KR20040001211A - The VPN for remote user mobility and method for processing service using that - Google Patents

Abstract

PURPOSE: A VPN(Virtual Private Network) for securing remote user mobility and a service processing method using the same are provided to prevent the modification of IPSec(IP(Internet Protocol) security protocol) data when the IPSec data pass an NAPT(Network Address Port Translator) by modifying a conventional mobile IP method, applying the modified mobile IP method, and encapsulating the IPSec data as a UDP(User Datagram Protocol). CONSTITUTION: A mobile terminal(10) inserts a UDP port number into a registration request message when registering a current position in an HA(Home Agent)(50), encapsulates the registration request message, and transmits the encapsulated registration request message. The mobile terminal(10) inserts the UDP port number into an ESP(Encapsulation Security Payload) header of an MIP(Mobility for IP)-IPSec datagram transmitted to an object-side node, and transmits the MIP-IPSec datagram. The HA(50) changes a datagram received from the object-side node to the MIP-IPSec datagram including the UDP port number, and transmits the MIP-IPSect datagram to the mobile terminal(10).

Description

The VPN for remote user mobility and method for processing service using that}

The present invention relates to a virtual private network (VPN), and more particularly, to a method for processing a virtual private network service that can guarantee the mobility and roaming of a remote user.

In general, IPv4 and IPv6, which are Internet address systems, provide security services using the IPsec protocol. The IPsec protocol consists of IP security architecture, Internet Key Exchange (IKE), IP Authentication Header (AH), and IP Encapsulating Security Payload (ESP) .AH and ESP provide authentication, integrity, and confidentiality services. To provide.

The construction of these protection mechanisms (AH, ESP) requires consultation between the sender and the receiver on keys, authentication algorithms, cryptographic algorithms, and additional sets of parameters required for these algorithms. Here, each of the keys, the authentication algorithm, and the like are called protection attributes, and the set of such protection attributes is called a security association (SA). Hereinafter, the protection association is referred to as SA.

In general, a virtual private network refers to a technology or a communication network that allows a private network to be established using a public network such as the Internet. As illustrated in FIG. 1, an FA located in the visitor network N1 is illustrated. (12), the address translator 13, the gateway 14, and the HA 15 located in the internal network N2.

In the conventional virtual private network configured as described above, the IPsec datagram is transmitted from the mobile terminal 11 to the FA 12, the address translator 13, the gateway 14, the HA 15, and the counterpart node 16, It is transmitted from the partner node 16 to the HA 15, the gateway 14, the NAT 13, the FA 12, and the mobile terminal 11.

At this time, the address translator 13 changes the temporary IP address in the virtual private network to a single authorized IP address, so that an outsider can track the authorized IP address, but can track the temporary IP address. It increases the security by eliminating it.

The address translator 13 includes a network address translator (NAT) and a network address port translator (NAPT).

However, the IPsec datagram in the virtual private network has a datagram in the transport mode ESP as shown in FIG. 2A and a datagram in the tunnel mode ESP as shown in FIG. 2B. ) Does not include an IP header (parts marked with an asterisk).

For this reason, IPsec datagrams are guaranteed integrity when NAT is used as a translator for NAT in a virtual private network that has mobility guarantee function. However, when NAPT, integrity is violated.

This is because NAT does not use the User Datagram Protocol (DUP) port number included in the IP header, and NAPT uses the DUP port number included in the original IP header. Here, the authentication area () and encryption area () of the datagram do not include the DUP port number information.

Currently, most of companies or businesses that require a virtual private network use NAPT as an address translator, and in this case, mobility cannot be guaranteed due to the above reasons.

Therefore, there is a need for a virtual private network service that guarantees subscriber mobility and enables IPsec data to be used with NAPT.

The present invention is to solve the conventional problem, IPSec data NAPT by modifying and applying the existing Mobile IP method to support mobility to subscribers provided with the virtual private network service and encapsulating IPSec data into UDP (User Datagram Protocol) It is aimed not to be deformed when passing through.

1 is a block diagram of a general virtual private network.

2 is a datagram structure diagram in the ESP of the IPsec protocol.

