Glossary
Multi-Tech RouteFinder RF650VPN User Guide
236
Rules
– The configuration settings used to set how packets are filtered. The rules are set with the
network and service definitions set up in the Definitions directory. When setting packet filter rules, the
two basic types of security policies are:
1. All packets are allowed through – the rules setup must be informed explicitly what is forbidden.
2. All packets are blocked – the rules setup needs information about which packets to let through.
This lets you explicitly define which packets may pass through the filter. All other packets are
blocked and can be displayed for viewing. See also "Filtering".
SA (Security Association)
– A unidirectional connection created for security purposes. All traffic
traversing an SA is provided the same security processing. In IPSec, an SA is an internet layer
abstraction implemented via the use of an AH or ESP. It contains data controlling how a transformation is
applied to an IP packet. The data is determined using specially-defined SA management mechanisms.
The data may be the result of an automated SA and key negotiation or it may be defined manually. The
SA is defined in IETF RFC 2401.
SCP (Secure copy)
– The main purpose of SCP is the safe copying of files between local and remote
computers. The RouteFinder supports login using SCP. A Windows SCP client can be downloaded from
http://winscp.vse.cz/eng/
. WinSCP is freeware SCP client for Windows 95/98/2000/NT using SSH
(Secure shell). WinSCP manages some other actions with files beyond the basic file copying function.
Secret Key
– The key used both for encryption and decryption in secret-key cryptography.
Secure Channel
– A communication medium that is safe from the threat of eavesdroppers.
Seed
– A random bit sequence used to generate another, usually longer, pseudo-random bit sequence.
Security Policy
– Enterprises should have a carefully-planned set of statements in place regarding
network protection. A good corporate Internet security policy should define acceptable use, acceptable
means of remote access, information types and required encryption levels, firewall hardware and software
management processes and procedures, non-standard access guidelines, and a policy for adding new
equipment to the network. New security protocols, new services, and security software upgrades should
also be considered.
The purpose of a security policy is to define how an organization is going to protect itself. The policy will
generally require two parts: a general policy and specific rules (system specific policy). The general policy
sets the overall approach to security. The rules define what is and what is not allowed. The security policy
describes how data is protected, which traffic is allowed or denied, and who is able to use the network
resources.
Server
– A server is a device on the network that provides mostly standardised services (e.g., www, FTP,
news, etc.). To be able to use these services, you as a user require the comparable client requirements
for the desired service.
SHA (Secure Hash Algorithm)
– A United States government standard for a strong one-way, hash
algorithm that produces a 160-bit digest. See MD5. SHA-1 is defined in FIPS PUB 180-1.
SHA-1 (Secure Hash Algorithm version one)
– The algorithm designed by NSA, and is part of the U.S.
Digital Signature Standard (DSS).
S-HTTP (Secure HTTP)
– The IETF RFC that describes a syntax for securing messages sent using the
Hypertext Transfer Protocol (HTTP), which forms the basis for the World Wide Web.
Secure HTTP (S-HTTP) provides independently applicable security services for transaction
confidentiality, authenticity/integrity and non-repudiability of origin. The protocol emphasizes maximum
flexibility in choice of key management mechanisms, security policies and cryptographic algorithms by
supporting option negotiation between parties for each transaction. The current IETF RFC describes S-
HTTP version 1.2. Previous versions of S-HTTP numbered 1.0 and 1.1 have also been released as
Internet-Drafts.
SNAT (Source NAT)
– A functionality equivalent to DNAT, except that the source addresses of the IP
packets are converted instead of the target address. This can be helpful in more complex situations (e.g.,
for diverting reply packets of connections to other networks or hosts). In contrast to Masquerading, SNAT
