KR20220064567A - Apparatus and method for constructing virtual private network based on quantum random number - Google Patents

Abstract

Disclosed are a device and a method for constructing a virtual private network (VPN) based on a quantum random number, which cannot be inferred. According to an embodiment of the present invention, the VPN device for constructing a VPN by communicating with a VPN client, comprises: a quantum random number generator for generating a quantum random number; and a session management unit for exchanging a pseudorandom number with a VPN client to generate a first session key, establishing a first VPN session, transmitting a first quantum random number generated by the quantum random number generator to the first client, and generating a second session key on the basis of the first quantum random number to establish a second VPN session.

Description

Apparatus and method for constructing virtual private network based on quantum random number}

The present invention relates to a virtual private network (VPN) technology, and more particularly, to an apparatus and method for constructing a virtual private network based on quantum random numbers.

A virtual private network (VPN) is a network in which hosts belonging to two different networks are virtually bundled so that they can communicate with each other. When establishing a virtual private network, a VPN server and a VPN client perform an authentication procedure through an SSL handshake process and generate a session key for encrypting and decrypting data. The VPN server and VPN client exchange random numbers with each other through Hello messages to generate a session key, which is a proxy key, respectively.

The random number for generating the session key is a pseudo-random number. A pseudorandom number is literally a number that a computer makes similar to look like a random number. Since it is not a completely random number, but a number generated by a computer through a predetermined formula, the probability is low, but the number is generated with a certain periodicity and pattern. In other words, since it is possible to infer the pseudo-random number generated by the VPN server and the VPN client and use it to generate a session key, the pseudo-random number is somewhat risky to use for security. Also, the Hello message generated by the VPN server and VPN client to exchange random numbers during the SSL handshake is not encrypted. Therefore, the session key may be exposed by hacking the random number through the Hello message.

If the session key is exposed by random number prediction or leakage, there is no secondary backup and defense measures to protect the existing VPN session. Normally, if the session key is exposed, you can break the VPN session and generate a new session key with a newly generated random number through reconnection. in providing the best network service to customers inevitably causes difficulties.

An object of the present invention is to provide an apparatus and method for establishing a virtual private network (VPN) based on quantum random numbers that cannot be inferred.

Another object of the present invention is to provide an apparatus and method for controlling an unauthenticated VPN client based on a quantum random number in a virtual private network environment.

A VPN device for establishing a virtual private network by communicating with a VPN (Virtual Private Network) client according to an embodiment includes: a quantum random number generator for generating a quantum random number; and exchanging pseudorandom numbers with the VPN client to generate a first session key and establish a first VPN session, transmit the first quantum random number generated by the quantum random number generator to the VPN client, and based on the first quantum random number and a session manager for establishing a secondary VPN session by generating a secondary session key with

The session manager may generate a quantum random number exchange message including the first quantum random number, encrypt the quantum random number exchange message with the primary session key, and transmit it to the VPN client.

The session manager receives, from the VPN client, a quantum random number exchange completion message including session identification information and an IP address for the secondary VPN session and encrypted with the secondary session key, the encrypted quantum random number exchange completion message can be decrypted with the secondary session key.

The session manager, after creating a first virtual NIC based on a physical network interface card (NIC), establishes the first VPN session based on the first virtual NIC, and configures the first virtual NIC After creating a second virtual NIC based on the second virtual NIC, the second VPN session may be established based on the second virtual NIC.

The VPN device further includes a certificate manager for receiving and storing the certificate authority private key from a certificate authority, wherein the session manager encrypts the second quantum random number generated by the quantum random number generator with the certificate authority private key It is transmitted to the VPN client, and the VPN session with the VPN client may be forcibly terminated depending on whether the second quantum random number is received from the VPN client.

The session manager may transmit the second quantum random number to the VPN client when it is determined that the VPN client is in an inactive state without transmitting data based on the session state information periodically received from the VPN client.

The session manager may generate a reduced message of a specific size by applying the second quantum random number to a hash algorithm, encrypt the reduced message with the authentication authority private key, and transmit it to the VPN client.

The session manager may forcibly terminate the VPN session with the VPN client according to whether the same message as the reduced message is received from the VPN client.

According to an embodiment, a method in which a virtual private network (VPN) server communicates with a VPN client to establish a virtual private network includes the steps of exchanging a pseudorandom number with the VPN client to generate a primary session key and establishing a primary VPN session ; and transmitting the first quantum random number generated by the quantum random number generator to the VPN client and generating a secondary session key based on the first quantum random number to establish a secondary VPN session.

The establishing of the secondary VPN session may include generating a quantum random number exchange message including the first quantum random number, encrypting the quantum random number exchange message with the primary session key, and transmitting the message to the VPN client. there is.

The method includes receiving, from the VPN client, a quantum random number exchange completion message including session identification information and IP address for the secondary VPN session and encrypted with the secondary session key, and receiving the encrypted quantum random number exchange completion message The method may further include decrypting with the secondary session key.

