• Proceedings of the Korean Information Science Society Conference
• /
• 2005.07a
• /
• pp.160-162
• /
• 2005

IPsec Tunnel Mode를 이용하여 보안 네트워크를 구축 시, 네트워크 구성이 중복된 경우에는 중복되지 않도록 재구성해야 하는 문제가 있다. 본 논문에서는 IPSec Tunnel Mode 통신을 하고자 하는 두 네트워크가 중복된 경우, IPSec 네트워크 별칭 기법을 통하여, 이전 네트워크의 구성을 변경하지 않고 통신할 수 있는 방안을 제시한다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.4
• /
• pp.1260-1265
• /
• 2010

IPSec is the security protocol that do encryption and authentication service to IP messages on network layer of the internet. This paper presents the key recovery mechanism that is applied to IKEv2 of IPSec for mobile communication environments. It results to have compatibility with IPSec and IKEv2, reduce network overhead, and perform key recovery without depending on key escrew agencies or authorized party.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.5
• /
• pp.27-35
• /
• 2002

In this paper, we present the structure and interaction flow between IKE server and the other modules for our IPsec System's efficiency. Our IPsec systems have several components for IP-based end-to-end security services. They are IKE, SADB and SPDB and so on, not to speak of IPsec Protocol Engine. Therefore the efficient interaction structure between them has an much influence on total system efficiency. Especially, in case of IPsec engine integrated with kernel, it is very important how IPsec engine can refer to SPDB and SADB entries efficiently according to the location of the implementation of SPDB and SADB. To solve the above problem, we use the SPI generated by IKE. Finally, we propose the interaction structure between IKE server and the other modules according to the optimization for referring to SPDB and SADB entries.

• Proceedings of the IEEK Conference
• /
• 2005.11a
• /
• pp.1035-1038
• /
• 2005

This paper describes the designs and the implementations of two H/W IPSec Systems, look-aside and inline, on TOE (Transport Offloading Engine). These systems aim for guaranteeing the security of datagram networks while preserving the bandwidth of gigabit networks. The TOE offloads a host CPU from network burdens, so that it makes the gigabit wire speed possible, and then deeper level security architecture of the IPSec guarantees the security of gigabit service network dominated by datagram packets. The focus of this paper is to minimize the TOE's performance degradation caused by the computation-oriented IPSec. The look-aside IPSec system provides a significant improvement in the CPU offload of the IPSec cryptography loads. However, the inline system completely offloads the host CPU from whole IPSec loads, providing significant additional cost saving compared to the look-aside system. In this paper, the implementations of TOE cards including commercial IPSec processors are presented. As the result of performance evaluation with the protocol analyzer, we can get the fact that the inline IPSec system is 8 times faster than the S/W system and 2 times faster than the look-aside system.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2003.05a
• /
• pp.241-244
• /
• 2003

Recently, IETF Mobile IP WG focus on security problem issues in Mobile IPv6 and provide appropriate protocol to solve them. These include the protections of Binding Updates both to home agents and correspondent nodes, prefix discovery messages and transporting data packets. In Mobile IPv6, control traffics between home agents and mobile nodes uses IPsec to avoid that mobile nodes and correspondent nodes may be vulnerable to attacks. It is used, however, Return Routability procedure for correspondent node to assure that the right mobile node is sending the messages. In this paper, we propose method of IPser processing to protect messages between home agents and mobile nodes.

• Proceedings of the IEEK Conference
• /
• 2006.06a
• /
• pp.37-38
• /
• 2006

In this paper, we describe a security problem of IPsec. And we propose a solution for this problem. The problem is a fragility of IPsec Gateway which is used in tunnel mode. The role of IPsec Gateway is encrypting or decrypting IPsec packets. Because of the role of IPsec Gateway, IPsec Gateway suffers overhead for decrypting numerous packets. Adversaries can easily attack IPsec Gateway using a DDoS attack. To solve this problem, we propose the "Priority based Random Packet Drop" method. In this method, the white list which is a list of normal users is created. After that, according to the frequency of uses, the method marks priorities of random drops to the white list. If anomalous traffic appeared, this method will drop many packets which consist of anomalous traffic. In simple experiment, we show our solution is proper to defend IPsec Gateway. For this experiment, we use empirical backbone traffic which includes DoS attacks.

