KR102708686B1 - Internet Key Exchange of Network Equipment - Google Patents

Abstract

The embodiment relates to a method for exchanging Internet keys of network equipment.
Specifically, this method requests and receives a service key using a quantum key from network equipment using the KSA of QKMS, and proceeds with the service key using the quantum key of QKMS instead of the existing DH key exchange during Internet key exchange.
Therefore, in the Internet key exchange method, the large and complex load of calculation and management is reduced for distributing keys by using a service key created using a quantum key, which is more secure than the DH key distribution method.

Description

{Internet Key Exchange of Network Equipment}

The subject matter disclosed in this specification relates to an Internet Key Exchange (IKE) method of network equipment (NE).

Unless otherwise indicated herein, the materials described in this section are not prior art to the claims of this application and their inclusion in this section is not an admission that they are prior art.

In general, Internet Key Exchange (IKE) is used when encrypting IPSEC (Internet Protocol Security), and generates and executes a random encryption key for each session. Since it is easy to be discovered if the same encryption key is used for a long time, the Diffie-Hellman (hereinafter referred to as 'DH') method is used as a method for the sending side to safely transmit the encryption key generated by the receiving side to the other party.

For reference, the above IPSEC is a set of protocols that provide data tampering prevention and concealment functions in IP packet units using encryption technology. It consists of two protocols: AH (Authentication Header) and ESP (Encapsulated Security Payload). AH operates to ensure authentication header and data integrity, and ESP is responsible for data encryption services through encapsulation. The IKE protocol is used in the application layer to manage encryption keys along with AH and ESP.

This IPSEC can use various encryption techniques and key security protocols using protocols and port numbers, etc., even in communication between the same nodes. The agreement shared between both ends of the communication is called a Security Association (hereinafter referred to as 'SA'), which means a logical communication path established with security provided between the sending and receiving sides.

The above SA requires agreement between the sender and receiver on a key, authentication algorithm, encryption algorithm, and a set of additional parameters required for these algorithms. Here, the key, authentication algorithm, etc. are each called a protection attribute, and the set of these protection attributes is called a security association.

For reference, the above DH key distribution method uses one integer and one prime number as the public key to be shared with the other party immediately before communication, and uses a number dedicated to a separate secret key for each party to calculate a common encryption key using these numbers and the public key numbers.

These existing Internet key exchange methods perform relatively complex calculations and management to distribute keys for each session in each network equipment (NE). Therefore, there may be a new key exchange method to reduce the burden of these calculations and management.

Meanwhile, quantum key distribution (QKD) technology is emerging as a possible way to implement a symmetric key distribution-based encryption protocol for secure data communication based on the principle of quantum uncertainty.

Quantum cryptography technology is a general term for quantum key distribution (QKD) technology, which generates and distributes symmetric keys that ensure confidentiality between any two nodes by utilizing quantum mechanical principles; data encryption and decryption technology based on distributed secret keys; and data transmission technology for safely transmitting encrypted data.

Therefore, these quantum keys can be used to reduce the burden or load that network equipment must compute and manage to distribute keys for each session in existing Internet key exchange methods.

The prior art in this context is as follows.

Literature 1 Korean Patent Publication No. 10-2023-0021565 Literature 2 Korean Publication Patent No. 10-2004-0028329 Document 3 Korean Patent No. 10-0412238 Document 4 United States Patent Publication No. 10-2018-0079324

The disclosed content is intended to provide a method for exchanging Internet keys of network equipment using quantum keys, which is more secure than the DH key distribution method, to reduce the load of calculating and managing keys for each session in the Internet key exchange method.

A method for exchanging Internet keys of network equipment according to an embodiment,

This is a key exchange method that uses a service key created using a quantum key that is more secure than the DH key distribution method.

Using the KSA (Key Supply Agent) of QKMS (Quantum Key Management System), a service key using a quantum key is requested and received from network equipment, and when exchanging Internet keys, the service key using the quantum key of QKMS is used instead of the existing DH key exchange.

First, the general Internet key exchange method is performed by at least two primary network devices and secondary network devices, and one network device must have both master and slave or transmitting and receiving functions. To this end, one network device has the function of performing all of the ISAKMP (Internet security association & key management protocol) SA proposal, selection, transmitting-side DH key exchange, receiving-side DH key exchange, transmitting-side authentication, and receiving-side authentication procedures.

The embodiment is characterized by performing key exchange using KSA of QKMS instead of such DH key exchange.

This key exchange selects ISAKMP SA, and if one network device is in charge of the master, it requests a service key using a quantum key to the KSA of QKMS and receives a service key ID and service key in response. Then, if it is in charge of the slave, it requests a service key to the KSA of QKMS through the service key ID received from the other party's master and receives a response. Therefore, if these two service keys are the same, the key exchange is processed as successful, and if they are different, it is processed as failed.

