NIKEv2 AR : IKE v2 실시간 분석 기술 연구
A Study on IKE v2 Analysis Method for RealTime
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
코로나19 팬데믹으로 인해 재택근무와 온라인 교육이 활성화되고 이에 따라 IPsec VPN 사용이 급속히 증가하고 있다. VPN 확산에 따라 VPN 취약점은 공격자들에게 중요 공격 대상이 되고 있으며, 이와 관련된 연구가 활발히 진행되고 있다. IKE v2 분석은 IPsec VPN 시스템 개발과 구축 뿐만 아니라 안전성 분석을 위해서 필요하며, 이를 위해서 Wireshark, Tcpdump 등 네트워크 패킷 분석 도구를 이용한다. Wireshark는 네트워크 분석을 위한 대표적인 도구 중 하나이며, IKE v2 분석을 지원하지만 이를 위해서는 IPsec VPN 시스템 관리자 권한을 알아야하는 등 여러 한계점이 존재한다. 본 논문에서는 Wireshark의 한계점을 분석하고 이를 해결할 수 있는 새로운 분석 기법을 제안한다. 제안하는 분석 기법은 세션키 교환 과정부터 암호화된 모든 IKE v2 메시지를 실시간으로 분석할 수 있다. 이뿐만 아니라 제안하는 분석 기법은 네트워크 패킷 포워딩 기능을 이용하여 패킷을 조작할 수 있기에 퍼징 등과 같은 동적 테스팅에 활용될 수 있을 것으로 기대된다.
Abstract
Due to the COVID-19 pandemic, remote working, e-learning, e-teaching and online collaboration have widely spread and become popular. Accordingly, the usage of IPsec VPN for security reasons has also dramatically increased. With the spread of VPN, VPN vulunerabilities are becoming an important target of attack for attackers, and many studies have been conducted on this. IKE v2 analysis is an essential process not only for developing and building IPsec VPN systems but also for security analysis. Network packet analysis tools such as Wireshark and Tcpdump are used for IKE v2 analysis. Wireshark is one of the most famous and widely-used network protocol analyzers and supports IKE v2 analysis. However Wireshark has many limitations, such as requiring system administrator privileges for IKE v2 analysis. In this paper, we describe Wireshark's limitations in detatil and propose a new analysis method. The proposed analysis method can analyze all encrypted IKE v2 messages in real time from the session key exchange In addition, the proposed analysis method is expected to be used for dynamic testing such as fuzzing as packet manipulation.
참고문헌 (17)
- "RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)", Internet Engineering Task Force (IETF), ~
- "RFC 7815: Minimal Internet Key Exchange Version 2 (IKEv2) Initiator Implementation", Internet Engineering Task Force (IETF), ~
- Sawalmeh, H., "VPN Remote Access OSPF-based VPN Security Vulnerabilities and Counter Measurements", 2021 International Conference on Innovation and Intelligence for Infor matics, Computing and Technologies (3ICT), pp.236~241 (2021)
- Y. Cui, "IKEv2Protocol Fuzzing Test on Simulated ASA", IEEE International Conference on Smart Internet of Things, pp.111~116 (2018)
- Tian, Kai, "Analysis of Vulnerability of IPsec Protocol Implementation Based on Differential Fuzzing", International Conference on Security and Privacy in New Computing Environments, pp.282~293 (2021)
- T. Ninet, "The Deviation Attack : A Novel Denial-of-Service Attack Against IKEv2", 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications, BigDataSE), pp.2019[DOI]
- Jiaxing Guo, "Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations", Information Techno logy and Control, 50(3), pp.570~587 (2021)
- D. Felsch, "The dangers of key reuse : Practical attacks on IPsec IKE", Proceedings of the 27th USENIX Security Symposium, pp.567~583 (2018)
- Streun, F., "Evaluating Susceptibility of VPN Implementations to DoS Attacks Using Adversarial Testing", Network and Distributed System Security Symposium (NDSS) (2022)
- B. Pranggono, "COVID-19pandemic cybersecurity issues", Internet Technology Letters, 4(2), pp.e247~ (2021)
- Favale, T., "Campus traffic and e-Learning during COVID-19pandemic", Computer networks, 176 (2020)
- "scapy"[URL]
- "wireshark"[URL]
- "strongswan"[URL]
- "tcpdump website"[URL]
- "PyCryptodome’s docu mentation"[URL]
- "cisco asa software"[URL]