KR20040028329A - Method for supplying discriminative services in VPN - Google Patents

Abstract

PURPOSE: A method for processing a VPN(Virtual Private Network) service supplying a differentiated service is provided to negotiate attributes related to service ranks as well as key and authentication algorithm, and to extract service rank values to set the extracted service rank values in a DSCP(Differential Service Code Point) field of an IP header. CONSTITUTION: When IKE(Internet Key Exchange) SA(Security Association) negotiation and key generation functions are carried out to form a tunnel between a client and a gateway or between VPN gateways, a system forms a tunnel through reciprocal authentication, SA negotiation, and key regeneration procedures(S200-S204). If the tunnel is generated by an SA setup, the system extracts values related to service ranks during the SA negotiation procedure, and sets the extracted values in a DSCP field of an IP header(S205). The system measures resources of an inputted packet according to the set DSCP field values, shapes or droops the packet, and transmits the packet to a destination(S206-S208).

Description

How to handle virtual private network services that provide differentiated services {Method for supplying discriminative services in VPN}

The present invention relates to a virtual private network (VPN) service processing method, and more particularly, to a virtual private network service processing method capable of providing differentiated services according to service grades to IPSec virtual private network users.

In general, virtual private networks use the IPSec protocol to provide many security services. The IPSec protocol consists of IP security structure, Internet Key Exchange (IKE), Authentication Header (AH) and IP Encapsulation Security Payload (ESP). Provides authentication, integrity and confidentiality services.

The construction of these protection mechanisms (AH, ESP) requires negotiation between the sender and the receiver about the keys, authentication algorithms, cryptographic algorithms and additional parameter sets required for these algorithms. Here, keys, authentication algorithms, etc., each of them is called a protection attribute, and such a set of protection attributes is called a security association (SA). Hereinafter, the protection association is called SA.

Currently, there is no attribute of service class when negotiating SA, so IPSec virtual private network only provides Best Effort service that delivers all packets equally to guarantee the requirement for differentiated service according to subscriber service class. I can't.

Therefore, a virtual private network service is urgently required for subscribers to guarantee differentiated services according to subscriber service grades of IPSec data.

SUMMARY OF THE INVENTION The present invention has been made to solve the problems of the prior art, and guarantees the Quality of Service (QoS) to subscribers provided with IPSec virtual private network service, and provides a differentiated service when discussing IKE and IPSec SA. It discusses not only algorithms but also attributes related to service class, and aims to provide differentiated services to IPSec virtual private network subscribers by extracting service class values and setting them in the DSCP field of the IP header.

1 is a configuration diagram of a virtual private network to which the present invention is applied;

2 is a flowchart illustrating an overall service processing operation in a virtual private network according to an embodiment of the present invention;

3 is a flowchart illustrating a process of IKE SA negotiation, key generation, and mutual authentication between a client / gateway and a gateway according to a main mode for processing a virtual private network service according to an embodiment of the present invention;

4 is a structural diagram of a main mode SA message according to the present invention;

5 is a diagram illustrating an IPSec security service using a quick mode when an IKE key is generated through SA negotiation and key exchange using a main mode or an aggressive mode for processing a virtual private network service according to an embodiment of the present invention. Is a flow chart showing the process of negotiating and regenerating keys,

6 is a structural diagram of a quick mode SA message applied to the present invention.

According to the present invention, a virtual private network service processing method comprising a client not equipped with IPSec, a client equipped with IPSec, a virtual private network (VPN) gateway, and an intranet server, wherein the virtual private network gateways or the When the IKE (Internet Key Exchange) protection association (SA) negotiation and key generation are performed to form an IPSec tunnel between the client and the gateway equipped with IPSec, the client and the gateway or the gateway Establishing a tunnel through mutual authentication between gateways and IPSec SA negotiation and key regeneration; When the SA is configured and the tunnel is generated, extracting a value related to a service level during the SA negotiation and setting the value in a DiffServ. Code Point (DSCP) field of an IP header; Measuring the resources consumed by the input packet and shaping or dropping the traffic, thereby delivering the packet to a destination; It provides a virtual private network service processing method for providing a differentiated service comprising a.

Hereinafter, a virtual private network service processing method for providing a differentiated service according to an embodiment of the present invention will be described with reference to the accompanying drawings. Advantages or features of the present invention will be more clearly understood through the following detailed description, and detailed descriptions of well-known techniques not directly related to the gist of the present invention will be omitted in the description of the present invention.

