KR20080080797A - Method and apparatus for securiting in packet switched domain - Google Patents

Abstract

A security method and an apparatus of a packet switched domain are provided to reduce the possibility of an error in a state transition between IPSec(Internet Protocol Security Protocol) processing units by easily processing the state transition without generating a delay due to frequent updating of dynamic state information. A second IPSec processing unit sets an error occurrence number(410). The second IPSec processing unit determines whether or not the first IPSec processing unit in an active state has an error(430). If the first IPSec processing unit has an error, the second IPSec processing unit transitions to an active state(450). The second IPSec processing unit generates an SN to be first used after state transition by multiplying a predetermined constant to be larger than an SN of a previously transmittable IPSec packet to the pre-set error occurrence number(470). The second IPSec processing unit generates a header by using the generated SN, and transmits an IPSec packet including the header to an IPSec packet receiving device(490).

Description

METHOD AND APPARATUS FOR SECURITING IN PACKET SWITCHED DOMAIN}

1 is a diagram illustrating a method of receiving an IPSec packet using an SN and a window in a packet switched domain;

2 is a block diagram showing an IPSec duplication apparatus according to an embodiment of the present invention;

3 is a diagram illustrating a method of generating and applying an SN to a window by the first and second IPSec processing units of FIG. 2;

4 is a flowchart illustrating a duplication method of IPSec according to an embodiment of the present invention.

The present invention relates to a security method and apparatus in a packet switched domain, and more particularly, to a security method using an Internet Protocol Security Protocol ("IPsec") to prevent a reply attack in a packet switched domain. Relates to a device.

In the packet switched domain, a network node such as a proxy-call session control function ("P-CSCF") and a plurality of user equipments ("UE") are provided to provide multimedia services. The security connection is established between them. In general, the Internet Multimedia Subsystem (“IMS”) is configured as an overlay to the packet switched domain and has a low dependency on the packet switched domain. As a result, a separate secure connection between the UE and the P-CSCF is required before accessing the multimedia service.

Security between the UE and the network node may be implemented using IPSec at the packet processing layer of the network or network communication according to the required secure connection.

The IPSec includes an Authentication Header (AH) protocol and an Encapsulating Security Payload (ESP) protocol. The AH protocol supports integrity and redundancy to prevent data source authentication and replay attacks. Here, the replay attack refers to an attack in which an intruder attempts to bring down the system by increasing the burden of IPSec processing by taking an IPSec packet, copying the same information, and transmitting the same information to a UE or a network node. The AH protocol provides a variety of defenses against intruder replay attacks. The ESP protocol provides data confidentiality, which includes all the functionality of the AH protocol to prevent attacks on encrypted but unauthenticated data streams.

Hereinafter, a method for preventing a replay attack that may include fake or destructive data by using IPSec duplication processing in a separate secure connection between the conventional UE and the P-CSCF will be described.

Conventional UEs and P-CSCFs include an active IPSec processing unit for processing IPSec to prevent a replay attack, and a backup IPSec processing unit for processing IPSec when the active IPSec processing unit fails.

The backup IPSec processing unit performs IPSec-related state backup in advance, and when the active IPSec processing unit is not operated, the backup IPSec processing unit is active by using the previously performed IPSec-related state backup. At this time, the active IPSec processing unit changes the dynamic state information (sequence number (SN)), anti-playback window (hereinafter, "window") information every time the IPSec packet is transmitted between the UE and the P-CSCF. In order to cope with a failover, the changed dynamic state information should be continuously backed up to the backup IPSec processing unit. For example, if 1 million subscribers remain stateful through one active IPSec processing unit and an average of 4BHCA (Busy Hour Call Attempts) calls are attempted, 33,000 messages per million (1 million subscribers * 4 BHCA) * 30 messages (messages per call) / 3600 seconds = 33,333 messages / second) are generated.

However, backing up dynamic state information for every such message can consume more system resources such as central processing unit and memory due to high frequency backups, and increase the probability of error if delays caused by frequent updates occur. Had a problem.

The present invention provides a security method and apparatus capable of processing redundancy without performing dynamic state information update during IPSec redundancy processing.

