Hack Security Pro.pdf - Index of

7.VPN
What is a Virtual Private Network?
Company networks are for the most part physical: all computer resources are physically articulated
around a local network in a same place. Using such a network means having to be physically close to
the access points that we wish to reach. This is a major restriction when information must transit over
long distances.
A network extension is often done by using Internet resources. It is however not technologically
possible to trust machines relaying information on the Internet. To make sure that the network remains
private, even if it follows public paths, there are software solutions using secure protocols, essentially.
As the communicating entities are not assembled in a same location, the network is said to be “virtual”.
So a VPN is more than a well-defined technical solution.
What services for a VPN?
Using secure services such as SSH, is within the elaboration of a VPN. Generally speaking, though, it
is actually necessary to secure not just one service, but all services, whatever they may be.
So we directly secure packets of common communication protocols (IP and protocols of associated
data transport). The security of a VPN means controlling the following points:
IPSec
– confidentiality of data (cryptography)
– integrity of data (checksums)
– authentication of entities (cryptographic signatures)
IPSec can secure Ipv4 and Ipv6 packets. IPSec is based on security rules called SA, as in Security
Associations. These rules are grouped in an SPD (Security Policy Database).
IPSec is flexible and modular. It is implemented in different ways according to the needs of the
association rules. It guarantees the integrity of a packet (AH method based on MD5 or SHA-1) and its
confidentiality through encrypting (ESP method based on RSA), or both. The negotiation protocol of
keys for the cryptographic aspect of IPSec is called IKE.
As the entries in SPD are static, IPSec is an efficient protocol for communications between machines
with fixed IPs (to link two local networks of companies via Internet through two gateways, for example).
There are two communication modes for IPSec: transport and tunnel. In transport zone, only
transported data is secured (IPSec headers are placed just after the IP header). In tunnel mode, IPSec
generally takes charge of the IP header as data to cover (IPSec is placed before the IP header, and
adds another one behind it).
The Hackademy DMP -205/209- SYSDREAM