KR20050102892A - Communication system capable of using multiple internet protocol address and method thereof - Google Patents

Abstract

The present invention relates to a communication system for communicating with the outside using a plurality of IP addresses. The communication system includes an IP address storage unit for storing and managing at least one currently available IP address, and a socket for setting and managing a socket for communicating with the outside in accordance with a request of a higher application of the communication system. And an IP address management unit for interworking with the socket management unit and associating with the IP address of the IP address storage unit for a specific socket and storing and managing the IP address and association information with the socket. Allow different IP addresses to be used depending on the socket or application being implemented.

According to the present invention, the IP address can be changed for each application, for each socket, for each packet to be transmitted to the socket, or for a predetermined time, thereby preventing the IP address from being exposed to the outside. Can be secured.

Description

COMMUNICATION SYSTEM CAPABLE OF USING MULTIPLE INTERNET PROTOCOL ADDRESS AND METHOD THEREOF}

The present invention relates to a communication system for communicating with an external network based on an Internet protocol, and more particularly, to communicate with an external network using a plurality of IP (Internet Protocol) addresses in one communication system. It relates to a communication system that allows.

The Internet is a network of networks using the Transmission Control Protocol / Internet Protocol (TCP / IP) developed by the US Department of Defense. It is a network of thousands of networks and millions of hosts worldwide. It was initially used as an academic and research network connecting schools, research institutes, etc., and recently expanded to commercial networks. Meanwhile, the Internet Protocol (hereinafter referred to as 'IP') is the world's most popular open system protocol. This is advantageous for communicating between interconnected networks and is suitable for LAN and WAN environments. IP consists of a combination of communication protocols. Transmission control protocol (TCP) and Internet protocol (IP) are typical.

The Internet Protocol (IP) is a network layer protocol corresponding to the third layer of the OSI layer and includes addressing information and some control information for routing packets. This IP plays two roles: one is to transmit data seamlessly over the network without disconnection, and the other is to connect data of different Maximum Transmission Unit (MTU) sizes. It is to perform data decomposition and combination to support.

As such, IP is a protocol used to send data from one computer to another on the Internet. Hereinafter, the process of transmitting data on the Internet will be briefly described. First, each computer on the Internet, or host, has a unique address, an IP address, to distinguish it from other computers. When a user sends or receives data such as an e-mail or a web page, the message is broken into small pieces called packets. Each of these packets contains the sender's Internet address and the receiver's Internet address. Any packet can be sent to the gateway computer first. The gateway computer reads the destination address and sends the packet to a nearby gateway. In turn, the gateways continue to forward the packet, repeating the reading of the destination address until the gateway in the immediate vicinity of the computer to which the packet belongs or in its domain receives it. When a gateway in the domain receives the packet, it forwards it directly to the computer at the address listed in the packet.

On the other hand, the most widely used IP version at present is version 4, commonly referred to as IPv4 (IP version 4). Since IPv4 has 32 bits assigned to the IP address, there are 2 ³² available. However, as the Internet has recently become an information and communication infrastructure in the information society, the number of users has increased rapidly, and as a result, the IPv6 address shortage has intensified. More than 70% of the theoretical total of IPv4's 4.3 billion addresses in August 2002 have already been allocated to each region, and IPv4 addresses are expected to be depleted globally between 2005 and 2006.

In order to solve this problem, the IETF formed an IP Next Generation (IPng) working group, which has been standardized since 1994 with the aim of developing a new protocol. As a result of this activity, the IPv6 protocol was developed. . IPv6 alleviates the shortage of IP addresses by allocating 128 bits to the IP address. On the other hand, IPv6 not only solved the shortage of IP addresses, but also added security functions and simplified IP headers.

When IPv6 was officially proposed as the next generation IP, in 1994, due to the problem of replacing all the routers for data transmission in the TCP / IP Internet network with a model supporting IPv6, it has not been used yet. However, modern Windows 2000 / XP and Linux operating systems already have built-in support for IPv6. In addition, as interest in IPv6 increases, new technologies such as security technologies based on IPv6, services based on IPv6, and mobile communication protocols based on IPv6 are introduced. Therefore, it is expected to change from the IPv4 system to the IPv6 system soon.

