KR100434357B1 - IP Security in Packet Data Service Node system - Google Patents

Abstract

An object of the present invention is to provide an IP security method of a packet data service node system that enables secure transmission / reception of data using an IPSec function according to a mobile IP protocol between a PDSN system and a home agent on a home IP network. Encrypting the information in a section between the PDSN system and the home agent system, which is a previous stage of the Internet section, by transmitting the IPSec protocol among the mobile IP protocols and transmitting it to a public network using a public IP; And decrypting the incoming information encrypted through the public network in a manner corresponding to the incoming encryption method, and transmitting it to each node on the home IP network using the private IP. The packet is transmitted when the packet is transmitted between the PDSN system and the home agent. Can be encrypted and transmitted according to the IPSec function of the mobile IP protocol, thereby securing the security of packet transmission.

Description

IP security method of packet data service node system {IP Security in Packet Data Service Node system}

The present invention relates to IP (Internet Protocol, or IP) security of a Packet Data Service Node (PDSN) system, and more particularly, secure transmission / transmission of data between a PDSN system and a home agent in a home IP network. The present invention relates to an IP security method of a packet data service node system suitable for reception.

1 is a block diagram of a typical PDSN system, and accordingly, when a mobile terminal 110 is connected to a user's notebook computer in connection with data transmission of a PDSN network, a mobile terminal 110 attempts to transmit data. In step 110, a signal is sent to a radio network controller (or RNC) 120, and the signal is processed by the PDSN 130. The data processed by the PDSN 130 may be connected to an external web server or an FTP server such as an FTP server through the home IP network 150 to be wirelessly serviced.

The PDSN 130 becomes an external agent on the home IP network 150 and is connected to the AAA configured to manage subscriber information for subscriber authentication and billing. The PDSN 130 is located on the public network side relative to the home agent 160 located inside the home IP network 150 based on the home IP network 150.

On the home IP network 150, the home agent 160 is managed by a home agent manager (not shown), and is usually connected to the home IP network 150 through an Ethernet line to IP the subscriber's mobile terminal 110. It assigns an address. The subscriber may selectively access the home IP network 150 to which the home agent 160 is connected to receive packet service, or access the home IP network 150 through the PDSN 130 as an external agent from an external network to receive the service. have.

On the other hand, by using the AAA (Administration, Authorization, and Authentication) 140 connected to the PDSN system 130, the subscriber information is managed, authenticated and billed.

Protocols applied to such PDSN systems include simple IP and mobile IP protocol. In the case of the simple IP protocol, the PDSN transmits unencrypted IP packets to the end host or home agent connected to the home IP network. Therefore, in this case, it is not easy to guarantee the security of the IP packet through the home IP network.

However, in the PDSN system according to the prior art, all data flowing in the Internet section, which is a representative public network, can be shared, and anyone can obtain this data. When the security of the transmitted packet is low, it is difficult to guarantee the secure data transmission and a solution is required.

The present invention was created to solve the above-mentioned conventional problems, and an object of the present invention is to securely transmit / receive data using an IPSec function according to a mobile IP protocol between a PDSN system and a home agent on a home IP network. To provide IP security method of packet data service node system.

In order to achieve the above object, the present invention performs a security association search during a call processing process between a PDSN system and a home agent system including a mobile node, and transmits the selected information to the user authentication server according to the search result. A security level encryption checking step of updating security policy information and security level by using a security level receiving step of receiving key information and a security level received by the security level receiving step, and confirming whether the corresponding security level requires encryption And a registration request processing step of processing a registration request of the mobile node immediately without negotiating a security bond when it is confirmed that the security level does not require encryption by the security level password and verification step, and the security level encryption verification step. If the security level requires encryption by Multi-level encryption phase to update security level and security policy to the appropriate level, and negotiate security ties with the home agent of public network; and if the security association is accepted during the multi-level encryption phase and there is no existing security ties, It provides an IP security method of a packet data service node system consisting of an encryption transmission step consisting of a registration step of registering the mobile node after performing the operation.

1 is an application block diagram of a typical PDSN system.

