KR101575578B1 - NETWORK SYSTEM FOR PROVIDING ADDITIONAL SERVICE INFORMATION USING IPSec SECURITY TUNNELING AND TRANSMITTING METHOD OF ADDITIONAL SERVICE INFORMATION USING IPSec SECURITY TUNNELING - Google Patents

Abstract

The network system 100 providing additional service information through IPSec secure tunneling includes an IPSec gateway 150 that forms an IPSec secure tunnel with the terminal 110 and controls the terminal 110 to access the server, Mobile WiMAX, and an access network device using a WiFi communication method, and includes at least any one of an access network device for connecting the terminal 110 and the IPSec gateway 150, information on the type of access network, access carrier information, To the IPSec gateway 150. The IPSec gateway 150 includes a terminal 110 that transmits at least one of the additional service information to the IPSec gateway 150. [

Description

TECHNICAL FIELD The present invention relates to a network system providing additional service information through IPSec secure tunneling, and a method of transmitting additional service information through IPSec secure tunneling. BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an IPSec secure tunneling method,

The following description relates to a network system or an additional service information transmission method in which a terminal provides additional service information to a gateway through IPSec secure tunneling.

In the environment where various wireless network connection technologies such as 3G wireless communication system (3G HSDPA), 4th generation mobile communication system (LTE and LTE-Advanced), WiFi system and mobile WiMAX coexist, The user receives data service through a specific wireless network according to the user preference and surrounding wireless environment.

Techniques for enhancing technology and security for providing seamless services to terminals when mobile terminals move between various heterogeneous networks are mainly studied.

One way to provide security is to use the IPSec protocol. In a network system, a terminal can access a new network device using the IPSec IKE protocol or move between heterogeneous networks using a MOBIKE protocol. The standard that proposes the IPSec protocol defines a connection procedure for accessing a new network or moving the network.

Korean Patent Publication No. 10-2011-0053320

The prior art focuses on providing security or providing mobility between different heterogeneous networks using IPSec. As for IPSec related protocols, existing IKE and MOBIKE protocols do not have a function to transmit access network information, access carrier information, and access location information when moving the network. Accordingly, the prior art has not been able to provide service quality enhancement and location-based additional service functions that can be implemented using access network information, access provider information, and access location information.

In a network system forming IPSec secure tunneling between a terminal and a gateway, when a terminal accesses a new access network apparatus or changes a connection path to another access network apparatus, the following description relates to a type of access network, To transmit location information to the gateway.

The solutions to the technical problems described below are not limited to those mentioned above, and other solutions not mentioned can be clearly understood by those skilled in the art from the following description.

A network system for providing additional service information through IPSec secure tunneling for solving the above problem includes an IPSec gateway for forming an IPSec secure tunneling with a terminal and controlling the terminal to access a server, an LTE, an HSDPA, a mobile WiMAX, and a WiFi communication method And at least one of an access network device connecting the terminal and the IPSec gateway, and additional service information composed of type information of the access network, access carrier information, and access location information to the IPSec gateway And a terminal for transmitting.

The service information may provide additional service information via IPSec secure tunneling, which is transmitted via at least one of a Notify payload, a Vendor ID payload, or a Configuration payload via the IPSec protocol .

The terminal includes a location information generation unit for generating location information including a GPS device, a network connection unit for performing packet transmission / reception with the access network device, a service information management unit for managing service information in cooperation with the network connection unit and the location information generation unit, A security protocol control unit for encrypting the service information using the IKE protocol of IPSec for controlling connection to the device and the MOBIKE protocol for controlling movement between the network devices and transmitting the encrypted service information to the connection unit, And a packet transmission unit for delivering the service information to the security protocol control unit and delivering the packet received at the connection unit to the security protocol control unit.

The IPSec gateway includes a receiving unit for receiving service information using the IKE protocol and the MOBIKE protocol of IPSec, an additional service providing unit for carrying out an additional service using service information, or an additional service for transmitting service information to a separate device performing an additional service And a service information control unit for controlling the additional service providing unit using the service control information.

The additional service control information may be at least one of subscriber information for which activation or deactivation information for the additional service is set for each subscriber and policy information for the additional service change.

The additional service provider can receive the QoS information from the external server and provide the QoS service to the terminal when the QoS guarantee for the access network is required by using the type information of the access network.

The supplementary service provider can change the IKE DPD (Dead Peer Detection) cycle according to the system setting when the access provider is an overseas provider using the access provider information.

