KR20010046990A - A security method of Frame Relay Routers for Advanced Information Communication Processing System - Google Patents

Abstract

The present invention relates to a frame relay router security method for a large capacity communication processing system.

The present invention is configured to perform authentication for each information provider host for the IP packet received from the frame relay router, the authentication process using a frame relay address and an IP address, " ID generation step of generating the ID (ID) of the frame relay network matching device through the expression ", and checks whether the ID (ID) of the frame relay network matching device matching the generated ID (ID) is registered An authentication step is performed to authenticate the information provider host.

Using the present invention, it is possible to block illegal access from the outside in the router, and encrypt the ID table for authenticating the frame relay network matching device of the mass communication processing system from potential hackers (information providers). It has the effect of protecting information.

Description

A security method of Frame Relay Routers for Advanced Information Communication Processing System

The present invention relates to a method for securing a frame relay router for a large capacity communication processing system, and more particularly, to a frame relay network accessing device (FNAS) that is a subsystem of an advanced information communication processing system (AICPS). It relates to a security method for protecting the router from intrusion from the outside.

1 is a block diagram of a frame relay service network using a large capacity communication processing system. The mass communication processing system generally includes a telephone network matching device 111 for connection with a public switched telephone network (PSTN), a comprehensive information communication network matching device 112 for connection with an ISDN, and a frame. Frame relay network matching device 120 for connection with the relay network 130, Internet matching device for connection with the Internet, high speed switch module 113 for connecting each matching device, etc., public telephone network A subscriber's user terminal or a comprehensive information communication network subscriber's user terminal is connected to the frame relay network 130 or the Internet network.

In this case, the user terminal refers to a personal computer (PC) or a hightel terminal, and is connected between a public telephone network subscriber and a public telephone network or between an integrated telecommunication network subscriber and an integrated information communication network (ISDN) through a modem. .

On the other hand, a user connecting to the mass communication processing system 100 is connected to the frame relay network 130 through the frame relay network matching device 120. At this time, the frame relay network 130 includes a plurality of passports (131, 132, 133: frame relay switch), and the mass communication system 100 and the passport are connected by an E1 link.

The user connects to the desired information provider host 160 through the frame relay routers 141 and 142 connected to the passports 131, 132 and 133. In general, the host 160 of the information provider that the user wants to access is connected to the LAN (LAN). 150 is connected to the routers 141 and 142 through a LAN.

2 is a diagram illustrating a normal service procedure of a conventional frame relay router, in which a user connected to the mass communication processing system 100 in the system shown in FIG. 1 uses the information provider host (via the frame relay network 130). 160 shows a procedure for connecting. At this time, the router 141 uses a network address translation (NAT) function whenever an Internet Protocol (IP) packet passes, and the LAN 150 of the router 141 transmits a source address of the IP packet. It converts to IP address.

First, a subscriber to a public telephone network or a comprehensive information communication network requests a connection to the frame relay network matching device 120 of the mass communication processing system 100 through the user terminal, and the frame relay network matching device 120 is connected to the user terminal. Informs that it succeeded (S210).

If the connection is successful, the user terminal requests the frame relay network matching device 120 to access the specific information provider host 160 of the frame relay network 130 again (S220).

Now, the frame relay network matching device 120 of the mass communication processing system requests the frame relay Switched Virtual Circuit (SVC) connection to the router 141, and the router 141 matches the frame relay network that the frame relay SVC connection is successful. In response to the device 120 (S230). That is, in order to use the frame relay SVC as a data transmission path, a procedure for setting the SVC is performed between the frame relay network matching device 120 and the information provider side frame relay router 141.

After setting the SVC, the mass communication processing system requests a TCP (Transmission Control Protocol) connection to the router 141, and the router 141 requests a TCP connection to the information provider host 160. The information provider host 160 responds to the frame relay network matching device 120 through the router 141 that the TCP connection is successful (S240).

Then, a telnet connection is made between the mass communication processing system 100 and the information provider host 160 (S250), and the initial screen of the information provider host 160 is transmitted to the user terminal via the mass communication processing system ( S260).

