IPsec Gateways Research Articles

Enhancing Branch Office Network Availability Using Cloud EoIP Gateway

Abstract Since internet service is mostly available in many countries, tunneling solution over an internet link often used in the company for network communication between its multi-regional branches. The current state of the art solution consisting of an EoIP tunnel combined with IPsec installed on the Head Quarter of the company. Researchers see this solution as prone to total network disruption when the HQ loses its internet service. With the rising trend of cloud computing development, researchers then propose a multi-region network infrastructure design consist of MikroTik devices and Cloud platforms using EoIP IPsec protocol. Cloud platform used as an EoIP IPsec gateway due to its high availability. From the implementation and testing, the EoIP Cloud gateway proved to have high network availability. Branch network communication proved to be running well with no impact on the HQ loss of internet services. IPsec also proved to be secure enough to secure user data transmitted over the internet. From the QoS findings, there is a 24ms drop in delay performance and 0,66 ms drop in jitter performance. The EoIP IPsec on cloud platform also proved to have a 0,97% improvement in throughput performance and has a 0% packet loss rate.

High-performance FPGA Architecture for Data Streams Processing on Example of IPsec Gateway

In modern digital world, there is a strong demand for efficient data streams processing methods. One of application areas is cybersecurity — IPsec is a suite of protocol that adds security to communications at the IP level. This paper presents principles of high-performance FPGA architecture for data streams processing on example of IPsec gateway implementation. Efficiency of the proposed solution allows to use it in networks with data rates of several Gbit/s.

基于DPDK的用户态IPSec网关的研究和实现

本论文针对在使用IPSec网关时由于用户量不断增加、网络流量需求大的情况下所造成的时延、阻塞、吞吐量小等问题，分析了内核态IPSec解决方案处理流程中存在的不足，提出了基于DPDK在用户态实现IPSec网关的方法。针对传统方案处理开销大的问题提出利用思科的VPP作框架，DPDK作收包工具搭建平台实现数据包在用户态的处理。测试结果表明，基于DPDK的用户态IPSec解决方案与传统方案相比，性能得到了有效的提升。 This paper aims at the problems of delay, congestion, small throughput caused due to increasing users and more network traffic demand by using IPSec gateway, analyzes the shortcomings during the IPSec solution process, and puts forward the method of implementation of DPDK gateway based on IPSec in user space. Aiming at the problem of large overhead of traditional programs, we propose to build Cisco VPP as a platform and DPDK as a receiving packets tool to build data processing platform. The test results show that the performance of the IPSec solution of user space based on DPDK is improved effectively compared with the traditional solution.

ROI-Driven Cyber Risk Mitigation Using Host Compliance and Network Configuration

Automated cyber security configuration synthesis is the holy grail of cyber risk management. The effectiveness of cyber security is highly dependent on the appropriate configuration hardening of heterogeneous, yet interdependent, network security devices, such as firewalls, intrusion detection systems, IPSec gateways, and proxies, to minimize cyber risk. However, determining cost-effective security configuration for risk mitigation is a complex decision-making process because it requires considering many different factors including end-hosts’ security weaknesses based on compliance checking, threat exposure due to network connectivity, potential impact/damage, service reachability requirements according to business polices, acceptable usability due to security hardness, and budgetary constraints. Although many automated techniques and tools have been proposed to scan end-host vulnerabilities and verify the policy compliance, existing approaches lack metrics and analytics to identify fine-grained network access control based on comprehensive risk analysis using both the hosts’ compliance reports and network connectivity. In this paper, we present new metrics and a formal framework for automatically assessing the global enterprise risk and determining the most cost-effective security configuration for risk mitigation considering both the end-host security compliance and network connectivity. Our proposed metrics measure the global enterprise risk based on the end-host vulnerabilities and configuration weaknesses, collected through compliance scanning reports, their inter-dependencies, and network reachability. We then use these metrics to automatically generate a set of host-based vulnerability fixes and network access control decisions that mitigates the global network risk to satisfy the desired Return on Investment of cyber security. We solve the problem of cyber risk mitigation based on advanced formal methods using Satisfiability Module Theories, which has shown scalability with large-size networks.