1 is a configuration diagram of a virtual private network to which the present invention is applied.

As shown in FIG. 1, in the virtual private network applied to the present invention, a client 111 without IPSec software is installed in a tunnel mode between the virtual private network gateway 113 and the counterpart's virtual private network gateway 114. Create a tunnel to access the intranet 115, or create a tunnel in the transport mode between the client 112 equipped with IPSec software and the virtual private network gateway 114 in the intranet 115. By accessing it, it provides a virtual private network service.

2 is a flowchart illustrating an overall service processing operation in a virtual private network according to an embodiment of the present invention, which will be described in detail as follows.

First, in step S200, in order to provide a differentiated service in the IPSec virtual private network, the client / gateways 112 and 113 use the main mode of IKE to send an encryption algorithm, a hash algorithm, and an authentication method to the counterpart gateway 114. When the Diffie-Hellman sends information on key distribution and subscriber's service class information, the counterpart gateway 114 selects the necessary information from the presented information and selects the selected SA from the client / gateway 112. 113, to initiate IKE SA negotiation between the client / gateway 112, 113 and the other gateway 114.

Subsequently, in step S201, when the IKE SA negotiation is made, the client / gateways 112 and 113 and the counterpart gateway 114 transmit and receive each other's public value and a random number which is a random number, thereby generating a key to each other. Then, in step S202, when the keys of the client / gateways 112 and 113 and the counterpart gateway 114 are generated, mutual authentication is performed by transmitting and receiving the ID value and the signed value to each other.

In step S203, when mutual authentication is performed between the client / gateway 112 and 113 and the counterpart gateway 114, the client / gateway 112 and 113 and the counterpart gateway are connected using a quick mode of IKE. After regenerating the IPSec SA negotiation and key between 114, in step S204, a tunnel is created.

Subsequently, in step S205, the service class value of the subscriber extracted in the SA negotiation process is set in an appropriate Diff.Serv Code Point (DSCP) field in order to provide a differentiation service, and in step S206, the incoming traffic is monitored to determine whether it is appropriate. Watch.

At this time, the flow rate and burst size are measured to compare whether the input packet has resources consumed and whether or not the burst data is included in order to send the stream according to the traffic profile. Judge.

As a result of the determination in step S206, when the burst data is included, the gateway 113 performs a shaping function to slow down the processing speed in step S207, or when the flow exceeds a set rate or threshold value. After performing a dropping function of discarding one or more packets of the flow in step S208, an IPSec packet is transmitted to the counterpart gateway 114 to provide a differentiated service to the virtual private network subscriber.

On the other hand, if the burst data is not included as a result of the determination in step S206, the flow proceeds to step S208.

Figure 3 shows in more detail the process of IKE SA negotiation, key generation and mutual authentication between the client / gateway (112, 113) and the gateway 114 in the main mode for processing the virtual private network service according to an embodiment of the present invention Note is a flow chart, which will be described below.

First, in step S300, six messages (three request / response pairs) are exchanged between the client / gateway 112 and 113 and the counterpart gateway 114 in order to perform IKE SA negotiation, key generation, and mutual authentication. .

Subsequently, in step S301, using the first pair of the six messages, the client / gateway 114 initiating communication is informed about the encryption algorithm, the hash algorithm, the authentication method, and the Diffelman's key distribution and the subscriber's information. When the service grade information is sent, the counterpart gateway 114 selects an appropriate one from the received information and transmits the selected SA to the client / gateways 112 and 113.

Meanwhile, the SA message conforms to the Request For Comments (RFC) 2409 standard, which is a standard document established by the Internet Engineering Task Force (IETF), and is a reserved field of the conversion payload of the SA message in order to provide a differentiated service according to the present invention. The subscriber service class value is set in the DSCP field of the IP header.

In step S302 and step S303, the second pair of the six messages is used, and the client / gateways 112 and 113 and the counterpart gateway 114 generate a random number which is a Diffhelman's public value and a random number to each other. Send and receive

Finally, in step S304 and step S305, using the third pair of the six messages, the client / gateway 112 and 113 and the counterpart gateway 114 transmit and receive an ID value and a signed value to each other. Perform the authentication function.

