Ipsec

IPSecurity (IPSec)
Devashree Kute 1906073

Hindavi Lande 1906077
What is IP security (IPSec) ?
◦ IPSecurity (IPSec) is a collection of protocols designed by the Internet Engineering Task Force
(IETF) to provide security for a packet at the network level. IPSec helps to create authenticated and
confidential packets for the IP layer.
2
IPSecurity Services :
• Access control
• Connectionless integrity
• Data origin authentication
• Rejection of replayed packets (a form of partial sequence integrity)
• Confidentiality (encryption)
• Limited traffic flow confidentiality

Applications of IPSecurity
IPsec can be used to do the following things:
◦ Secure remote internet access
◦ To Set up communication with other organizations
◦ Secure branch office connectivity
4
Two Modes of IPSecurity
◦ IPSec operates in two modes: Transport mode and Tunnel mode.
5
Transport Mode
◦ IPSec in transport mode does not protect the IP header; it only protects the information
coming from the transport layer.
6
Tunnel Mode
◦ In tunnel mode, IPSec protects the entire IP packet. It takes an IP packet,
including the header, applies IPSec security methods to the entire packet, and
then adds a new IP header.
◦ IPSec in tunnel mode protects the original IP header.
7
DIFFERENCE BETWEEN TWO
MODES
8
Two Security Protocols
IPSec defines two protocols –
◦ Authentication Header (AH) Protocol
◦ Encapsulating Security Payload (ESP) Protocol
to provide authentication and/or encryption for packets at the IP level. (1035)
9
Authentication Header (AH)
◦ The Authentication Header (AH) Protocol is designed to authenticate the

source host and to ensure the integrity of the payload carried in the IP
packet.
◦ AH (Authentication Header) Protocol provides both Authentication and

Integrity service. Authentication Header is implemented in one way only:
Authentication along with Integrity.
◦ The protocol uses a hash function and a symmetric key to create a

message digest; the digest is inserted in the authentication header.
◦ The AH is then placed in the appropriate location based on the mode

(transport or tunnel). 10
Authentication Header (AH) Protocol in
transport mode
11
◦ Next header - The 8-bit next-header field defines the type of payload carried
by the IP datagram (such as TCP, UDP, ICMP, or OSPF).
◦ Payload length - it defines the length of the authentication header in 4-byte

multiples, but it does not include the first 8 bytes.
◦ Security parameter index. The 32-bit security parameter index (SPI) field
plays the role of a virtual-circuit identifier and is the same for all packets sent
during a connection called a security association
◦ Sequence number. A 32-bit sequence number provides ordering information

for a sequence of datagrams. Range ( 0 – 2^32)
◦ Authentication data. Finally, the authentication data field is the result of

applying a hash function to the entire IP datagram except for the fields that are
changed during transit (e.g., time-to-live)
12
The AH Protocol provides source authentication and
data integrity, but not privacy. It does not protect data’s
confidentiality.
13
Encapsulating Security Payload (ESP)
◦ ESP (Encapsulation Security Payload) provides source authentication,

integrity, and privacy or confidentiality service.
◦ Encapsulation Security Payload is implemented in either two ways:
 ESP with optional Authentication.

 ESP with Authentication.
14
Encapsulating Security Payload (ESP) Protocol in
transport mode
15
◦ Security parameter index
◦ Sequence number
◦ Padding - This variable-length field (0 to 255 bytes) of Os serves as padding.
◦ Pad length - The 8-bit pad length field defines the number of padding bytes.
Range ( 0 -255)
◦ Next header
◦ Authentication data
◦ the authentication data field is the result of applying an authentication scheme

to parts of the datagram. In AH, part of the IP header is included in the
calculation of the authentication data; in ESP, it is not.
16
ESP provides source authentication, data integrity, and
confidentiality privacy.
17
Security Association
• Security Association (SA) form the basis of Internet Protocol Security (IPSec).
• A Security Association (SA) is a simplex (one-way channel) and logical

connection that provides relationship between two or more systems to build a
unique secure connection. A Security Association (SA) can be viewed as an
agreement between two devices about how to protect information during
transit.
• Security Association is a relationship exists between two entities that are

communicating with each other.
• This relationship describes that how the existing security services should be
utilized in a way that the entities can communicate securely. 18
Security Association
• A security association consists of features like traffic encryption key,

cryptographic algorithm and mode, and also parameters required for the
network data.
• With the help of the defined IPsec protocols, SAs offer data protection for
unidirectional traffic.
• Set of instructions – has to followed by each entity involved in communication

so that secure communication can be established.
19
Important parameters related to security Association are:
• Security Parameter Index (SPI) – to uniquely identify a particular security

association. (Identifier parameter).
• Security Protocol Identifier (AH / ESP) – to identify the used protocol
• Sequence number counter (0 – 2^32 -1)
• AH Information (Authentication algorithms, Keys) – all info related to AH

implementation.
• ESP Information
• Life time of SA (generate - initiate – terminate) - certain Life time which is

been followed for a Security Association (SA).
• IPSec Protocol Mode (Tunnel/ Transport)

20
Thanks !

Ipsec

Uploaded by

Copyright:

Available Formats

Ipsec

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ipsec

Uploaded by

Copyright:

Available Formats

IPSecurity (IPSec)

Devashree Kute 1906073

• Data origin authentication

• Rejection of replayed packets (a form of partial sequence integrity)

• Limited traffic flow confidentiality

◦ Secure remote internet access

◦ To Set up communication with other organizations

◦ Secure branch office connectivity

IPSec defines two protocols –

◦ Authentication Header (AH) Protocol

◦ Encapsulating Security Payload (ESP) Protocol

to provide authentication and/or encryption for packets at the IP level. (1035)

◦ The Authentication Header (AH) Protocol is designed to authenticate the

◦ AH (Authentication Header) Protocol provides both Authentication and

◦ The protocol uses a hash function and a symmetric key to create a

◦ The AH is then placed in the appropriate location based on the mode

◦ Payload length - it defines the length of the authentication header in 4-byte

◦ Sequence number. A 32-bit sequence number provides ordering information

◦ Authentication data. Finally, the authentication data field is the result of

◦ ESP (Encapsulation Security Payload) provides source authentication,

◦ Encapsulation Security Payload is implemented in either two ways:

 ESP with optional Authentication.

◦ Padding - This variable-length field (0 to 255 bytes) of Os serves as padding.

◦ the authentication data field is the result of applying an authentication scheme

• A Security Association (SA) is a simplex (one-way channel) and logical

• Security Association is a relationship exists between two entities that are

• A security association consists of features like traffic encryption key,

• Set of instructions – has to followed by each entity involved in communication

• Security Parameter Index (SPI) – to uniquely identify a particular security

• Security Protocol Identifier (AH / ESP) – to identify the used protocol

• Sequence number counter (0 – 2^32 -1)

• AH Information (Authentication algorithms, Keys) – all info related to AH

• Life time of SA (generate - initiate – terminate) - certain Life time which is

• IPSec Protocol Mode (Tunnel/ Transport)

You might also like