The supplementary service provision unit may provide the terminal with a service based on the location information using the connection location information, or may transmit the connection location information to the LBS service server connected to the IPSec gateway.

According to another aspect of the present invention, there is provided a method of transmitting additional service information through IPSec secure tunneling, comprising the steps of: a terminal accessing a new access network apparatus using an IKE protocol of IPSec or a new access network apparatus using a MOBIKE protocol; The terminal transmits at least one of the type of access network, additional service information composed of access carrier information and access location information to the IPSec gateway via the access network apparatus, and the step of the IPSec gateway performs the additional service using the service information .

The transmitting step transmits the service information to the IPSec gateway through at least one of a Notify payload, a Vendor ID payload, and a Configuration payload of the IPSec protocol.

The IPSec gateway can provide the QoS service for the terminal by receiving the QoS information from the external server when the IPSec gateway needs QoS guarantee for the access network by using the type information of the access network.

The steps to be performed may be to shorten the IKE Dead Peer Detection (DPD) cycle according to the system setting when the access provider is an overseas provider using the access carrier information.

The IPSec gateway may provide a service based on the location information to the terminal using the connection location information or may transmit the connection location information to the LBS service server connected to the IPSec gateway.

In the following description, when a terminal moves to a network using the IKE protocol or a network using the MOBIKE protocol, the terminal transmits the access network information, access point information and access location information to the IPSec gateway to provide differentiated QoS, And provide location-based additional services.

The effects of the techniques described below are not limited to those mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the following description.

1 (a) is an example of a network connection procedure using a conventional IKE protocol, and FIG. 1 (b) is an example of a network movement procedure using a conventional MOBIKE protocol.
2 is an example of a block diagram schematically showing a configuration for a network system that provides additional service information through IPSec secure tunneling.
Figure 3 shows an example of a payload for conveying additional service information.
FIG. 4A is a block diagram illustrating a configuration of a terminal in a network system providing additional service information through IPSec secure tunneling. FIG. 4B illustrates an example of providing additional service information through IPSec secure tunneling And is an example of a block diagram illustrating the configuration of an IPSec gateway in a network system.
FIG. 5A is another example of a network connection procedure using the IKE protocol, and FIG. 5B is another example of a network movement procedure using the MOBIKE protocol.
6 is an example of a flowchart of a method for transmitting additional service information through IPSec secure tunneling.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, A, B, etc., may be used to describe various components, but the components are not limited by the terms, but may be used to distinguish one component from another . For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

As used herein, the singular " include "should be understood to include a plurality of representations unless the context clearly dictates otherwise, and the terms" comprises & , Parts or combinations thereof, and does not preclude the presence or addition of one or more other features, integers, steps, components, components, or combinations thereof.

Before describing the drawings in detail, it is to be clarified that the division of constituent parts in this specification is merely a division by main functions of each constituent part. That is, two or more constituent parts to be described below may be combined into one constituent part, or one constituent part may be divided into two or more functions according to functions that are more subdivided. In addition, each of the constituent units described below may additionally perform some or all of the functions of other constituent units in addition to the main functions of the constituent units themselves, and that some of the main functions, And may be carried out in a dedicated manner. Therefore, the existence of the respective components described in the present specification should be interpreted as a function. For this reason, the configuration of the components according to the network system 100 for providing additional service information through the IPSec secure tunneling of the present invention It is clear that the present invention can be different from the second embodiment in the extent that the object of the present invention can be achieved.

Also, in performing a method or an operation method, each of the processes constituting the method may take place differently from the stated order unless clearly specified in the context. That is, each process may occur in the same order as described, may be performed substantially concurrently, or may be performed in the opposite order.

First, a network access procedure using a conventional IKE protocol and a network movement procedure using a conventional MOBIKE protocol will be described. 1 (a) is an example of a network connection procedure using a conventional IKE protocol, and FIG. 1 (b) is an example of a network movement procedure using a conventional MOBIKE protocol.

The Internet Key Exchange (IKE) protocol defines procedures and packet structures for creating, modifying, and deleting SAs for the IPSec protocol. Security Association (SA) is a set of policies and keys for protecting messages. In order to create the IPSec SA, IKE first exchanges messages in the main mode or the aggressive mode to establish a one-step key exchange process in which the ISAKMP SA is established and a two-step key Define the exchange process.