According to an embodiment, in an Internet key exchange method, a service key created using a quantum key that is more secure than a DH key distribution method is used to exchange Internet keys, thereby reducing the load on network equipment for calculating and managing keys for each session.

Figure 1 is a drawing conceptually explaining an Internet key exchange method of network equipment according to one embodiment.
Figure 2 is a drawing illustrating a system that applies an Internet key exchange method of network equipment according to one embodiment.
Figure 3 is a block diagram illustrating the configuration of an Internet key exchange module that applies an Internet key exchange method of network equipment according to an embodiment.
Figure 4 is a block diagram illustrating the configuration of QKMS that applies the Internet key exchange method of network equipment according to one embodiment.
Figure 5 is a drawing for explaining the KSA module function of QKMS that applies the Internet key exchange method of network equipment according to one embodiment.
Figure 6 is a drawing for explaining the initialization operation of KSA of QKMS applying the Internet key exchange method of network equipment according to one embodiment.
Figures 7 and 8 are drawings for explaining the service key supply operation of KSA of QKMS applying the Internet key exchange method of network equipment according to one embodiment.
Figure 9 is a flow chart illustrating a method for exchanging Internet keys of network equipment in sequence according to an embodiment of the present invention.

FIG. 1 is a diagram conceptually explaining an Internet key exchange method of network equipment according to one embodiment.

As illustrated in FIG. 1, an Internet key exchange method of one embodiment reduces the load on network equipment for calculating and managing keys for each session by exchanging keys using a service key created using a quantum key that is more secure than the DH key distribution method.

This method uses a key exchange module using KSA in a QKMS environment. Instead of the DH key distribution method of the existing Internet key exchange, the quantum key managed by QKMS is exchanged between network devices (Host A <-> Host B) through KSA. The network device can be a router.

In summary, the above method is a key exchange method that uses a service key created using a quantum key that is more secure than the DH key distribution method.

Using the KSA of QKMS, a service key using a quantum key is requested and received from network equipment, and when exchanging Internet Keys (IKE), the service key using the quantum key of QKMS is used instead of the existing DH key exchange.

First, the general Internet key exchange method is performed by at least two primary network devices and secondary network devices as described above, and one network device must have both master and slave or transmitting and receiving functions. To this end, one network device has the functions of performing ISAKMP SA proposal, selection, DH key exchange on the transmitting side, DH key exchange on the receiving side, authentication on the transmitting side, and authentication on the receiving side.

The embodiment performs key exchange using KSA of QKMS instead of such DH key exchange.

This key exchange selects ISAKMP SA, and if one network device is in charge of the master (R1 in Fig. 1), it requests a service key using a quantum key to the KSA of QKMS and receives a service key ID and service key in response. Then, if it is in charge of the slave (R2 in Fig. 1), it requests a service key to the KSA of the corresponding QKMS through the service key ID received from the other party's master and receives a response. Therefore, if these two service keys are the same, the key exchange is processed as successful, and if they are different, it is processed as failed.

FIG. 2 is a drawing illustrating a system that applies an Internet key exchange method of network equipment according to one embodiment.

As illustrated in FIG. 2, a system according to an embodiment largely includes a QKMS core (100) and an Internet Key Exchange (IKE) module (200) for linking KSA of QKMS.

The above QKMS core (100) manages quantum key distribution modules within a quantum key distribution (QKD) domain on a quantum key management (KM) layer. An example of a quantum cryptographic network includes a quantum key distribution (QKD) layer, a quantum key management layer, and a service layer. The quantum key distribution layer generates and distributes quantum keys through quantum channels and general channels connected to a quantum key distribution module. The quantum key distribution layer may include quantum key distribution domains in which the quantum key distribution module generates and transmits quantum keys. Quantum key management includes receiving, storing, formatting, relaying, synchronizing, authenticating, supplying, and deleting or preserving keys from the quantum layer during their life cycle to be used for QKD applications and services. The QKMS core (100) includes a system manager, a QKMS manager, a QKDE manager, a state agent, a KMA, a KSA, a KRA, and a DB. In particular, the QKMS manager manages QKDE and network equipment, and the KSA performs service key generation and supply.

The above Internet key exchange module (200) requests and receives a service key using a quantum key from network equipment using the KSA of QKMS, and proceeds with a service key using the quantum key of QKMS instead of the existing DH key exchange when exchanging Internet keys. In one embodiment, a part for requesting and responding to a service key and a part for managing Internet key exchange using the received service key are additionally provided. This key exchange method is a key exchange method using a service key created using a quantum key that is more secure than the DH key distribution method, and reduces the large and complex load that the network equipment calculates and manages to distribute the key for each session.