The step of establishing the first VPN session includes creating a first virtual NIC based on a physical network interface card (NIC), and establishing the first VPN session based on the first virtual NIC; The establishing of the secondary VPN session may include creating a second virtual NIC based on the first virtual NIC and establishing the secondary VPN session based on the second virtual NIC.

The method includes the steps of receiving and storing a certificate authority private key issued from a certificate authority; encrypting the second quantum random number generated by the quantum random number generator with the certificate authority private key and transmitting the encrypted second quantum random number to the VPN client; and forcibly terminating the VPN session with the VPN client according to whether the second quantum random number is received from the VPN client.

In the step of encrypting the second quantum random number with the certificate authority private key and transmitting it to the VPN client, it is determined that the VPN client is in an inactive state without transmitting data based on session state information periodically received from the VPN client In this case, the second quantum random number may be transmitted to the VPN client.

The step of encrypting the second quantum random number with the authentication authority private key and transmitting it to the VPN client includes generating a reduced message of a specific size by applying the second quantum random number to a hash algorithm, and authenticating the reduced message. It can be transmitted to the VPN client by encrypting it with an institution private key.

In the forced termination, the VPN session with the VPN client may be forcibly terminated depending on whether a message identical to the reduced message is received from the VPN client.

A VPN device for establishing a virtual private network by communicating with a VPN (Virtual Private Network) server according to an embodiment includes: a communication unit communicating with the VPN server; processor; and a memory for storing instructions executable by the processor, wherein the processor exchanges a pseudorandom number with the VPN server to generate a primary session key and establish a primary VPN session, which is received from the VPN server A secondary VPN session may be established by generating a secondary session key based on the first quantum random number.

According to the present invention, the security of a virtual private network can be improved by constructing a virtual private network (VPN) based on a quantum random number that cannot be inferred.

The present invention can improve the security of a virtual private network by detecting an unauthenticated VPN client based on a quantum random number in a virtual private network environment.

The present invention can be applied to any SDN (Software Defined Network)-based network environment while improving security at low cost by establishing double VPN tunneling without modification of the conventional SSL protocol, thereby ensuring high compatibility.

1 is a diagram illustrating a VPN environment according to an embodiment of the present invention.
2 is a diagram showing a duplex structure of a conventional VPN session.
3 is a diagram illustrating a redundant structure of a VPN session according to an embodiment of the present invention.
4 is a diagram showing the configuration of a VPN server according to an embodiment of the present invention.
5 is a flowchart illustrating a method for controlling a VPN session of a VPN client in a VPN server according to an embodiment of the present invention.
6 is a flowchart illustrating a method for establishing a session between a VPN server and a VPN client according to an embodiment of the present invention.

The above-described objects, features, and advantages will become more apparent through the following detailed description in relation to the accompanying drawings, whereby those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in the description of the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a VPN environment according to an embodiment of the present invention. Referring to FIG. 1 , the VPN environment according to the present embodiment has a one-to-N (N is a natural number) structure in which at least one VPN client 120 is connected to one VPN server 110 . The VPN client 120 is, for example, an electronic device capable of communication, such as a personal computer, a tablet PC, or a smart phone.

The VPN server 110 and the VPN client 120 communicate with each other through a network, perform an authentication procedure through an SSL handshake process, and generate a session key that is a proxy key for encrypting and decrypting data, Create a mutual VPN session. Preferably, the VPN server 110 and the VPN client 120 create a redundant VPN session. The VPN server 110 and the VPN client 120 create a first VPN session by sharing a pseudo random number with each other, and then the VPN server 110 generates a quantum random number and transmits it to the VPN client 120 for 2 Create a primary VPN session.

The VPN server 110 and the VPN client 120 may receive and store a certificate and a private key from a Certificate Authority (CA) to determine reliability for connecting to each other through a VPN. Specifically, the VPN server 110 receives and stores a VPN server certificate, a VPN server private key, and a certification authority certificate from a certification authority, and the VPN client 120 receives a VPN client certificate, a VPN client private key, and authentication from a certification authority. Receive and store the agency certificate.

Here, the VPN server certificate includes the VPN server public key, the VPN client certificate includes the VPN client public key, and the certification authority certificate includes the certification authority public key. Since the VPN server certificate and VPN client certificate are encrypted with the CA private key, decryption is possible only with the CA public key included in the CA certificate.

The VPN server 110 transmits its own certificate, that is, the VPN server certificate, to the VPN client 120 in order to inform the VPN client 120 that it is a trusted server. If the VPN server 110 is a host authenticated by a certification authority, the VPN client 120 may obtain the VPN server public key by decrypting the VPN server certificate with the certification authority public key included in the certification authority certificate it owns. The VPN client 120 also transmits the VPN client certificate to the VPN server 110, and if the VPN client 120 is a host certified by a certification authority, the VPN server 110 includes The VPN client public key can be obtained by decrypting the VPN client certificate with the public key of the certification authority.

