KR100415554B1 - Method for transmitting and receiving of security provision IP packet in IP Layer - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

The present invention relates to a method of transmitting and receiving information protected Internet protocol packets and a computer readable recording medium having recorded thereon a program for realizing the method.

2. Technical problem to be solved by the invention

The present invention provides a method and method for transmitting and receiving information protection Internet protocol packets to provide an information protection service for each packet in an IP layer that can be independently implemented and operated without affecting a program in an application layer service. The purpose is to provide a computer-readable recording medium that records the program.

3. Summary of Solution to Invention

The present invention relates to a method for transmitting an information protection internet protocol packet applied to an apparatus for transmitting an information protection internet protocol (IP) packet, wherein after generating an IP header of the packet, a security policy database and a security association database are referred to. A first step of determining whether to select a security service for each packet; If the security service selected in the first step is AH (Authentication Header), authentication data (ICV) calculation and generation of SN (Sequence Number) values for the packet are performed, and the tunnel header or the transport header is generated. A second step of generating and calculating the IP packet fragmentation and the check sum of the IP header, and then transmitting the information protection IP packet to which the data link header is added; And if the security service selected in the first step is an encapsulating security payload (ESP), after performing encapsulation, padding, and encryption processing on the packet, calculating authentication data (ICV) values and performing SN ( And a third step of generating the tunnel header or the transport header to calculate the IP packet fragmentation and the check sum of the IP header, and then transmitting the information protection IP packet with the data link header. do.

4. Important uses of the invention

The present invention is used for information protection services through the IP layer in the Internet.

Description

Method for transmitting and receiving information security Internet protocol packet {Method for transmitting and receiving of security provision IP packet in IP Layer}

The present invention relates to a method for transmitting and receiving an information security Internet Protocol (IP) packet, and more particularly, information for generating and transmitting a security packet for each packet in the Internet protocol layer without affecting an application layer service program. A method of transmitting and receiving a protected Internet protocol packet and a computer-readable recording medium having recorded thereon a program for realizing the method.

In the conventional information protection technology through the Internet, methods of performing information protection for each service of an application layer have been used. These methods are made in the form of creating a method for protecting user information for each service of the application layer, and directly called by the service program of the application layer, which will be described in detail with reference to the drawing shown in FIG.

1 is a diagram illustrating a protocol stack of a conventional Internet system.

As shown in Fig. 1, the structure of the protocol stack shows a vertical connection to the upper layer network application and the physical layer where the lower network media is located. The user's application goes through the Berkeley Software Distribution (BSD) socket layer (10) and the INET (InterNET) socket layer (11) of the system kernel to communicate with other systems. Abbreviated as "TCP" (12), User Datagram Protocol (abbreviated as "UDP") 13, Internet Control Messages Protocol (hereinafter referred to as "ICMP") After passing through the Internet Group Multicasting Protocol (hereinafter abbreviated as "IGMP") and commonly passing through the IP layer 16, an IP packet which is a basic communication unit of the Internet is created.

The IP packet is abbreviated as Point-to-Point Protocol (hereinafter referred to as "PPP") and Serial Line Interface Protocol (hereinafter referred to as "SLIP") according to data link layer protocol characteristics. As network device driver layers such as Ethernet and Ethernet are added, additional network headers are added to IP packets and then exported to the Internet.

These conventional Internet information protection methods mean that there is an information protection method for each Internet service, and in order to provide information protection in the Internet service, it is necessary to change the application layer service program. Therefore, not only does it incur much economic expenditure for users and Internet service providers, but also requires an independent information protection method for each application layer service, and requires an additional change of each application layer service program.

Accordingly, the present invention has been proposed to solve the above-mentioned conventional problems, and provides an information protection service for each packet in an IP layer that can be independently implemented and operated without affecting a program in an application layer service. An object of the present invention is to provide a method of transmitting and receiving information protected Internet protocol packets and a computer-readable recording medium having recorded thereon a program for realizing the method.

1 is a protocol stack structure diagram of a conventional Internet system.

2 is a protocol stack structure diagram for an information protection Internet protocol packet to which the present invention is applied.

3A and 3B are structural diagrams of one embodiment of an information protection IP packet generated in the protocol stack structure shown in FIG.

4A is a detailed structural diagram of the AH protocol header shown in FIG. 3A.

4B is a detailed structural diagram of the ESP protocol header shown in FIG. 3B.

Figure 5 is a configuration diagram of an embodiment of a method for transmitting and receiving an information protection Internet protocol packet to which the present invention is applied.

6 is a flowchart illustrating an embodiment of a method for transmitting / receiving an information security internet protocol packet according to the present invention.

FIG. 7 is a detailed flowchart of an embodiment of a procedure H1 for transmitting, by the transmitting host terminal shown in FIG. 6, the generated information protection Internet protocol packet to the Internet.

8A and 8B are detailed flowcharts of one embodiment of a procedure (H2) in which the gateway shown in FIG. 6 forwards an information protection Internet protocol packet to a receiving host terminal.

FIG. 9 is a detailed flowchart of an embodiment of a procedure H3, in which a receiving host terminal shown in FIG. 6 receives an information protection Internet protocol packet.

In order to achieve the above object, the present invention provides a method for transmitting an information protection internet protocol packet applied to a device for transmitting an information protection internet protocol (IP) packet, wherein the security policy is generated after generating an IP header of the packet. Determining whether to select a security service for each packet by referring to a database and a security association database; If the security service selected in the first step is AH (Authentication Header), authentication data (ICV) calculation and generation of SN (Sequence Number) values for the packet are performed, and the tunnel header or the transport header is generated. A second step of generating and calculating the IP packet fragmentation and the check sum of the IP header, and then transmitting the information protection IP packet to which the data link header is added; And when the security service selected in the first step is an encapsulating security payload (ESP), after performing encapsulation, padding, and encryption processing on the packet, calculating an authentication data (ICV) value and a sequence number (SN) value. And performing a generation of the tunnel header or the transport header to calculate the IP packet fragmentation and the check sum of the IP header, and then transmitting the information protection IP packet appended with the data link header. do.

