KR20210051207A - Apparatus and method for providing security to an end-to-end communication - Google Patents

Abstract

A security device that provides security for communication between a first end communication device and a second end communication device by interworking with the policy management device according to an embodiment is a storage unit that stores mapping information of an IP address, a sub ID, and a master ID ; A receiver configured to receive a first packet destined for the second end communication device from the first end communication device; ID confirmation that transmits the destination IP address of the first packet to the policy management device to receive a master ID corresponding thereto, and checks the sub ID and master ID corresponding to the source IP address of the first packet in the storage unit part; A policy inquiry unit for querying a policy and receiving an approval response by transmitting a master ID corresponding to the destination IP address, a sub ID and a master ID corresponding to the source IP address to the policy management device; A transmission unit for transmitting the first packet to the second end communication device in response to reception of the acknowledgment response; And a session maintenance unit generating a session maintenance packet and transmitting it to the second terminal communication device.

Description

Apparatus and method for providing security for end-to-end communication {APPARATUS AND METHOD FOR PROVIDING SECURITY TO AN END-TO-END COMMUNICATION}

The present invention relates to Internet of Things (IoT) technology, and more particularly, to an apparatus and method for providing security for communication between an IoT terminal and a terminal communication device such as an IoT service server.

The Internet is evolving from a human-centered network in which humans create and consume information, to an Internet of Things (IoT) network that exchanges and processes information between distributed components such as objects. The Internet of Things (IoT) refers to a concept in which all communicationable objects can be connected to a network to perform mutual communication. Things, which are all objects that can be recognized systematically, are equipped with short-range and long-distance communication functions, and can produce data through sensors. In order to implement IoT, technological elements such as sensing technology, wired/wireless communication and network infrastructure, service interface technology, and security technology are required. In recent years, technologies such as sensor network, machine to machine (M2M), and machine type communication (MTC) for connection between objects are being studied. These IoT services are provided in a public network environment. In other words, anyone can access the IoT network at any time. In this way, since IoT services are provided in a public network environment, IoT devices (IoT terminals or IoT service servers) may be exposed to the public network, resulting in weak security.

The present invention has been proposed to solve the above-described problem, and provides an apparatus and method for providing security based on an identifier (ID)-based policy in communication between an IoT terminal and an end communication device such as an IoT service server. There is a purpose to do it.

A security device that provides security for communication between a first end communication device and a second end communication device by interworking with the policy management device according to an embodiment is a storage unit that stores mapping information of an IP address, a sub ID, and a master ID ; A receiver configured to receive a first packet destined for the second end communication device from the first end communication device; ID confirmation that transmits the destination IP address of the first packet to the policy management device to receive a master ID corresponding thereto, and checks the sub ID and master ID corresponding to the source IP address of the first packet in the storage unit part; A policy inquiry unit for querying a policy and receiving an approval response by transmitting a master ID corresponding to the destination IP address, a sub ID and a master ID corresponding to the source IP address to the policy management device; A transmission unit for transmitting the first packet to the second end communication device in response to reception of the acknowledgment response; And a session maintenance unit generating a session maintenance packet and transmitting it to the second terminal communication device.

The session maintenance unit may include a specific flag in the header of the session maintenance packet so that the second end communication device determines the session maintenance packet as a packet for session maintenance and deletes it.

When a specific flag is included in the header of the session maintenance packet, the session maintenance unit may determine it as a session maintenance packet and then delete it.

The plurality of first end communication devices belong to one service group, one master ID is assigned to the service group to which a public IP address is assigned, and the plurality of first end communication devices are different from each other. A sub ID is assigned, and the security device may be installed under a network address translation (NAT) on a communication layer in a mobile communication core network.

The plurality of first end communication devices belong to one service group, one master ID is assigned to the service group to which a public IP address is assigned, and the same sub ID to each of the plurality of first end communication devices Is assigned, and the security device may be installed above a network address translation (NAT) on a communication layer in a mobile communication core network.

The receiving unit receives a second packet destined for the first end communication device from the second end communication device side, and the ID check unit responds by transmitting the source IP address of the second packet to the policy management device. A master ID corresponding to the destination IP address of the second packet, and a sub ID and a master ID corresponding to the destination IP address of the second packet are checked in the storage unit, and the policy inquiry unit includes a master ID corresponding to the source IP address of the second packet , A sub ID and a master ID corresponding to the destination IP address of the second packet are transmitted to the policy management device to query a policy and receive an approval response, and the transmission unit transmits the second packet to the first end communication device. Can be transferred to.

The policy inquiry unit may receive the approval response including a token seed, generate a token using the token seed, and insert the token into the first packet.

The policy inquiry unit may generate a token using a nonce, a payload of the first packet, a timestamp, the sub ID, and the token seed.

The policy management device stores, as policy information, mapping information of the master ID of the other end communication device for each sub-ID and master ID of each end communication device that are allowed to communicate with each other, and sends the approval response based on the policy information. In response, as IP address information, mapping information of a master ID and an IP address is stored, and a master ID corresponding to an IP address received from the ID verification unit may be returned to the ID verification unit based on the IP address information. .

