.NET Security: IPSec vs. SSL

The rapid advancement of digital communication technologies has increased the need for secure remote access within corporate environments.This study develops and implements a secure network architecture for PT Tanjungenim Lestari Pulp & Paper using Virtual Private Network (VPN) mechanisms based on Internet Protocol Security (IPsec) and Secure Socket Layer (SSL).The existing network, which utilizes a star topology and file-sharing mechanisms, was found to lack sufficient security, particularly in protecting data transmission to external partner companies.The proposed system integrates IPsecbased VPN tunneling to ensure encrypted communication channels and SSL certificates to safeguard FTP authentication processes.Data were collected through action research and document studies, followed by network design, IP addressing, router configuration, VPN deployment, FTP server installation (VSFTPD), and file transfer testing.The results demonstrate successful establishment of secure tunnels, encrypted data exchange, and protection against credential interception during authentication.This study concludes that implementing IPsec VPN and SSL-secured FTP significantly enhances remote access security, maintains data confidentiality, and strengthens the overall network infrastructure of PT Tanjungenim Lestari Pulp & Paper.

Since the Internet of Things (IoT) will be entwined with everything we use in our daily life, the consequence of security flaws escalates. Smart objects will govern most of the home appliances and car engines yielding potential disaster scenarios. In this context, successful attacks could lead to chaos and scary scenarios (www.darkreading.com). Unprotected personal information may expose sensitive and embarrassing data to the public and attacks may threaten not only our computers and smart devices, but our intimacy and perhaps our lives too. Because persons and objects will be bonded with each other, user consent becomes critical. Therefore, thing, object, and user Identity will be the focus of future IoT security solutions, yielding a Trust, Security, and Privacy (TSP) paradigm, which may constitute the Achilles' heel of IoT. While security issues are quite straightforward, mainly from background knowledge, privacy issues are far more complex. Privacy constitutes a rather challenging task, even for the m...

Chapter 59 - Virtual Private Networks

The Secure Sockets Layer (SSL) protocol and its standards-track successor, the Transport Layer Security (TLS) protocol, were developed more than a decade ago and have generally withstood scrutiny in that the protocols themselves haven't been found to have security flaws. Marsh Ray and Steve Dispensa discovered a design flaw in the TLS protocol that affects all versions of the protocol up to and including the current version.Whereas the vulnerability itself is serious, it need not affect many deployments once administrators apply suitable patches to disable renegotiation, leaving TLS sufficiently secure in most cases because exploiting the vulnerability requires the attacker to be an active man-in-themiddle, redirecting traffic between victims (for example, a browser and a Web server). However, because security problems only ever get worse, a change to the protocol is required. The vulnerability is an interesting attack in itself, but perhaps more interesting is the question, why didn't we see this earlier? In this article, the author explore this question but, unfortunately, can't answer it. Hopefully, simply asking the question might prompt developers to re-examine assumptions they've forgotten they've even made.

The unprecedented increase in web-based services and digital systems has prompted the dire need for secure information transmission all over the global networks. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols form the basis of web communication that will provide confidentiality, authenticity, and integrity of data communication between different systems. In this work, we have critically compared and contrasted Transport Layer Security (TLS) and Secure Socket Layer (SSL), considering their design architectures, cryptographic mechanisms, and operational performance in modern applications. We took advantage of recent literature, global best practices, and international standards such as IETF RFC 8446 (TLS 1.3) and NIST SP 800-52 Rev.2 to evaluate security capability, vulnerabilities, and the strategies for migrations. TLS 1.3 is now the basic standard due to its enhanced efficiency, lower latency of handshake, and better encryption through AEAD (Authenticated Encryption with Associated Data) algorithms; however, compatibility with legacy systems and inconsistencies in configuration pose serious challenges. We concluded by recommending the best practices for developers, system architects, and cybersecurity professionals to build robust, standards-compliant web applications

Transport Layer Security (TLS) is a secure communication protocol that is used in many secure electronic applications. In order to establish a TLS connection, a client and server engage in a handshake, which usually involves the transmission of digital certificates. In this paper we present a practical speedup of TLS handshakes over bandwidth-constrained, high-latency (i.e. disadvantaged) links by reducing the communication overhead associated with the transmission of digital certificates. This speedup is achieved by deploying two specialized TLS proxies across such links. Working in tandem, one proxy replaces certificate data in packets being sent across the disadvantaged link with a short reference, while the proxy on the other side of the link restores the certificate data in the packet. Local or remote caches supply the certificate data. Our solution preserves the end-to-end security of TLS and is designed to be transparent to third-party applications, and will thus facilitate rapid deployment by removing the need to modify existing installations of TLS clients and TLS servers. Testing shows that this technique can reduce the overall bandwidth used during a handshake by 50% in test emulation and by over 20% of TLS session volume in practice. In addition, it can reduce the time required to establish a secure channel by over 40% across Iridium, a widely used satellite link in practice.

