IPSec Overhead in Wireline and Wireless Networks
|
|
|
- Carmella Rice
- 7 years ago
- Views:
Transcription
1 IPSec Overhead in Wireline and Wireless Networks Hafeth Hourani 1 /Title/ T Postgraduate Course in Theoretical Computer Science
2 IPSec Overview and Architecture Contents Thesis Under Study IPSec Overhead in Wireline and Wireless Networks Other Studies and Researches Performance Evaluation of Data Transmission Using IPSec/IPv6 Evaluation of IPSec-based Wireline VPN Evaluation of IPSec-based Wireless VPN Wireline vs. Wireless VPN IPSec Performance Overall Conclusions Appendices References 2 /Title/ hafeth.hourani@nokia.com
3 Developed by IETF IPSec Overview IPSec can be used for Authentication Make sure that the packets are from the indicated user Confidentiality Protect the payload content Data Integrity Protect the IP packet against accidental or deliberate modifications Anti-Reply & Access Control Prevent reply attacks Network layer security IP packet level authentication/encryption (IP datagram protection) No need for application layer security solutions (TLS, SSL, HTTPS,..) IPSec is not a protocol, it is a security solution IPSec Suite 3 /Title/ hafeth.hourani@nokia.com
4 IPSec Architecture IPSec Architecture AH ESP Security Policy Authentication Algorithm Key Management Encryption Algorithm Domain of interoperation 4 /Title/ hafeth.hourani@nokia.com
5 IPSec implementation Transport Mode Protects the IP payload For end-to-end security Tunnel Mode IPSec Modes Protects the whole IP packet (header + payload) Used when the destination is not the end-point Considering the AH and ESP, four different combinations can exist: AH Transport Mode ESP Transport Mode AH Tunnel Mode ESP Tunnel Mode 5 /Title/ hafeth.hourani@nokia.com
6 6 /Title/ Thesis Under Discussion
7 About the Thesis Title: IPSec Overhead in Wireline and Wireless Networks for Web and Applications By George C. Hadjichristofi In Faculty of Virginia Polytechnic Institute Date 2001 URL 7 /Title/ hafeth.hourani@nokia.com
8 The research focused on: Research Goals The IPSec overhead introduced by using different combinations of IPSec policies and configurations ESP encryption and authentication vs. ESP encryption and AH authentication ESP authentication vs. AH authentication The overhead introduced by different authentication algorithms HMAC-MD5 vs. HMAC-SHA1 The network load overhead Compressed vs. Uncompressed files HTTP vs. SMTP protocol security overhead The IPSec overhead in Wireline vs. Wireless networks 8 /Title/ hafeth.hourani@nokia.com
9 File Edit Loc ate View H elp Network Traffic E D C B A Mount % / Help % /us File Edit Loc ate View H elp Network Traffic E D C B A Mount % / Help % /us Research Methodology: Configuration 1 Wireline testbed configuration 10 Mbps Ethernet LAN Server: Intel Celeron, 566 MHz, 128 MB Client: Pentium Pro, 200 MHz, 32 MB OS: RedHat Linux 7.0, kernel FreeS/WAN IPSec client sniffer server Wireless testbed configuration 10 Mbps Ethernet LAN 2 Mbps IEEE WLAN Wireless node: Pentium III, 1 GHz, 512 MB hub sniffer IPSec tunnel client Access point server hub IPSec tunnel 9 /Title/ hafeth.hourani@nokia.com
10 File E dit Locate View Help Network Traffic E D C B A Mount % / Help % /us File E dit Locate View Help Network Traffic E D C B A Mount % / Help % /us Research Methodology: Configuration 2 Wireline testbed configuration sniffer Wireless node client server hub Wireless testbed configuration hub IPSec tunnel sniffer Wireless node Access point client server hub hub IPSec tunnel 10 /Title/ hafeth.hourani@nokia.com
11 Research Methodology: Test Scenarios Seven test scenarios were performed Combination of Authentication & Encryption with different algorithms Different file sizes Two protocols (HTTP & SMTP) 1) [null]-[null] 2) [AH-MD5]-[null] 3) [AH-SHA-1][null] 4) [ESP-MD5]-[ESP-3DES] 5) [ESP-SHA-1][ESP-3DES] 6) [AH-MD5][ESP-3DES] 7) [AH-SHA-1][ESP-3DES] 1 KB 10 KB 100 KB 1 MB 10 MB HTTP SMTP 11 /Title/ hafeth.hourani@nokia.com
12 Number of Transactions From Server to Client (S2C) From Client to Server (C2S) Recorded Metrics Network Load => Throughput (bytes/sec) From Server to Client (S2C) From Client to Server (C2S) Transfer Time The time needed to transfer a file from the server to the client 12 /Title/ hafeth.hourani@nokia.com
13 1) Number of Transactions: Results Total number of transactions Increases as we go from [null][null] to [AH-SHA-1][ESP-3DES] But not for small files (1 KB & 10 KB)... Only for large files (100 KB, 1 MB, 10 MB) Same trend with SMTP 13 /Title/ hafeth.hourani@nokia.com
14 1) Number of Transactions: Analysis Facts: The Server is faster than the Client Connection-oriented scenarios Large files saturates the TCP buffers more than the small files The client needed to slow down the server continuously More control messages have been generated => More transactions when sending large files 14 /Title/
