KR20040046633A - METHOD FOR SECURING PAEKETS IN IPv6 LAYER - Google Patents

Abstract

PURPOSE: A method for protecting a packet in an IPv6 layer is provided to execute multiple security services according to each packet in an IPv6 layer that is independently realized without influencing on an application layer service program on a next generation Internet, thereby supplying an information protection function to all next generation Internet services. CONSTITUTION: A system generates an IPv6 header and an extension header of a packet to be transmitted, and determines whether to select security services according to each packet in reference to a security policy database and a security connection database. The system identifies whether a security service kind is an AH(Authentication Header) or an ESP(Encapsulating Security Payload), and processes an IPv6 packet according to each service kind. The system generates a transport header, and carries out the step of identifying the security service kind before an IPv6 packet fragmentation function. The system repeats the step of generating the IPv6 header and the extension header and the step of generating the transport header, and supplies multiple security services.

Description

Packet protection method in IPv6 layer {METHOD FOR SECURING PAEKETS IN IPv6 LAYER}

The present invention relates to a packet protection method in the IPv6 layer, and more particularly, to a method for protecting a packet in the IP layer (Internet Protocol layer) to provide multiple security services in the Next Generation Internet (Next Generation Internet). .

Conventionally, Internet information is protected by using methods for protecting information for each service of an application layer.

In the conventional Internet information protection methods, information protection methods exist for each Internet service, and in order to provide information protection in an Internet service, a change of an application layer service program is necessary. Therefore, it not only incurs a lot of economic expenditures for users and Internet service providers, but also requires an independent information protection method for each application layer service, and requires an additional change of each application layer service program. Doing. Furthermore, this problem is further magnified in the next generation Internet where the network is expanded and services are diversified.

The present invention has been made to solve the above-mentioned shortcomings, and in the IPv6 layer that can perform multiple security services per packet in the IPv6 layer that can be independently implemented and operated without affecting the application layer service program in the next generation Internet. The purpose is to provide a packet protection method.

In order to achieve the above object, the present invention provides a packet protection method in a packet protection system in an IPv6 layer including a security policy database and a security association database, and after generating an IPv6 header and an extended header of a packet to be transmitted, A first step of determining whether to select a packet-specific security service by referring to a security policy database and the security association database; Distinguishing whether the type of the security service is AH or ESP, and performing processing related to encapsulation, padding, encryption, ICV calculation, and generation of SN values for IPv6 packets according to the type of service, respectively. Two steps; A third step of generating a transport header to perform the second step before the IPv6 packet fragmentation function; And a fourth step of repeatedly performing the first step and the third step to provide multiple security services.

In a packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, after generating an IPv6 header and an extension header of a packet to be transmitted, the security policy database and the security association database will be referred to. A first step of determining whether to select a packet-based security service; A second step of classifying whether the type of security service is AH or ESP and performing encapsulation, padding, encryption processing, ICV calculation, and generation of SN values for IPv6 packets according to types of services; A third step of generating a tunnel header to perform the second step after the IPv6 packet fragmentation function and transferring to the IPv6 packet fragmentation process; And a fourth step of repeatedly performing the first step and the third step to provide multiple security services.

In a packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, the packet reception is performed after recombination of the received IPv6 packet and reception of the completed IPv6 packet. A first step of determining whether to select a packet-specific security service with reference to; A second step of examining SN and ICV values carried in the packet header; A third step of classifying whether the type of security service is AH or ESP and referring to the packet decryption, padding removal, decapsulation, and the security policy database according to the type of service, respectively; A fourth step of removing the transport header and performing the third step after IPv6 packet recombination; A fifth step of repeating the first to fourth steps when there are multiple applied security services; And a sixth step of delivering the packet back to the IPv6 header removal function.

In a packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, the packet reception is performed after recombination of the received IPv6 packet and reception of the completed IPv6 packet. A first step of determining whether to select a packet-specific security service with reference to; A second step of examining SN and ICV values carried in the packet header; A third step of classifying whether the type of security service is AH or ESP and referring to the packet decryption, padding removal, decapsulation, and the security policy database according to the type of service, respectively; A fourth step of removing the tunnel header and performing the third step prior to IPv6 packet recombination; A fifth step of repeating the first to fourth steps when there are multiple applied security services; And a sixth step of delivering the packet back to the IPv6 header removal function.

