• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.1 no.2
• /
• pp.107-122
• /
• 2008

Communication is be classified into public network and private network. VPN is made by integrating the circuit cost reduction of public network and the reliable security support of public network. This paper analyzes the IPSec using three layer tunneling, MPLS(Multi Protocol Label Switching) integrating 2 layer switching and 3 layer routing techniques and dedicated line from the viewpoint of security. In conclusion, VPN is better than dedicated network line in cost and security. If IPSec VPN is compared with MPLS VPN, MPLS VPN is more excellent than IPSec VPN in safe data transmission, cost, QoS and management.

• The Journal of Information Technology
• /
• v.7 no.4
• /
• pp.21-30
• /
• 2004

A VPN(Virtual Private Network) is constructed using public wires to connect nodes. It can be used like the dedicated line and maintain the security of the data on the VPN. And It uses encryption and other security mechanisms to ensure that only authorized users can access the network. In this paper we summarize IPsec and VPN technology and construct pilot VPN system for analyzing the performance of remote access VPN. Then we analyze the performance of remote VPN system using VPN concentrator in case of single user and in case of multi users.

• Journal of Digital Convergence
• /
• v.14 no.5
• /
• pp.341-348
• /
• 2016

Because VPN(Virtual Private Network) uses internet network, the security technique should support it and evaluation technique based on standard should support it. Therefore the method should be organized that can evaluate the security of VPN based on the related standard. In this study, we intended to construct the security evaluation model through combining CC(Common Criteria) which is a evaluation standard and a part of security(Confidentiality, Integrity, Non-repudiation, Accountability, Authenticity) evaluation of ISO which is the standard of software quality evaluation. For this, we analyzed the quality requirements about intra-technology and security of VPN and constructed the evaluation model related to the quality characteristics of two international standard. Through this, we are able to construct a convergence model for security evaluation of VPN. Through accumulating the evaluation practices for VPN in the future, the suitability and validity of the evaluation model must be improved.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.28 no.10B
• /
• pp.891-898
• /
• 2003

In the remote access VPN architecture which is based on IPsec, if the VPN client wants to be served the VPN service continuously during VPN client's handoff, It needs the techniques to merge VPN with Mobile IP. In this case, if the VPN client roams to new subnet, it acquires new CoA. As a result of changing IP address, existing SA becomes useless and new SA is required. The SA renegotiation process results from handoff of the VPN client and does not result from security aspect. Hence, In the environment which includes many handoffs, overhead by SA re-negotiation deteriorates performance. In this paper, we propose the technique provides that it doesn't need to renegotiate SA and be able to get the security service continuously even though MN's handoff occurs in Mobile IP VPN environment.

• Proceedings of the IEEK Conference
• /
• 2005.11a
• /
• pp.233-236
• /
• 2005

Our country compares with advanced nations by supply of super high speed network and information communication infra construction has gone well very. Many people by extension of on-line transaction and various internet services can exchange, or get information easily in this environment. But, virus or poisonous information used to Cyber terror such as hacking was included within such a lot of information and such poisonous information are threatening national security as well as individual's private life. There were always security and speed among a lot of items to consider networks equipment from these circumstance to now when develop and install in trade-off relation. In this paper, we present a high speed VPN Acceleration Board(VPN-AB) that balances both speed and security requirements of high speed network environment. Our VPN-AB supports two VPN protocols, IPsec and SSL. The protocols have a many cryptographic algorithms, DES, 3DES, AES, MD5, and SHA-1, etc.. The acceleration board process data packets into the system with In-line mode. So it is possible that VPN-AB processes inbound and outbound packets by 10Gbps. We use Nitrox-II CN2560 security processor VPN-AB is designed using that supports many hardware security modules and two SPI-4.2 interfaces to design VPN-AB.

