SCSC 455 Computer Security

Virtual Private Network (VPN)

How to connect LANsThere’re common demands of joining two or multiple LANs to facilitate corporate communications secure point-to-point communications The connection can only used by authenticated LANs /

hosts

One solution (traditional one) is to use private leased lines Problems: don’t scale well, cost is high, and the

complexity of maintaining the leased lines

Another solution – virtual private networks

VPNs

Goal of VPNs Provide a cost-effective and secure way to connect

businesses to one another and remote workers to office networks

Functionalities of VPNs Encapsulate and encrypt data being transmitted Use authentication to ensure that only approved users

can access the VPN Provide a means of secure point-to-point

communications over the public Internet

Index

VPN components and operations

Types of VPNs

VPN setups

Tunneling protocols used with VPNs

Enabling secure remote access connections within VPNs

VPNs best practices

Components within VPNSVPNs consist of two different types of components

Hardware devices two endpoints (terminators)

Encryption, authentication, and encapsulation a (virtual) tunnel

A series of connections between two endpoints than makes

use of Internet-based hosts/servers

Software that performs security-related activities

Essential Activities of VPNs

Three essential activities of VPNs

IP encapsulation

Data payload encryption

Encrypted authentication

IP Encapsulation

VPN encapsulates actual data packets within packets that use source and destination addresses of VPN gateway

The benefits of encapsulating IP packets Source and destination information of actual data packets are

completely hidden source and destination IP addresses of actual data packets can be

in private reserved blocks not usually routable over the Internet

Data Payload Encryption

VPNs do NOT encrypt the header within packets, only the data payload that the packets carry.

The encryption can be performed in one of two ways: Transport method

The host encrypts traffic when it’s generated Tunnel method

The traffic is encrypted and decrypted in transit, somewhere between the source host and destination.

Encrypted Authentication

Authentication is essentialHosts in the network that receive VPN communicationneed to know that the host originating thecommunications is an approved user of the VPN

Hosts are authenticated by exchanging long blocks of code - keys Types of keys that can be exchanged in an encrypted

transaction: Symmetric keys Asymmetric keys

Index

VPN components and operations

Types of VPNs

VPN setups

Tunneling protocols used with VPNs

Enabling secure remote access connections within VPNs

VPNs best practices

Types of VPNs

Two types of VPNs Site-to-site VPN

Links two or more networks Client-to-site VPN

Makes a network accessible to remote users who need dial-in access

These two types VPNs are NOT mutually exclusivee.g., a large corporations’ network support both site-to-site

VPN and client-to-site VPN

Advantage of Using Hardware Systems

Software VPN Systems

Software VPN are generally less expensive than hardware systems Tend to scale better for fast-growing networks

Examples F-Secure VPN+ Novell BorderManager VPN services Check Point FireWall-1

Index

VPN components and operations

Types of VPNs

VPN setups

Tunneling protocols used with VPNs

Enabling secure remote access connections within VPNs

VPNs best practices

Index

VPN components and operations

Types of VPNs

VPN setups

Tunneling protocols used with VPNs

Enabling secure remote access connections within VPNs

VPNs best practices

Tunneling Protocols Used with VPNs

In the past , firewalls support VPNs used proprietary protocols

Both endpoints must use the same brand of firewall

Today the proprietary protocols are used less often. Most VPNs use standard tunneling protocols

IPSec/IKE PPTP (Point-to-Point Tunneling Protocol) L2TP (Layer 2 Tunneling Protocol) PPP over SSL (Point-to-Point Protocol over Secure Sockets Layer) PPP over SSH (Point-to-Point Protocol over Secure Shell)

IPSec/IKEIPSec provides:

Encryption of the data part of packets Authentication Encapsulation between two VPN hosts Two security methods (AH and ESP)

Authenticated header is used to authenticate packets Encapsulating Security Payload encrypts the data portions of

the packet IPSec is commonly combined with IKE as means of using public

key cryptography to encrypt data

IKE provides: Exchange of public keys Ability to determine which encryption protocols should be used to

encrypt data that flows through VPN tunnel

Other tunneling protocols: PPTP

PPTP is developed by Microsoft for granting VPN access to

remote users over dial-up connections

Uses Microsoft Point-to-Point Encryption (MPPE) to encrypt data

Useful if support for older clients is needed

Compatible with Network Address Translation (NAT)

Replaced by L2TP

Other tunneling protocols: L2TP

L2TP is an extension of Point-to-point Protocol (PPP) that enables dial-up users to establish a VPN connection to a remote access server Uses IPSec rather than MPPE to encrypt data provides a higher level of encryption and authentication Incompatible with NAT

Other tunneling protocols: PPP Over SSL and PPP Over SSH

PPP over SSL and PPP over SSH are two UNIX based methods for creating VPNs

Both combine existing tunnel system (PPP) with a way of encrypting data in transport (SSL or SSH)

SSL Public key encryption system used to provide secure

communications over the Web SSH

UNIX secure shell that perform secure authenticated logons and encrypted communications between a client and a server.

When to Use Different tunneling Protocols (important!)