KR101093066B1 - Packet Security Method and Apparatus Thereof - Google Patents

Abstract

A packet security method and apparatus are disclosed. The packet security method according to the present invention is implemented by detecting a characteristic of a transmission target packet, determining a security level of the packet according to the detected characteristic, and generating a security packet according to the determined security level. . The characteristic of the packet may be at least one of a destination address of the packet, a device for sending the packet, a transmission protocol of the packet, the packet size, an application of the packet, and a specified security level of the packet. According to the present invention, by applying the security function applied to the conventional device unit adaptively according to the characteristics of the transmitted packet, it is possible to give flexibility to the security function application, thereby enabling the efficient use of resources. .

Network, security method, packet characteristics, security level, packet security, packet transmission

Description

Packet Security Method and Apparatus {Packet Security Method and Apparatus Thereof}

1 is a diagram illustrating an example of a home network system including home devices and a home server to which a packet security apparatus according to the present invention is applied;

2 is a block diagram showing a schematic configuration of a packet security apparatus according to the present invention; and

3 is a flowchart illustrating a packet security method according to the present invention.

The present invention relates to a packet security method and apparatus, and more particularly, to a packet security method and apparatus for adjusting the security level according to the packet characteristics.

 A major problem with using open networks such as the Internet is security issues such as invading systems from outside or pretending to be third parties and illegally accessing them.

In order to solve such an Internet security problem, IPSec (Internet Protocol Security) and SSL (Secure Socket Layer) are typically used.

IPSec is an extension of the Internet standard for authentication and encryption at the IP layer, providing data encryption for secure communication between both devices. Both devices that communicate with IPSec first perform a Security Association that links keys with authentication and encryption algorithms through IKE (Internet Key Exchange), share the information, and then secure the data transmitted according to the information. Send by applying a security function.

SSL provides data encryption for secure communication between both devices at the presentation layer.The handshake protocol determines the key and algorithm to be used between the devices and then uses the value for communication between the devices. .

According to the conventional security technology, only one key and algorithm are applied to one device regardless of the characteristics of the transmitted packet, and only one static security function determined in the security association process is applied.

Therefore, only one predetermined key, algorithm, and security function are applied in a batch without considering the type and characteristics of transmitted packets, so that even when the required security level is low, excessive security functions are applied, resulting in inefficient resource usage. This may be caused, on the contrary, if a higher level of security is required, there is a problem in that it is not sufficiently supported.

Accordingly, an object of the present invention is to provide a packet security method and apparatus for adjusting the security level according to packet characteristics.

Packet security method according to the present invention for achieving the above object, detecting the characteristics of the packet to be transmitted, determining the security level of the packet according to the detected characteristics, and the security packet according to the determined security level Generating a step.

Preferably, the characteristic of the packet is at least one of a destination address of the packet, a device sending the packet, a transmission protocol of the packet, the packet size, an application of the packet, and a specified security level of the packet. do.

In addition, when there are a plurality of characteristics of the detected packet, it is characterized by determining the security level of the packet in accordance with each characteristic step by step.

The method may further include determining an algorithm used to encrypt the packet according to the determined security level.

And if the determined algorithm is not suitable for the destination device of the packet, setting up a new algorithm suitable for the destination device of the packet.

The method may further include determining an alternative algorithm applicable to the determined security level when an algorithm corresponding to the determined security level does not exist in the security tool database.

The method may further include setting up an algorithm corresponding to the determined security level when the algorithm corresponding to the determined security level does not exist in the security tool database.

In addition, the security level of the packet, characterized in that it further comprises the step of determining according to the preset security policy, if there is.

In addition, the security level is characterized in that adjustable.

On the other hand, the packet security apparatus according to the present invention, a packet characteristic detection unit for detecting the characteristics of the packet to be transmitted, a security level determination unit for determining the security level of the packet in accordance with the detected characteristics, and according to the determined security level It includes a security packet generation unit for generating a security packet.

Preferably, the characteristic of the packet is at least one of a destination address of the packet, a device sending the packet and a category to which the device belongs, a transmission protocol of the packet, the packet size, an application of the packet, and a specified security level of the packet. It is characterized by one.

The security level determining unit may determine the security level of the packet step by step according to each characteristic when there are a plurality of characteristics of the detected packet.

The security packet generator may determine an algorithm used to encrypt the packet according to the determined security level.

