KR100447681B1 - method and recorded media for union key management using IPsec - Google Patents

Abstract

The present invention can negotiate a password and authentication key manually with a manual key management system for another security area in the application layer, or automatically negotiate a password and authentication key in conjunction with an automatic key management server, and The authentication key information forms a message according to the defined key socket protocol, interprets this information at the kernel level, stores it in the kernel as a security association database, and when sending or receiving a packet from the IPsec engine, the security association database stored at the kernel level. Reference is made to perform IPsec communication.

According to the present invention, it is not necessary to manage and maintain each key information according to an application layer service service, and provide a secure service to existing Internet users by managing only security association and key information for a security protocol to be provided. Can be.

Description

Integrated key management method using IPsec and recording medium for this method {method and recorded media for union key management using IPsec}

The present invention relates to an integrated key management method using IPsec and a recording medium therefor, and more particularly, to managing keys and security associations (SA) used in security protocols required by IPsec technology for providing information security services on the Internet. An integrated key management method using IPsec and a recording medium therefor.

As the Internet spreads and speeds up, the infringement of the Internet is increasing, and the magnitude and impact of public institutions, infrastructure, and financial institutions are large. Accordingly, there is a need for Internet security that can prevent Internet breaches, and IPsec is a representative example. IPsec defines AH / ESP and IKE as a protocol for providing security services in the IP layer, providing packet-based encryption and authentication services, and preventing forgery and replay attacks.

Security management products include 3COM's Policy-Powered Network, Netguard's NT-based Policy Server Technology, and BrainTree's SQL <> SECURE ().

Generally, key management techniques include techniques related to key generation, key update, key deletion, and key disposal. This key management technique is generally configured in a form called by the application layer.

In the conventional key management technology for the Internet information protection service, there is an information protection method for each Internet service, and key information for each of these is also required. Therefore, the user and the Internet service provider need each key information for each application service. Accordingly, there is a problem of separately managing each key information.

The present invention is to solve the above-mentioned problems, and is not a key management technology required in the conventional Internet information protection technology, but integrates using IPsec that manages security association and key information in the IP layer and independently implements and operates. The purpose is to provide a key management method and a recording medium therefor.

In the present invention to achieve the above object in the key management method of the IPsec communication, the application layer negotiates a password and authentication key manually with the system GUI for the other security area, or automatically linked with the automatic key management server, the password and authentication Negotiating a key; Forming a message according to a defined key socket protocol and interpreting the information at a kernel level by storing the cipher and authentication key information negotiated at the application layer as a security association database in the kernel; Performing inquiry and management of the security association database using a virtual file system with respect to the security association database stored in the kernel; and a security association database stored at the kernel level when a packet is transmitted or received by an IPsec engine. It provides an integrated key management method using IPsec, including; performing IPsec communication with reference to.

Further, according to the recording medium for performing the key management method of the IPsec communication according to the present invention, in order to perform the key management method of the IPsec communication, a program of instructions that can be executed by the digital processing apparatus is tangibly implemented. In a recording medium that can be read by a digital processing apparatus, the application layer can negotiate a password and an authentication key manually with a system GUI for another security area or automatically negotiate an encryption and an authentication key in conjunction with an automatic key management server. Process of doing; Forming a message according to a defined key socket protocol and interpreting the information at the kernel level by storing the cipher and the authentication key information negotiated at the application layer as a security association database in the kernel; Performing inquiry and management of the security association database using the virtual file system with respect to the security association database stored in the kernel; And when the packet is transmitted or received by the IPsec engine, performing IPsec communication with reference to a security association database stored at the kernel level.

Since the IPsec technology used in the present invention provides an information protection service for each packet in the IP layer, it is possible to provide an information protection function to all Internet services according to a desired security protocol and algorithm without affecting the application layer service program individually. Therefore, the Internet users can receive a secure information protection service by managing only the security association information and the related key information for the security protocol to be provided without requiring each key information according to the application layer service.

