KR100802652B1 - Recognition method of data variation in network and its device - Google Patents

Abstract

The present invention divides the data value generated in the application layer into segments in the transport layer, processes the partitioned data in a hash function, and adds the result of the hash function to the header of the packet as a reference value to be transmitted to the Internet network. And extracting a reference value from a header of a packet received from the internet network, and comparing the extracted reference value with a result value of a function processing data to start the network including a terminal for recognizing the deformation of the data. In addition, the receiving side that receives the data can check whether the data has been deformed, as well as request data retransmission when the data is deformed.

Description

Apparatus and Method for Detection of Data Alteration in the Network}

1 is a network connection diagram for explaining the configuration of the Internet network according to the present invention.

2 is a diagram for explaining each layer according to a general TCP.

FIG. 3 is a diagram for explaining a TCP header processed by the transport layer of TCP. FIG.

4 is a diagram illustrating a data processing flow of a terminal according to an exemplary embodiment of the present invention.

5 is a diagram illustrating a TCP header according to a preferred embodiment of the present invention.

6 is a flowchart for explaining a data transformation recognition method according to a preferred embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100-1: transmitting terminal 100-2: receiving terminal

The present invention relates to a method and apparatus for recognizing data modification of a network.

Today, the development of network technology is increasing the number of subscribers in wired / wireless networks (hereinafter referred to as the "Internet network"), and the development of the Internet network, the development of digital communication and storage technologies has resulted in many subscribers taking pictures, videos, documents and voices. Various multimedia data are exchanged through the Internet.

In the Internet network, a representative protocol defined for exchanging data is TCP / IP (Transmission Control Protocol / Internet Protocol).

TCP was developed for congestion-conscious in networks such as public Internet networks. TCP's collision control mechanisms include slow start, congestion avoidance, fast retransmit, and It consists of Fast Recovery.

TCP's collision control mechanism is designed to consider the case where only one data unit (hereinafter referred to as "segment") is lost within the sender's window. , Request resend.

TCP is composed of four layers such as network access layer, internet network layer, transport layer, and application layer. When sender transmits data, receiver adds headers for each series while transferring from application layer to lower layer. The receiver receives the data through the network access layer and delivers the data to the upper layer while removing the header for each layer to extract the data.

However, the segments exchanging data through the general Internet network may be exposed or modified in the Internet network, so that the third party may modify the data for malicious purposes or in the environment of the Internet network. Therefore, there is a possibility that serious problems may occur if the value of the data is modified.

For example, if a medical institution needs to know a patient's health level accurately, a malicious third party can modify the value of the data sent from the sender to the receiver, which can cause serious problems for the patient.

Therefore, the present invention was devised to solve the above problems, and it is possible to check whether or not a deformation has occurred in data transmitted to the Internet network, and in the case of a deformation of data, a network of a request for retransmission occurs. It is an object of the present invention to provide a method and an apparatus for recognizing data modification.

In order to achieve the above object, a network including a plurality of terminals according to an aspect of the present invention divides data generated in an application layer into segments in a transport layer, processes a hash function, and then processes a hash function. A first terminal including one result value as a reference value in a header of a transport packet and transmitting the same to a network; And extracting the reference value from the header of the packet received from the first terminal through the network, and modifying the data by comparing the extracted reference value with a result value hashed by inputting the data value of the packet as an input. It includes a second terminal that recognizes.
The header of the transport packet including the result of the hash function processing in the first terminal as a reference value is a Transmission Control Protocol (TCP) header, and the reference value is included in an option field of the TCP header. The reference value is 128 bits of the result of the hash function processing.
If the result value of the hash function processing and the reference value do not match, the second terminal discards the packet, requests the packet to be retransmitted to the first terminal, and the second terminal transmits the TCP of the packet. Extracts the sequence number from the header and requests retransmission of the packet corresponding to the sequence number.
In a network including a plurality of terminals according to another aspect of the present invention, the data value generated in the transport layer is inputted to the network by including the result value of the hash function processing in the header as a reference value, and retransmission of the packet is performed. When requested, extracts a reference value from the header of the first terminal retransmitting the packet and the packet received from the first terminal through the network, and compares the result value with the reference value by hashing the data value of the packet as an input. And a second terminal for recognizing the deformation of the data and requesting retransmission of the data to the first terminal if the result value and the reference value do not match.

delete

delete

delete

delete

delete

delete

According to another aspect of the present invention, there is provided a method for recognizing data deformation of a network, comprising: dividing data generated by a transmitting terminal into segments in a transport layer; Adding a header including the header as a reference value, transmitting a packet with the header added to the network by the transmitting terminal, extracting a reference value from the header of the packet received through the network, and receiving And comparing, by the terminal with the data value of the packet as a function, a result of the function processing, and the extracted reference value, and determining the deformation of the data.

