KR100846536B1 - Virtual Private Network Using DHCP and Method of Security on the Same - Google Patents

Abstract

The present invention relates to a security method of a virtual private network and a virtual private network using a dynamic address assignment system in the Internet public network, and more particularly, to a virtual private network including a plurality of subscribers, the unique MAC address DHCP, which is identified on a network and includes an authentication function of the plurality of subscribers, a storage function of the IP addresses of the plurality of subscribers, a communication setting function between the subscribers, a communication setting function between the subscribers and an external communication network, and a network security program. DNS server; A DHCP server randomly assigning IP addresses of the plurality of subscribers and a DHCP DNS server; And a subscriber server identified on a network by a unique ID and included in a subscriber station, the subscriber server communicating with the DHCP DNS server and the DHCP server, wherein the subscriber server comprises a command or a first setting of a network security program of the DHCP DNS server. Requesting reassignment of the IP address of the subscriber to the DHCP server every time, and transmitting the IP address of the subscriber reassigned by the DHCP server to the DHCP DNS server. There is an effect that can provide a virtual private network that maintains the castle.

Description

Virtual Private Network Using DHCP and Method of Security on the Same}

1 is a block diagram illustrating a virtual private network according to an embodiment of the present invention.

2 is an exemplary view showing a security method according to an embodiment of the present invention.

3 is a block diagram showing a DHCP DNS server and a subscriber server according to an embodiment of the present invention.

4 is a flow diagram illustrating subscriber communication connections in accordance with an embodiment of the present invention.

5 is a flowchart showing communication setup between subscribers according to an embodiment of the present invention.

6 is a flowchart showing a subscriber IP address change notification according to an embodiment of the present invention.

7 is a flowchart illustrating a changed subscriber IP address notification in accordance with an embodiment of the present invention.

8 is a flowchart illustrating a notification of DHCP DNS server location change according to an embodiment of the present invention.

9 is a flowchart illustrating a modified DHCP DNS server location notification according to an embodiment of the present invention.

10 is a flowchart illustrating IP address fixing according to an embodiment of the present invention.                 

<Description of Symbols for Major Parts of Drawings>

11,13: Internet public network DHCP subscriber 15,17: fixed IP subscriber

19: Internet private network DHCP subscribers 21,23,25,27: DHCP server

30: DHCP DNS server

The present invention relates to a security method of a virtual private network and a virtual private network using a dynamic address assignment (DHCP) system in the Internet public network, and more specifically, to a virtual private network using a DHCP DNS server. Among the subscribers of the private network, unique IDs are identified, and according to the security program command or the set time, the user's IP address and the DHCP DNS server's IP address are randomly reassigned. The present invention relates to a virtual private network that can maintain a high level of security for users other than the virtual private network subscribers by arbitrarily changing the method.

Recently, DHCP has been widely used in ADSL and virtual private networks of public networks to solve the problem of address depletion due to the spread of the Internet and to assign addresses to temporary users. However, the IP address is frequently reassigned so that the user can freely communicate with the outside and has the advantage of having anonymity for other users. However, in order to access the user from the outside, the user must know the address assigned to the user. Because of this, there is a problem that can not form a virtual interactive network.

In addition, if a conventional static IP address is used, a two-way network can be configured. However, if the address is disclosed or exposed to a large number of users, the security vulnerability is high due to the attack of a hacker, the spread of viruses, etc. There is this.

The present invention is to solve the above problems, even in a DHCP environment can provide accessibility between the virtual private network subscribers (hereinafter, subscribers) through a unique ID, it is possible to block the access of users except subscribers An object of the present invention is to provide a security method for a virtual private network and a virtual private network.