By the way, although the above-described TCP / IP network protocol structure guarantees interworking providing heterogeneous efficient interconnection to information resources around the world, there are various security problems due to the open source of UNIX system and communication utility. Therefore, the situation of damage by intruders continues to increase.

Examples of damage to the system or network of the Internet sign-up agency include not only the use of network intrusion through Telnet, but also various illegal activities on the system after the intrusion and the distribution of illegal programs such as the Internet Worm. Is being reported. The ways to prevent and prevent such violations hierarchically by type are being researched, and the development of practical security tools for the corresponding layers, security policies against security incidents, development of network applications that provide various security services, etc. Research and development is active in many fields.

In particular, data transmission currently performed between applications in the Internet is performed using one initially allocated IP address. Thus, third parties who are not users communicating with each other can know in any way the IP address used by a particular application or the IP address used by a user. By using these characteristics, the data of the user may be intermittently monitored or misused for other purposes. In order to solve the security problems of such communication, defense is applied by applying security policies or additional programs according to Internet security protocols, users, or applications. In many cases, the data cannot be protected, and in many cases, the security method cannot be effective unless it is continuously supplemented or modified.

In order to prevent an attack or hacking caused by the exposure of the IP address described above, the present invention makes it possible to allocate and use a plurality of IP addresses for a single device which is one communication system. It is an object of the present invention to provide a communication system that enables the use of independent addresses for an application or connection.

Another object of the present invention is to provide a communication system capable of periodically changing and assigning an IP address to a packet communicating with an external network at predetermined time intervals.

A feature of the present invention for achieving the above-described technical problem relates to a communication system for communicating with the outside based on the Internet protocol, the IP address storage unit for storing and managing at least one IP address currently available, and A socket management unit for setting and managing a socket for communicating with the outside according to a request of a higher application of a communication system, and interworking with the socket management unit to associate a specific socket with an IP address of the IP address storage unit; An IP address management unit for storing and managing an IP address and association information with the socket is provided so that different IP addresses can be used depending on the socket for communicating with the outside.

The communication system according to another aspect of the present invention further includes an IP address connection management unit, and the IP address connection management unit is interlocked with the socket management unit so that the corresponding application is terminated or the predetermined time elapses. The corresponding IP address of the address storage unit and the related information of the IP address manager are deleted.

The communication system according to another aspect of the present invention further includes a duplicate address checking unit, wherein the duplicate address checking unit checks whether IP addresses stored in the IP address storage unit are duplicated with IP addresses of other devices in the network.

The communication system according to another aspect of the present invention further includes a traffic management unit, and when the traffic is received from an external network, the IP corresponding to the destination of the traffic by using the associated information of the IP address management unit. It is determined whether an address is associated with the IP address management unit, and if not, delete the traffic.

The communication system according to another aspect of the present invention further includes an NDP processing unit, and the neighbor discovery protocol (NDP) processing unit performs a process for determining whether an external IP address is accessible.

According to the present invention, the IP address can be changed for each socket, for each packet to be transmitted to the socket, or for a predetermined time unit, thereby preventing the IP address from being exposed to the outside. As a result, the security of the system or the terminal can be prevented. I can keep it.

Hereinafter, the configuration and operation of a communication system according to a preferred embodiment of the present invention will be described in detail. First, a method of generating an IP address that can be used in an IPv6-based network will be described.

The first method uses the Dynamic Host Configuration Protocol (DHCP). DHCP basically manages TCP / IP settings automatically and gives individual systems IP address-related configuration information. It consists of a DHCP client and a DHCP server. Looking at the process of assigning an IP address using DHCP, DHCP clients first ask the DHCP server for an IP address for their system when the system starts up. The DHCP server maintains and manages the scope of the assignable IP address, and allocates a specific IP address in response to an IP address rental request from the DHCP client. When an IP address is borrowed from a DHCP server, the TCP / IP settings can be initialized and communicated with other hosts using the TCP / IP protocol. As such, the method of using DHCP continues to use the address assigned most of the time unless the corresponding user terminal or network interface is initialized.

