KR102564396B1 - Encryption packet transmitting device and transmitting method - Google Patents

Abstract

The present invention proposes an apparatus for transmitting an encrypted packet and a method for transmitting an encrypted packet that enable QoS transmission identical to that of an original data packet even when an encrypted packet in the form of an encrypted data packet is transmitted.

Description

Encryption packet transmission device and encryption packet transmission method {ENCRYPTION PACKET TRANSMITTING DEVICE AND TRANSMITTING METHOD}

The present invention relates to a technology for encrypting and transmitting data packets, and more particularly, an apparatus for transmitting encrypted packets enabling QoS transmission identical to that of original data packets even when transmitting encrypted packets in the form of encrypting data packets. and an encrypted packet transmission method.

In an LTE network, a terminal (user) creates an EPS bearer for data transmission in order to use a communication service. It can be referred to as a tunnel created between the terminal and the P-GW through the connecting wired section.

User (terminal) data is transmitted in the form of IP-based data packets through this tunnel, that is, EPS Bearer, and the traffic flow according to data packet transmission is called IP Flow.

On the other hand, in the LTE network, the EPS Bearer that differentiates the QoS (Quality of Service) level according to the media type of the communication service, distinguishes the IP flow of the data packet when transmitting IP-based data packets, and guarantees the QoS level suitable for the media type By transmitting through, it implements QoS transmission.

At this time, it is because of the 5-tuple (Source IP, Destination IP, Protocol ID, Source Port, Destination Port) of the IP-based data packet that the aforementioned IP flow classification is possible. This is because of the Protocol ID that allows

That is, since various data generated by the terminal are QoS-transmitted in the form of IP-based data packets to which the 5-tuple Rule is applied, QoS suitable for the media type of each data can be guaranteed.

Meanwhile, security issues have recently become important in communication services, and accordingly, the need for a technology for encrypting and transmitting data (data packets) of a user (terminal) is increasing.

[0003] As such, technologies for encrypting and transmitting data packets include a transport mode encryption method and a tunnel mode encryption method. Since the present invention is related to a tunnel mode encryption method, description of the transport mode encryption method will be omitted.

When encrypting a data packet, the tunnel mode encryption method encrypts not only the data in the payload of the data packet but also the IP header, and encrypts the encrypted data packet (IP header + data) and the encrypted packet composed of the new IP header (hereinafter , ESP packet) to structure data packets into encrypted ESP packets.

At this time, the most important parameter for QoS transmission is Protocol ID, which enables media types to be distinguished. In the case of the tunnel mode encryption method described above, the protocol ID field in the new IP header of the ESP packet contains the protocol ID in the IP header of the original data packet. Instead of the protocol ID in the field, the protocol ID indicating the protocol type of the ESP packet (eg, Protocol ID = 50) is collectively recorded.

In this case, when the terminal encrypts data packets for security and transmits them as ESP packets, it is impossible to provide the same QoS transmission that was possible when transmitting unencrypted data packets, and QoS transmission itself becomes impossible.

Therefore, in the present invention, even when transmitting an ESP packet in the form of encrypting a data packet, it is proposed to enable QoS transmission identical to that of the original data packet.

The present invention was created in view of the above circumstances, and an object to be reached in the present invention is to enable QoS transmission even when an encrypted packet in the form of an encrypted data packet is transmitted, and furthermore, the original data packet and It is to enable QoS transmission in the same way.

An encrypted packet transmission apparatus according to a first aspect of the present invention for achieving the above object encrypts a data packet composed of an IP header and data including identification information required for QoS (Quality of Service) transmission, and encrypts the encrypted packet. a packet encryption unit generating an encrypted packet composed of a data packet and a new IP header; and a QoS control unit that makes the identification information in the new IP header of the encrypted packet identical to the identification information in the IP header of the data packet so that the same QoS transmission as that of the data packet is possible when the encrypted packet is transmitted.

