METHODS TO ENHANCE THE GUARANTEED PROTECTION OF PERSONAL DATA IN APPLIED INTERNET SYSTEMS - Zander, Kostiantyn; Gnatyuk, Viktor (Science-based technologies, 2025)
Existing protection technologies for the operational environment of applied systems do not fully prevent unauthorized actions by administrators with the highest levels of authority, as they do not ensure complete process controllability. This undermines user trust in the guaranteed protection of their personal data. The most effective way to safeguard the operational environment from external threats is complete isolation. For critical applied applications, this isolation must meet the guarantee criteria of ND TZI 2.5-004-99 at the G-7 level. Ensuring full controllability of this isolation is essential, which is achievable only in internet systems with a transparent software-hardware environment. It is proposed that the structure of critical applied systems be transparent, and their Functional Protection Profile (FPP) should include an observability service specification according to ND TZI 2.5-004-99. Guaranteeing the correct implementation of this functionality at the G-7 level is a key factor in ensuring client trust. Additionally, the use of theoretically perfect protection methods is substantiated, providing absolute resistance to confidentiality breaches under certain conditions. The corresponding access delimitation rules (ADR) are synthesized, which provide clients with the ability to control the actions of system administrators throughout the entire time the system provides services to its clients. In general, the characteristics of the developed structure, ADR, threat model, protection model, as well as the specifications of the guarantees of such protection allow us to conclude that in the case of practical implementation of the above-mentioned works, the achieved level of guaranteed protection will be sufficient to hope for the unquestionable trust of clients of applied Internet systems regarding the guarantees of protection of their personal data.