According to an embodiment of the present invention, if a receiving terminal does not match a result value and a reference value, the method of extracting a sequence number from a header of a corresponding packet and requesting a transmitting terminal to retransmit a packet corresponding to the sequence number is performed. It includes more.

In the step of adding a header according to the present invention, the reference value is included in the option field of the TCP header added at the transport layer and added to the data front end.

The reference value according to the present invention is 128 bits of the result value of the hash function processing using the data value as an input.

Hereinafter, a method and an apparatus for recognizing data modification of an internet network according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a network connection diagram for explaining the configuration of the Internet network according to the present invention.

1, a first terminal 100-1, which is a transmitting terminal for generating data and transmitting data through an internet network, and a second terminal 100-2, which is a receiving terminal for receiving data through an internet network, are connected to an internet network. Connected via

The first terminal 100-1 divides the data generated in the application layer into segments, adds a header for each layer, and transmits the packet in a packet form, and the second terminal 100-2 is received through an internet network. Data is extracted by removing headers of each layer of the packet.

The first terminal 100-1 receives the data value divided by the segment as an input, and transmits the result value of the function processing to the internet network by including the reference value in the added header as a reference value, and the second terminal 100-2 A reference value is extracted from the header of the packet received through the internet network, and the data value is input to compare the result value with the reference value to recognize the data modification.

2 is a view for explaining each layer according to a general TCP.

As shown in FIG. 2, the TCP model is divided into a network access layer, an internet layer, a transport layer, and an application layer.

Each layer of the TCP model is briefly described as follows.

The network access layer creates a frame by attaching a frame header and a trailer for CRC (Cycle Redundancy Check) check to a packet coming down from the upper layer of the Internet network layer, and sets the packet as a series of bit streams ( bit stream so that it can be sent on the physical line.

The Internet layer encapsulates an IP header for routing in a segment descending from a transport layer, which is a higher layer.

The transport layer divides the data coming down from the upper application layer into appropriate segments and adds TCP headers.

The application layer provides a standard interface for applications to provide network services (for example, file transfer protocol (FTP), Telnet, etc.) and generates data according to the application.

As shown in FIG. 2, data generated at the application layer is divided into segments in the transport layer, and a TCP header is added.

The IP header is added and encapsulated at the Internet layer, and the header is added at the network access layer and transmitted to the receiving terminal 100 through the Internet network.

On the other hand, the receiving terminal 100 removes the header of the packet received from the network access layer to the Internet network to the Internet layer, and decapsulates to remove the IP header from the Internet layer to the transport layer.

The TCP header is removed from the transport layer to push the data up to the application layer, and applications in the application layer process the data.

3 is a diagram for explaining a TCP header processed in a transport layer of TCP.

Referring to FIG. 3, the TCP header added at the transport layer is composed of a plurality of fields.

Table 1 below describes the number of bits and the function of each field of the TCP header.

TABLE 1

field Bits function Egress port 16 Sender's port number Listening port 16 Receiver's port number Sequence number 32 Specify which byte of data to send corresponds to the byte to be sent. ACK number 32  Specify how many bytes of data arrived at the receiver (Receive-> Send Forward) Data offset 4 Specify where the data part begins (indicates the length of the header) unused 6 Control bits 4 The field of the URG-emergency pointer is valid.The serial number field of the ACK-received data is valid. Checking each other (showing connection operation) FIN-END Window size 16 Notify window size from receiver to sender Checksum 16 Error Check Emergency point 16 Data location for urgent processing option Variable length

4 is a diagram illustrating a data processing flow of a terminal according to an exemplary embodiment of the present invention.

As shown in FIG. 4, the terminal 100 according to the present invention divides data generated in an application layer into appropriate segment units in a transport layer.

In addition, the terminal 100 performs a function processing, for example, a hash function processing based on the data divided in the transport layer, and as a result, 128 bits of the value are added to the TCP header added as a reference value. Encapsulate by inclusion.

The terminal 100 adds an IP header at the Internet layer, adds the header at the network access layer, and transmits the same to the Internet network.

On the other hand, the terminal 100 removes the header of the packet received from the network access layer to the Internet network, and uploads it to the upper layer, the Internet layer.

Then, the IP header is removed from the Internet layer and then uploaded to the transport layer, and the reference value included in the TCP header is extracted from the transport layer.

The terminal 100 processes the hash function by reading the data value after the TCP header, and checks whether 128 bits of the result match the reference value extracted from the TCP header.

That is, the terminal 100 determines whether or not the result value of the hash function processing of the received terminal and the result value of the hash function processing of the received data correspond to whether or not the data received from the transmitting terminal 100 is modified. Judge by comparison.

