Glossary
VPN/DSL Security Option
A-4
24-10618-155 Rev. A
This document contains confidential and proprietary information of Johnson Controls, Inc.
© 2012 Johnson Controls, Inc.
Perfect Forward Secrecy (PFS)
– A method for deriving Phase 2 keys independent from and
unrelated to the preceding keys. Alternatively, the Phase 1 proposal creates the key (the
SKEYID_d key) from which all Phase 2 keys are derived. The SKEYID_d key can generate
Phase 2 keys with a minimum of CPU processing. Unfortunately, if an unauthorized party
gains access to the SKEYID_d key, all your encryption keys are compromised. PFS
addresses this security risk by forcing a new Diffie-Hellman key exchange to occur for each
Phase 2 tunnel. Using PFS is thus more secure, although the re-keying procedure in Phase 2
might take slightly longer with PFS enabled.
Point-to-Point Tunneling Protocol (PPTP)
– PPTP is an extension of the Point-to-Point Protocol
that is used for communication on the Internet. It was developed by Microsoft to support
virtual private networks (VPNs), which allow individuals and organizations to use the
Internet as a secure means of communication. PPTP supports encapsulation of encrypted
packets in secure wrappers that can be transmitted over a TCP/IP connection.
Replay Protection
– A replay attack occurs when somebody intercepts a series of packets and
uses them later either to flood the system, causing a denial-of-service (DoS), or to gain entry
to the trusted network. The replay protection feature enables devices to check every IPSec
packet to see if it has been received before.
Security Association
– An SA is a unidirectional agreement between the VPN participants
regarding the methods and parameters to use in securing a communication channel. For
bidirectional communication, there must be at least two SAs, one for each direction. The
VPN participants negotiate and agree to Phase 1 and Phase 2 SAs during an AutoKey IKE
negotiation. See also
Security Parameters Index.
Security Parameters Index
– (SPI) is a hexadecimal value which uniquely identifies each tunnel.
It also tells the NetScreen device which key to use to decrypt packets.
SHA-1
– Secure Hash Algorithm-1, an algorithm that produces a 160-bit hash from a message
of arbitrary length. (It is generally regarded as more secure than MD5 because of the larger
hashes it produces.)
Tunneling
– A method of data encapsulation. With VPN tunneling, a mobile professional dials
into a local Internet Service Provider’s Point of Presence (POP) instead of dialing directly
into their corporate network. This means that no matter where mobile professionals are
located, they can dial a local Internet Service Provider that supports VPN tunneling
technology and gain access to their corporate network, incurring only the cost of a local
telephone call. When remote users dial into their corporate network using an Internet Service
Provider that supports VPN tunneling, the remote user as well as the organization knows that
it is a secure connection. All remote dial-in users are authenticated by an authenticating
server at the Internet Service Provider’s site and then again by another authenticating server
on the corporate network. This means that only authorized remote users can access their
corporate network, and can access only the hosts that they are authorized to use.
Virtual Private Network (VPN)
– A VPN is an easy, cost-effective and secure way for
corporations to provide telecommuters and mobile professionals local dial-up access to their
corporate network or to another Internet Service Provider (ISP). Secure private connections
over the Internet are more cost-effective than dedicated private lines. VPNs are possible
because of technologies and standards such as tunneling, screening, encryption, and IPSec.
Содержание P2000
Страница 2: ......
