. The SMB server then receives a message from the SMB client containing the SMB client identifiers for authorization on the SMB server. Next, the SMB client identifiers are extracted from the received message and compared with the reference identifiers of authorized SMB clients from the W memory array. If the extracted SMB client identifiers match the identifiers of authorized SMB clients from the W memory array, the SMB client is granted access to the SMB server.Otherwise, if the comparison results in the allocated SMB client identifiers not matching the reference identifiers of authorized SMB clients in the W memory array, the SMB server sends a response message to the SMB client indicating an unsuccessful authorization attempt. Then, after a time t≥t. зaд , again receive a message from the SMB client containing its identifiers for authorization on the SMB server. The pre-defined initial data is additionally supplemented with a memory array Q for storing d fragments into which the response message to the SMB client about an unsuccessful attempt at authorization on the SMB server is divided, where d = 1, 2, …, D, and D is the total number of generated fragments into which the response message is divided. Next, a memory array R is specified for storing the generated delay times for transmitting fragments of the response message to the SMB client about an unsuccessful attempt at authorization on the SMB server, where and L is the total number of generated response message fragment delay times. After this, c is set—the counter of generated fragments into which the response message to the SMB client is divided, stored in the memory array Q. Then, S is set—the memory array for storing the correspondence matrix for the d-th fragment from the array Q. the generated value of its delay time from the memory array R. Next, after establishing a TCP connection between the SMB client and the SMB server, receiving from the SMB client a message containing its identifiers for authorization on the SMB server, extracting from it the SMB client identifiers, comparing them with the reference identifiers of authorized SMB clients from the memory array W and granting the SMB client access to the SMB server, if, according to the results of the comparison, the extracted SMB client identifiers correspond to the reference identifiers of authorized SMB clients from the memory array W, otherwise, when, according to the results of the comparison, the extracted SMB client identifiers do not correspond to the reference identifiers of authorized SMB clients from the memory array W, D fragments are formed, into which the response message about the unsuccessful authorization of the client on the SMB server sent to the SMB client is divided.Next, D fragments, into which the response message about the client's unsuccessful authorization on the SMB server, sent to the SMB client, is divided, are stored in memory array Q. After this, the counter of the generated fragments, into which the response message is divided, stored in memory array Q, is set to D. Next, L delay time values ​​are generated for each of the fragments into which the response message to the SMB client is divided. Then, L delay time values ​​for each of the fragments into which the response message to the SMB client is divided are stored in memory array R. After this, the correspondence to the d-th fragment from array Q is stored in memory array S. The generated delay time value is retrieved from memory array R. Next, the first of the D generated response message fragments is read from memory array Q and the first of the L generated delay time values ​​is read from memory array R. The first of the D response message fragments is then sent to the SMB client through the first of the R generated delay time values. After this, the first of the D generated response message fragments and the first of the L generated delay time values ​​are deleted, along with the record of their correspondence, from memory arrays Q, R, and S, respectively. Next, the counter value is decremented by one from the generated response message fragments stored in memory array Q. Then, the counter value is read from the generated response message fragments.If the counter value c ≠ 0, indicating that not all fragments of the response message have been sent to the SMB client, the next (d+1)th of the previously generated D fragments of the response message is read. After this, the next (d+1)th of the previously generated D fragments of the response message is sent via The delay time value is sent to the SMB client, and so on until the condition c=0 is met, meaning that all fragments of the response message have been sent to the SMB client. If the SMB server receives a command from the SMB client to terminate the TCP connection after sending the response message, the SMB server terminates the TCP connection for the SMB client. Otherwise, a message containing the client's identifiers for authorization on the SMB server is received again from the SMB client, a cycle of allocating SMB client identifiers is performed, comparing the allocated identifiers with the reference identifiers of authorized SMB clients, authorizing the client on the SMB server, or, if the allocated SMB client identifiers do not match the identifiers of authorized SMB clients, sending fragments of the authorization error response message to the SMB server at specified delay intervals for these fragments.

