KR100411436B1 - Method for distributing calculation of router in virtual private network - Google Patents

Abstract

The present invention relates to a method for distributing router computation in a virtual private network. Therefore, in the present invention, in order to reduce the computation of routers in a virtual private network, if a host transmits data to a host of a subnet of another router after the virtual private network tunnel is created, the host is cryptographic instead of performing all cryptographic operations. The security combination necessary to perform the operation is transmitted from the router to the host, and the host generates the virtual private network packet using the security combination, and transmits the data to the router. In the virtual private network, the router separates only the data to be transmitted through the virtual private network tunnel from the packet sent by the host and transmits the data using the virtual private network tunnel.

Therefore, in the present invention, the host performs calculations to be performed by the router for tunneling of the virtual private network in the virtual private network, thereby reducing the amount of computation required by the router for tunneling of the virtual private network, thereby greatly improving the throughput of the router without improving the performance of the router. It can provide a platform for building a virtual private network without reducing it.

Description

Method for distributing calculation of router in virtual private network}

The present invention relates to a method for enabling a router to handle a large amount of VPN traffic in a tunnel mode virtual private network (hereinafter referred to as a VPN) using IPsec. The present invention relates to a method for distributing router calculations to a host by causing a host to perform cryptographic operations.

Tunnel mode VPNs typically create VPN terminals using cryptographic algorithms between router 10 and router 20 as shown in FIG.

Referring to FIG. 1, using the VPN tunnel, hosts 1 to 3 belonging to the subnet of the first router 10 belong to the subnet of the second router 20 which is another router. Data can be exchanged with the hosts n-2 to n without being exposed to the third party. In order to perform such VPN tunneling, operations such as key distribution, mutual authentication, encryption / decryption, and the like are performed in the conventional IPsec tunnel mode VPN.

As such, in the conventional IPsec tunnel mode VPN, hosts belonging to the router's subnet can use the VPN tunnel generated by the router without any cryptographic operation, but the router encrypts all packets using the VPN tunnel created by the router. You must perform the operation.

Conventionally, VPN tunnel generation using IPsec is divided into a key distribution portion for protecting a security association (hereinafter referred to as SA) and an IPsec policy setting portion for protecting traffic. Is done according to.

Referring to FIG. 2, after the SA of the Internet Key Exchange (IKE) is set between the two routers 10 and 20 using the steps (S1) to (S3), the steps (S4) and (S5) are performed. The IPsec policy to be performed between the two routers 10 and 20 is determined. Once the IKE SA is set up, a VPN tunnel can be created by performing an IPsec policy using only the steps (S4) and (S5). In this process, a VPN tunnel using IPsec is created between the two routers 10 and 20, and secure communication is performed between the two routers 10 and 20 and hosts 1 to n belonging to the router's subnet. Can be done. That is, if a host belonging to one router's subnet sends data to be transferred by a host belonging to another router's subnet without any conversion, the router changes the data to fit the VPN and uses the created VPN tunnel. Send it to the other router.

As described above, the AH is generated after receiving a packet and generating an authentication header (AH) for key distribution and authentication and an encryption security payload (ESP) for encryption. The router performed all the reassembly of packets to apply.

As described above, since the router performs all cryptographic operations for key distribution, authentication, and encryption / decryption, there is a problem in that the amount of data that the router can process is drastically reduced.

515-UR 520-UR 525-UR 535-UR Cleartext (Mbps) 170 370 370 1,000 3DES (Mbps) 11 20 20 100

Table 1 above compares the amount of data processed by the CISCO VPN device, and shows the processing speed in the case of the plain text processing and the cipher text processing.

Referring to Table 1, it can be seen that when the CISCO VPN device processes the cipher text, the processing power is reduced to 1/10 or less than when the plain text is processed.

In order to compensate for this, the conventional virtual private network uses a high-performance central processor unit (hereinafter referred to as a CPU) in a router or a dedicated CPU or device for cryptographic operation.

In addition, in the conventional virtual private network, since the router must perform packet reassembly for the router to apply the AH, a lot of memory is required.

Accordingly, an object of the present invention is to provide a method for enabling a router to handle a large amount of VPN traffic in a virtual private network.

Another object of the present invention is to provide a method for allowing a host to perform cryptographic operations that a router must perform for VPN tunneling in a virtual private network.

Another object of the present invention is to provide a method of improving the efficiency of a router by distributing the calculation of a router to a host in a virtual private network.

The present invention to achieve these objectives is to reduce the computation of routers in a virtual private network, in which case the hosts transmit data to hosts in another router's subnet after the VPN tunnel is created, instead of the router performing all cryptographic operations. Transmits the SA required for performing the cryptographic operation from the router to the host, and the host generates the VPN packet using the SA and transmits the data to the router.

In addition, the present invention is characterized in that in the virtual private network, the router separates only the data to be transmitted through the VPN tunnel from the packet sent by the host and transmits the data using the VPN tunnel.

