차세대 인증 기술을 적용한 Post-Quantum 원격접속 터널링 프로토콜 연구
A Study on Post-Quantum Remote Access Tunneling ProtocolUtilizing Next-Generation Authentication
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
기존 대면 중심의 업무가 비대면 중심으로 전환됨에 따라 다양한 원격접속 환경에 VPN이 활용되고 있다. 하지만 기존 VPN은 지속적인 인증 문제를 보이고 있으며, 양자컴퓨터에 대한 내성이 부족하다는 한계가 있다. 최근 VPN의 대안으로 SDP 기반의 ZTNA가 주목받고 있지만 기존 인프라와의 호환성 등의 문제로 대부분의 ZTNA 솔루션이 VPN을 활용하고 있다. 따라서 본 논문에서는 FIDO 및 WebAuthn 표준에 의한 생체인증과 NIST PQC의 표준 KEM 알고리즘으로 선정된 CRYSTALS-Kyber를 통해 기존 프로토콜을 강화할 수 있는 차세대 인증 기술을 적용한 Post-Quantum 원격접속 터널링 프로토콜을 제안한다. 제안하는 프로토콜은 도메인에 매핑되는 인증정보를 통해 피싱 방지가 가능하며, 강력한 인증과 높은 보안성을 제공함에도 기존 WireGuard 연결과정에서 속도상 큰 차이를 보이지 않고 OpenVPN 연결 속도에 비해 약 54.55%의 성능 이점을 보인다.
Abstract
As remote work becomes more prevalent, VPNs are widely used in various remote access environments. However, traditional VPNs face challenges, such as continuous authentication issues and insufficient resistance to quantum computing threats. Recently, SDP-based ZTNA has gained attention as a VPN alternative, but many ZTNA solutions still rely on VPNs due to compatibility issues with existing infrastructure. This paper proposes a post-quantum remote access tunneling protocol that enhances traditional protocols using biometric authentication based on FIDO and WebAuthn standards, along with CRYSTALS-Kyber, the KEM algorithm selected by NIST for post-quantum cryptography. The proposed protocol prevents phishing through domain-mapped authentication information, offers strong authentication, and improves security. Despite these features, it shows minimal speed difference compared to WireGuard's connection process and delivers approximately 54.55% better performance than OpenVPN.
참고문헌 (23)
- Ict global market analysis:remote work trends by ict product category, "National IT Industry Promotion Agency", ~ (2022)
- Vpn market - virtual private network size & share analysis - growth trends & forecasts (2024–2029), "Mordor Intelligence Research &Advisory", Mordor Intelligence, ~ (2024)
- "Multi-factor authentication +vpn = secure and private" (2024)[URL]
- "CVE-2020-12812" (2024)[URL]
- "CVE-2021-22893" (2024)[URL]
- "CVE-2023-46805" (2024)[URL]
- "Showcasing expertise in quantumresistant cryptography at ‘quantum ko rea 2023’" (2024)[URL]
- "Genian ZTNA Leaflet" (2024)[URL]
- "Overview of openvpn" (2024)[URL]
- J.A. Donenfeld, "Wireguard: next generation kernel network tunnel", WireGuard, ~ (2020)
- S. de Vries, "Achieving 128-bit security against quantum attacks in openvpn", Master, pp.2016
- "Post-quantum cryptograph y vpn" (2019)[URL]
- A. Hülsing, "Post-quantum wireguard", Proceedings of the 2021 IEEE Symposium on Security and Privacy, pp.304~321 (2021)
- A. Marrok, "Pqh-wireguard: post-quantum hybrid cryptography-based wireguard vpn protocol", Proceedings of International Conference on Information Technology and Applications, pp.283~292 (2022)
- E. Huseynov, "Passwordless vpn using fido2 security keys: modern authentication security for legacy vpn systems", Proceedings of the 2022 4th International Conference on Data Intelligence and Security, pp.01~03 (2022)
- E. Huseynov, "VPN Helper Application for using FIDO2 Security Keys with Legacy VPN Systems", Proceedings of the 3rd IFSA Winter Conference on Automation, Robotics & Communications for Industry, 4.0, pp.5.0 (2023), 168~170
- Sang-rae Cho, "Introduction to fido 2.0 universal authentication technology", Journal of The Korea Institute of Information Security &Cryptology, 26(2), pp.14~19 (2016)
- J. Hodges, "Web authentication: an api for accessing public key credentials level 2", W3C Recommendation, ~ (2021)
- Dae-sung Kwon, "Post-quantum cryptography and quantum cryptography for countering quantum computer threats, ICT Standard Weekly vol. 1137", Telecommunications Technology Association, ~ (2023)
- R. Avanzi, "Crystals-kyber algorithm specifications and supporting documentation(version 3.02)", Round-3submission to the NIST PQC standardization project, ~ (2021)
- Korea Internet & Security Agency, "Personal information & information security management system (ISMS-P)certification criteria guide", 91~93 (2023)
- National Intelligence Service, "National security requirements v3.0 -explanation and common security requirements", ~ (2023)
- National Intelligence Service, "National security requirements v3.0 -section security product group", ~ (2021)