The environment is changed by people, both unconsciously and consciously. The engineering and economic development of the environment is complemented by actions that involve deliberate destruction. Since 2014, units of the Russian army have been carrying out illegal military and terrorist actions on the territory of Ukraine, in particular, against critical infrastructure objects. The purpose of the article is to find ways to protect critical information infrastructure objects from cyber attacks. A universal way to counter cyber attacks is to decentralize the telecommunications network. A universal way to ensure the “decentralization” of a network is its hybridization, which ensures proper scalability. The values of signal parameters in a hybrid network depend on the physical nature of the signal and the transmission medium. Based on this, it may be logical to use a hybrid telecommunications network to protect against cyber attacks, which allows the selection of a channel with parameters that do not correspond to the harmful signal for the transmission of a useful signal.
The environment is changed by humans mainly unconsciously.
At the same time, the environment is changed consciously by humans—engineering and economic development of the natural and geological system leads to its qualitatively new natural and anthropogenic state.
But some actions imply deliberate destruction, both of infrastructure and the environment itself [1]. In late February and early March 2014, Russian army units occupied the Crimean peninsula. In mid-April 2014, a conflict broke out in Donetsk and Luhansk regions between the armed groups of the Donetsk and Luhansk “people’s republics” on the one hand, and Ukrainian law enforcement officers with the involvement of the Armed Forces of Ukraine on the other. On February 24, 2022, Russian President vladimir putin announced a military operation on the territory of Ukraine; a few minutes later, missile attacks began. Russian troops invaded Ukraine, entering from Russia, Belarus, and the temporarily occupied Crimea. There is an obvious threat of an increase in the number of emergencies related to illegal acts of terrorism, as well as military emergencies related to the consequences of the use of weapons.
At the end of 2022, Russian troops launched attacks on critical electricity infrastructure. Drones and missiles hit 40% of Ukraine’s energy facilities [2]. All thermal and hydroelectric power plants suffered varying degrees of damage [3]. The total damage in the energy and extractive sector is estimated at approximately $10.6 billion; aggregate economic, social, and other monetary losses totaled almost $27.2 billion [4]. On 6 June, Russian occupation forces blew up the dam of the Kakhovka hydroelectric power station.
As a result of military-terrorist actions, the total loss in the telecommunications and digital sector is estimated at approximately 1.6 billion US dollars; combined economic, social, and other monetary losses amount to almost 1.6 billion US dollars.
The sustainable functioning of the system of
interconnected critical infrastructure facilities
is ensured by the critical information
infrastructure of these facilities. The critical
information infrastructure of Ukraine’s energy
sector has become the second springboard of
warfare, and cyber-attacks are a full-fledged
component of this aggression. Ukraine’s
energy sector had been subject to Russian
cyberattacks before 24 February 2022, but
with the start of the full-scale invasion, the
number of attacks increased significantly. Last
year, the Operational Security Centre of the
transmission system operator recorded more
than 1.5 million corresponding blockages of
attempts to attack the industry [
The purpose is to find ways to protect critical information infrastructure facilities from cyber threats of military and terrorist origin.
According to the classic scheme, authentication data is separated for each service separately. The result of the Li login will be a value determined by a separate function for each service:
= ( , ), where IDi is the user ID in a specific service; AUi is a secret; F() is a service-side authentication data verification function; Si is the corresponding service.
To ensure the hidden secret, you can add its hashing: = ( , ℋ( )).
The type of hashing function ℋ() can be any, the main thing is that it matches both on the user side and on the server side.
This approach creates a burden on the user to store authentication pairs for all services. Each service can have its own open session time, which obliges the user to transfer their data each time. On the other hand, each service must maintain a base of trusted users. With the increase in storage locations, the number of vulnerable repositories increases. And since users simplify their lives and create the same authentication pairs for different services, the hacking of one of the services indirectly compromises others.