The security method performed by the second IPSec processing unit in the backup state of the packet switched domain according to the present invention may determine whether a failure of the first Internet Protocol Security Protocol (IPSec) processing unit in the active state occurs. When the failure occurs, the second IPSec processing unit transitions to the active state after setting the number of failure occurrences by multiplying a predetermined constant by the predetermined number of occurrences of the failure. Generating a sequence number for first use after switching to a state; generating a header by using the generated sequence number in the second IPSec processing unit, and then transmitting an IPSec packet including the header; .

In addition, the security apparatus of a packet switched domain according to the present invention generates a header using a sequence number in an active state, and then transmits an Internet Protocol Security Protocol (“IPsec”) packet including the header. In the backup state of the first IPSec processing unit and the backup state, the first IPSec processing unit determines whether or not the failure occurs, when the failure occurs, the number of failure occurrences after the transition to the active state, and a predetermined constant predetermined in advance to the set number of failures And a second IPSec processing unit for generating a sequence number for first use by multiplying with, generating the header using the generated sequence number, and then transmitting the IPSec packet including the header.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, and may be changed according to intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification.

The main subject of the present invention is to handle redundancy without updating dynamic state information in IPSec redundancy processing. The dynamic state information includes an SN and an anti-playback window (hereinafter, referred to as a "window").

First, a method of receiving an IPSec packet from a UE or a network node (for example, P-CSCF) using SN and a window, which is dynamic state information, in order to prevent a replay attack in IPSec, will be described with reference to FIG. 1.

1 is a diagram illustrating a method of receiving an IPSec packet using an SN and a window in a packet switched domain. In FIG. 1, the receiving apparatus is a P-CSCF when the UE transmits an IPSec packet, and a UE when the P-CSCF transmits an IPSec packet. Accordingly, hereinafter, the receiver will be described as a UE or a P-CSCF, and the transmitter will be a P-CSCF or a UE.

In FIG. 1, a window 100 for preventing a replay attack is defined as the highest SN and a fixed window size W among SNs of normally received IPSec packets. If the highest SN is N, the window 100 has a range of [N-W + 1] to [N]. The window 100 is managed by the receiving apparatus in the form of a Boolean array representing 1s and 0s of normally received IPSec packets and unreceived IPSec packets within a fixed window size (W). After setting the window 100, the receiving apparatus distinguishes the normal IPSec packet by marking the SN of the normally received IPSec packet within the disposition of the window 100.

If the SN of the received IPSec packet is less than or equal to [N-W] which is the SN of the previous packet of the window 100, the received IPSec packet is dropped. When the SN of the received IPSec packet is in the window 100, that is, from [N-W + 1] to [N], the SN of the received IPSec packet is indicated in a Boolean array. At this time, if the SN of the received IPSec packet is already marked as '1' in the array, the receiver determines that the received IPSec packet is for a replay attack and discards it. If the SN of the received IPSec packet is equal to or larger than [N + 1], the receiving apparatus shifts the window 100 to the SN of the received IPSec packet so that the received IPSec packet can be included in the window 100. (Shift)

That is, after generating a header by generating a SN in the transmitting device and transmitting the IPSec packet including the header to the receiving device, the receiving device checks the SN of the received IPSec packet to determine whether there is a previously received record. If there is a record previously received, only the normal packet is received by discarding the received IPSec packets.

Since the receiving apparatus does not limit the range of the IPSec packets included in the window 100, the transmitting apparatus can stably transmit the IPSec packets by duplexing the IPSec using the SN and the window information.

2 is a block diagram illustrating an IPSec duplication apparatus according to an embodiment of the present invention. The transmitter 210 includes a first IPSec processor 211 and a second IPSec processor 213. One of the first IPSec processing unit 211 and the second IPSec processing unit 213 is an active state capable of normally transmitting a packet, and the other IPSec processing unit transmits a packet when a failure occurs in the active IPSec processing unit. The backup state is being prepared for.

Hereinafter, for convenience of explanation, it is assumed that the first IPSec processing unit 211 is in an active state, and the second IPSec processing unit 213 is assumed to be in a backup state. When the second IPSec processing unit 213 is in an active state and the first IPSec processing unit 211 is in a backup state, detailed descriptions thereof will be omitted since the same operation is performed in each of the IPSec processing units according to the active state and the backup state.

