Encapsulating Security Payload Research Articles

Towards Maximising Hardware Resources and Design Efficiency via High-Speed Implementation of HMAC based on SHA-256 Design

Some applications, such as Message Authentication Code (MAC), rely on different hashing operations. There are various hash functions, including Message-Digest 5 (MD5), RACE Integrity Primitives Evaluation Message Digest 160 (RIPEMD-160), Secure Hash Algorithm 1 (SHA-1), and Secure Hash Algorithm 256 (SHA-256), among others. The network layer is the third of seven layers of the Open Systems Interconnection (OSI) concept, also known as the Internet. It handles network addressing and physical data routing. Nowadays, enhanced internet security is necessary to safeguard networks from illegal surveillance. As a result, Internet Protocol Security (IPsec) introduces secure communication across the Internet by encrypting and/or authenticating network traffic at the IP level. IPsec is an internet-based security protocol. Encapsulating Security Payload (ESP) and Authentication Header (AH) protocols are separated into two protocols. The MAC value is stored in the authentication data files of the Authentication Header and Encapsulating Security Payload. This article analyses a fast implementation of the Hash-based Message Authentication Code (HMAC), which uses its algorithm to ensure the validity and integrity of data to optimise hardware efficiency and design efficacy using the SHA-256 algorithm. During data transfer, HMAC is critical for message authentication. It was successfully developed using Verilog Hardware Description Language (HDL) code with the implementation of a Field Programmable Gate Array (FPGA) device using the Altera Quartus II Computer-Aided Design (CAD) tool to enhance the maximum frequency of the design. The accuracy of the HMAC design, which is based on the SHA-256 design, was examined and confirmed using ModelSim. The results indicate that the maximum frequency of the HMAC-SHA-256 design is approximately 195.16 MHz.

Implementation of Site to Site IPsec VPN Tunnel between Routers

Today, security is very important in the communication system over through the Internet. The Transmission control protocol and Internet protocol (TCP/IP) protocol suite is used in the Internet communication that it includes five layers in which it is construct IPSec VPN Tunnel between two routers at the network layer. IPsec have two protocols that it is authentication header and encapsulation security payload (ESP) in which two protocols is shown simulation and then it is give encryption, authentication and confidentiality in which for packets at the IPSec layer within network layer and adds new IP header at the network layer. IPSec is designed to provide security at the network layer that it protects the entire IP packets. It takes an IP packet and then it includes the header, applies IPSec security methods to the entire packet and adds a new IP header. The system purpose is known use router devices at the network layer and then this layer is built IPSec VPN tunnel between routers that when it is known how does command line. IPsec VPN tunnel is built based on ACL (access list), crypto isakmp (internet security association and key management protocol) policy, transform set and crypto map and then the system is aimed to know it facts configuration and then to know used routers at the network layer and is built IPSec VPN tunnel between two routers. This system is simulated using packets tracer software 7.1.

ОСНОВНЫЕ ЭТАПЫ РАЗВИТИЯ КРИПТОГРАФИЧЕСКИХ ПРОТОКОЛОВ SSL/TLS И IPsec

The paper discusses the main stages of development of cryptographic protocols from SSL 2.0 (Secure Socket Layer) to TLS 1.3 (Transport Layer Security), which ensure the protection of transport layer data in the OSI model. A brief description of the modification of the RuTLS protocol based on TLS 1.3 and their main differences is given. The development of IPsec, which provides cryptographic protection of communications at the network level of the OSI model, is considered using examples of the development of the three most commonly used protocols. These include IKE (Internet Key Exchange), AH (Authentication Header), and ESP (Encapsulation Security Payload). For the SSL/TLS and IPsec specifications, the basic handshake protocols and the main stages of their development are considered. The described handshakes include primary cryptographic information exchange cycles in the form of identifiers of interaction participants, one-time numbers, lists of supported cryptographic combinations. Authentication of participants based on certificates, shared symmetric keys, data exchange for establishing a shared Diffie — Hellman secret, development of key material for secret keys of communication sessions, message authentication, and other cryptographic parameters are presented. For different versions of SSL/TLS and IPsec, the logical structures of application data cryptographic protection functions are described.

