KR20190074912A - End-to-end security communication method based on mac protocol using software defined-networking, and communication controller and computer program for the same - Google Patents

Abstract

An end-to-end security communication method includes: a step of generating a security key for end-to-end communication between first and second hosts if a communication controller receives a security key generation request packet from the first host; a step of transmitting the generated security key to the first and second hosts; and a step of setting a forwarding rule for transmitting a packet, of which destination is a MAC address of the first host or a MAC address of the second host, to first and second switches connected to the first and second hosts, respectively. According to the end-to-end security communication method, since software-defined networking is used to enable the communication controller to conduct a process of generating a security key shared between hosts, MAC security communication technology can be applied to communication between hosts belonging to different networks.

Description

TECHNICAL FIELD [0001] The present invention relates to an end-to-end secure communication method based on a MAC protocol using software defined networking, a communication controller and a computer program for the same, and a communication controller and a computer program therefor SAME}

The present invention relates to an end-to-end secure communication method based on a Media Access Control (MAC) protocol using Software Defined-Networking (SDN), a communication controller and a computer program therefor, And to enable secure communication between end terminals on the network at the MAC layer level.

MAC (Media Access Control) security communication technology, so-called MACsec, is an encryption function operating in layer 2 and is an international standard composed of communication protocols defined in IEEE 802.1AE. Existing network security technologies are often performed at layer 3, such as IP security communication technology (or IPsec). However, as traffic has increased and become more complex in recent years, there has been an increased interest in the ability to protect all traffic instead of security for specific applications or protocols. This technology is MAC security communication technology that protects the whole traffic at Layer 2.

In the conventional MAC security technology, nodes connected to the same wired network have created security keys to communicate with each other, thereby enabling secure communication only between nodes existing on the same network.

FIG. 1 is a conceptual diagram illustrating a process of transmitting a data packet between end terminals in a conventional MAC (Media Access Control) secure communication method.

Referring to FIG. 1, one host 101 is communicatively coupled to another host 102 via one or more switches 103, 104, and 105. The switches 103, 104, and 105 are open virtual switches for connecting the devices such as the hosts 101 and 102 or the network analyzer 100 to the network. At this time, in order for the hosts 101 and 102 belonging to different networks to perform MAC secure communication, the message must be encrypted and decrypted each time the transmitted message passes through each of the switches 103, 104, and 105.

That is, in the conventional MAC secure communication, a security key for secure communication between the host 101 and the switch 103, a security key for secure communication between the switch 103 and the switch 104, a switch 104 and a switch 105 And a security key for secure communication between the switch 105 and the host 102 are separately generated. When the host 101 encrypts and transmits a data packet using the secret key shared with the switch 103 by the host 101, the switches 104 and 105 except for the switch 103 check the destination of the packet It is impossible. Therefore, the switch 103 first decrypts the data, and then transmits the data packet to the switch 104 only after re-encrypting the data packet using the secret key shared by the switch 103 and the switch 104. [ This is because the purpose of the MAC security standard itself is to provide security on the same Local Area Network (LAN). Thereafter, the same decryption and re-encryption process is performed between the switch 104 and the switch 105. Finally, in the switch 105, the switch 105 uses the secret key shared with the host 102, And transmits it to the host 102.

Accordingly, in the conventional MAC security communication method, the data packet must be encrypted and decrypted four times, respectively, even in a simple topology as shown in FIG. 1. When the MAC secure communication method is applied to a larger area network, Which leads to a waste of resources.

KR 2010-0092768 A

SUMMARY OF THE INVENTION Accordingly, the present invention has been made in view of the above problems, and it is an object of the present invention to provide a method and apparatus for a communication controller to perform a process of generating a security key to be shared among hosts using Software Defined-Networking (SDN) To-end secure communication method that allows MAC (Media Access Control) secure communication technology to be applied to communication between hosts belonging to different networks.

It is another object of the present invention to provide a communication controller configured to perform the end-to-end secure communication method.

It is still another object of the present invention to provide a computer program stored in a computer-readable recording medium for executing the end-to-end secure communication method.

