KR20070121323A - How to support ISP in NAT-PT for interworking IPv6 network and IPv4 network - Google Patents

Abstract

The introduction of IPv6 requires coexistence with IPv4 for some time. Therefore, the conversion technology between IPv4 and IPv6 is required, and various conversion technologies have been proposed to enable communication between the two protocols. NAT-PT is a mechanism that enables direct communication between IPv6-based networks and IPv4-based networks. However, there is a security problem that the IPsec protocol cannot be applied to NAT-PT because the IP address is used to calculate the authentication value of the IPsec protocol, including the TCP / UDP / ICMP checksum value. Therefore, the present invention examines the characteristics of NAT-PT and IPsec, considers the security problems of NAT-PT, and proposes a method for applying IPsec to NAT-PT.

Description

A method for IPSec Supporting Mechanism for NAT-PT between IPv6 and IPv4 Networks} in NAT-PT for interworking IPv6 and IPv4 networks

1 is a view showing the operation of the NAT-PT.

2 is a diagram showing the structure of an AH protocol header.

3 is a diagram illustrating the structure of an ESP header.

4 is a diagram illustrating a NAT-PT traversal operation process through NAT-OA of IKE.

5 illustrates an ESP packet encapsulated in a UDP header.

6 is a view showing the overall operation of the method for supporting IPSec in NAT-PT according to an embodiment of the present invention.

The present invention relates to a method for using IPSec in NAT-PT. More specifically, an IPSec node at both ends acquires an address before changing through an IKE negotiation process, and encapsulates an IPSec packet by UDP to NAT- IPSec. It is about the method used in PT.

When an IPv6-based node sends a packet to an IPv4-based node, it acquires a destination IPv4 address from an IPv4 DNS server with the help of DNS-ALG, receives an IPv4 address for transmission from a NAT-PT address pool, and then NAT-PT. Sends packet by configuring IPv6 address with PREFIX assigned by. When the packet arrives at NAT-PT, it is converted into the IPv4 address allocated from the address pool and the IPv4 address without PREFIX, and the packet is updated to the IPv4 node by updating the checksum of the TCP header.

When calculating the checksum value of a TCP header, it includes three parts: a pseudo header, a TCP header, and data from an application layer. Since the pseudo-header contains the source and destination addresses of the IP, NAT-PT must update the checksum of the TCP header.

Protocols for providing security services in IPsec include AH and ESP. AH provides security services such as Access Control, Connectionless Integrity, and Data Origin Authentication for IP datagrams, and optionally provides Anti-Replay services. Can provide.

Figure 2 shows the structure of the AH protocol header and the part included in the ICV (Integrity Check Value) calculation. The AH calculates the ICV using information from the IP header field, the AH header, and the upper layer protocol header, and inserts it into the Authentication Data field. ICV calculations use HMAC-MD5 and HMAC-SHA-1 algorithms that combine Keyed-Hashing for Message Authentication (HMAC) and Message Digest (MD5), or Security Hash Algorithm (SHA-1) algorithms. The ESP header provides additional confidentiality services in addition to the services provided by the AH for payload.

3 shows the structure of the ESP protocol header and the parts included in the ICV calculation. The ESP encrypts from the payload field to the Next Header field. Unlike AH, the ESP does not use the IP header field for ICV calculation, and only uses the field included in the ESP header. The encryption algorithm of ESP uses a triple data encryption standard (3DES) algorithm of Cipher Block Chaining (CBC) mode.

In order to apply IPsec to NAT-PT, a method of using HTI message during IKE negotiation process has been proposed. In this algorithm, if an Internet Key Exchange (IKE) negotiation packet is forwarded to NAT-PT without using a NAT Original Address (NAT-OA) payload, NAT-PT uses the newly defined HTI message to send the Responder's actual message only to the initiator. Pass the address. Then, we proposed a method of applying IPsec to NAT-PT by predicting and calculating the checksum value of the TCP header updated by NAT-PT using the actual address of the receiving node received from NAT-PT. However, since this algorithm does not encapsulate ESP packets with UDP headers, the checksum value of the TCP header is updated by NAT-PT, and when the receiver calculates ICV with the checksum value of the updated TCP header, There will be a difference. Therefore, the packet is discarded before the modification of the checksum value of the TCP header. In addition, a method in which the sender of the packet predicts and calculates the checksum value of the TCP header in advance is also possible in the NAT-PT traversal proposed by the present invention. This processing is performed on the transmitting side rather than on the receiving side.

The problem of applying IPsec to NAT-PT can be divided into two cases, using AH and using ESP.

As shown in Fig. 2, AH uses the value of the IP header and the value of the TCP field in the ICV calculation. Therefore, when the source address and destination address of the IP header are converted by NAT-PT, the receiving side uses the source address and destination address of the converted IP header in the ICV verification process, so the calculated ICV is wrong and the packet is discarded. In addition, since the checksum value of the TCP header additionally updated by NAT-PT is also used for the ICV calculation of the receiver, the ICV calculated during the verification process is different from the ICV of the received packet.