15 2) Network Load : Results Network Load Network gets loaded more and more as we go from [null]-[null] to [AH-SHA-1][ESP- 3DES] Smaller files loads the network more than the bigger ones... Same trend with SMTP 15 /Title/ hafeth.hourani@nokia.com
16 2) Network Load : Analysis The Client is slower than the Server More control messages are needed Network get loaded Larger number of ACKs are needed to control the traffic flow for small files 16 /Title/ hafeth.hourani@nokia.com
17 3) Transfer Time: Results Transfer Time 17 /Title/
18 3) Transfer Time: Analysis Again... The Client is slower than the Server and The transfer time increases because of the needed control message to control the data flow /Title/
19 Almost same as wireline results Wireless Case 19 /Title/
20 Thesis Conclusions [AH authentication & ESP encryption] results in a higher network load compared to [ESP authentication & ESP encryption] Network Load and Number of Transactions were the same for both the wireless and wireline environments In the wireless environment, the Transfer Time increases due to the additional overhead of the wireless link 20 /Title/ hafeth.hourani@nokia.com
21 Thesis Critic (1/2) Quite Vague metrics Number of transactions What does this include? What is the transaction size? Network Load C2S vs. S2C Throughput should have been used instead of vague Network load... Transfer Time Most of the results can not be generalized Many un-identified HW and SW bottlenecks The MTU and its effect in the results was not studied quite well /Title/
22 Thesis Critic (2/2) The wireless transmission was not clear... No IPv6 consideration What about UDP... Personal Opinion: bad written thesis /Title/
23 Other Studies and Results This section is based on some literature research 23 /Title/
24 Performance Evaluation of Data Transmission Using IPSec over IPv6 Networks Ref[3] 24 /Title/
25 Overview and Test Configuration Evaluation system Host: Intel Pentium III 450 MHz, 128 MB OS: FreeBSD Router Inter Pentium III 500 MHz, 256 MB OS: FreeBSD 2.28 The end-to-end throughput is evaluated in the following cases: Without IPSec Only with AH Only with ESP (3DES) With both AH and ESP TCP & UDP / IPv4 & IPv6 Test types Stream data For 60 minutes streaming- Request/Response Ping message Fast Ethernet 25 /Title/ hafeth.hourani@nokia.com
26 Stream Data: TCP/IPSec Results MTU = 4 KB TCP socket buffers TCP_STREAM1 = 57,344 Bytes TCP_STREAM2 = 32,769 Bytes IPv4 End-to-End throughput With AH TP degrades ~ ½ With ESP TP degrades ~ ¼ Both AH & ESP TP degrades ~ < ¼ IPv6 26 /Title/ hafeth.hourani@nokia.com
27 Stream Data: UDP/IPSec Results UDP socket buffer size = 32,768 bytes MTU UDP_STREAM1 = 4,096 bytes UDP_STREAM2 = 1,024 bytes IPv4 End-to-End throughput With AH TP degrades ~ 1/3 With ESP TP degrades ~ 1/9 Both AH & ESP TP degrades ~ < 1/9 When MTU is larger, the TP is better IPv6 27 /Title/ hafeth.hourani@nokia.com
28 Request/Response : TCP & UDP Results Request/Response TCP_RR Request message = 1 byte Response message = 1 byte UDP_RR.1 Request message = 1 byte Response message = 1 byte UDP_RR.2 Request message = 512 bytes Response message = 4 bytes End-to-End throughput ESP TP > AH TCP_RR & UDP_RR.1 IPv4 IPv6 28 /Title/ hafeth.hourani@nokia.com
29 Results Analysis: Stream Data TCP vs. UDP Without IPSec: TCP throughput is less than UDP throughput With IPSec: TCP throughput UDP throughput => The IPSec processing is much larger than both TCP and UDP The IPSec overhead dominates the difference between TCP and UDP AH vs. ESP AH throughput twice ESP throughput In stream data, the packet size is larger than the header length (basic IP + AH) The required processing for ESP is far larger than that for AH ESP vs. (AH/ESP) The processing of ESP dominates that of AH MTU Larger MTU less throughput 29 /Title/ hafeth.hourani@nokia.com
30 Result Analysis: Request/Response Stream Data vs. Request/Response By applying IPSec; The throughput degradation with Request/Response data is less than Stream data The processing overhead of Request messages is far less than that of stream data 30 /Title/
31 Evaluation of IPSec-based Wireline VPN Ref[4] 31 /Title/
32 Test Bed Configuration Test setup Security tunnel is built using two VPN Routers SAMSUNG S3C4510, vlinux kernel Client Pentium III, 850 MHz, Windows 2000 Server Pentium III, 850 MHz, Windows 2000 Two application protocols where evaluated FTP HTTP VPN Router VPN Router Client IPSec tunnel Server 32 /Title/
33 Results 800 FTP HTTP 1 MB 10 MB throughput (Kbps) MB 10 MB 100 MB throughput (Kbps) MB none AH- MD5 AH- SHA-1 ESP- Null- MD5 ESP- Null- SHA-1 ESP- DES- Null ESP- 3DES- Null ESP- DES- MD5 ESP- DES- SHA-1 ESP- 3DES- MD5 ESP- 3DES- SHA none AH- MD5 AH- SHA-1 ESP- Null- MD5 ESP- Null- SHA-1 ESP- DES- Null ESP- 3DES- Null ESP- DES- MD5 ESP- DES- SHA-1 ESP- 3DES- MD5 ESP- 3DES- SHA-1 33 /Title/ hafeth.hourani@nokia.com
