VPN VPN requirements Encryption VPN-Types Protocols VPN and Firewalls

(1)

Computer Net Lab/Praktikum Datenverarbeitung 2 1

Overview

• VPN

• VPN requirements

• Encryption

• VPN-Types

• Protocols

• VPN and Firewalls

(2)

VPN

-

Definition

• VPNs (Virtual Private Networks) allow secure data transmission over insecure connection.

• VPNs connect computer and/or networks (on various locations) to a common network by use of public communication structures.

(3)

VPN Scheme

LAN LAN Internet _VPN VPN VPN-Tunnel Client Client

(4)

VPN

-

terms

• Virtual, due to the usage of a public communication

infrastructure there is no permanent physical connection but a logical one. If there are some data to transmit then the bandwith is occupied and data is transmitted according the routing

information.

• Private, because only valid users should have access to the network respectively the data. Additionally all data have to be transmitted confidential.

(5)

VPN requirements

• Data security must ensure Confidentiality

Integrity

Authentication

• Quality of Service

Guarantees availability of connectivity Support of all applications

• Additional requirements

Reasonable administration effort Effectiveness and extendibility

(6)

Confidentiality

• means that no unauthorized person, who got illegal access to data, is able to read respectively understand data.

• Is realized by encryption. The data are coded by an encryption algorithm and an encryption key. Only owner of the appropriate decryption key are able to decrypt the coded data.

(7)

Integrity

• means that no data has been changed/manipulated during transmission.

• is realised by checksum of transferred data. By use of a

mathematical function a checksum is build over the data which has to be transmitted. This checksum is unique. The checksum together with the data is sent to the recipient.

(8)

A

Authentication

• means that a recipient of a message is able to ensure that he got the message from the right person and not from a person who pretend to be the right one.

• is realized by use of digital signatures. Digital signatures are like a „normal“ signature in a document which unambiguously

(9)

Symmetric Encryption

• Each communication partner has the same key

• N (N-1) keys, for N communication partner which communicate pair wise

• High effort for Key maintenance

• Key length with 128 Bit are said to be sure, typical values 40,56,128

• Fast Method

(10)

Asymmetric Encryption

• Distinction between private (my) and public keys (for others) • Communication with N participants means N public keys • Key length higher than symetric keys

typical length: 512,1024,2048

• Slower than symmetric encryption • Example: PGP, RSA

(11)

Tunnel

• Tunneling means the embedding of a complete data package (header and payload) within the payload segment of an other protocol in the same protocol level.

Advantage: Data can be coded/encrypted

Orig IP Hdr TCP Hdr Data New IP Hdr Orig IP Hdr TCP Hdr Data

(12)

End

-to

-

to-

-

End Constellation

Computer 1

Internet

(13)

End

-to

-

to-

-

Site Constellation

mobile computer VPN Gateway Internet ISP ISP Di al-up Dial-u_p mobile computer Intranet

(14)

Site

-

to-

to

-Site Constellation

Site Constellation

VPN Gateway 1 Internet VPN Gateway 2 Intranet 1 Intranet 2

(15)

VPN

-Types

-

Types

Application-Layer encryption Network-Layer encryption Application-level (Layer 5-7) Transport-/ network level (Layer 3-4) Link-/ physical level (Layer 1-2) Link-Layer encryption Link-Layer encryption

(16)

VPN and ISO/OSI Layer

SSH, Kerberos, Virusscans, Content Screening, IPSEC (IKE)…

Application Transport

Network Link

SSL, Socks V5, TLS IPSEC (AH, ESP), Paket Filtering, NAT Tunneling Protocols (L2TP, PPTP, L2F), CHAP, PAP,…

(17)

PPTP

-

Protocol

• Point To Point Tunneling, widespread because simple • Layer-2 Protocol

• Only user authentification => Security = Password • Set up of communication:

1. PPP connection with user –Authentification 2. Link and control (TCP Port 1723)

3. Tunnel: _HeaderIP- GRE (IP 47) _Header _HeaderPPP PPP Payload

IP-Adresses Client+Server, => NAT and dynam. IP-Adresses ok

opt. with MPPE (RC4) encrypted

(18)

PPTP

(19)

IPSec

1

• Internet Protocol Security is a protocol family • Allows encryption and integrity check

– integrity check (Authentication Header Protocol):

– encryption (Encapsulating Security Payload Protocol):

• Open for enhancements, encryption method is not fixed

– Authentification: Diffie-Hellmann key exchange – confidentiality: Triple,-DES, IDEA, Blowfish

– Integrity by use of Hash building: MD5 und SHA

• Two mode of operation modes

– Tunnel mode protects address information and payload – Transport mode protects only payload

(20)

IPSec

AH

AH allows only check of integrity

Orig IP Hdr TCP Hdr Data

Original packet: Tunnel

mode: New IP Hdr AH Header Orig IP Hdr TCP Hdr Data

Transport

(21)

IPSec

ESP

ESP allows encryption

Original packet: _{Orig IP Hdr}

ESP Hdr Orig ESP Trailer ESP Auth New IP Hdr

TCP Hdr Data

Tunnel mode: Transport

(22)

VPN and Firewall

• Idea of the Firewall

The Firewall is the only connection to the Internet. All other computers (even the VPN-Gateway) are located behind the Firewall.

• Problem

The firewall ist not able to analyze the data because they are encrypted.

(23)

VPN behind Firewall

Internet Firewall VPN-Gateway VPN Client VPN LAN (branch office) LAN (center) decrypted Data

(24)

VPN and Firewall together

Internet Firewall and VPN-Gateway VPN Client decrypted Daten LAN (branch office) LAN (center) VPN

(25)

VPN Gateway in DMZ

Internet VPN client VPN LAN (branch office) Internet LAN (center) VPN-Gateway DMZ

inner Firewall outer Firewall

decrypted Daten

(26)

NAT

• Nat = Network Adress Translation

• Allows through mapping the assignment of official IP-Addresses to private one. Therefore it is possible to gain access to the

internet with private IP-Addresses.

Internet Sender-IP 192.168.0.10 Sender-IP 192.168.0.10 New Sender-IP 134.91.90.70 New Sender-IP 134.91.90.70 Webbrowser NAT New Target-IP 192.168.0.10 New Target-IP 192.168.0.10 Target-IP 134.91.90.70 Target-IP 134.91.90.70

(27)

IP

• It carries the transport protocols TCP and UDP.

• It builds IP-Packages out of the data which have to be transmitted.

• It adds additional information, the IP-Header. It contains source and destination address.

(28)

TCP

• TCP (Transmission Control Protocol) confirms every received data package.

• TCP repeats each data package until its receiving is confirmed. • TCP is reliable, that means the transmission is guaranteed.

(29)

IP

-

Forwarding

VPN Gateway

IP-Forwarding IP-Paket with

Target: 134.91.90.70 private, local Net Firewall IP-Paket with target: 192.168.1.1 Port 1723 or Gre-Protocol 47

(30)

VPN

-

Practical training

Internet private, local net Firewall private, local net Firewall VPN-Gateway VPN-Gateway =Tunnel