The security packet generation unit may set up a new algorithm suitable for the destination device of the packet when the determined algorithm is not suitable for the destination device of the packet.

The security packet generation unit may determine an alternative algorithm applicable to the determined security level when the algorithm corresponding to the determined security level does not exist in the security tool database.

The security packet generator may set up an algorithm corresponding to the determined security level when an algorithm corresponding to the determined security level does not exist in the security tool database.

In addition, the security level of the packet is characterized in that it is determined according to the preset security policy.

In addition, the security level is characterized in that adjustable.

Hereinafter, with reference to the drawings will be described the present invention in more detail.

The secure communication apparatus according to the present invention can be applied to devices that need to transmit and receive data on a public network such as the Internet, so that a security function can be applied to packets transmitted from each device. For convenience of description, an example in which the secure communication apparatus according to the present invention is applied to home devices and a home server built in a home network system will be described.

1 is a diagram illustrating an example of a home network system including home devices and a home server to which a packet security apparatus according to the present invention is applied. Referring to FIG. 1, a home network system is a digital device, and a home server such as a laptop 20, a refrigerator 30, and an audio 40, which is operable via the Internet, and a home server 10 that manages / controls the home devices. It is configured to include, and information about the IP (Internet Protocol) address, device category, device ID, and the like assigned to each home device is registered in the home server 10 so as to identify the home devices.

In the figure, for convenience of description, only the notebook 20, the refrigerator 30, and the audio 40 are illustrated as being connected to the home server 10. However, information devices such as personal computers, faxes, scanners, printers, TVs, A / V devices such as set-top boxes, DVDs, VCRs, camcorders, home game consoles, home appliances such as coffee makers, rice cookers, washing machines, microwave ovens, cameras, and dummy devices such as remote controls, interphones, sensors, lights, etc. Of course, it can be connected to the home server 10 can be registered.

In order to provide reliability for a home network composed of the home devices 20, 30, and 40 and the home server 10, authentication of the home devices 20, 30, and 40 is required. (20, 30, 40) and the home server 10 is required to apply a security function, such as encryption for the data transmitted between each other. The security communication apparatus according to the present invention for performing such a security function may be provided in the home devices 20, 30, and 40 and the home server 10, respectively.

2 is a block diagram showing a schematic configuration of a packet security apparatus according to the present invention. Referring to FIG. 2, the packet security device 100 according to the present invention includes a first transmitter 110, a packet characteristic detector 130, a security level determiner 150, a security packet generator 170, and a second transmitter. 190, a security policy table 120, and a security tool database 140.

The first transmitter 110 receives a packet transmitted from an external device. In the practice of the present invention, the packet should include the characteristic information of the packet, the characteristic information is the destination address (for example, IP address) of the packet, the packet transmission protocol, the packet size, the application in which the packet is used, It may be a predetermined security level preset for the packet, a recommended security level for the packet, a device category in which the packet is used, and a packet category.

Meanwhile, the first transmitter 110 transmits the received packet to the packet characteristic detector 130, and the packet characteristic detector 130 detects the characteristic of the packet from information included in the received packet. The packet characteristic detected by the packet characteristic detection unit 130 is transmitted to the security level determination unit 150.

Accordingly, the security level determiner 150 determines a security level indicating a security level for the packet from the packet characteristics received from the packet characteristic detector 130. In determining the security level from the characteristics of the packet, the security level determining unit 150 uses the security policy table 120 stored in the packet security apparatus 100.

Table 1 below shows an example of a security policy table stored in the packet security apparatus according to the present invention.

IP address Device category Application packet
size send
protocol packet
category security
level

165.132.49.5


computer
 every <thres1 TCP / IP Control 2 word processor thres1 <<
thres2 TCP / IP data 3 media player thres2 < IEEE1394, RTP entertainment 3
165.132.49.25

Refrigerator
- <thres1 TCP / IP Control 2 - thres1 <<
thres2 TCP / IP Etc 2

 For example, the packet's destination IP address is 165.132.49.5, the device category is computer, the application used is a word processor, the message size is smaller than thres2, the transport protocol used is IEEE1394, If the category of the packet is entertainment, the security level determination unit 150 determines the security level as three. When there is a plurality of characteristic information of the detected packet as described above, the security level of the packet is determined step by step according to each characteristic.

