Method for controlling an internet information security system in an IP packet level

• US 20030126466A1
• Filed: 07/03/2002
• Published: 07/03/2003
• Est. Priority Date: 12/28/2001
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Gunwoo, Jo, Su Hyung, Sohn, Sung Won, Park, So-Hee, Park, Won-Joo, Jeong, Ji Hoon, Park, Chee Hang, Lee, Hyung Kyu, Nah, Jae Hoon
• Application Number:
  US10/188,110
• Publication Number:
  US 20030126466A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for controlling an Internet information security system of a sender, for packet security in an IP level, is provided. It is determined whether to select security services of packets by referring to security policy database and security association database. Security association is negotiated with a key exchange server of a receiver. The negotiated security association is stored in a key management server. A security policy related with the security association is linked. A packet is sent by using the linked security policy and the security association.

Claims

1. A method for controlling an Internet information security system of a sender, in order to secure a packet in an IP level, comprising the steps of:

(a) determining whether to select a security service on a packet basis by referring to security policy database and security association database, after generating an IP header of a packet that is intended to send;

(b) setting up a security policy by negotiating with a security policy control server of a receiver, when the security policy database and the security association database do not exist;

(c) negotiating security association with a key exchange server of the receiver, based on the determined security policy;

(d) storing the negotiated security association in a key management server;

(e) linking a security policy related with the security association; and

(f) sending the packet by applying IPsec (IP security protocol) and using the linked security policy and the security association.

3. The method of claim 1, further comprising the step of:

(j) negotiating and storing the new security association database, and deleting and renewing a key, since a key management server requests a key exchange server to generate new security association database, when the security association database is expired.

4. The method of claim 1, further comprising the steps of:

(k) monitoring each function block of the Internet information security system and the packet in each step, which is performed by a security management manager and an agent, for providing a perfect information security service and an integrated control of components; and

(l) informing auditing events to a security management server, as a result of the monitoring.

5. The method of claim 1, further comprising the step of:

(m) evaluating a security service by intruding said each function block in offline, in order to analyze security vulnerability of each function block of the Internet information security system.

2. A method for controlling an Internet information security system of a receiver, for packet security in an IP packet, comprising the steps of:

(g) determining a security service on a packet basis with reference to security association database, after reassembling a received packet and receiving the reassembled packet;

(h) removing an IPsec service that is applied to the packet by using the referred security association database; and

(i) inquiring a security policy control server in order to confirm that the applied information security service corresponds the security policy of the receiver.