According to an aspect of the present invention, there is provided an end-to-end secure communication method including: a step in which a communication controller performs authentication of a first host and a second host; The communication controller receiving a secure key generation request packet including a Media Access Control (MAC) address of the first host from the second host; The communication controller transmitting the security key generation request packet to the first host; Generating a security key for end-to-end secure communication between the first host and the second host when the communication controller receives a secure key generation request packet from the first host; Transmitting the security key generated by the communication controller to the first host and the second host, respectively; And the communication controller transmits, to the first switch and the second switch respectively connected to the first host and the second host, a packet having a MAC address of the first host or a MAC address of the second host as a destination And setting a forwarding rule for the forwarding rule.

In an embodiment of the present invention, the step of performing authentication of the first host and the second host includes the steps of the communication controller performing authentication of the first host; The communication controller receiving an authentication request of the second host after authentication of the first host; And transmitting the success packet and the MAC address of the first host to the second host when the communication controller succeeds in authentication of the second host.

In an embodiment of the present invention, the end-to-end secure communication method comprises: the communication controller performing authentication of one or more third hosts; And transmitting the MAC address of the third host to the first host and the second host when the communication controller succeeds in authentication of the third host.

In the embodiment of the present invention, the step of setting the forwarding rule may be such that the communication controller transmits a packet having the MAC address of the first host as a departure point and the MAC address of the second host as a destination to the second switch And setting the forwarding rule of the first switch to directly transmit the forwarding rule.

In the embodiment of the present invention, the step of setting the forwarding rule may be such that the communication controller sends a packet having the MAC address of the second host as a source and the MAC address of the first host as a destination, to the first switch And setting a forwarding rule of the second switch to directly transmit the forwarding rule.

According to another aspect of the present invention for realizing the object of the present invention, there is provided a communication controller including an authentication unit configured to communicate with an authentication server to perform authentication of one or more hosts; A policy database storing a MAC address of a host authenticated by the authentication unit; Receiving a security key generation request packet including a MAC address of a first host from a second host, transmitting the security key generation request packet to the first host, receiving a security key generation request packet from the first host, A key generation unit configured to generate a security key for end-to-end secure communication between the first host and the second host and transmit the generated security key to the first host and the second host, respectively; And a forwarding rule for forwarding a MAC address of the first host or a MAC address of the second host to a first switch and a second switch respectively connected to the first host and the second host And a forwarding rule setting unit configured to set a forwarding rule.

In the embodiment of the present invention, the policy database includes the MAC address of the first host, and the authentication unit receives the authentication request of the second host, and when the authentication of the second host is successful, And may transmit the MAC address of the first host to the second host.

In an embodiment of the present invention, the authentication unit performs authentication of one or more third hosts, and when authentication of the third host is successful, transmits the MAC address of the third host to the first host and the second host, respectively .

In the embodiment of the present invention, the forwarding rule setting unit may set the forwarding rule of the first switch such that the forwarding rule setting unit directly transmits, to the second switch, a packet having the MAC address of the first host as a source and the MAC address of the second host as its destination You can set forwarding rules.

In the embodiment of the present invention, the forwarding rule setting unit sets the forwarding rule of the second switch such that the MAC address of the second host is used as a source and the packet having the MAC address of the first host as its destination is directly transmitted to the first switch You can set forwarding rules.

According to another aspect of the present invention, there is provided a computer program for performing authentication of a first host and a second host in combination with a communication controller. Receiving a secure key generation request packet including the MAC address of the first host from the second host; Transmitting the secure key generation request packet to the first host; Generating a security key for end-to-end secure communication between the first host and the second host when receiving a secure key generation request packet from the first host; Transmitting the generated security key to the first host and the second host, respectively; And a forwarding rule for forwarding a MAC address of the first host or a MAC address of the second host to a first switch and a second switch respectively connected to the first host and the second host , And is stored in a computer-readable recording medium.

The end-to-end secure communication method according to an aspect of the present invention can greatly expand the area of secure communication unlike the conventional MAC (Media Access Control) secure communication method. Therefore, for example, Ethernet) or internet of things (IoT) environment. In the case of automotive Ethernet equipment or IoT devices, it is difficult to apply layer 3 security techniques such as existing IP security communication technology due to performance limitations, and layer 2 security techniques must be applied. In the conventional layer 2 security measures, MAC security Since the communication technology is difficult to apply to hosts on different networks, coverage has a small limitation. At this time, by using the end-to-end secure communication method according to one aspect of the present invention, it is possible to increase the possibility of using the security technology in the automotive Ethernet or the small-scale IoT network by applying the MAC secure communication method extended to different networks have.

