• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.5
• /
• pp.11-21
• /
• 2004

To authorize IPSec-VPN Client in Client-to-Gateway type of the IPSec-VPN system, it can be normally used with ID/Password verification method or the implicit authorization method that regards implicitly IPSec-VPN gateway as authorized one in case that the IPSec-VPN client is authenticated. However, it is necessary for the Client-to-Gateway type of the IPSec-VPN system to have a more effective user authorization mechanism because the ID/Password verification method is not easy to transfer the ID/Password information and the implicit authorization method has the vulnerability of security. This paper proposes an effective user authorization mechanism using an attribute certificate and designs a user authorization engine. In addition, it is implemented in this study. The user authorization mechanism for the IPSec-VPN system proposed in this study is easy to implement the existing IPSec-VPN system. Moreover, it has merit to guarantee the interoperability with other IPSec-VPN systems. Furthermore, the user authorization engine designed and implemented in this paper will provide not only DAC(Discretional Access Control) and RBAC(Role-Based Access Control) using an attribute certificate, but also the function of SSO(Single-Sign-On).

• Journal of Internet Computing and Services
• /
• v.14 no.5
• /
• pp.11-26
• /
• 2013

In the wireless Internet, it is so restrictive to use the IPSec. The MIPv4 IPSec's path cannot include wireless links. That is, the IPSec of the wireless Internet cannot protect an entire path of Host-to-Host connection. Also wireless circumstance keeps a path static during the shorter time, nevertheless, the IKE for IPSec SA agreement requires relatively long delay. The certificate management of IPSec PKI security needs too much burden. This means that IPSec of the wireless Internet is so disadvantageous. Our paper is to construct the Mobile IPSec proper to the wireless Internet which provides the host-to-host transport mode service to protect even wireless links as applying excellent WP-IBE scheme. For this, Mobile IPSec requires a dynamic routing over a path with wireless links. FA Forwarding is a routing method for FA to extend the path to a newly formed wireless link. The FA IPSec SA for FA Forwarding is updated to comply the dynamically extended path using Source Routing based Bind Update. To improve the performance of IPSec, we apply efficient and strong future Identity based Weil Pairing Bilinear Elliptic Curve Cryptography called as WP-IBE scheme. Our paper proposes the modified protocols to apply 6 security-related algorithms of WP-IBE into the Mobile IPSec. Particularly we focus on the protocols to be applied to construct ESP Datagram.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.5
• /
• pp.27-35
• /
• 2002

In this paper, we present the structure and interaction flow between IKE server and the other modules for our IPsec System's efficiency. Our IPsec systems have several components for IP-based end-to-end security services. They are IKE, SADB and SPDB and so on, not to speak of IPsec Protocol Engine. Therefore the efficient interaction structure between them has an much influence on total system efficiency. Especially, in case of IPsec engine integrated with kernel, it is very important how IPsec engine can refer to SPDB and SADB entries efficiently according to the location of the implementation of SPDB and SADB. To solve the above problem, we use the SPI generated by IKE. Finally, we propose the interaction structure between IKE server and the other modules according to the optimization for referring to SPDB and SADB entries.

• Proceedings of the KIEE Conference
• /
• 2004.11c
• /
• pp.123-125
• /
• 2004

The importance for Internet security has being increased and the Internet Protocol Security (IPSec) standard, which incorporates cryptographic algorithms, has been developed as one solution to this problem. IPSec provides security services in IP-Layer using IP Authentication Header (AH) and IP Encapsulation Security Payload (ESP). In this paper, we propose IPSec cryptographic processor design based AMBA architecture. Our design which is comprised Rijndael cryptographic algorithm and HAMC-SHA-1 authentication algorithm supports the cryptographic requirements of IP AH, IP ESP, and any combination of these two protocols. Also, our IPSec cryptographic processor operates as AMBA AHB Slave. We designed IPSec cryptographic processor using Xilinx ISE 5.2i and VHDL, and implemented our design using Xilinx's FPGA Vertex XCV600E.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.406-408
• /
• 2004

인터넷 보안에 대한 중요성이 나날이 증가하고 있으며. 이러한 인터넷 보안 문제의 해결책으로 개발된 IPSec은 IP 계층에서 보안서비스를 제공하기 위하여 AH와 ESP를 사용하여 보안연계(Security Association) 서비스를 제공한다. 본 논문에서는 32-bit 데이터 베이스를 이용하여 새로운 AES로 채택된 Rijndael 암호 알고리즘과 HMAC-SHA-1 인증 알고리즘을 통합시킨 IPSec 암호 프로세서를 구현하였다. Xilinx ISE 5.2i를 사용하여 VHDL로 설계하였고, ModelSim으로 시뮬레이션 검증을 수행하였으며, Xilinx사의 Vertex XCV1000E로 구현하였다. 본 논문에서 구현한 IPSec 암호 프로세서는 WLAN이나 VPN, Firewall등에 응용될 수 있을 것이다.

