KR100617315B1 - Method and apparatus for performing internet security protocol tunneling - Google Patents

Abstract

The present invention relates to a method and apparatus for processing Internet security protocol tunnel mode for securely delivering MIPv6 signals and user packets for routing optimization in Mobile Internet Protocol version 6 (MIPv6). A method for this is a method for processing an Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6; Mobile IPv6), and outbound IPsec of MIPv6 packets in a mobile node. For tunnel mode processing, selecting a security policy inquiry identifier and applying IPsec tunnel mode using the selected security policy identifier, and for inbound IPsec tunnel mode processing of MIPv6 packets at the mobile node, Selecting an inquiry identifier and verifying whether the inquired security policy and the IPsec process match using the selected security policy identifier. Thus, according to the present invention, by integrating the IPsec tunnel mode processing procedure with the MIPv6 module to operate well in an environment in which the mobility of the terminal exists, it is possible to provide a simpler and clearer IPsec processing procedure, and to provide a wireless and mobile network environment in the future. Can provide an easier and faster way to the implementation of equipment with IPsec security.

Description

Method and apparatus for performing internet security protocol tunneling}

1 is a flowchart illustrating a method for processing an Internet security protocol tunnel mode according to an embodiment of the present invention.

2 is a flowchart illustrating a method for processing an Internet security protocol tunnel mode according to another embodiment of the present invention.

3 is a block diagram illustrating an apparatus for processing an Internet security protocol tunnel mode according to an embodiment of the present invention.

4 is a block diagram illustrating an apparatus for processing an Internet security protocol tunnel mode according to another embodiment of the present invention.

5 is a diagram illustrating a security policy and a security association inquiry procedure.

6 is a diagram illustrating an outbound packet processing procedure.

7 is a diagram illustrating an inbound packet processing procedure.

<Explanation of symbols for the main parts of the drawings>

2 ... IPsec tunnel mode application section, 3 ... verification section,

10 ... IPsec module, 20 ... MIPv6 module,

30 ... IPv6 module, 40 ... IPv6-IPv6 tunneling module,

50 ... security policy module, 60 ... security association module.

The present invention relates to a method and apparatus for processing an Internet security protocol tunnel mode, and more particularly, to a method and apparatus for processing an Internet security protocol tunnel mode for safely delivering MIPv6 signals and user packets for routing optimization in Mobile Internet Protocol version 6 (MIPv6). It is about.

When transmitting and receiving information using the Internet, it is necessary to protect the information transmitted and received. Accordingly, an IP security protocol (IPsec) has been defined and used. IPsec is a communication protocol for realizing secure communication on the Internet, which is vulnerable to security. It is a communication protocol for preventing the act of eavesdropping on data by establishing a virtual dedicated line that can be used like a dedicated line on the Internet. This communication protocol can be installed on the user's terminal, and only certain clients and servers can exchange data with IPsec via the Internet.

Meanwhile, Internet protocol version 4 (IPv4), which is a communication protocol, is widely used. In addition, Internet protocol version 6 (IPv6), the next generation of IPv4, is defined. IPv6 extends the IP address space to 128 bits, further enhancing network scalability, also known as Next Generation Internet Protocol (IPng).

In general, IPsec services are divided into outbound processing and inbound processing of IP packets. Outbound processing of an IP packet is performed by searching for a security policy through a transmission / reception address and an identifier of a protocol and applying a corresponding security association to the IP packet. Inbound processing of the IP packet is first performed after the processing of the security association, and then the target address, the security parameter index (SPI), and the IPsec protocol are used to check whether the corresponding policy is correctly applied. However, this general IPsec application method requires a different method in Mobile IPv6 (MIPv6). This is because in MIPv6, a mobile node must be assigned a new address when moving to a new network. Therefore, it is necessary to distinguish between the mobile address and the identifier for retrieving the security policy to provide the correct IPsec service. As a result, this processing plays a very important role in the application of IPsec for providing secure mobility of MIPv6.

MIPv6 defines the use of IPsec tunnel mode and transport mode to protect the messages between the home agent and the mobile node when the mobile terminal moves. In this case, obtaining the correct IPsec policy for the message to be protected is applied in the application of IPsec. Most important of all.

The technical problem to be achieved by the present invention is to set up between the mobile node and the home agent used for the delivery of MIPv6 signaling and user packets for routing optimization in Mobile IPv6 (MIPv6; Mobile IPv6) to solve the above disadvantages The present invention provides a method for processing tunnel mode of the Internet security protocol.