In-network middleboxes are vital for the Internet-of-Things (IoT) system security, but the widely adopted transport layer security (TLS) protocol blinds application-level middleboxes due to the encryption of traffic data. To resolve this problem, many solutions have been proposed to date. Among them, SplitTLS is widely adopted in the industry by proxy manufacturers. It requires TLS client to install customized root certificates and incurs additional security flaws, e.g., disabling server authentication and using weak cipher suites. Another approach is to customize the TLS protocol where middleboxes are enabled via either performing handshake directly with TLS endpoints or receiving session key materials in an out-of-band manner. Overall, current solutions would either jeopardize the original TLS handshake procedure or incur additional overheads on the endpoints. In this article, we design a new middlebox-enhanced TLS (ME-TLS), which enables endpoints to introduce authenticated middleboxes into a TLS session while control middleboxes' access permission and processing order of traffic data. Particularly, in our proposed ME-TLS, the handshake structure of TLS keeps unchanged and middleboxes work in a passive manner. That is, middleboxes in the ME-TLS could recover session key materials by monitoring handshake messages passively instead of interacting with endpoints; secondary secure channels for key transmission are also not needed in our ME-TLS. We implement our ME-TLS based on the TLS 1.3 protocol and evaluate its performances. The experimental results demonstrate that our proposal is practical and deployable for real-world IoT scenarios.

System security is the most important aspect in an information system, weak system security increases the risk of attacks that can cause system damage. One of the attacks that often occurs is an attack on a web server, this is because the web server is connected to the internet network and is accessed by many users widely, so the risk of attack increases. For example, the New Student Admission web site of Universitas Muhammadiyah Bengkulu, which manages data on prospective new students who have registered themselves. So that a web server security system is needed to avoid potential attacks and to increase data security. One method of securing a web server is by using the Secure Socket Layer (SSL). SSL is often used to secure communication between client and server. The stages carried out in this study are scanning web servers that have not used SSL and those that have used SSL. This research aims to determine the security of web servers and anticipate various potential attacks on web servers.

To provide secure content delivery, Transport Layer Security (TLS) has become a de facto standard over a couple of decades. However, TLS has a long history of security weaknesses and drawbacks. Thus, the security of TLS has been enhanced by addressing security problems through continuous version upgrades. Meanwhile, to provide fast content delivery globally, websites (or origin web servers) need to deploy and administer many machines in globally distributed environments. They often delegate the management of machines to web hosting services or content delivery networks (CDNs), where the security configurations of distributed servers may vary spatially depending on the managing entities or locations. Based on these spatial differences in TLS security, we find that the security level of TLS connections (and their web services) can be lowered. After collecting the information of (web) domains that exhibit different TLS versions and cryptographic options depending on clients' locations, we show that it is possible to redirect TLS handshake messages to weak TLS servers, which both the origin server and the client may not be aware of. We investigate 7M domains with these spatial differences of security levels in the wild and conduct the analyses to better understand the root causes of this phenomenon. We also measure redirection delays at various locations in the world to see whether there are noticeable delays in redirections.

By design, TLS (Transport Layer Security) is a 2-party, end-to-end protocol. Yet, in practice, TLS delegation is often deployed: that is, middlebox proxies inspect and even modify TLS traffic between the endpoints. Recently, industry-leaders (e.g., Akamai, Cloudflare, Telefonica, Ericcson), standardization bodies (e.g., IETF, ETSI), and academic researchers have proposed numerous ways of achieving safer TLS delegation. We present LURK the LURK (Limited Use of Remote Keys) extension for TLS 1.2, a suite of designs for TLS delegation, where the TLS-server is aware of the middlebox. We implement and test LURK. We also cryptographically prove and formally verify, in Proverif, the security of LURK. Finally, we comprehensively analyze how our designs balance (provable) security and competitive performance.

