- Introduction
- 2 VPN Motivation
- 3 The VPN Market
- 4 VPN Technologies
- 5 VPN Solutions
1.4 VPN Technologies
Several key technologies are employed by VPNs, as illustrated in Figure 1-3. A virtual or overlay network relies on tunneling, a concept discussed in great detail in this book. With tunneling, a network looks as if there is a set of simple links between the several sites when, in reality, the links may be a set of complex routes through the Internet. Authentication is the process whereby the identities of the VPN users and devices are verified. Access control provides ways to ensure authorized use of private corporate resources. The data transmitted over the VPN must be obscured from all but the intended recipient: cryptographic technologies provide data security for VPNs.
){kind=link}
Figure 1-3 Key technologies of VPNs
The technologies that form the building blocks of VPNs are the topics for chapters in Part II of this book.
Tunneling
Tunneling is defined as the encapsulation of a certain data packet (the original, or inner packet) into another data packet (the encapsulating, or outer packet) so that the inner packet is opaque to the network over which the outer packet is routed. The encapsulation is done in such a way that one or more protocol layers are repeated. For example, when an IP packet is put into a User Datagram Protocol (UDP) packet (which is itself put into an IP packet), we say that UDP is tunneling IP.
The need for tunneling arises when it is not appropriate for the inner packet to travel directly across the network for various reasons. For example, tunneling can be used to transport multiple protocols over a network based on some other protocol, or it can be used to hide source and destination addresses of the original packet. When tunneling is used for security services, an unsecure packet is put into a secure, usually encrypted, packet.
Two components can uniquely determine a network tunnel: the endpoints of the tunnel and the encapsulation protocol used to transport the original data packet within the tunnel. In most cases, a tunnel has two endpoints: one where the tunnel starts (encapsulation) and one where the tunnel ends (decapsulation). In the multicast case, a tunnel can have one starting point and multiple ending points, but we do not consider those tunnels in this book. In a VPN, authentication and access control decisions are made, and security services are negotiated and rendered, at these endpoints. Depending on the required services, different encapsulation protocols can be chosen.
Chapter 4 discusses details regarding tunneling technologies and the various standard tunneling protocols. One of the more important protocol suites, IPsec, is addressed in Chapter 5.
Authentication
Before any communication can be called private, each party must know the identity of the other. The same holds true for secure network communication: One network system must make sure that the other network system is the intended correspondent. The process of such identity verification is called authentication.
Authentication ensures that the data is indeed coming from the source it claims to be. In the traditional circuit-switched network, authentication is carried out only during the circuit provision phase. Verification of identities is implicit because the circuit is provisioned by the administrators, who presumably know the communicants. After the establishment of the circuit, the circuit, and thus the assumption of identity, remains in place indefinitely until it is explicitly torn down through another provisioning action.
When a secure VPN tunnel is established, the two endpoints (where the security service is negotiated and rendered) must authenticate each other.
Authentication methods can be broadly categorized into two kinds: two-party authentication and trusted third-party authentication. These methods are discussed in Chapter 6; Chapter 7 focuses on PKI, or public key infrastructure, the most important trusted third-party method.
Access Control
When the authentication process is completed, the communication entities can decide whether to allow the communication session to continue or to reject the session. In the case of VPNs, one purpose of secure communication is to allow authorized access to resources. When an access request is presented, the resource (or the security proxy responsible for safeguarding that resource) makes a decision as to whether to allow the access request to proceed. Usually, this access control procedure is performed at the endpoints of the tunnel.
An access control process has two aspects. The first aspect is the information on which the access control decision is made. Usually, this information includes the identity of the entity that is requesting access, the resources to be accessed, and rules governing the access. The complete identity information of the requester and resources can be presented at the time of the request, or it can be derived from stored information using data or credentials provided at the time of the request, such as username or IP address or both.
The second aspect is how the access control decision is made based on the information available. For example, the decision-making process can be carried out entirely at the location where the security service is negotiated and rendered, or the system can query a separate policy server for such decision. Having all the policies administered at a centralized server can make it easier to manage.
Chapter 8 addresses access control and explains how it can be performed in a VPN scenario.
Data Security
Data security touches on all VPN technology building blocks. Overall security is only as secure as its weakest link. If one link in the sequence that leads to the delivery of data is not secure, the entire process is not secure.
Because VPNs use a shared infrastructure to transport private traffic, it is possible for the data to be intercepted and even altered by others during its transit over the public infrastructure. Thus, strong encryption and data integrity should be applied to every data packet to make it opaque to interceptors. In addition, the packet delivery system should also be able to guard against replay attacks. In a replay attack, the attacker simply retransmits a previously captured packet. Because the original packet was authentic, it can pass all the cryptographic checks. If the receiver inserts a replayed packet into the received data stream, the entire message becomes incorrect, thus denying normal service.
Having strong encryption algorithms and well-conceived keys helps to ensure that the integrity of the data cannot be compromised by the interceptor without knowledge of the cryptographic keys. Changing the encryption in the middle of a communication session—a technique sometimes called over the air rekeying (OTAR)—helps to further the guard against attacks on the keys.
The basic concepts of cryptography are discussed in Chapter 2. Chapter 5 discusses the IPsec protocol suite, in which data security techniques are employed for IP-based networks.