The present invention also provides a method of forwarding an information protection internet protocol packet applied to a device for forwarding an information protection internet protocol (IP) packet, the security policy database and a security association database through the received information protection packet. A first step of determining whether to select a packet-specific security service with reference to; A second step of determining whether a type of security service is a tunnel mode when a packet-specific security service is selected in the first step; As a result of the determination of the second step, in the tunnel mode, whether the service type is AH (Authentication Header) or ESP (Encapsulating Security Payload), the packet is encapsulated (encapsulation), padding, A third step of performing encryption processing, authentication data (ICV) calculation and generation of SN (sequence number) values, and forwarding the packet with the tunnel header or the transport header forwarded to the information protection IP packet; ; A fourth step of judging whether the authority of the packet user has a root authority when the determination result of the second stage is not in the tunnel mode; A fifth step of discarding the packet when the authority of the user does not have the root authority as a result of the determination of the fourth step; A sixth step of judging whether the authority of the user is an endpoint of the security association as a result of the determination of the fourth step; As a result of the determination of the sixth step, when the endpoint of the security association, the SN value and the authentication data (ICV) value included in the packet header are examined, and the type of security service is AH (Authentication Header) or ESP (Encapsulating Security). Payload) and refer to packet decryption, pad removal, decapsulation, and security policy database according to the type of service, and forward information protection IP packets after removing the tunnel header or transport header. 7 steps; As a result of the determination in the sixth step, if the security association is not an endpoint, the security service may be classified as an authentication header (AH) or an encapsulating security payload (ESP), and the encapsulation for the packet may be performed according to the service type. encapsulation, padding, encryption processing, authentication data (Integrity Check Value (ICV)) calculation and generation of SN (Sequence Number) values, and forwarding information protection IP packets with the addition of a tunnel header or a transport header. And an eighth step.

In addition, the present invention is a method for receiving an information protection internet protocol packet applied to a device for receiving an information protection internet protocol (IP) packet, comprising: security association data after receiving an IP packet completed by recombination for the packet A first step of determining whether to select a packet-based security service by referring to the base; When the security service is selected, the second step of checking the SN value and the Integrity Check Value (ICV) value carried in the packet header and determining whether the security service is an Authentication Header (AH) or an Encapsulating Security Payload (ESP) ; As a result of the determination of the second step, if the type of security service is AH (Authentication Header), the processing of the currently received information protection packet is examined by referring to the security policy database, and after removing the tunnel header or the transport header, Removing an IP header to receive an information protection IP packet; And as a result of the determination of the second step, when the type of the security service is ESP, processing the currently received information protection packet by referring to the security policy database after decoding the packet, removing the pad, and decapsulating the packet. Inspecting, removing the tunnel header or the transport header, and then removing the IP header again to receive the information protection IP packet.

In addition, the present invention is a method for transmitting and receiving information protection Internet Protocol packet applied to a network system for transmitting and receiving information protection Internet Protocol (IP) packet over the Internet, the IP of the packet to be transmitted by the transmitting terminal device A first step of generating a (Internet Protocol) header and determining whether a security service for each packet is selected, and transmitting the information protection IP packet generated in units of frames according to the type of security service; Tunnel header or transport header for deciding packet decode, pad removal, decapsulation and security policy database according to the type of packet-specific security service selected by the gateway of the Internet. A second step of forwarding the generated information protection IP packet to the receiving terminal device; And decryption, pad removal, decapsulation, and security policy database of the IP packet according to whether and the type of security service for each packet determined in the forwarded information protection IP packet is determined by the receiving terminal device. And removing the port header and removing the IP header again to receive the information protection IP packet.

On the other hand, in order to achieve the object of the present invention, after generating the IP header of the packet in the terminal device having a processor for transmitting the information protection Internet Protocol (IP) packet, the security policy database and the security association database A first function of deciding whether to select a security service for each packet with reference to; When AH (Authentication Header) is selected as the security service selected in the first function, calculation of authentication data for the packet and generation of SN value are performed, and a tunnel header or a transport header is generated to check IP packet fragmentation and IP header. A second function of sending an information protection packet appending a data link header after calculating the sum; In case the security service is selected as ESP (Encapsulating Security Payload) in the first function, after performing encapsulation, padding, and encryption processing on the packet, authentication value (Integrity Check Value (ICV) value calculation and SN (Sequence) are performed. A third function of generating a value), generating a tunnel header or a transport header to calculate an IP packet fragmentation and a check sum of the IP header, and then transmitting an information protection packet appended with a data link header; And when the security service is not selected for each packet, generating a tunnel header or a transport header to calculate an IP packet fragmentation and a check sum of the IP header, and then transmitting an information protection packet in units of frames appended with a data link header. And a computer readable recording medium having recorded thereon a program for realizing the four functions.