FIG. 1 is a conceptual diagram illustrating a process of transmitting a data packet between end terminals in a conventional MAC (Media Access Control) secure communication method.
2 is a conceptual diagram of a network topology including a communication controller for implementing an end-to-end secure communication method in accordance with an embodiment of the present invention.
3 is a block diagram of a communication controller according to an embodiment of the present invention.
4 is a flowchart illustrating each step of sharing a peer list in the end-to-end secure communication method according to an embodiment of the present invention.
FIG. 5 is a flowchart illustrating each step of a security key generation process by a communication controller in an end-to-end secure communication method according to an embodiment of the present invention.
FIG. 6 is a flowchart illustrating each step of the authentication process by the authentication server in the end-to-end secure communication method according to an embodiment of the present invention.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

2 is a conceptual diagram of a network topology including a communication controller for implementing an end-to-end secure communication method in accordance with an embodiment of the present invention.

2, a communication controller 20 in accordance with one embodiment is configured to communicate with and operate with an authentication server 30 and one or more hosts 50, 60. As shown in FIG. The hosts 50 and 60 may be a server, a workstation, a user terminal, and the like, which are intended to transmit and receive data packets through a network. Each host 50, 60 is communicatively coupled to the communication controller 20 and the authentication server 30 via corresponding switches 55, 65. The switches 55 and 65 may be open virtual switches for connecting devices such as the hosts 50 and 60 to the network. The communication controller 20 may also be communicatively coupled to the hosts 50 and 60 via one or more routers 40, such as a broadband router.

The authentication server 30 performs authentication, authorization and accounting for the user names, passwords, and privileges of the respective hosts 50 and 60 in order to realize secure communication through the network. ) Function. ≪ / RTI > For example, the authentication server 30 may include an AA framework based on a RADIUS (Remote Access Dial-In User Service) protocol, but is not limited thereto.

The communication controller 20 is configured to perform authentication of one or more hosts 50 and 60 through communication with the authentication server 30. [ The authentication process through communication with the authentication server 30 performed by the communication controller 20 may adopt the same IEEE 802.1X standard as the conventional MAC security communication standard.

The communication controller 20 also utilizes Software Defined-Networking (SDN) in the communication between the authenticated first host 50 and the second host 60, 60 are different from each other and hide the fact that they belong to different networks, and generate a security key to be shared by the hosts 50, 60 and transmit them to the hosts 50, 60. The SDN can be utilized by the communication controller 20 to apply MAC security to the end-to-end communication between the first host 50 and the second host 60. [

3 is a block diagram of the communication controller 20 shown in FIG.

3, the communication controller 20 includes an authentication unit 201, a policy database 202, a key generation unit 203, and a forwarding rule setting unit 204 in one embodiment. The communication controller 20 and each of the units 201-204 included therein according to embodiments may be entirely hardware, or may be partially hardware, and partially software. In addition, each of the units 201-204 constituting the communication controller 20 is not necessarily intended to refer to a separate device that is physically separated from each other. That is, the authentication unit 201, the policy database 202, the key generation unit 203, and the forwarding rule setting unit 204 shown in FIG. 3 perform hardware and software constituting the communication controller 20 But they are not necessarily provided independently of each other.

The authentication unit 201 is configured to perform authentication of the first host 50 and the second host 60 while communicating with the authentication server 30. [ The authentication unit 201 may also perform authentication of one or more other hosts (also referred to as a third host) not shown in the figure. The specific authentication process will be described later in detail with reference to FIG.

The policy database 202 stores MAC addresses of one or a plurality of hosts authenticated by the authentication unit 201. The MAC addresses of the authorized hosts stored in the policy database 202 may be transmitted to existing authenticated hosts in the form of a peer list if other additional hosts are authenticated by the authentication unit 201. [

The key generation unit 203 transmits a security key generation request packet for establishing a security key with a specific host (for example, the first host 50) in which the MAC address is stored in the policy database 202, The first host 50 and the second host 60 may generate a secret key for sharing by the first host 50 and the second host 60, respectively. Also, the key generation unit 203 may transmit the generated security key to the first host 50 and the second host 60, respectively.