The second method relates to a method of generating an IP address in the user terminal itself. The user terminal generates an IP address by combining the prefix information periodically transmitted from the network, and its interface address information or an arbitrary value. The IP address generated by this method is in the form of "prefix information for the network + interface address information" or "prefix information for the network + any value". Here, the prefix information is information for identifying a network and may be changed according to a network, and generally has a size of 64 bits. In addition, the interface address information of the user terminal may use the MAC address assigned to the device of the user terminal, the MAC address is information that does not change unless the user changes the device for wireless or Internet access.

Hereinafter, a communication system and a communication method capable of using a temporary IP address according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 1, the communication system according to the present invention includes an IP address storage unit 100, a duplicate address checking unit 140, an IP address management unit 130, a socket management unit 110, a connection management unit 120, and a traffic management unit ( 160, an NDP processing unit 150. An example of such a communication system is a wired / wireless terminal capable of communicating based on TCP / IP. Hereinafter, the operation of each component of the communication system according to the present invention will be described in detail.

The IP address storage unit 100 corresponds to an IP address pool that holds and manages a plurality of IP addresses that can be used by the communication system. The IP addresses held and managed in the IP address storage unit receive and manage IP addresses generated in a network or are generated and managed in a communication system itself. An example of a method of receiving an IP address generated in a network as described above is to use a DHCP server, and a schematic process thereof is as follows. First, the communication system requests a lease of an IP address from a DHCP server, and the DHCP server leases a specific IP address in response to the request. In this case, when the communication system requests the lease of the IP address from the DHCP server, the communication system may change the identification information thereof sequentially and request at least one or more IP addresses by requesting the DHCP server several times. Through this process, the communication system receives a plurality of IP addresses from a DHCP server and stores and manages the IP address storage unit.

Meanwhile, a method of generating an IP address in a communication system generates a combination of prefix information received periodically from a network and its own interface address information. A plurality of IP addresses may be generated by variously changing and combining interface address information. It can be created.

Next, the duplicate address checking unit 140 performs duplication address detection on the IP addresses in order to actually use the IP addresses generated by the above-described method and retained and managed in the IP address storage unit 100. ). Such duplicate address checking is performed as defined in the IPv6 specification. Since the IP address already used by another device cannot be used, uniqueness check is performed on the pre-generated IP addresses. The duplicate address checker broadcasts the generated IP addresses, and receives a response message from other devices in the network, thereby determining uniqueness of the IP address. Through this process, if it is determined that the generated IP address is a duplicate IP address, it is deleted from the IP address storage unit.

Meanwhile, the socket manager 110 sets a socket for performing a connection to the outside of the communication system in order to transmit or receive data by an upper application.

Next, when the socket manager performs an external connection by an upper application, the IP address manager 130 associates one of the currently available IP addresses of the IP address storage with the socket so that communication is performed. Make it possible. In addition, the IP address management unit stores and manages association information with the IP address and the socket. Therefore, the communication system according to the present invention can communicate with the outside using different IP addresses depending on the type of application or the socket. On the other hand, in another embodiment of the present invention, different IP addresses may be given for each packet.

In another embodiment of the present invention, the IP address management unit associates one IP address with respect to the socket, and after a predetermined time elapses, may be changed to another IP address of the IP address storage unit. As a result, since the IP address is continuously changed for one socket, it is possible to prevent packet monitoring or hacking from the outside.

Next, the IP connection management unit 120 interoperates with the socket management unit, and after the corresponding application is terminated or after a predetermined time, by deleting the corresponding information of the IP address and the IP address management unit of the IP address storage unit, Do not use an IP address anymore.

