KR20030062106A - Method for receiving data packet from virtual private network and apparatus thereof - Google Patents

Abstract

PURPOSE: A method and apparatus for receiving a data packet from a private virtual network is provided to transmit data without a collision of a security protocol using an AH(Authentication Header) and NAT(Network Address Translation) operation. CONSTITUTION: In order to use an IPsec(IP security) security protocol, SA(Security Association) should be established between a receiving side and a transmitting side(501). If a data packet is received(502), an authentication part confirms whether NAT was used(503). If NAT was used, the authentication part replaces the authorized IP address and port number recorded in the received data packet with the IP address and port number of a private virtual network(504) and calculates an ICV(Integrity Check Value) using an authentication algorithm(505). The authentication part compares whether the calculated ICV is in accord with the ICV recorded in the data packet(506). In case that the two ICVs accord, the authentication part accepts the received packet(507). If the two ICVs do not accord, the authentication part discards the received data packet(508).

Description

Method and receiving data packet from virtual private network and apparatus

The present invention relates to a method and apparatus for receiving a data packet in a network address translation (NAT) based virtual private network environment using a security protocol.

Currently, Internet Protocol vesion 4 (IPv4) allocates only 32 bits to the address space, which has led to an explosive increase in Transmission Control Protocol / Internet Protocol (TCP / IP) networking and thus to all hosts on a TCP / IP network. Due to the constant allocation of unique addressing schemes, the available IP address space is quickly depleted, and the available TCP / IP addresses are expected to be exhausted soon.

Since unique addresses are required to connect to the global Internet, these problems are perceived as serious problems for new connections in new large networks.

IP version 6 (IPng), called IP (next generation), allocates 128 bits for the address space. It is expected to take some time.

Network address translation (NAT) is emerging as one of the ways to solve this problem.

Network Address Translation (NAT) operates on the border routers of private networks and public networks as presented by the Internet Engineering Task Force (IETF). It converts to a public IP address. By using Network Address Translation (NAT), a single public IP address can be assigned various virtual private network addresses as shown in FIG. 3 to share a limited IP address, thereby solving IP address shortages and reducing Internet connection costs. Will be.

There are three types of network address translation (NAT). The simplest is static network address translation (Static NAT), which assigns a public address for each private address, and uses it for a period of time with fewer public addresses than private addresses. There is dynamic network address translation (Dynamic NAT) that allows, and finally there is only one public address and packets entering the network address translation (NAT) router through the Transmission Control Protocol / User Datagram Protocol (TCP / UDP) port number. There is a Network Address Port Translation (NAPT).

By using network address translation (NAT), the public IP address of the Internet can be saved, and the Internet has the advantage of protecting the private network of users connected to the public network from intruders.

However, many problems arise when using Network Address Translation (NAT) while using Internet Protocol Security (IPsec) for security.

IPsec is an open framework for providing end-to-end IP layer security protocols and provides security features to protect vulnerabilities in IP. This security protocol is optional in IPv4 and mandatory in IPv6.

The main components of IPsec adopted as the standard are authentication headers for authentication and integrity checking of IP datagrams based on each datagram by a message compression algorithm such as Message Digest 5 (MD5). Header: AH), Encapsulation Security Payload for confidentiality of data through encryption, Security Association (SA) to establish the background of communication and to define some security conditions for that communication. There is this.

Such IPsec is widely used because of its characteristics and maintains its independence without interworking with transport layer protocols such as TCP and UDP, and application layer protocols such as HTTP (Hypertext Transfer Protocol) and FTP (File Transfer Protocol).

FIG. 1 shows the format of a packet using the authentication header AH of IPsec, and FIG. 2 shows the format of the authentication header AH.

In FIG. 1, the authentication area of the authentication header (AH) includes an IP header 110 except for a variable part during transmission such as TTL (Time To Live), an authentication header (AH) 120 except for an authentication data field. And up to TCP header 130 and user data 140.