3 is a configuration diagram of a virtual private network to which the present invention is applied.

4 is a flowchart illustrating an overall service processing operation in a virtual private network according to an embodiment of the present invention.

5 is a data flow diagram illustrating a Mobile IP registration procedure and a Security Association (SA) negotiation according to the present invention.

6 is a structure diagram of an Agent Advertisement message used in the present invention.

7 is a structure diagram of a Mobile IP registration request message according to the present invention;

8 is a structure diagram of a Mobile IP registration response message according to the present invention;

9 is a data flow diagram illustrating a datagram exchange process between a mobile terminal and a counterpart node in a non-moving state according to the present invention.

10 is a data flow diagram illustrating a datagram exchange process between a mobile terminal and a counterpart node according to the present invention.

11 is a structure diagram of a binding update message according to the present invention;

Virtual private network of the present invention as a feature for achieving the above technical problem,

It includes a mobile terminal equipped with IPsec software, FA, NAPT, gateway and HA, wherein the mobile terminal includes the UDP port number in the registration request message when the current location is registered in the HA, encapsulated and transmitted The UDP port number is included in the ESP header of the MIP-IPsec datagram transmitted to the other node, thereby ensuring the mobility of the remote user.

As another feature for achieving the above technical problem, the method of the present invention,

In the virtual private network service processing method for guaranteeing mobility of remote users in a virtual private network including a mobile terminal equipped with IPsec software, a plurality of FA, NAPT, gateway and HA,

The mobile terminal transmits a MIP registration request message including a User Datagram Port (UDP) number to the HA through a first FA, the NAPT, and a gateway to register a current location, and registers a registration response message from the HA. And upon receiving, a second step of performing SA negotiation, key exchange, and SA setup procedure to form an IPSec tunnel between the mobile station and the gateway; and when the SA setup is made, the mobile station exchanges data with a counterpart node. A third step of generating and transmitting a MIP-IPsec datagram including the UDP port number in an ESP header, and the UDP port number of the MIP-IPsec datagram transmitted from the mobile terminal is used for the NAPT to pass through And a fourth step of transmitting the decapsulated datagram to the counterpart node through the IPSec tunnel to the gateway. .

Hereinafter, a virtual private network service processing method for guaranteeing remote user mobility according to an embodiment of the present invention will be described with reference to the accompanying drawings. Advantages and features of the present invention will be more clearly understood through the following detailed description, and detailed descriptions of well-known techniques not directly related to the gist of the present invention will be omitted in the description of the present invention.

3 is a configuration diagram of a virtual private network to which the present invention is applied. As shown in FIG. 3, the virtual private network of the present invention includes a mobile terminal 10 moved to the visitor network N1, and a NAPT constituting the FA 20 and the insider network N2 installed in the visitor network N1. 30, the gateway 40 and the HA 50, and the partner node 60 is connected to the HA (50).

Hereinafter, an overall service processing operation in a virtual private network according to an embodiment of the present invention will be described with reference to FIG. 4. 4 is a flowchart illustrating an overall service processing operation in a virtual private network according to an embodiment of the present invention. As shown in FIG. 4, when the mobile terminal 10 moves from the insider network N1 or the visitor network to another visitor network N2 (S410), the mobile terminal 10 is located in the visitor network N2. The temporary IP address is provided from the FA 20, and unique address information of the FA 20 is provided (S410).

The temporary IP address is used as location information of the mobile terminal 10 in the visitor network N2, and is used as location information of a network currently visited by the mobile terminal 10 in the private temporary network.

Accordingly, the mobile terminal 10 generates a MIP registration request message including temporary IP address information and FA address information to register its current location in order to enable data exchange with the outside, and the MIP registration request message is generated. In order to ensure integrity, the MIP registration request message is encapsulated into a User Datagram Protocol (UDP) number (S412). Then, the mobile terminal 10 transmits the encapsulated MIP registration request message to the FA 20, and the FA 20 transmits it to the HA 50 through the NAPT 30 and the gateway 40 (S413). ).

