Internet Key Research Articles

Protecting Communication Situations Using IPSec and IKE Essentials and Applications

With a particular focus on IPSec (Internet Protocol Security) and IKE (Internet Key Exchange), this article offers a thorough analysis of the technologies used to protect communication channels inside contemporary networks. The ideas are explained in detail in the article. elements, modes of operation, and real-world uses of these technologies. The combination of IPSec and IKE is also covered, along with related issues and concerns and potential advancements in the sector.

Key Synchronization Method Based on Negative Databases and Physical Channel State Characteristics of Wireless Sensor Network.

Due to their inherent openness, wireless sensor networks (WSNs) are vulnerable to eavesdropping attacks. Addressing the issue of secure Internet Key Exchange (IKE) in the absence of reliable third parties like CA/PKI (Certificate Authority/Public Key Infrastructure) in WSNs, a novel key synchronization method named NDPCS-KS is proposed in the paper. Firstly, through an initial negotiation process, both ends of the main channels generate the same initial key seeds using the Channel State Information (CSI). Subsequently, negotiation keys and a negative database (NDB) are synchronously generated at the two ends based on the initial key seeds. Then, in a second-negotiation process, the NDB is employed to filter the negotiation keys to obtain the keys for encryption. NDPCS-KS reduced the risk of information leakage, since the keys are not directly transmitted over the network, and the eavesdroppers cannot acquire the initial key seeds because of the physical isolation of their eavesdropping channels and the main channels. Furthermore, due to the NP-hard problem of reversing the NDB, even if an attacker obtains the NDB, deducing the initial key seeds is computationally infeasible. Therefore, it becomes exceedingly difficult for attackers to generate legitimate encryption keys without the NDB or initial key seeds. Moreover, a lightweight anti-replay and identity verification mechanism is designed to deal with replay attacks or forgery attacks. Experimental results show that NDPCS-KS has less time overhead and stronger randomness in key generation compared with other methods, and it can effectively counter replay, forgery, and tampering attacks.

SDN-based automated rekey of IPsec security associations: Design and practical validations

The standard Request for Comments (RFC) 9061 defines a framework to autonomously manage IPsec security associations (SAs) in SDN environments. The standard describes two cases: the IKE case, in which the nodes use the Internet Key Exchange (IKEv2) protocol to negotiate IPsec SAs, and the IKE-less case, in which IKEv2 is not shipped in the network devices, and the SDN controller is in charge of distributing the IPsec SAs with all the information needed to secure the communications (cryptographic material, traffic selectors, algorithms, etc.). In both cases, for security reasons, the IPsec protocol requires the periodic renovation of the keys used by the IPsec SAs in a process named rekey. The IKE case already has an automatic rekey mechanism, the IKEv2 protocol, however the IKE-less case requires the definition of a rekey method, which is implemented by the controller. The use of the IKE-less case has been recognized useful in scenarios such as datacenters, with thousands of nodes requiring the management of SAs, or Internet of Things, with constrained devices that may not have enough resources to use IKEv2. Therefore, the definition of a suitable rekey process is a keystone for the IKE-less case. This work presents the design, implementation and validation of four different algorithms to perform a rekey process in the IKE-less case from the IPsec standard, taking to account performance, security and packet loss. We have also analyzed each algorithm’s behavior in representative network scenarios based on mesh or star topologies.

Private and Mutual Authentication Protocols for Internet of Things

The Internet of Things (IoT) consists of a range of devices that communicate with other devices that are surrounding them. Secure communications between IoT devices have been an essential requirement. However, most existing authentication protocols fail to provide privacy protection for devices such that sensitive information including device owner’s identity and device type can be leaked. In this paper, based on attribute-based encryption (ABE), we propose two private and mutual authentication protocols to protect the privacy of IoT devices. The first protocol is a three-message key exchange protocol, following the public-key encryption mode of the Internet Key Exchange (IKE). The second protocol is a one-round key exchange protocol, thereby providing simplicity and efficiency of messages communicated between the participants. Both of our protocols can be proved secure in the defined model. Finally, we implement the two protocols in an open source framework.