With more and more security threat events happened aiming at financial web services, there is an increasing amount of transactions performed over the Internet. As a de-facto standard the security protocol SSL (Secure Sockets Layer) or TLS (Transport Layer Security) is used to create a secure connection to web services. This paper analyze the weakness of the SSL and TLS protocols, based on which, we designed and implemented a root-kit for network based SSL and TLS traffic decrypt ion , which is called SSL-DP. With the experiment of SSL-DP we can see that SSL/TLS protocol is not secure enough to protect the important network information such as E-commerce etc.

Today, Hash-based Message Authentication Code with Secure Hash Algorithm 2 (HMAC-SHA2) is widely used in modern protocols, such as in Internet Protocol Security (IPSec) and Transport Layer Security (TLS). Many authors proposed their HMAC-SHA2 hardware implementations. Some targeted a high-performance design, while others aimed to satisfy an area constraint. Those implementations are acceptable for applications that require only low-cost or high throughput. However, some applications, such as Software-Defined Networking (SDN), Internet-of-Thing (IoT), and Wireless Sensor Network (WSN), need an efficient design that can satisfy both merits. In this paper, an FPGA implementation is proposed that can operate on multiple HMAC-SHA2 variants without re-synthesize. The proposed architecture achieves high performance with a low-cost area. The experimental results show that it can run up to 380-MHz, more than 4.8 Giga-bit-per-second (Gbps), with fewer resources compared to other similar designs.

This paper analyses the TLS Handshake protocol in a progressive manner, by gradually building the protocol's messages and message fields. Messages constituting the TLS protocol are described by Casper, a compiler for the analysis of security protocols. FDR, a model checking tool is then used to test whether the protocol achieves its goals. It has been shown that TLS achieves its security goals for the systems tested. By using this progressive approach of the TLS Handshake analysis, this paper identifies the importance of each message and message field to the overall achievement of the security goal of the TLS protocol. The study also shows that the TLS protocol contains much redundancy. A few important points that show how TLS has been carefully designed to thwart some attacks that have appeared in many of the previous security protocols are also emphasized.

Satellites are expected to play an increasingly important role in providing broadband Internet services over long distances in an efficient manner. Most future networks will be hybrid in nature - having terrestrial nodes interconnected by satellite links. Security is an important concern in such networks, since the satellite segment is susceptible to a host of attacks, including eavesdropping, session hijacking and data corruption. In this article we address the issue of securing communication in satellite networks. We discuss various security attacks that are possible in hybrid satellite networks, and survey the different solutions proposed to secure data communications in these networks. We look at the performance problems arising in hybrid networks due to security additions like Internet security protocol (IPSec) or secure socket layer (SSL), and suggest solutions to performance-related problems. We also point out important drawbacks in the proposed solutions, and suggest a hierarchical key-management approach for adding data security to group communication in hybrid networks.

SSL (Secure Sockets Layer) protocol and IPSec (Internet Protocol Security) are widely used for identity authentication and communication protection. However, both protocols suffer from intrusion and single-point of compromising as well as DDoS (distributed denial of service) attacks. An innovative Intrusion-Resilient, DDoS-Resistant Authentication System (IDAS) System is proposed to achieve the following goals:(1) An intrusion-resilient authentication protocol will be able to protect credential information by distributing shared secret to multiple computers and thus eliminates the single point of compromising.(2) This protocol can readily detect the use of partial credential as a user/computer and indicate which part of secret is exposed; consequently, the compromised computer can be recovered.(3) Even when an insider compromised all related servers, the credential is only valid for a short period of time and will be self healed in next period.(4) A DDoS resistant protocol must be stateless and efficient as well as stop botnet attacks and low and slow attacks.(5) This authentication protocol only takes a single round trip time, which is faster than any other authentication protocols and is important to the performance of critical applications in a multi-continent network.It is difficult to prove the capabilities of IDAS by actually implementing a full scale botnet due to financial constraint. Instead, simulation results are reported in this paper to show that this IDAS protocol can resist DDoS attacks even when thousands of attackers, which is about the same size as the current botnet, are bombarding it. A user will not even sense the extra delay due to the DDoS attacks; thus, the collateral damage is eliminated.