Chapter 5 - Defining a VPN

Chapter 59 - Virtual Private Networks

Needs for internetworking private networks over a commonly shared public network have expanded the usage of Virtual Private Networks (VPNs). Customers, through the use of a RFC 4364 VPN, use service provider (SP) backbones to establish private connectivity between geographically disparate networks. As a direct result of SPs migrating towards an Internet Protocol (IP) over a Multi-Protocol Label Switching (MPLS) infrastructure, as observed within the Defense Information Switched Network (DISN) of the Global Information Grid (GIG), SPs have also begun to transition from providing traditional circuit-switched leased permanent virtual circuits through a layer two (L2) protocol (e.g., Asynchronous Transfer Mode (ATM) or Frame Relay (FR) to providing layer three (L3) VPN services. Currently, requirements for securing the GIG control plane traffic are undecided. A potential solution for protecting the GIG control plane includes instantiating Internet Protocol security (IPsec) Encapsulating Security Payload (ESP) Transport Mode across all GIG routers on a router-to-router basis. Although the use of IPsec has been proven to provide effective data confidentiality, data integrity, and authentication to devices operating on the data plane, both routing vendors and SP operators have shared concerns regarding network performance degradation associated with the use of IPsec on the control plane. This paper will investigate the performance implications of applying IPsec ESP Transport Mode to routers participating in 4364 VPNs, given a typical GIG scenario. Testing has been recently completed to determine the impacts of using IPsec protection on 4364 VPNs, specifically in a simulated GIG operating environment.

The rapid advancement of digital communication technologies has increased the need for secure remote access within corporate environments.This study develops and implements a secure network architecture for PT Tanjungenim Lestari Pulp & Paper using Virtual Private Network (VPN) mechanisms based on Internet Protocol Security (IPsec) and Secure Socket Layer (SSL).The existing network, which utilizes a star topology and file-sharing mechanisms, was found to lack sufficient security, particularly in protecting data transmission to external partner companies.The proposed system integrates IPsecbased VPN tunneling to ensure encrypted communication channels and SSL certificates to safeguard FTP authentication processes.Data were collected through action research and document studies, followed by network design, IP addressing, router configuration, VPN deployment, FTP server installation (VSFTPD), and file transfer testing.The results demonstrate successful establishment of secure tunnels, encrypted data exchange, and protection against credential interception during authentication.This study concludes that implementing IPsec VPN and SSL-secured FTP significantly enhances remote access security, maintains data confidentiality, and strengthens the overall network infrastructure of PT Tanjungenim Lestari Pulp & Paper.

Virtual Private Network, Its ‘Virtual', Its ‘Private' and it's a ‘Network'. A virtual private network (VPN) provides a secure connection between a sender and a receiver over a public non-secure network such as the Internet. A secure connection is generally associated with private networks. (A private network is a network that is owned, or at least controlled via leased lines, by an organization.). We can define a VPN by the following relationship: VPN = Tunneling + Security + QoS Parameters. This Chapter deals with Advantages of VPNs, Types of VPNs, VPN Architectures, VPN Models, VPN Devices, Technologies and Protocols Used to Enable Remote Access VPNs.

Chapter 6 - Deciding on a VPN

The idea of using a low-cost public network such as the Internet to build a private network is intriguing. In this article, we will focus on virtual private networks (VPNs), which leverage the Internet to provide cost-effective, secure communications. We will discuss the challenges of implementing VPNs based on the Internet Engineering Task Force (IETF) Internet protocol security (IPSec) standards. We will cover various aspects including encryption, authentication, Internet key exchange (IKE), and public key infrastructure (PKI) as they relate to IPSec-based VPNs. We will discuss the major issues facing enterprises, service providers, and end-users in implementing intranets, extranets, and remote access VPNs. We will elaborate by discussing how the Lucent VPN firewall handles the various issues and scenarios described here, and how customers in implementing robust VPNs, use it in practice. We also will touch on other VPN solutions and product architectures, and briefly mention other Lucent VPN products. In closing, we will discuss future VPN challenges, including the impact of Internet protocol version 6 (IPv6).3

