KR20160063902A - Security communication method and apparatus - Google Patents

Abstract

The present invention relates to a secure communication method and an apparatus thereof to minimize performance degradation due to encryption while satisfying security requirements by changing an encryption level in accordance with a security level of data. In transmitting and receiving data using a security tunneling technology, the secure communication method of the present invention can minimize degradation of transmission efficiency while satisfying the security requirements by changing the encryption level in accordance with the security level of the data, i. e., by generating multiple security tunnels with different encryption levels, and transmitting the data through the security tunnel of the security level of the data to be transmitted.

Description

[0001] DESCRIPTION [0002] Security communication method and apparatus [

The present invention relates to a cryptographic communication method and apparatus for transmitting and receiving data using a secure tunneling technique, and more particularly, to a cryptographic communication method and apparatus for minimizing performance degradation due to encryption while satisfying security requirements by varying an encryption level according to a data security level And more particularly, to a method and apparatus for encrypted communication.

With the rapid growth of the Internet and network infrastructure, the business area of each company or organization is rapidly moving from offline to online environment. Therefore, not only a specific building, but also a large number of domestic and foreign branches Network connections between computing resources have become necessary.

In this environment change, Virtual Private Network (VPN) has emerged as a technology that solves the cost problems and security problems that necessarily arise in connection between headquarter - branch office and overseas - domestic.

VPN is a technology that can obtain the effect of a private network by using a public network such as the Internet. The VPN is a tunneling technique for generating a virtual tunnel from a communication start point to a target point as a main technique, And an encryption / authentication and key management technology for securely managing a tunnel. Standardization techniques include Internet Protocol Security (IPsec) and Secure Socket Layer (SSL), for example.

For example, DES (Data Encryption Standard), 3DES, RC4, AES (Advanced Encryption Standard), SEED, and the like are used as the encryption algorithm at this time.

Generally, when encrypting and transmitting data, the same encryption process is performed regardless of the data type. For example, in a thing Internet connecting a variety of devices such as household appliances, mobile equipment, and wearable computers, a gateway device performs encryption processing on data transmitted from connected devices in the same manner regardless of the type thereof.

Therefore, in the conventional cryptographic communication, since all the data are encrypted using a single key set on the basis of the data having the highest security level, waste of resources due to unnecessary cryptographic operation processing of data having a low security level is caused, There is a problem that efficiency is lowered.

Korean Patent Laid-Open No. 10-2008-0075725, published on August 19, 2008 (name: multi-mode security device for WiBro wireless Internet security)

SUMMARY OF THE INVENTION The present invention has been proposed in order to solve the conventional problems, and it is an object of the present invention to provide a cryptographic communication method and apparatus for minimizing performance degradation due to encryption while satisfying security requirements by varying the encryption level according to the security level of data.

In particular, in transmitting and receiving data using a secure tunneling technique, a plurality of secure tunnels having different encryption levels are generated, and data is transmitted through a secure tunnel having an encryption level corresponding to a security level of data to be transmitted And to provide a method and apparatus for cryptographic communication that can minimize the deterioration of transmission efficiency while satisfying the level of security requirement for each data.

As a solution to the above-mentioned problems of the present invention, there is provided a method for encrypting a plurality of secure tunnels, the method comprising: generating a plurality of secure tunnels having different encryption levels; Confirming a security level indicating an encryption level of the data when data to be transmitted is generated; Selecting one of the plurality of secure tunnels according to the identified security class; And encrypting and transmitting the data through the selected secure tunnel.

The encrypted communication method includes: checking a computing resource usage rate of a device that transmits or receives the data; And changing the selected secure tunnel to a secure tunnel having a different encryption level according to the computing resource utilization rate. At this time, in addition, the checking of the computing resource utilization rate may include receiving information on the computing resource utilization rate from the security control device.

In addition, the cryptographic communication method may further include setting a mapping relationship between the security level of the data and the secure tunnel based on the predetermined security policy before the step of creating the plurality of secure tunnels. Here, the setting step may also include receiving information on the security policy or the mapping relationship from the security control device.