2 is a flow chart of application at security levels 1, 2, and 3 of the IP security method of the packet data service node system according to the present invention;

Figure 3 is a bypass flow diagram at security level 4 of the IP security method of a packet data service node system according to the present invention.

Explanation of symbols on the main parts of the drawings

110, 210: mobile terminal 120: radio network controller (RNC)

130, 300: PDSN 140, 220: AAA

150: home IP network 160, 230: home agent

231, 373: IKE 240: Internet

300: PDSN

310: PDSN control processor (PCP)

320: Pi link control function (PLCF)

330, 370: IP Security Module (IPSM)

331, 371: IP Security Function Unit (IPSF)

332, 372: Security Policy Database (SPDB)

350: High Speed Link Processor (HLP)

360: Pi link interface function (PLIF)

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings.

2 is a flowchart illustrating the security level 1, 2, and 3 of the IP security method of the packet data service node system according to the present invention, and FIG. 3 is a security level of the IP security method of the packet data service node system according to the present invention. The bypass flow chart at 4.

The main terms used below are defined as follows.

AAA (Authorization, Authentication and Accounting): Module that exchanges information about user authentication, user profile information, billing information, etc. with PDSN.

-HA (Home Agent): Home Agent, acts as a gateway (Gateway) of the home IP network.

-HLP (High Speed Link Processor): A Packet Linking Control Function (PRCF) that is in charge of the packet routing function in conjunction with the High Speed Link Processor, the PLIF responsible for Pi link matching, and the Packet Routing Control Function (PRCF) of the PCP inner block. )

IKE (Internet Key Exchange): Provides a standardized method for Internet key exchanges, initial generation of all encryption keys to create security bonds, and continuous renewal of keys.

-IPSF (IP Security Function): Management module for applying IPSec.

PDSN Control Processor (PCP): PDSN Control Processor.

Pi Link Control Function (PLCF): Pi link control means, to perform data link layer management of Pi links that the PDSN matches with the Internet and intranets.

-PLIF (Pi Link Interface Function): Pi link interface means, Pi link matching function.

-SA (Security Association): Security ties, specific configuration information of IPSec protocol (light time, encryption method, etc.).

-SADB (Security Association Database): a space for storing security association (SA) information.

-SP (Security Policy): Security policy, IPSec application decision information (source address, destination address, security level, etc.).

-SPDB (Security Policy Database): security policy database, security policy (SP) information storage space.

Continue the description using the above terms.

In the case of the mobile IP protocol according to the RFC2002 standard, the mobile node has two IP addresses in order to maintain connection of the transport layer and correct routing of the IP layer. One address is a home address, which is fixed like a general Internet Protocol (IP) address, and is used to distinguish a Transmission Control Protocol (TCP) connection. The other address is a care-of address (COA), which is changed at each new connection point, and reflects the actual location of the mobile node connected to the mobile communication terminal such as a notebook computer.

The mobile node is given a home address from the home IP network. A home IP network is a network including a home agent node, which is usually a private network or a provider network to which a mobile node is registered. When a node moves and is not connected to a home IP network but is connected to another network (external network), the home agent receives all packets destined for the mobile node and forwards the packets to the external network to which the mobile node is currently connected.

In mobile IP, the home agent system generates an IP packet header destined for the COA of the mobile node for redirection. The generated header is used as the header of the new IP packet that wraps the original packet. In other words, the mobile node's home address, which is the destination address in the header of the original packet, is included in the payload of the new packet, and has no effect on the routers that process the packet while routing to the COA. In this way, the original packet is wrapped in a new packet for transmission.

IPSec is a protocol to ensure security at the upper layer by ensuring security at the network layer. The technical details are related to RFC2401, RFC2402, RFC2406, RFC2407 of RFC (Request For Comment) series , RFC2409, and the like.

Since the security of the packet transmitted by the IPSec function can be guaranteed, the IPSec protocol is installed in the PDSN system so that data is encrypted in the section between the PDSN system and the home agent system, which is the previous stage of the Internet section, and transmitted to the Internet section. In addition, it will be able to guarantee the safe transmission and reception of data by re-encrypting the encrypted data. Therefore, the present embodiment is to implement the IPSec function according to the mobile IP protocol in the PDSN system, and adds some procedures in the call processing flow according to the general mobile IP protocol so that the IPSec function can be implemented later. In other words, the present embodiment implements the previous steps for the IPSec function to be implemented between the PDSN system and the home agent.

