Virtual vpn in the cloud

3
 
IPS
EC 
VPN
 
A
SSOCIATIONS
 
This chapter explains in detail what the IPSec protocol suite consists of, its features and 
functionalities, followed by the various key distribution mechanisms that can be adopted for 
deployment in the cloud and the different VPN architectures suitable for implementation in 
the cloud.
3.1
 
IPSec 
IPSec is a protocol suite for securing Internet Protocol communications by authenticating 
and encrypting each IP packet in a communication session [20]. Encapsulation Security 
Payload, Authentication Header and Internet Key Exchange are the main IPSec protocols 
used to provide security services. Based on the architectural requirements, IPSec is 
implemented either on gateway routers or end-hosts.
3.1.1
 
IPSec Features 
Following are the features exhibited by IPSec [21]: 
•
Authentication
and 
Confidentiality
is provided by encrypting the packets, 
which when passed over the Internet are in the form of cipher text. Thus eaves 
dropping by any unknown third party sources renders meaningless since the 
data-carrying payload is unidentifiable. 
•
Data Integrity 
verifies that no bit has been modified or manipulated in transit 
across the end gateways. 
•
Anti Replay
ensures IP-packet level security by making it impossible for a third 
party source to intercept message packets and insert changed packets into the 
data stream between the end-to-end gateways.
So an IPSec VPN can be leveraged across the Internet to keep the transmitted data 
safe and secure. 
3.1.2
 
IPSec Functionality 
Traffic sourcing from particular subnet to be transmitted to the destination subnet, 
instead of only forwarding, the packets are encrypted converted to cipher text and 
encapsulated. Internet observes packets being transmitted from the router 1 to router 2, 
whereas packets are being transmitted across the 2 different subnets located on either side of 
the VPN gateways. (For instance, Any traffic sourcing from 10.1.0.0 network to be 
transmitted to the destination network of 10.2.0.0 is observed by the Internet to be 
transmitted from 192.168.0.1 to 192.168.0.2, which are the global address of the VPN 
gateways enables across the ends). The packet payload is completely encrypted not 
understandable to eavesdroppers, which is decrypted at the other end and forwarded to the 
specified destination.