KR100617321B1 - Method and Apparatus for Protection to Link Security Attack - Google Patents

Abstract

The present invention relates to an apparatus and method for preventing denial of service attacks and retransmission service attacks by third parties in an Ethernet passive optical network (EPON) network providing link encryption. The denial of service attack processing unit distinguishes whether an input frame is a frame transmitted from a broadcast security channel or a frame transmitted from a unicast security channel, and classifies whether the frame type is an encryption frame or a plain text frame.

The denial of service attack frame is evicted and processed according to an encryption mode parameter defining whether to apply encryption for each frame set in each security channel and a DoS attack frame application mode that determines whether DoS attacks are applied to input frames that violate the encryption mode definition. The retransmission attack blocker does not continuously increase the packet number in frames having the same AN value based on the packet number included in the encrypted frame and the logical secure channel identifier (AN) value. Evict and process the retransmission attack for frames whose previous values have been re-entered.

DoS attack blocking, replay attack blocking

Description

Device and method for preventing link encryption attack {Method and Apparatus for Protection to Link Security Attack}

1 is a schematic diagram of a SecY receiver module being standardized in the IEEE802.1AE working group.

FIG. 2 illustrates an encrypted frame structure input to the MACSecY receiver shown in FIG. 1.

FIG. 3 is a structural diagram of unencrypted plaintext frame types inputted and outputted to the MACsecY receiver shown in FIG. 1.

4 is a schematic diagram of a SecY receiver module with a function of blocking a denial of service attack and a replay attack.

5 is an internal hardware configuration diagram of a denial of service attack blocker.

6 shows the types of frames and Ethernet type values.

7 is a flowchart illustrating a process in the denial of service attack blocking unit.

FIG. 8 illustrates one embodiment of DoS attack blocking processing via a user set encryption mode parameter and a DoS attack application parameter in a broadcast secure channel.

9 is an internal hardware configuration diagram of a retransmission attack blocker.

10 is a flowchart illustrating a retransmission attack blocking procedure.

The present invention relates to a blocking device that guarantees Ethernet security service and performance by filtering a denial of service (DoS) attack and a replay attack. In more detail, the present invention provides a MAC security service in the EPON ONU terminal to filter the link encryption attacks, such as denial of service (DoS) attacks and replay attacks by third parties to filter the Ethernet security services and performance. An apparatus and a method for ensuring the same are provided.

In the topology of the EPON network, there is a risk of eavesdropping by other ONUs in downlink traffic, and there is a risk of unauthorized resource access or disguise by other ONUs in upstream traffic.

Since the subscriber must be able to provide confidentiality of information, and service providers must be able to provide protection of contents and billing for subscriber access, the security problem in subscriber network EPON is to provide the integrity of subscriber traffic, non-authentication devices and subscribers. The purpose is to block access.

In general, one of the most well-known hacks on the Internet is DoS attack and Replay attack, and exploits bugs or vulnerabilities in TCP / IP implementation to generate excessive traffic to attack terminals connected to the Internet.

A denial of service (DoS) attack is a situation in which a user or organization no longer receives services for resources that are commonly used on the Internet.

Loss of service generally indicates that certain network services, such as e-mail, are not working, or that network connections and services are temporarily inoperable. In the worst case, websites with millions of people occasionally stop working. It can also happen. DoS attacks can also disable programs or files on your computer system.

DoS attacks are a form of computer system security breaches that do not steal information or cause other security loss, but require significant sacrifices in terms of time and cost to targeted individuals or businesses. These DoS attacks on the Internet include Brute-force attacks, trinoo attacks, SYN Flooding attacks, Teardrop attacks, and LAND attacks.

Another type of hacking, the Replay attack is a spoofing attack that reuses previously sent messages.

In general, hacking is carried out by people with specialized knowledge of the system using various tools and vulnerabilities, while DoS or Replay attacks can be easily performed by anyone using the DoS attack program that roams the Internet without any specialized knowledge. Can attack equipment or systems.

The purpose of a DoS attack or a Replay attack is not to steal information, but to disable the device or network so that users can no longer access network resources.

In the prior art for preventing such DoS attacks, Korean Patent Laid-Open Publication No. 2003-0009887 analyzes a destination address at a subscriber access stage, measures traffic volume for each destination address and packet type, and compares the measured traffic volume with a reference value. It suggests how to block DoS attacks by sending or discarding.

In addition, as LAN scalability, broadband, and Ethernet switching technology have been accelerated, network transmission services using Ethernet devices are provided. To this end, the IEEE802.1AE Working Group is working on standardizing the MAC Security (MACSecY) module to provide security for MAC Ethernet services in LAN / MAN, including EPON.