In order to achieve the above object, a virtual private network including any plurality of subscribers according to the present invention is identified on the network by a unique MAC address, and the authentication function of the plurality of subscribers and the IP addresses of the plurality of subscribers A DHCP DNS server including a storage function, a communication setting function between the subscriber, a communication setting function between the subscriber and an external communication network, and a network security program; A DHCP server randomly assigning IP addresses of the plurality of subscribers and a DHCP DNS server; And a subscriber server identified on a network by a unique ID and included in a subscriber station, the subscriber server communicating with the DHCP DNS server and the DHCP server, wherein the subscriber server comprises a command or a first setting of a network security program of the DHCP DNS server. Requesting reassignment of the subscriber's IP address to the DHCP server every time, and transmitting the subscriber's IP address reassigned by the DHCP server to the DHCP DNS server.

In addition, a security method of a virtual private network including any of a plurality of subscriber servers identified by a unique ID, a DHCP DNS server identified by a unique MAC address, and a DHCP server according to the present invention, the subscriber server may be configured as the DHCP server. A first step of requesting to change the IP address of the subscriber at every instruction or security time stored in the DHCP DNS server; A second step of the DHCP server reassigning any IP address to the subscriber in response to the IP address change request from the subscriber server; And a third step of the subscriber server notifying the reassigned IP address to the DHCP DNS server.

The above and other objects and features and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a virtual private network according to an embodiment of the present invention. The virtual private network is composed of any of a plurality of subscribers 11, 13, 15, 17, 19, DNS servers 21, 23, 25, 27, and DHCP DNS server 30. The subscriber may be a DHCP subscriber 11, 13 of the Internet public network, a fixed IP subscriber 15, 17 of the Internet public network, or a DHCP subscriber 19 of the Internet private network.

The DHCP DNS server 30 is identified on the network by a unique MAC address, authenticates the plurality of subscribers 11, 13, 15, 17, 19, stores the IP address of the plurality of subscribers, and establishes communication between the subscribers. Function, communication setting function between subscriber and external communication network, and network security program.

Preferably, the authentication function of the subscriber may be performed by checking the ID and password of the subscriber transmitted from the subscriber server 40 to be described later. The function of storing the subscriber's IP address is an IP address allocated from the subscriber server 40 whenever the subscribers 11, 13, 15, 17 and 19 are assigned an IP address from the DHCP server 21, 23, 25 and 27. It is performed by receiving and storing by ID. Preferably, the communication setup function between subscribers, when the sending subscriber 11 queries the ID of the receiving subscriber 13, the DHCP DNS server 30 obtains an IP address corresponding to the ID of the corresponding receiving subscriber 13; The method may be performed by transmitting to the transmitting subscriber server 11. The communication setting function between the subscribers 11, 13, 15, 17, and 19 and the external communication network except the virtual private network is performed in the same manner as that of the general DNS server.

The network security program transmits an IP address change command to the subscriber server 40 as necessary or whenever a set time elapses. Preferably, the command for changing the IP address of the DHCP DNS server 30 may be transmitted to the DHCP DNS server 30, and more preferably, the command for changing the DHCP DNS server that is activated when the plurality of DHCP DNS servers are included. It can be delivered to the currently active DHCP DNS server 30.

The DHCP servers 21, 23, 25, and 27 serve to randomly assign IP addresses of the plurality of subscriber servers 11, 13, 15, 17, and 19 and the DHCP DNS server 30.                     

The subscriber server 40 is included in each subscriber terminal and is identified on the network by a unique ID, and can communicate with the DHCP DNS server 30 and the DHCP servers 21, 23, 25, 27. Subscriber servers (11, 13, 15, 17, 19) send the IP address of the subscriber to the DHCP server (21, 23, 25, 27) at the time of command of the network security program of the DHCP DNS server 30 or the first set time. It is possible to request the reassignment of the subscriber, and to transfer the IP address of the subscriber reassigned by the DHCP servers 21, 23, 25, and 27 to the DHCP DNS server 30.