In addition, the present invention provides, as another solution to the above-mentioned problems, a data pre-processing unit for selecting a security level indicating an encryption level of the data and a security tunnel mapped to the security level when data to be transmitted is generated; And a data transmission unit for generating a plurality of security tunnels having different encryption levels and encrypting the data through the security tunnel selected by the data preprocessing unit and transmitting the encrypted data.

The data preprocessing unit further verifies the computing resource usage rate of the device transmitting or receiving the data and may change the selected security tunnel to a security tunnel having a different encryption level according to the computing resource usage rate.

In addition, the cryptographic communication apparatus according to the present invention may further include a security policy management unit that manages data security level and mapping information of the secure tunnel based on a security policy received from the security control apparatus.

In the present invention, in transmitting and receiving data using a tunneling technology such as VPN, a plurality of security tunnels having different encryption levels are generated, and data is transmitted through a security tunnel having an encryption level corresponding to the security level of data to be transmitted , The encryption level can be varied for each data to satisfy the security requirements, and additionally, the deterioration of the transmission efficiency can be minimized.

In addition, according to the present invention, the security tunnel selected according to the data security level is changed into a security tunnel having a different encryption level according to the computing resource usage rate of the device transmitting or receiving data, It can maintain constant performance while improving stability.

In addition, the present invention can dynamically change the mapping relationship between the data security class and the secure tunnel according to a change of the security policy.

1 is a block diagram showing a network configuration to which an encrypted communication according to the present invention is applied.
2 is a block diagram showing a detailed connection structure of an encryption communication apparatus and a security control apparatus according to the present invention.
3 is a block diagram showing a configuration of an encrypted communication apparatus according to the present invention.
4 to 6 are flowcharts of a cryptographic communication method according to the present invention.
7 is a schematic diagram illustrating an example of a cryptographic communication process according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, detailed description of well-known functions or constructions that may obscure the subject matter of the present invention will be omitted. It should be noted that the same constituent elements are denoted by the same reference numerals as possible throughout the drawings.

The terms and words used in the present specification and claims should not be construed to be limited to ordinary or dictionary meanings and the inventor is not limited to the concept of terminology for describing his or her invention in the best way. It should be interpreted as meaning and concept consistent with the technical idea of the present invention. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and not all of the technical ideas of the present invention are described. Therefore, It is to be understood that equivalents and modifications are possible.

Also, terms including ordinal numbers such as first, second, etc. are used to describe various elements, and are used only for the purpose of distinguishing one element from another, Not used. For example, without departing from the scope of the present invention, the second component may be referred to as a first component, and similarly, the first component may also be referred to as a second component.

In addition, when referring to an element as being "connected" or "connected" to another element, it means that it can be connected or connected logically or physically. In other words, it is to be understood that although an element may be directly connected or connected to another element, there may be other elements in between, or indirectly connected or connected.

Also, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. It is also to be understood that the terms such as " comprising "or" having ", as used herein, are intended to specify the presence of stated features, integers, It should be understood that the foregoing does not preclude the presence or addition of other features, numbers, steps, operations, elements, parts, or combinations thereof.

The cryptographic communication technology according to the present invention can be applied to communication between a device connected to a communication network and transmitting / receiving data, for example, a terminal, a server, and a terminal, The network configuration shown in FIG.

In the embodiment shown in FIG. 1, the cryptographic communication technology according to the present invention is applied for secure communication between the terminal 10 and the server 20 connected through the communication network 30. In this case, the device for transmitting or receiving data, that is, the terminal 10 and the server 20 are each provided with the cryptographic communication apparatus 100 according to the present invention and perform mutual communication through the cryptographic communication apparatus 100 can do. The cryptographic communication apparatus 100 provided in the terminal 10 and the server 20 can operate in cooperation with the security control apparatus 200 through the communication network 30. [

The communication network 30 is connected to at least one wired / wireless communication network. In particular, the communication network 30 may include at least one wire / wireless public network such as a wired Internet, a wireless Internet, a mobile communication network, and a Wi-Fi network.

