Internet Protocol Security (IPSec) Comprehensive Overview

The Security Problem in Modern Networking

• Today's Internet is primarily comprised of public, un-trusted, and unreliable IP networks.
• Because of an inherent lack of security, the Internet is subject to various types of threats:
  • Data integrity: The contents of a packet can be accidentally or deliberately modified during transit.
  • Identity spoofing: The origin of an IP packet can be forged to impersonate another entity.
  • Anti-reply attacks: Unauthorized data can be retransmitted to exploit the system.
  • Loss of privacy: The contents of a packet can be examined by unauthorized parties while in transit.

Understanding TCP/IP and the OSI Reference Model

• The OSI Reference Model consists of the following layers:
  • Application Layer
  • Presentation Layer
  • Session Layer
  • Transport Layer
  • Network Layer
  • Logical Link Layer
  • Physical Layer
• Protocol and Service mapping within the TCP/IP stack:
  • Application Layer: Supports protocols such as HTTP, SMTP, FTP, SNMP, DNS, and NFS.
  • Transport Layer: Utilizes TCP and UDP.
  • Network Layer: Utilizes the IP protocol.
  • Data Link/Physical Layers: Managed by the Device Driver and Network Adapter.

Encapsulation of Data for Network Delivery

• The process of preparing an application message for network delivery involves multiple layers of encapsulation:
  1. Application Layer: Generates the Original Message.
  2. Transport Layer (TCP, UDP): Adds $Header\,3$ to the original message, creating $Data\,3$.
  3. Network Layer (IP): Adds $Header\,2$ to $Data\,3$, resulting in $Data\,2$.
  4. Data Link Layer: Adds $Header\,1$ to $Data\,2$, resulting in $Data\,1$.
• The final packet sent by Host A includes the Data Link $Header\,1$ and $Data\,1$.
• When an intermediary router receives the packet, it processes the Data Link Layer and Network Layer information.

De-capsulation of Data from Network Delivery

• When Host B receives the packet, it undergoes a de-capsulation process:
  1. Data Link Layer: Receives $Header\,1$ and $Data\,1$, then strips away the Data Link header.
  2. Network Layer (IP): Processes $Header\,2$ and $Data\,2$ before stripping the Network Layer header.
  3. Transport Layer (TCP, UDP): Processes $Header\,3$ and $Data\,3$ before stripping the Transport Layer header.
  4. Application Layer: Receives the Original Message.

Security Implementation at Different Network Layers

• Application Layer Security
  • Examples: PGP, Kerberos, SSH.
  • Implementation: Executed within end-hosts.
  • Advantages:
    • Applications can be extended without involving the operating system.
    • The application can understand the data flow and provide appropriate, context-specific security.
  • Disadvantages:
    • Security mechanisms must be designed independently for every individual application.
• Transport Layer Security (TLS)
  • Implementation: Executed within end-hosts.
  • Advantages:
    • Existing applications receive security benefits seamlessly.
  • Disadvantages:
    • The security is specific to certain protocols.
• Network Layer Security (IPSec)
  • Advantages:
    • Provides seamless security to both application and transport layers, also known as Upper Layer Protocols (ULPs).
    • Allows for per-flow or per-connection security, enabling very fine-grained security control.
  • Disadvantages:
    • It is more difficult to exercise security on a per-user basis when dealing with a multi-user machine.
• Data Link Layer Security
  • Method: Hardware encryption.
  • Requirements: Needs a dedicated link between hosts or routers.
  • Advantages: Very high speed.
  • Disadvantages:
    • Not scalable.
    • Requires dedicated physical or logical links.

IP Security (IPSec) Framework

• IPSec is a framework of open standards developed by the Internet Engineering Task Force (IETF).
• It creates secure, authenticated, and reliable communications over IP networks.
• IPSec Security Services:
  • Connectionless integrity: Provides assurance that the received traffic has not been modified. This service includes anti-reply defenses.
  • Data origin authentication: Provides assurance that the traffic was sent by the legitimate party or parties.
  • Confidentiality (encryption): Provides assurance that user traffic is not examined by non-authorized parties.
  • Access control: Prevention of unauthorized use of a network resource.

IPSec Modes of Operation

• Transport Mode
  • Used to protect the upper layer protocols.
  • Architecture: Host-to-Host connectivity.
  • Packet Structure: The original IP Datagram, containing an IP Header and TCP Header, is modified so that an IPSec Header is inserted between the IP Header and the TCP Header. The packet format is: $IP\,Header$ | $IPSec\,Header$ | $TCP\,Header$ | $Data$.
• Tunnel Mode
  • Used to protect the entire IP payload.
  • Architecture: Host-to-Network or Network-to-Network connectivity involving a Security Gateway (SG).
  • Packet Structure: The entire original IP packet is encapsulated within a new packet. The format is: $New\,IP\,Header$ | $IPSec\,Header$ | $Original\,IP\,Header$ | $TCP\,Header$ | $Data$.

IPSec Security Protocols

• Authentication Header (AH):
  • Provides connectionless integrity.
  • Provides data origin authentication.
  • Provides protection against replay attacks.
• Encapsulating Security Payload (ESP):
  • Provides confidentiality through encryption.
  • Provides connectionless integrity.
  • Provides data origin authentication.
  • Provides protection against reply attacks.
• Both AH and ESP protocols may be used independently or applied in combination with each other.

Outbound and Inbound IPSec Processing

• Processing for inbound and outbound traffic is completely independent.
• Core Components:
  • SPD: Security Policy Database, containing IPSec policies.
  • SAD: Security Association Database.
  • SA: Security Association.
• Outbound IPSec Processing:
  • A packet selector is used to consult the SPD.
  • Three possible outcomes:
    1. Drop the packet.
    2. Bypass IPSec.
    3. Apply IPSec using the appropriate Security Association ($SA_{out}$).
• Inbound IPSec Processing:
  • Case 1: If IPSec headers exist:
    1. Headers are processed.
    2. The SPD is consulted to determine if the packet can be admitted based on the incoming Security Association ($SA_{in}$).
  • Case 2: If IPSec headers are absent:
    1. The SPD is consulted to determine the type of service to afford this packet.
    2. If the SPD indicates that certain traffic is required to be IPSec protected and it is not, the packet must be dropped.

Real World Deployment Examples and Conclusion

• Deployment Scenarios:
  • VPNs (Virtual Private Networks): Using Security Gateways (SG) to create encrypted and authenticated tunnels over the Internet.
  • Wireless: Providing secure connections over wireless Internet infrastructures.
• Key Conclusions:
  • The Internet was not originally created with security in mind.
  • Communications are vulnerable to being altered, examined, and exploited.
  • There is a growing necessity to protect private information as it crosses public network infrastructures.
  • IPSec provides the necessary set of protocols and methodologies to establish secure IP connections.

Questions & Discussion

• Is there any part of the IPSec framework, security services, or modes of operation that requires further clarification?