1 is a diagram illustrating a difference between a protocol stack for packet protection in an IPv6 layer and a protocol stack according to the prior art according to the present invention;

2 is a block diagram of an IP packet to which the IPsecv6 function is added for providing information protection service for each IPv6 packet;

3 is a flowchart illustrating a processing procedure for an output IP packet for providing an information protection service for each IPv6 packet;

4 is a flowchart showing step by step a processing procedure for an input IPv6 packet provided with an information security service.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a difference between a protocol stack for packet protection in the IPv6 layer and a protocol stack according to the prior art according to the present invention.

FIG. 1A is a protocol stack of a conventional next generation Internet system, and shows a vertical connection to an upper layer network applications program and a lower layer media layer.

In FIG. 1A, a user's application program communicates with another system through a BSD socket and an INET socket layer of a system kernel, and transmits a control protocol version 6 (TCPv6) and a user datagram protocol version 6 (UDPv6) for each network protocol. ), Internet Control Messages Protocol Version 6 (ICMPv6), and Internet Group Multicasting Protocol Version 6 (IGMPv6) protocol processing modules, all of which cross the IPv6 layer to create IPv6 packets, the basic unit of communication for the next generation of the Internet. .

The IPv6 packet is an additional network to the IPv6 packet as it passes network device driver layers such as Point-to-Point Protocol (PPP), Serial Line Interface Protocol (SLIP), and Ethernet according to data link layer protocol characteristics. After adding the headers, they are exported to the Internet.

On the other hand, in the packet protection method in the IPv6 layer for providing multiple security services according to the present invention, in order to provide an information protection service for each packet in the IPv6 layer that can be independently implemented and operated without affecting the application layer service program As shown in FIG. 1B, an IPsec layer is added to a part of the IPv6 layer.

The IPsec layer has a function of applying and releasing security services to all packets passing through the IPv6 layer. Packets received from the lower layer are processed by the function to release the security service, and then the necessary processing is performed in the existing IPv6 layer, and packets received from the IPv6 layer from the upper layer are changed by the function of applying the security service. It is then forwarded to the data link layer.

2 is a configuration diagram of an IP packet to which an IPsecv6 function is added for providing an IPv6 packet-based information protection service.

That is, FIGS. 2A to 2F illustrate packet modification for a security service to be applied in the IPsec layer, and are divided into an authentication header (AH) and an encapsulating security payload (ESP) protocol according to the type of service. The AH protocol provides authentication services for IPv6 packets, and the ESP protocol encrypts IPv6 packets to provide both confidentiality of packet contents and authentication services for higher datagrams.

The two protocols have a transport mode for providing only basic services such as an authentication service for IPv6 packets and a confidentiality service for IPv6 upper payloads, and a tunnel that hides the source / destination information of the packet by hiding information in the IPv6 header. There is a mode.

In addition, both protocols use a Sequence Number (SN) value for endurance service for retransmission attacks, and by retrieving the SN value for packets continuously received at the receiving end, discarding the retransmitted packets to be stable from retransmission attacks. Maintain the system.

The security service as described above may be applied multiplely according to a security policy database. For example, the transport AH protocol, the transport ESP protocol, the tunnel AH protocol, and the tunnel ESP protocol may be combined with each other to provide a security service. However, if AH and ESP are applied simultaneously in the same mode, ESP should be applied first and AH applied later to eliminate security weakness.

Therefore, 15 security services can be applied to one IP packet. For example, transport AH, transport ESP, tunnel AH, tunnel ESP, transport ESP + transport AH, tunnel ESP + tunnel AH, transport AH + tunnel AH, transport AH + tunnel ESP, transport AH + tunnel ESP + tunnel AH, transport ESP + Tunnel AH, Transport ESP + Tunnel ESP, Transport ESP + Tunnel ESP + Tunnel AH, Transport ESP + Transport AH + Tunnel AH, Transport ESP + Transport AH + Tunnel AH, Transport ESP + Transport AH + Tunnel ESP, Transport ESP + Transport AH + Tunnel ESP + Tunnel AH.