In FIG. 2, the Next Header field 211 indicates the type identifier of the header behind the authentication header, the Length field 212 indicates the length of the authentication header field, and the Security Parameter Index (SPI) field 214 indicates data at the receiving side. Indicates an identifier for identifying a specific Security Association (SA) to be used for decryption, the Sequence Number field 215 indicates the number of the following data segment, and the Reserved field 213 has not yet been determined. The Authentication Data field 216 is a portion representing authentication data including an ICV (Integrity Check Value) which is a result obtained by using an authentication algorithm such as MD5.

In order to calculate the ICV of the authentication header, the IP address in the IP header and the TCP port number in the TCP header are used. Therefore, when the IP address and the TCP port number change during the transmission of the data packet, they are stored in the authentication header (AH). The ICV value changes so that the receiving end discards the packet as a packet lost due to an illegal attack.

Therefore, when using a network address translation (NAT) router that changes IP address or IP address and TCP port number while using the security protocol of IPsec, the operation of the security protocol and network address translation (NAT) collide with each other. There was a problem that all the packets are discarded.

In order to solve the conflict between IPsec security protocol and the operation of network address translation (NAT), various studies have been published in the case of security payload encapsulation (ESP), but the study of authentication header (AH) is still insignificant. to be.

In order to solve the above problems, an object of the present invention is to provide a method for transmitting data without collision between a security protocol using an authentication header (AH) and a network address translation (NAT) operation.

Another object of the present invention is to provide an apparatus capable of transmitting data without conflicting between a security protocol using an authentication header (AH) and a network address translation (NAT) operation.

Another object of the present invention is to provide a computer-readable recording medium having recorded thereon a program for realizing the above method.

1 is a diagram illustrating a format of a packet using an authentication header (AH) of IPsec.

2 illustrates the format of an authentication header AH.

3 is a diagram illustrating an address form of a virtual private network in network address translation (NAT).

4 is a block diagram showing a data receiving apparatus according to the present invention;

5 is a flowchart illustrating a data receiving method according to the present invention.

6 illustrates a format of a notification payload.

In order to achieve the above object, the present invention provides a method for receiving a data packet in a network address translation (NAT) based virtual private network environment using a security protocol, comprising: (a) whether the received data packet uses network address translation; Determining; converting address information recorded in the data packet into address information of the virtual private network when the data packet performs network address translation; (c) if the data packet has a network address translation, authentication is performed using the address information of the virtual private network; and if the data packet has not been network address translation, the address information recorded in the data packet is used. Performing an authentication operation; And (d) accepting the data packet if it is recognized as a valid packet as a result of the authentication, and discarding the data packet if it is recognized as an invalid packet. Provide a method.

In order to achieve the above object, the present invention provides a device for receiving a data packet in a network address translation-based virtual private network environment using a security protocol, the information mapping the public address information and the virtual private network address information used in the virtual private network to each other Virtual private network address data storage unit for storing the; An address conversion unit for converting a source address of the received data packet into a virtual private network address using information stored in the virtual private network address data storage unit; If the received data packet uses network address translation, an authentication operation is performed by using the address converted by the address translator. If the received data packet does not use network address translation, the data packet is written to the received data packet. It provides an apparatus for receiving a data packet from a virtual private network comprising a; authentication unit for performing an authentication operation using the public address information.

In order to achieve the above object, the present invention provides a computer readable recording medium having recorded thereon a program for realizing the above method.

In order to achieve the above object, the present invention is characterized in that the notification payload transmitted to establish a protection association includes a network address translation indication field indicating whether the transmitted data packet uses network address translation. A notification payload for establishing a protection association and a computer readable recording medium recording the payload are provided.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

4 is a block diagram showing a data receiving apparatus according to the present invention.

The data receiving apparatus of the present invention includes a virtual private network address data storage unit 401, an address conversion unit 402, an authentication unit 403, and a protection association data storage unit 404.

The protection association data store 404 stores data necessary for a security association (SA). To use the IPsec security protocol, security requires agreement between the receiving end and the sending end for keys, authentication algorithms, key exchange methods, key exchange cycles, cryptographic algorithms, and additional parameter sets required for these algorithms. Speaking of protection attributes, this set of protection attributes is called protection association (SA).