Securing VPN from insider and outsider bandwidth flooding attack

Globalization is the order of the day. Linking globally dispersed corporate offices and securing the data transferred between them is a critical activity. Virtual Private Network (VPN) is a viable and low cost option. VPN is cost effective as the Internet is its backbone. In addition to security, corporate needs uninterrupted and guaranteed service. Internet Protocol Security (IPSec) VPN can live up to their expectations by having reserved bandwidth. IPSec VPN provides confidentiality, availability and integrity. However it does not protect the network from spoofed packet attacks. These attacks target the bandwidth allocated to VPN and degrade the performance of the VPN. Bandwidth Flooding attack on VPN represents a major threat. In this paper we focus on making the reserved bandwidth available fully to the legitimate VPN users. Source end protection architecture is proposed to maximize the utilization of the reserved bandwidth by protecting VPN sites from insider and outsider attacks. The protection from insider attack is based on a probability based rate limiting model. The protection from outsider attack is based on an Access Token Embedded Encapsulating Security Payload (ATEESP) header. We analyze the effectiveness of our proposed architecture through simulation.

A research on the impact of encryption algorithms on the quality of VPN tunnels’ transmission

The following article presents the results on the impact of encryption algorithms and the cryptographic hash function on the QoS (Quality of Service) transmission in a computer network. A network model supporting data encryption using the AES algorithm and the MD5 and SHA hash functions used in VPN tunnels was designed and tested. The influence of different data length on the quality of transmission in a secured network was studied. The measurements and tests of networks were performed according to two methodologies ITU-T Y.1564 and RFC 2544. The impact of the data encryption mechanism on bandwidth, data loss and maximum delays was examined. The secured network tests were performed with different combinations of encryption algorithms and hash functions of the VPN tunnel in the ESP (Encapsulating Security Payload) transport mode.

Diet-ESP: IP layer security for IoT

The number of devices connected through the Internet of Things (IoT) will significantly grow in the next few years while security of their interconnections is going to be a major challenge. For many devices in IoT scenarios, the necessary resources to send and receive bytes are extremely high and w hen such devices are powered with battery the amount of exchanged bytes directly impacts their life time. As a result, compression of existing protocols is a widely accepted technique to make IoT benefit from the protocols developed over the last decades. This paper presents ESP Header Compression (EHC), a framework that enables compression of packets protected with Encapsulating Security Payload (ESP). EHC is composed of EHC Rules, targeting the compression of a specific field and organized according to EHC Strategies. Further, the paper presents Diet-ESP, an EHC Strategy that highly reduces the networking overhead of ESP packets to address the IoT security and bandwidth requirements. Diet-ESP results in sending fewer bytes which in turn reduces the number of required radio frames and thus battery consumption. The measurements showed that sending 10 byte application data on IEEE 802.15.4 radio networks secured with the standard ESP requires sending an additional frame. This results into a 95% energy overhead compared to the unprotected data, while Diet-ESP results only in a 3% overhead compared to unprotected data. This small overhead is achievable with some compressions being performed within the ESP stack which requires altering the same. Nevertheless, Diet-ESP remains fully security compliant to ESP and performs better than any other compression framework as far as ESP is considered.

An FPGA-based reconfigurable IPSec AH core with efficient implementation of SHA-3 for high speed IoT applications

The need for securing data across the Internet has become a fundamental issue over the last decade. The Internet protocol security IPSec standard has been developed as one solution to the problem of end-to-end secure communications. IPSec implementation is computationally intensive and can significantly limit the performance of high-speed networks. To overcome this speed issue, hardware implementations of IPSec offer the best solution. This work presents a field programmable gate array-based reconfigurable IPSec authentication header AH core. AH is one of the two main IPSec protocols, namely, AH and encapsulating security payload, and it supports both transport and tunnel modes of operations. For the AH protocol, a newly selected cryptographic hash function called secure hash algorithm-3 SHA-3 is implemented and used in this work. SHA-3 is implemented using a unique two-phase implementation approach that combines all the steps of SHA-3. The resultant equations, after combining the SHA-3 steps, are implemented as a proposed high-speed architecture, which results in data throughput in the gigabits per second range. The AH core proposed here outperforms other published techniques and is capable of supporting IPv4 datagrams for both modes of operation transport and tunnel and also can be used to provide security services for Internet of things applications that require high data throughput speeds. Copyright © 2016 John Wiley & Sons, Ltd.