A method of providing security for communication between a first end communication device and a second end communication device by interworking with a policy management device in a security device according to an embodiment includes storing mapping information of an IP address, a sub ID, and a master ID. step; Receiving a first packet from the first end communication device to the second end communication device; Transmitting the destination IP address of the first packet to the policy management device to receive a master ID corresponding thereto, and checking a sub ID and a master ID corresponding to the source IP address of the first packet in the storage unit; Transmitting a master ID corresponding to the destination IP address, a sub ID and a master ID corresponding to the source IP address to the policy management device to query a policy and receive an approval response; Transmitting the first packet to the second end communication device upon receipt of the acknowledgment response; And generating a session maintenance packet and transmitting it to the second end communication device.

The step of generating the session maintenance packet and transmitting it to the second terminal communication device may include specifying the session maintenance packet in the header of the session maintenance packet so that the second terminal communication device determines the session maintenance packet as a packet for session maintenance and deletes it. You can include flags.

Receiving the session maintenance packet may include determining that a specific flag is included in the header of the session maintenance packet and then deleting it after determining that it is a session maintenance packet.

The plurality of first end communication devices belong to one service group, one master ID is assigned to the service group to which a public IP address is assigned, and the plurality of first end communication devices are different from each other. A sub ID is assigned, and the security device may be installed under a network address translation (NAT) on a communication layer in a mobile communication core network.

The plurality of first end communication devices belong to one service group, one master ID is assigned to the service group to which a public IP address is assigned, and the same sub ID to each of the plurality of first end communication devices Is assigned, and the security device may be installed above a network address translation (NAT) on a communication layer in a mobile communication core network.

The method includes the steps of: receiving a second packet from the second end communication device side to the first end communication device; Transmitting a source IP address of the second packet to the policy management device to receive a master ID corresponding thereto, and checking a sub ID and a master ID corresponding to the destination IP address of the second packet in the storage unit; Transmitting a master ID corresponding to the source IP address of the second packet, and a sub ID and master ID corresponding to the destination IP address of the second packet to the policy management device to query a policy and receive an approval response ; And transmitting the second packet to the first end communication device.

The method may further include generating a token using a token seed included in the authorization response, and inserting the token into the first packet.

In the step of inserting the token, a token may be generated using a nonce, a payload of the first packet, a timestamp, the sub ID, and the token seed.

The policy management device stores, as policy information, mapping information of the master ID of the other end communication device for each sub ID and master ID of each end communication device allowed to communicate with each other, and sends the approval response based on the policy information. In response, mapping information of a master ID and an IP address may be stored as IP address information, and a master ID corresponding to an IP address received from the security device may be returned to the security device based on the IP address information.

In one embodiment, the security of the IoT service through the public network is improved by using an identifier (ID)-based policy by breaking away from the IP address-based policy, which is highly volatile according to the network structure.

In one embodiment, by inserting a token into a packet transmitted/received by a security module connected to the end communication device or verifying the inserted token, it is possible to block the reception of malicious packets to the end communication device, thereby preventing hacking of the end communication device. have.

In an embodiment, a session is prevented from being dropped while a session between security modules is connected, thereby enabling smooth communication.

1 is a diagram showing an end-to-end communication system according to an embodiment of the present invention.
2 is a diagram illustrating information managed by a policy management device according to an embodiment of the present invention.
3 is a diagram showing information managed by a policy management device according to another embodiment of the present invention.
4 is a block diagram of a security module and a policy management device according to an embodiment of the present invention.
5 is a block diagram of a security module and a policy management apparatus according to another embodiment of the present invention.
6 is a block diagram of a security module and a policy management device according to another embodiment of the present invention.
7 is a diagram illustrating a method of maintaining a session according to an embodiment of the present invention.

The above-described objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, whereby those of ordinary skill in the technical field to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing an end-to-end communication system according to an embodiment of the present invention. Referring to FIG. 1, an end-to-end communication system according to the present embodiment includes end communication devices 110 and 150, security modules 120 and 140, and a policy management device 180.

Terminal communication devices (110, 150) are communication devices that exist at the end of the communication path, for example, gas sensors, fire detection sensors, cameras, artificial intelligence speakers, IoT terminals such as devices installed in vehicles, such as IoT It includes an IoT service server that communicates with a terminal to provide IoT services. The IoT terminal may communicate with an IoT service server including a memory, a processor, and a communication circuit, or P2P communication with another IoT terminal. The IoT service server is connected to the IoT terminal to periodically receive status information from the IoT terminal, update the firmware of the IoT terminal, and provide services such as content streaming to the IoT terminal.