However, the MACSecY module, which is currently being standardized, is also vulnerable to DoS attacks or Replay attacks.

The uncontrolled port of the conventional MACSecY module is vulnerable to DoS attack, and the controlled port is vulnerable to Replay attack. In particular, when a large amount of Ethernet frames are continuously input to an uncontrolled port from an external hacker, the input Ethernet frames are transmitted to the upper processors as they occupy resources, so that Ethernet devices using the conventional MACSecY module attack such DoS attacks. The system will stop.

 Therefore, Ethernet systems using the MACSecY module require a method and a hardware device capable of checking and blocking DoS attacks or Replay attacks from hackers.

The technical problem to be achieved by the present invention is that the MAC Security module providing a security function in the 1Gbps EPON ONU terminal filters and blocks on a frame basis based on a mode defined according to a user setting for a denial of service attack (DoS attack), It is to provide MAC service and MAC Security service by filtering and blocking by Security Association (SA) for Replay attack.

In order to achieve the above technical problem, the apparatus for denial of service attack according to an embodiment of the present invention comprises a frame classifier for determining whether a frame is an encrypted frame or a plain text frame based on an Ethernet type value in a security tag field of a frame; Security that determines whether an encrypted frame is a broadcast channel or a unicast channel based on the SCB flag value in the security tag field, and whether the plaintext frame is a broadcast channel or a unicast channel based on the logical link identifier (LLID) field value of the frame. A channel classifier; And a DoS attack blocking unit for processing a denial of service attack on the frame based on an encryption mode parameter defining whether to apply a security function for each frame type for each security channel and a DoS attack application mode parameter defined for the frame type.

Retransmission attack blocking device according to another embodiment of the present invention for achieving the technical problem is to determine whether the frame is a broadcast security channel or a unicast security channel based on the SCB flag value in the security tag field of the frame Secure channel classification unit; A security association comparing unit for identifying a security association based on an AN flag value in the security tag field of the frame for each security channel and determining the identity of the security association; And determining whether the frame is a retransmission attack frame when the security association indicates the same state, and if not, replay attack blocking unit bypassing the frame.

MACSecY receiver according to another embodiment of the present invention for achieving the technical problem is to determine whether the type of the frame is an encryption frame or plain text frame based on the Ethernet type value in the security tag field of the frame and broadcast the frame Determining whether it is a cast security channel or a unicast security channel and performing a denial of service attack on the frame based on an encryption mode parameter defining whether to apply a security function for each frame type and security channel and a DoS attack frame application mode parameter defined for each encryption mode parameter A denial of service attack processing unit; And classifying the frame as a broadcast security channel or a unicast security channel, classifying the frame by security association in the corresponding security channel based on the AN flag field value in the encrypted frame, and determining the identity of the security association to retransmit the frame. It includes; retransmission attack blocker to determine whether or not.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic diagram of the MACSecY receiver module being standardized in the IEEE802.1AE working group.

Because EPON is a point-to-multipoint network, certain ONUs located within the same network can always eavesdrop on other ONUs with a simple operation. In addition, OAM and MPCP frames, which are control frames used for the operation of the EPON network, contain confidential information such as discovery status, event notification, and transmission start start time. Therefore, link security in the EPON network protects the frames that are delivered to the ONU.

 MACsecY is a link security method proposed by the IEEE802.1AE WG and is currently being standardized. The present invention implements MACsecY receiver based on draft2.0 proposed by IEEE802.1AE WG.

The MACsecY receiver provides user data decryption, frame data integrity check, data source authentication, anti-replay attack and denial of service attack in EPON OLT and ONU, and provides 128-bit GCM-AES encryption mechanism.

In addition, the MACSecY receiver functions to decrypt and decrypt the authentication encrypted MAC frame transmitted from the SecY transmitter to a plain text MAC frame. Referring to FIG. 1, the MACSecY receiving apparatus 100 includes a demultiplexer module 120, a decoder module 130, an encryption unit 140, and an FCS generation unit 150.

The MACSecY receiving apparatus 100 receives MAC frames from the MAC layer through the unencrypted common port 110 (a111), and according to whether the input MAC frame (a111) is encrypted, the Uncontrolled Port 160 and the Controlled Port ( 170) and transmits the plaintext MAC frame and the encrypted MAC frame.

The MACSecY receiver module includes an uncontrolled port 160, a controlled port 170, a common port 110 external interface, and an LMI interface 180. Uncontrolled Port 160 and Common Port 110 are non-secure service access points, and Controlled Port 170 is a secure service access point.