Hereinafter, a procedure in which the IPSec function of the mobile IP protocol is implemented and performed in the PDSN system will be described.

Referring to the configuration related to the security of the transport packet through the PDSN system, as shown in Figure 2, the mobile terminal 210, billing and subscriber registered with the home agent 230 is assigned to the IP on the home IP network with mobility AAA 220 for authentication, home agent 230, the Internet 240 is a public network serviced through the PDSN system 300 and the like.

Here, the home agent includes an IKE 231 for processing security-related cryptography according to mobile IP.

In addition, in the case of the PDSN system 300, the PDSN control processor (PCP) 320 and the high speed link processor (HLP) 350 are largely involved. In the PDSN control processor 320, the Pi link control function unit (PLCF) 320 for managing the data link layer of the Pi link that matches the Internet 240 or the intranet that the PDSN system 300 matches, and the IP security function. An IP Security Module (IPSM) 330 having a Part (IPSF) 331 and a Security Policy Database (SPDB) 332 is used.

On the other hand, in the case of the high-speed link processor 350, an IP security module (IPSM) 370 having an IP security function (IPSF) 371, a security policy database (SPDB) 332, and an IKE 373, and Pi link interface function (PLIF) 360 is used.

This embodiment is to ensure the security of the data for all at the upper layer by ensuring the security at the network layer for the secure transmission / reception of data between the PDSN system 300 and the home agent 230. The IPSec protocol, which wants to guarantee network security through the encryption of IP packets, includes the ESP protocol and the AH protocol. The AH protocol uses a key hash algorithm to prevent response attacks with data integrity and authentication. to provide. The ESP protocol provides confidentiality over the functionality of the AH protocol.

It is implemented in two modes: tunnel mode and transport mode of IPSec protocol. Transport mode is to perform IPSec processing at both ends of communicating hosts, and tunnel mode is to control IPSec between both entities including host and intermediate router. Processing the protocol involves inserting a new IP header to hide the original IP header.

An IPSec processing operation according to such a configuration will be described. An operation when the IPSec function is applied at security level 1, 2 or 3 will first be described with reference to FIG.

First, as described above, the mobile IP call processing process is performed between the general PDSN system 300 and the mobile terminal (or mobile node) 210. Description thereof will be omitted.

When the mobile IP call processing process is performed with the mobile terminal 210, the Pi link control function 320 receives the mobile IP from the AAA (or MCMF) 220, which is responsible for the client control function on the external mobile terminal 210 side. Receive an authentication response (eg MipAuthAck_MC2PL) (S11).

When the call is established, the Pi link control function 320 takes IP security as an argument of the Pi link control function 320 security policy structure (eg, PLCF_SSP_info) of the IP security function 331 in the PDSN control processor 320. The security association search (eg, ipsm_SA_LookUp (PLCF_SSP_info)) function of the module 330 is called to transfer the selection information to the IP security function unit 331 in the PDSN control processor 320. The security association search (ipsm_SA_LookUp ()) function of the IP security module 330 determines specific settings of the IPSec protocol (eg, life time, encryption method, etc.), that is, whether IPSec is applied before the security association (SA) is searched ( To determine the source address, destination address, security level, etc.) and search for the security policy (SP) and enter the security policy if the security policy does not exist. At this time, since there is no information on the security level, the security policy and the security level information are not input (S12).

The security bond search (ipsm_SA_LookUp ()) function of the IP security module 330 of the PDSN control processor 320 and the IP security function unit 331 searches for security bond information using destination and source address information (S13). .

The security bond search result is transmitted to the Pi link control function 320 (S14).

Pi link control function unit 320 transmits the security bond search results to the AAA (220) (S15).

The Pi link control function 320 receives only the security level value from the AAA (MCMF) 220 if the security bond exists, and receives the security level and public key information (PresharedKey) information if the security bond does not exist (S16). .