Network refers to a connection device that a terminal passes through to transmit / receive data to / from a specific server or the like. Therefore, the network includes various communication methods such as a 3G or 4G mobile communication network provided by a communication provider, a WiFi network connected via an AP, a Wibro network, and a mobile WiMAX network.

FIG. 1 illustrates a connection procedure between a terminal (UE) 110 and an IPSec gateway (IPSec G / W) 150. Various methods are possible according to the difference of the actual authentication method, but in FIG. 1, a procedure of briefly connecting the terminal 110 is shown.

1 (a), the terminal 110 transmits an initial message (IKE-INIT) 201 for connection to the IPSec gateway 150, and the IPSec gateway 150 transmits a response message (IKE-INIT To the terminal 110 (202). HDR is the IKE header, and the rest is the payload. SA is a security association, KE is a key exchange, and Ni is a nonce. The subscript i means the initiator, and the subscript r means the responder.

After that, the terminal 110 transmits an IKE-AUTH message for authentication 203 and the IPSec gateway 150 transmits a response message (IKE-AUTH) to the terminal 110 (204). Here, SK means Encrypted and Authenticated, Idi is the ID of the terminal 110 (Initiator), Idr is the ID of the IPSec gateway 150 (Responder), CERT is the Certificate, AUTH is the Authentication, CP is the Configuration, TSi is the Traffic Selector of the Terminal 110, and TSr is the Traffic Selector of the IPSec Gateway 150.

1 (b) shows a case of moving the access network. 1 (b), the UE 110 transmits (301) the initial message (IKE-INFORM) regarding the network movement to the IPSec gateway 150, and the IPSec gateway 150 transmits a response message (IKE- INFORM (302). Here, N means notify, meaning that the address of the changed SA in the parentheses (UPDATE_SA_ADDRESS), the source IP (NAT_DETECTION_SOURCE_IP) recognized by the NAT, and the destination IP (NAT_DETECTION_DESTINATION_IP) recognized by the NAT.

Thereafter, the IPSec gateway 150 transmits a cookie (COOKIE2) to the terminal 110 (303) through an additional message (IKE-INFORM), and the terminal 110 transmits a response message to the terminal 110 (304).

As shown in FIG. 1, when a user of a terminal (a subscriber to a network service) accesses a new network or moves between heterogeneous networks, the type of the access network, the provider information of the access network, can not do. This is because the standard does not define it.

Hereinafter, a network system 100 for providing additional service information through IPSec secure tunneling according to the present invention and a method for transmitting additional service information through IPSec secure tunneling will be described in detail with reference to the drawings.

Here, the additional service information refers to information that is at least one of the type of access network, access provider information, and access location information. That is, in FIG. 1, the conventional IKE protocol and the MOBIKE protocol transmit information that the IPSec gateway 150 has failed to transmit. Through this additional service information, the IPSec gateway 150 can perform additional services.

2 is an example of a block diagram schematically illustrating a configuration for a network system 100 that provides additional service information through IPSec secure tunneling. The present invention is applied to the case where data is transmitted and received between the terminal 110 and the IPSec gateway 150 using IPSec secure tunneling.

The network system 100 providing additional service information through IPSec secure tunneling includes an IPSec gateway 150 that forms an IPSec secure tunnel with the terminal 110 and controls the terminal 110 to access the server, Mobile WiMAX, and an access network device using a WiFi communication method, and includes at least any one of an access network device for connecting the terminal 110 and the IPSec gateway 150, information on the type of access network, access carrier information, To the IPSec gateway 150. The IPSec gateway 150 includes a terminal 110 that transmits at least one of the additional service information to the IPSec gateway 150. [

An access network device refers to an individual device conforming to 2G, LTE (4G), HSDPA (3G), Mobile WiMAX or WiFi communication scheme, and the access network device includes one or more of these individual network devices, (150). ≪ / RTI >

The terminal 110 includes a general mobile terminal, a smart phone, a tablet PC, a notebook, a personal computer, and the like.

The first network device 120 shown at the top of FIG. 2 refers to a network using 2G, 3G, LTE, LTE-Advanced or the like provided by a mobile communication service provider. FIG. 1 shows a case of 4G. The 4G mobile communication network generally includes a mobile communication AP (base station 121) and a packet data network gateway (PGW) 122. The PGW 122 is a gateway connected to the IPSec gateway 150. Although not shown, in 3G, a gateway GPRS support node (GGSN) is a node connected to the IPSec gateway 150.