When the VPN server 110 and the VPN client 120 transmit a message or data to the other party, the message or data is encrypted with the public key of the other party and transmitted, and the other party can decrypt the message or data encrypted with its own private key. there is. For example, during the SSL handshake process, the VPN client 120 encrypts the pseudo-random number with the VPN server public key and transmits it to the VPN server 110, or generates a pre-master-secret value generated using the pseudo-random number. After encryption, it can be transmitted to the VPN server 110 by encrypting it with the VPN server public key, and the VPN server 110 can decrypt a random number or pre-master-secret value encrypted with its private key.

After establishing a VPN session with the VPN client 120 , the VPN server 110 may control the VPN session to check whether the VPN client 120 is an unauthenticated terminal. To this end, the VPN server 110 stores the certificate authority private key, and after establishing a VPN session with the VPN client 120 , collects session state information of the VPN client 120 at regular intervals. The VPN server 110 checks whether the VPN client 120 is in an inactive state (Active Off) without transmitting data based on the session state information, and when the VPN client 120 is in an inactive state without transmitting data, It is checked whether the VPN client 120 is an unauthenticated terminal using a quantum random number.

Specifically, the VPN server 110 applies a quantum random number to a hash algorithm to generate a reduced message of a specific size, and encrypts the reduced message with a certificate authority private key to enable a VPN client through a TCP session rather than an inactive VPN session. (120). Since data encrypted with the certification authority private key can only be decrypted with the certification authority public key, if the VPN client 120 is an unauthenticated terminal, it does not have the certification authority public key, so it is transmitted from the VPN server 110 through the TCP session. The received encrypted message cannot be decrypted, and since the authentication terminal has the public key of the certification authority, the encrypted message can be decrypted.

If the VPN client 120 is an authentication terminal, in order to inform the VPN server 110 that it is an authentication terminal, the VPN client 120 decrypts the encrypted message to extract the reduced message, and the extracted reduced message It is encrypted with its own private key and transmitted to the VPN server 110 . Since the VPN server 110 holds the VPN client public key, it decrypts the encrypted reduced message received from the VPN client 120 and compares it with the reduced message it has generated to confirm whether it matches. Since the quantum random number is an eigenvalue that cannot be estimated, if the VPN client 120 is an unauthenticated terminal, the reduced message does not match. If the VPN client 120 is an authentication terminal, the reduced message generated by the VPN server 110 and the reduced message received from the VPN client 120 are the same, so the VPN server 110 is the VPN client 120 It can be recognized that it is an authentication terminal.

In one embodiment, the VPN server 110 may create a VPN session with the VPN client 120 dually. That is, the VPN server 110 first creates a first virtual NIC based on a single physical network interface card (NIC), establishes a first VPN session with the VPN client 120, and then Another second virtual NIC is created based on the virtual NIC to establish a second VPN session with the VPN client 120 . Logically, it can be understood as a form of wrapping the primary VPN session with a secondary VPN session once more, and finally, a duplicated VPN session is assigned a single session ID and collectively managed.

The conventional VPN session duplication is a method of establishing a VPN session for each virtual NIC by creating two virtual NICs independent of each other based on one physical NIC. Since the number of sessions must be maintained, resource consumption is high and the number of sessions to be controlled for each VPN client 120 from the VPN server 110 standpoint becomes two, so that twice as much control data as the number of VPN clients 120 (e.g., virtual NIC's IP address, session ID, activation information, etc.) are collected and managed. However, in this embodiment, a first virtual NIC is created based on one physical NIC and then a second virtual NIC is created based on the first virtual NIC. Finally, a duplicated VPN session is given a single session ID and batch Because it is managed, the resource consumed is the same as when managing one session.

FIG. 2 is a diagram illustrating a conventional duplication structure of a VPN session, and FIG. 3 is a view showing a duplication structure of a VPN session according to an embodiment of the present invention. 2, in the conventional VPN session duplication, the VPN server 210 and the VPN client 220 are two virtual NICs (212a, 212b, 222a) independent of each other based on one physical NIC (211, 221). 222b) is created, VPN sessions are established for each virtual NIC 212a and 222a, 212b and 222b are established, and session IDs a0001 and a0002 are assigned to each session. On the other hand, referring to FIG. 3 , in the VPN session duplication according to the present embodiment, the VPN server 110 and the VPN client 120 are first virtual NICs 112a and 122a based on one physical NIC 111 and 121 . ) and then create second virtual NICs 112b and 122b based on the first virtual NICs 112a and 122a. Therefore, finally, since one session ID (eg, b0001) is assigned to a duplicated VPN session and collectively managed, the resource consumed is the same as when managing one session.