In order to perform such a procedure, the frame relay end must have a frame relay address (X.121) and an IP address in pairs, and the frame relay network matching device 120 of the high-capacity communication processing system needs a plurality of services because of its characteristics. In order to install the frame relay router, the network address translation (NAT) function must be used.

Network Address Translation (NAT) is commonly used to interface hosts on a LAN with a private IP address with the Internet. In other words, it converts the internal private IP address to the public IP address of the gateway.

Since the frame relay network matching device 120 of the mass communication processing system uses a private IP address, the frame relay router for the mass communication processing system uses a general network address translation (NAT) function in reverse. From the information provider's perspective, the host on the LAN is accessed by changing the private IP address of the wide area network (WAN) section to the IP address inside the LAN. In addition, no authentication process is performed for external access requests to the router.

However, this conventional method allows illegal SVC connection attempts made to the router via a frame relay network (eg, HiNET-P / F), and from the hacker's point of view, the information provider's LAN is established using the set SVC. Hackers can also create serious security problems that cannot be traced by the Network Address Translation (NAT) feature of FrameRelay routers.

Meanwhile, FIG. 3 is a flowchart illustrating a hacking procedure and illustrates a process in which illegal access to an information provider occurs.

The hacker leases a frame relay SVC circuit that can be connected to a frame relay network (eg HiNET-P / F) as an informant. Connect a general frame relay router capable of an outgoing call function and set the LAN side IP address of the frame relay router to the same class as the IP address of the praim relay relay matching device 120. . With this simple procedure, everything is ready for hacking.

To describe the hacking procedure in detail, the hacker host requests a TCP connection from the hacker host to the hacker router (S310). The hacker router requests the information provider router to access the information provider host, and the information provider router informs the hacker router of the success of the frame relay SVC connection (S320). At this time, the information provider router converts the source address of the IP packet into the LAN side IP address of the router by using a network address translation (NAT) function whenever the IP packet passes. Therefore, the information provider host cannot recognize illegal intrusions as intrusions from the local host.

The hacker router makes a TCP connection request to the information provider router, and the information provider router sends a TCP connection request back to the information provider host, and the information provider host sends back a successful TCP connection to the hacker host through the information provider router. S330). Now, the hacker can extract the information of the information provider host using the host (S340).

At this time, since the hacker's source IP address is the same as that of the frame relay network matching device 120 of the mass communication processing system, the information provider-side router 141 will recognize that all connection attempts originating from the hacker are legitimate. In addition, since the hacker's IP packet information is changed to the information provider's internal IP address by the network address translation (NAT) function of the information provider's router, the information provider's host cannot filter it.

In this way, the IP packet of the wide area network (WAN) section is transmitted to the information provider side LAN without any authentication process, and the network address translation (NAT) function is applied to the IP address of the wide area network (WAN) section of the router. Due to this, the service providing host cannot authenticate for each IP address, and the router cannot distinguish illegal access by not having any information about the legal frame relay network matching device 120.

In other words, in order to prevent hacking, a device that can authenticate the user first needs to be authenticated. However, since it is not currently considered in the router for the frame relay network matching device of the mass communication processing system, illegal information is illegal. There is a problem that can be leaked.

Accordingly, the present invention has been made to solve the above problems, frame relay router for a large capacity communication processing system to prevent illegal intrusion from hackers to information providers connected to the frame relay network through a large capacity communication processing system The purpose is to provide a security method.

Frame relay router security method for a high-volume communication processing system according to the present invention for achieving the above object comprises the steps of: receiving an IP (Internet Protocol) packet from the frame relay network; The router transmits the source IP address of the received IP packet to the LAN if the source IP address is in a switched virtual circuit (SVC) management table, and examines whether the first IP packet is the first IP packet; The router discarding the packet if it is not the first IP packet as a result of the investigation in the investigation step; An authentication process for authenticating whether the router is a normal packet when the router is the first IP packet as a result of the investigation in the investigation step; And if the authentication succeeds in the authentication process, registers in the SVC management table, changes the source IP address to the LAN side IP address of the router, and transmits it to the LAN side, but discards the packet if authentication fails. Characterized in that comprises a.