The second network device 130 shown in the middle of FIG. 2 is a mobile WiMAX network including a WiMAX AP 131, an ASN gateway (not shown), a HA (Home Agent) 132, and the like. And the HA 132 is connected to the IPSec gateway 150.

The third network device 140 shown at the bottom of FIG. 2 means a WiFi network including the AP 141.

The present invention provides a system or method for transmitting additional service information to the IPSec gateway 150 when the terminal 110 is newly connected to the access network apparatus or when the terminal 110 moves by changing the type of the access network apparatus .

2 illustrates an example in which the IPSec gateway 150 is connected to a specific service server 160 providing data services. The policy server 170 refers to a server that manages a service policy for a user (subscriber) of the terminal 110. The subscriber server 180 shown as an example connected to the policy server 170 may be a subscriber, And a service subscription option. Here, the policy server 180 may manage information on an individual subscriber to an access network service (paid network service), or may manage policy information on a specific data service regardless of a connection path.

The present invention is for transmitting to the IPSec gateway 150 additional service information composed of type information of the access network, access carrier information and access location information. In the present invention, it is desired to transmit additional service information using any one of the payloads defined in the IKE protocol or the MOBIKE protocol.

Figure 3 shows an example of a payload for conveying additional service information. 3 (a) shows the format of the IKE notification payload, FIG. 3 (b) shows the format of the IKE Vendor ID Payload, and FIG. 3 (IKE Configuration Payload). 3 is merely an example of a payload usable in the present invention, and another payload may be used.

The type information of the access network means the type of access network as shown in Table 1 below. Table 1 is an example of the type information of the access network. The access network code is information corresponding to the type of the access network.

Access network code Connection network type One WLAN 2 HSDPA 3 Mobile WiMAX 4 LTE 5 LTE-A

The access provider information is the information of the provider providing the access network. Table 2 below is an example of access provider information.

Access provider code Type of access provider One KT 2 SKT 3 LGU + 4 Hellomobile 5 CJ

4A is an example of a block diagram illustrating the configuration of a terminal 110 in a network system 100 providing additional service information through IPSec secure tunneling and FIG. And is an example of a block diagram showing the configuration of the IPSec gateway 150 in the network system 100 providing additional service information.

4A, the terminal 110 includes a location information generation unit 111 for generating location information including a GPS device, a network connection unit 115 for performing packet transmission / reception with the access network apparatus, a network connection unit 115 A service information management unit 112 for managing service information in cooperation with the location information generation unit 111, an IKE protocol of IPSec for controlling connection to the access network apparatus, and a MOBIKE protocol for controlling movement between network devices A security protocol control unit 113 for encrypting the service information and transmitting the encrypted service information to the connection unit and the service information managed by the service information management unit to the security protocol control unit and forwards the packet received at the connection unit to the security protocol control unit And a packet transmission unit 114 for transmitting the packet.

Generally, the location information generating unit 111 generates location information of the terminal 110 using a GPS device. The network connection unit 115 means an apparatus for transmitting and receiving data including an antenna and the like. The service information management unit 112 is a device that manages the above-described additional service information. The service information management unit 112 receives the connection location information from the location information generation unit 111 and extracts either the type of the access network or the access carrier information from the network connection unit 115. [ The security protocol control unit 113 has a function of encrypting the additional service information and decrypting the data received from the outside. In addition, the security protocol control unit 113 is involved in network connection and network movement using the IKE protocol and the MOBIKE protocol, and controls the IPSec gateway 150 to transmit additional service information when the network access or the network is moved. The packet transfer unit 114 transfers the packet generated by the security protocol control unit 113 to the network connection unit 115 and transmits the packet received by the network connection unit 115 to the security protocol control unit 113 .

Referring to FIG. 4B, the IPSec gateway 150 includes a receiving unit 151 for receiving service information using the IPSec IKE protocol and the MOBIKE protocol, and a receiving unit 151 for performing additional services or performing additional services using the service information. And a service information control unit 152 for controlling the additional service providing unit using the additional service control information. 4B illustrates an example in which the LBS server providing the additional service is connected to the additional service provider 153 using the connection location information. However, it is apparent that other various additional service providing devices using additional service information can be connected.