1 is a conceptual diagram illustrating an integrated key management method using IPsec according to the present invention;

2 is a configuration diagram of a SADB structure for packet protection in the IP layer of the Internet according to the present invention;

3 is an interface diagram of a GUI server and a key management server for manually managing SADB according to the present invention;

4 is an interface configuration diagram for storing and managing automatically negotiated SA and key information in a key management server according to the present invention;

5 is a conceptual diagram illustrating a file system defined for showing an administrator SADB information located in a kernel layer according to the present invention;

6 is a flowchart illustrating an operation for managing security association and key information using a key management socket in a kernel layer in an application layer according to the present invention;

7 is a flowchart illustrating an operation for requesting renegotiation and renewal of an SA according to a valid period of key and security association information according to the present invention.

* Description of the symbols for the main parts of the drawings *

10: manual key management system 20: automatic key exchange server

30: Key Management Server 31: GUI Agent

32: IKMB 33: SADB

40: IPsec engine 50: proc file system

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings. 1 is a conceptual diagram illustrating an integrated key management method using IPsec according to the present invention.

Referring to the drawings, the present invention negotiates a password and an authentication key manually with a manual key management system 10 for another security area in an application layer, or automatically connects an encryption and authentication key with an automatic key management server 20. Negotiation protocol, and form a message according to the defined key socket protocol, the password and authentication key information negotiated at the application layer, interprets this information at the kernel level and stores it as a security association database in the kernel, and the packet in the IPsec engine 40 In case of sending or receiving, IPsec communication is performed by referring to security association database stored at kernel level.

2 is a configuration diagram of a SADB structure for packet protection in the IP layer of the Internet according to the present invention, illustrating information contained in the SADB structure generated in the kernel layer.

SADB creates a structure in kernel memory the first time an SA is created. The SAs stored in each database are identified by destination address, security parameter index (SPI), and security protocol (AH or ESP). SPI values are generated and used randomly using a random function in the system that generated the security association information. Each database adds a destination address, SPI, and security protocol (AH or ESP), modifies the value of SADB_HASH_MOD, 257, obtains a hash value, and stores this value as a pointer. When the IPsec engine transmits or receives a packet, applies an SA or extracts an applied SA, the hash value can be used to access the database and get SA information faster.

In addition, each time an SA is created, a SADB sequence number is assigned and an algorithm type of a security protocol to be applied by the SA is stored. The algorithm type is stored for the system to read.

That is, the system administrator has a readable name field so that the SA can take and view the SA. It has auth alg and enc alg fields that can store algorithms according to AH and ESP security protocols. Also, if you specify a replay window size when sending and receiving packets, the IPsec engine stores the replay window size directly in the SADB. The SADB can define two SA validity periods: bytes and seconds. Depending on the validity of manual or automatically negotiated SA information, the SADB can have hard, soft, and current validity periods. The expiration date is managed by dividing into bytes, addtime, and usetime.

Each SA has source address for packet transmission and destination address for packet arrival and has key value according to each security protocol and algorithm. In addition, each key value may have length information of a key to be used and an initial vector value to be used in an encryption algorithm (enc alg). The SADB enters a field value that is not specified in the application layer as 0 and is located at the kernel level so that communication between the kernel and the application layer can be made only when the SA is created and deleted.

When the SADB information is located at the application layer, the IPsec engine eliminates the need to communicate with the SA of the application layer or create another temporary database at the kernel level whenever a packet is transmitted or received.

3 is a diagram illustrating an interface between a GUI server and a key management server for manually managing SADB according to the present invention.

Referring to the drawings, according to the present invention, the SA for the IPsec service manually generates an SADB for communication with a host without a test bed and an automatic key negotiation server, stores and deletes the SA, manages and updates the validity period, and updates the database. It requires a function that needs to be discarded.

The present invention describes the functions and interface techniques and implementation methods that can manage SAs manually for this service. IPsec Internet Security Service must have SA information in advance in order to provide the desired security protocol and algorithm in the packet. To do this, they exchange information to be stored in the SADB, such as by phone or email. Input the exchanged information through the system GUI 10, create the SADB structure 33 in the kernel by the interface between the GUI 10 and the key management server 30, or link to an existing database and store in the SADB , Delete a particular SA or delete and discard an SADB structure. The system GUI 10 may view the SADB 33 through the GUI agent 31, and may add / delete / clear the SPI through the IKNB 32.