The forwarding rule setting unit 204 sets a forwarding rule for the first host 50 and the second host 60 that share the security key with the first host 50 and the second switch 65 connected to the second host 60. The first switch 55 and the second switch 65 are connected to each other. The forwarding rule setting unit 204 generates a forwarding rule so that the data packets transmitted between the first host 50 and the second host 60 can be directly transmitted to the destination without having to pass through other nodes such as switches And transmits it to the first switch 55 and the second host 60 to generate or overwrite the forwarding rule of the first switch 55 and the second host 60. [

Hereinafter, for convenience of description, an end-to-end secure communication method according to embodiments will be described with reference to the network topology of FIG. 2 and the block diagram of the communication controller of FIG.

4 is a flowchart illustrating each step of sharing a peer list in an end-to-end secure communication method according to an embodiment of the present invention.

4, the communication controller 20 first authenticates the first host 50 (S11), and transmits the MAC address of the authenticated first host 50 to the policy database (not shown) of the communication controller 20 202 (S12). The authentication process by the communication controller 20 can be performed by communicating with the authentication server 30. The specific authentication procedure will be described later in detail with reference to FIG.

When the first host 50 is authenticated and the authentication request is received from the second host 60 that has not yet been authenticated (S13), the communication controller 20 authenticates the first host 50 The authentication of the second host 60 is performed (S14). When the authentication of the second host 60 is successful, the communication controller 20 transmits a success packet for authentication to the second host 60 while simultaneously transmitting the MAC address of the first host 50 stored in the policy database 202 (S15). The transmitted MAC address is used in the security key generation request packet when the second host 60 intends to establish a security key with the first host 50, which will be described later in detail with reference to FIG.

In one embodiment, the communication controller 20 sends a potential peer list containing the MAC address of the newly authenticated host to the existing authenticated host whenever an additional host successfully authenticates. For example, the communication controller 20 may transmit the MAC address of the second host 60 to the authenticated first host 50 first. In addition, if the authentication of the third host (not shown) is successful (S16), the communication controller 20 stores the MAC address of the third host in the policy database 202 (S17) MAC address to the first host 50 and the second host 60 (S18).

FIG. 5 is a flowchart illustrating each step of a security key generation process by a communication controller in an end-to-end secure communication method according to an embodiment of the present invention.

5, when the second host 60 receives the MAC address of the first host 50 according to the procedure described above with reference to FIG. 4, the second host 60 transmits a security key for MAC security communication with the first host 50 The second host 60 may transmit a security key generation request packet to the communication controller 20 (S21). For example, the secure key generation request packet may be an Encapsulation over LAN (EAPOL) -MKA (MACsec Key Agreement) packet defined in the IEEE 802.1X standard. At this time, since the second host 60 has the MAC address of the first host 50 received together with the authentication success packet, the MAC address of the first host 50 to which the security key is to be established, MKA packet including the information of the EAPOL-MKA 60 and transmit it to the communication controller 20.

The transmission of the secure key generation request packet from the second host 60 may be performed through the second switch 65 corresponding to the second host 60 and this may be performed by the first host 50 and / The same is true for transmission and reception of other packets transmitted and received from the host 60.

The communication controller 20, which has received the EAPOL-MKA packet requesting the security key generation from the second host 60, transmits it to the first host 50 (S22). When the first host 50 having received the secure key generation request packet agrees to establish a security key with the second host 60, the first host 50 transmits an EAPOL-MKA packet requesting the security key generation to the communication controller 20 (S23). Transmission and reception of data packets from the first host 50 may be made via the first switch 55 corresponding to the first host 50, as described above in connection with the second switch 65. [

When the EAPOL-MKA packet is received from the first host 50 (S23) after the EAPOL-MKA packet of the second host 60 is transmitted to the first host 50, The first host 50 and the second host 60 may generate a secret key for sharing (S24). The communication controller 20 stores the information and the MAC address of each of the first host 50 and the second host 60 so that the security of the MAC secure communication between the first host 50 and the second host 60 A security association key (SAK) to be operated as a key can be generated as a security key.