Another technical problem to be solved by the present invention is to set up between the mobile node and the home agent used for the delivery of MIPv6 signals and user packets for routing optimization in Mobile IPv6 (MIPv6; Mobile IPv6) to solve the above disadvantages It is to provide an Internet security protocol tunnel mode processing device.

In order to achieve the above technical problem, the present invention provides a method for processing an Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6; Mobile IPv6).

(a) selecting a security policy inquiry identifier and applying an IPsec tunnel mode by using the selected security policy identifier for outbound IPsec tunnel mode processing of the MIPv6 packet in the mobile node; And

(b) selecting a security policy query identifier for inbound IPsec tunnel mode processing of the MIPv6 packet at the mobile node and verifying that the queryed security policy matches the IPsec processing using the selected security policy identifier; It provides an Internet security protocol tunnel mode processing method comprising a.

In order to achieve the above technical problem, the present invention provides a method for processing Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (Mobile IPv6),

Selecting a security policy identifier from the MIPv6 signal received from the corresponding node in the home agent, processing the IPsec tunnel mode using the selected security policy identifier, and delivering the same to the mobile node; And

Selecting a security policy identifier from the IPsec tunnel mode processed MIPv6 signal received from the mobile node at the home agent, removing the IPsec tunnel from the MIPv6 signal by using the selected security policy identifier, and transmitting the same to the corresponding node; An internet security protocol tunnel mode processing method is provided.

The present invention provides an apparatus for processing an Internet Security Protocol (IPsec) tunnel mode set up between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6; Mobile IPv6) in order to achieve the above technical problem.

Application means for selecting a security policy inquiry identifier and applying the IPsec tunnel mode using the selected security policy identifier for outbound IPsec tunnel mode processing of MIPv6 packets in the mobile node; And

For inbound IPsec tunnel mode processing of the MIPv6 packet in the mobile node, a security policy inquiry identifier is selected, and the verification means includes verifying whether the security policy and the IPsec processing matched using the selected security policy identifier. An internet security protocol tunnel mode processing apparatus is provided.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, when it is determined that detailed descriptions of related well-known technologies or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification.

Terms used in the present invention are defined as follows.

IPv6: Internet Protocol version 6

MIPv6: Mobile IPv6

SPDB: security policy database

SADB: security association database

HoA: Home address of the mobile node

HA: home agent address

CoA: mobile address of mobile node

CN: corresponding node address

ESP: Encapsulating Security Payload

AH: Authentication Header

MH: Mobility Header

HoTI: Home Test Start Message on Mobile IPv6

HoT: Home Test Message on Mobile IPv6

sa, sp: destination address and port

da, dp: destination address and port

x_ptc: ESP, AH as IPsec conversion protocol

Sa_ref: Information to logically link security policy with security association

1 is a flowchart illustrating a method for processing an Internet security protocol tunnel mode according to an embodiment of the present invention.

A method for processing an Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6) is described with reference to FIG. First, for processing outbound IPsec tunnel mode of the MIPv6 packet in the mobile node, a security policy inquiry identifier is selected, and the IPsec tunnel mode is applied using the selected security policy identifier (step S10). In addition, the mobile node selects a security policy inquiry identifier for inbound IPsec tunnel mode processing of the MIPv6 packet, and verifies whether the inquired security policy matches the IPsec processing using the selected security policy identifier (step S12). ).

Preferably, the steps S10 and S12 may include selecting a source address of a IPv6 header, a destination address, and a protocol type of next header information as a security policy inquiry identifier.

Also, the step S10 may include adding an IPv6 tunnel header including a source address and a destination address to the MIPv6 packet using the security policy inquiry identifier.

Meanwhile, the step S12 may include removing an IPv6 tunnel header including a source address and a destination address from the MIPv6 packet when the policy queried using the security policy inquiry identifier matches the IPsec process. .

2 is a flowchart illustrating a method for processing an Internet security protocol tunnel mode according to another embodiment of the present invention.

Referring to FIG. 2, a method for processing Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (Mobile IPv6) will be described. First, the home agent selects a security policy identifier from the MIPv6 signal received from the corresponding node, processes the IPsec tunnel mode using the selected security policy identifier, and delivers it to the mobile node (step S20). In addition, the home agent selects a security policy identifier from the IPsec tunnel mode processed MIPv6 signal received from the mobile node, removes the IPsec tunnel from the MIPv6 signal using the selected security policy identifier, and transfers the IPsec tunnel to the corresponding node (step S22). .