In the present embodiment, only the case of the main mode is described for convenience of description, but the present invention is also applied to an aggressive mode following the same SA message format of the main mode.

4 is a structural diagram of a main mode SA message applied to the present invention.

As shown in FIG. 4, an SA message according to an embodiment of the present invention includes an ISKAMP header, a security association payload, a proposed payload, and a transform payload in a main mode.

The security association payload includes a length of the SA payload related to the proposed security association, an interpretation domain identifying a domain of interpretation (DOI) to be negotiated, and a situation field which is a DOI specific field specifying a situation in which negotiation is to be performed.

The proposal payload may include a common payload header length related to the proposal, a proposal number identifying a proposal number for the current payload, Proto_ISAKMP specifying an identifier of a protocol for the current negotiation, and a security parameter defined by a protocol ID. Index) length, number conversion that specifies the number of transforms for the proposal, and the SPI of the sending entity.

The conversion payload is a conversion number for identifying a conversion number for a current payload, a conversion ID for designating a conversion identifier for a protocol among current proposals, and a DSCP which is a subscriber service class proposed for a differentiated service according to the present invention among reservation fields. And a security association attribute defined for the given transformation in the transformation ID field.

5 is a diagram illustrating an IPSec security service using a quick mode when an IKE key is generated through SA negotiation and key exchange using a main mode or an aggressive mode for processing a virtual private network service according to an embodiment of the present invention. A flowchart illustrating the process of negotiating and regenerating keys.

Meanwhile, in order to perform IPSec SA negotiation and key regeneration, the client / gateways 112 and 113 and the counterpart gateway 114 exchange three messages.

First, in step S310, the client / gateway 112, 113 transmits its ID, key, random number, proposed SA and hash value to the counterpart gateway 114, and in step S311, the counterpart gateway 114 Obtains the quick mode hash value of the random number sent by the client / gateway 112 and 113, generates its own random number, and transmits the selected SA and key value to the client / gateway 112 and 113. In this case, the SA message includes an encryption algorithm, a hash algorithm, an authentication method, information on the Diffelmann key distribution, and service class information of the subscriber defined in the present invention.

Subsequently, in step S312, the client / gateways 112 and 113 transmit a hash value of two random numbers in the quick mode to the counterpart gateway 114. Accordingly, the client / gateway 112 and 113 and the counterpart gateway 114 know both random values, and include the two random numbers and the SPI in the Internet Security Association and Key Management Protocol (ISAKMP) header, which is a key management protocol. SA is set by performing a hash value combined with the protocol value sent using the IKE key described with reference to FIG. 3. Meanwhile, the SA message complies with the RFC 2409 standard, which is a standard document established by the IETF, and in order to provide a differentiated service according to the present invention, the subscriber service class value is added to the DSCP field of the IP header in the reserved field of the conversion payload of the SA message. Set and use.

6 is a structural diagram of a quick mode SA message applied to the present invention.

As shown in FIG. 6, an SA message according to an embodiment of the present invention includes an ISAKMP header, a hash payload, a security association payload, a proposed payload, a transform payload, and an encryption bit in a quick mode.

The hash payload includes hash data and payload length fields, which are data obtained by applying a hash routine to an ISAKMP message state.

The security association payload includes a situation field which is a length of an SA payload related to the proposed security association, an interpretation domain identifying a DOI to be negotiated, and a DOI specific field specifying a situation to be negotiated.

The proposal payload includes a common payload header length related to the proposal, a proposal number identifying a proposal number for the current payload, Proto_ISAKMP specifying an identifier of a protocol for the current negotiation, an SPI length defined by a protocol ID, and a proposal. There is a number transformation and SPI of the transmitting entity that specifies the number of transformations for.

The conversion payload may include a conversion number for identifying a conversion number for the current payload, a conversion ID for designating a conversion identifier for a protocol in the current proposal, a DSCP which is a subscriber service class proposed for a differentiated service according to the present invention among reservation fields; Contains the security association attribute defined for the given transformation in the Translation ID field.

In addition, a quick mode SA message is composed of random data, sender ID, and receiver ID generated by the sender entity.

As described above, according to the present invention, a method for processing a virtual private network service applying a method of setting a subscriber service class value in a DSCP field of an IP header by negotiating not only key and authentication algorithm but also attributes related to service class is discussed. By providing the subscriber, there is an effect that can provide a differentiated service according to the service level.