• Convergence Security Journal
• /
• v.3 no.1
• /
• pp.1-6
• /
• 2003

Virtual Private Network (VPN) is the technology that can reduce the cost revolutionary and maintain the security like an private line, and the demand is increased more and more. Two kinds of current VPN Protection Profiles(PP) for the national organ are used on development, but it is considered by being several problems. In this paper we consider the VPN's PP problems that has been used currently, and describe to an improvement direction.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2022.07a
• /
• pp.257-258
• /
• 2022

COVID-19 팬데믹으로 인하여, 재택근무와 같은 비대면 업무환경이 확대됨에 따라, 기업에서는 내부 보안을 위한 VPN 구축 및 사용률이 급격하게 증가하였다. 하지만, 기존의 대면 환경과는 다르게, 비대면 업무환경에서는 자신을 식별할 수 있는 수단을 제한적으로 활용하기 때문에, 사용자의 비밀번호가 노출되면, VPN에 접근하기 위한 사용자 인증이 무력화되는 심각한 문제점이 존재하며, 이러한 보안 취약점을 해결하기 위한 기술이 요구되는 실정이다. 따라서 본 논문에서는 기존 VPN 인증 기술에 내재된 보안 취약점을 해결하기 위하여, 사물 환경 인증, HIP 기술, 위치 인증, 상호 인증 기술을 활용한 다중 인증 기반의 제로 트러스트를 제공하는 VPN 인증 기술을 제안한다. 최종적으로는 본 논문에서 제안하는 기술을 통하여, 보다 안전성이 향상된 VPN을 제공할 것으로 사료된다.

• Convergence Security Journal
• /
• v.5 no.3
• /
• pp.87-92
• /
• 2005

The performance of a cryptographic module is the most important thing to achieve a high performance VPN system which realizes information security by encrypting and decrypting all the communicating data packets. However the cryptographic operations require much computation power and software cryptographic systems reveal bad performance. Thus, it is strongly recommended to develop a VPN system employing hardware component. This paper introduces a case study of developing a PCI add-on card which supports several block cipher algorithms such as DES, 3DES, AES, and SEED. The performance of them was measured by embedding the card in a commercial VPN system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.4
• /
• pp.661-671
• /
• 2022

Due to the COVID-19 pandemic, remote working, e-learning, e-teaching and online collaboration have widely spread and become popular. Accordingly, the usage of IPsec VPN for security reasons has also dramatically increased. With the spread of VPN, VPN vulunerabilities are becoming an important target of attack for attackers, and many studies have been conducted on this. IKE v2 analysis is an essential process not only for developing and building IPsec VPN systems but also for security analysis. Network packet analysis tools such as Wireshark and Tcpdump are used for IKE v2 analysis. Wireshark is one of the most famous and widely-used network protocol analyzers and supports IKE v2 analysis. However Wireshark has many limitations, such as requiring system administrator privileges for IKE v2 analysis. In this paper, we describe Wireshark's limitations in detatil and propose a new analysis method. The proposed analysis method can analyze all encrypted IKE v2 messages in real time from the session key exchange In addition, the proposed analysis method is expected to be used for dynamic testing such as fuzzing as packet manipulation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.5
• /
• pp.11-21
• /
• 2004

To authorize IPSec-VPN Client in Client-to-Gateway type of the IPSec-VPN system, it can be normally used with ID/Password verification method or the implicit authorization method that regards implicitly IPSec-VPN gateway as authorized one in case that the IPSec-VPN client is authenticated. However, it is necessary for the Client-to-Gateway type of the IPSec-VPN system to have a more effective user authorization mechanism because the ID/Password verification method is not easy to transfer the ID/Password information and the implicit authorization method has the vulnerability of security. This paper proposes an effective user authorization mechanism using an attribute certificate and designs a user authorization engine. In addition, it is implemented in this study. The user authorization mechanism for the IPSec-VPN system proposed in this study is easy to implement the existing IPSec-VPN system. Moreover, it has merit to guarantee the interoperability with other IPSec-VPN systems. Furthermore, the user authorization engine designed and implemented in this paper will provide not only DAC(Discretional Access Control) and RBAC(Role-Based Access Control) using an attribute certificate, but also the function of SSO(Single-Sign-On).