Next, when traffic is received from the outside, the traffic manager 160 determines whether an IP address corresponding to a destination of the received traffic is associated with the IP address manager, and if so, processes the traffic. Otherwise, drop the traffic. Accordingly, the communication system according to the present invention processes only traffic in which an IP address corresponding to a destination is associated with the IP address management unit. As a result, if the association information is deleted by the IP connection manager after a certain time has elapsed, the corresponding traffic is also deleted.

Next, the neighbor discovery protocol (NDP) processing unit performs a response and processing on the NDP in order to determine whether access to a network interface is possible using a specific IP address from the outside.

The IP address according to the present invention may be used not only for the IPv6 standard but also for the IPv4 standard.

Although the present invention has been described above with reference to preferred embodiments thereof, this is merely an example and is not intended to limit the present invention, and those skilled in the art do not depart from the essential characteristics of the present invention. It will be appreciated that various modifications and applications which are not illustrated above in the scope are possible. For example, in the embodiment of the present invention, a method of generating an IP address, a form of an IP address, and the like may be variously modified to increase the efficiency of the network and to enhance security. And differences relating to such modifications and applications should be construed as being included in the scope of the invention defined in the appended claims.

According to the present invention, by using a different IP address whenever the communication system is connected to the outside, for each user's data, or according to the type of the upper application (Application), there is a security risk due to the exposure of the IP address Can be reduced significantly.

In addition, according to the present invention, it is possible to continuously change IP addresses to different values according to types of packets or applications or at regular intervals, and as a result, it is possible to fundamentally block illegal access from the outside. do.

In addition, the present invention enables to significantly increase the security effect for security-related applications and procedures currently used in the Internet environment.

1 is a block diagram illustrating a communication system according to a preferred embodiment of the present invention.

<Explanation of symbols for main parts of the drawings>

100: IP address storage unit

110: socket management unit

120: IP connection management unit

130: IP address management unit

140: duplicate address checker

150: NDP processing unit

160: traffic management unit

Claims (9)

In the communication system to communicate with the outside based on the Internet protocol, An IP address storage unit for storing and managing at least one or more currently available IP addresses; A socket manager for setting and managing a socket for communicating with the outside in response to a request of a higher application of the communication system; An IP address management unit interworking with the socket management unit to associate a specific socket with an IP address of the IP address storage unit, and store and manage the IP address and association information with the socket; And a different IP address according to a socket for performing communication with the outside. The communication system of claim 1, wherein the communication system further includes an IP address connection manager, wherein the IP address connection manager is linked with the socket manager to stop the corresponding application or to pass the predetermined time. And a corresponding IP address of the address storage unit and corresponding information of the IP address manager. The communication system of claim 1, further comprising a duplicate address checker, wherein the duplicated address checker checks whether IP addresses stored in the IP address storage unit overlap with IP addresses of other devices in a network. Communication system. According to claim 1, The communication system further comprises a traffic management unit, When the traffic is received from the external network, the IP address corresponding to the destination of the traffic using the associated information of the IP address management unit Determines whether is associated with the IP address management unit, and if not, deletes the traffic. The communication system of claim 1, wherein the communication system further comprises an NDP processing unit, and the neighbor discovery protocol processing unit performs a process for determining whether a specific IP address is accessible from the outside. The communication system according to any one of claims 1 to 5, wherein the IP address includes both an IPv6 standard and an IP address according to the IPv4 standard. According to any one of claims 1 to 5, wherein the IP address storage unit combines the prefix information transmitted from the network and its interface address information to generate an IP address, a plurality of IP by changing the interface address information A communication system for generating an address. The communication system according to any one of claims 1 to 6, wherein the IP address storage unit receives a plurality of IP addresses from a DHCP server using a dynamic host configuration protocol. The method according to any one of claims 1 to 5, wherein the IP address management unit periodically changes the IP address for each packet transmitted through the socket, and stores the IP address and association information with the packet. Communication system characterized in that for managing.