The demultiplexer 120 classifies the plaintext MAC frame a121 into the uncontrolled port 160 based on the Ethernet type of the MAC frame input from the MAC layer through the common port 110, and classifies the MAC frame into the controlled port 170. The encrypted MAC frame is transmitted to the decoder 130 for decryption.

In addition, the demultiplexer 120 separates the encrypted MAC frame into a MAC address (DA, SA) a122 and an MSDU (a123, MAC Service Protocol Data Unit). At this time, the MAC address (DA, SA) (a122) is used as a parameter for creating an authentication key for frame authentication in the encryption unit 140.

The decoder module 130 separates and transmits a frame from the received MSDU a123 to SecTAG (a131), Secure DATA (a132), and ICV (a133). SecTAG (a131) is composed of an Ethernet type field, a Tag Control Information (TCI) value, a Packet Number (PN), and the like.

The encryption unit 140 includes a verification parameter selector 141, an integrity verifier 142, and a data decryptor 143.

The verification parameter selector 141 stores parameters such as a 128-bit KEY or Initialization Vector (IV) value to be used in the encryption unit 140 and inputs a security association identifier (SAI) input from the decoder 130. To select the verification parameter set. That is, the SCB bit in the TCI field is used to determine whether to request a key set for a broadcast channel or a key set for a unicast channel.

The integrity verification unit 142 calculates the ICV (Integrity Check Value) for the MAC address (a133) and Secure Data (a132) input from the decoder 130, and the ICV value input from the decoder 130. Compared to (a133), the integrity of the MAC address (a133) and Secure Data (a132) is checked by the hacker. In this case, when the calculated ICV value and the input ICV value are different from each other, the decoded frame is transmitted together with the authentication failure signal (a145).

The data decryption unit 143 decrypts the encrypted data using the parameter set a144 selected by the decoder 130 in the verification parameter selection unit.

Since the FCS generator 150 decrypts the encrypted MAC frame by the plaintext MAC frame, the FCS generator 150 calculates a new FCS value for the plaintext MAC frame after the decryption is finished (a151).

The MAC frame is then combined with the MAC address a122 from the demultiplexer 120 and forwarded to the controlled port 170.

However, when the MACSecY receiver receives many normal plaintext MAC frames through the Uncontrolled Port 160 from an external hacker, the upper processor is controlled by processing a plaintext MAC frame input through the Uncontrolled Port 160. The processing of the MAC frame performed in the port 110 is insufficient, eventually resulting in a system down due to an overload of the system.

FIG. 2 illustrates an encrypted frame structure input to the MACSecY receiver shown in FIG. 1.

The encrypted MAC frame 200 is encapsulated by adding an 8-byte SecTAG (security tag) and an 16-byte ICV field 206. The 8-byte SecTAG (Security Tag) includes a 2-byte MACsecY Ethertype (ET) field 201, a 1-byte TCI field 202, a 1-byte SL (Short Length) field 203, and a 4-byte PN field ( 204). That is, at least 24 bytes are added to the existing MAC frame to provide MAC security service in the EPON network.

 The 1-byte TCI field 202 includes a 1-bit version field 207, a 1-bit ES field 208, a 1-bit SC field 209, a 1-bit SCB field 210, and a 1-bit SH field ( 211), and consists of a 2-bit AN field 212. The SCB field 210 indicates whether or not a single copy broadcast frame is present. The AN field 212 is used to distinguish a security association (SA). The SH field 211 is displayed when the size of the frame is less than 64 bytes, and the length thereof is indicated by the SL field 203 of one byte.

FIG. 3 is a structural diagram of unencrypted plaintext frame types inputted and outputted to the MACsecY receiver shown in FIG. 1.

The plain text frame includes a MAC DATA frame 300, an MPCP frame 310, and an OAM frame 320. The frames are distinguished through the two-byte MAC Ethernet type fields 301, 311 and 312.

4 is a schematic diagram of a MACSecY receiver module with a function of blocking a denial of service attack and a replay attack.

4 further includes a denial of service attack blocker 421 and a retransmission attack blocker 422 in addition to the components of FIG. 1.

In the MACSecY receiving apparatus 400 of FIG. 4, the demultiplexer module 420, the decoder module 430, the encryption unit 440, the FCS generator 450, the uncontrolled port 460, the controlled port 470, and the common port ( 410 The external interface and the LMI interface 480 perform functions corresponding to the corresponding components of FIG. 1, and the basic functions are similar.

The denial of service attack blocker 421 receives the unencrypted plaintext MAC frame a421 and the encrypted MAC frame a422 from the demultiplexer 420, and based on the Ethernet type value in the SecTAG field of the frame. Determine the type of the frame; and if the frame is an encrypted frame, if the frame corresponds to a broadcast channel based on the LLID value in the preamble based on the SCB Flag value in SecTAG, the frame corresponds to a unicast channel. Identify if applicable.

