KR101491692B1 - Security device managing multi session and operating method thereof - Google Patents

Abstract

The operating method of a security device according to an embodiment of the present invention determines with reference to first option information on a packet transmitted between a first host and a second host whether multiple sessions are supported, determines with reference to second option information on the packet whether the packet corresponds to a main session or sub session, extracts a main IP address and key from a normal packet to update a key in association with the main IP address in a session table when the packet corresponds to the main session, and extracts a sub IP address from a join packet to update, in the session table, the sub IP address in association with the main IP address with reference to third option information on the join packet when the packet corresponds to the sub session.

Description

TECHNICAL FIELD [0001] The present invention relates to a security device for managing a multi-session and a method of operating the security device.

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic apparatus, and more particularly, to a security apparatus for managing a multi-session and an operation method thereof.

TCP / IP (Transmission Control Protocol / Internet Protocol) is a network transmission protocol that is used as a standard protocol for information transmission because it can transmit data packets between computers using different operating systems. TCP is a protocol for transmitting transmission data divided into a predetermined unit, that is, data packets, and IP is a protocol for directly exchanging data.

2. Description of the Related Art Recently, as wireless terminals with various interfaces such as a wireless LAN (for example, Wi-Fi) and mobile communication have been increasing in number, functions to recognize and utilize a large number of network links have been highlighted. Multi-path TCP (Multi-path TCP) has advantages of collecting traffic load distribution and aggregation effect of network, and is therefore suitable for providing reliability to a service having a high traffic demand. In addition, multipath TCP can accommodate larger bursts by introducing a resource pooling concept that allows multiple sessions (e.g., one main session and at least one sub-session) to be used as one large session And by using multipath, it can be more robust and responsive to traffic congestion.

An existing intrusion prevention system of a security device analyzes a data pattern with a combination of data packets communicated through one session under TCP, and defends an attack. However, when data packets are communicated through a plurality of sessions, such as multi-path TCP, the pattern analysis often fails, thereby failing to secure operational stability of the network system.

It is an object of the present invention to improve security performance on a network system.

A method of operating a security device according to an exemplary embodiment of the present invention includes: determining whether a multi-session is supported by referring to first option information of a packet transmitted between a first host and a second host; Determining whether the packet corresponds to a main session or a sub-session with reference to second option information of the packet if the communication supports the multi-session; Extracting a main IP and a key from the normal packet when the packet is a normal packet corresponding to the main session and updating the key in the session table with respect to the main IP; Extracting a sub-IP from the join packet if the packet is a join packet corresponding to the sub-session, and updating the sub-IP in the session table with reference to the third option information of the join packet, .

As an embodiment, updating the sub-IP may include updating the sub-IP with respect to the main IP by sensing the key stored in association with the main IP with reference to the third option information have.

In an embodiment, the third option information may include a random number and a token number calculated by inputting the key and the random number.

As an embodiment, updating the sub-IP may include extracting the random number and the token number from the join packet; Generating a comparison number by computing each of a plurality of keys in the session table and the random number as inputs; And detecting a comparison number that matches the token number and updating the sub-ip with respect to the main IP corresponding to the key of the comparison number.

As an embodiment, updating the key to the session table with respect to the main IP may further include transmitting the main IP and the call key from the normal packet when the normal packet is transmitted from the first host to the second host And updating the call key in the session table with respect to the main IP; And extracting the main IP and the response key from the normal packet when the normal packet is transmitted from the second host to the second host and updating the response key to the session table with respect to the main IP .

The step of updating the sub-IP address in the session table may include extracting a random number included in the third option information, and a token number calculated by inputting the response key and the random number, Generating a comparison number by computing each of a plurality of response keys in the session table and the random number as an input; Detecting a comparison number that matches the token number, and updating the sub-ip with respect to the main IP in the session table corresponding to the response key of the comparison number.

As an example, the packet may be a handshaking packet.

The method may further include receiving a first data packet transmitted through the main session between the first host and the second host; Receiving a second data packet transmitted through the sub-session between the first host and the second host; And associating the first data packet with the second data packet by querying the session table to perform security processing.

Another aspect of the present invention relates to a method of operating a security device. A control unit configured to determine whether a multi-session is supported by referring to first option information of a packet transmitted between a first host and a second host, according to an exemplary embodiment of the present invention; A session type determining unit configured to determine whether the packet corresponds to a main session or a sub-session by referring to second option information of the packet when the communication supports the multi-session; A storage configured to store a session table; And if the packet is a normal packet corresponding to the main session, extracting a main IP and a key from the normal packet and updating the key in the session table with respect to the main IP, And a table management unit configured to extract the sub-IP from the join packet and to update the sub-IP in the session table with reference to the third option information of the join packet if the join packet corresponds to the main IP .