3 is a block diagram showing the Internet security protocol tunnel mode processing apparatus 1 according to an embodiment of the present invention.

Referring to FIG. 3, an apparatus 1 for processing Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6; Mobile IPv6) includes an IPsec tunnel mode application unit 2. And a verification unit 3. The IPsec tunnel mode applying unit 2 may select a security policy inquiry identifier and apply the IPsec tunnel mode by using the selected security policy identifier for outbound IPsec tunnel mode processing of MIPv6 packets in the mobile node. have. The verification unit 3 selects a security policy inquiry identifier for inbound IPsec tunnel mode processing of the MIPv6 packet in the mobile node, and checks whether the security policy and IPsec processing matched using the selected security policy identifier match. Can be verified

The IPsec tunnel mode application unit 2 and the verification unit 3 may select a protocol type which is a source address, a destination address, and next header information of an IPv6 header as a security policy inquiry identifier.

In addition, the IPsec tunnel mode applying unit 2 may add an IPv6 tunnel header including a source address and a destination address to the MIPv6 packet by using the security policy inquiry identifier.

Meanwhile, the verification unit 3 may remove the IPv6 tunnel header including the source address and the destination address from the MIPv6 packet when the policy queried using the security policy inquiry identifier matches the IPsec process.

4 is a block diagram showing the Internet security protocol tunnel mode processing apparatus 1 according to another embodiment of the present invention.

4, the Internet security protocol tunnel mode processing apparatus 1 according to the present invention is an IPsec module 10, MIPv6 module 20, IPv6 module 30, IPv6-IPv6 tunneling module 40, security policy Module 50, and security association module 60.

The MIPv6 IPsec tunnel mode application procedure provided by the present invention is divided into an outbound packet processing procedure and an inbound packet processing procedure. This procedure can be performed by the Internet security protocol tunnel mode processing apparatus 1 according to the present invention.

The IPsec module 10 is in charge of IPsec processing, and the MIPv6 module 20 performs processing related to node mobility. The IPv6 module 30 is responsible for the IPv6 packet processing procedure, and the IPv6-IPv6 tunneling module 40 provides an IPv6 tunneling header. The security policy module 50 is responsible for information on the packet to apply IPsec and IPsec security policy management, and the security association module 60 is responsible for management of security association.

The Internet security protocol tunnel mode processing apparatus 1 according to the present invention as described above may be included in a mobile node and a home agent.

Now, with reference to Figures 4 to 7 the Internet security protocol tunnel mode processing method and apparatus according to the present invention. 5 is a diagram illustrating a security policy and a security association inquiry procedure, FIG. 6 is a diagram illustrating an outbound packet processing procedure in a MIPv6 IPsec tunnel mode, and FIG. 7 is a diagram illustrating an inbound packet processing procedure in a MIPv6 IPsec tunnel mode. to be.

First, outbound IPsec tunnel mode processing in MIPv6 in the mobile node will be described. Outbound IPsec tunnel mode processing can be used when forwarding HoTI messages to corresponding nodes via a home agent. First, the IPv6 module 30 and the MIPv6 module 20 generate a packet having an IPv6 header, an MH header and data as shown by reference numeral 100 of FIG. 6.

Then, the tunneling operation is requested to the IPv6-IPv6 tunneling module 40 to obtain a packet as shown by reference numeral 102 of FIG. 6 according to the MIPv6 specification. When the IPv6-IPv6 tunneling operation is completed, the IPsec policy is inquired to the security policy module 50 using sa, da, and protocol (MH) as in the IPsec security policy inquiry procedure of FIG. 5. At this time, sa and da and the next header information as the identifier for the policy inquiry select the (HoA, CN, MH) information of the internal IPv6 header. Here, first, after examining the next header of the outer IPv6 header, if the next header is an IPv6 header, a procedure to use the information of the inner header as a policy identifier is performed. That is, since the next header is an IPv6 header indicates that the packet is an IPv6-IPv6 tunneled packet, an identifier for policy lookup is taken from the internal IPv6 header. Therefore, the security association can be obtained from the security association module 60 as shown in FIG. 5 by using the logical structure for obtaining the corresponding security association while the corresponding policy is inquired. As a result, after the IPsec ESP processing is performed, the final IPv6 packet as shown by reference numeral 104 of FIG. 6 can be obtained.

Similarly, a home agent receiving a packet similar to reference numeral 100 of FIG. 6 where sa is CN and da is HoA, for example, as in the case of a HoT message delivered from a corresponding node to a mobile node via a home agent. In the case of, the processing proceeds in the same way as the outbound IPsec tunnel mode processing of the mobile node.