Preferably, the DHCP server 21, 23, 25, 27 is requested to reassign its own IP address to the DHCP server 21, 23, 25, 27 at the command of the network security program or the second set time elapses. It is possible to transmit its own server IP address reassigned by the &lt; RTI ID = 0.0 &gt; 1) &lt; / RTI &gt;

More preferably, the virtual private network further includes a plurality of deactivated DHCP DNS servers having different MAC addresses, so as to change the DHCP DNS server to be activated at every command of the network security program or the third set time, and the changed DHCP The DNS server can send its server IP address and MAC address to all subscriber servers. At this time, preferably, in order to prevent the case in which the change information of the subscriber's IP address cannot be received during the change of the DHCP DNS server 30, the DHCP DNS server 30 may change all the DHCP DNS servers to be activated. In response to the IP address fixing command, the subscriber server may repeatedly transmit a PING to any living IP address at regular intervals and maintain the current IP address in response to the IP address fixing command.

Preferably, in the communication between all the DHCP DNS servers 30 and the subscriber servers 11, 13, 15, 17, and 19 described above, the DHCP DNS server 30 is connected to the subscriber server (from the DHCP DNS server 30). 11, 13, 15, 17, 19) if the subscriber server does not receive the set number of times, the network operator is notified of the communication failure, and the subscriber server sends a signal from the subscriber server to the DHCP DNS server 30 to the DHCP DNS If the server 30 does not receive it, it can be made to notify the user of the communication failure.

2 is an example of a security function of a virtual network group using the DHCP DNS server 30 according to an embodiment of the present invention. DHCP DNS (51, 52) can be configured separately or integrated between the virtual private network subscribers. Each subscriber is a member of the virtual private network network, and even under a DHCP environment, each IP address information (61, 62) can be known through the DHCP DNS server (51, 52) through a unique ID, thereby enabling bidirectional communication. . Since the subscriber IP address is reassigned as time passes by changing from 61 to 62 in the figure, external users can access the desired user unless the IP address is verified by accessing the DHCP DNS server 51. none.

According to a preferred embodiment of the present invention, as indicated by reference numeral 51 to 52 in the figure, the DHCP DNS server also changes the physical location and IP address of the DHCP DNS server to an arbitrary location and IP address at regular intervals, Since only the user group 62 is informed, the security function of the virtual network can be further enhanced.

Thus, even if an external user 80 temporarily knows the location 51 of the DHCP DNS server and the virtual private network network subscriber IP address 61, the location and IP address of the new DHCP DNS server 62 over time. In addition to being changed to, since the IP address 62 of the entire new subscriber group is changed, the network is blocked from the external user 80 to enhance security. In addition, it is possible to block the network access through the ID and password query for all connection attempts to the DHCP DNS server (51, 52) of the external user. Therefore, the internal subscriber group 61 can access the external fixed IP user 80 and other subscribers 62 who know the address at any time and the user group can exist anywhere in the Internet network so that the physical location Anonymity for third parties without restrictions.

3 is a diagram illustrating a DHCP DNS server unit 30 and a user server unit 30 according to an embodiment of the present invention. The DHCP DNS server 30 may be configured to include an input processor 31, an output processor 33, a DNS server operation processor 35, a server security function processor 37, and a transceiver 39. The input processing unit 31 is responsible for inputting various input data, security data, etc. including a network security program, and the output processing unit 33 is responsible for displaying the current network status and processing results of the input command to the network operator. do. DNS server operation processing unit 35 is responsible for the DNS function, such as maintaining the user's IP address data data and responding to the IP address query of the user server unit, server security function processing unit 37 changes the DNS server location in accordance with the network security program It is responsible for network security functions such as resetting the entire network IP address, managing IP and password, and transmitting / receiving unit 39 converts these data into protocols such as TCP / IP and UDP, and transmits them. In charge.                     