Accordingly, the present invention provides a method of transmitting a destination address and related information from a host to a router; Transmitting, by the router, an SA according to the transmitted destination address and related information to the host; And generating a packet for the virtual private network terminal at the host and transmitting the packet to the router.

The packet for the virtual private network terminal may include at least information for transmitting the packet from the host to the router.

In addition, the present invention provides a process for a router to check a destination address, and transmit an SA and a corresponding packet to the destination host for authentication and decryption of the virtual private network packet; And authenticating and decoding the received packet by using the SA received by the host.

1 is a tunnel mode configuration diagram of a virtual private network.

2 is a diagram illustrating a tunnel setting process of a virtual private network.

3 is a diagram illustrating a processing procedure for a packet leaving a virtual private network according to an embodiment of the present invention.

4 is a diagram illustrating a format of a packet transmitted in a virtual private network according to an embodiment of the present invention.

5 is a diagram illustrating a processing procedure for an incoming packet in a virtual private network according to an embodiment of the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

In addition, the present invention will be described under the assumption that a VPN tunnel has already been created between routers since the VPN tunnel is generated for data transmission.

That is, the routers 10 and 20 are referred to as a security policy database (hereinafter referred to as SPD) and a security association database (hereinafter referred to as SAD) by a process S1 to S5 as shown in FIG. The router 10 utilizes a VPN tunnel generated by processing data transmitted from the other router 20 or information transmitted from a host in the subnet according to a predetermined rule.

In order to distribute the calculation of the router in the VPN according to the present invention, since the processing for the incoming packet and the outgoing packet is different, it will be described separately.

First, a method of processing an outgoing packet in a VPN according to the present invention is as follows.

3 and 4, in step S11, the host 1 transmits a destination address and related information to the router 10 in order to inform the router 10 of a destination address for which VPN tunneling is desired. do.

Then, in the step S12, the router 10 searches for the SPD and the SAD, searches for the SA according to the destination address and the policy transmitted from the host 1, and transmits the information to the host 1. If the required SA does not exist in the SAD, but tunneling is required by the SPD, a process as shown in FIG. 2 is performed to set the SA and transmit the value to the host 1 that wants to perform VPN tunneling. .

Then, in step S13, the host 1 generates a VPN packet to be generated by the router 10 for VPN tunneling using the SA received from the router 10, and sends the packet to the router 10. send.

4 is a format of a VPN packet according to the present invention, wherein a new IP header has information for transmitting the packet from the host to the router.

Then, the router 10 transmits the packet for VPN tunneling excluding the new IP header part from the packet sent by the host 1 to the host 10.

On the other hand, in the VPN according to the present invention to process the incoming packet in order to distribute the calculation of the router is as follows.

IPsec Tunnel Mode The packets coming in through the VPN tunnel are encrypted with the IP header and hidden with a new IP header to hide the sender and receiver. In such a case, the receiving IP of the external IP header usually points to the router to which the host of the original IP header belongs, and the packet is transmitted to the router of the subnet to which the host belongs. Therefore, the router receiving the packet through the VPN tunnel can send the packet to the correct host only after confirming the original destination address in the encrypted IP header inside the received packet.

If the AH and ESP are processed for all packets received from the external network through the VPN tunnel, the router must perform all authentication and decryption. In addition, when AH is applied, a large memory space is required because authentication must be performed after reassembling the entire packet.

Instead of performing this operation, the router 20 decrypts only the portion corresponding to the IP header behind the AH in step S21 to confirm the destination IP as shown in FIG. 5. In operation S22, the router 20 transmits the SA and the corresponding packet to the destination host n to authenticate and decrypt the VPN packet.

The host n then authenticates and decrypts the received packet using the received SA.

As described above, the present invention reduces the amount of computation required by the router for VPN tunneling by performing a calculation that the router must perform for VPN tunneling in a VPN, without significantly reducing the throughput of the router without improving the performance of the router. You can get a foothold in building a VPN. In addition, when the AH is used in a VPN, the present invention requires reassembly of packets for authentication of packets, and thus requires the memory of the router. However, the memory of the router needs to be increased by performing such packet reassembly on the host. There is no advantage in implementing VPN tunneling at no additional cost.

Claims (3)

In a method for distributing router computation in a virtual private network, If the hosts send data to a host on another router's subnet after the tunnel in the virtual private network is created, the security association required for the host to perform the cryptographic operation instead of the router performing all the cryptographic operations. Transmitting from the router to the host; A host generating a packet of a virtual private network using the security combination, and transmitting the data to a corresponding router; Wherein the router separates only the data to be sent through the tunnel of the virtual private network from the packet sent by the host and transmits the data using the tunnel of the virtual private network. In a method for distributing router computation in a virtual private network, Transmitting a destination address and related information from a host to a router; Transmitting, by the router, a security combination according to the transmitted destination address and related information to the host; And generating at least one packet for a virtual private network terminal at the host and transmitting the packet to the router. The method of claim 2, wherein the packet for the virtual private network terminal, At least information for transmitting a packet from the host to the router.