• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.5
• /
• pp.11-21
• /
• 2004

To authorize IPSec-VPN Client in Client-to-Gateway type of the IPSec-VPN system, it can be normally used with ID/Password verification method or the implicit authorization method that regards implicitly IPSec-VPN gateway as authorized one in case that the IPSec-VPN client is authenticated. However, it is necessary for the Client-to-Gateway type of the IPSec-VPN system to have a more effective user authorization mechanism because the ID/Password verification method is not easy to transfer the ID/Password information and the implicit authorization method has the vulnerability of security. This paper proposes an effective user authorization mechanism using an attribute certificate and designs a user authorization engine. In addition, it is implemented in this study. The user authorization mechanism for the IPSec-VPN system proposed in this study is easy to implement the existing IPSec-VPN system. Moreover, it has merit to guarantee the interoperability with other IPSec-VPN systems. Furthermore, the user authorization engine designed and implemented in this paper will provide not only DAC(Discretional Access Control) and RBAC(Role-Based Access Control) using an attribute certificate, but also the function of SSO(Single-Sign-On).

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.1 no.2
• /
• pp.107-122
• /
• 2008

Communication is be classified into public network and private network. VPN is made by integrating the circuit cost reduction of public network and the reliable security support of public network. This paper analyzes the IPSec using three layer tunneling, MPLS(Multi Protocol Label Switching) integrating 2 layer switching and 3 layer routing techniques and dedicated line from the viewpoint of security. In conclusion, VPN is better than dedicated network line in cost and security. If IPSec VPN is compared with MPLS VPN, MPLS VPN is more excellent than IPSec VPN in safe data transmission, cost, QoS and management.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.6
• /
• pp.1065-1078
• /
• 2014

Considering the safety of the data and performance, it can be said that the performance of the AES algorithm in a symmetric key-based encryption is the best in the IPSec-based VPN. When using the AES algorithm in IPSec-based VPN even with the expensive hardware encryption card such as OCTEON Card series of Cavium Networks, the Performance of VPN works less than half of the firewall using the same hardware. In 2008, Intel announced a set of 7 AES-NI instructions in order to improve the performance of the AES algorithm on the Intel CPU. In this paper, we verify how much the performance IPSec-based VPN can be improved when using seven sets of AES-NI instruction of the Intel CPU.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.760-762
• /
• 2003

인터넷을 비롯한 대부분의 패킷스위칭 네트워크는 IP(Internet Protocol)을 기반으로 하고 있으나, IP는 기본적으로 보안에 취약하게 설계되어 보안이 필요한 통신에 사용하는데는 어려움이 있다. IPSec(IP Security)은 IP 트래픽에 대한 이러한 보안문제를 극복하기 위해 생겨났으며, 방화벽과 결합된 형태로 가장 널리 쓰이고 있는 VPN(Virtual Private Network) 제품의 하나이다. 그러나 IPSec 자체의 문제점이 대두되고, Web-based Service가 영역을 넓혀가면서 기존의 웹 보안 프로토콜인 SSL이 VPN의 새로운 형식으로 나타나고 있다. 본 고에서는 이러한 SSL VPN의 모델을 IPSec VPN과 비교하여 분석하고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.1
• /
• pp.41-52
• /
• 2024

Security audits of IPsec VPNs are crucial for identifying vulnerabilities caused by implementation flaws or misconfigurations, as well as investigating incidents. Nevertheless, auditing IPsec VPN presents noteworthy challenge due to the encryptiong of network contents which ensere confidentiality, integrity, authentications and more. Some researchers have suggested using man-in-the-middle(MITM) techniques to overcome this challenge. MITM techniques require direct participation in the network and prior knowledge of the pre-shared key for authentication. This causes temporary network disconnection for security audits, and it is impossible to analyse data collected before the audit. In this paper, we present an analysis technique aimed at ensuring network continuity without relying on a specific IPsec VPN topologies or authentication method. Therefore, it is anticipated that this approach will be effective, practical and adaptable for conducting IPsec VPN security

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.28 no.6C
• /
• pp.659-667
• /
• 2003

IPsec refers to a standardized set of security protocols and algorithms which can provide the integrity, the authentication and the confidentiality services for IP packets in the Internet. Between two security gateways, IPsec provides the access control, the connectionless Integrity, data origin authentication, the anti-replay, and the confidentiality services, not only to the IP layer but also to the upper layers. In this paper, we describe a VPN (Virtual Private Network) testbed configuration using the FreeS/WAN and analyze the ISAKMP messages exchanged between the linux security gateway during the IKE SA setup. Also, we describe our development of an IPSEC encryption verification tool which can be used conveniently by VPN administrators.