Authenticated key exchange protocol security of cloud services management using machine learning

The reason for cloud-based confirmation is to shield organizations from programmers attempting to take classified data. Cloud validation permits approved clients across organizations and landmasses to safely get to data put away in the cloud with verification given through cloud-based administrations. Artificial intelligent (AI) permits organizations to empower the information to show the framework how to tackle the central issue with AI calculations and how to get better after some time. The present undertakings are assaulted with information. To drive better business decisions, they need to sort out it. Distributed computing is a huge term for all Data Science and Machine Learning Enthusiasts. It is far-fetched that you probably won’t have run over it, even as a juvenile. The most important issue is that this type of security is needed for the cloud services. A clear explanation for this is that as the dataset develops, i.e., more models and features are added, the AI model ends up being more multifaceted. Internet Key Exchange (IKE) is a standard convention used to set up a safe and confirmed correspondence channel between two gatherings through a virtual private network (VPN). The convention guarantees security for VPN exchange, remote host and organization access.

Characterization of Quantum Grade Interconnects

Quantum grade interconnects, which includes quantum grade optical fibre links and Quantum Photonic Integrated Circuits (QPICs), are rapidly developing components central to the successful development of the Quantum Internet and Quantum Key Distribution (QKD). These interconnects will present new metrological challenges that need to be addressed to ensure key support of future scientific and industrial development. Potential metrological solutions evolving alongside associated standardisation will ensure success and reliability of this advanced technology and provide key support to future scientific research and industrial manufacturing.

The Techniques of Based Internet Key Exchange (IKE) Protocol to Secure Key Negotiation

The Internet is a massive network that connects millions of users from all over the world and the data transmitted via it needs great protection, especially since that are in the age of big data. To solve part of this problem, IPsec was utilized, which is a set of protocols necessary to offer security to units of the Internet in general and the IP layer in particular. It is mostly based on major exchange protocols. The most frequent mechanism for transferring key materials and establishing security linkages between two entities is Internet Key Exchange (IKE). In the present work, it is proposed to use a public key that works together with Diffie-Hellman cryptography and the main advantages of a single-stage contribution (as opposed to the two-stage in standard IKE) it is better in terms of improved transfer and time (more time for the corresponding negotiation) to make the proposed IKE more secure with Simple account constraints. Index Terms— IPsec; Internet Key Exchange (IKE) protocol; Security Association (SA).

Detecting IKEv1 Man-in-the-Middle Attack with Message-RTT Analysis

The IPSec has been a widely used VPN (virtual private network) protocol due to its security and convenience. The security of IPsec itself plays a fundamental role in the overall security of the application system. However, it can be found from the existing research that because of some insecurity issues in the application process, the IPsec protocol will suffer from the man-in-the-middle attack. In this paper, we constructed the first experiment environment of IKE (Internet Key Exchange) man-in-the-middle detecting, use normal distribution to detect the RTT (round-trip time), and get 90% of accuracy.

ОСНОВНЫЕ ЭТАПЫ РАЗВИТИЯ КРИПТОГРАФИЧЕСКИХ ПРОТОКОЛОВ SSL/TLS И IPsec

The paper discusses the main stages of development of cryptographic protocols from SSL 2.0 (Secure Socket Layer) to TLS 1.3 (Transport Layer Security), which ensure the protection of transport layer data in the OSI model. A brief description of the modification of the RuTLS protocol based on TLS 1.3 and their main differences is given. The development of IPsec, which provides cryptographic protection of communications at the network level of the OSI model, is considered using examples of the development of the three most commonly used protocols. These include IKE (Internet Key Exchange), AH (Authentication Header), and ESP (Encapsulation Security Payload). For the SSL/TLS and IPsec specifications, the basic handshake protocols and the main stages of their development are considered. The described handshakes include primary cryptographic information exchange cycles in the form of identifiers of interaction participants, one-time numbers, lists of supported cryptographic combinations. Authentication of participants based on certificates, shared symmetric keys, data exchange for establishing a shared Diffie — Hellman secret, development of key material for secret keys of communication sessions, message authentication, and other cryptographic parameters are presented. For different versions of SSL/TLS and IPsec, the logical structures of application data cryptographic protection functions are described.