The Pi link control function 320 requests the security policy information update of the IP security module 330 that takes a structure (PLCF_SSP_Info) having the PLCF security policy information of the PDSN control processor 320-the IP security function 331. Call a function (eg ipsm_request_Update_SPInfo (PLCF_SSP_Info)). The PDSN control processor 320-the IP security function unit 331 retrieves the corresponding security policy using the destination and source address information from the received PLCF security policy structure (PLCF_SSP_Info) and updates the policy information using the security level. In addition, the security level information is updated (S17 to S18).

This update result value is transmitted to the Pi link control function unit 320 as a return value (S19).

Pi link control function 320 is a security bond presence field added to the PLCF security policy structure (PLCF_SSP_Info) (nSAExistence, nSAExistence = 0: when there is no security policy, nSAExistence = 1: when there is security policy) The value of the security policy presence in the file and passed it to the Pi link interface function unit 360 using a message of a Pi link security bond open request function (eg PiSaOpenReq_P2H (PLCF_SSP_Info)) that takes a PLCF security policy structure (PLCF_SSP_Info) as an argument. (S20).

The Pi link interface function unit 360 casts the received information into a PLCF security policy structure (PLCF_SSP_Info) to filter and store the security level and Pi link port (eg nPiPort) information. Pi link port (nPiPort) information is used for later registration request (RRQ) or data encryption. If the security level value is 1, 2, or 3, the security policy information generation request function (eg, ipsm_request_SAInfo_Creation (PLCF_SSP_Info *) HLP-IPSF) of the IP security module 330, which takes a PLCF security policy structure (PLCF_SSP_Info) as an argument, is called. (S21).

The Pi link interface function unit 360 retrieves the security policy from the received PLCF security policy structure (PLCF_SSP_Info) using the destination and source address as a search condition.If the security policy does not exist, the Pi link interface function unit 360 inputs the security policy and then enters the security bond present field. Investigate nSAExistence. If the security association present field is 1, only the policy and security level are updated using the security level. If the security association present field is 0, the security level and policy of the security policy database 372 are updated, and a security association negotiation is performed (S22).

The secure link is established through negotiation between the high speed link processor 350 and the IKE 373 and the remote HA-IKE 231 (S23).

The SADB is updated using the thus established security bond (S24).

The IP security module security policy information generation request function (ipsm_request_SAInfo_Creation ()) of the high speed link processor 350 and the IP security function 331 may open the Pi link security association when the security association exists (nSAExistence = 1). Send a response indicating that a security association exists for the request. On the other hand, if there is no security association (nSAExistence = 0), the corresponding message is transmitted (S25).

When the Pi-Link interface function 360 receives a response message indicating that the security tie exists, the Pi-link interface function 360 does not call or distribute the PDSN control processor 320 to the IP security function 331 because the security tie already exists. If the registration request is performed immediately without receiving a response message indicating that the security association does not exist, the security association information structure (eg, a function of the PDSN control processor 320-IP security function 331) (eg, A security bond information synchronization request function (eg, ipsm_request_sync_SAInfo (SA_Info)) of the IP security module 330 having SA_Info as an argument is called to store the security bond information, and the PDSN control processor 320 performs SADB synchronization (S26). ~ S27).

The result of updating the SADB is transmitted as the return value to the Pi link control function unit 320 (S28).

In this case, since there is no security association, the Pi link control unit 320 that receives a positive response receives the Pi link security association that takes the security association information SAInfo as the security association information to each of the high speed link processors 350. Distribution is performed using the message type of the distribution request function (eg, PiSaDistReq_P2H (SA_Info)) (S29).