The user server unit 40 may include an input processor 41, an output processor 43, a user operating processor 45, a user security function processor 47, and a transceiver 49. The input processing unit 41 is responsible for inputting various user input data, and the output processing unit 43 is responsible for outputting the situation of the network and the processing result of the input command to the user. The user operation processor 45 performs a function of operating a virtual network in conjunction with the DNS server operation processor 35, such as obtaining an IP address from a DHCP server, and the user security function processor 47 is a server security function processor 37 It performs the function of processing the security function according to the total IP address reset, DHCP, DNS server location change, etc., and the transceiver 49 transmits and receives related data through protocols such as TCP / IP, UDP, etc. Perform the function.

4 is a flowchart illustrating communication setting according to an embodiment of the present invention. When a virtual private network network subscriber using DHCP connects to a new network or requests from the server security function processor 37 to reassign subscriber IP addresses of the entire virtual network 101, the subscriber server 40 receives a DHCP server 70. (102) obtains an arbitrary IP address (103) and connects to a DHCP DNS server (30) (104), notifies 105 of its own IP address (105), and then terminates the communication setup (106). .

5 is a flowchart illustrating communication setup between subscribers according to an embodiment of the present invention. The process of obtaining an IP address by accessing the DHCP DNS server 30 to communicate with other subscribers in the virtual network is as follows. First, the subscriber server 40 connects to the DHCP DNS server 30 (111), transmits an ID and password (112), requests an IP address corresponding to the ID of the subscriber to be connected (113), and DHCP Receive the IP address of the subscriber to be connected from the DNS server 30 (116). If the address is not received, after repeating the connection up to three times (117) terminates and outputs the failure information in case of failure (118) to inform the user.

Security method of a virtual private network including a plurality of subscriber server identified by a unique ID, a DHCP DNS server 40 identified by a unique MAC address, DHCP server 70 according to the present invention is a subscriber server (40) The first step of requesting the DHCP server 70 to change the IP address of the subscriber every time the first command or the command of the security program stored in the DHCP DNS server 30, DHCP server 70 is a subscriber server (40) A second step of reallocating an arbitrary IP address to the subscriber in response to the IP address change request from the third party; and a third step of the subscriber server 40 notifying the DHCP DNS server 30 of the reassigned IP address. It is made to include.

The subscriber server may be notified before the IP address resetting operation as described above. 6 is a procedure diagram of notifying reservation information for changing an entire IP address of a virtual network user according to a predetermined cycle according to an embodiment of the present invention. The server security function processing unit 37 of the DHCP DNS server 30 repeatedly notifies all users of the reset time 122 and the reception time of the IP address according to the input network security program (123) and confirms the reception state ( 125. Notifies the network operator of the fault information (128) to cope with the fault.

FIG. 7 reconnects the communication to the DHCP server 70 in the user security function processor 47 according to the subscriber IP address reset command notified by the server security function processor 37 to acquire a new IP address. The procedure for notifying the DHCP DNS security function processing unit (133) is also shown. After acquiring a new IP address from the DHCP server within the set reception time, it notifies the DHCP DNS server (136) and repeatedly notifies up to three times (137). It helps to cope.

Preferably, during any of the first to third steps, the DHCP DNS server 30 requests the DHCP server 70 to change the server IP address every time the command of the security program or the second set time elapses. Step 5, the DHCP server 70 reassigns an arbitrary IP address to the DHCP DNS server 30 in response to the IP address change request from the DHCP DNS server 30, and the DHCP DNS server 30 The method may further include a sixth step of notifying all subscriber servers 40 of the reassigned IP address.

More preferably, during any of the first to sixth steps, the virtual private network further includes a plurality of DHCP DNS servers having different MAC addresses, which are activated every time a command of the network security program or the third set time elapses. A seventh step of arbitrarily changing the DHCP DNS server 30 to be established, and an eighth step of the activated DHCP DNS server 30 notifying all the subscriber servers 40 of their own server IP address and MAC address; Can be.