For reference, FIG. 2A shows an example of a packet in which AH transport and tunnel mode services are added to an existing IPv6 header, and FIG. 2B shows an example in which ESP transport and tunnel mode services are added to an existing IPv6 header. 2c shows an example in which the AH and ESP protocols are simultaneously applied in the transport mode and an example in which the AH and ESP protocols are simultaneously applied in the tunnel mode, and FIG. 2d is a tunnel mode in which the AH and ESP protocols are applied in the transport mode. Shows an example where both AH and ESP protocols are applied. FIG. 2E shows the structure of the AH protocol header, and FIG. 2F shows the structure of the ESP protocol header.

Herein, the header of the AH protocol includes a header type that appears after the AH header, a payload length, a security parameter index (SPI) that uniquely identifies a security association database, and a sequence number (SN) for tolerance to retransmission attacks. It consists of authentication data ICV (Integrity Check Value) for verification of data tampering.

The ESP protocol header appears after the SPI identifying the security association database, the SN for tolerability of retransmission attacks, the payload data from the upper layer, the padding for encryption processing by the block cipher algorithm, the padding length, and the ESP header. It consists of a header type and authentication data ICV.

3 is a flowchart illustrating a processing procedure for an output IP packet for providing an IPv6 packet information protection service step by step. The packet transmission function of a next generation Internet host / gateway system is performed as follows.

When sending arbitrary information from the parent application to a system with an IPv6 address over the Internet, create a socket for communication at the socket layer, create an INET6 socket, and send the data from the application layer to the TCPv6 layer through this socket. .

In the TCPv6 layer, the TCP header is added to the message from the upper application layer and then sent down to the IPv6 layer.

The IPv6 layer assembles an IPv6 packet by adding an IP header to data descended from the TCPv6 layer, and adds an extension header.

After the packets of the IPv6 layer are assembled, the security policy database and the security association database are searched to check whether a security service is selected, and when the security service is not selected, the packet is sent down to the data link layer. After generating a frame with a data link header according to the transmission path characteristics of the layer, the frame is transmitted to the Internet.

On the other hand, when the security service is selected, the type of security service of the security association database is identified.

If the security service is in the transport mode, the security service is applied before fragmentation of the existing IPv6 packet occurs, and in the tunnel mode, the security service is applied after the fragmentation of the existing IPv6 packet occurs. In tunnel mode, additional IPv6 packet fragmentation is performed if necessary.

If AH service is selected, authentication data (ICV: Integrity Check Value) is calculated to compare the original value with the authentication data at the packet destination, and SN value is generated by generating SN value to prevent retransmission attack. After adding the transport or tunnel header to the IPv6 packet, the packet fragmentation process is used to change the payload length in the IP header and then send it down to the data link layer. According to the characteristics of the transmission path, a frame added with a data link header is generated and transmitted to the Internet.

When the ESP service is selected, after encapsulation of the packet is performed, padding is performed after padding so that the length of data can be applied to the block encryption algorithm. After packet encryption is completed, the authentication data (ICV: Integrity Check Value) is calculated to calculate the authentication data at the packet destination and compared with the original value, and the SN value is generated within the ESP header to prevent retransmission attacks. After adding the transport or tunnel header to the IPv6 packet, the packet fragmentation process changes the payload length in the IP header and sends it down to the data link layer. According to the characteristics, a frame added with a data link header is generated and transmitted to the Internet.

If one security service is applied and additional security service is needed, repeat the above process.

4 is a flowchart illustrating a step-by-step procedure for processing an input IPv6 packet provided with an information protection service. The packet reception function of the next generation Internet host / gateway system is performed as follows.

After transmitting a frame from the next-generation Internet, the data link header is removed from the data link layer and then sent to the IPv6 layer. The received IPv6 packet is assembled through a packet recombination process of the IPv6 layer into a packet and then delivered to the IPv6 layer packet reception function. The assembled IPv6 packet searches the security association database to check if the security service is selected, and if the security service is not selected, removes the IPv6 header and then uploads it to the TCPv6 layer.In the TCPv6 layer, the INET6 socket To the upper application layer through the communication socket.