In this embodiment, the end communication devices 110 are IoT terminals, and the end communication devices 150 are IoT service servers, constituting one service group. The end communication devices 110 communicate with the end communication device 150. For example, the terminal communication devices 110 are terminals installed in automobiles, and the terminal communication device 150 is a server operated by an automobile company. The end communication devices 110 use a private IP address and a public IP address based on a network address translation (NAT). Preferably, the public IP address is allocated an IP address band such as 1.1.1.1 to 1.1.1.10, and each end communication device 110 is allocated a private IP address selected from the private IP address band designated internally. Different public IP address bands are allocated for different service groups, and private IP addresses are allocated internally within different private IP address bands.

The security modules 120 and 140 protect the end communication devices 110 and 150 from external attacks through a communication network. The security modules 120 and 140 are located in an upper layer of the terminal communication devices 110 and 150 on the communication layer. The first security module 120 is installed in a core network of a mobile communication network, and the second security module 140 is manufactured in the form of a physical adapter to be physically connected to the end communication devices 150. Preferably, the first security module 120 may be installed in a 5G edge server. In the terminal communication devices 110 communicating with the first security module 120, an APN (Access Point Name) of the first security module 120 is set. The security modules 120 and 140 may include a memory, a processor, and a communication circuit. Alternatively, the security modules 120 and 140 may be manufactured as software and stored in the memory of the end communication devices 110 and 150 to be executed.

The core network of the mobile communication network is an Access and Mobility Management Function (AMF) that performs authentication, access, and mobility control functions, a Session Management Function (SMF) that performs a session control function, and a data plane network entity that accommodates a radio access network. Including UPF (User Plane Function). The UPF and the radio access network receive routing rules for terminals from the SMF through N4 and N2 interfaces, and perform IP routing functions through the received writing rules. It also includes Network Address Translation (NAT), which is responsible for translation of IP addresses. The first security module 120 may be located above the NAT on the communication layer based on the end communication devices 110 or located below the NAT.

Termination communication devices 110 and 150 are assigned a sub ID and a master ID. The sub ID is an identifier corresponding to the end communication devices 110 and 150, and the master ID is of the end communication devices 110 and 150 connected to the security modules 120 and 140 based on the security modules 120 and 140. This is an identifier corresponding to the service group.

The sub IDs assigned to the end communication devices 110, which are IoT terminals, may be the same or different from each other depending on the embodiment. It is determined according to the installation position of the first security module 120. When the first security module 120 is installed under the NAT, that is, the source IP address of the packet transmitted from the end communication devices 110 to the first security module 120 is not changed to a public IP address by NAT. If not received by the first security module 120, the sub-IDs assigned to the end communication devices 110 are all different. On the other hand, when the first security module 120 is installed above the NAT, that is, the source IP address of the packet transmitted from the end communication devices 110 to the first security module 120 is converted to a public IP address by NAT. If changed and received by the first security module 120, the sub IDs assigned to the end communication devices 110 are the same.

The master ID is irrelevant to the installation location of the first security module 120. Termination communication devices 110 located under the first security module 120 and belonging to the same service group are assigned the same master ID, and end communication devices 150 located under the second security module 140 Is assigned a different master ID.

When transmitting a packet received from the end communication devices 110 and 150 to the outside, the security modules 120 and 140 query the policy management device 180 to the outside of the packet according to the policy inquiry result. Decide whether to transmit or not. In addition, when a packet destined for the end communication devices 110 and 150 from the outside is received, the security modules 120 and 140 also query the policy management device 180 for a policy, and the packet Determines whether to transmit to the inside of the device. In this case, the policy is an ID-based end communication connection policy, which is generated for each sub-ID, and is ID mapping information between end communication devices that are allowed to communicate with each other.

The security modules 120 and 140 request a token seed from the policy management device 180 when transmitting a packet received from the end communication device 110 or 150 to the outside, and the token seed received from the policy management device 180 The token generated by using can be inserted into the packet and transmitted. In addition, the security modules 120 and 140, when a packet destined for the end communication devices 110 and 150 from the outside is received, request a token seed used by the side that transmitted the packet to the policy management device 180, and , Using the token seed received from the policy management device 180, the token included in the packet is verified. When the token verification is successful, the security modules 120 and 140 remove the token from the packet received from the outside and transmit it to the internal end communication devices 110 and 150.

The policy management device 180 stores information of the end communication devices 110 and 150, an ID-based end communication connection policy, and IP address information.

2 is a diagram showing information managed by a policy management apparatus according to an embodiment of the present invention, and is an example when the first security module 120 is installed above the NAT. In this embodiment, the end communication devices 110 belonging to a specific service group located under the first security module 120 are assigned the same sub ID, DevID1, and the master ID, MasterID1. Since the first security module 120 is installed above the NAT, the first security module 120 does not see different private IP addresses of the lower end communication devices 110, but only the public IP address. The management device 180 manages the sub IDs of the corresponding end communication devices 110 in the same manner. In the end communication device 150 located below the second security module 140, DevID2 is assigned as a sub ID and MasterID2 is assigned as a master ID.

