WO2013028056A1

WO2013028056A1 - Method and system for providing a secured internet protocol based communication

Info

Publication number: WO2013028056A1
Application number: PCT/MY2012/000157
Authority: WO
Inventors: Ahmad Raif Mohamed Noor Beg; Raja Mohd Fuad Tengku Aziz; Mohammad Firdaus JUHARI
Original assignee: Mimos Bhd
Current assignee: Mimos Bhd
Priority date: 2011-08-19
Filing date: 2012-06-28
Publication date: 2013-02-28
Anticipated expiration: 2014-02-19
Also published as: MY178555A

Abstract

The present invention discloses a method and system for use in an IP based network, whereby a highly secured communication between two participating devices can be achieved. Instead of masking a key after encyrption to be shared between devices to establish communication, the present invention masks the original key at an earlier level, preferably at key input prior to using it for encryption and decryption. The key is masked using X-OR operation (102) integrated in the CBC block (100) thus generating a secondary key which is then used for encryption and decryption process.

Description

METHOD AND SYSTEM FOR PROVIDING A SECURED INTERNET PROTOCOL

BASED COMMUNICATION

FIELD OF THE INVENTION

Embodiments of the present invention are directed generally to a method and system for use in a network, and more particularly a method and system for use in providing a secured internet protocol based communication between at least two participating devices within a network.

BACKGROUND OF THE INVENTION

Managing a network signifies the need to gather network information that flows into and from a respective device, in order to efficiently monitor network traffic and detecting the problems which may arise on said network. Information gathered can be used to, among other variety of tasks, perform routine trouble- shooting tasks, such as locating a server that is down, or that is receiving a disproportionate number of work requests. Evidently, these tasks can only be carried out with the aid of effective network traffic monitoring .

One of the various quintessential tasks in network traffic monitoring is managing Internet Protocol security, whereby the primary objective of this task is to ensure communications between devices over Internet Protocols (IP) network is effectively protected. Typically, across an IP based network, IP packets are transferred and received between devices or agents, subject to mutual authentication between said devices. Devoid of Internet security systems, these devices or agents may be exposed to perilous network attacks. At present, Internet protocol communications are being secured by a protocol suite known as the Internet Protocol security (IPsec).

During operation, IPsec generates authentication and cryptographic keys for secure establishment between participating devices within the network. Currently the widely used IPsec keys are known as static keys, in which they are used classically over a long period of time with respect to communication establishments within a network, in contrast with ephemeral keys. Although static keys play a significant role in ensuring safe and protected communication- between devices, there are several disadvantages have been observed since its introduction to the industry.

Challenges or tribulations which are typically associated with the use of static keys include being vulnerable to attacks, as in many cases static keys are not random enough thus allowing,, attackers to launch password guessing attacks; and replay protection are not feasible using static keys. Another vital disadvantage is that once key is ^' leaked, the communication between two devices within a respective network will be substantially compromised. One primary factor of how these keys can be leaked lies in the administrator itself. Administrators are the ones who have knowledge on which encryption algorithm is used as well as the full length details of the encryption keys. Therefore, the keys can be leaked to eavesdroppers due to the administrator's negligence.

Recognizing the shortcomings of the existing static keys deployment within an IP based network, it is highly desirable to have a method and system that can resolve the glaring issues as discussed and thus prevent the communications between devices being compromised.

The present invention is a method and system that is a step ahead the prior art, whereby with the present invention, the static keys are masked prior to using it for encryption, thus even though the attacker or sniffer has knowledge of the encryption keys, they cannot use this key for decryption as data is encrypted using a masked version of the keys. Accordingly, the IP security intensity is greater and therefore communication between devices within an IP based network will not be compromised.

Still other embodiments and advantages of the present invention will become readily apparent to those skilled in the art from the following detailed description, wherein embodiments of the invention are described by way of illustration.

SUMMARY OF THE INVENTION

In one embodiment, there is provided a method and system for static key masking, whereby one of the main steps is to mask the original key using X-OR operator .

In another embodiment of the present invention, at the implementation levels, the key masking block is provided as part of cipher block, thereby resulting to the secondary key and the key transformation process being invisible for the insiders or administrators.

In one embodiment, the method and system of the present invention includes utilities that are configured to manage the Security Association Database (SAD) and Security Policy Database (SPD) . In another embodiment, the method and system of the present invention includes using standard crypto libraries of linux' s kernel 2.6x. In one embodiment, there is disclosed a method for use in an Internet Protocol Security (IPsec) System in providing a secured Internet Protocol based communication between two devices within a network, said method comprising the steps of: performing an X-OR operation to mask an original key to be shared between two devices; and generating a secondary key based on said X-OR operation to be used in encryption and decryption; wherein the X-OR operation comprises the step of generating a secret value for use in generating the secondary key.

In another embodiment, there is disclosed a security system for use in an Internet Protocol (IP) based network, for providing a secured communication between two devices within a network, said system comprising: a CBC block cipher (100) integrated with an XOR block for XOR operation to generate a masked key based on an original key and a register (102) for generating secret values to be used in generating said masked key; a security association database (SAD) ; a security policy database (SPD) ; at least one device which is configured to manage said SAD and SPD; and a standard crypto library. As will be realized in the following description, the invention is capable of other and different embodiments and its several details are capable of modifications in various respects, all without departing from the scope of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Features of the invention will be apparent from following description when read with reference to accompanying drawings:

FIG 1 shows the overall view of the method and system of the present invention;

FIG 2 shows an example of a scenario, a communication between two devices, Alice and Bob devoid of any security system;

FIG 3 shows another example of a scenario, a communication between two devices, Alice and Bob, with the deployment of a conventional security system;

FIG 4 shows an example of SAD Database listing; FIG 5 shows another example of a scenario, a communication between two devices, Alice and Bob, with Eve and an acquaintance of Alice which can be a potential key leaker;

FIG 6 shows the implementation of the present invention;

FIG 7 shows another view in the implementation of the present invention;

FIG 8 shows the a part of the present invention, whereby it is shown that the X-OR block is integrated at key input; and

FIG 9 shows another view in the implementation of the present invention.

