Chapter- 4:
IP security :
Overview :
IP Security (IPSec) is a suite of protocols that provides security for
Internet Protocol (IP) communications. It addresses issues like
authentication, data integrity, and confidentiality, which are essential for
secure communication over IP networks. IPSec can be used with both
IPv4 and IPv6, making it versatile for current and future network
environments.
Authentication and Encryption in IP Security: The Internet
Architecture Board (IAB) recognized the need for security features in IP
communications and included authentication and encryption in the
design of IPv6, the next-generation IP. These features were also made
compatible with IPv4, allowing vendors to implement IPSec capabilities
in their products for both IP versions.
Applications of IPSec:
1. Secure Branch Office Connectivity over the Internet: IPSec enables
businesses to build secure virtual private networks (VPNs) over the
Internet or public WANs. This reduces the reliance on costly private
networks.
2. Secure Remote Access over the Internet: With IPSec, end users can
securely access a company network over the Internet through their ISP.
This reduces costs for traveling employees and telecommuters.
3. Establishing Extranet and Intranet Connectivity with Partners: IPSec
can secure communications with external organizations, ensuring
authentication, confidentiality, and secure key exchange.
4. Enhancing Electronic Commerce Security: IPSec can improve the
security of web and e-commerce applications by providing an additional
layer of security.
Key Features of IPSec:
Encryption and Authentication: IPSec can encrypt and
authenticate all traffic at the IP level, securing various applications
including remote logon, client/server, email, file transfer, and web
access.
Versatility: IPSec can be used across LANs, private and public
WANs, and the Internet, making it suitable for a wide range of
network environments.
IP SEC USAGE IN THE ORGANIZATION :
Organization has LANs located in different geographical locations
These LANs communicate with each other and with the outside
world using non secure IP traffic.
To secure the communication over the WAN (Wide Area Network),
IPSec protocols are employed.
LAN Connectivity: Each LAN within the organization conducts non
secure IP traffic for internal communication.
WAN Connectivity: To connect to the outside world or other
LANs, the organization uses a private or public WAN. This WAN
connection is where IPSec protocols come into play.
IPSec Implementation: IPSec is implemented in networking
devices such as routers or firewalls that connect each LAN to the
WAN. These devices serve as gateways for the LANs, handling the
encryption and decryption of traffic.
Encryption and Compression: The IPSec networking device
encrypts and compresses all outgoing traffic from the LAN before
sending it over the WAN. This ensures that the data is secure
during transmission. Upon receiving data from the WAN, the
device decrypts and decompresses the traffic before forwarding it
to the LAN.
Transparency to LAN Devices: The encryption and compression
operations are transparent to the workstations and servers on the
LAN. This means that the devices on the LAN do not need to
implement IPSec protocols; the networking device handles all
security-related tasks.
BENEFITS OF IP-SEC:
1. Perimeter Security: Implementing IPSec in a firewall or router
provides strong security for all traffic crossing the perimeter.
This ensures that traffic entering or leaving the organization is
secure without imposing security overhead on internal traffic.
2. Resistance to Bypass: IPSec in a firewall is resistant to bypass
because all traffic from the outside must use IP, and the firewall
is the only entrance from the Internet into the organization.
This adds an additional layer of security against unauthorized
access.
3. Transparency to Applications: IPSec operates below the
transport layer (TCP, UDP), making it transparent to
applications. This means that there is no need to modify
software on user or server systems when IPSec is implemented
in the firewall or router. Even if IPSec is implemented in end
systems, upper-layer software, including applications, remains
unaffected.
4. User Transparency: IPSec can be transparent to end users,
eliminating the need to train users on security mechanisms or
issue keying material on a per-user basis. This simplifies key
management and reduces administrative overhead.
5. Routing Security: IPSec can play a vital role in the routing
architecture required for internetworking. It can assure that
router advertisements, neighbor advertisements, redirect
messages, and routing updates come from authorized sources.
This helps prevent unauthorized disruptions or diversions of
traffic.
IP SECURITY ARCHITECTURE :
IPSEC DOCUMENTS :
The IPSec specification comprises several documents, with the
most important ones issued in November 1998 being RFCs
2401, 2402, 2406, and 2408:
1. RFC 2401: Provides an overview of the IPSec security
architecture.
2. RFC 2402: Describes a packet authentication extension for IPv4
and IPv6.
3. RFC 2406: Describes a packet encryption extension for IPv4 and
IPv6.
4. RFC 2408: Specifies key management capabilities.
Support for these features is mandatory for IPv6 and optional
for IPv4. The security features are implemented as extension
headers that follow the main IP header, with the Authentication
header for authentication and the Encapsulating Security
Payload (ESP) header for encryption.
Additional Drafts: In addition to the four main RFCs, the IP
Security Protocol Working Group has published several
additional drafts, categorized into seven groups:
1. Architecture: Covers general concepts, security requirements,
definitions, and mechanisms defining IPSec technology.
2. Encapsulating Security Payload (ESP): Covers packet format
and issues related to using ESP for packet encryption and
authentication.
3. Authentication Header (AH): Covers packet format and issues
related to using AH for packet authentication.
4. Encryption Algorithm: Describes how various encryption
algorithms are used for ESP.
5. Authentication Algorithm: Describes how various
authentication algorithms are used for AH and the
authentication option of ESP.
6. Key Management: Describes key management schemes.
7. Domain of Interpretation (DOI): Contains values needed for
other documents to relate to each other, including identifiers
for approved encryption and authentication algorithms, as well
as operational parameters like key lifetime.
IPIP
*
IP SEC SERVICES :
IPSec (Internet Protocol Security) provides security services at the
IP layer, allowing systems to select necessary security protocols,
algorithms, and cryptographic keys. It operates through two main
protocols: Authentication Header (AH) and Encapsulating Security
Payload (ESP). These protocols offer various security services,
including:
Access control
Connectionless integrity
Data origin authentication
Rejection of replayed packets (a form of partial sequence
integrity)
Confidentiality (encryption)
Limited traffic flow confidentiality