The Pi link interface function unit 360 calls a security association information synchronization request function (eg, ipsm_request_sync_SAInfo (char *)) of the IP security module 370 of the high speed link processor 350-IP security function 371. This function first searches whether the security policy exists using the destination and source address, and inputs the security policy information if the security policy does not exist. In this case, since security level information and policy information are not provided, default information is stored. This is because the security bond information synchronization request function (ipsm_request_sync_SAInfo (SA_Info)) of the IP security module 370 taking the security bond information SA_Info as an argument stores only the security bond information without updating the policy or the security level using the security level. At the time of invoking the security bond information generation request function (ipsm_request_SAInfo_Creation (PLCF_SSP_Info)) of the IP security module 370, which takes the PLCF security policy structure (PLCF_SSP_Info) as an argument, it checks the new security level for each session and sets the policy and security level with it. Because it applies and updates. And stores the security bond information (S30 ~ S31).

The Pi link control function unit 320 performs a registration request (S32).

Thereafter, the Pi link interface function unit 360 retrieves the Pi link port information and the corresponding security level information of the received registration request, and if the security level is 1 or 3, the high speed link that takes a datagram including an IP header as an argument. The encryption function of the processor 350-the IP security function 371 is called and transmitted to the home agent 230. When the security level is 2 or 4, the processor 350 directly transmits the encryption function to the home agent 230.

In the above process, the IPSec process procedure is described at security level 1, 2 or 3. Next, the bypass process when the security level 4, that is, IPSec is not applied will be described with reference to FIG. The procedure performed in the previous step of the procedure described below is omitted since it is a mobile IP call processing process between the general PDSN system 300 and the mobile terminal 210.

3, the Pi link control function 320 receives a mobile IP authentication response (MipAuthAck_MC2PL) from the MCMF (or AAA) (S51).

Pi link control function 320 is a security association search function of IP security module 330, which takes a PLCF security policy structure (PLCF_SSP_info) of PDSN control processor 320-IP security function 331 at the time of call establishment. (ipsm_SA_LookUp (PLCF_SSP_info)) is called to pass the selection information to the PDSN control processor 320-IP security function 331. The security bond search function ipsm_SA_LookUp () of the IP security module 330 searches for a security policy SP before the security bond SA and inputs a security policy if the security policy does not exist. At this time, since there is no information on the security level, the security policy and the security level information are not input (S52).

The security association search function (ipsm_SA_LookUp ()) of the IP security module 330 of the PDSN control processor 320 and the IP security function unit 331 searches for the security association information by using the destination and source address information (S53). .

The security bond search result is transmitted to the Pi link control function unit 320 (S54).

The Pi link control function unit 320 transmits the security bond search result to the AAA 220 (S55).

The Pi link control function 320 receives only the security level value from the AAA (MCMF) 220 if the security bond exists, and receives the security level and public key information (PresharedKey) information if the security bond does not exist (S56). .

The Pi link control function 320 requests the security policy information updater of the IP security module 330 that takes a structure (PLCF_SSP_Info) having the PLCF security policy information of the PDSN control processor 320-the IP security function 331. Call the function ipsm_request_Update_SPInfo (PLCF_SSP_Info). The PDSN control processor 320-the IP security function unit 331 retrieves the corresponding security policy using the destination and source address information from the received PLCF security policy structure (PLCF_SSP_Info) and updates the policy information using the security level. In addition, the security level information is updated (S57 to S58).

The result value according to the security policy and the security level information update is returned as the return value to the Pi link control function unit 320 (S59).

The Pi link control function 320 stores the security policy presence value in the security association existence field (nSAExistence) added to the PLCF security policy structure (PLCF_SSP_Info) and takes the Pi link security bond as the argument to the PLCF security policy structure (PLCF_SSP_Info). Using the message of the open request function (for example, PiSaOpenReq_P2H (PLCF_SSP_Info)), the message is transmitted to the Pi link interface function unit 360 (S60).

The Pi link interface function unit 360 casts the received information into a PLCF security policy structure (PLCF_SSP_Info) to filter and store the security level and Pi link port (nPiPort) information. Pi link port (nPiPort) information is used for later registration request (RRQ) or data encryption. When the security level value is 1,2 or 3, the security policy information generation request function of the IP security module 330, which takes a PLCF security policy structure (PLCF_SSP_Info) as an argument, for example, ipsm_request_SAInfo_Creation (PLCF_SSP_Info *) HLP-IPSF) is called. On the other hand, when the security level is 4, since the bypass, the message type is configured to send a response message indicating the bypass to the Pi link control function unit (320) (S61 to S62).

