Patent ID: 8336093

Claim:
An abnormal Internet Protocol Security (IPSec) packet control system using IPSec configuration data and IPSec session data for controlling traffic in IPSec communication, the system comprising: an extended header processing unit that receives an IPSec packet, classifies the IPSec packet into an extended header portion in which an IPSec communication packet is sorted out and a network layer header portion in which an IPSec configuration packet is sorted out by identifying the IPSec communication packet if the extended header portion is encrypted by an Encapsulating Security Payload (ESP), and if not, then identifying the IPSec configuration packet, and extracts the IPSec configuration data and the IPSec session data to be used in traffic control; a first check unit for checking at least source/destination address data and communication mode data of the IPSec configuration packet and blocking an abnormal packet, the first check unit including an IPSec configuration DB that manages the IPSec configuration data, receives the IPSec configuration data extracted from the IPSec configuration packet, and compares the IPSec configuration data with data stored in the IPSec configuration DB to thereby determine whether or not the IPSec packet has passed; a second check unit for checking at least the source/destination address data and security data of the IPSec communication packet and blocking abnormal traffic, the second check unit including an IPSec session DB that manages the IPSec session data, receives the IPSec session data extracted from the IPSec communication packet, and compares the IPSec session data with data stored in the IPSec session DB to thereby determine whether or not the IPSec packet has passed; and a control unit that can pass or block the IPSec packet depending upon check results from the first and second check units for checking the IPSec configuration packet and the IPSec communication packet.