Preferably, the QoS control unit changes identification information recorded in a protocol ID field in the new IP header to identification information recorded in a protocol ID field in an IP header of the data packet during the process of generating the encrypted packet. can

Preferably, during the process of generating the encrypted packet, identification information indicating the protocol type of the encrypted packet may be collectively recorded in the protocol ID field of the new IP header, regardless of the protocol type of the data packet.

Preferably, the encrypted packet is transmitted through a specific radio resource mapped to identification information in a new IP header of the encrypted packet, among radio resources allocated by the base station for packet transmission, and the specific radio resource when the encrypted packet is transmitted. It may further include a packet transmission unit that guarantees the QoS level provided by .

To achieve the above object, an encrypted packet transmission method according to a second aspect of the present invention encrypts a data packet composed of an IP header and data including identification information required for QoS transmission, and encrypts the encrypted data packet and the new IP address. A packet encryption step of generating an encrypted packet composed of a header; and a QoS control step of making the identification information in the new IP header of the encrypted packet identical to the identification information in the IP header of the data packet so that the same QoS transmission as that of the data packet is possible when the encrypted packet is transmitted.

Preferably, in the QoS control step, during the process of generating the encrypted packet, identification information recorded in a protocol ID field in the new IP header is converted to identification information recorded in a protocol ID field in an IP header of the data packet. can be changed

Preferably, the encrypted packet is transmitted through a specific radio resource mapped to identification information in a new IP header of the encrypted packet, among radio resources allocated by the base station for packet transmission, and the specific radio resource when the encrypted packet is transmitted. A packet transmission step for guaranteeing QoS provided by may be further included.

Therefore, according to the encrypted packet transmission apparatus and the encrypted packet transmission method of the present invention, QoS transmission is possible even when an encrypted packet in the form of an encrypted data packet is transmitted, and furthermore, QoS transmission is performed in the same way as the original data packet. derive the effect that makes it possible.

1 is an exemplary view illustrating a tunnel mode encryption method related to the present invention.
2 is an exemplary diagram showing a flow of transmission of an ESP packet previously generated using a tunnel mode encryption method.
3 is a block diagram showing the configuration of an encrypted packet transmission device according to a preferred embodiment of the present invention.
4 is an exemplary diagram showing a flow of transmitting an ESP packet in the present invention.
5 is a flowchart illustrating an encryption packet transmission method according to an operation flow according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

First, prior to a detailed description of the present invention, a tunnel mode encryption scheme related to the present invention will be described with reference to FIG. 1 .

Data generated by the terminal is generated in the form of IP-based data packets to which the 5-tuple Rule is applied for QoS transmission to the LTE network.

As shown in FIG. 1, these IP-based data packets are composed of an IP header and data.

At this time, a protocol ID is recorded as identification information indicating the type of the data packet in the protocol ID field in the IP header of the IP-based data packet. For example, if the data packet type is UDP, Protocol ID = 17 will be recorded.

Of course, in the IP header of the IP-based data packet, besides the Protocol ID, the rest of the parameters (Source IP, Destination IP, Source Port, Destination Port) among the 5-tuple required for QoS transmission will be recorded, and various other reference information. These will be included, but for convenience of description, specific illustrations and descriptions will be omitted.

As shown in FIG. 1, the tunnel mode encryption method encrypts not only the data in the payload of an IP-based data packet but also the IP header, and consists of the encrypted data packet (IP header + data) and a new IP header. This is a method of structuring a data packet into an encrypted ESP packet by generating an encrypted packet (hereinafter referred to as an ESP packet).

At this time, the most important parameter for QoS transmission is Protocol ID, which enables media types to be distinguished. In the case of tunnel mode encryption, the protocol ID field in the new IP header of the ESP packet and the protocol ID field in the IP header of the original data packet Instead of Protocol ID = 17 (UDP) that exists, the protocol ID indicating the protocol type of the ESP packet (eg Protocol ID = 50) is collectively recorded.