Regional Energy Internet Construction Framework and Key Tasks

Based on the strategic needs of the State Grid Corporation of China in building regional energy Internet, this paper carries out study from the following points: first, analyzing the connotation and characteristics of regional energy Internet; second, building the “three systems” structure of regional energy Interest construction; last, defining the key tasks of regional energy Internet construction from three aspects: infrastructure, technological innovation and market mechanism.

Разработка и реализация группового протокола генерации ключа на базе IKE

The protocol for generating a shared secret key often acts as the basis for informational interaction of participants in an untrusted environment. With the help of such a key, a secure channel or a secure communication network can be built in further interactions. Currently, the task of developing protocols for generating a shared key for a group of participants is relevant. One way to build such protocols is to generalize the protocol for two participants to the case of several participants. In the paper a protocol for generating a shared secret key for a group of participants (for a conference) is developed. The developed protocol is based on the Internet Key Exchange (IKE) protocol from the IPSec family of protocols for two participants, which ensures the implementation of security properties, such as authentication of the subject and message, generation of new keys, protection against reading back, protection against repetition, and a number of others. The strength of the developed key generation protocol is based on the complexity of the discrete logarithm problem in a cyclic group. The work studies the security properties provided by the constructed protocol, in particular, it studies the resistance to coalition attacks that are relevant for group protocols. Some features of the practical application of the constructed protocol are also noted

5G wireless P2MP backhaul security protocol: an adaptive approach

5G has introduced various emerging demands for new services and technologies that raised the bar for quality of service, latency, handovers, and data rates. Such diverse and perplexing network requirements bring numerous issues, among which security stands in the first row. The backhaul, which can be implemented as a wired or wireless solution, serves as a bridge between the radio access and core networks assuring connectivity to end users. The recent trends in backhaul usage rely on wireless technologies implemented using point-to-point (PTP) or point-to-multipoint (P2MP) configurations. Unfortunately, due to the nature of the transmission medium, the wireless backhaul is vulnerable and exposed to more various security threats and attacks than the wired one. In order to protect the backhaul, there have been several researches, whose authentication and key exchange scheme mainly depends on the existing security standards such as transport layer security (TLS), Internet Key Exchange version 1 (IKEv1), IKEv2, Host Identity Protocol (HIP), and Authentication and Key Agreement (AKA). However, such security standards cannot completely fulfil the security requirements including security policy update, key update, and balancing between security and efficiency, which are necessary for the emerging 5G networks. This is basically the motive behind why we study and propose a new security protocol for the backhaul link of wireless access network based on P2MP model. The proposed protocol is designed to be 5G-aware, and provides mutual authentication, perfect forward secrecy, confidentiality, integrity, secure key exchange, security policy update, key update, and balancing trade-off between efficiency and security while preventing resource exhaustion attacks. The protocol’s correctness is formally verified by the well-known formal security analysis tools: BAN-logic and Scyther. Moreover, the derived lemmas prove that the security requirements are satisfied. Finally, from a comparison analysis, it is shown that the proposed protocol is better than other standard protocols.

Towards a standard SDN-based IPsec management framework

The Software-defined Network (SDN) paradigm enables an efficient management of future networks by decoupling the control plane from the data plane. Specifically, network resources (e.g. switches or routers) only perform Internet Protocol (IP) packet forwarding in the data plane based on rules dictated by SDN controllers that implement the control plane.Despite the applicability of SDNs to manage network security is a hot topic, managing security associations using SDNs to protect data plane communications is not well covered in the literature.In this sense, the IP Security (IPsec) protocol is the standard to protect IP traffic at network level and it is foreseen a key element in the forthcoming 5G networks or Software-Defined WAN (SD-WAN). Traditionally, the IPsec operation is assisted by a key management protocol, such as the Internet Key Exchange (IKEv2), responsible for establishing IPsec Security Associations (IPsec SAs). Yet, manual configuration of IKEv2 is still required, which does not scale when the number of IPsec entities is high.In this paper we propose a solution to manage IPsec SAs using SDNs avoiding manual configuration in the network resources and enabling a reduced involvement of network administrators. We present two different cases, IKE case and IKE-less case, balancing between the participation of the SDN controller in the IPsec management and the complexity of the network resource. We provide a comprehensive explanation and deep analysis of the solution, which is undergoing standardization at the Internet Engineering Task Force (IETF), describing the interfaces, the operation and security aspects. Finally, we include a simple but significative performance analysis of both cases and a proof-of-concept implementation of the proposal.