5 is a diagram for explaining a TCP header according to a preferred embodiment of the present invention.

As shown in FIG. 5, the terminal 100 performs a hash function processing using a data value as an input in the transport layer, and selects 128 bits as a reference value from the result value to include in an option field and encapsulates it.

In addition, when the terminal 100 hashes the received data value as an input value and the reference value included in the TCP header does not coincide, that is, when data deformation occurs, the terminal 100 retransmits the packet to the transmitting terminal 100. Ask.

For example, when data modification occurs, the terminal 100 extracts a sequence number from the sequence number field of the TCP header and requests packet retransmission to the transmitting terminal 100.

6 is a flowchart illustrating a method of recognizing data transformation according to an exemplary embodiment of the present invention.

Referring to FIG. 6, the transmitting terminal 100 generates data in an application layer according to an application program (S100).

In addition, the transmitting terminal 100 divides the data generated in the application layer into appropriate segment units in the transport layer, and performs a function process by using the data value as an input (S 110).

The transmitting terminal 100 includes 128 bits of the function-processed result values in the TCP header as a reference value and adds the TCP header to the front end of the data to encapsulate the data (S 120).

In this case, the transmitting terminal 100 may include a reference value in the option field of the TCP header.

Then, the transmitting terminal 100 adds a header in the Internet layer and the network access layer and transmits it to the Internet network (S 130).

On the other hand, the receiving terminal 100 decapsulates to remove the header of the packet received through the Internet network in the network access layer and the Internet layer (S 140).

Then, the receiving terminal 100 extracts a reference value from the TCP header in the transport layer (S 150).

The receiving terminal 100 processes a hash function by inputting a data value at the rear end of the TCP header (S 160).

The receiving terminal 100 compares whether or not the 128 bits of the hash value processing result and the reference value extracted from the TCP header match (S 170).

When the result value of the hash function processing and the reference value coincide with each other, the receiving terminal 100 determines that no deformation of the data has occurred and uploads the data to the application layer (S 180).

On the other hand, the receiving terminal 100 discards the received packet if the result value of the hash function processing by inputting the data value and the reference value extracted from the TCP header does not match, and retransmits the packet to the transmitting terminal 100. Request (S 190).

Although the present invention has been described in detail only with respect to the described embodiments, it will be apparent to those skilled in the art that various modifications and changes are possible within the technical spirit of the present invention, and such modifications and modifications belong to the appended claims.

As described above, according to the present invention, it is possible to verify whether the data has been modified at the receiving side receiving the data through the Internet network, thereby verifying the integrity of the data, and of course, requesting data retransmission when the data is modified. Can be.

Claims (11)

In a network including a plurality of terminals, A first terminal that divides the data generated in the application layer by segment in the transport layer, processes the divided data in a hash function, and then includes the result of the hash function in the header of the transport packet as a reference value and transmits the data to the network. ; And The reference value is extracted from the header of the packet received from the first terminal through the network, and the data value of the packet is input to compare the result of the hash process with the extracted reference value to modify the data. Network comprising a second terminal to recognize. The method of claim 1, And a header of a transport packet including a result value of the hash function processing in the first terminal as a reference value is a TCP (Transmission Control Protocol) header. The method of claim 2, The reference value is, A network included in the option field of the TCP header. The method of claim 1, wherein the reference value is, A network having 128 bits of the result of the hash function processing. The method of claim 1, wherein the second terminal, And if the result of the hash function processing does not coincide with the reference value, discards the packet and requests packet retransmission to the first terminal. The method of claim 5, wherein the second terminal, Extracting a sequence number from the TCP header of the packet and requesting retransmission of a packet corresponding to the sequence number. delete In the method of recognizing data variation of a network, Dividing data generated by a transmitting terminal into segments in a transport layer; Adding, by the transmitting terminal, a header including a result value of a function processing by inputting the divided data value as a reference value; Transmitting, by the transmitting terminal, the packet having the header added to the network; Extracting, by a receiving terminal, the reference value from a header of the packet received through the network; And And receiving, by the receiving terminal, a data value of the packet as an input, and comparing the extracted reference value with a result value, and determining the deformation of the data. The method of claim 8, wherein the data transformation recognition method comprises: The receiving terminal extracts a sequence number from the header of the packet, if the result value and the reference value does not match, and further comprising the step of requesting the transmitting terminal to retransmit the packet corresponding to the sequence number Cognitive method. The method of claim 8, wherein adding the header, And the reference value is included in an option field of a TCP header added at the transport layer and added to the data front end. The method of claim 8, wherein the reference value, And a 128-bit data transformation recognition method based on a hash function processing the data value as an input.

Images