The additional service control information may be at least one of subscriber information for which activation or deactivation information for the additional service is set for each subscriber and policy information for the additional service change. The subscriber server 180 shown in FIG. 2 provides subscriber information, and the policy server 170 provides policy information. The service information control unit 152 can determine whether the subscriber (terminal) is required to provide the supplementary service through the subscriber information, and can determine whether the content of the supplementary service is changed through the policy information. The service information control unit 152 controls the additional service providing unit 153 using various information received.

The additional service provider 153 is an apparatus that provides an additional service to the terminal 110 in cooperation with an IPSec gateway 150 itself or an external server.

Additional services are available for a variety of services. For example, the supplementary service providing unit 153 may provide the QoS service for the terminal 110 by receiving the QoS information from the external server when QoS guarantee for the access network is required by using the type information of the access network. In this case, traffic filter information and static QoS configuration information or dynamic QoS information received from AAA (Authentication, Authorization, and Accounting) are used. AAA is not shown in Fig. 2 or the like.

In addition, the supplementary service provider 153 may change the IKE DPD (Dead Peer Detection) cycle according to the system setting when the access provider is an overseas provider using the access provider information. This is to enhance security in overseas roaming.

Furthermore, the supplementary service providing unit 153 may provide the service based on the location information to the terminal 110 using the connection location information or transmit the connection location information to the LBS service server connected to the IPSec gateway 150 to provide the LBS service You may.

FIG. 5A is another example of a network connection procedure using the IKE protocol, and FIG. 5B is another example of a network movement procedure using the MOBIKE protocol. Descriptions of the contents common to those in Fig. 1 will be omitted.

5A is a diagram illustrating an IPSec gateway 150 that transmits type information, access carrier information, and access location information of an access network using an NCV payload in a process 403 of transmitting an IKE-AUTH message unlike FIG. 1 (a) Lt; / RTI > In FIG. 5 (b), in step 501 of transmitting the IKE-INFORM message, the type of access network, access carrier information, and access location information are transmitted to the IPSec gateway 150 using the NCV payload.

The NCV payload may be at least one of the notification payload, the vendor ID payload, or the configuration payload described above.

FIG. 6 is an example of a flowchart for a method 900 for transmitting additional service information through IPSec secure tunneling.

 First, it is determined whether the terminal 110 accesses a new access network apparatus or a connected network apparatus (901). The path to the new access network device is the left path, and the path to the access network device is the right path.

In the case of connecting to a new access network apparatus, the terminal 110 accesses a new access network apparatus using the IPSec IKE protocol (902), and the terminal 110 transmits the type information of the access network, (903) via the access network apparatus to the IPSec gateway 150 and the IPSec gateway 150 performs the supplementary service using the service information (904).

When the access network device is moved, the terminal 110 accesses a new access network device using the MOBIKE protocol of IPSec (905), and the terminal 110 accesses the access network type information, access carrier information, and access location information (906) at least one of the additional service information configured via the access network apparatus to the IPSec gateway 150 (906), and the IPSec gateway 150 performs the additional service using the service information (907).

The transmitting steps 903 and 906 are performed when the terminal 110 transmits the service information to the IPSec gateway 100 through at least one of a Notify payload, a Vendor ID payload, and a Configuration payload of the IPSec protocol. (150).

In steps 904 and 907, the IPSec gateway 150 controls the additional service using at least one of the subscriber information for which the activation or deactivation information for the additional service is set for each subscriber and the policy information for the additional service change Can be performed.

When the IPSec gateway 150 needs QoS guarantee for the access network by using the type information of the access network in steps 904 and 907, the IPSec gateway 150 receives the QoS information from the external server, .

The IPSec gateway 150 may change the IKE DPD (Dead Peer Detection) period according to the system setting when the access provider is an overseas provider using the access provider information in steps 904 and 907.

The IPSec gateway 150 provides the service based on the location information to the terminal 110 using the connection location information or performs the connection location information to the LBS service server connected to the IPSec gateway 150 at steps 904 and 907 Lt; / RTI >

It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. It will be understood that variations and specific embodiments which may occur to those skilled in the art are included within the scope of the present invention.