The VPN server 110 generates a quantum random number and then generates a quantum random number exchange message including the quantum random number in order to establish a secondary VPN session with the VPN client 120, and generates a quantum random number exchange message including the quantum random number The quantum random number exchange message is encrypted with the secondary session key and transmitted to the VPN client 120 . Accordingly, the VPN client 120 can extract the quantum random number by decrypting the quantum random number exchange message with the primary session key it possesses. Accordingly, the VPN server 110 and the VPN client 120 share the same quantum random number, and the VPN server 110 and the VPN client 120 generate a secondary session key using the quantum random number. Then, the VPN server 110 and the VPN client 120 establish a secondary VPN session using the secondary session key.

When the secondary VPN session is established, the existing primary VPN session and the newly established secondary VPN session are treated as one single session, so a new session ID is assigned, and a new IP address is also assigned to the virtual NIC associated with the secondary VPN session. is allocated Accordingly, the VPN server 110 needs to update the session state information of the VPN client 120 with which the secondary VPN session is established, and for this purpose, the VPN client 120 exchanges quantum random numbers as a response message to the quantum random number exchange message. A completion message is generated and transmitted to the VPN server 110 . The quantum random number exchange completion message includes a new session ID and a new IP address generated through establishment of the secondary VPN session, and the quantum random number exchange completion message is encrypted with the secondary session key and transmitted to the VPN server 110 . The VPN server 110 decrypts the quantum random number exchange completion message with the secondary session key to update the session state information.

When the establishment of the secondary VPN session is finally completed, as described above, the existing primary VPN session can be logically described as being wrapped once more with the secondary VPN session, but looking at the actual data flow, the data is First encrypted with the primary session key through 1 virtual NIC and delivered to the second virtual NIC, the primary encrypted data is secondary encrypted with the secondary session key through the second virtual NIC, and then one finally created session transmitted to the other device via That is, two sessions are logically configured in duplicate, but from a data flow point of view, encrypted data is exchanged with one final session created through the establishment of the secondary VPN session.

Through the duplicated VPN session described in this embodiment, the VPN server 110 and the VPN client 120 improve security by transmitting and receiving data through double encryption and double decryption. Even if the primary session key generated through the pseudo random number having a certain pattern is exposed, data cannot be decrypted without the secondary session key generated through the quantum random number whose pattern cannot be guessed.

4 is a diagram showing the configuration of a VPN server according to an embodiment of the present invention. Referring to FIG. 4 , the VPN server 110 includes a quantum random number generator 410 , a certificate manager 420 , a session manager 430 , and a storage 440 . These may be implemented as a program, stored in a memory, and executed by one or more processors, or may be implemented and operated as a combination of hardware and software, and communicate with the VPN client 120 through a communication unit not shown in FIG. can

The quantum random number generator 410 generates a random number by using a radioactive isotope. A radioisotope emits a particle called alpha during its half-life, and the time interval at which the particle is generated follows quantum mechanical uncertainty, so it is defined as having perfect randomness. And the value converted into a numerical value by measuring a time interval with such uncertainty is a quantum random number. The quantum random number generator 410 generates a quantum random number by measuring the time interval of alpha particles generated during the half-life of the radioisotope with a diode. The quantum random number generator 410 may generate a quantum random number having a length requested by the session manager 430 .

The certificate management unit 420 may receive and store a certificate and a private key from a certificate authority (CA). Specifically, the certificate management unit 420 may receive a VPN server certificate, a VPN server private key, and a certificate authority certificate and a certificate authority private key from a certification authority, and store it in the storage unit 440 . Here, the VPN server certificate includes the VPN server public key, and the certification authority certificate includes the certification authority public key. Since the VPN server certificate is encrypted with the certificate authority private key, decryption is possible only with the certificate authority public key included in the certificate authority certificate.

The certificate management unit 420 transmits the VPN server certificate to the VPN client 120 in order to inform the VPN client 120 that the VPN server 110 is a trusted server. If the VPN server 110 is a host authenticated by a certification authority, the VPN client 120 may obtain the VPN server public key by decrypting the VPN server certificate with the certification authority public key included in the certification authority certificate it owns.

The certificate management unit 420 may receive a VPN client certificate from the VPN client 120 . If the VPN client 120 is a host authenticated by the certification authority, the certificate management unit 420 may obtain the VPN client public key by decrypting the VPN client certificate with the certification authority public key included in the certification authority certificate.

The session manager 430 creates and manages a session between the VPN server 110 and the VPN client 120 . The session manager 430 creates and manages a session for each VPN client 120 . The session manager 430 may perform an authentication procedure through an SSL handshake process, generate a session key that is a proxy key for encrypting and decrypting data, and may create a mutual VPN session. Preferably, the session manager 430 creates a redundant VPN session for each VPN client 120 . The session manager 430 may create a first VPN session by sharing a pseudo random number with the VPN client 120 , and then generate a quantum random number and transmit it to the VPN client 120 to create a second VPN session.

