KR20110087972A - Method for blocking abnormal traffic using session table - Google Patents

Abstract

PURPOSE: A method for blocking an abnormal traffic using a session table is provided to monitor an abnormal traffic in an IPSec protocol network. CONSTITUTION: A session table is created in a security system(300) when a security session is established using an IPSec protocol between a transmission part and a reception part. Predetermined information is extracted from a normal packet header which is received from the transmission part. The session table is updated using the extracted information. The predetermined information is extracted from the received packet and the information is compared with the information of the corresponding session table.

Description

Method for blocking abnormal traffic using session table}

The present invention relates to a method for monitoring and blocking abnormal traffic in a manner of managing a predetermined field of an extension header for an IPSec protocol in a session table in a secure communication performed using the IPSec protocol.

The IPSec protocol is a security service that can be applied between the IP layer and the transport layer, and is a security protocol that can be applied to network security independently and to communication between hosts. The IPv6 protocol recommends using the IPSec protocol as a basic security technology. The IPSec protocol provides services such as data integrity, authentication, confidentiality, and nonrepudiation by authenticating or encrypting IP packets.

In the case of the packet to which the IPSec protocol is applied, it is required to go through key agreement, authentication, and encryption parameter setting during transmission and reception. In addition, since the secret key must be shared between the transmitting and receiving parties through a security association (SA) negotiation, authentication (AH extended header) and encryption (ESP extended header) must be performed using the shared key. There is a problem that it is difficult to process traffic quickly and accurately in a security system located.

When the IPSec protocol operates in tunnel mode, the IPSec protocol is applied between the security gates between both ends. Therefore, when the security system is installed outside the tunnel, the IPSec protocol is regarded as unapplied traffic. . On the other hand, if the security system is installed inside the tunnel, the above-mentioned reasons make it difficult to process the traffic to which the IPSec protocol is applied quickly.

On the other hand, when the IPSec protocol operates in the transmission mode, the same problem continues because the security system has to handle the traffic to which the IPSec protocol is applied.

In particular, since the security system of the intermediate security system cannot check the packet encrypted by the ESP extension header, the security system cannot respond properly when the attacker cleverly applies the ESP extension header to the packet containing the malicious code.

In order to solve this problem, a countermeasure using key distribution has been proposed. The key distribution scheme is to share the key used in the IPSec protocol with the security system so that abnormal traffic can be checked for AH-authenticated or ESP-encrypted traffic.

That is, the packet encrypted by applying the ESP extension header cannot be determined by the security system. However, if the security system shares the same encryption algorithm with the same key as the receiver, the received packet can be decrypted to determine whether the packet is encrypted. Can be.

However, the following problems are caused by the key distribution method.

First, there is a risk that the key is exposed to the security system for key distribution.

Secondly, the key distribution method with the security system using IPSec requires an additional IPSec communication in order to transmit a key and an encryption algorithm, thereby increasing network overhead. You can also consider copying one key value to the security system when the sender / receiver divides it, but there is also a risk of being attacked by hackers. In addition, after deciphering the packet in the security system, it may be considered to ask the receiver whether to re-encrypt the packet or transmit it as it is, but this also incurs network overhead.

An object of the present invention is to provide a method for monitoring abnormal traffic by a network security system located in the middle of a transmission path in an IPSec protocol network to which an ESP extension header is applied.

In order to solve the above problems, the present invention proposes, as an example, a method in which a security system on a transmission path blocks abnormal traffic.

In the abnormal traffic blocking method according to an embodiment of the present invention, if a secure session using an IPSec protocol is established between a sender and a receiver, a session table is generated in the security system, and a normal packet received from the sender is included. Extracting predetermined information from a header, updating the session table using the extracted information, extracting predetermined information from a header of a received packet, and comparing the corresponding information in the session table with the received packet to be abnormal. Determining whether or not it is.

The predetermined information extracted from the received packet includes at least one of a source IP address, a destination IP address, a security parameter index (SPI), and a sequence number.

The security system compares the security parameter index of the received packet with the session table to block abnormal traffic disguised as a source IP address.