• Review of KIISC
• /
• v.11 no.6
• /
• pp.53-62
• /
• 2001

본 고에서는 현재 가장 주목받는 IP 기반의 VPN 기술인 IPSec과 BGP/MPLS, 그리고 최근에 제안된 프로토콜인 SMPLS와 BGP/IPSec에 대하여 각각의 특징 및 장단점을 비교하고 IP VPN프로토콜의 연구동향 및 발전방향에 대하여 분석한다. 보안성(Security)에 강점을 갖는 IPSec과 확장성(Scalability)의 장점을 지닌 BGP/MPLS는 VPN의 구축 시에 반대로 각각 확장성과 보안성의 단점을 갖는다. 이에 대하여, BGP/IPSec은 IPSec에 확장성을 추가하여 VPN 구성을 효율적으로 하도록 했으며, SMPLS는 MPLS 페이로드에 대하여 암호화 및 인증이 가능하도록 하였다. VPN 사업자들이 서비스를 준비중이거나 시작한 IPSec과 BGP/MPLS 기술은 각각의 장단점 때문에 다른 기술과 융합하거나 계속하여 발전 될 것이 예상되며, 이는 VPN 기술의 확장성과 보안성을 강화하는 방향으로 진행될 것이다.

• Journal of KIISE:Information Networking
• /
• v.34 no.1
• /
• pp.1-15
• /
• 2007

Increase in the wireless mobile network users brings the issue of mobility management into the Virtual Private Network (VPN) services. We propose a provider edge (PE)-based provider provisioned mobile VPN mechanism, which enables efficient communication between a mobile VPN user and one or more correspondents located in different VPN sites. The proposed mechanism not only reduces the IPSec tunnel overhead at the mobile user node to the minimum, but also enables the traffic to be delivered through optimized paths among the (mobile) VPN users without incurring significant extra IPSec tunnel overhead regardless of the user's locations. The proposed architecture and protocols are based on the BGP/MPLS VPN technology that is defined in RFC24547. A service provider platform entity named PPVPN Network Server (PNS) is defined in order to extend the BGP/MPLS VPN service to the mobile users. Compared to the user- and CE-based mobile VPN mechanisms, the proposed mechanism requires less overhead with respect to the IPSec tunnel management. The simulation results also show that it outperforms the existing mobile VPN mechanisms with respect to the handoff latency and/or the end-to-end packet delay.

• The Journal of Information Technology
• /
• v.7 no.4
• /
• pp.21-30
• /
• 2004

A VPN(Virtual Private Network) is constructed using public wires to connect nodes. It can be used like the dedicated line and maintain the security of the data on the VPN. And It uses encryption and other security mechanisms to ensure that only authorized users can access the network. In this paper we summarize IPsec and VPN technology and construct pilot VPN system for analyzing the performance of remote access VPN. Then we analyze the performance of remote VPN system using VPN concentrator in case of single user and in case of multi users.

• Review of KIISC
• /
• v.13 no.5
• /
• pp.24-30
• /
• 2003

인터넷을 비롯한 대부분의 패킷스위칭 네트워크는 IP(Internet Protocol)을 기반으로 하고 있다. 그러나, IP는 기본적으로 보안에 취약하게 설계되어 보안이 필요한 통신에 사용하는데는 어려움이 있다. IPSec(IP Security)은 IP 트래픽에 대한 이러한 보안문제를 극복하기 위해 생겨났으며, 방화벽과 결합된 형태로 가장 널리 쓰이고 있는 VPN(Virtual Private Network) 제품의 하나이다. 그러나 IPSec의 문제점이 대두되고, Web-based Service가 영역을 넓혀가면서 기존의 웹보안프로토콜인 SSL이 VPN의 새로운 형식으로 나타나고 있다. 본 고에서는 IPSec VPN과 SSL VPN의 차이점의 분석하여 정리하고자 한다.