In an embodiment, the table management unit is configured to update the sub-IP with respect to the main IP by sensing the key stored in association with the main IP with reference to the third option information.

The third option information may include a random number and a token number calculated by inputting the key and the random number, wherein the table management unit extracts the random number and the token number from the join packet, The comparison number can be generated by calculating each of the plurality of keys in the session table and the random number as inputs.

In an embodiment, the table management unit may detect a comparison number corresponding to the token number and may additionally update the sub-IP with respect to the main IP corresponding to the key of the comparison number.

As an embodiment, the table management unit may extract the main IP and the call key from the normal packet when the normal packet is transmitted from the first host to the second host, extract the main IP and the call key from the normal packet, Extracts the main IP and the response key from the normal packet when the normal packet is transmitted from the second host to the second host and updates the response key to the session with respect to the main IP, You can update the table.

The table management unit may extract a random number included in the third option information, a token number calculated by inputting the response key and the random number, and a plurality of response keys in the session table, A random number is input to generate a comparison number, and a comparison number corresponding to the token number is detected to update the sub-IP with respect to the main IP corresponding to the response key of the comparison number.

According to an embodiment of the present invention, security performance on a network system is improved.

1 is a conceptual diagram showing a network system.
2 is a diagram for explaining a 3-way handshake between a first host and a second host;
3 is a conceptual diagram showing a data format of a handshaking packet communicated between the first and second hosts in the main handshake.
4 is a conceptual diagram showing a data format of a handshaking packet communicated between first and second hosts in a join handshake.
5 is a flowchart illustrating an operation method of a security device according to an embodiment of the present invention.
6 is a view showing a session table.
7 is a flowchart showing a security processing method of a security apparatus when a data packet is received.
8 is a block diagram illustrating an embodiment of a security device.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

FIG. 1 is a conceptual diagram showing a network system 100. FIG.

Referring to FIG. 1, a network system 100 includes a first host 110, a first network 120, a security device 130, a second network 140, and a second host 150.

The first host 110 is connected to the second host 150 via the first and second networks 120 and 140. The first host 110 forms at least one session with the second host 150 through the first and second networks 120 and 140 and communicates data packets through the formed session. For example, the first host 110 can receive various services by exchanging data packets with the second host 150. For example, the first host 110 can access a web page corresponding to the second host 150 while exchanging data packets with the second host 150. For example, the first host 110 installs an application provided from the second host 150, communicates with the second host 150 as an installed application and receives contents such as music and moving images, And can be provided with services such as animation and games by communicating with the host 150.

The first host 110 may communicate with the second host 150 via the two IPs IP1 and IP2. For example, assuming that the first host 110 is a computing device communicating with a wired network, such a computing device may communicate with the second host 150 by selectively using two IPs corresponding to a wired LAN have. For example, assuming that the first host 110 is a computing device that communicates with a wired network and a wireless network, such a computing device may be connected to an IP and wireless LAN (e.g., Wireless Fidelity) And can communicate with the second host 150 selectively using the corresponding IP. For example, assuming that the first host 110 is a computing device communicating with a wireless network, such a computing device may selectively use the IP and Mobile IP corresponding to the wireless LAN to access the second host 150).

When the first host 110 and the second host 150 communicate, a main session is established between the first IP1 of the first host 110 and the kth IP of the second host IPk, A sub-session is formed between the second IP (IP2) of the first host 110 and the kth IP (IPk) of the second host. The first and second hosts 110 and 150 will exchange the mutual data packets while selectively using the main session and the sub-session.

The security device 130 is connected to the first host 110 through the first network 120 and is connected to the second host 150 through the second network 140. The security device 130 is configured to manage communication between the first host 110 and the second host 150. [

According to an embodiment of the present invention, the security device 130 includes a data packet communicated via a main session between the first and second hosts 110 and 150, and a data packet communicated between the first and second hosts 110 and 150, And performs a security check by associating data packets communicated through the subsession between the data packets. For example, if a security check uses a method of monitoring the number of data packets communicated between the first and second hosts 110 and 150, the security device 130 may determine that the data packets And the number of data packets communicated through the subsession. For example, if the security checker uses a method to monitor whether a particular signature is detected in data packets communicated between the first and second hosts 110 and 150, A data packet communicated through a session and a data packet communicated through a subsession are aggregated to determine whether a particular signature is detected.