That is, the security level determination unit 150 determines the security level for the packet through the packet characteristic and security policy table 120 received from the packet characteristic detection unit 130. If there is information on a predetermined security level preset for the packet among the packet characteristic information, the security level may be determined accordingly.

The security level determiner 150 transmits the information on the security level determined for the packet to the security packet generator 170. Accordingly, the security packet generator 170 generates a security packet according to the security level of the packet from the security level determiner 150.

In more detail, first, the security packet generator 170 determines a security function to be applied to a packet by referring to the security function mapping table according to the security level determined by the security level determiner 150.

The security function mapping table maps and stores the security functions, security algorithms, and key sizes to be applied to packets according to security levels as shown in Table 2 below.

Security level Security features algorithm Key size Remarks 0 none -
One
User Auth. hash (SHA-1) - keyed hash (HMAC) 128 2 Mess. Auth. keyed hash (HMAC) 128 Default level 3 Encryption Block Cipher (AES) 128 4
Signature / Encryption
Public Key (RSA) 1024 Public Key (ECC) 160

For example, when the security level determined by the security level determiner 150 is 3, the security packet generator 170 determines to encrypt a packet using a block cipher (AES) algorithm, and determines the determined security. According to the function, a security tool such as an algorithm or a key to be applied to the packet is found in the security tool database 140 and applied to the packet to generate a packet to which the security function is applied.

If an algorithm corresponding to the determined security level does not exist in the security function mapping table, the security packet generator 170 may determine an alternative algorithm applicable to the determined security level. In this case, in determining the replacement algorithm, the algorithm may be determined to be one level higher or one level lower than the corresponding security level. Alternatively, in this case, the security packet generator 170 determines the algorithm closest to the security level determined by the security level determiner 150, finds it in the security tool database 140, and applies the packet to which the security function is applied. You can also create

Hereinafter, a method of finding the closest algorithm at the security level will be described with reference to Table 3.

Security level  Home device key algorithm
2
165.132.49.5 128 bit AES  165.132.49.25 - - 165.132.49.4 128 bit DES

  As shown in Table 3, the algorithm to be applied to the packet to be sent to the home device with the IP address 165.132.49.25 is not determined, and the algorithm DES applied to the 165.132.49.4 IP address closest to the IP address 165.132.49.25 can be applied. have.

In addition, if an algorithm corresponding to a specific security level in the security function mapping table does not exist in the security tool database 140, the security packet generator may set up an algorithm corresponding to the security level. That is, if a security tool algorithm or the like to be applied to the packet is not found in the security tool database 140, the security packet generator 170 starts the security association process according to the conventional method, sets the security tool, and sets the security. Some tools apply security to packets.

In addition, the security packet generation unit 170 may determine whether the determined algorithm is an algorithm that cannot be used by the destination device of the packet, or when the determined device does not have sufficient resources such as memory, CPU, etc. to use the algorithm. If the purpose of the packet is not suitable for the device, a new algorithm may be set up for the destination device of the packet.

In this case, in setting up a new algorithm, one may set up an algorithm, which is a security tool stored in the packet's destination device. For example, if the destination device is a low-power device such as a sensor, it may be implemented to apply an existing security tool.

Meanwhile, the security packet generator 170 transmits the generated security packet to the second transmitter 190, and the second transmitter 190 transmits the security packet from the security packet generator 170 to the destination device. .

3 is a flowchart illustrating a packet security method according to the present invention.

2 and 3, a packet security method according to the present invention will be described. First, the packet security apparatus 100 checks whether a packet from an external device has been received. Meanwhile, in the practice of the present invention, the packet security device 100 may not only perform security on packets from an external device, but also may perform security on packets inside the packet security device 100.

When packet transmission is performed to an external device (S200) (or when it is necessary to perform security on a packet in the packet security device 100), the packet characteristic detection unit 130 detects the characteristic of the packet (S205). . In determining the security level from the detected packet characteristics, the security level determination unit 150 first checks whether a specified security level for the packet exists (S210). In carrying out the invention, the information on the designated security level may be included in the packet in the form of a security sensitivity flag.

If the specified security level exists, the security level determination unit 150 determines the security level according to the security level specified in the packet (S215), and if the specified security level does not exist, the security level determination unit 150 determines the packet. Using the characteristic information of the packet detected by the characteristic detector 130 and the security policy table 120, the security level of the corresponding packet is determined (S220).