On the other hand, in FIG. 1, the structure of the ESP packet is briefly described as an encrypted data packet (IP header + data) and a new IP header, but this is for convenience of description, and other fields that record various information are included. can be configured.

Hereinafter, with reference to FIG. 2, a flow of transmitting an ESP packet generated by the tunnel mode encryption method described above will be described.

Prior to the detailed description, when a terminal accesses an LTE network, an EPS bearer must be created unconditionally, and this EPS bearer is referred to as a default bearer. This default bearer is maintained until the terminal leaves the LTE network (Detach). The QoS characteristic of the default bearer is Non-GBR (Non-Guaranteed Bit Rate), and the Bearer ID is set to 5.

The terminal may initiate use of additional communication services. For example, the terminal may initiate use of a VoIP service (UDP protocol) and may initiate use of a video streaming service (TCP protocol).

In this case, based on signal transmission and reception through the default bearer, the terminal uses an additional EPS bearer suitable for the media type of the LTE network, VoIP service, and video streaming service, that is, a dedicated bearer (GBR, Bearer ID = 8) suitable for the QoS level of the VoIP service. , QCI = 1 (VoIP)) and Dedicated Bearer (Non-GBR, Bearer ID = 10, QCI = 9 (streaming)) suitable for the QoS level of the video streaming service.

In FIG. 2, it is illustrated assuming that the above-mentioned situation, that is, the situation in which two dedicated bearers are additionally created between the terminal and the LTE network.

Thereafter, the terminal will generate a data packet A for the video streaming service, and will separately generate a data packet B for the VoIP service.

If data packet A is transmitted without encryption, when the terminal transmits data packet A, a Dedicated Bearer (Non-GBR, Bearer ID = 10, QCI = 9 (streaming)), in other words, by transmitting through a Dedicated Bearer (Non-GBR, Bearer ID = 10, QCI=9 (streaming)) that guarantees QoS suitable for the media type of the video streaming service, the data packet of the video streaming service A will be QoS transmitted (dotted line).

In addition, if data packet B is transmitted without encryption, when transmitting data packet B, the terminal maps a Dedicated Bearer (GBR, Bearer ID = 8, QCI = 1 ( VoIP)), in other words, by transmitting through a Dedicated Bearer (GBR, Bearer ID = 8, QCI=1 (VoIP)) that guarantees QoS suitable for the media type of the VoIP service, the data packet B of the VoIP service will be QoS transmitted ( dotted line).

However, as can be seen from FIG. 2, if data packets are structured (encrypted) into ESP packets and then transmitted, whether the ESP packet A encrypting data packet A or the ESP packet B encrypting data packet B, the protocol ID in the new IP header Since Protocol ID = 50 is collectively recorded in the field, the UE transmits both ESP packet A and ESP packet B to the same EPS bearer mapped to Protocol ID = 50 (ESP) regardless of media types of video streaming service and VoIP service. In the case of FIG. 2, it is transmitted through a dedicated bearer (Non-GBR, Bearer ID = 10, QCI = 9 (streaming)) (solid line).

After all, when the terminal transmits an ESP packet to which encryption for security is applied, it is impossible to distinguish the media type that was possible when transmitting unencrypted data packet A and data packet B, so the QoS transmission before encryption is identical. Not only can it not be provided, but QoS transmission itself, which is divided according to the media type, becomes impossible.

Accordingly, the present invention proposes a method of enabling QoS transmission even when an ESP packet in the form of an encrypted data packet is transmitted, and furthermore, enabling QoS transmission in the same way as the original data packet.

Hereinafter, with reference to FIG. 3, the configuration of a device realizing the method proposed in the present invention, that is, an encrypted packet transmission device 100 according to a preferred embodiment of the present invention will be described in detail.