FIG. 3 is a block diagram illustrating the configuration of an Internet key exchange module that applies an Internet key exchange method to network equipment according to one embodiment.

As shown in Fig. 3, the Internet key exchange module (100) according to one embodiment largely includes an Internet key exchange unit (101) for KSA linkage, a KSA service key information transmission/reception unit (102), and a socket (103).

Additionally, there are schedulers, processors, transmitters, receivers, loggers, kernel interfaces, IPsec stacks, etc.

The above Internet key exchange unit (101) performs the proposal and selection of ISAKMP SA, key exchange using KSA of QKMS, and authentication procedures. In particular, the key exchange selects ISAKMP SA according to an embodiment, and then, when one network device is in charge of the master, requests a service key using a quantum key with KSA of QKMS and receives a service key ID and service key in response. Then, when in charge of the slave, requests a service key with KSA of QKMS through this service key ID received from the other party's master and receives a response. Therefore, when these two service keys are the same, the key exchange is processed as successful, and when they are different, it is processed as failed.

The above KSA service key information transmission and reception unit (102) transmits and receives information for various key exchanges in conjunction with the above KSA.

The above socket (103) transmits or receives the processed transmission/reception information to or from the corresponding KSA.

FIG. 4 is a diagram illustrating the configuration of QKMS that applies an Internet key exchange method of network equipment according to one embodiment.

As illustrated in FIG. 4, QKMS according to an embodiment largely includes a system manager, a QKMS manager, a QKDE manager, a status agent, a KMA, a KSA, a KRA, and a DB.

The above system manager manages QKMS control and block management and live updates. For example, a block has a KSA block.

The above QKMS manager manages components such as QKDE and network equipment, manages topology settings and queries, and sets and queries operation policies.

The above QKDE manager manages QKDE control and performance management information settings and queries, fault collection, and performance collection.

The above status manager manages fault reporting, performance reporting, key status reporting, etc.

The above KMA performs quantum key life cycle management, quantum key reception, key synchronization, etc.

The above KSA performs service key generation and provision, and service key life cycle management.

The above KRA performs key transmission path setup, inquiry and request, key transmission and synchronization, etc.

The above DB registers the generated quantum key-based service key corresponding to each service key ID, and also registers setting information and registration information for various key exchanges.

FIG. 5 is a drawing for explaining the KSA module function of QKMS that applies the Internet key exchange method of network equipment according to one embodiment.

As illustrated in FIG. 5, the KSA module function according to one embodiment is as follows: First, KSA is a quantum key distribution device, and the key distributed through the quantum key distribution device is ultimately transmitted to the application service or network device that uses the service. In addition, KSA provides a function for allocating and managing quantum keys according to requirements.

The main functions of these KSA modules are initialization, service key generation, service key provision, service key status information provision, and service key life cycle management.

The above initialization performs the KSA block initialization function. The above service key generation generates a service key to be provided to network equipment using a quantum key, and the above service key provision supplies a service key at the request of the network equipment. The above service key status information provision provides service key status information at the request of the network equipment, and the service key life cycle management manages the life cycle for the service key.

FIG. 6 is a drawing for explaining the initialization operation of KSA applying the Internet key exchange method of network equipment according to one embodiment.

As illustrated in FIG. 6, the initialization operation of the KSA according to an embodiment is an initialization function of the quantum key supply module, which obtains the Q-KMS name from the configuration file, converts it into an ID, and registers the rest API to the KM interface and the N-PAL interface. The initialization procedure loads the configuration file from the KSA block and then transmits the rest API to the KM interface and the N-PAL interface.

FIGS. 7 and 8 are drawings for explaining the service key supply operation of KSA applying the Internet key exchange method of network equipment according to one embodiment.

Specifically, Fig. 7 shows a service key supply operation in a master network device, and Fig. 8 shows a service key supply operation in a slave network device.

As shown in FIGS. 7 and 8, in order to explain the service key supply operation of KSA according to one embodiment, the service key generation operation is first explained.

The above service key generation operation is one of the main functions of the quantum key supply module, which generates a service key using a quantum key stored in the DB according to a request from a network device and a service key provision item set in QKMS. The generated service key is used to supply the service key.

Therefore, the above service key supply operation is a function that provides a service key when a service key request comes from a network device. There are cases where the request is made from the master and cases where the request is made from the slave.

