US 2008/0168551 A1 · Abnormal IPSec packet control system using IPSec configuration and session data, and method thereof

Abstract

Disclosed are an abnormal Internet Protocol Security (IPSec) packet control system and method using IPSec configuration and session data which detects whether or not the packets encrypted by an Encapsulating Security Payload extended header are abnormal by using IPSec configuration and session data tables without decrypting them, thereby blocking harmful packets. The IPSec packet control system comprises: an extended header processing unit that receives an IPSec packet and extracts the data to be used in traffic control; check units for checking the packets in the stages of IPSec configuration and IPSec communication that receive the extracted data to determine whether or not the IPSec packet has passed; and a control unit that allows the IPSec to pass or to be blocked according to a determination result from the check units for checking the IPSec configuration and communication packets, whereby the abnormal IPSec packets are blocked using the IPSec configuration and session tables without decryption and encryption thereof, thereby processing the IPSec packet without performance degradation.

Claims32

Dependent claims

An abnormal Internet Protocol Security (IPSec) packet control system using IPSec configuration data and IPSec session data for controlling traffic in IPSec communication, the system comprising:

an extended header processing unit that receives an IPSec packet, divides the same into an IPSec configuration packet and an IPSec communication packet, and extracts the respective data to be used in traffic control;
a check unit for checking the IPSec configuration packet which includes an IPSec configuration DB that manages IPSec configuration data, receives the data extracted from the IPSec configuration packet, and compares the same with data stored in the IPSec configuration DB to thereby determine whether or not the IPSec packet has passed;
a check unit for checking the IPSec communication packet which includes an IPSec session DB that manages IPSec session data, receives the data extracted from the IPSec communication packet, and compares the same with data stored in the IPSec communication DB to thereby determine whether or not the IPSec packet has passed;
and
a control unit that can pass or block the IPSec depending upon a check result from the check unit for checking the IPSec configuration or communication packet.

2 more elements

An abnormal IPSec packet control method using IPSec configuration data and IPSec session data for controlling traffic in IPSec communication with an IPSec packet control system which includes:

an extended header processing unit that receives an IPSec packet and extracts the data to be used in traffic control;
a check unit for checking the IPSec configuration packet which includes an IPSec configuration DB that manages IPSec configuration data, and determines whether or not the IPSec packet has passed;
a check unit for checking the IPSec communication packet which includes an IPSec session DB that manages IPSec session data, and determines whether or not the IPSec packet has passed;
and a control unit that can pass or block the IPSec, the control method comprising the steps, of:
receiving, in the extended header processing unit, the IPSec packet;
classifying, in the extended header processing unit, the IPSec packet into an extended header portion and a network layer header portion;
determining, in the extended header processing unit, whether or not an ESP extended header portion exists in the extended header portion;
if the ESP extended header portion does not exist, extracting, in the extended header processing unit, data from the network layer header portion and transmitting the same to the check unit for checking the IPSec configuration packet;
if the ESP extended header portion exists, extracting, in the extended header processing unit, data from the extended header portion and transmitting the same to the check unit for checking the IPSec communication packet;
in the check unit for checking the IPSec configuration packet, receiving the data extracted from the network layer header portion, comparing the same with the IPSec configuration data stored in the IPSec configuration database, and determining whether or not the IPSec packet has passed;
in the check unit for checking the IPSec communication packet, receiving the data extracted from the extended header portion, comparing the same with the IPSec session data stored in the IPSec session database, and determining whether or not the IPSec packet has passed;
and
passing or blocking, in the control unit, the IPSec packet depending upon a determination result from the check unit for checking the IPSec configuration or communication packet.

10 more elements

Dependencies are inferred from the claim text.

Abnormal IPSec packet control system using IPSec configuration and session data, and method thereof

Life of this patent

Abnormal IPSec packet control system using IPSec configuration and session data, and method thereof

Life of this patent

Abstract

Claims32