The Pi link interface function unit 360 filters the type of the received response message and calls or distributes a function of the PDSN control processor 320 to the IP security function unit 331 when the type indicates a bypass. Immediately perform the registration request without (S63).

The Pi link interface function 360 knows that the security level of the session or data is 4 using the Pi link port (PiPort) of the received message, without calling the encryption module of the IP security function 371 directly. The registration request message is transmitted to the home agent 230 (S64 to S65).

Subsequent processes depend on the general operation of the home agent 230.

The embodiments described above are within the scope of various changes, modifications, and equivalents of the present invention. Therefore, the present invention is not limited to the description of the examples.

According to the IP security method of the packet data service node system of the present invention, when transmitting a packet between the PDSN system and the home agent, the packet can be encrypted and transmitted according to the IPSec function of the mobile IP protocol, thereby securing the security of packet transmission. Will be.

Claims (11)

Security level reception step of receiving security level and public key information by performing security association search during call processing between PDSN system and home agent system including mobile node and transmitting the corresponding selection information to user authentication server according to the search result A security level encryption checking step of updating security policy information and security level by using the security level received by the security level receiving step and confirming whether the corresponding security level requires encryption, and the security level encryption and checking step If it is confirmed that the security level does not require encryption by the registration request processing step of processing the registration request of the mobile node immediately without negotiating security association, and the security level encryption request by the security level encryption verification step The security policy is retrieved and the appropriate level for that security level and security policy. After renewing, multi-level encryption stage for negotiating security ties with home agent of public network, and if the establishment of security ties is accepted during the multi-level encryption phase, and there is no existing security ties, the mobile node is registered after synchronizing security ties. IP security method of a packet data service node system, characterized in that consisting of an encryption transmission step consisting of a registration step. delete The method of claim 1, further comprising: decrypting data information encrypted and transmitted through the public network during the encryption transmission step in a manner corresponding to the encryption method, and transmitting the decrypted data information to each node on a home IP network using a private IP. IP security method of a packet data service node system comprising a. The method of claim 1, wherein, during the security level reception step, a search step for searching for a security policy to determine whether to apply IPSec before performing a security tie search, and when it is confirmed that no security policy exists by the search step A security policy input step of inputting a security policy; The IP security method of the packet data service node system, characterized in that the multi-step encryption step further comprises a security policy input step so that the security policy is input when there is no security bond information. 2. The security association search of the security level receiving step is to be searched using the destination and source address information of the packet. When the security association exists, only the security level value is obtained from the user authentication server. And a receiving step of receiving a security level and public key information when there is no security association as a result of the search. 2. The method of claim 1, wherein after the security level reception step, a filtering step of filtering and storing the processed security level and the set link port information, and the stored link port information is used in a subsequent mobile node registration request or data encryption. IP security method of a packet data service node system, characterized in that it further comprises a link port information processing step. delete The method according to claim 1, wherein after the encryption transmission step, a request distribution step of distributing a request for establishing a security bond is determined if acceptance of the security bond is determined as a result of the security association negotiation, and if the security policy exists if the security association establishment request is distributed. A security policy determination step of determining whether the security policy is determined, a default input step of inputting security policy information set as a default when no security policy exists as a result of the security policy determination step, and the security bond information after the default input step. And a synchronization step of storing and synchronizing security association information. The method of claim 1, wherein in the encryption transmission step, after the security association is established and the corresponding mobile node is registered, the set link port information of the received registration request and the security level information loaded in the header of the packet are retrieved. An encryption request determination step of determining whether the security level requires encryption, An encryption transmission step of encrypting a datagram including the packet header and transmitting it to a home agent when it is determined that the security level requires encryption by the encryption request determination step; And a non-encrypted transmission step of transmitting the datagram to the home agent without encrypting the datagram when the security level does not require encryption as determined by the encryption and request determination step. How to secure your system's IP. delete The IP of the packet data service node system according to claim 1, wherein the encryption transmission step further includes a registration step of registering and accepting a registration request of a corresponding mobile node when there is an existing security bond. Security method.