In addition, the present invention provides a gateway device having a processor for forwarding an information protection Internet Protocol (IP) packet to each packet by referring to a security policy database and a security association database through the received information protection packet. A first function of determining whether to select a security service; A second function of determining whether a type of security service is a tunnel mode when a packet-specific security service is selected in the first function; As a result of the determination of the second function, in the tunnel mode, whether the service type is AH (Authentication Header) or ESP (Encapsulating Security Payload (ESP)) is classified, and according to the type of service, encapsulation, padding, A third function of performing encryption processing, authentication data (Integrity Check Value (ICV)) calculation, and generation of SN values, and forwarding the packet with the tunnel header or the transport header to the information protection packet; A fourth function of judging whether the authority of the packet user has a root authority when the second function is not determined in the tunnel mode; A fifth function of discarding the packet if the authority of the user does not have the root authority as a result of the determination of the fourth function; A sixth function that determines whether the security association is an endpoint when a user's authority has root authority as a result of the determination of the fourth function; As a result of the determination of the sixth function, when the endpoint of the security association, the SN value carried in the packet header and the authentication data (Integrity Check Value (ICV)) value are examined, and whether the type of security service is AH or ESP, A seventh function of referencing packet decryption, pad removal, decapsulation and security policy database according to the kind, and forwarding the information protection packet after removing the tunnel header or the transport header; As a result of the determination in the sixth function, if the security service is not an endpoint, the security service may be classified into an authentication header (AH) or an encapsulating security payload (ESP), and the encapsulation of the packet may be performed according to the service type. encapsulation, padding, encryption processing, authentication data (Integrity Check Value (ICV)) calculation and generation of SN values, and an eighth function of forwarding an information protection packet added with a tunnel header or a transport header is realized. And a computer readable recording medium having recorded thereon a program for the purpose of the recording.

In addition, the present invention, after receiving the IP packet completed by the recombination to the packet to the terminal device having a processor for receiving the information protection Internet Protocol (IP) packet packet by referring to the security association database A first function of determining whether to select a specific security service; When the security service is selected, a second function that checks the SN value and the authentication data (ICV) value carried in the packet header and determines whether the security service is an authentication header (AH) or an encapsulating security payload (ESP). ; As a result of the determination of the second function, if the type of security service is AH (Authentication Header), the processing of the currently received information protection packet is examined by referring to the security policy database, and after removing the tunnel header or the transport header, A third function of receiving an information protection packet at the IP layer by removing the IP header; As a result of the determination of the second function, when the type of security service is ESP, after processing of packet decryption, pad removal, and decapsulation, the processing of the currently received information protection packet is examined with reference to the security policy database. A fourth function of removing the tunnel header or the transport header, and then removing the IP header to receive the information protection packet at the IP layer; And removing the IP header and the TCP header of the received packet when the security service is not selected, and then recording a program for realizing a fifth function of receiving the packet through the INET socket and the communication socket. Characterized in providing.

In addition, the present invention, in the network system having a processor for transmitting and receiving information security Internet Protocol (IP) packet, after generating the IP header of the packet to be transmitted by the sending terminal device, A first function of determining whether to select and transmitting the information protection IP packet generated according to the type of security service, respectively, to the Internet; Tunnel header or transport header for deciding packet decode, pad removal, decapsulation and security policy database according to the type of packet-specific security service selected by the gateway of the Internet. A second function of forwarding the generated information protection IP packet to the receiving terminal device; And decryption, pad removal, decapsulation, and security policy database of the IP packet according to whether the receiving terminal device receiving the information protection IP packet forwarded by the second function is selected and the type of the security service for each packet. The present invention provides a computer-readable recording medium having recorded thereon a program for realizing a third function of receiving an information protection packet by removing an IP header after removing a tunnel header or a transport header.

The objects, features and advantages described above will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a protocol stack structure diagram for an information protection Internet protocol packet to which the present invention is applied.

As shown in FIG. 2, the protocol stack structure for the information protection IP packet in the IP layer of the Internet, for the information protection service for each packet in the IP layer that can be independently implemented and operated without affecting the application layer service program. An IPsec layer 27 was added to a portion of the IP layer 26.

In other words, the user's application program passes through the BSD socket layer 20 and the INET socket layer 21 of the system kernel for communication with other systems, such as TCP (22), UDP (23), ICMP (24), By passing through the IGMP 25 and commonly passing through the IP layer 26, an IP packet, which is a basic communication unit of the Internet, is created. In the IPsec layer 27, information protection for all packets passing through the IP layer 26 is made. It has a function of applying and releasing a service, and the packet received from the lower layer is processed by the function of releasing the information protection service and then delivered to the existing IP layer 26, and the packet received from the IP layer 26 is After the packet is changed by the function of applying the information protection service, an additional network header is added to the information protection IP packet as the data link layer passes through the PPP (28), the SLIP (29), and the Ethernet (30). After the Internet Will be exported.

3A and 3B are structural diagrams of an embodiment of an information protection IP packet generated at an IP layer in the protocol stack structure shown in FIG.

FIG. 3A is a structure including an authentication header (AH) protocol for providing an authentication service for an IP header in an information protection IP packet to be applied in an IPsec layer, and includes an authentication service for an IP header and a confidentiality service for an IP packet. There is a transport mode to provide only the basic services of A and a tunnel mode to add a function for hiding source information of a packet. In addition, the AH protocol uses a sequence number (hereinafter, abbreviated as "SN") value for endurance service for retransmission attack. Therefore, by checking the SN value for packets continuously received at the receiving side, it is possible to discard the retransmitted packet and maintain a stable system from retransmission attacks.

3B is a structure including an Encapsulating Security Payload (ESP) protocol for providing an authentication service for an IP header in an information protection IP packet to be applied in an IPsec layer. The ESP protocol includes an authentication service and an IP packet for an IP header. There is a transport mode for providing only basic services such as a confidentiality service, and a tunnel mode for adding a function for hiding source information of a packet. In addition, all of the ESP protocols use a sequence number (SN) value for endurance service for retransmission attacks. Therefore, by checking the SN value for packets continuously received at the receiving side, it is possible to discard the retransmitted packet and maintain a stable system from retransmission attacks.

4A is a detailed structural diagram of the AH protocol header shown in FIG. 3A.

As shown in Fig. 4A, the structure of the AH protocol header is the type of header to appear after the AH protocol, the length of the payload, and the SPI (Security Parameter Index) required for searching the security association database. It consists of authentication data which is the core of SN and AH protocol for tolerance to retransmission attack.

4B is a detailed structural diagram of the ESP protocol header shown in FIG. 3B.