34 Analysis Largest throughput degradation comes with [ESP-3DES-SHA-1] ~ 90 % compared to the [null] IPSec throughput is almost the same for both FTP and HTTP The end-to-end throughput will not be affected by the upper layer protocols In other words... The data type and payload will not have any influence in IPSec throughput 34 /Title/ hafeth.hourani@nokia.com
35 Evaluation of IPSec-based Wireless VPN Ref[5] 35 /Title/
36 36 /Title/ Test Bed Configuration Test setup Clients Intel PC, RedHat Linux 6.2, kernel Mobile Nodes Apple 4G computers, OS9 IPSec Gateway Pentium 1, 32 MB, FreeS/WAN 1.5 Base Stations : IEEE Wireless LAN Base station (hugs) : ~5 meters away from the mobile nodes Base station (kisses): ~25 meters away from the mobile nodes => The signal strength of kisses is 150% higher than that of hugs client client client IPSec Gateway LAN BS: hugs BS: kisses Mobile node Mobile node
37 Results (1/2) Throughput The UDP throughput of kisses and hugs is about the same The gap increases for larger packet sizes Packet Loss The signal from hugs is weaker than kisses When the packet size increase, the loss rate increases as well With IPSec [ESP-?] 37 /Title/
38 Results (2/2) TCP throughput without IPSec is about 3 times that with IPSec When packet size increased from 1 KB to 1.5 KB TCP TP increased for the connection via kisses TCP TP decreased for the connection via hugs => For different signal strength, TCP has different optimal => strong signal strength supports larger optimal packet size With IPSec [ESP-?] 38 /Title/ hafeth.hourani@nokia.com
39 Analysis UDP UDP Packet loss favors small packet sizes UDP throughout favors strong signals and large packet size TCP There exist an optimal packet size for highest throughput 39 /Title/
40 Wireline vs. Wireless VPN IPSec performance Ref[6] 40 /Title/
41 Test Bed Configuration Client Windows 2000, 11 Mbps wireless connection Server Windows 2000, 100 Mbps wireless connection 41 /Title/
42 Test Results For wired connection ~ 4.5% throughput degradation for TCP ~ 8.5% throughput degradation for UDP For wireless connection ~ 7% throughput degradation for TCP ~ 20% throughput degradation for UDP throughput (MBps) TCP UDP 0 42 /Title/ hafeth.hourani@nokia.com non-encrypted wired encrypted wired non-encrypted wireless encrypted wireless
43 43 /Title/ Overall Conclusions
44 Conclusions (1/2) Without IPSec, TCP throughput is less than that of UDP (with no IPSec) With IPSec, the gap between TCP and UDP throughputs vanishes IPSec processing overhead is dominant to TCP and UDP overheads IPSec/IPv4 exhibits the same throughput as IPSec/IPv6 For streaming data, the AH throughput is almost twice that of ESP The overhead of ESP is larger than that of AH For the streaming data; larger MTU results in less throughput By applying IPSec, the throughput degradation with Request/Response data is less than streaming data The processing overhead of the Request/Response messages is far less than that of streaming data 44 /Title/
45 Conclusions (2/2) The [ESP-3DES-SHA-] causes the largest throughput degradation amongst other IPSec scenarios The IPSec throughout is independent than upper layer protocols In wireless environment, there exist an optimal TCP packet size for the highest throughput as a function of wireless signal strength In wireless environment, the UDP throughput degradation is higher than that of TCP 45 /Title/ hafeth.hourani@nokia.com
46 46 /Title/ Appendices
47 IPSec Extension Headers: ESP Encapsulation Security Protocol Provides confidentiality Security Parameter Index (SPI) Sequence Number Initialization Vector + Protected Data (variable) Padding Pad length Authentication Data Next Header Transport Mode ESP Original IP header TCP/UDP Data Original IP header ESP header TCP/UDP Data ESP trailer ESP Authentication Tunnel Mode ESP Encrypted Authenticated New IP header 47 /Title/ hafeth.hourani@nokia.com ESP header Original IP header TCP/UDP Data ESP trailer ESP Authentication Encrypted Authenticated Back Back
48 IPSec Extension Headers: AH Authentication Header Provides the services of authentication and data integrity Next Header Payload length Reserved Security Parameter Index (SPI) Sequence number Authentication data Original IP header TCP/UDP Data Transport Mode AH Original IP header AH TCP/UDP Data Authenticated Tunnel Mode AH New IP header AH Original IP header TCP/UDP Data Authenticated 48 /Title/ Back Back
49 Authentication & Encryption Algorithms Authentication Algorithms MAC Used by the two parties to validate the exchanged messages MD5 An algorithm that takes as input a message of any length, and produces as an output a 128-bits message digest of the input SHA-1 An algorithm that takes as input a message of any length, and produces as an output a 160-bits authenticator value Encryption Algorithms DES A symmetric key encryption method. It uses 56-bit key and them breaks the message into 64-bits blocks and encrypts them 3DES Triple-DES. Three keys are involved in the operation 49 /Title/ hafeth.hourani@nokia.com Back Back