Then, if the denial of service attack frame is based on the encryption mode parameter defining whether to apply the security function by frame type for each security channel and the DoS attack frame application mode parameter defined by the frame type, the input frame is deleted. An input frame is transmitted to the controlled port 470 and the uncontrolled port 460.

Therefore, by removing all the denial of service attack MAC frames transmitted to the uncontrolled port 460 or the controlled port 470 by the external hacker at the input terminal, the upper processors do not increase the load caused by the denial of service attack frame. A more detailed description thereof will be described later.

The retransmission attack blocking unit 422 receives an encrypted MAC frame (a422) that does not correspond to a service denial attack frame from the denial of service attack blocking unit 421 and broadcast security channel based on the Ethernet type value of the frame. Determine whether it is a unicast secure channel. After that, the packet number value is compared for each security association in the corresponding channel. If the packet number value of the currently input frame is less than or equal to the packet number value input in the previous frame in the same security association state, it is regarded as a retransmission attack frame and deleted. The other frame is transmitted to the decoder 430. A more detailed description thereof will be described later.

FIG. 5 is a diagram illustrating an internal hardware configuration of a denial of service attack blocking unit shown in FIG. 4.

The denial of service attack blocking unit 421 includes a frame classifier 500, an SCB secure channel classifier 510, a session secure channel classifier 520, an encrypted DoS attack processor 530, a plain text DoS attack processor 540, Security management unit 550 is included.

The frame classifier 500 distinguishes whether the type of the frame is an encryption frame or a plain text frame based on a 2-byte Ethernet type value in a SecTAG field in a frame input from the common port 410. The first secure channel classifier 510 transmits the plain text frame to the second secure channel classifier 520.

Types of frames and Ethernet types input from the common port 410 are illustrated in FIG. 6. The MACsecY Ethernet type of the encrypted MAC frame is not currently defined in the standardization, and accordingly, the present invention is designed to use a value defined according to a user's request. As shown in FIG. 6, the present invention uses "0x880a" as a default value of the MACsecY Ethernet type.

The secure channel classifier 510 includes a first secure channel classifier 510 and a second secure channel classifier 520.

The first secure channel classifier 510 receives the encrypted frame from the frame classifier 500 and determines whether the frame is a broadcast secure channel based on the SCB Flag value in the SecTAG of the frame. After identifying the identification, the encrypted DoS attack processor 530 transmits a security channel (SC) selection signal.

The second secure channel classifier 520 receives the plaintext frame from the frame classifier 500 and uses the LLID (Logical Link ID) information present in the preamble of the frame to determine whether the plaintext frame is a broadcast secure channel or unicast security. After determining whether the channel is transmitted to the plain text DoS attack processing unit 540 transmits a security channel (SC) selection signal.

The DoS attack processing unit 530, 540 processes whether the service attack denial frame is included, and includes an encrypted DoS attack processing unit 530 and a plain text DoS attack processing unit 540.

The encryption DoS attack processing unit 530 uses the broadcast security channel denial of service attack processing unit 531 and the unicast security channel denial of service attack processing unit 532 to block denial of service attacks on the broadcast security channel and the unicast security channel. Include.

In addition, since only the encrypted frame is input, the encrypted DoS attack processing unit 530 receives only the encryption mode parameter a551 of the 1-bit DATA MAC frame defined by the user's setting from the security management unit 550. It is determined whether a denial of service attack is applied to a frame input from the common port 410 using the 1-bit DATA MAC frame encryption mode parameter.

The plaintext DoS attack processing unit 540 uses the broadcast security channel denial of service attack processing unit 541 and the unicast security channel denial of service attack processing unit 542 to block denial of service attacks on the broadcast security channel and the unicast security channel. Include.

In addition, since the plain text DoS attack processing unit 540 receives a plain text MAC frame, an OAM frame, and an MPCP frame, a 3-bit frame-by-frame encryption mode parameter a552 defined by a user's setting from the security management unit 550 and a DoS attack The frame application mode parameter s553 is received. It is determined whether a denial of service attack is applied to the plain text frames input from the common port 410 using the frame-by-frame encryption mode parameter a552 and the DoS attack frame application mode parameter a553.

The security manager 550 receives the frame encryption mode parameters a551 and a552 and the DoS attack application mode parameter a553 from the user and transmits the received frame encryption mode parameters a551 and a552 to the encrypted DoS attack processing unit 530 or the plain text DoS attack processing unit 540.