As shown in Fig. 4B, the ESP protocol header includes a security parameter index for searching a security association database, a sequence number (SN) for tolerance to retransmission attacks, payload data from a higher layer, and a block cipher algorithm. Padding for encryption processing, pad length, header type to appear after the ESP header, and authentication data.

5 is a diagram illustrating an embodiment of a system for transmitting and receiving information protection IP packets generated in an IP layer of the Internet to which the present invention is applied.

As shown in FIG. 5, the system includes a transmitting host terminal 510, a gateway 520, and a receiving host terminal 530. The gateway 520 forwards through the Internet 530.

The transmitting host terminal 510 transmits the information protection IP packet, which is generated by adding encryption and authentication information to the packet received from the application layer, to the Internet 530 through the data link layer.

The gateway 520 is located in a path between the transmitting host terminal 510 and the receiving host terminal 540 via the Internet 530, and receives the information protection IP packet transmitted from the transmitting host terminal 510. Forward to).

The receiving host terminal 540 receives the information protection packet forwarded and transmitted from the gateway 520 to perform decryption and verification of authentication information.

6 is a flowchart of an embodiment of a method for transmitting / receiving an information protection IP packet generated at an IP layer of the Internet according to the present invention.

As shown in FIG. 6, first, a transmitting host terminal 510 receives a packet from an application layer (601), and generates an information protection packet in which encryption and authentication information is added to the received packet (602).

In other words, for the AH protocol header that selects a security service, authentication data is calculated at the packet destination, and then an information protection packet that has undergone packet fragmentation is generated, and for the ESP protocol header, encapsulation and padding of the packet is performed. After encrypting, encryption is performed, and an information protection packet in which authentication information is added to the encrypted packet is generated.

Thereafter, the information protection packet generated as described above is added to the data link header and transmitted to the gateway 520 through the Internet 530 in units of frames (603).

At this time, the transmitted frame information protection packet is received at the gateway 520 of the Internet 530, the gateway 520 removes the data link header from the received information protection packet and performs the forwarding (604, 605).

That is, when the security service is selected for the information protection packet from which the data link header is removed, packet encryption and decryption are performed according to the AH protocol header and the ESP protocol header, and the information protection packet, which is a frame unit to which the data link header is added, is again connected to the Internet. And transmits to 530 (606). Then, the information protection packet is transmitted to the receiving host terminal 540 by the forwarding operation of the gateway 520 of the Internet 530.

The receiving host terminal 540 then receives the forwarded information protection packet from the gateway 520 of the Internet 530, deletes the data link header from the information protection packet (607), and secures the deleted information protection packet. The authentication data is checked according to whether the service is selected, and the decryption and authentication information is checked according to the type of the protocol header, that is, the AH protocol header and the ESP protocol header (608). Thereafter, the received data is transmitted to the application layer above the receiving host terminal 540 (609).

FIG. 7 is a detailed flowchart of an embodiment H1 of transmitting the generated information protection IP packet to the Internet by the host terminal illustrated in FIG. 6.

As shown in FIG. 7, when the upper application exports arbitrary information through the Internet 530, first, a socket for communication is created in the socket layer (701), and then an INET socket is generated (702). Through this INET socket 702, data of the application layer is sent down to the TCP layer. Then, the TCP layer adds the TCP header to the message from the upper application layer and then sends it down to the IP layer (703). At this time, the IP layer assembles an IP packet by adding an IP header to data coming from the TCP layer (704 and 705).

As described above, after the packet of the IP layer is assembled, the security policy database and the security association database are searched to determine whether the security service is selected (706).

As a result of the determination in step 706, when the security service is not selected, the tunnel header or the transition port header generated in the IP packet is added (713), and the IP header fragmentation process 714 passes through the check sum of the IP header ( After the checksum is calculated (715), the IP packet is sent down to the data link layer, and the data link layer transmits data in units of frames added with a data link header according to a transmission path characteristic of the physical layer (716).

On the other hand, as a result of the determination in step 706, when the security service is selected, it is determined whether the security service of the security association database, that is, AH service or ESP service (707). As a result of the determination in step 707, when AH service is selected, ICV (Integrity Check Value: abbreviated as "authentication data value") is calculated so that authentication data can be calculated at the packet destination and compared with the original value. Calculate (711). In order to prevent retransmission attacks, SN values are generated and inserted into AH headers, and transport or tunnel headers are added to IP packets (712, 713), and packet fragmentation is performed to calculate checksums of IP headers. Then, the data link layer is sent down to the data link layer (714,715), and the data link layer generates a frame to which the data link header is added according to the transmission path characteristics of the physical layer, and transmits it to the Internet (716).

On the other hand, as a result of the determination in step 707, when the ESP service is selected, after encrypting the packet, the packet is encrypted after padding so that the length of the data can be applied to the block encryption algorithm. (708, 709, 710). After the packet encryption is completed, the authentication data value is calculated to calculate the authentication data at the packet destination and then compared with the original value (711), and the SN value is generated to generate the SN value to prevent retransmission attacks. After adding the transport or tunnel header to the IP packet (712,713), the packet summarization process calculates the checksum of the IP header and sends it down to the data link layer (714,715). After generating a frame to which a data link header according to a transmission path characteristic of a physical layer is added, the frame is transmitted to the Internet (716).

8A and 8B are detailed flowcharts of one embodiment of a procedure H2 of forwarding of an information protection IP packet by a gateway of the Internet shown in FIG. 6.

As shown in FIGS. 8A and 8B, when a frame including an information protection IP packet is received at the gateway 520 of the Internet 530, the received frame is removed after the data link header is removed from the data link layer. Upload to hierarchy (800). Then, the frame uploaded to the IP layer performs IP forwarding to search the security policy database and the security association database (801, 802). In this case, as a result of the search, it is determined whether the security service is selected (803). If the security service is not selected as the result of the process (803), the data link layer is changed after changing the value of the IP header using routing information. Send it down. Then, the data link layer generates a frame to which the data link header is added according to the transmission path characteristics of the physical layer and transmits the frame to the Internet (822, 823).