More specifically, the session manager 430 generates a pseudo-random number through the known SSL handshake process, exchanges the pseudo-random number with the VPN client 120 , and uses the pseudo-random number generated by the VPN server 110 and A primary session key shared with the VPN client 120 may be generated using the pseudo random number received from the VPN client 120 . The session manager 430 establishes a primary VPN session with the VPN client 120 using the primary session key. Preferably, the session manager 430 and the VPN client 120 create a first virtual NIC based on the physical NIC, and then establish a primary VPN session with each other based on the first virtual NIC.

In one embodiment, the session manager 430 may transmit the message or data to the VPN client 120 by encrypting the message or data with the VPN client public key, and may also transmit the message or data from the VPN client 120 to the VPN server public key. Encrypted data can be received. Data encrypted with the VPN client public key may be decrypted by the VPN client 120 with the VPN client private key, and data encrypted with the VPN server public key may be decrypted by the session manager 430 with the VPN server private key. For example, when the VPN client 120 encrypts and transmits a pseudo-random number with the VPN server public key during the SSL handshake process, the session manager 430 may extract the pseudo-random number by decrypting it with the VPN server private key.

When a VPN session is established, the session manager 430 may periodically collect session state information and store it in the storage unit 440 . The session state information includes identification information (Client ID) of the VPN client 120, an IP address assigned to the virtual NIC of the VPN client 120, a session key, a session ID, and whether a session is activated (Activity, on) is active/off disabled), the accumulated size of data transmitted by the VPN client 120 after session establishment (ByteCount), and the session maintenance time (Idle Time, default) when the VPN client 120 does not transmit packets after session establishment as 10 minutes). An example of session state information is as follows [Table 1]. The session state information in [Table 2] is the session state information after establishing the first VPN session.

[Table 1]

After establishing the first VPN session with the VPN client 120 , the session manager 430 may establish a second VPN session with the VPN client 120 . The session manager 430 requests the quantum random number generator 410 to generate a quantum random number to establish a secondary VPN session with the VPN client 120, and includes the quantum random number generated by the quantum random number generator 410 A quantum random number exchange message is generated, encrypted with the primary session key, and transmitted to the VPN client 120 . Accordingly, the VPN client 120 can extract the quantum random number by decrypting the quantum random number exchange message with the primary session key it possesses. Accordingly, the session manager 430 and the VPN client 120 share the same quantum random number, and the session manager 430 and the VPN client 120 generate a secondary session key using the same quantum random number. Then, the session manager 430 and the VPN client 120 establish a secondary VPN session using the secondary session key. Preferably, the session manager 430 and the VPN client 120 establish a second VPN session between each other by creating another second virtual NIC based on the first virtual NIC used to establish the first VPN session. .

When the secondary VPN session is established, the existing primary VPN session and the newly established secondary VPN session are treated as one single session, so a new session ID is assigned, and a new IP address is also assigned to the virtual NIC associated with the secondary VPN session. is allocated Accordingly, the VPN client 120 generates a quantum random number exchange completion message as a response message to the quantum random number exchange message and transmits it to the session manager 430 . The quantum random number exchange completion message includes a new session ID and a new IP address generated through establishment of the secondary VPN session, and the quantum random number exchange completion message is encrypted with the secondary session key and transmitted to the session manager 430 . Accordingly, the session manager 430 updates the session state information by decoding the quantum random number exchange completion message with the secondary session key. An example of the updated session state information is as follows [Table 2]. Compared with [Table 1], which is an example of session state information during the establishment of the first session, the IP address is changed from 10.0.0.2 to 11.0.0.2, and the session key is also changed from session1.key to session2.key.

[Table 2]

After establishing the first or second VPN session with the VPN client 120 , the session manager 430 may control the VPN session to check whether the VPN client 120 is an unauthenticated terminal. After establishing a VPN session with the VPN client 120, the session manager 430 collects and stores the session state information of the VPN client 120 in the storage unit 440 at regular intervals, and based on the session state information, the VPN client ( 120) does not transmit data and checks whether it is in an inactive state (Active Off).

When the VPN client 120 is in an inactive state without transmitting data, the session manager 430 requests the quantum random number generator 410 to generate a quantum random number, and receives the quantum random number generated by the quantum random number generator 410 . It is used to check whether the VPN client 120 is an unauthenticated terminal. The session management unit 430 applies a quantum random number to a hash algorithm to generate a reduced message of a specific size, and encrypts the reduced message with a certificate authority private key, so that the VPN client 120 through a TCP session rather than an inactive VPN session. send to Since data encrypted with the certification authority private key can only be decrypted with the certification authority public key, if the VPN client 120 is an unauthenticated terminal, it does not have the certification authority public key, so it is transmitted from the VPN server 110 through the TCP session. The received encrypted message cannot be decrypted, and since the authentication terminal has the public key of the certification authority, the encrypted message can be decrypted.