As shown in Figure 2, the information of the terminal communication devices (110, 150), includes the public IP address and sub-ID of the terminal communication device. In FIG. 2, the terminating communication devices 110 having a sub ID of DevID1 are allocated a public IP address band of 1.1.1.1 to 1.1.1.10, and the terminating communication device 150 having a sub ID of DevID2 are within the designated private IP address band. It indicates that the public IP address of 2.2.2.2 has been assigned.

The end communication connection policy is generated based on a sub ID as ID mapping information of the end communication devices 110 and 150 that are allowed to communicate with each other. In the example of FIG. 2, {DevID1, MasterID1, MasterID2} is, among the end communication devices 110 connected to the first security module 120, the end communication devices of the service group in which the sub ID is DevID1 and the master ID is MasterID1, This indicates that communication is possible with the end communication device 150 whose master ID is MasterID2. {DevID2, MasterID2, MasterID1} indicates that the terminal communication device 140 whose sub ID is DevID2 and the master ID is MasterID2 can communicate with the terminal communication device 150 whose master ID is MasterID1. The end communication connection policy is used to determine whether to allow packet transmission or packet reception when the end communication devices 110 and 150 transmit a packet to the outside or receive a packet from the outside.

The IP address information is IP address information based on the master ID. In FIG. 2, a public IP address band of 1.1.1.1 to 1.1.1.10 is allocated to the master ID of MasterID1, and a public IP address band of 2.2.2.2 is allocated to the master ID of MasterID2. The IP address information corresponds to the destination IP address of the packet transmitted to the outside when the end communication device (110, 150) transmits a packet to the outside or receives a packet from the outside, before querying the policy. It is used to check the master ID or the master ID corresponding to the source IP address of the packet received from the outside.

3 is a diagram showing information managed by a policy management device according to another embodiment of the present invention, and is an example when the first security module 120 is installed under a NAT. In this embodiment, the end communication devices 110 belonging to a specific service group located under the first security module 120 are assigned different sub IDs. In the two end communication devices 110, DevID1 and DevID3 are assigned as sub IDs, respectively, and MasterID1 is assigned as the master ID. In addition, in the end communication device 150 located below the second security module 140, DevID2 is assigned as a sub ID and MasterID2 is assigned as a master ID. Since the first security module 120 is installed under the NAT, the first security module 120 shows different private IP addresses of the lower end communication devices 110, so that the policy management device 180 The sub IDs of the end communication devices 110 are managed differently.

As shown in FIG. 3, the information of the end communication devices 110 and 150 includes a private IP address or a public IP address and a sub ID of the end communication device. In FIG. 3, the terminal communication devices 110 with sub IDs DevID1 and DevID3 record private IP addresses of 0.0.0.1 and 0.0.0.2, respectively, and the terminal communication device 150 with the sub ID DevID2 is 2.2.2.2. The public IP address is recorded. Since the two end communication devices 110 belonging to the lower level of the first security module 120 are assigned different sub IDs, respectively, as shown in FIG. 3, a total of three end communication connection policies are set. IP address information is IP address information based on the master ID. In Fig. 3, a private IP address band of 0.0.0.1 to 0.0.0.256 and a public IP address band of 1.1.1.1 to 1.1.1.10 are allocated to the master ID of MasterID1, and the public IP address band of 2.2.2.2 is allocated to the master ID of MasterID2. Is assigned.

4 is a block diagram of a first security module 120 and a policy management device 180 according to an embodiment of the present invention, in which the first security module 120 is installed above the NAT, and the first security module ( 120) is a block diagram when receiving a packet destined for the second terminal communication device 150 from the first terminal communication device 110. 4, the first security module 120 includes a receiving unit 310, an ID verification unit 320, a policy inquiry unit 340, and a transmission unit 350, and the policy management device 180 is It includes an address management unit 370, a policy management unit 380, and a storage unit 390. These can be implemented in software, stored in memory, and executed by the processor. In the embodiment with reference to FIG. 4, the operation of each component is described in the order of packet flow.

In step S301, the receiving unit 310 receives a packet from the first terminal communication device 110 to the second terminal communication device 150. In this packet, 1.1.1.1, which is the public IP address of the first end communication device 110, is set as the source (Src) IP address, and the second end communication device 150 is authorized as the destination (Dst) IP address. The IP address 2.2.2.2 is set.

In step S302, the ID verification unit 320, in order to check the master ID corresponding to the destination IP address included in the packet received by the receiving unit 310, transmits the corresponding destination IP address to the policy management device 180 To request a master ID. In step S303, the IP address management unit 370 of the policy management device 180 inquires the master ID corresponding to the destination IP address in the storage unit 390 and retrieves the inquired master ID from the first security module 120. It responds to the ID verification unit 320. Since IP address information is stored in the storage unit 390 of the policy management device 180 as shown in FIG. 2, the IP address management unit 370 can query the master ID corresponding to the destination IP address. . 2, as the master ID, MasterID2 is inquired.