DETAILED DESCRIPTION

In the following description, reference is made to the accompanying drawings where, by way of illustration,, specific embodiments of the invention are shown. It is to be understood that other embodiments may be used as structural and other changes may be made without departing from the scope of the present invention. Also, the various embodiments and aspects from each of the various embodiments may be used in any suitable combinations. Accordingly, the drawings and detailed description are to be regarded as illustrative in nature and not as restrictive.

FIG 1 shows the overall view of the method and system of the present invention, in accordance with a preferred embodiment. As shown in FIG 1, the system of the present invention includes a Security Association Database (SAD) module (60), an operating system (OS) (70), IPsec packet processor (80), a key masking block (102) and a block cipher (100) which is preferably in the form of CBC block-cipher. The method and system of the present invention provides the integration of key masking method block in the encryption hardware implementation, in one embodiment.

The principle of functionality of an IPsec system will now be described so as to elucidate the mechanism of the present invention.

In a basic tri-party communication, there is Alice, who wants to send a message to Bob, having Eve as an IP-packet sniffer or potential attacker. This situation is illustrated in FIG 2. In the first scenario, the communication between Alice and Bob is not secured or protected by any encryption system. Therefore, Eve has access to all information sent by Alice to Bob. In a second scenario, Alice connects with Bob through a secure channel, as shown in FIG 3. Therefore, all messages sent to Bob are encrypted using the same key that they share. The "Shared Key" is usually in the form of SAD (Security Association Database) that is situated at both Alice and Bob. An example of the SAD is shown FIG 4. This time, Eve is not able to decrypt the message sent as she can only see rubbish messages flowing through the communication channel. In the next scenario which is illustrated in FIG 5, Nora is introduced whereby she is an acquaintance to Alice thus has the access to Alice's SAD. In the event that Eve has the encryption or has a similar decryptor as Bob's, Eve may be able to access all information sent to Bob if she has the encryption key. The feasibility to obtain such key will be higher if Nora leaks the key to Eve. Based on the situations or scenarios discussed above, it is evident that the communications between Alice and Bob are highly compromised due to the existence of Eve and the possibility of the key being leaked by Nora. This also shows that any insider can leak the key to Eve, and Eve can use this information together with a network analysis tool to decipher the encrypted messages in real time.

The method and system of the present invention will now be described, particularly on how it can resolve the security hole which may be created in various network communication instances, as described above. In one embodiment, the present invention masks the keys at hardware level or the device level; preferably, said key is masked at the key input level. With the key being masked at this early, level, Alice and Bob will not have the knowledge of the mechanism of masking that device uses thus adding more security to the IPSEC implementation. Now referring to FIG 6, a simple X-OR operation is performed based onthe original key with a secret value. It is preferred that this secret value is at the same dimension as the original key.

Still referring to FIG 6, KMM by X-ORing is provided thus a key with a secret value is generated. This is a secondary key generated to be used in the encryption process. Further, the XOR function is embedded within the CBC block cipher (100) to ensure its invisibility towards any insider.

As seen in FIG 7 and FIG 8, in accordance with an embodiment of the present invention, there is provided a CBC block- cipher (100) structure with an addition of X-OR block at the key input. There is further provided a register which is configured to generate the secret value. . The KTP .inside the encryption system and method in accordance with the present invention is represented by an XOR operator and a register. Now referring to FIG 9, in effect, the register generates a secret value which is used in the X-OR operation with key to generate a second or masked key. The secondary key is then used in encryption and decryption, which may be based on various algorithms such as 128-bits AES, RSA and DES . While the invention has been particularly shown and described with reference to the illustrated embodiments, those skilled in the art will understand that changes in form and detail may be made without departing from the scope of the invention.

Claims

1. A method for use in an Internet Protocol Security (IPsec) System in providing a secured Internet Protocol based communication between two devices within a network, said method comprising the steps of:

performing an X-OR operation to mask an original key to be shared between two devices; and

generating a secondary key based on said X-OR operation to be used in encryption and decryption;

wherein the X-OR operation comprises the step of generating a secret value for use in generating the secondary key.

2. The method as claimed in Claim 1 wherein the secret value is at the same dimension as the original key.

3. The method as claimed in Claim 1 wherein the method further comprising the step of providing an XOR module or block at the key input of a CBC block cipher.

.

4. The method as. claimed, in Claim 3 wherein the method further comprising providing a register for generating secret values adjacent to the XOR block.

5. A security system for use in an Internet Protocol (IP) based network, for providing a secured communication between two devices within a network, said system comprising:

a CBC block cipher (100) integrated with an XOR block for XOR operation to generate a masked key based on an original key and a register (102) for generating secret values to be used in generating said masked key;

a security association database (SAD) (60);

a security policy database (SPD) ;

at least one device which is configured to manage said SAD and SPD; and

a standard crypto library.

6. The security system as claimed in Claim 5 wherein the device installed with XOR comprises a CBC block-cipher and a register for generating secret values to generate the masked key.

7. The security system as claimed in Claim 5 wherein the masked key is a secondary key to be used in encryption and decryption so as to establish communication between the devices.

8. The security system as claimed in Claim 1 wherein the device installed with an XOR is configured to encrypt the key XORED with a constant value and with a predetermined bit length, preferably similar to the key bit length.

9. The security system as claimed in Claim 4 wherein the constant value is in the form of a register or memory module .