Network Programmability for VPN Overlay Construction and Bandwidth Management

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

MPLS technology has recently been widely adopted, not only in large-scale IP backbones, but in metro and enterprise networks as well. Among the merits of MPLS, effective and efficient support of TE (traffic engineering) and VPN (virtual private network) services is the most influential factor that has facilitated the diffusion of the technology. However, although MPLS itself has become a currently operational technology, issues regarding the management of various services that are built on top of individually operating MPLS capable network elements have not been well identified or solved. These service level management issues arise, not only under heterogeneous conditions, but even when the target network is homogeneously composed. The paper discusses the requirements and architectural aspects of an integrated service management system for MPLS TE and VPN services. The discussion encompasses fault and performance management issues and information models which should be flexible to support newer services that can be rendered by merging TE, VPN, and QoS technologies. We also examine performance, fault tolerance, and scalability issues that cannot be neglected when such systems are deployed in a real-world environment.

Global Internet users increasingly rely on virtual private network (VPN) services to preserve their privacy, circumvent censorship, and access geo-filtered content. Due to their own lack of technical sophistication and the opaque nature of VPN clients, however, the vast majority of users have limited means to verify a given VPN service's claims along any of these dimensions. We design an active measurement system to test various infrastructural and privacy aspects of VPN services and evaluate 62 commercial providers. Our results suggest that while commercial VPN services seem, on the whole, less likely to intercept or tamper with user traffic than other, previously studied forms of traffic proxying, many VPNs do leak user traffic---perhaps inadvertently---through a variety of means. We also find that a non-trivial fraction of VPN providers transparently proxy traffic, and many misrepresent the physical location of their vantage points: 5--30% of the vantage points, associated with 10% of the providers we study, appear to be hosted on servers located in countries other than those advertised to users.

With the rapid development of Virtual Private Network (VPN), many companies and organizations use VPN to implement their private communication. Traditionally, VPN uses security protocols to protect the confidentiality of data, the message integrity and the endpoint authentication. One core technique of VPN is tunneling, by which clients can access the internal servers traversing VPN. However, the tunneling technique also introduces a concealed security hole. It is possible that if one vicious user can establish tunneling by the VPN server, he can compromise the internal servers behind the VPN server. So this paper presents a novel Application-layer based Centralized Information Access Control (ACIAC) for VPN to solve this problem. To implement an efficient, flexible and multi-decision access control model, we present two key techniques to ACIAC—the centralized management mechanism and the stream-based access control. Firstly, we implement the information center and the constraints/events center for ACIAC. By the two centers, we can provide an abstract access control mechanism, and the material access control can be decided dynamically by the ACIAC's constraint/event mechanism. Then we logically classify the VPN communication traffic into the access stream and the data stream so that we can tightly couple the features of VPN communication with the access control model. We also provide the design of our ACIAC prototype in this paper.

Virtual Private Network (VPN) is a private network that uses public network to tunnel the connection from the users’ end to the VPN server. VPN allows users to create a secure connection to another network over the public Internet. VPNs can be used to shield users’ browsing activity and encrypts data transmitted over the network to prevent sniffing attack. Nowadays, users can either pay a premium price for a good VPN service or risk their privacy using free browser-based VPN. Thus, SafeSearch is developed to address these issues in mind. With SafeSearch, users will not need to fork out a lot of money for premium VPN subscription services or expose themselves to targeted advertising when utilising free browser-based VPN. In this study, open VPN protocol was used to create the VPN server on a microcomputer called Raspberry Pi. The software used was mostly open-source except for the VPN client. Obfuscation technique was used to hide VPN traffic by disguising it as just another normal Internet traffic against Deep Packet Inspection when passing through firewall. After the VPN server was established, tests were carried out to evaluate the functionality and reliability of the VPN server in “real-world” environment. The tests conducted were network restriction penetration assessment, network performance and user acceptance test. Penetration assessment result showed that SafeSearch is capable of bypassing web filtering and deep packet inspection. Network performance during SafeSearch connection has slight latency and bandwidth decline, although it is not overly affected. The outcome of the user acceptance test was positive as the majority of participants of the study were confident that SafeSearch can secure their connection and protect their privacy when browsing the web. To conclude, both objectives of this project were fully achieved and the scope of study was followed thoroughly.