The cryptographic communication apparatus 100 provided in the terminal 10 and the server 20 may be implemented as a hardware device such as a SoC (System on Chip) or an Embedded System, And may be executed by the processor of the terminal 10 and the server 20 after being recorded in the storage means of the terminal 10 and the server 20. [ At this time, the computer program (also known as program, software, software application, script or code) may be written in any form of programming language including compiled or interpreted language, a priori or procedural language, Or any other type of unit, module, component, subroutine, or other unit suitable for use in a computer environment. Also, the computer program does not necessarily correspond to the file of the file system. The program may be stored in a single file provided to the requested program, or in multiple interactive files (e.g., a file storing one or more modules, subprograms, or portions of code) (E.g., one or more scripts stored in a markup language document).

The cryptographic communication apparatus 100 implemented in this manner generates a plurality of secure tunnels having different encryption levels between the terminal 10 and the server 20 in cooperation with other cryptographic communication apparatuses provided in other apparatuses, A security level indicating an encryption level of the data is checked and a function of selecting one of the plurality of security tunnels according to the identified security level and encrypting and transmitting the data is performed.

2 is a diagram illustrating a detailed connection structure of an encryption communication apparatus and a security control apparatus according to the present invention. 2, the cryptographic communication apparatus 100 is divided into first and second cryptographic communication apparatuses 101 and 102. FIG. Here, the first and second cryptographic communication apparatuses 101 and 102 are merely for distinguishing between two apparatuses for transmitting and receiving mutual data, for example, a cryptographic communication apparatus provided in the terminal 10 and the server 20, Its function is the same.

Referring to FIG. 2, the first and second cryptographic communication devices 101 and 102, which are installed in two devices to be cryptographically communicated, create a plurality of security tunnels connecting the two devices. Here, the creation of the secure tunnel may be performed according to a known protocol such as IPsec. At this time, the plurality of secure tunnels have different encryption levels. For example, at least one of the encryption algorithm, the key length, and the encryption operation mode may be set differently.

For example, in the encrypted communication according to the present invention, AES (Advanced Encryption Standard) may be applied as an encryption algorithm.

The AES is a symmetric key encryption algorithm proposed by the National Institute of Standards and Technology (NIST) in place of the conventional DES (Data Encryption Standard) algorithm, and has a size of 128, 192, and 256 bits And performs four basic operations such as SubBytes, ShiftRows, MixColumns, and AddRoundKey for a 128-bit input with a key value that can be held, thereby encrypting the data. AES is an encryption operation mode for associating blocks when input data is encrypted in a 128-bit (16-byte) block. The AES is an electric code book (ECB) mode, a cipher block chaining (CBC) Cipher Feedback mode, OFB (Output Feedback) mode and CTR (Counter) mode.

The security level of such an AES algorithm may vary depending on the key length and the encryption operation mode.

Therefore, in an embodiment of the present invention, the first and second cryptographic communication apparatuses 101 and 102 are provided with three encryption methods, AES-128-CBC, AES-192-CBC and AES- Create a secure tunnel. The AES-128-CBC means a 128-bit key and the AES algorithm which is encrypted in the CBC mode. The AES-192-CBC means a 192-bit key and the AES algorithm operated in the CBC mode. CBC means 256 bit key and AES algorithm operated in CBC mode. In this embodiment, the encryption level of the security tunnel is different by varying the key length, and the encryption level is high in proportion to the key length. However, this is an embodiment only, and the operation mode and the encryption algorithm may be set differently. For example, when the integrity of data is required, the CTR mode can be applied to data for which confidentiality of data is required while applying the CBC mode.

The first and second cryptographic communication apparatuses 101 and 102 select one of the AES-128-CBC, AES-192-CBC and AES-256-CBC security tunnels according to the security level of data to be transmitted And transmit the data. For example, data having a high security level may be transmitted through a secure tunnel of AES-256-CBC, and data having a low security level may be transmitted through a secure tunnel of AES-128-CBC. Here, the transmission through the secure tunnel includes a process of encrypting data by applying encryption parameters (encryption algorithm, key value, encryption operation mode, etc.) set in the corresponding secure tunnel.