At this time, the authentication process uses a frame relay address and an IP address of the received packet, ID generation step of generating an ID (ID) of the frame relay network matching device through the formula "; and checking whether the ID (ID) of the frame relay network matching device matching the generated ID (ID) is registered; It can be implemented more preferably by including an authentication step of performing authentication for the information provider host.

1 is a block diagram of a frame relay service network using a large capacity communication processing system,

2 is a normal service procedure diagram of a conventional frame relay router;

3 is a procedure of hacking is made,

4 is a normal service procedure of the frame relay router to which the present invention is applied;

5 is a procedure of preventing hacking in the present invention,

6 is a detailed flowchart illustrating an authentication procedure of a router.

* Explanation of symbols for main parts of the drawings

100: mass communication processing system 111: telephone network matching device

112: integrated information network matching device 113: switching module

120: frame relay network matching device 130: frame relay network

131,132,133: Passport 141,142: Router

150: LAN 160: information provider host

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

4 is a flowchart illustrating a normal service procedure of a frame relay router to which the present invention is applied. Authentication of each user session uses a host-specific authentication method based on a source IP address. It has address table of frame relay network matching device and performs authentication function using it.

Each router is potentially exploitable by hackers, and thus uses a one-way hash function as one preferred embodiment for authentication of each session. Then, the frame relay network matching device address of the mass communication processing system cannot be known using the frame relay network matching device address table distributed to each router.

In the network shown in Fig. 1, a description will now be made on how a service procedure for accessing an information provider host via a frame relay network after a user connects to a mass communication processing system.

The subscriber of the public telephone network or the general information communication network requests a connection to the frame relay network matching device 120 of the mass communication processing system through his user terminal, and the mass communication processing system notifies that the connection to the user terminal is successful (S410). ).

The user terminal requests a connection to a specific information provider host 160 of the frame relay network 130 to the frame relay network matching device 120 (S420).

Then, a frame relay Switched Virtual Circuit (SVC) connection request is made to the router 141 through the frame relay network matching device 120, and the router 141 indicates that the frame relay SVC connection is successful. 120) (S430). That is, in order to use the frame relay SVC as a data transmission path, a procedure for setting the SVC is performed between the frame relay network matching device 120 and the information provider side frame relay router 141.

After setting the SVC, the frame relay network matching device 120 requests a TCP connection to the router 141 (S441).

Now, the router 141 proceeds to the authentication process (S442) that checks whether the match with the X.121 / IP address of the already registered frame relay network matching device 120, the information provider host 160 only if authentication is successful In step S444, a TCP connection is requested. This is different from the conventional procedure. That is, there is an overhead in which an authentication process (S442) is added to the SVC for which the connection is attempted for the first time, but it can be ignored because it occurs only at the moment of the user's call connection.

The information provider host 160 responds to the frame relay network matching device 120 via the router 141 that the TCP connection is successful (S445).

Now, a telnet connection is made between the frame relay network matching device 120 and the information provider host 160 (S450), and the initial screen provided by the information provider host 160 sets the large frame relay network matching device 120. It is transmitted to the user terminal via (S460).

On the other hand, since the call connection request of the user is basically acted by the frame relay network matching device 120 of the mass communication processing system, the host-specific authentication method is preferable. As described above, in the frame relay network matching device 120 of the mass communication processing system, each E1 link has an address system composed of a pair of X.121 addresses and IP addresses.

The X.121 address for each E1 link is unique within the frame relay network (eg HiNET-P / F) and therefore cannot be forged. On the other hand, the unique private IP address for each E1 link can be arbitrarily forged.

One preferred embodiment of the authentication process (S442) of the present invention is as follows.

The ID ID of the frame relay network matching device 120, which is already known as a key value for host-specific authentication, is used, and this ID is generated by a hash algorithm as shown in Equation 1 below.

That is, the sum of the X.121 address and the IP address allocated to each E1 line of the frame relay network matching device 120 is used as the seed value of the MD5 hash function. By using the 128-bit string generated as a key, the address table of the frame relay network matching device distributed to each router cannot be seen and its address is unknown.