FIG. 2 is a diagram for explaining a 3-way handshake between the first host HOST1 and the second host HOST2. 3 is a conceptual diagram showing a data format of a handshaking packet communicated between the first and second hosts HOST1 and HOST2 in the main handshake. 4 is a conceptual diagram showing a data format of a handshaking packet communicated between the first and second hosts HOST1 and HOST2 at the time of a join handshake.

Referring to FIG. 2, a three-way handshake includes a main handshake for creating a main session and a join handshake for creating a sub-session.

In the main handshake, the first host (HOST1) communicates with the kth IP (IPk) of the second host (HOST2) via the first IP (IP1).

The first host HOST1 transmits SYN information SYN to form a main session with the second host HOST2. At this time, the handshaking packet generated by the first host HOST1 includes SYN information (SYN), information indicating that the session for forming the session is a main session (MS), and a call key (KeyA).

The second host HOST2 transmits SYN / ACK information (SYN / ACK) to the first IP (IP1) of the first host HOST1 in response to the SYN information SYN. The handshaking packet generated by the second host HOST2 includes SYN / ACK information (SYN / ACK), information indicating that the session is a main session (MS), and a response key (KeyB).

Then, the first host HOST1 transmits ACK information (ACK) to the second host HOST2 in response to the SYN / ACK information (SYN / ACK). The handshaking packet generated by the first host HOST1 includes ACK information (ACK), information indicating that the session is the main session (MS), a calling key (KeyA) generated by the first host HOST1, And a response key (KeyB) generated by the host (HOST2).

Referring to FIG. 3, a handshaking packet generated by the first and second hosts HOST1 and HOST2 includes a header field HDF and a first option field OF1 during a main handshake.

The header field HDF includes a source IP (SIP) and a destination IP (DIP). In the case of SYN information (SYN) and ACK information (ACK), the source IP (SIP) indicates the first IP (IP1) of the first host HOST1 and the destination IP It will point to IP (IPk). In the case of SYN / ACK information (SYN / ACK), the source IP (SIP) indicates the kth IP (IPk) of the second host HOST2 and the destination IP (DIP) indicates the first IP IP1).

Furthermore, the header field HDF will contain SYN information (SYN), SYN / ACK information (SYN / ACK), or ACK information (ACK).

The first option field OF1 includes first option information (kind), second option information (subtype), and key information (key). The first option information (kind) indicates whether multi-path TCP, i.e., multi-session is supported. In the case of the handshaking packet generated by the first host 110, the first option kind will indicate whether the first host 110 supports multi-session. In the case of a handshaking packet generated by the second host 150, the first option information kind will indicate whether the second host 150 supports multi-session.

The second option information (subtype) indicates whether the handshaking packet is for forming a main session or a subsession. In the main handshake, the second option information (subtype) will include information (MS) that the session of FIG. 2 is the main session.

As an embodiment, whether the handshaking packet is for forming a main session or a sub-session will be determined by the first host HOST1 transmitting the first SYN information SYN.

The key information includes at least one of a call key (key A) and a response key (key B). In the case of a handshaking packet including the SYN information SYN, the key information (key) will include the call key (key A). In the case of a handshaking packet including ACK information (ACK), the key information (key) will include a call key (keyA) and a response key (keyB).

Referring again to FIG. 2, in a join handshake for creating a sub-session, the first host HOST1 communicates with the kth IP (IPk) of the second host HOST2 via the second IP2.

The first host HOST1 transmits the handshaking packet including the SYN information SYN, the session information SSS, the random number RN and the token number TN to the second host HOST2, Lt; / RTI >

Referring to FIG. 4, the handshaking packet generated by the first and second hosts HOST1 and HOST2 in the join handshake includes a header field HDF and a second option field OF2.

The second option field OF2 includes third option information composed of first option information kind, second option information (subtype), random number (RN) and token number (TN). The first option information (kind) indicates whether or not the multisession is supported. The second option information (subtype) indicates whether the handshaking packet corresponds to the main session or the subsession when the multi-session is supported. During the join handshake, the second option information (subtype) will include the information (SS) that the session of FIG. 2 is a subsession.

