Deployment Of Virtual Private Networks Research Articles

The Silence of the LANs: Efficient Leakage Resilience for IPsec VPNs

Virtual private networks (VPNs) are increasingly used to build logically isolated networks. However, existing VPN designs and deployments neglected the problem of traffic analysis and covert channels. Hence, there are many ways to infer information from VPN traffic without decrypting it. Many proposals have been made to mitigate network covert channels, but previous works remained largely theoretical or resulted in prohibitively high padding overhead and performance penalties. In this paper, we: 1) analyse the impact of covert channels in IPsec; 2) present several improved and novel approaches for covert channel mitigation in IPsec; 3) propose and implement a system for dynamic performance trade-offs; and 4) implement our design in the Linux IPsec stack and evaluate its performance for different types of traffic and mitigation policies. At only 24% overhead, our prototype enforces tight information-theoretic bounds on information leakage. To encourage further research, we put our prototype code and data in the public domain.

Analysis of the security of VPN configurations in industrial control environments

Virtual private networks (VPNs) are a popular approach for protecting otherwise insecure industrial control protocols. VPNs provide confidentiality, integrity and availability, and are often considered to be secure. However, implementation vulnerabilities and protocol flaws expose VPN weaknesses in many industrial deployments. This paper employs a probabilistic model to evaluate and quantify the security of VPN configurations. Simulations of the VPN model are conducted to investigate the trade-offs and parameter dependence in various VPN configurations. The experimental results provide recommendations for securing VPN deployments in industrial control environments.

Securing IEEE 802.11g WLAN Using Open VPN and its Impact Analysis

Like most advances, wireless LAN poses both opportunities and risks. The evolution of wireless networking in recent years has raised many serious security issues. These security issues are of great concern for this technology as it is being subjected to numerous attacks. Because of the free-space radio transmission in wireless networks, eavesdropping becomes easy and consequently a security breach may result in unauthorized access, information theft, interference and service degradation. Virtual Private Networks (VPNs) have emerged as an important solution to security threats surrounding the use of public networks for private communications. While VPNs for wired line networks have matured in both research and commercial environments, the design and deployment of VPNs for WLAN is still an evolving field. This paper presents an approach to secure IEEE 802.11g WLAN using OpenVPN, a transport layer VPN solution and its impact on performance of IEEE 802.11g WLAN.

Alternative Schemes for Dynamic Secure VPN Deployment in UMTS

Three alternative schemes for secure Virtual Private Network (VPN) deployment over the Universal Mobile Telecommunication System (UMTS) are proposed and analyzed. The proposed schemes enable a mobile node to voluntarily establish an IPsec-based secure channel to a private network. The alternative schemes differ in the location where the IPsec functionality is placed within the UMTS network architecture (mobile node, access network, and UMTS network border), depending on the employed security model, and whether data in transit are ever in clear-text, or available to be tapped by outsiders. The provided levels of privacy in the deployed VPN schemes, as well as the employed authentication models are examined. An analysis in terms of cost, complexity, and performance overhead that each method imposes to the underlying network architecture, as well as to the mobile devices is presented. The level of system reliability and scalability in granting security services is presented. The VPN management, usability, and trusted relations, as well as their behavior when a mobile user moves are analyzed. The use of special applications that require access to encapsulated data traffic is explored. Finally, an overall comparison of the proposed schemes from the security and operation point of view summarizes their relative performance.

IPsec-based end-to-end VPN deployment over UMTS

Next generation mobile users require flexible security mechanisms, which provide customized security services to data traffic, take into account end-user mobility and mobile network characteristics, and are available anywhere–anytime. An IPsec-based end-to-end Virtual Private Network (VPN) deployment scheme over the Universal Mobile Telecommunication System (UMTS) is proposed and analysed. The UMTS infrastructure provides the mobile users with access to public Internet, and allows them to employ IPsec tunnels to traverse firewalls, access private networks, and convey sensitive data securely. The VPN functionality is integrated in the communicating peers, which negotiate and apply security. For VPN establishment the Internet Key Exchange (IKE) protocol is employed, which has to operate in a mobile UMTS environment, where Network Address Translation (NAT) is used. The proposed scheme has minimal impact on the existing network infrastructure, but it requires that each mobile station have the appropriate IPsec software. Security features may have an adverse effect on aspects of quality of service offered to the end-users and the system capacity. The computational cost and the space overhead that the security protocols and algorithms impose on the lightweight end-user devices, as well as on the underlying network architecture are analysed. Simulation results quantify the relative throughput—delay performance penalty of the different security policy options, and can be used for designing security policy configurations that strike the desired balance between security and performance.

Scalable network resource management for large scale Virtual Private Networks

A VPN (Virtual Private Network) is a private data network that uses a non-private data network to carry traffic between remote sites. There is currently significant interest in the deployment of VPN service across IP backbone facilities. In this study, we focus on designing a scalable IP-based VPN architecture and applying the distributed scheme to efficiently manage the VPN network resource. Specifically, our technologies include the following: (1) We present a scalable VPN architecture. In terms of the VPN maintenance cost and average end-to-end delay measured by average tunnel lengths, the different virtual network topologies are evaluated. (2) We take the distributed approach to solve the VPN bandwidth allocation problem. Several heuristic algorithms to select `better' route are proposed to improve the successful VPN request rate with certain QoS (quality of service) requirement. We conduct extensive performance evaluations on different systems and algorithms. The evaluation shows that in terms of admission probabilities, the distributed VPN bandwidth allocation protocol based on local status information and partial of network information can perform well, which is close to theoretical optimal result. We note that the optimal solution has the single failure and scalability issues for the large VPN deployment.