Virtual private networks (VPNs) enable companies to connect geographically dispersed offices and remote workers via secure links to the private company network, using the public Internet as a backbone. Specially, VPN service in the broadband data communication network is very important and necessary to take in users who want to specify group communication. VPN mechanisms are needed which work over existing deployed backbones, and which can also be migrated to new backbones like MPLS (Multi-Protocol Label Switching). MPLS is the latest step in the evolution of multi-layer switching in the Internet. In this paper, we clarify how MPLS can be applied to creating VPNs. For this, we researched an architectural model for building VPNs in an MPLS domain. The proposed model takes advantage of both network layer peering and packet switching, and link-layer circuit and per-stream switching. It comes with a design scheme and an implementation procedure for VPN services in MPLS systems. Then we describe MPLS-based VPN service procedures and we describe MPLS VPN schemes that must be accommodated with existing network backbones and must also provide for a full range of QoS characteristics.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

In recent times, secure communication protocols over web such as HTTPS (Hypertext Transfer Protocol Secure) are being widely used instead of plain web communication protocols like HTTP (Hypertext Transfer Protocol). HTTPS provides end-to-end encryption between the user and service. Nowadays, organizations use network firewalls and/or intrusion detection and prevention systems (IDPS) to analyze the network traffic to detect and protect against attacks and vulnerabilities. Depending on the size of organization, these devices may differ in their capabilities. Simple network intrusion detection system (NIDS) and firewalls generally have no feature to inspect HTTPS or encrypted traffic, so they rely on unencrypted traffic to manage the encrypted payload of the network. Recent and powerful next-generation firewalls have Secure Sockets Layer (SSL) inspection feature which are expensive and may not be suitable for every organizations. A virtual private network (VPN) is a service which hides real traffic by creating SSL-protected channel between the user and server. Every Internet activity is then performed under the established SSL tunnel. The user inside the network with malicious intent or to hide his activity from the network security administration of the organization may use VPN services. Any VPN service may be used by users to bypass the filters or signatures applied on network security devices. These services may be the source of new virus or worm injected inside the network or a gateway to facilitate information leakage. In this paper, we have proposed a novel approach to detect VPN activity inside the network. The proposed system analyzes the communication between user and the server to analyze and extract features from network, transport, and application layer which are not encrypted and classify the incoming traffic as malicious, i.e., VPN traffic or standard traffic. Network traffic is analyzed and classified using DNS (Domain Name System) packets and HTTPS- (Hypertext Transfer Protocol Secure-) based traffic. Once traffic is classified, the connection based on the server’s IP, TCP port connected, domain name, and server name inside the HTTPS connection is analyzed. This helps in verifying legitimate connection and flags the VPN-based traffic. We worked on top five freely available VPN services and analyzed their traffic patterns; the results show successful detection of the VPN activity performed by the user. We analyzed the activity of five users, using some sort of VPN service in their Internet activity, inside the network. Out of total 729 connections made by different users, 329 connections were classified as legitimate activity, marking 400 remaining connections as VPN-based connections. The proposed system is lightweight enough to keep minimal overhead, both in network and resource utilization and requires no specialized hardware.

The RACE project PRISM (Pan-European Reference Configuration for IBC Services Management) studies management of international telecommunications services in general, and by using case studies as examples. One case study aims at description of selected areas in management of Virtual Private Networks (VPN). It is of vital importance that such management is performed in a secure way. To illustrate the security issues, a scenario has been developed for a customer with high security demands, namely a bank. Requirements and solutions for the bank's use of a VPN service are briefly outlined, while the security of the management of the bank's VPN is discussed in more detail.KeywordsSecurity RequirementVirtual Private NetworkBandwidth RequestSecurity DomainBranch OfficeThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Needs for internetworking private networks over a commonly shared public network have expanded the usage of Virtual Private Networks (VPNs). Customers, through the use of a RFC 4364 VPN, use service provider (SP) backbones to establish private connectivity between geographically disparate networks. As a direct result of SPs migrating towards an Internet Protocol (IP) over a Multi-Protocol Label Switching (MPLS) infrastructure, as observed within the Defense Information Switched Network (DISN) of the Global Information Grid (GIG), SPs have also begun to transition from providing traditional circuit-switched leased permanent virtual circuits through a layer two (L2) protocol (e.g., Asynchronous Transfer Mode (ATM) or Frame Relay (FR) to providing layer three (L3) VPN services. Currently, requirements for securing the GIG control plane traffic are undecided. A potential solution for protecting the GIG control plane includes instantiating Internet Protocol security (IPsec) Encapsulating Security Payload (ESP) Transport Mode across all GIG routers on a router-to-router basis. Although the use of IPsec has been proven to provide effective data confidentiality, data integrity, and authentication to devices operating on the data plane, both routing vendors and SP operators have shared concerns regarding network performance degradation associated with the use of IPsec on the control plane. This paper will investigate the performance implications of applying IPsec ESP Transport Mode to routers participating in 4364 VPNs, given a typical GIG scenario. Testing has been recently completed to determine the impacts of using IPsec protection on 4364 VPNs, specifically in a simulated GIG operating environment.