 In addition, the first and second cryptographic communication devices 101 and 102 may change the security tunnel to be used in the data transmission in conjunction with the security control device 200. [

The security control apparatus 200 monitors the usage rate of computing resources of the devices, for example, the terminal 10 and the server 20, on which the first and second cryptographic communication apparatuses 101 and 102 are mounted, And provides information on the resource utilization rate to the first and second cryptographic communication devices (101, 102). The first and second cryptographic communication devices 101 and 102 may check the usage rate of the computing resources and change the security tunnel selected according to the security level of the data to a security tunnel having a lower encryption level when the usage rate is higher than a predetermined threshold. Accordingly, in a system overload state due to a high utilization rate of computing resources of the device transmitting or receiving data, that is, the terminal 10 or the server 20, the data transmitted through the security tunnel of the AES-256- Can be transmitted through the secure tunnel of the lower AES-192-CBC. When the computing resource utilization rate is high, by lowering the encryption level, it is possible to reduce the computation amount due to the encryption processing, thereby minimizing the degradation of the transmission performance.

Also, the security control device 200 manages the security level of the data and the mapping information of the secure tunnel based on the preset security policy, and provides it to the first and second cryptographic communication devices 101 and 102. The first and second cryptographic communication apparatuses 101 and 102 can change the security level of the data and the mapping information of the secure tunnel according to information received from the security control apparatus 200. [ Here, the security level can be set separately for each type of data.

3 is a block diagram showing the configuration of an encryption communication apparatus 100 according to the present invention. The encryption communication apparatus 100 includes a data preprocessing unit 110, a data transmission unit 120, a security policy And may include a management unit 130.

The data preprocessing unit 110 receives the data to be transmitted and confirms the security level corresponding to the type of the data, And performs data preprocessing so as to be transmitted through a security tunnel having an encryption level corresponding to the security level. Specifically, the data preprocessing unit 110 may add a forward mark indicating a security tunnel to be transmitted to the data in accordance with the identified security level.

The data transmission unit 120 generates a plurality of security tunnels having different encryption levels and transmits the data through the security tunnel selected by the data preprocessing unit. For example, the data transmission unit 120 may include a routing table mapping a corresponding security tunnel for each forwarding mark, and may correspond to a forwarding mark added to data transferred from the data preprocessing unit 110 through the routing table , And performs encryption transmission through the corresponding security tunnel.

In addition, the data preprocessing unit 110 further checks the usage rate of the computing resources of the devices (the terminal 10 and the server 20) performing the cryptographic communication, and if the computing resource utilization rate is greater than or equal to a predetermined threshold value, The security tunnel selected according to the security level can be changed to a security tunnel having a lower encryption level than the currently selected security tunnel. That is, when the computing resource usage rate is greater than or equal to a predetermined threshold value, a forwarding mark of a security tunnel lower in level than the security tunnel corresponding to the security level may be added to the corresponding data. Here, the threshold value may be set in consideration of the system overload of the apparatus.

Lastly, the security policy management unit 130 is configured to manage the security level of the data and the mapping information of the secure tunnel at the time of selecting the security tunnel in the data preprocessing unit 110, Receives the security policy from the security control apparatus 200 shown in FIG. 4A, and sets the security level of the data and the mapping information of the secure tunnel based on the received security policy. In addition, when the security policy is changed, the security policy management unit 130 may change predetermined mapping information according to the changed security policy.

Next, an encrypted communication process performed by the encrypted communication device 100 configured as described above will be described in detail with reference to Figs. 4 to 7. Fig. 4 to 6 are flowcharts of an encryption communication method according to the present invention, and FIG. 7 is a schematic diagram illustrating an example of an encryption communication processing procedure according to the present invention.

Basically, the encrypted communication apparatus 100 according to the present invention can operate as shown in FIG.