The random number RN is a random value generated by the first host HOST1 and the token number TN is a value calculated by inputting a random number RN and a response key keyB. For example, the first host HOST1 may generate a token number TN by applying a random number RN and a response key keyB as an input value to a hash function. The random number RN and the token number TN constitute the third option information.

2, the second host HOST2 transmits a handshaking packet including the SYN / ACK information (SYN / ACK) and information indicating that the session is a subsession (SS) to the first host HOST1 . The second host HOST2 searches the response key keyB provided to the first host HOST1 at the time of the main handshake and computes the retrieved response key keyB and the random number RN with the input, Value to the token number (TN). If the calculated value and the token number TN match, the second host HOST2 transmits the handshaking packet including the SYN / ACK information (SYN / ACK) and the information that the session is a subsession (SS) (HOST1). If the calculated value and the token number TN do not match, the second host HOST2 will not provide the handshaking packet to the first host HOST1. As an embodiment, the random number RN (see FIG. 4) and the token number TN (see FIG. 4) of the second option field OF2 of the handshaking packet transmitted by the second host HOST2 (null).

Then, the first host HOST1 transmits the handshaking packet including the ACK information (ACK) and the information (SS) that the session is a sub-session to the second host HOST2 through the second IP2, You will complete the handshake.

5 is a flowchart illustrating an operation method of the security device 130 according to an embodiment of the present invention. 6 is a diagram showing a session table (STB).

1 and 5, in step S100, the security device 130 receives a handshaking packet communicated between the first host HOST1 and the second host HOST2, It is determined whether or not it exists in the table.

Here, the session table is a table containing the main IP and sub-IP matching information, and may be stored in a storage medium (see 540 in FIG. 8) in the security device 130 or a storage medium outside the security device 130 . The main IP will refer to the source IP (e.g., IP1 in FIG. 1) and the destination IP (e.g., IPk in FIG. 1) in which the main session is formed. The sub-IP will mean the source IP (e.g., IP2 in FIG. 1) and the destination IP (e.g., IPk in FIG. 1) in which the sub-session is formed.

The fact that there is no match between the IP of the handshaking packet among the main and sub-IPs of the session table means that the main session as well as the sub-session between the two hosts are not formed.

In step S110, the security device 130 determines whether or not the handshaking packet is generated under TCP. It can be determined whether or not the handshaking packet is generated under TCP by determining whether or not the received handshaking packet satisfies a specific pattern. As an embodiment, it is determined whether a handshaking packet is generated under TCP, depending on whether the received handshaking packet includes a TCP header field.

In step S120, the security device 130 refers to the first option information (kind, see FIGS. 3 and 4) of the option field OF1 or OF2 of the handshaking packet (see FIGS. 3 and 4) It is determined whether or not it is supported. The first option information (kind) indicates whether multi-path TCP, i.e., multi-session is supported. In the case of the handshaking packet generated by the first host 110, the first option kind will indicate whether the first host 110 supports multi-session. In the case of a handshaking packet generated by the second host 150, the first option information kind will indicate whether the second host 150 supports multi-session.

In step S130, the security device 130 refers to the second option information (subtype, see FIGS. 3 and 4) of the option field OF1 or OF2 of the handshaking packet to determine whether the session is a main session or a sub session . If the second option information (subtype) includes the information (MS) that the session is the main session, step S140 is performed. If the second option information (subtype) includes information (SS) that the session is a subsession, step S160 is performed.

2) or a response key (see FIG. 2) in the handshaking packet when the session is the main session, in step S140, the secure device 130 transmits the handshake packet . The main IP will be the first IP (IP1) of the first host 110 and the kth IP (IPk) of the second host 150. [

If the received handshaking packet includes SYN information (SYN, see FIG. 2) generated by the first host 110, the call key (keyA) will be extracted from the key information (see FIG. When the handshaking packet includes SYN / ACK information (SYN / ACK, see FIG. 3) generated in the second host 150, the response key keyB is extracted from the key information (see FIG. 3) will be. If the handshaking packet includes ACK information (ACK, see FIG. 3) generated at the first host 110, the call key (key A) and the response key (key B) will be extracted.

In step S150, the secure device 130 updates the extracted main IP, and the call key (key A) or the response key (key B) to the session table.

Referring to FIG. 6, the main IPs IP1 and IPk and corresponding information are matched to the session table STB. The calling key A and the response key KB will be matched to the main IPs IP1 and IPk as the call key KA or the response key KB is updated in the session table STB in step S150.