In order to perform this protection association, various types of messages defined in the Internet Security Association Key Management Protocol (ISAKMP) are exchanged between the sending host and the receiving host. The protection attributes recorded in this message are stored in the protection association data storage unit 404.

In the present invention, a message indicating whether network address translation (NAT) is used is inserted into a notification payload message among messages defined in the Internet Security Association Key Management Protocol (ISAKMP), and subsequent packets are converted into network address translation ( NAT) or not.

In addition, the present invention is characterized in that the address information of the virtual private network is recorded in a notification payload message among the messages defined in the ISAKMP (Internet Security Association Key Management Protocol).

6 is a diagram illustrating a format of a notification payload.

In FIG. 6, the Next Payload 601 field is a field indicating an IP header of a next packet, a Payload Length 603 field is a field indicating a length of a next packet, and a Protocol-ID 605 field is a transport protocol. This field indicates the type of.

In addition, the Domain Of Interpretation (DOI) 604 field is a field indicating a domain in which an Internet key change occurs, and the Notify Message Type (607) field is a field indicating a type of a next packet, and a Security Parameter Index (SPI) ( 608) field is a field indicating an identifier relating to a protection association established with a receiving end, a Notification Data (609) field is a field representing data for authentication, and a RESERVED (602, 606) field has not yet been drafted. Field not.

In the present invention, whether or not to use network address translation (NAT) by inserting a field indicating whether next data uses network address translation (NAT) in the Notify Message Type field 607 of each field of the notification payload described above. The receiving end is informed, and the information on the virtual private network address of the host of the transmitting end located in the virtual private network is recorded in the notification data field 609 so that the receiving end can know the address of the virtual private network.

The notification payload described above may be transmitted during the establishment of the protection association or after the establishment of the protection association.

The data are stored in the protection-associated data storage unit 404 and the virtual private network address data storage unit 401 of the receiving end, and the data are implemented as computer readable codes. The computer readable recording medium storing the code includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

In this way, the protection association data storage unit 404 stores the data necessary for the protection association transmitted and received while establishing the protection association and the data of each field of the notification payload transmitted after establishing the protection association or after establishing the protection association. The address information of the virtual private network transmitted while establishing the association or after establishing the protection association is stored in the virtual private network address data storage 401.

When the data packet starts to be received, the authentication unit 403 indicates whether the data packet uses network address translation (NAT) or not, using whether network address translation (NAT) stored in the protection association data storage unit 404 is used. Judging by referencing the data.

If network address translation (NAT) is not used, authentication is performed using only the received data to calculate the ICV (Integrity Check value), which is an integrated authentication value, and compared with the ICV recorded in the received data packet. When the network address translation (NAT) is used, the authentication algorithm is replaced by replacing the value obtained by converting the public address of the transmitter from the address conversion unit 402 to the address of the virtual private network to the value recorded in the address field of the received data packet. Calculate the ICV.

At this time, the authentication algorithm generally uses MD5, and if there is a separate agreement while establishing a protection association (SA) between the receiving end and the transmitting end, it is also possible to perform authentication work using the agreed authentication algorithm.

The address conversion unit 402 receives the received data and converts address information such as an IP address and a port number recorded in the data packet into virtual private network address information stored in the virtual private network address data storage unit 401, and authenticates the authentication. Upon request from the unit 403, the converted address information is informed to the authentication unit.

5 is a flowchart illustrating a data receiving method according to the present invention.

In order to use the IPsec security protocol, a security association (SA) must first be established between the receiving end and the transmitting end (501). The protection association establishment process includes receiving a notification payload. The notification payload may be transmitted after the establishment of the protection association or after the establishment of the protection association. In this embodiment, the notification payload is also transmitted during the establishment of the protection association.

Upon receiving the notification payload, the protection-associated data storage unit 404 stores whether the next data packet uses network address translation (NAT), and the virtual private network address data storage unit 401 stores the virtual private network address of the transmitting end. The information is stored.