That is, the cryptographic communication apparatus 100 generates a plurality of secure tunnels having different encryption levels, while creating a secure tunnel for encrypted transmission between the cryptographic communication apparatus 100 and a counterpart device to which communication is to be performed (S110). The security tunnel can be created based on a protocol such as IPsec, and a specific method thereof is known in the prior art and will not be described here. The plurality of secure tunnels may have different encryption levels by changing one or more of encryption parameters such as an encryption algorithm, a key length, and an encryption operation mode. For example, in an embodiment of the present invention, the encryption level is divided by changing the key length to 128 bits, 192 bits, or 256 bits in the AES algorithm, or the block encryption operation mode of the AES algorithm is set differently, . Here, although only one encryption algorithm is used as an example, another encryption algorithm may be further used to change the encryption levels of a plurality of tunnels.

In addition, the cryptographic communication apparatus 100 sets a mapping relation between the generated security tunnels and the security level of the data (S120). This can be done according to the security policy transmitted from the security control apparatus 200. [ Here, the security policy defines a security level indicating a security level required for each data type, and a relationship between security tunnels corresponding to a security level required for each security level. For example, in the security policy, the metadata can be set to a lower security level as compared with other data, and the metering data can be set to a security level higher than that of the character data. In addition, the security policy can also set a security level by distinguishing image data from text data.

When the data to be transmitted to the partner device occurs (S130), the encryption communication device 100 confirms the security level indicating the encryption level of the data (S140), and according to the checked security level, One of the tunnels is selected (S150). FIG. 7 is a diagram illustrating an exemplary process of performing steps S130 through S150 described above. 7, a forwarding mark 71a assigned to each data type, a routing table 72a, and a security tunnel 72b are provided for mapping between the security level of data and security tunnels, as shown in FIG. ) Can be managed and managed. The data preprocessing unit 110 of the cryptographic communication apparatus 100 checks the security level of each data when the data to be transmitted (packet1, packet2, packet3) occurs as indicated by reference numeral 71, To the data (packet1, packet2, packet3) as the forwarding mark 71a. The data (packet1, packet2, packet3) to which the forwarding mark 71a is added is transmitted to the data transmitting unit 120. The data transmitting unit 120 transmits the forwarding mark 71a Confirms the routing table 72a corresponding to the forwarding mark 71a and encrypts and transmits the data through the security tunnel 72b defined in the routing table 72a.

The above-described steps S130 through S150 are performed every time data to be transmitted is transmitted until data transmission is completed, and data can be encrypted with different encryption levels for each data.

4, during transmission of data through a secure tunnel having an encryption level corresponding to the security level of data, the cryptographic communication apparatus 100 according to the present invention further performs the process of FIG. 5, The encryption level of the data of the security level can be changed according to the usage rate.

5, the cryptographic communication apparatus 100 according to the present invention checks the usage rate of a computing resource of a device performing encryption communication, that is, the terminal 10 or the server 20 at step S210. The cryptographic communication apparatus 100 may be configured to receive information on the computing resource utilization rate of the terminal 10 or the server 20 monitored by the security control apparatus 200 from the security control apparatus 200 have.

The cryptographic communication apparatus 100 may change the currently selected security tunnel to a secure tunnel having a different encryption level according to the computing resource usage rate. Specifically, the cryptographic communication apparatus 100 sets Is compared with a threshold value (S220). For example, the threshold may be set based on an overload condition of the computing system.

As a result of the comparison, if the computing resource usage rate is greater than or equal to a predetermined threshold value, the computing system determines that there is an overload state or an overload state, and changes the security tunnel to a security tunnel having a lower encryption level than the currently selected security tunnel. This can be done by changing the forwarding mark corresponding to the security level of the data to be transmitted at present to a forwarding mark corresponding to the lower security level.

In contrast, when the computing resource utilization rate is not equal to or greater than the predetermined threshold value, the cryptographic communication apparatus 100 maintains the selected security tunnel according to the security level of the currently transmitted data (S240).

