콘텐츠 감사를 위한 IPsec VPN 패킷 분석 기술 연구
IPsec VPN Encrypted Packet Analysis Method for Contents Auditing
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
IPsec VPN에 대한 보안 감사는 구현 결함이나 설정 오류로 인한 취약점을 점검하고 사고 발생에 대한 조사 등을 위해 매우 중요하다. 하지만 IPsec VPN은 기밀성, 무결성, 인증 등을 보장하기 위해 네트워크 콘텐츠가 암호화되어 있어 보안 감사에 큰 어려움이 있다. 이를 해결하기 위해 중간자 공격 방식을 이용한 분석 기법들이 이전 연구들에서 제안되었다. 중간자 공격 기법을 적용하기 위해서는 상호 인증을 위한 사전 공유키를 알고 있어야 하며, 네트워크에 직접 참여해야 한다. 이는 보안 감사를 위해 일시적으로 네트워크 단절을 유발하며, 감사 이전에 수집된 데이터에 대한 분석이 불가능하다. 본 논문에서는 네트워크 연속성을 보장하며, 특정 IPsec VPN 연결 방식과 인증 방식에 한정되지 않는 새로운 분석 기법을 제안한다. 따라서, 제안하는 분석 기법은 IPsec VPN 보안 감사를 위해 실제적으로 활용될 것으로 기대된다.
Abstract
Security audits of IPsec VPNs are crucial for identifying vulnerabilities caused by impleme- ntation flaws or misconfigurations, as well as investigating incidents. Nevertheless, auditing IPsec VPN presents noteworthy challenge due to the encryptiong of network contents which ensere confidentiality, integrity, authentications and more. Some researchers have suggested using man-in-the-middle(MITM) techniques to overcome this challenge. MITM techniques require direct participation in the network and prior knowledge of the pre-shared key for authentication. This causes temporary network disconnection for security audits, and it is impossible to analyse data collected before the audit. In this paper, we present an analysis technique aimed at ensuring network continuity without relying on a specific IPsec VPN topologies or authentication method. Therefore, it is anticipated that this approach will be effective, practical and adaptable for conducting IPsec VPN security
참고문헌 (18)
- Kaufman, Charlie, "RFC 7296:Internet Key Exchange Protocol Version 2 (IKEv2)", ~ (2014)
- Kivinen, T., "RFC 7815: Minimal Internet Key Exchange Version 2(IKEv2) Initiator Implementation", ~ (2016)
- Kent, Stephen, "RFC 4303: IP encapsulating security payload (ESP)", ~ (2005)
- Migault, D., "RFC 9333: Minimal IP Encapsulating Security Payload (ESP)", ~ (2023)
- G. Wang, "A Content Auditing Method of IPsec VPN", 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC), pp.634~639 (2018)
- J. Park, "A Study on IKE v2 Analysis Method for RealTime", Journal of the Korea Institute of Information Security &Cryptology, 32(4), pp.661~671 (2022)
- Abbas, Haider, "Security Assessment and Evaluation of VPNs : A Comprehensive Survey", ACM Computing Surveys, 55(13s), pp.1~47 (2023)
- Hauser, Frederik, "P4-ipsec:Site-to-site and host-to-site vpn with ipsec in p4-based sdn", IEEE Access, 8, pp.139567~139586 (2020)
- Lopez-Millan, Gabriel, "Towards a standard SDN-based IPsec management framework", Com- puter Standards &Interfaces, 66, pp.103357~ (2019)
- López-Millán, Gabriel, "Analysis and practical validation of a standard SDN-based framework for IPsec management", Computer Standards &Interfaces, 83, pp.103665~ (2023)
- Parra-Espín, "Sdn-based automated rekey of ipsec security associations: design and practical validations", Computer Networks, 233, pp.109905~ (2023)
- Hamed, Hazem, "Modeling and verification of IPSec and VPN security policies", 13th IEEE International Conference on Network Protocols (ICNP'05), pp.10~ (2005)
- Fang, Dongxiang, "Attacking the IPsec standards when applied to IPv6 in confidentiality-only ESP tunnel mode", 16th International Conference on Advanced Communication Technology, pp.401~405 (2014)
- Mizrahi, Tal, "Time synchronization security using IPsec and MACsec", 2011 IEEE International Symposium on Precision Clock Synchronization for Measurement, Control and Communication, pp.38~43 (2011)
- "Scapy" (2024)[URL]
- "StrongSwan" (2024)[URL]
- "PyCryptodome" (2024)[URL]
- Huttunen, A, "RFC 3948: UDP encapsulation of IPsec ESP packets", ~ (2005)