IPSec 보안 이슈와 대응 방안

IPSec은 네트워크상에서 안전한 통신환경을 제공하기 위해 사용하는 보안 프로토콜로, 헤더 인증(Authentication Header)과 데이터와 송신자를 인증하는 Encapsulating Security Payload (ESP) 서비스를 제공하며, 이에 대한 기본적인 개념과, IPSec의 종류를 알아보고 활용되는 방법에 대해서 조사하였다. IPSec 프로토콜이 악용되었을 때의 문제점과 그에 대한 대응책을 알아보고 IPSec을 통한 DDoS 공격에 대한 해결방법을 제시하여 IPSec 프로토콜 사용을 통한 안전한 통신환경을 구축하고자 한다. IPSec provides two services that are authentication header and Encapsulating Security Payload(ESP). In this research work, security issues on the Internet and the basic concept of IPSec are described. Security issues on the Internet are presented and proposed a possible solution for DDoS attack using IPSec. Therefore, this research will be able to contribute for building secure communication against DDoS attack.

ENHANCED ENCAPSULATED SECURITY PAYLOAD A NEW MECHANISM TO SECURE INTERNET PROTOCOL VERSION 6 OVER INTERNET PROTOCOL VERSION 4

A considerable amount of time will be needed before each system in the Internet can convert from Internet Protocol version 4 (IPv4) to Internet Protocol version 6 (IPv6). Three strategies have been proposed by the Internet Engineer Task Force (IETF) to help the transition from IPv4 to IPv6 which are dual stack, header translation and tunneling. Tunneling is used when two computers using IPv6 want to communicate with each other and the packet will travel through a region that uses IPv4. To pass through this region, IPv6 packet must be encapsulated in IPv4 packet to have an IPv4 address in order to make it IPv4 routing compatible. Internet Protocol security (IPsec) in transport mode carries the payload of the encapsulating packet as a plain data without any mean of protection. That is, two nodes using IPsec in transport mode to secure the tunnel can spoof the inner payload; the packet will be de-capsulated successfully and accepted. IETF mentioned this problem in many RFCs. According to RFC 3964 there is no simple way to prevent spoofing attack in IPv6 over IPv4 tunnel and longer term solutions would have to be deployed in both IPv4 and IPv6 networks to help identify the source of the attack, a total prevention is likely impossible. This study proposed a new spoofing defense mechanism based on IPsec’s protocol Encapsulated Security Payload (ESP). ESP’s padding area had been used to write the IPv6 source address of the encapsulated packet. Simulation is conducted based on two scenarios, one with spoofing attack and one without. The outcome proved that proposed mechanism has managed to eliminate spoofing threat in IPv6 over IPv4 tunnel.

Specification, implementation and performance evaluation of the QoS‐friendly encapsulating security payload (Q‐ESP) protocol

AbstractWhile IPSec standard is largely used to protect real time network applications, it unfortunately consumes more processing time, cause packet delay and impede QoS enforcement. The QoS level that a flow receives depends on the value of the Type of Service (ToS) field; the later is set by the ‘Multi‐Field’ (MF) packet classifiers according to the IP source and destination addresses and ports as well as the transport layer protocol. The last three fields are encrypted by the IPSec ESP, and thus ESP prevents network control devices from providing preferred treatment for time critical applications. To solve this problem, we propose a QoS‐friendly Encapsulated Security Payload (Q‐ESP) as a new IPSec security protocol that provides QoS supports while enforcing the same security services assured by IPSec ESP and AH used jointly. Basically, Q‐ESP allows network elements to inspect all the needed fields to perform classification adequately. In this paper, we present details about Q‐ESP design, processing and kernel implementation. Moreover, we give analytical as well as experimental evaluation of our protocol to measure its impact on real time VoIP; we also compare it to IPSec ESP and AH according to QoS and security metrics. Finally, we present and discuss some application scenarios in which the use of the Q‐ESP protocol has many advantages. Copyright © 2010 John Wiley & Sons, Ltd.