TinyIKE: Lightweight IKEv2 for Internet of Things

There is unanimous consensus that cyber security in the Internet of Things (IoT) is necessary. In cyber security, key establishment is one of the toughest problems. It is even more challenging in resource-constrained but Internet-connected IoT devices that use low-power wireless communication. A number of IoT communication protocols define cryptographic mechanisms for confidentiality and integrity services but do not specify key management. For example, IEEE 802.15.4, RPL, and object security all rely on external key management protocols. Due to the lack of automatic key management support, IoT devices either end up using preshared keys or no security at all. In this paper, we overcome these challenges and present TinyIKE, a lightweight adaptation of Internet Key Exchange version 2 (IKEv2) for the IoT. Using TinyIKE, we solve the key establishment problem for multiple IoT protocols using a single IKEv2-based solution. We implement TinyIKE for resource-constrained IoT devices that run the Contiki OS. The TinyIKE implementation supports full certificate-based IKEv2 that uses elliptic curve cryptography. In order to ensure the feasibility of TinyIKE in the IoT, we perform an extensive evaluation of TinyIKE using a setup consisting of real IoT hardware.

Analysis and improvement of the Internet‐Draft IKEv3 protocol

SummaryInternet protocol (IP) is the kernel of the TCP/IP protocol family. Because IP is the only one that is shared by all high‐level protocols in TCP/IP. So the security of the IP is particularly important to the whole communication network. Fortunately, IPsec provides excellent protection for the kIP security. As a part of the IPsec, Internet Key Exchange (IKE) protocol can achieve security association negotiation, key generation, and identity authentication. The study of IKEv2, both in its application and security analysis, has been relatively mature. When the Internet Engineering Task Force published the Internet‐Draft IKEv3 protocol, there is not much attention and research on it. In this paper, we analyze the security and authentication of IKEv3 by formal verification and show that IKEv3 is susceptible to reflection attack and DoS attack. Then we propose a new variant of the IKEv3 protocol, which both resists reflection attack and mitigates the impact of the DoS attack.

Securing Vehicular IPv6 Communications

A common practice is applying security after a network has been designed or developed. We have the opportunity of not committing this error in vehicular networks. Apart from particular works in the literature, ETSI TC ITS has defined general security services for (vehicular) cooperative systems. However, existent efforts do not pay the needed attention to the integration of IPv6 yet. The potential of IPv6 in the field is being described within ISO TC 204, above all, but further work is needed for a proper integration of security. This work follows this direction, and a reference vehicular communication architecture considering ETSI/ISO regulations, uses Internet Protocol security (IPsec) and Internet Key Exchange version 2 (IKEv2) to secure IPv6 Network Mobility (NEMO). A key advance is also the implementation and experimental evaluation of the proposal in a challenging vertical handover scenario between 3G and 802.11p. The performance of the secured NEMO channel is widely analyzed in terms of the movement speed, bandwidth, traffic type or signal quality, and it is concluded that the addition of IPv6 security only implies a slight reduction in the overall performance, with the great advantage of providing confidentiality, integrity and authenticity to the communication path.

Collaborative Key Exchange System Based on Chinese Remainder Theorem in Heterogeneous Wireless Sensor Networks

IPv6 over Low Power Wireless Personal Area Networks (6LoWPANs), in the next generation of wireless sensor networks, represent an emerging field which can be integrated with Internet technology. Security is one of the most important issues in 6LoWPANs given the vulnerability to security threats from Internet and the inherent constraints such as bandwidth, processing power, memory, and energy. Despite limited resources, data security for nodes adds an additional heavy cost by using various security schemes. Moreover, there is no standard approach to provide the end-to-end security in 6LoWPANs. In this work, we first axed our research to propose a new end-to-end security scheme for IP enabled sensor networks to optimize battery energy consumption and then we adapted the Internet Key Exchange version 2 (IKEv2) to wireless sensor networks while taking into consideration the scarce resources. Hence a novel Cooperative Key Exchange System (CKES) has been proposed in this paper based on Chinese Remainder Theorem (CRT) which has also been implemented in NS2 to analyze energy consumption compared to IKEv2.