When the data packet is received (502), the authentication unit 403 confirms whether network address translation (NAT) is used (503), and if network address translation (NAT) is used, the authentication unit 403 converts the address. The public IP address and port number recorded in the data packet received from the unit 402 are obtained by replacing the public IP address and port number with the public IP address and port number (504) and recording an authentication algorithm such as MD5. The ICV is calculated using the 505.

On the other hand, if the received data packet does not use network address translation (NAT), the ICV is calculated by performing authentication operation using the public address information without converting the address information (505).

The calculated ICV is compared with the ICV value recorded in the data packet (506), and if it matches, the received data packet is accepted (507). If it does not match, the received data packet is discarded (508). .

The method of the present invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, according to the apparatus and method for receiving a data packet from the virtual private network of the present invention, an IPsec security protocol can use an authentication header (AH) while using network address translation (NAT).

Claims (15)

A method for receiving a data packet in a network address translation (NAT) based virtual private network environment using a security protocol, (a) determining whether the received data packet used network address translation; converting address information recorded in the data packet into address information of the virtual private network when the data packet performs network address translation; (c) if the data packet has a network address translation, authentication is performed using the address information of the virtual private network; and if the data packet has not been network address translation, the address information recorded in the data packet is used. Performing an authentication operation; And (d) accepting the data packet if it is recognized as a valid packet as a result of the authentication, and discarding the data packet if it is recognized as an invalid packet; and receiving the data packet from the virtual private network. . The method of claim 1, wherein the method of receiving data is performed before step (a). (f) storing information including information about the address of the virtual private network; and receiving a data packet from the virtual private network. 2. The method of claim 1, wherein step (a) determines whether the data packet used network address translation (NAT) by receiving information indicating whether the data packet used network address translation before receiving the data packet. Receiving a data packet from a virtual private network, characterized in that. The method of claim 1, wherein step (a) confirms a message indicating whether subsequent data recorded in a notification message type included in a notification payload defined in the Internet protection-related key management protocol uses network address translation. And determining whether or not the data packet uses network address translation. The virtual private network according to claim 2, wherein the step (f) receives and stores information about an address of the virtual private network recorded in the notification data included in the notification payload defined in the Internet protection-related key management protocol. To receive a data packet from a network. The method of claim 1, wherein the step (c) is to calculate the integrated authentication value of the data packet according to a predetermined predetermined authentication algorithm and compare it with the integrated authentication value recorded in the data packet to determine whether it is identical. Receiving a data packet from a virtual private network. The method of claim 1, wherein the address information is information recorded in an IP address field and a port number field. The method of claim 1, wherein the security protocol uses an authentication header provided by Internet Protocol Security (IPsec). An apparatus for receiving a data packet in a virtual private network environment based on network address translation using a security protocol, A virtual private network address data storage unit which stores information obtained by mapping public address information and virtual private network address information used in the virtual private network to each other; An address conversion unit for converting a source address of the received data packet into a virtual private network address using information stored in the virtual private network address data storage unit; If the received data packet uses network address translation, an authentication operation is performed by using the address converted by the address translator. If the received data packet does not use network address translation, the data packet is written to the received data packet. Apparatus for receiving a data packet from a virtual private network comprising a; authentication unit for performing an authentication operation using the public address information. The apparatus of claim 9, wherein the data packet receiving apparatus And a protection association data storage unit for storing protection attributes necessary for establishing a protection association. 10. The virtual private network according to claim 9, wherein the authentication unit determines whether the data packet uses network address translation by receiving information indicating whether the data packet uses network address translation before receiving the data packet. A device for receiving data packets from the network. The received data packet according to claim 9, wherein the authentication unit calculates an integrated authentication value of the data packet according to a predetermined predetermined authentication algorithm and compares it with the integrated authentication value recorded in the data packet to determine whether the received data packet is identical. And a data packet from a virtual private network, characterized in that it is determined whether this network address translation is used. A computer-readable recording medium having recorded thereon a program for realizing the method according to any one of claims 1 to 8. A notification payload transmitted for establishing a protection association, the notification payload for establishing protection association comprising a network address translation indication field indicating whether the transmitted data packet uses network address translation. 15. The notification payload of claim 14, wherein the notification payload further includes address information of a virtual private network using the network address translation.