If the VPN client 120 is an authentication terminal, in order to inform the VPN server 110 that it is an authentication terminal, the VPN client 120 decrypts the encrypted message to extract the reduced message, and the extracted reduced message It is encrypted with its own private key and transmitted to the session management unit 430 . Since the VPN client public key is stored in the storage unit 440, the session management unit 430 decrypts the encrypted reduced message received from the VPN client 120, and compares it with the reduced message it has generated. Make sure they match. Since quantum random numbers are eigenvalues that cannot be estimated, if the VPN client 120 is an unauthenticated terminal, the reduced message does not match, and if the VPN client 120 is an authenticated terminal, the reduced message matches . When it is confirmed that the VPN client 120 is an unauthenticated terminal, the session manager 430 forcibly terminates the VPN session of the VPN client 120 .

The storage unit 440 may include a high-speed random access memory, a magnetic disk storage device, a nonvolatile memory such as a flash memory device, or other nonvolatile semiconductor memory device. The storage unit 440 may store instructions executable by the processor. In this embodiment, the storage unit 440 stores the VPN server certificate and the VPN server private key issued from the certification authority, and the certification authority certificate and the certification authority private key. In addition, the storage unit 440 stores the session state information of the VPN clients 120 as described above.

5 is a flowchart illustrating a method for controlling a VPN session of a VPN client in a VPN server according to an embodiment of the present invention.

Referring to FIG. 5 , in step S501 , the VPN server 110 collects and stores session state information of the VPN client 120 with which the VPN session is established periodically, for example, every 2 minutes. Preferably, the VPN server 110 may collect session state information from an agent installed in the VPN client 120 . The session state information includes identification information (Client ID) of the VPN client 120, an IP address assigned to the virtual NIC of the VPN client 120, a session key, a session ID, and whether a session is activated (Activity, on) is active/off disabled), the accumulated size of data transmitted by the VPN client 120 after session establishment (ByteCount), and the session maintenance time (Idle Time, default) when the VPN client 120 does not transmit packets after session establishment as 10 minutes).

In step S502, the VPN server 110 checks whether the accumulated size (ByteCount) of the data received from the VPN client 120 to date is the same as the accumulated size 2 minutes ago. If the accumulated size 2 minutes ago and the accumulated data received so far are different from each other, the VPN client 120 is transmitting data. In step S503, the VPN server 110 determines the data accumulation size of the pre-stored session state information. is updated with the accumulated size of data received so far.

If the accumulated size 2 minutes ago and the accumulated data received so far are the same, it means that the VPN client 120 is not transmitting data. In step S504, the VPN server 110 sends the VPN client 120 ), that is, the Idle Time is updated to 10 minutes, and in step S505, it is checked whether data is not continuously received from the VPN client 120 for 10 minutes.

If data is not received from the VPN client 120 for 10 minutes, in step S506 , the VPN server 110 checks whether the Active value is 'on' in the session state information most recently collected from the VPN client 120 . That is, it is checked whether the session of the VPN client 120 is active. If the session is in the active state, the flow returns to step S504, the idle time is re-updated to 10 minutes, and the subsequent steps are repeated.

When the session is in an inactive state, that is, when the Active value is 'off', in step S507, the VPN server 110 applies the quantum random number generated by the quantum random number generator 410 to the hash algorithm to reduce a specific size A message is generated, the reduced message is encrypted with the certificate authority private key, and transmitted to the VPN client 120 through a TCP session rather than a deactivated VPN session.

In step S508, the VPN server 110 checks whether a quantum random number is received from the VPN client 120 for a predetermined time. Preferably, the VPN client 120 decrypts the encrypted message received in step S507 to extract the reduced message, encrypts the extracted reduced message with its own private key, and transmits it to the VPN server 110 And, the VPN server 110 can see that a quantum random number has been received when this encrypted message is received.

If the random quantum number is not received from the VPN client 120 for a certain period of time, in step S509, the VPN server 110 determines that the VPN client 120 is an unauthenticated terminal and forces the VPN session of the VPN client 120 ends with Since data encrypted with the certification authority private key can only be decrypted with the certification authority public key, if the VPN client 120 is an unauthenticated terminal, it does not have the certification authority public key, so it is transmitted from the VPN server 110 through the TCP session. This is because the received encrypted message cannot be decrypted, and the quantum random number will not be transmitted to the VPN server 110 .

If a quantum random number is received from the VPN client 120 within a predetermined time, in step S510, the VPN server 110 generates the quantum random number received from the VPN client 120 and the VPN client ( 120) to check whether the quantum random number transmitted is the same. Preferably, the VPN server 110 decrypts the encrypted message received from the VPN client 120 with the VPN client public key, and compares the decrypted message with the reduced message generated by applying the hash algorithm in step S507. By doing so, quantum random numbers can be compared. Since the quantum random number is a eigenvalue that cannot be estimated, if the VPN client 120 is an unauthenticated terminal, the reduced message does not match, and in this case, the VPN server 110 forcibly terminates the VPN session in step S509 . If the VPN client 120 is an authentication terminal, the reduced message is matched, and the VPN server 110 maintains the VPN session.