[0009] The delay time value for each fragment of the response message to the SMB client is selected randomly within the range from 0.1 to 1 second.

[0010] The size of the fragments into which the response message to the SMB client is divided is selected randomly within the range of 1 to 2 bytes.

[0011] Thanks to a new set of essential features, the claimed method improves protection effectiveness by reducing an attacker's ability to guess the names and passwords of authorized SMB clients, as well as to compromise and bypass information system security. This reduction in attacker ability to guess the names and passwords of authorized SMB clients is achieved by simulating a poor-quality communication channel, significantly increasing the time required to conduct password bruteforce attacks. This is achieved by sending a fragmented authorization error response message to an SMB client that has failed successful authorization, with fragments sent at short delay intervals.The ability of an attacker to compromise information system security tools and bypass them is reduced by not blocking the TCP connection with an SMB client that has not successfully completed authorization, and by sending fragments of the response message at short delay intervals that are shorter than the timeout values ​​set by the attacker for waiting for a response message from the SMB server.

[0012] The claimed objects of the invention are explained by drawings, which show:

[0013] Fig. 1 - illustration of the SMB protocol operation process;

[0014] Fig. 2 - SMB message header structure;

[0015] Fig. 3 - block diagram of the sequence of actions implementing the declared method of protecting information systems;

[0016] Fig. 4 - illustration of the process of sending a fragmented response message to the SMB client about an authorization error on the SMB server.

[0017] The implementation of the claimed method is explained as follows. It is known that the Server Message Block protocol specification, starting from version 2.0 and later (defined in MS-SMB2) (see, for example, the article "What is Microsoft SMB Protocol and CIFS Protocols" URL: https: / / learn.microsoft.com / en-us / windows / win32 / fileio / microsoft-smb-protocol-and-cifs-protocol-overview), is actively used in modern operating systems for file sharing, printing, and accessing network resources. However, when analyzing the security of the session setup stage, a number of vulnerabilities are revealed that can be exploited by an attacker for brute-force attacks:

[0018] Unlimited authentication attempts: The protocol does not limit the number of consecutive unsuccessful login attempts within a single TCP connection. The client can send SESSION_SETUP requests multiple times with different username / password pairs, and the server will return an error status (e.g., STATUS_LOGON_FAILURE) each time without terminating the connection;

[0019] Immediate server response: In the event of authentication failure, the server immediately responds to the client without introducing artificial delays. This speeds up brute-force attacks, reducing their time costs.

[0020] Error code diagnostics: the protocol returns various failure codes upon unsuccessful authentication (STATUS_LOGON_FAILURE - invalid login / password pair; STATUS_ACCOUNT_LOCKEDjOUT - account locked; STATUS_PASSWORD_EXPIRED, STATUS_NO__LOGON_SERVERS, etc.). These statuses allow an attacker to refine the status of the target account and adapt the attack strategy, including enumeration (trying through usernames).

[0021] Thus, the MS-SMB2 specification does not contain any mechanisms by default to prevent brute-force attacks, making it potentially vulnerable without additional layers of protection.

[0022] In response to the identified vulnerabilities, network administrators can use protection mechanisms built into the operating system or implemented using Group Policy (GPO), see, for example, the article “Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers”, URL: https: / learn.microsoft.com / en-us / previous-versions / windows / it-pro / windows-10 / security / threat-protection / secunty-policy-settings / network-stcurity-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.

[0023] However, all of the approaches listed are reactive - they act only after the attack has begun and often with a delay.

[0024] In order to prevent attacks at the authentication stage, Microsoft has implemented a mechanism to limit the authentication rate (SMB Authentication Rate Limiter), starting with Windows Server 2025, Windows 11 (version 24H2), see, for example, the article “Configure SMB authentication rate limiter for Windows”, URL: https: / / learn.microsoft.com / en-us / windows-server / storage / file-server / configure-smb-authenntication-rate-limiter?tabs=powershell.

