• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.9B
• /
• pp.1342-1349
• /
• 2010

Full-mesh IPSec tunnels, which constitute a black network, are required so that the dynamically changing PT (Plain Text) networks can be reachable across the black network in military environments. In the secure and mobile black networks, dynamically re-configuring IPSec tunnels and security policy database (SPD) is very difficult to manage. In this paper, for the purpose of solving mobility and security issues in military networks, we suggest the relating main technologies in association with DMIDP (Dynamic Multicast-based IPSec Discovery Protocol) based on existing IPSec ESP (Encapsulating Security Payload) tunnels and IPSec key managements. We investigate the main parameters of the proposed DMIDP techniques and their operational schemes which have effects on mobility and analyze operational effectivemess of the DMIDP with proposed parameters.

• TTA Journal
• /
• s.77
• /
• pp.72-80
• /
• 2001

본 고는 IP 기반 VPN의 핵심 요소기술인 대표적 터널 프로토콜과 이들의 표준화동향을 살펴본다. IPSEC의 최근 표준화동향, IPSEC을 이용한 L2TP 터널 보안, 그리고 네트워크 기반 VPN의 유력한 터널 프로토콜로 부상하는 MPLS가 논의된다. 아울러 말미에 VPN 표준 기술의 향후 전망이 간략히 기술된다.

• Journal of KIISE:Computing Practices and Letters
• /
• v.11 no.6
• /
• pp.531-537
• /
• 2005

The Tunnel Broker is to provide dedicated servers and to automatically manage tunnel requests coming from the users. This approach is useful to stimulate the growth of IPv6 interconnected hosts and to provide easy access to their IPv6 networks. However, the existing tunnel broker is vulnerable to attacks of malicious users about network resources and services. Therefore, to solve the secure problem of tunnel broker, this paper presents secure IPv6 tunnel broker based on TSP(Tunnel Setup Protocol). The clients and the tunnel broker are communicated based on SHTTP(Secure HTTP) and the XML message of plain text is converted to XML signature by encryption and decryption. finally, Clients and tunnel server use the IPsec method to protect the important information.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.6B
• /
• pp.977-983
• /
• 2010

In mobile and secure military networks, full-meshed IPSec tunnels, which do correspond to not physical links but logical links between each IPSec device and its peer, are required to provide multicast communications. All IPSec devices need support in changing IPSec tunnels by a way of using a multicast group key which is updated dynamically. Tactical terminals, which often constitute a group, need also secure multicast communications in the same group members. Then, the multicast group key is required to be updated dynamically in order to support group members' mobility. This paper presents challenging issues of designing a secure and dynamic group key management of which concept is based on the Diffie-Hellman (DH) key exchange algorithm and key trees. The advantage of our dynamic tree based key management is that it enables the dynamic group members to periodically receive status information from every peer members and effectively update a group key based on dynamically changing environments.

• Journal of KIISE:Information Networking
• /
• v.34 no.1
• /
• pp.1-15
• /
• 2007

Increase in the wireless mobile network users brings the issue of mobility management into the Virtual Private Network (VPN) services. We propose a provider edge (PE)-based provider provisioned mobile VPN mechanism, which enables efficient communication between a mobile VPN user and one or more correspondents located in different VPN sites. The proposed mechanism not only reduces the IPSec tunnel overhead at the mobile user node to the minimum, but also enables the traffic to be delivered through optimized paths among the (mobile) VPN users without incurring significant extra IPSec tunnel overhead regardless of the user's locations. The proposed architecture and protocols are based on the BGP/MPLS VPN technology that is defined in RFC24547. A service provider platform entity named PPVPN Network Server (PNS) is defined in order to extend the BGP/MPLS VPN service to the mobile users. Compared to the user- and CE-based mobile VPN mechanisms, the proposed mechanism requires less overhead with respect to the IPSec tunnel management. The simulation results also show that it outperforms the existing mobile VPN mechanisms with respect to the handoff latency and/or the end-to-end packet delay.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.26 no.11C
• /
• pp.102-112
• /
• 2001

This paper analyzes Security Performance and Processing Performance to measure performance between nodes by using AH and ESP protocol. IPsec VPN provides application with security service implemented in IP Layer while traffic cost and packet processing time it increased by encryption, decryption and authentication in AH and ESP. We measured overall packet processing time and IPsec module processing time. The result of the efficiency test showed that the factors of influencing electrical transmission efficiency were the size of electrical transmission packets, codes used for tunnelling, authentication functions, CPU velocity of host7, and the embodiment of IPsec; for a high capacity traffic, IPsec transmission was not appropriate, because transmission velocity was delayed by more than ten times in comparison with Non-IPsec.

• Journal of KIISE:Information Networking
• /
• v.30 no.5
• /
• pp.604-613
• /
• 2003

Network Address Translation-Protocol Translation(NAT-PT) is an IPv4/IPv6 translation mechanism, as defined in RFC2766, allowing IPv6-only devices to communicate with IPv4-only devices and vice versa. But NAT-PT has the restriction that applies to IPv4 NAT where NAT-PT does not provide end-to-end security, which is a major goal of IPSec. Therefore it cannot support security services such as confidentiality, authentication, and integrity. In this paper, we propose secure NAT-PT(SNAT-PT) and the corresponding secure host architecture to support IPSec security service. And also tunneling scheme using dummy IP header is presented to show the valid operation of end-to-end IPSec protocol on the proposed architectures.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.1 no.2
• /
• pp.107-122
• /
• 2008

Communication is be classified into public network and private network. VPN is made by integrating the circuit cost reduction of public network and the reliable security support of public network. This paper analyzes the IPSec using three layer tunneling, MPLS(Multi Protocol Label Switching) integrating 2 layer switching and 3 layer routing techniques and dedicated line from the viewpoint of security. In conclusion, VPN is better than dedicated network line in cost and security. If IPSec VPN is compared with MPLS VPN, MPLS VPN is more excellent than IPSec VPN in safe data transmission, cost, QoS and management.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.43 no.7 s.349
• /
• pp.41-49
• /
• 2006

Wireless AD-hoc network can construct a network itself without any arbitrator. Therefore, it is difficult to make preparation for disguised assault from an illegal node, and because lots of packets from disguised assault spread over whole network, it influences the network usability and livability. This thesis proposed a safe IPv6 tunnel broker (TB) based on TSP (Tunnel Setup Protocol) to improve safety of the wireless Ad-hoc network, and to solve security problem of a tunnel broker that makes a linkage IPv4 and IPv6. To communicate between client and the tunnel broker, proposed method does not base on HTTP, but S-HTTP (Secure-HTTP) and it uses encryption/decryption to send and receive XML document. Finally, this method encrypts (decrypts) important information by applying IPSec between client and TS (Tunnel Server).

• Journal of the Korea Society for Simulation
• /
• v.11 no.1
• /
• pp.31-44
• /
• 2002

VPN which cuts down on expense and assures security and reliance, has increased its market shares quickly because the requirement of enterprise on security has increased. But Fragmentation may raise communication failure when VPN has been implemented using IPSec. In our paper, we have given careful consideration to various reasons Preventing us from communicating stable and have presented the existing solutions about them. Also we hate provided adaptive PMTU discovery mechanism to improve: the solutions. We have proven a prowess of this mechanism through simulation