In step S160, if the session is a sub-session, the secure device 130 extracts the IP included in the handshaking packet, i.e., the sub-IP, and the random number RN and the token number TN. The sub-IP may be the second IP (IP2) of the first host 110 and the k-th IP (IPk) of the second host 150. [

In step S170, the security device 130 calculates a comparison number by inputting each of a plurality of main IP addresses and corresponding response keys in the session table (STB) and a random number as an input. In step S180, the security device 130 checks whether the calculated comparison number matches the token number TN. When the comparison device detects a comparison number corresponding to the token number TN, ). The security device 130 updates the session table STB by matching the main IPs IP1 and IPk of the recognized response key keyB with the sub-IP2 extracted in step S160. Accordingly, the call key key A, the response key K B, and the sub IP address IP 2 are stored in the session table STB in association with the main IPs IP 1 and IP k in step S 190.

FIG. 7 is a flowchart showing a security processing method of the security device 130 when a data packet is received. The security device 130 performs security processing with reference to the session table STB.

Referring to FIG. 7, in step S200, the security device 130 receives a first data packet transmitted between the first and second hosts 110 and 150 through a main session. As an example, a first data packet through the main session may be communicated after the main session is created according to the main handshake between the first and second hosts 110,150. As an example, a first data packet over the main session may be communicated between the first and second hosts 110, 150 after the main handshake and join handshake are completed and the main session and sub-session are created .

 In step S210, the security device 130 receives a second data packet transmitted between the first and second hosts 110 and 150 through the sub-session. The second data packet will be communicated after the sub-session is created according to the join handshake.

In step S220, the security device 130 associates the first and second data packets by referring to the session table (STB) to perform security processing. It is recognized that the first data packet and the second data packet correspond to the main session and the sub-session, respectively, by referring to the IP (i.e., main IP) of the first data packet and the IP (i.e., sub-ip) Accordingly, the first data packet and the second data packet are considered together, and security processing can be performed.

FIG. 8 is a block diagram illustrating an embodiment of security device 130. FIG.

8, the security device 130 includes a receiving unit 510, a control unit 520, a session type determining unit 530, a storage unit 540, a table management unit 550, an operation unit 560, 580 and a security unit 590.

Receiving unit 510 is configured to receive a handshake packet communicated at the time of the main handshake, a handshake packet communicated at the time of the join handshake, and a data packet communicated via the main session or subsession.

The control unit 520 controls all operations of the security device 130. The control unit 520 controls the table management unit 550 to detect whether the IP of the received handshaking packet exists in the session table, and determines whether the handshaking packet is generated under the TCP according to the result.

The session type determining unit 530 operates according to the determination result of the control unit 520. [ The session type determining unit 530 determines whether the multisession is supported by referring to the first option information (kind) of the handshaking packet. Subsequently, the session type determining unit 530 refers to the second option information (subtype) of the handshaking packet to determine whether the corresponding session is a main session or a sub session.

The storage unit 540 is configured to store a session table (STB). The storage unit 540 stores data packets received through the receiving unit 510 under the control of the control unit 520. The security unit 590 may perform the security check according to the data packets stored in the storage unit 540.

If the session is a main session, the table management unit 550 receives the main IP, the call key (key A) or the response key (key B) extracted by the control unit 520, To the table (STB).

If the session is a sub-session, the table management unit 550 provides each of the response keys in the session table (STB) to the operation unit 560. Meanwhile, the control unit 520 extracts a sub-IP, a random number (RN), and a token number (TN) from the handshaking packet. The operation unit 560 computes each of the response keys in the session table STB received from the table management unit 550 and the extracted random number RN by input to generate a comparison number, Recognizes the response key (key B) of the comparison number, and informs the table management unit 550 of the recognized response key (key B) and sub-ip. The table management unit 550 updates the response key keyB and the sub-IP address in the session table STB of the storage unit 540 in association with the main IP.

The security unit 590 may perform a security check according to the data packets stored in the storage unit 540. If the data packet is determined as an allowed packet according to the security check, the security unit 590 transmits the data packet to the outside through the transmission unit 580. If the corresponding data packet is determined to be a malicious packet according to the security check, the security unit 590 can block the corresponding data packet, for example.

According to an embodiment of the present invention, the security device 130 includes a data packet communicated between the first and second hosts 110 and 150 via the main session, and a data packet communicated between the first and second hosts 110 and 150, And performs a security check by associating data packets communicated through the subsession. Accordingly, the security performance of the security device 130 in the network system 100 is improved.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the equivalents of the claims of the present invention as well as the claims of the following.