[0025] The mechanism is that after each unsuccessful login attempt via NTLM or PKU2U, the server, by default, introduces a 2-second delay before returning a response. This delay is independent of account or session lockouts and applies to all anonymous connections. Repeated authentication attempts are slowed linearly, increasing the attacker's time investment.

[0026] For example, if previously it was possible to brute-force 90,000 passwords in 5 minutes, with this limit enabled, it would take approximately 50 hours. This protection is implemented before a session is established, reducing the possibility of "enumeration." It works even when the account is disabled or when using local users, and it doesn't affect legitimate clients, since no delay is applied upon successful authentication.

[0027] These security measures block the attacker only after multiple attempts to obtain information about user accounts within the information system. This approach is focused on responding to unauthorized access that has already occurred. Furthermore, the use of such mechanisms may expose the specifics of the implemented security measures, which entails the risk of their bypass or the attacker adapting their attack vector. For example, in the articles Walla, S. MALPITY: Automatic identification and Exploitation of Tarpit Vulnerabilities in Malware / S. Walla, S Rossow / / 2019 IEEE European Symposium on Security and Privacy (EuroS&P), 2019. - P. 590-605 and Eggendorger, T. Combining SMTP and HTTP tar pits to proactively reduce spam / T. Eggendorger, J. Keller / / Proceedings of the 2006 International Conference on Security & Management, 2006. - P.1-7 show the average empirical values ​​of the timeout for waiting by the attacker's means for responses from the attacked elements of information systems, regulated by their protection means - network traps (network tarpits), as well as the standard settings of operating systems and network services, which are 2 seconds.

[0028] In this regard, fundamentally new methods of countering malicious attacks on SMB are becoming relevant. They implement proactive protection mechanisms (see, for example, the article by Voronchikhin I.S., Ivanov I.I., Maksimov R.V., Sokolovsky S.P. Masking the structure of distributed information systems in cyberspace / / Cybersecurity Issues. 2019. No. 6 (34). Pp. 92-101), based on complicating or eliminating the possibility of collecting information about the identifiers of information network users, ensuring the limitation of the computing and time resources of the attacker without significantly affecting the load of the protected information system.

[0029] Thus, a number of contradictions arise between the effectiveness of protecting information systems using the SMB protocol and the ability of attackers to compromise the security tools and user identifiers of an information system, on the one hand, and between the need to manage the attacker's resource capabilities for network reconnaissance and the implementation of computer attacks and the lack of technical solutions for dynamically managing the parameters of network connections with the attacker, on the other hand.

[0030] The claimed method is aimed at eliminating the said contradictions.

[0031] The claimed method is implemented as follows. The SMB protocol is used to provide network access to files, printers, and other resources in a client-server architecture over TCP / IP. Second-generation SMB (SMB2 and later SMB 3.x) is used in modern Windows systems and is actively being developed.

[0032] SMB uses a single TCP connection (port 445) for all operations between the client and server, including connection initialization, authentication, resource access, and data transfer (see, for example, the article "What is Microsoft SMB Protocol and CIFS Protocol" URL: https: / / learn.microsoft.com / en-us / windows / win32 / fileio / microsoft-smb-protocol-and-cifs-protocol-overview).

[0033] The SMB protocol operation description diagram is shown in Fig. 1 and includes the following steps.

[0034] TCP connection establishment. The transfer begins with the classic TCP 3-way handshake (SYN → SYN / ACK → ACK) (see, for example, Technical Specifications RFC 959. File Transfer Protocol (FTP). 1985. URL: https: / / tools.ietf.org / html / rfc959). After the TCP connection is established, the exchange of SMB messages begins.

[0035] Exchange messages about the protocol version used (SMB Negotiate). The first stage of interaction at the SMB level is the negotiation of parameters:

[0036] The client sends SMB2_NEGOTIATE_Request, where it specifies the list of supported SMB versions (e.g. 2.1, 3.0, 3.1.1), security and cryptography options;

[0037] The server responds with SMB2_NEGOTIATE_Response, selecting the highest compatible protocol version and specifying security contexts (e.g., support for Pre-auth Integrity, encryption, and compression, starting with SMB3.1.1).