As shown in FIG. 3, the encrypted packet transmission apparatus 100 according to the present invention encrypts a data packet composed of an IP header and data including identification information required for QoS (Quality of Service) transmission, and the encryption A packet encryption unit 120 that generates an encrypted packet composed of one data packet and a new IP header, and makes the identification information in the new IP header of the encrypted packet the same as the identification information in the IP header of the data packet to obtain the encrypted packet It includes a QoS control unit 130 that enables the same QoS transmission as the data packet during transmission.

The encrypted packet transmission apparatus 100 of the present invention may be a terminal accessing the LTE network described above, or may be a function (eg, a module, application, or program) for realizing the method proposed in the present invention in the terminal.

Hereinafter, for convenience of description, the encrypted packet transmission device 100 of the present invention is described as a terminal, and in this case, the encrypted packet transmission device 100 may further include a data packet generator 110.

The data packet generator 110 generates the data of the communication service to be used by the encrypted packet transmission device 100, that is, the terminal, in the form of a data packet composed of an IP header and data.

For example, when the encrypted packet transmission apparatus 100, that is, the terminal, wants to use a video streaming service and a VoIP service as communication services, as shown in FIG. 4, the data packet generator 110 provides the video streaming service. Data packet A for VoIP service will be generated, and data packet B for VoIP service will be generated separately.

The packet encryption unit 120 encrypts a data packet composed of an IP header including identification information required for QoS transmission and data, and generates an encrypted packet composed of the encrypted data packet and a new IP header.

Here, the identification information required for QoS transmission means a protocol ID included in the IP header of the data packet.

Accordingly, the packet encryption unit 120 encrypts the data packet composed of the IP header and data including the Protocol ID, that is, the data packet generated by the data packet generator 110, and encrypts the encrypted data packet (IP header + data). and generating an encrypted packet composed of the new IP header.

As a result, the packet encryption unit 120 encrypts the data packet generated by the data packet generation unit 110 according to the tunnel mode encryption method to generate an encryption packet (hereinafter referred to as an ESP packet), so that the data packet is encrypted. It is a functional unit that structures as an ESP packet.

Here, during the process of generating an encrypted packet, that is, an ESP packet in the packet encrypting unit 120, the protocol ID field in the new IP header includes identification information representing the protocol type of the ESP packet, regardless of the protocol type of the original data packet. is recorded as

That is, in the Protocol ID field of the new IP header of the ESP packet encrypted according to the tunnel mode encryption method, the Protocol ID indicating the protocol type of the ESP packet (e.g., not the Protocol ID in the Protocol ID field of the IP header of the original data packet) : Protocol ID = 50) are collectively recorded.

The QoS control unit 130 makes the identification information (Protocol ID) in the new IP header of the encrypted packet generated by the packet encryption unit 120, that is, the ESP packet the same as the protocol ID in the IP header of the original data packet, and transmits the ESP packet In this case, the same QoS transmission as the original data packet is possible.

Specifically, the QoS control unit 130 intervenes in the process of generating an encrypted packet, that is, an ESP packet, in the packet encryption unit 120, and collective identification information, i.e. Protocol ID, recorded in the protocol ID field in the new IP header of the ESP packet. = 50 to the identification information (Protocol ID) recorded in the protocol ID field in the IP header of the original data packet, thereby changing the identification information (Protocol ID) in the new IP header of the ESP packet to Protocol in the IP header of the original data packet. ID can be the same.

For example, Protocol ID = 6 (TCP) is recorded in the protocol ID field in the IP header of the data packet A of the video streaming service generated by the data packet generator 110, and the data packet generator 110 generates Protocol ID = 17 (UDP) will be recorded in the protocol ID field of the data packet B IP header of a VoIP service.

And, when the packet encrypting unit 120 generates an ESP packet A obtained by encrypting the data packet A, the protocol ID field in the new IP header of the ESP packet A includes Protocol in the protocol ID field in the IP header of the original data packet A. Protocol ID = 50 indicating the protocol type of the ESP packet, not ID = 6 (TCP), will be recorded.