6 is a flowchart illustrating a method for establishing a session between a VPN server and a VPN client according to an embodiment of the present invention.

Referring to FIG. 6 , in step S601 , the VPN server 110 and the VPN client 120 establish a primary VPN session using a pseudorandom number through a known SSL handshake process. Preferably, the VPN server 110 and the VPN client 120 create a first virtual NIC based on the physical NIC, and then establish a primary VPN session with each other based on the first virtual NIC. When the primary VPN session is established, the session state information of Table 1 described above is stored in the storage unit 440 .

In step S602 , the VPN server 110 generates a quantum random number through the quantum random number generator 410 to establish a secondary VPN session with the VPN client 120 . Then, in step S603, the VPN server 110 generates a quantum random number exchange message with reference to the quantum random number and the session state information. The fields of the quantum random number exchange message are as shown in Table 3 below.

[Table 3]

In step S604, the VPN server 110 encrypts the quantum random number exchange message with the primary session key generated in the process of establishing the primary VPN session in step S601. And in step S605 , the VPN server 110 transmits the encrypted quantum random number exchange message to the VPN client 120 .

In step S606, the VPN client 120 decrypts the encrypted quantum random number exchange message with the primary session key generated in the process of establishing the primary VPN session in step S601. Accordingly, the VPN client 120 may extract a quantum random number from the decoded quantum random number exchange message.

In steps S607 and S608, each of the VPN server 110 and the VPN client 120 generates a secondary session key using a quantum random number held in the same way. And in step S609, the VPN server 110 and the VPN client 120 establish a secondary VPN session using the secondary session key. Preferably, the VPN server 110 and the VPN client 120 establish a secondary VPN session between each other by creating another second virtual NIC based on the first virtual NIC used to establish the primary VPN session. .

In step S610, the VPN client 120 generates a quantum random number exchange completion message. The quantum random number exchange completion message includes a new secondary session ID and a new IP address generated through secondary VPN session establishment. An example of a quantum random number exchange completion message is as follows [Table 4].

[Table 4]

In step S611, the VPN client 120 encrypts the quantum random number exchange completion message with the secondary session key. And in step S612 , the VPN client 120 transmits the encrypted quantum random number exchange completion message to the VPN server 110 . And in step S613, the VPN server 110 decrypts the encrypted quantum random number exchange completion message with the secondary session key, and updates the session state information based on the quantum random number exchange completion message.

For the above embodiment, the VPN client 120 may include a memory, a communication unit, and one or more processors. The memory may include a high-speed random access memory, a magnetic disk storage device, a nonvolatile memory such as a flash memory device, or other nonvolatile semiconductor memory device. The memory may store various types of information and program instructions. The memory may include a program for creating a VPN session with the VPN server 110 , and transmitting session state information to the VPN server 110 . The program stored in the memory may be executed by the processor. The communication unit converts electrical signals into electromagnetic waves or vice versa, and can communicate with communication networks, other mobile gateways, and electronic devices through the electromagnetic waves. A communications unit may include, but is not limited to, an antenna system, an RF transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a CODEC chipset, a subscriber identity module (SIM) card, memory, and the like, for example. It may include well-known circuitry for performing the function. One or more processors may perform the operation of the VPN client 120 in the above-described embodiment according to a program stored in the memory.

According to the above embodiment, the VPN server 110 and the VPN client 120 can perform the most secure symmetric key-based encrypted communication by generating a secondary session key using a quantum random number that is the most complete random number, not a pseudo-random number. . In particular, since VPN can be easily established without modification of the conventional SSL protocol, it can be applied to any SDN (Software Defined Network)-based network environment, thereby ensuring high compatibility.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features described herein in a single embodiment may be implemented in various embodiments individually, or may be implemented in appropriate combination.

Although acts are described in a particular order in the drawings, it should not be understood that the acts are performed in the particular order as shown, or that all of the described acts are performed in a continuous order, or to obtain a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable form in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.). Since this process can be easily performed by a person skilled in the art to which the present invention pertains, it will not be described in detail any longer.

The present invention described above, for those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible within the scope without departing from the technical spirit of the present invention. It is not limited by the drawings.