[0038] Authentication (Session Setup). After selecting a protocol, the client initiates a session: using the SMB2_SESSION_SETUP Request, which carries NTLMv2 or Kerberos authentication data; the server returns the SMB2_SESSION_SETUP_Response, confirming (or rejecting) the session; this process may consist of one or more exchanges if multi-step authentication is used.

[0039] Connecting to a resource (Tree Connect). After successful authentication, the client requests access to a specific resource: the SMB2_TREE_CONNECT_Request is for access to a specific shared folder; the SMB2_TREE_CONNECT_Response contains a tree identifier (TreeID) confirming access.

[0040] Performing operations with files and folders. After connecting, the client can perform actions on resources: SMB2_CREATE - open / create a file or directory; SMB2_READ - read data; SMB2_WRITE - write data, etc. After this, the TCP connection is terminated (TCP FIN / ACK).

[0041] Each SMB2 message consists of a fixed header (64 bytes) as shown in Figure 2, followed by a command structure and, optionally, a payload.

[0042] The header consists of the following fields: IDF (Identifier) ​​- protocol identifier (Oxff, 0x53('S'), 0x4d('M'), 0x42('B')), Command - protocol command, RCLS - error class code, ERR - error code, Tree ID (TID) - identifier of the connection to the network resource, Process ID (PID) - identifier of the client process of the actual connection, User ID (UID) - user identifier, Multiplex ID (MID) - user group identifier, WCT - the number of parameters following the header, BCC - the number of data bytes following the parameters, which is known and described, for example, in the article "[MS-SMB2]: Server Message Block (SMB) Protocol Versions 2 and 3" URL: https: / / learn.microsoft.com / en-us / openspecs / windows_protocols / ms-smb2 / 5606ad47-5ee0-437a-817e70c366052962.

[0043] Commands are encoded in the Command field, which takes values ​​from 0x00 (NEGOTIATE) to 0x13 (CANCEL), depending on the request type, see, for example, the article “What is Microsoft SMB Protocol and CIFS Protocol, URL: https: / / learn.microsoft.com / en-us / windows / win32 / fileio / microsoft-smb-protocol-and-cifs-protocol-overview.

[0044] The server responds to each client request with a separate message containing: the command code (the same as in the request); the execution status (NTSTATUS); the response context (e.g. access, identifiers, length of transferred data, etc.).

[0045] Some commands, such as SESSION_SETUP, may require multiple steps (multi-round exchange) if repeated authentication checks are required.

[0046] Fig. 3 shows a block diagram of the sequence of actions implementing the claimed method of protecting information systems, in which the following designations are adopted:

[0047] N≥1 - a base of reference identifiers of authorized SMB clients, which include the username and password;

[0048] W - memory array for storing reference identifiers of authorized SMB clients;

[0049] Q - a memory array for storing d fragments into which the response message to the SMB client about an unsuccessful attempt to authorize it on the SMB server is divided, where d=1, 2, …, D, and D is the total number of generated fragments into which the response message is divided;

[0050] R - a memory array for storing / generated values ​​of the delay time for transmitting fragments of a response message to an SMB client about an unsuccessful attempt to authorize it on an SMB server, where l=1, 2, …, L, and L is the total number of generated values ​​of the delay time for sending fragments of a response message;

[0051] s - counter of generated fragments into which the response message to the SMB client is divided, stored in the Q memory array;

[0052] S - memory array for storing the matrix of correspondence to the d-th fragment from the array of the Ql-th generated value of its delay time from the memory array R.