FIG. 8 is a flowchart informing the entire virtual network user of a change schedule of the DHCP DNS server 30 and an IP address according to a server position change command inputted from a network security program of the server security function processor 37. After sending the IP and password to all user servers (141), complete the connection to the user server (142), notify the DHCP DNS server movement time (143), and change the user IP address to receive the changed DHCP DNS server location information. Instead of notifying the user to wait for the user security function processing unit (144) after confirming the reception status, if not received repeatedly notified up to three times (148) notification of failures by outputting failure information (149) to inform the network operator To deal with disabilities.

9 is a procedure diagram of notifying the virtual network users of the changed IP address and password after changing the position of the DHCP DNS server 30 in the server security function processing unit 37. After accessing each user server 40 (152) after notifying the changed location information of the DHCP DNS server (153), the reception status is checked (155) and the unreceived user is repeatedly notified up to three times (157). The information is output (158) and notified to the network operator so that they can cope with the failure.

More preferably, before a certain time before proceeding to the seventh step, the ninth step in which the currently active DHCP DNS server 30 transmits the IP address fixing command to all the subscriber servers 40, the subscriber server 40 In response to the IP address fixing command, a tenth step of repeatedly transmitting a PING to any living IP address at regular intervals to maintain the current IP address, and the DHCP DNS server 30 receives a response during the subscriber server 40; The method may further include an eleventh step of terminating the communication of the missing subscriber server 40.

In general, the DHCP server 70 makes a communication unavailable by reclaiming the assigned address if the DHCP user does not use the communication for a certain time. FIG. 10 shows the user security function processing unit 47 of the user server unit 40 when the user security function processing unit 37 receives a command for maintaining the IP address for a predetermined time in order to change the position of the DHCP DNS server 30. In order to maintain an existing IP address, the procedure is a procedure for repeatedly maintaining a current IP address by repeatedly sending a PING to a certain live IP address at regular intervals. After the indicated time elapses, the timer is terminated (165) to stop this attempt, returning its own address and ending communication (166).

As described above, the virtual private network and its security method according to the present invention are used as a fixed IP by using a unique ID among subscribers in the network in a DHCP environment, and the IP address of the subscriber and the IP address of the DHCP DNS are frequently used by users outside the network. As a result, the physical location is changed to maintain a high level of security, and by using a DHCP scheme to solve the address shortage problem of the service provider, the user pays a low usage fee, and any subscriber group is located at the user's location. It is possible to economically maintain a virtual private network that is secure regardless and use the public network to provide a new service development means for ISP operators and small and medium-sized enterprises to provide a foundation for new types of security techniques. To provide.

In addition, preferred embodiments of the present invention are disclosed for the purpose of illustration, those skilled in the art will be able to make various modifications, changes, additions, etc. within the spirit and scope of the present invention, such modifications and modifications belong to the scope of the claims You will have to look.

Claims (15)

