Evaluating the Impact of Latency in a Virtual Private Network Performance Using Different Encryption Algorithm and Hashing

Due to increased inspection of internet traffic and the pervasive surveillance practices put in place by many organizations, virtual private networks (VPNs) are now frequently used to safeguard online privacy and circumvent censorship. However, existing VPN protocols are susceptible to methods of detection and blockage employed by network administrators, internet service providers, and in certain cases, governments. Stealth protocols and proxying techniques have therefore been presented as potential means of hiding VPN activity and avoiding discovery. Therefore, the purpose of this work is to assess how well stealth protocols and proxying work to hide the use of VPNs using a thorough experimental setup (i.e., evaluate how well-known stealth VPN protocols like Obfsproxy, Shadowsocks, and WireGuard perform against different detection techniques like deep packet inspection (DPI)). Furthermore, examine the effects of using proxy servers in conjunction with VPN connections in order to further obfuscate traffic signatures and improve privacy. The results center on how well various stealth protocols and proxying techniques defy detection attempts, offering insightful information to VPN users and developers. Thus, the outcomes help strengthen censorship resistance and online particularity in keeping pace with the development of monitoring technology. Also, analyze the efficiency of Obfsproxy, Shadowsocks, and WireGuard to provide comprehensive comparisons of current capabilities and potential enhancements. Finally, a discussion for future VPN design is conducted, focusing on the importance of adaptability in keeping secure communication channels among increasingly sophisticated surveillance measures. Received: 18 June 2024 | Revised: 2 August 2024 | Accepted: 20 August 2024 Conflicts of Interest The authors declare that they have no conflicts of interest in this work. Data Availability Statement Data available on request from the corresponding author upon reasonable request. Author Contribution Statement Mohammad Shehab: Conceptualization, Methodology, Validation, Investigation, Resources, Data curation, Writing – original draft, Writing – review & editing, Visualization, Supervision, Project administration. Lial Raja Alzabin: Conceptualization, Methodology, Formal analysis, Resources, Writing – review & editing, Visualization.

In an era marked by technological advancement, the rising reliance on Virtual Private Networks (VPNs) necessitates sophisticated forensic analysis techniques to investigate VPN traffic, especially in mobile environments. This research introduces an innovative approach utilizing Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs) for classifying VPN traffic, aiding forensic investigators in precisely identifying applications or websites accessed via VPN connections. By leveraging the combined strengths of CNNs and GNNs, our method provides an effective solution for discerning user activities during VPN sessions. Further extending this framework, we incorporate blockchain technology to meticulously record all mobile VPN transactions, ensuring a tamper-proof and transparent ledger that significantly bolsters the integrity and admissibility of forensic evidence in legal scenarios. A specific use-case demonstrates this methodology in mobile forensics, where our integrated approach not only accurately classifies data traffic but also securely logs transactional details on the blockchain, offering an unprecedented level of detail and reliability in forensic investigations. Extensive real-world VPN dataset experiments validate our approach, highlighting its potential to achieve high accuracy and offering invaluable insights for both technological and legal domains in the context of mobile VPN usage.

Chapter 59 - Virtual Private Networks

The largely used of cyberspace has brought the attention of business interposes across the globe in modern era which resulted in numerous security issues. Business enterprises find it difficult to protect and manage resource sharing and data infrastructure effectively. The business enterprises consider Virtual private network (VPN) as a novel development to protect data and information, and to create a VPN connection, it is significant to consider the type of security protocols to use to make VPN more efficient and more powerful. The significant issue in this research is to study the performance of Secure Socket Layer (SSL) in VPN with intrusion detection systems (IDS) on Linux operating system in terms of Quality of Service (QoS) parameters (throughput, latency and packet loss). We also used two different encryption algorithms, Triple Data Encryption Standard (TDES/3DES) and Advance Encryption Standard (AES). Encryption algorithms are used to encrypt data, so it cannot be read or modify by a third-party while in transit between two end points of a network. This research found that when considering throughput, packet loss and latency in network infrastructures, SSL/3DES offers fair and reasonable performance than SSL/AES. VPN protocols with higher throughput have the best performance and VPN protocol the low packet loss has the best performance. The research indicated deploying SSL/3DES is more effective in business enterprises also indicated that IDS could be able to function effectively on both protected traffic packets (VPN packets) and server log files.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