In step S304, the ID verification unit 320 checks the sub ID and the master ID of the first end communication device 110 in the storage unit 330. Since the storage unit 330 stores the mapping information of the IDs and public IP addresses of the end communication devices 110, the ID verification unit 320 is the source IP address of the packet, that is, the first end communication device 110 Using the public IP address, the storage unit 330 checks the sub ID and master ID of the first end communication device 110. In this embodiment, the sub ID of the first end communication device 110 is DevID1, and the master ID is MasterID1.

In step S305, the policy inquiry unit 340 queries the policy management device 180 for a policy in order to check whether the packet can be transmitted to the destination IP address. The policy inquiry unit 340 includes a sub ID/master ID (DevID1, MasterID1) of the first end communication device 110 checked by the ID verification unit 320 and a master ID (MasterID2) of the second end communication device 150. ) To the policy management device 180 to query the policy.

In step S306, the policy management unit 380 of the policy management device 180 checks the policy in the storage unit 390 using the IDs according to the policy query of the policy inquiry unit 340. The storage unit 390 stores the policy information shown in FIG. 2. Since the storage unit 390 stores the policy information of {DevID1, MasterID1, MasterID2}, the policy management unit 380, in step S307, approves the policy inquiry unit 340 of the first security module 120 (Allow ) Send the response. At this time, the policy management unit 380 transmits the approval response including the token seed.

The policy inquiry unit 340 of the first security module 120 generates a token by using a token seed included in the approval response received from the policy management device 180. More specifically, the policy inquiry unit 340 generates a nonce and a timestamp, which are random values for preventing reuse of a token, and then generates a token as follows.

Token = sign(hmac(seed xor Nonce, Payload)∥Nonce∥Timestamp∥ID)

Here, hmac (seed xor Nonce, Payload) means that the value obtained by hashing the payload of the packet is encrypted with the value of the token seed and the nonce xor, and'∥' means concatenating it into a plain text. And ID is a sub-ID of the first terminal communication device 110, sign means signing with the private key of the first security module 120.

The transmission unit 350 inserts the token generated by the policy inquiry unit 340 into a packet and transmits it to the second end communication device 150 through a communication network.

On the other hand, in the embodiment with reference to Figure 4, when a packet is transmitted from the second end communication device 150 to the first end communication device 110, the ID verification unit 320 of the first security module 120, Check the corresponding master ID from the policy management device 180, that is, the master ID of the second end communication device 150 using the source IP address, and the sub ID and master corresponding to the destination IP address from the storage unit 330 ID, that is, the sub ID and the master ID of the first end communication device 110 are checked. Further, the policy inquiry unit 340 retrieves the policy from the policy management device 180 using these IDs and receives an approval response, and the transmission unit 350 transmits the packet to the first end communication device 110. Token verification is performed in the same manner as described above.

5 is a block diagram of a second security module 140 and a policy management device 180 according to another embodiment of the present invention, when a packet transmitted from the first security module 120 of FIG. 4 is received and processed. It is a block diagram. Referring to FIG. 4, the second security module 140 includes a receiving unit 410, an ID verification unit 420, a policy inquiry unit 440, and a transmission unit 450. The policy management device 180 includes the same components described with reference to FIG. 3. These can be implemented in software, stored in memory, and executed by the processor. In the embodiment with reference to FIG. 5, the operation of each component in the order of packet flow is described.

In step S401, the receiving unit 410 receives a packet destined for the second terminal communication device 150. In this packet, 1.1.1.1, which is the public IP address of the first end communication device 110, is set as the source (Src) IP address, and is the public IP address of the second end communication device 150 as the destination (Dst) IP address. 2.2.2.2 is set.

In step S402, the ID verification unit 420, in order to check the master ID corresponding to the source IP address included in the packet received by the receiving unit 410, transmits the corresponding source IP address to the policy management device 180 To request a master ID. In step S403, the IP address management unit 370 of the policy management device 180 inquires the master ID corresponding to the source IP address in the storage unit 390, and uses the inquired master ID of the second security module 140. It responds to the ID verification unit 420. Since IP address information is stored in the storage unit 390 of the policy management device 180 as shown in FIG. 2, the IP address management unit 370 serves as a master ID corresponding to the source IP address 1.1.1.1. You can inquire.

In step S404, the ID verification unit 420 checks the sub ID and the master ID of the second end communication device 150 in the storage unit 430. The storage unit 430 stores mapping information of the ID and public IP address, and the ID verification unit 420 uses the public IP address of the second end communication device 150 to communicate the second end in the storage unit 430 Check the sub ID and master ID of the device 150. In this embodiment, the sub ID of the second end communication device 150 is DevID2, and the master ID is MasterID2.

In step S405, the policy inquiry unit 440 queries the policy management device 180 for a policy in order to check whether the packet can be transmitted to the destination IP address, that is, the second end communication device 150. The policy inquiry unit 440 includes a sub ID/master ID (DevID2, MasterID2) of the second end communication device 150 checked by the ID verification unit 420 and a master ID (MasterID1) of the first end communication device 110. ) To the policy management device 180 to query the policy.

