IPsec: security structure of IPv4 and IPv6

In computer networking, packets are the basic elements of data communication (set of bits) on the Web. They are composed of two elements: on the one hand, the payload datawhich include language, text or images. On the other hand, we find the header datawith the address of the sender and recipient. The big problem with this Internet protocol in relation to data packets is the absence of encryption or identification systems. The data is not encrypted during sending and passes through different routers. They can therefore be intercepted, manipulated and read at any time. The three basic pillars of data security are therefore not ensured. These pillars rest on the confidentialitytheauthenticity and theintegrity. It is for this reason that the IPsec protocol suite, or Internet Protocol Security, was developed. This suite includes many features ensuring secure transfer of data packets over public networks. This is why IPsec is a central element among VPN (virtual private network) connections.

What is IPsec?

IPsec is part of the TCIP-IP family of protocols. Its architecture is standardized by IETF (Internet Engineering Task Force), an organization that aims to continually develop the Internet. IPsec was developed for the latest version of the Internet protocol called IPv6 as well as for IPv4. There are three categories of functions:

• Transfer protocols : Authentication Header (AH), Encapsulating Security Payload (ESP)

• Key management method : Internet Security Association and Key Management Protocol (ISAKMP), Internet Key Exchange (IKE)

• Databases : Security Association Database (SAD), Security Policy Database (SPD)

Using the AH and ESP transfer protocols, the IPsec protocol guarantees both the authenticity and security of the data sent, i.e. ensuring that their content actually corresponds to that of thesender and that it arrives as is RECIPIENT. This is why AH offers a real-time authentication system of the data source, via the data packet header. On the other hand, the protocol guarantees that the data remains intact during transfer. Additionally, the header includes a sequence number, so that these packets can only be sent once.

The ESP protocol also allows the data that has been sent to be encrypted. ESP authentication differs from the AH protocol because its system is not complete and does not take into account theIP header. Using additional encapsulation, ESP elements can still be delivered correctly as with private DSL access over NAT networks.

ESP encryption management is largely managed by the IKE protocol. These are security arrangements (security associations) between the sender and the recipient. For this, theDiffie-Hellman key exchange is used according to the definitions of the ISAKMP framework. THE information needed to send the package based on IPsec are saved in two databases SPD And SAD. Entries in the Security Policy Database determine, for example, which transmission protocols (AH, ESP or both) will be used. The SAD administers security association specific entries that are placed by the IKE protocol. Thus, the sender manages the encryption system and the recipient receives the encryption key.

IPsec transport mode and tunnel mode

Two different operating modes ensure secure connections with IPsec: transport mode and tunnel mode. IPsec tunnel mode has the particularity of allowing connection between two IP networks.

Close

The mode of transport

Transport mode with IPsec works as follows: the transfer protocol header is inserted between the IP header of the data packet, which remains unchanged, and the user data. Data protection is ensured from the originating computer to the target computer. Only after the packet has been delivered can the seed data be opened and made available to the receiver. Thus, the method of encryption and communication of data is identical. This mode has the advantage of having a very reduced processing time but only protects the security of the user’s data, while the data concerning the source and target addresses is not protected. Typically, the mode is used for host-to-host or host-to-router connections (e.g. for network administration).

Tunnel mode

With tunnel mode, you get a completely new IP header, in which the target and source address as well as user data are hidden. The transmission protocol is implemented there, as with transport mode. This is why we say that the packet is encapsulated or packaged. The new outer header defines cryptographic properties, which differ from the inner IP header. It is only when the packet has been unpacked by so-called secure gateways that it is transferred to the recipient. Typically, IPsec tunnel mode data transfer occurs in a Gateway to Gateway (gateway to gateway). Host-to-gateway and host-to-host transfers are also possible.

Strengths and weaknesses of IPsec

When building secure VPN tunnels (which make up the majority of the protocol family), IPsec has a major advantage over alternatives like SSL. IPsec, as a standard among networks, is independent of any application. Once the connection is established, various forms of data traffic (be it email, file transfers, or IP telephony for example) can be carried out without any required tools having to be installed. This protocol stack is therefore an inexpensive solution when it comes to VPN connections. On the other hand, using IPsec requires special software for remote access. This must be installed, modulated and updated on the client in question. Independence from applications can also become problematic in the event of unauthorized access if they are not blocked by a central firewall, as all applications could be put at risk. But the advantages of IPsec are undeniable in terms of performance and reliability. A gateway can operate without difficulty on a cluster system, even when thousands of users are supplied with data packets. Finally, IPsec prevails as the optimal solution for all sensitive data with maximized security for internal enterprise data traffic.