In one embodiment, the communication controller 20 further generates a connection association key (CAK) together with a SAK corresponding to the security key. The CAK is a master secret key for authenticating that the security key is to be authenticated by the IEEE 802.1X framework for use in a network, and is stored by the communication controller 20.

Next, the generated security key SAK is transmitted to the first host 50 and the second host 60 by the communication controller 20 (S25, S26), respectively. The first host 50 and the second host 60 encrypt the data packet using the security key received by the communication controller 20 and transmit the data packet designated as the destination to the other, Based communication can be performed.

At this time, in order for the encrypted data packet to be normally transmitted between the first host 50 and the second host 60, the first controller 50 and the second host 60 A forwarding rule is set for the first switch 55 and the second switch 65, which are connected to each other (S27, S28). The forwarding rule is such that a data packet encrypted and transmitted based on the security key shared by the first host 50 and the second host 60 is transmitted directly between the first host 50 and the second host 60, To exclude additional encryption or decryption processes for communication with the nodes.

Specifically, the communication controller 20 directly transmits the packet having the MAC address of the first host 50 as a source and the MAC address of the second host 60 as a destination to the second switch 65, The forwarding rule of the first switch 55 can be set. Similarly, the communication controller 20 controls the second switch 60 to forward the packet having the MAC address of the second host 60 as a source and the MAC address of the first host 50 as a destination to the first switch 55 65 can be set.

Accordingly, unlike the conventional MAC secure communication, there is no need to encrypt and decrypt data packets by additional nodes in transmitting packets based on the MAC address between the first host 50 and the second host 60 .

FIG. 6 is a flowchart illustrating each step of the authentication process by the authentication server in the end-to-end secure communication method according to an embodiment of the present invention.

Referring to FIG. 6, the communication controller 20 can identify the first host 50 that can communicate with the communication controller 20 (S31). The identification process may be performed through the response of the first host 50 to the identification request of the communication controller 20, and the identification request and the response may include an EAPOL-Extensible Authentication Protocol (EAP) -based data packet.

A handshake process for establishing communication parameters between the authentication server 30 and the first host 50 is performed through the communication protocol 20 after the identification and the first host 50 sends a handshake message to the authentication server 30 (S32). ≪ / RTI > The authentication request may include an EAP protocol-based packet.

The authentication server 30 having received the authentication request can transmit the server information of the authentication server 30 and the server key to the first host 50 in the form of an EAPOL-EAP data packet (S33). If it is determined that the server information and the server key are valid after verifying the validity of the server information and the key, the first host 50 receives the information of the first host 50 and the client key (34) in the form of an EAPOL-EAP data packet. The EAPOL-EAP data packet transmitted at this time may include change information for a cipher spec.

Next, the first host 50 and the authentication server 30 achieve Transport Layer Security (TLS) based on the encryption specification change information and the like and transmit the TLS to the first host 50 and the authentication server 30, Lt; RTI ID = 0.0 > (S35). ≪ / RTI >

After the encryption channel is created, the first host 50 may store the master session key (MSK) received through the encryption channel (S36). Further, the first host 50 may transmit an authentication response to the authentication server 30 (S37). The authentication response may include an EAP-PEAP (Protected Extensible Authentication Protocol) -based data packet as defined in the EAPOL-EAP protocol.

When the authentication server 30 receives the authentication response, it can transmit a success packet for authentication to the communication controller 20 (S38). The communication controller 20 stores the MSK received from the authentication server 30 in the policy database 202 of the communication controller 20 and transmits a success packet indicating successful authentication to the first host 50 (S40) . At this time, as described above, the communication controller 20 may transmit the peer list including MAC addresses of other hosts that can communicate on the network to the first host 50 together with the success packets for MAC secure communication using the SDK have.

Although the authentication procedure for the first host 50 has been described with reference to FIG. 6 for the sake of convenience, the same authentication procedure may be equally applied to the authentication process of the second host 60 or one or more additional hosts Point will be readily appreciated by those of ordinary skill in the art.