In step S406, the policy management unit 380 of the policy management device 180 checks the policy in the storage unit 390 using the IDs according to the policy query of the policy inquiry unit 440. The storage unit 390 stores the policy information shown in FIG. 2. Since the storage unit 390 stores the policy information of {DevID2, MasterID2, MasterID1}, the policy management unit 380 is approved by the policy inquiry unit 440 of the second security module 140 in step S407 (Allow ) Send the response.

Preferably, the policy inquiry unit 440 of the second security module 140 is a sub ID of the first end communication device 110 inserted in plaintext in the token inserted in the received packet (ie, DevID1) And the sub ID, and the master ID of the first end communication device 110 (ie, MasterID1) and the master ID (ie, MasterID2) of the second end communication device 140 checked by the ID verification unit 420 ) Is transmitted to the policy management device 180 to request and receive a token seed used by the transmitting side. The policy inquiry unit 440 simultaneously receives the public key of the first security module 120 from the policy management device 180. The policy inquiry unit 440 includes a nonce, a timestamp inserted in plain text in a token inserted in a packet, a sub ID of the first end communication device 110, and the received token seed. It generates a token using the same and checks whether it is the same as the token inserted in the packet. In addition, the policy inquiry unit 440 may verify the signature of the token with the received public key of the first security module 120. If token verification fails, the packet is discarded.

The transmission unit 450 removes the token from the packet in which token verification is successful, and transmits it to the second end communication device 150.

On the other hand, in the embodiment with reference to Figure 5, when a packet is transmitted from the second end communication device 150 to the first end communication device 110, the ID verification unit 420 of the second security module 140, Check the corresponding master ID from the policy management device 180, that is, the master ID of the first end communication device 110 using the destination IP address, and the sub ID and master corresponding to the source IP address from the storage unit 430 ID, that is, the sub ID and the master ID of the second end communication device 150 are checked. The policy inquiry unit 440 retrieves the policy from the policy management device 180 using these IDs and receives an approval response, and the transmission unit 450 transmits the packet to the first end communication device 110. Token verification is performed as well.

Although the first and second security modules 120 and 140 have been separately described in FIGS. 4 and 5, it should be understood that the functions described in FIGS. 4 and 5 are all included in one security module.

6 is a block diagram of a first security module 120 and a policy management device 180 according to another embodiment of the present invention, in which the first security module 120 is installed under the NAT, and the first security module It is a block diagram when 120 receives a packet destined for the second terminal communication device 150 from the first terminal communication device 110. 6, the first security module 120 includes a receiving unit 610, an ID verification unit 620, a policy inquiry unit 640, and a transmission unit 650, and the policy management device 180 is It includes an address management unit 670, a policy management unit 680, and a storage unit 690. These can be implemented in software, stored in memory, and executed by the processor. In the embodiment with reference to FIG. 6, the operation of each component in the order of packet flow is described.

In step S601, the receiving unit 610 receives a packet from the first terminal communication device 110 to the second terminal communication device 150. In this packet, 0.0.0.1, which is the private IP address of the first end communication device 110, is set as the source (Src) IP address, and the second end communication device 150 is authorized as the destination (Dst) IP address. The IP address 2.2.2.2 is set.

In step S602, the ID verification unit 620 transmits the destination IP address to the policy management device 180 in order to verify the master ID corresponding to the destination IP address included in the packet received by the receiving unit 610 To request a master ID. In step S603, the IP address management unit 670 of the policy management device 180 inquires the master ID corresponding to the destination IP address in the storage unit 690 and retrieves the inquired master ID from the first security module 120. It responds to the ID verification unit 620. Since IP address information is stored in the storage unit 690 of the policy management device 180 as shown in FIG. 3, the IP address management unit 670 can query the master ID corresponding to the destination IP address. . 3, as the master ID, MasterID2 is inquired.

In step S604, the ID verification unit 620 checks the sub ID and the master ID of the first end communication device 110 in the storage unit 630. Since the storage unit 630 stores the mapping information of the IDs and private IP addresses of the end communication devices 110, the ID verification unit 620 is the source IP address of the packet, that is, the first end communication device 110 Using the private IP address, the storage unit 630 checks the sub ID and master ID of the first end communication device 110. In this embodiment, the sub ID of the first end communication device 110 is DevID1, and the master ID is MasterID1.

In step S605, the policy inquiry unit 640 queries the policy management device 180 for a policy in order to check whether the packet can be transmitted to the destination IP address. The policy inquiry unit 640 includes a sub ID/master ID (DevID1, MasterID1) of the first end communication device 110 checked by the ID verification unit 620 and a master ID (MasterID2) of the second end communication device 150. ) To the policy management device 180 to query the policy.

In step S606, the policy management unit 680 of the policy management device 180 checks the policy in the storage unit 690 using the IDs according to the policy query of the policy inquiry unit 640. The storage unit 690 stores the policy information shown in FIG. 3. Since the storage unit 690 stores the policy information of {DevID1, MasterID1, MasterID2}, the policy management unit 680, in step S607, approves the policy inquiry unit 640 of the first security module 120 (Allow ) Send the response. At this time, the policy management unit 680 transmits the approval response including the token seed.