It should be noted that some users use
password managers, but in this case, if an
attacker gains unauthorized access to the
password manager [
One of the ways to ensure the uniformity of
passwords is to transfer the function of the
password manager to a separate service that is
located in the middle of the infrastructure of
one organization, for example, identity
provider, or in the role of a third party, for
example, according to the OAuth 2.0 [
If the services are combined into one information system, then the need to save separate authentication pairs for access to different services S of the same information system recedes into the background. It remains sufficient to perform one login through the security gateway: | = ( , ℋ( )), = [ 1, 2, … , ],
∈ .
The zero trust security model postulates the separation of access not only at the login level for the security loop of the information system but also defines the levels of access to each service:
| = ( , ℋ( )), = [( 1, 1), ( 2, 2), … , ( , )],
∈ , where Ri is the role of the user in the service Si.
If a user can have several levels of access/roles in different services, then to switch between roles it is necessary to go through the re-login procedure or use several access media, for example, for web systems it can be different browsers or different instances of the same browser.
On the other hand, a single service may accept more than one identifier from a single user, such as an email address or phone number. In this case, instead of a single identifier, an ID array of identifiers should be used:
Different AU secrets can be applied to multiple IDs at the same time, such as password, fingerprint scan, face or retina image, etc. This method allows you to use multiple secrets of the same type, for example, multiple fingerprints. Therefore, the general formula has the form:
The novelty of this method is that it is not important for the authentication service which identifier and which secret were sent. Thus, any communication by any communication channel is allowed. As a result, the authentication system becomes more universal, and the influence of temporarily unavailable methods of transmitting identifiers and secrets is reduced.
According to the definition, information
security objectives are confidentiality, data
integrity, authentication (entity and data
origin), and non-repudiation (for example, [
Thus, the probability of violation of the
functional properties of Critical Information
Infrastructure (CII) takes into account the
classes of threats to its security:
4
P = 1 − (1 − qi ) ,
i=1
(1)
where q1 is the probability of a breach of
confidentiality (protection of data from
unauthorized reading by unauthorized
persons, entities, or processes); q2 is the
probability of a breach of data integrity (the
ability to detect any modifications, insertions,
or deletions that affect the correctness of the
data stored in the information resource); q3 is
the probability of breach of authentication
security (protection against unauthorized use
of the resource); q4 is the probability of breach
of non-failure security (security when a
participant in the interaction cannot
successfully deny the performance of certain
actions) [
According to practice, the analysis of
possible threats is carried out during the
design, modernization, and reconstruction of
CII. The synthesis of measures aimed at
reducing damage is usually carried out for
individual threats [
A universal way to counter cyber threats is
to decentralize the telecommunications
network [
A universal way to ensure the “decentralization” of the network is its hybridization, which ensures proper scalability.
Fig. 1 shows a diagram of a hybrid
telecommunications network consisting of a
hierarchical sequence of multiplexers.
According` to the functional diagram,
communication channels are described by a
dependency of the form [
According to the scheme shown in Fig. 1, a
hybrid telecommunications network, in
addition to frequency (the same as spectral,
with wavelength division) and time division
multiplexing, supports multiplexing of
communication channels with division by
physical nature and transmission media.
Table 1 shows the matrix of their
correspondence.
The values of signal parameters in a hybrid
network depend on the physical nature of the
signal and the transmission medium [
Based on this, it may be logical to use a hybrid telecommunications network to protect against cyber attacks, which allows the selection of a channel for the transmission of a useful signal with indicators that do not correspond to the malicious signal through which the malicious code is distributed. Protection in the event of an attack is provided by changing the physical nature of the useful information signal and/or its transmission medium.
Decentralized control systems provide an
effective solution to many problems of
managing large-scale industrial processes.
They are more effective in terms of cyber
attacks than distributed and centralized
control systems [
A decentralized authentication and access
control protocol addresses broader data
privacy and security needs [
Different values of signal parameters in a hybrid telecommunications network decentralized through the use of channels and channel sections (communication lines, telecommunications equipment) with signals of different physical nature is a feature of a hybrid telecommunications network. This determines the feasibility of choosing a channel from the available list of existing ones in the event of a cyber attack or cyber threat. Protection is achieved by changing the physical nature of the useful information signal and/or its transmission medium.