In a virtual private network including any plurality of subscribers, A unique MAC address is identified on the network, the authentication function of the plurality of subscribers and the storage function of the IP address of the plurality of subscribers, the communication setting function between the subscribers, the communication setting function between the subscriber and the external communication network, and a network security program. DHCP DNS server comprising a; A DHCP server randomly assigning IP addresses of the plurality of subscribers and a DHCP DNS server; And Includes a subscriber server identified on the network by a unique ID, included in the subscriber terminal and communicating with the DHCP DNS server and the DHCP server, The subscriber server requests the DHCP server to reassign the IP address of the subscriber every time the command of the network security program of the DHCP DNS server or the first set time elapses, and the subscriber IP is reassigned by the DHCP server. And transmit an address to the DHCP DNS server. The method of claim 1, wherein the DHCP DNS server, Requesting reassignment of its own server IP address to the DHCP server at each command of the network security program or the second set time, and transmitting its own server IP address reassigned by the DHCP server to all the subscriber servers; Virtual private network, characterized in that. The method of claim 1 or 2, wherein the DHCP DNS server, And a subscriber authentication by a method of identifying a subscriber using an ID and a password transmitted from the subscriber server. The method of claim 1 or 2, wherein the DHCP DNS server, The inter-subscriber communication is established by receiving an ID of a receiving subscriber that wants to communicate from the transmitting subscriber server and transmitting the IP address of the receiving subscriber corresponding to the ID to the transmitting subscriber server. Virtual private network. The method according to claim 1 or 2, The DHCP DNS server notifies the network operator of a communication failure when the subscriber server does not receive a signal from the DHCP DNS server to the subscriber server for a set number of times; And the subscriber server notifies the user of a communication failure when the DHCP DNS server does not receive a signal from the subscriber server to the DHCP DNS server. The method according to claim 1 or 2, wherein the virtual private network, Further comprising a plurality of deactivated DHCP DNS servers having different MAC addresses, wherein the DHCP DNS server to be activated at each command of the network security program or at a third set time elapses; The modified DHCP DNS server transmits its server IP address and MAC address to all the subscriber servers. The method of claim 6, wherein the DHCP DNS server, Virtual private network characterized in that the subscriber authentication is performed by checking the ID and password transmitted from the subscriber server. The method of claim 6, wherein the DHCP DNS server, The communication between the subscribers is performed by receiving the ID of the receiving subscriber that the transmitting subscriber wants to communicate with from the transmitting subscriber server and transmitting the IP address of the receiving subscriber corresponding to the ID to the transmitting subscriber server. Setting up a virtual private network. The method of claim 6, The DHCP DNS server sends an IP address fix command to all the subscriber servers before changing the DHCP DNS server to be activated; And the subscriber server repeatedly transmits a PING to any living IP address at regular intervals in response to the IP address fixing command to maintain the current IP address. The method of claim 6, wherein the DHCP DNS server, Notifying a network operator of a communication failure when the subscriber server does not receive a signal from the DHCP DNS server to the subscriber server for a set number of times; And the subscriber server notifies the user of a communication failure when the DHCP DNS server does not receive a signal from the subscriber server to the DHCP DNS server. In the security method of a virtual private network comprising any of a plurality of subscriber server identified by a unique ID, DHCP DNS server identified by a unique MAC address, DHCP server, A first step of requesting, by the subscriber server, to change the IP address of the subscriber every time a command of a security program stored in the DHCP DNS server or a first set time elapses; A second step of the DHCP server reassigning any IP address to the subscriber in response to the IP address change request from the subscriber server; And And a third step of the subscriber server notifying the reassigned IP address to the DHCP DNS server. The method of claim 11, A fourth step of requesting, by the DHCP DNS server, to change the server IP address every time a command of the security program or a second set time elapses from the DHCP server; A fifth step of the DHCP server reallocating an arbitrary IP address to the DHCP DNS server in response to the IP address change request from the DHCP DNS server; And And a sixth step of the DHCP DNS server notifying the subscriber server of the reassigned IP address. The method of claim 11, The virtual private network further includes a plurality of DHCP DNS servers having different MAC addresses, and optionally changing a DHCP DNS server to be activated at each command of the network security program or after a third set time elapses; And And a fifth step of the activated DHCP DNS server notifying the subscriber server of its own server IP address and MAC address. The method of claim 13, wherein a predetermined time before proceeding to the seventh step, A ninth step of sending an IP address fixing command to the subscriber server by a currently activated DHCP DNS server; A tenth step in which the subscriber server repeatedly transmits a PING to any living IP address at regular intervals in response to the IP address fixing command to maintain a current IP address; And the eleventh step of terminating, by the DHCP DNS server, the communication of the subscriber server having no response among the subscriber servers. The method of claim 12, The virtual private network further includes a plurality of DHCP DNS servers having different MAC addresses, and optionally changing a DHCP DNS server to be activated at every command of the network security program or after a third set time elapses; And And an eighth step of the activated DHCP DNS server notifying the subscriber server of its server IP address and MAC address.

Images