The policy inquiry unit 640 of the first security module 120 generates a token by using a token seed included in the approval response received from the policy management device 180. More specifically, the policy inquiry unit 640 generates a nonce and a timestamp, which are random values for preventing reuse of a token, and then generates a token as follows.

Token = sign(hmac(seed xor Nonce, Payload)∥Nonce∥Timestamp∥ID)

Here, hmac (seed xor Nonce, Payload) means that the value obtained by hashing the payload of the packet is encrypted with the value of the token seed and the nonce xor, and'∥' means concatenating it into a plain text. And ID is a sub-ID of the first terminal communication device 110, sign means signing with the private key of the first security module 120.

The transmission unit 650 inserts the token generated by the policy inquiry unit 640 into a packet and transmits it to the second end communication device 150 through a communication network.

Meanwhile, as the packet transmitted from the transmission unit 650 passes through the NAT, the source IP address is changed from a private IP address to a public IP address. Therefore, since the source address of the packet received by the second security module 140 has a public IP address recorded, the configuration for processing the packet in the second security module 140 is the same as the embodiment described with reference to FIG. 5. .

On the other hand, in the embodiment with reference to Figure 6, when a packet is transmitted from the second end communication device 150 to the first end communication device 110, the ID verification unit 620 of the first security module 120, Check the corresponding master ID from the policy management device 180, that is, the master ID of the second end communication device 150 using the source IP address, and the sub ID and master corresponding to the destination IP address from the storage unit 630 ID, that is, the sub ID and the master ID of the first end communication device 110 are checked. Further, the policy inquiry unit 640 retrieves the policy from the policy management device 180 using these IDs and receives an approval response, and the transmission unit 650 transmits the packet to the first end communication device 110. Token verification is performed in the same manner as described above.

When communicating between the security modules 120 and 140, a User Datagrm Protocol (UDP) session must be maintained. In the NAT located between the security modules 120 and 140, if there is no packet transmission/reception between the security modules 120 and 140 for a certain period of time, the UDP session is dropped. Accordingly, the security modules 120 and 140 need a method for maintaining the UDP session, and the security modules 120 and 140 periodically transmit and receive a session maintenance packet for maintaining the UDP session. FIG. 7 is a diagram illustrating a session maintenance method according to an embodiment of the present invention. Referring to FIG. 7, a first security module 120 is a session including a header (GS header) indicating a packet for session maintenance. The maintenance packet is periodically transmitted to the second security module 140. The header includes a flag indicating that the packet is a packet for session maintenance and also includes a token. Similar to the above-described embodiment, the token is received from the policy management device 180, inserted, and verified. When receiving a packet, the second security module 140 checks whether a flag indicating session maintenance is included in the header and in the header, and if so, immediately deletes the packet. To this end, the security modules 120 and 140 include a thin line maintenance unit that generates, receives, and deletes such packets. The session maintenance packet may be periodically transmitted by either one of the two security modules 120 and 140, or may be periodically transmitted alternately with each other.

While this specification includes many features, such features should not be construed as limiting the scope or claims of the invention. In addition, features described in separate embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in a single embodiment in the present specification may be individually implemented in various embodiments, or may be properly combined and implemented.

Although the operations have been described in a specific order in the drawings, it should not be understood that such operations are performed in a specific order as shown, or as a series of consecutive sequences, or that all described operations are performed to obtain a desired result. . Multitasking and parallel processing can be advantageous in certain environments. In addition, it should be understood that classification of various system components in the above-described embodiments does not require such classification in all embodiments. The above-described program components and systems may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a form that can be read by a computer. This process can be easily performed by a person of ordinary skill in the art to which the present invention pertains, and thus will not be described in detail.

The present invention described above, for those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible within the scope of the technical spirit of the present invention. It is not limited by the drawings.

110, 150: terminating communication device
120, 140: security module
180: policy management device
310, 410, 610: receiver
320, 420, 620: ID verification unit
330, 430, 630: storage
340, 440, 640: Policy inquiry unit
350, 450, 650: transmission unit
370, 670: IP address management unit
380, 680: Policy Management Department
390, 690: storage

Claims (16)