FIG. 7 is a flowchart illustrating a process in the denial of service attack blocking unit shown in FIG. 4.

The flowchart shown in FIG. 7 checks whether a frame is a denial of service attack frame according to a mode defined by a user's setting for each security channel for a frame, deletes a frame corresponding to a denial of service attack, and does not correspond to a denial of service attack. Regarding the transmission operation, the service attack frame check is cyclically repeated for each frame input.

When the frame is input through the common port 410, the MACSecY receiver 400 checks whether the encryption unit 480 is activated (s700). If the encryption section is not activated, the denial of service attack blocker does not work. Whether the frame input from the common port 410 is an encrypted frame or a plain text frame is distinguished by an Ethernet type value in SecTAG of the frame (S710). In the case of an encrypted frame, it is checked whether the frame is a broadcast secure channel or a unicast secure channel using the SCB Flag value in SecTAG (S720).

In the case of a frame corresponding to the broadcast security channel, it is determined whether encryption is set for a frame based on the encryption mode parameter value of each broadcast frame, and in the case of the encryption mode, the decoder determines that the frame is a normal frame. In step S750). If not, the frame is regarded as a denial of service attack frame and deleted (s760).

In the case of a frame corresponding to a unicast secure channel, it is determined whether encryption is set for a frame based on an encryption mode parameter value of each unicast frame (s740). In step (s750). If not, the frame is regarded as a denial of service attack frame and deleted (S770).

In the case of the plain text frame, not the encrypted frame, the LLID information of the frame is used to check whether the two-byte upper LLID value is “7FFF” or “FFFF” to distinguish whether the frame corresponds to the broadcast security channel (s721). Frames corresponding to the cast security channel are again classified based on the Ethernet type value (s732).

It is checked whether an encryption mode parameter for each frame is set in the divided frame (s733). The encryption mode parameter for each frame is set for each frame. If the encryption mode parameter is set for each frame, the frame must be transmitted as an encrypted frame. Therefore, when the encryption mode parameter is set for each frame, if an unencrypted frame is input, it is treated as an abnormal input frame.

Thereafter, in the encryption mode parameter check step (s733), the DoS attack application mode parameter is checked to check whether the frame processed as the abnormal frame is treated as a denial of service attack frame or a normal frame (s734). The frame corresponding to the denial of service attack frame is deleted (s735), and the frame not transmitted to the uncontrolled port 460 (s736).

An embodiment of the DoS attack blocking process through the encryption mode parameter and the DoS attack application parameter for each user set frame in the broadcast security channel is illustrated in FIG. 8.

In the case of a frame corresponding to a unicast secure channel, the processing flow of the frame corresponding to the broadcast secure channel is similar to that described above, and the two-byte higher LLID value is “7FFF” or “FFFF” using the LLID information of the frame. If not, it checks whether the encryption mode is set according to the type of input frame and determines whether to apply a DoS attack.

FIG. 9 is a diagram illustrating an internal hardware configuration of the retransmission attack blocking unit shown in FIG. 4.

The retransmission attack blocking unit includes a security channel classification unit 900, a security association comparison unit 910, a replay attack blocking unit 920, and a multiplexer 930.

The encrypted channel passed through the service attack processor 421 is input to the secure channel classifier 900. The SCB Flag value in the security tag (SecTAG) of the encrypted frame is used to determine whether the frame is a broadcast security channel or a unicast security channel, and a security channel selection signal a901 is transmitted.

The security association comparison unit 910 includes a broadcast security association comparison unit 911 and a unicast security association comparison unit 912, and determines whether the AN flag value of the current input frame and the AN flag value of the previous frame are the same. Determine continuity of security association. That is, if the AN Flag value is the same, it indicates that the security association is continuous, otherwise it is a discontinuous state. In this case, the 2-bit AN flag value is an identifier parameter for identifying a security association (SA).

The broadcast security association comparison unit 911 checks whether the security association status has changed with respect to the security association existing in the broadcast security channel. It includes four security associations: Current Master Key SA, Next Master Key SA, Current Common Key SA, Next Common Key SA, and the AN Flag value for the SA is predefined by the user's setting.

The unicast security association comparison unit 912 checks whether the security association status has changed with respect to the security association existing in the unicast security channel. This includes four SAs: Current Master Key SA, Next Master Key SA, Current Session Key SA, and Next Session Key SA.

The replay attack blocking unit 920 determines that the security association is the same as the AN flag value in the security association comparison unit 910, if the security association is the same, the bypass unit 925 bypasses the frame and the security association is the same. And a replay check unit 924 for determining whether the frame is a retransmission attack frame.