100: Network system providing additional service information
110: UE 111: Position information generating unit
112: service information management unit 113: security protocol control unit
114: packet transmission unit 115: network connection unit
120: first network device 121: mobile communication AP
122: PGW 130: second network device
131: WiMAX AP 132: HA
140: second network device 141: AP
150: IPSec gateway 151:
152: service information control unit 153:
160: service server 170: policy server
180: Subscriber server

Claims (14)

1. A network system for forming and transmitting IPSec security tunneling between a terminal and a gateway,
An IPSec gateway for establishing IPSec secure tunneling with the terminal and controlling the terminal to access the server;
An access network device including at least any one of LTE, HSDPA, mobile WiMAX, and a network device using a WiFi communication scheme, the access network device connecting the terminal and the IPSec gateway; And
And providing additional service information through IPSec secure tunneling including at least one of the type of access network, access carrier information, and access service information to the IPSec gateway through the IPSec secure tunneling. Network system. The method according to claim 1,
The service information is transmitted through an IPSec protocol through at least one of a Notify payload, a Vendor ID payload, and a Configuration payload. system. The method according to claim 1,
The terminal
A position information generating unit for generating position information including a GPS device;
A network connection unit for performing packet transmission / reception with the access network apparatus;
A service information management unit operable to manage the service information in cooperation with the network connection unit and the location information generation unit;
A security protocol controller for encrypting the service information using an IKE protocol of IPSec for controlling connection to the access network apparatus and a MOBIKE protocol for controlling movement between the network apparatuses and transmitting the encrypted service information to the connection unit, ; And
And a packet transmission unit for transmitting the service information managed by the service information management unit to the security protocol control unit and delivering the packet received at the connection unit to the security protocol control unit, system. The method according to claim 1,
The IPSec gateway
A receiving unit for receiving the service information using the IKE protocol and the MOBIKE protocol of IPSec;
An additional service providing unit that transmits the service information to a separate device that performs an additional service or performs an additional service using the service information; And
And a service information control unit for controlling the supplementary service provision unit using the supplementary service control information, wherein the additional service information is provided through IPSec secure tunneling. 5. The method of claim 4,
The supplementary service control information
And provides additional service information through IPSec secure tunneling, which is at least one of subscriber information for which the activation or deactivation information for the supplementary service is set for each subscriber, and policy information for the supplementary service change for each subscriber. 5. The method of claim 4,
The additional service provider
And provides additional service information through IPSec secure tunneling for receiving QoS information from an external server and providing a QoS service for the terminal when QoS guarantee for the access network is required by using the type information of the access network. 5. The method of claim 4,
The additional service provider
And provides additional service information through IPSec secure tunneling in which the IKE DPD (Dead Peer Detection) period is shortened according to the system setting when the access service provider is an overseas service provider using the access service provider information. 5. The method of claim 4,
The additional service provider
Providing the service based on the location information to the terminal using the connection location information or providing additional service information through IPSec secure tunneling for transmitting the connection location information to the LBS service server connected to the IPSec gateway. A method for transmitting service information to an IPSec gateway in a network system in which IPSec secure tunneling is established between a terminal and an IPSec gateway to transmit and receive data,
The terminal accesses a new access network device using the IPSec IKE protocol or moves to another access network device using a MOBIKE protocol;
Transmitting, by the terminal, at least one of additional service information including type information of an access network, access provider information, and access location information to the IPSec gateway via the access network device through the IPSec secure tunneling; And
And transmitting the additional service information through the IPSec secure tunneling, wherein the IPSec gateway performs an additional service using the service information. 10. The method of claim 9,
The transmitting step
The terminal adds the service information to the IPSec gateway through at least one of a Notify payload, a Vendor ID payload, and a Configuration payload of the IPSec protocol through IPSec secure tunneling. How to transfer service information. 10. The method of claim 9,
The step of performing
The IPSec gateway performs an additional service through the IPSec secure tunneling in which the IPSec gateway controls at least one of the subscriber information and the additional service change policy information for activating or deactivating the additional service for each subscriber, How to transfer information. 10. The method of claim 9,
The step of performing
When the IPSec gateway needs QoS guarantee for the access network using the type information of the access network, the IPSec gateway receives the QoS information from the external server and transmits additional service information through IPSec secure tunneling for providing the QoS service for the terminal How to. 10. The method of claim 9,
The step of performing
Wherein the IPSec gateway transmits the additional service information through the IPSec secure tunneling in which the IKE DPD (Dead Peer Detection) period is shortened according to the system setting when the access service provider is an overseas service provider using the access service provider information. 10. The method of claim 9,
The step of performing
The IPSec gateway provides the service based on the location information to the terminal using the connection location information or transmits the additional service information through the IPSec secure tunneling for transmitting the connection location information to the LBS service server connected to the IPSec gateway Way.

Images