1 / 11

IPSec: Authentication Header, Encapsulating Security Payload Protocols

IPSec: Authentication Header, Encapsulating Security Payload Protocols. CSCI 5931 Web Security Edward Murphy. IPSec Architecture. Set of security services offered by IPSec include Connectionless integrity Data origin authentication Protection against replay attacks Confidentiality

rfish
Download Presentation

IPSec: Authentication Header, Encapsulating Security Payload Protocols

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. IPSec: Authentication Header, Encapsulating Security Payload Protocols CSCI 5931 Web Security Edward Murphy

  2. IPSec Architecture • Set of security services offered by IPSec include • Connectionless integrity • Data origin authentication • Protection against replay attacks • Confidentiality • Limited traffic flow confidentiality • The services can be used alone or in combination • Security is provided for protection of the IP and/or upper layer protocols(tcp, udp) • IPSec can be thought of as a software or hardware module that is implemented in either a host or a security gateway (router or firewall)

  3. IPSec Architecture • IPSec module is used to manage security for individual connections to other modules • Security Policy Database (SPD) provides specifications of the security services to be applied to each packet • Security Association Database (SAD) contains the security parameters (encryption algorithms, mode used, initialization data, session keys) used to enforce a specific policy • A connection from one module to another is created through a security association (SA) that corresponds to an entry in the SAD • An SA is a uni-directional connection that defines the type of security services and mechanisms used between two modules

  4. IPSec Architecture

  5. IPSec Protocols • The protocols used to provide security are the Authentication Header (AH) and Encapsulating Security Payload (ESP) • Each protocol can be used in one of two modes • Transport mode – used to protect upper layer payloads of an IP packet (tcp, udp) • Tunnel mode – used to protect an entire IP packet including its payload (VPN) • Transport mode is used as an SA between two hosts • Tunnel mode is used as an SA between two gateways or a host and gateway

  6. IPSec Protocols • Transport Mode (upper level protocols) • Tunnel Mode (entire IP packet)

  7. IPSec Protocols • AH is used to provide • Connectionless integrity and data origin authentication (integrity) • Optional anti-replay service • ESP is used to provide • Confidentiality and (integrity) connectionless integrity and data origin authentication • Connectionless integrity and data origin authentication (integrity) • Limited traffic flow confidentiality • Optional anti-replay service

  8. IPSec Protocols • Integrity Algorithm (AH, ESP) • Hashed Message Authentication Code (160 bit key) • Confidentiality Algorithm (ESP) • AES CBC mode (128 bit key – 256 bit key) • Transport Mode Protection • AH - Integrity • Immutable sections of the IP header, the AH header, and the upper level data • ESP - Integrity • The ESP header, the upper level data, and the ESP trailer • ESP – Confidentiality • The upper level data, and the ESP trailer

  9. IPSec Protocols • Transport Mode (AH) • Transport Mode (ESP)

  10. IPSec Protocols • Tunnel Mode Protection • AH - Integrity • Immutable sections of the outer IP header, the AH header, and the entire inner IP packet • ESP - Integrity • The ESP header, the entire inner IP packet, and the ESP trailer • ESP – Confidentiality • The entire inner IP packet, and the ESP trailer

  11. IPSec Protocols • Tunnel Mode (AH) • Tunnel Mode (ESP)

More Related