Internet Security Association & Key Mana gement Protocol

1. Internet Security Association & Key Management Protocol CNET 이동재

2. 3. ISAKMP Payloads ISAKMP payloadsprovide modular building blocks for constructing ISAKMP messages

3. 3.1 ISAKMP Header Format 고정된 header는 해당 프로토콜에 필요한 정보를 포함한다. (다음과 같은 사항을 위해) 1) maintain state 2) process payloads 3) possibly prevent denial of service or replay attacks

4. Exchange Type(1 octet) – 사용되고 있는 exchange의 타입을 나타낸다. The presence and ordering of payloads in ISAKMP is defined by and dependent upon this Exchange Type Field located in the ISAKMP Header (see Figure 2)

5. 3.2 Generic Payload Header provides a payload "chaining" capability clearly defines the boundaries of a payload

6. 3.3 Data Attributes Data Attributes are not an ISAKMP payload, but are contained within ISAKMP payloads Data Attributes의 format으로 다양한 형태의 정보를 표현 할 수 있다. 하나의 payload안에 여러 개의 Data Attributes가 존재할 수 있다.

7. Attribute Format bit data attributes로서, Type/Length/Value (TLV) format이 오는지, Type/Value (TV) format만이 오는지를 나타냄 AF bit가 0 이면, Data Attributes는 Type/Length/Value (TLV) form AF bit가 1이면, Data Attributes는 Type/Value form

8. 3.4 Security Association Payload 다음과 같은 목적으로 사용된다. 1) to negotiate security attributes 2) to indicate the Domain of Interpretation (DOI) and Situation under which the negotiation is taking place

9. 3.5 Proposal Payload Contains information used during Security Association negotiation The proposal consists of security mechanisms or transforms, to be used to secure the communications channel

10. 3.6 Transform Payload contains the security association attributes associated with the specific transform · SA Attributes : SHOULD be represented using the Data Attributes format described in section 3.3.

11. 3.7 Key Exchange Payload supports a variety of key exchange techniques · Key Exchange Data : Data required to generate a session key

12. 3.8 Identification Payload Contains DOI-specific data used to exchange identification information 이 identificationinformation는 communicating peers의 identities를 결정하는데 사용됨 · ID Type : Specifies the type of identification being used · DOI Specific : Contains DOI-specific identification data · Identification Data : Contains identity information

13. 3.9 Certificate Payload ISAKMP를 통해 certificates 또는 다른 certificate 관련정보를 전송할 수 있는 수단을 제공 어떤 ISAKMP message에도 나타날 수 있음 · Certificate Encoding : indicates the type of certificates or other certificate-related information contained in the Certificate Data field · Certificate Data : Actual encoding of Certificate Data

14. 3.10 Certificate Request Payload Provides a means to request certificates via ISAKMP SHOULD be included in an exchange whenever an appropriate directory service is not available to distribute certificates · Certificate Type :Contains an encoding of the type of certificate requested · Certificate Authority : Contains an encoding of an acceptable certificate authority X.509 standard 어떤 정보가 certificate으로 될 수 있는지를 정의 어떤 data format로 기록할지를 기술

15. 3.11 Hash Payload hash function에 의해 생성된 data를 포함 May be used to verify the integrity of the data in an ISAKMP message or for authentication of the negotiating entities · Hash Data : hash routine을 ISAKMP message에 적용시킨 결과로 발생한 Data

16. 3.12 Signature Payload Digital signature function에 의해 발생된 data를 포함 Being used to verify the integrity of the data in the ISAKMP message, and may be of use for non-repudiation services · Signature Data :ISAKMP message에 Digital signature function을 적용시킨 결과로 발생한 Data

17. 3.13 Nonce Payload exchange동안 liveness를 보장하고 replay attacks로 부터 보호하기 위해 사용되는 random data를 포함 · Nonce Data :송신측에 의해 발생되는 random data

18. 3.14 Notification Payload ISAKMP와 DOI-specific data를 포함할 수 있다. error conditions과 같은 informational data를 ISAKMP peer에게 전송하는데 사용됨 single ISAKMP message에있는 여러 Notification payloads를 전송 가능 · Notify Message Type (2octects) : notification message의 type을 지정 DOI가 specify했다면, 더 이상의 text는 Notification Data field 에 위치한다. · Notification Data (variable) : Notify Message Type에 더하여 전송되는 Informational or error data

19. 3.14.1 Notify Message Types Notification information은 SA가 구성될 수 없었던 이유를 열거하는 error messages가 될 수 있다. 또한, SA database를 관리하는 process가 peer process와 communicate하길 원하는 status data가 될 수 있다

20. 3.15 Delete Payload Contains a protocol-specific security association identifier that the sender has removed from its security association database  Therefore, no longer valid Delete payload에 있는 multiple SPIs을 보낼 수는 있지만, 각각의 SPI는 같은 protocol에 대한 것 이어야 함. Delete payload에서는 Protocol Identifiers의 혼합을 피해야 함. · Security Parameter Index(es): Identifies the specific security association(s) to delete

21. 3.16 Vendor ID Payload Contains a vendor defined constant If a Vendor ID payload is sent, it MUST be sent during the Phase 1 negotiation · Vendor ID :Hash of the vendor string plus version