When receiving the MIP registration request message, the HA 50 stores the current location of the mobile terminal 10 to be registered and then transmits a message corresponding to the registration completion to the mobile terminal 10 (S414).

When the current location is registered, the mobile terminal 10 performs SA negotiation and key exchange with the gateway 40 to verify identity and protocol and operation algorithm with the gateway 40 (S415).

When the SA negotiation and key exchange are made as described above, the mobile terminal 10 and the gateway 40 set the SA using the IKE (Internet Key Exchange) key generated through the key exchange (S415). Is set (S416).

When the call path is established as described above, the mobile terminal 10 encapsulates the datagram to be transmitted to the opposite node as the MIP-IPsec datagram using the UDP port number and transmits it to the opposite node 60 (S417). 40 transmits the encapsulated MIP-IPsec datagram to the counterpart node 60 (S419).

At this time, when the gateway 40 receives the encapsulated MIP-IPsec datagram from the opposite node 16, the gateway 40 transmits it to the mobile terminal 10 to make a mutual call (S420).

Hereinafter, the MIP registration process and SA negotiation process for virtual private network service processing according to an embodiment of the present invention will be described in detail with reference to FIG. 5.

The FA 12 periodically broadcasts an AAM (Agent Advertisement Massage) signal in the network requesting registration of the current location (S501).

Here, the AAM signal has a structure as shown in FIG. As shown in FIG. 6, the AAM signal includes a type, a length, a sequence number, a lifetime, flags, and a care-of address field. It consists of.

The type field is a field allowed for the mobile terminal 10 to distinguish various extensions used for the Internet Control Message Protocol (ICMP) router advertisement, and the FA 12 or the HA 15 allows the ICMP router advertisement. Means that you are using. As an example, the type of mobility agent advertisement extension is "3". The length field depends on how many care-of addresses are advertised. For example, if 6 bits + 4 ^N , N is the number of advertised temporary addresses. The sequence number field is the number of transmissions of the AAM after the agent is initialized, and the lifespan field means the time (in seconds) to accept the registration request. The flag field is used to inform the mobile terminal 10 about the characteristics of the advertisement as follows.

R: Registration is requested, B: FA is in use, H: Agent is HA, F: Agent is FA, M: Tunneled datagram with minimal encryption, G: Tunneled datagram with GRE encryption Implementation, V: "Van Jacobson" header compression implementation, L: local tunnel management (allowing internal registration), where the F and H bits are not mutually exclusive, and the B bit is not set unless the F bit is set . In addition, the FA 20 sends the AAM to the mobile terminal 10 even if it is too busy to provide service for the new mobile terminal 10. The temporary address field has a temporary IP address to be provided to the mobile terminal 10.

Accordingly, the mobile terminal 10 moving to the visitor network N2 receives an AAM signal from the FA 20 (S301), selects one of a plurality of temporary IP addresses included in the AAM, and uniquely identifies the FA 20. After determining the address, a MIP registration request message including the temporary IP address and the address of the HA 15 is generated (S502).

Then, the mobile terminal 10 encapsulates the MIP registration request message by adding a UDP port number to the generated MIP registration request message (S503).

This encapsulated MIP registration request message is shown in FIG. As shown in FIG. 7, the MIP registration request message according to an embodiment of the present invention may include a type, a flag, a lifetime, a home address, a home agent, and a temporary message. It consists of a Care-of Address, Identification, UDP Port Number, and Extensions.

The type field is a field related to the registration request. The value is "1", and the flag field uses 1 bit among 6 bits used in the existing MIP and 2 bits not used as the flag indicating whether to use the UDP port. Flags at this time include S, B, D, M, G, V, and U.

S is simultaneous binding, and if the S bit is set to '1', the HA 15 is requested to maintain the previous mobility bindings of the mobile terminal 10. B is a broadcast datagram, which is used by the mobile terminal 10 to request the broadcast datagram to the HA 15. D is a decapsulation by mobile node, which is used to decapsulate a datagram sent by the mobile terminal 10 to a temporary address. This means using co-located temporary addresses. M is the minimum encryption implementation, G is the Generic Routing Encapsulation (GRE) encryption implementation, V is the Jacobson header compression implementation, and U is the UDP port number.