When requested by the master, the master transmits a service key request message through the N-PAL interface of the QKMS as shown in Fig. 7, and when the KSA receives the message, it checks the key profile information in the DB. And,

Check whether peer QKMS exists in the key profile of the corresponding KSA, and if peer QKMS exists, check whether network device information exists in the peer QKMS. Therefore, if network device information exists, respond to the corresponding peer QKMS, and generate a service key and service key ID with a quantum key in the corresponding KSA, and supply them to the corresponding network device. In other words, the KSA block performs service key generation and then supplies the service key through the N-PAL interface.

This may be because quantum key distribution technology is limited to end-to-end key distribution with physical distance constraints, and there must be a network-level quantum key transmission method through trusted nodes between multiple nodes on the network.

Meanwhile, when requesting a service key from a slave, as shown in Fig. 8, when requesting a service key through the N-PAL interface of the QKMS, the KSA block retrieves the service key stored in the DB and supplies it.

Additionally, one embodiment has a service key information provision function, and provides information used for service key status and generation when a request for service key status information comes from network equipment.

Figure 9 is a flow chart illustrating a method for exchanging Internet keys of network equipment according to an embodiment of the present invention in sequence.

As illustrated in FIG. 9, a method according to an embodiment first proposes an ISKMP SA from a master network device (100-1) to a slave network device (100-2) for an Internet session. Then, the slave network device (100-2) selects an ISAKMP SA from the master network device (100-1).

In this state, key exchange is performed according to an embodiment.

First, the master network device (100-1) requests a service key using a quantum key as the KSA of the registered QKMS. Then, it receives a service key ID and service key in response to this request. Then, it transmits this service ID to the slave network device (100-2).

For example, the above service key response is responded to the QKMS if the peer QKMS set in the key profile of the corresponding KSA has the corresponding network equipment information, and the service key and service key ID are generated and supplied as quantum keys in the KSA. These service keys are stored corresponding to each ID.

To do this, first, the Q-KMS name of the file is converted into an ID, and the rest API is registered and initialized in the KM interface and N-PAL interface. Thus, the request is processed through the initialized N-PAL interface.

Meanwhile, the slave network equipment (100-2) requests a service key from the KSA of the QKMS through the service key ID and receives the service key in response.

Therefore, if the service key of the master network device (100-1) and the service key of the slave network device (100-2) are the same, the key exchange is processed as successful, and if they are different, it is processed as failed.

The operation is completed by mutually authenticating each other based on the key exchange processed in this way.

As described above, one embodiment uses the KSA of QKMS to request and receive a service key using a quantum key from network equipment, and when exchanging Internet keys, proceeds with a service key using the quantum key of QKMS instead of the existing DH key exchange.

Therefore, one embodiment reduces the large and complex load of calculation and management for distributing keys by using a service key created using a quantum key, which is more secure than the DH key distribution method, in an Internet key exchange method.

100 : Internet Key Exchange Module
101: Internet Key Exchange
102: KSA Service Key Information Transmitter and Receiver
103 : Socket
200 : QKMS

Claims (3)

In a method for exchanging Internet keys of network equipment between a master NE and a slave NE,
Step 1 where the above master NE proposes ISAKMP SA for Internet session to the above slave NE;
A second step in which the slave NE selects the ISAKMP SA proposed in the first step;
A third step in which the master NE requests a service key using a quantum key to the KSA of QKMS through the ISAKMP selected in the second step;
Step 4 where the master NE receives a response from the KSA of the QKMS for the service key and service key ID requested in the step 3;
Step 5 where the slave NE receives the service key ID received in response in Step 4 from the master NE and requests a service key using the KSA of the corresponding QKMS;
Step 6, where the slave NE responds with the service key requested in Step 5;
Step 7, in which the master NE receives the service key responded to in Step 6 and, if it matches the service key responded to in Step 4, processes the key exchange as successful; and
An 8th step of processing authentication between the master NE and the slave NE according to the key exchange processed successfully in the 7th step;

The above 4th step is
Step 4-1 where the above master NE checks whether a peer QKMS exists in the key profile of the KSA of the above QKMS through the KSA of the above QKMS;
Step 4-2 of checking whether the network equipment information exists in the peer QKMS when the peer QKMS exists in the step 4-1 above; and
A method for exchanging Internet keys of network equipment, characterized in that it includes a step 4-3;; of responding to the peer QKMS when network equipment information exists in the step 4-2 above, generating a service key and a service key ID with a quantum key in the corresponding KSA, and supplying them to the corresponding master NE. delete In claim 1,
The above step 4-1
Step 4-1-1: Converting the Q-KMS name of the file to an ID, registering the rest API in the KM interface and N-PAL interface, and initializing it; and
A method for exchanging Internet keys in network equipment, characterized by including a step 4-1-2 for processing a request of the step 3 through the N-PAL interface initialized in the step 4-1-1.

Images