In recent times, secure communication protocols over web such as HTTPS (Hypertext Transfer Protocol Secure) are being widely used instead of plain web communication protocols like HTTP (Hypertext Transfer Protocol). HTTPS provides end-to-end encryption between the user and service. Nowadays, organizations use network firewalls and/or intrusion detection and prevention systems (IDPS) to analyze the network traffic to detect and protect against attacks and vulnerabilities. Depending on the size of organization, these devices may differ in their capabilities. Simple network intrusion detection system (NIDS) and firewalls generally have no feature to inspect HTTPS or encrypted traffic, so they rely on unencrypted traffic to manage the encrypted payload of the network. Recent and powerful next-generation firewalls have Secure Sockets Layer (SSL) inspection feature which are expensive and may not be suitable for every organizations. A virtual private network (VPN) is a service which hides real traffic by creating SSL-protected channel between the user and server. Every Internet activity is then performed under the established SSL tunnel. The user inside the network with malicious intent or to hide his activity from the network security administration of the organization may use VPN services. Any VPN service may be used by users to bypass the filters or signatures applied on network security devices. These services may be the source of new virus or worm injected inside the network or a gateway to facilitate information leakage. In this paper, we have proposed a novel approach to detect VPN activity inside the network. The proposed system analyzes the communication between user and the server to analyze and extract features from network, transport, and application layer which are not encrypted and classify the incoming traffic as malicious, i.e., VPN traffic or standard traffic. Network traffic is analyzed and classified using DNS (Domain Name System) packets and HTTPS- (Hypertext Transfer Protocol Secure-) based traffic. Once traffic is classified, the connection based on the server’s IP, TCP port connected, domain name, and server name inside the HTTPS connection is analyzed. This helps in verifying legitimate connection and flags the VPN-based traffic. We worked on top five freely available VPN services and analyzed their traffic patterns; the results show successful detection of the VPN activity performed by the user. We analyzed the activity of five users, using some sort of VPN service in their Internet activity, inside the network. Out of total 729 connections made by different users, 329 connections were classified as legitimate activity, marking 400 remaining connections as VPN-based connections. The proposed system is lightweight enough to keep minimal overhead, both in network and resource utilization and requires no specialized hardware.

The largely used of cyberspace has brought the attention of business interposes across the globe in modern era which resulted in numerous security issues. Business enterprises find it difficult to protect and manage resource sharing and data infrastructure effectively. The business enterprises consider Virtual private network (VPN) as a novel development to protect data and information, and to create a VPN connection, it is significant to consider the type of security protocols to use to make VPN more efficient and more powerful. The significant issue in this research is to study the performance of Secure Socket Layer (SSL) in VPN with intrusion detection systems (IDS) on Linux operating system in terms of Quality of Service (QoS) parameters (throughput, latency and packet loss). We also used two different encryption algorithms, Triple Data Encryption Standard (TDES/3DES) and Advance Encryption Standard (AES). Encryption algorithms are used to encrypt data, so it cannot be read or modify by a third-party while in transit between two end points of a network. This research found that when considering throughput, packet loss and latency in network infrastructures, SSL/3DES offers fair and reasonable performance than SSL/AES. VPN protocols with higher throughput have the best performance and VPN protocol the low packet loss has the best performance. The research indicated deploying SSL/3DES is more effective in business enterprises also indicated that IDS could be able to function effectively on both protected traffic packets (VPN packets) and server log files.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

Hose-model virtual private networks (VPNs) provide customers with more flexibility in specifying bandwidth requirements than pipe-model VPNs. Many hose-model VPN provisioning algorithms have been proposed, and they focus on the bandwidth efficiency in the construction of a single hose-model VPN. In practice, however, VPNs come and go and the dynamics will affect the performance of these VPN provisioning algorithms. If the frequency of adding and deleting VPNs is high, these algorithms will have a scalability problem. We propose in this paper a new network architecture for dynamic VPN construction. In the proposed architecture, adding a new VPN is much simpler and faster, and all that is required is to check if the edge routers have enough bandwidth. There is no need to check the bandwidth left on each internal link because the architecture guarantees that as long as the edge routers have enough capacities to accept the VPN, the internal links will never experience overflow caused by adding the new VPN. We present a linear programming formulation for finding the optimal routing that maximizes the amount of admissible VPN traffic in the network. We then exploit the underlying network flow structure and convert the linear programming problem into a subgradient iterative search problem. The resulting solution is significantly faster than the linear programming approach.

