• Proceedings of the Korean Information Science Society Conference
• /
• 2002.04a
• /
• pp.385-387
• /
• 2002

IETF에서 IPSec(Internet Protocol Security)[1]의 구조를 발표한 이래 IPSec을 이용한 많은 VPN(Virtual PrivateNetwork)[2][3]이 구축되어 왔다. 이렇게 구축된 VPN에서 사용되는 CG(CryptoGate) 혹은 SG(Security Gateway)는 각각의 망에서 게이트 역할을 한다. 하지만 이런 기존의 CG나 SG는 IPSec의 정책을 사용자가 선택하는 것이 아닌 망 관리자가 일방적으로 서비스하도록 설계되어있다. 이러한 점은 사용자가 자신의 데이터를 평가하여 자율적으로 그에 맞는 서비스를 이용하는 것이 아니므로 사용자가 사용하는 것을 꺼릴 수도 있다. 또한 게이트웨이에 자신의 키를 백업할 수 있도록 하여서 사용자가 다시 이 망에 접근할 경우 다시 키 협상을 하는 것이 아닌 백업해둔 키를 가지고 연결할 수 있도록 하였다. 본 논문은 VPN에서 이러한 점을 고려하여 CG를 설계함으로써 VPN 사용의 확장성을 해결한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.07a
• /
• pp.328-330
• /
• 2005

현재의 RSVP-TE는 VPN hose provisioning 메커니즘들을 고려하여 자원예약을 수행하지 못한다. 이 논문에서는 Provider Provisioned-Virtual Private Network(PP-VPN)에서 Quality of Service(QoS)를 제공하는 Hose 모델 기반의 provisioning 메커니즘들을 네트워크에 적용하여 자원예약을 수행하도록 하기 위해 Resource Reservation Protocol Traffic Engineering(RSVP-TE)의 확장방안에 대해 설명한다. 동일한 VPN을 서비스하는 LSP들 간 자원을 공유할 수 있게 함으로써 네트워크 상에 요구되는 자원을 최적화하였으며, VPN 고객을 서비스하기 위한 효율적이고 자동적인 자원예약이 가능하도록 하였다. 이 논문에서는 솔루션의 프로토콜 elements와 procedure에 대하여 설명한다.

• The KIPS Transactions:PartC
• /
• v.9C no.4
• /
• pp.481-488
• /
• 2002

Guarantee of the data integrity is important to the Virtual Private Network (VPN) which can be improved cost decreasing and effective work by applying on Internet as the private network. Thus, the integrity function in the VPN must be maintained and the security manager must be check it occasionally. In this paper we propose the VPN Integrity Evaluation System (VIES) which is collecting, and evaluating automatically the vulnerable data of VPN against current hacking mechanisms in information security system. And this VIES obtain to the results which have objectivity and fairness of evaluation by driving off the evaluation scenario based on Common Criteria (CC), and general users or non-specialist can utilize easy the security evaluation of organization.

• 제어로봇시스템학회:학술대회논문집
• /
• 2005.06a
• /
• pp.1586-1589
• /
• 2005

GUMF (Global User Management Framework) that is proposed in this research can be applied to next generation network such as BcN (Broadband convergence Network), it is QoS guaranteed security framework for user that can solve present Internet's security vulnerability. GUMF offers anonymity for user of service and use the user's real-name or ID for management of service and it is technology that can realize secure QoS. GUMF needs management framework, UMS (User Management System), VNC (Virtual Network Controller) etc. UMS consists of root UMS in country dimension and Local UMS in each site dimension. VNC is network security equipment including VPN, QoS and security functions etc., and it achieves the QoSS (Quality of Security Service) and CLS(Communication Level Switching) functions. GUMF can offer safety in bandwidth consumption attacks such as worm propagation and DoS/DDoS, IP spoofing attack, and current most attack such as abusing of private information because it can offer the different QoS guaranteed network according to user's grades. User's grades are divided by 4 levels from Level 0 to Level 3, and user's security service level is decided according to level of the private information. Level 3 users that offer bio-information can receive secure network service that privacy is guaranteed. Therefore, GUMF that is proposed in this research can offer profit model to ISP and NSP, and can be utilized by strategy for secure u-Korea realization.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.8
• /
• pp.3012-3020
• /
• 2010

VPN can give safety in connection in Timbuc-too, by corporation's basis communication means today that transfer user support in Timbuc-too is required compulsorily, VPN is activated. This research wishes to investigate base technology of VPN software field and investigate VPN software market trend and standard and develop estimation model of VPN software. For this special quality of VPN software investigation / analyze and investigate or analyze market trend and standard this to VPN software to base deduction of estimation item and estimation model develop.