On the other hand, if the security service is selected, if the security service of the received IP packet is in tunnel mode, the security association database is searched before the packet recombination process is processed, and if it is transport mode, the security service is released after packet recombination. Process.

First, the SN value is checked to identify the type of security service in the security association database, and the possibility of packet retransmission attack. The authentication data is generated using the contents of the received packet and then compared with the ICV value in the AH or ESP header.

If AH service is selected, it checks the security policy database to check whether the currently received packet was processed according to the security policy, removes the IPv6 header and uploads it to the TCPv6 layer, removes the TCP header at the TCPv6 layer, and then opens the INET6 socket and communication socket. Through the upper application layer.

When the ESP service is selected, the packet is decrypted, the padding added for the block cipher algorithm processing is removed, and the packet is decapsulated.

As such, after decrypting the encrypted packet, the packet is played back before the encryption. After checking that the currently received packet is processed according to the security policy, the IPv6 header is removed and sent to the TCPv6 layer. In the TCP layer, the TCP header is removed and transmitted to the upper application layer through INET6 socket and communication socket.

If multiple security services are applied, repeat the above process.

As described above, the present invention can selectively provide an information security service in the process of transforming a message generated from a higher application layer into an IPv6 packet that can be transmitted through the next generation Internet, and can provide multiple security services. have. Therefore, it is possible to provide an information protection function to all next-generation Internet services without changing the upper layer service program. In addition, it is possible not only to process general IPv6 packet which does not need information protection service, but also existing next-generation Internet users do not feel any change in the use of Internet service, and compared to conventional IPv4 layer packet protection method, next-generation Internet One or more security services can be applied to packets of an IPv6 layer.

Claims (6)

A packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, A first step of generating an IPv6 header and an extended header of a packet to be transmitted and determining whether to select a packet-specific security service by referring to the security policy database and the security association database; A second step of classifying whether the type of security service is AH or ESP and processing IPv6 packets according to types of services; A third step of generating a transport header to perform the second step before the IPv6 packet fragmentation function; And And a fourth step of repeating the first step and the third step to provide multiple security services. A packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, A first step of generating an IPv6 header and an extended header of a packet to be transmitted and determining whether to select a packet-specific security service by referring to the security policy database and the security association database; A second step of classifying whether the type of security service is AH or ESP and processing IPv6 packets according to types of services; A third step of generating a tunnel header to perform the second step after the IPv6 packet fragmentation function and transferring to the IPv6 packet fragmentation process; And And a fourth step of repeating the first step and the third step to provide multiple security services. The method of claim 1, wherein the second step distinguishes whether the type of security service is AH or ESP, and encapsulates, pads, and encrypts an IPv6 packet according to the type of service. A process for protecting transmission packets in an IPv6 layer, characterized by performing processing relating to processing, ICV calculation, and generation of SN values. A packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, Receiving the packet is a first step of recombining the received IPv6 packet, and after receiving the completed IPv6 packet to determine whether to select a security service for each packet by referring to the security association database; A second step of examining SN and ICV values carried in the packet header; A third step of identifying whether the type of security service is AH or ESP and referring to each type of service; A fourth step of removing the transport header and performing the third step after IPv6 packet recombination; A fifth step of repeating the first to fourth steps when there are multiple applied security services; And And a sixth step of forwarding the packet back to the IPv6 header removal function. A packet protection method in a packet protection system at an IPv6 layer having a security policy database and a security association database, Receiving the packet is a first step of recombining the received IPv6 packet, and after receiving the completed IPv6 packet to determine whether to select a security service for each packet by referring to the security association database; A second step of examining SN and ICV values carried in the packet header; A third step of identifying whether the type of security service is AH or ESP and referring to each type of service; A fourth step of removing the tunnel header and performing the third step prior to IPv6 packet recombination; A fifth step of repeating the first to fourth steps when there are multiple applied security services; And And a sixth step of forwarding the packet back to the IPv6 header removal function. The method of claim 4, wherein the third step is to distinguish whether the type of security service is AH or ESP, and to decode, remove padding, decapsulation, and packet according to the type of service, respectively. Receiving packet protection method in the IPv6 layer, characterized in that referring to the security policy database.