Mitigation of Storage Covert Channels in IPSec for QoS Aware Applications

Gateways implementing IPSec protocol suite are used to provide secure communication between different client machines over public infrastructure. However the exploitation of covert storage channel in the IPSec protocol may defeat the very purpose of protecting leakage of information from the client machine. This threat gets more aggravated as some of the channels might be exploited from the client machine even without compromising the security of the IPSec gateways. The possibility of information leakage by compromising only the client machine, either in form of a colluding insider or due to the presence of some malware at the client machine, poses a serious threat to any organization dealing with sensitive information and a resourceful adversary. The existing approaches to mitigate the threats against storage covert channels severely restrict the usability of many QoS aware applications by reducing the allowance of relevant header fields to minimum. This work overcomes the same by creating separate partitions based on application specific QoS requirements. Subsequent IPSec processing involves extension of the scope of security services as per the predefined QoS requirements. This is achieved by appropriate allowance of QoS related header fields using a comprehensive treatment of the storage and timing covert channels. When compared with existing approaches, the proposed approach provides better usability in QoS demanding contexts while maintaining equivalent strength of protection against storage covert channels and providing equivalent performance. The paper also outlines an implementation strategy of the same on Linux kernel IPSec stack.

A data flow-oriented specification method for analysing network security configurations

The implementation of a network security policy requires the configuration of heterogeneous and complex security mechanisms (IPsec gateways, ACLs on routers, statefull firewalls, proxies, etc.). The complexity of this task resides in the number, the nature, and the interdependence of these mechanisms. Although several researchers have proposed different analysis tools, achieving this task requires experienced and proficient security administrators who can handle all these parameters. A generic formal theory that allows to reason about network data flows and security mechanisms is missing. In previous articles, we have proposed a formal data-flow-oriented model to detect network security conflicts. In this article, we supplement it with a generic model of equipment configuration constructed on our attribute-based approach. Network security services will be represented by specific atomic abstract functions called 'basic commands' that can modify the data flow. Based on this representation, we define an abstract model of configuration. Therefore, we specify our approach in coloured Petri networks to automate the conflicts detection analysis and test it on NAPT/IPsec scenario.

Methodology for Benchmarking IPsec Gateways

The paper analyses forwarding performance of IPsec gateway over the rage of offered loads. It focuses on the forwarding rate and packet loss particularly at the gateway's performance peak and at the state of gateway's overload. It explains possible performance degradation when the gateway is overloaded by excessive offered load. The paper further evaluates different approaches for obtaining forwarding performance parameters - a widely used throughput described in RFC 1242, maximum forwarding rate with zero packet loss and us proposed equilibrium throughput. According to our observations equilibrium throughput might be the most universal parameter for benchmarking security gateways as the others may be dependent on the duration of test trials. Employing equilibrium throughput would also greatly shorten the time required for benchmarking. Lastly, the paper presents methodology and a hybrid step/binary search algorithm for obtaining value of equilibrium throughput.

Distributed Automatic Configuration of Complex IPsec-Infrastructures

The Internet Protocol Security Architecture IPsec is hard to deploy in large, nested, or dynamic scenarios. The major reason for this is the need for manual configuration of the cryptographic tunnels, which grows quadratically with the total amount of IPsec gateways. This way of configuration is error-prone, cost-intensive and rather static. When private addresses are used in the protected subnetworks, the problem becomes even worse as the routing cannot rely on public infrastructures. In this article, we present a fully automated approach for the distributed configuration of IPsec domains. Utilizing peer-to-peer technology, our approach scales well with respect to the number of managed IPsec gateways, reacts robust to network failures, and supports the configuration of nested networks with private address spaces. We analyze the security requirements and further desirable properties of IPsec policy negotiation, and show that the distribution of security policy configuration does not impair security of transmitted user data in the resulting virtual private network (VPN). Results of a prototype implementation and simulation study reveal that the approach offers good characteristics for example with respect to quick reconfiguration of all gateways after a central power failure (robustness), or after insertion of new gateways (scalability and agility).

Automated Security Configuration Management

With the explosive growth of Internet connectivity that includes not only end-hosts but also pervasive devices, secure and reliable Internet becomes a requirement for enterprises as well as home users. Although a significant effort has been made by the research community to develop defense techniques against security attacks, efficient management of security configuration has been overlooked. Network security devices, such as Firewalls, IPSec gateways, Intrusion Detection and Prevention Systems, as well as end-host access control servers, operate based on locally configured policies. Yet these policies are not necessarily independent as they interact with each other to form global end-to-end security. Managing these security policies are complex and error prone. Intraand interpolicy conflicts or inconsistency is one of the main challenges for deploying effective security. In addition, the complexity of changing, testing, and validating security configuration in real-time environment become a major hindrance for evaluating security. Last but not least, security configurations such as policy rules are mostly defined in low level abstraction and represented in isolation of each other, which makes discovering misconfiguration in large-scale network intractable. As a result, the complexity of integrated security management not only makes