[0053] In order to reduce the attacker's ability to guess the names and passwords of authorized SMB clients by simulating a communication channel with unsatisfactory quality at the authorization stage, which provides a significant increase in the time for carrying out attacks with password guessing, the pre-set data is additionally specified (see block 1 in Fig. 3) Q - a memory array for storing d fragments into which the response message to the SMB client about an unsuccessful attempt to authorize it on the SMB server is divided, where d = 1, 2, ..., D, and D is the total number of generated fragments into which the response message is divided.

[0054] To increase the effectiveness of protection by reducing the likelihood of an intruder detecting the use of security tools and preventing the possibility of bypassing them by setting short timeouts for waiting for response messages, an R-memory array for storing is additionally specified in the pre-set data (see block 1 in Fig. 3) generated values ​​of the delay time for transmitting fragments of the response message to the SMB client about an unsuccessful attempt to authorize it on the SMB server, where and L is the total number of generated response message fragment transmission delay values. To define the memory array, the RAM capacity (in bytes) is allocated statically or dynamically. The use of response message fragment transmission delay values ​​to the SMB client, during which fragments of the authorization error response message will be sent to the SMB client, is used to increase the time of dialog interaction with an SMB client that has not successfully authorized on the SMS server, for example, as shown in Fig. 3.

[0055] Next, the pre-defined data is additionally specified (see block 1 in Fig. 3) as c - the counter of generated fragments into which the response message to the SMB client is divided, stored in the memory array Q. The counter of generated fragments into which the response message to the SMB client is divided allows for their accounting and tracking the moment of sending the last fragment of the response message, which are formed and sent with the generated delay time values ​​​​each, also for the purpose of increasing the duration of the dialog interaction with an unauthorized SMB client that has not passed authorization during the network interaction. Upon receipt of the last fragment of the response message, the unauthorized SMB client will be notified of an authorization error on the SMB server, but after a significantly longer time compared to the standard network interaction procedure.

[0056] After this, an S-memory array is additionally set into the pre-set data (see block 1 in Fig. 3) for storing the matrix of correspondence to the d-th fragment from the Q array. generated value of its delay time from the memory array R.

[0057] After establishing a TCP connection (see block 2 in Fig. 3) between the SMB client and the SMB server, receiving (see block 3 in Fig. 3) a message from the SMB client containing its identifiers for authorization on the SMB server, extracting (see block 4 in Fig. 3) the SMB client identifiers from it, comparing them (see block 5 in Fig. 3) with the reference identifiers of authorized SMB clients from the memory array W and granting the SMB client access to the SMB server (see block 20 in Fig. 3) if, based on the results of the comparison, the extracted SMB client identifiers correspond to the reference identifiers of authorized SMB clients from the memory array W, otherwise, when, based on the results of the comparison, the extracted SMB client identifiers do not correspond to the reference identifiers of authorized SMB clients from the memory array W, they form (see block 6 in Fig. 3) D fragments into which the response message about unsuccessful authorization of the client on the SMB server, sent to the SMB client, is divided.

[0058] Then, D fragments are stored (see block 7 in Fig. 3), into which the response message about unsuccessful authorization of the client on the SMB server, sent to the SMB client, is divided, in the memory array Q.

[0059] Then set (see block 8 in Fig. 3) the value of the counter from the generated fragments, into which the response message is divided, stored in the memory array Q, equal to D.

[0060] After this, L values ​​of the delay time are formed (see block 9 in Fig. 3) for each of the fragments into which the response message to the SMB client is divided.

[0061] Next, L values ​​of the delay time are stored (see block 10 in Fig. 3) for each of the fragments into which the response message to the SMB client is divided in the memory array R.

[0062] Then the corresponding values ​​of the d-th fragment from the Ql-th array of the generated delay time from the R-th array of memory are stored (see block 11 in Fig. 3) in the S-th array of memory.

[0063] At the next stage, the first of the D generated fragments of the response message is read from the Q memory array (see block 12 in Fig. 3) and the first of the L generated delay time values ​​is read from the R memory array.