• Journal of KIISE:Information Networking
• /
• v.30 no.5
• /
• pp.604-613
• /
• 2003

Network Address Translation-Protocol Translation(NAT-PT) is an IPv4/IPv6 translation mechanism, as defined in RFC2766, allowing IPv6-only devices to communicate with IPv4-only devices and vice versa. But NAT-PT has the restriction that applies to IPv4 NAT where NAT-PT does not provide end-to-end security, which is a major goal of IPSec. Therefore it cannot support security services such as confidentiality, authentication, and integrity. In this paper, we propose secure NAT-PT(SNAT-PT) and the corresponding secure host architecture to support IPSec security service. And also tunneling scheme using dummy IP header is presented to show the valid operation of end-to-end IPSec protocol on the proposed architectures.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.15 no.5
• /
• pp.147-154
• /
• 2015

Satellite broadcasting networks, like if you have if you have just received information that everyone must bring the required security attributes this earth should be done as encryption. In this paper, a satellite communication network AH additional security header in transport mode IPsec VPN by applying the SHA-256 and MD-5 authentication algorithm to authenticate the data portion Error rate and analyze the BER and Throughput. First, to generate a normal IP packet added to IPsec transport mode security header AH were constructed internal authentication data by applying the SHA-256 and MD-5 algorithm. Channel coder was applied to the Rate Compatible Punctured Turbo Codes, packet retransmission scheme Hybrid-ARQ Type-II and Type-III were used. Modulation method was applied to the BPSK, the wireless channel Markov channel (Rician 80%, Rayleigh 20% and Rician 90%, Rayleigh 10%) as an authentication algorithm according to the satellite channel state analyzed how they affect the error rate and Throughput.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2002.05d
• /
• pp.920-925
• /
• 2002

급속히 고갈되어가는 IPv4의 주소 부족 문제를 해결하기 위하여, 차세대 인터넷 프로토콜 (IP)인 IPv6가 제안되었고 실용화 단계까지 진행되고 있다. IPv6에서의 요구 사항 중의 하나인 IPSec은 IPv4의 취약한 보안 기능을 강화하는 것이다. 현재 IPSec에서 반드시 구현되어야 할 암호화 알고리즘으로 MD5, SHA1, 3DES와 더불어 최근 표준안으로 채택된 AES(Rijndael)을 요구하고 있다. IPv6의 고속 수행을 위하여는 IPSec이 하드웨어로 구현될 필요성이 있으므로, 본 논문에서는 IPv6용 IPSec 칩에 탑재할 AES 하드웨어 모듈을 구현하였다. 제안된 하드웨어 모듈은 효율적인 알고리즘의 수행과 구현을 위하여, 암호화/복호화 단계가 동일한 구조로 동작하도록 설계하였으며, 가변적인 128, 196,256 비트의 키에 대하여 같은 로직을 사용하도록 설계하였다.

• Review of KIISC
• /
• v.13 no.5
• /
• pp.24-30
• /
• 2003

인터넷을 비롯한 대부분의 패킷스위칭 네트워크는 IP(Internet Protocol)을 기반으로 하고 있다. 그러나, IP는 기본적으로 보안에 취약하게 설계되어 보안이 필요한 통신에 사용하는데는 어려움이 있다. IPSec(IP Security)은 IP 트래픽에 대한 이러한 보안문제를 극복하기 위해 생겨났으며, 방화벽과 결합된 형태로 가장 널리 쓰이고 있는 VPN(Virtual Private Network) 제품의 하나이다. 그러나 IPSec의 문제점이 대두되고, Web-based Service가 영역을 넓혀가면서 기존의 웹보안프로토콜인 SSL이 VPN의 새로운 형식으로 나타나고 있다. 본 고에서는 IPSec VPN과 SSL VPN의 차이점의 분석하여 정리하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.04b
• /
• pp.813-816
• /
• 2002

현재 인터넷은 IPv4(Internetworking Protocol, version 4)를 사용하고 있다. 하지만 데이터 통신은 1970년대에 IPv4가 나온 이래에 발전을 거듭하여 왔다. IPv4는 빠르게 발전하는 인터넷에의 요구를 수용하기 위해 IPv6가 제안되었고 현재 표준이 되었다. IPv6에서는 암호화와 인증옵션들은 패킷의 신뢰성과 무결성을 등을 제공한다. 인터넷에서의 정보보호는 인터넷을 구성하는 여러 계층에서 이루어 질 수 있지만, IPsec에서는 AH(Authentication Header)프로토콜과 IPsec ESP(Encapsulating Security Payload)프로토콜 두 가지의 암호 프로토콜이 사용되지만 AH에서는 HMAC를 이용한 HMAC-MD5나 HMAC-SHA-1 중 하나를 반드시 기본 인증 알고리즘으로 지원하여야 한다. 본 논문에서는 MD5를 이용한 HMAC-MD5를 기준으로 설계하였으며, Iterative Architecture과 Full loop unrolling Architecture의 두 가지 구조를 설계하였다.