110, 210: VPN Server
120, 220: VPN client
111, 121, 211, 221 : Physical NIC
112a, 112b, 122a, 122b : Virtual NIC
410: quantum random number generator
420: certificate management unit
430: session management unit
440: storage

Claims (17)

A VPN device for establishing a virtual private network by communicating with a VPN (Virtual Private Network) client, comprising:
a quantum random number generator for generating quantum random numbers; and
A first session key is generated by exchanging a pseudorandom number with the VPN client, a first VPN session is established, the first quantum random number generated by the quantum random number generator is transmitted to the VPN client, and based on the first quantum random number A VPN device including a session manager for establishing a secondary VPN session by generating a secondary session key. According to claim 1,
The session management unit,
VPN device, characterized in that generating a quantum random number exchange message including the first quantum random number, encrypting the quantum random number exchange message with the primary session key and transmitting the message to the VPN client. 3. The method of claim 2,
The session management unit,
Receives, from the VPN client, a quantum random number exchange completion message including session identification information and IP address for the secondary VPN session and encrypted with the secondary session key, and sends the encrypted quantum random number exchange completion message to the secondary session VPN device, characterized in that decryption with a key. According to claim 1,
The session management unit,
After a first virtual NIC is created based on a physical network interface card (NIC), the first VPN session is established based on the first virtual NIC, and a second virtual NIC is established based on the first virtual NIC. VPN device, characterized in that after the NIC is created, the secondary VPN session is established based on the second virtual NIC. According to claim 1,
It further includes; a certificate management unit for receiving and storing the certificate authority private key from the certification authority;
The session management unit,
The second quantum random number generated by the quantum random number generator is encrypted with the certificate authority private key and transmitted to the VPN client, and the VPN session with the VPN client is forcibly terminated depending on whether the second quantum random number is received from the VPN client VPN device, characterized in that. 6. The method of claim 5,
The session management unit,
The VPN device, characterized in that when it is determined that the VPN client is in an inactive state without transmitting data based on the session state information periodically received from the VPN client, the second quantum random number is transmitted to the VPN client. 6. The method of claim 5,
The session management unit,
A VPN device, characterized in that by applying the second quantum random number to a hash algorithm to generate a reduced message of a specific size, encrypting the reduced message with the private key of the certification authority and transmitting the reduced message to the VPN client. 8. The method of claim 7,
The session management unit,
The VPN device, characterized in that forcibly terminating the VPN session with the VPN client according to whether a message identical to the reduced message is received from the VPN client. A method in which a VPN (Virtual Private Network) server communicates with a VPN client to establish a virtual private network, the method comprising:
exchanging pseudo-random numbers with the VPN client to generate a primary session key and establishing a primary VPN session; and
A method comprising: transmitting a first quantum random number generated by a quantum random number generator to the VPN client and generating a secondary session key based on the first quantum random number to establish a secondary VPN session. 10. The method of claim 9,
The step of establishing the second VPN session comprises:
generating a quantum random number exchange message including the first quantum random number, encrypting the quantum random number exchange message with the primary session key, and transmitting the encrypted quantum random number exchange message to the VPN client. 11. The method of claim 10,
Receives, from the VPN client, a quantum random number exchange completion message including session identification information and IP address for the secondary VPN session and encrypted with the secondary session key, and transmits the encrypted quantum random number exchange completion message to the secondary session and decrypting with the key. 10. The method of claim 9,
The step of establishing the first VPN session comprises:
creating a first virtual NIC based on a physical network interface card (NIC), establishing the first VPN session based on the first virtual NIC,
The step of establishing the second VPN session comprises:
Creating a second virtual NIC based on the first virtual NIC, and establishing the secondary VPN session based on the second virtual NIC. 10. The method of claim 9,
receiving and storing a certification authority private key from a certification authority;
encrypting the second quantum random number generated by the quantum random number generator with the certificate authority private key and transmitting the encrypted second quantum random number to the VPN client; and
The method further comprising the step of forcibly terminating the VPN session with the VPN client according to whether the second quantum random number is received from the VPN client. 14. The method of claim 13,
The step of encrypting the second quantum random number with the authentication authority private key and transmitting it to the VPN client comprises:
When it is determined that the VPN client is in an inactive state without transmitting data based on the session state information periodically received from the VPN client, the second quantum random number is transmitted to the VPN client. 14. The method of claim 13,
The step of encrypting the second quantum random number with the authentication authority private key and transmitting it to the VPN client comprises:
A method of generating a reduced message of a specific size by applying the second quantum random number to a hash algorithm, encrypting the reduced message with the certificate authority private key, and transmitting the reduced message to the VPN client. 16. The method of claim 15,
The step of forcibly quitting is
Method, characterized in that forcibly terminating the VPN session with the VPN client according to whether the same message as the reduced message is received from the VPN client. A VPN device for establishing a virtual private network by communicating with a VPN (Virtual Private Network) server, comprising:
a communication unit communicating with the VPN server;
processor; and
a memory for storing instructions executable by the processor;
The processor is
A first session key is generated by exchanging a pseudorandom number with the VPN server, a first VPN session is established, and a second VPN session is established by generating a second session key based on the first quantum random number received from the VPN server VPN device, characterized in that.

Images