IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.76 Use of suitable tunnel protocols for RAS
communication
Initiation responsibility: Head of IT Section, IT Security Management
Team
Implementation responsibility: Administrator
Remote access to a LAN is effected through a data link which is generally
shared with external third parties. Thus, for example, direct dial-in entails use
of the network of the telecommunications provider. If the connection is
established over the Internet, then the data is forwarded over the networks of
the Internet service providers involved (and possibly their partners). Since
logging on of the RAS client to a LAN is effected over a RAS connection, the
network path used for data transmission must be protected so that the security
of the data (confidentiality, integrity, authenticity) is safeguarded. This
protection is achieved through encryption and digital signing of the data
packets exchanged after the communications partners have been authenticated
(see also S 4.34 Using encryption, checksums or digital signatures). In the
RAS environment, various procedures and mechanisms for protecting the
communications link (e.g. tunnelling, see below) have been developed.
The choice of which procedure to use to protect a RAS connection depends on
various factors such as:
- the security requirements regarding the strength of the procedure (for
example, this determines the key lengths),
- the procedures which can be used at protocol level (see below),
- the procedures supported by the RAS hardware and software.
In general, the following applies:
- The RAS product normally offers a selection of standard procedures
supported for the protection of communications. The aim here should be to
have the widest possible range of procedures supported.
- The actual protocols used for data transport also offer security
mechanisms. These can be used by the RAS product. Alternatively, the
RAS product may offer a procedure of its own.
The security mechanisms are based on different cryptographic procedures.
Safeguard S 3.23 contains a brief introduction to basic cryptographic concepts.
Encryption of protocol connections: tunnelling
If an encrypted data connection is established between two communications
partners, then this connection constitutes a "secure channel". Any data can be
securely transmitted over this channel with the underlying communications
protocol (e.g. IP). If the data transmitted is in the form of data packets of a
communications protocol, then the term "tunnel" is used also. The protocol
which is used to encrypt the data, transmit it through the tunnel and manage
the connection is also referred to as tunnel protocol. With tunnel protocols
distinctions can be made as to
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Protection of RAS
communication