Secure collaborative system in heterogenous wireless sensor networks

The IPv6 over Low power Wireless Personal Area Networks (6LoWPANs) have turned out to be one of the most emerging field in Wireless Sensor Networks (WSNs) which can be integrated with Internet technology. 6LoWPAN network consists of heterogeneous wireless sensors which have high resource-constraints such as bandwidth, processing power, memory, energy, etc. The resource-constraints put forth many challenges to apply the available standard security protocols such as Transport Layer Security (TLS), Internet Protocol Security (IPSec), Internet Key Exchange version 2 (IKEv2), etc., for the interconnection of Heterogeneous Wireless Sensor Networks (HWSNs) with Internet. To overcome these situations, the researchers aimed to reinforce and adapt the end-to-end security between Internet and the IP enabled sensor networks. The above mentioned security protocols are not modified at the Internet end point in HWSNs. Hence we are proposing a novel Cooperative Key Exchange System (CKES) by using the concept of Chinese Remainder Theorem (CRT). We have used NS2 simulator to implement the proposed concept and also compared with IKEv2. All Rights Reserved © 2015 Universidad Nacional Autonoma de Mexico, Centro de Ciencias Aplicadas y Desarrollo Tecnologico. This is an open access item distributed under the Creative Commons CC License BY-NC-ND 4.0.

Authenticated Deniable Internet KeyExchange

We propose two public-key schemes to achieve deniable authentication for the Internet Key Exchange (IKE). Authentication in security had is the essential factor in the key establishment over Internet. The Deniable Internet key exchange protocol gives more value to the IKE standard. Our schemes can in some situations be more efficient than existing IKE protocols as well as having stronger deniability properties. Key-exchange, in particular Diffie–Hellman key exchange (DHKE), is among the core cryptographic mechanisms for ensuring network security. For key-exchange over the Internet, both security and privacy are desired. In this paper, we develop a family of privacy-preserving authenticated DHKE protocols named deniable Internet key-exchange (DIKE), both in the traditional PKI setting and in the identity-based setting. The newly developed DIKE protocols are of conceptual clarity and practical (online) efficiency. They provide useful privacy protection to both protocol participants, and add novelty and new value to the IKE standard.

Automated Analysis of Internet Key Exchange Protocol v2 for Denial of Service Attacks

The Denial of service (DoS) and Distributed Denial of Service (DDoS) attacks are aimed at maliciously consuming the available resources in computing systems to prevent genuine users from legitimately accessing them. These attacks can easily interrupt or disable targeted systems, so it is important for the system to detect and filter bogus connection requests as early as possible. Many common protocols TCP, HIP, SSL, etc., are vulnerable to DoS attacks. Until now, there has been no fit for all, generic solution to resist a DoS/DDoS attacks presented. An attractive alternative therefore is to investigate the approaches by which one can at least reduce the impact of the DoS/DDoS attacks. Our research work presented here focuses on the same. We develop a formal model of Internet Key Exchange version 2 (IKEv2) protocol using formal specification language of Colored Petri Nets (CPNs) to analyze the protocol for DoS attacks. IKEv2 is a member of the IPSec protocol suite and establishes a security association that includes secret information between source and destination. IPSec provides security services to applications viz. VPN, remote login, email, file transfer etc. Till date no automatic formal analysis of IKEv2 protocol is attempted for DoS attacks, hence we choose IKEv2 protocol to illustrate automatic analysis for DoS attacks. We use simulation approach of CPNs to analyze the protocol for DoS attacks. We analyze the processing cost and memory cost to carry out DoS attacks in IKEv2. In addition, we measure the strength of the protocol against DoS attacks using different experiments in CPNs.