In this case, only a change to a security tunnel having a low encryption level upon system overloading has been described. However, the present invention sets a threshold considering the amount of computation required for encryption processing, and if the computing resource utilization rate is lower than the threshold, You may want to change to a secure tunnel with a higher encryption level than the secure tunnel. The present invention may also set a plurality of thresholds and change the selected secure tunnel to a lower-security tunnel or a higher-encryption-level secure tunnel, depending on the result of comparison of the computing resource utilization and thresholds.

The above-described process may be repeated until data transmission is terminated (S250).

The above-described steps S210 to S250 may be performed after step S140 in FIG.

Therefore, when the computing resource usage rate exceeds a threshold value, the cryptographic communication apparatus 100 according to the present invention transmits data through a secure tunnel having a lower encryption level than the security tunnel selected according to the security level of data to be transmitted, Is lower than the threshold value, the data is transmitted through the selected security tunnel according to the security level of the data to be transmitted again.

As a result, it is possible to reduce the increase of the system load due to the encryption processing by performing the encrypted communication at a lower encryption level while the system is overloaded or close to the system where the utilization rate of the computing resource is high, Efficient data transmission is possible by performing encrypted communication at an encryption level according to the security level.

In addition, the cryptographic communication apparatus 100 according to the present invention can dynamically change the encryption level mapped to the security level of the data according to the security policy.

To this end, the cryptographic communication apparatus 100 receives the security policy transmitted from the security control apparatus 200, and dynamically changes the mapping information of the security tunnel and the security level for each data type based on the received security policy have.

For this, the security control apparatus 200 manages the mapping relationship information between the data based on the security policy and the security tunnel (S310), and when the security policy is changed (S320) The mapping relationship of the tunnel is changed in step S330 and the mapping relationship information of the security tunnel and the data according to the changed security policy is transmitted to the cryptographic communication apparatus 100 in step S340. And the mapping information of the security tunnel can be set.

According to this, it is possible to dynamically change the mapping relationship between the data and the security tunnel applied by the cryptographic communication apparatus 100 according to the security policy changed according to the operation policy of the service provider.

The cryptographic communication method according to the present invention can be implemented in the form of software readable by various computer means and recorded in a computer-readable recording medium. Here, the recording medium may include program commands, data files, data structures, and the like, alone or in combination. Program instructions to be recorded on a recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. For example, the recording medium may be an optical recording medium such as a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, a compact disk read only memory (CD-ROM), a digital video disk (DVD) Includes a hardware device that is specially configured to store and execute program instructions such as a magneto-optical medium such as a floppy disk and a ROM, a random access memory (RAM), a flash memory, do. Examples of program instructions may include machine language code such as those generated by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like. Such a hardware device may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, It will be apparent to those skilled in the art. Furthermore, although specific terms are used in this specification and the drawings, they are used in a generic sense only to facilitate the description of the invention and to facilitate understanding of the invention, and are not intended to limit the scope of the invention.

Although the present specification and drawings describe exemplary device configurations, the functional operations and subject matter implementations described herein may be embodied in other types of digital electronic circuitry, or alternatively, of the structures disclosed herein and their structural equivalents May be embodied in computer software, firmware, or hardware, including, or in combination with, one or more of the foregoing. Implementations of the subject matter described herein may be embodied in one or more computer program products, i. E. One for computer program instructions encoded on a program storage medium of the type for < RTI ID = 0.0 & And can be implemented as a module as described above. The computer-readable medium can be a machine-readable storage device, a machine-readable storage substrate, a memory device, a composition of matter that affects the machine readable propagation type signal, or a combination of one or more of the foregoing.

While the specification contains a number of specific implementation details, it should be understood that they are not to be construed as limitations on the scope of any invention or claim, but rather on the description of features that may be specific to a particular embodiment of a particular invention Should be understood. Certain features described herein in the context of separate embodiments may be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments, either individually or in any suitable subcombination. Further, although the features may operate in a particular combination and may be initially described as so claimed, one or more features from the claimed combination may in some cases be excluded from the combination, Or a variant of a subcombination.