Next, the security packet generation unit 170 determines a security tool such as an algorithm to be used for security according to the security level determined by the security level determination unit 150 (S225), and tools corresponding to the determined algorithm are stored in the security tool database. It is checked whether or not present at 140 (S230).

If tools corresponding to the determined algorithm do not exist in the security tool database 140, the alternative algorithm is determined (S235), and if the determined algorithm exists in the security tool database 140, and if the alternative algorithm is determined It is checked whether the determined algorithm is applicable to the destination device (S240).

The security packet generation unit 170 sets up a new algorithm when the determined algorithm is not applicable to the destination device (S245).

When the determined algorithm is applicable to the destination device and when a new algorithm is set up, the security packet generator 170 generates a security packet using a security tool such as the corresponding algorithm (S250) and removes the generated security packet. 2 The transmission unit 190 transmits to the destination device (S255).

As described above, according to the present invention, by applying the security function applied to the conventional device unit adaptively according to the characteristics of the transmitted packet, it is possible to give flexibility to the security function application, thereby enabling efficient use of resources. There is an advantage to doing that.

In addition, since security level determination, security function selection, and security function application are automatically performed at the bottom of the application, it is possible to apply security functions to data packets that are transmitted more conveniently with minimal intervention from the user's perspective. There are advantages to it.

In addition, while the above has been shown and described with respect to preferred embodiments and applications of the present invention, the present invention is not limited to the specific embodiments and applications described above, without departing from the gist of the invention claimed in the claims Various modifications can be made by those skilled in the art to which the present invention pertains, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

Claims (18)

A packet security method in a packet security device that can communicate with at least one device of a home device and a home server using an encrypted security packet, Detecting, by the packet security device, characteristic information of a transmission target packet to be transmitted to at least one of the home device and the home server; Determining, by the packet security device, the security level of the packet according to the detected characteristic information and a previously stored security policy table; And Generating, by the packet security device, a security packet according to the determined security level. The method of claim 1, Characteristic information of the packet is at least one of the destination address of the packet, the device that sends the packet, the transmission protocol of the packet, the size of the packet, the application of the packet, and the specified security level of the packet. Packet security method. 3. The method of claim 2, Determining the security level of the packet, And when there is a plurality of characteristic information of the detected packet, determining a security level of the packet step by step according to each characteristic information. The method of claim 1, Determining, by the packet security device, an algorithm used to encrypt the packet according to the determined security level. The method of claim 4, wherein If the determined algorithm is not suitable for the destination device of the packet, the packet security device setting up a new algorithm suitable for the destination device of the packet. The method of claim 1, And determining, by the packet security device, an alternative algorithm applicable to the determined security level when an algorithm corresponding to the determined security level does not exist in the security tool database. The method of claim 1, And if the algorithm corresponding to the determined security level does not exist in the security tool database, setting up an algorithm corresponding to the determined security level by the packet security device. The method of claim 1, Determining the security level of the packet, Packet security method, characterized in that for determining the security level of the packet according to a predetermined security policy when there is a predetermined security policy. The method of claim 1, And said security level is adjustable. In the packet security device that can perform communication using an encrypted security packet, A packet characteristic detector for detecting characteristic information of a packet to be transmitted; A security level determiner configured to determine a security level of the packet according to the detected characteristic information and a previously stored security policy table; And And a security packet generator for generating a security packet according to the determined security level. The method of claim 10, The characteristic information of the packet includes at least one of a destination address of the packet, a device and a type of a device that sends the packet, a transmission protocol of the packet, a size of the packet, an application of the packet, and a specified security level of the packet. Packet security device, characterized in that. The method of claim 11, And the security level determiner determines step by step a security level of the packet according to each characteristic information when there is a plurality of characteristic information of the detected packet. The method of claim 10, And the security packet generator determines an algorithm used to encrypt the packet according to the determined security level. The method of claim 13, And the security packet generation unit sets up a new algorithm suitable for the destination device of the packet when the determined algorithm is not suitable for the destination device of the packet. The method of claim 10, And the security packet generator determines an alternative algorithm applicable to the determined security level when an algorithm corresponding to the determined security level does not exist in the security tool database. The method of claim 10, And the security packet generator sets up an algorithm corresponding to the determined security level when an algorithm corresponding to the determined security level does not exist in a security tool database. The method of claim 10, The security level of the packet is a packet security device, characterized in that determined according to the predetermined security policy. The method of claim 10, And said security level is adjustable.

Images