[0064] Then the first of the D fragments of the response message is sent to the SMB client (see block 13 in Fig. 3) via the first of the R generated delay time values.

[0065] After this, the first of the D generated fragments of the response message and the first of the L generated delay time values, as well as the record of their correspondence, are deleted from the memory arrays Q, R and S, respectively (see block 14 in Fig. 3).

[0066] Then the value of the counter from the generated fragments of the response message stored in the memory array Q is reduced by one (see block 15 in Fig. 3).

[0067] At the next stage, the counter value is read (see block 16 in Fig. 3) from the generated fragments of the response message.

[0068] If the value of the counter c ≠ 0, which indicates that not all fragments of the response message have been sent to the SMB client, the next (d+1)-n of the previously generated D fragments of the response message are read (see block 12 in Fig. 3).

[0069] Then the next (d+1)th of the previously generated D fragments of the response message is sent (see block 13 in Fig. 3) the delay time value to the SMB client, and so on until the condition c=0 is met (see block 17 in Fig. 3), meaning that all fragments of the response message are sent to the SMB client.

[0070] If the SMB server receives a command from the SMB client to terminate the TCP connection after sending a response message (see block 18 in Fig. 3), the TCP connection for the SMB client is terminated by the SMB server (see block 19 in Fig. 3). In most cases, the command to terminate the TCP connection from the SMB client to the SMB server will not be sent, since attackers use specialized software and botnets to identify usernames and brute-force passwords. These tools operate automatically and are unable to intelligently respond to changes in the duration of the dialogue with security tools.

[0071] Otherwise, a message containing its identifiers for authorization on the SMB server is received again (see block 3 in Fig. 3) from the SMB client, a cycle of allocating the identifiers of the SMB client is performed, the allocated identifiers are compared with the reference identifiers of authorized SMS clients, its authorization on the SMB server, or, if the allocated identifiers of the SMB client do not match the identifiers of authorized SMB clients, fragments of a response message about an authorization error on the SMS server are sent at specified time intervals for the delay of these fragments.

[0072] In order to make it difficult for an attacker to calculate the algorithm of the information system protection system, the delay time value for each fragment of the response message to the SMB client is selected randomly within the range of 0.1 to 1 second.

[0073] To increase the time of dialog interaction with an attacker and make it difficult for them to calculate the algorithm of the information system protection system, the size of the fragments into which the response message to the SMB client is divided is selected randomly within the range of 1 to 2 bytes.

[0074] Thus, the claimed method achieves the stated goal of increasing protection effectiveness by reducing an attacker's ability to guess the names and passwords of authorized SMB clients, as well as to compromise and bypass information system security. This reduction in attacker ability to guess the names and passwords of authorized SMB clients is achieved by simulating a poor-quality communication channel, significantly increasing the time required to conduct password bruteforce attacks, by sending a fragmented authorization error response message to an SMB client that has failed successful authorization, with fragments sent at short delay intervals.The ability of an attacker to compromise information system security and bypass it is reduced by not blocking the connection to an SMB client that has not successfully authorized, by sending it through short delay intervals of varying sizes, eliminating the possibility of an attacker using small timeout values ​​and a fragmented response message from the SMB server about an authorization error.