50 IPSec Management Key Management IKE (Internet Key Exchange) Protocol used to negotiate the cryptographic keys used by IPSec Security Policy AS (Security Association) A contract between two IPSec peers. It defines the security services that will be used SAD (Security Association Database) A database containing all SA s that are currently established SPD (Security Policy Database) Contains the defined security policies to be enforced for any SA Domain of Interoperations Parameters used and negotiated by different peers 50 /Title/ hafeth.hourani@nokia.com Back Back
51 Abbreviations 3DES Triple-DES AH Authenticated Header DES Data Encryption Standard ESP Encapsulated Security Protocol HMAC keyed-hashing Message Authentication Code HTTP HyperText Transfer Protocol ICV Integrity Check Value IKE Internet Key Exchange ISAKMP Internet Security Association and Key Management Protocol MAC Message Authentication Code MD5 Message Digest 5 MTU Maximum Transfer Unit SHA Secured Hash Algorithm SMTP Simpel Message Transfer Protocol VPN Virtual Private Network 51 /Title/ hafeth.hourani@nokia.com
52 References [1] George C. Hadjichristofi, MSc. thesis, IPSec Overhead in Wireline and Wireless Networks for Web and Applications [2] Hadjichristofi, G.C.; Davis, N.J., IV; Midkiff, S.F.; IPSec Overhead in Wireline and Wireless Networks for Web and Applications, Performance, Computing, and Communications Conference, Conference Proceedings of the 2003 IEEE International, 9-11 April 2003 Pages: [3] S. Ariga, et. al, Performance Evaluation of Data Transmission Using IPSec over IPv6 Networks, URL: [4] Jin-Cherng Lin; Ching-Tien Chang; Wei-Tao Chung; Design, implementation and performance evaluation of IP-VPN, Advanced Information Networking and Applications, AINA th International Conference on, March 2003 Pages: [5] Wei Qu; Srinivas, S.; IPSec-based secure wireless virtual private network ; MILCOM Proceedings, Volume: 2, 7-10 Oct. 2002,Pages: vol.2 [6] Jeff Custard; Wireless VPN Performance Tests ; URL: [7] Alain Jourez; An IPsec Primer, URL: /Title/ hafeth.hourani@nokia.com
53 53 /Title/ Thank You!
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
Protocol Security Where?
IPsec: AH and ESP 1 Protocol Security Where? Application layer: (+) easy access to user credentials, extend without waiting for OS vendor, understand data; (-) design again and again; e.g., PGP, ssh, Kerberos
Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity
Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration
Securing IP Networks with Implementation of IPv6
Securing IP Networks with Implementation of IPv6 R.M.Agarwal DDG(SA), TEC Security Threats in IP Networks Packet sniffing IP Spoofing Connection Hijacking Denial of Service (DoS) Attacks Man in the Middle
Introduction to Security and PIX Firewall
Introduction to Security and PIX Firewall Agenda Dag 28 Föreläsning LAB PIX Firewall VPN A Virtual Private Network (VPN) is a service offering secure, reliable connectivity over a shared, public network
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
An Experimental Study of Cross-Layer Security Protocols in Public Access Wireless Networks
An Experimental Study of Cross-Layer Security Protocols in Public Access Wireless Networks Avesh K. Agarwal Wenye Wang Department of Electrical and Computer Engineering North Carolina State University,
Lecture 17 - Network Security
Lecture 17 - Network Security CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Idea Why donʼt we just integrate some of these neat
An Experimental Study on Wireless Security Protocols over Mobile IP Networks
An Experimental Study on Wireless Security Protocols over Mobile IP Networks Avesh K. Agarwal Department of Computer Science Email: akagarwa@unity.ncsu.edu Jorinjit S. Gill Department of Electrical and
APNIC elearning: IPSec Basics. Contact: training@apnic.net. esec03_v1.0
APNIC elearning: IPSec Basics Contact: training@apnic.net esec03_v1.0 Overview Virtual Private Networks What is IPsec? Benefits of IPsec Tunnel and Transport Mode IPsec Architecture Security Associations
Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku
Univerzita Komenského v Bratislave Fakulta matematiky, fyziky a informatiky Príprava štúdia matematiky a informatiky na FMFI UK v anglickom jazyku ITMS: 26140230008 dopytovo orientovaný projekt Moderné
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance Johnnie Chen Project Manager of Network Security Group Network Benchmarking Lab Network Benchmarking Laboratory
Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide
![Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide](/thumbs/24/4351346.jpg "Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide")
Network Security [2] Public Key Encryption Also used in message authentication & key distribution Based on mathematical algorithms, not only on operations over bit patterns (as conventional) => much overhead