• Journal of KIISE:Information Networking
• /
• v.30 no.5
• /
• pp.604-613
• /
• 2003

Network Address Translation-Protocol Translation(NAT-PT) is an IPv4/IPv6 translation mechanism, as defined in RFC2766, allowing IPv6-only devices to communicate with IPv4-only devices and vice versa. But NAT-PT has the restriction that applies to IPv4 NAT where NAT-PT does not provide end-to-end security, which is a major goal of IPSec. Therefore it cannot support security services such as confidentiality, authentication, and integrity. In this paper, we propose secure NAT-PT(SNAT-PT) and the corresponding secure host architecture to support IPSec security service. And also tunneling scheme using dummy IP header is presented to show the valid operation of end-to-end IPSec protocol on the proposed architectures.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10e
• /
• pp.415-417
• /
• 2002

운영체제가 지원되지 않는 소규모 기기에서 IPv6의 보안기능을 고성능으로 제공하기 위해본 연구실에서는 IPv6용 IPsec 프로토콜과 암호화 알고리즘을 하드웨어로 구현하였다. 이러한 IPv6용 하드웨어 IPsec을 기반으로 한 보안 서비스를 제공하기 위해서는 안전한 키의 교환과 인증이 중요하다. 이를 위하여 본 논문에서는 IPv6용 하드웨어 IPsec을 위한 키 교환시스템으로서 IKE Module을 설계하여 드라이버 프로그램으로 구현하였다. 그리고 구현된 IKE Module을 IPv6용 하드웨어 IPsec의 드라이버로 탑재하여 기존의 소프트웨어 IKE Module과의 테스트를 통하여 기능을 검증하였다.

• Review of KIISC
• /
• v.11 no.2
• /
• pp.16-26
• /
• 2001

IPSsec 제품은 호스트에 구현될 수도 있고, VPN 장비의 형태일 수도 있으며, 방화벽이나 라우터에 구현되어 있을 수 도 있다. 또한, IPSec은 동일한 조직의 네트워크에서뿐만 아니라 독립된 조직의 네트워크들 사이에서도 사용될 수 있어야 하며, 따라서 여러 제품들끼리의 상호운용성이 그 사용에 있어서의 기본 요건이다 IPSec 제품의 상호운용성을 위해 IPSec 제품이 표준을 준수하고 있는지에 대한 적합성 시험과 IPSec 제품들 사이에 상호 운용 여부를 시험하는 상호운용성 시험이 필요하며, 본 논문에서는 IPSec 제품에 대한 적합성 시험과 상호운용성 시험 기술과 방법을 미국과 일본의 사례를 중심으로 조사한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04d
• /
• pp.391-393
• /
• 2003

대학 전산망은 다양한 종류의 하드웨어와 소프트웨어로 이루어진 대표적인 이질망이며 , 다양한 성향을 갖는 사용자들이 공존하는 환경이므로 망 계층 보안 서비스의 도입이 필연적이다. 본 논문에서는 대학 전산망에서 IPSec을 도입하는데 필수적인 IPSec 키 관리 시스템을 제시한다. 제안된 IPSec 키 관리 시스템은 IPSec과 PKIX가 결합된 형태로 구성되며 , 각 호스트는 부팅 과정에서 IP 주소를 결정 한 후, 망 계층 서버에 자신의 IP 주소와 공개키를 등록하여 망 계층 보안 서비스를 제공하도록 한다. 또한 망 계층 인증 서버는 웹 인터페이스를 통해 망 관리자가 전체 구성원의 키를 관리하는 인터페이스를 제공한다.