Scribd
Upload
29 views26 pages

Unit-4 IP Security (IPSec)

IPSec, designed by the IETF, provides security at the network layer, offering authentication, confidentiality, integrity, and key management for data packets. It operates in two modes—Transport and Tunnel—and utilizes two main protocols: the Authentication Header (AH) for integrity and the Encapsulating Security Payload (ESP) for both integrity and privacy. IPSec is applicable over various networks, including LANs and the Internet, and addresses security needs identified in a 1994 report by the Internet Architecture Board.

Uploaded by

Sharmili Nukapeyi N
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
29 views26 pages

Unit-4 IP Security (IPSec)

IPSec, designed by the IETF, provides security at the network layer, offering authentication, confidentiality, integrity, and key management for data packets. It operates in two modes—Transport and Tunnel—and utilizes two main protocols: the Authentication Header (AH) for integrity and the Encapsulating Security Payload (ESP) for both integrity and privacy. IPSec is applicable over various networks, including LANs and the Internet, and addresses security needs identified in a 1994 report by the Internet Architecture Board.

Uploaded by

Sharmili Nukapeyi N
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 26

IP Security (IPSec)

Security at Network Layer


Dr. D N Sharmili

Ref: Cryptography and Network Security


by William Stallings , and Forouzan & Mukhopadhyay
IPSec ids designed by Internet Engineering Task Force (IETF) to
provide security for a packet at the network layer/IP layer.

The network layer determines how messages move across a


network, such as end-to-end movement of data packets using
logical addresses.
IP Security
• IP Security mechanisms provides
– authentication
– Confidentiality
– Integrity
– key management
• Applicable to use over LANs, across public & private WANs, &
for the Internet
• Need identified in 1994 report
– the IAB (the Internet Architecture Board ) included
authentication and encryption as necessary security
features in the next-generation IP, which has been issued as
IPv6
IPSec Services
• Access control
• Connectionless integrity
• Data origin authentication
• Rejection of replayed packets
– a form of partial sequence integrity
• Confidentiality (encryption)
• Limited traffic flow confidentiality
IPSec
• IPSec provides security in three situations:
– Host-to-host, host-to-gateway and
gateway-to- gateway
• IPSec operates in two modes:
– Transport mode (for end-to-end)
– Tunnel mode (for VPN)

IPSec defines two protocols


• The Authentication Header protocol
• Encapsulating Security Payload (ESP) protocol
Transport and Tunnel Modes
• Transport Mode
– to encrypt & optionally authenticate IP data
– good for ESP host to host traffic
• Tunnel Mode
– encrypts entire IP packet
– add new header for next hop
– no routers on way can examine inner IP header
– good for VPNs, gateway to gateway security
IPSec operates in one of two modes
• Transport Mode
• Tunnel Mode
Host –host comm
Gateway sender –gateway dest comm
• Transport node does not protect the IP Header
• It protects the packet received from the transport layer
• The IPSec Header and Trailer are added to the packet coming from
the transport layer
• The IP Header is added later at Network layer
• Sending host uses IPSec to authenticate /encrypt the
payload delivered from the transport layer
• The receiving host uses IPSec to check authentication/decrypt the
IP packet and deliver same to transport layer
Tunnel Mode
• Tunnel mode, IPSec protects the entire packet
• Tunnel mode generally used when either the sender or
the
receiver is not a host.
IPSec defines two protocols
• The Authentication Header protocol –integrity and authentication(32)
• Encapsulating Security Payload (ESP) protocol

The Authentication Header Protocol

fixed

variable
Authentication Header (AH) Protocol
• It provides source authentication and data integrity, but
not
privacy
• It uses a hash function and a symmetric key to create a MD, and
the MD is inserted in the AH
• The AH is then placed in a location based on the mode to send
• AH fields
• Next Header: 8-bit length defines the type of payload carried
by the IP .
• Payload length: 8-bit length. Defines the length of AH
• Security Parameter Index: 32-bit length. Identifier to know the
security association used to send packets.
• Sequence number: 32-bit length. Ordering information to
prevent a playback. Unique number always used even a packet
is retransmitted.
• Authentication data: applying a hash function to entire IP data
packet to create a MD.
Encapsulating Security Payload (ESP) Protocol
• Encapsulating Security Payload (ESP) protocol provides
source
authentication, data integrity, and privacy
• It adds a header and trailer ESP’s authentication data are added at
the end of the packet
• ESP procedure follows
• ESP trailer is added to the payload
• The payload and trailer are encrypted
• ESP header is added
• The ESP header, payload, and ESP trailer are used to create the
authentication data.
• the authentication data are added to the end of the ESP trailer
• The IP header is added after changing the protocol value to 50
The fields of header and trailer are
• Security Parameter Index: 32-bit length. Identifier to know the
security association used to send packets
• Sequence Number: 32-bit length. Ordering information to prevent
a playback. Unique number always used even a packet is
retransmitted.
• Pad length: 8-bit length. defines no. of padding bytes. Value is
between 0 and 255.
• Next header: 8-bit length defines the type of payload carried by
the IP .
ESP Packet Details
ESP Packet Details
• Security Parameters Index (32 bits): Identifies a
security association.
• Sequence Number (32 bits): A monotonically
increasing counter value; this provides an anti-replay
function.
• Payload Data (variable): This is a transport-level
segment (transport mode) or IP packet (tunnel mode)
that is protected by encryption.
• Padding (0–255 bytes): The purpose of this field is to
make the plaintext to a multiple of some number of
bytes.
• Pad Length (8 bits): Indicates the number of pad bytes
immediately preceding this field.
• Next Header (8 bits): Identifies the type of data
contained in the payload data.
• Integrity Check Value (variable): A variable-length
field (must be an integral number of 32-bit words)
that contains the Integrity Check Value computed
over the ESP packet.
Encryption & Authentication
Algorithms & Padding
• ESP can encrypt payload data, padding, pad length, and
next header fields
• ESP can have optional ICV for integrity
– is computed after encryption is performed
• ESP uses padding
– to expand plaintext to required length
– to align pad length and next header fields
IPSec Services

You might also like