Claims

1. A method for protecting information systems that consists of pre-setting N ≥ 1 reference identifiers of authorized SMB clients, t зад- the delay time after which the SMB client is given the opportunity to make another authorization attempt in the event of a previous unsuccessful attempt at its authorization on the SMB server, W is a memory array for storing reference identifiers of authorized SMB clients, establish a TCP connection between the SMB server and the SMB client, receive on the SMB server from the SMB client a message containing the identifiers of the SMB client for authorization on the SMB server, extract the identifiers of the SMB client from the received message, compare the extracted identifiers of the SMB client with the reference identifiers of authorized SMB clients from the memory array W, if the extracted identifiers of the SMB client match the identifiers of authorized SMB clients from the memory array W, grant the SMB client access to the SMB server, otherwise, if, according to the results of the comparison, the extracted identifiers of the SMB client do not correspond to the reference identifiers of authorized SMB clients from the memory array W,send a response message from the SMB server to the SMB client about an unsuccessful authorization attempt, after time t ≥ t, зад , again receive from the SMB client a message containing its identifiers for authorization on the SMB server, characterized in that the pre-set data additionally specifies Q - a memory array for storing d fragments into which the response message to the SMB client about an unsuccessful attempt at its authorization on the SMB server is divided, where d = 1, 2, ..., D, and D is the total number of generated fragments into which the response message is divided, R is a memory array for storing generated values ​​of the delay time for transmitting fragments of the response message to the SMB client about an unsuccessful attempt to authorize it on the SMB server, where a L is the total number of generated values ​​of the delay time for sending fragments of the response message, s is the counter of generated fragments into which the response message to the SMB client is divided, stored in the memory array Q, S is the memory array for storing the matrix of correspondence to the d-th fragment from the array Q the generated value of its delay time from the memory array R, after establishing a TCP connection between the SMB client and the SMB server, receiving from the SMB client a message containing its identifiers for authorization on the SMB server, extracting from it the SMB client identifiers, comparing them with the reference identifiers of authorized SMB clients from the memory array W and granting the SMB client access to the SMB server, if, according to the results of the comparison, the extracted SMB client identifiers correspond to the reference identifiers of authorized SMB clients from the memory array W, otherwise, when, according to the results of the comparison, the extracted SMB client identifiers do not correspond to the reference identifiers of authorized SMB clients from the memory array W, D fragments are formed, into which the response message about the unsuccessful authorization of the client on the SMB server sent to the SMB client is divided, D fragments are stored,into which the response message about the unsuccessful authorization of the client on the SMB server sent to the SMB client is divided, in the memory array Q, the value of the counter from the generated fragments, into which the response message is divided, stored in the memory array Q, is set equal to D, L values ​​of the delay time are formed for each of the fragments, into which the response message to the SMB client is divided, L values ​​of the delay time are stored for each of the fragments, into which the response message to the SMB client is divided in the memory array R, the correspondence to the d-th fragment from the array Q is stored in the memory array S, the generated value of its delay time from the memory array R, the first of the D generated fragments of the response message are read from the memory array Q and from the memory array R and the first of the L generated values ​​of the delay time, the first of the D fragments of the response message are sent to the SMB client through the first of the R generated values ​​of the delay time, the first of the D generated fragments of the response message and the first of the L generated values ​​of the delay time are deleted, as well as the record of their correspondence from the memory arrays Q, R and S, respectively, the value of the counter c of the generated fragments of the response message stored in the memory array Q is decreased by one, the value of the counter c of the generated fragments of the response message is read, if the value of the counter c ≠ 0, which indicates that not all fragments of the response message have been sent to the SMB client yet, the next of the previously generated D fragments of the response message is read,send the next (d+1)th of the previously formed D fragments of the response message through, the delay time value to the SMB client, and so on until the condition c=0 is met, meaning that all fragments of the response message have been sent to the SMB client; if the SMB server receives a command from the SMB client to terminate the TCP connection after sending the response message, the SMB server terminates the TCP connection for the SMB client; otherwise, a message containing its identifiers for authorization on the SMB server is again received from the SMB client, a cycle of allocating the SMB client's identifiers, comparing the allocated identifiers with the reference identifiers of authorized SMB clients, its authorization on the SMB server, or if the allocated identifiers of the SMB client do not match the identifiers of authorized SMB clients, sending fragments of the response message about an authorization error on the SMB server at specified intervals of delay time for these fragments.

2. The method according to paragraph 1, characterized in that the delay time value for each of the fragments of the response message to the SMB client is selected randomly within the range from 0.1 to 1 second.

3. The method according to paragraph 1, characterized in that the size of the fragments into which the response message to the SMB client is divided is selected randomly within the range of 1 to 2 bytes.

Images