Recently, there has been rapid development and deployment of virtual private network (VPN) services. There are wide varieties of IP-based VPNs and optical VPNs (OVPNs) proposed in the literature and readers could easily get confused with so many different types of VPNs. The purpose of this paper is to present a comprehensive overview of the VPN and discuss the main issues associated with the design of IP VPN and OVPN. We first present a classification of the VPNs including CE-based, network based, customers provisioned, provider provisioned, connection oriented, connectionless oriented, port based, connection based, layer 1 VPN, layer 2 VPN, and layer 3 VPN, and describe different VPN protocols such as IPSec, GRE and MPLS. We then review the recent work on OVPN by different standard bodies, and outline the key requirements for OVPN service providers and customers. Finally, we describe several OVPN architectures appeared in the literature, highlight the future work in OVPN.

With the worldwide acceptance of the Internet as a de-facto public network, there is great interest in the deployment of Virtual Private Networks (VPNs) across IP networks. VPNs provide an economic alternative to the expensive private leased lines. The main purpose of a VPN is to provide a company secure communication among multiple sites through the shared Internet. The allocation of bandwidth for VPNs to meet the requirements specified by customers is an important traffic engineering research issue. This paper addresses the problem of provisioning VPN services based on pipe and hose workload models over shared network infrastructure with bandwidth guarantees, an issue studied only by different resource allocation methods [1] and not studied before by general optimization methods. The general problem of computing a constrained VPN tree with optimum bandwidth allocation is a hard combinatorial optimization problem [2]. Our proposed optimization method for provisioning VPNs is based on the Simulated Evolution (SE) meta-heuristic originally introduced in [3]. The proposed Evolutionary Algorithm (EA) connects VPN nodes using a tree structure while seeking to optimize the total bandwidth reserved on the edges of the VPN tree. Experimental results with Waxman network graphs [4] show that tree bandwidth costs obtained with hose workloads are higher by a factor of a maximum 2.5 compared to those obtained with pipe workloads.

A virtual private network (VPN) is an overlay network that uses the public network to carry data traffic between corporate sites and users, maintaining privacy through the use of tunnelling protocols and security procedures. In the network-based model, VPN-aware network elements are placed within the network to set up concatenated tunnels between the user/site and enterprise resources to offer intranet VPN and remote access VPN. This paper identifies the important differences between a traditional VPN and the mobile VPN and proposes a hierarchical network architecture to efficiently realize network-based mobile VPNs. We address the problem of optimally provisioning VPN-aware devices, called IP service gateways (IPSGs), in the hierarchical network architecture for mobile VPNs, while taking into account of (1) the cost of links over which VPN tunnels are established, (2) the cost of provisioning a VPN customer on an IPSG, and (3) redundancy in IPSG provisioning for fault tolerance. We develop generic yet powerful problem formulations for different scenarios described above while considering practical requirements of the network elements and business requirements of the VPN service provider. The formulation becomes a set of integer programming problems. We solve several instances of the problem for a few practical cases and discuss their applications in the overall network design.

The largely used of cyberspace has brought the attention of business interposes across the globe in modern era which resulted in numerous security issues. Business enterprises find it difficult to protect and manage resource sharing and data infrastructure effectively. The business enterprises consider Virtual private network (VPN) as a novel development to protect data and information, and to create a VPN connection, it is significant to consider the type of security protocols to use to make VPN more efficient and more powerful. The significant issue in this research is to study the performance of Secure Socket Layer (SSL) in VPN with intrusion detection systems (IDS) on Linux operating system in terms of Quality of Service (QoS) parameters (throughput, latency and packet loss). We also used two different encryption algorithms, Triple Data Encryption Standard (TDES/3DES) and Advance Encryption Standard (AES). Encryption algorithms are used to encrypt data, so it cannot be read or modify by a third-party while in transit between two end points of a network. This research found that when considering throughput, packet loss and latency in network infrastructures, SSL/3DES offers fair and reasonable performance than SSL/AES. VPN protocols with higher throughput have the best performance and VPN protocol the low packet loss has the best performance. The research indicated deploying SSL/3DES is more effective in business enterprises also indicated that IDS could be able to function effectively on both protected traffic packets (VPN packets) and server log files.

Virtual Private Networks (VPN) constitute a particular class of shared networks. In such networks, the resources are shared among several customers. The management of these resources requires a high level of automation to obtain the dynamics necessary for the well-functioning of a VPN. In this paper, we consider the problem of a network operator who owns the physical infrastructure and who wishes to deliver VPN service to his customers. These customers may be Internet Service providers, large corporations and enterprises. We propose a new routing approach referred to as Traffic Split Routing (TSR) which splits the traffic as fairly as possible between the network links. We show that TSR outperforms Shortest Path Routing (SPR) in terms of the number of admitted VPN and in terms of Quality of Service.