The replay checker 924 includes a Common Key SA Replay checker 921, a Master Key SA Replay checker 922, and a Session Key SA Replay checker 923.

The common replay checker 921 compares the packet number value of the broadcast secure channel frame input in the previous frame with the packet number value of the currently input broadcast secure channel frame, and inputs the currently input packet number value in the previous frame. If less than or equal to the packet number value, it is determined that the same frame is retransmitted and a signal for deleting the frame is transmitted. Otherwise, a signal for transmitting an input frame is transmitted.

The Session Replay checker 923 compares the packet number value of the unicast secure channel frame input in the previous frame with the packet number value of the currently input unicast secure channel frame, and inputs the packet number value currently input in the previous frame. If less than or equal to the packet number, it is determined that the same frame is retransmitted and a signal for deleting the frame is transmitted. Otherwise, a signal for transmitting an input frame is transmitted.

The Master Replay checker 922 compares the packet number value of the broadcast secure channel or unicast secure channel frame input to the previous frame with the packet number value of the currently entered broadcast secure channel or unicast secure channel frame. When the packet number value is less than or equal to the packet number value input in the previous frame, it is determined that the same frame is retransmitted and a signal for deleting the frame is transmitted. Otherwise, a signal for transmitting an input frame is transmitted.

10 is a flowchart illustrating a retransmission attack blocking process.

The flow shown in FIG. 10 compares the packet number value of the current frame with the packet number value of the previous frame for each security association with respect to the encrypted frame, and determines whether the packet is a retransmission attack, and deletes the corresponding frame. It is related to the operation of transmitting. Retransmission attack frame check is repeatedly performed every frame is input.

When an encrypted frame is input from the denial of service attack blocking unit, it is determined whether the frame corresponds to a broadcast secure channel frame or a unicast secure channel frame (S1000).

In the case of a frame corresponding to the broadcast security channel, the AN flag value of the current frame is compared with the AN 'flag value of the previous frame (S1100).

If the AN Flag value is the same, the security association is recognized as the same state (s1200). In this case, it is determined whether the security association is a Master Key SA or a Common Key SA (s1400).

If the security association is Master Key SA, it is determined whether the retransmission attack frame is compared by comparing the packet number value PN inputted in the current frame and the packet number value MK_PN 'inputted in the previous Master Key SA frame (s1600). . If the PN value is less than or equal to the MK_PN ', the frame is deleted in response to the retransmission attack frame (S1710). Otherwise, the frame is determined to be a normal frame and transmitted. The PN value input in the current frame is stored in the MK_PN 'value (S1800).

When the security association is Common Key SA, it is determined whether a retransmission attack frame is made by comparing a packet number PN inputted in a current frame and a packet number value CK_PN 'inputted in a previous Common Key SA frame. If the value is smaller than or equal to CK_PN ', the frame is deleted in response to the retransmission attack frame. Otherwise, the frame is determined to be a normal frame, and the frame is transmitted. The PN value input in the current frame is stored in the CK_PN 'value.

On the other hand, if the AN Flag value is different, the security association does not recognize the continuity, and stores the AN Flag value of the current frame in a register that stores the AN Flag value of the previous frame (s1300).

In the case of a frame corresponding to the unicast secure channel, the AN flag value of the current frame is compared with the AN 'flag value of the previous frame (S1101).

If the AN Flag value is the same, the security association is recognized as the same state (s1201). In this case, it is determined whether the security association is a Master Key SA or a Session Key SA (s1401).

If the security association is Master Key SA, it is determined whether the retransmission attack frame is compared by comparing the packet number value PN inputted in the current frame and the packet number value MK_PN 'inputted in the previous Master Key SA frame (S1601). If the PN value is smaller than or equal to the MK_PN ', the frame is deleted in response to the retransmission attack frame (S1710). Otherwise, the frame is determined to be a normal frame and transmitted. The PN value input in the current frame is stored in the MK_PN 'value (S1720).

If the security association is a Session Key SA, it is determined whether the retransmission attack frame is compared by comparing the packet number value (PN) input in the current frame and the packet number value (SK_PN ') input in the previous Session Key SA frame. If the PN value is less than or equal to the SK_PN ', the frame is deleted in response to the retransmission attack frame. Otherwise, the frame is determined to be a normal frame and the frame is transmitted. The PN value input in the current frame is stored in the SK_PN 'value.

On the other hand, if the AN Flag value is different, the security association does not recognize the continuity, and stores the AN Flag value of the current frame in a register that stores the AN Flag value of the previous frame (s1301).

