1. 1 Network Layer Security Howie Weiss (NASA/JPL/Cobham Analytic Solutions) Mike Pajevski (NASA/JPL) October 2010

2. 2 Agenda IPSec Profile for CCSDS

3. 3 What is Network Layer Security? SCPS-NPIP Space Link Subnet: CCSDS Data Link SCPS-SP Other Apps IPSec UDPTCP SCPS-FP TCPOptionsTCPOptions FTP FTPFeaturesFTPFeatures Space extensions to the Socket Interface Common Network- Layer Interface SCPS-TP “TCP Tranquility” options The CCSDS protocol suite supports either “native” or “space enhanced” Internet services, at the discretion of the Project organization Space-optimized IP variant Space-optimized IPSec variant Space extensions to FTP

4. 4 IPSec: one protocol, many options Tunnel mode vs. transport mode Default cipher suite (encryption + auth + mode) – Authenticated encryption? – Null encryption (authentication-only)? » ESP w/null encrypt or AH? – What would be allowed? Anti-replay option Keying and rekeying – Pre-placed keys? – IKE auto rekey » Automatic when keys expire – regardless of mission state? » Rekey “now” button?

5. 5 Approach: Issues to be resolved Define transport vs. tunnel mode – Eliminate the one not to be used Define default cipher suite(s) Authenticated Encryption or Encryption w/o auth allowed? ESP-only? AH-only? Authentication-only w/o encryption allowed? Keying and rekeying questions – Automated vs. manual

6. 6 Summary Look at the IPSec options: – Determine what needs to be kept – Determine what can be eliminated Determine ciphers Determine keying strategy