Performance Analysis of IP Security VPN

Internet Protocol Security (IPSec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream. . IPSec architecture requires the host to provide confidentiality using Encapsulating Security Payload and data integrity using either Authentication Header or Encapsulating Security Payload and anti-replay protection. IPSec has become the most common network layer security control and, a widely deployed mechanism for implementing Virtual Private Networks (VPNs). This paper presents analysis of IPSec VPN for videoconference in real time traffic over a secure communication links by implementing an IPSec-based VPN technology. General Terms Security, Algorithms, Network.

Simplified IPSec Protocol Stack for Micro Server

In this paper, we propose a simple IPSec protocol stack for Micro Server. We proposed an implementation of IPSec protocol stack which is constructed by Encapsulating Security Payload (ESP) protocol with Advanced Encryption Security (AES) encryption scheme, whereas authentication using MD5 algorithm is optional. Researchers have focused on creating a small system composed of sensors and a Micro Server where it has a small sized memory, multi-function, low cost, but without security consideration. The security problem in the Micro Server is a challenging task because of the very limited flash memory. Here, we have implemented the AES function as 2.704 Kbytes and the ESP protocol with this encryption function as 3.822Kbytes of code. Therefore, the proposed method has less than 4Kbytes in code size. Even including the authentication using MD5, the file size is less than 7Kbytes although this is still optional. In our proposed method, we have focused on implementing the encapsulation of the payload and ignored the key exchange procedure to simplify the secure communication compared to conventional IPSec protocol stack.

Authenticated route optimization scheme for network mobility (NEMO) support in heterogeneous networks

AbstractFor the efficient communications between mobile or fixed hosts in mobile networks, the route optimization and its security are indispensable. So, the Internet Engineering Task Force introduced a NEMO basic support protocol in 2005. However, this protocol does not provide a strong security between hosts and especially in nested‐mobile network it can incur a pinball routing problem. And the previous Proxy Binding Update (PUB) protocol has an advantage that can prove the ownership of address of a host using Multi‐key Cryptographically Generated Address (MCGA) which can alleviate a neighbor bombing attack. However, a Mobile Network Node (MNN) belonging to the mobile network which can have low power or limited computing capability may be require burdened costs such as signification and verification of messages. Also, the PUB protocol does not provide the secure message communication architecture between the MNN and its Mobile Router (MR). In this paper we propose a CGA‐based Authentication Route Optimization scheme (CARO) in mobile hotspots with heterogeneous networks. The proposed CARO protocol satisfies two problems using IPsec Encapsulating Security Payload (ESP) tunnel, a secret mobile group key, and the CGA. And we also do not require the considerable computing costs to the MNN or a Correspondent Node. In performance analysis, we prove more secure and efficient protocols than the previous protocols using the defense of various attacks and the result of computational cost, etc. Copyright © 2010 John Wiley & Sons, Ltd.

Performance Analysis of Transmitting Voice over Communication Links Implementing IPsec

The prevalence and ease of packet sniffing and other techniques for capturing packets on an IP based network makes encryption a necessity for VOIP(Voice Over Internet Protocol). Security in VOIP is concerned both with protecting what a person says(by Encryption) as well as to whom the person is speaking(by Authentication). IPsec can be used to achieve both of these goals as long as it is applied with ESP(Encapsulating Security Payload) using the tunnel method. This secures the identities of both the endpoints and protects the voice data from prohibited users once packets leave the corporate intranet. The incorporation of IPsec with IPv4 increase the availability of encryption, VOIPsec (VOIP using IPsec) helps reduce the threat of man in the middle attacks, packet sniffers, and many types of voice traffic analysis. Combined with the firewall implementations, IPsec makes VOIP more secure than a standard phone line, In this paper the negative effect of adding security to VoIP networks has been measured for different simulation times using OPNET(Network Simulation Tool). the results show that transmitting voice over IPsec increase the end to end delay,delay variation(jitter),packet loss and call setup time.

