IP Security (IPsec)

IPsec is an #Network Layer security framework for secure communications over Internet Protocol (IP)# network. This means it could protect every application or Protocol#, including those that are security-ignorant (doesn’t design around security), running on top of IP (IPv4 or IPv6#, however, both of them are not compatible to each other). It is common having it to have secure access over the Internet, extranet and intranet connectivity with partners or just to enhance the security especially in electronic commerce. It provides Authentication#, Confidentiality#, and key management (secure key exchanges) services.

Note: Since IPsec is transparent to application, there is no need to retrain the user to use IPsec. Thus, it is able to provide security for individual applications and users with little refitting efforts.

Note: IPsec could be used for router advertisement to prevent forged routing update.

The security architecture of IPsec is defined by RFC 4301 which includes the need of tunnel/transport mode and SA with database implementation. Further standardisation are done in RFC 2401, RFC 2402, RFC 2406, and RFC 2408, which makes IPsec mandatory in #IPv6 Address and optional in IPv4 Address (which needs additional application). IPsec’s implementation must support four cases of Security Association (SA)#:

  • Case 1 security is provided between end systems.
  • Case 2 security is provided between gateways.
  • Case 3 security builds on Case 2 by adding end-to-end security.
  • Case 4 provides a remote host to securely access an organisation’s firewall over Internet and then gain access to the internal resources behind it.

The data encapsulation is done by two extension headers (append to the IP header): Authentication Header (AH) and Encapsulating Security Payload (ESP), defined by RFC 4303 and RFC 4302 respectively. AH provides Access Control#, Authentication# (including the IP Address#) and Connectionless Data Integrity# services using Message Authentication Code (MAC# /HMAC) where both parties must share secret key. It guards against address spoofing attacks and Replay Attack. ESP provides Confidentiality# services over message contents and traffic flow (but limited) and optionally support Access Control# services like in AH using MAC. It can also guard against Replay Attack#. The users can design which kind of ciphers, modes, and padding to be used in ESP. The IPsec could be set up to have AH only or ESP only or both.

To authenticate key, IPsec uses a protocol called Internet Key Exchange (IKE) which is used to establish a Security Association (SA)# for AH and ESP. If IKE is broken, both AH and ESP provide no protection over the IP packet.

There are two protocol modes available in IPsec: transport mode and tunnel mode. Transport mode provides End-to-end security# which only protects the IP packet payload. Tunnel mode provides gateway-to-gateway (usually Router owned by the same corporation) security which protects the entire IP packet. However, the traffic after the gateway will not be protected under tunnel mode, and it can’t be set up by normal user. The authentication and encryption will be done slightly different in each mode. In transport mode, authentication and encryption will only be done on the payload (could be susceptible to Traffic Analysis#) and sometimes include a portion of IP header (if using AH only) and IPv6 extension headers. In tunnel mode, authentication and encryption must be done on the entire packet (in AH only tunnel mode SA, it will authenticate a portion of IP header and IPv6 extension headers too). Both mode could be stacked to each other in order to satisfy four cases of SA.

IPsec’s implementations and/or applications:

Links to this page
  • X.509 Authentication Service
  • Virtual Private Network (VPN)

    VPN allows individuals sends and/or receives data across public network as if they are connected to a dedicated private network. For example, people in their own home can access to their corporate private sites using VPN provided by the company. This negates the need for Point-to-Point/Leased Line. To avoid eavesdropping, a typical implementation of VPN involves authentication and encryption using #IP Security (IPsec).

  • TNS3131 Chapter 6: IP Security
  • Symmetric Cryptography

    Symmetric Cryptography, or Private-Key Cryptography is a #Cryptographic system that uses the same key for encryption and decryption. However, you can already imagine the security risk of sharing the same secret over a network, requiring a secure channel (usually via IPsec#). If the key get compromised#, it means the need to generate a new key and distribute# it again. It also requires a strong encryption #algorithm for the intruder to not be able to guess the secret key easily. That being said, it is quite fast when comparing to Asymmetric Cryptography.

  • Security Association (SA)
    #IPsec protocol mode (tunnel or transport mode)

    SA is a one way relationship between a sender and a receiver. This means that it only defines one communication link between a source and a destination over an application. If multiple applications or #p2p secure communications are needed, there needs to be multiple SA correspondingly. It is identified by three parameters: Security Parameter Index (SPI) (a bit string to enable the receiver to select the SA under which a received packet will be processed), IP Destination address (allows only unicast address), and Security Protocol Identifier (either AH or ESP, see more in #IP Security (IPsec)).

  • Network Layer
  • Multiprotocol Label Switching (MPLS)

    Because of the rising concerns of the Fabrication# of the label, many entities have been opted for IP Security (IPsec)# to enhance the traffic security while traversing MPLS networks.

  • IPv6 Address

    Furthermore, IPv6 has *embedded support for IP Security (IPsec)#* (IP Security, a protocol for IP encryption). Host #operating-system can configure their own IPsec tunnel to other IPv6 host on-demand without needing help from the network unlike in IPv4. It enhances security of the connection and autonomy of the host in the network. Such support is also extended to Mobile IPv6 (MIPv6).

  • Diameter

    Comparing to Remote Access Dial-In User Service (RADIUS), it supports transport layer security such as IP Security (IPsec) and Transport Layer Security (TLS). Furthermore, it has larger address space for Attribute Value Pairs (AVP) and identifiers (32-bit instead of 8-bit). Moreover, it supports application layer acknowledgements and has error notification, basic support for user-sessions and accounting, and better roaming support than RADIUS. It is also more easily extended. It also supports both stateful and stateless models.

#security #networking #)