The first IPSec processing unit 211 generates an initial value of SN according to the number of occurrences of failures in the first IPSec processing unit 211 and the second IPSec processing unit 213, and then uses the initial value of the generated SN. Generates a header and transmits the IPSec packet including the header to the receiver 250. Thereafter, IPSec packets having SNs increased by one from the first SN are sequentially generated from the first IPSec processing unit 211.

The second IPSec processing unit 213 sets the frequency of occurrence of the failure. The number of occurrences of the failure is set to the total number of failures generated by the first IPSec processing unit 211 and the second IPSec processing unit 213.

The second IPSec processing unit 213 determines whether a failure occurs in the first IPSec processing unit 211 in an active state. As an example, the second IPSec processing unit 213 may transmit a predetermined request bit to the first IPSec processing unit 211 and check whether a response bit corresponding to the request bit is received, thereby causing a failure of the first IPSec processing unit 211. Determine whether or not it occurred. In another embodiment, the second IPSec processing unit 213 receives a notification of a failure of the first IPSec processing unit 211 from a controller (not shown) that monitors the state of the first IPSec processing unit 211.

The second IPSec processing unit 213 transitions to an active state when a failure occurs in the first IPSec processing unit 211 according to a determination result of the failure of the first IPSec processing unit 211. When the second IPSec processing unit 213 operates in an active state, it generates an initial value of SN for an IPsec packet to be transmitted for the first time. At this time, the initial value of the SN is set to a value larger than the maximum value of the SN transmittable by the first IPSec processing unit 211. A method of generating the initial value of SN will be described below with an example.

The second IPSec processing unit 211 generates a header using the initial value of the SN, and then transmits an IPSec packet including the header to the receiving device 250. The receiving device 250 receiving the IPSec packet shifts the window to the SN of the transmitted IPSec packet, and then normally receives the IPSec packet. By shifting the window as described above, the second IPSec processing unit 213 may allow the IPSec packets to reach the receiving device 210 without error even after not knowing the SN finally transmitted by the first IPSec processing unit 211. have. Subsequent IPSec packets have SNs that increment by one from the initial value of the SN.

Therefore, the present invention can continuously inspect the encryption and integrity of the IPSec itself even if a failure occurs due to an intruder attack by duplexing the IPSec.

Hereinafter, a method of generating the initial value of the SN will be described with reference to FIG. 3.

FIG. 3 is a diagram illustrating a method of generating and applying an SN to a window by the first and second IPSec processing units of FIG. 2.

First, T is the maximum time that the IPSec connection is maintained until the IPSec connection is reset due to a failure, and X is a constant larger than the maximum value of the SN of the previously transmitted IPSec packet when a failure occurs in the active IPSec processing unit. (n) is the SN of the IPSec packet to be transmitted next when n failures have occurred in the transmitter 210. And Y is the maximum number of IPSec packets that can be received in the IPSec connection unit, Z is the maximum available SN of the window, M is the maximum number of possible failures. Using these parameters, calculate X (1) such that [Y <X (1) * Z], and [X (n) = X (1) * n] (n = number of failures occurring during T = n> = 2) and [M = Z / X (1)].

For example, assuming that T = 2hr and Y = 300, first X is set larger than Y and smaller than Z (Y <X <Z). As an example, X = 500 is defined. When the first failure occurs in the transmitter 210, if X is designated as X (1), it is defined as [X (1) = Y], so [X (1) = 500] and [X (n) = 500 * n]. And since Z becomes 4G when using a 32-bit SN, [M = 800] can distinguish up to 8 million failures in the transmitter 210. Accordingly, when the transmission device 210 increases the SN of the first IPSec packet generated by the IPSec processing unit, which is newly activated each time, by 500 (= X), up to 8 million failures can be supported.