A new protocol for security and QoS in IP networks

To effectively manage network resources and to serve different traffic needs, several studies have been done in the Quality of Service (QoS) area. Basically, 'Multi-Field' (MF) packet classifiers classify a packet by looking for multiple fields of the IP-TCP headers, recognise which flow the packet belongs to, and according to this information, provide service differentiation in IP networks. However, for security purposes, existing security protocols (such as the IPSec ESP) hide much of this information in their encrypted payloads, preventing network control devices such as routers and switches from utilising this information in performing classification appropriately. The ESPQ protocol deals with this problem but it has some security weaknesses. In this paper, we present the ESPQ vulnerabilities and we propose QoS-friendly Encapsulated Security Payload (Q-ESP) as a security protocol that provides both security and QoS support.

Solutions for Group Domain of Interpretation

This paper presents a modified standard for Internet Security Associations and Key Management Protocol (ISAKMP) Domain of Interpretation (DOI) for group key management to support secure group communications. The Group Domain of Interpretation (GDOI) manages group security associations, which are used by IPSec (Internet Protocol Security) and other potential data security protocols running at the IP or application layers. These security associations protect one or more key-encrypting keys, traffic-encrypting keys and data shared by group members. In this paper few inadequacies like lack of group identification, lack in unique Source authentication of ESP (Encapsulated Security Payload) and bottle neck in the Group Controller Key Server (GCKS) are addressed and modifications are suggested in order to make GDOI a more secure protocol. The experimental results also prove the above claim.

Back seat drivers

SecEdVol. 2005, No. 6 OthersBack seat driversPeter KentPeter KentSearch for more papers by this authorPeter KentPublished Online:28 Jan 2014https://doi.org/10.12968/sece.2005.6.459AboutSectionsView articleView Full TextView EPUB ToolsAdd to favoritesDownload CitationsTrack CitationsPermissions ShareShare onFacebookTwitterLinked InEmail View article FiguresReferencesRelatedDetailsCited byLife Cycle Assessment of Microbial Electrolysis Cells for Hydrogen Generation Using TRACI Methodology12 May 2022 | Sakarya University Journal of ScienceEnhanced bioelectrochemical nitrogen removal in flow through electrodesSustainable Energy Technologies and Assessments, Vol. 47A secured, automated, and dynamic end-to-end service level negotiation18 January 2012 | Concurrency and Computation: Practice and Experience, Vol. 25, No. 2Specification, implementation and performance evaluation of the QoS-friendly encapsulating security payload (Q-ESP) protocol7 December 2010 | Security and Communication Networks, Vol. 4, No. 12Case Study IP RAN and Mobile Backhaul QOS20 December 2010 1 June 2005Volume 2005Issue 6ISSN (print): 1479-7704ISSN (online): 2755-290X Metrics History Published online 28 January 2014 Published in print 1 June 2005 Information© MA Education Ltd 2005

A network-based VPN architecture using virtual routing

A network-based Virtual Private Network (VPN) architecture by using fundamental routing mechanism is proposed. This network is a virtual overlay network based on the relay of IP-in-IP tunneling of virtual routing modules. The packet format employs the encapsulation of IPSec ESP (Encapsulating Security Payload), an impact path code and an extended DS (Differentiated Services) code to support multi-path routing and QoS. Comparing with other models of VPN, this network system can be deployed in the current network with little investment, and it is easy to implement. The simulation result shows its performance is better than the traditional VPN system of black box mode.

A security protocol intended to ease QoS management in IP networks

AbstractMany research projects and implementations related to QoS (Quality of Service) management technologies for providing stable network services have been undertaken. To perform QoS management, traffic classes are required. Generally, traffic is classified by setting priorities for packets, and the methods of setting those priorities include passive admission control in which clients set priorities and active admission control in which network edge routers check traffic and set priorities. To perform active admission control, identification information such as a TCP or UDP header must be inspected. However, with existing security protocols such as ESP (Encapsulating Security Payload) or SSH (Secure Shell), these kinds of information cannot be inspected because they are encrypted. Based on the point of view that active admission control should be performed to simplify QoS management of IP networks, the authors of this paper propose a security protocol named ESPQ (ESP considered QoS) for constructing active admission controllable packets and investigate the stability of that protocol. They also perform implementation experiments to show that existing control equipment such as routers can perform QoS management of ESPQ packets. © 2004 Wiley Periodicals, Inc. Electron Comm Jpn Pt 2, 87(2): 47–58, 2004; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/ecjb.10215