Welcome to our site! EDAboard.com is an international Electronics Discussion Forum focused on EDA software, circuits, schematics, books, theory, papers, asic, pld, 8051, DSP, Network, RF, Analog Design, PCB, Service Manuals... and a whole lot more! To participate you need to register. Registration is free. Click here to register now.
Virtual private networ: A Virtual Private Network, or VPN, is a private communications network usually used within a company, or by several different companies or organizations, to communicate over a public network. VPN message traffic is carried on public networking infrastructure (e.g. the Internet) using standard (often insecure) protocols, or over a service provider's network providing VPN service guarded by well defined Service Level Agreement (SLA) between the VPN customer and the VPN service provider.
Authentication mechanism:
VPN involves two parts: the protected or "inside" network that provides physical security and administrative security sufficing to protect transmission (somehow, it is not always the case), and a less trust-worthy or "outside" network or segment (Internet is the largest "jungle"). Generally, a firewall sits between a remote user's workstation or client and the host network or server. As the user's client establishes the communication with the firewall, the client may pass authentication data to an authentication service inside the perimeter. A known trusted person, sometimes only when using trusted devices, can be provided with appropriate security privileges to access resources not available to general users.
Many VPN client programs can be configured to require that all IP traffic must pass through the tunnel while the VPN is active, for better security. From the user's perspective, this means that while the VPN client is active, all access outside their employer's secure network must pass through the same firewall as would be the case while physically connected to the office ethernet. This reduces the risk that an attacker might gain access to the secured network by attacking the employee's laptop: to other computers on the employee's home network, or on the public internet, it is as though the machine running the VPN client simply does not exist. Such security is important because other computers local to the network on which the client computer is operating may be untrusted or partially trusted. Even with a home network that is protected from the outside internet by a firewall, people who share a home may be simultaneously working for different employers over their respective VPN connections from the shared home network. Each employer would therefore want to ensure their proprietary data is kept secure, even if another computer in the local network gets infected with malware. And if a travelling employee uses a VPN client from a Wi-Fi access point in a public place, such security is even more important.
Types of VPNs:
Secure VPNs (SVPNs) use cryptographic tunneling protocols to provide the necessary confidentiality (preventing snooping), sender authentication (preventing identity spoofing), and message integrity (preventing message alteration) to achieve the privacy intended. When properly chosen, implemented, and used, such techniques can provide secure communications over unsecured networks.
Because such choice, implementation, and use are not trivial, there are many insecure VPN schemes on the market.
Secure VPN technologies may also be used to enhance security as a "security overlay" within dedicated networking infrastructures.
Secure VPN protocols include the following:
* IPsec (IP security), an obligatory part of IPv6.
* SSL used either for tunneling the entire network stack, such as in OpenVPN, or for securing what is essentially a web proxy. Although the latter is often called a "SSL VPN" by VPN vendors, it is not really a fully-fledged VPN. (See also TUN/TAP.)
* PPTP (point-to-point tunneling protocol), developed jointly by a number of companies, including Microsoft.
Some large ISPs now offer "managed" VPN service for business customers who want the security and convenience of a VPN but prefer not to undertake administering a VPN server themselves. In addition to providing remote workers with secure access to their employer's internal network, sometimes other security and management services are included as part of the package, such as keeping anti-virus and anti-spyware programs updated on each client's computer.
Trusted VPNs do not use cryptographic tunneling, and instead rely on the security of a single provider's network to protect the traffic. Multi-protocol label switching (MPLS) is commonly used to build trusted VPNs. Other protocols for trusted VPNs include:
* L2F (Layer 2 Forwarding), developed by Cisco.
* L2TP (Layer 2 Tunnelling Protocol), including work by both Microsoft and Cisco.
* L2TPv3 (Layer 2 Tunnelling Protocol version 3).
Characteristics in application:
A well-designed VPN can greatly benefit a company. For example, it can:
* Extend geographic connectivity.
* Improve security where data lines have not been ciphered.
* Reduce operational costs versus traditional WAN.
* Reduce transit time and transportation costs for remote users.
* Simplify network topology in certain scenarios.
* Provide global networking opportunities.
* Provide telecommuter support.
* Provide broadband networking compatibility.
* Provide faster ROI (return on investment) than traditional carrier leased/owned WAN lines.
* Show a good economy of scale.
* Scale well, when used with a public key infrastructure.
However, since VPNs extend the "mother network" by such an extent (almost every employee) and with such ease (no dedicated lines to hire), there are certain security implications that have to receive special attention:
* Security on the client side has to be tightened and enforced. Keywords: Central Client Administration, Security Policy Enforcement. It is common for a company to require that each employee wishing to use their VPN from home first install an approved hardware firewall.
* The scale of access to the target network may have to be limited.
* Logging must be evaluated and in most cases revised.
Any single breach or failure may result in the privacy and security of the network being compromized.
Tunneling:
Tunneling, also known as port forwarding, is the transmission of data intended for use only within a private, usually corporate network through a public network in such a way that the routing nodes in the public network are unaware that the transmission is part of a private network. Tunneling is generally done by encapsulating the private network data and protocol information within the public network transmission units so that the private network protocol information appears to the public network as data. Tunneling allows the use of the Internet, which is a public network, to convey data on behalf of a private network.
The four types of VPN secure dialog:
The most important part of a VPN solution is security. The very nature of VPNs — putting private data on public networks — raises concerns about potential threats to that data and the impact of data loss. A Virtual Private Network must address all types of security threats by providing security services in the areas of:
Authentication (access control) - Authentication is the process of ensuring that a user or system is who the user claims to be. There are many types of authentication mechanisms, but these mechanisms all work off of one or more of the following principles: something you know (a login name, a password), something you have (a token, a card key), something you are (fingerprint, retinal scan). Weak authentication makes use of one of these components, usually a simple login/password sequence. Strong authentication combines at least two authentication components from different areas.
Presentation (privacy /encryption) - Encryption is based on two components: an algorithm and a key. A cryptographic algorithm is a mathematical function that combines data with the string of digits contained in a key to produce encrypted text. There are several major types of encryption of varying degrees of complexity, as measured by lengths (bits) of cryptographic keys. Sample of this one: Advanced Encryption Algorithm (AES), RSA, Advanced Encryption Algorithm (AES), Elliptic Curve Cryptosystems (ECC)
Transportation (data integrity) - The modification of data packets in a network is an attack on data integrity. Message authentication is the procedure used to verify that received messages come from the alleged source and have not been altered
Non repudiation (correct message reception) - Non-repudiation is a means to verify that an electronic message has been sent and received by the specified parties. This protects both parties to ensure that neither the sender nor the recipient can later claim the transaction did not take place. This is vital not only when dealing with contracts, but also for online sales of digital goods such as music.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