As shown in FIG. 3, since the ESP header uses only a part included in the ESP header for ICV calculation, there is no problem due to IP address translation like AH. However, since the checksum value of the TCP header is included in the ESP header, a problem occurs when the checksum value of the TCP header updated by NAT-PT is used in the ICV verification process on the receiving side as in AH.

The present invention has been made in view of this point, and when the IPv6 network and the IPv4 network communicate using NAT-PT, the NAT-PT traversal method and the method of encapsulating IPsec ESP packets into UDP headers are used on the NAT-PT. Its purpose is to provide a method that supports the IPSec security protocol.

According to the present invention for achieving this purpose, since NAT-PT is a technology based on Network Address Translation (NAT), its properties are not significantly different from NAT. Accordingly, the present invention proposes a NAT-PT traversal scheme that applies the IPsec ESP protocol to NAT-PT through a scheme for encapsulating IKE negotiation and IPsec ESP packet in a UDP header used in NAT.

During the IKE negotiation process, IPv6-based nodes and IPv4-based nodes can exchange actual addresses used in IPsec using NAT-OA (NAT Original Address) payload of Quick Mode. Therefore, each node can modify the checksum value of the TCP header using the actual address obtained through NAT-OA.

4 is a process of exchanging actual addresses using a NAT-OA payload. Iaddr is the real address of the IPv6 node, Raddr is the real address of the IPv4 node, and NAT-PTPub is the IPv4 address of the IPv6 node assigned by NAT-PT.

① Initiator (IPv6 nodes)

NAT-OA initiator = Iaddr = IPv6 node's original address

NAT-OA responder = Raddr = PREFIX :: IPv4 node's original address

② Responder (IPv4 nodes)

NAT-OA initiator = NAT-PTPub = IPv6 node's assigned address by NAT-PT address pool

NAT-OA responder = Raddr = IPv4 node's original address

In order to prevent NAT-PT from updating the TCP checksum value inside the ESP header, the ESP packet is encapsulated in the UDP header as shown in FIG.

▶ Procedure for Encapsulating UDP Header

① ESP encapsulation

② Insert UDP header before ESP header

If the checksum value of the UDP header is set to 0, NAT-PT can be passed without updating the checksum of the UDP header. (IPv4 nodes only)

③ Modify the Total Length, Protocol, and Header Checksum fields of the IP header to match the inserted UDP header (only for IPv4 nodes).

▶ UDP Encapsulation Procedure

① Remove UDP Header

② Modify the Total Length, Protocol, and Header Checksum fields of the IP header with the existing IP header values (IPv4 nodes only)

③ ESP reverse encapsulation process

Therefore, all fields in the ESP header can pass through NAT-PT without any change.

The checksum of the TCP header passing through NAT-PT without updating the checksum value is not a problem for ICV verification of the ESP, but the problem remains because the receiver refers to the pseudo header to verify the checksum of the TCP header. To solve this problem, the checksum value of the TCP header is re-modified using the actual address exchanged during the IKE negotiation.

The modification process is as follows.

① Subtract the source address of the IP header from the checksum value of the TCP header of the received packet.

② Add the actual source address obtained through NAT-OA to the checksum value of the TCP header.

③ Subtract the destination address of the IP header from the checksum value of the TCP header of the received packet.

(4) Add the actual destination address obtained through NAT-OA to the checksum value of the TCP header.

As described above, the present invention provides a method for supporting the IPSec security protocol in NAT-PT. More specifically, the present invention has an effect that end-to-end security is enabled even when an IPv4 packet is converted into an IPv6 packet through NAT-PT. Application services such as messenger, electronic payment, and online game are IPv4 and IPv6. When directly communicating over the same different network, it can be used as a security service providing technology.

Claims (4)

A first step of exchanging an address before being converted by NAT-PT in an Internet Key Exchange (IKE) negotiation process; Encapsulating the IPSec packet into a UDP packet; And And a third step of modifying a checksum value of the TCP header based on the address received in the first step. The method of claim 1, wherein in the first step A method of supporting IPSec in which IPv6-based nodes and IPv4-based nodes exchange real addresses used in IPsec using the NAT-OA (NAT Original Address) payload of Quick Mode, which is used in NAT during IKE negotiation. The method of claim 1, wherein in the second step Encapsulating a UDP header before the ESP header to prevent NAT-PT from updating the TCP checksum value inside the ESP header at the sender; And A method of supporting IPSec, comprising encapsulating, at a receiving end, an ESP packet captured with a UDP header. The method of claim 1, wherein the third step If the ESP packet passes NAT-PT without updating the checksum value, the source side of the IP header is subtracted from the checksum value of the TCP header of the packet received at the receiving end, and the NAT of the first stage is added to the checksum value of the TCP header. Adding an actual starting address obtained through the OA; And Modifying the checksum value of the TCP header by subtracting the destination address of the IP header from the checksum value of the received packet's TCP header and adding the actual destination address obtained through NAT-OA to the checksum value of the TCP header. IPSec support method, including the steps.

Images