21.4 Network Address Translation (NAT) 21.4.1 NAT concept
21.4 Network Address Translation (NAT) This section explains Network Address Translation (NAT). NAT is also known as IP masquerading. It provides a mapping between internal IP addresses and officially
INF3510 Information Security University of Oslo Spring 2011. Lecture 9 Communication Security. Audun Jøsang
INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture
Security Engineering Part III Network Security. Security Protocols (II): IPsec
Security Engineering Part III Network Security Security Protocols (II): IPsec Juan E. Tapiador jestevez@inf.uc3m.es Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
CSCI 454/554 Computer and Network Security. Topic 8.1 IPsec
CSCI 454/554 Computer and Network Security Topic 8.1 IPsec Outline IPsec Objectives IPsec architecture & concepts IPsec authentication header IPsec encapsulating security payload 2 IPsec Objectives Why
Chapter 9. IP Secure
Chapter 9 IP Secure 1 Network architecture is usually explained as a stack of different layers. Figure 1 explains the OSI (Open System Interconnect) model stack and IP (Internet Protocol) model stack.
CS 356 Lecture 27 Internet Security Protocols. Spring 2013
CS 356 Lecture 27 Internet Security Protocols Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 roadmap 1 What is network security? 2 Principles of cryptography 3 Message integrity, authentication
Laboratory Exercises V: IP Security Protocol (IPSec)
Department of Electronics Faculty of Electrical Engineering, Mechanical Engineering and Naval Architecture (FESB) University of Split, Croatia Laboratory Exercises V: IP Security Protocol (IPSec) Keywords:
IP Security. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49
IP Security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Internetworking and Internet Protocols (Appendix 6A) IP Security Overview IP Security
Chapter 32 Internet Security
Chapter 32 Internet Security Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. Chapter 32: Outline 32.1 NETWORK-LAYER SECURITY 32.2 TRANSPORT-LAYER SECURITY 32.3
Ethernet. Ethernet. Network Devices
Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) 13.2 Layer 2/3/4 VPNs 13.3 Multi-Protocol Label Switching 13.4 IPsec Transport Mode
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) PPP-based remote access using dial-in PPP encryption control protocol (ECP) PPP extensible authentication protocol (EAP) 13.2 Layer 2/3/4
Building scalable IPSec infrastructure with MikroTik. IPSec, L2TP/IPSec, OSPF
Building scalable IPSec infrastructure with MikroTik IPSec, L2TP/IPSec, OSPF Presenter information Tomas Kirnak Network design Security, wireless Servers Virtualization MikroTik Certified Trainer Atris,
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Chapter 4 Virtual Private Networking
Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications between
IP SECURITY (IPSEC) PROTOCOLS
29 IP SECURITY (IPSEC) PROTOCOLS One of the weaknesses of the original Internet Protocol (IP) is that it lacks any sort of general-purpose mechanism for ensuring the authenticity and privacy of data as
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
Quantifying the Performance Degradation of IPv6 for TCP in Windows and Linux Networking
Quantifying the Performance Degradation of IPv6 for TCP in Windows and Linux Networking Burjiz Soorty School of Computing and Mathematical Sciences Auckland University of Technology Auckland, New Zealand
Outline. INF3510 Information Security. Lecture 10: Communications Security. Communication Security Analogy. Network Security Concepts
Outline INF3510 Information Security Lecture 10: Communications Security Network security concepts Communication security Perimeter security Protocol architecture and security services Example security
Lecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Audun Jøsang University of Oslo Spring 2015 Outline Network security concepts Communication security Perimeter security Protocol architecture
Network Security. Lecture 3
Network Security Lecture 3 Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Security protocols application transport network datalink physical Contents IPSec overview
Internet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
MPLS VPN in Cellular Mobile IPv6 Architectures(04##017)
MPLS VPN in Cellular Mobile IPv6 Architectures(04##017) Yao-Chung Chang, Han-Chieh Chao, K.M. Liu and T. G. Tsuei* Department of Electrical Engineering, National Dong Hwa University Hualien, Taiwan, Republic
Remote Access VPNs Performance Comparison between Windows Server 2003 and Fedora Core 6
Remote Access VPNs Performance Comparison between Windows Server 2003 and Fedora Core 6 Ahmed A. Joha, Fathi Ben Shatwan, Majdi Ashibani The Higher Institute of Industry Misurata, Libya goha_99@yahoo.com
VPN. VPN For BIPAC 741/743GE
