Virtual Private Networks What is a Virtual Private Network (VPN)? How do VPNs work? How is security achieved? How secure is a VPN? What sort of VPN is right for your application? 30-Nov-18 Jeff Rupp CS691

VPN: What is it VPNs provide a means to have access to an internal network from a remote location via the Internet They are called ‘Virtual’ since the data is still traveling through the public network, but both the data and the header can be encrypted 30-Nov-18 Jeff Rupp CS691

How do VPNs work VPNs consist of a gateway to the internal network and any number of remote clients The gateway is the machine to which the clients connect The gateway provides the server side encryption/decryption and user authentication 30-Nov-18 Jeff Rupp CS691

How VPNs Work The most common standard in use today is IPSec as established by the Internet Engineering Task Force (IETF) IPSec allows for 2 modes of operation: Transport: only the packet data is encrypted, the header is in the clear Tunnel: both header and data are encrypted 30-Nov-18 Jeff Rupp CS691

Security The first step in a VPN session is authentication, where the user and host authenticate each other via X.509, LDAP The next step is to establish a key typically using the Diffie/Hellman protocol (public/private keys) Packets are encrypted with this shared secret key, as public/private key cryptography is slower than secret key The secret key may be changed may times during a single VPN session. 30-Nov-18 Jeff Rupp CS691

Security IPSec does not dictate the encryption algorithm that is used Most common is Triple DES apply DES 3 times with unique keys each time Some vendors have their own proprietary algorithm These vendors would be worth avoiding, since if their algorithm is ever broken, then your system may be compromised 30-Nov-18 Jeff Rupp CS691

Speed The limiting factor in the speed of a VPN system is the complexity of the encryption/decryption. A software only solution provides acceptable bandwidth for 1-2 clients Speed is dependent on the platform, and other loads on the VPN gateway Large scale VPNs require a hardware solution, called a VPN Appliance These appliances range in speed from 20Mbit - 200Mbit 30-Nov-18 Jeff Rupp CS691

Choosing a VPN All VPNs provide a software solution for the client, so the only hardware piece needs to be the gateway If your system will support more than 2 simultaneous clients then a VPN appliance is the best choice If you restrict the VPN gateway’s duties to VPN (not firewall, etc) then a software server side solution is acceptable for 1-2 simultaneous clients 30-Nov-18 Jeff Rupp CS691

References G2 Firewall Solutions Brief http://www.securecomputing.com Mar 05, 2003 Virtual Private Network Consortium http://www.vpnc.org/vpn-standards.html Windows 2000 Step-by-Step Guid to Internet Protocol Security (IPSec) http://www.microsoft.com/windows2000/techinfo/planning/security/ipsecsteps.asp Scott, Charlie; Wolfe, Paul; Erwin, Mike Virtual Private Networks, Second Edition O’Reilly & Associates, Inc 1999 Network World, Inc., 2002 Product database from 10/28/2002 30-Nov-18 Jeff Rupp CS691