On the other hand, if the security service is selected as a result of the determination in step 803, it is determined whether the type of security service is the tunnel mode (804). As a result of the determination in step 804, when the type of the security service is in the tunnel mode, the process proceeds to step 807 for identifying the type of security service.

As a result of the determination in step 804, if the security service is not in the tunnel mode, that is, in the transport mode, it is determined whether the user of the packet is the route (805). If not, discard the packet (814), and if it is the root proceeds to step 806 to determine whether or not the end of the security association. In this case, if it is not the end of the security association, the process proceeds to step 807 of identifying the type of security service.

Therefore, if the type of security service is AH service in step 807, the authentication data value is calculated to be compared with the original value after calculating the authentication data at the packet destination (811), and the retransmission attack is prevented. An SN value is generated and inserted into the AH header, and then the transport or tunnel header is added to the IP packet (812, 813). In operation 822, the IP header is changed using the routing information and then the IP header value is changed to the data link layer. Accordingly, the data link layer generates a frame to which a data link header according to a transmission path characteristic of the physical layer is added and transmits the frame to the Internet (823).

On the other hand, if the type of security service is an ESP service in step 807, after encapsulating the packet, padding is performed after padding so that the length of the data can be applied to the block encryption algorithm. (808, 809, 810). After the packet encryption is completed, the authentication data value is calculated to calculate the authentication data at the packet destination and then compared with the original value (811), and an SN value is generated to generate an SN value to prevent retransmission attacks. After inserting the packet into the packet (812), the transport header or tunnel header is added to the IP packet, and then the IP header is changed using routing information through IP forwarding and then sent down to the data link layer (813, 822). The data link layer generates a frame to which a data link header according to a transmission path characteristic of the physical layer is added and transmits the frame to the Internet (823).

On the other hand, as a result of the determination in step 806, in the case of the termination of the security association, the SN value is examined to determine the possibility of the retransmission attack (815), and after generating authentication data using the contents of the received packet In operation 816, the process compares the ICV value in the AH or ESP header. In this case, when the inspection of the SN value and the authentication data (ICV) value is completed successfully, the security service type of the security association database is determined (817).

As a result of the determination in step 817, if the AH service is selected, the tunnel header or transport header is removed and then sent down to the data link layer (111). Then, the data link layer generates a frame to which the data link header is added according to the transmission path characteristics of the physical layer and transmits the frame to the Internet (822, 823).

As a result of the determination in step 817, when the ESP service is selected, the packet is decrypted (818), the pad added for the block cipher algorithm processing is removed, and the packet is decapsulated (818, 819, 820). . That is, after decrypting the encrypted packet as described above, the packet is reproduced as a packet before encryption, and then the IP header is changed using routing information in IP forwarding and then sent down to the data link layer (821). Then, the data link layer generates a frame to which the data link header is added according to the transmission path characteristics of the physical layer and transmits the frame to the Internet (822, 823).

FIG. 9 is a detailed flowchart of an embodiment H3 of a receiving host terminal shown in FIG. 6 receiving an information protection IP packet.

That is, after receiving the frame through the gateway 520 of the Internet 530, the receiving host terminal 540 removes the data link header from the data link layer and uploads it to the IP layer (900). Then, the IP layer receives the IP packet in the IP layer after recombining the fragmented packet into one packet through a packet recombination process (901, 902). In this case, the received IP packet searches the security association database (903), and determines whether the security service is selected as a result of the search (904).

As a result of the determination in step 904, if the security service is not selected, the IP header is removed and then uploaded to the TCP layer (913), and the TCP layer is removed from the TCP header (914), through the INET socket and the communication socket. Transmission to the higher application layer (915, 916).

As a result of the determination in step 904, if the security service is selected, the SN value is examined to determine the possibility of the retransmission attack (905), and the authentication data is generated using the contents of the received packet to generate the AH header or ESP. The process of comparing the authentication data value in the header is performed (906). In this case, when the inspection of the SN value and the ICV value is completed, the type of security service of the security association database is identified, that is, whether the security service is an AH service or an ESP service (907).

As a result of the determination in step 907, when the AH service is selected, the tunnel header and the transport header are removed by referring to the security policy database, and the IP header is removed by checking whether the currently received packet has been processed according to the security policy. 911, 912, 913), which is sent to the TCP layer to remove the TCP header (914). The INET socket and the communication socket are created and transmitted to the upper application layer (915, 916).

On the other hand, as a result of the determination in step 907, when the ESP service is selected, the packet is decrypted (908), the pad added for the block cipher algorithm processing is removed, and the packet is decapsulated (decapsulation) ( 909,910). After replaying the encrypted packet through the decryption process of the encrypted packet (911), the TNC removes the tunnel header and the transport header by referring to the security policy database and checks whether the currently received packet is processed according to the security policy. After removing the IP header (912, 913), it is sent to the TCP layer to remove the TCP header (914). In operation 915 and 916, the INET socket and the communication socket are transmitted to the upper application layer.

The method of the present invention as described above may be implemented in a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the stated embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be evident to those who have knowledge of.

As described above, the present invention selectively provides an information protection service in the process of transforming a message generated from a higher application layer into an IP packet that can be transmitted through the Internet, thereby changing the upper layer service program to all Internet services. It has the effect of providing information protection.