VPN For BIPAC 741/743GE August, 2003 1 The router supports VPN to establish secure, end-to-end private network connections over a public networking infrastructure. There are two types of VPN connections,
Chapter 10. Network Security
Chapter 10 Network Security 10.1. Chapter 10: Outline 10.1 INTRODUCTION 10.2 CONFIDENTIALITY 10.3 OTHER ASPECTS OF SECURITY 10.4 INTERNET SECURITY 10.5 FIREWALLS 10.2 Chapter 10: Objective We introduce
Internet Protocol Security IPSec
Internet Protocol Security IPSec Summer Semester 2011 Integrated Communication Systems Group Ilmenau University of Technology Outline Introduction Authentication Header (AH) Encapsulating Security Payload
Virtual Private Networks: IPSec vs. SSL
Virtual Private Networks: IPSec vs. SSL IPSec SSL Michael Daye Jr. Instructor: Dr. Lunsford ICTN 4040-001 April 16 th 2007 Virtual Private Networks: IPSec vs. SSL In today s society organizations and companies
The BANDIT Products in Virtual Private Networks
encor! enetworks TM Version A.1, March 2010 2010 Encore Networks, Inc. All rights reserved. The BANDIT Products in Virtual Private Networks One of the principal features of the BANDIT products is their
CS 4803 Computer and Network Security
Network layers CS 4803 Computer and Network Security Application Transport Network Lower level Alexandra (Sasha) Boldyreva IPsec 1 2 Roughly Application layer: the communicating processes themselves and
CCNA Security 1.1 Instructional Resource
CCNA Security 1.1 Instructional Resource Chapter 8 Implementing Virtual Private Networks 2012 Cisco and/or its affiliates. All rights reserved. 1 Describe the purpose and types of VPNs and define where
Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300
Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300 This example explains how to configure pre-shared key based simple IPSec tunnel between NetScreen Remote Client and RN300 VPN Gateway.
Chapter 5. Data Communication And Internet Technology
Chapter 5 Data Communication And Internet Technology Purpose Understand the fundamental networking concepts Agenda Network Concepts Communication Protocol TCP/IP-OSI Architecture Network Types LAN WAN
IPv6 Security: How is the Client Secured?
IPv6 Security: How is the Client Secured? Jeffrey L Carrell Network Conversions Network Security Consultant 1 IPv6 Security: How is the Client Secured? IPv6/IPsec IPsec Challenges IPsec Monitoring/Management
Implementing and Managing Security for Network Communications
3 Implementing and Managing Security for Network Communications............................................... Terms you ll need to understand: Internet Protocol Security (IPSec) Authentication Authentication
High Performance VPN Solutions Over Satellite Networks
High Performance VPN Solutions Over Satellite Networks Enhanced Packet Handling Both Accelerates And Encrypts High-Delay Satellite Circuits Characteristics of Satellite Networks? Satellite Networks have
Branch Office VPN Tunnels and Mobile VPN
WatchGuard Certified Training Branch Office VPN Tunnels and Mobile VPN Fireware XTM and WatchGuard System Manager v11.7 Revised: January 2013 Updated for: Fireware XTM v11.7 Notice to Users Information
EITF25 Internet Techniques and Applications L5: Wide Area Networks (WAN) Stefan Höst
EITF25 Internet Techniques and Applications L5: Wide Area Networks (WAN) Stefan Höst Data communication in reality In reality, the source and destination hosts are very seldom on the same network, for
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Communication Security for Applications
Communication Security for Applications Antonio Carzaniga Faculty of Informatics University of Lugano March 10, 2008 c 2008 Antonio Carzaniga 1 Intro to distributed computing: -server computing Transport-layer
IPsec Details 1 / 43. IPsec Details
Header (AH) AH Layout Other AH Fields Mutable Parts of the IP Header What is an SPI? What s an SA? Encapsulating Security Payload (ESP) ESP Layout Padding Using ESP IPsec and Firewalls IPsec and the DNS
IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers
IPsec VPN Security between Aruba Remote Access Points and Mobility Controllers Application Note Revision 1.0 10 February 2011 Copyright 2011. Aruba Networks, Inc. All rights reserved. IPsec VPN Security
Using IPSec in Windows 2000 and XP, Part 2
Page 1 of 8 Using IPSec in Windows 2000 and XP, Part 2 Chris Weber 2001-12-20 This is the second part of a three-part series devoted to discussing the technical details of using Internet Protocol Security
How To Analyze The Security On An Ipa Wireless Sensor Network
Throughput Analysis of WEP Security in Ad Hoc Sensor Networks Mohammad Saleh and Iyad Al Khatib iitc Stockholm, Sweden {mohsaleh, iyad}@iitc.se ABSTRACT This paper presents a performance investigation
Performance Analysis of IPv4 v/s IPv6 in Virtual Environment Using UBUNTU
Performance Analysis of IPv4 v/s IPv6 in Virtual Environment Using UBUNTU Savita Shiwani Computer Science,Gyan Vihar University, Rajasthan, India G.N. Purohit AIM & ACT, Banasthali University, Banasthali,