Likewise, although the operations are depicted in the drawings in a particular order, it should be understood that such operations must be performed in that particular order or sequential order shown to achieve the desired result, or that all illustrated operations should be performed. In certain cases, multitasking and parallel processing may be advantageous. Also, the separation of the various system components of the above-described embodiments should not be understood as requiring such separation in all embodiments, and the described program components and systems will generally be integrated together into a single software product or packaged into multiple software products It should be understood.

Certain embodiments of the subject matter described herein have been described. Other embodiments are within the scope of the following claims. For example, the operations recited in the claims may be performed in a different order and still achieve desirable results. By way of example, the process illustrated in the accompanying drawings does not necessarily require that particular illustrated or sequential order to obtain the desired results. In certain implementations, multitasking and parallel processing may be advantageous.

The description sets forth the best mode of the invention, and is provided to illustrate the invention and to enable those skilled in the art to make and use the invention. The written description is not intended to limit the invention to the specific terminology presented. Thus, while the present invention has been described in detail with reference to the above examples, those skilled in the art will be able to make adaptations, modifications, and variations on these examples without departing from the scope of the present invention.

Therefore, the scope of the present invention should not be limited by the described embodiments but should be defined by the claims.

In the present invention, in transmitting and receiving data using a tunneling technology such as VPN, a plurality of security tunnels having different encryption levels are generated, and data is transmitted through a security tunnel having an encryption level corresponding to the security level of data to be transmitted , It is possible to vary the encryption level according to the security level of the data to satisfy the security requirement, and additionally, the deterioration of the transmission efficiency can be minimized.

In addition, according to the present invention, a security tunnel selected according to the data security level is changed to a security tunnel having a different encryption level according to a computing resource usage rate of a device performing encryption communication, It can maintain constant performance while improving stability.

In addition, the present invention can dynamically change the mapping relationship between the data security class and the secure tunnel according to a change of the security policy.

10: terminal 20: server
30: communication network 100, 101. 102: encrypted communication device
110: Data preprocessing unit 120: Data transmission unit
130: security policy management unit 200: security control device

Claims (9)

Creating a plurality of secure tunnels having different encryption levels;
Confirming a security level indicating an encryption level of the data when data to be transmitted is generated;
Selecting one of the plurality of secure tunnels according to the identified security class; And
And encrypting and transmitting the data through the selected secure tunnel. The method according to claim 1,
Confirming a computing resource usage rate of a device transmitting or receiving the data;
Further comprising changing the selected secure tunnel to a secure tunnel having a different encryption level according to the computing resource utilization rate. The method according to claim 1,
Further comprising setting a mapping relationship between the security level of the data and the secure tunnel based on the predetermined security policy before the step of creating the plurality of secure tunnels. 4. The method of claim 3, wherein the setting comprises:
And receiving information on a mapping relationship between the security policy or the security level of the data and the secure tunnel from the security control device. The method of claim 1, wherein the plurality of secure tunnels
Wherein at least one of an encryption algorithm, a key length, and an encryption operation mode is set differently. A data pre-processing unit for selecting a security level indicating an encryption level of the data and a security tunnel mapped to the security level when data to be transmitted is generated; And
And a data transmission unit for generating a plurality of security tunnels having different encryption levels and transmitting the data through a security tunnel selected by the data preprocessing unit. 7. The apparatus of claim 6, wherein the data preprocessing unit
Further checking a usage rate of a computing resource of a device transmitting or receiving the data, and changing the selected security tunnel to a security tunnel having a different encryption level according to the computing resource usage rate. The method according to claim 6,
Further comprising a security policy management unit for managing security level of data and mapping information of a security tunnel based on a security policy received from the security control device. 7. The apparatus of claim 6, wherein the data transmitter
Wherein at least one of the encryption algorithm, the key length, and the encryption operation mode is set differently to generate a plurality of secure tunnels having different encryption levels.

Images