The present invention provides a service rejection attack and a retransmission attack blocking function that is easy to be attacked by an external hacker as a link encryption attack blocking device in the EPON ONU terminal and has a fatal result in the operation of the ONU system.

In addition, denial of service attack frames are selected and filtered for each frame according to the parameter value set according to the definition of the user.

In addition, Ethernet security services and performance are guaranteed by filtering and blocking hacking attacks by security association for retransmission attacks.

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

The best embodiments have been disclosed in the drawings and specification above. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims (26)

A frame classifying unit which determines whether the type of the frame is an encrypted frame or a plain text frame based on a type value in a security tag field of a frame; Determine whether the encrypted frame is a broadcast channel or a unicast channel based on an SCB flag value in the security tag field, and unicast whether the plaintext frame is a broadcast channel based on a logical link identifier (LLID) field value of the frame Secure channel classification unit to determine whether the channel; Defined whether to apply security function by frame type or security channel Denial of service attack processing to block a link encryption attack, comprising: a DoS attack blocking unit for processing a denial of service attack on the frame based on an encryption mode parameter and DoS attack application mode parameters defined for each of the encryption mode parameters Device. The method of claim 1, wherein the DoS attack blocking unit An encryption DoS attack processor configured to determine whether a denial of service attack is performed on a frame-by-frame basis based on the encryption mode parameter in a broadcast security channel or a unicast security channel; And And a plain text DoS attack processor configured to determine whether a denial of service attack is performed on a frame-by-frame basis based on the encryption mode parameter and the DoS attack frame application mode parameter in a broadcast secure channel or a unicast secure channel. A denial of service attack processing device that blocks a link encryption attack. The method of claim 1, And a security management unit which receives the frame encryption mode parameter and the DoS attack application mode parameter from a user and transmits the received frame encryption mode parameter to the DoS attack blocking unit. A secure channel classification unit for identifying whether the frame is a broadcast secure channel or a unicast secure channel based on an SCB flag value in a security tag field of a frame; A security association comparing unit for identifying a security association based on an AN flag value in a security tag field of the frame for each security channel and determining whether the identified security association is the same as the security association of a previous frame; And a replay attack blocking unit for determining whether the frame is a retransmission attack frame when the security association indicates the same state. The method of claim 4, wherein the Replay attack blocking unit Bypass unit bypassing the frame when the security association is not the same; And if the security association is the same, if the packet number value of the frame in the security association divided based on the AN flag value is greater than the packet number value of the frame in the previous security association, the frame is transmitted and a replay checker. Replay Attack Blocker. The method of claim 5, wherein the bypass unit And retransmitting an AN flag value of a previous frame to an AN flag value of the frame. The method of claim 5, wherein the Replay check unit And retransmit the packet number value of the previous frame to the packet number value of the frame when transmitting the frame. A service for identifying a type and a security channel of a frame based on a security tag field of a frame and processing a denial of service attack on the frame based on a user setting parameter defining whether to apply a security function to each of the identified frame type and security channel. Reject attack processing unit; For each security channel, a retransmission attack blocking unit for identifying a security association for the frame in the corresponding security channel based on an AN flag value in the frame, and determining whether to retransmit an attack based on determining the sameness of the identified security association; A decoder that decomposes the frame for each parameter; An encryption unit which decrypts the frame into a plain text frame and checks integrity based on a parameter received from the decoder; And a FCS generator for regenerating the FCS value in the frame for the frame into the FCS value for the decrypted frame. The method of claim 8, wherein the denial of service attack processing unit Determine whether the frame is an encrypted frame or a plain text frame based on a type value in the security tag field, and determine whether the encrypted frame is a broadcast secure channel or a unicast secure channel based on an SCB tag in the secure tag field; SecY receiving apparatus for blocking a link encryption attack, characterized in that whether the plain text frame is a broadcast channel or a unicast channel based on the logical link identifier (LLID) field value of the frame. The method of claim 9, wherein the denial of service attack processing unit And a security management unit for receiving the frame encryption mode parameter and the DoS attack application mode parameter that define whether the security function is applied to each of the frame type and the security channel as the user setting parameter and transmitting the received DoS attack blocking unit to the DoS attack blocking unit. SecY receiver device that blocks a link encryption attack. The system of claim 10, wherein the denial of service attack processing unit An encryption DoS attack processor configured to determine whether a denial of service attack is performed on a frame-by-frame basis based on the frame encryption mode parameter in a broadcast secure channel or a unicast secure channel; And And a plain text DoS attack processor configured to determine whether a denial of service attack is performed on a frame-by-frame basis based on the frame encryption mode parameter and the