• The KIPS Transactions:PartC
• /
• v.14C no.7
• /
• pp.559-570
• /
• 2007

In this paper, we define a Hose-NSIS-QoSM, which reserves and manages resources according to the hose based resource provisioning mechanisms for supporting the VPN QoS(Quality of Service) using the NSIS(Next Step in Signaling) signaling protocol. Specifically, we specify the NSIS message objects, the structures of QoS NSLP(NSIS Signaling Layer Protocol)/NTLP(NSIS Transport Layer Protocol)/RMF(Resource Management Function) state tables and the processing of the signaling messages in NSIS nodes. Also, we compare the Hose-NSIS-QoSM with the Hose-RSVP-TE-QoSM that supports the hose based VPN QoS in the MPLS networks using the extended RSVP-TE mechanism.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.38 no.11
• /
• pp.9-18
• /
• 2001

Currently most of VPNs within internet has only capability to protect cooperate data. Recently, various types of VPNs are being studied based on the concept of SCG(Secure Communication Group). This paper analyses the problems of path-definition method and area-definition method of VPNs using SCG technology, and discusses the possible models among VPNs using SCG technology. This paper proposes the hierarchal VPN configuration method using SCG number and internet based area definition method, and analyze the characteristics of the proposed VPN model on the point of the authentication frequency and the number of managements keys.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.28 no.6C
• /
• pp.659-667
• /
• 2003

IPsec refers to a standardized set of security protocols and algorithms which can provide the integrity, the authentication and the confidentiality services for IP packets in the Internet. Between two security gateways, IPsec provides the access control, the connectionless Integrity, data origin authentication, the anti-replay, and the confidentiality services, not only to the IP layer but also to the upper layers. In this paper, we describe a VPN (Virtual Private Network) testbed configuration using the FreeS/WAN and analyze the ISAKMP messages exchanged between the linux security gateway during the IKE SA setup. Also, we describe our development of an IPSEC encryption verification tool which can be used conveniently by VPN administrators.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.42 no.10 s.340
• /
• pp.31-38
• /
• 2005

Ipsec is a security protocol suite that provides encryption and authentication services for IP messages at the network layer of the internet. Internet Key Exchange (IKE) is a protocol that is used to negotiate and provide authenticated keying materials in a protected manner for Security Associations (SAs). In this paper, we propose a dynamic key lifetime change algorithm for performance enhancement of virtual private networks using IPSec. The proposed algorithm changes the key lifetime according to the number of secure tunnels. The proposed algorithm is implemented with Linux 2.4.18 and FreeS/WAN 1.99. The system employing our proposed algorithm performs better than the original version in terms of network performance and security.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.04a
• /
• pp.404-405
• /
• 2015

최근 IT기술과 인터넷의 발전으로 시간과 공간에 제한을 두지 않고 업무를 처리해야 하는 상황으로 업무환경이 급격히 변화되고 있다. 특히 기업에서는 외부 네트워크와 정보교환의 필요성이 증가되었고, 구성원들의 잦은 외근, 출장 등 사무실 밖에서 업무를 처리하는 비중이 높아져, 내부뿐만 아니라 외부와의 정보공유를 하는데 있어 안전한 네트워크 구조를 요구하고 있다. 외부에서 효율적이고 안전하게 내부시스템에 접속할 수 있게 사용되는 것이 VPN(가상사설망: Virtual Private Network)으로, 기관 및 기업에서 VPN을 지속적으로 도입하여 운영하고 있다. 하지만 VPN에 인증이 성공되면 다양한 업무시스템에 접근이 용이하기 때문에, 악의적인 사용자로부터 정보유출이 손쉽게 이루어질 수 있다. 따라서 본 연구에서는 사용되고 있는 VPN에 대해 관리가 잘 이루어지는지 확인하는 실태점검 리스트를 제시하고, VPN에 대한 정보유출방지 모니터링을 위해 VPN의 접속로그를 분석하여 정보유출 보안위협행위를 탐지할 수 있는 시나리오를 도출하고자 한다.