In addition, when the packet encrypting unit 120 generates an ESP packet B by encrypting the data packet B, the protocol ID field in the new IP header of the ESP packet B also includes Protocol in the protocol ID field in the IP header of the original data packet B. Protocol ID = 50 indicating the protocol type of the ESP packet, not ID = 17 (UDP), will be recorded.

At this time, the QoS control unit 130 intervenes in the process of generating an encrypted packet, that is, an ESP packet in the packet encryption unit 120, that is, tunnel mode encryption, and Protocol ID recorded in the protocol ID field in the new IP header of ESP packet A = By changing 50 to Protocol ID = 6 (TCP) recorded in the Protocol ID field in the IP header of the original data packet A, the identification information (Protocol ID) in the new IP header of the ESP packet A is changed to the IP of the original data packet A. It can be the same as the protocol ID in the header.

In addition, the QoS control unit 130 intervenes in the process of generating an encrypted packet, that is, an ESP packet in the packet encryption unit 120, that is, tunnel mode encryption, and Protocol ID recorded in the protocol ID field in the new IP header of ESP packet B = By changing 50 to Protocol ID = 17 (UDP) recorded in the protocol ID field in the IP header of the original data packet B, the identification information (Protocol ID) in the new IP header of the ESP packet B is changed to the IP of the original data packet B. It can be the same as the protocol ID in the header.

The packet transmission unit 140 transmits an ESP packet through a specific radio resource mapped to identification information (Protocol ID) in the new IP header of the encrypted packet, that is, the ESP packet, among radio resources allocated by the base station for packet transmission, When transmitting an ESP packet, the QoS level provided by the specific radio resource is guaranteed.

Here, the radio resource allocated from the base station means between the encrypted packet transmission apparatus 100 (terminal) and the base station in the EPS Bearer created between the encrypted packet transmission apparatus 100 (terminal) and the P-GW of the present invention. For convenience, it will be described as an EPS Bearer.

That is, the packet transmission unit 140, among the EPS bearers generated based on the radio section with the base station, ESP through a specific radio resource mapped to identification information (Protocol ID) in the new IP header of the ESP packet, that is, a specific EPS bearer. By transmitting packets, the QoS level provided by a specific EPS bearer is guaranteed when ESP packets are transmitted (QoS transmission).

After all, in the present invention, if the packet transmission unit 140 transmits the ESP packet in the same way as the QoS transmission of the data packet, the protocol ID in the new IP header of the ESP packet is changed to the original data before encryption. Because it is changed to be the same as the identification information (Protocol ID) of the packet, the ESP packet is also QoS-transmitted.

In FIG. 4, as in FIG. 2, it is shown assuming that two dedicated bearers are additionally created between the encrypted packet transmission apparatus 100 (terminal) of the present invention and the LTE network.

If the encrypted packet transmission apparatus 100 of the present invention transmits data packet A of a video streaming service without encryption, when data packet A is transmitted, Dedicated mapped to Protocol ID = 6 (TCP) in the IP header of data packet A Bearer (Non-GBR, Bearer ID = 10, QCI=9 (Streaming)), in other words, Dedicated Bearer (Non-GBR, Bearer ID = 10, QCI=9 (Streaming) )), the data packet A of the video streaming service will be QoS transmitted (dotted line).

In addition, if the encrypted packet transmission apparatus 100 of the present invention transmits data packet B of VoIP service without encryption, when data packet B is transmitted, a dedicated bearer mapped to Protocol ID = 17 (UDP) in the IP header of data packet B (GBR, Bearer ID = 8, QCI=1 (VoIP)), in other words, by transmitting through a Dedicated Bearer (GBR, Bearer ID = 8, QCI=1 (VoIP)) that guarantees QoS suitable for the media type of VoIP service , data packet B of VoIP service will be QoS transmitted (dotted line).