Meanwhile, in the mobile node, inbound IPsec tunnel mode processing will be described. First, the mobile node receives an IPv6 packet, such as reference numeral 200 of FIG. At this time, the IPsec module 10 obtains (da, spi, x_ptc) information as shown in the inbound process of FIG. 5 by looking at the external IPv6 header and the IPsec header and requests the security association information to the security association module 60 using the same. . When the security association is inquired, the IPsec module 10 performs IPsec processing and removes the ESP header as shown by reference numeral 202 of FIG. 7.

After successful IPsec processing, it verifies whether the IPsec processing conforms to the security policy. The security policy inquiry identifier used at this time is (sa, da, next header) information of the IPv6 internal header. As in the outbound process, this allows the procedure to use the internal IPv6 header information only when the next header information of the external IPv6 is the IPv6 header. Therefore, it selects (CN, HoA, MH) as an identifier from the internal IPv6 header and verifies whether the inquired policy and IPsec processing match. When the verification is completed, the IPv6 module 30 removes the tunnel header as shown by reference numeral 204 of FIG. 7, and then passes the packet to the MIPv6 module 20 for MIPv6 signal processing.

On the other hand, a home agent receiving an IPsec tunnel message from a mobile node where sa is CoA and da is HA may be similarly performed according to the mobile node inbound IPsec tunnel processing procedure. As a result, the IPv6 packet with the tunnel header removed is forwarded to the destination address of the inner header.

In addition, the present invention can be applied to the use of the IPsec tunnel mode for the delivery of user packets on MIPv6.

The present invention can be used in a communication service for providing a mobile terminal safely and efficiently using an IPv6 network.

Although the preferred embodiments of the present invention have been described in detail above, those of ordinary skill in the art to which the present invention pertains may make various changes without departing from the spirit and scope of the present invention as defined in the appended claims. It will be appreciated that modifications or variations may be made. Accordingly, modifications to future embodiments of the present invention will not depart from the technology of the present invention.

As described above, the present invention provides a simpler and clearer IPsec processing procedure by linking the IPsec tunnel mode processing procedure with the MIPv6 module so as to operate well in an environment where the mobility of the terminal exists. Therefore, it is possible to provide an easier and faster method for the implementation of equipment with IPsec security in the future wireless and mobile network environment.

Claims (9)

A method for processing Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6; Mobile IPv6), (a) In the mobile node, for outbound IPsec tunnel mode processing of MIPv6 packets, a security policy inquiry identifier including a source address of a IPv6 header, a destination address, and a protocol type, which is next header information, is selected, and Applying an IPsec tunnel mode by adding an IPv6 tunnel header including a source address and a destination address to the MIPv6 packet using a security policy inquiry identifier; And (b) The mobile node selects the security policy query identifier for inbound IPsec tunnel mode processing of MIPv6 packets, and if the policy queried using the security policy query identifier matches IPsec processing, the IPv6 And removing a tunnel header from the MIPv6 packet. delete delete delete A method for processing Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (Mobile IPv6), From the MIPv6 signal received from the correspondent node, the home agent selects a security policy identifier including a source address of the IPv6 header, a destination address, and a protocol type, which is next header information, and uses the selected security policy identifier to select a source address and Forwarding an IPv6 tunnel header including a destination address to the MIPv6 packet to a mobile node; And In the home agent, the security policy identifier is selected from the IPsec tunnel mode processed MIPv6 signal received from the mobile node, and when the policy queried using the security policy inquiry identifier matches the IPsec processing, the IPv6 tunnel header is set to the MIPv6. Removing from the packet and forwarding the packet to the corresponding node. An apparatus for processing Internet Security Protocol (IPsec) tunnel mode established between a mobile node and a home agent on Mobile Internet Protocol version 6 (MIPv6; Mobile IPv6), For the outbound IPsec tunnel mode processing of the MIPv6 packet in the mobile node, a security policy inquiry identifier including a source address, a destination address, and a protocol type, which is the next header information, is selected and the selected security is selected. Applying means for applying an IPsec tunnel mode by adding an IPv6 tunnel header including a source address and a destination address to the MIPv6 packet using a policy identifier; And For the inbound IPsec tunnel mode processing of the MIPv6 packet in the mobile node, the security policy inquiry identifier is selected, and when the policy queried using the security policy inquiry identifier matches the IPsec processing, the IPv6 tunnel header is selected. And verification means for removing from the MIPv6 packet. delete delete delete

Images