Part III-b. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part III-b Contents Part III-b Secure Applications and Security Protocols Practical Security Measures Internet Security IPSEC, IKE SSL/TLS Virtual Private Networks Firewall Kerberos SET Security Measures
Chapter 8 Virtual Private Networking
Chapter 8 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FWG114P v2 Wireless Firewall/Print Server. VPN tunnels provide secure, encrypted
VPN. Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu
VPN Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu What is VPN? A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet), maintaining
ReadyNAS Remote White Paper. NETGEAR May 2010
ReadyNAS Remote White Paper NETGEAR May 2010 Table of Contents Overview... 3 Architecture... 3 Security... 4 Remote Firewall... 5 Performance... 5 Overview ReadyNAS Remote is a software application that
IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31
IP address format: 7 24 Class A 0 Network ID Host ID 14 16 Class B 1 0 Network ID Host ID 21 8 Class C 1 1 0 Network ID Host ID 28 Class D 1 1 1 0 Multicast Address Dotted decimal notation: 10000000 00001011
Web Security Considerations
CEN 448 Security and Internet Protocols Chapter 17 Web Security Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
Computer Networks CS321
Computer Networks CS321 Dr. Ramana I.I.T Jodhpur Dr. Ramana ( I.I.T Jodhpur ) Computer Networks CS321 1 / 22 Outline of the Lectures 1 Introduction OSI Reference Model Internet Protocol Performance Metrics
Computer and Network Security
Computer and Network Security c Copyright 2000 R E Newman Computer & Information Sciences & Engineering University Of Florida Gainesville, Florida 32611-6120 nemo@ciseufledu Network Security Protocols
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
2057-15. First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring
2057-15 First Workshop on Open Source and Internet Technology for Scientific Environment: with case studies from Environmental Monitoring 7-25 September 2009 TCP/IP Networking Abhaya S. Induruwa Department
Corso di Network Security a.a. 2012/2013. Collection of some exercises on the second part of the course
University of Parma Department of Information Engineering Corso di Network Security a.a. 2012/2013 Collection of some exercises on the second part of the course 1) Specify the name of the CHAP messages
Chapter 5: Network Layer Security
Managing and Securing Computer Networks Guy Leduc Mainly based on Network Security - PRIVATE Communication in a PUBLIC World C. Kaufman, R. Pearlman, M. Speciner Pearson Education, 2002. (chapters 17 and
Keying Mode: Main Mode with No PFS (perfect forward secrecy) SA Authentication Method: Pre-Shared key Keying Group: DH (Diffie Hellman) Group 1
Prepared by SonicWALL, Inc. 09/20/2001 Introduction: VPN standards are still evolving and interoperability between products is a continued effort. SonicWALL has made progress in this area and is interoperable
Virtual Private Networks
Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication
Site to Site Virtual Private Networks (VPNs):
Site to Site Virtual Private Networks Programme NPFIT DOCUMENT RECORD ID KEY Sub-Prog / Project Information Governance NPFIT-FNT-TO-IG-GPG-0002.01 Prog. Director Mark Ferrar Owner Tim Davis Version 1.0
Network Security TCP/IP Refresher
Network Security TCP/IP Refresher What you (at least) need to know about networking! Dr. David Barrera Network Security HS 2014 Outline Network Reference Models Local Area Networks Internet Protocol (IP)
Influence of the TCP packet setting and encryption for data transfer in medical applications
Influence of the TCP packet setting and encryption for data transfer in medical applications VLADIMÍR SCHINDLER Department of Telecommunications,Faculty of Electrical Engineering and Communication Brno
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer
Other VPNs TLS/SSL, PPTP, L2TP Advanced Computer Networks SS2005 Jürgen Häuselhofer Overview Introduction to VPNs Why using VPNs What are VPNs VPN technologies... TLS/SSL Layer 2 VPNs (PPTP, L2TP, L2TP/IPSec)
Comparing TCP performance of tunneled and non-tunneled traffic using OpenVPN
System & Network Engineering Comparing TCP performance of tunneled and non-tunneled traffic using OpenVPN Authors: bhoekstra@os3.nl dmusulin@os3.nl Version 1.1 Revision 191 Supervisor: Jan Just Keijser
Understanding the Cisco VPN Client
Understanding the Cisco VPN Client The Cisco VPN Client for Windows (referred to in this user guide as VPN Client) is a software program that runs on a Microsoft Windows -based PC. The VPN Client on a
IPsec VPN Application Guide REV: 1.0.0 1910010876
IPsec VPN Application Guide REV: 1.0.0 1910010876 CONTENTS Chapter 1. Overview... 1 Chapter 2. Before Configuration... 2 Chapter 3. Configuration... 5 3.1 Configure IPsec VPN on TL-WR842ND (Router A)...