The transmission flow (dotted line) for transmitting data packets without encryption is the same as the transmission method of the encrypted packet transmission apparatus 100 of the present invention or the transmission method of the existing terminal.

However, as can be seen in FIG. 4, if the encrypted packet transmission apparatus 100 of the present invention structures (encrypts) the data packet into an ESP packet and transmits it, the protocol in the new IP header of the encrypted ESP packet A Since Protocol ID = 50, which is collectively recorded in the ID field, is changed to be the same as Protocol ID = 6 (TCP) of data packet A, Dedicated mapped to Protocol ID = 6 (TCP) in the new IP header of ESP packet A Bearer (Non-GBR, Bearer ID = 10, QCI=9 (Streaming)), in other words, Dedicated Bearer (Non-GBR, Bearer ID = 10, QCI=9 (Streaming) )) through (solid line).

That is, according to the encrypted packet transmission apparatus 100 of the present invention, when transmitting an ESP packet A in which data packet A of a video streaming service is encrypted, not only enables QoS transmission, but also transmits the same QoS as the original data packet A. That is, it enables QoS transmission ensuring a QoS level suitable for the media type of the video streaming service.

In addition, as can be seen in FIG. 4, if the encrypted packet transmission apparatus 100 of the present invention structures (encrypts) the data packet into an ESP packet and transmits it, the protocol in the new IP header of the ESP packet B having encrypted the data packet B Since Protocol ID = 50 collectively recorded in the ID field is changed to be the same as Protocol ID = 17 (UDP) of data packet B, Dedicated mapped to Protocol ID = 17 (UDP) in the new IP header of ESP packet B Bearer (GBR, Bearer ID = 8, QCI=1 (VoIP)), in other words, transmitted through a Dedicated Bearer (GBR, Bearer ID = 8, QCI=1 (VoIP)) that guarantees QoS suitable for the media type of VoIP service (solid line).

That is, according to the encrypted packet transmission apparatus 100 of the present invention, even when transmitting the ESP packet B in which the data packet B of the VoIP service is encrypted, QoS transmission is possible, and the same QoS transmission as the original data packet B, that is, It enables QoS transmission that guarantees the QoS level suitable for the media type of VoIP service.

In summary, the present invention intervenes in the process of encrypting data packets into ESP packets using the tunnel mode encryption method and maintains the same protocol ID of the data packets before encryption in the new IP header of the ESP packet, thereby resulting in ESP packet transmission. As a result, the effect of enabling the same QoS transmission as the data packet before encryption is derived.

Meanwhile, the ESP packet (eg ESP packet A) transmitted in this way will be delivered to the designated node (eg VPN server) through the Dedicated Bearer (Non-GBR, Bearer ID = 10, QCI = 9 (streaming)), The VPN server decrypts the encrypted ESP packet A and delivers it to the actual destination.

At this time, from the viewpoint of the VPN server, even if the identification information (Protocol ID) in the new IP header of the received ESP packet A is not Protocol ID = 50 indicating the protocol type of the ESP packet (e.g. Protocol ID = 6, 17, etc.), encryption It will be necessary to share a minimum amount of information that can be recognized as an ESP packet.

As described above, the encrypted packet transmission apparatus according to the embodiment of the present invention transmits an encrypted packet in the form of an encrypted data packet, especially an encrypted packet (ESP packet) encrypted by the tunnel mode encryption method, even when the original data packet is transmitted. It enables QoS transmission in the same way as data packets.

Hereinafter, an encrypted packet transmission method according to a preferred embodiment of the present invention will be described with reference to FIGS. 4 to 7.

For convenience of description, the method of transmitting an encrypted packet according to the present invention will be referred to as an operation method of the apparatus 100 for transmitting an encrypted packet.

The encrypted packet transmission method of the present invention, that is, the operating method of the encrypted packet transmission apparatus 100, generates data of a communication service to be used in a terminal in the form of a data packet composed of an IP header and data (S100).