The lifetime field records the time (in seconds) before the registration expires, the home address field records the IP address of the mobile terminal 10, the home agent field records the address of the HA 50, and the temporary address field. Is the IP address pointing to the end of the tunnel. The identification field is a 64-bit number generated by the mobile terminal 10 and is used for whether the registration request and the registration response match, that is, for replay protection. The UDP port number field is 16 bits in which the input port number of the NAPT 30 added to ensure the integrity when IPSec data passes through the NAPT 30 is recorded. Service information is included in the UDP port number to be used. The extension field means that there is one or more extensions, and all registration requests must include the Mobile-Home Authentication Extension.

After creating the encapsulated MIP registration request message as described above, the mobile terminal 10 transmits the encapsulated MIP registration request message to the FA 20 (S503), and the FA 20 NAPT (30) the MIP registration request message. And the MIP registration request message encapsulated to the HA 50 through the gateway 40 (S504).

The encapsulated MIP registration request message transmitted from the FA 20 is received by the NAPT 30, and the NAPT 30 converts the mobile IP address of the mobile terminal into its own formulated IP address (S305). At this time, the NAPT 30 changes the IP address by using the UDP port number and data of the encryption area A and the authentication area B shown in FIG. 2, thereby ensuring integrity.

The NAPT 30 changes the temporary IP address to the official IP address and then transmits the MIP registration request message to the gateway 40 in the changed state (S506), and the gateway 40 registers the MIP received from the NAPT 30. The request message is delivered to the HA 50 (S507).

Then, the HA 50 registers the official IP address of the mobile terminal 10 and the address pair of the FA 12 so that location registration of the mobile terminal 10 is performed, and then a location registration response message indicating the location registration success. Is generated and transmitted to the gateway 40 (S508, 509).

The structure of the location registration response message generated in the HA 50 is shown in FIG. As shown in FIG. 8, the location registration message includes a type, a code, a lifetime, a home address, a home agent, an identification, a UDP port number. And Extension.

The type field is a field related to the request response. The value field is "3", and the code field is recorded with a value indicating the result of the registration request.

0: registration allowed,

If registration is denied by FA 20

66: insufficient resources

69: Lifetime Request> Advertised Limits (if requested lifetime is too long)

70: Incomplete Request

71: incomplete response

88: Home Agent Unreachable

If registration is denied by HA 15

130: insufficient resources

131: Mobile node authentication failed

133: registration identification mismatch

134: incomplete request

136: Unknown home agent address

The lifetime field indicates the number of seconds remaining before registration expires if registration has been accepted and " 0 " indicates that the mobile terminal 10 has been deregistered. If registration is denied, this field is ignored.

The home address field records the IP address of the mobile station 10, the home agent field records the HA address, and the temporary address field records the IP address indicating the end of the tunnel. The identification field is used for response protection. The UDP port number field is 16 bits in which the input port number of NAPT 30 added to ensure the integrity when IPSec data passes through NAPT 13 is recorded.

When the gateway 40 receives the location registration response message as described above from the HA 50, the gateway 40 transmits the location registration response message to the NAPT 30 (S510), and the NAPT 30 transfers the official IP address to the mobile terminal 10. After changing to a temporary IP address of (S511), and transmits to the FA 20 (S512), FA 12 transmits a location registration response message to the mobile terminal (S513), the mobile terminal 10 is Check the location registration success (S514).

After performing the MIP registration procedure, the mobile terminal 10 performs SA negotiation and key exchange with the gateway 40 according to an aggressive mode to form a virtual private network (S515).

That is, the mobile terminal 10 generates a random number, its identifier, and a Diffie-Hellman public value together with the SA and transmits it to the gateway 40, and the gateway 40 transmits the mobile terminal 10. The SA, the random number, its own identifier, and the Diffelmann public value are received to authenticate the identifier of the mobile terminal 10, the mobile terminal 10 selects one of the values presented by the SA, and the selected SA and the mobile terminal 10 The identity between the mobile station 10 and the virtual private network gateway 40 is verified by sending the signed value and the Diffie-Hellman public value to the mobile station 10.

