• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.727-729
• /
• 2003

IPsec는 IP layer에서의 보안을 제공하기 위해 제안된 프로토콜이다. 이를 구현하는데 있어서 아직은 여러가지 문제점들이 있다. 그 중 하나가 키 관리 프로토콜인 IKE의 복잡성과 보안상의 허점 때문이다. IETF IPsec WG에서는 이러한 문제점을 해결하기 위한 프로토콜들을 제안해 왔으며 최근에, IKE를 대체할 프로토콜로 결정한 것이 IKEv2이다. IKEv2는 IKE를 기반으로 하여 보다 단순하고 강건하게 설계된 프로토콜이다. 본 논문에서는 현 IKE와 IKEv2를 소개하고 개선된 점을 위주로 비교 분석한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.4
• /
• pp.661-671
• /
• 2022

Due to the COVID-19 pandemic, remote working, e-learning, e-teaching and online collaboration have widely spread and become popular. Accordingly, the usage of IPsec VPN for security reasons has also dramatically increased. With the spread of VPN, VPN vulunerabilities are becoming an important target of attack for attackers, and many studies have been conducted on this. IKE v2 analysis is an essential process not only for developing and building IPsec VPN systems but also for security analysis. Network packet analysis tools such as Wireshark and Tcpdump are used for IKE v2 analysis. Wireshark is one of the most famous and widely-used network protocol analyzers and supports IKE v2 analysis. However Wireshark has many limitations, such as requiring system administrator privileges for IKE v2 analysis. In this paper, we describe Wireshark's limitations in detatil and propose a new analysis method. The proposed analysis method can analyze all encrypted IKE v2 messages in real time from the session key exchange In addition, the proposed analysis method is expected to be used for dynamic testing such as fuzzing as packet manipulation.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2003.11b
• /
• pp.719-722
• /
• 2003

IP 기반에서 보안 서비스를 제공하는 IPsec은 IP 패킷에 대한 기밀성과 무결성 그리고 인증과 같은 보안 서비스를 제공하는 국제 표준 프로토콜이며, IPsec의 키 관리 프로토콜은 IKE이다. 그러나 기존의 IKE 프로토콜은 구현이 복잡하고 1단계와 2단계의 SA 설정에 총 9번의 과다한 메시지 교환으로 인해 실제 시스템간의 상호 운용성이 떨어질 뿐만 아니라 기존 시스템의 성능을 저하시키는 단점이 꾸준히 제기되어 왔다. 또한 서비스 거부 공격에 대해 매우 취약한 구조를 가지고 있다. 따라서 본 논문에서는 이를 해결하기 위해 IKE가 가지고 있는 대부분의 특징과 속성을 유지하면서 프로토콜을 단순화하고 효율성과 안전성, 유연성을 증대시킬 수 있도록 기존 IKE 프로토콜을 개선하여 단순화된 IKE 프로토콜을 설계하였다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2004.05b
• /
• pp.173-176
• /
• 2004

전 세계적으로 안전한 데이터의 송수신에 대한 많은 연구가 지속되어 왔다. IPsec은 IP 패킷에 대해 기밀성과 무결성 그리고 인증과 같은 보안 서비스를 제공하는 국제 표준 프로토콜이며 IPsec의 키 관리 메커니즘이 IKE이다. 기존 IKE는 시스템간의 상호 운용성이 떨어질 뿐만 아니라 시스템의 성능을 저하시키며 서비스 거부 공격(DoS)에 대해 매우 취약한 구조를 가지고 있다. 본 논문에서는 이러한 문제점을 해결하기 위해서 기존 IKE 프로토콜에서 사용되지 않는 모드를 삭제하고 인증 방법을 전자서명과 공유된 비밀키에 기반한 방식으로 단일화시켰다. 또한 DoS 공격을 예방할 수 있도록 단순화된 IKE 프로토콜을 구현하고 테스트하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2008.05a
• /
• pp.917-920
• /
• 2008

The Internet Key Exchange (IKE) protocol is most widely used as a security key exchange protocol on the Internet. Security policies used by the IKE protocol must be configured in advance, however the complex options and manual settings cause inconvenience. This paper proposes an automatic configuration method for the IKE protocol based on X.509 certificate. Security policies are embedded in the certificate, read, and added into the IKE configuration file by a negotiation assistant module in order to achieve automatic IKE configuration. Our proposed method reduces the complexity of configuration process and improves the adaptability of the IKE protocol.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2003.10a
• /
• pp.199-202
• /
• 2003

IPsec is a standardization way for protection of IP packets in network layer and it is composed of three protocols that is AH(Authentication Header), ESP(Encapsulation Security Protocol) and IKE(Internet Key Exchange). Before doing encryption and decryption using AH or ESP protocols, both of communicating entities have to share same key safely. IKE protocol works automatically. But it has less interoperability because IKE protocol is not simple. A work which standardize IKEv2 has been done up to now. In this article, we will examine the Cryptographic Algorithms of IKEv2, and describe the AES usage with IPsec, based on the IETF Draft document.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.10 no.4
• /
• pp.33-46
• /
• 2000

IPsec is a protocol suite to protect the data communication between computers on internet and many VPNs(Virtual Private Networks) use IPsec protocol. IKE protocol is used to exchange keys in IPsec. Formal analysis method is used increasingly in computer science to increase the reliability of a system. In this paper, the IKE protocol is analyzed formally. This paper shows that IKE with Authentication with Signature and Authentication with Pre-Shared Key is safe, but Authentication with Public Key Encryption and A Revised Method of Authentication with Public Key Encryption are safe only with the assumption that a participant has the correct public key of the correspondent. To make sure that a participant has the correct public key of the correspondent, the usage of certificate is recommended.

• Proceedings of the KIEE Conference
• /
• 2004.11c
• /
• pp.126-128
• /
• 2004

This paper proposes design and implementation for IKE system that is available to IP security communication on IPv6 network. IPsec is a standard for security on network or processing layer of network communication. IPsec consists of step to negotiate security policy and step to negotiate and provide security key material for peer-to-peer security. We use the ISAKMP for negotiating security policy. And we use the IKE for negotiating and providing the key material. The system is based on VxWorks and is tested with Racoon that is a IKE daemon on FreeBSD. In this paper, we propose an implementation method for mobile host providing network communication with IP security.

• The KIPS Transactions:PartC
• /
• v.10C no.2
• /
• pp.133-140
• /
• 2003

IKE, which is the standard key management protocol for IPSEC, is said to have several known problems. To resolve the problems of the IKE, two protocol proposals are being discussed in the IETF. the IKE version 2 and Just Fast Keying protocols. They should satisfy several protocol design requirements such as the protocol simplicity, the endurability against DOS attacks, the degree of the PFS, the identity protection, the cryptographic negotiation, and the authentication methods. In this paper, we summarize the characteristics of these two protocols and try to analyze their implications according to the protocol design requirements.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.5
• /
• pp.27-35
• /
• 2002

In this paper, we present the structure and interaction flow between IKE server and the other modules for our IPsec System's efficiency. Our IPsec systems have several components for IP-based end-to-end security services. They are IKE, SADB and SPDB and so on, not to speak of IPsec Protocol Engine. Therefore the efficient interaction structure between them has an much influence on total system efficiency. Especially, in case of IPsec engine integrated with kernel, it is very important how IPsec engine can refer to SPDB and SADB entries efficiently according to the location of the implementation of SPDB and SADB. To solve the above problem, we use the SPI generated by IKE. Finally, we propose the interaction structure between IKE server and the other modules according to the optimization for referring to SPDB and SADB entries.