110: First host
130: Security device
150: Second host
kind: First option information
subtype: second option information
keyA: call key
keyB: response key

Claims (14)

A method of operating a security device configured to manage communication between a first host and a second host, the method comprising:
Determining whether a multi-session is supported by referring to first option information of a packet transmitted between the first host and the second host;
Determining whether the packet corresponds to a main session or a sub-session with reference to second option information of the packet if the communication supports the multi-session;
Extracting a main IP and a key from the normal packet when the packet is a normal packet corresponding to the main session and updating the key in the session table with respect to the main IP; And
Extracting a sub-IP from the join packet if the packet is a join packet corresponding to the sub-session, and updating the sub-IP in the session table with reference to the third option information of the join packet ≪ / RTI > The method according to claim 1,
Updating the sub-IP to the session table includes updating the sub-IP with respect to the main IP by sensing the key stored in association with the main IP with reference to the third option information Way. The method according to claim 1,
Wherein the third option information comprises a random number and a token number computed by inputting the key and the random number. The method of claim 3,
Updating the sub-ip to the thin line table
Extracting the random number and the token number from the join packet;
Generating a comparison number by computing each of a plurality of keys in the session table and the random number as inputs; And
Detecting a comparison number that matches the token number and updating the sub-ip with respect to the main IP corresponding to the key of the comparison number. The method according to claim 1,
Wherein updating the key to the session table comprises:
Extracting the main IP and the call key from the normal packet when the normal packet is transmitted from the first host to the second host and updating the call key in the session table with respect to the main IP; And
Extracting the main IP and the response key from the normal packet when the normal packet is transmitted from the second host to the first host and updating the response key in the session table with respect to the main IP Lt; / RTI > 6. The method of claim 5,
Wherein updating the sub-IP address to the session table comprises:
Extracting a random number included in the third option information, and a token number calculated by inputting the response key and the random number;
Generating a comparison number by computing each of a plurality of response keys in the session table and the random number as an input; And
Detecting a comparison number that matches the token number and updating the sub-ip in association with the main IP in the session table corresponding to the response key of the comparison number. The method according to claim 1,
Wherein the packet is a handshaking packet. 8. The method of claim 7,
Receiving a first data packet transmitted through the main session between the first host and the second host;
Receiving a second data packet transmitted through the sub-session between the first host and the second host; And
Further comprising: querying the session table to associate the first data packet with the second data packet to perform security processing. A security device configured to manage communications between a first host and a second host, the security device comprising:
A controller configured to determine whether a multisession is supported by referring to first option information of a packet transmitted between the first host and the second host;
A session type determining unit configured to determine whether the packet corresponds to a main session or a sub-session by referring to second option information of the packet when the communication supports the multi-session;
A storage configured to store a session table; And
Extracting a main IP and a key from the normal packet if the packet is a normal packet corresponding to the main session, updating the key in the session table with respect to the main IP, And a table management unit configured to extract a sub-IP from the join packet and to update the sub-IP in the session table with reference to third option information of the join packet when the corresponding join packet is a corresponding join packet, Device. 10. The method of claim 9,
And the table management unit is configured to update the sub-IP in the session table with respect to the main IP by sensing the key stored in association with the main IP with reference to the third option information. 10. The method of claim 9,
Wherein the third option information includes a random number and a token number calculated by inputting the key and the random number,
Wherein the table management unit extracts the random number and the token number from the join packet, and computes each of a plurality of keys in the session table and the random number as inputs to generate a comparison number. 12. The method of claim 11,
Wherein the table management unit detects a comparison number that matches the token number and updates the sub-ip in the session table with respect to the main IP corresponding to the key of the comparison number. 10. The method of claim 9,
The table management unit,
Extracting the main IP and the call key from the normal packet when the normal packet is transmitted from the first host to the second host, updating the call key in the session table with respect to the main IP,
Extracts the main IP and the response key from the normal packet when the normal packet is transmitted from the second host to the first host, and updates the response key with respect to the session table in association with the main IP. 14. The method of claim 13,
The table management unit,
A random number included in the third option information, and a token number calculated by inputting the response key and the random number, and calculating each of a plurality of response keys in the session table and the random number as input, Detects a comparison number that matches the token number, and updates the sub-ip with respect to the main IP corresponding to the response key of the comparison number.

Images