The security system also blocks the attacker's retransmission attack by comparing the sequence numbers of the received packets in the session table.

In addition, the security system compares the source IP address, the destination IP address, the security parameter index and the sequence number of the received packet with the session table to block a large amount of abnormal traffic attack.

According to the abnormal traffic monitoring method of the present invention, there is no overhead for key distribution and no risk of key exposure compared to the conventional key distribution method, thereby maintaining a higher security level from end to end. In addition, since the header information of the IPSec protocol is used, the processing can be performed faster than the corresponding method in the transport layer or the application layer. In addition, when collaborating with other security policies performed at the network layer, abnormal traffic can be monitored more thoroughly.

1 shows the structure of an extension header of an AH in an IPSec protocol.
2 illustrates the structure of an extension header of an ESP in an IPSec protocol.
3 is a block diagram of a network communication system to which an abnormal traffic blocking method of the present invention is applied.
4 illustrates a specific example of a session table managed in a security system.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention manages the SPI item and sequence number item of the extension header as a session table in the security system whenever a secure session using the IPSec protocol is established. Compare abnormal information to block abnormal traffic.

Before describing the operation of the security system in detail, the basic packet configuration of the IPSec protocol will be described.

1 shows the structure of an extension header of an AH in an IPSec protocol.

The authentication header (AH) of the IPsec protocol supports data integrity and authentication of IP packets and provides protection against replay attacks. Data integrity can be checked to determine whether the transmission packet is illegally modified, and authentication can be used to verify that the final receiving system or network device is normal for the user or application.

As shown in FIG. 1, the extended header of the AH includes, in particular, a security parameter index (SPI) field 11 and a sequence number field 12.

Next, Fig. 2 shows the structure of the extension header of the ESP in the IPSec protocol.

Encapsulating Security Payload (ESP) includes the basic functions provided by AH and additionally provides confidentiality of the message content. The content of the message is encrypted by a predetermined algorithm to maintain confidentiality.

As shown in FIG. 2, it can be seen that the extension header of the ESP includes the SPI field 11 and the sequence number field 12.

1 and 2, the SPI field 11 is used to identify a secure connection applied to a received packet by combining it with a destination address and a security protocol (AH or ESP).

In addition, the sequence number field 12 provides a reproduction blocking protection function to the packet. The sequence number is a 32-bit number that increases in order starting from 1 and indicates the serial number of packets sent to the fast mode security connection for that communication. The sequence number cannot be repeated during a quick mode secure connection. That is, the receiving computer checks the sequence number field of the received packet to confirm whether there is a packet previously received with the number for the secure connection, and if the received packet exists, the packet is rejected.

The SPI entry (11) and sequence number entry (12) in the AH and ESP extension headers provide information that the network security system can always determine, regardless of which mode the IPSec protocol is operating in (for example, tunnel mode or transport mode). to be.

Based on the basic structure of the IPSec protocol described above, the abnormal traffic blocking method of the security system will be described in detail.

3 is a block diagram of a network communication system to which an abnormal traffic blocking method of the present invention is applied.

When an IPSec protocol session is established to perform secure data communication between the host 1 100 of the source and the host 2 200 of the destination, the session for the data communication is transmitted to the security system 300. The table is created.

After the normal packet is sent from the host 1 to the security system 300, the source IP address, the destination IP address, the SPI and the sequence number are obtained from the IP header and the IPSec extension header of the packet and added to the session table. Here, the source IP address, the destination IP address, and the SPI are values that do not change after the IPSec protocol session is connected after SA negotiation, whereas the sequence number is a value that is updated each time a packet is transmitted.

The process of managing the session table and monitoring abnormal traffic by the security system 300 will be described with reference to the example of FIG. 4 as follows. 4 illustrates a specific example of a session table managed in a security system.

In the example of FIG. 3, the host 1 (100) of the sending side having the source IP address of 3ffe: ffff: 0: f102 :: 2 and the receiving side having the destination IP address of 2001: 3ffe: 0: f101 :: 6 When Host 2 200 of S1 initially creates an SA, one SPI is created and the sequence number is initialized to zero. At this time, a new session table is created in the security system 300.