Claims (21)

A transmission method of an information protection Internet Protocol (IP) packet applied to a device for transmitting an information protection Internet Protocol (IP) packet, Generating a packet IP header and determining whether to select a security service for each packet by referring to a security policy database and a security association database; If the security service selected in the first step is AH (Authentication Header), authentication data (ICV) calculation and generation of SN (Sequence Number) values for the packet are performed, and the tunnel header or the transport header is generated. A second step of generating and calculating the IP packet fragmentation and the check sum of the IP header, and then transmitting the information protection IP packet to which the data link header is added; And When the security service selected in the first step is an encapsulating security payload (ESP), after performing encapsulation, padding, and encryption processing on a packet, authentication value (Integrity Check Value (ICV)) value calculation and SN (Sequence) are performed. A third step of generating a value), generating a tunnel header or a transport header to calculate the IP packet fragmentation and the check sum of the IP header, and then transmitting the information protection IP packet to which the data link header is added; Information transmission Internet Protocol packet transmission method comprising a. The method of claim 1, If the security service is not selected for each packet, after generating a tunnel header or a transport header to calculate the IP packet fragmentation and the check sum of the IP header, and transmitting the information protection IP packet in units of frames to which the data link header is added. 4 steps The transmission method of the information protection Internet protocol packet further comprising. The method of claim 1, The first step is, Creating a socket for communication at the socket layer for transmitting arbitrary information A fifth step; A sixth step of adding a Transmission Control Protocol (TCP) header to arbitrary information through the created INET (InterNET) socket; A seventh step of assembling an IP packet by adding an IP header to the data to which the Transmission Control Protocol (TCP) header is added; And Eighth step to search the security policy database and security association database to determine whether the security service makes a selection Information transmission Internet Protocol packet transmission method comprising a. The method of claim 1, The second step, A fifth step of, if the security service selects an authentication header (AH), calculates authentication data at the packet destination, and then calculates an authentication data value to be compared with the original value; A sixth step of generating a sequence number (SN) for preventing a retransmission attack and inserting it into an authentication header (AH); A seventh step of adding a tunnel header or a transport header to the IP packet and calculating a check sum of the IP header through a fragmentation process; And Eighth step of transmitting an information protection IP packet in units of frames to which a data link header according to a transmission path characteristic of a physical layer is added Information transmission Internet Protocol packet transmission method comprising a. The method of claim 1, The third step, A fifth step of performing encapsulation on the packet; A sixth step of encrypting the packet by performing padding to apply the length of the data to the block encryption algorithm; A seventh step of calculating the authentication data value after calculating the authentication data in the encrypted packet and comparing it with the original value; An eighth step of generating a sequence number (SN) for preventing a retransmission attack and inserting it into an authentication header (AH); A ninth step of adding a tunnel header or a transport header to an IP packet and calculating a check sum of the IP header through a fragmentation process; And A tenth step of transmitting an information protection packet added with a data link header according to a transmission path characteristic of a physical layer in units of frames Information transmission Internet Protocol packet transmission method comprising a. In the forwarding method of the information protection Internet Protocol packet applied to a device for forwarding information protection Internet Protocol (IP) packet, Determining whether to select a packet-specific security service by referring to a security policy database and a security association database through the received information protection packet; A second step of determining whether a type of security service is a tunnel mode when a packet-specific security service is selected in the first step; As a result of the determination of the second step, in the tunnel mode, whether the service type is AH (Authentication Header) or ESP (Encapsulating Security Payload), the packet is encapsulated (encapsulation), padding, A third step of performing encryption processing, authentication data (ICV) calculation and generation of SN (sequence number) values, and forwarding the packet with the tunnel header or the transport header forwarded to the information protection IP packet; ; A fourth step of judging whether the authority of the packet user has a root authority when the determination result of the second stage is not in the tunnel mode; A fifth step of discarding the packet when the authority of the user does not have the root authority as a result of the determination of the fourth step; A sixth step of judging whether the authority of the user is an endpoint of the security association as a result of the determination of the fourth step; As a result of the determination of the sixth step, when the endpoint of the security association, the SN value and the authentication data (ICV) value included in the packet header are examined, and the type of security service is AH (Authentication Header) or ESP (Encapsulating Security). Payload) and refer to packet decryption, pad removal, decapsulation, and security policy database according to the type of service, and forward information protection IP packets after removing the tunnel header or transport header. 7 steps; And As a result of the determination in the sixth step, if the security association is not an endpoint, the security service is classified as an authentication header (AH) or an encapsulating security payload (ESP), and an encapsulation of a packet according to the service type is performed. ), Padding, encryption processing, authentication check (Integrity Check Value (ICV)) calculation, and generation of SN (Sequence Number) values, and forwarding information protection IP packets with a tunnel header or a transport header. 8 steps Method for forwarding information protection Internet Protocol packets comprising a. The method of claim 6, The third step, A ninth step of determining whether the security service is an Authentication Header (AH) or an Encapsulating Security Payload (ESP); A tenth step of calculating the authentication data value so that the security service can compare the original value after calculating the authentication data at the packet destination if the security service selects an authentication header (AH) as a result of the determination in the ninth step; Generates SN (Sequence Number) value to prevent retransmission attack, inserts into AH (Authentication Header), adds tunnel header or transport header to IP packet, calculates the check sum of IP header through fragmentation, and transmits An eleventh step of generating an information protection IP packet including a data link header according to a channel characteristic and forwarding it in units of frames; As a result of the determination in step 9, when the security service selects the encapsulating security payload (ESP), the packet is encapsulated and the padding is performed so that the length of the data can be applied to the block encryption algorithm. A twelfth step of encrypting; After calculating the authentication data in the encrypted packet, the authentication data value is calculated so that it can be compared with the original value, and an SN (Sequence Number) value is generated to prevent retransmission attacks, thereby inserting an Encapsulating Security Payload (ESP). Step 13; And After adding a tunnel header or a transport header to an IP packet, a fragmentation process is performed to calculate a check sum of the IP header, and an information protection IP packet including a data link header according to a transmission path characteristic of a physical layer is forwarded in units of frames. Fourteenth step Method for forwarding information protection Internet