In addition, when the mobile terminal 10 generates an IKE (Internet Key Exchange) key through SA negotiation and key exchange using Aggressive mode, the mobile terminal 10 uses Quick Mode to negotiate a matter for the IPSec security service and regenerate the key. Meanwhile, the gateway 14 receiving the quick mode hash value, the suggestions and the random number from the mobile terminal 10 obtains the quick mode hash value of the random number sent by the mobile terminal 10 and checks the random number of the mobile terminal. Send to (10).

The mobile terminal 10 transmits the hash value of the two random numbers Quick mode to the gateway 40. Accordingly, the mobile terminal 10 and the virtual private network gateway 40 know both the random numbers, two random numbers, Security Parameter Index (SPI) and the IKE key obtained from the SA negotiation and key exchange phase are combined with the hash value combined with the protocol value sent by the mobile terminal 10 in the Internet Security Association and Key Management Protocol (ISAKMP) header. SA is set by performing each operation (S516).

In the above, the MIP registration request message and the MIP registration response message shown in FIGS. 7 and 8 comply with the IETF (Internet Engineering Task Force) Request For Comments (RFC) 2002 document standard.

Hereinafter, a process of exchanging datagrams between the mobile terminal and the counterpart node without moving will be described with reference to FIG. 9.

9 is a data flow diagram illustrating a datagram exchange process between a mobile terminal and a counterpart node without moving according to the present invention. As shown in FIG. 9, the transmission path of the MIP-IPsec datagram generated in a situation where the mobile terminal 10 does not move to another network and transmitted to the opposite node 60 is almost similar to the path shown in FIG. 5. The only difference is that the destination is the opposite node 60.

That is, the mobile terminal 10 performs the current location registration, sets up the SA with the gateway 40, and when the gate-to-gate call tunnel is established, generates a MIP-IPsec datagram to make a call with the other party (S901) and NAPT ( 30) The UDP port number is added to the ESP header shown in FIG. 2 and encapsulated so as to ensure integrity when passing (S902 and S903).

The MIP-IPsec datagram transmitted from the mobile terminal 10 is received by the FA 20, and the FA 20 transfers the MIP-IPsec datagram to the NAPT 30 (S904), and the NAPT 30 receives the MIP. The temporary IP address is changed to an authorized IP address by using the UDP port number included in the IPsec datagram and data of the authentication and encryption area, and then forwarded to the gateway 40 (S905 and S906).

Then, the gateway 40 decapsulates the MIP-IPSec datagram and then transmits the decapsulated datagram to the opposite node 60 (S907).

If the datagram transmitted from the mobile terminal 10 is transmitted to the counterpart node 60, the counterpart node 60 also generates a datagram for the call and transmits the datagram to the mobile station 10 (S908, S909). .

Therefore, when the partner node 60 transmits the datagram, the HA 50 receives the datagram (S910), converts the datagram into a MIP datagram, and sends the datagram to the gateway 40 (S911).

Then, the gateway 14 converts the MIP datagram into a MIP-IPsec datagram and transmits it to the NAPT 30 (S912), and the NAPT 13 transmits the public IP address recorded in the MIP-IPsec datagram to the private IP. After changing to the address, M12 transmits the MIP-IPSec datagram to the FA 12 (S913 and S914). The FA 12 decapsulates the MIP from the MIP-IPSec datagram and then transmits the IPSec datagram to the mobile terminal 10 (S915).

Hereinafter, a method of delivering a datagram when the mobile terminal 11 moves from the same visited network to another network for processing of the virtual private network service according to the present invention will be described with reference to FIG. 10.

10 is a data flow diagram illustrating a datagram exchange process between a mobile terminal and a counterpart node according to the present invention. As shown in FIG. 10, when the mobile node 10 transmits a datagram to the HA 50 receiving the datagram in a state in which a tunnel is formed between the gateways 40 (S101), the HA 50. Encapsulates the datagram in a MIP and sends it to the gateway 40 (S102).

