Introduction to Virtual Private Networks
To learn something new, and review it from time to time, is quite joyful.
—Confucius
As long as human beings have had the ability to communicate, we have had the need to keep certain conversations private. No matter the medium, one technology or another has been invented to hide content from unwanted listeners: from whispering to enciphering to scrambling pay TV channels. Private conversations discriminate between the intended audience and all others.
There are, in general, two ways to make a conversation private: physical separation, where only the intended audience can access the signal, and obfuscation, where—even though many might detect the signal—only the intended audience can understand the message. When the communication happens in a public medium, obfuscation is the only solution.
In a historical sense, the Internet is a recent phenomenon, yet it has had such a profound impact on the way people communicate that it ranks among the greatest hallmarks in the evolution of communication. The Internet has fundamentally changed both social and commercial interactions. For businesses in particular, the Internet is rapidly becoming the communications medium of choice. Yet conducting business requires private communications, and the Internet is a public medium. In a virtual private network (VPN), various networking technologies are applied toward the goal of providing private communications within the public Internet infrastructure.
A VPN is a concept composed of two parts: a virtual network overlaid on top of the ubiquitous interconnection of the Internet1 and a private network for confidential communications and exclusive usage.
In VPNs, "virtual" implies that there is no physical network infrastructure dedicated to the private network. Instead, a single physical network infrastructure is shared among various logical networks. For example, you can use the same network access circuit to access the Internet, to connect different corporate sites, and to connect to another business's network. This virtual network allows the construction of additional logical networks by changing device configuration only. This approach is faster to deploy and is less costly than employing dedicated physical infrastructures.
Perhaps even more important is the "private" aspect of the VPN. The very purpose of a private network is to keep the data—and sometimes even the act of communicating the data—confidential so that it can be received only by the intended audience. This privacy ensures that advantages you gain by using a public infrastructure do not come at the expense of data security.
Therefore, a VPN is defined as a logical network that is created within a shared infrastructure while retaining the properties of a private network; the communication across this logical network is kept private, and the quality of the communication channel is maintained. The aim of VPNs is to use the public Internet to enable private communication to be conducted securely and reliably across the globe.
VPNs are applicable to a wide variety of users—anyone requiring private communication over a public medium. Although there is certainly much motivation outside the corporate world, business communication offers a particularly compelling case for the application of VPNs.
1.1 Business Communication
There are many types of business communication. Broadly speaking, business communication can be classified into three categories:
Internal communication The message is limited to selected internal audiences. For example, a corporation may periodically distribute an updated company employee directory to all its employees. Confidentiality is essential.
Selected external communication The message is intended for selected external audiences. For example, a retail store may want to order a product from its supplier. Although not all communications of this type are considered proprietary, one company's business with another is generally confidential.
Communication with public and other external audiences The message is intended for general public consumption. Sometimes, the wider audience the message reaches, the better. For example, a company may place a 30-second commercial during a sporting event to reach a large audience. At other times, a targeted message is designed to cater to a specific audience to maximize its impact. This type of communication is generally not confidential.
Businesses have traditionally used specialized technologies for these different types of communication and have managed them separately.
The Convergence of Business Communication
Although businesses have a variety of communication types—and hence the need for different modes of communication—the digitization of information, and the creation of computer networks to deliver it, has been a unifying factor. Internal memos are now emails, and employee directories are kept in databases. Orders can be placed online. The World Wide Web provides a means for publishing sophisticated product brochures. Although there will always be the need for traditional forms of information dissemination, much business communication is converging on a digital network.
The computer networking technologies are also converging. There used to be many types and formats of computer networks, each developed by a different vendor. IBM offered Systems Networking Architecture (SNA) for its mainframe and minicomputers. Digital had DECNET, used in the once-popular VAX computing environment. In the PC environment, Novell's Netware was dominant and still is fairly widely used for PC interconnections. Nonetheless, with the development of the Internet, most computer networks have migrated to an IP-based infrastructure. IP—the Internet Protocol—serves as the common format for all connected network devices on the Internet.
Private Networks
To meet their information infrastructure needs, corporations have invested heavily in internal networks called intranets. Intranets serve the employees at the corporate site, but not employees on the road or telecommuting from home. To accommodate the remote access needs of "road warriors" and telecommuters, companies have set up remote access servers to extend intranets into the field. Usually, a bank of modems allows these users to dial in through public switched telephone networks (PSTNs). Furthermore, employees at branch offices require access to the same information and the same resources, so private lines are used to interconnect the various sites to make one corporatewide intranet.
Special arrangements are sometimes made to allow business partners to have limited access to some part of the corporate intranet.2 These networks, usually called extranets, provide the means to improve the efficiency of business information flow.
Each form of access to the intranet, as shown in Figure 1-1, is a separate private networking solution. This is true even when some aspects of each solution, such as the underlying networking protocols used, are the same. Each form of access also has its own requirements for privacy—requirements that are met by keeping data transmission on separate dedicated channels.
){kind=link}
Figure 1-1 Separate private networks.
Public Networks
It is also imperative for a corporation to exchange information outside the established private networks. This requires access to a public networking infrastructure such as the Internet.
In addition, the public network opens a new avenue of commerce. It is now unthinkable for a corporation not to have a presence in the World Wide Web. For many companies, such as Amazon.com, there is no "brick and mortar" storefront. The only place where they face customers is in cyberspace.
Virtual Private Networks
Protection of private corporate information is of utmost importance when designing an information infrastructure. However, the separate private networking solutions are expensive and cannot be updated quickly to adapt to changes in business requirements. The Internet, on the other hand, is inexpensive but does not by itself ensure privacy. Virtual private networking, as shown in Figure 1-2, is the collection of technologies applied to a public network—the Internet—to provide solutions for private networking needs. VPNs use obfuscation through secure tunnels, rather than physical separation, to keep communications private.
){kind=link}
Figure 1-2 Virtual private networking.
Footnotes
- VPN has several other meanings, such as software-defined telephone network and frame relay networks. Unless otherwise noted, we use VPN to mean an Internet-based VPN.
- Here and elsewhere, we use the term business partner to mean external corporate organizations—such as vendors of parts or supplies—that work closely with your business and to which you give limited access to certain records.