Such an end-to-end secure communication method may be implemented in an application or may be implemented in the form of program instructions that may be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination.

The program instructions recorded on the computer-readable recording medium may be ones that are specially designed and configured for the present invention and are known and available to those skilled in the art of computer software.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims. You will understand.

100: Network Analyzer
101, 102, 50, 60: Host
103, 104, 105, 55, 65: switch
20: Communication controller
201: Authentication section
202: Policy database
203:
204: forwarding rule generation unit
30: Authentication server
40: Router

Claims (11)

The communication controller performing authentication of the first host and the second host;
The communication controller receiving a secure key generation request packet including the MAC address of the first host from the second host;
The communication controller transmitting the security key generation request packet to the first host;
Generating a security key for end-to-end secure communication between the first host and the second host when the communication controller receives a secure key generation request packet from the first host;
Transmitting the security key generated by the communication controller to the first host and the second host, respectively; And
Wherein the communication controller has a first switch and a second switch respectively connected to the first host and the second host for transmitting a MAC address of the first host or a packet having a MAC address of the second host as a destination And establishing a forwarding rule for the end-to-end secure communication.
The method according to claim 1,
Wherein performing authentication of the first host and the second host comprises:
The communication controller performing authentication of the first host;
The communication controller receiving an authentication request of the second host after authentication of the first host; And
And if the communication controller succeeds in authenticating the second host, sending a success packet and a MAC address of the first host to the second host.
The method according to claim 1,
The communication controller performing authentication of one or more third hosts; And
Further comprising the step of the communication controller transmitting the MAC address of the third host to the first host and the second host, respectively, when authentication of the third host is successful.
The method according to claim 1,
Wherein the setting of the forwarding rule is performed by the communication controller such that the communication controller directly transmits a packet having the MAC address of the first host as a departure point and the MAC address of the second host as a destination to the second switch, And establishing a forwarding rule of the end-to-end secure communication.
The method according to claim 1,
Wherein the setting of the forwarding rule is performed by the communication controller such that the communication controller directly transmits a packet having the MAC address of the second host as a departure point and the MAC address of the first host as a destination to the first switch, And establishing a forwarding rule of the end-to-end secure communication.
An authentication unit configured to communicate with an authentication server and perform authentication of one or more hosts;
A policy database storing a MAC address of a host authenticated by the authentication unit;
Receiving a security key generation request packet including a MAC address of a first host from a second host, transmitting the security key generation request packet to the first host, receiving a security key generation request packet from the first host, A key generation unit configured to generate a security key for end-to-end secure communication between the first host and the second host and transmit the generated security key to the first host and the second host, respectively; And
A forwarding rule for forwarding a packet having a MAC address of the first host or a MAC address of the second host as a destination is set in the first switch and the second switch respectively connected to the first host and the second host And a forwarding rule setting unit configured.
The method according to claim 6,
Wherein the policy database includes a MAC address of the first host,
Wherein the authentication unit is further configured to receive an authentication request of the second host, and send a success packet and a MAC address of the first host to the second host when authentication of the second host is successful.
The method according to claim 6,
Wherein the authentication unit is further configured to perform authentication of one or more third hosts and to transmit the MAC address of the third host to the first host and the second host respectively upon authentication of the third host.
The method according to claim 6,
Wherein the forwarding rule setting unit sets a forwarding rule of the first switch to directly forward a packet having the MAC address of the first host as a source and the MAC address of the second host as a destination to the second switch, .
The method according to claim 6,
Wherein the forwarding rule setting unit sets a forwarding rule of the second switch so that a packet having the MAC address of the second host as a source and the MAC address of the first host as a destination is directly transmitted to the first switch, .
Combined with the communication controller,
Performing authentication of the first host and the second host;
Receiving a secure key generation request packet including the MAC address of the first host from the second host;
Transmitting the secure key generation request packet to the first host;
Generating a security key for end-to-end secure communication between the first host and the second host when receiving a secure key generation request packet from the first host;
Transmitting the generated security key to the first host and the second host, respectively; And
A forwarding rule for forwarding a MAC address of the first host or a MAC address of the second host to a first switch and a second switch respectively connected to the first host and the second host is set A computer program stored in a computer-readable medium for executing steps.

Images