5 is a flowchart illustrating a procedure in which hacking is performed according to the present invention, and illustrates a process of preventing illegal access to an information provider.

The hacker leases a FrameRelay SVC circuit that can be connected to a frame relay network (eg HiNET-P / F) as an informant. After connecting a general frame relay router capable of an outgoing call, set the LAN side IP address of the frame relay router to the same class as the IP address of the frame relay relay matching device. With this simple procedure, everything is ready for hacking.

Now, request a TCP connection from the hacker host to the hacker router (S510). The hacker router requests the information provider router 141 to access the frame relay information provider host 160 (S520), and the information provider router 141 informs the hacker router of the success of the frame relay SVC connection (S530). The SVC connection is complete. The hacker router transmits the TCP connection request to the information provider router 141 (S541).

At this time, the information provider router 141 performs an authentication process (S442) that checks whether the X.121 / IP address of the frame relay network matching device 120 of the mass communication processing system already registered. When the authentication fails, the hacker router notifies the hacker router that the authentication fails without transmitting the TCP connection request to the information provider host 160 (S543).

That is, the first IP packet transmitted through the newly set SVC is generally set to the SYN bit requesting a TCP connection. At this time, the authentication module of the router generates a hash value according to a predetermined rule and then checks whether the same value exists by searching the frame relay network matching device ID table. In the frame relay network (eg HiNET-P / F), the X.121 address of each link is unique, so the hacker cannot generate the same hash value.

FIG. 6 is a detailed flowchart illustrating an authentication procedure of a router, and a packet processing process in the router will be described in detail using this.

The router 141 waits to receive an IP packet from the frame relay network 130 and receives the packet (S610).

The router 141 receiving the packet transmits the source IP address of the received IP packet to the LAN side (S620) when the source IP address of the received IP packet is present in the switched virtual circuit (SVC) management table (S660). It is checked whether the TCP Transmission Control Protocol SYN (SYN) packet is present (S630).

If it is determined that the packet is not a TCP SYN packet, the corresponding packet is discarded (S631). If the result is a TCP SYN packet, an authentication process for authenticating the frame relay address and the IP address of the packet is performed (S442). This authentication process (S442) is performed by generating a key value using a frame relay address and an IP address as described above, and searching whether there is an ID of the frame relay network matching device 120 matching the key value. .

If the authentication is successful in the authentication process (S442), the router 141 registers in the SVC management table (S651), changes the source IP address to the LAN side IP address of the router (S652), and transmits it to the LAN side (S660). If the authentication fails, the packet is discarded (S631).

Using the present invention, since the router manages information about the legal frame relay network matching device of the large capacity communication processing system, it is possible to block illegal access from the outside, and to authenticate the frame relay network matching device of the large capacity communication processing system. By encrypting the ID table, the information can be protected from potential hackers.

Claims (2)

A large capacity communication processing system for connecting to the frame relay network through a frame relay network matching device, a router for connecting to the frame relay network, and an information provider host for accessing the router through a LAN. In the system, the router receives an Internet Protocol (IP) packet from the frame relay network; The router transmits the source IP address of the received IP packet to the LAN if the source IP address is in a switched virtual circuit (SVC) management table, and examines whether the first IP packet is the first IP packet; The router discarding the packet if it is not the first IP packet as a result of the investigation in the investigation step; An authentication process for authenticating whether the router is a normal packet when the router is the first packet as a result of the investigation in the investigation step; And If the authentication is successful in the authentication process, the router registers in the SVC management table, changes the source IP address to the LAN side IP address of the router, and transmits it to the LAN side, but discards the packet if authentication fails. Frame relay router security method for a large capacity communication processing system, characterized in that comprising a. The method of claim 1, wherein the authentication process uses a frame relay address and an IP address of a received packet, ID generation step of generating an ID (ID) of the frame relay network matching device through the expression of "; Mass communication characterized in that it comprises an authentication step of performing an authentication for the information provider host by checking whether the ID (ID) of the frame relay network matching device matching the generated ID (ID) is registered; Frame Relay Router Security Method for Processing System.