4 is an interface configuration diagram for storing and managing automatically negotiated SA and key information in a key management server according to the present invention.

Referring to the drawings, the integrated key management server proposed by the present invention provides not only manual key management but also automatically negotiated security association and key management by communicating with an automatic key exchange server.

The present invention sends this information to the key management server 30 when the automatic key exchange server 20 negotiates a security association and key to be applied by the IPsec engine. Upon receiving this information, the key management server 30 adds a new SA by processing the information and passing it to a key management function in the kernel in order to send this information to the SADB 33 in the kernel. Arrows in the figure represent each mode of negotiating a key.

Accordingly, the automatic key exchange server 20 on the initiator side transmits to the automatic key exchange server 20 on the responder side via the quick mode 1, and the key management on the responder side on the automatic key exchange server 20 on the responder side. If SA (I-> R) is stored in the server R, and the auto-exchange server 20 on the responder side responds to the auto-exchange server 20 on the initiator side through the quick mode 2, the autonomous on the initiator side is The key exchange server 20 stores SA (I-> R) out and SA (R-> I) in in the key pipe server 30 on the initiator side. On the other hand, the automatic key exchange server 20 on the responder side stores SA (R-> I) out after executing quick mode 3.

Also, when applying the SA in the IPsec engine, check the validity period, delete the SA when the expiration date expires, and inform the key exchange server to negotiate a new SA with this host and the host with the specified destination address. Re-negotiate to update. The key management server deletes the expired SA from the existing SADB list and deletes it safely.

5 is a conceptual diagram of a file system defined to show SADB information located in a kernel layer to an administrator.

Referring to the figure, since the SA information 33 located in the memory of the kernel layer is not directly accessible from the application layer, the memory contents of the kernel layer may be viewed from the application layer using the proc file system 50. The proc filesystem 50 is a kind of illusion that doesn't really exist. This filesystem is created by the kernel in memory and does not exist on disk. It registers itself with the virtual filesystem just like a real filesystem.

Then when the VFS requests an inode while opening a file or directory, the proc file system 50 creates these files and directories with the information in the kernel. The proc file system 50 provides a window for the user to view the internal workings of the kernel so that the IPsec engine manager and the GUI system manager 10 can view the SA information in the kernel hierarchy.

In addition, it defines not only the SA information of the kernel layer but also the proc file to view the registered sockets used in the key socket, the type of security protocol and algorithm information provided by a particular host.

6 is a flowchart illustrating an operation of managing security association and key information using a key management socket in a kernel layer in an application layer according to the present invention.

Referring to FIG. 5, a process of configuring a message containing security association and key information using a key management socket in a kernel layer in an application layer, and parsing and processing a message in the kernel layer receiving the packet will be described.

The present invention uses key management sockets in the application layer and the kernel layer to manage security information automatically negotiated, as well as security association and key information management.

When receiving a command for storing and deleting a key automatically and manually negotiated from an auto key management server (Autokem) or system GUI (S1), a security protocol for the received command, an algorithm for a specified security protocol, SA message with SPI value, replay window value, transport mode and tunnel mode value, expiration message to be applied to SA, address message with source and destination address of packet to apply SA, key information message required for SA (S2) Get down to the kernel through the key socket (S3).

The kernel receives this message from the application layer through the key socket (S4), parses and processes each received message (S5), and processes the received message by connecting to the SADB in the kernel (S6). In the case of the add command, the information is inserted according to each field, and in the case of the delete command, the information is deleted from the corresponding field.

FIG. 7 illustrates that the IPsec engine compares the current system clock with the SA validity period to perform renegotiation and renewal of the SA when the system clock is read and stored and the packet is transmitted or received to set and check the validity period of the key and security association information. This is a required flow chart.

The key management system of the present invention does not put a timer at the kernel level to manage the validity of the SA. Running a timer at the kernel level can increase the load on the kernel because a process is allocated and progressed.