Claims (7)

In the virtual private network service processing method comprising a client with IPSec, a client without IPSec, a virtual private network (VPN) gateway and an intranet server, When the KEY (International Key Exchange) protection association (SA) negotiation and key generation are performed to form an IPSec tunnel between the virtual private network gateway or the client equipped with the IPSec and the gateway, the client A first step of establishing a tunnel between the gateway and the gateway or the gateway and the gateway through mutual authentication and IPSec SA negotiation and key regeneration; A second step of, when the SA is configured and the tunnel is generated, extracting a value related to a service level in the SA negotiation process and setting the value in a DiffServ. Code Point (DSCP) field of an IP header; And A third step of delivering a packet to a destination by shaping or dropping the traffic consumed by the input packet according to the set DSCP field value; Virtual private network service processing method for providing a differentiated service comprising a. The method of claim 1, The first step is, A sub-step of transmitting, by the client or gateway, the subscriber's service class information to the counterpart gateway when IKE SA negotiation and key generation are performed to form an IPSec tunnel between the virtual private network gateway or the client equipped with IPSec and the gateway; And Receiving, by the gateway, the service grade information of the subscriber, selecting corresponding information from the received information, and transmitting the selected SA to the client / gateway; Virtual private network service processing method for providing a differentiated service comprising a. The method according to claim 1 or 2, The IKE SA message is A security association payload including a length of an SA payload related to the proposed security association, an interpretation domain identifying a domain of interpretation (DOI) to be negotiated, and a situation field, which is a DOI specific field specifying a situation in which negotiation is to be made; Common payload header length associated with the proposal, proposal number identifying the proposal number for the current payload, Proto_ISAKMP specifying the protocol identifier for the current agreement, security parameter index (SPI) length defined by the protocol ID, proposal A proposed payload comprising a number conversion and an SPI of a transmitting entity that specifies the number of transforms for the transmission entity; And The security association attribute defined for the translation given in the translation number identifying the translation number for the current payload, the translation ID specifying the translation identifier for the protocol in the current proposal, the DSCP, the subscriber service class of the reservation field, and the translation ID field. A transform payload comprising; Virtual private network service processing method for providing a differentiated service comprising a. The method of claim 1, The first step is, When mutual authentication and IPSec SA negotiation are performed between the client and the gateway or between the gateway and the gateway, when the client / gateway sends an SA message including the service class information of the subscriber to the counterpart gateway, the counterpart gateway checks the client for confirmation. A virtual private network service processing method for providing a differentiated service, comprising: obtaining a quick mode hash value of a random number sent by a gateway, generating a random number of its own, and transmitting a selected SA and key value to the client / gateway . The method according to claim 1 or 4, The IPSec SA message is, A hash payload including a hash data and a payload length field that is data of a result of applying a hash routine to an ISAKMP message state; A security association payload comprising a length of an SA payload related to the proposed security association, an interpretation domain identifying a DOI to be negotiated, and a situation field which is a DOI specific field specifying a situation to be negotiated; Common payload header length associated with the proposal, proposal number identifying the proposal number for the current payload, Proto_ISAKMP specifying the identifier of the protocol for the current negotiation, SPI length defined by the protocol ID, number of translations for the proposal A suggestion payload comprising an SPI field of a number translation and transmission entity specifying a; And The security number attribute that defines the translation number that identifies the translation number for the current payload, the translation ID that specifies the translation identifier for the protocol in the current proposal, the DSCP, the subscriber service class of the reserved fields, and the translation given for the translation ID field. A transform payload comprising; Virtual private network service processing method for providing a differentiated service comprising a. The method of claim 1, The second step, During the IKE SA and IPSec SA negotiations, the service class information is extracted from the encryption algorithm, hash algorithm, authentication method, Diffie-Hellman's key distribution information, and subscriber service class information. Virtual private network service processing method for providing a differentiated service, characterized in that by setting and transmitting the packet. The method of claim 1, The third step, A sub-step of determining whether an input packet has resources consumed by measuring a flow rate and a burst size, which are input traffics; A sub-step of shaping to slow down the processing speed when the burst data is included to send a stream according to the traffic profile as a result of the determination; And Performing a dropping function of discarding one or more packets in the flow when the flow exceeds the set rate or threshold as a result of the determination; Virtual private network service processing method for providing a differentiated service comprising a.