In this state, when a packet is transmitted from the host 1 (100), the intermediate security system 300 obtains a source IP address, a destination IP address, an SPI, and a sequence number from the packet and records the first record (R01) in the session table. Add to

Thereafter, whenever the host 1 (100) and the host 2 (200) encrypts or authenticates a packet according to SA and transmits the packet, the SPI is not changed and the sequence number is increased by one. Each time a packet is transmitted, one record is added to the session table of the security system 300.

In the case of an attack being attempted due to abnormal traffic in the network system of FIG. 3, an attack blocking method according to each type will be described in detail.

<Attack type 1>

In FIG. 3, when the attacker attacks the host 2 200 by masquerading as the IP address of the host 1 100, the security system 300 stores the SPI value and the sequence number value of the received packet in the session of the security system 300. Abnormal traffic can be detected by comparing the SPI values in the table with the sequence number values.

For example, if an attacker sent a fake packet by setting the IP address of Host 1 (100) "3ffe: ffff: 0: f102 :: 2" as the source IP address, the SPI value of the fake packet (for example, For example, since "0x9326adec" is different from the SPI value of the session table ("0x08ce81ae" in the example of FIG. 4), the security system 300 may detect that the spoofed packet is abnormal traffic. Therefore, the spoof packet is dropped immediately after being sent to the destination.

<Attack type 2>

An attacker may launch a retransmission attack on the network system of FIG.

However, in the network system of FIG. 3, since the sequence number is information shared only between the host 1 (100) and the host 2 (200), the attacker attacks the retransmission attack without knowing the correct sequence number.

In other words, the attacker needs to estimate the sequence number and send the packet. Since the estimated sequence number has a high probability of overlapping with information previously stored in the session table of the security system 300, the success rate of the retransmission attack is very low.

For example, when an attacker transmits a spoofed packet with a sequence number "5", the sequence number of the spoofed packet is duplicated with the sequence number "5" of one of the records (R02) previously stored in the session table. The security system 300 may detect that the spoofed packet is abnormal traffic. Therefore, the spoof packet is dropped immediately after being sent to the destination.

<Attack type 3>

An attacker can also launch a large-scale abnormal traffic attack that exploits the IPSec protocol. In this case, blocking all traffic, including normal traffic, causes serious problems with the quality of service.

Therefore, the security system 300 compares the source IP address, the destination IP address, the SPI, the sequence numbers of the received packets with those in the session table, and transmits only those determined to be normal traffic to the receiving party for an appropriate level of quality assurance. Make sure the service is done.

In this process, in order to overcome the limitations of the vulnerabilities for the large traffic abnormality of the IPSec protocol, the netfilter6 framework can be used to respond to the large traffic abnormalities in real time in the IPv6 environment, and the CBQ mechanism is added to reduce the false positive rate. This can reduce the bandwidth of suspicious traffic.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements may be made by those skilled in the art using the basic concept of the present invention as defined in the following claims. It belongs to the scope of the present invention.

Claims (5)

In the security system on the transmission path to block abnormal traffic,
Generating a session table in the security system when a secure session is established between the transmitting side and the receiving side using the IPSec protocol;
Extracting predetermined information from a header of a normal packet received from the transmitting side, and updating the session table using the extracted information; And
Extracting predetermined information from a header of a received packet and comparing the corresponding information in the session table to determine whether the received packet is abnormal;
Blocking of abnormal traffic using the session table comprising a. The method of claim 1,
The predetermined information extracted from the received packet is at least one of a source IP address, a destination IP address, a security parameter index (SPI), and a sequence number. How to block traffic. The method of claim 2,
The security system is to block the abnormal traffic disguised as a source IP address by comparing the security parameter index of the received packet with the session table. The method of claim 2,
The security system is to block the abnormal traffic using the session table, characterized in that for comparing the sequence number of the received packet in the session table to block the retransmission attack of the attacker. The method of claim 2,
The security system compares the source IP address, the destination IP address, the security parameter index, and the sequence number of the received packet with the session table to block a large amount of abnormal traffic attack, wherein the abnormal traffic using the session table How to block.

Images