Configuring a Site-to-Site VPN Tunnel Between Cisco RV320 Gigabit Dual WAN VPN Router and Cisco (1900/2900/3900) Series Integrated Services Router
print email Article ID: 4938 Configuring a Site-to-Site VPN Tunnel Between Cisco RV320 Gigabit Dual WAN VPN Router and Cisco (1900/2900/3900) Series Integrated Services Router Objective Virtual Private
z/os Firewall Technology Overview
z/os Firewall Technology Overview Mary Sweat E - Mail: sweatm@us.ibm.com Washington System Center OS/390 Firewall/VPN 1 Firewall Technologies Tools Included with the OS/390 Security Server Configuration
INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002
INTERNET SECURITY: FIREWALLS AND BEYOND Mehernosh H. Amroli 4-25-2002 Preview History of Internet Firewall Technology Internet Layer Security Transport Layer Security Application Layer Security Before
A Transport Protocol for Multimedia Wireless Sensor Networks
A Transport Protocol for Multimedia Wireless Sensor Networks Duarte Meneses, António Grilo, Paulo Rogério Pereira 1 NGI'2011: A Transport Protocol for Multimedia Wireless Sensor Networks Introduction Wireless
Why SSL is better than IPsec for Fully Transparent Mobile Network Access
Why SSL is better than IPsec for Fully Transparent Mobile Network Access SESSION ID: SP01-R03 Aidan Gogarty HOB Inc. aidan.gogarty@hob.de What are we all trying to achieve? Fully transparent network access
Internetwork Security
Internetwork Security Why Network Security Layers? Fundamentals of Encryption Network Security Layer Overview PGP Security on Internet Layer IPSec IPv6-GCAs SSL/TLS Lower Layers 1 Prof. Dr. Thomas Schmidt
Internet Security Architecture
accepted for publication in Computer Networks and ISDN Systems Journal Internet Security Architecture Refik Molva Institut Eurécom 2229, route des Crêtes F-06904 Sophia-Antipolis molva@eurecom.fr Abstract
Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security
UNIT 4 SECURITY PRACTICE Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security Slides Courtesy of William Stallings, Cryptography & Network Security,
A Performance Analysis of Gateway-to-Gateway VPN on the Linux Platform
A Performance Analysis of Gateway-to-Gateway VPN on the Linux Platform Peter Dulany, Chang Soo Kim, and James T. Yu PeteDulany@yahoo.com, ChangSooKim@yahoo.com, jyu@cs.depaul.edu School of Computer Science,
Background Implementation Setup MAC Layer Protocols: Hardware Configuration Higher Layer Protocols:
Measuring Performance Impact of Security Protocols in Wireless Local Area Networks Avesh K. Agarwal Wenye Wang Department of Electrical and Computer Engineering North Carolina State University, Raleigh,
Application Note: Onsight Device VPN Configuration V1.1
Application Note: Onsight Device VPN Configuration V1.1 Table of Contents OVERVIEW 2 1 SUPPORTED VPN TYPES 2 1.1 OD VPN CLIENT 2 1.2 SUPPORTED PROTOCOLS AND CONFIGURATION 2 2 OD VPN CONFIGURATION 2 2.1
Insecure network services
NFS (port 2049) Insecure network services - Read/write entire FS as any non-root user given a dir. handle - Many OSes make handles easy to guess Portmap (port 111) - Relays RPC requests, making them seem
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
Quality of Service Analysis of site to site for IPSec VPNs for realtime multimedia traffic.
Quality of Service Analysis of site to site for IPSec VPNs for realtime multimedia traffic. A Network and Data Link Layer infrastructure Design to Improve QoS in Voice and video Traffic Jesús Arturo Pérez,
LES: Layered Encryption Security
LES: Layered Encryption Security Manish Karir John S. Baras Center for Satellite and Hybrid Communication Networks Department of Electrical and Computer Engineering & Institute for Systems Engineering
ETSF10 Part 3 Lect 2
ETSF10 Part 3 Lect 2 DHCP, DNS, Security Jens A Andersson Electrical and Information Technology DHCP Dynamic Host Configuration Protocol bootp is predecessor Alternative: manual configuration IP address
Final for ECE374 05/06/13 Solution!!
1 Final for ECE374 05/06/13 Solution!! Instructions: Put your name and student number on each sheet of paper! The exam is closed book. You have 90 minutes to complete the exam. Be a smart exam taker -
Secure SCTP against DoS Attacks in Wireless Internet
Secure SCTP against DoS Attacks in Wireless Internet Inwhee Joe College of Information and Communications Hanyang University Seoul, Korea iwjoe@hanyang.ac.kr Abstract. The Stream Control Transport Protocol
Lecture Objectives. Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks. Agenda. References
Lecture Objectives Wireless Networks and Mobile Systems Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks Introduce security vulnerabilities and defenses Describe security functions