DoS attack frame application mode parameter in a broadcast secure channel or a unicast secure channel. SecY receiver unit for blocking a link encryption attack. The method of claim 8, wherein the retransmission attack blocking unit It is determined whether the security association determined based on the AN Flag value is the same as the security association of the previous frame. Bypass unit for bypassing the frame when the security association is not the same; If the security association is the same, within the security association divided based on the AN Flag value And a Replay check unit for transmitting the frame when the packet number value of the frame is greater than the packet number value of the frame in the previous security association. The method of claim 12, wherein the bypass unit MACSecY receiver unit characterized in that for updating the AN Flag value of the previous frame to the AN Flag value of the frame. The method of claim 12, wherein the Replay check unit And the packet number value of the previous frame is updated to the packet number value of the frame when the frame is transmitted. Determining whether the type of the frame is an encrypted frame or a plain text frame based on a type value in a security tag field of the frame; Determine whether the encrypted frame is a broadcast channel or a unicast channel based on an SCB flag value in the security tag field, and unicast whether the plaintext frame is a broadcast channel based on a logical link identifier (LLID) field value of the frame Determining whether it is a channel; Defined whether to apply security function by frame type or security channel And processing a denial of service attack on the frame based on an encryption mode parameter and a DoS attack application mode parameter defined for each of the encryption mode parameters. 16. The method of claim 15, wherein processing the denial of service attack Determining whether a denial of service attack is performed on a frame-by-frame basis based on the frame encryption mode parameter in a broadcast secure channel or a unicast secure channel; And Determining whether the plaintext frame is a denial of service attack on a frame-by-frame basis based on the frame encryption mode parameter and the DoS attack frame application mode parameter in a broadcast secure channel or a unicast secure channel. How to block denial attacks. Determining whether the frame is a broadcast secure channel or a unicast secure channel based on an SCB flag value in a frame's security tag field; Identifying a security association based on an AN flag value in the security tag field of the frame for each security channel and determining whether the identified security association is the same as the security association of a previous frame; Determining whether the frame is a retransmission attack frame when the security association indicates the same state; And bypassing the frame when the security association is not the same. 18. The method of claim 17, wherein determining whether the frame is a retransmission attack frame And if the packet number of the frame in the security association divided based on the AN flag value is greater than the packet number value of the frame in the previous security association, transmitting the frame and deleting the frame. 18. The method of claim 17, wherein bypassing the frame And retransmitting an AN flag value of a previous frame to an AN flag value of the frame. The method of claim 17, And retransmitting a packet number value of a previous frame to the packet number value of the frame when the frame is transmitted. (a) identifying a type and a security channel of the frame based on the security tag field of the frame; (b) processing a denial of service attack on the frame based on a user setting parameter that defines whether to apply a security function for each identified frame type and security channel; (c) identifying, by the security channel, the security association for each of the frames in the corresponding security channel based on an AN flag value in the frame; (d) determining whether a retransmission attack is made based on determining the identity of the identified security association; (e) decomposing the frame for each parameter; (f) decoding the frame into a plain text frame and checking its integrity based on the parameter received from the decoder; (g) regenerating the FCS value in the frame for the frame into the FCS value for the decrypted frame. The method of claim 21, wherein step (a) Determine whether the frame is an encrypted frame or a plain text frame based on a type value in the security tag field, and determine whether the encrypted frame is a broadcast secure channel or a unicast secure channel based on an SCB tag in the secure tag field; And determining whether the plaintext frame is a broadcast channel or a unicast channel based on a logical link identifier (LLID) field value of a frame. The method of claim 22, wherein step (b) Receiving a frame encryption mode parameter and a DoS attack application mode parameter that define whether to apply a security function for each frame type and security channel as the user setting parameter; (b1) determining whether a denial of service attack is performed on a frame-by-frame basis based on the frame encryption mode parameter in a broadcast secure channel or a unicast secure channel; And (b2) determining whether a plaintext frame is a denial of service attack on a frame-by-frame basis based on the frame encryption mode parameter and the DoS attack frame application mode parameter in a broadcast secure channel or a unicast secure channel; and How to block link encryption attacks. The method of claim 21, wherein in step (d), It is determined whether the security association determined based on the AN Flag value is the same as the security association of the previous frame. (d1) bypassing the frame when the security association is not the same; (d2) when the security association is the same, transmitting the frame when the packet number value of the frame in the security association divided based on the AN flag value is greater than the packet number value of the frame in the previous security association; How to block link encryption attacks. The method of claim 24, wherein step (d1) Updating an AN flag value of a previous frame with an AN flag value of the frame. The method of claim 24, wherein step (d2) And link packet update value of the previous frame to the packet number value of the frame during transmission of the frame.

Images