For example, in the case of using the VoIP service as a communication service, the encrypted packet transmission method of the present invention, that is, the method of operating the encrypted packet transmission apparatus 100, will generate a data packet B for the VoIP service. At this time, Protocol ID = 17 (UDP) will be recorded in the Protocol ID field in the IP header of data packet B of the VoIP service.

The operation method of the encrypted packet transmission apparatus 100 according to the present invention encrypts the data packet (IP header + data) generated in step S100 (S110), and generates an encrypted packet composed of the encrypted data packet and a new IP header. Do (S120).

That is, in the operating method of the encrypted packet transmission apparatus 100 according to the present invention, the data packet (IP header + data) generated in step S100 is encrypted according to the tunnel mode encryption method to generate an encrypted packet (hereinafter referred to as an ESP packet). By doing so, the data packet is structured into an encrypted ESP packet.

In the process of generating the encrypted packet, that is, the ESP packet (S120), the protocol ID indicating the protocol type of the ESP packet is collectively recorded in the protocol ID field of the new IP header, regardless of the protocol type of the original data packet.

That is, assuming that data packet B is generated as an ESP packet B encrypted according to the tunnel mode encryption method, the protocol ID field in the new IP header of ESP packet B contains the protocol ID field in the IP header of the original data packet B. Instead of Protocol ID = 17 (UDP), Protocol ID = 50 (ESP) indicating the protocol type of the ESP packet is collectively recorded.

The operating method of the encrypted packet transmission apparatus 100 according to the present invention is to make identification information (Protocol ID) in the new IP header of the encrypted packet generated in step S120, that is, the ESP packet, identical to the Protocol ID in the IP header of the original data packet. (S130), when the ESP packet is transmitted, the same QoS transmission as the original data packet is possible.

Specifically, the operation method of the encrypted packet transmission apparatus 100 according to the present invention intervenes in the process of generating an encrypted packet, that is, an ESP packet in step S120, and collectively records the protocol ID field in the new IP header of the ESP packet. Identification information, that is, Protocol ID = 50, is changed to identification information (Protocol ID) recorded in the protocol ID field in the IP header of the original data packet, so that the identification information (Protocol ID) in the new IP header of the ESP packet is changed to the original data packet It can be the same as the protocol ID in the IP header of

According to the example described above, Protocol ID = 17 (UDP) is recorded in the protocol ID field within the IP header of the data packet B of the VoIP service generated in step S100, and the data packet B generated by encrypting data packet B in steps S110 and S120 In the protocol ID field of the new IP header of the ESP packet B, Protocol ID = 50 indicating the protocol type of the ESP packet, instead of Protocol ID = 17 (UDP) in the protocol ID field of the IP header of the original data packet B, is recorded. will be.

At this time, in the operating method of the encrypted packet transmission apparatus 100 according to the present invention, Protocol ID = 50 recorded in the protocol ID field in the new IP header of the ESP packet B is transferred to the protocol ID field in the IP header of the original data packet B. By changing the recorded Protocol ID = 17 (UDP), the identification information (Protocol ID) in the new IP header of ESP packet B can be made the same as the Protocol ID in the IP header of the original data packet B.

In this case, the operating method of the encrypted packet transmission apparatus 100 according to the present invention maps to Protocol ID = 17 (UDP) in the new IP header of ESP packet B among EPS bearers generated based on the radio section with the base station ESP packet B is transmitted through a dedicated EPS bearer (GBR, Bearer ID = 8, QCI = 1 (VoIP)) that guarantees QoS suitable for the media type of the VoIP service (S140), so that the original ESP packet B is transmitted. It enables the same QoS transmission as the data packet B of , that is, QoS transmission that guarantees the QoS level suitable for the media type of the VoIP service.

In summary, the present invention intervenes in the process of encrypting data packets into ESP packets using the tunnel mode encryption method and maintains the same protocol ID of the data packets before encryption in the new IP header of the ESP packet, thereby resulting in ESP packet transmission. As a result, the effect of enabling the same QoS transmission as the data packet before encryption is derived.