This paper discusses some modes of signal transmission for corporate systems using the technology of virtual private networks VPN. A very important property of tunnels is the ability to differentiate different types of traffic and assign them the necessary service priorities. In this work, research has been carried out and comparative characteristics of signal transmission modes using virtual networks have been obtained to identify the effectiveness of the network in various modes of organizing a virtual network, and to optimize a virtual network in order to identify an effective method for organizing a VPN. Also, the work analyzes the specifics of the work of corporate information systems and networks intended for their maintenance, showed that for building a corporate network it is advisable to use virtual private network (VPN) technology, which makes it possible to ensure the fulfillment of the basic requirements for the security and quality of customer service and applications and the current state and direction of development of VPN technology when creating new generation corporate networks, while highlighting the main tasks that need to be addressed when creating a network. Some features of setting up an IPSec VPN server for corporate networks are considered.

Recently, a fast and secure hash function SFHA - 256 has been proposed and claimed as more secure and as having a better performance than the SHA - 256. In this paper an improved version of SFHA - 256 is proposed and analyzed using two parameters, namely the avalanche effect and uniform deviation. The experimental results and further analysis ensures the performance of the newly proposed and improved SFHA-256. From the analysis it can be concluded that the newly proposed algorithm is more secure, efficient, and practical.

The meaning of security is to protect something important from not authorized peoples. Cryptography is one of the security systems. Many applications could be used in the security systems like military applications, email, banking, information technology of database. The proposed system uses advanced encryption standard(AES) with secure hash algorithms(SHA-1) to produce a strong ciphertext. Moreover, this paper make the combination of (SHA-1) which is a one way encryption, as a key with (AES) algorithm which is a two way encryption as a ciphering generator to obtain confidentiality and integrity, In this paper presented implementation of Advanced Encryption Standard (AES) and Secure Hash (SHA-1) Algorithm by the use of FPGA Hardware card, However implementation of the AES algorithm and SHA-1 using LABVIEW environment with MATLAB system generator to generate stream data to FPGA hardware target. The output of the hash function is used as an input key for AES in order to improve data security, From the algorithms result of AES and SHA-1 obtained in FPGA, the system obtained how it is simple in modeling hashing and AES algorithms, generating hash codes and plain texts in (small and capital letters), symbols and numbers. The FPGA card used in this system (Spartan 3AN)with frequency (50%), the complete system take (1,147)size from the available space of (11,776) and accuracy (90%),the system work properly.

In this paper, a chaotic image encryption algorithm is suggested combining with double chaotic maps, SHA‐3 (Secure Hash Algorithm‐3), and auto‐updating system. To shuffle pixel positions, a matrix having same size of the plain‐image is generated dependent on the plain‐image in stage of permutation. Then, SHA‐3 is taken to calculate its hash values used to produce control parameter and initial condition of Logistic map. After that, total permutation is implemented for row and column to exchange pixels, where auto‐updating systems are established by different images acting like one‐time pad. Furthermore, 3D chaotic cat map is employed to enlarge key space in diffusion process. Permuted image is firstly divided into four sub‐blocks, which are queued randomly according to the key of Logistic map. The last sub‐block is picked out to calculate the hash values using SHA‐3, of which are assigned into three groups to update the initial conditions of 3D chaotic cat map performing like one‐time pad again. Current sub‐block is designed to influence next sub‐block in diffusion process. As a result, the proposed algorithm can resist efficiently the chosen‐plaintext and known‐plaintext attacks. Experimental results are also given to explain the high security of the proposed method. Copyright © 2016 John Wiley & Sons, Ltd.