Then, the gateway 40 makes the MIP datagram into the MIP-IPsec datagram and forwards it to the FA 17 (S103). At this time, if the mobile terminal 10 moves from the visited network in which the FA 21 is located to another visited network in which the FA 20 is located, the FA 21 becomes the previous FA and the FA 20 becomes the current FA. 21 receives the fact that the mobile terminal 10 has moved from the HA 50. Therefore, the previous FA 21 forwards the MIP-IPSec datagram to the current FA 20 (S104).

The FA 20 receiving the MIP-IPSec datagram from the previous FA 21 sends the IPSec datagram to the mobile terminal 10 after decapsulating the MIP (S105), and the previous FA 21 sends the HA 15 to the HA 15. The binding update message, which is a message that the mobility coupling has been changed, is transmitted (S106).

The HA 50 performs the update procedure for the mobility combining to the address of the mobile station 10 and the FA 20 where the mobile station 10 moves to another network, and then the SA negotiation described with reference to FIG. 5. And a new tunnel is formed between the mobile station 10 and the gateway 40 moved to another network by performing a key exchange and SA setup procedure.

As such, when a tunnel is newly established between the mobile terminal 10 and the gateway 40, the datagram transmitted from the partner node 60 is a MIP datagram encapsulated in MIP by the HA 50 and thus the gateway 40. It is transmitted to (S109, S110).

Then, the gateway 14 encapsulates the MIP datagram into IPSec and then forwards the MIP-IPSec datagram to the FA 20 in the newly formed tunnel (S211), and the FA receives the MIP-IPSec datagram from the gateway 14. 20 decapsulates the MIP and transmits the IPSec datagram to the mobile terminal 10 (S112).

In the above, the binding update message conforms to the IETF RFC 2002 document standard and uses the UDP encapsulation method to ensure the integrity when IPSec data passes through the NAPT 30, wherein the binding update procedure including information in the UDP port number to be used. Perform

As shown in FIG. 11, the binding update message includes a type, a flag, a lifetime, a home address, a care-of address, an identification, It consists of UDP port number and extensions.

First, the type field means binding update. The value is '18', and the flag field uses 1 bit among 4 bits used in the existing MIP and 4 bits not used previously as a flag indicating whether to use a UDP port.

A: Set by the node sending the binding update message to request binding confirmation.

I: If present in the identifying field, set by the node sending the binding update message.

M: If this bit is set, it is implemented by the minimum encryption method.

G: If this bit is set, implemented by GRE encryption method.

U: Use UDP port.

The lifetime field records the number of seconds remaining before the binding cache entry is completed. If "0", the lifetime field is not included in the binding cache list for the mobile terminal 11.

The home address field records the IP address of the mobile station 10 associated with the binding update, the temporary address field records the current care-of address of the mobile station 10, and the identification field is used for response protection. . The UDP port number field is 16 bits in which the input port number of the NAPT 30 for ensuring the integrity when IPSec data passes through the NAPT 30 is recorded.

Although the NAPT 30 is not illustrated in the description with reference to FIG. 11, the operation of the NAPT may be sufficiently understood through FIGS. 5 and 9.

The description so far has described the principles and features of the present invention by taking specific embodiments of the present invention for the purpose of understanding the present invention, but the scope of the present invention is not limited by these embodiments. Those skilled in the art can make various changes and modifications without departing from the scope and spirit of the appended claims.

When the virtual private network service providing method applying the method of modifying the existing MIP method and UDP encapsulation of IPSec data according to the present invention is used, it supports mobility to remote users equipped with IPSec software and when the IPSec data passes through NAPT, the IP header Is modified to solve the problem of violating integrity, thereby providing a virtual private network service that guarantees mobility.