As described above, in the encrypted packet transmission method according to the embodiment of the present invention, even when transmitting an encrypted packet in the form of an encrypted data packet, particularly an encrypted packet (ESP packet) encrypted by the tunnel mode encryption method, the original It enables QoS transmission in the same way as data packets.

As described above, the operating method of the encrypted packet transmission apparatus according to the present invention, that is, the encrypted packet transmission method of the present invention, can be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the medium may be those specially designed and configured for the present invention or those known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to act as one or more software modules to perform the operations of the present invention, and vice versa.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above embodiments, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the following claims. Anyone skilled in the art will extend the technical spirit of the present invention to the extent that various variations or modifications are possible.

According to the encrypted packet transmission apparatus and the encrypted packet transmission method according to the present invention, even when an encrypted packet in the form of an encrypted data packet is transmitted, QoS transmission is possible in the same way as the original data packet. It is an invention with industrial applicability because not only the use of the related technology, but also the possibility of marketing or business of the applied device is sufficient and it can be clearly practiced in reality.

100: encrypted packet transmission device (terminal)
110: data packet generator 120: packet encryption unit
130: QoS control unit 140: packet transmission unit

Claims (7)

a packet encryption unit which encrypts a data packet composed of an IP header and data and generates an encrypted packet composed of the encrypted data packet and a new IP header; and
Intervening in the process of generating the encrypted packet, making the identification information in the new IP header of the encrypted packet the same as the identification information required for QoS (Quality of Service) transmission included in the IP header of the data packet before encryption, a QoS control unit enabling the same QoS transmission as the data packet before encryption when the encrypted packet is transmitted;
In the process of generating the encrypted packet, in the identification information in the new IP header,
Encryption packet transmission apparatus characterized in that identification information indicating the type of the encryption packet is collectively recorded regardless of the data packet before encryption. According to claim 1,
The QoS control unit,
In the process of generating the encrypted packet, the identification information recorded in the protocol ID field in the new IP header is changed to the identification information recorded in the protocol ID field in the IP header of the data packet. . According to claim 2,
In the process of generating the encrypted packet, in the protocol ID field in the new IP header,
Encryption packet transmission apparatus characterized in that identification information indicating the protocol type of the encryption packet is collectively recorded regardless of the protocol type of the data packet. According to claim 1,
Among the radio resources allocated by the base station for packet transmission, the encrypted packet is transmitted through a specific radio resource mapped to identification information in the new IP header of the encrypted packet, and QoS provided by the specific radio resource when the encrypted packet is transmitted Encryption packet transmission device characterized in that it further comprises a packet transmission unit for guaranteeing the level. A packet encryption step of encrypting a data packet composed of an IP header and data, and generating an encrypted packet composed of the encrypted data packet and a new IP header; and
Intervening in the process of generating the encrypted packet, making the identification information in the new IP header of the encrypted packet the same as the identification information required for QoS (Quality of Service) transmission included in the IP header of the data packet before encryption, a QoS control step of allowing the same QoS transmission as the data packet before encryption when the encrypted packet is transmitted;
In the process of generating the encrypted packet, in the identification information in the new IP header,
The method of transmitting encrypted packets, characterized in that identification information indicating the type of the encrypted packets is collectively recorded regardless of the data packets before encryption. According to claim 5,
The QoS control step,
In the process of generating the encrypted packet, the identification information recorded in the protocol ID field of the new IP header is changed to the identification information recorded in the protocol ID field of the IP header of the data packet. . According to claim 5,
Among the radio resources allocated by the base station for packet transmission, the encrypted packet is transmitted through a specific radio resource mapped to identification information in the new IP header of the encrypted packet, and QoS provided by the specific radio resource when the encrypted packet is transmitted Encrypted packet transmission method characterized in that it further comprises a packet transmission step to ensure.