With the worldwide acceptance of the Internet as a de-facto public network, there is great interest in the deployment of Virtual Private Networks (VPNs) across IP networks. VPNs provide an economic alternative to the expensive private leased lines. The main purpose of a VPN is to provide a company secure communication among multiple sites through the shared Internet. The allocation of bandwidth for VPNs to meet the requirements specified by customers is an important traffic engineering research issue. This paper addresses the problem of provisioning VPN services based on pipe and hose workload models over shared network infrastructure with bandwidth guarantees, an issue studied only by different resource allocation methods [1] and not studied before by general optimization methods. The general problem of computing a constrained VPN tree with optimum bandwidth allocation is a hard combinatorial optimization problem [2]. Our proposed optimization method for provisioning VPNs is based on the Simulated Evolution (SE) meta-heuristic originally introduced in [3]. The proposed Evolutionary Algorithm (EA) connects VPN nodes using a tree structure while seeking to optimize the total bandwidth reserved on the edges of the VPN tree. Experimental results with Waxman network graphs [4] show that tree bandwidth costs obtained with hose workloads are higher by a factor of a maximum 2.5 compared to those obtained with pipe workloads.

A virtual private network (VPN) is an overlay network that uses the public network to carry data traffic between corporate sites and users, maintaining privacy through the use of tunnelling protocols and security procedures. In the network-based model, VPN-aware network elements are placed within the network to set up concatenated tunnels between the user/site and enterprise resources to offer intranet VPN and remote access VPN. This paper identifies the important differences between a traditional VPN and the mobile VPN and proposes a hierarchical network architecture to efficiently realize network-based mobile VPNs. We address the problem of optimally provisioning VPN-aware devices, called IP service gateways (IPSGs), in the hierarchical network architecture for mobile VPNs, while taking into account of (1) the cost of links over which VPN tunnels are established, (2) the cost of provisioning a VPN customer on an IPSG, and (3) redundancy in IPSG provisioning for fault tolerance. We develop generic yet powerful problem formulations for different scenarios described above while considering practical requirements of the network elements and business requirements of the VPN service provider. The formulation becomes a set of integer programming problems. We solve several instances of the problem for a few practical cases and discuss their applications in the overall network design.

With the rapid development of Virtual Private Network (VPN), many companies and organizations use VPN to implement their private communication. Traditionally, VPN uses security protocols to protect the confidentiality of data, the message integrity and the endpoint authentication. One core technique of VPN is tunneling, by which clients can access the internal servers traversing VPN. However, the tunneling technique also introduces a concealed security hole. It is possible that if one vicious user can establish tunneling by the VPN server, he can compromise the internal servers behind the VPN server. So this paper presents a novel Application-layer based Centralized Information Access Control (ACIAC) for VPN to solve this problem. To implement an efficient, flexible and multi-decision access control model, we present two key techniques to ACIAC—the centralized management mechanism and the stream-based access control. Firstly, we implement the information center and the constraints/events center for ACIAC. By the two centers, we can provide an abstract access control mechanism, and the material access control can be decided dynamically by the ACIAC's constraint/event mechanism. Then we logically classify the VPN communication traffic into the access stream and the data stream so that we can tightly couple the features of VPN communication with the access control model. We also provide the design of our ACIAC prototype in this paper.

This paper discusses some modes of signal transmission for corporate systems using the technology of virtual private networks VPN. A very important property of tunnels is the ability to differentiate different types of traffic and assign them the necessary service priorities. In this work, research has been carried out and comparative characteristics of signal transmission modes using virtual networks have been obtained to identify the effectiveness of the network in various modes of organizing a virtual network, and to optimize a virtual network in order to identify an effective method for organizing a VPN. Also, the work analyzes the specifics of the work of corporate information systems and networks intended for their maintenance, showed that for building a corporate network it is advisable to use virtual private network (VPN) technology, which makes it possible to ensure the fulfillment of the basic requirements for the security and quality of customer service and applications and the current state and direction of development of VPN technology when creating new generation corporate networks, while highlighting the main tasks that need to be addressed when creating a network. Some features of setting up an IPSec VPN server for corporate networks are considered.