}
10.3 IPSec
With the development of network safety standards and protocols, various VPN
technologies have emerged. IPSec VPN is one of the most widely used VPN security
technologies today.
IPSec is a set of open standards and protocols to implement network secure
communication, which provides two security mechanisms: encryption and
authentication. Encryption mechanism is used to ensure data confidentiality; and
authentication mechanism is used to ensure that data is from the claimed sender and
not destroyed or tampered during transmission.
10.3.1.1 Abbreviations and Terminology
IPSec (IP Security): IPSec consists of a set of services and protocols developed by
the IETF. It provides various types of protection, including authentication, integrity, and
confidentiality, to support secure exchange of packets at the IP layer over the Internet.
IKE (Internet Key Exchange): IKE is a hybrid protocol that provides utility services for
IPSec: authentication of the IPSec endpoints, negotiation and creation of IKE and
IPSec security associations, and establishment of keys for encryption algorithms used
by IPSec.
DES (Data Encryption Standard): DES is a data encryption algorithm supported by
IPSec. DES uses a 56-bit key to encrypt and decrypt the packets, ensuring
high-performance encryption.
3DES (Triple Data Encryption Standard):
3DES is a data encryption algorithm
supported by IPSec. As a variant of the 56-bit DES, 3DES effectively doubles
encryption strength over 56-bit DES.
AES (Advanced Encryption Standard): AES is a data encryption algorithm supported
by IPSec. In comparison with DES and 3DES, AES is safer and more efficient.
DH (Diffie-Hellman): DH is a public key cryptography protocol. It allows two endpoints
to establish a shared secret key dynamically over an insecure network channel. DH is
used in IKE to establish session keys which are used by encryption algorithms, such
as DES, 3DES, AES or MD5.
MD5 (Message Digest 5):
MD5
is a hash algorithm that produces a 128-bit hash (also
called message digest or digital signature) from a message of arbitrary length. The
hash is used to verify data origin authentication and data integrity.
SHA-1 (Secure Hash Algorithm 1):
SHA-1 is a hash algorithm produces a 160-bit
hash (also called message digest or digital signature) from a message of arbitrary
length. As SHA-1 can produce a larger hash, it is considered cryptographically
stronger than MD5.
SA (Security Association): The concept of a
Security Association
(
SA
) is
fundamental to
IPSec
. An SA is a relationship between two IPSec endpoints that
describes how the endpoints will use security services to communicate. Each SA