In FIG. 3, when the first IPSec processing unit 211 is in an active state, the second IPSec processing unit 213 determines whether a failure occurs in the first IPSec processing unit 211. When the first failure F1 occurs after transmitting the IPSec packets having sequence numbers 0 to 25 in the first IPSec processing unit 211, the second IPSec processing unit 213 becomes an active state and the first IPSec 211 is activated. It will be in backup state. Then, the newly activated second IPSec processing unit 213 generates a header by setting the SN of the first IPSec packet generated after the state transition to 500, and then transmits the IPSec packet including the header to the receiver 250. .

When the second IPSec processing unit 213 is in an active state, the second IPSec processing unit 213 determines whether a failure occurs in the first IPSec processing unit 211. When a second failure (F2) occurs after transmitting the IPSec packets having sequence numbers 500 to 550 in the first IPSec processing unit 211, the first IPSec processing unit 211 becomes an active state and the second IPSec 213 is activated. The first IPSec processing unit 211, which becomes a backup state and becomes active again, sets the SN of the first IPSec packet generated after the state transition to 1000 (= F2 * 500), generates a header, and then includes the IPSec including the header. The packet is transmitted to the receiver 250.

As described above, the state transition is easily performed between the IPSec processing units without continuously monitoring the dynamic state information of the active IPSec processing unit in each backup state.

4 is a flowchart illustrating a duplexing method of IPSec according to an embodiment of the present invention. The first IPSec processing unit 211 is an active state, and the second IPSec processing unit 213 is assumed to be a backup state.

In step 410 of FIG. 4, the second IPSec processing unit 213 sets the number of failures by increasing the number of previous failures by one. In operation 430, the second IPSec processing unit 213 determines whether a failure of the first IPSec processing unit 211 in an active state occurs. If a failure occurs in the first IPSec processing unit 311 in step 403, the second IPSec processing unit 213 proceeds to step 450 to switch to the active state, and if the failure occurs in the first IPSec processing unit 211 430 Return to step

In step 450, the second IPSec processing unit 213 transitions to the active state. In step 470, the second IPSec processing unit 213 multiplies the set number of occurrences of the failure by a predetermined constant that is greater than a maximum value of the SN of the previously transmittable IPSec packet to generate an SN to be used first after the state transition. In operation 490, the second IPSec processing unit 213 generates a header using the generated SN, and then transmits an IPSec packet including the header to the receiver 250.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

As described above, the present invention can reduce the resources used by the IPsec processing unit during the IPSec duplication processing in the packet switched domain, and can easily handle the state transition between the IPSec processing units without delay caused by frequent update of the dynamic state information. As a result, it is possible to reduce the possibility of error in the state transition.

Claims (6)

In the security method of a packet switched domain, Determining whether a failure occurs in the active IPsec processing unit in an active state, and when the failure occurs, transitioning the second IPSec processing unit in a backup state to an active state and setting the number of failures; Generating a sequence number for first use after the second IPSec processing unit switches to the active state by multiplying the set number of failures by a predetermined constant; And And generating, by the second IPSec processing unit, a header using the generated sequence number, and then transmitting an IPSec packet including the header. The method of claim 1, The constant is The first IPSec processing unit is a security method that is determined to be greater than the maximum value of the sequence number of the IPSec packet that can be transmitted for a predetermined time. The method of claim 2, The predetermined time is, The security method is determined by the maximum time that the IPSec connection is maintained by the first IPSec processing unit. In the security device of a packet switched domain, A first IPSec processor for generating a header using a sequence number in an active state and transmitting an Internet Protocol Security Protocol (IPsec) packet including the header; And In the backup state, it is determined whether a failure occurs in the first IPSec processing unit, and when the failure occurs, the number of failure occurrences is set after transitioning to the active state, and multiplied by a predetermined constant predetermined for the first occurrence of failure. And a second IPSec processing unit for generating a sequence number for generating the header, and generating the header using the generated sequence number and transmitting the IPSec packet including the header. The method of claim 4, wherein In the second IPSec processing unit The constant is The security device is determined to be greater than the maximum value of the sequence number of the IPSec packet that can be transmitted for a predetermined time in the first IPSec processing unit. The method of claim 5, wherein The predetermined time is, The security device is determined as the maximum time that the IPSec connection is maintained by the first IPSec processing unit.

Images