Claims (10)

In the virtual private network service processing method for guaranteeing mobility of remote users in a virtual private network including a mobile terminal equipped with IPsec software, a plurality of FA, NAPT, gateway and HA, A first step of registering a current location by transmitting a MIP registration request message including a User Datagram Port (UDP) number from the mobile station to the HA through a first FA, the NAPT, and a gateway; Receiving a registration response message from the HA, and performing a SA negotiation, key exchange, and SA establishment procedure to form an IPSec tunnel between the mobile station and the gateway; Generating, by the mobile station, a MIP-IPsec datagram including the UDP port number in an ESP header for data exchange with a counterpart node; And And a fourth step in which the UDP port number of the MIP-IPsec datagram transmitted from the mobile terminal is used for the NAPT, passed through, passed to the gateway through the IPSec tunnel, and transmitted to the counterpart node as a decapsulated datagram. A virtual private network service processing method that guarantees remote user mobility. The method of claim 1, The MIP registration request message, A type field for recording a value related to a registration request, a flag field for recording a flag indicating whether to use a UDP port for 6 bits used in the MIP and one of the remaining 2 bits, a lifetime field for recording an expiration date of registration, A home address field for recording the IP address of the mobile terminal, an HA field for recording the address information of the HA, a temporary address field for recording a current temporary IP address, an identification field for response protection, and a UDP port number. And a UDP port number field to record and an extension field to record the number of extensions. The method of claim 1, The first FA is, When the mobile terminal currently moves from its own network to another network, a virtual private network service processing method of guaranteeing remote user mobility, characterized in that to generate a binding update message indicating the movement of the mobile terminal to transmit to the HA. The method of claim 3, The binding update message is A type field for recording a value indicating a binding update, a 4-bit flag field for recording a flag used in a MIP, a 4-bit flag field for a flag indicating whether a UDP port is used, and a binding cache entry A lifetime field that records the time remaining before completion, a home address field that records the mobile station's IP address associated with the binding update, a care-of address field that records the mobile's current temporary IP address, A method for processing a virtual private network service assuring remote user mobility, comprising an identification field for response protection, a UDP port number field for recording a UDP port number, and an extension field for recording an extension number. The method of claim 1, The registration response message, A type field for recording a value related to the request response, a code field for recording a registration request result value, a lifetime field for recording the time remaining before the registration expires, and a home address field for recording the IP address of the mobile terminal. And a home agent field for recording the HA address, an identification field for response protection, a UDP port number field for recording a UDP port number, and an Extensions field for recording the number of extensions. Virtual private network service processing method to ensure the mobility of remote users. The method of claim 1, The fourth step, Transmitting the MIP-IPSec datagram transmitted from the mobile terminal to the NAPT by changing the source address of the MIP header at the FA, and converting an unauthorized IP address to the authorized IP address using the UDP port number in the NAPT. Modifying and transmitting to the gateway; and decapsulating the MIP-IPsec datagram at the gateway and transmitting the data packet to a counterpart node as a datagram. . The method of claim 1, When a datagram is transmitted from the opposite node in a state where a call tunnel is formed between the mobile station and the gateway, the gateway converts the UDP port number information into a MIP-IPsec datagram included in an ESP header and transmits the datagram to the mobile station. The virtual private network service processing method for guaranteeing remote user mobility, characterized in that it further comprises five steps. The method of claim 7, wherein The fifth step, Receiving the datagram transmitted to the other node from the HA and encapsulating it with MIP, and then transmitting the MIP datagram to the gateway, and encapsulating the MIP datagram with MIP-IPsec including the UDP port number at the gateway. Transmitting a MIP-IPsec datagram to the NAPT, changing an authorized IP address in the NAPT to a temporary IP address of a transferred mobile terminal, and transmitting the MIP-IPsec datagram to the FA; and in the FA, the MIP-IPsec datagram Decapsulating the MIP to an IPSec datagram, the virtual private network service processing method comprising the step of transmitting to the mobile terminal comprising the step of transmitting to the mobile terminal. In a mobile terminal equipped with IPsec software and a virtual private network including FA, NAPT, gateway, and HA, When the mobile station registers the current location with the HA, the mobile terminal includes the UDP port number in the registration request message, encapsulates the data, and transmits the encapsulated UDP message. Virtual private network that guarantees remote user mobility. The method of claim 9, The HA changes the datagram received from the opposite node into a MIP-IPsec datagram including the UDP port number and transmits the datagram to the mobile terminal.