Protocol packets comprising a. In the method of receiving an information protection Internet Protocol packet applied to a device for receiving an information protection Internet Protocol (IP) packet, A first step of determining whether to select a security service for each packet by referring to a security association database after receiving an IP packet completed by recombination for the packet; When the security service is selected, the second step of checking the SN value and the Integrity Check Value (ICV) value carried in the packet header and determining whether the security service is an Authentication Header (AH) or an Encapsulating Security Payload (ESP) ; As a result of the determination of the second step, if the type of security service is AH (Authentication Header), the processing of the currently received information protection packet is examined by referring to the security policy database, and after removing the tunnel header or the transport header, Removing an IP header to receive an information protection IP packet; And As a result of the determination of the second step, if the type of security service is ESP, after processing the packet decryption, pad removal, and decapsulation, the processing of the currently received information protection packet is examined with reference to the security policy database. And removing the tunnel header or the transport header and removing the IP header again to receive the information protection IP packet. Method of receiving an information protection internet protocol packet comprising a. The method of claim 8, A fifth step of removing the IP header and the TCP header of the received packet when the security association service is not selected, and then receiving the packet through the INET socket and the communication socket; Method of receiving an information protection internet protocol packet further comprising. In the information transmission Internet Protocol (IP) packet transmission and reception method of the information protection Internet Protocol packet applied to a network system for transmitting and receiving over the Internet, A first step of generating, by the transmitting terminal apparatus, an IP header of a packet to be transmitted, determining whether to select a security service for each packet, and transmitting the information protection IP packet generated in units of frames according to the type of security service; Tunnel header or transport header for deciding packet decode, pad removal, decapsulation and security policy database according to the type of packet-specific security service selected by the gateway of the Internet. A second step of forwarding the generated information protection IP packet to the receiving terminal device; And Tunnel header or transport with reference to decryption, pad removal, decapsulation and security policy database of IP packet according to packet type security service selection and type determined in forwarded information protection IP packet After removing the header, the third step to receive the information protection IP packet by removing the IP header again Method of transmitting and receiving an information protection Internet protocol packet comprising a. The method of claim 10, The first step is, Generating an IP header of the packet and determining whether to select a security service for each packet by referring to a security policy database and a security association database; When AH (Authentication Header) is selected as the security service selected in the first step, the authentication data for the packet is calculated and the SN value is generated, and the tunnel header or the transport header is generated to check the IP packet fragmentation and the IP header. After calculating the sum, transmitting a data protection packet appended with a data link header; If the security service is selected as the ESP (Encapsulating Security Payload) in the first step, the authentication data (Integrity Check Value, ICV) value calculation and SN (Sequence) after performing encapsulation, padding and encryption processing for the packet A sixth step of generating a value), generating a tunnel header or a transport header to calculate an IP packet fragmentation and a check sum of the IP header, and then transmitting an information protection packet including the data link header; And If the security service is not selected for each packet, after generating a tunnel header or a transport header to calculate the IP packet fragmentation and the check sum of the IP header, and transmitting the information protection packet in units of frames with the data link header added thereto. step Method of transmitting and receiving an information protection Internet protocol packet comprising a. The method of claim 10, The second step, A fifth step of determining whether to select a packet-specific security service by referring to the security policy database and the security association database through the received information protection packet; In the fifth step, determining whether a type of security service is a tunnel mode when a packet-specific security service is selected; As a result of the determination of the sixth step, in the tunnel mode, whether the service type is AH (Authentication Header) or ESP (Encapsulating Security Payload) is classified and encapsulation (packing), padding, A seventh step of performing encryption processing, authentication data (Integrity Check Value (ICV)) calculation, and generation of SN value, and forwarding the packet with the tunnel header or the transport header to the information protection packet; An eighth step of judging whether the authority of the packet user has a root authority when the determination result of the sixth step is not in the tunnel mode; A ninth step of discarding the packet when the authority of the user does not have the root authority as a result of the determination of the eighth step; A tenth step of judging whether the security association is an endpoint when the authority of the user has root authority as a result of the determination of the eighth step; As a result of the determination of the tenth step, when the endpoint of the security association is determined, the SN value and the authentication data (ICV) value included in the packet header are examined, and whether the type of the security service is AH or ESP is determined. An eleventh step of referring to packet decryption, pad removal, decapsulation, and security policy database according to the type, and forwarding the information protection IP packet after removing the tunnel header or the transport header; And As a result of the determination in the tenth step, if the security association is not an endpoint, the security service is classified as an authentication header (AH) or an encapsulating security payload (ESP), and an encapsulation of a packet according to the service type is performed. 12) step of processing information related to padding, encryption processing, authentication data (Integrity Check Value (ICV)) calculation, and generation of SN values, and forwarding an information protection packet added with a tunnel header or a transport header. Method of transmitting and receiving an information protection Internet protocol packet comprising a. The method of claim 10, The third step, A fourth step of determining whether to select a security service for each packet by referring to a security association database after receiving an IP packet completed by recombination for the packet; When the security service is selected, the fifth step of checking the SN value and the authentication data (Integrity Check Value (ICV)) value carried in the packet header and determining whether the security service is an Authentication Header (AH) or an Encapsulating Security Payload (ESP). ; As a result of the determination of the fifth step, when the type of security service is an authentication header (AH), the processing of the currently received information protection packet is examined by referring to the security policy database, and after removing the tunnel header or the transport header, A seventh step of receiving the information protection packet at the IP layer by removing the IP header; And As a result of the determination of the second step, if the type of security service is ESP, after processing the packet decryption, pad removal, and decapsulation, the processing of the currently received information protection packet is examined with reference to the security policy database. An eighth step of removing the tunnel header or the transport header, and then removing the IP header to receive the information protection packet at the IP layer. Method of transmitting and receiving an information protection Internet protocol packet comprising a. The