IPsec ESP Research Articles

A High-Throughput Hardware Implementation of NAT Traversal For IPSEC VPN

In this paper, we present a high-throughput FPGA implementation of IPSec core. The core supports both NAT and non-NAT mode and can be used in high speed security gateway devices. Although IPSec ESP is very computing intensive for its cryptography process, our implementation shows that it can achieve high throughput and low lantency. The system is realized on the Zynq XC7Z045 from Xilinx and was verified and tested in practice. Results show that the design can gives a peak throughput of 5.721 Gbps for the IPSec ESP tunnel mode in NAT mode and 7.753 Gbps in non-NAT mode using one single AES encrypt core. We also compare the performance of the core when running in other mode of encryption.

Specification, implementation and performance evaluation of the QoS‐friendly encapsulating security payload (Q‐ESP) protocol

AbstractWhile IPSec standard is largely used to protect real time network applications, it unfortunately consumes more processing time, cause packet delay and impede QoS enforcement. The QoS level that a flow receives depends on the value of the Type of Service (ToS) field; the later is set by the ‘Multi‐Field’ (MF) packet classifiers according to the IP source and destination addresses and ports as well as the transport layer protocol. The last three fields are encrypted by the IPSec ESP, and thus ESP prevents network control devices from providing preferred treatment for time critical applications. To solve this problem, we propose a QoS‐friendly Encapsulated Security Payload (Q‐ESP) as a new IPSec security protocol that provides QoS supports while enforcing the same security services assured by IPSec ESP and AH used jointly. Basically, Q‐ESP allows network elements to inspect all the needed fields to perform classification adequately. In this paper, we present details about Q‐ESP design, processing and kernel implementation. Moreover, we give analytical as well as experimental evaluation of our protocol to measure its impact on real time VoIP; we also compare it to IPSec ESP and AH according to QoS and security metrics. Finally, we present and discuss some application scenarios in which the use of the Q‐ESP protocol has many advantages. Copyright © 2010 John Wiley & Sons, Ltd.

Enterprise Network Packet Filtering for Mobile Cryptographic Identities

Firewalls are an essential component of the Internet and enterprise network security policy enforcement today. The configurations of enterprise firewalls are typically rather static. Even if client’s IP addresses can be dynamically added to the packet filtering rules, the services allowed through the firewall are commonly still fixed. In this paper, we present a transparent firewall configuration solution based on mobile cryptographic identifiers of Host Identity Protocol (HIP). HIP allows a client to protect the data transfer with IPsec ESP, and supports dynamic address changes for mobile clients. The HIP-based firewall learns the identity of a client when it communicates with the server over HIP. The firewall configures the necessary rules based on HIP control messages passing through the firewall. The solution is secure and flexible, and introduces only minimal latency to the initial HIP connection establishment.

A new protocol for security and QoS in IP networks

To effectively manage network resources and to serve different traffic needs, several studies have been done in the Quality of Service (QoS) area. Basically, 'Multi-Field' (MF) packet classifiers classify a packet by looking for multiple fields of the IP-TCP headers, recognise which flow the packet belongs to, and according to this information, provide service differentiation in IP networks. However, for security purposes, existing security protocols (such as the IPSec ESP) hide much of this information in their encrypted payloads, preventing network control devices such as routers and switches from utilising this information in performing classification appropriately. The ESPQ protocol deals with this problem but it has some security weaknesses. In this paper, we present the ESPQ vulnerabilities and we propose QoS-friendly Encapsulated Security Payload (Q-ESP) as a security protocol that provides both security and QoS support.