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

Virtual private networks (VPN) and link sharing are cost-effective ways of realizing corporate intranets. Corporate intranets will increasingly have to provide integrated services for voice and multimedia traffic. Although packet scheduling algorithms can be used to implement integrated services in link sharing and virtual private networks, their statistical multiplexing gains are limited. We propose a new scheme called stochastic fair sharing (SFS) to carry out fair link sharing and fair sharing among virtual leased links (VLL). In the link sharing environment, capacities allocated to different classes are adjusted dynamically as sessions arrive (or depart). The SFS admission control algorithm decides which sessions to accept and which to reject depending upon the current utilizations and provisioned capacities of the classes. SFS gives protection to classes with low session arrival rate against classes with high session arrival rates by ensuring them a low blocking probability. In the case of multi-hop VLL, capacity resizing requests are sent in the service providers's network which are admission-controlled using SFS. Our simulations indicate that using SFS, the equivalent capacity of virtual links converge to their max-min fair capacity, with a fairness index of 0.97 in extreme situations. The average signaling load of the protocol was found to be reasonable. The scheme is simple to implement, efficient, and robust. The potential applications of SFS are fair and efficient resource sharing in telecommunication networks, ATM networks, virtual private networks (VPN) and integrated services or differentiated services-based IP networks.

Hose-model virtual private networks (VPNs) provide customers with more flexibility in specifying bandwidth requirements than pipe-model VPNs. Many hose-model VPN provisioning algorithms have been proposed, and they focus on the bandwidth efficiency in the construction of a single hose-model VPN. In practice, however, VPNs come and go and the dynamics will affect the performance of these VPN provisioning algorithms. If the frequency of adding and deleting VPNs is high, these algorithms will have a scalability problem. We propose in this paper a new network architecture for dynamic VPN construction. In the proposed architecture, adding a new VPN is much simpler and faster, and all that is required is to check if the edge routers have enough bandwidth. There is no need to check the bandwidth left on each internal link because the architecture guarantees that as long as the edge routers have enough capacities to accept the VPN, the internal links will never experience overflow caused by adding the new VPN. We present a linear programming formulation for finding the optimal routing that maximizes the amount of admissible VPN traffic in the network. We then exploit the underlying network flow structure and convert the linear programming problem into a subgradient iterative search problem. The resulting solution is significantly faster than the linear programming approach.

The idea of using a low-cost public network such as the Internet to build a private network is intriguing. In this article, we will focus on virtual private networks (VPNs), which leverage the Internet to provide cost-effective, secure communications. We will discuss the challenges of implementing VPNs based on the Internet Engineering Task Force (IETF) Internet protocol security (IPSec) standards. We will cover various aspects including encryption, authentication, Internet key exchange (IKE), and public key infrastructure (PKI) as they relate to IPSec-based VPNs. We will discuss the major issues facing enterprises, service providers, and end-users in implementing intranets, extranets, and remote access VPNs. We will elaborate by discussing how the Lucent VPN firewall handles the various issues and scenarios described here, and how customers in implementing robust VPNs, use it in practice. We also will touch on other VPN solutions and product architectures, and briefly mention other Lucent VPN products. In closing, we will discuss future VPN challenges, including the impact of Internet protocol version 6 (IPv6).3

A distributed resource management model for Virtual Private Networks: Tit-for-Tat strategies

Virtual Private Network, Its ‘Virtual', Its ‘Private' and it's a ‘Network'. A virtual private network (VPN) provides a secure connection between a sender and a receiver over a public non-secure network such as the Internet. A secure connection is generally associated with private networks. (A private network is a network that is owned, or at least controlled via leased lines, by an organization.). We can define a VPN by the following relationship: VPN = Tunneling + Security + QoS Parameters. This Chapter deals with Advantages of VPNs, Types of VPNs, VPN Architectures, VPN Models, VPN Devices, Technologies and Protocols Used to Enable Remote Access VPNs.