In the present invention, when the validity period information of the SA is received from the application layer automatic key management server (Autokem) or system GUI to the key management server (S11), the key management server reads the system clock of the current kernel and stores the current value information. The validity period is set and the set validity period is stored in the SADB (S12). The SA validity period may have a validity period of 28800 seconds, for example, and the present value information may be calculated in jiffies / Hz. Accordingly, the SA validity period set in the SADB is set to the current clock value plus the validity period (sec). When the IPsec engine transmits or receives a packet (S12), it applies the security association information stored in the SADB (S15). When applying the packet, the IPsec engine compares the current system clock with the validity period information and manages the SA validity period. That is, it is determined whether the current system clock is greater than the valid period (S16). It is determined whether the current clock value C is greater than the SA validity period (sec). If the system clock is greater than the validity period, the validity period of this SA is expired and the IPsec engine discards the packet and requests the key management server to delete and renegotiate this security association (S17). If the system clock is not larger than the valid period, the transmitted packet or the received packet is processed normally (S18).

In addition, the key management system of the present invention can designate the limit of bytes to which a specific security association can be applied by having not only time information but also byte information as valid period information.

As described above, according to the present invention, it is not necessary to manage and maintain each key information according to the application layer service service, and manages only the security association and key information for the security protocol to be provided to existing Internet users. Can provide a secure service.

In addition, by placing key information and SA information at the kernel level, the IPsec engine eliminates the need to communicate with the SA of the application layer or create another temporary database at the kernel level whenever a packet is transmitted or received.

Claims (8)

In the key management method of IPsec communication, Negotiating a password and an authentication key manually with a system GUI for another security area in an application layer or automatically negotiating an encryption and an authentication key in association with an automatic key management server; Forming a message according to a defined key socket protocol, and storing the encrypted negotiation and authentication key information negotiated at the application layer at the kernel level and storing the information as a security association database in the kernel; Performing inquiry and management on the security association database using a virtual file system with respect to the security association database stored in the kernel; And And performing an IPsec communication by referring to a security association database stored at the kernel level when a packet is transmitted or received by an IPsec engine. The method of claim 1, wherein in the storing in the security association database, When the security association is saved, the system clock is read and the current clock value is saved.When the IPsec engine refers to the security association information, the validity period of the security association database is compared by comparing the current system clock with the system clock when it is stored in the database. Integrated key management method using IPsec, characterized in that for checking. The method of claim 2, wherein the validity period is expressed by time information or byte information. The method of claim 1, wherein the storing in the kernel as a security association database, The security association database, At least one of a destination address, an SPI, a security protocol (AH or ESP) value, replay window information, validity information of SA information, key length information to be used for the key value, and initial vector values to be used in the encryption algorithm. Integrated key management method using IPsec comprising a. The method of claim 1, wherein the storing in the kernel as a security association database, The security association database, the field value not specified in the application layer is set to 0, and the integrated key management method using IPsec characterized in that the communication between the kernel and the application layer is performed only when SA creation and deletion. According to claim 1, In the step of performing the query and management for the security association database, The virtual file system is a proc system integrated key management method using IPsec. The method of claim 1, wherein performing the IPsec communication comprises: Referencing security association information stored in the security association database when a packet is transmitted or received; Comparing the current system clock with valid period information; And If the system clock is greater than the validity period as a result of the comparison, determining that the validity period of the corresponding SA has expired, discarding the corresponding packet, and requesting the key management server to delete and renegotiate the security association. Integrated key management method using IPsec characterized in that. In order to perform the key management method of IPsec communication, a program of instructions that can be executed by the digital processing apparatus is tangibly implemented, and in the recording medium that can be read by the digital processing apparatus, Negotiating a password and an authentication key manually with a system GUI for another security area in an application layer, or automatically negotiating a password and an authentication key in association with an automatic key management server; Forming a message according to a defined key socket protocol by using the negotiated encryption and authentication key information in the application layer, and interpreting the information at a kernel level and storing the information in a kernel as a security association database; Querying and managing the security association database using a virtual file system with respect to the security association database stored in the kernel; And When a packet is transmitted or received by an IPsec engine, performing IPsec communication with reference to a security association database stored at the kernel level; a recording medium having a program therein for performing the same.