method according to any one of claims 10 to 13, And an IPsec layer for applying and releasing an information protection service for all packets passing through the IP layer as a part of the IP layer. The method according to any one of claims 10 to 13, Types of the information protection service, Information protection comprising an Authentication Header (AH) protocol that provides authentication services for IP headers and an Encapsulating Security (ESP) protocol that provides authentication services for IP headers by encrypting IP packets. How to send and receive Internet Protocol packets. The method according to any one of claims 10 to 13, The header of the AH protocol is The type of header to appear after the AH header, the length of the payload, the Security Parameter Index (SPI) required to retrieve the security association database, and the SN (Sequence Number) to maintain a stable system against retransmission attacks by discarding retransmitted packets. And an authentication check value (Integrity Check Value, ICV) value. The method according to any one of claims 10 to 13, The header of the ESP protocol is Required Security Parameter Index (SPI) to search the security association database, Sequence Number (SN) for tolerance to replay attacks, Payload data from upper layer, Pad for encryption processing by block cipher algorithm And a pad length, a type of header to appear after the ESP header, and authentication data. In a terminal device having a processor for transmitting an information protection Internet Protocol (IP) packet, A first function of determining whether to select a security service for each packet by generating an IP header of the packet and referring to the security policy database and the security association database; When AH (Authentication Header) is selected as the security service selected in the first function, calculation of authentication data for the packet and generation of SN value are performed, and a tunnel header or a transport header is generated to check IP packet fragmentation and IP header. A second function of sending an information protection packet appending a data link header after calculating the sum; In case the security service is selected as ESP (Encapsulating Security Payload) in the first function, after performing encapsulation, padding, and encryption processing on the packet, authentication value (Integrity Check Value (ICV) value calculation and SN (Sequence) are performed. A third function of generating a value), generating a tunnel header or a transport header to calculate an IP packet fragmentation and a check sum of the IP header, and then transmitting an information protection packet appended with a data link header; And If the security service is not selected for each packet, after generating a tunnel header or a transport header to calculate the IP packet fragmentation and the check sum of the IP header, a fourth packet for transmitting the information protection packet in units of frames appended with the data link header function A computer-readable recording medium having recorded thereon a program for realizing this. In a gateway device having a processor for forwarding information protection Internet Protocol (IP) packets, A first function of determining whether to select a packet-specific security service by referring to a security policy database and a security association database through the received information protection packet; A second function of determining whether a type of security service is a tunnel mode when a packet-specific security service is selected in the first function; As a result of the determination of the second function, in the tunnel mode, whether the service type is AH (Authentication Header) or ESP (Encapsulating Security Payload (ESP)) is classified, and according to the type of service, encapsulation, padding, A third function of performing encryption processing, authentication data (Integrity Check Value (ICV)) calculation, and generation of SN values, and forwarding the packet with the tunnel header or the transport header to the information protection packet; A fourth function of judging whether the authority of the packet user has a root authority when the second function is not determined in the tunnel mode; A fifth function of discarding the packet if the authority of the user does not have the root authority as a result of the determination of the fourth function; A sixth function that determines whether the security association is an endpoint when a user's authority has root authority as a result of the determination of the fourth function; As a result of the determination of the sixth function, when the endpoint of the security association, the SN value carried in the packet header and the authentication data (Integrity Check Value (ICV)) value are examined, and whether the type of security service is AH or ESP, A seventh function of referencing packet decryption, pad removal, decapsulation and security policy database according to the kind, and forwarding the information protection packet after removing the tunnel header or the transport header; And As a result of the determination in the sixth function, if the security association is not an endpoint, the security service is classified as an authentication header (AH) or an encapsulating security payload (ESP), and an encapsulation of a packet according to each service type. The eighth function of performing information regarding padding, encryption processing, Integrity Check Value (ICV) calculation, and generation of SN values, and forwarding an information protection packet added with a tunnel header or a transport header. A computer-readable recording medium having recorded thereon a program for realizing this. In a terminal device having a processor for receiving an information protection Internet Protocol (IP) packet, A first function of determining whether to select a security service for each packet by referring to a security association database after receiving an IP packet completed by recombination for the packet; When the security service is selected, a second function that checks the SN value and the authentication data (ICV) value carried in the packet header and determines whether the security service is an authentication header (AH) or an encapsulating security payload (ESP). ; As a result of the determination of the second function, if the type of security service is AH (Authentication Header), the processing of the currently received information protection packet is examined by referring to the security policy database, and after removing the tunnel header or the transport header, A third function of receiving an information protection packet at the IP layer by removing the IP header; As a result of the determination of the second function, when the type of security service is ESP, after processing of packet decryption, pad removal, and decapsulation, the processing of the currently received information protection packet is examined with reference to the security policy database. A fourth function of removing the tunnel header or the transport header, and then removing the IP header to receive the information protection packet at the IP layer; And A fifth function of receiving a packet through an INET socket and a communication socket after removing the IP header and the TCP header of the received packet when the security service is not selected A computer-readable recording medium having recorded thereon a program for realizing this. In a network system having a processor for transmitting and receiving information protected Internet Protocol (IP) packets, A first function of generating, by the transmitting terminal apparatus, an IP header of a packet to be transmitted, determining whether to select a security service for each packet, and transmitting the information protection IP packet generated according to the type of security service to the Internet; Tunnel header or transport header for deciding packet decode, pad removal, decapsulation and security policy database according to the type of packet-specific security service selected by the gateway of the Internet. A second function of forwarding the generated information protection IP packet to the receiving terminal device; And The receiving terminal device receiving the information protection IP packet forwarded in the second function determines the decoding, pad removal, decapsulation and security policy database of the IP packet according to whether or not the security service for each packet is selected. Third function to receive the information protection packet by removing the IP header again after removing the tunnel header or the transport header with reference A computer-readable recording medium having recorded thereon a program for realizing this.