In a security device that provides security for communication between a first end communication device and a second end communication device by interworking with a policy management device,
A storage unit for storing mapping information of an IP address and a sub ID and a master ID;
A receiver configured to receive a first packet destined for the second end communication device from the first end communication device;
ID confirmation that transmits the destination IP address of the first packet to the policy management device to receive a master ID corresponding thereto, and checks the sub ID and master ID corresponding to the source IP address of the first packet in the storage unit part;
A policy inquiry unit for querying a policy and receiving an approval response by transmitting a master ID corresponding to the destination IP address, a sub ID and a master ID corresponding to the source IP address to the policy management device;
A transmission unit for transmitting the first packet to the second end communication device according to reception of the acknowledgment response; And
A security device comprising a session maintenance unit for generating a session maintenance packet and transmitting it to the second end communication device. The method of claim 1,
The session maintenance unit,
And including a specific flag in a header of the session maintenance packet so that the second end communication device determines the session maintenance packet as a packet for session maintenance and deletes it. The method of claim 1,
A plurality of the first end communication devices belong to one service group,
One of the master IDs is assigned to the service group to which a public IP address is assigned,
Different sub IDs are allocated to each of the plurality of first end communication devices,
The security device is a security device, characterized in that installed below the NAT (Network Address Translation) in the communication layer in the mobile communication core network. The method of claim 1,
A plurality of the first end communication devices belong to one service group,
One of the master IDs is assigned to the service group to which a public IP address is assigned,
The same sub ID is assigned to each of the plurality of first end communication devices,
The security device is a security device, characterized in that installed above the NAT (Network Address Translation) on the communication layer in the mobile communication core network. The method of claim 1,
The receiving unit receives a second packet directed to the first terminal communication device from the second terminal communication device side,
The ID verification unit transmits the source IP address of the second packet to the policy management device to receive a master ID corresponding thereto, and stores a sub ID and a master ID corresponding to the destination IP address of the second packet. Check in,
The policy inquiry unit transmits a master ID corresponding to the source IP address of the second packet, and a sub ID and master ID corresponding to the destination IP address of the second packet to the policy management device to query a policy and respond to an approval And receive
The transmission unit, the security device, characterized in that for transmitting the second packet to the first terminal communication device. The method of claim 1,
The policy inquiry unit,
A security device comprising: receiving and including a token seed in the authorization response, generating a token using the token seed, and inserting the token into the first packet. The method of claim 6,
The policy inquiry unit,
A security device comprising generating a token using a nonce, a payload of the first packet, a timestamp, the sub ID, and the token seed. The method of claim 1,
The policy management device,
As policy information, mapping information of the master ID of the other end communication device is stored for each sub ID and master ID of each end communication device allowed to communicate with each other, and the approval response is returned based on the policy information,
As IP address information, a master ID and mapping information of an IP address are stored, and a master ID corresponding to an IP address received from the ID verification unit is returned to the ID verification unit based on the IP address information. Device. As a method for providing security for communication between a first end communication device and a second end communication device by interworking with a policy management device in a security device,
Storing mapping information between an IP address and a sub ID and a master ID;
Receiving a first packet from the first end communication device to the second end communication device;
Transmitting the destination IP address of the first packet to the policy management device to receive a master ID corresponding thereto, and checking a sub ID and a master ID corresponding to the source IP address of the first packet in the storage unit;
Transmitting a master ID corresponding to the destination IP address, a sub ID and a master ID corresponding to the source IP address to the policy management device to query a policy and receive an approval response;
Transmitting the first packet to the second end communication device upon receipt of the acknowledgment response; And
And generating a session maintenance packet and transmitting it to the second end communication device. The method of claim 9,
Generating the session maintenance packet and transmitting it to the second end communication device,
And including a specific flag in a header of the session maintenance packet so that the second end communication device determines the session maintenance packet as a packet for session maintenance and deletes it. The method of claim 9,
A plurality of the first end communication devices belong to one service group,
One of the master IDs is assigned to the service group to which a public IP address is assigned,
Different sub IDs are allocated to each of the plurality of first end communication devices,
The method, characterized in that the security device is installed under a network address translation (NAT) on a communication layer in a mobile communication core network. The method of claim 9,
A plurality of the first end communication devices belong to one service group,
One of the master IDs is assigned to the service group to which a public IP address is assigned,
The same sub ID is assigned to each of the plurality of first end communication devices,
The security device, characterized in that installed above the NAT (Network Address Translation) on the communication layer in the mobile communication core network. The method of claim 9,
Receiving a second packet from the second end communication device side to the first end communication device;
Transmitting a source IP address of the second packet to the policy management device to receive a master ID corresponding thereto, and checking a sub ID and a master ID corresponding to the destination IP address of the second packet in the storage unit;
Transmitting a master ID corresponding to the source IP address of the second packet, and a sub ID and master ID corresponding to the destination IP address of the second packet to the policy management device to query a policy and receive an approval response ; And
And transmitting the second packet to the first end communication device. The method of claim 9,
And generating a token using the token seed included in the authorization response, and inserting the token into the first packet. The method of claim 14,
Inserting the token,
A method of generating a token using a nonce, a payload of the first packet, a timestamp, the sub ID, and the token seed. The method of claim 9,
The policy management device,
As policy information, mapping information of the master ID of the other end communication device is stored for each sub ID and master ID of each end communication device allowed to communicate with each other, and the approval response is returned based on the policy information,
As IP address information, mapping information of a master ID and an IP address is stored, and a master ID corresponding to an IP address received from the security device is returned to the security device based on the IP address information.

Images